FLIR E75 Upgrade to E95 - Page 1
Forum section: electronics / general

author: DaveWB
author_rank: Regular Contributor
timestamp: March 02, 2018, 07:25:39 pm
content: Currently have an E75 on loan, man is it sweet compared to an upgraded E4, using this was my first time hearing about/using the UltraMax feature. Only downside to the camera is it's 7x the price of the E4.(Unless the E53 can be upgraded to E95, which is around $5k),I was able to get the camera to get to RNDIS mode via the hidden menu and it shows up as 192.168.0.1 under ipconfig /all(screenshot attached), however when trying to FTP into the camera with FileZilla it saysCode:Status:Connecting to 192.168.0.1:21...Status:Connection attempt failed with "ECONNREFUSED - Connection refused by server".Error:Could not connect to serverI tried both connecting anonymously and flir:3vlig and received the same error for both.I would like to upload a backup of the camera to see if there is a remote possibility of these cameras being upgraded before I have to give it back.

author: Chanc3
author_rank: Frequent Contributor
timestamp: March 02, 2018, 07:32:12 pm
content: I had the same problem when connecting to the T1030sc I had on demo. Perhaps try admin|admin admin|password or even root. Not that familiar with Linux, but try the default ones for that.

author: Spirit532
author_rank: Frequent Contributor
timestamp: March 02, 2018, 08:26:35 pm
content: The Ex5 and the E53 cameras run a brand new, in-house, completely unknown(to us) Linux firmware, rather than using the WinCE firmware that has roots in AGEMA, which was acquired by FLIR(the PM and P-series cameras).It would likely require a direct flash dump(or internal serial) to get the new FTP server passwords, sadly. And even then, it's a completely different OS with(likely) better security, since the entire Ex5 lineup and the E53 have a full-sized 640x480 30Hz detector inside them.

author: railrun
author_rank: Regular Contributor
timestamp: March 02, 2018, 09:17:16 pm
content: Hi Dave,192.168.0.1 is your PC. You have to try 192.168.0.2Quote from: DaveWB on March 02, 2018, 07:25:39 pm

author: Fraser
author_rank: Super Contributor
timestamp: March 02, 2018, 09:32:38 pm
content: Spirit523,A very interesting comment from you here. I thought the PM series cameras ran Linux but it was only a suspicion. I thought the WinCE usage came from the FLIR purchase of Extech and Indigo ?Have you had any experience accessing the operating system on a PM or P series camera please.I ask because I am interested n delving inside both a PM and P series cameras OS.Fraser

author: Spirit532
author_rank: Frequent Contributor
timestamp: March 02, 2018, 10:05:12 pm
content: Quote from: Fraser on March 02, 2018, 09:32:38 pmThe PM cameras are visibly screaming "I AM RUNNING NATIVE WINDOWS CE UI" when you run it, I don't know how you can miss it.You'll find that it's extremely similar to the new Ex series.

author: Fraser
author_rank: Super Contributor
timestamp: March 02, 2018, 10:43:44 pm
content: I am a specialist hardware tech, not a coder and definitely not knowledgeable on WinCE 😄

author: Fraser
author_rank: Super Contributor
timestamp: March 02, 2018, 10:54:13 pm
content: Likely showing my ignorance here, but I always thought Win CE was an X86 / ARM OSThe PM series cameras are MC68K based devices. The MC68340 to be precise. I shall have to investigate the firmware further in light of your comments.ThanksFraser

author: Fraser
author_rank: Super Contributor
timestamp: March 02, 2018, 11:07:50 pm
content: Wow I see WinCE was only released in late 1996 and the PM570 was a 1997 release as I tested the first one in the UK. That means the PM570 would be running WinCE 1.0 aka Pegasus. The very first release. AGEMA were pretty brave to base their latest ground breaking camera on one of Microsofts very early software releasesSorry, I have dragged this thread off topic. It was just that Spirits's comment grabbed my attention.Fraser

author: DaveWB
author_rank: Regular Contributor
timestamp: March 02, 2018, 11:20:01 pm
content: Whoops, my bad. I did try both 192.168.0.1 and 192.168.0.2 to connect to the camera using a bunch of combinations including admin/admin, root/ , root/toor, admin/password, etc... no go.

author: Spirit532
author_rank: Frequent Contributor
timestamp: March 03, 2018, 01:50:07 am
content: Quote from: Fraser on March 02, 2018, 10:54:13 pmCorrect, that means my knowledge is wrong.The UI definitely does look like CE though.

author: Pinkus
author_rank: Frequent Contributor
timestamp: March 03, 2018, 08:33:52 am
content: I am sure Flir's product manager of the Exx line almost got a heart attackwhen he first read the subject/topic in the thread list. You better add a question mark behind for their easement

author: railrun
author_rank: Regular Contributor
timestamp: March 03, 2018, 08:51:05 am
content: Quote from: Pinkus on March 03, 2018, 08:33:52 am

author: BOGET
author_rank: Contributor
timestamp: March 13, 2018, 02:23:30 pm
content: I don't have enough $ to burden a new Exx for test anymore,The price is too high for me, but I still want to see someone who can hack Linux-based systems.@Daveyou should try to login first using by a brute-force attack tool, (e.g. Hydra)Specified the username and use dictionary to find the password out.like:Code:# hydra -t 1 -l flir -P /your/password_dictionary's/path/password.txt -vV 192.168.as.yours ftpHere has some tutorial :

author: tomas123
author_rank: Frequent Contributor
timestamp: March 13, 2018, 09:36:24 pm
content: Quote from: DaveWB on March 02, 2018, 11:20:01 pmreally doesn't work the good old login?user: flirpass: 3vligthere is a simple hack to get the password:Connect the camera with the IOS/Android app and get the ftp password by record the wifi traffic (wireshark)

author: railrun
author_rank: Regular Contributor
timestamp: March 13, 2018, 09:46:01 pm
content: Quote from: DaveWB on March 02, 2018, 07:25:39 pm@tomas123: Maybe they changed the login, and/or password and/or use a other port...

author: tomas123
author_rank: Frequent Contributor
timestamp: March 14, 2018, 08:26:22 am
content: as I described above, I got the FTP password for my Exx some years ago with wireshark.it's easy

author: BOGET
author_rank: Contributor
timestamp: March 14, 2018, 09:24:08 am
content: @tomasI read lots of your post before,that was really awesome and very professionally,I think you're the one who can easily hack into new linux-based systems.

author: DaveWB
author_rank: Regular Contributor
timestamp: March 16, 2018, 08:50:35 pm
content: Sorry, haven't been watching this lately. Was just about to return the camera but will try both BOGET's and tomas123's suggestions

author: DaveWB
author_rank: Regular Contributor
timestamp: March 17, 2018, 02:19:03 am
content: I am not finding an iphone or android app for wireshark, are there special instructions to get it to work?

author: tomas123
author_rank: Frequent Contributor
timestamp: March 17, 2018, 09:20:54 am
content: wireshark is a PC Software.https://en.m.wikipedia.org/wiki/Wiresharkthere are some variants to record the wifi traffic:a) catch traffic with a wifi router e.g. fritz.box in germany :-)b) use a notebook with a lan and wlan port as man in the middle (or two wlan ports as wifi subnet)google this topic, it's easythe ftp password is uncrypted plain text

author: DaveWB
author_rank: Regular Contributor
timestamp: March 24, 2018, 08:52:54 pm
content: Quote from: tomas123 on March 17, 2018, 09:20:54 amI created a wifi network on the camera, and connected to it from my PC. unfortauntely I was unable to find a plain text ftp username and password

author: tomas123
author_rank: Frequent Contributor
timestamp: March 25, 2018, 12:36:03 am
content: greatDo you have recorded the traffic between the flir tools app and your Exx camera (load an image)?see this sample for decoding the stream:http://www.freekb.net/Article?id=133https://blog.packet-foo.com/2016/07/how-to-use-wireshark-to-steal-passwords/comment-page-1/

author: DaveWB
author_rank: Regular Contributor
timestamp: April 13, 2018, 05:07:39 am
content: Quote from: tomas123 on March 25, 2018, 12:36:03 amI attempted following this however I was unable to see any ftp data within Wireshark. I have a Ubiquiti Accesspoint in which this is connected to, I connected my computer to the secondary port of this access poin. The camera was connected to the access point and I could see the camera connection within Wireshark but when I went on my phone and imported images over wifi, nothing showed up. The only protocol the FLIR seems to be triggering within Wireshark seems to be TCP and MDNS.

author: tomas123
author_rank: Frequent Contributor
timestamp: April 14, 2018, 01:03:08 pm
content: Hi DaveWB,I looked in my old notes fromJune 2013.With Flir Tools for IOS, my E40, WiFi and Wireshark I got this FTP protocol snippet after taking an "instant picture" with the Flir tools app :USER anonymous / PASS cfnetwork@apple.comCode:WireShark FTP220 Service ready for new user.USER anonymous331 Anonymous access allowed, send identity (e-mail name) as password.PASS cfnetwork@apple.com230 User logged in, proceed.SYST215 Windows_CE version 6.0.PWD257 "/".TYPE I200 Command okay.CWD /Temp/250 Requested file action okay, completed.PASV227 Entering Passive Mode (192,168,16,70,192,22).RETR irviewerimg.jpg125 Data connection already open; transfer starting.226 Closing data connection.With this steps, Flir Tools loaded the last imageirviewerimg.jpgfrom my E40.here is the wireshark TCP snippet, which shows how the Exx get the single Telnet commands from the app to take an imageuser: root / pw: 3vligQuotemaybe this helps...Quote from: Bud on November 21, 2014, 06:39:21 pm

author: Abvelv
author_rank: Newbie
timestamp: April 21, 2018, 11:05:56 am
content: Quote from: DaveWB on March 02, 2018, 07:25:39 pmConnection refused isn't a credential issue, it means that there is no service listening on tcp/21. As someone else pointed out this may be the address of your local machine. Once you are sure you are connecting to the right IP (such as .2) use a port scanning tool such as nmap to see what's open on the system. It might be using ssh or something else, regardless of what OS it's running under the hood.

author: Chanc3
author_rank: Frequent Contributor
timestamp: April 21, 2018, 11:09:37 am
content: I've got a T1020 at our office, which runs the same OS as the Ex5 series. I'll check port numbers etc when I get a chance and can see if that info helps.

author: DaveWB
author_rank: Regular Contributor
timestamp: April 21, 2018, 09:30:17 pm
content: I attempted these combos and unfortunately none of them worked but I think it is tied to something else: when I connect the cam via USB while its in RNDIS mode via hidden menu, the blue box in the bottom right of my screen will pop up saying Thermacam IP 192.168.0.2 then about 15 seconds later is will say connected after it had already said it was connected.

author: agiorgitis
author_rank: Regular Contributor
timestamp: August 20, 2019, 06:57:10 pm
content: any news on this topic?

author: Spirit532
author_rank: Frequent Contributor
timestamp: August 21, 2019, 03:30:27 am
content: It'd help to have a complete flash dump, but I doubt anyone would donate a fresh Ex5 camera for a warranty-destroying teardown

author: agiorgitis
author_rank: Regular Contributor
timestamp: November 22, 2019, 01:43:09 pm
content: Hi guys,As an update to this topic, is anyone interested on trying to decryptconf.cfcfrom an E75? Like on E4.cfccfg.py and cfccfg_v2.py methods do not work.I can help you with any camera files needed for this research.

author: agiorgitis
author_rank: Regular Contributor
timestamp: January 28, 2020, 02:35:10 pm
content: I wonder why no one is interested on adding custom functions, or porting E95 functions to E75, or trying to liberate E75/85 to match E95.Is this due to hacking abilities? Or just lack of interest or no hands-on access to those models?

author: Fraser
author_rank: Super Contributor
timestamp: January 28, 2020, 02:52:28 pm
content: I think there is a very simple explanation...... the cost of an E75.At around £7K in the UK, the E75 is anything but budget priced ! People who buy such expensive thermal cameras are less likely to want to mess with them.The E4 was an amazing opportunity as it was a ‘budget’ priced thermal camera that could be upgraded to the far more expensive model. The risk of wrecking an sub £1K E4 during the research into the cameras firmware was far less scary than bricking a £7K+ camera. Just watch Mike tear into his new E4 to investigate its design to see what I mean !The Ex5 series are intended for semi- professional and professional use. Such users are often businesses and less interested in hacking a camera that they rely upon to earn income. Also, using a ‘hacked’ camera can be bad for the businesses reputation.The Ex5 series are not a simple task to upgrade as FLIR did learn from the Ex series upgrade developments. Enough people would need to want the upgrade to make it worth the potential cost and time required. I do not see that demand at the present time. Maybe when the Ex5 cameras come onto the secondary market at around the $2K mark we may see development of upgrades in the community.Fraser

author: agiorgitis
author_rank: Regular Contributor
timestamp: January 30, 2020, 05:50:50 pm
content: Fair enough, I agree.Plus the fact that even E75 produces much better images compared to an E8, so they probably don't need more resolution than that.But what about the extra UI modifications which can be done safely? Like palletes.I guess that I'm one of the few who has played around with the -safe to edit- files, like activating the timelapse function for example, found on E95.I could try to do more, but anything more than that, like decrypting of conf files and boot sequence, are beyond my abilities...

author: _Wim_
author_rank: Super Contributor
timestamp: February 02, 2020, 07:01:03 am
content: If your lucky enough to have an Ex5, I would also snatch this one from Ebay:https://www.ebay.co.uk/itm/FLIR-42-Wide-Angle-Lens-EXX-TXX-Series-T199590/233469566566?hash=item365bdede66:g:mf0AAOSwM2deEkW0Seller is even open for offers! If only it would fit my E30...

author: agiorgitis
author_rank: Regular Contributor
timestamp: February 02, 2020, 09:53:25 am
content: Thanks Wim!Unfortunately I'm chasing an offer for the 14o zoom version.

author: Fraser
author_rank: Super Contributor
timestamp: February 02, 2020, 11:50:01 am
content: Wim,That lens previously sold for £130 from the same seller. A total bargain if it actually truly sold (look at recent ‘sales’ then look for recent feedback). Why is it up for same again ? I have my own thoughts on that sellers auctions but I will keep them to myself. As you state, it is a primary lens and not a supplementary type as used by the Ex0 series.A ~45 Degree lens is very useful as it normally provides great close-up working capability and is perfect for viewing building exteriors. ~24 Degree HFOV can be a little narrow when wishing to view large targets. You do, of course, trade IFOV for greater HFOV.I managed to buy the 10mm wide angle lens for my E40 the other day. It is currently on its way to me from Canada. Cost was a reasonable C$300 (US$226). They do appear on eBay now and then.Fraser

author: _Wim_
author_rank: Super Contributor
timestamp: February 02, 2020, 07:03:03 pm
content: Quote from: Fraser on February 02, 2020, 11:50:01 amHa, that I did not notice before! Thanks for pointing out. Seems to be a trend lately, I also had 2 Ebay purchases that would have been bargains, but both sellers apparently "lost" the device and cancelled the purchase. One of them put the same back up for auction only a few weeks later, the other one did not so far.Quote from: Fraser on February 02, 2020, 11:50:01 amSo far I am using a ZnSe CO2 laser lens with decent results, but for 226$ I would not let it pass also. You seem to be very good in finding thermal imaging deals!

author: mikhail076
author_rank: Contributor
timestamp: April 28, 2021, 10:25:41 am
content: it seems someone did this upgrade:https://www.ebay.com/itm/124699245429

author: therwp
author_rank: Contributor
timestamp: April 30, 2021, 05:57:37 am
content: Quote from: mikhail076 on April 28, 2021, 10:25:41 am"Someone" indeed.From the listing: "The upgrade was completed in house by Flir Systems Canada Ltd. in Burlington Ontario. The documentation for the service record is available."Damn lol.

author: agiorgitis
author_rank: Regular Contributor
timestamp: April 30, 2021, 02:30:25 pm
content: How difficult is to flash the firmware from E95 into E75?Instead of hacking E75 with a resolution update, to load the E95 one instead bypassing any hardware S/N checks.

author: Spirit532
author_rank: Frequent Contributor
timestamp: May 07, 2021, 07:52:58 pm
content: Quote from: agiorgitis on April 30, 2021, 02:30:25 pmExternally, likely not very possible. And if done, it would most certainly wipe all the calibration data, rendering the unit near useless, permanently.It would require a hack. Doable, with enough reverse-engineering, but I've yet to have anyone offer to donate a newer Ex5 series device(or two, really, one non-working) for a semi-destructive teardown to dump the flash and reverse-engineer it.I'm almost certain that it's possible to hack the lowest end Ex5 to the highest end(and beyond, as with the E8+) 640x480 Ex6 unit, and the firmware is almost certainly built on an older kernel with plenty of unpatched exploits that were never meant to be accessible(since it's not a networked IoT device).The Ex5 and T5xx both run a similar, if not identical, platform, so this would apply to that lineup as well.

author: mikhail076
author_rank: Contributor
timestamp: May 08, 2021, 05:09:44 am
content: very expected.all is by analogy with e30))sure e53 has the same hardware as eX5.