Rooting the new FLIRs (E76, etc) - Page 1
Forum section: electronics / general

author: KaneTW
author_rank: Frequent Contributor
timestamp: February 21, 2022, 09:26:04 pm
content: The new FLIR cameras no longer have a world readable /etc/shadow, so rooting them is a bit harder. However, you can access the /dev/mmc* and /dev/mtd* files as fliruser (password 3lvig). This contains *all* information on the drive, and one of them will have your custom root hash "$1$...", NOT "qA7LRQDa1amZM".You can then crack it in a short amount of time using a modern GPU with hashcat. Take the $1$.. string, put it in e.g. hash.txt, and run hashcat:Code:hashcat.exe -m 500 -a 3 -1 ?l?u?d -O ?1?1?1?1?1?1 hash.txtOn my RTX A6000 this took about 25 minutes.Once you have this, you have root access to the camera. Now you can access the service menu as follows:1. Run the service websocket usingCode:LD_LIBRARY_PATH=/FLIR/usr/lib PATH=/usr/local/bin:/usr/bin:/bin:/usr/local/sbin:/usr/sbin:/sbin:/home/root/bin:/FLIR/usr/bin sh /FLIR/usr/Service/scripts/start_service_socket.sh2. Log in as service in the web interface after connecting via WLAN. I couldn't guess the service password and bcrypt is very slow to crack, so...a. Download /home/root/users.dbb. Run sqlite3 and change the password hash to 'admin' (or whatever you desire):Code:UPDATE users SET user_password_hash='$2y$10$/J/KDhh0.UDg5pbwtPG9B.W2gEWrS36qHji1scgxO7uiTk1GuAa.K' where user_id=4;c. Upload users.db back to /home/root. Don't forget to do a backup.Now you can log in as 'service' / 'admin' and get access to the service menu.NB: You can also get access to 'developer' mode by doing the same for user_id=5 and logging in as 'developer'.

author: KaneTW
author_rank: Frequent Contributor
timestamp: February 21, 2022, 10:37:21 pm
content: After updating to 7.8.77, the regular web interface is giving me "404 not found", but the rest still works. Going to try and figure out what's going on with the web if.E:I was able to reinstall the web interface by grabbing it from Axxx and decrypting it, then `opkg install` the .opk as root.The new users.db is in /var/www/users.db!

author: KaneTW
author_rank: Frequent Contributor
timestamp: February 21, 2022, 11:19:46 pm
content: The tool `fefunpack` can decrypt .opx files from the firmware updates.

author: KaneTW
author_rank: Frequent Contributor
timestamp: February 21, 2022, 11:41:44 pm
content: The sensor in my E76 is a 464x348 sensor, according to the new web interface:

author: KaneTW
author_rank: Frequent Contributor
timestamp: February 22, 2022, 01:54:24 am
content: I have reverse engineered the decryption for .cfc; it has changed to AES256. However, unfortunately, it is signed with an RSA key. Modifying the capabilities will require a binary patch to make it accept any signature.A decryption script is available athttps://0bin.net/paste/9Njm5R8m#AJqvDicIqTd7lbL0J4e7szDB+yQpPXYF99azLSYZrpl-- The code is a touch weird, artifact of transcribing from IDA...E: I have successfully upgraded my camera to its stated detector resolution of 464x348.As this is highly experimental, I will not provide a script yet, but describe the steps instead.1. Decrypt the cfcs with the script, and do whatever changes you want.2. Back up every file that you change on the device!!3. Analyze CCfc::verifySign and make it always return 1. This depends on your firmware version, but in 7.8.44 it was sufficient to change the final MOV R0, R4 to MOV R0, #1 at byte 0x9867C4. Re-encrypt the CFC, changing the length in the new header. You can reuse the rest of the header itself, but you also need to re-XOR it.5. Replace the files (remember the backup!)E2: hm, seems like some things are not working. Maybe a CRC check of some kind.E3: Yep, new CRC algorithm. It can be computed by 'zlib.crc32(<data without the CRC line>, 0x71941268 ^ 0xffffffff)'E4: Camera is now running at 484x348!

author: agiorgitis
author_rank: Regular Contributor
timestamp: February 22, 2022, 11:11:10 am
content: WOWAny idea if the same thing apply to E75 as well? (Ps: Users.db is in home/root too)Because it may help liberate E75 into E95 tooedit: It works on users.db on E75 too! (Just used a DB Browser instead of command line to make the changes)

author: KaneTW
author_rank: Frequent Contributor
timestamp: February 22, 2022, 03:58:35 pm
content: The fundamental method of access should be possible, but some details esp. about modifying the .cfc's might be different.I'd recommend gaining access and investigating. I'd offer to take a look but I don't think I can in a reasonable timeframe right now.

author: agiorgitis
author_rank: Regular Contributor
timestamp: February 22, 2022, 04:39:50 pm
content: Quote from: KaneTW on February 22, 2022, 03:58:35 pmGreat, thanks for your time mate. No worries!As I edited above, the users.db trick works on E75 too.I'll try the rest on my own, although my skills are not near close to a programmer.PS: What's the difference between logging into the 192.168.x.x to access the camera settings, and using the LD_LIBRARY_PATH=/FLIR/usr/lib PATH=/usr/loc etc path?(How do you use it anyway?)

author: KaneTW
author_rank: Frequent Contributor
timestamp: February 22, 2022, 05:00:59 pm
content: Not sure, I haven't tried the 192.168.x.x method. Does it have a service menu with calibration, EEPROM, etc?I'm digging deeper into the sensor data and found that the sensor in my camera is cropped on the FPGA. I wonder if this is hackable...Code:CameraPlatform::CCameraPlatform(): pcb = PCB_MODULE_EVIO and ir = IR_MODULE_MEDIUM_640 module detectedappcore: FVD_Init: Downsampling setting: 0x00appcore: Detector resolution according FPGA:464x348 (Croppped:1)

author: agiorgitis
author_rank: Regular Contributor
timestamp: February 22, 2022, 05:28:33 pm
content: Quote from: KaneTW on February 22, 2022, 05:00:59 pmJust connect camera to the network and use a web browser like mozilla to access it. Yes it has calibration, eeprom, info, lenses etc.How can I use your way to test things, through service websocket?Flir Ex was using the same 640x480 sensor for all models, so probably they're doing the same here.

author: KaneTW
author_rank: Frequent Contributor
timestamp: February 22, 2022, 05:55:25 pm
content: It's a bit different from previous iterations where the detector is downsampled. Here there's something more happening I think.That's a similar menu, just accessible over Wifi. The key improvement for hacking would be the new cfc decryption algorithm I think. Are you able to use the instructions to get root and get the config.d/*.cfc? You can check if these are using the new AES256 method then.

author: agiorgitis
author_rank: Regular Contributor
timestamp: February 22, 2022, 10:56:01 pm
content: Quote from: KaneTW on February 22, 2022, 05:55:25 pmLOL it works!File(s) decrypted!.caps entry.caps.config entry.caps.config.name text "app E75".caps.config.revision text "1.0".caps.config.image.settings.IRheight int32 240.caps.config.image.settings.IRwidth int32 320.caps.config.image.targetNoise entry.caps.config.image.targetNoise.enabled bool false.caps.config.image.targetNoise.targetNoiseMk int32 0

author: Bud
author_rank: Super Contributor
timestamp: February 22, 2022, 11:33:54 pm
content: That is quite a breakthrough after E4 golden times

author: KaneTW
author_rank: Frequent Contributor
timestamp: February 23, 2022, 01:16:48 am
content: Here's my script to re-encrypt ithttps://0bin.net/paste/VCrcwO7h#oM5D-Z+Xco7tWb4WxeYAdV4pLk1BgcQ4E1H37d4iKJsNeeds the old cfc to get the header from it (don't want to mess it up by accident), takes the new cfg, recomputes the CRC05, encrypts it and puts the (now incorrect) signature and (corrected for length etc) header back in place.Can definitely be way cleaned up but I figured I'd rather get it out there.For patching the libcommon_dll.so, I'll see if I can make a patcher utility.

author: agiorgitis
author_rank: Regular Contributor
timestamp: February 23, 2022, 05:39:52 am
content: OK I'll test it later today, although I can't know it works unless I send it to camera.And problem here is that I'm not sure what, and what not, can brick my camera. I remember that for E4 Bud had a bunch of files and instructions, along with the libcommon dll.Not sure which settings I can change in the conf.cfc without any risk...

author: kaz911
author_rank: Super Contributor
timestamp: February 23, 2022, 11:44:32 am
content: arghhhh stop it - 2nd prices on the new E series is already high enough...Please wait until I have purchased one...

author: KaneTW
author_rank: Frequent Contributor
timestamp: February 24, 2022, 02:56:54 am
content: Quote from: agiorgitis on February 23, 2022, 05:39:52 amRight now without the libcommon_dll.so, it'll just fail and boot a fallback mode. Working on a patcher for the libcommon_dll.so so it works across versions.

author: agiorgitis
author_rank: Regular Contributor
timestamp: February 24, 2022, 10:49:21 am
content: encryption works fine on my cfc too, at least decryption>encryption without making any changes within the cfc, produces a file with the exact same bytes are the original one.One step closer to E75/E76 liberation

author: KaneTW
author_rank: Frequent Contributor
timestamp: February 24, 2022, 04:02:48 pm
content: Here's the patcher utility:https://0bin.net/paste/Ddbip0Rm#Fzpl1DBN+O8g8j5HCp438RLPM0iM9YUMCYsLva6+T+pIt's not the most elegant approach, but I believe it should work. Finds the function symbol, looks for a matching string, patches it.

author: Bud
author_rank: Super Contributor
timestamp: February 24, 2022, 08:11:21 pm
content: Are these Python scripts ? Which version of Python you use ?

author: KaneTW
author_rank: Frequent Contributor
timestamp: February 24, 2022, 08:31:23 pm
content: Python3.8 (but any 3.x version should work).The first two require PyCryptodome, the last one pyelftools to be installed.

author: KaneTW
author_rank: Frequent Contributor
timestamp: February 24, 2022, 11:36:19 pm
content: The Flir 24 degree lens has a macro mode. It's a paid option only available on the T5xx series, but you can enable it viaCode:.caps.config.system.focus.mode entry.caps.config.system.focus.mode.macro entry.caps.config.system.focus.mode.macro.enabled bool truein the conf.cfgHere are some shots (freehand, so a bit blurry):No macro mode, for reference:

author: KaneTW
author_rank: Frequent Contributor
timestamp: February 25, 2022, 03:51:20 am
content: Seems like the FPGA is pretty stubborn about outputting the reduced resolution.The code indicated that it's cropped, but wouldn't that mess with viewing angles? Hm.The bitstream is in one of the accessible SPI flashes, but reversing that is a pain.E: Checked the datasheets. E76/E86 have 17um pitch, E96 has 12um. This gives a sensor size of 5440, 7888, 7680 respectively. This means that the sensor is, in fact, cropped.However, it's unclear how it manages to maintain the FOV.E2: Requesting a /dev/mtdblock{0,1} dump from a E75 and E86 please, if someone has access.

author: agiorgitis
author_rank: Regular Contributor
timestamp: February 25, 2022, 09:11:11 am
content: I assume that for some hidden/disabled functions we may need the conf files from E95/E96. Is it possible to grab those from the flir update files, or do we need someone with a E95/E96 to post the files?

author: KaneTW
author_rank: Frequent Contributor
timestamp: February 25, 2022, 02:05:25 pm
content: Unfortunately they're not in the firmware update from what I can tell.

author: agiorgitis
author_rank: Regular Contributor
timestamp: February 25, 2022, 02:51:49 pm
content: Quote from: KaneTW on February 25, 2022, 03:51:20 amHow I do that? I just have the files within the /dev folderActually just a file named "zero". most others are 0 bytesPS: have a look at FLIR\usr\ui.d\Resources, it has a bunch of design files for other camera models too, like t1k and axxx

author: KaneTW
author_rank: Frequent Contributor
timestamp: February 25, 2022, 02:58:05 pm
content: `dd if=/dev/mtdblock0 of=/home/root/mtd0_backup` then use e.g. scp to copy /home/root/mtd0_backup over to your host. While you're at it, can you also copy over /FLIR/system assuming you have root?

author: agiorgitis
author_rank: Regular Contributor
timestamp: February 26, 2022, 06:14:22 pm
content: Quote from: KaneTW on February 25, 2022, 02:58:05 pmI'll try to get time for this over the next couple of days!I have root access, yes(Actually I got root access couple of years ago, and I'm a guy who had 0 (zero) linux knowledge, I didn't even know what "root" was. If a random guy can just google how to get root access, and succeeds after couple of days of trying, I don't think Flir is doing such a great job on securing their systems)

author: Logan
author_rank: Frequent Contributor
timestamp: March 07, 2022, 04:32:50 pm
content: Quote from: KaneTW on February 25, 2022, 03:51:20 amInteresting, I've never heard a sensor of that resolution. I wonder how many different group of hardware they use across the whole series?Also, what does the new Exx series's picture quality compare to the older Ex/Exx series?

author: fenugrec
author_rank: Frequent Contributor
timestamp: May 14, 2022, 05:33:12 pm
content: Quote from: KaneTW on February 22, 2022, 01:54:24 amAwesome, thanks for sharing that and other info.I'm looking at a different (poor man's) device, the C5, and much of what you found is applicable to it. Your decryption script works almost as-is, with minor tweaks :Code:* header is 256 bytes from end, not 372* de-xor applies on range(12,60), withnewheader ^= header[x+48])* signature is "FEF1", not CFC2* suidbytes : 0x614b4e61654e7241I haven't made it much farther than this, but wanted to share it here, before I start a new thread focused on the C5 :https://www.eevblog.com/forum/thermal-imaging/flir-c5-reverse-engineering-firmware-hack/

author: agiorgitis
author_rank: Regular Contributor
timestamp: May 15, 2022, 01:17:06 pm
content: So were are we as for E75?Is the hack usable for increasing the resolution? I remember last time we spoke we were able to de/encrypt the conf and the dll files via your scripts

author: Psi
author_rank: Super Contributor
timestamp: May 15, 2022, 02:01:14 pm
content: Meanwhile, At FLIR head office...."Not again..."

author: KaneTW
author_rank: Frequent Contributor
timestamp: May 17, 2022, 05:18:12 pm
content: Quote from: agiorgitis on May 15, 2022, 01:17:06 pmTo the best of my knowledge, you can increase it to the maximum that the FPGA allows. So 640x480 for E86 and 464x348 for E76. Without reverse engineering the bitstream it's impossible to say what's exactly happening. Could be different sensors, could be a cropped sensor, could be some FPGA-side processing.

author: peppy88
author_rank: Regular Contributor
timestamp: December 30, 2022, 10:51:26 pm
content: Is there a way to view the file system on windows or Mac OS, im not familiar with linux. I've connected via the web interface (192.168.0.2) but its just the standard web interface and not the service menu

author: KaneTW
author_rank: Frequent Contributor
timestamp: December 31, 2022, 12:59:20 am
content: Some googling shows a tool calledext2readthat might work. Otherwise set up a Linux VM and use that.

author: peppy88
author_rank: Regular Contributor
timestamp: December 31, 2022, 10:39:01 pm
content: ok decided to go the linux route. How do you connect to the camera initially? Is it via the terminal and I'm guessing the camera is in RNDIS mode.

author: KaneTW
author_rank: Frequent Contributor
timestamp: January 01, 2023, 12:04:59 am
content: Just SSH into it. 'ssh fliruser@<camera address>'You can copy the relevant block devices using (off the top of my head) 'ssh fliruser@<camera address> dd if=/dev/... | dd of=dump_file' where '...' is the block device you want to copy. one of them will have the right data

author: peppy88
author_rank: Regular Contributor
timestamp: January 01, 2023, 02:18:20 am
content: ok I tried to do: ssh fliruser@192.168.0.1But I get a connection refused:ssh: connect to host 192.168.0.1 port 22: Connection refusedEdit: ok nvm I was able to connect via ssh. I was trying to connect via. RNDIS way which doesn't work. The correct way to connect is via first connecting the camera to local wifi network

author: peppy88
author_rank: Regular Contributor
timestamp: January 01, 2023, 02:41:15 am
content: ok I was able to copy one of the files using that command: ssh fliruser@192.168.51.211 dd if=/dev/mmcblk0 | dd of=/home/parallels/Desktop/dev/mmcblk0(This is taking a long time 1.7GB and counting are these suppose to be this big?)Do you have to copy all of the mmc and mtd files?These are the files I see:mmcblk0mmcblk0boot0mmcblk0boot1mmcblk0p1mmcblk0p2mmcblk0p3mmcblk0p4mmcblk0p5mmcblk0p6mmcblk0p7mmcblk0prpmbmmcblk1mmcblk1p1mtd0mtd0romtd1mtd1romtdblock0mtdblock1After I do this how do I search for my custom root hash?I understand the hash.txt part but which part of this command includes input file:hashcat.exe -m 500 -a 3 -1 ?l?u?d -O ?1?1?1?1?1?1 hash.txt

author: peppy88
author_rank: Regular Contributor
timestamp: January 01, 2023, 03:11:34 am
content: ok I think I got it. After letting the data dump run for a little I just decided to stop it.I just opened it up in a textedit and searched for $1$I found this: root:$1$ucUReizE$7BNm6Kx48Jes8UPoQKnSj1:17149:0:99999:7:::Im guessing this is it correct?

author: peppy88
author_rank: Regular Contributor
timestamp: January 01, 2023, 05:32:52 am
content: When I try to do:hashcat -m 500 -O -a 3 -1 "?l?d?u" "?1?1?1?1?1?1" /Users/kerbal/Desktop/hash.txt -D 2Hash '?1?1?1?1?1?1': Separator unmatchedNo hashes loaded.What format should the hash be in the hash.txt fileEdit:Nvm got it to work on Mac: hashcat -m 500 -O -a 3 /Users/kerbal/Desktop/hash.txt -1 "?l?d?u" "?1?1?1?1?1?1" -D 1,2

author: peppy88
author_rank: Regular Contributor
timestamp: January 01, 2023, 03:44:13 pm
content: Quote from: KaneTW on January 01, 2023, 12:04:59 amHmm After running hashcat it wasn't able to crack it using -1 "?l?d?u" "?1?1?1?1?1?1"Is it possible it is more than 6 characters?

author: KaneTW
author_rank: Frequent Contributor
timestamp: January 02, 2023, 03:23:22 pm
content: It should be 6 characters, but I've seen some examples of where it had more. That hash looks correct.I tossed it on my GPU with a larger keyspace, I'll let you know if it works.

author: peppy88
author_rank: Regular Contributor
timestamp: January 02, 2023, 05:24:25 pm
content: ok I tried both 6 and 7 characters using hashcat.Even with 8 GPUs would take 21 days. Have you seen examples of 8 characters. I don't really want to run this and waste electricity if its longer.Code:Session..........: hashcatStatus...........: RunningHash.Mode........: 500 (md5crypt, MD5 (Unix), Cisco-IOS $1$ (MD5))Hash.Target......: $1$ucUReizE$7BNm6Kx48Jes8UPoQKnSj1Time.Started.....: Mon Jan 02 12:28:00 2023 (13 secs)Time.Estimated...: Tue Jan 24 05:17:33 2023 (21 days, 16 hours)Kernel.Feature...: Optimized KernelGuess.Mask.......: ?1?1?1?1?1?1?1?1 Guess.Charset....: -1 ?l?d?u, -2 Undefined, -3 Undefined, -4 UndefinedGuess.Queue......: 1/1 (100.00%)Speed.#1.........: 21192.4 kH/s (14.37ms) @ Accel:64 Loops:62 Thr:1024 Vec:1Speed.#2.........: 22862.3 kH/s (2.61ms) @ Accel:128 Loops:15 Thr:512 Vec:1Speed.#3.........: 15961.3 kH/s (10.56ms) @ Accel:64 Loops:62 Thr:1024 Vec:1Speed.#4.........: 16659.8 kH/s (10.08ms) @ Accel:1024 Loops:62 Thr:64 Vec:1Speed.#5.........: 14052.0 kH/s (9.89ms) @ Accel:1024 Loops:62 Thr:64 Vec:1Speed.#6.........: 10304.9 kH/s (4.87ms) @ Accel:512 Loops:62 Thr:64 Vec:1Speed.#7.........: 7741.6 kH/s (10.23ms) @ Accel:256 Loops:62 Thr:256 Vec:1Speed.#8.........: 7604.7 kH/s (10.44ms) @ Accel:256 Loops:62 Thr:256 Vec:1Speed.#9.........: 75000 H/s (7.05ms) @ Accel:128 Loops:62 Thr:8 Vec:4Speed.#*.........: 116.5 MH/sRecovered........: 0/1 (0.00%) Digests (total), 0/1 (0.00%) Digests (new)Progress.........: 1518272512/218340105584896 (0.00%)Rejected.........: 0/1518272512 (0.00%)Restore.Point....: 0/3521614606208 (0.00%)Restore.Sub.#1...: Salt:0 Amplifier:51-52 Iteration:930-992Restore.Sub.#2...: Salt:0 Amplifier:5-6 Iteration:690-705Restore.Sub.#3...: Salt:0 Amplifier:7-8 Iteration:930-992Restore.Sub.#4...: Salt:0 Amplifier:10-11 Iteration:992-1000Restore.Sub.#5...: Salt:0 Amplifier:12-13 Iteration:744-806Restore.Sub.#6...: Salt:0 Amplifier:23-24 Iteration:992-1000Restore.Sub.#7...: Salt:0 Amplifier:8-9 Iteration:992-1000Restore.Sub.#8...: Salt:0 Amplifier:7-8 Iteration:992-1000Restore.Sub.#9...: Salt:0 Amplifier:18-19 Iteration:558-620Candidate.Engine.: Device GeneratorCandidates.#1....: F9rC4523 -> FDioMANACandidates.#2....: aBQYFONA -> aQawTONACandidates.#3....: pz3ILANA -> prLuyaneCandidates.#4....: ddmcYONA -> dKDpQW12Candidates.#5....: rSQyxy12 -> rZ3dCANACandidates.#6....: 9XafTY12 -> 9wtyFESSCandidates.#7....: lGiFzone -> lUsOVANACandidates.#8....: plLuyane -> pCkAUANACandidates.#9....: nv4H5434 -> nM5YorinHardware.Mon.#1..: Temp: 47c Fan:100% Util: 99% Core:1305MHz Mem:9501MHz Bus:1Hardware.Mon.#2..: Temp: 43c Fan: 95% Util: 93% Core:1845MHz Mem:9251MHz Bus:1Hardware.Mon.#3..: Temp: 43c Fan: 95% Util: 99% Core:1785MHz Mem:6800MHz Bus:1Hardware.Mon.#4..: Temp: 43c Fan: 90% Util: 96% Core:1935MHz Mem:6800MHz Bus:1Hardware.Mon.#5..: Temp: 37c Fan: 95% Util: 98% Core:1920MHz Mem:6800MHz Bus:1Hardware.Mon.#6..: Temp: 37c Fan: 95% Util: 96% Core:1972MHz Mem:7300MHz Bus:1Hardware.Mon.#7..: Temp: 38c Fan: 95% Util: 98% Core:1950MHz Mem:6801MHz Bus:1Hardware.Mon.#8..: Temp: 38c Fan: 95% Util: 98% Core:1860MHz Mem:6801MHz Bus:1Hardware.Mon.#9..: N/A

author: KaneTW
author_rank: Frequent Contributor
timestamp: January 02, 2023, 06:09:13 pm
content: I've only seen 7. Maybe special characters?

author: peppy88
author_rank: Regular Contributor
timestamp: January 02, 2023, 06:10:25 pm
content: Ok yeah good point. Let me try running 6 and 7 again with special charsAlso I wonder if it is worth trying to figure out the service password. That hash is common across a lot of the models. T5xx and A4xx, A7xx etc.I know bcrypt is slower to crack but if we make assumptions that it is only lowercase or something simple it maybe possible? After all admin was admin etc hahaP.S. Im running my hash again with 6 characters in hashcat. But this time with special characters "?a". Hopefully this is it, fingers crossed

author: KaneTW
author_rank: Frequent Contributor
timestamp: January 02, 2023, 06:22:59 pm
content: I thought about cracking the service password but it's much harder. I've done some back of the napkin math and you can probably get decent speeds if you do it on a modern FPGA, but that requires time to code the gateware that I don't have.

author: peppy88
author_rank: Regular Contributor
timestamp: January 02, 2023, 08:01:16 pm
content: Darn looks like it definitely not 6 characters:Code:Session..........: hashcatStatus...........: ExhaustedHash.Mode........: 500 (md5crypt, MD5 (Unix), Cisco-IOS $1$ (MD5))Hash.Target......: $1$ucUReizE$7BNm6Kx48Jes8UPoQKnSj1Time.Started.....: Mon Jan 02 13:18:45 2023 (1 hour, 43 mins)Time.Estimated...: Mon Jan 02 15:01:47 2023 (0 secs)Kernel.Feature...: Optimized KernelGuess.Mask.......: ?1?1?1?1?1?1 Guess.Charset....: -1 ?a, -2 Undefined, -3 Undefined, -4 UndefinedGuess.Queue......: 1/1 (100.00%)Speed.#1.........: 20528.4 kH/s (2.58ms) @ Accel:8 Loops:250 Thr:1024 Vec:1Speed.#2.........: 24639.7 kH/s (9.96ms) @ Accel:512 Loops:62 Thr:128 Vec:1Speed.#3.........: 15861.2 kH/s (7.47ms) @ Accel:32 Loops:250 Thr:512 Vec:1Speed.#4.........: 16485.3 kH/s (0.86ms) @ Accel:256 Loops:62 Thr:256 Vec:1Speed.#5.........: 14038.4 kH/s (3.54ms) @ Accel:64 Loops:250 Thr:256 Vec:1Speed.#6.........: 10425.0 kH/s (7.02ms) @ Accel:32 Loops:250 Thr:512 Vec:1Speed.#7.........: 7515.6 kH/s (1.89ms) @ Accel:128 Loops:125 Thr:256 Vec:1Speed.#8.........: 7559.4 kH/s (1.91ms) @ Accel:128 Loops:125 Thr:256 Vec:1Speed.#9.........: 75364 H/s (1.46ms) @ Accel:128 Loops:62 Thr:8 Vec:4Speed.#*.........: 117.1 MH/sRecovered........: 0/1 (0.00%) Digests (total), 0/1 (0.00%) Digests (new)Progress.........: 735091890625/735091890625 (100.00%)Rejected.........: 0/735091890625 (0.00%)Restore.Point....: 7729905664/7737809375 (99.90%)Restore.Sub.#1...: Salt:0 Amplifier:94-95 Iteration:750-1000Restore.Sub.#2...: Salt:0 Amplifier:94-95 Iteration:992-1000Restore.Sub.#3...: Salt:0 Amplifier:94-95 Iteration:750-1000Restore.Sub.#4...: Salt:0 Amplifier:94-95 Iteration:992-1000Restore.Sub.#5...: Salt:0 Amplifier:94-95 Iteration:750-1000Restore.Sub.#6...: Salt:0 Amplifier:94-95 Iteration:750-1000Restore.Sub.#7...: Salt:0 Amplifier:94-95 Iteration:875-1000Restore.Sub.#8...: Salt:0 Amplifier:94-95 Iteration:875-1000Restore.Sub.#9...: Salt:0 Amplifier:94-95 Iteration:992-1000Candidate.Engine.: Device GeneratorCandidates.#1....: ^O(}? -> ~}~}Candidates.#2....: lEyZ| -> iw'<~Candidates.#3....: J@=`} -> BAX}?Candidates.#4....: H*Y|~ -> ~89}?Candidates.#5....: .@%~} -> [S,~}Candidates.#6....: DAX}? -> L;?'~Candidates.#7....: AJP?} -> fRt ~Candidates.#8....: U5q~} -> Sv*|~Candidates.#9....: 4R(q} -> W.!{~Hardware.Mon.#1..: Temp: 47c Fan:100% Util: 0% Core: 0MHz Mem: 405MHz Bus:1Hardware.Mon.#2..: Temp: 54c Fan: 95% Util: 79% Core:1950MHz Mem:9251MHz Bus:1Hardware.Mon.#3..: Temp: 49c Fan: 96% Util: 0% Core: 210MHz Mem: 405MHz Bus:1Hardware.Mon.#4..: Temp: 49c Fan: 90% Util: 0% Core: 210MHz Mem: 405MHz Bus:1Hardware.Mon.#5..: Temp: 44c Fan: 95% Util: 0% Core: 210MHz Mem: 405MHz Bus:1Hardware.Mon.#6..: Temp: 49c Fan: 96% Util: 0% Core: 210MHz Mem: 405MHz Bus:1Hardware.Mon.#7..: Temp: 50c Fan: 95% Util: 0% Core: 300MHz Mem: 405MHz Bus:1Hardware.Mon.#8..: Temp: 45c Fan: 96% Util: 0% Core: 300MHz Mem: 405MHz Bus:1Hardware.Mon.#9..: N/AStarted: Mon Jan 02 13:18:30 2023Stopped: Mon Jan 02 15:01:49 2023I'm gonna try 7. Are there any special characters I can omit. Seems like ?a option has a few that won't be used? (Otherwise it will take 7 days using my setup)

author: KaneTW
author_rank: Frequent Contributor
timestamp: January 02, 2023, 08:10:33 pm
content: Yeah, I think stuff like " " can be omitted. I tried to find the generation script but it seems like it's just a file on the EEPROM.What model do you have?

author: KaneTW
author_rank: Frequent Contributor
timestamp: January 02, 2023, 08:11:18 pm
content: One thing that could be doable is just replacing the hash with a custom one. It'd be an issue if you need to send it in for repair and their root password doesn't work, though.

author: peppy88
author_rank: Regular Contributor
timestamp: January 02, 2023, 08:20:20 pm
content: Oh interesting. Didn’t know u could just use a custom hash. How does that work? If the hash can be modified, could you just put back the original hash when done?Also I have a T530

author: KaneTW
author_rank: Frequent Contributor
timestamp: January 02, 2023, 08:35:11 pm
content: I'm not sure how to do it safely, actually. Would have to dig into it. The naive way would be to just directly replace the string with an equal length one, but I'm not sure if the filesystem would like that.T530 was the camera that someone reported a 7 character password on, but it was alphanumeric.

author: peppy88
author_rank: Regular Contributor
timestamp: January 02, 2023, 08:40:32 pm
content: Quote from: KaneTW on January 02, 2023, 08:35:11 pmOh interesting. If the password is alphanumeric, wouldn't my hashcat with 7 chars using ?l?d?u would have worked?If it is indeed 7 characters I might just do the 7 days of hashing on ?a. Gotta calculate how much electricity I will burn tho haha.(Command I will use: hashcat.exe -m 500 -a 3 hashMD5.txt -O -1 ?a ?1?1?1?1?1?1?1 )

author: KaneTW
author_rank: Frequent Contributor
timestamp: January 02, 2023, 09:57:32 pm
content: Yeah, the ?l?d?u 7-character should've worked. Weird that it didn't.

author: peppy88
author_rank: Regular Contributor
timestamp: January 02, 2023, 10:02:56 pm
content: yeah it was a bummer. My hope is that this next run with hashcat will work. Since im doing 7 char ?a . If that doesn't work then I might just call it quits haha. I dont even want to know how long an 8character one would take with special characters

author: KaneTW
author_rank: Frequent Contributor
timestamp: January 02, 2023, 10:08:49 pm
content: Quote from: peppy88 on January 02, 2023, 10:02:56 pmI'd just do 8 character alphanumeric if special doesn't work.

author: peppy88
author_rank: Regular Contributor
timestamp: January 02, 2023, 10:50:25 pm
content: Quote from: KaneTW on January 02, 2023, 10:08:49 pmK sounds good. Do we know what type of system this is? According to this:https://serverfault.com/questions/129137/what-is-the-longest-password-for-sshsome systems only look at the first 8 characters of the password.

author: KaneTW
author_rank: Frequent Contributor
timestamp: January 03, 2023, 12:16:19 am
content: The MD5 hash can theoretically be any length, it isn't truncated. It's just not super likely that a password required for service access is long.

author: peppy88
author_rank: Regular Contributor
timestamp: January 11, 2023, 08:57:28 pm
content: ok I got a E75 on my hands and was able to crack the hash. It was 6 char ?l?d?u. So it is looking more and more likely that the EXX series is for sure a 6 character password for root.Also can you just ssh into it to download and change the users.db file or do you have to use the web socket way. I am not sure how to do thatspecifically this part:Code:LD_LIBRARY_PATH=/FLIR/usr/lib PATH=/usr/local/bin:/usr/bin:/bin:/usr/local/sbin:/usr/sbin:/sbin:/home/root/bin:/FLIR/usr/bin sh /FLIR/usr/Service/scripts/start_service_socket.shI was able to download the conf.cfc from /FLIR/system/appcore.d/config.d/conf.cfc using scpI used the two decrypt and reencrypt scripts to create a new conf.cfcIs this the only file I need to update in order to change the resolution?Will I be able to ssh back into here if things don't go right and need to replace it with the original conf.cfc?

author: peppy88
author_rank: Regular Contributor
timestamp: January 12, 2023, 04:00:02 pm
content: Quote from: KaneTW on February 24, 2022, 11:36:19 pmCan these entries just be added to the config and work? Are there no additional files needed from a T-series camera?P.S. I tried hascat on a T1020's root hash and got the same results. as the T530. They both do not use a 6 or a 7 char alphanumeric pass. Looking more and more likely it is 8 character or even possibly something else.It looks like an unlocker tools exist for at least the C5. I wonder what is in this tool that allows it to set the root to "Opened":https://github.com/flir-cx/flir-yocto-documentation/blob/master/unlock_tool.md

author: peppy88
author_rank: Regular Contributor
timestamp: January 12, 2023, 06:34:48 pm
content: @KaneTW Also is there a way to check if the patch was successful? for the libcommon.so file? it ran and outputted the file.In case I need to revert will I still be able to connect to the camera via ssh

author: Bud
author_rank: Super Contributor
timestamp: January 12, 2023, 09:15:32 pm
content: Quote from: KaneTW on January 03, 2023, 12:16:19 amNo password in service mode may be required at all, if there is a service connector on a camera, access to which may be somewhere under the cover. I recall this was my conclusion after analysis of E4. Password is bypassed by pulling one of the pins on the connector to ground or Vcc (cant remember the level).

author: peppy88
author_rank: Regular Contributor
timestamp: January 12, 2023, 09:28:57 pm
content: Quote from: Bud on January 12, 2023, 09:15:32 pmWhat does the service connector look like?And that is very interesting. After pulling the connector to ground/vcc, how does that bypass the password? Also would you just login to the same service portal via ip?

author: Bud
author_rank: Super Contributor
timestamp: January 12, 2023, 11:17:53 pm
content: There was a check in the firmware. It made a call to an I/O routine which returned a value, and the firmware examined one of the bits. If it was set, the firmware made a jump bypassing password check. The connector i believe was a Molex type, the early E4 thread may had a photo of it. But that was before WiFi models appeared. Maybe the purpose of the connector was initial programming or factory calibration, noone knows.

author: peppy88
author_rank: Regular Contributor
timestamp: January 13, 2023, 12:44:33 am
content: Quote from: Bud on January 12, 2023, 11:17:53 pmI wonder if the connector on the right is it. I've seen it on other models too. The bottom middle connector is just for the keypad and the top one is for the screen. Left JST connector is for microphone and right JST is for speaker.

author: peppy88
author_rank: Regular Contributor
timestamp: January 20, 2023, 05:18:16 pm
content: Quote from: KaneTW on January 03, 2023, 12:16:19 amHey just following up on this. Is the libcommon.so and conf.cfc the only two files you need to upgrade it? If so can you still access the camera via ssh if it doesn't boot properly. Wanted to figure that out before I tried uploading the files.

author: KaneTW
author_rank: Frequent Contributor
timestamp: January 20, 2023, 06:03:36 pm
content: Sorry, missed the earlier post.libcommon.so and conf.cfc are the only two files, and it shouldn't affect SSH access if it's broken. I've had a broken conf.cfc before and it just loaded a default setting. Not sure about libcommon.so, but it should still start SSH.

author: peppy88
author_rank: Regular Contributor
timestamp: January 20, 2023, 06:05:26 pm
content: alright thanks ill test it out later.

author: agiorgitis
author_rank: Regular Contributor
timestamp: January 21, 2023, 11:46:07 am
content: Watching carefully for the outcome peppy88, I have E75, let's see if it works for resolution upgrade...

author: agiorgitis
author_rank: Regular Contributor
timestamp: January 21, 2023, 10:57:43 pm
content: Hey Kane, I tried doing some testing with the conf.cfc file, but although it decrypts fine (I had tried that in the past), it doesn't seem to encrypt it back properly. The camera does not recognize it and reverts to a default one (it has only some palletes and no MSX, etc)Strange thing is that when I decrypt it to a txt file, on the bottom I see this:Are those boxes supposed to be CRs? In your comment for the decrypt script you mention CRC32, but here it says CRC05. Does it have to do anything with this?I even tried conf.cfc > decrypt to conf.txt > don't even touch the txt file > encrypt conf.txt to conf.cfc > replace file in camera. Not recognized by camera (E75).

author: agiorgitis
author_rank: Regular Contributor
timestamp: January 22, 2023, 10:01:02 am
content: Also while running the libcommon py script, it comes back with an error:line 35, in <module>func[match.end() - 8 : match.end() - 4] = b'\x01\x00\xa0\xe3'AttributeError: 'NoneType' object has no attribute 'end'

author: Bud
author_rank: Super Contributor
timestamp: January 22, 2023, 03:44:47 pm
content: Make sure you use same version of Python which was used to make the script

author: agiorgitis
author_rank: Regular Contributor
timestamp: January 22, 2023, 06:25:14 pm
content: Quote from: Bud on January 22, 2023, 03:44:47 pmThanks Bud, I'm using same version as Kane but no luck, still the same message.installed version 3.8 (3.8.10 to be exact)

author: Bud
author_rank: Super Contributor
timestamp: January 22, 2023, 07:05:06 pm
content: Then it could be your version of the libcommon is different and the script is not finding a match (line 33).You can load the file into a Hex editor and search for a match yourself, then update it manually.

author: KaneTW
author_rank: Frequent Contributor
timestamp: January 22, 2023, 08:41:24 pm
content: Quote from: agiorgitis on January 22, 2023, 10:01:02 amThis sounds like it failed to find a match. You'll have to find the relevant spot manually.

author: KaneTW
author_rank: Frequent Contributor
timestamp: January 22, 2023, 08:43:42 pm
content: Quote from: agiorgitis on January 21, 2023, 10:57:43 pmCRC05 is just a FLIR-internal tag. The problem is likely the failed libcommon.so patch

author: agiorgitis
author_rank: Regular Contributor
timestamp: January 26, 2023, 08:28:52 pm
content: Guys is it possible that you could help me? I tried a Hex editor but I have no clue what I'm looking forThat's my file (remaned from .so) what are the changes I should make the the py script?Thanks a lot

author: KaneTW
author_rank: Frequent Contributor
timestamp: January 26, 2023, 10:00:47 pm
content: Replace the string in line 33 with b'\x14\x30\x9D\xE5\x01\x00\x44\xE2\xAC\x25\x9D\xE5\x10\x0F\x6F\xE1\xA0\x02\xA0\xE1\x00\x30\x93\xE5'(Method: open libcommon.so in decompiler of your choice, go to _Zn4Cfc... (string in line 21), find where the return value is set, make sure it's 1. In this case I just changed the search string so it matches another mov r0, ... instruction that sets the retur nvalue)

author: agiorgitis
author_rank: Regular Contributor
timestamp: January 27, 2023, 05:06:11 pm
content: Ok thanks!Unfortunately it's not working... The script works and created the new .so file, but now the camera does not boot upI guess that i'll have to now research how to put the original .so file in the camera, apart from wifi.Any ideas?

author: agiorgitis
author_rank: Regular Contributor
timestamp: January 28, 2023, 07:44:23 am
content: Alright, I managed to revert back to my firmware by loading the update folder in my SD card and placing the update.ful in SD root.A strange thing I noticed was that after the update it has kept my altered conf file, so it booted with the backup settings. I placed the original conf in the folder but it got deleted after the reboot, and my altered was placed in the folder again.So I fooled it by placing my original conf in the folder and doing another firmware update.Now everything is back to normal, ready to mess around again

author: KaneTW
author_rank: Frequent Contributor
timestamp: January 28, 2023, 03:35:20 pm
content: Quote from: agiorgitis on January 27, 2023, 05:06:11 pmHm, interesting. Here's the manually patched file. If it fails again, can you ssh into it and look for logs?

author: agiorgitis
author_rank: Regular Contributor
timestamp: January 28, 2023, 05:18:59 pm
content: i looked at your version and it's the same as mineOriginal : 14 30 9D E5 01 00 44 E2 AC 25 9D E5 10 0F 6F E1 A0 02 A0 E1 00 30 93 E5Becomes: 14 30 9D E5 01 00 44 E2 AC 25 9D E5 10 0F 6F E101 00 A0 E300 30 93 E5At offset 99DC0, 99DD0If the above is correct, it may be because I also replaced the altered conf file too?(I changed the resolution in it)Upon boot there was the FLIR image and then black screen, no focus motor moves as it normally does. So I don't think it was even reaching to the point to load the conf file.PS1: From _ZN4CCfc how do you end up on the above hex places?PS2: Where can I find the logs? (to speed up my search process)

author: Bud
author_rank: Super Contributor
timestamp: January 28, 2023, 05:28:25 pm
content: Quote from: agiorgitis on January 28, 2023, 07:44:23 amYou should have used a cold boot with the battery removed for 20 sec.

author: KaneTW
author_rank: Frequent Contributor
timestamp: January 28, 2023, 06:06:55 pm
content: Quote from: agiorgitis on January 28, 2023, 05:18:59 pmUh it's been a while, /var/log somewhere usually. Maybe also post an output of "ps ax"I just open up the file in IDA and see what assembly line to change to make it always succeed.

author: insinion
author_rank: Newbie
timestamp: April 18, 2023, 01:16:22 pm
content: Hello. Sorry for not writing on topic. I'm new here and don't quite understand how to post my question on the forum. Please tell me if you can help me. I have Flir E86. When I turn it on, why do I have a logo on the screen, a loading animation on the black screen and nothing else happens? It won't load further. The firmware has been updated, the memory card is working. Batteries are fully charged. Thanks in advance for your understanding and reply.

author: _Wim_
author_rank: Super Contributor
timestamp: April 18, 2023, 05:46:02 pm
content: Quote from: insinion on April 18, 2023, 01:16:22 pmPlease don't double post, this is considered not polite. Did you try to remove the battery and reinstall it to ensure it fully boots from zero?

author: KaneTW
author_rank: Frequent Contributor
timestamp: April 19, 2023, 01:32:48 am
content: Quote from: insinion on April 18, 2023, 01:16:22 pmIs this a stock device? Have you performed a factory reset?Hard to know what's happening without logs.

author: aproape
author_rank: Newbie
timestamp: July 30, 2023, 05:57:35 pm
content: Good morning KaneTW!Great work - thanks for the info - I just purchased a sh E54 and I'm ready to try and liberate it..Can you post again your de-crypt / re-encrypt scripts?I believe the pastebin links no longer works..Thank you - I'll keep you updated on progress on my end.Cheers,aproape

author: KaneTW
author_rank: Frequent Contributor
timestamp: July 31, 2023, 12:12:07 am
content: These should work. I'm not sure if they're the exact same as the ones I uploaded last time, though.

author: aproape
author_rank: Newbie
timestamp: July 31, 2023, 04:10:51 am
content: Thanks!I'll keep you posted on the progress.The salty hash I have is $1$X.SORnX.$Pk2brCZWqimHPBeiyNPsy/(initial attempt with 6 alphanumeric didn't seem to work)Cheers,aproape

author: aproape
author_rank: Newbie
timestamp: July 31, 2023, 04:15:47 am
content: Quote from: KaneTW on February 25, 2022, 03:51:20 amWould a similar dump from an E54 help? (it's still listed as current model / should be more in line with E76/E86/E96.. )

author: KaneTW
author_rank: Frequent Contributor
timestamp: July 31, 2023, 05:45:00 pm
content: Quote from: aproape on July 31, 2023, 04:15:47 amThe E76+E86 likely share a 17um pitch sensor (probably an ULIS UL 04 27 2), while the E96 has a 12um pitch sensor (probably i3system DB640-12C-A). I haven't taken it apart so I don't know for sure, but someone DM'd me those specs last year. This means that it's not possible to use the full 640x480 resolution without prohibitive reverse engineering efforts, and even then it might be occluded by the hardware design (12um 640x480 is a smaller optical window than 17um 640x480, but the two systems share lenses => 17um will have clipped or distorted peripheral image at full resolution)

author: Spirit532
author_rank: Frequent Contributor
timestamp: August 06, 2023, 06:31:40 am
content: Quote from: KaneTW on July 31, 2023, 05:45:00 pmFLIR manufactures their own sensors.The entire E7x and E8x series shares the same 640x480 sensor.

author: KaneTW
author_rank: Frequent Contributor
timestamp: August 07, 2023, 09:17:19 pm
content: Quote from: Spirit532 on August 06, 2023, 06:31:40 amIf you check the datasheet, E76+E86 have a 17um pitch sensor. E96 has a 12um sensor.

author: aproape
author_rank: Newbie
timestamp: September 23, 2023, 07:29:32 pm
content: Good morning everyone,I have recently added to my Flir stable the E96 (I know, I know.. )If someone needs anything extracted from it - let me know (-:Cheers,aproape

author: tcq1000
author_rank: Contributor
timestamp: November 08, 2024, 12:22:03 pm
content: FLIR T1010 adopts an architecture similar to E76. Although it has WiFi hardware, the connection button is gray and cannot enable WiFi. It is connected to a PC via USB, which is UVC. How can it be connected to read internal files?

author: adranp
author_rank: Regular Contributor
timestamp: January 29, 2025, 10:21:41 am
content: Hi everyone..I'm the new owner of a E76 camera. Got it with 7.33.86 firmware. Seems like the fliruser has different pass.Does anyone has the new pass? I was thinking of you guys who already rooted the cameras if you have upgraded the firmware to newer releases and can look into the fliruser new pass?Or if anyone has an older firmware version and is kind enough to post it somewhere I would be grateful.Thanks in advance.

author: adranp
author_rank: Regular Contributor
timestamp: February 01, 2025, 11:32:47 am
content: It seems last time I tried i did something wrong. I can confirm that the fliruser has the same pass with fw 7.33.86 -> 3vlig

author: adranp
author_rank: Regular Contributor
timestamp: February 10, 2025, 02:04:48 am
content: Managed to get root, but struggling with the SUID. Assumed it's the serial number but I could not decrypt the .cfc file. Anyone able to help with some advices? Thanks in advance.

author: 2h2o
author_rank: Newbie
timestamp: February 17, 2025, 03:12:27 pm
content: It seems that you can get it directly by typing the SUID command in cmd.

author: 2h2o
author_rank: Newbie
timestamp: February 17, 2025, 03:19:39 pm
content: Hi all, I'm new here, does anyone know what's wrong with my libcommon_dll.so file? why can't I modify it when I use the script as instructed? is it possible for Flir to change to a new validation mechanism?

author: adranp
author_rank: Regular Contributor
timestamp: February 17, 2025, 05:48:54 pm
content: :2h2oMany thanks for the suggestion. It is working with suid command and the decryption scripts from :KaneTWRegarding the libcommon_dll.so question. I'm not aware of any script for changing this file. It was probably decompiled with IDA and then changed directly in the file. There is a discussion regarding the pattern which you should look for.The decryption/encryption scripts are for the .cfc files where the configuration resides.Now that I have the configuration files decrypted I'm going to go further and look into replacing this libcommon_dll.so file.In the firmware I've got -> 7.33.86 many files seem to have changed location. There is no /FLIR/usr/Service/scripts/start_service_socket.sh for example. Also no web application which :KaneTW already mentioned at some point. I'm trying to figure out from which Axxx files I can get it "grabbing it from Axxx and decrypting it, then `opkg install` the .opk as root."Also of interest would be which settings did you change to liberate it in conf.cfc. From what I see there are just 2 lines of interest ->.caps.config.image.settings.IRheight int32 240.caps.config.image.settings.IRwidth int32 320If anyone can help with some directions I would be very grateful.

author: mikhail076
author_rank: Contributor
timestamp: March 14, 2025, 01:18:21 pm
content: Hi all.I have several older firmwares.PM to me if anyone needs it.

author: tske
author_rank: Regular Contributor
timestamp: March 14, 2025, 04:39:31 pm
content: Anyone have tear down photos?