Modying Hikvsion/Hikmicro Lynx LE10 - adding reticle and replacing screen - Page 1
Forum section: electronics / general

author: Unseal
author_rank: Newbie
timestamp: March 30, 2022, 06:53:17 am
content: HelloWhile browsing the google for a way to modify my thermal camera , I stumbled upon this forum.Would you help me with finding a way in making a reticle to appear on handheld hikvisions? Right now I own a Lynx LE10 (HM-TS02-10XG/W-LE10)I'm helping people with finding and buying any kind of night and thermal devices before going to Ukraine , mostly people buy hikvisoon thermal scopes but lately the prices went up a lot, and they are out of stock almost anywhere..unlike normal cameras, I know it's not great but always something.Simple dot/cross that would appear in the centre and not disappear would be sufficient - right now we use the cameras in range finding mode winch shows a T shaped reticle that wont disappear. Sadly, in this mode you cant use zoom and change the colour paletteAnother idea was replacing the screen itself with some kind of FPV screen, I saw one person doing that for airsoft gun months ago...but I can't find it now..I recall he was using original board connectors from the board..Any kind of advice would be helpfulOliwier

author: Unseal
author_rank: Newbie
timestamp: March 30, 2022, 09:10:45 am
content: I managed to open the camera - screen unit is connected by fpc ribbon it is0.2 inch, LCOS, 720× 540, any ideas what would be compatible? I would be happy with any tft screen because eye relief on it is awful

author: vav
author_rank: Contributor
timestamp: March 30, 2022, 03:55:58 pm
content: Hi, I can't advise you, but I have a question. What kind of people are leaving for Ukraine at this time? Because now the opposite trend, people are leaving Ukraine.

author: Unseal
author_rank: Newbie
timestamp: March 30, 2022, 04:14:36 pm
content: Well there are two thing mostly. - males going back to Ukraine to defend, and groups organising gear for them. Like buying vests, gloves, scopes etc.There is need for night vision right now and thermal cameras are good substitute for even patrolling or searching.

author: Unseal
author_rank: Newbie
timestamp: March 30, 2022, 07:39:51 pm
content: Here's the LCOS screen I found, it seems its the same that is mounted inside the camera. the seller listed interface protocol winch can be helpfulhttps://m.pl.aliexpress.com/i/4001338431768.html?gatewayAdapt=Pc2Msite

author: johnelot
author_rank: Contributor
timestamp: April 02, 2022, 06:28:48 pm
content: i have an iray eye pro and it has a reticle and i think it is moveable but these type units have no good way to mount on a rifle and will not be rated for recoil , they would still be usefull as a spotter in and could be real usefull with a seperate battery powered lcd screen and video out attached so as not to be exposed when using (looking round corner without sticking your head out )

author: radiskull2000
author_rank: Newbie
timestamp: April 06, 2022, 02:49:14 am
content: I had one of these types of monoculars, purchased as a "TM160 Thermal Monocular" from "AGM Global Vision". I had the same plan for mine, turned out to be a PITA and wound up bricking it in the process of attempting to use the sketchy debug/maintenence software. The monocular runs busybox with Hikvision's proprietary software on a 700MHz single core Arm v7 SOC. I forget what manufacturer it was from, been a while since mine was in any condition to report this. It has 128MB of DDR2 RAM. The screen is the "Upscale VGA module" sold by Miyota DCA. It appears that the Xilinx Artix 7 FPGA is used to convert the video feed from the sensor to a format useable by the SOC, conversion to CVBS is handled by the ADV7393 located next to the USB-C port. In theory you could gain root access or just outright add your crosshair if you could figure out how the update files are formatted and encrypted, the encryption used is not the same as what Hikvision uses on any of their IP cameras or DVRs.You cannot replace the display with a full size LCD/TFT, however there is a smartphone app you can use to connect to the monocular and have it mirror the display to the phone. The app is called "T-Vision", though according to the Google Play reviews it has issues running on Samsung devices. I have a Moto G7 and it runs and connects to the monocular just fine so ymmv. If you're good with rezeroing it literally every time you turn on the device I suppose you could use the dead pixel correction function's crosshair cursor as a stopgap solution. IIRC you still can't change pallettes or zoom in/out in this mode, but at least you can zero it. Though it has been over a year since mine was in any condition to test so I could be wrong.Another thing you can try is getting an NTSC/PAL monitor, such as the ones sold on eBay as "back up camera monitors" or the kind sold sometimes by adafruit that takes 5V power rather than 12V like the eBay monitors. Some of the Ebay monitors can be modified to take 5V as well. Then you need to get of the USB-C to CVBS cable for these monoculars. Enable CVBS output on the monocular, connect the display using the cable, give power to the display and turn it on. Note this still doesn't give you a crosshair.I have no idea how technologically proficient you are but I will say that if at some point this wall of text coming up stops making sense (or you don't know what SSH, sh, or bash are) it's probably best to leave it as is. The process of adding a crosshair can brick your device, especially if you di what I did and go down the rabbit hole of playing with the sketchy, barely compatible software.In order to add a proper crosshair you would need root access to the device since root is the only user you can actually log in as and you need to be able to either find one lurking around and disabled in a config file or add one the hard way. You would also need to be able to modify the UI program somehow so you can actually enable the crosshair and zero the thing, and I have no clue how that works or how one would do that since my monocular didn't last long enough for me to find out. There are two ways you can gain root access to the device that I know of:First way is through SSH. Using the sketchy "demo" maintenence software provided by Hikvision for their IP security cameras you can enable SSH on the monocular if it isn't already available, there are a few versions of this software floating around. The firmware mine came with had SSH enabled until I updated it. Be careful messing with the options in that software, I clicked the wrong button and it nuked the calibration data on my monocular's sensor and appeared to cause permanent damage to the sensor somehow. Trust me, that calibration data is very important if you want to get a useable image out of the thing. Also their IP security camera user suite can connect to the monocular as if it were a regular security camera if run on a computer that is logged into the monocular's hotspot.Once SSH is enabled you can log in using the username "root" and password "hiklinux". It drops you into a psh (protected) shell with limited commands, to access a full shell type in the hidden command "debug" and you will need to enter the challenge code generated within Hikvision's customer service portal. Hikvision does generally reveal this from what I've read on IPCamTalk if you send them the code the camera gives you on the line above where you enter the response, though they wouldn't do it when I gave them the code and requested the challenge code response since mine was a rebrand sold by AGM. They told me to ask AGM for it and AGM claimed it was their own "proprietary IP" (yeah right, they didn't even bother changing the password from "hiklinux" to something less obvious or any of the comments in the debug commands that explicitly state the software is all Hikvision) and told me to kick rocks. They also don't have any of the source code available for their modifications to busybox (if they made any that is, looks like they just knida threw stuff on top of it and called it a day). Also this code changes every time you reboot the monocular. Once you have access to a root shell I'd recommend changing the default shell from psh to bash or sh if you want access in the future, since you won't be able to use the code they gave you anymore after you reboot the device. Since I never got that far I can't help much past that point and I doubt Hikvision will either.If you can desolder and resolder the eMMC IC the second way would be to desolder it and hook it up to one of the eMMC to USB or SD card adapters you can buy on eBay, bypassing the whole login issue. I'd recommend using linux for this since the root fs is formatted as EXT4 iirc. I doubt the device uses disk encryption but if it does this won't really work either unless you wanna try to crack that. Once you have access to the root filesystem from there you can rig it to drop you into an unrestricted shell (maybe replace the psh binary a symlink to bash/sh?) or reverse engineer the challenge code program so you can generate your own answers to the challenge code thing.Another possibility I never got around to exploring was the fact that Hikvision's remote CCI software uses some proprietary TCP protocol with root level priviledges on the device end. The whole debug/maintenence software package uses this and there is some sort of jank proprietary encrypted FTP protocol it can use to send and receive files. Might be worth checking out.As far as I could tell, the software is actually pretty jank under the hood. You can really tell they were more interested in pushing it to market ASAP and didn't care if there were bugs or outright broken pieces of software so long as they weren't apparent to the end user. The psh shell is located in the home folder for the root user and most of the commands it allows you to use either do nothing or output garbage. One of the commands indicated that the sensor actually outputs at 25Hz, not the advertised 50Hz. The display module runs at 50Hz interlaced. I also found the stadiametric rangefinder on mine to be... less than reliable.Some interesting things I noted while tinkering with it were that the debug software allows you to control the dead pixel correction program while connected to the device via its internal WiFi hotspot but it also outputs pixel coordinates if you use your mouse instead of the built in cursor. Interestingly enough despite mine having a "160x120" pixel sensor, the coordinates begin at 0,0 and end at 388,284 indicating that either they just use the same software for the 160 and 388 models or the sensor is actually a 388x284 resolution sensor that is just hobbled to 160x120 via software. The fact that your device despite being marketed as a "256x192" resolution device looks 100% identical to mine is also rather interesting. The 160 also uses the same updates as the 388 model. The sensor does output radiometry data that can be read by the software, or at least it did on mine.Just keep in mind all of this predates the 256x192 model entirely so things may have changed with that one, though I somehow doubt it did. If all of this isn't useful to you, then hopefully this wall of text is useful to someone and my thermal monocular's sacrifice was not in vain.

author: Fraser
author_rank: Super Contributor
timestamp: April 06, 2022, 06:32:48 am
content: Very useful, Thankyou. I have the Hikvision 2TP31B Fever detection thermal camera that I was hoping to revert to ‘non fever detection’ specification. It likely uses a similar firmware structure to that which you have described here. I have read that Hikvision firmware is generally quite crude in its implementation but works. Sadly they seem to make configuration modification a little more challenging than that of the famous FLIR E4 first generation cameras with their easily modified configuration !Fraser