ICI and DALI thermal camera software ? - Page 1
Forum section: electronics / general

author: Fraser
author_rank: Super Contributor
timestamp: August 04, 2023, 06:23:00 pm
content: I am on the hunt foranyICI or DALI thermal camera/core software or SDK's.ICI have some software called "IR FLASH Pro" and "IR Flash STM". I believe DALI cores are used in some ICI cameras so DALI software is also of interest.If anyone has any of this software, I would love to try it as I may be working with a ICI FM-640-P in the near future. I would like to see whether that camera may be repurposed.Fraser

author: ArsenioDev
author_rank: Frequent Contributor
timestamp: August 04, 2023, 10:26:17 pm
content: Oh I have that, hang on lemme dig it upEdit all ICI FM are Dali OEM relabels.

author: Fraser
author_rank: Super Contributor
timestamp: August 04, 2023, 11:26:06 pm
content: Brilliant ! Thank youFraser

author: Chanc3
author_rank: Frequent Contributor
timestamp: August 06, 2023, 06:06:44 am
content: I've got most, if not all of the ICI software I believe. When I get to the office tomorrow, I'll upload and send a link.

author: Fraser
author_rank: Super Contributor
timestamp: August 06, 2023, 09:36:34 am
content: Thank youFraser

author: radziorr
author_rank: Newbie
timestamp: August 12, 2023, 02:43:11 pm
content: Hi,Under link below you will find Dali software, which is mentioned in attached manual, however I was not able to install it as it requires path with chinese characters to some unpacked files.. maybe you will be more successfull with that taskhttp://yk3.gokuai.com/file/x849mlaibswfgg8dk5qrg13uzktkm0xf#There are two versions of FM-640-P cameras, older one with Hikvision DS-2CD7027FWD camera inside, and newer design with more light sensitive (unnamed) color camera, smaller chassis, different Dali thermal module and some AI chip for face recognition from horizon robotics. Both versions have web-service interface and rtsp streams, so they work without additional softwareI had somewhere manual for dali module, which describes pinout, communication protocol, etc. I will try to dig for it later.

author: Fraser
author_rank: Super Contributor
timestamp: August 12, 2023, 03:06:25 pm
content: Radziorr,Many thanks for that information and software. I appreciate any and all information relating to these cameras and if you can find the DALI cores documentation that would be great to have.I was aware of four versions of the camera in terms of exterior detail:1. Type 1 - Rear panel contains a fan port, multi way connector and cable anchor point.2. Type 2 - Rear panel contains only a cable gland with fixed cable coming through it.3. Type 3 - Front visor has a small Black Body plate added to it for dynamic temperature measurement calibration.4. Type 4 - Rear panel contains a fan port, multiple I/O ports plus cable anchor point. Appears to be a variant of Type 1 camera.In terms of the specifications... the DALI DM60-W/WS appears to be available in 160 x 120 pixel and 320 x 240 pixel thermal core versions. The ICI FM 640 P version is 640 x 512 Pixels.Fraser

author: Fraser
author_rank: Super Contributor
timestamp: August 12, 2023, 03:34:53 pm
content: My camera is due to arrive on Monday but, from the pictures, it looks to be a "Type 2" as I have called the version. This has a slightly different case design and a fixed cable that exits the camera at the rear panel via a cable gland. I attach the auction pictures of my camera.

author: Fraser
author_rank: Super Contributor
timestamp: August 12, 2023, 03:59:01 pm
content: Front views of the varions versions....

author: ArsenioDev
author_rank: Frequent Contributor
timestamp: August 12, 2023, 04:09:55 pm
content: Great news, that's the more compact one inside.Bad news: It's not the nice RTSP backpack equipped one from V1.Upside: Not hard to modify to patch in NTSC out on the BNCI'll get some documentation up on that effort I did

author: radziorr
author_rank: Newbie
timestamp: August 12, 2023, 04:20:03 pm
content: Version 2 contains Dali D843C module (https://www.dalithermal.com/productinfo/741568.html) with DLD640 detector (http://www.dali-tech.us/products/dld64017m-uncooled-infrared-fpa-detector-86.html)I might satisfy your curiosity by this pic:I wouldn't say that this is a great module - not very sensitive,with noisy image when heated up, so requires frequent nuc's, and shutter is loud as hellbut still quite capable regarding the price...UserManual is attached to this post - I've got it from Dali tech support (they are quite helpful - props to them)some other photos:

author: Fraser
author_rank: Super Contributor
timestamp: August 12, 2023, 04:40:23 pm
content: Radziorr,Many thanks for sharing that very helpful information and documentation.The FPA has the appearance of the early ULIS microbolometers that were supplied to China when they did not have their own microbolometer fabrication houses up to speed on the technology. The module casings were a modified standard design from the opto electronics industry. Its flaw was fragile glass seals on the leads so the modules need to be treated with care to avoid stressing the leads and associated glass seals. My thanks to forum member Bill_W for warning me of this issue some years agoI understand that some Chinese companies tried to copy the ULIS A-Si microbolometers and several clones of the ULIS modules appeared on the market. Interestingly, the technology used within the clone modules often became VOx rather than A-Si. VOx offers a better signal to noise ratio than A-Si but OEM's have overcome the A-Si noise challenges through lower noise microbolometers and more advanced noise processing. I note that DALI are still using A-Si microbolometer technology in this camera core. It could even be an early ULIS technology.Fraser

author: Fraser
author_rank: Super Contributor
timestamp: August 12, 2023, 04:49:30 pm
content: Interesting document detailing ULIS microbolometer technology attached....I have added a picture of a ULIS 04-17-1 VGA A-Si microbolometer as well. Note that the 04-17-1 design dates back to 2005 and uses larger (25um) pixels than the DLD640. More modern microbolometers from Linred (was ULIS) are in a ceramic module format.

author: Fraser
author_rank: Super Contributor
timestamp: August 12, 2023, 10:30:03 pm
content: The user manual for the Dali imaging core makes for very interesting reading. From it I can see that the core may be controlled using either Pelco or Dali command sets. Pelco is a standard and I own CCTV keyboards that ‘talk Pelco’ so that is an option. Sadly the Dali command protocol is not detailed and another document is referenced. I also noted from the manual that there are hardware pins on the I/O connector that appear to provide local menu access with a simple button pad as found on cameras like the FLIR A20 and A40. If this is the case, it is a real bonus for me as I like having local menu access to the cores functions. It would be a simple task to make a dumb remote controller that plugs into the camera.Once I have the ICI FM 640 P I will test the Dali software with it and see what can be achieved via that path to control the camera.Thankfully the cores VGA resolution has not been squandered on a very large field of view (34Hx 26V degrees) so I am hoping to get some decent thermal imagery out of it. I find it interesting that ICI claim a thermal resolution of 640 x 512 pixels, yet Dali indicate that the core actually produces 640 x 480 pixels. The ICI marketing department getting carried away maybeFraser

author: Fraser
author_rank: Super Contributor
timestamp: August 13, 2023, 05:42:34 pm
content: I received a delivery today ..... it was the FM 640 P camera kitThe kit contains the camera head, BlackBody, power supply, mounting hardware and an Ethernet cable. The camera is in pristine condition with no evidence of use outside or inside its casing. I attach some pictures, including one showing the FM 640 P sat on top of my larger and heavier ACE Biotech camera head. The FM 640 P is a very neat little camera head and the interior is nicely designedAs has been previously detailed in this thread, the thermal imaging core is the DALI D8X3C with DLD640FC VGA microbolometer. I was very fortunate to win this camera kit for £125 ! They normally sell for a lot more than that. I half expected the eBay seller to refuse to ship it to me for that auction end price.I will need to find the spare time to hook the camera up to a laptop and see what I can do with it. My sincerest thanks to those who have provided help and information on this camera system. I would not have been able to use it to its full potential without the information that has been provided. Any further software and information for the FM 640 P/DM60WS or D8XC core would be very gratefully receivedI am very chuffed to have a VGA thermal camera again after I sold my Ganz/DRS VGA CCTV camera some time ago.Fraser

author: ArsenioDev
author_rank: Frequent Contributor
timestamp: August 14, 2023, 01:38:44 pm
content: Full ICDs provided.Still working on making a nice little USB interface backpack for this core with full control.

author: Fraser
author_rank: Super Contributor
timestamp: August 14, 2023, 04:32:01 pm
content: Thank you. The Dali protocol certainly provides plenty of control over the coreFraser

author: radziorr
author_rank: Newbie
timestamp: August 15, 2023, 12:11:55 pm
content: Thanks Fraser for sharing interesting info regarding ULIS microbolometers. Those DALI ones surely looks like those early models from ULIS! I wonder if the performance is similiarYou are right about ICI marketing dpt being too optimistic as VLC confirms, that video stream resolution is 640x480. The problem however is as usual with network cameras - laggy video stream, like 1s or so over the web and even more via VLC. I tried to use analog output for lower latency as a quick walkaround, but without luckit seems that there have be some activation needed in the dedicated software as the signal goes missing somewhere on mainboard.£125 for that camera was a good deal, I've seen some prices in the web that were way over 10,000USD (a covid type prices - obviously)Regarding those KEY input pins, sadly they are only accessible on 50-pin main connector, and are absent on that ribbon cable connector. Connector specified in manual is hardly accessible, but I have found compatible replacement:DF12NB-50DS-0.5V(51), unfortunately I don't have much time for "development" right now..btw. what sits inside that Biotek?ArsenioDev,I'm strongly interested in such interface backpack, especially if there will be posibility to change the settings on the goDo you have any timeline for that project?

author: Fraser
author_rank: Super Contributor
timestamp: August 15, 2023, 12:40:24 pm
content: Radziorr,The Ace BIOTEK camera contains a cased IP CCTV visible light camera of unknown manufacturer and a Yoseen Infrared X384D thermal imaging core. I created a thread in an effort to identify the thermal core and it may be seen here, along with a tear down of that core.https://www.eevblog.com/forum/thermal-imaging/mystery-thermal-ip-camera-could-be-from-dali-teardown-)/I am pleased to say that the core was identified and I received great support from Yoseen Infrared.Fraser

author: ArsenioDev
author_rank: Frequent Contributor
timestamp: August 15, 2023, 01:49:51 pm
content: Quote from: radziorr on August 15, 2023, 12:11:55 pmMy basic PCB layout is coming along well, the main issue will be software on the chip and on the host OS side.I am a hardware dude by training, software is hard.As for outputting analog, I had to do a hardware hack to get that on my unit, will write up some docs on that later this week

author: Fraser
author_rank: Super Contributor
timestamp: August 23, 2023, 12:24:49 pm
content: I found time yesterday to attempt install of the Dali and ICI software for the FM 640 P camera. Sadly both installations failed. Both pieces of software reported missing files despite being self contained installation archives. The DALI software reports a missing CAB but I can see the same file present as a RAR type and no amount of effort allowed that to be unpacked by the installation routine. All the files are present in the RAR, it apparently should be a .CAB file though.The ICI IR FLASH software installs but when run it reports three missing .DLL files. The files are not present in the installation folderNot a very successful day on that front !If anyone has another copy of this software, I would very much appreciate a copy pleaseFraser

author: Fraser
author_rank: Super Contributor
timestamp: August 23, 2023, 05:25:53 pm
content: I contacted ICI today asking for the latest version of IR Flash Pro STM and they very kindly provided it to me. Sadly it is the same Version 6.6 software as has already been provided and it produces the same error when run. Time to investigate the error further.Great support from ICIFraser

author: Chanc3
author_rank: Frequent Contributor
timestamp: August 31, 2023, 08:44:12 pm
content: I'm off this week, but when I return on Tuesday, I'll send you a copy of the software I have, which works with my ICI camera.

author: Fraser
author_rank: Super Contributor
timestamp: September 01, 2023, 10:26:14 am
content: Chanc3,Thank youFraser

author: zev
author_rank: Newbie
timestamp: November 02, 2023, 10:39:40 pm
content: I got a couple of these cameras from folks getting rid of them now that COVID is in the rear view mirror. Seems ICI charged an arm and a leg for these when they were new but can be had rather cheaply. Finally got in and was able to change settings and record video, here is the process I used, I have the "type 2" model Fraser mentioned with the integrated cable.Point web browser tocamera IP: 192.168.1.102The default login credentials are:User Name: adminPassword: Admin123(I doubt many users would reset this, not a security device exactly)From there, in Internet Explorer (and I believe other browsers supporting the VLC plugin) you should be able to view both feeds under the preview tab. In all browser though, you can change the configuration settings and the viewing pallet, these settings appear to stay set after reboot. You can also change the frequency of auto NUC, or turn it off completely (image will get rather noisy after a few tens of seconds).Video feeds can be viewed alternatively captured as RTSP streams at the following addresses (thanks to Arsenio for this info!), in VLC as a network stream or many other ways:IR feed: rtsp://192.168.1.102/ONVIFMediaVIS feed: rtsp://192.168.1.102/ONVIFMediaVLC can record as well which makes it quite handy for this.The manual provided by ICI (can be found here:https://f.hubspotusercontent10.net/hubfs/20335613/Product%20PDFs/Product%20Manuals/ici-skin-temperature-monitor-software-manual.pdf) includes a link to a firmware updater for this camera (file is here:https://www.dropbox.com/s/v84t1sbyyhr1o9q/Firmware_20200826.zip), I believe when the camera originally shipped it only worked with the Dali Tech "InspectionQuarentineSystem" software, and eventually ICI made the "ICI Flash STM" software. Interestingly, I have a copy of the standard ICI Flash (non-STM version) and it does not support this camera either, it seems.One thing I have noticed about the ONVIF output, changing framrate and bitrate settings do not seem to actually have any effect. Also, there appears to be less compression when using a pallet such as Hot Metal (a sort of orange gradient) vs the monochrome White Hot or Black Hot, which are usually my preferred pallets. The upside of Hot Metal vs one of the rainbows is that it still is a luminance gradient, so you can take recorded footage and convert it to monochrome and luminance will be correctly preserved (if with a slight gamma curve applied).Next step is to poke at the analog output. These are quite nice little cameras, very interested to see what backpack you put together Arsenio!

author: zev
author_rank: Newbie
timestamp: November 05, 2023, 12:51:34 am
content: A little more info:I got analog out set up on the camera now. As per the documentation (D8X3CUserManual attached earlier in this thread) analog video out is pin 1 of the 50 pin header on the board. A little continuity testing showed that that pin is connected to the following traces, picture 1 shows where it is on the camera module and picture 2 shows it on the unit main board.I spliced in so that the analog video connector in the rear cable is connected direct to the camera board instead of the main board, circumventing the main board entirely.This in interesting, because it appears the analog out directly from the camera is a much higher quality signal than what is output over the ethernet port. I wonder if the digital capture being done by the ethernet board is not taking the full 14bit depth or some other bottle neck, it is less sharp and has less dynamic range and sensitivity than the analog channel.One interesting next direction to go would be to directly control the camera module. This can be done with pins 3-7, and should allow full control of the camera without using the ICI main board at all. As is, if you try to run the module without connecting it to the main board it only NUCs once at startup, which quickly makes it not a great image. Very interesting that the analog video looks so much better, definitely points to the fact that a custom data capture 'backpack' could squeeze much more performance out of this camera.

author: Bobertsawesome
author_rank: Regular Contributor
timestamp: March 03, 2024, 07:53:14 pm
content: To add to this thread on different variants of the ICI FM 640 P...I snagged one off eBay for ~$300, still a good price IMO for what's inside. It was absolutely caked with dust on the inside of the housing and must've been used for a while or in an industrial setting. It has a variation of the visible camera I've never seen before in teardowns (although noted as being on the original model by radziorr). A HIKVision (DS-2CD7027FWD) camera equipped with electronic focus control.The core is theDLD640and the backpack/core combo is theDali-TechD843NT, which is Dali's own module. I'm hoping that this will provide better implementation possibilities if I can get Dali to provide core documentation, plus it's got a much smaller footprint than the later ICI "Plus" models which had a separate processing board.The login password is different when connecting via IP 192.168.1.102 than the newer modules noted in this thread. Exact same interface otherwise.Username:adminPassword:adminOne thing I did notice is this whole module gets rather warm, which I'm sure isn't great for image sensitivity. I used another thermal camera to image the Dali module (I recognize the irony) and it seems the Altera Cyclone is the main heat source. It would be interesting to see if I can add some heatsinking or cooling to remove this heat. After several minutes the whole core housing becomes heated. I do have a stirling crycooler at my disposal, the Superlink Hybrid 98, which may call for some experimentation.

author: Fraser
author_rank: Super Contributor
timestamp: March 04, 2024, 12:47:48 am
content: Bobertawsome,Thank you for sharing details of your cameras internal modules. Very interestingRegarding localised heating of the thermal camera module, this is not uncommon and not normally a problem. The Microbolometer normally operates in thermal equilibrium at around +32 Degrees Celsius. The die temperature is monitored by the electronics package. Cryogenic cooling of a microbolometer is not normally needed or recommended. If a component in the electronics package is generating too much localised heat it is often dealt with by adding forced air cooling to the enclosure and a small finned heatsink to the offending component. Another option is to use a copper heat pipe or solid copper ‘finger’ attached to the offending component and a large heat sink or thermal reservoir. As I say, heat from the electronics package is not normally a problem in larger cores where air can circulate. It is the miniature imaging cores with hot processors in close proximity to the rear of the microbolometer that can cause thermal gradients and other undesirable effects on the image output.Fraser

author: Bobertsawesome
author_rank: Regular Contributor
timestamp: March 04, 2024, 06:08:17 am
content: Thanks for the additional infoLooking at the product page I believe the camera core is TEC temp controlled, so it would make sense that the die is probably a lower temp and the additional heat is sinking off the hot side of the Peltier.

author: Fraser
author_rank: Super Contributor
timestamp: March 04, 2024, 11:37:26 am
content: If a Peltier module is being used that is good news as it greatly improves microbolometer stability. The down side of the Peltier temperature stabiliser is that the core will be quite power hungry, especially at first switch on. You will see the Peltier stabilising the microbolometer by monitoring the current draw when the core is switched on. The current will drop significantly once operating temperature is reached. I personally like cores that have temperature stabilisation so it is good that yours has this featureFraser

author: Fraser
author_rank: Super Contributor
timestamp: March 11, 2024, 09:43:02 pm
content: Several nice thermal cameras were rehomed in private sales. I have multiple examples of some cameras so sold some excess inventoryI still buy the odd thermal camera if it is interesting enough and the price is right(it has to be inexpensive!) I no longer buy cameras purely for teardown and analysis posts on this forum though as my funds are very limited. Times have changed from when I used to buy many cameras to learn about the designs and technology within. I have now accumulated enough technical knowledge to repair both old and new camerasI have also moved onto repairing specialist fully rugged laptops, as used by the military, law enforcement and hazardous environment teams. That new interest distracts me a little from the thermal imaging sceneThat said, a nice high-end industrial thermal imaging camera connected to a mint Dell Latitude Rugged 7414 laptop is a thing of beauty to me

author: CRC
author_rank: Contributor
timestamp: August 28, 2024, 10:40:22 pm
content: I just got one of the 640 type 2 units in the mail today. Wow, this is really a very neat camera. I am able to see the thermal side via VLC using the address previously posted but I'm not understanding what address carries the regular camera video.

author: angelortega
author_rank: Contributor
timestamp: August 28, 2024, 11:46:37 pm
content: i have that same unit. go to the Hikvision USA website and download the software if i remember its the sadp toolit will scan for any Hikvision camera that you have on your networki used it and it showed that addresses for my color camera had bin changedgood luck

author: CRC
author_rank: Contributor
timestamp: August 29, 2024, 01:25:40 am
content: Quote from: angelortega on August 28, 2024, 11:46:37 pmThanks, I tried it but it didn't locate it. Advanced Network Scanner found the camera's base address but that's it. I assume it must be a different port.

author: angelortega
author_rank: Contributor
timestamp: August 29, 2024, 11:52:38 am
content: All these cameras are using the same address and ports . I think that for security reasons , people are changing the normal settings to keep other's from logging on.I used sadp tool to change the address on the color camera the hikvision ds-2cd7027fwd-a, and saved it And I was able logon and it worked . Good luck

author: angelortega
author_rank: Contributor
timestamp: August 29, 2024, 02:14:49 pm
content: I just check my files and found ,that port addresses you can try are port 8000 or 8080 or just 80.good luck

author: CRC
author_rank: Contributor
timestamp: August 29, 2024, 07:40:25 pm
content: I just received another camera and it's the very large case style with the large visual hikvision camera and the thermal with the ethernet integrated to the back like pictured above by bobertsawesome. I was able to remove the thermal from the housing with two screws, apply 12 volts, plug in an ethernet and was immediately met with a very nice image via VLC. Loosening a torx ring clamp allows for focus.Now, to find where the analog output is.I also like the Wago/Euroblock style connectors they used. They are very easy to plug and play.So far, I'm extremely happy. The possibilities are nearly endless with these things.

author: angelortega
author_rank: Contributor
timestamp: August 29, 2024, 09:27:38 pm
content: On my hikvision camera it's the green and white wire, and for thermal camera it's two pin on the upper left as pictured

author: CRC
author_rank: Contributor
timestamp: August 30, 2024, 03:35:45 am
content: Oh, the top row of the empty green connector. That worked great using one of the 2 pin plugs included in the kit. Thanks!The image looks great.

author: angelortega
author_rank: Contributor
timestamp: August 30, 2024, 09:19:49 pm
content: As for the thermal camera the first pin plus and second is negative

author: angelortega
author_rank: Contributor
timestamp: August 30, 2024, 11:25:06 pm
content: You can get great looking video out of gray colored wire connector I made to the upper left of the camera header's. But there's a problem, changing the color plate doesn't effect the output it will stay the same, If you check the others posting on this site I was discovered that these Cameras have a direct video output before it's sent to the feature boards for network output witch is slower frame rates. good news is you now have two outputs one direct fast composite video and one network video you can record from both. enjoy yourself ok

author: ArsenioDev
author_rank: Frequent Contributor
timestamp: August 31, 2024, 02:13:50 am
content: I need to get around to documenting all the hacks I've got up on these.Got some stuff that I'm whangjangling before SUPERCON though, as i'll be there.

author: CRC
author_rank: Contributor
timestamp: September 01, 2024, 07:18:46 pm
content: Thanks for the info! I wonder if a guy could poke around and find post feature board color pallete processing?

author: zrq
author_rank: Frequent Contributor
timestamp: September 04, 2024, 08:21:02 pm
content: Quote from: zev on November 02, 2023, 10:39:40 pmThanks for sharing. I think you have a typo for the VIS feed.There is a third RTSP feed: rtsp://192.168.1.102/rawdata used by the ICI body temperature software which transports the raw radiometric data in uncompressed format (but only 8 bits dynamic range?). However nothing can handle these unencoded data neither VLC nor ffmpeg, I'd like to try to hack something together using this library once I get the time:https://github.com/marss/aiortsp/tree/masterAlso the firmware update package ICI_20200826_restart .upg in the Dropbox link posted by others can be easily unpacked. binwalk should find a tar.gz in it and then you can explore the filesystem. It seems there is not much to hack around though.

author: CRC
author_rank: Contributor
timestamp: September 05, 2024, 03:33:07 am
content: Quote from: zrq on September 04, 2024, 08:21:02 pmThank you! I was trying to obtain the visual feed and couldn't figure it out.

author: CRC
author_rank: Contributor
timestamp: September 17, 2024, 12:59:40 am
content: Checking to see if anyone happened to have scavenged a camera out of one of the type 1 small units and maybe has no use for the networking board. My camera works fine but for whatever reason the thing will no longer connect to my network and no IP is seen when I scan for it. Both voltage regulator leds are lit but it just doesn't want to talk. I would like to replace the board so I can continue to use it. Thanks.

author: zev
author_rank: Newbie
timestamp: September 19, 2024, 09:17:22 pm
content: Very cool find. Super interested if you make more progress here, I will try this out myself soon too.

author: ArsenioDev
author_rank: Frequent Contributor
timestamp: September 20, 2024, 04:46:33 pm
content: Figured out how to change ROIC TIA capacitance and sense range on-core.Now have more parameters to tune.

author: CRC
author_rank: Contributor
timestamp: September 20, 2024, 06:07:13 pm
content: I found some commands for other products on their site. Do you know if it's worth testing to see if they share any of the same structure?

author: whiskthecat
author_rank: Newbie
timestamp: September 20, 2024, 07:32:42 pm
content: Has anyone figured out some way to automate issuing a NUC from outside of the web interface?The 3 NUC speed choices are all very frequent.

author: CRC
author_rank: Contributor
timestamp: September 21, 2024, 04:14:00 am
content: From what I've seen they need to be frequent or it degrades quickly. Those with the commands won't respond so it's up to us to figure it out.

author: CRC
author_rank: Contributor
timestamp: September 27, 2024, 10:28:54 pm
content: I found a 30 pin .5mm FFC break out board on Amazon that fits the cable from the small type. Pin 30 is video and 1 is ground. I think I traced out the serial lines too. I'm going to connect them to a 3.3v serial to USB adapter and see if it spits out anything when it boots up. The image indicates Dali protocol, 38400 baud and address 2 when it first powers up. It would be nice if it accepted both Dali and PELCO-D commands but being set to Dali I'm sure I'm locked out.Searching Dali commands is futile since all you get are Dali lighting system documents.

author: nidlaX
author_rank: Frequent Contributor
timestamp: September 27, 2024, 10:51:41 pm
content: Quote from: CRC on September 27, 2024, 10:28:54 pmHave you thought about sniffing the bus while the module receives commands from the dual camera control board? I can't imagine the protocol being all that complicated.

author: Fraser
author_rank: Super Contributor
timestamp: September 27, 2024, 11:12:47 pm
content: Sadly the communications protocol may be set to Pelco P, Pelco D or DALI proprietary command strings. As yours is set to DALI you would need to change the communications setting in the menu system to use Pelco with your unit. The Pelco command structure is also a bit unusual as it is using a standard CCTV keyboard as the terminal. It is not a function per button but rather accessing functions via presets.The DALI proprietary command set is sadly not one that I would have been able to guess and the command string is not as simple as ASCII or AT commands. The command set document may be obtained from DALI but you may be required to sign an NDA.

author: CRC
author_rank: Contributor
timestamp: September 28, 2024, 02:01:47 am
content: Quote from: Fraser on September 27, 2024, 11:12:47 pmI would gladly sign an NDA and abide by it if they would acknowledge my attempts to communicate with them.

author: CRC
author_rank: Contributor
timestamp: September 28, 2024, 02:03:22 am
content: Quote from: nidlaX on September 27, 2024, 10:51:41 pmI'm working on that now. Currently I'm just sniffing what it's doing when it powers up and does NUCs. Now that I have confirmed which lines are what for serial RX and TX I'm going to attempt exactly what you suggest.

author: CRC
author_rank: Contributor
timestamp: September 28, 2024, 04:37:41 am
content: I used the breakout board then also found that R64 = camera TX and R65 = camera RX on the ribbon connected video board. Tapping those and running them to a Waveshare USB to RS232/485/422/TTL box, using TTL at 3.3v setting I am seeing hex 02 06 00 4B 42 44 2C 43 2C 6C 03 going to the camera every time it auto-NUCs or when manual NUC is initiated. However, I am unable to get it to respond to that command when trying to inject that from my TTL box.That hex array converts to ASCII; KBD,C,lIt also seems that if the camera is disconnected the networking board goes manic and starts sending increasingly frequent commands trying to make contact with it.

author: Fraser
author_rank: Super Contributor
timestamp: September 28, 2024, 04:51:45 pm
content: KBD,C, is the calibrate command as you have discovered. It is from the keyboard simulation command set.There are two commands that you can send to the camera to see if you have good communications and no faults. As you will see, it is not a simple ASCII text command as there are other 'components' in the packet.Try these as a test but I cannot supply the complete command set for this core (it is not mine to share).CCM (Communications check)02 04 00 43 43 4D 2C FF 03Core should respond with CCM 1 to show that the command was received OK so comms are good.GCS (Core status, including any faults found)02 04 00 47 43 53 2C 09 03Core should respond with GCS 1 which is "all OK" or another number to indicate a fault found in the core.If you do not get a response from the core to these commands something is wrong (obviously).Fraser

author: CRC
author_rank: Contributor
timestamp: September 28, 2024, 07:12:41 pm
content: Quote from: Fraser on September 28, 2024, 04:51:45 pmThank you Fraser for the info! I just tried it and get no response so my transmit side tap must not be correct or something.I tried with the FFC breakout board camera and received responses so yes, my communications setup is at least working!Could you pass along any contact info for them? I used a "contact us" type of link on a web page but never received anything back from them.Also, do you know if it's even possible to obtain any other video color but the hot iron out of the camera's CSVB output or does it require external processing?

author: Fraser
author_rank: Super Contributor
timestamp: September 28, 2024, 07:35:48 pm
content: The core is capable of providing a range of colour palettes that may be selected via the Pelco commands and likely also directly using DALI commands The core also offers an “invert” option so “white hot” and “black hot” is available in the monochrome palette.Normally when someone has trouble communicating via serial TTL I suggest that the communication settings, levels and data polarity is checked as these can differ when working with various cores. In your case you are able to read the data coming out of the network board so you should have the correct levels and data polarity configured. Why your core is not responding I am not sure.

author: nidlaX
author_rank: Frequent Contributor
timestamp: September 29, 2024, 01:43:23 am
content: Actually, you should just email sales@dali-tech.com. Ask for the DALI protocol specification, turnaround time is a few business days or less, no NDA was required (for me).

author: cynfab
author_rank: Regular Contributor
timestamp: September 29, 2024, 02:09:16 pm
content: I picked up one of the Type 2 cameras off e-bay the other day and have been poking around.I tried installing the posted Dali control software, firmware updater as well as the IR Flash STM software with WINE.The updater installed and ran, I didn't update the firmware as I wanted to poke at the old version for a while.The Dali control software failed with the afore mentioned missing .cab.The STM software failed due to an incomplete implementation of the ninput.dll.Neither of those failures were unexpected.So I tried again on a "Real" Windows 10 Pro machine.The updater behaved as expected.The Dali control software failed in almost the same way with a nice error message about the missing .cab not beingfound: C:\Users\kenm\AppData\Roaming\DALI\Temperature measuring system 1.0.18\install\***chineese chars***-DL1.cabThe STM software installed but when run, just produced a splash screen and either crashed of terminated without any further messages.I gave up and started reading the eevblog thread again and then the comments from all the sellers of Completed Items on e-bay.One said that "I can pre-program these cameras for use on your NVR system". Another refereed to the Debug connector.I opened mine up an sure enough there was a debug connector, 4 pin JST 1.25mm. I then figured out the pinnout andconnected a USB-serial adapter and was met with a u-boot startup followed by the Linux kernel startup followed bythe camera startup.I was able to interrupt the u-boot startup and change the bootargs to give me a root shell after the kernel and system were up butbefor the camera was started.I am now at the point of poking around in the file system to see what I can find. ...stay tuned...UPDATE,The system supports both an mmc card and USB vfat formatted thumbdrive. There is a 4 pin JST connector labeled USB which I'll try and connect up at some point.UPDATE 2,Attached is a zip file of some interesting parts of the file system.UPDATE 3,Not really an update but a question:What firmware do folks have on their cameras, and did you update it?

author: CRC
author_rank: Contributor
timestamp: September 29, 2024, 07:00:45 pm
content: Interesting, to me they seem far too slow.

author: clavo
author_rank: Newbie
timestamp: October 04, 2024, 01:41:27 pm
content: Thanks for that explanation. Are you aware of HTTP strings that can be sent to change the camera color lookup tables? For example, after a lot of time I figured out an older FLIR core would cycle color tables by sending:http://192.168.1.XX/axis-cgi/com/serial.cgi?port=1&write=ff01000b000511.This was an old pan/tilt FLIR Photon plugged into an old 4 port AXIS server that used serial for the Pelco pan/tilt.... if remember right. So perhaps that command was taken by the AXIS server and changed to Pelco..... then sent serial to the camera in serial (Most likely guess). Old AXIS servers are pennies on ebay, and there is plenty on space inside these cases to take an AXIS board and just stick it inside. The older ones run linux and have a built in web server and even could provide a clean composite 2x2 or 4x4 mosaic/matrix. I was using a AXIS 2400+

author: cynfab
author_rank: Regular Contributor
timestamp: October 05, 2024, 02:32:22 pm
content: A bit of progress, I have been able to fiddle with some of the .html files on my camera to enable some of the menus that were disabled.Also found that by usinghttps://github.com/sr99622/libonvifthe video is not laggy at all.I am by no means skilled at html, but I used Opera to dynamically fiddle with the code.Here is a quick look.

author: CRC
author_rank: Contributor
timestamp: October 07, 2024, 11:11:07 pm
content: Quote from: cynfab on October 05, 2024, 02:32:22 pmWhere are the files you modded located? How did you access them?

author: ArsenioDev
author_rank: Frequent Contributor
timestamp: October 08, 2024, 12:11:42 am
content: Quote from: CRC on October 07, 2024, 11:11:07 pmHit f12 and edit the lines for the right menus to not be hidden.Then you'll have access to the other menus

author: cynfab
author_rank: Regular Contributor
timestamp: October 08, 2024, 12:40:28 am
content: Most of the files are in /app/web/webpages/. Now to find what in the .html/js/css/conf files I need to change to make it permanent.And to test what actually works when the menus are enabled.Got both mmc & USB working, the USB needs a jumper soldered on the main board. mmc works without any hardware fiddling.

author: CRC
author_rank: Contributor
timestamp: October 08, 2024, 08:53:37 pm
content: Quote from: nidlaX on September 29, 2024, 01:43:23 amI did. I received no response.

author: CRC
author_rank: Contributor
timestamp: October 08, 2024, 09:01:07 pm
content: Quote from: cynfab on October 08, 2024, 12:40:28 amI noticed the 5v power line to that usb header had a missing jumper but I'm not sure if that's what you are referring to if I missed one somewhere else as mine didn't respond when trying to access it.Also, on a bit of a tangent here, I have one of the small cameras that completely stopped responding via ethernet. All indications are that it's on and working (internal LEDs, activity lights, etc...) but it doesn't even respond to a port scan. It's strange. I have no idea what changed or happened to it. I tested the camera separately and it works normally.

author: CRC
author_rank: Contributor
timestamp: October 08, 2024, 09:03:42 pm
content: Maybe I missed it but has anyone found any info about the visual camera in the small ones? I didn't see any writing on it that lead to anything I could research on line. It would be nice to be able to adjust its gain and whatever other parameters. Mine also seems adjusted to be best focused at about 12 feet away or so. Images of the street out front are a bit out of focus with the front yard and items closer clear. It looks as if there is a focus ring on that black plastic lens tube assembly but it doesn't want to turn and I fear I will break it.

author: ArsenioDev
author_rank: Frequent Contributor
timestamp: October 08, 2024, 09:37:26 pm
content: Not sure what sensor, but does pretty nice in low light.The glue on it is halfass, pick at it with your fingernails and it'll come loose

author: cynfab
author_rank: Regular Contributor
timestamp: October 09, 2024, 01:39:29 pm
content: The jumper to enable the 5V for USB is labeled LB22 on the main board. I believe it is a reference to a ferite bead for EMI suppression. Some disassembly required.There are references to an IMX290 in the startup messages that come out the debug port. That is a SONY 2M pixel STARVIS low light level camera, not the most sensitive in the product family, that would be the IMX462, but pretty good.$ grep -ri imx *Binary file app/modules/hisi.so matchesstartup_2.txt:==== Your input Sensor0 type is imx290 ====startup_2.txt:>>> imx290_initstartup_2.txt:imx290_i2c_init startup_2.txt:===IMX290 1080P 30fps 12bit LINE Init OK!===Seems like the hisi.so driver supports several imx flavors.$ strings hisi.so |grep imximx415_i2c_addrimx415_addr_byteimx415_data_byteimx415_initimx415_exitg_astimx415imx415_standbyimx415_restartimx415_write_registerimx415_read_registerimx415_i2c_initimx415_i2c_exitimx415_linear_8M25_initg_astimx290Stateimx290_write_registerimx290_i2c_addrimx290_addr_byteimx290_data_byteimx290_initimx290_exitg_astimx290imx290_standbyimx290_restartimx290_read_registerimx290_i2c_initimx290_i2c_exitimx290_progimx290_linear_1080p30_initimx290_wdr_1080p30_2to1_initimx290_wdr_1080p60_2to1_initimx290_wdr_1080p30_3to1_initimx290_wdr_720p60_2to1_initimx290_wdr_720p60_3to1_initimx290_wdr_1080p120_2to1_initimx290_wdr_1080p120_3to1_initg_astimx274Stateimx274_write_registerimx274_initimx274_exitimx274_standbyimx274_restartimx274_read_registerimx274_spi_initimx274_spi_exitimx274_progimx415_set_bus_infoimx415_i2c_initimx415_write_registerimx290_set_bus_infoimx290_write_registerimx290_i2c_initimx290_init===Imx290 imx290 1080P15fps 12bit 3to1 WDR(30fps->7p5fps) init success!========Imx290 imx290 720P30fps 12bit 2to1 WDR(60fps->30fps) init success!========Imx290 imx290 720P15fps 12bit 3to1 WDR(60fps->15fps) init success!========Imx290 imx290 1080P60fps 10bit 2to1 WDR(120fps->60fps) init success!========Imx290 imx290 1080P30fps 10bit 3to1 WDR(120fps->30fps) init success!=====imx274_init

author: cynfab
author_rank: Regular Contributor
timestamp: October 09, 2024, 05:38:34 pm
content: There is also resistor R788 that connects the video out of the thermal camera to the BNC connector.But there are other components connected as well. R702, U10 and R701 which leads back to the CPU which is a HiSilicon Hi3519V101.

author: cynfab
author_rank: Regular Contributor
timestamp: October 12, 2024, 10:27:22 pm
content: I can confirm that R65 and R64 are the comm lines from the Hi3519 to the Dali Thermal camera.Baud rate 38400 (although the firmware will try at 115200 if 38400 fails) N81.With the Super/Debug menu enabled you can send commands to the core, and see the response.

author: cynfab
author_rank: Regular Contributor
timestamp: October 14, 2024, 05:16:12 pm
content: If you are comfortable with embedded linux, the command line and the vi editor give this a try,This is not a detailed how to, still a work in progress, probably a lot missing, and maybe not the best way to achieve our goals.Way 1, which is not permanent.Using Opera or some other browser with an html developer feature, do an "inspect element"on the main window, browse through the consolidated html/js code and remove theappropriate "display:none" attributes, reloading the page will remove your edits, but if you don't,the hidden menu will appear and sometimes work.Way 2, can be permanent, and disastrous to your camera if you are not careful.Connect a 3.3v TTL serial adapter to the debug port of the main board, interrupt u-boot and change the bootargs to add "init=/bin/ash", save the environment.When you reboot you will be dropped into a root shell before the /etc/init.d/rcS script has executed.Then go to /app/web/webpages/js and change the D8X3Nmain.js files and comment out:// alert("cookie="+document.cookie);// $_("Playbackli").style.display="none";// $_("Alarmli").style.display="none";// $_("Playbackli").style.width="0px";// $_("Alarmli").style.width="0px";// $_("listMain").style.width="280px";Then in D8X3NMonitor.js comment out each menu you want to display, here I only did the RecordAndCap menu://$_("RecordAndCap").style.display="none";$_("PTZtype").style.display="none";$_("StreamType").style.display="none";$_("ImageTable").style.display="none";$_("VideoAudio").style.display="none";$_("PointTable").style.display="none";$_("AreaMeasureTable").style.display="none";$_("LineMeasureTable").style.display="none";Then in SSMenu_left.js comment out:// $_("FTPCfg").style.display="none";// $_("HTTPSCfg").style.display="none";// $_("EMailCfg").style.display="none";// $_("8021xCfg").style.display="none";// $_("AutoFocusSetting").style.display="none";$_("Audiocfg").style.display="none";// $_("StorageMange").style.display="none";// $_("PtzCfgTitle").style.display="none";// $_("Menu6TR").style.display="none";$_("LVideoSettings").innerHTML=LMediaSetting;BTW you need to use the vi editor included in busybox as that's all there is.Save the files, reboot the camera. You will still be in the root shell when it reboots,so you then have to execute /etc/init.d/rcS to bring the camera to a working state. As the camera continually outputstext, it will be hard, not impossible to continue to use the shell after this point. There is probablya way to disable this but I haven't found it yet.Not all of the menus work properly, I'm still trying to figure out why.Don't forget to back up your original files.You can put an SD card in, but you have to mount it to use it, look in /lib/udev, there are 2 scripts there,one to mount and one to unmount the mmc card. You may have to edit the dali.cfg file to enable the hdd.If you want to use the menu to record data, the camera will want you to format the drive, I haven't done thisas yes so I have no clue as to what format it will make the drive. To just use it after mounting it it shouldbe vfat.You can connect a USB thumb drive to the USB port, but you must add a jumper at the LB22 position on the main board.This is a 0402 footprint so it is small. You probably have to edit dali.cfg and enable the USB. You will have toeither make a node in /media like there is for the mmc card or co-opt that one to mount the USB drive. it enumeratesas sd1. The OS supports either vfat of ext4There is probably a better way to do all the above, but I'm not an html or javascript expert.You can also edit the dali.cfg file in /app to change various parameters.Best of luck, and please post results.

author: clavo
author_rank: Newbie
timestamp: October 19, 2024, 05:00:09 pm
content: Thanks for this. Poking through the HTML there is a boatload of fun. I wish I new HTML better.There has to be a way to script some find/replace intermediary thing for those that aren't going to delve into permanently editing it in *nix. I'll probably take a stab at the USB route, but....ugh.... have to use 'vi'. *smirk*. That belongs somewhere on the shelf with COBOL and Fortran books, and a dusty stack of disks for Banyan Vines.-c

author: NegativeION
author_rank: Newbie
timestamp: November 18, 2024, 05:06:40 pm
content: So I recently got a Type 2 DM60-W for a steal off ebay. I just took the lid off and it has a bit more "guts" than I was anticipating. I plan to do some testing and more disassembly that I'll make sure to share here.

author: ArsenioDev
author_rank: Frequent Contributor
timestamp: November 18, 2024, 07:51:55 pm
content: Whoah okay, that's a brand new thermal core architecture!Please document and pop covers off

author: NegativeION
author_rank: Newbie
timestamp: November 18, 2024, 11:24:27 pm
content: Alright,I've had some more time to play around with the device. I was able to connect to it via VLC player and the video output is showing 640x480. I had no luck using the web interface with the camera. I was able to login, but there was no video feed and none of the controls or settings would work.As for disassembly of the device, this was a bit trickier than i anticipated. It seems the entire webserver components are stored within the CCTV case. I was able to remove this and get to the core, but I'm a bit unfamiliar with what I'm looking at...I've attached a some pictures of the assembly. Curious to get input from other users.

author: ArsenioDev
author_rank: Frequent Contributor
timestamp: November 19, 2024, 01:32:13 am
content: Quote from: NegativeION on November 18, 2024, 11:24:27 pmBased on the ident string, I'd say it's a 384 microbolometer. Not sure why video stream is 640 though.I've had issues if i'm running scriptkill and in chrome, video stream works in older legacy internet explorer just fine though.

author: NegativeION
author_rank: Newbie
timestamp: November 19, 2024, 07:07:35 am
content: Quote from: ArsenioDev on November 19, 2024, 01:32:13 amYeah, it seems that it is a 384 core, that being said I think $200 is still a deal for it. Unfortunately, there seems to be an issue with the firmware on this device. Whenever I log into the control panel, the JS scripts fail to load due to /js/login.js missing, resulting in nothing working. However, after digging through the HTML and JS, I was able to run a couple queries against the device that gave me some basic information and control of the device.This query will enable the OSD for the camera, unfortunately its all in Chinese and I can't really figure out how to control it lol.Code:http://192.168.1.102/cgi-bin/system?Module=Control&ShowMenu=YesHere is command that outputs basic device informationCode:http://192.168.1.102/cgi-bin/system?Module=Query&Type=SystemVersion;DM60Version;Model;HardwareVersion;StorageDevice;PreviewClientNumMy output from that command looked like this:Code:SystemVersion=DM63-W/N-V2.04-Dec 9 2019&DM60Version=DM60-W V1.14, Nov 20 2017 11:06:30Here is some JS you can use to change the color gradient of the thermal. Just Change the number next to "RuleId=" in the "Body" portion of the JS. I believe it supports 0-10:Code:fetch("http://192.168.1.102/cgi-bin/system?Module=DMColor", {"headers": {"accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7","accept-language": "en-US,en;q=0.9","cache-control": "no-cache","content-type": "text/plain;charset=UTF-8","pragma": "no-cache","upgrade-insecure-requests": "1"},"referrer": "http://192.168.1.102/cgi-bin/system?Module=DMColor","referrerPolicy": "strict-origin-when-cross-origin","body": "RuleId=2","method": "POST","mode": "cors","credentials": "include"});I also patched the Dali installer to remove the Chinese characters so it properly installs on Win 10. Unfortunately the software is in Chinese and I can't get it to work with my camera :'(. I went ahead and uploaded it to google drive if any of you want to check it out.Code:https://drive.google.com/file/d/1VlBPiLAPNdlSzzQghp7yDggPOobAXQf3/view?usp=sharing

author: ati
author_rank: Newbie
timestamp: January 07, 2025, 07:29:14 am
content: Quote from: ArsenioDev on October 08, 2024, 12:11:42 amI have found that the below file contains a list of all the valid usernames and passwords for the web login./app/web/lighttpd.userFor me these are:Code:admin:adminsuper:871897If you log in via the 'super' user, there is no need to edit the .js files on the camera or the display properties directly in the browser. The additional debug menu is visible by default for this user.

author: cynfab
author_rank: Regular Contributor
timestamp: January 07, 2025, 02:43:28 pm
content: My lighthttpd.user contains the same data. ;>))

author: lololo
author_rank: Contributor
timestamp: February 27, 2025, 07:35:20 am
content: Hello, I've been following this topic for a while and I finally managed to get my hands on an ICI FM 640 P (a seller on eBay has plenty of them right now and ships internationally).@ArsenioDev, have you been able to create a USB interface?

author: ArsenioDev
author_rank: Frequent Contributor
timestamp: February 27, 2025, 03:34:43 pm
content: Not yet, still in spinup and setup phase.Day job has been eating a huge chunk of my time, then my friends group got four MWIR cameras including a 1280 and continuous zoom lenses in which killed even more free time.Boards are in the design phase and I'm trying to nail down some of the FPGA learning.

author: lololo
author_rank: Contributor
timestamp: March 09, 2025, 10:07:11 am
content: I just received the camera, and I'm really happy because it appears to be brand new and has never been used. It comes with documentation and a USB key with software. (There are still three left on eBay, though the seller has doubled the shipping costs.)

author: ChrisZ
author_rank: Newbie
timestamp: May 06, 2025, 04:57:23 am
content: Nice thread. I just got my D8x3NT thermal core from eBay tested it. I am planning to convert it to a handheld device. Per my test, the default RTSP (rtsp://<camera IP>/ONVIFMedia has ~1s latency. However, if you go with JPEG stream (rtsp://<camera IP>/ONVIFMediaM), the latency will dramatically drop. But yes, you lose some depth, so not that smooth an image.I will update whatever I have found in hacking this device. My goal is to be able to control it (one press to calibrate/change color pattern/recording/shot image) with some SBC and stream video with CVBS (RTSP latency is too large for me)So far, I find this is how you can trigger the calibration with one HTTP request, this will work with admin:admin login, you may change it as your device needed:Code:curl -X POST \-H "Content-Type: application/x-www-form-urlencoded" \-H "Cookie: Name=admin; Pass=admin; Type=Admin; Language=zh-cn; DevType=D8X3NT; OEMINFO=OEM; Name=admin; Pass=admin; UserType=Admin; IPCamera=D8X3NT" \-d "" \"http://<camera IP address>/cgi-bin/system?Module=ManualAdjust"

author: ChrisZ
author_rank: Newbie
timestamp: May 08, 2025, 07:58:20 pm
content: Here are some more API endpoints that you can use to control the camera without accessing the webpage:Change colorCode:curl -X POST \-H "Content-Type: application/x-www-form-urlencoded" \-H "Cookie: Name=admin; Pass=admin; Type=Admin; Language=zh-cn; DevType=D8X3NT; OEMINFO=OEM; Name=admin; Pass=admin; UserType=Admin; IPCamera=D8X3NT" \-d "RuleId=8" \"http://<camera IP address>/cgi-bin/system?Module=DMColor"RuleId is defined as:Code:<option value="100">High Temperature</option><option value="1">Amber</option><option value="2">Hot Metal</option><option value="3">L. C. Rainbow</option><option value="4">Dark Tint</option><option value="6">H. C. Rainbow</option><option value="7">Cool Metal</option><option value="8">White Hot</option><option value="9">H. Rainbow</option><option value="10">Black Hot</option><option value="11">Iron Oxide</option>Zoom levelCode:curl -X POST \-H "Content-Type: application/x-www-form-urlencoded" \-H "Cookie: Name=admin; Pass=admin; Type=Admin; Language=zh-cn; DevType=D8X3NT; OEMINFO=OEM; Name=admin; Pass=admin; UserType=Admin; IPCamera=D8X3NT" \-d "value=X2" \"http://<camera IP address>/cgi-bin/system?Module=VideoEZoom"GainCode:curl -X POST \-H "Content-Type: application/x-www-form-urlencoded" \-H "Cookie: Name=admin; Pass=admin; Type=Admin; Language=zh-cn; DevType=D8X3NT; OEMINFO=OEM; Name=admin; Pass=admin; UserType=Admin; IPCamera=D8X3NT" \-d "value=20" \"http://<camera IP address>/cgi-bin/system?Module=GainAdjust"BrightnessCode:curl -X POST \-H "Content-Type: application/x-www-form-urlencoded" \-H "Cookie: Name=admin; Pass=admin; Type=Admin; Language=zh-cn; DevType=D8X3NT; OEMINFO=OEM; Name=admin; Pass=admin; UserType=Admin; IPCamera=D8X3NT" \-d "value=50" \"http://<camera IP address>/cgi-bin/system?Module=BrightnessAdjust"

author: clavo
author_rank: Newbie
timestamp: May 15, 2025, 10:53:41 pm
content: Does adding or removing that resistor make the BNC composite pigtail work?Quote from: cynfab on October 09, 2024, 05:38:34 pm

author: cynfab
author_rank: Regular Contributor
timestamp: May 19, 2025, 01:17:51 pm
content: Adding a 0 Ohm resistor there does route the NTSC video to the BNC. Should it be 0 Ohms, or some other value? 0 Ohms works in my case, but I hardly use the BNC output.In other news, the patched DALI "Temperature measuring system" provided by NegativeION can be switched to English by deleting the CN, JP, KR, RUS and TUR folders from the Resources folder.You can then unlock the Config section with the password "AdminPass".This software runs quite well under Wine on Linux.

author: Crispy9325
author_rank: Newbie
timestamp: June 14, 2025, 03:24:22 am
content: Hey folks - got one of these units in today and I've been playing round with it, lots of valuable information on here so far. It's one of the newer(?) 640 cores with the 4 stacked boards.Figured out the wiring for Analog out and got that hooked up, got it running on DHCP now instead of fixed which is also very nice.I may have missed it while reading the thread - has there been any progress on getting Analog out to show any of the other color profiles? It seems like it might be controllable with 5 buttons either getting pulled to ground (or up to 3.3v?), but there seems to be some oddness in how they are broken out of the 50 pin.Pins 4-7 go to a bank of 4.7k resistors, which all are connected on the other side. That connection does not appear to run straight to ground, so I'm unsure if they are being pulled up by 3.3 and shorting them to ground would "press the button", or if there is something else going on.The one that seems to be a doozy is pin 3, as while first it hops through a 0 ohm resistor, it then lands on the manual reset pin of an ADM706, and I haven't been able to beep out WHAT the reset pin is connected to. Not insignificant chance that it literally just blinks an LED when you press button 3, which I'm guessing is the menu. Possibly.But if it's not just blinking an LED...I suppose it depends whether these pins are held at ~1.8v and pulled high, held at 3.3v and pulled low... etc.If anyone has more insight on these would love to hear it. The 50 pin is a bit small, but I can spot tack some wires on the resistors no issues if that would give me a hardware controller!

author: davidje321
author_rank: Newbie
timestamp: June 21, 2025, 08:52:33 am
content: Is there a way you can provide me with the latest version of ICI Flash. Our computer crashed last week and we dont seem to get any response from ICI yet.Thanks

author: ThermalBreak
author_rank: Newbie
timestamp: July 07, 2025, 04:11:47 pm
content: Thanks to all the information in this thread, I have made a fair amount of progress on turning mine into a handheld. I have been using it with the backpack and a 12v battery that also powers a 7" screen. I tried using an adafruit 2 inch screen (640p), but that screen just does not have the contrast or brightness to be useful.With my newly designed breakout board I am getting much closer using only the core and direct analog video output as a handheld. I also wired up the onboard buttons to a 5 way joystick button so that I can access the core menu. Im planning on pairing it with a V760A-5 screen once I get it in. The menu buttons, I can confirm are pulled down to ground, at least on the initial core board (and my breakout). I would assume the same applies to the other backpack boards, but I am a newb when it comes to electronics, so while I would assume on the 3rd level board like @Crispy9325 is asking about is the same. I do not know that for a fact.Using the core menu via the buttons I am able to change the color pallets and contrast/brightness etc and those settings do stay for the next boot up.My 3d printed case is still a work in progress. This project has been a huge learning curve for me from having to learn kicad to trying to design a semi ergonomic handheld device in FreeCad that I can design and print in stages as the project progresses. I certainly never would have attempted it without the information in this thread.

author: Crispy9325
author_rank: Newbie
timestamp: July 07, 2025, 06:02:42 pm
content: Wow-ee! That's incredible!What's the board you're using for the analog out, and do you have the schematic file for that breakout board anywhere? (or was it one purchased?)That looks perfect for what I want to do with this little guy, and super excited that the onboard menu actually works!

author: angelortega
author_rank: Contributor
timestamp: July 08, 2025, 02:57:11 pm
content: Good work. Can you put some close up shots of where the 5-way controller wires are soldered to the back of the camera board so we can all do the same thing to the camera we all have thank you

author: ThermalBreak
author_rank: Newbie
timestamp: July 09, 2025, 03:48:03 am
content: I think there may be some confusion. I am soldering to the breakout board I designed so in essence I am just getting slightly bigger pads for the pinout in the user manual in this thread. I am using pins 1 and 2 for video and then 3-7 for the buttons. If you are attempting to solder to the board for the menu pins, I think where Crispy9325 has identified them with the resistor pads is probably the best bet. Pin 3 is certainly the menu button. So it wouldnt surprise me if it does blink an LED.I am working on an upgraded version of the board that fixes some of my issues (mislabeled pins) and making bigger pads for the buttons we actually care about (pins 1-7). I had also originally thought about building the board as a pass-through board with a female connector on the reverse so that you could have buttons and then utilize the rest of the backpack.Is the backpack worth saving for some applications? From what I can tell it's only usable function is to output the IP streams. I was thinking about playing around with overlays on the output, but it seems like you would either need to use other hardware to consume and re-output the stream, or find a way to hack the existing hardware. That is well beyond me.

author: gamerpaddy
author_rank: Regular Contributor
timestamp: July 16, 2025, 04:18:13 pm
content: Right now on ebay from poland (ships EU wide i think) there are a few ICI 384.https://www.ebay.com/itm/286638727266so i ordered one ... or lets say 5 lolit came with all the cables and even the black body calibrator, nice.i couldnt get the network stuff working tho. so i soldered a wire to it for analog video out. it wants High-Z video input, having a 75ohm doesnt seem to work.keep in mind, the video grabber is probably not the best for that test image.i allready set the menu to english by poking the button pins with tweezers to groundteardown next post due to image limit.weirdly, it says 640 all over the sensor and stickers, just one sticker says 384.. so its a 384x288 somehow. maybe it can be patched to be a 640?gonna dump the flash later.

author: gamerpaddy
author_rank: Regular Contributor
timestamp: July 16, 2025, 04:19:47 pm
content: more pics of the pcb stackthe sensor is definately a 640 :/

author: gamerpaddy
author_rank: Regular Contributor
timestamp: July 17, 2025, 12:30:03 pm
content: SPI Flash dump of my unit (thermal, not the ethernet / videoserver part):https://archive.org/details/dali-d-843n-flash-dumpThe bytemap has a interessting pattern ontop. it almost looks the same as on the FLIR units. its gotta be something related with the Altera cyclone IV fpga.The Videoserver has quite a bad video grabber on my unit. the OSD is barely useable with it. not sure whats going on, over CVBS it looks much better.i made some backpack boards to break out all of the pins, they should arrive in a week or two.has anyone figured out the password for System (17) or Main (18) menu? its not the focus- focus+ trippleAll OSD strings i could find:Code:ID_TEXT_BEGIN=BEGIN..===========================================ID_BOOT_PLEASE_WAIT=PLEASE WAIT...ID_BOOT_UARTADDR=Addr:ID_BOOT_UARTBAUD=Baud:ID_BOOT_UARTPROTOCOL=Protocol: ..==============================================ID_MONITOR_TITLE=IR SETTINGID_MONITOR_CONTRAST=1 GainID_MONITOR_BRIGHT=2 BrightnessID_MONITOR_ENHANCE=3 EnhanceID_MONITOR_AutoR1=4 RectifyID_MONITOR_ZOOM=5 ZoomID_MONITOR_COLOURMARK=6 Color MarkID_MONITOR_ALARMVALUE=7 Fire ThresholdID_MONITOR_NUC_MODE=8 Rectify ModeID_MONITOR_FLIP_VERTICAL=9 VerticalID_MONITOR_FLIP_HORIZONTAL=10 HorizontalID_MONITOR_LANTYPE=11 LanguageID_MONITOR_AUTOFOCUS=12 AutofocusID_MONITOR_TEMP_PARA=13 Temperature MeasurementID_MONITOR_SETUART=14 UartID_MONITOR_TEMP_ANALYSIS=15 Temperature AnalysisID_MONITOR_ALARMPARA=16 AlarmID_MONITOR_FACTORY=17 System MenuID_MONITOR_MENU=18 Main MenuID_MONITOR_RESET=19 Restore Factory SettingsID_MONITOR_EXIT=20 ExitID_MONITOR_AutoR1_OFF=NID_MONITOR_AutoR1_SHORT=LID_MONITOR_AutoR1_LONG=HID_MONITOR_COLOURMARK_FIRECOLOR=FireID_MONITOR_COLOURMARK_WHITEHOT=White HotID_MONITOR_COLOURMARK_BLACKHOT=Black HotID_MONITOR_COLOURMARK_IRONRED=Iron RedID_MONITOR_COLOURMARK_AMBER=AmberID_MONITOR_COLOURMARK_RAINBOW=RainbowID_MONITOR_COLOURMARK_LOWRAINBOW=LCR RainbowID_MONITOR_COLOURMARK_HIGHRAINBOW=HCR RainbowID_MONITOR_COLOURMARK_HOTMETAL=Hot MetalID_MONITOR_COLOURMARK_COLDMETAL=Cold MetalID_MONITOR_COLOURMARK_DARKTONE=Dark ToneID_MONITOR_COLOURMARK_STAGEDCOLOR=Staged ColorID_MONITOR_NUC_MODE_IN=INID_MONITOR_NUC_MODE_OUT=OUTID_MONITOR_FLIP_VERTICAL_YES=YID_MONITOR_FLIP_VERTICAL_NO=NID_MONITOR_FLIP_HORIZONTAL_YES=YID_MONITOR_FLIP_HORIZONTAL_NO=NID_MONITOR_LANTYPE_CHINESE=CHID_MONITOR_LANTYPE_ENGLISH=ENID_MONITOR_LANTYPE_RUSSIAN=RUID_MONITOR_RESET_SUCCSEE=Reseting Successful..===========================================ID_AUTOFOCUS_TITLE=Autofocus SettingsID_AUTOFOCUS_SWITCH=1 Autofocus SwitchID_AUTOFOCUS_PARA=2 Autofocus ParameterID_AUTOFOCUS_OVERSHOOT=3 Motor OvershootID_AUTOFOCUS_EXIT=4 ExitID_AUTOFOCUS_YES=YID_AUTOFOCUS_NO=NID_AUTOFOCUS_ING=Auto Focusing.....===========================================ID_TEMPPARA_TITLE=Temperature Measurement SettingsID_TEMPPARA_EMISS=1 EmissID_TEMPPARA_REVISE_TEMPERATURE=2 Revise TemperatureID_TEMPPARA_REVISE_DISTANCE=3 Revise DistanceID_TEMPPARA_HUMIDITY=4 HumidityID_TEMPPARA_ENVIRONMENT_TEMPERATURE=5 Environment TemperatureID_TEMPPARA_EXIT=6 Exit..===========================================ID_UART_TITLE=Uart SettingsID_UART_BAUD=1 Baud RateID_UART_ADDR=2 AddrID_UART_MODE=3 ProtocolID_UART_EXIT=4 Exit..===========================================ID_TEMPANALYSIS_TITLE=Temperature Analysis SettingsID_TEMPANALYSIS_STALL=1 StallID_TEMPANALYSIS_DISPLAY=2 Temperature DisplayID_TEMPANALYSIS_MODEL=3 Display ModeID_TEMPANALYSIS_EXIT=4 ExitID_TEMPANALYSIS_STALL_A=-20-180...ID_TEMPANALYSIS_STALL_B=100-600...ID_TEMPANALYSIS_DISPLAY_YES=YID_TEMPANALYSIS_DISPLAY_NO=NID_TEMPANALYSIS_MODEL_MAX=MaximunID_TEMPANALYSIS_MODEL_MIN=MinimumID_TEMPANALYSIS_MODEL_AVG=AverageID_TEMPANALYSIS_MODEL_CENTER=CenterID_TEMPANALYSIS_MODEL_ALL=AllID_MAX_TEMP=P_H:ID_MIN_TEMP=P_L:ID_AVG_TEMP=P_A:ID_CENTER_TEMP=P: ..===========================================ID_MONITOR2_TITLE=Alarm Parameter SettingsID_MONITOR2_ALARM_SWITCH=1 Alarm SwitchID_MONITOR2_ALARM_VALUE=2 Alarm ValueID_MONITOR2_ALARM_COLOR=3 Alarm ColorID_MONITOR2_EXIT=4 ExitID_MONITOR2_ALARM_YES=YID_MONITOR2_ALARM_NO=NID_MONITOR2_ALARM_COLOR_WHITE=WhiteID_MONITOR2_ALARM_COLOR_RED=RedID_MONITOR2_ALARM_COLOR_YELLOW=YellowID_MONITOR2_ALARM_COLOR_GREEN=GreenID_MONITOR2_ALARM_COLOR_BLACK=Black..===========================================ID_PASSWD=Password:ID_PASSWD_ERROR=Password Error..===========================================ID_RESET_102_ZOOM=Zoom:ID_RESET_103_GAIN=Gain:ID_RESET_104_MIDPORT=Brightness:ID_RESET_105_SHUTTER=Shutter:ID_RESET_106_POLARITY=Polarity:ID_ON=ONID_OFF=OFF..===========================================ID_TEXT_END=ENDstarting offset 0x107c00 there is some interessting stuff.like sensor variants, protocols, etc.looks like its running uC/OS-II RTOShttps://www.osrtos.com/rtos/uc-os-ii/Pelco-DPelco-PDaliBT656BT601FPA:DLD640, FPA:DLD641, FPA:DLD384, FPA:DLD384-6FPA:DLC384Prj:D883/D883T/D883CDL8XX, MJ32, MJ54Bad pixel correction: Bad points1, Bad points2, ReplaceBPEmissivity adjustment: fEmissivity==%fetc.edit: changing the color palette from the webserver doesnt change it on the camera itself.i have added a UART header but my phone decided to delete the image where to solder....

author: dennis1573
author_rank: Contributor
timestamp: July 17, 2025, 03:17:53 pm
content: Hi,i just desoldered the Flash chip of my Camera.This one is actually VGA res maybe it helps

author: gamerpaddy
author_rank: Regular Contributor
timestamp: July 17, 2025, 04:12:24 pm
content: Thank you so much dennis.it seems to have worked, It started right away, first shutter click was like, it didnt blow up WOHOOthe menu is chinese again so yes, it loaded the new flash contents.edit: to set it to english, its on page 2 #11. right below flip vertically and horizontally.The web server is still running on 384x288 so its all cropped but the shifted image and osd reveals, its a 640x512 YES!!!!i cant wait for the boards to arrive to get a proper analog video output.or somehow get terminal access and try to change it on the webserver.edit2: i should have backupped the web server flashby flashing the firmware from page one (V1.00.02 ....) its now bricked lol restarts constantly, no video stream.gotta get the flash contents off another cam next week.

author: dennis1573
author_rank: Contributor
timestamp: July 17, 2025, 04:58:12 pm
content: Nice, glad it worked :-)I also bought 2 of these cameras this morning. I had these cameras on my radar for a while now, but I didn't want to spend ~160 € for 300x400 resolution… I just waited and hoped for a price drop.I thought they had the DLC384 camera module inside... it uses the same lens, so it's impossible to tell what camera core is inside without opening the case…Now I really hope my cameras are also the DLD640 variant :-DBut what about the bad pixel map, and pixel gain/offset and all of that? That won't match your camera…Maybe it makes more sense, to compare the two .bin files and try to find the lines that are responsible for the resolution change and only replace those in your .bin file?

author: gamerpaddy
author_rank: Regular Contributor
timestamp: July 17, 2025, 06:53:23 pm
content: theres a lot of differences all over the place, as if its a newer firmware.i havent found the offset for the pixel map yetcouldnt get ghidra with the nios ii module working to disassemble the flashdump.but i also havent seen any bad pixels on that crop view yet, but i have to check once i get the boards for analog video out.for now, im trying to get the web server running again. uart debug just says restart with the wrong firmware i uploaded.

author: dennis1573
author_rank: Contributor
timestamp: July 17, 2025, 07:13:00 pm
content: Yes you are right, i just had a look with a hex editor myself....I dont think i can help you with the Webserver Flash chip...its a 25Q256 and i cant find it in the supported ic list for my TL866CS... :-/

author: gamerpaddy
author_rank: Regular Contributor
timestamp: July 17, 2025, 07:33:12 pm
content: so, i quickly hooked a wire to it, for analog video out.may be still a bit blurry, that grabber is horrible.it looks good, a little low on contrast as i couldnt set up the gain/brightness without the network module / knobs to navigate osd.but its using the whole image now, centered, not crop. very nice.dead pixels are there as expected. maybe we find a solution for this someday.good thing is, the thermal module eeprom can be flashed without desoldering i found out. a soic8 clip works just fine.i ordered 4 more cams yesterday, i just grab the flash contents off one of these. thanks.

author: dennis1573
author_rank: Contributor
timestamp: July 17, 2025, 09:11:00 pm
content: No problem, hope you get it working again :-)The Bad pixel map might be from 00F80020 - 00FCB010. I see mostly 0x00, with a few 0x01 dotted around.if i select that Area and save the selection to a .bin file, its exactly 307200 bytes in size that would match 640x480.

author: gamerpaddy
author_rank: Regular Contributor
timestamp: July 18, 2025, 07:38:26 am
content: the header at 00F80000 is BPRP, i wondered what that could be.first i saw there was a bitmap hidden (somewhere else) in there but its just a crosshair.but this "BPRP" makes sensefor mine it was 110624 bytes (32 + 384x288 )for yours its 307232 (32 + 640*480 )so i cant just load my old map into the new firmware, i gotta craft a new one.32 byte header consists off:4 bytes "BPRP"4 bytes maybe checksum?16 bytes Sensor model4 bytes 0x004 bytes (little endian 32bit) pixel count<pixel count> bytes of either 0x0 or 0x1just made a program to display and edit them but without changing those 4 (probably) checksum bytes yet.i havent checked the orientation of that map yet. could be the wrong way around.just load in the flash dump, edit, save and flash it back on the chip.https://2466047.playcode.io(source:https://playcode.io/2466047)turns out, the camera doesnt care what those 4 "checksum" bytes are. i just made a binary with a clean map and flashed it. it started up straight away.Next step maybe STM32/FX3 DCMI to USB UVC backpack? to get raw Y16 stream?^^

author: dennis1573
author_rank: Contributor
timestamp: July 18, 2025, 12:30:51 pm
content: Oh.. quite a few bad pixels on my Detector... and thanks for that program.The crosshair looks like it might be used for selecting new bad pixels?So maybe, there is an option for that in the protected menu.Some newer thermal monoculars have that option too...Maybe if you align your Bad Pixel map correctly, you only have to do a little bit of manual work on the edges...I dont think the webserver board will help you alot with BPR, because the videostream has compression and so on.. its not 1:1...I was never really impressed with the output of this camera, the picture looks...flat.. not much contrast...i think its because in white-hot for example, black isnt really black its still gray... its not "0".With the help of Chatgpt, i made a small Python script to remap the output of the webserver back to 0-255 this really boosts the contrast but also adds alot of noise...Maybe thats why they did it that way? to hide the image noise?

author: ArsenioDev
author_rank: Frequent Contributor
timestamp: July 18, 2025, 01:42:24 pm
content: Quote from: gamerpaddy on July 18, 2025, 07:38:26 amYou can enable the reticle in the settings menu. These are ***NOT*** shock and vibe rated for recoil dyamics though, do not just slap on a rifle and call it a day (unless it's 10/22 lol)Quote from: dennis1573 on July 18, 2025, 12:30:51 pmThere's only 8 bits of the 14 used on the digi output to the webserver, rebinning the histogram to 8B was too computationally expensive and not useful for the targeted purpose of these systems.Compare the analog (which is I think 10 or 12 bits) to the digital from the webstream and you'll see major differences.

author: gamerpaddy
author_rank: Regular Contributor
timestamp: July 18, 2025, 03:12:04 pm
content: Yes probably, in the firmware there are strings like Bad points1, Bad points2, ReplaceBPunless we crack the password for those menus.. 5 keys 6 digits ..its just 15600 possible combinationsor someone gets that ghidra / ida pro nios ii module running and analyzes the binary first. that out of my scope tho.those sensors are from 2010, so not the latest tech. but i think the electronics behind them are the limiting factor.a board that turns those 14bit cmos video into useful signals would be great.Maybe a STM32H7 board with its DCMI interface and some external SDRAM to Ethernet / USB.not only for this core but FLIR and my unknown Ulis "Northpoint" thingy seems to use it aswellthere are allready such products for flir...https://thermalcapture.com/thermalcapture-grabber-usb-v2/but they ask 2..3 grand for just the backpack module.

author: Crispy9325
author_rank: Newbie
timestamp: July 18, 2025, 03:26:54 pm
content: Quote from: gamerpaddy on July 18, 2025, 03:12:04 pmCould probably automate cracking that with an arduino or similar somehow, I doubt there's security/lockout protection on these things to prevent spamming password attempts. Even if it took 10s per attempt that would be 100% chance of getting the password within 44 hours. Not great, but automated to not terrible.

author: gamerpaddy
author_rank: Regular Contributor
timestamp: July 18, 2025, 04:12:18 pm
content: i tried a few minutes over the webui and havent been locked out.as you can press buttons over UART by sending the "KBD,key,checksum" command, i think its really easy.just havent figured out how to calc that checksum. i probably just replay commands i captured from the webserver to core sniffer.just reading back if you succeeded is a problem so i probably film it and light up some leds that represents the keys, then later watch back the footage what password it was....then reset the flash for all the mess caused by setting random stuff in forbidden menusi asked Dali for the protocol reference datasheet but havent heard back from them.i just captured some on startup, the webserver sends this to the core (some characters are non ascii)Code:KBD,1,ZBPM,0,gBPM,1,hSCO,1,nIBR,1,fGSI,1,lKBD,C,lGFZ,GCS,MEH,MEH,MEH,GTD,GET,GEM,GRT,GRD,GHD,¦GNU,SDT,2010-01-01 00:21:49,SCO,127,IBR,127,¦SEH,0,hSSM,1,|SMR,0,zSDT,2010-01-01 00:21:50,¦KBD,C,lthe core sends this back:Code:BPM,0,gAVS,0,rABS,0,^ABBPM,0,gBPM,1,hBPM,1,hAVS,1,GCS,1,0,¦MEH,2,dMEH,2,dMEH,2,GTD,1,0,¦GET,1,18,¦GEM,1,100GRT,1,0,¦GRD,1,20,¦GHD,1,60,GNU,1,1,¦SCO,1,nIBR,1,fSEH,1,iSSM,1,|SMR,1,{BPM,0,gBPM,1,h

author: Crispy9325
author_rank: Newbie
timestamp: July 18, 2025, 04:34:14 pm
content: Set up a light sensor over part of the screen that doesn't change when doing inputs, presumably it will change when it gets into the menu, have it pause operations on change. at worst if it was moving quickly you'll have 4-5 sequential numbers.But also try this code if it's a numeric input: 871897

author: gamerpaddy
author_rank: Regular Contributor
timestamp: July 18, 2025, 05:03:59 pm
content: its not the super password for the webserver.its just 5 possible buttons, S F M + -, the C key doesnt count.the password is exactly 6 in length (auto accepts/rejects at the sixth) and the menu is just some faint ascii overlay on the image.nothing that can be differentiated easily from the background noise.

author: dennis1573
author_rank: Contributor
timestamp: July 19, 2025, 12:56:06 am
content: Ok with the Magic of AI, i made this Python script to bruteforce the Password...I use ODM, because there is almost no latency. The script takes a Screenshot of the Center of the Screen (1000*500 Pixels).The Filename is the Combination it tried, but its not perfect... sometimes the webserver is to slow or whatever and it misses a button press...I already made the Delay longer, but sometimes the video lags/freezes and it misses it... or the text is already gone....i dont know, if this also happens with uart i havent tried that yet...But the script could be improved, with OpenCV perhaps.Maybe analyzing the last screenshot (OCR), if it sees the "*" Symbol somewhere or no text at all, it missed a key so it tries the Combination again and if it sees "error" continue.Of course, if it fails it has to close the password prompt by counting the "*" and press a Button a few times before trying again...i will try to improve the script tomorrow...well, i mean Chatgpt will :-DBut isnt it 6 Buttons? the Debug Menu has 6 Buttons, and the S Button opens a Password prompt but also acts as a key for the password.So i think its 6 buttons, 46656 Combinations according to Chatgpt (not including retries) just under 8 days...Edit:I completely overread that...You said the C button doesnt count but why?It also registers as a Button press for the Password...And now i see why it lags/freezes! it takes longer for that button to register...interesting.But the S button aswell, sometimes i have to press it multiple times for it to register.The other 4 buttons work perfectly and very fast....Ok, i let the script run overnight or whats left of it...(without the C and S key) maybe i get lucky :-DThats what the Script looks like at the moment:Code:import requestsimport timeimport itertoolsimport pyautoguiimport os# Camera settingsCAMERA_URL = "http://192.168.1.102/cgi-bin/dmcmd?Command=KeyBoard"HEADERS = {"Accept": "*/*","Accept-Language": "de-DE,de;q=0.9,en-US;q=0.8,en;q=0.7","Connection": "keep-alive","Content-type": "application/x-www-form-urlencoded","Origin": "http://192.168.1.102","Referer": "http://192.168.1.102/D8X3NMonitor.html","User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36"}COOKIES = {"Name": "super","Pass": "871897","Type": "Super","Language": "en-us","DevType": "D8X3NT","OEMINFO": "OEM","UserType": "Super","IPCamera": "D8X3NT"}KEY_MAP = {'+': 43,'-': 45,'F': 70,'M': 77,'S': 83,'C': 67}KEY_DELAY = 2 # Seconds between each keySCREENSHOT_DELAY = 0.5 # Wait after last key before screenshotAFTER_SCREENSHOT_DELAY = 2 # Wait after screenshot before next try# Screenshot configSCREENSHOT_WIDTH = 1000SCREENSHOT_HEIGHT = 500SCREENSHOT_DIR = "screenshots"os.makedirs(SCREENSHOT_DIR, exist_ok=True)def send_key(char, delay=True):if char not in KEY_MAP:print(f" Unknown key: {char}")returnpayload = f"Value1={KEY_MAP}"try:res = requests.post(CAMERA_URL, headers=HEADERS, cookies=COOKIES, data=payload, timeout=5)print(f" {char} -> Status {res.status_code} | Response: {res.text.strip()}")except Exception as e:print(f" Sending {char}: {e}")if delay:time.sleep(KEY_DELAY)def take_screenshot(combination_str):screen_width, screen_height = pyautogui.size()left = (screen_width - SCREENSHOT_WIDTH) // 2top = (screen_height - SCREENSHOT_HEIGHT) // 2filename = os.path.join(SCREENSHOT_DIR, f"{combination_str}.png")image = pyautogui.screenshot(region=(left, top, SCREENSHOT_WIDTH, SCREENSHOT_HEIGHT))image.save(filename)print(f" Screenshot saved: {filename}")def try_combination(combo):combo_str = ''.join(combo)print(f" Combination: {combo_str}")send_key('S') # Open password promptfor key in combo[:-1]: # Send all except last with delaysend_key(key)send_key(combo[-1], delay=False) # Send last without delaytime.sleep(SCREENSHOT_DELAY)take_screenshot(combo_str)time.sleep(AFTER_SCREENSHOT_DELAY)def main():all_combos = itertools.product(KEY_MAP.keys(), repeat=6)for combo in all_combos:try_combination(combo)if __name__ == "__main__":main()

author: gamerpaddy
author_rank: Regular Contributor
timestamp: July 19, 2025, 07:22:01 am
content: Ah!KBD C causes the FFC shutter click that makes everything lag until it is finished.when i tried over the web ui, (which took forever) i didnt see it counts as a key, maybe didnt wait long enough.good luck. thats gonna take a whileedit:4 more arrived. THERE IS a chance to actually get a 384 core, as one of the four was a real 384 not 640.lol angry reboot routine found in /app/app.shjust dumped the webserver flash and soldered some wires to it for uart console.. its root no pass.EDIT:modifying the /app/mach.cfg and /app/dali.cfg (downloadable via tftp) makes the webserver accept 640x480just set toMACH = DL640InfraWidth =640InfraHeight =480also a higher bitrate is no problem performance wise.edit2:to add more palettes, just put <number>.bmp of 256x20 into /app/color and load them as usual with curl system?Module=DMColor RuleId=<number>.by default theres 0-10 and 100. i added 11-20, it works.onvifserver is spamming all over the place..Code:killall onvifserverit and thenCode:./app/onvifserver > /dev/null &makes it quiet.

author: dennis1573
author_rank: Contributor
timestamp: July 22, 2025, 09:06:06 pm
content: My 2 Cameras arrived yesterday, both are DLD640 variants :-)Unfortunately, i havent had much time to test them yet...My little Bruteforce attempt also didnt go anywhere....Actually, it just revealed more Problems...There seem to be a few Combinations after which it will open the Menu instead of a new Password prompt, when you press the S button again....i dont know if this is some kind of counter measure or just bad chinese programming...ive tested around a bit today, with openCV and tesseract ocr well...until the Shutter suddenly stopped working...now i have another Problem to solveits probably the DRV8837 next to the Altera BGA, i will swap it between 2 of the cameras to see if thats the issue...Atleast i got something done today, here is a little case i designed for the board stack.I think, it makes the Camera look a bit more like a finished Product. :-)The Tripod mount has no threading, i made it a bit smaller so it cuts into the Plastic...Attached is the STL file and a few Pictures.

author: gamerpaddy
author_rank: Regular Contributor
timestamp: July 22, 2025, 10:01:47 pm
content: i have had that shutter problem too once, after re-assembly but it somehow fixed itself after a while.maybe it messed with your settings and turned it off?Option 4 "Rectify" is auto zero function: Off / Short / LongOption 8 "Rectify mode" IN: Internal calibration mode (factory default setting) OUT: External calibration modeso probably shutter related.Also, Dali responded to my emails but is not very helpful. just questions where and when i bought them and if i have a order proof.. and that i should contact ICI instead as its their oem integration.i gotta start looking at the sensor directly, how its driven.just saw the 384x288 had 3 clock signals:7.5MHz14.705KHz50Hz (short pulses)its driven by 3.3V alongside with some control voltagesnice looking case, but i probably want to get rid of that webserver alltogether, it just degrading the video quality too much.maybe a ESP32-P4 is able to work with the digital out when using external PSRAM, its got a h264 encoder and a DVP input. aswell as USB HS and webserver capabilities.but im not into this deep enough, i probably spend a few bucks on a AI API and start vibe codinghttps://docs.espressif.com/projects/esp-idf/en/stable/esp32p4/api-reference/peripherals/isp.htmledit:its gotta be those 5 or 6 keys.ive sent custom keyboard commands to the core using http://<ip>/cgi-bin/dmcmd?Command=KBD,%2B (2B is ascii +)they go trough but wont get registered in password prompts.

author: gamerpaddy
author_rank: Regular Contributor
timestamp: July 24, 2025, 09:25:56 pm
content: tried to figure out some commands to the core38400 BAUD,all sent trough http://<ip>/cgi-bin/dmcmd?Command=COMMAND,VALUEGet commands need a , to be validto get the answer.. well solder a uart header to the thermal core. (on the bottom where the eeprom is are two resistors)see drawingMade a editor for some settingshttps://2476424.playcode.io/Code:KBDKEYKeyboard (F S M C + -)SSM0-1Image Filtering Off/OnGSM0Image filter statusSEH0-1Image Enhancement Off/OnGEH0-1Image enhancer statusSCO0-255Set Gain (locked when SAG auto gain is on)GCO0-255Get gainINT0-255set actual gain? not just contrast sometimes disabled?IBR0-255Set brightnessGBR0-255Get brightnessSMR0-3Mirror mode bit0=horizontal, bit1=verticalGMR0Get rotation/flipSDT0-1displays temp=44.65°C osd, but webserver sends date/time to the cam there....GDT0-1Get temp display active?GPTDisplay temp oft SDTGNU0-1Get Shutter closed/openSNU0-1Shutter close / openSTD0-1Set Range 0: -20-180°C 1: 100-600°CGTD0-1Get RangeSET°CSet Ambient temperatureGET°CGet Ambient temperatureSEM0-1000-1 set emissivity x100GEM0-100Get EmissivitySRT°CSet revise temperature -100-100 -10-10°GRT°CGet revise temperatureSRD100Set Distance 4.4m x100GRD100Get DistanceSHD0-100Set HumidityGHD55Get HumiditySWP0-1invert s/w polarity imageGWP1is inverted?SPA0-10?Set color paletteGPA3white hotSMV0-1Show temperature 3x3 grid?? in combination with GTV maybeGMV0SMS0-1displays "collected 0/<number set by SCT>" by SCP delay "saves the daily number of highest temperatures?"GMS0SCT1-500sets the amount of "collected" points for SMSGCT80SCP5-60"collected" delay in seconds for SMSGCP60GTVGet the collected temp values?SAG0-255Auto brightness / gainGAG0SLR0-9???GLR0SRP0,0 - 639,479set crosshair positionGRP320,240get crosshair positionDRC0-1Show crosshairSLG-500-500??GLGSCEtext??GCE0SCBtext??GCB0SVB0-16383adc offset, exposure? good at 9650GVB6733value is 16383 minus SVBSVC1-1023set contrast but betterGVC260SZM1-499?GZM1MSVsave settings too eepromASVSaves something aswell?GCS0Get Core status & faultsALD0,2?video blanks lots of eeprom activity. reload eeprom? doesnt load defaultsSOT0-1?? sensor supply, looks weird when off.SVF100-??? video freaks outSVS100-??? video freaks outSAV0-9999?? profile maybe or SAC SAB relatedBACchange uart protocol? carefulCBDDisplays Recovery successful?LRDDisplays Recovery successful?LREDisplays Temperature Repair successful?DBP??? shutter clicksDPIShow weird pixelsAPIHide weird pixelsCCM??ASN0-4??GAB4 vals?? 3,-10,50,150GAN1??GAR11 vals?? 10,10,5,20,35,50,70,90,120,150,180,,GCM6 values??GAV2100Fire ThresholdGFVprints screen gray value?GIT200??PTSechoes but with extra stuff??QYA7170Query Gray Info (information mode)QYI7124Query Gray Average modeQYM7512Query Gray Minimum modeVTP400-4000??return 0 invalid params:STS??STT??SAC??SAH??SAS??SAT??SCX?? displays crosshair but invalid paramsSCY?? displays crosshair but invalid paramsGAC??GAH??GAS??GAT??GME??GPC??GPI??GPM??GTA??GTC??GTI??GTM??GTS??GTT??Return 0 is wrong parameters or out of range?Return 1 is OKReturn 2 is invalidanswer:BPM0-1stream ready? answers with 0 stop, 1 go, 2 when promptedAVS0,1MEHPWI0-1changing palette from wh to fireunconfirmed (from dm60comm.so):SDT2024,03,15,14,30,25Set Date Time with year,month,day,hour,minute,secondSTS1Set Temperature Show display (0=off, 1=on)SVA2Set Video Auto mode (0=manual, 2=auto)SMP0,1,1,0,100,150,200,250,300,350,90,25Set Measurement Point (type,index,enable,mode,startX,startY,endX,endY,anchorX,anchorY,threshold,color)STVStop Temperature View measurementsSPF5Set Profile parameterSVL-10Set Video Left pan movement (signed value)SVU-5Set Video Up tilt movement (signed value)SVD5Set Video Down tilt movement (signed value)SSP17,1,0Set System Parameter (param_id,value,index) #46temperature format 0 °C, 1 °F, 2 KSCPSet Current Preset (save current position)GCPGet Current PresetSTT300,350Set Temperature Threshold (low,high values *10)SDC1Set Display Configuration parameterGCSGet Current StatusGMMGet Memory Map informationGFVGet Frame Value (grayscale data)GFZGet Freeze StatusGSI1Get System Information (parameter=1)GSSGet System StatusGSP21,0Get System Parameter (param_21=surround temp, value=0)GTTGet Temperature Threshold rangeGTV1,3,10Get Temperature Values (enable,type,count)GNUGet Network Update status (response command)FRZFreeze current display frameLIVLive mode (unfreeze display)CALCalibrate systemCCP3Call Current Preset (preset number 0-9)APF100Auto Profile settingMEHMeasure EnhancementBPTBuilt-in TestMTCS,0Measure Temperature Capture (S=start, 0=sequence)MTGU,0,1024,<data>Measure Temperature Gray data transferMTDU,0,1024,<data>Measure Temperature Data transferUFPS,0,2048Update Firmware Prepare (S=start, 0=offset, 2048=size)UFDS,0,1024Update Firmware Data transferBABUBuffer operation (U=update)TTHS,0Temperature Threshold operationIPP192.168.001.102,255.255.255.000,192.168.001.001,192.168.000.001,9989,9998IP Parameters (IP,netmask,gateway,DNS,port1,port2)MAC00:60:A9:10:00:01MAC Address settingSNPSet Network Parameters (response command)QYIQuery Gray Info (information mode)QYAQuery Gray Average modeQYMQuery Gray Minimum modeGAIGet Alarm Info (response command)YTC<data>Unknown command with data parameterHTHLRSLRDGARDRCPTSSCXSCYCBTLRECBDCBSXXXGSPGTTQYIQYAQYMedit:i hooked up my Logic analyzer to the spi busfigured out some eeprom settingsCode:Flash offsets:0x000000-altera cyclone iv stuff0x200000-settings0x280000-?0x4C0000-looks like a image?? 36010 bytes0x580000-image aswell? 36010 bytes0x740000-GUIX?0x7C0000-Strings for Gui?0x800000-another shorter GUIX0x880000-Strings for second gui?0x8C0000-GUIX0x940000-Strings for gui0xE00000-?0xE80000-dzxg? short0xEC0000-crosshair.bmp0xF40000-3DTM?0xF80000-Bad pixel map BPRP0x20000 Settings offsets:offset size Cmd0x01SAG(0-2) auto gain0x22SVB(0-16383) saved value is 16383 - SVB0x42SVC(0-1023) set exposure or gain0x61SSMimage filtering0x81SEHimage enhancement0xA1SWPinvert b/w polarity0x141SMRFlip0x161SMRMirror0x201MENUCal source 0 IN, 1 OUT0x3A1MENUEnhance value 0-1000x401MENURectify (shutter 0 OFF, 1 L, 2 H)0x501MENULanguage 0 english, 1 chinese, 2 russian0xA2-SCOset contrast gain0xA4-IBRset brightness0xAE2MENUFire Threshold0xAC1SPAset color palette0xE21SMSdisplay "collected 0/80" enabled0xF81SEMset emissivity0x1101SRTset revise temp0x1161SHDset humidity0x1181SETset ambient temp0x11A1STDset temp range0x1202SLG-500 to 500?0x1242SRDset distance0x12C1SCP???0x1302SCT???there is more obviously but without the command / menu i cant change it to see what it doesEDIT:the dead pixel map is stored somewhere else aswell.the BPRP is very basic.i noticed when running the DPI command all my cameras had the same dead pixel map even tho i cleared it.turns out 0x4C0000 and 0x280000 are the real dead pixel (and flatfield) mapsi made a viewer to show this:https://2477569.playcode.io/the fake 384 cameras with dld640 in it have a large chunk taken out of these maps.edit4.. or5:i found a raw-data endpoint on the webserver to get 14 bits of data from it under:<ip>:5000/stream?Type=RAW&Source=Raw&Mode=TCPits a file with a DL700B12 header and contains two 640x480 images, one is the upper one the lower byte of a unsigned intthis program captures it (well.. its not fast ) and you can adjust the raw value offset and range to display, including palettes.https://pastebin.com/dyNWDPT3

author: dennis1573
author_rank: Contributor
timestamp: August 03, 2025, 03:37:18 pm
content: Looks like alot has happend in my absence...QuoteYes thats exactly what happened... thanks :-)i refined the script, OCR didnt work it couldnt reliably detect the "*" symbol it would sometimes see a "." or an "a"i could have made my own OCR library, with pictures of the actual chars on screen but that would have been to much work... a seperate program is needed for that and it only runs on linux apparently...So i did a simple bright/dark check for the areas with the * charsi had the script running on an old laptop for the last 6 days first i tried all combinations with + - F M Sbut nothing...Then i included the C button and changed it to only try combinations with atleast one C in it. That didnt work at all, because if the C is the last char in the combination it wouldnt display "wrong password" the box would just never appear...just try: +++++C for example...So I changed it to only try combinations that have at least one C, but only if the C isnt at the end of the combination.I left it running for a few more days, and this morning I was greeted with the system menu.Now drumroll please :-DThis is the Combination: +-MC+-At first, I was hesitant to post this. A few times, someone here on the forum was looking for software I actually had, but it had "Do not distribute" written all over it... so I didn’t share it...But I guess in this case it's okay. With enough time and maybe some AI help, someone would probably find the password anyway.

author: gamerpaddy
author_rank: Regular Contributor
timestamp: August 03, 2025, 03:44:07 pm
content: Thanks to all efforts on this projectIve documented all whats known so far on the RECESSIM wikihttps://wiki.recessim.com/view/Dali_D8X3N_Thermal_Camerafeel free to contribute.

author: gamerpaddy
author_rank: Regular Contributor
timestamp: August 04, 2025, 01:38:11 am
content: I made a web ui that shows the raw stream within a modern browser. horrible performance tho.Just create the file and the code inside./app/web/webpages/raw.htmlhttps://pastebin.com/kaiXwAgD/app/web/webpages/cgi-bin/proxy.cgihttps://pastebin.com/vii1HXcUand run chmod +x /app/web/webpages/cgi-bin/proxy.cgithen restart your camera.It should be accessible now trough http://<camera ip>/raw.html in the browser and click Start StreamI also documented the folder structure on the secret menus on the recessim wiki.there is also a auto-correction mode for dead pixels!its under System Menu - Area - DeadPixelModel and set the AutoBP (sensitivity for auto bad pixel finding) to 50 or so. Then press C ButtonR2: is flatfield. put something cold infront, press +, then something warm, press + and wait.in the end hit S: to save.

author: Killy.THI
author_rank: Newbie
timestamp: August 08, 2025, 07:27:22 am
content: I got one of these cameras today. Using the existing backpack and an MS 2107 Capture card, I managed to craft a makeshift backpack PCB with a little bit of soldering, and it already reveals some awesome pictures.The picture is taken from an OTG-capable Android device, and the chip supports up to 50 Hz (or perhaps my software limitations) capture rate. I am drawing a more integrated backpack for easier hardware side development. Just wondering if anyone knows how the buttons are defined? Are they pulled down (active high) or pulled up (active low)?Thanks in advance!

author: CRC
author_rank: Contributor
timestamp: August 10, 2025, 04:23:30 pm
content: Maybe I posted some of this before, I should go look but anyway, I made an outdoor rated housing for my jeep and piped the video to the aux backup camera input of my jeep stereo. A stand alone 4.3" monitor with a 3D printed shim to expand it houses an Arduino and menu buttons for control. The gray housing was an initial test but I ended up changing to PA6CF filament.I tried to upload more photos but it kept giving a size limit error. I'll try later when on the PC and can resize.

author: Fraser
author_rank: Super Contributor
timestamp: August 10, 2025, 04:26:33 pm
content: Nice housingFraser

author: gamerpaddy
author_rank: Regular Contributor
timestamp: August 11, 2025, 02:35:32 am
content: @Killy.THIThe button inputs are internal pull-up and go to ground when pressed.just noticed, there is no "S" key, just over the KBD command.ive been trying some sharpening and contrast enhancement methods like palette repeating in the raw viewer, i also got it to work with a continous stream at about 12fps nowand made case to fit one of those 12V PoE splitter adapters so i can run it directly over a PoE switchthe adaptor pcb was a failure, i managed to flip the pinout completely.. luckily i didnt fry one of my cameras.i also tried other features like frame averaging, motion extraction and different sharpening methods, no success so far on improving it further.

author: ThermalBreak
author_rank: Newbie
timestamp: August 11, 2025, 07:51:20 pm
content: Quote from: CRC on August 10, 2025, 04:23:30 pmI saw where you had posted this on another site and that post is what inspired me to give it a try! I have mine working as a decent handheld.Im using a v760a-5 screen and a single protected 18650 battery along with my custom breakout board and a simple 5 way button for the menu. A cheap mini DVR is tapped to the side for recording fed from my built-in 3.5mm video out port.Im still working on the case design. The most difficult has been trying to figure a way to use a screw cap for the battery bay and have it transmit power in something made of plastic. Version 2 case (green) with my design for the contact in the rim of the battery tub didnt pan out so for the moment im using a free wired battery terminal I just hold in place by the cap. The hole in the side I cut to access the screw locking the focus ring so I could manually adjust it.Unfortunately the lens on these is a little bit less than 1:1.

author: Killy.THI
author_rank: Newbie
timestamp: August 22, 2025, 07:39:45 am
content: Thanks for the pull-up info, I have designed a backpack with an integrated analog-USB capture card and a USB-Serial, probably for easier debug. Also fan-out all digital pins & convert to 3.3v for better development, should be arriving in a couple of weeks (or months, depends on the shipping)Note: the length matching is just pure pain...

author: gamerpaddy
author_rank: Regular Contributor
timestamp: August 22, 2025, 11:57:45 am
content: nicewhat chip are you using for video grabbing and uart? i considered just taking the ones off those 5$ grabbers but why not just solder the whole module onto the board directly.

author: Killy.THI
author_rank: Newbie
timestamp: August 22, 2025, 03:53:00 pm
content: The video grabbing chip is the MS2107, which simulates itself as a USB camera. The UART chip is the CH340N, and it also includes a USB 2.0 Hub IC, the CH334P. Also, thank you for your wiki info; it's really helpful. I can give you one of the backpacks once it is tested and working (it comes with a batch of 5 anyway), just lmk if you think my backpack can help your further development.I have also sent for SMT, not sure how long that would take. Once I've verified that my backpack is working properly and does not bake the camera, I'll open-source it.

author: Crispy9325
author_rank: Newbie
timestamp: August 22, 2025, 05:48:10 pm
content: That board looks great, looking forward to hearing how it works out!

author: gamerpaddy
author_rank: Regular Contributor
timestamp: August 29, 2025, 12:50:06 pm
content: Thanks for you kind offer, but im good for now.My boards also just arrived.. the working version, i hate soldering that 50pin connector...its a simple one, just to get to the digital pins, uart and buffered analog out. nothing fancy.The core commands look like this and require the correct length and checksum<STX><LENGTH1><LENGTH2>CMD,value,checksum<ETX>pseudocode:Code://cmd is allways 3 byte uppercase chars//values can be multiple comma seperated like 320,240function make_packet(cmd, values):payload = cmd + "," + join(values, ",") + ","bytes = ascii(payload)length = len(bytes)checksum = sum(bytes) mod 256return [0x02, length&0xFF, length>>8] + bytes + [checksum, 0x03]yes i made the holes too big

author: Killy.THI
author_rank: Newbie
timestamp: September 09, 2025, 04:19:40 am
content: Finally got my boards to arrive, worked immediately with a clear image with serial console for debug, and the button worked well, all in one! Got 5 SMT'd in a batch, for sure cannot use that much, so will either give or sell to someone else, perhaps. Just DM me if interested in a plug-and-play model.Will open-source it and create a GitHub repo for the boards themselves after more testing is done.

author: Crispy9325
author_rank: Newbie
timestamp: September 09, 2025, 04:26:45 am
content: Do those still have an analog out or is it now essentially a pure USB webcam with features? Interested in a board either way, especially if there's still analog!

author: Killy.THI
author_rank: Newbie
timestamp: September 09, 2025, 04:37:52 am
content: Yes, the upper FPC connector has all the signals you need (including analog output), please see Reply #128 pinout for ref.

author: Killy.THI
author_rank: Newbie
timestamp: September 14, 2025, 06:46:46 am
content: Alright, after some tweaks and edits, the schematic & production file for my backpack is here. There are still some edits and updates to be done, though, but the repo is set up, and a star is appreciated! Thanks in advance and o7!https://github.com/TOA-HI/Dali-Tech-D8X3C-Thermal-Camera-BackpackNote: a schematic & Gerber with BOM is attached below, in case someone doesn't have a stable GitHub access.

author: LMasterGame
author_rank: Contributor
timestamp: October 01, 2025, 05:10:40 pm
content: I got one of the Killy boards a week ago, and it works great.Although the board by Killy still applies MPEG compression, its way better than the compression from the web server and it doesn't compromise details.Also, I'm not sure if its the analog to UVC chip, or the core itself, but the analog video seems to have interlaced interpolation, which makes the video look way smoother than 25FPS. Some may hate it, some may love it.Maybe In a future design, someone could include an analog to UVC chip that supports uncompressed YUV stream.One thing that seemed odd is that the serial port is read only, I tried sending commands through several serial clients on linux and windows, and even with python scripts, but no luck.I wonder if it is intended to be read only, or theres a bug in the design, or in my unit itself.Other odd thing is that it doesn't align perfectly with the screw holes of the core, but at least 2 screws can be inserted, its more than enough.Nevertheless, this board is very convenient with the buttons and UVC output.Perhaps with an android phone, a battery bank, and USB-C splitter, it could be made somewhat portable.I already tried powering it directly from the phone, but it will simply not deliver power. I tried connecting it to a USB hub, and it worked, but it may burn the phone (or it may not with fast charging phones), so I wouldn't recommend it (it draws 3W from the USB port).

author: Killy.THI
author_rank: Newbie
timestamp: October 02, 2025, 01:20:34 am
content: Thanks for the update, I highly appreciate it!Please let me clarify some questions that you might get confused about:1), For the analog signal, the core itself outputs a 50Hz, PAL: 768 × 576; NTSC: 720 × 480 analog signal (quote from datasheet), while on the digital side, the raw heat-map data is 25Hz. The UVC chip I use is capable of handling higher-resolution data (see the attachment for the supported input by the UVC IC), but the analog signal is processed & capped by the core itself. I do have a separate digital fanout via FPC; I have started to find some way to see if it's possible to directly deal with the heatmap via a GoWin FPGA, or someone else with enough knowledge on FPGA can design their own video processing core.2), The serial also does not work on my end; however, I used an oscilloscope and captured the incoming signal sent to the camera. Somehow the camera does not respond to the signal input... Weird, more to be figured out here... I haven't tested it, but you can probably short / replace R4 and R5 resistors, as those are 10K resistors in the serial line for protective purposes.3), The screw hole is shifted by 0.5mm, due to the errors in their datasheet. The dimensions shown in the diagram are misleading, where, if I measured correctly, the lower bottom length should be 31mm, not 31.6mm, resulting in the screw holes on my design being biased. I tried to screw 4 screws all together (very tight fitting), and fortunately, it did not break. This is fixed in my second iteration.4), Regarding the Type-C USB port, if you try to flip the Type-C cable on the camera side, you will find that it should work with C-C cables on your phone. There is an error that I accidentally misconnected a CC resistor to the SS pin, resulting in one side of the Type C connector not receiving the proper power-on sequence, and consequently, no power is delivered to the device. Flipping the C-C cable will use the correct side (thus enabling the power supply). It will not toast your phone based on my testing on my OnePlus 11. Type A does not have a CC pin, so it is not affected by this. Also, this is fixed in my second iteration.Anyway, I have started designing for the second iteration of the board, fixed most of the above problems, which probably takes another one or two weeks till it arrives, stay tuned.

author: Killy.THI
author_rank: Newbie
timestamp: October 11, 2025, 04:29:12 am
content: Good news, the second iteration of my backpack has arrived!Most importantly, all problems were solved, screw hole matches, type C works in both ways, and most importantly, the Serial also works.The phone screenshot verifies everything all at once. The USB-C & USB 2.0 splitter works as the phone powering the camera, the analog capture chip works, and the serial monitor shows that the camera correctly responds to the command.For my older design, now it is confirmed that the Serial hardware wiring does not have any problems, but you need to short/replace R4, R5 with a 0R resistor (or at least low resistance), the old design uses a 10K in the serial bus; my mistake, shorting them should solve the Serial not responding problem.

author: LMasterGame
author_rank: Contributor
timestamp: October 12, 2025, 02:41:25 pm
content: Thanks for the update Killy, it is highly appreciatedI short-circuited the R4 R5 resistors, and the serial works like a charm! But it was a painful experience, since I only have a soldering iron with the thickness of my thumb (not literally, but still huge)But it was worth the hassle.For some reason, the USB on my board always worked both ways with any cable, as if the problem on the USB never existed, I supposed its only noticeable on some devices.My PC works both ways, while my phone works neither ways unless I plug the camera through a USB hub (otherwise it complains about high power consumption)Lastly, I never figured out how to pull the YUV uncompressed stream, it doesn't appear on any software.I have other camera that support YUV and show it correctly, so its definitely not an issue on my PC.I wish you succeed on making a board with the FPGA, it would be a huge upgrade compared to the poor dynamic range and washed out image on the core's analog video.

author: gamerpaddy
author_rank: Regular Contributor
timestamp: October 13, 2025, 03:39:40 am
content: the CC pins issue is only when you use a USB-C to C cable, if your using a USB-C to A cable those wrong wired CC pins dont matter.Good work killy!i stole your ideaof using CH340 and CH334 together with a ms2107 grabber module (less soldering needed) for my flir backpacks, they should arrive soon aswell. i hope i didnt made too many mistakes.The MS2107 should support YUV422 out of the box if it detected USB 2.0 according to their datasheet. i dont think having a uncompressed stream makes it much better.its still a limited analog signal and dac/adc conversion process before all that encoding and usb stuff that wont improve thingsmaybe this instead of a FPGA.STM32H747 DCMI to USBhttps://community.st.com/t5/stm32-mcus-touchgfx-and-gui/how-to-send-dcmi-capture-to-my-own-computer-display-not-lcd-st/td-p/51647Arduino Pro Portenta H7 for example.. or just the chip which is 20 bucks alone, more than a tang nano fpga board.