Flir T3xx\T4xx\B3xx\B4xx un-brick + semi-hack - Page 1
Forum section: electronics / general

author: arttdat
author_rank: Newbie
timestamp: May 19, 2024, 12:20:43 pm
content: First of all, although not tested, but most of what is written below should theoretically apply to Flir T3xx/T4xx/B3xx/B4xx family of cameras as well.Some of the methods probably expand even beyond that, as per my understanding, large array of Flir cameras share similarities in SW part.Initial issueI had a Flir T335 camera which suddenly stuck on boot, no GUI available, buttons besides power are unresponsive.RNDIS connection worked, so upon investigation i had determined, that whole flash storage died suddenly, most probably partition corrupted along with whole FlashFS folder.You can easily check if that is the case for your issue as well by runningCode:diskutil -Lin the console. If you see, and specifically:No partitions found on "DSK1:"!, well my condolences to your GUI file system.Fixing attemptsYou could try to use update files from the Flir website, using FLIRInstallNet, or copying FlashFS manually trough FTP, but ultimately it wont give much.As the FlashFS folder is being created after startup, it will be created in volatile storage - RAM, which means that any changes made to the file system will be lost on power-off.Nevertheless, even if you do so, Flir update files do not contain crucial sensor specification data which the appcore requires to properly initialize. They are only designed to be update to the existing FlashFS file system.You will have the GUI, and even the Service menu, but it will be unusable, so no calibration could be done.Repairing procedure1. RepartitioningFlowing applies to those cases where you haveNOFlashFS folder, or it is empty, otherwise following procedures listed below can make itworsefor you. If you still suspect some partitioning issue, backup that FlashFS folder before wiping.So first of all, check if you have the "DSK1:" at all, if you also have SD card inserted, it should read as "DSK2:"If youdon'thave "DSK1:" (Intel Virtual File System),do notfollow next steps, you probably have HW issues at this point, and you only will nuke your SD card.If "DSK1:" is there, do a full low-level format:Code:diskutil -F DSK1: -lThen make sure that youdo nothave the FlashFS folder, like left over from previous attempts or installs of updates.If it's there, delete it.Then make a new partition:Code:diskutil -C DSK1: -p Part00 -x 88600(88600 is the partition size, if you have larger or smaller size, adjust accordingly, check "Biggest Partition Creatable (sectors)" in diskutil for DSK1)Restart the camera by entering "restart"Upon booting run theCode:diskutil -Lagain. If above steps were successful, that newly created partition should be mounted as FlashFS, and diskutil should look something like that:If you are here, congratulations, easy step is done2. Diagnosing severitySo now that the easy part is done, we need to rebuild the file system.This step could vary for some people, as if you have at least part of the FlashFS, you could just recalibrate it yourself and possibly have a working camera again.Now run the update using update files from the Flir website by FLIRInstallNet, or extracting FlahsFS from update file and copying FlashFS manually trough FTP.If you had some backups or parts of the system, copy them to FlashFS folder afterwards.Restart the camera, check that all you files are still there, then we can continue.Now we check on how dire is the situation, activate the service mode in Service menu, or run a command:Code:rset prod.preparation.command restartHighResIf its nagging about bad command, or unavailability of server, runCode:start restartapp.batThen after everything is started, you can check for prodapp and appcore process by:Code:psIf appcore or prodapp is not starting at all, well you have some deeper issue, check the logs in \Temp or \FlashFS\tmp\prod.log or \FlashFS\tmp\cmd.out.If you have successfully entered service mode (check in web server or by running: "rls prod.preparation"), observe how your camera is behaving, if you have thermal image, congrats, you probably only will need to recalibrate and do other setups in the Service menu, I wont be going into that, as I'm not an expert in it.But if you don't see any usable image, thats far more serious.As a possibly useful side step of diagnostics, you can try to force visual stream to the display:Code:rset image.services.channel.active VISUALrset image.services.channel.commit trueIn my case it showed a working camera (the normal one, not IR).3. Rebuilding FlashFSSo now if you are here, that's bad news.The only way of repairing the FlashFS is to search the internet for backup files or full system images (I assume that any T3xx/T4xx/B3xx/B4xx will do, but you can expect some manual tuning of the files and settings).I can't be going into details, but can generally describe that process as "poke and see", by constantly consulting with the log and changing stuff.Possibly, to be on a safe side, you will need to update EEPROM data accordingly to the backup files.That's done in Service menu, password: 1235Also if you see "No \FlashFS\system\prodresult.rsc found", don't worry about it, it's not required.

author: arttdat
author_rank: Newbie
timestamp: May 19, 2024, 12:30:21 pm
content: Now, during my investigation I found an array of potentially useful commands as well as hacky workarounds that one could use in various debugging or configuration situations.►prodappcommands:(use by setting command variable for example: "rsetprod.calib.commandinit")prod.calib.commandnopinitsetCasesetLensCasesetCaseExsetLensCaseExmeasurecalcRBFcalcRBFZaiminitProtoprotMeasuresaveProtologResultsfocusFarfocusSavefocusRestoreaimzcheckBBprod.map.commandnopinitsetCaseExsetLensCaseExgainMapgainDeadMapautoGainMapautoBgMapkillSpatImgkillSpatGainkillTempoImgkillTempoLongkillSlowkillDynkillAllGainkillAllGainEkillPixkillColumnkillRowautoColumnautoRowcheckMapcheckMapNoSpecspecPixKilllogResultslogDosResultssaveGainMapsaveDeadMapmeasColdImagemeasWarmImagemakeMapInfomeasColdImageMpmeasWarmImageMpsaveCrsMapnucdeleteMapskillUnLinreplaceKilledsaveCalibprod.measure.commandnopinitaverageImagecalcResponsestartGrabstopGrabprod.netd.commandnopinitspatialtemporaltotalfileSpatialfileTemporalfileTotaltempoFilterbilateralFilteredgeFiltersetNoisespecOperationlogResultslogDosResultsspatFiltercolumnFiltersetSpanprod.onchip.commandnopinitcollectselectcoarseMapsimpleMaplogResultsfindRMfindOAresponseColdresponseWarmcalcIntTimecalcDuWm2findKOAfindOffsetcalcRmTresponseColdZprod.preparation.commandnopinitsetDateTimestopguipowerOffprodResultssaveProdStatecheckProdStatesetTorrentErrclearUploadedrestartHighResrestartReconfigcheckPowerDownevalprod.syscalib.commandnopinitselCasesaddLensCasesmeasureclearAllSeladdOneBBdelOneBBretrRBFcondcalcRBFgetVersionsactiSavesavediscardswitchaccInitaccSelaccMeasaccSaveaimaimDonealignFaralignNearalignStorealignInitfusionlaserInitlaserFarlaserNearlaserStorefocusfocusFarfocusNearfocusStorefocusDistfocusAutologAlignResultssetLensDistprod.tdrift.commandnopinitstartstopstoreImagerefLogLinenucnearReferencereferencemakeBGMapsstoreRawImagedosCollectImagelogResultsfirstRefnextReffirstShutterMapnextShutterMapsaveShutterMapshutterMapHTprod.ulisDos.commandnopinittecLoglogResultsfindVskstoreRawImagecalcGainDeadMapcalcRBFcalcRTVBB35CcalcDynRangecalckVskcheckVskupdateAtpInfostateColdstateWarmmemTest►Some useful launch keys:supv[-p port] [-l] [-a] [-m <msg>] [-k] [stop|start|unload]-l list libraries as well as tasks-a list applications as well as tasks-m send message to progress app, prefix with '#' or '!'-k kill progress appAppCore[-p <port>] [-r item] [-t] [-v]-p local port (default 0x%04x)-r remove  from startup-t disable FMP, use only TCP-v verbose supv (debug)ProdApp[-n <name>] [-p <port>] [-a <addr>] [-s <port>] [-v]-n local name (default %s)-p local port (default 0x567B)-a server addr (default 127.0.0.1)-s server port (default 0x5678)-t <use FMP> If -t 1, use FMP for interprocess comm. Defaults to 0-v verbose supv (debug)Especially useful might be the -vkeys, as in the process of initialization they will generate more information, both in the console output and in logs.Also you can unpack my scriptrestartappVerb.7zto the FlashFS or any other directory, upon running it, it will kill currently opened instances of prodapp and appcore and restart them in verbose mode.►Service menuWhile I was tinkering with the SW guts of the camera, I noticed that no matter which password I try, I couldn't get into the Service menu whatsoever.None of the passwords that can be found on this forum or the internet seems to be working.There could be several problems that could lead to that, and here are few interesting ways of mitigating that issue:Try to run "start \FlashFS\system\defaultusr.exe".As i discovered, sometimes the "flir" user is not being set up during boot time, and you wont be able to log in.Use commands provided above, as they are basically the same stuff (but slightly more advanced) that is in that Service menu.httpd service running in Windows part of the SW only restricts entry to specific part of the web server, which is "http://_CAMERA_IP_/service/",but if we were to make a copy of it, altering internal links, there is no restriction on a different nameNot sure how it works on a different family of Flir, you probably will need to make your own out of "service" folder in \FlashFS\system\web, but for the T/B series, you can use mine:manuf.7zJust unpack it in "\FlashFS\system\web" and access by the link: "http://_CAMERA_IP_/manuf/index.asp"If there is "no connection" message, you can try to run "start sdauthutildevice.exe", and restart prodapp, because sometimes supervisor is messing up something in httpd service.►Config dumpWhile you are changing stuff and trying to configure something blindly using different backup files and what not, its useful to actually compare current config of the server to the previous.To do that you can make dumps and just compare them in the Notepad++ compare plugin, or any other app.You can useCode:rls -r -l -t >\StorageCard\rlsDump_T335.txtorCode:rdump -r -o -f \StorageCard\rdumpService_T335.txt .►Windows UI accessYou can access Windows UI for various reasons, but easiest way for me was to start the appcore, wait for the screen to update to the GUI, and the kill it, and start the shell and explorer.Also if transparent sections of UI bothers you, just set background image in Windows to tiling.Code:start restartapp.batstart stopapp.batstart shellstart explorerEdit:It's worth to point out, that UI of the Windows have higher priorities on some files than the console does.For example, you could copy httpd log by Windows UI and read it by console or download directly to PC.Also by Windows UI Explorer you can easily uncheck hiding of system files and others, and browse ALL actual files that it contains.As connecting by FTP usually does it in a "linux" way and viewing hidden files is not straightforward.You could also use "dir" command with specified hidden and system attributes, but different sets of files, have different attributes, so in my opinion it's easier to just browse all of them in the Explorer.Who knows what gems you could find thereSomewhat-hackOf course we want the full potential of our hardware, and non of the pesky "target noise" added to our pictureTherefore I made a script purely for lab and testing purposesFIF for easy one button Service mode launch from the GUI of the camera:FLIR_Service_activator.7zTo start it just do the "Firmware update" selecting that FIF file from the Menu -> Info -> Service information -> Firmware fileAnd there is also batch script for running within the console:restartServiceMode.7zI personally have not done it, for me current optional service mode is enough, but if someone was determined to have Service mode on-boot, to do that, he would probably use something like that:Code:rcreate -n 99 appl.startup.addrset appl.startup.add.99.action "START"rset appl.startup.add.99.name "cmd.exe"rset appl.startup.add.99.param1 "/C \FlashFS\system\restartServiceMode.bat"rset appl.startup.add.99.type "APP"(don't quote me on that, haven't tried it, possibly need to add some delays in the script to wait for proper init of the prodapp, if someone wants to test and verify, you are welcome)

author: arttdat
author_rank: Newbie
timestamp: May 19, 2024, 12:34:43 pm
content: Credits:Repairing of the broken partitionRepairing of the bricked T335And of course, the Man, the Myth, THE LEGEND:Mr. FraserhimselfThat man singlehandedly had outsupported whole multi-billion dollar company, as their help was: "Yeah... No. If you want your multi-thousand camera be working again, send us hundreds of dollars and may be in a month you will get it"But that man has provided with the crucial system files that were required for primary initialization of the system, and therefore Christmas miracle had happened in May for me

author: Fraser
author_rank: Super Contributor
timestamp: May 19, 2024, 02:19:12 pm
content: Arttdat,Thanks for the excellent post detailing your hard work and processes to recover your camera. I am so pleased that it is now working againFraser

author: arttdat
author_rank: Newbie
timestamp: May 19, 2024, 02:25:25 pm
content: Fraser,All thanks to you!Please keep up the good work, You’re making a real difference!

author: radioorizont
author_rank: Regular Contributor
timestamp: February 15, 2025, 11:05:42 am
content: Hi,I have a p640 which i'm also trying to revive, i posted my journey on the forum "Topic: FLIR SC640 Thermal Camera power up / software / firmware issue " .I'm notr sure whether i have a hardware fault or some firmware issue, i tried flashing the autoload.fif official recovery and always get stuck at the same step.Flash status failure  0x00800000Unrecoverable failure encountered while erasing flash.Can you give your thoughts on this?Many thanks