Unbricking FLIR T620 - Page 1
Forum section: electronics / general

author: BiD
author_rank: Contributor
timestamp: June 27, 2020, 11:27:17 am
content: I had purchased a damaged FLIR T620 that has a broken screen and didn't seem to boot. I've tried using the update tool however it doesn't seem to retain the update, once I reboot I can see via that the /FlashFS directory that gets created after the update disappears. I made a quick video of some of it:I was wondering if anyone happen to have some ideas as to why the flash update isn't being retained? I know there was effort to revert the firmware to older firmware on the FLIR E40, I read through a lot of the E40-related thread and if they had ran into the same problem.I was able to capture the authentication to the FTP using Wireshark:User: anonymousPassword: NcFTP@however maybe the privilege of "anonymous" isn't sufficient to see and write to the real root directory and it's writing to a "chroot"-like root, this would explain why the update isn't taking and the system reverts when it reboots.I was able to figure out the pinouts on the 12-pin receptacle that's seen in many FLIR boards.12-pin connector:Digi-Key Part Number: (1195-3392-1-ND)Connector Manufacturer: HARTINGConnector Manufacturer Part Number: 1521012260100026-pin connector:Digi-Key Part Number: (1195-3395-1-ND)Connector Manufacturer: HARTINGConnector Manufacturer Part Number: 15210262601000I'm working through the 26-pin receptacle that's also common on FLIR boards and will update.Open to ideas! Thanks!** Update 2020-06-27:* Found some I2C in 26-pin receptacle, added photo and decoded I2C output.* Attached UART output in uart_output.20200627.1.txt for referenceWhat was happening was when I ran the upgrade, it was installing the files into /FlashFS/ however it was creating that directory. That directory *should* of existed prior to the install. I had issued the cmd `diskutil -L` and saw:Code:Store "Intel Virtual File System":Device Name: "DSK1:"Description.: Intel Virtual File SystemPartitions: 0Mount Count: 0Device Type: FLASHDevice Flags: |STORAGE_DEVICE_FLAG_READWRITE|Device Attributes: |AUTOFORMAT|Number of Sectors: 216513Bytes per Sector: 512Free Sectors: 0Biggest Partition Creatable (sectors): 0No partitions found on "DSK1:"!so basically the partition somehow is corrputed. I preformed a low-level format using `diskutil`Code:-F 
 -l Low-level format storethen created a partition on DSK1 with the size of the whole device:Code:diskutil -C DSK1: -p Part00 -x 216510and now I see this `diskutil -L`Code:Received shell command message:Store "Intel Virtual File System":Device Name: "DSK1:"Description.: Intel Virtual File SystemPartitions: 1Mount Count: 1Device Type: FLASHDevice Flags: |STORAGE_DEVICE_FLAG_READWRITE|Device Attributes:Number of Sectors: 216513Bytes per Sector: 512Free Sectors: 0Biggest Partition Creatable (sectors): 0Partiton "Part00" on "DSK1:":Partition Name: "Part00"File System: exfat.dllVolume Name: FlashFSVolume Attributes:Volume Flags: |TRANSACTION_SAFE|WFSC_SUPPORTED|LOCKFILE_SUPPORTED|STORE|Number of Sectors: 216510Partition Type: DOS4_FAT (FAT16)Partition Attributes: |MOUNTED|and when I list directory, I get:Code:Directory of \01/01/1998 04:00a <DIR> StorageCard01/01/1998 04:00a <DIR> FlashFS01/08/2010 07:17p 4,096 Printer.swap01/08/2010 11:17a <DIR> profiles01/08/2010 11:17a <DIR> Documents and Settings01/08/2010 11:17a <DIR> My Documents01/08/2010 11:17a <DIR> Program Files01/08/2010 11:17a <DIR> Temp01/08/2010 11:17a <DIR> Windows1 File(s) 4,096 bytes8 Dir(s) 50,008,064 bytes freeDevice now boots up fine however looks like calibration data is missing. In UART logs "uart_output-afterflash.20200627.1.txt" :Code:Exception 'Raised Exception' (-1): Thread-Id=066e0032(pth=90a8b33c), Proc-Id=0705000a(pprc=903b23a0) 'uicore.exe', VM-active=075000a(pprc=903b23a0) 'uicore.exe'PC=400608c4(coredll.dll+0x000508c4) RA=883ba2c0(kernel.dll+0x000062c0) SP=0032dd34, BVA=0032ddfcuicore: 1263010518:964: Info: Cascades version: 3.8.13uicore: 1263010520:610: Error: FLIR::modules::SystemInfo::UpdateLensInfo: Failed to read calibration resource: FLIR::core_interace::ResourceManager::OpenResource: Failed to open resource: .calib.lens.le.isMeasured, return code: 0xab010004Exception 'Raised Exception' (-1): Thread-Id=066e0032(pth=90a8b33c), Proc-Id=0705000a(pprc=903b23a0) 'uicore.exe', VM-active=075000a(pprc=903b23a0) 'uicore.exe'PC=400608c4(coredll.dll+0x000508c4) RA=883ba2c0(kernel.dll+0x000062c0) SP=0032e490, BVA=0032e558uicore: 1263010521:168: Error: FLIR::modules::ImageOps::OpenResources: Zoom disabled.Exception 'Raised Exception' (-1): Thread-Id=066e0032(pth=90a8b33c), Proc-Id=0705000a(pprc=903b23a0) 'uicore.exe', VM-active=075000a(pprc=903b23a0) 'uicore.exe'PC=400608c4(coredll.dll+0x000508c4) RA=883ba2c0(kernel.dll+0x000062c0) SP=0032e714, BVA=0032e7d8POST 20100108 20:15:21 - uicore.exe: pdfReader tid 0x065F0236 qid 82Exception 'Raised Exception' (-1): Thread-Id=066e0032(pth=90a8b33c), Proc-Id=0705000a(pprc=903b23a0) 'uicore.exe', VM-active=075000a(pprc=903b23a0) 'uicore.exe'PC=400608c4(coredll.dll+0x000508c4) RA=883ba2c0(kernel.dll+0x000062c0) SP=0032e9c8, BVA=0032ea90uicore: 1263010521:881: Error: FLIR::modules::VoiceAnnotation::OpenResources: Couldnt open resources for VoiceAnnotation; IGNORNG during devPOST 20100108 20:15:21 - uicore.exe: Created modules in 2431 msCamAppThread: 256 buffers, 21 Hz** Update 2020-07-04:I was able to get it working! The fixed required the missing filesCode:Flashfs/system/calib.rscFlashfs/system/appcore.d/config.d/conf.cfgFlashfs/system/maps/*Flashfs/system/appcore.d/*The *.rsc required updating of the serial number and CRC value.The unit boots up fine and shows the imager's image . Since the map files were from another unit, it's not calibrated to this unit and there's dead pixels that's not compensated for. Next bit is to figure out where that information stored.It's worth noting that the UART/JTAG socket is accessible behind the sticker in the battery shroud, see IMG_6120.jpeg.H/T to Chanc3 for helping me on this.

author: agiorgitis
author_rank: Regular Contributor
timestamp: June 27, 2020, 09:37:43 pm
content: Just couple of ideas:-Try filezilla with fliruser:3vlig like in Ex-Since it doesn't recognize the lens, try to boot without it (if the camera fell and broke the screen, maybe lens chip got destroyed too)-Try different firmware versions (older ones) if you can find online-maybe the screen's touch surface is shortcircuited and when you boot it's like pressing many times the screen and hangs?-Is there an internal battery that you can replace?

author: BiD
author_rank: Contributor
timestamp: June 27, 2020, 10:06:53 pm
content: agiorgitis,Thanks for the suggestions> -Try filezilla with fliruser:3vlig like in ExYes, I initially tried that and it didn't work and ended up using Wireshark to capture the credential mentioned in OP> -Since it doesn't recognize the lens, try to boot without it (if the camera fell and broke the screen, maybe lens chip got destroyed too)Just tried, it did not seem to make a difference.> -Try different firmware versions (older ones) if you can find onlineI'll see if I can dig up anything.> -maybe the screen's touch surface is shortcircuited and when you boot it's like pressing many times the screen and hangs?I've tried removing it and I just get additional error shown in UART and doesnt seem to make any differences in booting.> -Is there an internal battery that you can replace?Yes, I've checked its voltage and it seems okay.Attached UART output in OP uart_output.20200627.1.txt , some of the peripheral errors I think are okay because I don't have those things plugged in. Most of them go away when I reassemble however it still doesn't boot just with I2C related messages going away.

author: railrun
author_rank: Regular Contributor
timestamp: June 27, 2020, 10:26:47 pm
content: Have you tried different key combinations? When you start the camera keep the joystick down(Or up/left/right) for example?On the E40 you can then login via ftp without username/password.

author: BiD
author_rank: Contributor
timestamp: June 27, 2020, 11:06:35 pm
content: > Have you tried different key combinations? When you start the camera keep the joystick down(Or up/left/right) for example?I have not, I'll try that although there's a lot of possible key combinations. For E40, was it single-key combination?

author: BiD
author_rank: Contributor
timestamp: June 28, 2020, 01:29:48 am
content: I've made progress!What was happening was when I ran the upgrade, it was installing the files into /FlashFS/ however it was creating that directory. That directory *should* of existed prior to the install. I had issued the cmd `diskutil -L` and saw:Code:Store "Intel Virtual File System":Device Name: "DSK1:"Description.: Intel Virtual File SystemPartitions: 0Mount Count: 0Device Type: FLASHDevice Flags: |STORAGE_DEVICE_FLAG_READWRITE|Device Attributes: |AUTOFORMAT|Number of Sectors: 216513Bytes per Sector: 512Free Sectors: 0Biggest Partition Creatable (sectors): 0No partitions found on "DSK1:"!so basically the partition somehow is corrputed. I preformed a low-level format using `diskutil`Code:-F 
 -l Low-level format storethen created a partition on DSK1 with the size of the whole device:Code:diskutil -C DSK1: -p Part00 -x 216510and now I see this `diskutil -L`Code:Received shell command message:Store "Intel Virtual File System":Device Name: "DSK1:"Description.: Intel Virtual File SystemPartitions: 1Mount Count: 1Device Type: FLASHDevice Flags: |STORAGE_DEVICE_FLAG_READWRITE|Device Attributes:Number of Sectors: 216513Bytes per Sector: 512Free Sectors: 0Biggest Partition Creatable (sectors): 0Partiton "Part00" on "DSK1:":Partition Name: "Part00"File System: exfat.dllVolume Name: FlashFSVolume Attributes:Volume Flags: |TRANSACTION_SAFE|WFSC_SUPPORTED|LOCKFILE_SUPPORTED|STORE|Number of Sectors: 216510Partition Type: DOS4_FAT (FAT16)Partition Attributes: |MOUNTED|and when I list directory, I get:Code:Directory of \01/01/1998 04:00a <DIR> StorageCard01/01/1998 04:00a <DIR> FlashFS01/08/2010 07:17p 4,096 Printer.swap01/08/2010 11:17a <DIR> profiles01/08/2010 11:17a <DIR> Documents and Settings01/08/2010 11:17a <DIR> My Documents01/08/2010 11:17a <DIR> Program Files01/08/2010 11:17a <DIR> Temp01/08/2010 11:17a <DIR> Windows1 File(s) 4,096 bytes8 Dir(s) 50,008,064 bytes freenow going to re-try updating firmware and see what happens!

author: BiD
author_rank: Contributor
timestamp: June 28, 2020, 02:15:44 am
content: Does anyone know where nodes/values that "rls" lists out resides? Does it come from the file system somewhere?Does anyone happen to have a FLIR T6x0 and could dump the content of:Code:rls -r .calib.lensI understand that the calibration would not be for the lens built into the unit I have however it'll help me get a bit closer to working state.Thanks

author: BiD
author_rank: Contributor
timestamp: July 04, 2020, 08:52:14 am
content: I was able to get it working! The fixed required the missing filesCode:Flashfs/system/calib.rscFlashfs/system/appcore.d/config.d/conf.cfgFlashfs/system/maps/*Flashfs/system/appcore.d/*The *.rsc required updating of the serial number and CRC value.The unit boots up fine and shows the imager's image . Since the map files were from another unit, it's not calibrated to this unit and there's dead pixels that's not compensated for. Next bit is to figure out where that information stored.It's worth noting that the UART/JTAG socket is accessible behind the sticker in the battery shroud, see IMG_6120.jpeg.H/T to Chanc3 for helping me on this.My next steps is to try and figure out how to mark dead pixels. I was able to get an idea of the format for the map's .dpx, .gan, and .bgm files. The value distribution and size aligns perfectly with 640x480 pixels after removing the header portions thats mostly zeros. I've so far tried doing 0xFFFFFFFF for like 1/3 of the files of .dpx and .gan but it didn't seem to make any difference in the image produced.Anyone happen to have an idea where dead pixel calibration data lives?

author: railrun
author_rank: Regular Contributor
timestamp: July 04, 2020, 09:38:42 am
content: Have you tried to get to the service menu via http?

author: BiD
author_rank: Contributor
timestamp: July 05, 2020, 12:46:13 pm
content: > Have you tried to get to the service menu via http?I've not but that's a good callout worth trying. Thanks

author: radioorizont
author_rank: Regular Contributor
timestamp: November 16, 2021, 08:23:48 pm
content: Hi BiD,I was able to find the flash app in Flir Tools but my camera never gets a valid IP, only says identifyingMy cam does not have usb connection, only ethernet through the usb port.Have you come across this?Thanks

author: BiD
author_rank: Contributor
timestamp: November 20, 2021, 05:40:41 pm
content: > Have you come across this?I had tested the pins, usually the JTAG will output data on boot.> My cam does not have usb connection, only ethernet through the usb port.What model is this unit you have?

author: Bud
author_rank: Super Contributor
timestamp: November 22, 2021, 03:57:59 pm
content: Quote from: radioorizont on November 16, 2021, 08:23:48 pmFlir Tools are notorious for not always working well on Windows 7 and higher. Try getting a WinXP virtual machine and install Flir Tools on it. It is only you will have same problem on WinXP you can conclude the problem is elsewhere and not with Flir Tools.

author: tcq1000
author_rank: Contributor
timestamp: June 18, 2024, 07:56:48 am
content: Many FLIR models sometimes experience blue screen issues, and I have encountered this phenomenon on multiple T6xx models. Fortunately, after a long period of research, I have successfully resolved the issue, which is usually caused by missing files. However, the detectors of each device are different, so even if the files are copied in, the image still cannot appear normally. Therefore, the image calibration process needs to be carried out.