Attempt on Reverse Engineering the Magnity Mag160Core USB Thermal Camera - Page 1
Forum section: electronics / general

author: LMasterGame
author_rank: Contributor
timestamp: July 12, 2025, 12:43:50 am
content: Hi everyone. I'm new to this website, I just discovered this forum yesterday when trying to search every corner of the internet for clues about what I'm doing. And I really like what I see posted here.First, let me introduce to you the MAG160Corehttps://www.magnity.com.cn/product/id/17.htmlbefore going to the progress on reverse engineering it.It is a USB thermal camera with an FPA of 160x120 pixels at 15fps. I got this because it was really cheap on ebay (around 100 USD, but later, it got a bit more expensive, around 130 USD), cheap thermal cameras are mostly garbage, but this one isn't, and since I'm just getting started with this hobby, I didn't want to spend like 600 USD for a bigger microbolometer.As you can see, it has both male and female USB-C ports, the female one is very useful when you want to use it with an extension, but don't want to carry special extra cables.The camera also has a manual focus lens of 6.5 mm focal length that gives you 36.4degx27.2deg of FOV. It is great for macro applications.Here I show 2 samples made with it, but don't let them make you think it's a bad camera, it's just my shaky hands that can't keep the optimal focus distance.Here is a comparison of the minimum distance focus vs. a photo with a normal camera, the photographed object is an orange pi zero 3, and the smallest component in the IR photo is less than half a millimeter long.The orange piAnd so, my progress on reverse engineering this thingy is up to being able to capture a raw frame and trigger the shutter.I got inspired by Dmytro's video on reverse engineering the Infiray T2S+, and since I'm almost an engineer, I thought this would be my first personal big software development project.The camera doesn't output video as a UVC device, you have to talk with it in raw USB transfers. Thankfully, the app provided by Magnity (Mag-Cx) had everything to make it work without having to touch any assembly code or Ghidra generated code.In order to enter in business with this camera, you have to send some commands. The following has some definitions needed to operate the camera:Code:ENDPOINT_ADDRESSES = {"command_out" : 0x03, # 3"calibration_out" : 0x05, # 5"image_in" : 0x81, # 129"command_in" : 0x82, # 130"calibration_in" : 0x84, # 132}HOST2DEV_COMMANDS = {"GetParameter1" : 0x6BB6B66B, # 1807136363"GetParameter2" : 0x6BB6B66C, # 1807136364"SetParameter1" : 0x6BB6B66D, # 1807136365, i don't want to mess with it."SetParameter2" : 0x6BB6B66E, # 1807136366, i don't want to mess with it."GetCaliInfo" : 0x6BB6B66F, # 1807136367"GetCaliFile" : 0x6BB6B670, # 1807136368"SendCaliFile" : 0x6BB6B671, # 1807136369, i don't want to mess with it."SetShutterState" : 0x6BB6B672, # 1807136370"StartTransferImg" : 0x6BB6B673, # 1807136371"StopTransferImg" : 0x6BB6B674, # 1807136372"GetLifeTime" : 0x6BB6B675, # 1807136373"SetLaserState" : 0x6BB6B676, # 1807136374, unused for this model."PowerSave" : 0x6BB6B677, # 1807136375, didn't make a difference."GetFPAState" : 0x6BB6B678, # 1807136376, unused for this model."SetFrameRate" : 0x6BB6B679, # 1807136377, haven't tried this yet, but its probably unused as well.}You first have to send the next commands: GetParameter1, GetParameter2, GetCaliInfo, to the command_out endpoint and read the response data from each command through the command_in endpoint.After you do this, now you can send the StartTransferImg command to the command_out endpoint and now you will be able to receive the frame data from the image_in endpoint (in this state, the camera consumes around 150mW). And to open or close the shutter, you have to send the command SetShutterState appended with a little endian 0 or 1 depending on the open shutter state you want to trigger, to the command_out endpoint.And finally, you can stop capturing the camera with the command StopTransferImg, this will put the camera in a low power consumption state (around 50mW)Here is a screenshot of the image being captured with a script I made for this.Here is the data from the GetParameters commands.Code:Camera parameters: {"serial_number": 160042155,"hardware_version": 0,"device_type": "MAG-160CORE","firmware_version": 67113504,"fpa_serial_number": 37439,"fpa_width": 160,"fpa_height": 120,"fps": 15,"reserved_1": 120,"fpa_gain": 0,"fpa_flip": 3,"inter_frame": 10,"inter_line": 12,"gfid": 3000,"gsk": 1120,"base_line_acc": 4,"denoise_level": 0,"reserved_2": 0,"reserved_3": 0,"fpa_temp_fix": 3106,"shutter_close_speed": 5,"shutter_open_speed": 4,"ffc_trigger_frame": 1800,"ffc_trigger_temperature": 250,"enlarge_range": 8,"laser_pos": 0,"at_zero_error_point": 24146,"at_error_slope": -0.051600001752376556,"reserved_4": 0,"reserved_5": 0}And here is where the easy part ends. Up to this point, I can only get the pixel count value, but I can't do important stuff like thermometry, these data are stored in a calibration file that can be downloaded from the camera's flash with the GetCaliFile command.I managed to analyze the calibration file with ImHex (I attached the file pattern that shows the regions of interest in the file), and found what look like flat raw frames and perhaps frames with some sort of convolutional function applied, they might be needed for lens correction, background subtraction, dead pixel removal, and to make the count to temperature LUTs. However, I still don't know what to do with this data, since I would need to know the temperatures of the black body in frame.So I searched the internet for an SDK of the camera, and can you guess what happened? DING DING DING, CORRECT!!! The SDK was nowhere around (although I found the SDK manual for the network version of the cameras).I tried to contact the seller, and he kindly uploaded a SDK from a third party (elotouch), this is enough to reverse engineer the SDK library with Ghidra, however, you know, analyzing a binary isn't an easy task, and even worse, I have no experience with C or C++.My main programming language is Python (everyone makes mistakes in their life) so the most I can do for now is analyzing easy variables and arguments.Things like pointers to specific data, or wrongly parsed function arguments, are a nightmare to analyze for me in my state of knowledge.Now, I'm slowly analyzing the binaries for clues on how to extract all the information from the calibration file, I will post updates here if I ever discover anything new.Here are the resources I have found through this effort:official buggy APP (Mag-Cx):https://www.magnity.com.cn/cx.html(direct download)https://www.magnity.com.cn/product/id/33.html(APP site)official, more professional APP (Mag-Mx):https://www.magnity.com.cn/mx.html(direct download)https://www.magnity.com.cn/product/id/30.html(APP site)Windows, Linux, and android third party SDKs:https://elosupport.elotouch.com/hc/en-us/articles/31651015048343-Where-can-I-find-documents-for-the-Elo-Temperature-Sensor-Pro(information)https://elotouch.sharepoint.com/:f:/s/KnoxvilleTechnicalServices/EnD-V5rIu_pHv2-Be6IS0e4BeJV94TGr6ggalyTwp2LEMQ?e=dGAlV7(drive folder)SDK manual for the network cameras:https://usermanual.wiki/Document/ThermoGroup20SDK20Manual20V2434.1106204049.pdfA project that makes use of the network SDK (useful for extracting workflows, expected data, structures, etc.):https://gitee.com/ChenLong0507/juge-thermal-imaging-softwareebay item listing:https://www.ebay.com/itm/405670541239I will also attach the rough scripts and calibration data I used.You might want to run the script for the camera more than once, it sometimes crashes before being able to capture the frames from the camera.And finally, I hope this was of any help to the possible null amount of people that owns the same camera as me.If i ever completely reverse engineer this camera successfully, I plan to make a desktop software and android APP that doesn't suck. and release everything to the open source community.

author: LMasterGame
author_rank: Contributor
timestamp: July 12, 2025, 12:52:38 am
content: I apologize to the people that read this in the first minutes, I messed up with the attachments placement.At this point, I have edited this post like 50 times as I find unclear things and other mistakes.

author: LMasterGame
author_rank: Contributor
timestamp: July 12, 2025, 04:24:53 am
content: Here I include some extra images

author: Fraser
author_rank: Super Contributor
timestamp: July 12, 2025, 12:41:09 pm
content: This core reminds me of one mentioned on this forum previously. A very inexpensive 160x120 pixel imaging core that has become very common in China and sells for around $40 as a bare core that needs a housing. I believe that this core is one of the many surplus products left over from the Chinese Pandemic response. There is a project detailing how to use this core and integrate it with an LCD display etc. I will see if I can find it.The current situation in the budget thermal imaging marketplace is very interesting. In the past I would have rushed to buy a $100 thermal camera dongle with 160x120 pixel resolution, but these days complete thermal cameras are available for not a lot more money in real terms considering what they offer. We have the Thermal Master $199 P2 but even more recently there is the Thermal Master THOR-002 with a retail price of $299. Suddenly a simple core for $100 is less appealing in terms of what you actually receive for your money. 256x192 pixel cores now dominate the budget end of the thermal camera market. I still like the fact that these relatively inexpensive imaging cores are available to those who wish to learn about thermal cameras and want to build projects, but the original $40 price was, obviously, better. Once this core started to become popular (after people published how to use it) the sellers increased their pricesYou are doing great work with your core and I support anyone wishing to learn more about thermal imagingFraser

author: Fraser
author_rank: Super Contributor
timestamp: July 12, 2025, 01:13:51 pm
content: As an example of what I have said in my previous post. A very quick look on Aliexpress shows many 256x192 pixel thermal camera dongles for around $100. The one pictured in my attachment is $103 with free shipping !Fraser

author: LMasterGame
author_rank: Contributor
timestamp: July 12, 2025, 03:17:29 pm
content: Quote from: Fraser on July 12, 2025, 12:41:09 pmIf I bought the camera in aliexpress or other chinese marketplace, I'd probably had saved a decent amount of money, or had bought a better core with a little more amount of money, but for some reason they never allowed me to do purchases, so ebay was my option.This camera was decent for me, as I wanted no matter what a manual focus (I originally wanted a T2S+, but they are relatively expensive for me) lens instead of a fixed focus one (like the P2, or most handheld cameras). The camera also have some DIY external parts (the orange ones) but otherwise it has no plastic parts, which I appreciate.The core itself though, definitely looked like a cheap one, it had scratches and dents on its surface.Quote from: Fraser on July 12, 2025, 12:41:09 pmThanks. I certainly learned quite a lot along the process.Flat field correction, non uniformity correction, signal transfer function, lens vignetting, dead pixel removal, thermal drift, etc. Those were concepts that I have never realized they were happening when capturing thermal images.A couple of years ago, having my own thermal imager was only a dream for me. Now that I that got into this rabbit hole, it will be very difficult getting out of it, but isn't like I want to.I also want some MWIR action, but it won't be any time soon when I get my first MWIR camera, uncooled inexpensive MWIR sensors will probably come earlier than the cash money required to buy a cooled MWIR one.I have recently bought another chinese thermal camera (Hik Vision HM-TM32-3RG/T), it is a 256x192 25fps FPA, definitely better than the magnity one, but theres a catch, it has an awful lot of noise, but its probably because the contrast enhancement postprocessing. Also the fact that the lens can't be focused easily like the magnity really doesn't make me happy.But that won't be an issue for long, I already have the SDK for it and this one has a lot more documentation to play with.Here I attach some images about the hik vision.And regarding the SDK, I could upload it if someone is interested.

author: Fraser
author_rank: Super Contributor
timestamp: July 12, 2025, 03:34:59 pm
content: The Hikmicro TM32 is an interesting little camera. At first I thought it might contain a Guide Sensmart TIMO256 core but now I am not sure. Did you receive a software APP to drive it or just the SDK ?I would appreciate the SDK as I am always trying to expand my knowledge and thermal imaging data archiveFraser

author: LMasterGame
author_rank: Contributor
timestamp: July 12, 2025, 03:45:50 pm
content: I got an android APP, and requested the seller to download the SDK for me, since most chinese companies lock their stuff to chinese people only.For some reason, the Hik micro desktop software works with this Hik Vision camera. I assume hik micro is the international division, and hik vision is the company itself in china.Folder with android APP, Windows software, and SDK for Win, Linux and Android:https://drive.google.com/drive/folders/1KWwkk-xors60yNB5yaQfooEe8kzXmOJ1?usp=sharing

author: Fraser
author_rank: Super Contributor
timestamp: July 12, 2025, 03:59:11 pm
content: Yes, Hikmicro and Hikvision are one and the same companyI thought the Hikvision part of the company specialised in CCTV related systems whereas Hikmicro offer everything else made by the company. Hikvision offered two hand held human temperature screening thermal cameras during the pandemic but they were actually modified versions of standard Hikmicro cameras. Hikvision discontinued those two special purpose cameras after the pandemic was over. Hikmicro continue to make the original camera models.Fraser

author: LMasterGame
author_rank: Contributor
timestamp: July 12, 2025, 04:34:04 pm
content: When I was looking for the SDK, I realized there were 2 different hik vision websites, one for china, and other for USA (there is also one for europe, but its a copy of the USA one)SDK page for china (requires chinese phone number registration to download):https://open.hikvision.com/download/5cda567cf47ae80dd41a54b3?type=20&id=cd699e0e3def4519a6e8676f72e1ea1eSDK page for US (note this only has the network SDK for CCTV cameras, but not the USB SDK):https://www.hikvision.com/us-en/support/download/sdk/Sharing the chinese SDK probably made my social credit go below negative infinity.

author: TinLethax
author_rank: Regular Contributor
timestamp: July 21, 2025, 02:35:17 am
content: Great work, you deserve a thank you! I'm also looking into reverse engineer this thermal cam too but I've been busy with other project. Glad to see someone working on this already.I was annoyed by the android app. Especially the watermark. I ended up replacing the watermark PNG with the transparent PNG in the APK 😂It would be nice if we can do something with the firmware (ideally wrote a custom open-source one) to convert it to USB UVC. I didn't dare to do a complete teardown because I'm actively using it in my job.