Flir E4 Thermal imaging camera teardown

[TurboTom]

Hi, the whole day I tried to upgrade my E4 to resolution E8...now I am becoming crazy...
:
:
Thanks i.a. reifill

Hey reifill,

sometimes just scanning through a few of the previous pages of a bulletin board provides valuable information
You may want to check my contribution here: https://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg563620/#msg563620

I would say as long as your camera is a 1.0 or 1.1 hardware, you can hack it using the "old" method, i.e. like it's described in the links published on the first page of this thread for the original 1.19.8 firmware. The menu hack wouldn't work, though. But there's a good chance that you can "downgrade" your camera back to 1.19.8

First thing to do is to download Marphy's TIConfig tool: https://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg421535/#msg421535 and check if the cfg files are encrypted or not. If they are readable clear-text, the standard hack for 1.19.8 firmware will work. If you'ld post a list of your camera's configuration, I can tell you if my "downgrade package" will work for you.

But from all I've learned with my cam, an updated 1.19 is still closer to the old configuration than to a factory native 2.3.

Cheers,
Thomas

[tomas123]

I've got a question for people who own additional FLIR cameras besides an E4 (or any other Ex camera). Are the screens of other FLIR cameras scratched as easily as on the Ex ones, or is this issue specific to the Ex series?

It's a Ex trouble.
The touch display of Exx is better.

[Bud]

If you need manual temp scale it is possible that way:

OK janekivi, that worked, I will play more with it when have more time
 

[yogort1]

Is it possible to unplug the lcd screen and stream video through USB? My question regards E4 firmware 2.3 with hacked resolution.

[tomas123]

Is it possible to unplug the lcd screen and stream video through USB? My question regards E4 firmware 2.3 with hacked resolution.

What do you mean with "unplug the lcd screen"?

Windows
for USB Video use Flir Tools
see https://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg377140/#msg377140
or free camera player
https://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg378926/#msg378926

Linux
https://www.eevblog.com/forum/testgear/capturing-video-from-flir-e4-to-portable-device/

[yogort1]

I mean remove the LCD screen completely from the camera I want to design my own case for E4's electronics module and print it on my 3D printer. I'm asking about streaming video through USB, because I want to process it through OpenCV and add some features. I'm worrying that camera could make some initial peripheral devices check on startup, and when it finds out that the LCD is missing it simply won't boot up.

[mikeselectricstuff]

I mean remove the LCD screen completely from the camera I want to design my own case for E4's electronics module and print it on my 3D printer. I'm asking about streaming video through USB, because I want to process it through OpenCV and add some features. I'm worrying that camera could make some initial peripheral devices check on startup, and when it finds out that the LCD is missing it simply won't boot up.

It will work fine without the LCD ( or the buttons)
You may want to investigate disabling the backlight driver to save power - these are usually step-ups, and with no load will usually go into some sort of protection mode - in some cases this draws minimal power, but could just be burning it in a zener.
ISTR someone mentioned issues with UVC video on later FW.

[leoibb]

Hello I am considering buying an e4 spoke with flir and they claimed they have stopped the hack so I am asking can the new e4 be hacked to e8. . Also if it can who can do it as I am no wizzard with software . Appreciate the reply

[Isaac-1]

That is always a hard question to answer, because no one knows exactly what new "un-hackable" model may have just been introduced into the supply chain.  But the ones people have reported receiving in recent days with the 2.3.X firmware are still partly hackable.  In particular there is still a resolution hack available to get to the E8 resolution, but what is still missing is some of the extended menu functionality of the E8, so in effect the current hack gets you a higher resolution E4, and some of the recent sub-hacks that get some of the extended menu functions back, but not yet all of them.  As to the difficulty of performing the hack, overall it is what I would call a mid level skill hack, as they have introduced a few obstacles that makes the process a bit more complex, but once you determine what it is you need to do for your particular revision the process only takes a few minutes.  I just did it for the first time yesterday on a used E4 which had the latest software, but slightly older firmware which added some minor complications.  I spent about 3 or 4 hours reading through old messages in this thread, determining what I had, downloaded various bits of software, had to trouble shoot some of the installation, go out and dig up a driver to download, etc.  Much of this time was spent due to the high level that the instructions are written at, such as "put E4 in RNDIS mode", so go spend 45 minutes finding out what RNDIS mode is and how to set it, find that there was a hidden menu for RNDIS on older firmware models, but newer ones needed another way to trick into RNDIS......

[Fraser]

@leoibb,

You didn't honestly ask FLIR if their E4 could still be hacked did you ? Not very diplomatic if you did 

FLIR are against the hacking of their product and any response from them on the matter cannot be trusted. I was surprised and impressed that firmware 2.3 has been hacked relatively quickly. Where there is a will, there is often a way 

All versions up to Firmware 2.3 may be upgraded to higher resolution but if you can find a 1.19, 1.21 or 1.22 firmware it is capable of even more improvements that are very useful.

Aurora

[janekivi]

This is better if you go to Flir and say to sales manager: what if I buy from you E4 and pay to hacker to make it to E8 and more better OR make me very good offer and sell me E8, I have cash in pocket right now : )))

[lwi004]

My question from before still stands.

Which hacks have not been managed yet on the new firmware versions?

Also is the sensitivity that of an E8 ? with 2.3.x

[mikeselectricstuff]

Hello I am considering buying an e4 spoke with flir and they claimed they have stopped the hack

..to which your response should be "which hach..?" 

Also is the sensitivity that of an E8 ? with 2.3.x

I don't think anyone has figured out the sensitivity differences (if any) on any version.
Has anyone managed to get a config file from a real E8? I wonder if maybe they just turn the noise value down?

[Fraser]

Noise gen on E8 is set to 5mK.

Aurora

[Isaac-1]

My question from before still stands.

Which hacks have not been managed yet on the new firmware versions?

Also is the sensitivity that of an E8 ? with 2.3.x

What you need to understand is this is a fluid situation, the resolution hack seems to work on all firmware versions, recently someone seems to have figured out how to get additional color palettes back, and work arounds have been partly found for some other features like manual temperature scale, or logo removal, others are in the works, but may have to be set from a connected computer and can't be toggled by on screen menu, or will not persist after a reboot, Who knows what next week and next month may bring.

As to E8 sensitivity that is a hard one to answer since we don't know if Flir does some sort of in house grading system giving the best sensors to the E8's etc.  The setting for the artificial noise generator has been discovered, and someone seems to have found how to completely turn it off, but not how to fine tune yet.

[janekivi]

E4 2.3.0 recalculated-hacked conf: noise nr have 1 position now (because reso takes 2 position more now and they come from here) - address 1657
I can write here:
; - C8
: - C9
9 - CA
8 - CB
7 - C4
6 - C5
5 - C6
4 - C7
3 - C0
2 - C1
1 - C2
0 - C3
that way the rc4 pattern goes here for me.
Changing all numbers is easy but false to [space]true... not yet. Hope that have this key what he got for changing conf contents...

[janekivi]

Noise gen on E8 is set to 5mK.

and in E60 files it is 40

[GH05TMS]

evening all, iv still not really got a clue about all this hacking malarkey but I am desperately trying to figure it all out. my trouble is the wording used by you experts on here lol, im not very technically minded at all and really have no idea where to start despite reading the posts on this page over and over and over again.

Anyway, I have a new question for you all. Having just acquired my e4 last Friday ive had to get it swapped for a new one because of what I can only describe as pixel failure in places on the screen. Upon bootup, where the flir logo is displayed upon the black background, a big red dot was present, and also various pixels were playing up in the settings menu too. mainly over the words ''Demonstration mode'' and ''reset options'' when scrolling up and down the menu. these pixels could not be seen at fault under normal viewing using the cam as a actual cam, and only noticeable when in menus. So, I got onto the guys I bought from and they said they had another in stock, I drove up there today to swap units and guess what? this new one does it too, in exactly the same places on the menus. This one however has no big blurred and smudged red dot on the flir logo bootup screen. the guy also got out a e5 and a e8 and they also had this weird pixel thing in the menus!? have I got a duff or is there a faulty batch of screens? could this be a software issue with 2.3.0 units? anyone else had the same probs?

back to the old drawing board now trying to figure out where to even start for this hack!?!? god help me! my knowledge with computers is about as much as turning one on, basic browsing and then shutting it down lol. 

[Sofia]

evening all, iv still not really got a clue about all this hacking malarkey but I am desperately trying to figure it all out. my trouble is the wording used by you experts on here lol, im not very technically minded at all and really have no idea where to start despite reading the posts on this page over and over and over again.

Anyway, I have a new question for you all. Having just acquired my e4 last Friday ive had to get it swapped for a new one because of what I can only describe as pixel failure in places on the screen. Upon bootup, where the flir logo is displayed upon the black background, a big red dot was present, and also various pixels were playing up in the settings menu too. mainly over the words ''Demonstration mode'' and ''reset options'' when scrolling up and down the menu. these pixels could not be seen at fault under normal viewing using the cam as a actual cam, and only noticeable when in menus. So, I got onto the guys I bought from and they said they had another in stock, I drove up there today to swap units and guess what? this new one does it too, in exactly the same places on the menus. This one however has no big blurred and smudged red dot on the flir logo bootup screen. the guy also got out a e5 and a e8 and they also had this weird pixel thing in the menus!? have I got a duff or is there a faulty batch of screens? could this be a software issue with 2.3.0 units? anyone else had the same probs?

back to the old drawing board now trying to figure out where to even start for this hack!?!? god help me! my knowledge with computers is about as much as turning one on, basic browsing and then shutting it down lol. 

The red pixels in the menu, I also met in last supply cameras.
Try the following hack factory camera settings. And let me know if that helps.

[GH05TMS]

evening all, iv still not really got a clue about all this hacking malarkey but I am desperately trying to figure it all out. my trouble is the wording used by you experts on here lol, im not very technically minded at all and really have no idea where to start despite reading the posts on this page over and over and over again.

Anyway, I have a new question for you all. Having just acquired my e4 last Friday ive had to get it swapped for a new one because of what I can only describe as pixel failure in places on the screen. Upon bootup, where the flir logo is displayed upon the black background, a big red dot was present, and also various pixels were playing up in the settings menu too. mainly over the words ''Demonstration mode'' and ''reset options'' when scrolling up and down the menu. these pixels could not be seen at fault under normal viewing using the cam as a actual cam, and only noticeable when in menus. So, I got onto the guys I bought from and they said they had another in stock, I drove up there today to swap units and guess what? this new one does it too, in exactly the same places on the menus. This one however has no big blurred and smudged red dot on the flir logo bootup screen. the guy also got out a e5 and a e8 and they also had this weird pixel thing in the menus!? have I got a duff or is there a faulty batch of screens? could this be a software issue with 2.3.0 units? anyone else had the same probs?

back to the old drawing board now trying to figure out where to even start for this hack!?!? god help me! my knowledge with computers is about as much as turning one on, basic browsing and then shutting it down lol. 

The red pixels in the menu, I also met in last supply cameras.
Try the following hack factory camera settings. And let me know if that helps.

thanks for the reply. please forgive me but what do you mean try the following hack factory settings?

[janekivi]

May be?:
Try the following hack: factory camera settings.
Settings -> Device settings -> Reset options ->
[Reset device settings to factory default...]

[GH05TMS]

May be?:
Try the following hack: factory camera settings.
Settings -> Device settings -> Reset options ->
[Reset device settings to factory default...]

ah I tried that on the original unit and also on this but no joy. still got a few red/orange pixels bleeding through in places on the menus.

[Kitsok]

Hello, all!

 I've made the stupid mistake and upgraded my E4 to 2.3.0
The hack for the 2.3.0 is not working (I've got a windows error on the TIC), and the size of conf.cfc file is 6336 (instead of 6608).
The information on the service page (I've uploaded the web folder) is here:

Code: [Select]

Camera
Name Part # Serial # Date
FLIR E4 63901-0101 63917130 2014-03-04
HW-id
hwtype System UID
Z3 2A4BD5020090153E
Kits
Name Version Date
SW combination 2.3.0
appkit 2.1.2 23-May-2014
userconf E4 1.1L 25-Oct-2013
ASCO OS image 18.1.20 2014-06-05
prodkit 0 28-Feb-2014
Calibration
Name Date
org 2014-03-03 10:01:22
Hardware
Name Part # Revision # Serial #
camcore T198304 01 63814506
detector * * *
mainboard T198283 11 20136316
Firmware
Name Version Date From
IRDM 0.0.1.0 - -
POLLUX 0.1.0.0 07-Apr-2014 FLIR
POLLUX_FPGA 8.7.0.0 - FLIR
Software
Name Version Date From
AppCore 25.0.0.1 22-May-2014 upalmer@SE-BRYGG5/ALPHA_1.12
AppServices 25.0.0.1 16-Apr-2014 upalmer@SE-BRYGG5/ALPHA_1.12
Bootloader 16.1.5.0 - FLIR
ResMon 25.0.0.1 03-Apr-2014 upalmer@SE-BRYGG5/ALPHA_1.12
WinCE 6.0.0.0 2005 Microsoft
appcore_dll 1.12.1.1 03-Apr-2014 upalmer@SE-BRYGG5
common_dll 1.12.1.1 29-Apr-2014 upalmer@SE-BRYGG5
facet_core 25.0.0.1 22-May-2014 upalmer@SE-BRYGG5/ALPHA_1.12
facet_ui_qml 25.0.0.1 22-May-2014 upalmer@SE-BRYGG5/ALPHA_1.12
fvd 16.0.48.0 Apr 8 2014 upalmer@SE-BRYGG4
Usage Statistics
Number of cold starts 33
Number of shutter operations 723
Number of focus moves 0
Laser time (hrs) 0
Max. operating temperature (°C) 44.73
Max. operating temperature time 2014-11-01 22:25:03
Min. operating temperature (°C) 2.635
Min. operating temperature time 2014-12-14 05:27:00
Operating time (hrs) 14
Up-time (hrs) 0

The EEPROM unlock code is not 1235
Is there a chance to hack the resolution?

Thank you!!

[Kitsok]

Okay, answering myself.

The conf.cfc in the upgraded TIC is the same format as in previous, so I've used ftool, decrypted the file, removed # CRC03 line (leaving CR after the last line), changed the width and the height to 320x240, re-calculated CRC03 (using crc03.exe from the ftool).
Then I've encrypted the file back using the SUID and ftool.exe, uploaded file to the device and rebooted. Gotcha.
But the cross was on the wrong place (at 30x60).
Okay. I've downloaded default.rcs, changed the cross position (measureFuncs.spot.1.x and y), recalculated CRC32, added the line, uploaded the file and rebooted device.
Now I'm happy!

Thank you, all!

[Isaac-1]

Yes you can unlock the full resolution on E4's with 2.3.0. I am re posting this with a few edits to the original:

(originally posted by compet17)

STEP BY STEP INSTRUCTIONS for Flir E4 (Firmware 2.3.0) for beginners (How I did it... and it worked)
-----------------------------------------------------------------------------------------

(If somebody finds an error in this procedure, please tell me immediately and I will correct it)

- Get FlirTools from Flir website (free download) PC version recommended (Note: V5 does not work on Win XP...)
- Install FlirTools on your PC
- Get the files "Set_RNDIS_temporary.fif" and "Set_RNDIS_permanent.fif" from this forum (zipped downloads somewhere in this thread)
- If you want to use the "permanent" file, you also need "remove_RNDIS_Permanent.fif"
   (Temporary.fif sets the USB of your cam to RNDIS mode UNTIL A REBOOT. Permanent does the same but it stays in RNDIS until YOU RUN   
     REMOVE.fif)
- Get E4 hack "v04.zip" for Version 2.3.0
- I assume that the installation of FlirTools does also install the camera driver. If not install it manually. Links are found in this thread
- Get PYTHON version 2.x (not version 3.x!) from the Python website and install it. This is needed to run the hack script. It's a programming language.

- Connect your E4 via USB to your PC and turn it on
- Go to "Programs(x86)/Flir systems/Flir Tools/bin and execute FLIRInstallNet.exe (this is part of the FlirTools software installed in step 2)
- Select the Set_RNDIS_xxxxxxx.fif (permanent or temporary) and click RUN FIF button.
  (A timeout error is normal after the command has succeeded because USB is now set to RNDIS mode)
(On mine I had to disconnect and hard reboot for the change to show up.... which meant I had to use the permanent file.  I had to use a win 8 PC.  After the Hard reboot I moved to a win XP PC)
- Wait a moment and open a CMD window, then enter IPCONFIG
- An additional network connection should be listed with IP Address 192.168.0.1 and gateway 192.168.0.2
- Enter "FTP", then "open 192.168.0.2" and a connection to your cam should be established
- Login with user "flir" and password "3vlig"
- Issue a "dir" command and the files and directories of your cam are listed.
- If all that works, type "quit" to exit and close ftp connection.

- copy the hack files from the v04.zip into the PYTHON folder.
- open CMD, use the command cd and go into python folder and enter "python apply.py apply 192.168.0.2"
- it will read two files from your cam and stores them in a backup folder, then it will do some magic with the files.
- you will find newly created conf.cfc and common_dll.dll in that folder and upload them back to the camera.

- In case you get an error 500 at the upload, you have to upload the files manually by FTP:

*** Only in case of error 500 ***
- Open CMD and FTP again and connect to your camera as before
- go to the indicated folders (cd /foldername/foldername/foldername)
- check the folder with "pwd" to make sure you're in the right one
- Use the lcd command to change to your local directory where the conf and common files are.
- put the files to the correct folders (put filename)

MAKE SURE YOU PUT THE RIGHT FILES INTO THE RIGHT FOLDER!!!
***------***

- Reboot your cam by removing/inserting the battery
- Be happy!!!

- It is possible that the measuring spot is off center after reboot. Turn the spot off/on in the setup menu of the cam and it should be centered.

I had a few issues with this process applying it to an E4 with 1.2L which had been upgraded to 2.3.13, but I was able to get things to work

1, The current release of flirtools did not install the windows RNDIS driver on my windows 7 computer, after a bit of digging I was able to download a copy of the RNDIS driver dated 2013 from the Flir support site.

2, I was able to set RNDIS using the hidden USB menu, and did not have to use  "Set_RNDIS_temporary.fif" or "Set_RNDIS_permanent.fif" I suspect this is due to the 1.2L original firmware (I bought this E4 used, certification date was in april 2014)