Vevor SC240N / TopDon TC004 / InfiRay C200 / Hisilicon HI3516DV300 - Page 1
Forum section: electronics / general

author: Manawyrm
author_rank: Contributor
timestamp: May 17, 2023, 06:31:19 pm
content: Hey,after a recent video by Marco Reps, I grabbed one of those cheap InfiRay cameras.They boot Linux on a Hisilicon SoC, which makes them a bit of an interesting target for tinkering.I got the SC240N-variant, without the visible-light camera (and thus without video recording capability).This camera also doesn't support USB/UVC webcam, although the seemingly identical TC004 does.Marco has a teardown at the end of the video, so no real need for pictures here, I think.First observations:Serial port on the board, J16.Actual RS232 levels, not a UART! With negative voltages, inverted signal level and everything!Code:1 gnd2 tx3 rx4 ??? probably also gnd5 ???6 ???Bootlog is attached.U-Boot can be aborted and has a shell (pretty fully featured).Parts of the env:Code:bootargs=mem=256M console=ttyAMA0,115200 root=/dev/mmcblk0p3 rw rootfstype=ext4 rootwait blkdevparts=mmcblk0:1M(boot),4M(kernel),150M(rootfs)bootcmd=mmc read 0x0 0x81000000 0x800 0x2000;mmc read 0x0 0x82000000 0x680 0x80;mmc read 0 0xb8300000 0x700 0x80;mmc read 0 0x83000000 0x780 0x80;decjpg 0;startvo 0 2048 42;startvl 0 0xb8100000 256 0 0 240 320;bootm 0x81000000soc=hi3516dv300stderr=serialLet's dump the firmware before we break anything. We sadly can't do the same trick with uboot as optotester did for his i.MX-based imagers, so let's boot into Linux and use dd:Code:setenv bootargs init=/bin/sh mem=256M console=ttyAMA0,115200 root=/dev/mmcblk0p3 rw rootfstype=ext4 rootwait blkdevparts=mmcblk0:1M(boot),4M(kernel),150M(rootfs)boot(same bootargs, just with init=/bin/sh)this drops us into a shell.I copied the firmware usingCode:dd if=/dev/mmcblk0 of=/dev/mmcblk1 bs=8Mto the SD card (this wipes the SD card of course).So, what can we learn for now?- Linux 4.9.37- Hisilicon HI3516DV300- u-boot doesn't have SD support, only eMMC (or the device tree is misconfigured, etc. mmc list only shows the eMMC)- 8 GiB eMMC, 256 MiB DRAM- stock kernel has r8152, usb-storage and WiFi modules (8189fs.ko SDIO).- lighttpd (webserver!) installed- ext4 root FS is mounted read/write in operation. There's a good chance this device will kill itself over time with this.- hostapd, etc. is also installed, maybe there's a chance to get this thing using network or even WiFi with USB-OTG.So far I haven't seen a way "in" yet, without using a RS232 serial.Cracked the root-Password:Code:0SV1EYeeHloi.:iraytekUsed the u-boot/bootargs trick again to edit the /etc/inittab with vi and added:Code:::respawn:/sbin/getty 115200 ttyAMA0and was then greeted by a root shell:

author: Fraser
author_rank: Super Contributor
timestamp: May 17, 2023, 09:54:22 pm
content: Interesting work. ThanksFraser

author: nsa666
author_rank: Newbie
timestamp: May 18, 2023, 01:54:27 pm
content: Adding Video-Recording and UVC would be great. Can you launch another control app from sd?

author: Manawyrm
author_rank: Contributor
timestamp: May 18, 2023, 02:13:06 pm
content: Boot processSome notes about the boot process, it starts with /etc/init.d, running all the scripts there.The first really interesting one is /etc/init.d/S90start:loads /iray_app/huamian (seems to be some kind of JPEG decoder)loads a bunch of kernel modulesoptionally configures the USB UVC webcam modethen runs /hisi_ko/load3516dv300 (bash script), which loads a bunch more kernel modules.on my camera (without visible light camera), the commandlineCode:./load3516dv300 -i -senor0 gc2145 -sensor1 rtd2121w -osmem 256 -yuv0 3is used.Notice the typo in "-senor0" at the visible light camera. Very strange.It will then run /iray_app/iray-hisi-camera (in the background), which is the actual QT camera application.UVC webcam modeI have enabledCode:export uvc_sd=1on my camera, which actually leads to a UVC device being enumerated.Unfortunately, connecting to it using OBS, VLC, etc. will result in a single frame of video and then stops.I have played around with the YUV, MJPEG and H264 settings, buffer sizes, etc. but nothing changes the behaviour.Code:/iray_app/uvc_app.confalso has a bunch of configuration parameters related to the webcam mode, but again, wasn't able to get a properly working config there.Camera settings / video recordingThe camera seems to store it's settings inCode:/iray_ko/iray_m.ini, which has a bunch of the user-defined configuration parameters (like the palettes, image auto-save, emissivity, etc.).Sadly, I didn't yet find the flag responsible for allowing video recording.Kernel hackingI've also extracted the device-tree from /proc/device-tree (just to take a look at settings like the USB dwc3 mode, which is currently set to peripheral), so no easy way to connect USB devices (like a WiFi dongle or NIC) to the USB-C port.I chroot'ed into a ArchLinux ARM userland on an SD card:I found the repohttps://github.com/cijliu/linux, which is the same 4.9.37 kernel used on the camera, with the fitting HiSilicon board support.After fixing some -fcommon bugs (due to my modern host toolchain), I was able to compile that kernel usinghttps://releases.linaro.org/components/toolchain/binaries/6.3-2017.05/arm-linux-gnueabi/.I wasn't able to boot my custom kernel (most likely due to differences in the device tree or configs), but I was able to load modules from my kernel, which is very nice:Code:insmod u_ether.koinsmod u_serial.koinsmod usb_f_acm.koinsmod usb_f_ecm.koinsmod usb_f_ecm_subset.koinsmod usb_f_mass_storage.koinsmod usb_f_obex.koinsmod usb_f_rndis.koinsmod usb_f_serial.koinsmod usb_f_uvc.komount -t configfs none /sys/kernel/config/CONFIGFS_HOME=/sys/kernel/configGADGET_NAME="l4t"VID="0x0955"PID="0x7020"SERIAL="no-serial"MANUF="RR"PRODUCT="RR gadget"mkdir -p "$CONFIGFS_HOME/usb_gadget/$GADGET_NAME"cd "$CONFIGFS_HOME/usb_gadget/$GADGET_NAME"echo "$VID" > idVendorecho "$PID" > idProductmkdir strings/0x409echo "$SERIAL" > strings/0x409/serialnumberecho "$MANUF" > strings/0x409/manufacturerecho "$PRODUCT" > strings/0x409/productCFG="c.1"CFG_STR="ECM"mkdir -p "configs/$CFG"FUNC_NAME="ecm"INSTANCE_NAME="usb0"FUNC="functions/$FUNC_NAME.$INSTANCE_NAME"mkdir -p "$FUNC"mac_ecm_h="7a:68:46:2f:bd:aa"mac_ecm_d="7a:68:46:2f:bd:ab"echo "$mac_ecm_h" > "$FUNC/host_addr"echo "$mac_ecm_d" > "$FUNC/dev_addr"ln -sf "$FUNC" "configs/$CFG"mkdir -p "configs/$CFG/strings/0x409"echo "$CFG_STR" > "configs/$CFG/strings/0x409/configuration"UDC_DEV=`ls /sys/class/udc`echo "$UDC_DEV" > UDCip link set usb0 upip addr add 172.16.0.2/24 dev usb0ip route add 0.0.0.0/0 via 172.16.0.1echo "nameserver 8.8.8.8" > /etc/resolv.confand then we expose a new usb0 network interface over to the computer and we have internet connectivity on the camera (provided that the attached computer does NAT/routing).I was able to start the (already installed) lighttpd webserver, there's a start script for it in /iray_sh/http.sh, but it also tries to setup WiFi and stuff.I ranCode:lighttpd -f /lighthttp/config/lighttpd.conf:(this exposes the partition with all the images on the SD card, pretty useful)Modding the device tree and either adding an SDIO card with a WiFi chipset or switching the USB dwc3 controller mode to host would probably allow us to have network connectivity permanently, which would be very nice.FramebufferSomeone mentioned DOOM, so I've had a quick look, /dev/fb0 seems to be magically overlayed/mixed with the hardware video signal.It contains RGBA8888 data and the alpha channel is actually used. I dumped /dev/fb0 into a file and opened it using GIMP:So the fb0 just contains the overlay/GUI, no video data for us to extract sadly.Modding without the serial portI was actively looking for some backdoor / other method of getting into the device without soldering a RS232 serial to it.Sadly, so far I didn't find anything super simple in any of the scripts.One of the binaries (ELF/Linux/armv7) contains references to an update .zip file and has some paths related to that.My binary reverse engineering skills aren't sufficient to try and understand how to give it a useful "update", I think, but there might be a way in.

author: Manawyrm
author_rank: Contributor
timestamp: May 18, 2023, 02:19:07 pm
content: Quote from: nsa666 on May 18, 2023, 01:54:27 pmYou can do pretty much anything, yes. Not sure how/where you'd find a compatible control app to run on this device, though.Getting a firmware dump from a SC240M (with video recording, etc.) would probably be pretty interesting, but they're out of stock unfortunately.

author: nsa666
author_rank: Newbie
timestamp: May 18, 2023, 03:56:02 pm
content: There:https://www.eevblog.com/forum/thermal-imaging/infiray-c210-thermal-camera-review/msg4368193/#msg4368193is a dump of Infiray C200 Firmware. Dont know if it helps.

author: IanJ
author_rank: Unknown
timestamp: May 18, 2023, 04:11:22 pm
content: Quote from: Manawyrm on May 17, 2023, 06:31:19 pmFrom the spec on the web:Vevor SC240N = 240x180Topdon TC004 = 256x192Would be interesting to see a direct comparison if somebody has both.Ian.

author: Manawyrm
author_rank: Contributor
timestamp: May 18, 2023, 07:22:29 pm
content: Quote from: IanJ on May 18, 2023, 04:11:22 pmAck.But interestingly enough, everything on the SC240N's firmware also references 256x192:Code:Camera=105Picture_h=192Picture_w=256Not sure if 240x180 is the usable area of the chip or something like that (and Vevor being sold in the EU don't want to break advertising laws), but they really seem to have identical sensors & specs.

author: Manawyrm
author_rank: Contributor
timestamp: May 18, 2023, 08:33:36 pm
content: Oh...OK, well, that's a working UVC webcamTurns out: Their implementation seems to behave buggy against a Linux 6.3 host.With Windows (both OBS and the native Windows 11 camera app) it works immediately.macOS just kernel panic's the camera alltogether, which is very funSeeing this, I've enabled UVC tracing on my Linux machine:Code:echo 0xffff > /sys/module/uvcvideo/parameters/tracewhich results in the following log output (in YUV mode):Code:[26524.076642] usb 1-1: Dropping payload (out of sync)[26524.076644] usb 1-1: Dropping payload (out of sync)[26524.076646] usb 1-1: Dropping payload (out of sync)[26524.076648] usb 1-1: Dropping payload (out of sync)[26524.076650] usb 1-1: Dropping payload (out of sync)[26524.076653] usb 1-1: Dropping payload (out of sync)[26524.080584] usb 1-1: Dropping payload (out of sync)[26524.080589] usb 1-1: Dropping payload (out of sync)[26524.080591] usb 1-1: frame 2 stats: 0/451/451 packets, 0/0/0 pts (!early !initial), 0/0 scr, last pts/stc/sof 0/0/0[26524.083365] usb 1-1: uvc_v4l2_poll[26524.114524] usb 1-1: Device requested 3072 B/frame bandwidth[26524.114528] usb 1-1: Selecting alternate setting 1 (3072 B/frame bandwidth)[26524.467629] usb 1-1: Allocated 5 URB buffers of 32x3072 bytes each[26524.467680] usb 1-1: uvc_v4l2_poll[26524.471630] usb 1-1: Frame complete (EOF found)[26524.471632] usb 1-1: frame 1 stats: 0/29/29 packets, 0/0/0 pts (!early !initial), 0/0 scr, last pts/stc/sof 0/0/0[26524.499631] usb 1-1: Frame complete (overflow)[26524.499637] usb 1-1: Dropping payload (out of sync)[26524.499639] usb 1-1: Dropping payload (out of sync)[26524.499643] usb 1-1: Dropping payload (out of sync)[26524.499645] usb 1-1: Dropping payload (out of sync)[26524.499647] usb 1-1: Dropping payload (out of sync)[26524.499649] usb 1-1: Dropping payload (out of sync)[26524.499652] usb 1-1: Dropping payload (out of sync)[26524.499654] usb 1-1: Dropping payload (out of sync)[26524.499656] usb 1-1: Dropping payload (out of sync)[26524.499659] usb 1-1: Dropping payload (out of sync)[26524.499661] usb 1-1: Dropping payload (out of sync)[26524.499663] usb 1-1: Dropping payload (out of sync)[26524.499665] usb 1-1: Dropping payload (out of sync)[26524.499667] usb 1-1: Dropping payload (out of sync)[26524.499669] usb 1-1: Dropping payload (out of sync)[26524.499672] usb 1-1: Dropping payload (out of sync)[26524.499674] usb 1-1: Dropping payload (out of sync)[26524.499676] usb 1-1: Dropping payload (out of sync)[26524.499679] usb 1-1: Dropping payload (out of sync)[26524.499681] usb 1-1: Dropping payload (out of sync)[26524.499683] usb 1-1: Dropping payload (out of sync)[26524.499685] usb 1-1: Dropping payload (out of sync)[26524.499687] usb 1-1: Dropping payload (out of sync)[26524.499689] usb 1-1: Dropping payload (out of sync)[26524.503629] usb 1-1: Dropping payload (out of sync)[26524.503633] usb 1-1: Dropping payload (out of sync)[26524.503636] usb 1-1: Dropping payload (out of sync)[26524.503639] usb 1-1: Dropping payload (out of sync)[26524.503642] usb 1-1: Dropping payload (out of sync)[26524.503644] usb 1-1: Dropping payload (out of sync)[26524.503646] usb 1-1: Dropping payload (out of sync)[26524.503649] usb 1-1: Dropping payload (out of sync)[26524.503651] usb 1-1: Dropping payload (out of sync)[26524.503653] usb 1-1: Dropping payload (out of sync)[26524.503655] usb 1-1: Dropping payload (out of sync)[26524.503657] usb 1-1: Dropping payload (out of sync)[26524.503660] usb 1-1: Dropping payload (out of sync)[26524.503662] usb 1-1: Dropping payload (out of sync)[26524.503664] usb 1-1: Dropping payload (out of sync)[26524.503666] usb 1-1: Dropping payload (out of sync)[26524.503668] usb 1-1: Dropping payload (out of sync)[26524.503670] usb 1-1: Dropping payload (out of sync)[26524.503672] usb 1-1: Dropping payload (out of sync)[26524.503674] usb 1-1: Dropping payload (out of sync)[26524.503677] usb 1-1: Dropping payload (out of sync)[26524.503679] usb 1-1: Dropping payload (out of sync)[26524.503681] usb 1-1: Dropping payload (out of sync)[26524.503683] usb 1-1: Dropping payload (out of sync)[26524.503685] usb 1-1: Dropping payload (out of sync)[26524.503687] usb 1-1: Dropping payload (out of sync)[26524.503690] usb 1-1: Dropping payload (out of sync)[26524.503692] usb 1-1: Dropping payload (out of sync)[26524.503694] usb 1-1: Dropping payload (out of sync)[26524.503696] usb 1-1: Dropping payload (out of sync)[26524.503698] usb 1-1: Dropping payload (out of sync)[26524.503700] usb 1-1: Dropping payload (out of sync)[26524.507631] usb 1-1: Dropping payload (out of sync)[26524.507636] usb 1-1: Dropping payload (out of sync)[26524.507638] usb 1-1: Dropping payload (out of sync)[26524.507642] usb 1-1: Dropping payload (out of sync)[26524.507644] usb 1-1: Dropping payload (out of sync)[26524.507646] usb 1-1: Dropping payload (out of sync)[26524.507649] usb 1-1: Dropping payload (out of sync)[26524.507651] usb 1-1: Dropping payload (out of sync)[26524.507653] usb 1-1: Dropping payload (out of sync)[26524.507656] usb 1-1: Dropping payload (out of sync)[26524.507658] usb 1-1: Dropping payload (out of sync)[26524.507660] usb 1-1: Dropping payload (out of sync)[26524.507663] usb 1-1: Dropping payload (out of sync)[26524.507665] usb 1-1: Dropping payload (out of sync)[26524.507667] usb 1-1: Dropping payload (out of sync)[26524.507669] usb 1-1: Dropping payload (out of sync)[26524.507672] usb 1-1: Dropping payload (out of sync)[26524.507674] usb 1-1: Dropping payload (out of sync)[26524.507676] usb 1-1: Dropping payload (out of sync)[26524.507679] usb 1-1: Dropping payload (out of sync)[26524.507681] usb 1-1: Dropping payload (out of sync)[26524.507683] usb 1-1: Dropping payload (out of sync)[26524.507685] usb 1-1: Dropping payload (out of sync)[26524.507688] usb 1-1: Dropping payload (out of sync)[26524.507690] usb 1-1: Dropping payload (out of sync)[26524.507692] usb 1-1: Dropping payload (out of sync)[26524.507694] usb 1-1: Dropping payload (out of sync)[26524.507696] usb 1-1: Dropping payload (out of sync)[26524.507699] usb 1-1: Dropping payload (out of sync)[26524.507701] usb 1-1: Dropping payload (out of sync)[26524.507703] usb 1-1: Dropping payload (out of sync)[26524.507705] usb 1-1: Dropping payload (out of sync)[26524.511632] usb 1-1: Dropping payload (out of sync)[26524.511636] usb 1-1: Dropping payload (out of sync)[26524.511638] usb 1-1: Dropping payload (out of sync)[26524.511642] usb 1-1: Dropping payload (out of sync)[26524.511644] usb 1-1: Dropping payload (out of sync)[26524.511646] usb 1-1: Dropping payload (out of sync)[26524.511649] usb 1-1: Dropping payload (out of sync)[26524.511651] usb 1-1: Dropping payload (out of sync)[26524.511653] usb 1-1: Dropping payload (out of sync)[26524.511656] usb 1-1: Dropping payload (out of sync)[26524.511658] usb 1-1: Dropping payload (out of sync)[26524.511660] usb 1-1: Dropping payload (out of sync)[26524.511662] usb 1-1: Dropping payload (out of sync)[26524.511664] usb 1-1: Dropping payload (out of sync)[26524.511667] usb 1-1: Dropping payload (out of sync)[26524.511669] usb 1-1: Dropping payload (out of sync)[26524.511671] usb 1-1: Dropping payload (out of sync)[26524.511674] usb 1-1: Dropping payload (out of sync)[26524.511676] usb 1-1: Dropping payload (out of sync)[26524.511678] usb 1-1: Dropping payload (out of sync)[26524.511680] usb 1-1: Dropping payload (out of sync)[26524.511682] usb 1-1: Dropping payload (out of sync)[26524.511684] usb 1-1: Dropping payload (out of sync)[26524.511686] usb 1-1: Dropping payload (out of sync)[26524.511689] usb 1-1: Dropping payload (out of sync)[26524.511691] usb 1-1: Dropping payload (out of sync)[26524.511693] usb 1-1: Dropping payload (out of sync)[26524.511695] usb 1-1: Dropping payload (out of sync)[26524.511697] usb 1-1: Dropping payload (out of sync)[26524.511700] usb 1-1: Dropping payload (out of sync)[26524.511702] usb 1-1: Dropping payload (out of sync)[26524.511704] usb 1-1: Dropping payload (out of sync)[26524.515630] usb 1-1: Dropping payload (out of sync)[26524.515635] usb 1-1: Dropping payload (out of sync)[26524.515637] usb 1-1: Dropping payload (out of sync)[26524.515640] usb 1-1: Dropping payload (out of sync)[26524.515643] usb 1-1: Dropping payload (out of sync)[26524.515645] usb 1-1: Dropping payload (out of sync)[26524.515647] usb 1-1: Dropping payload (out of sync)[26524.515649] usb 1-1: Dropping payload (out of sync)[26524.515651] usb 1-1: Dropping payload (out of sync)[26524.515653] usb 1-1: Dropping payload (out of sync)[26524.515656] usb 1-1: Dropping payload (out of sync)[26524.515658] usb 1-1: Dropping payload (out of sync)[26524.515660] usb 1-1: Dropping payload (out of sync)[26524.515662] usb 1-1: Dropping payload (out of sync)[26524.515664] usb 1-1: Dropping payload (out of sync)[26524.515666] usb 1-1: Dropping payload (out of sync)[26524.515668] usb 1-1: Dropping payload (out of sync)[26524.515671] usb 1-1: Dropping payload (out of sync)[26524.515673] usb 1-1: Dropping payload (out of sync)[26524.515675] usb 1-1: Dropping payload (out of sync)[26524.515677] usb 1-1: Dropping payload (out of sync)[26524.515679] usb 1-1: Dropping payload (out of sync)[26524.515681] usb 1-1: Dropping payload (out of sync)[26524.515683] usb 1-1: Dropping payload (out of sync)[26524.515685] usb 1-1: Dropping payload (out of sync)[26524.515688] usb 1-1: Dropping payload (out of sync)[26524.515690] usb 1-1: Dropping payload (out of sync)[26524.515692] usb 1-1: Dropping payload (out of sync)[26524.515694] usb 1-1: Dropping payload (out of sync)[26524.515696] usb 1-1: Dropping payload (out of sync)[26524.515698] usb 1-1: Dropping payload (out of sync)[26524.515701] usb 1-1: Dropping payload (out of sync)[26524.519633] usb 1-1: Dropping payload (out of sync)[26524.519637] usb 1-1: Dropping payload (out of sync)[26524.519640] usb 1-1: Dropping payload (out of sync)[26524.519644] usb 1-1: Dropping payload (out of sync)[26524.519646] usb 1-1: Dropping payload (out of sync)[26524.519648] usb 1-1: Dropping payload (out of sync)[26524.519650] usb 1-1: Dropping payload (out of sync)[26524.519652] usb 1-1: Dropping payload (out of sync)[26524.519654] usb 1-1: Dropping payload (out of sync)[26524.519657] usb 1-1: Dropping payload (out of sync)[26524.519659] usb 1-1: Dropping payload (out of sync)[26524.519661] usb 1-1: Dropping payload (out of sync)[26524.519663] usb 1-1: Dropping payload (out of sync)[26524.519666] usb 1-1: Dropping payload (out of sync)[26524.519668] usb 1-1: Dropping payload (out of sync)[26524.519670] usb 1-1: Dropping payload (out of sync)[26524.519672] usb 1-1: Dropping payload (out of sync)[26524.519674] usb 1-1: Dropping payload (out of sync)[26524.519676] usb 1-1: Dropping payload (out of sync)[26524.519678] usb 1-1: Dropping payload (out of sync)[26524.519680] usb 1-1: Dropping payload (out of sync)[26524.519682] usb 1-1: Dropping payload (out of sync)[26524.519685] usb 1-1: Dropping payload (out of sync)[26524.519687] usb 1-1: Dropping payload (out of sync)[26524.519689] usb 1-1: Dropping payload (out of sync)[26524.519691] usb 1-1: Dropping payload (out of sync)[26524.519693] usb 1-1: Dropping payload (out of sync)[26524.519695] usb 1-1: Dropping payload (out of sync)[26524.519697] usb 1-1: Dropping payload (out of sync)[26524.519699] usb 1-1: Dropping payload (out of sync)[26524.519701] usb 1-1: Dropping payload (out of sync)[26524.519703] usb 1-1: Dropping payload (out of sync)[26524.523634] usb 1-1: Dropping payload (out of sync)[26524.523638] usb 1-1: Dropping payload (out of sync)[26524.523640] usb 1-1: Dropping payload (out of sync)[26524.523644] usb 1-1: Dropping payload (out of sync)[26524.523646] usb 1-1: Dropping payload (out of sync)[26524.523648] usb 1-1: Dropping payload (out of sync)[26524.523651] usb 1-1: Dropping payload (out of sync)[26524.523653] usb 1-1: Dropping payload (out of sync)[26524.523655] usb 1-1: Dropping payload (out of sync)[26524.523658] usb 1-1: Dropping payload (out of sync)[26524.523660] usb 1-1: Dropping payload (out of sync)[26524.523662] usb 1-1: Dropping payload (out of sync)[26524.523665] usb 1-1: Dropping payload (out of sync)[26524.523667] usb 1-1: Dropping payload (out of sync)[26524.523669] usb 1-1: Dropping payload (out of sync)[26524.523671] usb 1-1: Dropping payload (out of sync)[26524.523673] usb 1-1: Dropping payload (out of sync)[26524.523675] usb 1-1: Dropping payload (out of sync)[26524.523678] usb 1-1: Dropping payload (out of sync)[26524.523680] usb 1-1: Dropping payload (out of sync)[26524.523682] usb 1-1: Dropping payload (out of sync)[26524.523684] usb 1-1: Dropping payload (out of sync)[26524.523687] usb 1-1: Dropping payload (out of sync)[26524.523689] usb 1-1: Dropping payload (out of sync)[26524.523691] usb 1-1: Dropping payload (out of sync)[26524.523693] usb 1-1: Dropping payload (out of sync)[26524.523695] usb 1-1: Dropping payload (out of sync)[26524.523698] usb 1-1: Dropping payload (out of sync)[26524.523700] usb 1-1: Dropping payload (out of sync)[26524.523702] usb 1-1: Dropping payload (out of sync)[26524.523704] usb 1-1: Dropping payload (out of sync)[26524.523706] usb 1-1: Dropping payload (out of sync)[26524.527632] usb 1-1: Dropping payload (out of sync)[26524.527636] usb 1-1: Dropping payload (out of sync)[26524.527638] usb 1-1: Dropping payload (out of sync)[26524.527642] usb 1-1: Dropping payload (out of sync)[26524.527645] usb 1-1: Dropping payload (out of sync)[26524.527647] usb 1-1: Dropping payload (out of sync)[26524.527649] usb 1-1: Dropping payload (out of sync)[26524.527652] usb 1-1: Dropping payload (out of sync)[26524.527654] usb 1-1: Dropping payload (out of sync)[26524.527657] usb 1-1: Dropping payload (out of sync)[26524.527659] usb 1-1: Dropping payload (out of sync)[26524.527661] usb 1-1: Dropping payload (out of sync)[26524.527663] usb 1-1: Dropping payload (out of sync)[26524.527665] usb 1-1: Dropping payload (out of sync)[26524.527668] usb 1-1: Dropping payload (out of sync)[26524.527670] usb 1-1: Dropping payload (out of sync)[26524.527672] usb 1-1: Dropping payload (out of sync)[26524.527674] usb 1-1: Dropping payload (out of sync)[26524.527676] usb 1-1: Dropping payload (out of sync)[26524.527678] usb 1-1: Dropping payload (out of sync)[26524.527681] usb 1-1: Dropping payload (out of sync)[26524.527683] usb 1-1: Dropping payload (out of sync)[26524.527685] usb 1-1: Dropping payload (out of sync)[26524.527687] usb 1-1: Dropping payload (out of sync)[26524.527689] usb 1-1: Dropping payload (out of sync)[26524.527691] usb 1-1: Dropping payload (out of sync)[26524.527694] usb 1-1: Dropping payload (out of sync)[26524.527696] usb 1-1: Dropping payload (out of sync)[26524.527698] usb 1-1: Dropping payload (out of sync)[26524.527700] usb 1-1: Dropping payload (out of sync)[26524.527702] usb 1-1: Dropping payload (out of sync)[26524.527704] usb 1-1: Dropping payload (out of sync)[26524.531634] usb 1-1: Dropping payload (out of sync)[26524.531639] usb 1-1: Dropping payload (out of sync)[26524.531641] usb 1-1: frame 2 stats: 0/451/451 packets, 0/0/0 pts (!early !initial), 0/0 scr, last pts/stc/sof 0/0/0[26524.534416] usb 1-1: uvc_v4l2_poll[26524.609581] usb 1-1: Device requested 3072 B/frame bandwidth[26524.609584] usb 1-1: Selecting alternate setting 1 (3072 B/frame bandwidth)[26524.906684] usb 1-1: Allocated 5 URB buffers of 32x3072 bytes each[26524.916780] usb 1-1: uvc_v4l2_release[26525.541452] usb 6-3.1: uvc_v4l2_open[26525.541465] usb 6-3.1: uvc_v4l2_release[26525.541479] usb 1-1: uvc_v4l2_openSo there is data being sent to the Linux box, but the kernel just doesn't like it. I'm neither a USB nor UVC expert, so I'll have to pass on further debugging, but I'll ping some friends.

author: RuneHansen
author_rank: Contributor
timestamp: May 19, 2023, 03:12:40 pm
content: I should be able to add these cameras to IRCAM Thermal Viewer

author: tsys
author_rank: Newbie
timestamp: May 20, 2023, 02:58:56 pm
content: Hey all,while hacking on this camera together with Manawyrm I've designed a new 3D-printable top USB/micro SD port panel to improve continous hackability while the camera is fully assembled:In addition to all ports on the stock panel it adds a cutout for a 3 pin .1 inch female header. This allows permanently exposing the internal serial port and thus bootloader and root shell on the device exterior.The printable 3D model is available onThingiverseandGitHub.

author: jwet
author_rank: Frequent Contributor
timestamp: May 20, 2023, 04:28:47 pm
content: I saw the same Marco Reps video and grabbed one of these last week- love it- hoping it will be useful for electronic troubleshooting but its a great toy either way. I spent an extra hundred and got the Topdon TC005 which has the visible camera and video functtion but looks identical. I'm not quite ready to bust it open but if someone can tell me how to get the code out on the card or the USB cable, I'd be happy to grab an image and post it for the use of science. Is this possible?

author: Manawyrm
author_rank: Contributor
timestamp: May 20, 2023, 04:34:24 pm
content: Quote from: jwet on May 20, 2023, 04:28:47 pmHm, well, yes, I think it might be possible, but I don't know how exactly the update mechanism works yetFor now, I think it still requires an RS232 connection to the pins.If you'd be willing to do that, I'd be happy to assist.If someone else here is familiar with ELF/Linux32 armv7 binaries/reverse engineering, I'd also be happy to post the binary with the updater code, maybe someone else can understand it.QuoteMarco shows it pretty well in the video, the only 2 really sketchy parts are the clips in the middle of the handle (we've just snapped them off on our camera now on purpose) and the plastic screen cover (which you'll need to bend/lift without breaking it).Generally, it's a pretty nice experience to open, don't worry.

author: nsa666
author_rank: Newbie
timestamp: May 20, 2023, 06:41:58 pm
content: Quote from: Manawyrm on May 20, 2023, 04:34:24 pmghidra can't decompile it?

author: Manawyrm
author_rank: Contributor
timestamp: May 20, 2023, 07:33:07 pm
content: Quote from: nsa666 on May 20, 2023, 06:41:58 pmYes, it can, but that's not a one-stop-magical shop to readable C codeThere's a bit more experience needed, I think

author: jwet
author_rank: Frequent Contributor
timestamp: May 20, 2023, 08:11:46 pm
content: If someone really wants the firmware, I may tackle it. Its only a week old...Thanks for digging in. It answered a lot of questions for me- especially the slow boot.

author: Manawyrm
author_rank: Contributor
timestamp: May 20, 2023, 08:26:23 pm
content: Quote from: jwet on May 20, 2023, 08:11:46 pmMine didn't even last 4 hours before I took a look inside (and that was because I had to finish the workday)If you'd feel comfortable with the soldering required to connect to J16 (those small pins) or can manage to find a fitting connector (I'm not sure what type of connector it is, sorry), I would appreciate that very much...I'd be really curious about the differences between your firmware and mine...Another benefit would be having the backup for yourself. The camera never shuts itself down properly. Every shutdown is a hard power-off without unmounting the ext4 filesystem on the internal flash. I'm not too confident that this will actually last long, so chances are that you might actually need the backup to restore the filesystem at some point in the future after it bricked itself. (ext4's journalling is pretty good these days, it might not actually break that quickly. We'll see.)tsys is currently working on a really cool magnetic swappable lens attachment for it, which is looking _super_ promising.So you might want to get familiar with taking it apart anyway

author: nsa666
author_rank: Newbie
timestamp: May 20, 2023, 09:25:01 pm
content: Quote from: Manawyrm on May 20, 2023, 08:26:23 pmIt looks like M40-1100600 (1,00mm pitch) could fit. But i dont know for sure.Edit: or M30-1100600 if it is 1,25mm pitch.

author: Manawyrm
author_rank: Contributor
timestamp: May 29, 2023, 05:35:33 am
content: This just had to be done:It was surprisingly hard to do. Both video output and control input gave a bunch of trouble.The video output/framebuffer was not actually RGB or something like that, but rather YVU420SP, aka semi-planar YUV (with U/V flipped) and sub-divided colors.I just used /dev/mem to get a memory mapping for the physical address space and wrote directly to it:https://github.com/Manawyrm/fbDOOM/blob/3c011e8c87bea3f29a52947410e9e4d1be036239/fbdoom/i_video_fbdev.c#L166Input was also unnecessarily cruel, the buttons are all just GPIOs, but some of them don't have pull-ups and are somehow magically pulled up from the main application.I've spent a couple hours banging my head against a wall and trying to get all of the GPIOs into the same state, but it still wouldn't enable the required pull-ups on all of the buttons.In the end, just not loading the kernel modules and just starting the main application briefly (which then segfaults due to missing dependencies) will setup the buttons correctly. Evil hack, but who's counting... After that, it's just a matter of reading the GPIO port states (yes, this is both ugly and slow, but we have 2x 1GHz, I don't care):https://github.com/Manawyrm/fbDOOM/blob/3c011e8c87bea3f29a52947410e9e4d1be036239/fbdoom/i_input_tty.c#L38

author: tsys
author_rank: Newbie
timestamp: May 29, 2023, 02:10:46 pm
content: Using the Vevor SC240N for microelectronics we found that the rather large minimum focus distance makes it difficult to differentiate between individual components.I've designed a magnetic lens attachment that allows adding cheap ZnSe lenses to the camera. With the lens attachment minimum focus distance goes down from ~20cm to below 5cm.Working with small SMD components the reduction in minimum focus distance makes all the differece:Without lens attachmentWith lens attachmentWith the lens attached small heat sources (in this case 0402 LEDs) are easy to spot and clearly defined.To make removal and swapping between different lenses as easy as possible the attachment is held in place magnetically:From the factory there is nothing sufficiently magnetic close to the front of the camera to allow the magnetic lens attachment to stick. A couple of small magnets need to be glued into the device front shell:The lens mount is fully 3D-printable in two pieces. The pieces are then connected using M1 self-tappers. Design files can be found onThingiverseandGitHub.

author: DH7DN
author_rank: Regular Contributor
timestamp: May 29, 2023, 02:19:31 pm
content: Amazing hack, thanks for sharing

author: ragequit
author_rank: Newbie
timestamp: June 02, 2023, 10:26:32 am
content: Hello there,I got one a week ago, but it is currently being borrowed by friends. If someone could sent me the firmware binaries, especially the update routine, I would be willing to take a look.Best regards

author: bebopdk
author_rank: Contributor
timestamp: June 02, 2023, 01:21:54 pm
content: On the C200, this is in the apps.sh file, there seem to be something related to the streaming/uvc_gadget which is remarked out:#!/bin/sh#app#cd /opt/qt4.8.5/demos/embedded/fluidlauncher#./fluidlauncher -qws &#usb otgcd /lib/modules/3.14.38-6UL_ga\+ge4944a5/kernel/fs/configfs/insmod configfs.kocd /lib/modules/3.14.38-6UL_ga+ge4944a5/kernel/drivers/usb/gadgetinsmod libcomposite.koinsmod u_serial.koinsmod usb_f_acm.koinsmod usb_f_mass_storage.ko#insmod g_mass_storage.ko file=/dev/mmcblk0p1insmod g_acm_ms.ko file=/dev/mmcblk0p1 removable=1 stall=1#insmod g_webcam.ko streaming_maxpacket=1024#gc0308 cameracd /lib/modules/3.14.38-6UL_ga+ge4944a5/kernel/drivers/media/platform/mxc/subdev/insmod mx6s_capture.koinsmod gc0308_camera.kosleep 2#appcd /root./IRay_C200_Thermal -qws -nomouse &#./led_ctrl_test &# ftp serveradduser nobodyvsftpd &sleep 5#./uvc-gadget &./led_ctrl_test &#appsI have not played around with my C200 yet since I am a bit reluctant to take it apart while it is still under warranty, but would love to have the web cam working

author: actuallyjaseg
author_rank: Contributor
timestamp: June 02, 2023, 02:39:36 pm
content: Y'all might be interested to hear that I have an older Infiray-branded C200, which *did* work as a webcam on Windows out of the box. If I find the time, I will pull an image of its flash later this weekend.

author: bebopdk
author_rank: Contributor
timestamp: June 03, 2023, 11:38:32 am
content: That firmware would be highly interesting to see, my C200(which when ordered should have been a C210), does not have that feature from the factory

author: vfx_luis
author_rank: Newbie
timestamp: June 03, 2023, 04:21:25 pm
content: I'm still waiting for mine to show up, but in the Hisilicon Datasheet it states that the SoC has a HDMI 1.4 output (so 1080P60). Idk if the internal Screen uses that somehow, but just for the sake of it, do you think it would be possible to add an HDMI out to the camera?Or better just stick with UVC?

author: Manawyrm
author_rank: Contributor
timestamp: June 04, 2023, 02:44:57 am
content: Quote from: vfx_luis on June 03, 2023, 04:21:25 pmNo, the required pins probably aren't connected to the SoC and we don't have either the HiSilicon SDK nor the InfiRay application source.So I don't see any way of getting something like that too work. UVC will be the much better approach.

author: Alibulala
author_rank: Newbie
timestamp: June 04, 2023, 05:23:50 pm
content: Does anyone know what is the deal with the lower resolution of the Vevor SC240 compared to the Topdon TC004 and Infiray C200?(240x180 vs 256x192)Is it really a different sensor or just software locked?Or are they selling sensors with some dead pixels under a cheaper brand name?I´ve ordered the Vevor SC240M after I saw the Marco Reps video, but now I´m unsure if I want to keep it once it arrives, or send it back and get the Infiray or Topdon version.

author: Oreg
author_rank: Newbie
timestamp: June 07, 2023, 05:57:05 am
content: Hey guys, I would like to hear your opinions on my issue with the Vevor SC240N.I noticed that on my SC240N, the lens cover gasket was not installed properly, so it is oozing out. I was afraid that the IP54 rating is not valid. So I contacted Vevor support and they answered me that the protruding part can be cut off without affecting the use. Nevertheless they offer me a significant subsequent discount (almost 30 %) due to the inconvenience.I've been toying with the idea of doing the magnetic macro lens modification anyway and could then use the opportunity to properly install the gasket myself.So my question to the people who have opened their camera before: In your estimation, is vevor's statement accurate or should the seal be installed properly to ensure the IP54 rating?

author: JohnPi
author_rank: Regular Contributor
timestamp: June 09, 2023, 07:07:35 pm
content: The firmware for the TD004 is available athttps://www.topdon.com/pages/pro-down.html?fuzzy=TC004Its readme includes:How to Upgrade Your TC004 Device?1. Turn on TC004, and go to Setting >> System Setting >> USB Mode to switch to the USB Disk mode.2. Connect TC004 to your Windows computer with the supplied USB cable, then go tohttps://www.topdon.com/pages/pro-down?fuzzy=TC004and download the upgrade package file (IRPT_EMD_C200SE_V1473(107)-TC004) to the root directory of the TC004 SD card.3. Unzip the file, and rename it as "update". (See figure below).4. Press and hold the right button of the device for 10 seconds; then press and hold the left button while still holding the right button; release both buttons until the following update page appears on the device.

author: bebopdk
author_rank: Contributor
timestamp: June 10, 2023, 11:13:28 am
content: The same update for the TC005(with visual camera) can be found here:https://lenkor-plat.oss-cn-hongkong.aliyuncs.com/topdon-web/information_app_file/Update%20software-TC005.zip

author: JohnPi
author_rank: Regular Contributor
timestamp: June 10, 2023, 07:12:02 pm
content: That's version 1.4.7.3 (103); my SC240M has a version 1.4.4 (102) Has anyone tried the TC005 firmware in a SC240M ?

author: ImpulsiveJames
author_rank: Contributor
timestamp: June 12, 2023, 06:49:54 pm
content: Well crap, now I have to buy one.....

author: Manawyrm
author_rank: Contributor
timestamp: June 12, 2023, 06:53:23 pm
content: Oh, that's awesome, I'm not sure how I missed that!Thank you. I'll try to build a (no-hardware hacking required) firmware dumping image with that.

author: Oreg
author_rank: Newbie
timestamp: June 13, 2023, 11:36:24 pm
content: Quote from: Oreg on June 07, 2023, 05:57:05 amAs it turns out, Vevor's statement may have been correct, as the seal is quite wide. Nevertheless, I have now installed it correctly.I would love to unlock some more features on my SC240N like additional color palletes and video recording.By coincidence I found a hidden menu which is partly english and partly chinese. I don't know the exact button sequence but I can trigger it sooner or later when I fiddle with the left/right buttons.Hold left button, press right button 3x, keep right button pressed down and and press left button 3x. Repeat alternately until the menu opens.

author: Fraser
author_rank: Super Contributor
timestamp: June 14, 2023, 01:04:34 am
content: Google translate says.....Update datManual bindingClear User tableExport LogGet System Module IDUpdate Splash screen

author: Oreg
author_rank: Newbie
timestamp: June 14, 2023, 08:31:46 am
content: And in the first line it says "update" badly recognizable in red font.

author: zrq
author_rank: Frequent Contributor
timestamp: June 14, 2023, 06:05:25 pm
content: Translation of the menu:UpdateUpdate_datManual marking of bad pixelsClear user bad pixel tableExport logsGet module systemIDUpdate start up screen/picture.

author: pie314isi
author_rank: Contributor
timestamp: June 15, 2023, 12:03:21 am
content: that menu is documented in the zipfiles linked above.

author: pie314isi
author_rank: Contributor
timestamp: June 15, 2023, 01:07:00 am
content: followup:"Press and hold the right button of the device for 10 seconds; then press and hold the left button while still holding the right button; release both buttons until the following update page appears on the device."

author: ragequit
author_rank: Newbie
timestamp: June 18, 2023, 12:30:59 pm
content: It seems like I have been looking in the wrong placeThere is a really complex update procedure in iray_hisi_camera, but now I see the much simpler update procedure in iraytek_softer_01.I am not certain yet, but it seems like i can just put a S90start file in the update folder on the SDcard and start the update via UI?Can anyone confirm this before I brick my camera?here is the relevant functionhttps://paste.ofcode.org/bC8wYWgHYApgJqSudyCckw

author: bap2703
author_rank: Regular Contributor
timestamp: August 29, 2023, 02:24:24 am
content: Just got a TC004.On Win11, the camera app / vlc / obs see the camera but can't get the video.The software from topdon, TDView, works.I suspect some unusual encoding.Manawyrm did you do something special to get it to work? I mean apart from completely hacking the device

author: pinchies
author_rank: Contributor
timestamp: September 01, 2023, 02:49:53 am
content: The ".h264" files should play in VLC fine. They are a h.264 video stream but are not packaged in the MP4 container format, so they are not very compatible with other software. To fix this, you can do a "convert" using VLC to export an MP4 file with passthrough video, and that worked well for me.

author: bap2703
author_rank: Regular Contributor
timestamp: September 01, 2023, 05:18:31 pm
content: I meant about the UVC streaming.Quote from: Manawyrm on May 18, 2023, 08:33:36 pmWith the TC004 that has streaming enabled by default, you still need to activate it in the menu, I can use Topdon's software to display the live video.But any other software won't work.Maybe Topdon's firmware has a different "encoding" of the streamed data?

author: jetpad
author_rank: Newbie
timestamp: October 21, 2023, 08:51:33 pm
content: I have the Vevor SC240N and stupidly thought "maybe the firmware for the TC004 or TC005 will load on it". I did nothing to back up the original firmware and after performing the firmware install, of course, it just boots to the logo screen and hangs. Is this bricked for good or is there a way to reinstall the original firmware?

author: Manawyrm
author_rank: Contributor
timestamp: October 21, 2023, 10:31:21 pm
content: OopsWell, I do have an image of the original firmware and would be willing to share it.Do you have serial console access already? With that you can probably recover it.

author: jetpad
author_rank: Newbie
timestamp: October 22, 2023, 03:54:29 pm
content: Thanks, that would help a lot. I haven't opened it up yet to add the port but don't have anything to lose now.

author: Honusnap
author_rank: Contributor
timestamp: October 26, 2023, 04:11:03 pm
content: I can see i'm not the only dumbass hereI did it on my C200 Pro => same punition, C200 is staying on the boot screen... i guess you too have the nice TCView logo ..

author: Honusnap
author_rank: Contributor
timestamp: October 26, 2023, 04:23:59 pm
content: I'm in the same boat as Jetpad, if you got directions to solve this ...I got the C200 Pro (same as Topdon TC005, well not entirely .. for sure .. i guess the systemID is different at least)I'm all ear, what should i do ..? I think i got en FTDI somewhere, what chip do you use for USB/RS232 ?My problem is that i got no firmware for the C200 Pro.I got a firmware upgrade but... it's in Chinese, dunno if it's usefull to compare.. just ask me for it.

author: Manawyrm
author_rank: Contributor
timestamp: October 26, 2023, 04:35:52 pm
content: Quote from: Honusnap on October 26, 2023, 04:23:59 pmWell, not exactly directions, this might be a little hard to follow for an embedded hacking beginner, not sure how much experience you have.The FTDI won't do the trick here, you would have to do the RS232 level conversion yourself. Much easier to buy one of the many USB to RS232.Get a proper one likehttps://www.amazon.de/UGREEN-RS232-Seriell-PL2303-Chipsatz-Grau/dp/B00QUZY4UG(or similar in your region).Then try to either solder wires or source a suitable connector for the serial port (pinout mentioned in the first post).From there, after we have a shell, we can work out a solution to copy a fresh/original image file from an SD card to the eMMC flash.I'm hoping that the Linux is still fine on both of your cameras and it's just the application software.That would be ideal, because that means that we can use the Linux itself to recover the flash.Otherwise, things get a lot more complex because we'd need to upload a new Linux image via RS232.There's currently no Linux image which could be uploaded via RS232, so this would get a bit ugly.

author: Honusnap
author_rank: Contributor
timestamp: October 26, 2023, 04:56:38 pm
content: Ok seen the J16, do you have the specs of the connector ?EDIT : Ok i think i found it : JST SH1.0 6pinFound a PL2303 : But have a question, i've read some pages on the subject and seems there are ... REAL RS232 levels (like 12V/5V), RS232 levels (like 5/3.3V).. i'm kind lost here, the PL2303 seems to be ok to connect to the C200 right ? It got RS232 levels at 3.3V or 5.5V, which voltage is the good one for the C200 board ?Or maybe this one which is able to do far more : CP2102

author: jetpad
author_rank: Newbie
timestamp: October 27, 2023, 01:45:26 pm
content: My solution was to solder one of thesehttps://www.amazon.com/gp/product/B07PDQKHJ2/to a little scrap connector I had. Then connecting that tohttps://www.amazon.com/gp/product/B0BG2BPVXV/That connects tohttps://www.amazon.com/gp/product/B074VN9ZG4/Which plugs into my MacBook. Just a temporary setup while it is disassembled.

author: Honusnap
author_rank: Contributor
timestamp: October 28, 2023, 09:38:26 am
content: Hello Jet,Good, SH1.0 connector confirmed, i would like to avoid the DB9 connector cause i haven't got any, i bought the PL2303 and the CP2102 (which will help in my RS485 projects anyway), and a bunch of SH1.0 connectors .. should be ok...

author: jetpad
author_rank: Newbie
timestamp: November 01, 2023, 09:44:39 pm
content: Ok, I was able to get the firmware loaded back on the SC240N thanks to Manawyrm. Lots of things tripped me up since this was a little out of my norm. The two main ones were: 1) The RX connection on the serial cable wasn't working so I thought the camera was ignoring me and 2) I wasn't pressing the spacebar fast enough to interrupt U-boot.Now, after I put it all back together, I realized it wasn't displaying the correct hi, low and center temperatures correctly. It's displaying -273.1 C for all three. The thermal image looks right, it's just that the temperatures never change.Do I need to do some sort of calibration? Has anyone else encounter this?

author: Honusnap
author_rank: Contributor
timestamp: November 08, 2023, 06:33:04 pm
content: Hello,I think i've read something about calibration being specific to each device (obviously), isn't there a menu to calibrate ..? I searched but did not find infomation while i think i've seen something about this...About the reviving of your device, what did you flashed ..? The whole firmware through the firmware script, or just some files ?Cause nobody seems to have the firmware i have on my device .. (chinese one) and so i got no source, appart from what seems to be a partial firmware (4 or 5 files).

author: povlhp
author_rank: Newbie
timestamp: November 10, 2023, 07:37:39 am
content: I can see that there is a solder free way to copy files to the Infiray C210, do anybody know if this works for this series as well ?I have the Vevor SC240M aka C200 Pro (video recording and normal cam as well) - And if so, does somebody have an original usbdisksettings.sh or whatever I am going to replace ?https://www.eevblog.com/forum/thermal-imaging/infiray-c210-thermal-camera-review/msg4368193/#msg4368193

author: Honusnap
author_rank: Contributor
timestamp: November 29, 2023, 08:59:44 am
content: Hello Jet,Did you suceed calibrating your device ?I'm in contact with Infiray and for my device the guy said i ned to send it back for flashing firmware again .. AND recalibrate the device, they also added that they need something called a dark mater to calibrate, it's something the temperature is well known.But i suppose we can calibrate it with something else if we do not need extreme precision afterall.About your SC240N, how did you flash the firmware ? What tools and procedure did you follow ?I need to flash my C200 Pro (aka SC240M), if someone got a SC240M OR a C200 Pro firmware .. i would love to have it.Thanks ..

author: jetpad
author_rank: Newbie
timestamp: December 01, 2023, 08:17:04 pm
content: No it's still not back to the original state because I guess it needs to be recalibrated and I don't know if that is possible without sending it back. You've probably gotten farther along on that aspect since I haven't contacted Vevor about it yet. But it does display a thermal image, just without all the nice temperatures on it (and probably not in a calibrated way). Sorry, I don't have a copy of the SC240M firmware, just the SC240N. I don't remember the exact commands I used to get the firmware back on but it was something like this. Please verify each one before using them as I'm sure they need to be each customized for your setup. These were run on my MacBook after getting the serial cable working between the SC240N and the MacBook.cd sbinfdisk -l /dev/mmcblk0diskutil listdiskutil unmountDisk /dev/disk4sudo dd if=/Users/jetpad/Downloads/vevor-sc240n-firmware/vevor-sc240n-emmc.img of=/dev/rdisk4 bs=1m; This command took about 10 minutes for me.sudo dd if=path_to_image.img of=/dev/rdiskX bs=1mdiskutil eject /dev/disk4/dev/mmcblk1dd if=/dev/mmcblk1 of=/dev/mmcblk0 bs=4M

author: Honusnap
author_rank: Contributor
timestamp: December 02, 2023, 07:04:25 pm
content: I checked both Topdon TC004 and TC005 firmware, they are identical BUT 2 files :iray-hisi-camera-newiraytek_softer_01_newS90start seems different at first but is in fact differently organised.Those 2 firmwares got different numbers :TC004 : V1.4.7.8(109)TC005 : V1.4.7.8(105)I also got a C200 PRo V1.3.8(131), S90start is the same as TC004 and TC005, iray-hisi-camera-new and iraytek_softer_01_new are also present and diferent then the TC004 or TC005.Nobody got a Vevor firmware ?

author: Gridstop
author_rank: Contributor
timestamp: December 03, 2023, 04:41:27 pm
content: I picked up one of these and am pretty happy with it so far, haven't opened it up yet though. I wanted to do it all at once when I put together the macro lens.If anybody has used one of those 18mm CO2 laser lenses with it (such as the 3D print tsys posted on the first page) what focal length did you use? I'm not sure if it's as simple as 'use a 5cm FL to get a 5cm minimum focal length' since I have no idea what optics are inside the camera otherwise. And the lenses are $25 each or so, so I'd prefer not to guess several times.

author: cat99
author_rank: Newbie
timestamp: December 05, 2023, 11:02:23 am
content: Quote from: jetpad on December 01, 2023, 08:17:04 pmnot sure if it's relevant to your situation, butthis amazon reviewmentions a possible calibration menu (I didn't try it)Quote

author: cat99
author_rank: Newbie
timestamp: December 06, 2023, 06:58:42 am
content: Does anyone know if there is a trick to updating the firmware on a unit that is running an older firmware?I bought a topdon tc004 recently, when comparing it to videos online, my device is missing the "usb mode" menu entry, always running in mass storage mode.The device is running firmware 1.2.1(1110), which seems older than the 1.4.x most people are running.I tried updating to the current 1.4.7.8(109) but have not been able to get it to work.I followed these steps:put sdcard in devicetell it to format the sdcarddownload the firmware rar file, unpack the contents including a zip file, unpack the zip fileconnect the device to a computercopy the folder that was contained in the zip file and rename it to "update"disconnect from computerhold right for 10sec, then while still holding right begin holding left, update screen appearsthis is where I get stuck, instead of a list beginning with "update" and "update_dat", "update" is missing and it only has "update_dat"if I select "update_dat" it responds in chinese:QuoteI also found a link onarchive.orgfor the older firmware, 1.4.7.3, but this failed in the same way.I'm thinking the problem is most likely one of these:option1- they have some older units that can't function in webcam mode, maybe can't be updated, and wanted to dump them on black fridayoption2- the update process on older firmwares was different than on the newer ones, and the older process isn't documented anywhereoption3- I'm doing something wrong

author: federigo
author_rank: Newbie
timestamp: December 11, 2023, 08:17:47 am
content: Does someone with this device havethis problem?I know some kind of vignetting is considered normal, but it was my impression that the vignette is "colder". What I noticed during use is that I have some kind of "warm halo" on left/bottom side of the image. This is less noticable depending on NUC/range of what I have in view (though it is still noticeable by rotating the camera), but when pointing to a uniform surface is quite evident (picture attached of the camera pointed at a paper sheet).The hottest point is always in the bottom-left side corner and the temperature difference between that spot and the coldest spot is always in the range of 1.8-2.2 °CCan this considered "normal" or do I have a defective unit?Also, the unit didn't come with any emissivity table in any form, it's set at 0.95 / 25 °C ambient temp / 0.5 m distance, how important is it to set these parameters if I don't care (too much) about absolute temperature measurements? I'm more interested in temperature differences and a rough indication of the actual temperature (if it's 30 °C instead of 35 °C is not important).Thanks.

author: jetpad
author_rank: Newbie
timestamp: December 22, 2023, 10:04:14 pm
content: QuoteThanks. That does look very promising! I messed around with it but I was having trouble translating those menu options and wasn't able to figure it out. I'm going to keep trying.

author: Honusnap
author_rank: Contributor
timestamp: December 23, 2023, 12:14:07 pm
content: Use google translate camera mode on your android phone .. easy to translate your IR screen.

author: Honusnap
author_rank: Contributor
timestamp: December 24, 2023, 03:30:14 pm
content: Allright, after some ... annoying discussions with Infiray, and a stuck boot C200, i was able to install a Frankestein firmware based on a TC005, my device is working nice today and even better ... coming from a Chinese only device i now have a fully international device.Infiray asked me 100€ to provide me with an international firmware while my device was Chinese only.... what a bunch of scammer.

author: bap2703
author_rank: Regular Contributor
timestamp: January 15, 2024, 05:25:44 pm
content: Quote from: cat99 on December 06, 2023, 06:58:42 amOn the software pagehttps://www.topdon.com/pages/pro-down?fuzzy=TC004I see two versions. On for devices with four digits (V1.4.7.9) and one for devices with three digits (V1.2.7).It seems you tried to put a 4 digit on a 3 digit.Interestingly their version numbers without dots are reversed,4 digits with dots = 3 digit number, 3 digits with dots = 4 digit number, as highlighted in your post.

author: brc
author_rank: Newbie
timestamp: January 24, 2024, 06:50:11 am
content: Quote from: Gridstop on December 03, 2023, 04:41:27 pmIn this post, jairbj said they used a 20 mm diameter, 50.8mm focal length lens:https://www.eevblog.com/forum/thermal-imaging/infiray-c210-thermal-camera-review/msg3698872/#msg3698872

author: cat99
author_rank: Newbie
timestamp: January 31, 2024, 09:34:21 am
content: Quote from: bap2703 on January 15, 2024, 05:25:44 pmInteresting, I checked archive.org to confirm none of the 3-digit vs 4-digit info was on that page last time I checked it.A friend of mine who has the same device emailed Topdon asking about this and they replied saying units that run four-digit firmwares are the old hardware revision, three-digit firmwares are for the newer hardware revision.I just installed 1.2.7 and it still doesn't have a "usb mode" to toggle between mass storage mode and webcam mode.However after updating it I ran cheese (webcam tester) and was able to get video from the camera for around 5 seconds or so before it glitched out, which is encouraging, so maybe it just appears both as a mass storage device and a slightly non-standard webcam at the same time on these "newer" hardware revision models.There is also a "super-resolution" option now, I looked at it briefly it appears to try and remove some of the macroblock style artifacts, and may be doing a sharpening filter of some sort.Still images using "super-resolution" do generally look more asthetically appealing, I can't tell yet if it's a net positive when looking at the live video.

author: brc
author_rank: Newbie
timestamp: February 08, 2024, 04:59:03 am
content: Quote from: brc on January 24, 2024, 06:50:11 amhttps://www.thingiverse.com/thing:6051118mentions using an 18 mm lens. Here's one option:https://www.aliexpress.us/item/2251832054759353.html

author: Mrnilcs
author_rank: Newbie
timestamp: September 08, 2024, 01:16:28 pm
content: Dear thermal imaging enthusiast and hobbyists!!I’m in middle of the process of evaluating this device’s capabilities so I’m reaching out: Could someone DM me some raw, uncompressed photos taken with SC240M? Especially interested in photos taken with the model with camera module.Photos of interest to me are those taken from inside of apartment buildings, documenting temperature differences near window, vents, doors and bathroom floor/drains. Also curious to see how the apartment buildings look from outside-in. In this case, more is more so if you can provide multiple photos, I would greatly appreciate it!My goal is to better understand the capabilities of the device: resolution and sensitivity in apartment and building context.Here is my e-mail for image delivery: mazurka_spinach.0@icloud.comBr,Max

author: Evolver
author_rank: Newbie
timestamp: November 12, 2024, 03:19:22 pm
content: Hi all!Looks like my C200 Pro on Hisilicon HI3516DV300 platform is dead.The thermal image looks very noisy and there are a lot of lines. And this is not a problem with the screen - the picture from the video camera and a menu are absolutely normal.The camera was used for amateur purposes for about 2 years, about once a month. I guess not more than 3 full battery charges.What's confusing me, is that the problem first appeared after two months. I wanted to use the warranty, but the camera is self fixed after the battery was completely discharged and then recharged. And then it worked perfectly. Until a few days ago, the problem arose again and it can no longer be solved with simple methods.FFC events (shutter sound) occur frequently at powering on, but after a while everything goes to once per one/two minutes - looks normal for me.I disassembled the camera, checked and cleaned all ribbon cables - no luck.All voltages on both boards are OK, the oscilloscope shows no noise on the capacitors.The RTC battery is completely dead, it doesn't even charge, although 3.2v present, when the camera is on.Judging by the attached log and numerous messages"[1970-01-01 00:00:12]: HisImageProcess error."unit experiencing problems communicating with ELF1 (thermal module) image processor.I guess troubles even not with the connection itself, but processing of the received data.But thermal image is alive, i can see the outline of my hand, the center point showing like the right temperature. But there is a lot of noise from the min to max values of the measurement range at the same time.Masking different lines in S90start I found out that "HisImageProcess error" occurs when launching /iray_app/iray-hisi-camera, which initializes the communication with the thermal module and eventually displays the thermal image on the screen. The problem is exactly in this place. And only after that /iray_app/iray_softer_01 - the user shell - is launched, but this does not change anything in the corrupted image.Fraser, can your wealth of experience tell - if this is a hardware or software problem? I think it's faulty thermal module/integrated image processor...By the way, there are 8Gb eMMC disk and 512M RAM inside - quite a powerful thing.

author: Fraser
author_rank: Super Contributor
timestamp: November 13, 2024, 11:02:04 am
content: Evolver,That looks like a nasty fault. As to whether it is hardware or software that is causing it, I cannot be certain. This fault would need some detailed investigation of the signals coming out of the microbolometer module.Fraser

author: Evolver
author_rank: Newbie
timestamp: November 13, 2024, 01:06:19 pm
content: Thank you.I suspected that there is no easy solution here. So I bought another one full clone of that cameraMileseey TR256B.It can be included it in the topic title. The only difference from C200Pro is a body color, even measured weight is same. At least if it breaks too, I can assemble one frankenstein from parts of two ones.

author: OneGeekGuy
author_rank: Regular Contributor
timestamp: March 08, 2025, 07:50:26 am
content: Hi everyone!,I just received this week a Vevor SC240N, and for the moment, so far I am very pleased regarding how it works. Since I did not wanted to open the housing to do the Macro lens mod (With magnets) I have been playing around creating a small fixture to hold the Macro lenses, if someone is interested I leave it here:https://www.printables.com/model/1220941-vevor-sc240n-thermal-camera-macro-lens-holderIt uses 20mm lenses and I have tested 38.1 and 50.8 focal lengths and both worked fine, it depends on the situation one is more suitable than the other.

author: Valmiro
author_rank: Newbie
timestamp: May 16, 2025, 08:12:38 pm
content: Hi everyone,I thought I'd share the design I already made a while back for a macro lens holder for the SC240N. Design goal was to do something that is nice and tidy and does not need the camera to be opened as it is stuck down with double sided adhesive tape.https://www.thingiverse.com/thing:7039807I chose the smaller 12mm diameter with a focal length of 38.1mm and am pleased with the result. I cannot compare to bigger lenses, but as far as the over all image quality of this camera gets I don't think I'm missing something.

author: Juen
author_rank: Newbie
timestamp: July 26, 2025, 03:51:08 pm
content: How did you mod the FW? I've bought a Mileseey TR256B and they don't seem to update their FW. There's no download section on their website.

author: Juen
author_rank: Newbie
timestamp: July 31, 2025, 08:50:45 am
content: Any of these devices offers the thermal uncompressed feed?I have just acquired a MILESEEY TR256B and I wanted to use it with the computer as a thermal camera. I have been able to retrieve both the MJPG and the H264 video feed but I need the raw (YUYV 4:2:2) feed.This is the capability list of the camera as reported by v4lc-ctl tool:Code:v4l2-ctl --list-formats-ext -d /dev/video0ioctl: VIDIOC_ENUM_FMTType: Video Capture: 'YUYV' (YUYV 4:2:2)Size: Discrete 640x480Interval: Discrete 0.033s (30.000 fps): 'MJPG' (Motion-JPEG, compressed)Size: Discrete 640x360Interval: Discrete 0.033s (30.000 fps)Size: Discrete 1280x720Interval: Discrete 0.033s (30.000 fps)Size: Discrete 1920x1080Interval: Discrete 0.033s (30.000 fps): 'H264' (H.264, compressed)Size: Discrete 640x360Interval: Discrete 0.033s (30.000 fps)Size: Discrete 1280x720Interval: Discrete 0.033s (30.000 fps)Size: Discrete 1920x1080Interval: Discrete 0.033s (30.000 fps)Trying to decode the YUYV feed results in a errors. Which is the latest one, according to Mileseey... I doubt it thou, knowing that the TopDon is the same camera, and that they seem to have a newer FW.Additionally, the camera offers a second video interface (/dev/video1) but it does not list any controls or video feeds. Anybody knows what is it for?Thanks!