Unbricking FLIR T620

[BiD]

I had purchased a damaged FLIR T620 that has a broken screen and didn't seem to boot.  I've tried using the update tool however it doesn't seem to retain the update, once I reboot I can see via that the /FlashFS directory that gets created after the update disappears.  I made a quick video of some of it:



I was wondering if anyone happen to have some ideas as to why the flash update isn't being retained?  I know there was effort to revert the firmware to older firmware on the FLIR E40, I read through a lot of the E40-related thread and if they had ran into the same problem.


I was able to capture the authentication to the FTP using Wireshark:

User: anonymous
Password: NcFTP@

however maybe the privilege of "anonymous" isn't sufficient to see and write to the real root directory and it's writing to a "chroot"-like root, this would explain why the update isn't taking and the system reverts when it reboots.

I was able to figure out the pinouts on the 12-pin receptacle that's seen in many FLIR boards. 

12-pin connector:
    Digi-Key Part Number: ( 1195-3392-1-ND )
    Connector Manufacturer: HARTING
    Connector Manufacturer Part Number: 15210122601000

26-pin connector:
    Digi-Key Part Number: ( 1195-3395-1-ND )
    Connector Manufacturer: HARTING
    Connector Manufacturer Part Number: 15210262601000


I'm working through the 26-pin receptacle that's also common on FLIR boards and will update.

Open to ideas!  Thanks!

** Update 2020-06-27:
* Found some I2C in 26-pin receptacle, added photo and decoded I2C output.
* Attached UART output in uart_output.20200627.1.txt for reference

What was happening was when I ran the upgrade, it was installing the files into /FlashFS/ however it was creating that directory.  That directory *should* of existed prior to the install.  I had issued the cmd `diskutil -L` and saw:

Code: [Select]

Store "Intel Virtual File System":
Device Name: "DSK1:"
Description.: Intel Virtual File System
Partitions: 0
Mount Count: 0
Device Type: FLASH
Device Flags: |STORAGE_DEVICE_FLAG_READWRITE|
Device Attributes: |AUTOFORMAT|
Number of Sectors: 216513
Bytes per Sector: 512
Free Sectors: 0
Biggest Partition Creatable (sectors): 0
No partitions found on "DSK1:"!

so basically the partition somehow is corrputed.  I preformed a low-level format using `diskutil`

Code: [Select]

-F <s> -l               Low-level format store
then created a partition on DSK1 with the size of the whole device:

Code: [Select]

diskutil -C DSK1: -p Part00 -x 216510
and now I see this `diskutil -L`

Code: [Select]

Received shell command message:
Store "Intel Virtual File System":
Device Name: "DSK1:"
Description.: Intel Virtual File System
Partitions: 1
Mount Count: 1
Device Type: FLASH
Device Flags: |STORAGE_DEVICE_FLAG_READWRITE|
Device Attributes:
Number of Sectors: 216513
Bytes per Sector: 512
Free Sectors: 0
Biggest Partition Creatable (sectors): 0

Partiton "Part00" on "DSK1:":
Partition Name: "Part00"
File System: exfat.dll
Volume Name: FlashFS
Volume Attributes: Volume Flags: |TRANSACTION_SAFE|WFSC_SUPPORTED|LOCKFILE_SUPPORTED|STORE|
Number of Sectors: 216510
Partition Type: DOS4_FAT (FAT16)
Partition Attributes: |MOUNTED|


and when I list directory, I get:

Code: [Select]

Directory of \

01/01/1998    04:00a    <DIR>          StorageCard
01/01/1998    04:00a    <DIR>          FlashFS
01/08/2010    07:17p             4,096 Printer.swap
01/08/2010    11:17a    <DIR>          profiles
01/08/2010    11:17a    <DIR>          Documents and Settings
01/08/2010    11:17a    <DIR>          My Documents
01/08/2010    11:17a    <DIR>          Program Files
01/08/2010    11:17a    <DIR>          Temp
01/08/2010    11:17a    <DIR>          Windows
               1 File(s)         4,096 bytes
               8 Dir(s)     50,008,064 bytes free



Device now boots up fine however looks like calibration data is missing.  In UART logs "uart_output-afterflash.20200627.1.txt" :

Code: [Select]

Exception 'Raised Exception' (-1): Thread-Id=066e0032(pth=90a8b33c), Proc-Id=0705000a(pprc=903b23a0) 'uicore.exe', VM-active=075000a(pprc=903b23a0) 'uicore.exe'
PC=400608c4(coredll.dll+0x000508c4) RA=883ba2c0(kernel.dll+0x000062c0) SP=0032dd34, BVA=0032ddfc
uicore: 1263010518:964: Info: Cascades version: 3.8.13
uicore: 1263010520:610: Error: FLIR::modules::SystemInfo::UpdateLensInfo: Failed to read calibration resource: FLIR::core_interace::ResourceManager::OpenResource: Failed to open resource: .calib.lens.le.isMeasured, return code: 0xab010004
Exception 'Raised Exception' (-1): Thread-Id=066e0032(pth=90a8b33c), Proc-Id=0705000a(pprc=903b23a0) 'uicore.exe', VM-active=075000a(pprc=903b23a0) 'uicore.exe'
PC=400608c4(coredll.dll+0x000508c4) RA=883ba2c0(kernel.dll+0x000062c0) SP=0032e490, BVA=0032e558
uicore: 1263010521:168: Error: FLIR::modules::ImageOps::OpenResources: Zoom disabled.
Exception 'Raised Exception' (-1): Thread-Id=066e0032(pth=90a8b33c), Proc-Id=0705000a(pprc=903b23a0) 'uicore.exe', VM-active=075000a(pprc=903b23a0) 'uicore.exe'
PC=400608c4(coredll.dll+0x000508c4) RA=883ba2c0(kernel.dll+0x000062c0) SP=0032e714, BVA=0032e7d8
POST 20100108 20:15:21 -       uicore.exe: pdfReader tid 0x065F0236 qid 82
Exception 'Raised Exception' (-1): Thread-Id=066e0032(pth=90a8b33c), Proc-Id=0705000a(pprc=903b23a0) 'uicore.exe', VM-active=075000a(pprc=903b23a0) 'uicore.exe'
PC=400608c4(coredll.dll+0x000508c4) RA=883ba2c0(kernel.dll+0x000062c0) SP=0032e9c8, BVA=0032ea90
uicore: 1263010521:881: Error: FLIR::modules::VoiceAnnotation::OpenResources: Couldnt open resources for VoiceAnnotation; IGNORNG during dev
POST 20100108 20:15:21 -       uicore.exe: Created modules in 2431 ms
CamAppThread: 256 buffers, 21 Hz



** Update 2020-07-04:
I was able to get it working!  The fixed required the missing files

Code: [Select]

Flashfs/system/calib.rsc
Flashfs/system/appcore.d/config.d/conf.cfg
Flashfs/system/maps/*
Flashfs/system/appcore.d/*

The *.rsc required updating of the serial number and CRC value.

The unit boots up fine and shows the imager's image .  Since the map files were from another unit, it's not calibrated to this unit and there's dead pixels that's not compensated for.  Next bit is to figure out where that information stored.

It's worth noting that the UART/JTAG socket is accessible behind the sticker in the battery shroud, see IMG_6120.jpeg.

H/T to Chanc3 for helping me on this. 

[agiorgitis]

Just couple of ideas:
-Try filezilla with fliruser:3vlig like in Ex
-Since it doesn't recognize the lens, try to boot without it (if the camera fell and broke the screen, maybe lens chip got destroyed too)
-Try different firmware versions (older ones) if you can find online
-maybe the screen's touch surface is shortcircuited and when you boot it's like pressing many times the screen and hangs?
-Is there an internal battery that you can replace?

[BiD]

agiorgitis,

Thanks for the suggestions

> -Try filezilla with fliruser:3vlig like in Ex

Yes, I initially tried that and it didn't work and ended up using Wireshark to capture the credential mentioned in OP

> -Since it doesn't recognize the lens, try to boot without it (if the camera fell and broke the screen, maybe lens chip got destroyed too)

Just tried, it did not seem to make a difference.

> -Try different firmware versions (older ones) if you can find online

I'll see if I can dig up anything.

> -maybe the screen's touch surface is shortcircuited and when you boot it's like pressing many times the screen and hangs?

I've tried removing it and I just get additional error shown in UART and doesnt seem to make any differences in booting.

> -Is there an internal battery that you can replace?

Yes, I've checked its voltage and it seems okay.


Attached UART output in OP uart_output.20200627.1.txt , some of the peripheral errors I think are okay because I don't have those things plugged in.  Most of them go away when I reassemble however it still doesn't boot just with I2C related messages going away.

[railrun]

Have you tried different key combinations? When you start the camera keep the joystick down(Or up/left/right) for example?
On the E40 you can then login via ftp without username/password.

[BiD]

> Have you tried different key combinations? When you start the camera keep the joystick down(Or up/left/right) for example?

I have not, I'll try that although there's a lot of possible key combinations.  For E40, was it single-key combination?

[BiD]

I've made progress!

What was happening was when I ran the upgrade, it was installing the files into /FlashFS/ however it was creating that directory.  That directory *should* of existed prior to the install.  I had issued the cmd `diskutil -L` and saw:

Code: [Select]

Store "Intel Virtual File System":
Device Name: "DSK1:"
Description.: Intel Virtual File System
Partitions: 0
Mount Count: 0
Device Type: FLASH
Device Flags: |STORAGE_DEVICE_FLAG_READWRITE|
Device Attributes: |AUTOFORMAT|
Number of Sectors: 216513
Bytes per Sector: 512
Free Sectors: 0
Biggest Partition Creatable (sectors): 0
No partitions found on "DSK1:"!

so basically the partition somehow is corrputed.  I preformed a low-level format using `diskutil`

Code: [Select]

-F <s> -l               Low-level format store
then created a partition on DSK1 with the size of the whole device:

Code: [Select]

diskutil -C DSK1: -p Part00 -x 216510
and now I see this `diskutil -L`

Code: [Select]

Received shell command message:
Store "Intel Virtual File System":
Device Name: "DSK1:"
Description.: Intel Virtual File System
Partitions: 1
Mount Count: 1
Device Type: FLASH
Device Flags: |STORAGE_DEVICE_FLAG_READWRITE|
Device Attributes:
Number of Sectors: 216513
Bytes per Sector: 512
Free Sectors: 0
Biggest Partition Creatable (sectors): 0

Partiton "Part00" on "DSK1:":
Partition Name: "Part00"
File System: exfat.dll
Volume Name: FlashFS
Volume Attributes: Volume Flags: |TRANSACTION_SAFE|WFSC_SUPPORTED|LOCKFILE_SUPPORTED|STORE|
Number of Sectors: 216510
Partition Type: DOS4_FAT (FAT16)
Partition Attributes: |MOUNTED|


and when I list directory, I get:

Code: [Select]

Directory of \

01/01/1998    04:00a    <DIR>          StorageCard
01/01/1998    04:00a    <DIR>          FlashFS
01/08/2010    07:17p             4,096 Printer.swap
01/08/2010    11:17a    <DIR>          profiles
01/08/2010    11:17a    <DIR>          Documents and Settings
01/08/2010    11:17a    <DIR>          My Documents
01/08/2010    11:17a    <DIR>          Program Files
01/08/2010    11:17a    <DIR>          Temp
01/08/2010    11:17a    <DIR>          Windows
               1 File(s)         4,096 bytes
               8 Dir(s)     50,008,064 bytes free



now going to re-try updating firmware and see what happens!

[BiD]

Does anyone know where nodes/values that "rls" lists out resides?  Does it come from the file system somewhere?

Does anyone happen to have a FLIR T6x0 and could dump the content of:

Code: [Select]

rls -r .calib.lens
I understand that the calibration would not be for the lens built into the unit I have however it'll help me get a bit closer to working state. 


Thanks

[BiD]

I was able to get it working!  The fixed required the missing files

Code: [Select]

Flashfs/system/calib.rsc
Flashfs/system/appcore.d/config.d/conf.cfg
Flashfs/system/maps/*
Flashfs/system/appcore.d/*

The *.rsc required updating of the serial number and CRC value.

The unit boots up fine and shows the imager's image .  Since the map files were from another unit, it's not calibrated to this unit and there's dead pixels that's not compensated for.  Next bit is to figure out where that information stored.

It's worth noting that the UART/JTAG socket is accessible behind the sticker in the battery shroud, see IMG_6120.jpeg.

H/T to Chanc3 for helping me on this. 


My next steps is to try and figure out how to mark dead pixels.  I was able to get an idea of the format for the map's .dpx, .gan, and .bgm files. The value distribution and size aligns perfectly with 640x480 pixels after removing the header portions thats mostly zeros.  I've so far tried doing 0xFFFFFFFF for like 1/3 of the files of .dpx and .gan but it didn't seem to make any difference in the image produced.

Anyone happen to have an idea where dead pixel calibration data lives?

[railrun]

Have you tried to get to the service menu via http?

[BiD]

> Have you tried to get to the service menu via http?

I've not but that's a good callout worth trying. Thanks

[radioorizont]

Hi BiD,
I was able to find the flash app in Flir Tools but my camera never gets a valid IP, only says identifying
My cam does not have usb connection, only ethernet through the usb port.
Have you come across this?
Thanks

[BiD]

> Have you come across this?

I had tested the pins, usually the JTAG will output data on boot. 

> My cam does not have usb connection, only ethernet through the usb port.

What model is this unit you have?

[Bud]

Hi BiD,
I was able to find the flash app in Flir Tools but my camera never gets a valid IP, only says identifying
My cam does not have usb connection, only ethernet through the usb port.
Have you come across this?
Thanks

Flir Tools are notorious for not always working well on Windows 7 and higher. Try getting a WinXP virtual machine and install Flir Tools on it. It is only you will have same problem on WinXP you can conclude the problem is elsewhere and not with Flir Tools.

[tcq1000]

Many FLIR models sometimes experience blue screen issues, and I have encountered this phenomenon on multiple T6xx models. Fortunately, after a long period of research, I have successfully resolved the issue, which is usually caused by missing files. However, the detectors of each device are different, so even if the files are copied in, the image still cannot appear normally. Therefore, the image calibration process needs to be carried out.