RECESSIM - User contributions [en]

Dali D8X3N Thermal Camera

2025-09-14T18:17:16Z

Gamerpaddy: added professional pcb adapter

=Dali D8X3N Thermal Camera Reverse Engineering=
 

===Introduction===
The [https://www.dali-irtech.com/productinfo/741567.html Dali D8X3N] Thermal Camera module comes in two versions, a 384x288 and 640x480 resolution, utilizing the [http://www.dali-tech.us/products/dld64017m-uncooled-infrared-fpa-detector-86.html DLD Series] of amorphous-Silicon Microbolometers.

They were mainly used in [http://www.dali-tech.us/products/dm60-w--online-body-temperature-thermal-imaging-camera-55.html Dali DM60-W] or WS-1 Body Temperature screening cameras in conjunction with a Black Body radiator set to 37°C to detect infected individuals at the start of the 2020 Covid Pandemic.
[[File:ICI FM320P Innerts.jpg|thumb|Internals. A TP-Link Switch, HikVision Visible Camera and the D8x3N Network thermal camera module]]
[https://infraredcameras.com/ ICI] rebranded these models as FM 320 P and FM 640 P, and distributed them on the local US market, but as the need for such Cameras exploded, those models were built with what was in stock.

So happens, that some of the FM 320 P Models had a DLD640 640x480 instead of a DLD384 384x288 Microbolometer in them, and just got their Firmware modified.

It also could be, because they have excessive amounts of bad pixels outside the 384x288 area, that they were binned to a lower grade.

Discussions about these Cameras started around 2022 in the [https://www.eevblog.com/forum/thermal-imaging/ici-and-dali-thermal-camera-software/ EEVBlog Forums.] when they started to appear secondhand and affordable.

Originally they were priced around US$ 20... 30.000 by ICI, and a unknown amount by Dali Tech.

The Modules specs according to the manufacturer are:

≤50..60mK@F1，300K，50Hz

17 or 25µm pixel pitch

Hisilicon SoC running Linux to provide Onvif and RTSP streams, analysis and a Web UI

 
[[File:Dali D8X3N Module.jpg|thumb|A real 384x288 model with a DLD384 sensor. notice the Productnumber ]]
ICI FM Cameras are found all over Online secondhand marketplaces for scrap Prices, as they are no longer needed.

But you never know, what are you getting. It could be a real DLD384 or the better DLD640 inside. Its a gamble.
 

======640x480 Imagers======
are labeled 22D843 Nxxxx and have a DLD640 sensor in it, they can be upgraded if they run the 384x288 firmware.

======384x288 Imagers======
are labeled 22D883Nxxxx and have a DLD384 sensor in it, they cannot be upgraded

 

==D8X3N Module closer look==
From now on, i will refer to the Thermal Imaging Module as TIM

On the front there is a 2 Element Germanium Lens of a unknown focal length and aperture.

It can be focus-adjusted when unscrewing the clamp around the housing. It can be focussed from infinity down to 10..20cm with some quality loss.
 The outter diameter of the Lens is 42mm with a 1 1/3 inch thread diameter of undetermined pitch.

Dimensions of the germanium elements are 21mm to 3 and 6mm and 14grams in weight.
[[File:Disassembled Thermal Camera Lens.jpg|thumb|Two element Germanium Lens of unknown focal length and aperture]]

The TIM is composed of 6 Stacked PCB modules, 3 of which are for the Web Server functionality. taking them off will give you the basic configuration of a [https://www.dalithermal.com/productinfo/741568.html Dali D8X3C] TIM<gallery>
File:Dali DLD640 Thermal Image Sensor.jpeg|DLD640 Sensor
File:Dali DLD384 Thermal Imaging Sensor.jpeg|DLD384 Sensor
File:Dali D8X3N Board1 Back.jpeg|Network & GPIO Board Back
File:Dali D8X3N Board1 Front.jpeg|Network & GPIO Board Front
File:Dali D8X3N Glue Board Back.jpeg|Board between Logic and IO Back
File:Dali D8X3N Glue Board Front.jpeg|Board between Logic and IO Front
File:Dali D8X3N SoC Board Back.jpeg|SoC Board back
File:Dali D8X3N SoC Board front.jpeg|SoC board front
File:Dali D8X3N FPGA Board Back.jpeg|FPGA Board of the D8X3C Thermal Imager including a PMIC
File:Dali D8X3N FPGA Board Front.jpeg|FPGA Board Front with Video DAC and SPI Flash
File:Dali D8X3N Sensor Power and ADC Board.jpeg|Sensor control and ADC board
File:Dali D8X3N Thermal Core Debug wiring.jpeg|Debug wiring for sniffing SPI and UART
</gallery>

===User Manual===
including pinout diagram and important data

can be found here https://archive.org/details/dali-d-8-x-3-cuser-manualen-v-1.0-1

==Viewing the Video Stream==
[[File:Onvif Device Manager ODM.png|thumb|ODM streaming the Thermal view]]
when first connecting it to power and Ethernet, the camera will have 192.168.1.102 as a Static ip.

If you are running a 192.168.0.x or .178.x net, you need to change it or add a subnet under windows ipv4 settings.

to view it, you can use VLC and the stream URL
rtsp://admin@admin:<camera ip>/ONVIFMedia
there is /ONVIFMedia /ONVIFMediaM and /ONVIFMediaS for different stream Profiles.

VLC is quite slow and delayed, rather use Onvif Device Manager ODM,

it has no delay and auto-detects cameras in the network.

Be sure to log in as user: admin pass: admin in ODM.

in there, you can also set you camera to DHCP under Network settings.

===Web Interface===
[[File:Dali D8X3N web interface.png|thumb|Since browsers cant display RTSP anymore, open in Edge and select IE Compatibility Mode.]]
the web interface can be accessed by opening the camera IP in a browser

login is:
user: admin pass: admin
You can set Temperature markers and areas, but without using the Black Body calibration source, your readings may be way off or not working.

 

====OSD====
there is a debug-login with
user: super pass: 871897
that lets you send Key commands to the Imager to navigate the OSD.

Setting the OSD to english is accomplished with option #11
[[File:Dali D8X3C OSD.png|thumb|OSD in english, if yours is Chinese. go to option #11 and click + or -]]

To acces some locked menus, press
+ - + - + -

The password for the locked System and Main menu is
+-MC+-

Be careful in the UART menu to not change the BAUD rate or Protocol, as your ability to control it via the Web API gets lost.

You need to reflash or solder buttons on the thermal core then.

==Viewing Raw Thermal Data from the Web API==
there is a hidden endpoint in the stream.so file that could be found while decompiling

accessing
[[File:Arduino Nano blink sketch thermal gif.gif|thumb|Arduino Nano running blink sketch while thermally recording it, notice the led and resistor on the right]]
<ip of camera>:5000/stream?Type=JPEG&Source=Jpeg&Mode=TCP
lets you download a JPEG. but there are more options available (not all have been tested)

we are mainly interessted in Raw thermal data.

====Source (Stream Type)====

*<code>Major</code> - Main video stream (channel 0)
*<code>Minor</code> - Sub video stream (channel 1)
*<code>MinorAV</code> - Sub video + audio stream
*<code>MajorAV</code> - Main video + audio stream
*<code>Jpeg</code> - JPEG snapshot stream
*<code>Raw</code> - Raw thermal data stream
*<code>YUV</code> - YUV raw video stream

====Type (Data Format)====

*<code>H264</code> - H.264 video encoding
*<code>JPEG</code> - JPEG image format
*<code>RAW</code> - Raw sensor data
*<code>QBOX</code> - Custom protocol format
*<code>FRAME</code> - Frame-based format

====Mode (Transport Protocol)====

*<code>TCP</code> - TCP streaming (default)
*<code>UDP</code> - UDP streaming
*<code>MUL</code> - Multicast streaming

====Quality Parameters====

*<code>Quality=[1-100]</code> - Video quality level
*<code>Frames=[number]</code> - Number of frames to send
*<code>Interval=[ms]</code> - Frame interval in milliseconds

====Network Parameters====

*<code>IPAddr=[ip]</code> - Client IP address for UDP/multicast
*<code>Port=[port]</code> - Client port for UDP/multicast
*<code>Heart-beat=[Yes/No]</code> - Enable/disable heartbeat

====Snapshot Parameters====

*<code>Snap=[Yes/No]</code> - Enable snapshot mode

 
====Raw Viewer for PC (Python)====
[[File:Dali D8X3N Raw Thermal viewer.png|thumb|Raw Data Viewer in python]]

To view the raw stream, i made a python program that converts the 14bit thermal data to a visible image.

it is low fps tho, due to bad optimizations.

rev1 first working version https://pastebin.com/dyNWDPT3

rev2 with temperature readout https://pastebin.com/u107Q85w

rev3 and onward will only be available directly as a Webpage on the Device (see below).

====Raw Viewer for the internal Webserver (recommended)====
It is also possible to use the Raw viewer directly in the browser.

To achieve this, the stream had to be proxied from port 5000 to 80 due to CORS.

luckily the internal lighttpd had the CGI module enabled, so piping it troug (using wget ... i know) worked with very low overhead.

To install, you need '''Terminal access''' to the Camera. see below.

optional for simplicity: '''ftp''' access

[[File:Dali D8X3N Webviewer.png|thumb|Web Raw Viewer with histogram (rev3)]]

Create the files and the code inside.

'''/app/web/webpages/raw.html''' https://pastebin.com/kaiXwAgD

and

'''/app/web/webpages/cgi-bin/proxy.cgi''' https://pastebin.com/vii1HXcU

then run
chmod +x /app/web/webpages/cgi-bin/proxy.cgi
'''restart''' your camera.

It should be accessible now trough '''http://<camera ip>/raw.html''' in the browser and click Start Stream

'''NOTE''': ''If it does not work'', check the contents of both files. FTP sometimes messes them up.

also run
dos2unix /app/web/webpages/cgi-bin/proxy.cgi
because linux <> windows difficulties that couldnt be resolved in over 30 years.

<blockquote>

performance may need improvement.</blockquote>

==Getting Root Terminal Access==
To access the Terminal you need to solder or plug in a UART connection to Connector J7 on the "Glue" board.

Pinout is (left to right) '''RX TX GND 3.3V Baud 115200 3.3V!'''

But the system will spam with debug messages, making patching the files a hard job unless you use "tftp" or "sed" commands.
 

====Enabling Telnet access to make patching easier====
[[File:Upgrade ici dali firmware updater.png|thumb|ICI Firmware updater software with modified firmware loaded]]

there is a easier way using a modified Firmware updater to enable Telnet temporarily to patch the Files.

Download the '''upgrade_ici.exe''' form [https://archive.org/details/fwupdate here] and run it.

Then you should be able to connect to it via Telnet.

The Login credentials are '''User: roo'''t '''Password: DLroot'''

 

===Patching Device===

===Patching the Web Server===
 

====Enabling Telnet and ftpd permanently====

This only works if you also patch the Thermal Camera module flash!

to permanently enable Telnet, go to '''/etc/init.d''' and edit '''S90app'''
vi S90app
in vi, move your cursor to the '''#''' at '''#telnetd''' and press x<blockquote>optional: enable ftp by removing the '''#''' at '''ftpd''' and adjust the path to / </blockquote>now press ''':''' and type '''wq''' and hit '''enter'''. this should be it.

====Patching the decoder and streamer to 640x480:====
go to /app and edit the mach.cfg

replace DL384 with D640 and edit the resolution to 640 480

(press i in vi to enter edit mode, press ESC to exit edit mode. :wq to write and quit.)

repeat that procedure for the dali.cfg

=====(optional) patching app.sh to prevent it from rebooting=====
edit the app.sh in /app and remove all "reboot" occasions to prevent the camera from rebooting if onvifserver, httpd or daliServer arent running for debugging purposes.

 

====Patching the Thermal Camera module====
To patch it, you need to disassemble everything down to the FPGA Board,

on the bottom there is a SPI SOIC8 Flash.

Use a CH341 EEPROM programmer (be sure to have a fixed or modified version to not put out 5V!, set it to 3.3V) and SOIC8 clamp.

Use NeoProgrammer (i used 2.2.0.10 but there are newer available, use the latest) and click Detect. It should find W25Q128 chips, select the FV one.

Dont forget to download a backup of your flash and save it !

Download the Binary "Dali 640x480 '''actual''' cleared pixelmap.bin" from #3 below and load it into NeoProgrammer,

Click Erase, Program and Verify.

This can take a while.

Your imager should start up right after assembly by hearing the shutter click.

==Hardware Hacking==

===Flash Contents===
On archive, click on show all files to download them.

<nowiki>#</nowiki>1 a Flash dump of the original downgraded D8X3N can be found [https://archive.org/details/dali-d-843n-flash-dump here]

<nowiki>#</nowiki>2 a Flash dump of a original 640x480 model can be found [https://archive.org/details/d-843-n-640x-480 here]

<nowiki>#</nowiki>3 a modified Flash dump of a 640x480 with cleared dead pixel map, flat map etc. can be found [https://archive.org/details/d-843-n-640x-480-cleared-pixelmap here]

a Flash dump of the web server SPI flash W25Q256JV can be found [https://archive.org/details/dm-60-webserver-flash-dump here] in case a bad firmware update caused a bootloop.

 

===Flash Binary Analysis===
The Flash IC is a Winbond 25Q128JV SPI Flash that contains the FPGA Bitstream, Deadpixel and Flatmap, aswell as the Device Settings.

a copy of the SPI Logic Capture at startup can be found [https://archive.org/details/dali-eeprom-capture here], the free software [https://www.dreamsourcelab.com/download/ DSView from DreamSourceLab] is required to view it.
[[File:Dali Thermal Imager SPI Flash capture.png|thumb|SPI Flash access while booting the Thermal Module]]

a approximation of the offsets resulted in this list:<syntaxhighlight lang="vb">
0x000000 - altera cyclone iv stuff
0x200000 - settings
0x280000 - Flat field correction map
0x4C0000 - Bad Pixel correctio nmap
0x580000 - image aswell? 36010 bytes
0x740000 - GUIX?
0x7C0000 - Strings for Gui?
0x800000 - another shorter GUIX
0x880000 - Strings for second gui?
0x8C0000 - GUIX
0x940000 - Strings for gui
0xE00000 - ?
0xE80000 - dzxg? short
0xEC0000 - crosshair.bmp
0xF40000 - 3DTM?
0xF80000 - fake? Bad pixel map BPRP
</syntaxhighlight> 

====Settings offset 0x200000====
The settings are read and written every startup, aswell when you close the OSD, sporadically and when executing the command MSV

these are some of the settings i could figure out by changing and watching the logic capture what changed.
 <syntaxhighlight lang="vb">
offset size Cmd
0x0 1 SAG (0-2) auto gain
0x2 2 SVB (0-16383) saved value is 16383 - SVB
0x4 2 SVC (0-1023) set exposure or gain
0x6 1 SSM image filtering
0x8 1 SEH image enhancement
0xA 1 SWP invert b/w polarity
0x14 1 SMR Flip
0x16 1 SMR Mirror
0x20 1 MENU Cal source 0 IN, 1 OUT
0x3A 1 MENU Enhance value 0-100
0x40 1 MENU Rectify (shutter 0 OFF, 1 L, 2 H)
0x50 1 MENU Language 0 english, 1 chinese, 2 russian
0xA2 - SCO set contrast gain
0xA4 - IBR set brightness
0xAE 2 MENU Fire Threshold
0xAC 1 SPA set color palette
0xE2 1 SMS display "collected 0/80" enabled
0xF8 1 SEM set emissivity
0x110 1 SRT set revise temp
0x116 1 SHD set humidity
0x118 1 SET set ambient temp
0x11A 1 STD set temp range
0x120 2 SLG -500 to 500?
0x124 2 SRD set distance
0x12C 1 SCP ???
0x130 2 SCT ???
</syntaxhighlight> 
[[File:Dali D8X3N Bad Pixel Map Viewer.png|thumb|Bad pixel map of a 640x512 sensor, about 0.56% of dead pixels in this map]]
So i let the AI create a [https://2476424.playcode.io/ Configurator page] that lets you change the Settings in your Flashdump to your liking
 

====Bad Pixel and Flatframe Maps 0x280000 and 0x4C0000====
Thermal cameras require a bad pixel and flat frame map to compensate for manufacturing inconsistencies.

unfourtainly, the maps of the downgraded cameras only contain enough data for a 384 model, not the full 640.

at offset 0xF80000 there is a BPRP which was mistaken at first as the Bad pixel map, it could just be a mask to where to apply the offset maps, as its either 0x0 or 0x1.

The [https://2477569.playcode.io/ Viewer Page] is written in JS and does not require any special dependencies, it can run as a plain html file offline.

''See "Automatic Dead Pixels and Flatmap Correction" below how to create new dead pixel and flatmaps using the system menu.''

[[File:Dali D8X3N Flat Field Map Viewer.png|thumb|Flat Field viewer]]

==Dali Commands==
To control the TIM you can either use Pelco or Dali command set. By default the Dali commandset is used at 38400 BAUD.

Those commands consist of a 0x02 start byte followed by two length Bytes, then the actual command which is allways 3 uppercase Letters in ASCII (eg. KBD for keyboard) followed by a comma and the values.

Some commands take multiple values, some dont. But you allways have to send the comma after the Command.

The camera will answer with the Command and 0, 1 or 2. Sending no value counts as zero.
0 is invalid parameters, too few or out of range

1 is OK, valid command

2 is Invalid command

Commands can be sent trough the Web server using the URL Api endpoint or directly trough the UART port.

(keyboard, C button, causes the shutter to do a calibration)
<camera ip>/cgi-bin/dmcmd?Command=KBD,C
Listening to the answer can be done while being in the Linux shell and typing
cat /dev/ttyAMA2 | strings

By bruteforcing the UART with AAA to ZZZ a list of Commands could be obtained, but some with unknown Parameters or functionality yet. including some from a decompiled DM60comm.so module found in /app/modules folder.<syntaxhighlight lang="vb">
KBD KEY Keyboard (F S M C + -)
SSM 0-1 Image Filtering Off/On
GSM 0 Image filter status
SEH 0-1 Image Enhancement Off/On
GEH 0-1 Image enhancer status
SCO 0-255 Set Gain (locked when SAG auto gain is on)
GCO 0-255 Get gain
INT 15-320 set actual gain? not just contrast sometimes disabled?
IBR 0-255 Set brightness
GBR 0-255 Get brightness
SMR 0-3 Mirror mode bit0=horizontal, bit1=vertical
GMR 0 Get rotation/flip
SDT 0-1 displays temp=44.65°C osd, but webserver sends date/time to the cam there....
GDT 0-1 Get temp display active?
GPT Display temp oft SDT
GNU 0-1 Get Shutter closed/open
SNU 0-1 Shutter close / open
STD 0-1 Set Range 0: -20-180°C 1: 100-600°C
GTD 0-1 Get Range
SET °C Set Ambient temperature
GET °C Get Ambient temperature
SEM 0-100 0-1 set emissivity x100
GEM 0-100 Get Emissivity
SRT °C Set revise temperature -100-100 -10-10°
GRT °C Get revise temperature
SRD 100 Set Distance 4.4m x100
GRD 100 Get Distance
SHD 0-100 Set Humidity
GHD 55 Get Humidity
SWP 0-1 invert s/w polarity image
GWP 1 is inverted?
SPA 0-10? Set color palette
GPA 3 white hot
SMV 0-1 Show temperature 3x3 grid?? in combination with GTV maybe
GMV 0
SMS 0-1 displays "collected 0/<number set by SCT>" by SCP delay "saves the daily number of highest temperatures?"
GMS 0
SCT 1-500 sets the amount of "collected" points for SMS
GCT 80
SCP 5-60 "collected" delay in seconds for SMS
GCP 60
SAG 0-2 Auto brightness / gain
GAG 0
SLR 0-9 ???
GLR 0
SRP 0,0 - 639,479 set crosshair position
GRP 320,240 get crosshair position
DRC 0-1 Show crosshair
SLG -500-500 ??
GLG
SCE text ??
GCE 0
SCB text ??
GCB 0
SVB 0-16383 adc offset, exposure? good at 9650
GVB 6733 value is 16383 minus SVB
SVC 1-1023 set contrast but better
GVC 260
SVF 100-? ?? video freaks out 3400 seems good
SVS 100-? ?? video freaks out 3300 seems good
SOT 0-1 ?? sensor supply, looks weird when off.
SZM 1-4 ?
GZM 1
MSV save settings too eeprom
ASV Saves something aswell?
GCS 0 Get Core status & faults
ALD 0,2? video blanks lots of eeprom activity. reload pixel map??
SAV 0-9999 set Fire threshold
GAV 2100 get Fire Threshold
BAC change uart protocol? careful
CBD Displays Recovery successful?
CBS Displays Saved successfully
LRD Displays Recovery successful?
LRS Displays Saved successfully?
LRE Displays Temperature Repair successful?
CBT Displays Calibration successful?
DBP ??? shutter clicks
DPI Show weird pixels
API Hide weird pixels
CCM ??
ASN 0-4 ??
GAB 4 vals ?? 3,-10,50,150
GAN 1 ??
GAR 11 vals ?? 10,10,5,20,35,50,70,90,120,150,180,,
GCM 6 values ??
GFV prints screen gray value?
GIT 200 ??
GTV Get the collected temp values?
PTS echoes but with extra stuff??
QYA 7170 Query Gray Info (information mode)
QYI 7124 Query Gray Average mode
QYM 7512 Query Gray Minimum mode
VTP 400-4000 ??
MTD U/S,0,0 ?? S answers with bytes, U upload bytes?
MTC U/S? ?? S answers with U,0,0, S doesnt.

return 0 invalid params:
STS ??
STT ??
SAC ??
SAH ??
SAS ??
SAT ??
SCX ?? displays crosshair but invalid params
SCY ?? displays crosshair but invalid params
GAC ??
GAH ??
GAS ??
GAT ??
GME ??
GPC ??
GPI ??
GPM ??
GTA ??
GTC ??
GTI ??
GTM ??
GTS ??
GTT ??

answer only:

BPM 0-1 stream ready? answers with 0 stop, 1 go, 2 when prompted
AVS 0,1
MEH
PWI 0-1 changing palette from wh to fire

unconfirmed (from dm60comm.so):
SDT 2024,03,15,14,30,25 Set Date Time with year,month,day,hour,minute,second
STS 1 Set Temperature Show display (0=off, 1=on)
SVA 2 Set Video Auto mode (0=manual, 2=auto)
SMP 0,1,1,0,100,150,200,250,300,350,90,25 Set Measurement Point (type,index,enable,mode,startX,startY,endX,endY,anchorX,anchorY,threshold,color)
STV Stop Temperature View measurements
SPF 5 Set Profile parameter
SVL -10 Set Video Left pan movement (signed value)
SVU -5 Set Video Up tilt movement (signed value)
SVD 5 Set Video Down tilt movement (signed value)
SSP 17,1,0 Set System Parameter (param_id,value,index) #46 temperature format 0 °C, 1 °F, 2 K
SCP Set Current Preset (save current position)
GCP Get Current Preset
STT 300,350 Set Temperature Threshold (low,high values *10)
SDC 1 Set Display Configuration parameter
GCS Get Current Status
GMM Get Memory Map information
GFV Get Frame Value (grayscale data)
GFZ Get Freeze Status
GSI 1 Get System Information (parameter=1)
GSS Get System Status
GSP 21,0 Get System Parameter (param_21=surround temp, value=0)
GTT Get Temperature Threshold range
GTV 1,3,10 Get Temperature Values (enable,type,count)
GNU Get Network Update status (response command)
FRZ Freeze current display frame
LIV Live mode (unfreeze display)
CAL Calibrate system
CCP 3 Call Current Preset (preset number 0-9)
APF 100 Auto Profile setting
MEH Measure Enhancement
BPT Built-in Test
MTC S,0 Measure Temperature Capture (S=start, 0=sequence)
MTG U,0,1024,<data> Measure Temperature Gray data transfer
MTD U,0,1024,<data> Measure Temperature Data transfer
UFP S,0,2048 Update Firmware Prepare (S=start, 0=offset, 2048=size)
UFD S,0,1024 Update Firmware Data transfer
BAB U Buffer operation (U=update)
TTH S,0 Temperature Threshold operation
IPP 192.168.001.102,255.255.255.000,192.168.001.001,192.168.000.001,9989,9998 IP Parameters (IP,netmask,gateway,DNS,port1,port2)
MAC 00:60:A9:10:00:01 MAC Address setting
SNP Set Network Parameters (response command)
QYI Query Gray Info (information mode)
QYA Query Gray Average mode
QYM Query Gray Minimum mode
GAI Get Alarm Info (response command)
YTC <data> Unknown command with data parameter
HTH
LRS
LRD
GAR
DRC
PTS
SCX
SCY
CBT
LRE
CBD
CBS
XXX
GSP
GTT
QYI
QYA
QYM

</syntaxhighlight>

==Secret Menu Overview==
The secret menus Main and System can be openend with the password '''+-MC+-'''

Its structured like this, not all variables have been figured out yet.

The format is Menu: submenu: submenu:

and for menu entries: Name, default value, command, description or messages that pop up.
 <syntaxhighlight lang="vb">
MAIN & SYSTEM PASS: +-MC+-

entries are NAME VALUE COMMAND DESC or if its a folder its just ":"

System:
System:
Gain 255 SCO
Bright 102 IBR
BenDi 100 ?
BenDiContrase 80 ?
DisMode 0 ?
Frequency 48hz (24,25,48,50)
DigitalOut 8-14bit 14bit, BT656(_P), ?, BT601
AutoFocus N ?
Line 1 ?
Ltemp0 11800 ?
LTemp1 11000 ?
HTemp0 9500 ?
HTemp1 8700 ?
DelayTime 0 ?
Enhance 0-1 ?
Enhanced E1 230 ?
FPA_Gain 12pF ? between 4 and 18 at random.
NUCEn N ?

Area:
SE 2 ASN 0-4 "Partition"
INT 200 INT "Points time"
VS 3161 SVS
VF 2800 SVF
Vtemp 1401 VTP
VtempArea Low ?
VtempBase 13500 ?
VtempStep -1 ?
VsStep 8 ?
DeadPixelModel preset / calculate
DP: Cursor to select dead pixels
X 360 position
Y 288 position
AutoBP: 50 Press C to start automatic dotting
Quit? Number of bad pixels 961& "Blind element replacement in progress"
Undo
R2: Save data? blind pixel replacement in progress
Replace Y N = DPI, Y = API
L: Reading parameters
S: Saving parameters

Debug:
Rectify N
DisplayGary N
TE N SDT
AutoE ? ?
AutoVS Y ?
VSGrayH 8000 ?
VSGrayL 7000 ?
Trends 1 ?
Shelter N ?
MotorCon 3 ?
SaveFactoryPara:
LanTyp EN ? LANGUAGE
DisplayMT N ?
Version:
PRJ D843 DLD640 ImLib, MTlib, Soft, Logic

BackDispose:
GammaEN 1 ?
Gain 1 ?
EnhanceEN 0 ?
Hpf_shift 5 ?
Hpf_thrd 5 ?
Enhance 150 ?
Lthrd 50 ?

Monitor:
Opens normal OSD

Alarm Set:
Alarm Switch Y ?
Alarm Mode No ?
Alarm Temperature -1°C ?
Reference Gray Y ?
Alarm Level 1L ?
Alarm Gray 65535 ?
Alarm PointNum 0 ?
Correct Gray 0 ?

Thermometry:
Data Collection 0 SMS
Interval 60 SCP
Ammount 90 SCT
Environment normal ?
Export:
Displays: Exportin normal temperature MTC data
Correction -1 ?
Emissivity 100 SEM
Calibration:
BlackbodyTemp -10 grabs a val from GAB
Save CBS
Cancel CBD
Correction:
BlackbodyTemp -10 Picks from the list GAR
Grayscale 0 SLG
Confirm LRE
Save LRS
Cancel LRD
Ninepoint measurement SMV

Cursor:
Cur N DRC enable cursor
X 320 SRP set cursor position
Y 240 SRP set cursor position

Main:
Auto 2 SAG Auto gain
G 211 SVC
B 10002 SVB
P 1 SWP polarity
Z X ?
Settings:
Image:
FI Y ?
FIValue 0 ? 0-31
Freeze N Freeze image
VE N SMR Vertical flip
HO N SMR Horizontal flip
AutoCali L same as rectify?
O IN internal or external
COM:
Opens UART menu
AvoidburnSwitch OFF enable anti burn in
ProtectedTime 10S duration
AvoidBurn 16383 threshold to trigger antiburn

</syntaxhighlight>

===Automatic Dead Pixels and Flatmap Correction===

It it possible to generate a new flat and dead pixel map automatically within the camera after flashing the cleared-map binary.
 

=====Dead pixels:=====
In the secret menu "System", navigate to Area - DeadPixelModel and set the AutoBP (sensitivity for auto bad pixel finding) to 50 or so. Then press C Button

This can take a while.
[[File:High emissivity peltier black body.jpg|thumb|A Peltier / TEC coated in Candle sood to give it a high emissivity surface. It can be cooled or heated by swapping the polarity. ]]

Afterwards, navigate to S: and press + to save it.
 

=====Flatfield:=====
In the Debug menu navigate to R2 and press +

now place something '''Cold''' infront of the Camera with a high emissivity. (it needs to fill the whole image)

Press '''+''', wait for it to says High temperature.

Place something '''Hot''' infront and press '''+''' again.

Afterwards, save with '''S:''' again.

Flatfield should now be calibrated
 <blockquote>Note: Not all dead pixels are auto detected or get removed. you can manually select them in the Dead pixel editor but its not known yet how to select and correct them.</blockquote>

 

==Using the Thermal module without Webserver==
[[File:Breakoutboard d8x3c dali v1.1.png|alt=|thumb|Breakout board for D8X3C]]
to use it, you need to interface it directly.

The module will put out a Analog video signal (High-Z, need to buffer when connecting it to 75Ohm Video input)

Also a 8 or 14bit or 8-bit BT656 output.

the header exposes the FPGA JTAG and UART aswell as 6 Hardware Keys to Navigate the OSD.

To interface, you need to have a adapter board with a DF12-50DS-0.5V(86) Docking socket.

A open source project can be found here, it includes pin access to:

*FPGA JTAG
*UART 3.3V with pin compatible FT232 socket
*Power 5V over USB-C
*5 Button inputs
*Buffered video output and socket for USB Videograbber
*Digital 14 bit video out header with hsync vsync and clk.
*

the pcb layout has been tested and seems to work.

<blockquote>Very basic fanout of pins to 2.54mm headers with a socket for a Video grabber and FT232 adapter and buttons. by gamerpaddy
https://oshwlab.com/gamerpaddy/d8x3c-backpack-usb</blockquote><blockquote>Professional adapter with integrated Video grabber and USB/UART bridge built in including a FFC connector for pin fanout and buttons. by TOA-HI / Killy.THI

https://github.com/TOA-HI/Dali-Tech-D8X3C-Thermal-Camera-Backpack</blockquote>

==Sending Serial Commands directly over UART==

Sending Serial commands directly over UART to the core requires some additional bytes.

The packet structure is as follows (Strip spaces, commands are allways uppercase and 3 chars)
<STX> <LENGTH1> <LENGTH2> Command, Value, Checksum <ETX>

Pseudocode to craft a command packet may look like this<syntaxhighlight lang="c">
//cmd is allways 3 byte uppercase chars
//values can be multiple comma seperated like 320,240
function make_packet(cmd, values):
payload = cmd + "," + join(values, ",") + ","
bytes = ascii(payload)
length = len(bytes)
checksum = sum(bytes) mod 256
return [0x02, length&0xFF, length>>8] + bytes + [checksum, 0x03]
</syntaxhighlight>

 

==Sensor Pinout==
[[File:Dali DLD384 Sensor pinout basic.png|thumb|basic pinout of a DLD384]]
the pinout of the thermal sensor havent been analyzes much.

besides some supply and Control voltages, 3 clocks and a analog output have been found.

17.5MHz

14.705KHz

50Hz

Dali D8X3N Thermal Camera

2025-08-29T13:08:46Z

Gamerpaddy: /* Using the Thermal module without Webserver */

=Dali D8X3N Thermal Camera Reverse Engineering=
 

===Introduction===
The [https://www.dali-irtech.com/productinfo/741567.html Dali D8X3N] Thermal Camera module comes in two versions, a 384x288 and 640x480 resolution, utilizing the [http://www.dali-tech.us/products/dld64017m-uncooled-infrared-fpa-detector-86.html DLD Series] of amorphous-Silicon Microbolometers.

They were mainly used in [http://www.dali-tech.us/products/dm60-w--online-body-temperature-thermal-imaging-camera-55.html Dali DM60-W] or WS-1 Body Temperature screening cameras in conjunction with a Black Body radiator set to 37°C to detect infected individuals at the start of the 2020 Covid Pandemic.
[[File:ICI FM320P Innerts.jpg|thumb|Internals. A TP-Link Switch, HikVision Visible Camera and the D8x3N Network thermal camera module]]
[https://infraredcameras.com/ ICI] rebranded these models as FM 320 P and FM 640 P, and distributed them on the local US market, but as the need for such Cameras exploded, those models were built with what was in stock.

So happens, that some of the FM 320 P Models had a DLD640 640x480 instead of a DLD384 384x288 Microbolometer in them, and just got their Firmware modified.

It also could be, because they have excessive amounts of bad pixels outside the 384x288 area, that they were binned to a lower grade.

Discussions about these Cameras started around 2022 in the [https://www.eevblog.com/forum/thermal-imaging/ici-and-dali-thermal-camera-software/ EEVBlog Forums.] when they started to appear secondhand and affordable.

Originally they were priced around US$ 20... 30.000 by ICI, and a unknown amount by Dali Tech.

The Modules specs according to the manufacturer are:

≤50..60mK@F1，300K，50Hz

17 or 25µm pixel pitch

Hisilicon SoC running Linux to provide Onvif and RTSP streams, analysis and a Web UI

 
[[File:Dali D8X3N Module.jpg|thumb|A real 384x288 model with a DLD384 sensor. notice the Productnumber ]]
ICI FM Cameras are found all over Online secondhand marketplaces for scrap Prices, as they are no longer needed.

But you never know, what are you getting. It could be a real DLD384 or the better DLD640 inside. Its a gamble.
 

======640x480 Imagers======
are labeled 22D843 Nxxxx and have a DLD640 sensor in it, they can be upgraded if they run the 384x288 firmware.

======384x288 Imagers======
are labeled 22D883Nxxxx and have a DLD384 sensor in it, they cannot be upgraded

 

==D8X3N Module closer look==
From now on, i will refer to the Thermal Imaging Module as TIM

On the front there is a 2 Element Germanium Lens of a unknown focal length and aperture.

It can be focus-adjusted when unscrewing the clamp around the housing. It can be focussed from infinity down to 10..20cm with some quality loss.
 The outter diameter of the Lens is 42mm with a 1 1/3 inch thread diameter of undetermined pitch.

Dimensions of the germanium elements are 21mm to 3 and 6mm and 14grams in weight.
[[File:Disassembled Thermal Camera Lens.jpg|thumb|Two element Germanium Lens of unknown focal length and aperture]]

The TIM is composed of 6 Stacked PCB modules, 3 of which are for the Web Server functionality. taking them off will give you the basic configuration of a [https://www.dalithermal.com/productinfo/741568.html Dali D8X3C] TIM<gallery>
File:Dali DLD640 Thermal Image Sensor.jpeg|DLD640 Sensor
File:Dali DLD384 Thermal Imaging Sensor.jpeg|DLD384 Sensor
File:Dali D8X3N Board1 Back.jpeg|Network & GPIO Board Back
File:Dali D8X3N Board1 Front.jpeg|Network & GPIO Board Front
File:Dali D8X3N Glue Board Back.jpeg|Board between Logic and IO Back
File:Dali D8X3N Glue Board Front.jpeg|Board between Logic and IO Front
File:Dali D8X3N SoC Board Back.jpeg|SoC Board back
File:Dali D8X3N SoC Board front.jpeg|SoC board front
File:Dali D8X3N FPGA Board Back.jpeg|FPGA Board of the D8X3C Thermal Imager including a PMIC
File:Dali D8X3N FPGA Board Front.jpeg|FPGA Board Front with Video DAC and SPI Flash
File:Dali D8X3N Sensor Power and ADC Board.jpeg|Sensor control and ADC board
File:Dali D8X3N Thermal Core Debug wiring.jpeg|Debug wiring for sniffing SPI and UART
</gallery>

===User Manual===
including pinout diagram and important data

can be found here https://archive.org/details/dali-d-8-x-3-cuser-manualen-v-1.0-1

==Viewing the Video Stream==
[[File:Onvif Device Manager ODM.png|thumb|ODM streaming the Thermal view]]
when first connecting it to power and Ethernet, the camera will have 192.168.1.102 as a Static ip.

If you are running a 192.168.0.x or .178.x net, you need to change it or add a subnet under windows ipv4 settings.

to view it, you can use VLC and the stream URL
rtsp://admin@admin:<camera ip>/ONVIFMedia
there is /ONVIFMedia /ONVIFMediaM and /ONVIFMediaS for different stream Profiles.

VLC is quite slow and delayed, rather use Onvif Device Manager ODM,

it has no delay and auto-detects cameras in the network.

Be sure to log in as user: admin pass: admin in ODM.

in there, you can also set you camera to DHCP under Network settings.

===Web Interface===
[[File:Dali D8X3N web interface.png|thumb|Since browsers cant display RTSP anymore, open in Edge and select IE Compatibility Mode.]]
the web interface can be accessed by opening the camera IP in a browser

login is:
user: admin pass: admin
You can set Temperature markers and areas, but without using the Black Body calibration source, your readings may be way off or not working.

 

====OSD====
there is a debug-login with
user: super pass: 871897
that lets you send Key commands to the Imager to navigate the OSD.

Setting the OSD to english is accomplished with option #11
[[File:Dali D8X3C OSD.png|thumb|OSD in english, if yours is Chinese. go to option #11 and click + or -]]

To acces some locked menus, press
+ - + - + -

The password for the locked System and Main menu is
+-MC+-

Be careful in the UART menu to not change the BAUD rate or Protocol, as your ability to control it via the Web API gets lost.

You need to reflash or solder buttons on the thermal core then.

==Viewing Raw Thermal Data from the Web API==
there is a hidden endpoint in the stream.so file that could be found while decompiling

accessing
[[File:Arduino Nano blink sketch thermal gif.gif|thumb|Arduino Nano running blink sketch while thermally recording it, notice the led and resistor on the right]]
<ip of camera>:5000/stream?Type=JPEG&Source=Jpeg&Mode=TCP
lets you download a JPEG. but there are more options available (not all have been tested)

we are mainly interessted in Raw thermal data.

====Source (Stream Type)====

*<code>Major</code> - Main video stream (channel 0)
*<code>Minor</code> - Sub video stream (channel 1)
*<code>MinorAV</code> - Sub video + audio stream
*<code>MajorAV</code> - Main video + audio stream
*<code>Jpeg</code> - JPEG snapshot stream
*<code>Raw</code> - Raw thermal data stream
*<code>YUV</code> - YUV raw video stream

====Type (Data Format)====

*<code>H264</code> - H.264 video encoding
*<code>JPEG</code> - JPEG image format
*<code>RAW</code> - Raw sensor data
*<code>QBOX</code> - Custom protocol format
*<code>FRAME</code> - Frame-based format

====Mode (Transport Protocol)====

*<code>TCP</code> - TCP streaming (default)
*<code>UDP</code> - UDP streaming
*<code>MUL</code> - Multicast streaming

====Quality Parameters====

*<code>Quality=[1-100]</code> - Video quality level
*<code>Frames=[number]</code> - Number of frames to send
*<code>Interval=[ms]</code> - Frame interval in milliseconds

====Network Parameters====

*<code>IPAddr=[ip]</code> - Client IP address for UDP/multicast
*<code>Port=[port]</code> - Client port for UDP/multicast
*<code>Heart-beat=[Yes/No]</code> - Enable/disable heartbeat

====Snapshot Parameters====

*<code>Snap=[Yes/No]</code> - Enable snapshot mode

 
====Raw Viewer for PC (Python)====
[[File:Dali D8X3N Raw Thermal viewer.png|thumb|Raw Data Viewer in python]]

To view the raw stream, i made a python program that converts the 14bit thermal data to a visible image.

it is low fps tho, due to bad optimizations.

rev1 first working version https://pastebin.com/dyNWDPT3

rev2 with temperature readout https://pastebin.com/u107Q85w

rev3 and onward will only be available directly as a Webpage on the Device (see below).

====Raw Viewer for the internal Webserver (recommended)====
It is also possible to use the Raw viewer directly in the browser.

To achieve this, the stream had to be proxied from port 5000 to 80 due to CORS.

luckily the internal lighttpd had the CGI module enabled, so piping it troug (using wget ... i know) worked with very low overhead.

To install, you need '''Terminal access''' to the Camera. see below.

optional for simplicity: '''ftp''' access

[[File:Dali D8X3N Webviewer.png|thumb|Web Raw Viewer with histogram (rev3)]]

Create the files and the code inside.

'''/app/web/webpages/raw.html''' https://pastebin.com/kaiXwAgD

and

'''/app/web/webpages/cgi-bin/proxy.cgi''' https://pastebin.com/vii1HXcU

then run
chmod +x /app/web/webpages/cgi-bin/proxy.cgi
'''restart''' your camera.

It should be accessible now trough '''http://<camera ip>/raw.html''' in the browser and click Start Stream

'''NOTE''': ''If it does not work'', check the contents of both files. FTP sometimes messes them up.

also run
dos2unix /app/web/webpages/cgi-bin/proxy.cgi
because linux <> windows difficulties that couldnt be resolved in over 30 years.

<blockquote>

performance may need improvement.</blockquote>

==Getting Root Terminal Access==
To access the Terminal you need to solder or plug in a UART connection to Connector J7 on the "Glue" board.

Pinout is (left to right) '''RX TX GND 3.3V Baud 115200 3.3V!'''

But the system will spam with debug messages, making patching the files a hard job unless you use "tftp" or "sed" commands.
 

====Enabling Telnet access to make patching easier====
[[File:Upgrade ici dali firmware updater.png|thumb|ICI Firmware updater software with modified firmware loaded]]

there is a easier way using a modified Firmware updater to enable Telnet temporarily to patch the Files.

Download the '''upgrade_ici.exe''' form [https://archive.org/details/fwupdate here] and run it.

Then you should be able to connect to it via Telnet.

The Login credentials are '''User: roo'''t '''Password: DLroot'''

 

===Patching Device===

===Patching the Web Server===
 

====Enabling Telnet and ftpd permanently====

This only works if you also patch the Thermal Camera module flash!

to permanently enable Telnet, go to '''/etc/init.d''' and edit '''S90app'''
vi S90app
in vi, move your cursor to the '''#''' at '''#telnetd''' and press x<blockquote>optional: enable ftp by removing the '''#''' at '''ftpd''' and adjust the path to / </blockquote>now press ''':''' and type '''wq''' and hit '''enter'''. this should be it.

====Patching the decoder and streamer to 640x480:====
go to /app and edit the mach.cfg

replace DL384 with D640 and edit the resolution to 640 480

(press i in vi to enter edit mode, press ESC to exit edit mode. :wq to write and quit.)

repeat that procedure for the dali.cfg

=====(optional) patching app.sh to prevent it from rebooting=====
edit the app.sh in /app and remove all "reboot" occasions to prevent the camera from rebooting if onvifserver, httpd or daliServer arent running for debugging purposes.

 

====Patching the Thermal Camera module====
To patch it, you need to disassemble everything down to the FPGA Board,

on the bottom there is a SPI SOIC8 Flash.

Use a CH341 EEPROM programmer (be sure to have a fixed or modified version to not put out 5V!, set it to 3.3V) and SOIC8 clamp.

Use NeoProgrammer (i used 2.2.0.10 but there are newer available, use the latest) and click Detect. It should find W25Q128 chips, select the FV one.

Dont forget to download a backup of your flash and save it !

Download the Binary "Dali 640x480 '''actual''' cleared pixelmap.bin" from #3 below and load it into NeoProgrammer,

Click Erase, Program and Verify.

This can take a while.

Your imager should start up right after assembly by hearing the shutter click.

==Hardware Hacking==

===Flash Contents===
On archive, click on show all files to download them.

<nowiki>#</nowiki>1 a Flash dump of the original downgraded D8X3N can be found [https://archive.org/details/dali-d-843n-flash-dump here]

<nowiki>#</nowiki>2 a Flash dump of a original 640x480 model can be found [https://archive.org/details/d-843-n-640x-480 here]

<nowiki>#</nowiki>3 a modified Flash dump of a 640x480 with cleared dead pixel map, flat map etc. can be found [https://archive.org/details/d-843-n-640x-480-cleared-pixelmap here]

a Flash dump of the web server SPI flash W25Q256JV can be found [https://archive.org/details/dm-60-webserver-flash-dump here] in case a bad firmware update caused a bootloop.

 

===Flash Binary Analysis===
The Flash IC is a Winbond 25Q128JV SPI Flash that contains the FPGA Bitstream, Deadpixel and Flatmap, aswell as the Device Settings.

a copy of the SPI Logic Capture at startup can be found [https://archive.org/details/dali-eeprom-capture here], the free software [https://www.dreamsourcelab.com/download/ DSView from DreamSourceLab] is required to view it.
[[File:Dali Thermal Imager SPI Flash capture.png|thumb|SPI Flash access while booting the Thermal Module]]

a approximation of the offsets resulted in this list:<syntaxhighlight lang="vb">
0x000000 - altera cyclone iv stuff
0x200000 - settings
0x280000 - Flat field correction map
0x4C0000 - Bad Pixel correctio nmap
0x580000 - image aswell? 36010 bytes
0x740000 - GUIX?
0x7C0000 - Strings for Gui?
0x800000 - another shorter GUIX
0x880000 - Strings for second gui?
0x8C0000 - GUIX
0x940000 - Strings for gui
0xE00000 - ?
0xE80000 - dzxg? short
0xEC0000 - crosshair.bmp
0xF40000 - 3DTM?
0xF80000 - fake? Bad pixel map BPRP
</syntaxhighlight> 

====Settings offset 0x200000====
The settings are read and written every startup, aswell when you close the OSD, sporadically and when executing the command MSV

these are some of the settings i could figure out by changing and watching the logic capture what changed.
 <syntaxhighlight lang="vb">
offset size Cmd
0x0 1 SAG (0-2) auto gain
0x2 2 SVB (0-16383) saved value is 16383 - SVB
0x4 2 SVC (0-1023) set exposure or gain
0x6 1 SSM image filtering
0x8 1 SEH image enhancement
0xA 1 SWP invert b/w polarity
0x14 1 SMR Flip
0x16 1 SMR Mirror
0x20 1 MENU Cal source 0 IN, 1 OUT
0x3A 1 MENU Enhance value 0-100
0x40 1 MENU Rectify (shutter 0 OFF, 1 L, 2 H)
0x50 1 MENU Language 0 english, 1 chinese, 2 russian
0xA2 - SCO set contrast gain
0xA4 - IBR set brightness
0xAE 2 MENU Fire Threshold
0xAC 1 SPA set color palette
0xE2 1 SMS display "collected 0/80" enabled
0xF8 1 SEM set emissivity
0x110 1 SRT set revise temp
0x116 1 SHD set humidity
0x118 1 SET set ambient temp
0x11A 1 STD set temp range
0x120 2 SLG -500 to 500?
0x124 2 SRD set distance
0x12C 1 SCP ???
0x130 2 SCT ???
</syntaxhighlight> 
[[File:Dali D8X3N Bad Pixel Map Viewer.png|thumb|Bad pixel map of a 640x512 sensor, about 0.56% of dead pixels in this map]]
So i let the AI create a [https://2476424.playcode.io/ Configurator page] that lets you change the Settings in your Flashdump to your liking
 

====Bad Pixel and Flatframe Maps 0x280000 and 0x4C0000====
Thermal cameras require a bad pixel and flat frame map to compensate for manufacturing inconsistencies.

unfourtainly, the maps of the downgraded cameras only contain enough data for a 384 model, not the full 640.

at offset 0xF80000 there is a BPRP which was mistaken at first as the Bad pixel map, it could just be a mask to where to apply the offset maps, as its either 0x0 or 0x1.

The [https://2477569.playcode.io/ Viewer Page] is written in JS and does not require any special dependencies, it can run as a plain html file offline.

''See "Automatic Dead Pixels and Flatmap Correction" below how to create new dead pixel and flatmaps using the system menu.''

[[File:Dali D8X3N Flat Field Map Viewer.png|thumb|Flat Field viewer]]

==Dali Commands==
To control the TIM you can either use Pelco or Dali command set. By default the Dali commandset is used at 38400 BAUD.

Those commands consist of a 0x02 start byte followed by two length Bytes, then the actual command which is allways 3 uppercase Letters in ASCII (eg. KBD for keyboard) followed by a comma and the values.

Some commands take multiple values, some dont. But you allways have to send the comma after the Command.

The camera will answer with the Command and 0, 1 or 2. Sending no value counts as zero.
0 is invalid parameters, too few or out of range

1 is OK, valid command

2 is Invalid command

Commands can be sent trough the Web server using the URL Api endpoint or directly trough the UART port.

(keyboard, C button, causes the shutter to do a calibration)
<camera ip>/cgi-bin/dmcmd?Command=KBD,C
Listening to the answer can be done while being in the Linux shell and typing
cat /dev/ttyAMA2 | strings

By bruteforcing the UART with AAA to ZZZ a list of Commands could be obtained, but some with unknown Parameters or functionality yet. including some from a decompiled DM60comm.so module found in /app/modules folder.<syntaxhighlight lang="vb">
KBD KEY Keyboard (F S M C + -)
SSM 0-1 Image Filtering Off/On
GSM 0 Image filter status
SEH 0-1 Image Enhancement Off/On
GEH 0-1 Image enhancer status
SCO 0-255 Set Gain (locked when SAG auto gain is on)
GCO 0-255 Get gain
INT 15-320 set actual gain? not just contrast sometimes disabled?
IBR 0-255 Set brightness
GBR 0-255 Get brightness
SMR 0-3 Mirror mode bit0=horizontal, bit1=vertical
GMR 0 Get rotation/flip
SDT 0-1 displays temp=44.65°C osd, but webserver sends date/time to the cam there....
GDT 0-1 Get temp display active?
GPT Display temp oft SDT
GNU 0-1 Get Shutter closed/open
SNU 0-1 Shutter close / open
STD 0-1 Set Range 0: -20-180°C 1: 100-600°C
GTD 0-1 Get Range
SET °C Set Ambient temperature
GET °C Get Ambient temperature
SEM 0-100 0-1 set emissivity x100
GEM 0-100 Get Emissivity
SRT °C Set revise temperature -100-100 -10-10°
GRT °C Get revise temperature
SRD 100 Set Distance 4.4m x100
GRD 100 Get Distance
SHD 0-100 Set Humidity
GHD 55 Get Humidity
SWP 0-1 invert s/w polarity image
GWP 1 is inverted?
SPA 0-10? Set color palette
GPA 3 white hot
SMV 0-1 Show temperature 3x3 grid?? in combination with GTV maybe
GMV 0
SMS 0-1 displays "collected 0/<number set by SCT>" by SCP delay "saves the daily number of highest temperatures?"
GMS 0
SCT 1-500 sets the amount of "collected" points for SMS
GCT 80
SCP 5-60 "collected" delay in seconds for SMS
GCP 60
SAG 0-2 Auto brightness / gain
GAG 0
SLR 0-9 ???
GLR 0
SRP 0,0 - 639,479 set crosshair position
GRP 320,240 get crosshair position
DRC 0-1 Show crosshair
SLG -500-500 ??
GLG
SCE text ??
GCE 0
SCB text ??
GCB 0
SVB 0-16383 adc offset, exposure? good at 9650
GVB 6733 value is 16383 minus SVB
SVC 1-1023 set contrast but better
GVC 260
SVF 100-? ?? video freaks out 3400 seems good
SVS 100-? ?? video freaks out 3300 seems good
SOT 0-1 ?? sensor supply, looks weird when off.
SZM 1-4 ?
GZM 1
MSV save settings too eeprom
ASV Saves something aswell?
GCS 0 Get Core status & faults
ALD 0,2? video blanks lots of eeprom activity. reload pixel map??
SAV 0-9999 set Fire threshold
GAV 2100 get Fire Threshold
BAC change uart protocol? careful
CBD Displays Recovery successful?
CBS Displays Saved successfully
LRD Displays Recovery successful?
LRS Displays Saved successfully?
LRE Displays Temperature Repair successful?
CBT Displays Calibration successful?
DBP ??? shutter clicks
DPI Show weird pixels
API Hide weird pixels
CCM ??
ASN 0-4 ??
GAB 4 vals ?? 3,-10,50,150
GAN 1 ??
GAR 11 vals ?? 10,10,5,20,35,50,70,90,120,150,180,,
GCM 6 values ??
GFV prints screen gray value?
GIT 200 ??
GTV Get the collected temp values?
PTS echoes but with extra stuff??
QYA 7170 Query Gray Info (information mode)
QYI 7124 Query Gray Average mode
QYM 7512 Query Gray Minimum mode
VTP 400-4000 ??
MTD U/S,0,0 ?? S answers with bytes, U upload bytes?
MTC U/S? ?? S answers with U,0,0, S doesnt.

return 0 invalid params:
STS ??
STT ??
SAC ??
SAH ??
SAS ??
SAT ??
SCX ?? displays crosshair but invalid params
SCY ?? displays crosshair but invalid params
GAC ??
GAH ??
GAS ??
GAT ??
GME ??
GPC ??
GPI ??
GPM ??
GTA ??
GTC ??
GTI ??
GTM ??
GTS ??
GTT ??

answer only:

BPM 0-1 stream ready? answers with 0 stop, 1 go, 2 when prompted
AVS 0,1
MEH
PWI 0-1 changing palette from wh to fire

unconfirmed (from dm60comm.so):
SDT 2024,03,15,14,30,25 Set Date Time with year,month,day,hour,minute,second
STS 1 Set Temperature Show display (0=off, 1=on)
SVA 2 Set Video Auto mode (0=manual, 2=auto)
SMP 0,1,1,0,100,150,200,250,300,350,90,25 Set Measurement Point (type,index,enable,mode,startX,startY,endX,endY,anchorX,anchorY,threshold,color)
STV Stop Temperature View measurements
SPF 5 Set Profile parameter
SVL -10 Set Video Left pan movement (signed value)
SVU -5 Set Video Up tilt movement (signed value)
SVD 5 Set Video Down tilt movement (signed value)
SSP 17,1,0 Set System Parameter (param_id,value,index) #46 temperature format 0 °C, 1 °F, 2 K
SCP Set Current Preset (save current position)
GCP Get Current Preset
STT 300,350 Set Temperature Threshold (low,high values *10)
SDC 1 Set Display Configuration parameter
GCS Get Current Status
GMM Get Memory Map information
GFV Get Frame Value (grayscale data)
GFZ Get Freeze Status
GSI 1 Get System Information (parameter=1)
GSS Get System Status
GSP 21,0 Get System Parameter (param_21=surround temp, value=0)
GTT Get Temperature Threshold range
GTV 1,3,10 Get Temperature Values (enable,type,count)
GNU Get Network Update status (response command)
FRZ Freeze current display frame
LIV Live mode (unfreeze display)
CAL Calibrate system
CCP 3 Call Current Preset (preset number 0-9)
APF 100 Auto Profile setting
MEH Measure Enhancement
BPT Built-in Test
MTC S,0 Measure Temperature Capture (S=start, 0=sequence)
MTG U,0,1024,<data> Measure Temperature Gray data transfer
MTD U,0,1024,<data> Measure Temperature Data transfer
UFP S,0,2048 Update Firmware Prepare (S=start, 0=offset, 2048=size)
UFD S,0,1024 Update Firmware Data transfer
BAB U Buffer operation (U=update)
TTH S,0 Temperature Threshold operation
IPP 192.168.001.102,255.255.255.000,192.168.001.001,192.168.000.001,9989,9998 IP Parameters (IP,netmask,gateway,DNS,port1,port2)
MAC 00:60:A9:10:00:01 MAC Address setting
SNP Set Network Parameters (response command)
QYI Query Gray Info (information mode)
QYA Query Gray Average mode
QYM Query Gray Minimum mode
GAI Get Alarm Info (response command)
YTC <data> Unknown command with data parameter
HTH
LRS
LRD
GAR
DRC
PTS
SCX
SCY
CBT
LRE
CBD
CBS
XXX
GSP
GTT
QYI
QYA
QYM

</syntaxhighlight>

==Secret Menu Overview==
The secret menus Main and System can be openend with the password '''+-MC+-'''

Its structured like this, not all variables have been figured out yet.

The format is Menu: submenu: submenu:

and for menu entries: Name, default value, command, description or messages that pop up.
 <syntaxhighlight lang="vb">
MAIN & SYSTEM PASS: +-MC+-

entries are NAME VALUE COMMAND DESC or if its a folder its just ":"

System:
System:
Gain 255 SCO
Bright 102 IBR
BenDi 100 ?
BenDiContrase 80 ?
DisMode 0 ?
Frequency 48hz (24,25,48,50)
DigitalOut 8-14bit 14bit, BT656(_P), ?, BT601
AutoFocus N ?
Line 1 ?
Ltemp0 11800 ?
LTemp1 11000 ?
HTemp0 9500 ?
HTemp1 8700 ?
DelayTime 0 ?
Enhance 0-1 ?
Enhanced E1 230 ?
FPA_Gain 12pF ? between 4 and 18 at random.
NUCEn N ?

Area:
SE 2 ASN 0-4 "Partition"
INT 200 INT "Points time"
VS 3161 SVS
VF 2800 SVF
Vtemp 1401 VTP
VtempArea Low ?
VtempBase 13500 ?
VtempStep -1 ?
VsStep 8 ?
DeadPixelModel preset / calculate
DP: Cursor to select dead pixels
X 360 position
Y 288 position
AutoBP: 50 Press C to start automatic dotting
Quit? Number of bad pixels 961& "Blind element replacement in progress"
Undo
R2: Save data? blind pixel replacement in progress
Replace Y N = DPI, Y = API
L: Reading parameters
S: Saving parameters

Debug:
Rectify N
DisplayGary N
TE N SDT
AutoE ? ?
AutoVS Y ?
VSGrayH 8000 ?
VSGrayL 7000 ?
Trends 1 ?
Shelter N ?
MotorCon 3 ?
SaveFactoryPara:
LanTyp EN ? LANGUAGE
DisplayMT N ?
Version:
PRJ D843 DLD640 ImLib, MTlib, Soft, Logic

BackDispose:
GammaEN 1 ?
Gain 1 ?
EnhanceEN 0 ?
Hpf_shift 5 ?
Hpf_thrd 5 ?
Enhance 150 ?
Lthrd 50 ?

Monitor:
Opens normal OSD

Alarm Set:
Alarm Switch Y ?
Alarm Mode No ?
Alarm Temperature -1°C ?
Reference Gray Y ?
Alarm Level 1L ?
Alarm Gray 65535 ?
Alarm PointNum 0 ?
Correct Gray 0 ?

Thermometry:
Data Collection 0 SMS
Interval 60 SCP
Ammount 90 SCT
Environment normal ?
Export:
Displays: Exportin normal temperature MTC data
Correction -1 ?
Emissivity 100 SEM
Calibration:
BlackbodyTemp -10 grabs a val from GAB
Save CBS
Cancel CBD
Correction:
BlackbodyTemp -10 Picks from the list GAR
Grayscale 0 SLG
Confirm LRE
Save LRS
Cancel LRD
Ninepoint measurement SMV

Cursor:
Cur N DRC enable cursor
X 320 SRP set cursor position
Y 240 SRP set cursor position

Main:
Auto 2 SAG Auto gain
G 211 SVC
B 10002 SVB
P 1 SWP polarity
Z X ?
Settings:
Image:
FI Y ?
FIValue 0 ? 0-31
Freeze N Freeze image
VE N SMR Vertical flip
HO N SMR Horizontal flip
AutoCali L same as rectify?
O IN internal or external
COM:
Opens UART menu
AvoidburnSwitch OFF enable anti burn in
ProtectedTime 10S duration
AvoidBurn 16383 threshold to trigger antiburn

</syntaxhighlight>

===Automatic Dead Pixels and Flatmap Correction===

It it possible to generate a new flat and dead pixel map automatically within the camera after flashing the cleared-map binary.
 

=====Dead pixels:=====
In the secret menu "System", navigate to Area - DeadPixelModel and set the AutoBP (sensitivity for auto bad pixel finding) to 50 or so. Then press C Button

This can take a while.
[[File:High emissivity peltier black body.jpg|thumb|A Peltier / TEC coated in Candle sood to give it a high emissivity surface. It can be cooled or heated by swapping the polarity. ]]

Afterwards, navigate to S: and press + to save it.
 

=====Flatfield:=====
In the Debug menu navigate to R2 and press +

now place something '''Cold''' infront of the Camera with a high emissivity. (it needs to fill the whole image)

Press '''+''', wait for it to says High temperature.

Place something '''Hot''' infront and press '''+''' again.

Afterwards, save with '''S:''' again.

Flatfield should now be calibrated
 <blockquote>Note: Not all dead pixels are auto detected or get removed. you can manually select them in the Dead pixel editor but its not known yet how to select and correct them.</blockquote>

 

==Using the Thermal module without Webserver==
[[File:Breakoutboard d8x3c dali v1.1.png|alt=|thumb|Breakout board for D8X3C]]
to use it, you need to interface it directly.

The module will put out a Analog video signal (High-Z, need to buffer when connecting it to 75Ohm Video input)

Also a 8 or 14bit or 8-bit BT656 output.

the header exposes the FPGA JTAG and UART aswell as 6 Hardware Keys to Navigate the OSD.

To interface, you need to have a adapter board with a DF12-50DS-0.5V(86) Docking socket.

A open source project can be found here, it includes pin access to:

* FPGA JTAG
* UART 3.3V with pin compatible FT232 socket
* Power 5V over USB-C
* 5 Button inputs
* Buffered video output and socket for USB Videograbber
* Digital 14 bit video out header with hsync vsync and clk.
*

the pcb layout has been tested and seems to work.

https://oshwlab.com/gamerpaddy/d8x3c-backpack-usb

== Sending Serial Commands directly over UART ==

Sending Serial commands directly over UART to the core requires some additional bytes.

The packet structure is as follows (Strip spaces, commands are allways uppercase and 3 chars)
<STX> <LENGTH1> <LENGTH2> Command, Value, Checksum <ETX>

Pseudocode to craft a command packet may look like this<syntaxhighlight lang="c">
//cmd is allways 3 byte uppercase chars
//values can be multiple comma seperated like 320,240
function make_packet(cmd, values):
payload = cmd + "," + join(values, ",") + ","
bytes = ascii(payload)
length = len(bytes)
checksum = sum(bytes) mod 256
return [0x02, length&0xFF, length>>8] + bytes + [checksum, 0x03]
</syntaxhighlight>

 

==Sensor Pinout==
[[File:Dali DLD384 Sensor pinout basic.png|thumb|basic pinout of a DLD384]]
the pinout of the thermal sensor havent been analyzes much.

besides some supply and Control voltages, 3 clocks and a analog output have been found.

17.5MHz

14.705KHz

50Hz

Dali D8X3N Thermal Camera

2025-08-29T13:03:50Z

Gamerpaddy: /* Using the Thermal module without Webserver */

=Dali D8X3N Thermal Camera Reverse Engineering=
 

===Introduction===
The [https://www.dali-irtech.com/productinfo/741567.html Dali D8X3N] Thermal Camera module comes in two versions, a 384x288 and 640x480 resolution, utilizing the [http://www.dali-tech.us/products/dld64017m-uncooled-infrared-fpa-detector-86.html DLD Series] of amorphous-Silicon Microbolometers.

They were mainly used in [http://www.dali-tech.us/products/dm60-w--online-body-temperature-thermal-imaging-camera-55.html Dali DM60-W] or WS-1 Body Temperature screening cameras in conjunction with a Black Body radiator set to 37°C to detect infected individuals at the start of the 2020 Covid Pandemic.
[[File:ICI FM320P Innerts.jpg|thumb|Internals. A TP-Link Switch, HikVision Visible Camera and the D8x3N Network thermal camera module]]
[https://infraredcameras.com/ ICI] rebranded these models as FM 320 P and FM 640 P, and distributed them on the local US market, but as the need for such Cameras exploded, those models were built with what was in stock.

So happens, that some of the FM 320 P Models had a DLD640 640x480 instead of a DLD384 384x288 Microbolometer in them, and just got their Firmware modified.

It also could be, because they have excessive amounts of bad pixels outside the 384x288 area, that they were binned to a lower grade.

Discussions about these Cameras started around 2022 in the [https://www.eevblog.com/forum/thermal-imaging/ici-and-dali-thermal-camera-software/ EEVBlog Forums.] when they started to appear secondhand and affordable.

Originally they were priced around US$ 20... 30.000 by ICI, and a unknown amount by Dali Tech.

The Modules specs according to the manufacturer are:

≤50..60mK@F1，300K，50Hz

17 or 25µm pixel pitch

Hisilicon SoC running Linux to provide Onvif and RTSP streams, analysis and a Web UI

 
[[File:Dali D8X3N Module.jpg|thumb|A real 384x288 model with a DLD384 sensor. notice the Productnumber ]]
ICI FM Cameras are found all over Online secondhand marketplaces for scrap Prices, as they are no longer needed.

But you never know, what are you getting. It could be a real DLD384 or the better DLD640 inside. Its a gamble.
 

======640x480 Imagers======
are labeled 22D843 Nxxxx and have a DLD640 sensor in it, they can be upgraded if they run the 384x288 firmware.

======384x288 Imagers======
are labeled 22D883Nxxxx and have a DLD384 sensor in it, they cannot be upgraded

 

==D8X3N Module closer look==
From now on, i will refer to the Thermal Imaging Module as TIM

On the front there is a 2 Element Germanium Lens of a unknown focal length and aperture.

It can be focus-adjusted when unscrewing the clamp around the housing. It can be focussed from infinity down to 10..20cm with some quality loss.
 The outter diameter of the Lens is 42mm with a 1 1/3 inch thread diameter of undetermined pitch.

Dimensions of the germanium elements are 21mm to 3 and 6mm and 14grams in weight.
[[File:Disassembled Thermal Camera Lens.jpg|thumb|Two element Germanium Lens of unknown focal length and aperture]]

The TIM is composed of 6 Stacked PCB modules, 3 of which are for the Web Server functionality. taking them off will give you the basic configuration of a [https://www.dalithermal.com/productinfo/741568.html Dali D8X3C] TIM<gallery>
File:Dali DLD640 Thermal Image Sensor.jpeg|DLD640 Sensor
File:Dali DLD384 Thermal Imaging Sensor.jpeg|DLD384 Sensor
File:Dali D8X3N Board1 Back.jpeg|Network & GPIO Board Back
File:Dali D8X3N Board1 Front.jpeg|Network & GPIO Board Front
File:Dali D8X3N Glue Board Back.jpeg|Board between Logic and IO Back
File:Dali D8X3N Glue Board Front.jpeg|Board between Logic and IO Front
File:Dali D8X3N SoC Board Back.jpeg|SoC Board back
File:Dali D8X3N SoC Board front.jpeg|SoC board front
File:Dali D8X3N FPGA Board Back.jpeg|FPGA Board of the D8X3C Thermal Imager including a PMIC
File:Dali D8X3N FPGA Board Front.jpeg|FPGA Board Front with Video DAC and SPI Flash
File:Dali D8X3N Sensor Power and ADC Board.jpeg|Sensor control and ADC board
File:Dali D8X3N Thermal Core Debug wiring.jpeg|Debug wiring for sniffing SPI and UART
</gallery>

===User Manual===
including pinout diagram and important data

can be found here https://archive.org/details/dali-d-8-x-3-cuser-manualen-v-1.0-1

==Viewing the Video Stream==
[[File:Onvif Device Manager ODM.png|thumb|ODM streaming the Thermal view]]
when first connecting it to power and Ethernet, the camera will have 192.168.1.102 as a Static ip.

If you are running a 192.168.0.x or .178.x net, you need to change it or add a subnet under windows ipv4 settings.

to view it, you can use VLC and the stream URL
rtsp://admin@admin:<camera ip>/ONVIFMedia
there is /ONVIFMedia /ONVIFMediaM and /ONVIFMediaS for different stream Profiles.

VLC is quite slow and delayed, rather use Onvif Device Manager ODM,

it has no delay and auto-detects cameras in the network.

Be sure to log in as user: admin pass: admin in ODM.

in there, you can also set you camera to DHCP under Network settings.

===Web Interface===
[[File:Dali D8X3N web interface.png|thumb|Since browsers cant display RTSP anymore, open in Edge and select IE Compatibility Mode.]]
the web interface can be accessed by opening the camera IP in a browser

login is:
user: admin pass: admin
You can set Temperature markers and areas, but without using the Black Body calibration source, your readings may be way off or not working.

 

====OSD====
there is a debug-login with
user: super pass: 871897
that lets you send Key commands to the Imager to navigate the OSD.

Setting the OSD to english is accomplished with option #11
[[File:Dali D8X3C OSD.png|thumb|OSD in english, if yours is Chinese. go to option #11 and click + or -]]

To acces some locked menus, press
+ - + - + -

The password for the locked System and Main menu is
+-MC+-

Be careful in the UART menu to not change the BAUD rate or Protocol, as your ability to control it via the Web API gets lost.

You need to reflash or solder buttons on the thermal core then.

==Viewing Raw Thermal Data from the Web API==
there is a hidden endpoint in the stream.so file that could be found while decompiling

accessing
[[File:Arduino Nano blink sketch thermal gif.gif|thumb|Arduino Nano running blink sketch while thermally recording it, notice the led and resistor on the right]]
<ip of camera>:5000/stream?Type=JPEG&Source=Jpeg&Mode=TCP
lets you download a JPEG. but there are more options available (not all have been tested)

we are mainly interessted in Raw thermal data.

====Source (Stream Type)====

*<code>Major</code> - Main video stream (channel 0)
*<code>Minor</code> - Sub video stream (channel 1)
*<code>MinorAV</code> - Sub video + audio stream
*<code>MajorAV</code> - Main video + audio stream
*<code>Jpeg</code> - JPEG snapshot stream
*<code>Raw</code> - Raw thermal data stream
*<code>YUV</code> - YUV raw video stream

====Type (Data Format)====

*<code>H264</code> - H.264 video encoding
*<code>JPEG</code> - JPEG image format
*<code>RAW</code> - Raw sensor data
*<code>QBOX</code> - Custom protocol format
*<code>FRAME</code> - Frame-based format

====Mode (Transport Protocol)====

*<code>TCP</code> - TCP streaming (default)
*<code>UDP</code> - UDP streaming
*<code>MUL</code> - Multicast streaming

====Quality Parameters====

*<code>Quality=[1-100]</code> - Video quality level
*<code>Frames=[number]</code> - Number of frames to send
*<code>Interval=[ms]</code> - Frame interval in milliseconds

====Network Parameters====

*<code>IPAddr=[ip]</code> - Client IP address for UDP/multicast
*<code>Port=[port]</code> - Client port for UDP/multicast
*<code>Heart-beat=[Yes/No]</code> - Enable/disable heartbeat

====Snapshot Parameters====

*<code>Snap=[Yes/No]</code> - Enable snapshot mode

 
====Raw Viewer for PC (Python)====
[[File:Dali D8X3N Raw Thermal viewer.png|thumb|Raw Data Viewer in python]]

To view the raw stream, i made a python program that converts the 14bit thermal data to a visible image.

it is low fps tho, due to bad optimizations.

rev1 first working version https://pastebin.com/dyNWDPT3

rev2 with temperature readout https://pastebin.com/u107Q85w

rev3 and onward will only be available directly as a Webpage on the Device (see below).

====Raw Viewer for the internal Webserver (recommended)====
It is also possible to use the Raw viewer directly in the browser.

To achieve this, the stream had to be proxied from port 5000 to 80 due to CORS.

luckily the internal lighttpd had the CGI module enabled, so piping it troug (using wget ... i know) worked with very low overhead.

To install, you need '''Terminal access''' to the Camera. see below.

optional for simplicity: '''ftp''' access

[[File:Dali D8X3N Webviewer.png|thumb|Web Raw Viewer with histogram (rev3)]]

Create the files and the code inside.

'''/app/web/webpages/raw.html''' https://pastebin.com/kaiXwAgD

and

'''/app/web/webpages/cgi-bin/proxy.cgi''' https://pastebin.com/vii1HXcU

then run
chmod +x /app/web/webpages/cgi-bin/proxy.cgi
'''restart''' your camera.

It should be accessible now trough '''http://<camera ip>/raw.html''' in the browser and click Start Stream

'''NOTE''': ''If it does not work'', check the contents of both files. FTP sometimes messes them up.

also run
dos2unix /app/web/webpages/cgi-bin/proxy.cgi
because linux <> windows difficulties that couldnt be resolved in over 30 years.

<blockquote>

performance may need improvement.</blockquote>

==Getting Root Terminal Access==
To access the Terminal you need to solder or plug in a UART connection to Connector J7 on the "Glue" board.

Pinout is (left to right) '''RX TX GND 3.3V Baud 115200 3.3V!'''

But the system will spam with debug messages, making patching the files a hard job unless you use "tftp" or "sed" commands.
 

====Enabling Telnet access to make patching easier====
[[File:Upgrade ici dali firmware updater.png|thumb|ICI Firmware updater software with modified firmware loaded]]

there is a easier way using a modified Firmware updater to enable Telnet temporarily to patch the Files.

Download the '''upgrade_ici.exe''' form [https://archive.org/details/fwupdate here] and run it.

Then you should be able to connect to it via Telnet.

The Login credentials are '''User: roo'''t '''Password: DLroot'''

 

===Patching Device===

===Patching the Web Server===
 

====Enabling Telnet and ftpd permanently====

This only works if you also patch the Thermal Camera module flash!

to permanently enable Telnet, go to '''/etc/init.d''' and edit '''S90app'''
vi S90app
in vi, move your cursor to the '''#''' at '''#telnetd''' and press x<blockquote>optional: enable ftp by removing the '''#''' at '''ftpd''' and adjust the path to / </blockquote>now press ''':''' and type '''wq''' and hit '''enter'''. this should be it.

====Patching the decoder and streamer to 640x480:====
go to /app and edit the mach.cfg

replace DL384 with D640 and edit the resolution to 640 480

(press i in vi to enter edit mode, press ESC to exit edit mode. :wq to write and quit.)

repeat that procedure for the dali.cfg

=====(optional) patching app.sh to prevent it from rebooting=====
edit the app.sh in /app and remove all "reboot" occasions to prevent the camera from rebooting if onvifserver, httpd or daliServer arent running for debugging purposes.

 

====Patching the Thermal Camera module====
To patch it, you need to disassemble everything down to the FPGA Board,

on the bottom there is a SPI SOIC8 Flash.

Use a CH341 EEPROM programmer (be sure to have a fixed or modified version to not put out 5V!, set it to 3.3V) and SOIC8 clamp.

Use NeoProgrammer (i used 2.2.0.10 but there are newer available, use the latest) and click Detect. It should find W25Q128 chips, select the FV one.

Dont forget to download a backup of your flash and save it !

Download the Binary "Dali 640x480 '''actual''' cleared pixelmap.bin" from #3 below and load it into NeoProgrammer,

Click Erase, Program and Verify.

This can take a while.

Your imager should start up right after assembly by hearing the shutter click.

==Hardware Hacking==

===Flash Contents===
On archive, click on show all files to download them.

<nowiki>#</nowiki>1 a Flash dump of the original downgraded D8X3N can be found [https://archive.org/details/dali-d-843n-flash-dump here]

<nowiki>#</nowiki>2 a Flash dump of a original 640x480 model can be found [https://archive.org/details/d-843-n-640x-480 here]

<nowiki>#</nowiki>3 a modified Flash dump of a 640x480 with cleared dead pixel map, flat map etc. can be found [https://archive.org/details/d-843-n-640x-480-cleared-pixelmap here]

a Flash dump of the web server SPI flash W25Q256JV can be found [https://archive.org/details/dm-60-webserver-flash-dump here] in case a bad firmware update caused a bootloop.

 

===Flash Binary Analysis===
The Flash IC is a Winbond 25Q128JV SPI Flash that contains the FPGA Bitstream, Deadpixel and Flatmap, aswell as the Device Settings.

a copy of the SPI Logic Capture at startup can be found [https://archive.org/details/dali-eeprom-capture here], the free software [https://www.dreamsourcelab.com/download/ DSView from DreamSourceLab] is required to view it.
[[File:Dali Thermal Imager SPI Flash capture.png|thumb|SPI Flash access while booting the Thermal Module]]

a approximation of the offsets resulted in this list:<syntaxhighlight lang="vb">
0x000000 - altera cyclone iv stuff
0x200000 - settings
0x280000 - Flat field correction map
0x4C0000 - Bad Pixel correctio nmap
0x580000 - image aswell? 36010 bytes
0x740000 - GUIX?
0x7C0000 - Strings for Gui?
0x800000 - another shorter GUIX
0x880000 - Strings for second gui?
0x8C0000 - GUIX
0x940000 - Strings for gui
0xE00000 - ?
0xE80000 - dzxg? short
0xEC0000 - crosshair.bmp
0xF40000 - 3DTM?
0xF80000 - fake? Bad pixel map BPRP
</syntaxhighlight> 

====Settings offset 0x200000====
The settings are read and written every startup, aswell when you close the OSD, sporadically and when executing the command MSV

these are some of the settings i could figure out by changing and watching the logic capture what changed.
 <syntaxhighlight lang="vb">
offset size Cmd
0x0 1 SAG (0-2) auto gain
0x2 2 SVB (0-16383) saved value is 16383 - SVB
0x4 2 SVC (0-1023) set exposure or gain
0x6 1 SSM image filtering
0x8 1 SEH image enhancement
0xA 1 SWP invert b/w polarity
0x14 1 SMR Flip
0x16 1 SMR Mirror
0x20 1 MENU Cal source 0 IN, 1 OUT
0x3A 1 MENU Enhance value 0-100
0x40 1 MENU Rectify (shutter 0 OFF, 1 L, 2 H)
0x50 1 MENU Language 0 english, 1 chinese, 2 russian
0xA2 - SCO set contrast gain
0xA4 - IBR set brightness
0xAE 2 MENU Fire Threshold
0xAC 1 SPA set color palette
0xE2 1 SMS display "collected 0/80" enabled
0xF8 1 SEM set emissivity
0x110 1 SRT set revise temp
0x116 1 SHD set humidity
0x118 1 SET set ambient temp
0x11A 1 STD set temp range
0x120 2 SLG -500 to 500?
0x124 2 SRD set distance
0x12C 1 SCP ???
0x130 2 SCT ???
</syntaxhighlight> 
[[File:Dali D8X3N Bad Pixel Map Viewer.png|thumb|Bad pixel map of a 640x512 sensor, about 0.56% of dead pixels in this map]]
So i let the AI create a [https://2476424.playcode.io/ Configurator page] that lets you change the Settings in your Flashdump to your liking
 

====Bad Pixel and Flatframe Maps 0x280000 and 0x4C0000====
Thermal cameras require a bad pixel and flat frame map to compensate for manufacturing inconsistencies.

unfourtainly, the maps of the downgraded cameras only contain enough data for a 384 model, not the full 640.

at offset 0xF80000 there is a BPRP which was mistaken at first as the Bad pixel map, it could just be a mask to where to apply the offset maps, as its either 0x0 or 0x1.

The [https://2477569.playcode.io/ Viewer Page] is written in JS and does not require any special dependencies, it can run as a plain html file offline.

''See "Automatic Dead Pixels and Flatmap Correction" below how to create new dead pixel and flatmaps using the system menu.''

[[File:Dali D8X3N Flat Field Map Viewer.png|thumb|Flat Field viewer]]

==Dali Commands==
To control the TIM you can either use Pelco or Dali command set. By default the Dali commandset is used at 38400 BAUD.

Those commands consist of a 0x02 start byte followed by two length Bytes, then the actual command which is allways 3 uppercase Letters in ASCII (eg. KBD for keyboard) followed by a comma and the values.

Some commands take multiple values, some dont. But you allways have to send the comma after the Command.

The camera will answer with the Command and 0, 1 or 2. Sending no value counts as zero.
0 is invalid parameters, too few or out of range

1 is OK, valid command

2 is Invalid command

Commands can be sent trough the Web server using the URL Api endpoint or directly trough the UART port.

(keyboard, C button, causes the shutter to do a calibration)
<camera ip>/cgi-bin/dmcmd?Command=KBD,C
Listening to the answer can be done while being in the Linux shell and typing
cat /dev/ttyAMA2 | strings

By bruteforcing the UART with AAA to ZZZ a list of Commands could be obtained, but some with unknown Parameters or functionality yet. including some from a decompiled DM60comm.so module found in /app/modules folder.<syntaxhighlight lang="vb">
KBD KEY Keyboard (F S M C + -)
SSM 0-1 Image Filtering Off/On
GSM 0 Image filter status
SEH 0-1 Image Enhancement Off/On
GEH 0-1 Image enhancer status
SCO 0-255 Set Gain (locked when SAG auto gain is on)
GCO 0-255 Get gain
INT 15-320 set actual gain? not just contrast sometimes disabled?
IBR 0-255 Set brightness
GBR 0-255 Get brightness
SMR 0-3 Mirror mode bit0=horizontal, bit1=vertical
GMR 0 Get rotation/flip
SDT 0-1 displays temp=44.65°C osd, but webserver sends date/time to the cam there....
GDT 0-1 Get temp display active?
GPT Display temp oft SDT
GNU 0-1 Get Shutter closed/open
SNU 0-1 Shutter close / open
STD 0-1 Set Range 0: -20-180°C 1: 100-600°C
GTD 0-1 Get Range
SET °C Set Ambient temperature
GET °C Get Ambient temperature
SEM 0-100 0-1 set emissivity x100
GEM 0-100 Get Emissivity
SRT °C Set revise temperature -100-100 -10-10°
GRT °C Get revise temperature
SRD 100 Set Distance 4.4m x100
GRD 100 Get Distance
SHD 0-100 Set Humidity
GHD 55 Get Humidity
SWP 0-1 invert s/w polarity image
GWP 1 is inverted?
SPA 0-10? Set color palette
GPA 3 white hot
SMV 0-1 Show temperature 3x3 grid?? in combination with GTV maybe
GMV 0
SMS 0-1 displays "collected 0/<number set by SCT>" by SCP delay "saves the daily number of highest temperatures?"
GMS 0
SCT 1-500 sets the amount of "collected" points for SMS
GCT 80
SCP 5-60 "collected" delay in seconds for SMS
GCP 60
SAG 0-2 Auto brightness / gain
GAG 0
SLR 0-9 ???
GLR 0
SRP 0,0 - 639,479 set crosshair position
GRP 320,240 get crosshair position
DRC 0-1 Show crosshair
SLG -500-500 ??
GLG
SCE text ??
GCE 0
SCB text ??
GCB 0
SVB 0-16383 adc offset, exposure? good at 9650
GVB 6733 value is 16383 minus SVB
SVC 1-1023 set contrast but better
GVC 260
SVF 100-? ?? video freaks out 3400 seems good
SVS 100-? ?? video freaks out 3300 seems good
SOT 0-1 ?? sensor supply, looks weird when off.
SZM 1-4 ?
GZM 1
MSV save settings too eeprom
ASV Saves something aswell?
GCS 0 Get Core status & faults
ALD 0,2? video blanks lots of eeprom activity. reload pixel map??
SAV 0-9999 set Fire threshold
GAV 2100 get Fire Threshold
BAC change uart protocol? careful
CBD Displays Recovery successful?
CBS Displays Saved successfully
LRD Displays Recovery successful?
LRS Displays Saved successfully?
LRE Displays Temperature Repair successful?
CBT Displays Calibration successful?
DBP ??? shutter clicks
DPI Show weird pixels
API Hide weird pixels
CCM ??
ASN 0-4 ??
GAB 4 vals ?? 3,-10,50,150
GAN 1 ??
GAR 11 vals ?? 10,10,5,20,35,50,70,90,120,150,180,,
GCM 6 values ??
GFV prints screen gray value?
GIT 200 ??
GTV Get the collected temp values?
PTS echoes but with extra stuff??
QYA 7170 Query Gray Info (information mode)
QYI 7124 Query Gray Average mode
QYM 7512 Query Gray Minimum mode
VTP 400-4000 ??
MTD U/S,0,0 ?? S answers with bytes, U upload bytes?
MTC U/S? ?? S answers with U,0,0, S doesnt.

return 0 invalid params:
STS ??
STT ??
SAC ??
SAH ??
SAS ??
SAT ??
SCX ?? displays crosshair but invalid params
SCY ?? displays crosshair but invalid params
GAC ??
GAH ??
GAS ??
GAT ??
GME ??
GPC ??
GPI ??
GPM ??
GTA ??
GTC ??
GTI ??
GTM ??
GTS ??
GTT ??

answer only:

BPM 0-1 stream ready? answers with 0 stop, 1 go, 2 when prompted
AVS 0,1
MEH
PWI 0-1 changing palette from wh to fire

unconfirmed (from dm60comm.so):
SDT 2024,03,15,14,30,25 Set Date Time with year,month,day,hour,minute,second
STS 1 Set Temperature Show display (0=off, 1=on)
SVA 2 Set Video Auto mode (0=manual, 2=auto)
SMP 0,1,1,0,100,150,200,250,300,350,90,25 Set Measurement Point (type,index,enable,mode,startX,startY,endX,endY,anchorX,anchorY,threshold,color)
STV Stop Temperature View measurements
SPF 5 Set Profile parameter
SVL -10 Set Video Left pan movement (signed value)
SVU -5 Set Video Up tilt movement (signed value)
SVD 5 Set Video Down tilt movement (signed value)
SSP 17,1,0 Set System Parameter (param_id,value,index) #46 temperature format 0 °C, 1 °F, 2 K
SCP Set Current Preset (save current position)
GCP Get Current Preset
STT 300,350 Set Temperature Threshold (low,high values *10)
SDC 1 Set Display Configuration parameter
GCS Get Current Status
GMM Get Memory Map information
GFV Get Frame Value (grayscale data)
GFZ Get Freeze Status
GSI 1 Get System Information (parameter=1)
GSS Get System Status
GSP 21,0 Get System Parameter (param_21=surround temp, value=0)
GTT Get Temperature Threshold range
GTV 1,3,10 Get Temperature Values (enable,type,count)
GNU Get Network Update status (response command)
FRZ Freeze current display frame
LIV Live mode (unfreeze display)
CAL Calibrate system
CCP 3 Call Current Preset (preset number 0-9)
APF 100 Auto Profile setting
MEH Measure Enhancement
BPT Built-in Test
MTC S,0 Measure Temperature Capture (S=start, 0=sequence)
MTG U,0,1024,<data> Measure Temperature Gray data transfer
MTD U,0,1024,<data> Measure Temperature Data transfer
UFP S,0,2048 Update Firmware Prepare (S=start, 0=offset, 2048=size)
UFD S,0,1024 Update Firmware Data transfer
BAB U Buffer operation (U=update)
TTH S,0 Temperature Threshold operation
IPP 192.168.001.102,255.255.255.000,192.168.001.001,192.168.000.001,9989,9998 IP Parameters (IP,netmask,gateway,DNS,port1,port2)
MAC 00:60:A9:10:00:01 MAC Address setting
SNP Set Network Parameters (response command)
QYI Query Gray Info (information mode)
QYA Query Gray Average mode
QYM Query Gray Minimum mode
GAI Get Alarm Info (response command)
YTC <data> Unknown command with data parameter
HTH
LRS
LRD
GAR
DRC
PTS
SCX
SCY
CBT
LRE
CBD
CBS
XXX
GSP
GTT
QYI
QYA
QYM

</syntaxhighlight>

==Secret Menu Overview==
The secret menus Main and System can be openend with the password '''+-MC+-'''

Its structured like this, not all variables have been figured out yet.

The format is Menu: submenu: submenu:

and for menu entries: Name, default value, command, description or messages that pop up.
 <syntaxhighlight lang="vb">
MAIN & SYSTEM PASS: +-MC+-

entries are NAME VALUE COMMAND DESC or if its a folder its just ":"

System:
System:
Gain 255 SCO
Bright 102 IBR
BenDi 100 ?
BenDiContrase 80 ?
DisMode 0 ?
Frequency 48hz (24,25,48,50)
DigitalOut 8-14bit 14bit, BT656(_P), ?, BT601
AutoFocus N ?
Line 1 ?
Ltemp0 11800 ?
LTemp1 11000 ?
HTemp0 9500 ?
HTemp1 8700 ?
DelayTime 0 ?
Enhance 0-1 ?
Enhanced E1 230 ?
FPA_Gain 12pF ? between 4 and 18 at random.
NUCEn N ?

Area:
SE 2 ASN 0-4 "Partition"
INT 200 INT "Points time"
VS 3161 SVS
VF 2800 SVF
Vtemp 1401 VTP
VtempArea Low ?
VtempBase 13500 ?
VtempStep -1 ?
VsStep 8 ?
DeadPixelModel preset / calculate
DP: Cursor to select dead pixels
X 360 position
Y 288 position
AutoBP: 50 Press C to start automatic dotting
Quit? Number of bad pixels 961& "Blind element replacement in progress"
Undo
R2: Save data? blind pixel replacement in progress
Replace Y N = DPI, Y = API
L: Reading parameters
S: Saving parameters

Debug:
Rectify N
DisplayGary N
TE N SDT
AutoE ? ?
AutoVS Y ?
VSGrayH 8000 ?
VSGrayL 7000 ?
Trends 1 ?
Shelter N ?
MotorCon 3 ?
SaveFactoryPara:
LanTyp EN ? LANGUAGE
DisplayMT N ?
Version:
PRJ D843 DLD640 ImLib, MTlib, Soft, Logic

BackDispose:
GammaEN 1 ?
Gain 1 ?
EnhanceEN 0 ?
Hpf_shift 5 ?
Hpf_thrd 5 ?
Enhance 150 ?
Lthrd 50 ?

Monitor:
Opens normal OSD

Alarm Set:
Alarm Switch Y ?
Alarm Mode No ?
Alarm Temperature -1°C ?
Reference Gray Y ?
Alarm Level 1L ?
Alarm Gray 65535 ?
Alarm PointNum 0 ?
Correct Gray 0 ?

Thermometry:
Data Collection 0 SMS
Interval 60 SCP
Ammount 90 SCT
Environment normal ?
Export:
Displays: Exportin normal temperature MTC data
Correction -1 ?
Emissivity 100 SEM
Calibration:
BlackbodyTemp -10 grabs a val from GAB
Save CBS
Cancel CBD
Correction:
BlackbodyTemp -10 Picks from the list GAR
Grayscale 0 SLG
Confirm LRE
Save LRS
Cancel LRD
Ninepoint measurement SMV

Cursor:
Cur N DRC enable cursor
X 320 SRP set cursor position
Y 240 SRP set cursor position

Main:
Auto 2 SAG Auto gain
G 211 SVC
B 10002 SVB
P 1 SWP polarity
Z X ?
Settings:
Image:
FI Y ?
FIValue 0 ? 0-31
Freeze N Freeze image
VE N SMR Vertical flip
HO N SMR Horizontal flip
AutoCali L same as rectify?
O IN internal or external
COM:
Opens UART menu
AvoidburnSwitch OFF enable anti burn in
ProtectedTime 10S duration
AvoidBurn 16383 threshold to trigger antiburn

</syntaxhighlight>

===Automatic Dead Pixels and Flatmap Correction===

It it possible to generate a new flat and dead pixel map automatically within the camera after flashing the cleared-map binary.
 

=====Dead pixels:=====
In the secret menu "System", navigate to Area - DeadPixelModel and set the AutoBP (sensitivity for auto bad pixel finding) to 50 or so. Then press C Button

This can take a while.
[[File:High emissivity peltier black body.jpg|thumb|A Peltier / TEC coated in Candle sood to give it a high emissivity surface. It can be cooled or heated by swapping the polarity. ]]

Afterwards, navigate to S: and press + to save it.
 

=====Flatfield:=====
In the Debug menu navigate to R2 and press +

now place something '''Cold''' infront of the Camera with a high emissivity. (it needs to fill the whole image)

Press '''+''', wait for it to says High temperature.

Place something '''Hot''' infront and press '''+''' again.

Afterwards, save with '''S:''' again.

Flatfield should now be calibrated
 <blockquote>Note: Not all dead pixels are auto detected or get removed. you can manually select them in the Dead pixel editor but its not known yet how to select and correct them.</blockquote>

 

==Using the Thermal module without Webserver==
[[File:Breakoutboard d8x3c dali v1.1.png|alt=|thumb|Breakout board for D8X3C]]
to use it, you need to interface it directly.

The module will put out a Analog video signal (High-Z, need to buffer when connecting it to 75Ohm Video input)

Also a 8 or 14bit or 8-bit BT656 output.

the header exposes the FPGA JTAG and UART aswell as 6 Hardware Keys to Navigate the OSD.

To interface, you need to have a adapter board with a DF12-50DS-0.5V(86) Docking socket.

A open source project can be found here, it includes pin access to:

FPGA JTAG

UART 3.3V with pin compatible FT232 socket

Power 5V over USB-C

5 Button inputs

Buffered video output and socket for USB Videograbber

Digital 14 bit video out header with hsync vsync and clk.

the pcb has been tested and seems to work.https://oshwlab.com/gamerpaddy/d8x3c-backpack-usb

 

==Sensor Pinout==
[[File:Dali DLD384 Sensor pinout basic.png|thumb|basic pinout of a DLD384]]
the pinout of the thermal sensor havent been analyzes much.

besides some supply and Control voltages, 3 clocks and a analog output have been found.

17.5MHz

14.705KHz

50Hz

File:Breakoutboard d8x3c dali v1.1.png

2025-08-29T13:01:29Z

Gamerpaddy:

fixed version

Dali D8X3N Thermal Camera

2025-08-15T17:14:50Z

Gamerpaddy: /* Bad Pixel and Flatframe Maps 0x280000 and 0x4C0000 */

=Dali D8X3N Thermal Camera Reverse Engineering=
 

===Introduction===
The [https://www.dali-irtech.com/productinfo/741567.html Dali D8X3N] Thermal Camera module comes in two versions, a 384x288 and 640x480 resolution, utilizing the [http://www.dali-tech.us/products/dld64017m-uncooled-infrared-fpa-detector-86.html DLD Series] of amorphous-Silicon Microbolometers.

They were mainly used in [http://www.dali-tech.us/products/dm60-w--online-body-temperature-thermal-imaging-camera-55.html Dali DM60-W] or WS-1 Body Temperature screening cameras in conjunction with a Black Body radiator set to 37°C to detect infected individuals at the start of the 2020 Covid Pandemic.
[[File:ICI FM320P Innerts.jpg|thumb|Internals. A TP-Link Switch, HikVision Visible Camera and the D8x3N Network thermal camera module]]
[https://infraredcameras.com/ ICI] rebranded these models as FM 320 P and FM 640 P, and distributed them on the local US market, but as the need for such Cameras exploded, those models were built with what was in stock.

So happens, that some of the FM 320 P Models had a DLD640 640x480 instead of a DLD384 384x288 Microbolometer in them, and just got their Firmware modified.

It also could be, because they have excessive amounts of bad pixels outside the 384x288 area, that they were binned to a lower grade.

Discussions about these Cameras started around 2022 in the [https://www.eevblog.com/forum/thermal-imaging/ici-and-dali-thermal-camera-software/ EEVBlog Forums.] when they started to appear secondhand and affordable.

Originally they were priced around US$ 20... 30.000 by ICI, and a unknown amount by Dali Tech.

The Modules specs according to the manufacturer are:

≤50..60mK@F1，300K，50Hz

17 or 25µm pixel pitch

Hisilicon SoC running Linux to provide Onvif and RTSP streams, analysis and a Web UI

 
[[File:Dali D8X3N Module.jpg|thumb|A real 384x288 model with a DLD384 sensor. notice the Productnumber ]]
ICI FM Cameras are found all over Online secondhand marketplaces for scrap Prices, as they are no longer needed.

But you never know, what are you getting. It could be a real DLD384 or the better DLD640 inside. Its a gamble.
 

======640x480 Imagers======
are labeled 22D843 Nxxxx and have a DLD640 sensor in it, they can be upgraded if they run the 384x288 firmware.

======384x288 Imagers======
are labeled 22D883Nxxxx and have a DLD384 sensor in it, they cannot be upgraded

 

==D8X3N Module closer look==
From now on, i will refer to the Thermal Imaging Module as TIM

On the front there is a 2 Element Germanium Lens of a unknown focal length and aperture.

It can be focus-adjusted when unscrewing the clamp around the housing. It can be focussed from infinity down to 10..20cm with some quality loss.
 The outter diameter of the Lens is 42mm with a 1 1/3 inch thread diameter of undetermined pitch.

Dimensions of the germanium elements are 21mm to 3 and 6mm and 14grams in weight.
[[File:Disassembled Thermal Camera Lens.jpg|thumb|Two element Germanium Lens of unknown focal length and aperture]]

The TIM is composed of 6 Stacked PCB modules, 3 of which are for the Web Server functionality. taking them off will give you the basic configuration of a [https://www.dalithermal.com/productinfo/741568.html Dali D8X3C] TIM<gallery>
File:Dali DLD640 Thermal Image Sensor.jpeg|DLD640 Sensor
File:Dali DLD384 Thermal Imaging Sensor.jpeg|DLD384 Sensor
File:Dali D8X3N Board1 Back.jpeg|Network & GPIO Board Back
File:Dali D8X3N Board1 Front.jpeg|Network & GPIO Board Front
File:Dali D8X3N Glue Board Back.jpeg|Board between Logic and IO Back
File:Dali D8X3N Glue Board Front.jpeg|Board between Logic and IO Front
File:Dali D8X3N SoC Board Back.jpeg|SoC Board back
File:Dali D8X3N SoC Board front.jpeg|SoC board front
File:Dali D8X3N FPGA Board Back.jpeg|FPGA Board of the D8X3C Thermal Imager including a PMIC
File:Dali D8X3N FPGA Board Front.jpeg|FPGA Board Front with Video DAC and SPI Flash
File:Dali D8X3N Sensor Power and ADC Board.jpeg|Sensor control and ADC board
File:Dali D8X3N Thermal Core Debug wiring.jpeg|Debug wiring for sniffing SPI and UART
</gallery>

===User Manual===
including pinout diagram and important data

can be found here https://archive.org/details/dali-d-8-x-3-cuser-manualen-v-1.0-1

==Viewing the Video Stream==
[[File:Onvif Device Manager ODM.png|thumb|ODM streaming the Thermal view]]
when first connecting it to power and Ethernet, the camera will have 192.168.1.102 as a Static ip.

If you are running a 192.168.0.x or .178.x net, you need to change it or add a subnet under windows ipv4 settings.

to view it, you can use VLC and the stream URL
rtsp://admin@admin:<camera ip>/ONVIFMedia
there is /ONVIFMedia /ONVIFMediaM and /ONVIFMediaS for different stream Profiles.

VLC is quite slow and delayed, rather use Onvif Device Manager ODM,

it has no delay and auto-detects cameras in the network.

Be sure to log in as user: admin pass: admin in ODM.

in there, you can also set you camera to DHCP under Network settings.

===Web Interface===
[[File:Dali D8X3N web interface.png|thumb|Since browsers cant display RTSP anymore, open in Edge and select IE Compatibility Mode.]]
the web interface can be accessed by opening the camera IP in a browser

login is:
user: admin pass: admin
You can set Temperature markers and areas, but without using the Black Body calibration source, your readings may be way off or not working.

 

====OSD====
there is a debug-login with
user: super pass: 871897
that lets you send Key commands to the Imager to navigate the OSD.

Setting the OSD to english is accomplished with option #11
[[File:Dali D8X3C OSD.png|thumb|OSD in english, if yours is Chinese. go to option #11 and click + or -]]

To acces some locked menus, press
+ - + - + -

The password for the locked System and Main menu is
+-MC+-

Be careful in the UART menu to not change the BAUD rate or Protocol, as your ability to control it via the Web API gets lost.

You need to reflash or solder buttons on the thermal core then.

==Viewing Raw Thermal Data from the Web API==
there is a hidden endpoint in the stream.so file that could be found while decompiling

accessing
[[File:Arduino Nano blink sketch thermal gif.gif|thumb|Arduino Nano running blink sketch while thermally recording it, notice the led and resistor on the right]]
<ip of camera>:5000/stream?Type=JPEG&Source=Jpeg&Mode=TCP
lets you download a JPEG. but there are more options available (not all have been tested)

we are mainly interessted in Raw thermal data.

====Source (Stream Type)====

*<code>Major</code> - Main video stream (channel 0)
*<code>Minor</code> - Sub video stream (channel 1)
*<code>MinorAV</code> - Sub video + audio stream
*<code>MajorAV</code> - Main video + audio stream
*<code>Jpeg</code> - JPEG snapshot stream
*<code>Raw</code> - Raw thermal data stream
*<code>YUV</code> - YUV raw video stream

====Type (Data Format)====

*<code>H264</code> - H.264 video encoding
*<code>JPEG</code> - JPEG image format
*<code>RAW</code> - Raw sensor data
*<code>QBOX</code> - Custom protocol format
*<code>FRAME</code> - Frame-based format

====Mode (Transport Protocol)====

*<code>TCP</code> - TCP streaming (default)
*<code>UDP</code> - UDP streaming
*<code>MUL</code> - Multicast streaming

====Quality Parameters====

*<code>Quality=[1-100]</code> - Video quality level
*<code>Frames=[number]</code> - Number of frames to send
*<code>Interval=[ms]</code> - Frame interval in milliseconds

====Network Parameters====

*<code>IPAddr=[ip]</code> - Client IP address for UDP/multicast
*<code>Port=[port]</code> - Client port for UDP/multicast
*<code>Heart-beat=[Yes/No]</code> - Enable/disable heartbeat

====Snapshot Parameters====

*<code>Snap=[Yes/No]</code> - Enable snapshot mode

 
====Raw Viewer for PC (Python)====
[[File:Dali D8X3N Raw Thermal viewer.png|thumb|Raw Data Viewer in python]]

To view the raw stream, i made a python program that converts the 14bit thermal data to a visible image.

it is low fps tho, due to bad optimizations.

rev1 first working version https://pastebin.com/dyNWDPT3

rev2 with temperature readout https://pastebin.com/u107Q85w

rev3 and onward will only be available directly as a Webpage on the Device (see below).

====Raw Viewer for the internal Webserver (recommended)====
It is also possible to use the Raw viewer directly in the browser.

To achieve this, the stream had to be proxied from port 5000 to 80 due to CORS.

luckily the internal lighttpd had the CGI module enabled, so piping it troug (using wget ... i know) worked with very low overhead.

To install, you need '''Terminal access''' to the Camera. see below.

optional for simplicity: '''ftp''' access

[[File:Dali D8X3N Webviewer.png|thumb|Web Raw Viewer with histogram (rev3)]]

Create the files and the code inside.

'''/app/web/webpages/raw.html''' https://pastebin.com/kaiXwAgD

and

'''/app/web/webpages/cgi-bin/proxy.cgi''' https://pastebin.com/vii1HXcU

then run
chmod +x /app/web/webpages/cgi-bin/proxy.cgi
'''restart''' your camera.

It should be accessible now trough '''http://<camera ip>/raw.html''' in the browser and click Start Stream

'''NOTE''': ''If it does not work'', check the contents of both files. FTP sometimes messes them up.

also run
dos2unix /app/web/webpages/cgi-bin/proxy.cgi
because linux <> windows difficulties that couldnt be resolved in over 30 years.

<blockquote>

performance may need improvement.</blockquote>

==Getting Root Terminal Access==
To access the Terminal you need to solder or plug in a UART connection to Connector J7 on the "Glue" board.

Pinout is (left to right) '''RX TX GND 3.3V Baud 115200 3.3V!'''

But the system will spam with debug messages, making patching the files a hard job unless you use "tftp" or "sed" commands.
 

====Enabling Telnet access to make patching easier====
[[File:Upgrade ici dali firmware updater.png|thumb|ICI Firmware updater software with modified firmware loaded]]

there is a easier way using a modified Firmware updater to enable Telnet temporarily to patch the Files.

Download the '''upgrade_ici.exe''' form [https://archive.org/details/fwupdate here] and run it.

Then you should be able to connect to it via Telnet.

The Login credentials are '''User: roo'''t '''Password: DLroot'''

 

===Patching Device===

===Patching the Web Server===
 

====Enabling Telnet and ftpd permanently====

This only works if you also patch the Thermal Camera module flash!

to permanently enable Telnet, go to '''/etc/init.d''' and edit '''S90app'''
vi S90app
in vi, move your cursor to the '''#''' at '''#telnetd''' and press x<blockquote>optional: enable ftp by removing the '''#''' at '''ftpd''' and adjust the path to / </blockquote>now press ''':''' and type '''wq''' and hit '''enter'''. this should be it.

====Patching the decoder and streamer to 640x480:====
go to /app and edit the mach.cfg

replace DL384 with D640 and edit the resolution to 640 480

(press i in vi to enter edit mode, press ESC to exit edit mode. :wq to write and quit.)

repeat that procedure for the dali.cfg

=====(optional) patching app.sh to prevent it from rebooting=====
edit the app.sh in /app and remove all "reboot" occasions to prevent the camera from rebooting if onvifserver, httpd or daliServer arent running for debugging purposes.

 

====Patching the Thermal Camera module====
To patch it, you need to disassemble everything down to the FPGA Board,

on the bottom there is a SPI SOIC8 Flash.

Use a CH341 EEPROM programmer (be sure to have a fixed or modified version to not put out 5V!, set it to 3.3V) and SOIC8 clamp.

Use NeoProgrammer (i used 2.2.0.10 but there are newer available, use the latest) and click Detect. It should find W25Q128 chips, select the FV one.

Dont forget to download a backup of your flash and save it !

Download the Binary "Dali 640x480 '''actual''' cleared pixelmap.bin" from #3 below and load it into NeoProgrammer,

Click Erase, Program and Verify.

This can take a while.

Your imager should start up right after assembly by hearing the shutter click.

==Hardware Hacking==

===Flash Contents===
On archive, click on show all files to download them.

<nowiki>#</nowiki>1 a Flash dump of the original downgraded D8X3N can be found [https://archive.org/details/dali-d-843n-flash-dump here]

<nowiki>#</nowiki>2 a Flash dump of a original 640x480 model can be found [https://archive.org/details/d-843-n-640x-480 here]

<nowiki>#</nowiki>3 a modified Flash dump of a 640x480 with cleared dead pixel map, flat map etc. can be found [https://archive.org/details/d-843-n-640x-480-cleared-pixelmap here]

a Flash dump of the web server SPI flash W25Q256JV can be found [https://archive.org/details/dm-60-webserver-flash-dump here] in case a bad firmware update caused a bootloop.

 

===Flash Binary Analysis===
The Flash IC is a Winbond 25Q128JV SPI Flash that contains the FPGA Bitstream, Deadpixel and Flatmap, aswell as the Device Settings.

a copy of the SPI Logic Capture at startup can be found [https://archive.org/details/dali-eeprom-capture here], the free software [https://www.dreamsourcelab.com/download/ DSView from DreamSourceLab] is required to view it.
[[File:Dali Thermal Imager SPI Flash capture.png|thumb|SPI Flash access while booting the Thermal Module]]

a approximation of the offsets resulted in this list:<syntaxhighlight lang="vb">
0x000000 - altera cyclone iv stuff
0x200000 - settings
0x280000 - Flat field correction map
0x4C0000 - Bad Pixel correctio nmap
0x580000 - image aswell? 36010 bytes
0x740000 - GUIX?
0x7C0000 - Strings for Gui?
0x800000 - another shorter GUIX
0x880000 - Strings for second gui?
0x8C0000 - GUIX
0x940000 - Strings for gui
0xE00000 - ?
0xE80000 - dzxg? short
0xEC0000 - crosshair.bmp
0xF40000 - 3DTM?
0xF80000 - fake? Bad pixel map BPRP
</syntaxhighlight> 

====Settings offset 0x200000====
The settings are read and written every startup, aswell when you close the OSD, sporadically and when executing the command MSV

these are some of the settings i could figure out by changing and watching the logic capture what changed.
 <syntaxhighlight lang="vb">
offset size Cmd
0x0 1 SAG (0-2) auto gain
0x2 2 SVB (0-16383) saved value is 16383 - SVB
0x4 2 SVC (0-1023) set exposure or gain
0x6 1 SSM image filtering
0x8 1 SEH image enhancement
0xA 1 SWP invert b/w polarity
0x14 1 SMR Flip
0x16 1 SMR Mirror
0x20 1 MENU Cal source 0 IN, 1 OUT
0x3A 1 MENU Enhance value 0-100
0x40 1 MENU Rectify (shutter 0 OFF, 1 L, 2 H)
0x50 1 MENU Language 0 english, 1 chinese, 2 russian
0xA2 - SCO set contrast gain
0xA4 - IBR set brightness
0xAE 2 MENU Fire Threshold
0xAC 1 SPA set color palette
0xE2 1 SMS display "collected 0/80" enabled
0xF8 1 SEM set emissivity
0x110 1 SRT set revise temp
0x116 1 SHD set humidity
0x118 1 SET set ambient temp
0x11A 1 STD set temp range
0x120 2 SLG -500 to 500?
0x124 2 SRD set distance
0x12C 1 SCP ???
0x130 2 SCT ???
</syntaxhighlight> 
[[File:Dali D8X3N Bad Pixel Map Viewer.png|thumb|Bad pixel map of a 640x512 sensor, about 0.56% of dead pixels in this map]]
So i let the AI create a [https://2476424.playcode.io/ Configurator page] that lets you change the Settings in your Flashdump to your liking
 

====Bad Pixel and Flatframe Maps 0x280000 and 0x4C0000====
Thermal cameras require a bad pixel and flat frame map to compensate for manufacturing inconsistencies.

unfourtainly, the maps of the downgraded cameras only contain enough data for a 384 model, not the full 640.

at offset 0xF80000 there is a BPRP which was mistaken at first as the Bad pixel map, it could just be a mask to where to apply the offset maps, as its either 0x0 or 0x1.

The [https://2477569.playcode.io/ Viewer Page] is written in JS and does not require any special dependencies, it can run as a plain html file offline.

''See "Automatic Dead Pixels and Flatmap Correction" below how to create new dead pixel and flatmaps using the system menu.''

[[File:Dali D8X3N Flat Field Map Viewer.png|thumb|Flat Field viewer]]

==Dali Commands==
To control the TIM you can either use Pelco or Dali command set. By default the Dali commandset is used at 38400 BAUD.

Those commands consist of a 0x02 start byte followed by two length Bytes, then the actual command which is allways 3 uppercase Letters in ASCII (eg. KBD for keyboard) followed by a comma and the values.

Some commands take multiple values, some dont. But you allways have to send the comma after the Command.

The camera will answer with the Command and 0, 1 or 2. Sending no value counts as zero.
0 is invalid parameters, too few or out of range

1 is OK, valid command

2 is Invalid command

Commands can be sent trough the Web server using the URL Api endpoint or directly trough the UART port.

(keyboard, C button, causes the shutter to do a calibration)
<camera ip>/cgi-bin/dmcmd?Command=KBD,C
Listening to the answer can be done while being in the Linux shell and typing
cat /dev/ttyAMA2 | strings

By bruteforcing the UART with AAA to ZZZ a list of Commands could be obtained, but some with unknown Parameters or functionality yet. including some from a decompiled DM60comm.so module found in /app/modules folder.<syntaxhighlight lang="vb">
KBD KEY Keyboard (F S M C + -)
SSM 0-1 Image Filtering Off/On
GSM 0 Image filter status
SEH 0-1 Image Enhancement Off/On
GEH 0-1 Image enhancer status
SCO 0-255 Set Gain (locked when SAG auto gain is on)
GCO 0-255 Get gain
INT 15-320 set actual gain? not just contrast sometimes disabled?
IBR 0-255 Set brightness
GBR 0-255 Get brightness
SMR 0-3 Mirror mode bit0=horizontal, bit1=vertical
GMR 0 Get rotation/flip
SDT 0-1 displays temp=44.65°C osd, but webserver sends date/time to the cam there....
GDT 0-1 Get temp display active?
GPT Display temp oft SDT
GNU 0-1 Get Shutter closed/open
SNU 0-1 Shutter close / open
STD 0-1 Set Range 0: -20-180°C 1: 100-600°C
GTD 0-1 Get Range
SET °C Set Ambient temperature
GET °C Get Ambient temperature
SEM 0-100 0-1 set emissivity x100
GEM 0-100 Get Emissivity
SRT °C Set revise temperature -100-100 -10-10°
GRT °C Get revise temperature
SRD 100 Set Distance 4.4m x100
GRD 100 Get Distance
SHD 0-100 Set Humidity
GHD 55 Get Humidity
SWP 0-1 invert s/w polarity image
GWP 1 is inverted?
SPA 0-10? Set color palette
GPA 3 white hot
SMV 0-1 Show temperature 3x3 grid?? in combination with GTV maybe
GMV 0
SMS 0-1 displays "collected 0/<number set by SCT>" by SCP delay "saves the daily number of highest temperatures?"
GMS 0
SCT 1-500 sets the amount of "collected" points for SMS
GCT 80
SCP 5-60 "collected" delay in seconds for SMS
GCP 60
SAG 0-2 Auto brightness / gain
GAG 0
SLR 0-9 ???
GLR 0
SRP 0,0 - 639,479 set crosshair position
GRP 320,240 get crosshair position
DRC 0-1 Show crosshair
SLG -500-500 ??
GLG
SCE text ??
GCE 0
SCB text ??
GCB 0
SVB 0-16383 adc offset, exposure? good at 9650
GVB 6733 value is 16383 minus SVB
SVC 1-1023 set contrast but better
GVC 260
SVF 100-? ?? video freaks out 3400 seems good
SVS 100-? ?? video freaks out 3300 seems good
SOT 0-1 ?? sensor supply, looks weird when off.
SZM 1-4 ?
GZM 1
MSV save settings too eeprom
ASV Saves something aswell?
GCS 0 Get Core status & faults
ALD 0,2? video blanks lots of eeprom activity. reload pixel map??
SAV 0-9999 set Fire threshold
GAV 2100 get Fire Threshold
BAC change uart protocol? careful
CBD Displays Recovery successful?
CBS Displays Saved successfully
LRD Displays Recovery successful?
LRS Displays Saved successfully?
LRE Displays Temperature Repair successful?
CBT Displays Calibration successful?
DBP ??? shutter clicks
DPI Show weird pixels
API Hide weird pixels
CCM ??
ASN 0-4 ??
GAB 4 vals ?? 3,-10,50,150
GAN 1 ??
GAR 11 vals ?? 10,10,5,20,35,50,70,90,120,150,180,,
GCM 6 values ??
GFV prints screen gray value?
GIT 200 ??
GTV Get the collected temp values?
PTS echoes but with extra stuff??
QYA 7170 Query Gray Info (information mode)
QYI 7124 Query Gray Average mode
QYM 7512 Query Gray Minimum mode
VTP 400-4000 ??
MTD U/S,0,0 ?? S answers with bytes, U upload bytes?
MTC U/S? ?? S answers with U,0,0, S doesnt.

return 0 invalid params:
STS ??
STT ??
SAC ??
SAH ??
SAS ??
SAT ??
SCX ?? displays crosshair but invalid params
SCY ?? displays crosshair but invalid params
GAC ??
GAH ??
GAS ??
GAT ??
GME ??
GPC ??
GPI ??
GPM ??
GTA ??
GTC ??
GTI ??
GTM ??
GTS ??
GTT ??

answer only:

BPM 0-1 stream ready? answers with 0 stop, 1 go, 2 when prompted
AVS 0,1
MEH
PWI 0-1 changing palette from wh to fire

unconfirmed (from dm60comm.so):
SDT 2024,03,15,14,30,25 Set Date Time with year,month,day,hour,minute,second
STS 1 Set Temperature Show display (0=off, 1=on)
SVA 2 Set Video Auto mode (0=manual, 2=auto)
SMP 0,1,1,0,100,150,200,250,300,350,90,25 Set Measurement Point (type,index,enable,mode,startX,startY,endX,endY,anchorX,anchorY,threshold,color)
STV Stop Temperature View measurements
SPF 5 Set Profile parameter
SVL -10 Set Video Left pan movement (signed value)
SVU -5 Set Video Up tilt movement (signed value)
SVD 5 Set Video Down tilt movement (signed value)
SSP 17,1,0 Set System Parameter (param_id,value,index) #46 temperature format 0 °C, 1 °F, 2 K
SCP Set Current Preset (save current position)
GCP Get Current Preset
STT 300,350 Set Temperature Threshold (low,high values *10)
SDC 1 Set Display Configuration parameter
GCS Get Current Status
GMM Get Memory Map information
GFV Get Frame Value (grayscale data)
GFZ Get Freeze Status
GSI 1 Get System Information (parameter=1)
GSS Get System Status
GSP 21,0 Get System Parameter (param_21=surround temp, value=0)
GTT Get Temperature Threshold range
GTV 1,3,10 Get Temperature Values (enable,type,count)
GNU Get Network Update status (response command)
FRZ Freeze current display frame
LIV Live mode (unfreeze display)
CAL Calibrate system
CCP 3 Call Current Preset (preset number 0-9)
APF 100 Auto Profile setting
MEH Measure Enhancement
BPT Built-in Test
MTC S,0 Measure Temperature Capture (S=start, 0=sequence)
MTG U,0,1024,<data> Measure Temperature Gray data transfer
MTD U,0,1024,<data> Measure Temperature Data transfer
UFP S,0,2048 Update Firmware Prepare (S=start, 0=offset, 2048=size)
UFD S,0,1024 Update Firmware Data transfer
BAB U Buffer operation (U=update)
TTH S,0 Temperature Threshold operation
IPP 192.168.001.102,255.255.255.000,192.168.001.001,192.168.000.001,9989,9998 IP Parameters (IP,netmask,gateway,DNS,port1,port2)
MAC 00:60:A9:10:00:01 MAC Address setting
SNP Set Network Parameters (response command)
QYI Query Gray Info (information mode)
QYA Query Gray Average mode
QYM Query Gray Minimum mode
GAI Get Alarm Info (response command)
YTC <data> Unknown command with data parameter
HTH
LRS
LRD
GAR
DRC
PTS
SCX
SCY
CBT
LRE
CBD
CBS
XXX
GSP
GTT
QYI
QYA
QYM

</syntaxhighlight>

==Secret Menu Overview==
The secret menus Main and System can be openend with the password '''+-MC+-'''

Its structured like this, not all variables have been figured out yet.

The format is Menu: submenu: submenu:

and for menu entries: Name, default value, command, description or messages that pop up.
 <syntaxhighlight lang="vb">
MAIN & SYSTEM PASS: +-MC+-

entries are NAME VALUE COMMAND DESC or if its a folder its just ":"

System:
System:
Gain 255 SCO
Bright 102 IBR
BenDi 100 ?
BenDiContrase 80 ?
DisMode 0 ?
Frequency 48hz (24,25,48,50)
DigitalOut 8-14bit 14bit, BT656(_P), ?, BT601
AutoFocus N ?
Line 1 ?
Ltemp0 11800 ?
LTemp1 11000 ?
HTemp0 9500 ?
HTemp1 8700 ?
DelayTime 0 ?
Enhance 0-1 ?
Enhanced E1 230 ?
FPA_Gain 12pF ? between 4 and 18 at random.
NUCEn N ?

Area:
SE 2 ASN 0-4 "Partition"
INT 200 INT "Points time"
VS 3161 SVS
VF 2800 SVF
Vtemp 1401 VTP
VtempArea Low ?
VtempBase 13500 ?
VtempStep -1 ?
VsStep 8 ?
DeadPixelModel preset / calculate
DP: Cursor to select dead pixels
X 360 position
Y 288 position
AutoBP: 50 Press C to start automatic dotting
Quit? Number of bad pixels 961& "Blind element replacement in progress"
Undo
R2: Save data? blind pixel replacement in progress
Replace Y N = DPI, Y = API
L: Reading parameters
S: Saving parameters

Debug:
Rectify N
DisplayGary N
TE N SDT
AutoE ? ?
AutoVS Y ?
VSGrayH 8000 ?
VSGrayL 7000 ?
Trends 1 ?
Shelter N ?
MotorCon 3 ?
SaveFactoryPara:
LanTyp EN ? LANGUAGE
DisplayMT N ?
Version:
PRJ D843 DLD640 ImLib, MTlib, Soft, Logic

BackDispose:
GammaEN 1 ?
Gain 1 ?
EnhanceEN 0 ?
Hpf_shift 5 ?
Hpf_thrd 5 ?
Enhance 150 ?
Lthrd 50 ?

Monitor:
Opens normal OSD

Alarm Set:
Alarm Switch Y ?
Alarm Mode No ?
Alarm Temperature -1°C ?
Reference Gray Y ?
Alarm Level 1L ?
Alarm Gray 65535 ?
Alarm PointNum 0 ?
Correct Gray 0 ?

Thermometry:
Data Collection 0 SMS
Interval 60 SCP
Ammount 90 SCT
Environment normal ?
Export:
Displays: Exportin normal temperature MTC data
Correction -1 ?
Emissivity 100 SEM
Calibration:
BlackbodyTemp -10 grabs a val from GAB
Save CBS
Cancel CBD
Correction:
BlackbodyTemp -10 Picks from the list GAR
Grayscale 0 SLG
Confirm LRE
Save LRS
Cancel LRD
Ninepoint measurement SMV

Cursor:
Cur N DRC enable cursor
X 320 SRP set cursor position
Y 240 SRP set cursor position

Main:
Auto 2 SAG Auto gain
G 211 SVC
B 10002 SVB
P 1 SWP polarity
Z X ?
Settings:
Image:
FI Y ?
FIValue 0 ? 0-31
Freeze N Freeze image
VE N SMR Vertical flip
HO N SMR Horizontal flip
AutoCali L same as rectify?
O IN internal or external
COM:
Opens UART menu
AvoidburnSwitch OFF enable anti burn in
ProtectedTime 10S duration
AvoidBurn 16383 threshold to trigger antiburn

</syntaxhighlight>

===Automatic Dead Pixels and Flatmap Correction===

It it possible to generate a new flat and dead pixel map automatically within the camera after flashing the cleared-map binary.
 

=====Dead pixels:=====
In the secret menu "System", navigate to Area - DeadPixelModel and set the AutoBP (sensitivity for auto bad pixel finding) to 50 or so. Then press C Button

This can take a while.
[[File:High emissivity peltier black body.jpg|thumb|A Peltier / TEC coated in Candle sood to give it a high emissivity surface. It can be cooled or heated by swapping the polarity. ]]

Afterwards, navigate to S: and press + to save it.
 

=====Flatfield:=====
In the Debug menu navigate to R2 and press +

now place something '''Cold''' infront of the Camera with a high emissivity. (it needs to fill the whole image)

Press '''+''', wait for it to says High temperature.

Place something '''Hot''' infront and press '''+''' again.

Afterwards, save with '''S:''' again.

Flatfield should now be calibrated
 <blockquote>Note: Not all dead pixels are auto detected or get removed. you can manually select them in the Dead pixel editor but its not known yet how to select and correct them.</blockquote>

 

==Using the Thermal module without Webserver==
[[File:Dali D8X3C Breakout board.png|thumb|Breakout board for D8X3C ]]
to use it, you need to interface it directly.

The module will put out a Analog video signal (High-Z, need to buffer when connecting it to 75Ohm Video input)

Also a 8 or 14bit or 8-bit BT656 output.

the header exposes the FPGA JTAG and UART aswell as 6 Hardware Keys to Navigate the OSD.

To interface, you need to make a adapter board with a DF12-50DS-0.5V(86) Docking socket.

A breakout board is still a work in progress

 

==Sensor Pinout==
[[File:Dali DLD384 Sensor pinout basic.png|thumb|basic pinout of a DLD384]]
the pinout of the thermal sensor havent been analyzes much.

besides some supply and Control voltages, 3 clocks and a analog output have been found.

17.5MHz

14.705KHz

50Hz

Dali D8X3N Thermal Camera

2025-08-06T00:26:32Z

Gamerpaddy: breakout board setback

=Dali D8X3N Thermal Camera Reverse Engineering=
 

===Introduction===
The [https://www.dali-irtech.com/productinfo/741567.html Dali D8X3N] Thermal Camera module comes in two versions, a 384x288 and 640x480 resolution, utilizing the [http://www.dali-tech.us/products/dld64017m-uncooled-infrared-fpa-detector-86.html DLD Series] of amorphous-Silicon Microbolometers.

They were mainly used in [http://www.dali-tech.us/products/dm60-w--online-body-temperature-thermal-imaging-camera-55.html Dali DM60-W] or WS-1 Body Temperature screening cameras in conjunction with a Black Body radiator set to 37°C to detect infected individuals at the start of the 2020 Covid Pandemic.
[[File:ICI FM320P Innerts.jpg|thumb|Internals. A TP-Link Switch, HikVision Visible Camera and the D8x3N Network thermal camera module]]
[https://infraredcameras.com/ ICI] rebranded these models as FM 320 P and FM 640 P, and distributed them on the local US market, but as the need for such Cameras exploded, those models were built with what was in stock.

So happens, that some of the FM 320 P Models had a DLD640 640x480 instead of a DLD384 384x288 Microbolometer in them, and just got their Firmware modified.

It also could be, because they have excessive amounts of bad pixels outside the 384x288 area, that they were binned to a lower grade.

Discussions about these Cameras started around 2022 in the [https://www.eevblog.com/forum/thermal-imaging/ici-and-dali-thermal-camera-software/ EEVBlog Forums.] when they started to appear secondhand and affordable.

Originally they were priced around US$ 20... 30.000 by ICI, and a unknown amount by Dali Tech.

The Modules specs according to the manufacturer are:

≤50..60mK@F1，300K，50Hz

17 or 25µm pixel pitch

Hisilicon SoC running Linux to provide Onvif and RTSP streams, analysis and a Web UI

 
[[File:Dali D8X3N Module.jpg|thumb|A real 384x288 model with a DLD384 sensor. notice the Productnumber ]]
ICI FM Cameras are found all over Online secondhand marketplaces for scrap Prices, as they are no longer needed.

But you never know, what are you getting. It could be a real DLD384 or the better DLD640 inside. Its a gamble.
 

======640x480 Imagers======
are labeled 22D843 Nxxxx and have a DLD640 sensor in it, they can be upgraded if they run the 384x288 firmware.

======384x288 Imagers======
are labeled 22D883Nxxxx and have a DLD384 sensor in it, they cannot be upgraded

 

==D8X3N Module closer look==
From now on, i will refer to the Thermal Imaging Module as TIM

On the front there is a 2 Element Germanium Lens of a unknown focal length and aperture.

It can be focus-adjusted when unscrewing the clamp around the housing. It can be focussed from infinity down to 10..20cm with some quality loss.
 The outter diameter of the Lens is 42mm with a 1 1/3 inch thread diameter of undetermined pitch.

Dimensions of the germanium elements are 21mm to 3 and 6mm and 14grams in weight.
[[File:Disassembled Thermal Camera Lens.jpg|thumb|Two element Germanium Lens of unknown focal length and aperture]]

The TIM is composed of 6 Stacked PCB modules, 3 of which are for the Web Server functionality. taking them off will give you the basic configuration of a [https://www.dalithermal.com/productinfo/741568.html Dali D8X3C] TIM<gallery>
File:Dali DLD640 Thermal Image Sensor.jpeg|DLD640 Sensor
File:Dali DLD384 Thermal Imaging Sensor.jpeg|DLD384 Sensor
File:Dali D8X3N Board1 Back.jpeg|Network & GPIO Board Back
File:Dali D8X3N Board1 Front.jpeg|Network & GPIO Board Front
File:Dali D8X3N Glue Board Back.jpeg|Board between Logic and IO Back
File:Dali D8X3N Glue Board Front.jpeg|Board between Logic and IO Front
File:Dali D8X3N SoC Board Back.jpeg|SoC Board back
File:Dali D8X3N SoC Board front.jpeg|SoC board front
File:Dali D8X3N FPGA Board Back.jpeg|FPGA Board of the D8X3C Thermal Imager including a PMIC
File:Dali D8X3N FPGA Board Front.jpeg|FPGA Board Front with Video DAC and SPI Flash
File:Dali D8X3N Sensor Power and ADC Board.jpeg|Sensor control and ADC board
File:Dali D8X3N Thermal Core Debug wiring.jpeg|Debug wiring for sniffing SPI and UART
</gallery>

===User Manual===
including pinout diagram and important data

can be found here https://archive.org/details/dali-d-8-x-3-cuser-manualen-v-1.0-1

==Viewing the Video Stream==
[[File:Onvif Device Manager ODM.png|thumb|ODM streaming the Thermal view]]
when first connecting it to power and Ethernet, the camera will have 192.168.1.102 as a Static ip.

If you are running a 192.168.0.x or .178.x net, you need to change it or add a subnet under windows ipv4 settings.

to view it, you can use VLC and the stream URL
rtsp://admin@admin:<camera ip>/ONVIFMedia
there is /ONVIFMedia /ONVIFMediaM and /ONVIFMediaS for different stream Profiles.

VLC is quite slow and delayed, rather use Onvif Device Manager ODM,

it has no delay and auto-detects cameras in the network.

Be sure to log in as user: admin pass: admin in ODM.

in there, you can also set you camera to DHCP under Network settings.

===Web Interface===
[[File:Dali D8X3N web interface.png|thumb|Since browsers cant display RTSP anymore, open in Edge and select IE Compatibility Mode.]]
the web interface can be accessed by opening the camera IP in a browser

login is:
user: admin pass: admin
You can set Temperature markers and areas, but without using the Black Body calibration source, your readings may be way off or not working.

 

====OSD====
there is a debug-login with
user: super pass: 871897
that lets you send Key commands to the Imager to navigate the OSD.

Setting the OSD to english is accomplished with option #11
[[File:Dali D8X3C OSD.png|thumb|OSD in english, if yours is Chinese. go to option #11 and click + or -]]

To acces some locked menus, press
+ - + - + -

The password for the locked System and Main menu is
+-MC+-

Be careful in the UART menu to not change the BAUD rate or Protocol, as your ability to control it via the Web API gets lost.

You need to reflash or solder buttons on the thermal core then.

==Viewing Raw Thermal Data from the Web API==
there is a hidden endpoint in the stream.so file that could be found while decompiling

accessing
[[File:Arduino Nano blink sketch thermal gif.gif|thumb|Arduino Nano running blink sketch while thermally recording it, notice the led and resistor on the right]]
<ip of camera>:5000/stream?Type=JPEG&Source=Jpeg&Mode=TCP
lets you download a JPEG. but there are more options available (not all have been tested)

we are mainly interessted in Raw thermal data.

====Source (Stream Type)====

*<code>Major</code> - Main video stream (channel 0)
*<code>Minor</code> - Sub video stream (channel 1)
*<code>MinorAV</code> - Sub video + audio stream
*<code>MajorAV</code> - Main video + audio stream
*<code>Jpeg</code> - JPEG snapshot stream
*<code>Raw</code> - Raw thermal data stream
*<code>YUV</code> - YUV raw video stream

====Type (Data Format)====

*<code>H264</code> - H.264 video encoding
*<code>JPEG</code> - JPEG image format
*<code>RAW</code> - Raw sensor data
*<code>QBOX</code> - Custom protocol format
*<code>FRAME</code> - Frame-based format

====Mode (Transport Protocol)====

*<code>TCP</code> - TCP streaming (default)
*<code>UDP</code> - UDP streaming
*<code>MUL</code> - Multicast streaming

====Quality Parameters====

*<code>Quality=[1-100]</code> - Video quality level
*<code>Frames=[number]</code> - Number of frames to send
*<code>Interval=[ms]</code> - Frame interval in milliseconds

====Network Parameters====

*<code>IPAddr=[ip]</code> - Client IP address for UDP/multicast
*<code>Port=[port]</code> - Client port for UDP/multicast
*<code>Heart-beat=[Yes/No]</code> - Enable/disable heartbeat

====Snapshot Parameters====

*<code>Snap=[Yes/No]</code> - Enable snapshot mode

 
====Raw Viewer for PC (Python)====
[[File:Dali D8X3N Raw Thermal viewer.png|thumb|Raw Data Viewer in python]]

To view the raw stream, i made a python program that converts the 14bit thermal data to a visible image.

it is low fps tho, due to bad optimizations.

rev1 first working version https://pastebin.com/dyNWDPT3

rev2 with temperature readout https://pastebin.com/u107Q85w

rev3 and onward will only be available directly as a Webpage on the Device (see below).

====Raw Viewer for the internal Webserver (recommended)====
It is also possible to use the Raw viewer directly in the browser.

To achieve this, the stream had to be proxied from port 5000 to 80 due to CORS.

luckily the internal lighttpd had the CGI module enabled, so piping it troug (using wget ... i know) worked with very low overhead.

To install, you need '''Terminal access''' to the Camera. see below.

optional for simplicity: '''ftp''' access

[[File:Dali D8X3N Webviewer.png|thumb|Web Raw Viewer with histogram (rev3)]]

Create the files and the code inside.

'''/app/web/webpages/raw.html''' https://pastebin.com/kaiXwAgD

and

'''/app/web/webpages/cgi-bin/proxy.cgi''' https://pastebin.com/vii1HXcU

then run
chmod +x /app/web/webpages/cgi-bin/proxy.cgi
'''restart''' your camera.

It should be accessible now trough '''http://<camera ip>/raw.html''' in the browser and click Start Stream

'''NOTE''': ''If it does not work'', check the contents of both files. FTP sometimes messes them up.

also run
dos2unix /app/web/webpages/cgi-bin/proxy.cgi
because linux <> windows difficulties that couldnt be resolved in over 30 years.

<blockquote>

performance may need improvement.</blockquote>

==Getting Root Terminal Access==
To access the Terminal you need to solder or plug in a UART connection to Connector J7 on the "Glue" board.

Pinout is (left to right) '''RX TX GND 3.3V Baud 115200 3.3V!'''

But the system will spam with debug messages, making patching the files a hard job unless you use "tftp" or "sed" commands.
 

====Enabling Telnet access to make patching easier====
[[File:Upgrade ici dali firmware updater.png|thumb|ICI Firmware updater software with modified firmware loaded]]

there is a easier way using a modified Firmware updater to enable Telnet temporarily to patch the Files.

Download the '''upgrade_ici.exe''' form [https://archive.org/details/fwupdate here] and run it.

Then you should be able to connect to it via Telnet.

The Login credentials are '''User: roo'''t '''Password: DLroot'''

 

===Patching Device===

===Patching the Web Server===
 

====Enabling Telnet and ftpd permanently====

This only works if you also patch the Thermal Camera module flash!

to permanently enable Telnet, go to '''/etc/init.d''' and edit '''S90app'''
vi S90app
in vi, move your cursor to the '''#''' at '''#telnetd''' and press x<blockquote>optional: enable ftp by removing the '''#''' at '''ftpd''' and adjust the path to / </blockquote>now press ''':''' and type '''wq''' and hit '''enter'''. this should be it.

====Patching the decoder and streamer to 640x480:====
go to /app and edit the mach.cfg

replace DL384 with D640 and edit the resolution to 640 480

(press i in vi to enter edit mode, press ESC to exit edit mode. :wq to write and quit.)

repeat that procedure for the dali.cfg

=====(optional) patching app.sh to prevent it from rebooting=====
edit the app.sh in /app and remove all "reboot" occasions to prevent the camera from rebooting if onvifserver, httpd or daliServer arent running for debugging purposes.

 

====Patching the Thermal Camera module====
To patch it, you need to disassemble everything down to the FPGA Board,

on the bottom there is a SPI SOIC8 Flash.

Use a CH341 EEPROM programmer (be sure to have a fixed or modified version to not put out 5V!, set it to 3.3V) and SOIC8 clamp.

Use NeoProgrammer (i used 2.2.0.10 but there are newer available, use the latest) and click Detect. It should find W25Q128 chips, select the FV one.

Dont forget to download a backup of your flash and save it !

Download the Binary "Dali 640x480 '''actual''' cleared pixelmap.bin" from #3 below and load it into NeoProgrammer,

Click Erase, Program and Verify.

This can take a while.

Your imager should start up right after assembly by hearing the shutter click.

==Hardware Hacking==

===Flash Contents===
On archive, click on show all files to download them.

<nowiki>#</nowiki>1 a Flash dump of the original downgraded D8X3N can be found [https://archive.org/details/dali-d-843n-flash-dump here]

<nowiki>#</nowiki>2 a Flash dump of a original 640x480 model can be found [https://archive.org/details/d-843-n-640x-480 here]

<nowiki>#</nowiki>3 a modified Flash dump of a 640x480 with cleared dead pixel map, flat map etc. can be found [https://archive.org/details/d-843-n-640x-480-cleared-pixelmap here]

a Flash dump of the web server SPI flash W25Q256JV can be found [https://archive.org/details/dm-60-webserver-flash-dump here] in case a bad firmware update caused a bootloop.

 

===Flash Binary Analysis===
The Flash IC is a Winbond 25Q128JV SPI Flash that contains the FPGA Bitstream, Deadpixel and Flatmap, aswell as the Device Settings.

a copy of the SPI Logic Capture at startup can be found [https://archive.org/details/dali-eeprom-capture here], the free software [https://www.dreamsourcelab.com/download/ DSView from DreamSourceLab] is required to view it.
[[File:Dali Thermal Imager SPI Flash capture.png|thumb|SPI Flash access while booting the Thermal Module]]

a approximation of the offsets resulted in this list:<syntaxhighlight lang="vb">
0x000000 - altera cyclone iv stuff
0x200000 - settings
0x280000 - Flat field correction map
0x4C0000 - Bad Pixel correctio nmap
0x580000 - image aswell? 36010 bytes
0x740000 - GUIX?
0x7C0000 - Strings for Gui?
0x800000 - another shorter GUIX
0x880000 - Strings for second gui?
0x8C0000 - GUIX
0x940000 - Strings for gui
0xE00000 - ?
0xE80000 - dzxg? short
0xEC0000 - crosshair.bmp
0xF40000 - 3DTM?
0xF80000 - fake? Bad pixel map BPRP
</syntaxhighlight> 

====Settings offset 0x200000====
The settings are read and written every startup, aswell when you close the OSD, sporadically and when executing the command MSV

these are some of the settings i could figure out by changing and watching the logic capture what changed.
 <syntaxhighlight lang="vb">
offset size Cmd
0x0 1 SAG (0-2) auto gain
0x2 2 SVB (0-16383) saved value is 16383 - SVB
0x4 2 SVC (0-1023) set exposure or gain
0x6 1 SSM image filtering
0x8 1 SEH image enhancement
0xA 1 SWP invert b/w polarity
0x14 1 SMR Flip
0x16 1 SMR Mirror
0x20 1 MENU Cal source 0 IN, 1 OUT
0x3A 1 MENU Enhance value 0-100
0x40 1 MENU Rectify (shutter 0 OFF, 1 L, 2 H)
0x50 1 MENU Language 0 english, 1 chinese, 2 russian
0xA2 - SCO set contrast gain
0xA4 - IBR set brightness
0xAE 2 MENU Fire Threshold
0xAC 1 SPA set color palette
0xE2 1 SMS display "collected 0/80" enabled
0xF8 1 SEM set emissivity
0x110 1 SRT set revise temp
0x116 1 SHD set humidity
0x118 1 SET set ambient temp
0x11A 1 STD set temp range
0x120 2 SLG -500 to 500?
0x124 2 SRD set distance
0x12C 1 SCP ???
0x130 2 SCT ???
</syntaxhighlight> 
[[File:Dali D8X3N Bad Pixel Map Viewer.png|thumb|Bad pixel map of a 640x512 sensor, about 0.56% of dead pixels in this map]]
So i let the AI create a [https://2476424.playcode.io/ Configurator page] that lets you change the Settings in your Flashdump to your liking
 

====Bad Pixel and Flatframe Maps 0x280000 and 0x4C0000====
Thermal cameras require a bad pixel and flat frame map to compensate for manufacturing inconsistencies.

unfourtainly, the maps of the downgraded cameras only contain enough data for a 384 model, not the full 640.

at offset 0xF80000 there is a BPRP which was mistaken at first as the Bad pixel map, it could just be a mask to where to apply the offset maps, as its either 0x0 or 0x1.

The [https://2477569.playcode.io/ Viewer Page] is written in JS and does not require any special dependencies, it can run as a plain html file offline.

There still needs to be work done to create own maps and flatfields but the cameras are still very capable and useable with fully cleared maps.

To clear the maps, just go to these offsets and fill with values around 0x3F or 0x0 for total length of X Resolution x Y Resolution x 2 bytes (0x96000 for 640x480)

[[File:Dali D8X3N Flat Field Map Viewer.png|thumb|Flat Field viewer]]

==Dali Commands==
To control the TIM you can either use Pelco or Dali command set. By default the Dali commandset is used at 38400 BAUD.

Those commands consist of a 0x02 start byte followed by two length Bytes, then the actual command which is allways 3 uppercase Letters in ASCII (eg. KBD for keyboard) followed by a comma and the values.

Some commands take multiple values, some dont. But you allways have to send the comma after the Command.

The camera will answer with the Command and 0, 1 or 2. Sending no value counts as zero.
0 is invalid parameters, too few or out of range

1 is OK, valid command

2 is Invalid command

Commands can be sent trough the Web server using the URL Api endpoint or directly trough the UART port.

(keyboard, C button, causes the shutter to do a calibration)
<camera ip>/cgi-bin/dmcmd?Command=KBD,C
Listening to the answer can be done while being in the Linux shell and typing
cat /dev/ttyAMA2 | strings

By bruteforcing the UART with AAA to ZZZ a list of Commands could be obtained, but some with unknown Parameters or functionality yet. including some from a decompiled DM60comm.so module found in /app/modules folder.<syntaxhighlight lang="vb">
KBD KEY Keyboard (F S M C + -)
SSM 0-1 Image Filtering Off/On
GSM 0 Image filter status
SEH 0-1 Image Enhancement Off/On
GEH 0-1 Image enhancer status
SCO 0-255 Set Gain (locked when SAG auto gain is on)
GCO 0-255 Get gain
INT 15-320 set actual gain? not just contrast sometimes disabled?
IBR 0-255 Set brightness
GBR 0-255 Get brightness
SMR 0-3 Mirror mode bit0=horizontal, bit1=vertical
GMR 0 Get rotation/flip
SDT 0-1 displays temp=44.65°C osd, but webserver sends date/time to the cam there....
GDT 0-1 Get temp display active?
GPT Display temp oft SDT
GNU 0-1 Get Shutter closed/open
SNU 0-1 Shutter close / open
STD 0-1 Set Range 0: -20-180°C 1: 100-600°C
GTD 0-1 Get Range
SET °C Set Ambient temperature
GET °C Get Ambient temperature
SEM 0-100 0-1 set emissivity x100
GEM 0-100 Get Emissivity
SRT °C Set revise temperature -100-100 -10-10°
GRT °C Get revise temperature
SRD 100 Set Distance 4.4m x100
GRD 100 Get Distance
SHD 0-100 Set Humidity
GHD 55 Get Humidity
SWP 0-1 invert s/w polarity image
GWP 1 is inverted?
SPA 0-10? Set color palette
GPA 3 white hot
SMV 0-1 Show temperature 3x3 grid?? in combination with GTV maybe
GMV 0
SMS 0-1 displays "collected 0/<number set by SCT>" by SCP delay "saves the daily number of highest temperatures?"
GMS 0
SCT 1-500 sets the amount of "collected" points for SMS
GCT 80
SCP 5-60 "collected" delay in seconds for SMS
GCP 60
SAG 0-2 Auto brightness / gain
GAG 0
SLR 0-9 ???
GLR 0
SRP 0,0 - 639,479 set crosshair position
GRP 320,240 get crosshair position
DRC 0-1 Show crosshair
SLG -500-500 ??
GLG
SCE text ??
GCE 0
SCB text ??
GCB 0
SVB 0-16383 adc offset, exposure? good at 9650
GVB 6733 value is 16383 minus SVB
SVC 1-1023 set contrast but better
GVC 260
SVF 100-? ?? video freaks out 3400 seems good
SVS 100-? ?? video freaks out 3300 seems good
SOT 0-1 ?? sensor supply, looks weird when off.
SZM 1-4 ?
GZM 1
MSV save settings too eeprom
ASV Saves something aswell?
GCS 0 Get Core status & faults
ALD 0,2? video blanks lots of eeprom activity. reload pixel map??
SAV 0-9999 set Fire threshold
GAV 2100 get Fire Threshold
BAC change uart protocol? careful
CBD Displays Recovery successful?
CBS Displays Saved successfully
LRD Displays Recovery successful?
LRS Displays Saved successfully?
LRE Displays Temperature Repair successful?
CBT Displays Calibration successful?
DBP ??? shutter clicks
DPI Show weird pixels
API Hide weird pixels
CCM ??
ASN 0-4 ??
GAB 4 vals ?? 3,-10,50,150
GAN 1 ??
GAR 11 vals ?? 10,10,5,20,35,50,70,90,120,150,180,,
GCM 6 values ??
GFV prints screen gray value?
GIT 200 ??
GTV Get the collected temp values?
PTS echoes but with extra stuff??
QYA 7170 Query Gray Info (information mode)
QYI 7124 Query Gray Average mode
QYM 7512 Query Gray Minimum mode
VTP 400-4000 ??
MTD U/S,0,0 ?? S answers with bytes, U upload bytes?
MTC U/S? ?? S answers with U,0,0, S doesnt.

return 0 invalid params:
STS ??
STT ??
SAC ??
SAH ??
SAS ??
SAT ??
SCX ?? displays crosshair but invalid params
SCY ?? displays crosshair but invalid params
GAC ??
GAH ??
GAS ??
GAT ??
GME ??
GPC ??
GPI ??
GPM ??
GTA ??
GTC ??
GTI ??
GTM ??
GTS ??
GTT ??

answer only:

BPM 0-1 stream ready? answers with 0 stop, 1 go, 2 when prompted
AVS 0,1
MEH
PWI 0-1 changing palette from wh to fire

unconfirmed (from dm60comm.so):
SDT 2024,03,15,14,30,25 Set Date Time with year,month,day,hour,minute,second
STS 1 Set Temperature Show display (0=off, 1=on)
SVA 2 Set Video Auto mode (0=manual, 2=auto)
SMP 0,1,1,0,100,150,200,250,300,350,90,25 Set Measurement Point (type,index,enable,mode,startX,startY,endX,endY,anchorX,anchorY,threshold,color)
STV Stop Temperature View measurements
SPF 5 Set Profile parameter
SVL -10 Set Video Left pan movement (signed value)
SVU -5 Set Video Up tilt movement (signed value)
SVD 5 Set Video Down tilt movement (signed value)
SSP 17,1,0 Set System Parameter (param_id,value,index) #46 temperature format 0 °C, 1 °F, 2 K
SCP Set Current Preset (save current position)
GCP Get Current Preset
STT 300,350 Set Temperature Threshold (low,high values *10)
SDC 1 Set Display Configuration parameter
GCS Get Current Status
GMM Get Memory Map information
GFV Get Frame Value (grayscale data)
GFZ Get Freeze Status
GSI 1 Get System Information (parameter=1)
GSS Get System Status
GSP 21,0 Get System Parameter (param_21=surround temp, value=0)
GTT Get Temperature Threshold range
GTV 1,3,10 Get Temperature Values (enable,type,count)
GNU Get Network Update status (response command)
FRZ Freeze current display frame
LIV Live mode (unfreeze display)
CAL Calibrate system
CCP 3 Call Current Preset (preset number 0-9)
APF 100 Auto Profile setting
MEH Measure Enhancement
BPT Built-in Test
MTC S,0 Measure Temperature Capture (S=start, 0=sequence)
MTG U,0,1024,<data> Measure Temperature Gray data transfer
MTD U,0,1024,<data> Measure Temperature Data transfer
UFP S,0,2048 Update Firmware Prepare (S=start, 0=offset, 2048=size)
UFD S,0,1024 Update Firmware Data transfer
BAB U Buffer operation (U=update)
TTH S,0 Temperature Threshold operation
IPP 192.168.001.102,255.255.255.000,192.168.001.001,192.168.000.001,9989,9998 IP Parameters (IP,netmask,gateway,DNS,port1,port2)
MAC 00:60:A9:10:00:01 MAC Address setting
SNP Set Network Parameters (response command)
QYI Query Gray Info (information mode)
QYA Query Gray Average mode
QYM Query Gray Minimum mode
GAI Get Alarm Info (response command)
YTC <data> Unknown command with data parameter
HTH
LRS
LRD
GAR
DRC
PTS
SCX
SCY
CBT
LRE
CBD
CBS
XXX
GSP
GTT
QYI
QYA
QYM

</syntaxhighlight>

==Secret Menu Overview==
The secret menus Main and System can be openend with the password '''+-MC+-'''

Its structured like this, not all variables have been figured out yet.

The format is Menu: submenu: submenu:

and for menu entries: Name, default value, command, description or messages that pop up.
 <syntaxhighlight lang="vb">
MAIN & SYSTEM PASS: +-MC+-

entries are NAME VALUE COMMAND DESC or if its a folder its just ":"

System:
System:
Gain 255 SCO
Bright 102 IBR
BenDi 100 ?
BenDiContrase 80 ?
DisMode 0 ?
Frequency 48hz (24,25,48,50)
DigitalOut 8-14bit 14bit, BT656(_P), ?, BT601
AutoFocus N ?
Line 1 ?
Ltemp0 11800 ?
LTemp1 11000 ?
HTemp0 9500 ?
HTemp1 8700 ?
DelayTime 0 ?
Enhance 0-1 ?
Enhanced E1 230 ?
FPA_Gain 12pF ? between 4 and 18 at random.
NUCEn N ?

Area:
SE 2 ASN 0-4 "Partition"
INT 200 INT "Points time"
VS 3161 SVS
VF 2800 SVF
Vtemp 1401 VTP
VtempArea Low ?
VtempBase 13500 ?
VtempStep -1 ?
VsStep 8 ?
DeadPixelModel preset / calculate
DP: Cursor to select dead pixels
X 360 position
Y 288 position
AutoBP: 50 Press C to start automatic dotting
Quit? Number of bad pixels 961& "Blind element replacement in progress"
Undo
R2: Save data? blind pixel replacement in progress
Replace Y N = DPI, Y = API
L: Reading parameters
S: Saving parameters

Debug:
Rectify N
DisplayGary N
TE N SDT
AutoE ? ?
AutoVS Y ?
VSGrayH 8000 ?
VSGrayL 7000 ?
Trends 1 ?
Shelter N ?
MotorCon 3 ?
SaveFactoryPara:
LanTyp EN ? LANGUAGE
DisplayMT N ?
Version:
PRJ D843 DLD640 ImLib, MTlib, Soft, Logic

BackDispose:
GammaEN 1 ?
Gain 1 ?
EnhanceEN 0 ?
Hpf_shift 5 ?
Hpf_thrd 5 ?
Enhance 150 ?
Lthrd 50 ?

Monitor:
Opens normal OSD

Alarm Set:
Alarm Switch Y ?
Alarm Mode No ?
Alarm Temperature -1°C ?
Reference Gray Y ?
Alarm Level 1L ?
Alarm Gray 65535 ?
Alarm PointNum 0 ?
Correct Gray 0 ?

Thermometry:
Data Collection 0 SMS
Interval 60 SCP
Ammount 90 SCT
Environment normal ?
Export:
Displays: Exportin normal temperature MTC data
Correction -1 ?
Emissivity 100 SEM
Calibration:
BlackbodyTemp -10 grabs a val from GAB
Save CBS
Cancel CBD
Correction:
BlackbodyTemp -10 Picks from the list GAR
Grayscale 0 SLG
Confirm LRE
Save LRS
Cancel LRD
Ninepoint measurement SMV

Cursor:
Cur N DRC enable cursor
X 320 SRP set cursor position
Y 240 SRP set cursor position

Main:
Auto 2 SAG Auto gain
G 211 SVC
B 10002 SVB
P 1 SWP polarity
Z X ?
Settings:
Image:
FI Y ?
FIValue 0 ? 0-31
Freeze N Freeze image
VE N SMR Vertical flip
HO N SMR Horizontal flip
AutoCali L same as rectify?
O IN internal or external
COM:
Opens UART menu
AvoidburnSwitch OFF enable anti burn in
ProtectedTime 10S duration
AvoidBurn 16383 threshold to trigger antiburn

</syntaxhighlight>

===Automatic Dead Pixels and Flatmap Correction===

It it possible to generate a new flat and dead pixel map automatically within the camera after flashing the cleared-map binary.
 

=====Dead pixels:=====
In the secret menu "System", navigate to Area - DeadPixelModel and set the AutoBP (sensitivity for auto bad pixel finding) to 50 or so. Then press C Button

This can take a while.
[[File:High emissivity peltier black body.jpg|thumb|A Peltier / TEC coated in Candle sood to give it a high emissivity surface. It can be cooled or heated by swapping the polarity. ]]

Afterwards, navigate to S: and press + to save it.
 

=====Flatfield:=====
In the Debug menu navigate to R2 and press +

now place something '''Cold''' infront of the Camera with a high emissivity. (it needs to fill the whole image)

Press '''+''', wait for it to says High temperature.

Place something '''Hot''' infront and press '''+''' again.

Afterwards, save with '''S:''' again.

Flatfield should now be calibrated
 <blockquote>Note: Not all dead pixels are auto detected or get removed. you can manually select them in the Dead pixel editor but its not known yet how to select and correct them.</blockquote>

 

==Using the Thermal module without Webserver==
[[File:Dali D8X3C Breakout board.png|thumb|Breakout board for D8X3C ]]
to use it, you need to interface it directly.

The module will put out a Analog video signal (High-Z, need to buffer when connecting it to 75Ohm Video input)

Also a 8 or 14bit or 8-bit BT656 output.

the header exposes the FPGA JTAG and UART aswell as 6 Hardware Keys to Navigate the OSD.

To interface, you need to make a adapter board with a DF12-50DS-0.5V(86) Docking socket.

A breakout board is still a work in progress

 

==Sensor Pinout==
[[File:Dali DLD384 Sensor pinout basic.png|thumb|basic pinout of a DLD384]]
the pinout of the thermal sensor havent been analyzes much.

besides some supply and Control voltages, 3 clocks and a analog output have been found.

17.5MHz

14.705KHz

50Hz

Dali D8X3N Thermal Camera

2025-08-04T18:00:06Z

Gamerpaddy: /* Raw Viewer for the internal Webserver (recommended) */

=Dali D8X3N Thermal Camera Reverse Engineering=
 

===Introduction===
The [https://www.dali-irtech.com/productinfo/741567.html Dali D8X3N] Thermal Camera module comes in two versions, a 384x288 and 640x480 resolution, utilizing the [http://www.dali-tech.us/products/dld64017m-uncooled-infrared-fpa-detector-86.html DLD Series] of amorphous-Silicon Microbolometers.

They were mainly used in [http://www.dali-tech.us/products/dm60-w--online-body-temperature-thermal-imaging-camera-55.html Dali DM60-W] or WS-1 Body Temperature screening cameras in conjunction with a Black Body radiator set to 37°C to detect infected individuals at the start of the 2020 Covid Pandemic.
[[File:ICI FM320P Innerts.jpg|thumb|Internals. A TP-Link Switch, HikVision Visible Camera and the D8x3N Network thermal camera module]]
[https://infraredcameras.com/ ICI] rebranded these models as FM 320 P and FM 640 P, and distributed them on the local US market, but as the need for such Cameras exploded, those models were built with what was in stock.

So happens, that some of the FM 320 P Models had a DLD640 640x480 instead of a DLD384 384x288 Microbolometer in them, and just got their Firmware modified.

It also could be, because they have excessive amounts of bad pixels outside the 384x288 area, that they were binned to a lower grade.

Discussions about these Cameras started around 2022 in the [https://www.eevblog.com/forum/thermal-imaging/ici-and-dali-thermal-camera-software/ EEVBlog Forums.] when they started to appear secondhand and affordable.

Originally they were priced around US$ 20... 30.000 by ICI, and a unknown amount by Dali Tech.

The Modules specs according to the manufacturer are:

≤50..60mK@F1，300K，50Hz

17 or 25µm pixel pitch

Hisilicon SoC running Linux to provide Onvif and RTSP streams, analysis and a Web UI

 
[[File:Dali D8X3N Module.jpg|thumb|A real 384x288 model with a DLD384 sensor. notice the Productnumber ]]
ICI FM Cameras are found all over Online secondhand marketplaces for scrap Prices, as they are no longer needed.

But you never know, what are you getting. It could be a real DLD384 or the better DLD640 inside. Its a gamble.
 

======640x480 Imagers======
are labeled 22D843 Nxxxx and have a DLD640 sensor in it, they can be upgraded if they run the 384x288 firmware.

======384x288 Imagers======
are labeled 22D883Nxxxx and have a DLD384 sensor in it, they cannot be upgraded

 

==D8X3N Module closer look==
From now on, i will refer to the Thermal Imaging Module as TIM

On the front there is a 2 Element Germanium Lens of a unknown focal length and aperture.

It can be focus-adjusted when unscrewing the clamp around the housing. It can be focussed from infinity down to 10..20cm with some quality loss.
 The outter diameter of the Lens is 42mm with a 1 1/3 inch thread diameter of undetermined pitch.

Dimensions of the germanium elements are 21mm to 3 and 6mm and 14grams in weight.
[[File:Disassembled Thermal Camera Lens.jpg|thumb|Two element Germanium Lens of unknown focal length and aperture]]

The TIM is composed of 6 Stacked PCB modules, 3 of which are for the Web Server functionality. taking them off will give you the basic configuration of a [https://www.dalithermal.com/productinfo/741568.html Dali D8X3C] TIM<gallery>
File:Dali DLD640 Thermal Image Sensor.jpeg|DLD640 Sensor
File:Dali DLD384 Thermal Imaging Sensor.jpeg|DLD384 Sensor
File:Dali D8X3N Board1 Back.jpeg|Network & GPIO Board Back
File:Dali D8X3N Board1 Front.jpeg|Network & GPIO Board Front
File:Dali D8X3N Glue Board Back.jpeg|Board between Logic and IO Back
File:Dali D8X3N Glue Board Front.jpeg|Board between Logic and IO Front
File:Dali D8X3N SoC Board Back.jpeg|SoC Board back
File:Dali D8X3N SoC Board front.jpeg|SoC board front
File:Dali D8X3N FPGA Board Back.jpeg|FPGA Board of the D8X3C Thermal Imager including a PMIC
File:Dali D8X3N FPGA Board Front.jpeg|FPGA Board Front with Video DAC and SPI Flash
File:Dali D8X3N Sensor Power and ADC Board.jpeg|Sensor control and ADC board
File:Dali D8X3N Thermal Core Debug wiring.jpeg|Debug wiring for sniffing SPI and UART
</gallery>

===User Manual===
including pinout diagram and important data

can be found here https://archive.org/details/dali-d-8-x-3-cuser-manualen-v-1.0-1

==Viewing the Video Stream==
[[File:Onvif Device Manager ODM.png|thumb|ODM streaming the Thermal view]]
when first connecting it to power and Ethernet, the camera will have 192.168.1.102 as a Static ip.

If you are running a 192.168.0.x or .178.x net, you need to change it or add a subnet under windows ipv4 settings.

to view it, you can use VLC and the stream URL
rtsp://admin@admin:<camera ip>/ONVIFMedia
there is /ONVIFMedia /ONVIFMediaM and /ONVIFMediaS for different stream Profiles.

VLC is quite slow and delayed, rather use Onvif Device Manager ODM,

it has no delay and auto-detects cameras in the network.

Be sure to log in as user: admin pass: admin in ODM.

in there, you can also set you camera to DHCP under Network settings.

===Web Interface===
[[File:Dali D8X3N web interface.png|thumb|Since browsers cant display RTSP anymore, open in Edge and select IE Compatibility Mode.]]
the web interface can be accessed by opening the camera IP in a browser

login is:
user: admin pass: admin
You can set Temperature markers and areas, but without using the Black Body calibration source, your readings may be way off or not working.

 

====OSD====
there is a debug-login with
user: super pass: 871897
that lets you send Key commands to the Imager to navigate the OSD.

Setting the OSD to english is accomplished with option #11
[[File:Dali D8X3C OSD.png|thumb|OSD in english, if yours is Chinese. go to option #11 and click + or -]]

To acces some locked menus, press
+ - + - + -

The password for the locked System and Main menu is
+-MC+-

Be careful in the UART menu to not change the BAUD rate or Protocol, as your ability to control it via the Web API gets lost.

You need to reflash or solder buttons on the thermal core then.

==Viewing Raw Thermal Data from the Web API==
there is a hidden endpoint in the stream.so file that could be found while decompiling

accessing
[[File:Arduino Nano blink sketch thermal gif.gif|thumb|Arduino Nano running blink sketch while thermally recording it, notice the led and resistor on the right]]
<ip of camera>:5000/stream?Type=JPEG&Source=Jpeg&Mode=TCP
lets you download a JPEG. but there are more options available (not all have been tested)

we are mainly interessted in Raw thermal data.

====Source (Stream Type)====

*<code>Major</code> - Main video stream (channel 0)
*<code>Minor</code> - Sub video stream (channel 1)
*<code>MinorAV</code> - Sub video + audio stream
*<code>MajorAV</code> - Main video + audio stream
*<code>Jpeg</code> - JPEG snapshot stream
*<code>Raw</code> - Raw thermal data stream
*<code>YUV</code> - YUV raw video stream

====Type (Data Format)====

*<code>H264</code> - H.264 video encoding
*<code>JPEG</code> - JPEG image format
*<code>RAW</code> - Raw sensor data
*<code>QBOX</code> - Custom protocol format
*<code>FRAME</code> - Frame-based format

====Mode (Transport Protocol)====

*<code>TCP</code> - TCP streaming (default)
*<code>UDP</code> - UDP streaming
*<code>MUL</code> - Multicast streaming

====Quality Parameters====

*<code>Quality=[1-100]</code> - Video quality level
*<code>Frames=[number]</code> - Number of frames to send
*<code>Interval=[ms]</code> - Frame interval in milliseconds

====Network Parameters====

*<code>IPAddr=[ip]</code> - Client IP address for UDP/multicast
*<code>Port=[port]</code> - Client port for UDP/multicast
*<code>Heart-beat=[Yes/No]</code> - Enable/disable heartbeat

====Snapshot Parameters====

*<code>Snap=[Yes/No]</code> - Enable snapshot mode

 
====Raw Viewer for PC (Python)====
[[File:Dali D8X3N Raw Thermal viewer.png|thumb|Raw Data Viewer in python]]

To view the raw stream, i made a python program that converts the 14bit thermal data to a visible image.

it is low fps tho, due to bad optimizations.

rev1 first working version https://pastebin.com/dyNWDPT3

rev2 with temperature readout https://pastebin.com/u107Q85w

rev3 and onward will only be available directly as a Webpage on the Device (see below).

====Raw Viewer for the internal Webserver (recommended)====
It is also possible to use the Raw viewer directly in the browser.

To achieve this, the stream had to be proxied from port 5000 to 80 due to CORS.

luckily the internal lighttpd had the CGI module enabled, so piping it troug (using wget ... i know) worked with very low overhead.

To install, you need '''Terminal access''' to the Camera. see below.

optional for simplicity: '''ftp''' access

[[File:Dali D8X3N Webviewer.png|thumb|Web Raw Viewer with histogram (rev3)]]

Create the files and the code inside.

'''/app/web/webpages/raw.html''' https://pastebin.com/kaiXwAgD

and

'''/app/web/webpages/cgi-bin/proxy.cgi''' https://pastebin.com/vii1HXcU

then run
chmod +x /app/web/webpages/cgi-bin/proxy.cgi
'''restart''' your camera.

It should be accessible now trough '''http://<camera ip>/raw.html''' in the browser and click Start Stream

'''NOTE''': ''If it does not work'', check the contents of both files. FTP sometimes messes them up.

also run
dos2unix /app/web/webpages/cgi-bin/proxy.cgi
because linux <> windows difficulties that couldnt be resolved in over 30 years.

<blockquote>

performance may need improvement.</blockquote>

==Getting Root Terminal Access==
To access the Terminal you need to solder or plug in a UART connection to Connector J7 on the "Glue" board.

Pinout is (left to right) '''RX TX GND 3.3V Baud 115200 3.3V!'''

But the system will spam with debug messages, making patching the files a hard job unless you use "tftp" or "sed" commands.
 

====Enabling Telnet access to make patching easier====
[[File:Upgrade ici dali firmware updater.png|thumb|ICI Firmware updater software with modified firmware loaded]]

there is a easier way using a modified Firmware updater to enable Telnet temporarily to patch the Files.

Download the '''upgrade_ici.exe''' form [https://archive.org/details/fwupdate here] and run it.

Then you should be able to connect to it via Telnet.

The Login credentials are '''User: roo'''t '''Password: DLroot'''

 

===Patching Device===

===Patching the Web Server===
 

====Enabling Telnet and ftpd permanently====

This only works if you also patch the Thermal Camera module flash!

to permanently enable Telnet, go to '''/etc/init.d''' and edit '''S90app'''
vi S90app
in vi, move your cursor to the '''#''' at '''#telnetd''' and press x<blockquote>optional: enable ftp by removing the '''#''' at '''ftpd''' and adjust the path to / </blockquote>now press ''':''' and type '''wq''' and hit '''enter'''. this should be it.

====Patching the decoder and streamer to 640x480:====
go to /app and edit the mach.cfg

replace DL384 with D640 and edit the resolution to 640 480

(press i in vi to enter edit mode, press ESC to exit edit mode. :wq to write and quit.)

repeat that procedure for the dali.cfg

=====(optional) patching app.sh to prevent it from rebooting=====
edit the app.sh in /app and remove all "reboot" occasions to prevent the camera from rebooting if onvifserver, httpd or daliServer arent running for debugging purposes.

 

====Patching the Thermal Camera module====
To patch it, you need to disassemble everything down to the FPGA Board,

on the bottom there is a SPI SOIC8 Flash.

Use a CH341 EEPROM programmer (be sure to have a fixed or modified version to not put out 5V!, set it to 3.3V) and SOIC8 clamp.

Use NeoProgrammer (i used 2.2.0.10 but there are newer available, use the latest) and click Detect. It should find W25Q128 chips, select the FV one.

Dont forget to download a backup of your flash and save it !

Download the Binary "Dali 640x480 '''actual''' cleared pixelmap.bin" from #3 below and load it into NeoProgrammer,

Click Erase, Program and Verify.

This can take a while.

Your imager should start up right after assembly by hearing the shutter click.

==Hardware Hacking==

===Flash Contents===
On archive, click on show all files to download them.

<nowiki>#</nowiki>1 a Flash dump of the original downgraded D8X3N can be found [https://archive.org/details/dali-d-843n-flash-dump here]

<nowiki>#</nowiki>2 a Flash dump of a original 640x480 model can be found [https://archive.org/details/d-843-n-640x-480 here]

<nowiki>#</nowiki>3 a modified Flash dump of a 640x480 with cleared dead pixel map, flat map etc. can be found [https://archive.org/details/d-843-n-640x-480-cleared-pixelmap here]

a Flash dump of the web server SPI flash W25Q256JV can be found [https://archive.org/details/dm-60-webserver-flash-dump here] in case a bad firmware update caused a bootloop.

 

===Flash Binary Analysis===
The Flash IC is a Winbond 25Q128JV SPI Flash that contains the FPGA Bitstream, Deadpixel and Flatmap, aswell as the Device Settings.

a copy of the SPI Logic Capture at startup can be found [https://archive.org/details/dali-eeprom-capture here], the free software [https://www.dreamsourcelab.com/download/ DSView from DreamSourceLab] is required to view it.
[[File:Dali Thermal Imager SPI Flash capture.png|thumb|SPI Flash access while booting the Thermal Module]]

a approximation of the offsets resulted in this list:<syntaxhighlight lang="vb">
0x000000 - altera cyclone iv stuff
0x200000 - settings
0x280000 - Flat field correction map
0x4C0000 - Bad Pixel correctio nmap
0x580000 - image aswell? 36010 bytes
0x740000 - GUIX?
0x7C0000 - Strings for Gui?
0x800000 - another shorter GUIX
0x880000 - Strings for second gui?
0x8C0000 - GUIX
0x940000 - Strings for gui
0xE00000 - ?
0xE80000 - dzxg? short
0xEC0000 - crosshair.bmp
0xF40000 - 3DTM?
0xF80000 - fake? Bad pixel map BPRP
</syntaxhighlight> 

====Settings offset 0x200000====
The settings are read and written every startup, aswell when you close the OSD, sporadically and when executing the command MSV

these are some of the settings i could figure out by changing and watching the logic capture what changed.
 <syntaxhighlight lang="vb">
offset size Cmd
0x0 1 SAG (0-2) auto gain
0x2 2 SVB (0-16383) saved value is 16383 - SVB
0x4 2 SVC (0-1023) set exposure or gain
0x6 1 SSM image filtering
0x8 1 SEH image enhancement
0xA 1 SWP invert b/w polarity
0x14 1 SMR Flip
0x16 1 SMR Mirror
0x20 1 MENU Cal source 0 IN, 1 OUT
0x3A 1 MENU Enhance value 0-100
0x40 1 MENU Rectify (shutter 0 OFF, 1 L, 2 H)
0x50 1 MENU Language 0 english, 1 chinese, 2 russian
0xA2 - SCO set contrast gain
0xA4 - IBR set brightness
0xAE 2 MENU Fire Threshold
0xAC 1 SPA set color palette
0xE2 1 SMS display "collected 0/80" enabled
0xF8 1 SEM set emissivity
0x110 1 SRT set revise temp
0x116 1 SHD set humidity
0x118 1 SET set ambient temp
0x11A 1 STD set temp range
0x120 2 SLG -500 to 500?
0x124 2 SRD set distance
0x12C 1 SCP ???
0x130 2 SCT ???
</syntaxhighlight> 
[[File:Dali D8X3N Bad Pixel Map Viewer.png|thumb|Bad pixel map of a 640x512 sensor, about 0.56% of dead pixels in this map]]
So i let the AI create a [https://2476424.playcode.io/ Configurator page] that lets you change the Settings in your Flashdump to your liking
 

====Bad Pixel and Flatframe Maps 0x280000 and 0x4C0000====
Thermal cameras require a bad pixel and flat frame map to compensate for manufacturing inconsistencies.

unfourtainly, the maps of the downgraded cameras only contain enough data for a 384 model, not the full 640.

at offset 0xF80000 there is a BPRP which was mistaken at first as the Bad pixel map, it could just be a mask to where to apply the offset maps, as its either 0x0 or 0x1.

The [https://2477569.playcode.io/ Viewer Page] is written in JS and does not require any special dependencies, it can run as a plain html file offline.

There still needs to be work done to create own maps and flatfields but the cameras are still very capable and useable with fully cleared maps.

To clear the maps, just go to these offsets and fill with values around 0x3F or 0x0 for total length of X Resolution x Y Resolution x 2 bytes (0x96000 for 640x480)

[[File:Dali D8X3N Flat Field Map Viewer.png|thumb|Flat Field viewer]]

==Dali Commands==
To control the TIM you can either use Pelco or Dali command set. By default the Dali commandset is used at 38400 BAUD.

Those commands consist of a 0x02 start byte followed by two length Bytes, then the actual command which is allways 3 uppercase Letters in ASCII (eg. KBD for keyboard) followed by a comma and the values.

Some commands take multiple values, some dont. But you allways have to send the comma after the Command.

The camera will answer with the Command and 0, 1 or 2. Sending no value counts as zero.
0 is invalid parameters, too few or out of range

1 is OK, valid command

2 is Invalid command

Commands can be sent trough the Web server using the URL Api endpoint or directly trough the UART port.

(keyboard, C button, causes the shutter to do a calibration)
<camera ip>/cgi-bin/dmcmd?Command=KBD,C
Listening to the answer can be done while being in the Linux shell and typing
cat /dev/ttyAMA2 | strings

By bruteforcing the UART with AAA to ZZZ a list of Commands could be obtained, but some with unknown Parameters or functionality yet. including some from a decompiled DM60comm.so module found in /app/modules folder.<syntaxhighlight lang="vb">
KBD KEY Keyboard (F S M C + -)
SSM 0-1 Image Filtering Off/On
GSM 0 Image filter status
SEH 0-1 Image Enhancement Off/On
GEH 0-1 Image enhancer status
SCO 0-255 Set Gain (locked when SAG auto gain is on)
GCO 0-255 Get gain
INT 15-320 set actual gain? not just contrast sometimes disabled?
IBR 0-255 Set brightness
GBR 0-255 Get brightness
SMR 0-3 Mirror mode bit0=horizontal, bit1=vertical
GMR 0 Get rotation/flip
SDT 0-1 displays temp=44.65°C osd, but webserver sends date/time to the cam there....
GDT 0-1 Get temp display active?
GPT Display temp oft SDT
GNU 0-1 Get Shutter closed/open
SNU 0-1 Shutter close / open
STD 0-1 Set Range 0: -20-180°C 1: 100-600°C
GTD 0-1 Get Range
SET °C Set Ambient temperature
GET °C Get Ambient temperature
SEM 0-100 0-1 set emissivity x100
GEM 0-100 Get Emissivity
SRT °C Set revise temperature -100-100 -10-10°
GRT °C Get revise temperature
SRD 100 Set Distance 4.4m x100
GRD 100 Get Distance
SHD 0-100 Set Humidity
GHD 55 Get Humidity
SWP 0-1 invert s/w polarity image
GWP 1 is inverted?
SPA 0-10? Set color palette
GPA 3 white hot
SMV 0-1 Show temperature 3x3 grid?? in combination with GTV maybe
GMV 0
SMS 0-1 displays "collected 0/<number set by SCT>" by SCP delay "saves the daily number of highest temperatures?"
GMS 0
SCT 1-500 sets the amount of "collected" points for SMS
GCT 80
SCP 5-60 "collected" delay in seconds for SMS
GCP 60
SAG 0-2 Auto brightness / gain
GAG 0
SLR 0-9 ???
GLR 0
SRP 0,0 - 639,479 set crosshair position
GRP 320,240 get crosshair position
DRC 0-1 Show crosshair
SLG -500-500 ??
GLG
SCE text ??
GCE 0
SCB text ??
GCB 0
SVB 0-16383 adc offset, exposure? good at 9650
GVB 6733 value is 16383 minus SVB
SVC 1-1023 set contrast but better
GVC 260
SVF 100-? ?? video freaks out 3400 seems good
SVS 100-? ?? video freaks out 3300 seems good
SOT 0-1 ?? sensor supply, looks weird when off.
SZM 1-4 ?
GZM 1
MSV save settings too eeprom
ASV Saves something aswell?
GCS 0 Get Core status & faults
ALD 0,2? video blanks lots of eeprom activity. reload pixel map??
SAV 0-9999 set Fire threshold
GAV 2100 get Fire Threshold
BAC change uart protocol? careful
CBD Displays Recovery successful?
CBS Displays Saved successfully
LRD Displays Recovery successful?
LRS Displays Saved successfully?
LRE Displays Temperature Repair successful?
CBT Displays Calibration successful?
DBP ??? shutter clicks
DPI Show weird pixels
API Hide weird pixels
CCM ??
ASN 0-4 ??
GAB 4 vals ?? 3,-10,50,150
GAN 1 ??
GAR 11 vals ?? 10,10,5,20,35,50,70,90,120,150,180,,
GCM 6 values ??
GFV prints screen gray value?
GIT 200 ??
GTV Get the collected temp values?
PTS echoes but with extra stuff??
QYA 7170 Query Gray Info (information mode)
QYI 7124 Query Gray Average mode
QYM 7512 Query Gray Minimum mode
VTP 400-4000 ??
MTD U/S,0,0 ?? S answers with bytes, U upload bytes?
MTC U/S? ?? S answers with U,0,0, S doesnt.

return 0 invalid params:
STS ??
STT ??
SAC ??
SAH ??
SAS ??
SAT ??
SCX ?? displays crosshair but invalid params
SCY ?? displays crosshair but invalid params
GAC ??
GAH ??
GAS ??
GAT ??
GME ??
GPC ??
GPI ??
GPM ??
GTA ??
GTC ??
GTI ??
GTM ??
GTS ??
GTT ??

answer only:

BPM 0-1 stream ready? answers with 0 stop, 1 go, 2 when prompted
AVS 0,1
MEH
PWI 0-1 changing palette from wh to fire

unconfirmed (from dm60comm.so):
SDT 2024,03,15,14,30,25 Set Date Time with year,month,day,hour,minute,second
STS 1 Set Temperature Show display (0=off, 1=on)
SVA 2 Set Video Auto mode (0=manual, 2=auto)
SMP 0,1,1,0,100,150,200,250,300,350,90,25 Set Measurement Point (type,index,enable,mode,startX,startY,endX,endY,anchorX,anchorY,threshold,color)
STV Stop Temperature View measurements
SPF 5 Set Profile parameter
SVL -10 Set Video Left pan movement (signed value)
SVU -5 Set Video Up tilt movement (signed value)
SVD 5 Set Video Down tilt movement (signed value)
SSP 17,1,0 Set System Parameter (param_id,value,index) #46 temperature format 0 °C, 1 °F, 2 K
SCP Set Current Preset (save current position)
GCP Get Current Preset
STT 300,350 Set Temperature Threshold (low,high values *10)
SDC 1 Set Display Configuration parameter
GCS Get Current Status
GMM Get Memory Map information
GFV Get Frame Value (grayscale data)
GFZ Get Freeze Status
GSI 1 Get System Information (parameter=1)
GSS Get System Status
GSP 21,0 Get System Parameter (param_21=surround temp, value=0)
GTT Get Temperature Threshold range
GTV 1,3,10 Get Temperature Values (enable,type,count)
GNU Get Network Update status (response command)
FRZ Freeze current display frame
LIV Live mode (unfreeze display)
CAL Calibrate system
CCP 3 Call Current Preset (preset number 0-9)
APF 100 Auto Profile setting
MEH Measure Enhancement
BPT Built-in Test
MTC S,0 Measure Temperature Capture (S=start, 0=sequence)
MTG U,0,1024,<data> Measure Temperature Gray data transfer
MTD U,0,1024,<data> Measure Temperature Data transfer
UFP S,0,2048 Update Firmware Prepare (S=start, 0=offset, 2048=size)
UFD S,0,1024 Update Firmware Data transfer
BAB U Buffer operation (U=update)
TTH S,0 Temperature Threshold operation
IPP 192.168.001.102,255.255.255.000,192.168.001.001,192.168.000.001,9989,9998 IP Parameters (IP,netmask,gateway,DNS,port1,port2)
MAC 00:60:A9:10:00:01 MAC Address setting
SNP Set Network Parameters (response command)
QYI Query Gray Info (information mode)
QYA Query Gray Average mode
QYM Query Gray Minimum mode
GAI Get Alarm Info (response command)
YTC <data> Unknown command with data parameter
HTH
LRS
LRD
GAR
DRC
PTS
SCX
SCY
CBT
LRE
CBD
CBS
XXX
GSP
GTT
QYI
QYA
QYM

</syntaxhighlight>

==Secret Menu Overview==
The secret menus Main and System can be openend with the password '''+-MC+-'''

Its structured like this, not all variables have been figured out yet.

The format is Menu: submenu: submenu:

and for menu entries: Name, default value, command, description or messages that pop up.
 <syntaxhighlight lang="vb">
MAIN & SYSTEM PASS: +-MC+-

entries are NAME VALUE COMMAND DESC or if its a folder its just ":"

System:
System:
Gain 255 SCO
Bright 102 IBR
BenDi 100 ?
BenDiContrase 80 ?
DisMode 0 ?
Frequency 48hz (24,25,48,50)
DigitalOut 8-14bit 14bit, BT656(_P), ?, BT601
AutoFocus N ?
Line 1 ?
Ltemp0 11800 ?
LTemp1 11000 ?
HTemp0 9500 ?
HTemp1 8700 ?
DelayTime 0 ?
Enhance 0-1 ?
Enhanced E1 230 ?
FPA_Gain 12pF ? between 4 and 18 at random.
NUCEn N ?

Area:
SE 2 ASN 0-4 "Partition"
INT 200 INT "Points time"
VS 3161 SVS
VF 2800 SVF
Vtemp 1401 VTP
VtempArea Low ?
VtempBase 13500 ?
VtempStep -1 ?
VsStep 8 ?
DeadPixelModel preset / calculate
DP: Cursor to select dead pixels
X 360 position
Y 288 position
AutoBP: 50 Press C to start automatic dotting
Quit? Number of bad pixels 961& "Blind element replacement in progress"
Undo
R2: Save data? blind pixel replacement in progress
Replace Y N = DPI, Y = API
L: Reading parameters
S: Saving parameters

Debug:
Rectify N
DisplayGary N
TE N SDT
AutoE ? ?
AutoVS Y ?
VSGrayH 8000 ?
VSGrayL 7000 ?
Trends 1 ?
Shelter N ?
MotorCon 3 ?
SaveFactoryPara:
LanTyp EN ? LANGUAGE
DisplayMT N ?
Version:
PRJ D843 DLD640 ImLib, MTlib, Soft, Logic

BackDispose:
GammaEN 1 ?
Gain 1 ?
EnhanceEN 0 ?
Hpf_shift 5 ?
Hpf_thrd 5 ?
Enhance 150 ?
Lthrd 50 ?

Monitor:
Opens normal OSD

Alarm Set:
Alarm Switch Y ?
Alarm Mode No ?
Alarm Temperature -1°C ?
Reference Gray Y ?
Alarm Level 1L ?
Alarm Gray 65535 ?
Alarm PointNum 0 ?
Correct Gray 0 ?

Thermometry:
Data Collection 0 SMS
Interval 60 SCP
Ammount 90 SCT
Environment normal ?
Export:
Displays: Exportin normal temperature MTC data
Correction -1 ?
Emissivity 100 SEM
Calibration:
BlackbodyTemp -10 grabs a val from GAB
Save CBS
Cancel CBD
Correction:
BlackbodyTemp -10 Picks from the list GAR
Grayscale 0 SLG
Confirm LRE
Save LRS
Cancel LRD
Ninepoint measurement SMV

Cursor:
Cur N DRC enable cursor
X 320 SRP set cursor position
Y 240 SRP set cursor position

Main:
Auto 2 SAG Auto gain
G 211 SVC
B 10002 SVB
P 1 SWP polarity
Z X ?
Settings:
Image:
FI Y ?
FIValue 0 ? 0-31
Freeze N Freeze image
VE N SMR Vertical flip
HO N SMR Horizontal flip
AutoCali L same as rectify?
O IN internal or external
COM:
Opens UART menu
AvoidburnSwitch OFF enable anti burn in
ProtectedTime 10S duration
AvoidBurn 16383 threshold to trigger antiburn

</syntaxhighlight>

===Automatic Dead Pixels and Flatmap Correction===

It it possible to generate a new flat and dead pixel map automatically within the camera after flashing the cleared-map binary.
 

=====Dead pixels:=====
In the secret menu "System", navigate to Area - DeadPixelModel and set the AutoBP (sensitivity for auto bad pixel finding) to 50 or so. Then press C Button

This can take a while.
[[File:High emissivity peltier black body.jpg|thumb|A Peltier / TEC coated in Candle sood to give it a high emissivity surface. It can be cooled or heated by swapping the polarity. ]]

Afterwards, navigate to S: and press + to save it.
 

=====Flatfield:=====
In the Debug menu navigate to R2 and press +

now place something '''Cold''' infront of the Camera with a high emissivity. (it needs to fill the whole image)

Press '''+''', wait for it to says High temperature.

Place something '''Hot''' infront and press '''+''' again.

Afterwards, save with '''S:''' again.

Flatfield should now be calibrated
 <blockquote>Note: Not all dead pixels are auto detected or get removed. you can manually select them in the Dead pixel editor but its not known yet how to select and correct them.</blockquote>

 

==Using the Thermal module without Webserver==
[[File:Dali D8X3C Breakout board.png|thumb|Breakout board for D8X3C ]]
to use it, you need to interface it directly.

The module will put out a Analog video signal (High-Z, need to buffer when connecting it to 75Ohm Video input)

Also a 8 or 14bit or 8-bit BT656 output.

the header exposes the FPGA JTAG and UART aswell as 6 Hardware Keys to Navigate the OSD.

To interface, you need to make a adapter board with a DF12-50DS-0.5V(86) Docking socket.

The breakout board files can be found [https://oshwlab.com/gamerpaddy/d8x3c-backpack-usb here] but may be still work in progress.

 

==Sensor Pinout==
[[File:Dali DLD384 Sensor pinout basic.png|thumb|basic pinout of a DLD384]]
the pinout of the thermal sensor havent been analyzes much.

besides some supply and Control voltages, 3 clocks and a analog output have been found.

17.5MHz

14.705KHz

50Hz

Dali D8X3N Thermal Camera

2025-08-04T17:49:54Z

Gamerpaddy: /* Automatic Dead Pixels and Flatmap Correction */

=Dali D8X3N Thermal Camera Reverse Engineering=
 

===Introduction===
The [https://www.dali-irtech.com/productinfo/741567.html Dali D8X3N] Thermal Camera module comes in two versions, a 384x288 and 640x480 resolution, utilizing the [http://www.dali-tech.us/products/dld64017m-uncooled-infrared-fpa-detector-86.html DLD Series] of amorphous-Silicon Microbolometers.

They were mainly used in [http://www.dali-tech.us/products/dm60-w--online-body-temperature-thermal-imaging-camera-55.html Dali DM60-W] or WS-1 Body Temperature screening cameras in conjunction with a Black Body radiator set to 37°C to detect infected individuals at the start of the 2020 Covid Pandemic.
[[File:ICI FM320P Innerts.jpg|thumb|Internals. A TP-Link Switch, HikVision Visible Camera and the D8x3N Network thermal camera module]]
[https://infraredcameras.com/ ICI] rebranded these models as FM 320 P and FM 640 P, and distributed them on the local US market, but as the need for such Cameras exploded, those models were built with what was in stock.

So happens, that some of the FM 320 P Models had a DLD640 640x480 instead of a DLD384 384x288 Microbolometer in them, and just got their Firmware modified.

It also could be, because they have excessive amounts of bad pixels outside the 384x288 area, that they were binned to a lower grade.

Discussions about these Cameras started around 2022 in the [https://www.eevblog.com/forum/thermal-imaging/ici-and-dali-thermal-camera-software/ EEVBlog Forums.] when they started to appear secondhand and affordable.

Originally they were priced around US$ 20... 30.000 by ICI, and a unknown amount by Dali Tech.

The Modules specs according to the manufacturer are:

≤50..60mK@F1，300K，50Hz

17 or 25µm pixel pitch

Hisilicon SoC running Linux to provide Onvif and RTSP streams, analysis and a Web UI

 
[[File:Dali D8X3N Module.jpg|thumb|A real 384x288 model with a DLD384 sensor. notice the Productnumber ]]
ICI FM Cameras are found all over Online secondhand marketplaces for scrap Prices, as they are no longer needed.

But you never know, what are you getting. It could be a real DLD384 or the better DLD640 inside. Its a gamble.
 

======640x480 Imagers======
are labeled 22D843 Nxxxx and have a DLD640 sensor in it, they can be upgraded if they run the 384x288 firmware.

======384x288 Imagers======
are labeled 22D883Nxxxx and have a DLD384 sensor in it, they cannot be upgraded

 

==D8X3N Module closer look==
From now on, i will refer to the Thermal Imaging Module as TIM

On the front there is a 2 Element Germanium Lens of a unknown focal length and aperture.

It can be focus-adjusted when unscrewing the clamp around the housing. It can be focussed from infinity down to 10..20cm with some quality loss.
 The outter diameter of the Lens is 42mm with a 1 1/3 inch thread diameter of undetermined pitch.

Dimensions of the germanium elements are 21mm to 3 and 6mm and 14grams in weight.
[[File:Disassembled Thermal Camera Lens.jpg|thumb|Two element Germanium Lens of unknown focal length and aperture]]

The TIM is composed of 6 Stacked PCB modules, 3 of which are for the Web Server functionality. taking them off will give you the basic configuration of a [https://www.dalithermal.com/productinfo/741568.html Dali D8X3C] TIM<gallery>
File:Dali DLD640 Thermal Image Sensor.jpeg|DLD640 Sensor
File:Dali DLD384 Thermal Imaging Sensor.jpeg|DLD384 Sensor
File:Dali D8X3N Board1 Back.jpeg|Network & GPIO Board Back
File:Dali D8X3N Board1 Front.jpeg|Network & GPIO Board Front
File:Dali D8X3N Glue Board Back.jpeg|Board between Logic and IO Back
File:Dali D8X3N Glue Board Front.jpeg|Board between Logic and IO Front
File:Dali D8X3N SoC Board Back.jpeg|SoC Board back
File:Dali D8X3N SoC Board front.jpeg|SoC board front
File:Dali D8X3N FPGA Board Back.jpeg|FPGA Board of the D8X3C Thermal Imager including a PMIC
File:Dali D8X3N FPGA Board Front.jpeg|FPGA Board Front with Video DAC and SPI Flash
File:Dali D8X3N Sensor Power and ADC Board.jpeg|Sensor control and ADC board
File:Dali D8X3N Thermal Core Debug wiring.jpeg|Debug wiring for sniffing SPI and UART
</gallery>

===User Manual===
including pinout diagram and important data

can be found here https://archive.org/details/dali-d-8-x-3-cuser-manualen-v-1.0-1

==Viewing the Video Stream==
[[File:Onvif Device Manager ODM.png|thumb|ODM streaming the Thermal view]]
when first connecting it to power and Ethernet, the camera will have 192.168.1.102 as a Static ip.

If you are running a 192.168.0.x or .178.x net, you need to change it or add a subnet under windows ipv4 settings.

to view it, you can use VLC and the stream URL
rtsp://admin@admin:<camera ip>/ONVIFMedia
there is /ONVIFMedia /ONVIFMediaM and /ONVIFMediaS for different stream Profiles.

VLC is quite slow and delayed, rather use Onvif Device Manager ODM,

it has no delay and auto-detects cameras in the network.

Be sure to log in as user: admin pass: admin in ODM.

in there, you can also set you camera to DHCP under Network settings.

===Web Interface===
[[File:Dali D8X3N web interface.png|thumb|Since browsers cant display RTSP anymore, open in Edge and select IE Compatibility Mode.]]
the web interface can be accessed by opening the camera IP in a browser

login is:
user: admin pass: admin
You can set Temperature markers and areas, but without using the Black Body calibration source, your readings may be way off or not working.

 

====OSD====
there is a debug-login with
user: super pass: 871897
that lets you send Key commands to the Imager to navigate the OSD.

Setting the OSD to english is accomplished with option #11
[[File:Dali D8X3C OSD.png|thumb|OSD in english, if yours is Chinese. go to option #11 and click + or -]]

To acces some locked menus, press
+ - + - + -

The password for the locked System and Main menu is
+-MC+-

Be careful in the UART menu to not change the BAUD rate or Protocol, as your ability to control it via the Web API gets lost.

You need to reflash or solder buttons on the thermal core then.

==Viewing Raw Thermal Data from the Web API==
there is a hidden endpoint in the stream.so file that could be found while decompiling

accessing
[[File:Arduino Nano blink sketch thermal gif.gif|thumb|Arduino Nano running blink sketch while thermally recording it, notice the led and resistor on the right]]
<ip of camera>:5000/stream?Type=JPEG&Source=Jpeg&Mode=TCP
lets you download a JPEG. but there are more options available (not all have been tested)

we are mainly interessted in Raw thermal data.

====Source (Stream Type)====

*<code>Major</code> - Main video stream (channel 0)
*<code>Minor</code> - Sub video stream (channel 1)
*<code>MinorAV</code> - Sub video + audio stream
*<code>MajorAV</code> - Main video + audio stream
*<code>Jpeg</code> - JPEG snapshot stream
*<code>Raw</code> - Raw thermal data stream
*<code>YUV</code> - YUV raw video stream

====Type (Data Format)====

*<code>H264</code> - H.264 video encoding
*<code>JPEG</code> - JPEG image format
*<code>RAW</code> - Raw sensor data
*<code>QBOX</code> - Custom protocol format
*<code>FRAME</code> - Frame-based format

====Mode (Transport Protocol)====

*<code>TCP</code> - TCP streaming (default)
*<code>UDP</code> - UDP streaming
*<code>MUL</code> - Multicast streaming

====Quality Parameters====

*<code>Quality=[1-100]</code> - Video quality level
*<code>Frames=[number]</code> - Number of frames to send
*<code>Interval=[ms]</code> - Frame interval in milliseconds

====Network Parameters====

*<code>IPAddr=[ip]</code> - Client IP address for UDP/multicast
*<code>Port=[port]</code> - Client port for UDP/multicast
*<code>Heart-beat=[Yes/No]</code> - Enable/disable heartbeat

====Snapshot Parameters====

*<code>Snap=[Yes/No]</code> - Enable snapshot mode

 
====Raw Viewer for PC (Python)====
[[File:Dali D8X3N Raw Thermal viewer.png|thumb|Raw Data Viewer in python]]

To view the raw stream, i made a python program that converts the 14bit thermal data to a visible image.

it is low fps tho, due to bad optimizations.

rev1 first working version https://pastebin.com/dyNWDPT3

rev2 with temperature readout https://pastebin.com/u107Q85w

rev3 and onward will only be available directly as a Webpage on the Device (see below).

====Raw Viewer for the internal Webserver (recommended)====
It is also possible to use the Raw viewer directly in the browser.

To achieve this, the stream had to be proxied from port 5000 to 80 due to CORS.

luckily the internal lighttpd had the CGI module enabled, so piping it troug (using wget ... i know) worked with very low overhead.

To install, you need '''Terminal access''' to the Camera. see below.

optional for simplicity: '''ftp''' access

[[File:Dali D8X3N Webviewer.png|thumb|Web Raw Viewer with histogram (rev3)]]

Create the files and the code inside.

'''/app/web/webpages/raw.html''' https://pastebin.com/kaiXwAgD

and

'''/app/web/webpages/cgi-bin/proxy.cgi''' https://pastebin.com/vii1HXcU

then run
chmod +x /app/web/webpages/cgi-bin/proxy.cgi
'''restart''' your camera.

It should be accessible now trough '''http://<camera ip>/raw.html''' in the browser and click Start Stream

 <blockquote>performance may need improvement.</blockquote>

==Getting Root Terminal Access==
To access the Terminal you need to solder or plug in a UART connection to Connector J7 on the "Glue" board.

Pinout is (left to right) '''RX TX GND 3.3V Baud 115200 3.3V!'''

But the system will spam with debug messages, making patching the files a hard job unless you use "tftp" or "sed" commands.
 

====Enabling Telnet access to make patching easier====
[[File:Upgrade ici dali firmware updater.png|thumb|ICI Firmware updater software with modified firmware loaded]]

there is a easier way using a modified Firmware updater to enable Telnet temporarily to patch the Files.

Download the '''upgrade_ici.exe''' form [https://archive.org/details/fwupdate here] and run it.

Then you should be able to connect to it via Telnet.

The Login credentials are '''User: roo'''t '''Password: DLroot'''

 

===Patching Device===

===Patching the Web Server===
 

====Enabling Telnet and ftpd permanently====

This only works if you also patch the Thermal Camera module flash!

to permanently enable Telnet, go to '''/etc/init.d''' and edit '''S90app'''
vi S90app
in vi, move your cursor to the '''#''' at '''#telnetd''' and press x<blockquote>optional: enable ftp by removing the '''#''' at '''ftpd''' and adjust the path to / </blockquote>now press ''':''' and type '''wq''' and hit '''enter'''. this should be it.

====Patching the decoder and streamer to 640x480:====
go to /app and edit the mach.cfg

replace DL384 with D640 and edit the resolution to 640 480

(press i in vi to enter edit mode, press ESC to exit edit mode. :wq to write and quit.)

repeat that procedure for the dali.cfg

=====(optional) patching app.sh to prevent it from rebooting=====
edit the app.sh in /app and remove all "reboot" occasions to prevent the camera from rebooting if onvifserver, httpd or daliServer arent running for debugging purposes.

 

====Patching the Thermal Camera module====
To patch it, you need to disassemble everything down to the FPGA Board,

on the bottom there is a SPI SOIC8 Flash.

Use a CH341 EEPROM programmer (be sure to have a fixed or modified version to not put out 5V!, set it to 3.3V) and SOIC8 clamp.

Use NeoProgrammer (i used 2.2.0.10 but there are newer available, use the latest) and click Detect. It should find W25Q128 chips, select the FV one.

Dont forget to download a backup of your flash and save it !

Download the Binary "Dali 640x480 '''actual''' cleared pixelmap.bin" from #3 below and load it into NeoProgrammer,

Click Erase, Program and Verify.

This can take a while.

Your imager should start up right after assembly by hearing the shutter click.

==Hardware Hacking==

===Flash Contents===
On archive, click on show all files to download them.

<nowiki>#</nowiki>1 a Flash dump of the original downgraded D8X3N can be found [https://archive.org/details/dali-d-843n-flash-dump here]

<nowiki>#</nowiki>2 a Flash dump of a original 640x480 model can be found [https://archive.org/details/d-843-n-640x-480 here]

<nowiki>#</nowiki>3 a modified Flash dump of a 640x480 with cleared dead pixel map, flat map etc. can be found [https://archive.org/details/d-843-n-640x-480-cleared-pixelmap here]

a Flash dump of the web server SPI flash W25Q256JV can be found [https://archive.org/details/dm-60-webserver-flash-dump here] in case a bad firmware update caused a bootloop.

 

===Flash Binary Analysis===
The Flash IC is a Winbond 25Q128JV SPI Flash that contains the FPGA Bitstream, Deadpixel and Flatmap, aswell as the Device Settings.

a copy of the SPI Logic Capture at startup can be found [https://archive.org/details/dali-eeprom-capture here], the free software [https://www.dreamsourcelab.com/download/ DSView from DreamSourceLab] is required to view it.
[[File:Dali Thermal Imager SPI Flash capture.png|thumb|SPI Flash access while booting the Thermal Module]]

a approximation of the offsets resulted in this list:<syntaxhighlight lang="vb">
0x000000 - altera cyclone iv stuff
0x200000 - settings
0x280000 - Flat field correction map
0x4C0000 - Bad Pixel correctio nmap
0x580000 - image aswell? 36010 bytes
0x740000 - GUIX?
0x7C0000 - Strings for Gui?
0x800000 - another shorter GUIX
0x880000 - Strings for second gui?
0x8C0000 - GUIX
0x940000 - Strings for gui
0xE00000 - ?
0xE80000 - dzxg? short
0xEC0000 - crosshair.bmp
0xF40000 - 3DTM?
0xF80000 - fake? Bad pixel map BPRP
</syntaxhighlight> 

====Settings offset 0x200000====
The settings are read and written every startup, aswell when you close the OSD, sporadically and when executing the command MSV

these are some of the settings i could figure out by changing and watching the logic capture what changed.
 <syntaxhighlight lang="vb">
offset size Cmd
0x0 1 SAG (0-2) auto gain
0x2 2 SVB (0-16383) saved value is 16383 - SVB
0x4 2 SVC (0-1023) set exposure or gain
0x6 1 SSM image filtering
0x8 1 SEH image enhancement
0xA 1 SWP invert b/w polarity
0x14 1 SMR Flip
0x16 1 SMR Mirror
0x20 1 MENU Cal source 0 IN, 1 OUT
0x3A 1 MENU Enhance value 0-100
0x40 1 MENU Rectify (shutter 0 OFF, 1 L, 2 H)
0x50 1 MENU Language 0 english, 1 chinese, 2 russian
0xA2 - SCO set contrast gain
0xA4 - IBR set brightness
0xAE 2 MENU Fire Threshold
0xAC 1 SPA set color palette
0xE2 1 SMS display "collected 0/80" enabled
0xF8 1 SEM set emissivity
0x110 1 SRT set revise temp
0x116 1 SHD set humidity
0x118 1 SET set ambient temp
0x11A 1 STD set temp range
0x120 2 SLG -500 to 500?
0x124 2 SRD set distance
0x12C 1 SCP ???
0x130 2 SCT ???
</syntaxhighlight> 
[[File:Dali D8X3N Bad Pixel Map Viewer.png|thumb|Bad pixel map of a 640x512 sensor, about 0.56% of dead pixels in this map]]
So i let the AI create a [https://2476424.playcode.io/ Configurator page] that lets you change the Settings in your Flashdump to your liking
 

====Bad Pixel and Flatframe Maps 0x280000 and 0x4C0000====
Thermal cameras require a bad pixel and flat frame map to compensate for manufacturing inconsistencies.

unfourtainly, the maps of the downgraded cameras only contain enough data for a 384 model, not the full 640.

at offset 0xF80000 there is a BPRP which was mistaken at first as the Bad pixel map, it could just be a mask to where to apply the offset maps, as its either 0x0 or 0x1.

The [https://2477569.playcode.io/ Viewer Page] is written in JS and does not require any special dependencies, it can run as a plain html file offline.

There still needs to be work done to create own maps and flatfields but the cameras are still very capable and useable with fully cleared maps.

To clear the maps, just go to these offsets and fill with values around 0x3F or 0x0 for total length of X Resolution x Y Resolution x 2 bytes (0x96000 for 640x480)

[[File:Dali D8X3N Flat Field Map Viewer.png|thumb|Flat Field viewer]]

==Dali Commands==
To control the TIM you can either use Pelco or Dali command set. By default the Dali commandset is used at 38400 BAUD.

Those commands consist of a 0x02 start byte followed by two length Bytes, then the actual command which is allways 3 uppercase Letters in ASCII (eg. KBD for keyboard) followed by a comma and the values.

Some commands take multiple values, some dont. But you allways have to send the comma after the Command.

The camera will answer with the Command and 0, 1 or 2. Sending no value counts as zero.
0 is invalid parameters, too few or out of range

1 is OK, valid command

2 is Invalid command

Commands can be sent trough the Web server using the URL Api endpoint or directly trough the UART port.

(keyboard, C button, causes the shutter to do a calibration)
<camera ip>/cgi-bin/dmcmd?Command=KBD,C
Listening to the answer can be done while being in the Linux shell and typing
cat /dev/ttyAMA2 | strings

By bruteforcing the UART with AAA to ZZZ a list of Commands could be obtained, but some with unknown Parameters or functionality yet. including some from a decompiled DM60comm.so module found in /app/modules folder.<syntaxhighlight lang="vb">
KBD KEY Keyboard (F S M C + -)
SSM 0-1 Image Filtering Off/On
GSM 0 Image filter status
SEH 0-1 Image Enhancement Off/On
GEH 0-1 Image enhancer status
SCO 0-255 Set Gain (locked when SAG auto gain is on)
GCO 0-255 Get gain
INT 15-320 set actual gain? not just contrast sometimes disabled?
IBR 0-255 Set brightness
GBR 0-255 Get brightness
SMR 0-3 Mirror mode bit0=horizontal, bit1=vertical
GMR 0 Get rotation/flip
SDT 0-1 displays temp=44.65°C osd, but webserver sends date/time to the cam there....
GDT 0-1 Get temp display active?
GPT Display temp oft SDT
GNU 0-1 Get Shutter closed/open
SNU 0-1 Shutter close / open
STD 0-1 Set Range 0: -20-180°C 1: 100-600°C
GTD 0-1 Get Range
SET °C Set Ambient temperature
GET °C Get Ambient temperature
SEM 0-100 0-1 set emissivity x100
GEM 0-100 Get Emissivity
SRT °C Set revise temperature -100-100 -10-10°
GRT °C Get revise temperature
SRD 100 Set Distance 4.4m x100
GRD 100 Get Distance
SHD 0-100 Set Humidity
GHD 55 Get Humidity
SWP 0-1 invert s/w polarity image
GWP 1 is inverted?
SPA 0-10? Set color palette
GPA 3 white hot
SMV 0-1 Show temperature 3x3 grid?? in combination with GTV maybe
GMV 0
SMS 0-1 displays "collected 0/<number set by SCT>" by SCP delay "saves the daily number of highest temperatures?"
GMS 0
SCT 1-500 sets the amount of "collected" points for SMS
GCT 80
SCP 5-60 "collected" delay in seconds for SMS
GCP 60
SAG 0-2 Auto brightness / gain
GAG 0
SLR 0-9 ???
GLR 0
SRP 0,0 - 639,479 set crosshair position
GRP 320,240 get crosshair position
DRC 0-1 Show crosshair
SLG -500-500 ??
GLG
SCE text ??
GCE 0
SCB text ??
GCB 0
SVB 0-16383 adc offset, exposure? good at 9650
GVB 6733 value is 16383 minus SVB
SVC 1-1023 set contrast but better
GVC 260
SVF 100-? ?? video freaks out 3400 seems good
SVS 100-? ?? video freaks out 3300 seems good
SOT 0-1 ?? sensor supply, looks weird when off.
SZM 1-4 ?
GZM 1
MSV save settings too eeprom
ASV Saves something aswell?
GCS 0 Get Core status & faults
ALD 0,2? video blanks lots of eeprom activity. reload pixel map??
SAV 0-9999 set Fire threshold
GAV 2100 get Fire Threshold
BAC change uart protocol? careful
CBD Displays Recovery successful?
CBS Displays Saved successfully
LRD Displays Recovery successful?
LRS Displays Saved successfully?
LRE Displays Temperature Repair successful?
CBT Displays Calibration successful?
DBP ??? shutter clicks
DPI Show weird pixels
API Hide weird pixels
CCM ??
ASN 0-4 ??
GAB 4 vals ?? 3,-10,50,150
GAN 1 ??
GAR 11 vals ?? 10,10,5,20,35,50,70,90,120,150,180,,
GCM 6 values ??
GFV prints screen gray value?
GIT 200 ??
GTV Get the collected temp values?
PTS echoes but with extra stuff??
QYA 7170 Query Gray Info (information mode)
QYI 7124 Query Gray Average mode
QYM 7512 Query Gray Minimum mode
VTP 400-4000 ??
MTD U/S,0,0 ?? S answers with bytes, U upload bytes?
MTC U/S? ?? S answers with U,0,0, S doesnt.

return 0 invalid params:
STS ??
STT ??
SAC ??
SAH ??
SAS ??
SAT ??
SCX ?? displays crosshair but invalid params
SCY ?? displays crosshair but invalid params
GAC ??
GAH ??
GAS ??
GAT ??
GME ??
GPC ??
GPI ??
GPM ??
GTA ??
GTC ??
GTI ??
GTM ??
GTS ??
GTT ??

answer only:

BPM 0-1 stream ready? answers with 0 stop, 1 go, 2 when prompted
AVS 0,1
MEH
PWI 0-1 changing palette from wh to fire

unconfirmed (from dm60comm.so):
SDT 2024,03,15,14,30,25 Set Date Time with year,month,day,hour,minute,second
STS 1 Set Temperature Show display (0=off, 1=on)
SVA 2 Set Video Auto mode (0=manual, 2=auto)
SMP 0,1,1,0,100,150,200,250,300,350,90,25 Set Measurement Point (type,index,enable,mode,startX,startY,endX,endY,anchorX,anchorY,threshold,color)
STV Stop Temperature View measurements
SPF 5 Set Profile parameter
SVL -10 Set Video Left pan movement (signed value)
SVU -5 Set Video Up tilt movement (signed value)
SVD 5 Set Video Down tilt movement (signed value)
SSP 17,1,0 Set System Parameter (param_id,value,index) #46 temperature format 0 °C, 1 °F, 2 K
SCP Set Current Preset (save current position)
GCP Get Current Preset
STT 300,350 Set Temperature Threshold (low,high values *10)
SDC 1 Set Display Configuration parameter
GCS Get Current Status
GMM Get Memory Map information
GFV Get Frame Value (grayscale data)
GFZ Get Freeze Status
GSI 1 Get System Information (parameter=1)
GSS Get System Status
GSP 21,0 Get System Parameter (param_21=surround temp, value=0)
GTT Get Temperature Threshold range
GTV 1,3,10 Get Temperature Values (enable,type,count)
GNU Get Network Update status (response command)
FRZ Freeze current display frame
LIV Live mode (unfreeze display)
CAL Calibrate system
CCP 3 Call Current Preset (preset number 0-9)
APF 100 Auto Profile setting
MEH Measure Enhancement
BPT Built-in Test
MTC S,0 Measure Temperature Capture (S=start, 0=sequence)
MTG U,0,1024,<data> Measure Temperature Gray data transfer
MTD U,0,1024,<data> Measure Temperature Data transfer
UFP S,0,2048 Update Firmware Prepare (S=start, 0=offset, 2048=size)
UFD S,0,1024 Update Firmware Data transfer
BAB U Buffer operation (U=update)
TTH S,0 Temperature Threshold operation
IPP 192.168.001.102,255.255.255.000,192.168.001.001,192.168.000.001,9989,9998 IP Parameters (IP,netmask,gateway,DNS,port1,port2)
MAC 00:60:A9:10:00:01 MAC Address setting
SNP Set Network Parameters (response command)
QYI Query Gray Info (information mode)
QYA Query Gray Average mode
QYM Query Gray Minimum mode
GAI Get Alarm Info (response command)
YTC <data> Unknown command with data parameter
HTH
LRS
LRD
GAR
DRC
PTS
SCX
SCY
CBT
LRE
CBD
CBS
XXX
GSP
GTT
QYI
QYA
QYM

</syntaxhighlight>

==Secret Menu Overview==
The secret menus Main and System can be openend with the password '''+-MC+-'''

Its structured like this, not all variables have been figured out yet.

The format is Menu: submenu: submenu:

and for menu entries: Name, default value, command, description or messages that pop up.
 <syntaxhighlight lang="vb">
MAIN & SYSTEM PASS: +-MC+-

entries are NAME VALUE COMMAND DESC or if its a folder its just ":"

System:
System:
Gain 255 SCO
Bright 102 IBR
BenDi 100 ?
BenDiContrase 80 ?
DisMode 0 ?
Frequency 48hz (24,25,48,50)
DigitalOut 8-14bit 14bit, BT656(_P), ?, BT601
AutoFocus N ?
Line 1 ?
Ltemp0 11800 ?
LTemp1 11000 ?
HTemp0 9500 ?
HTemp1 8700 ?
DelayTime 0 ?
Enhance 0-1 ?
Enhanced E1 230 ?
FPA_Gain 12pF ? between 4 and 18 at random.
NUCEn N ?

Area:
SE 2 ASN 0-4 "Partition"
INT 200 INT "Points time"
VS 3161 SVS
VF 2800 SVF
Vtemp 1401 VTP
VtempArea Low ?
VtempBase 13500 ?
VtempStep -1 ?
VsStep 8 ?
DeadPixelModel preset / calculate
DP: Cursor to select dead pixels
X 360 position
Y 288 position
AutoBP: 50 Press C to start automatic dotting
Quit? Number of bad pixels 961& "Blind element replacement in progress"
Undo
R2: Save data? blind pixel replacement in progress
Replace Y N = DPI, Y = API
L: Reading parameters
S: Saving parameters

Debug:
Rectify N
DisplayGary N
TE N SDT
AutoE ? ?
AutoVS Y ?
VSGrayH 8000 ?
VSGrayL 7000 ?
Trends 1 ?
Shelter N ?
MotorCon 3 ?
SaveFactoryPara:
LanTyp EN ? LANGUAGE
DisplayMT N ?
Version:
PRJ D843 DLD640 ImLib, MTlib, Soft, Logic

BackDispose:
GammaEN 1 ?
Gain 1 ?
EnhanceEN 0 ?
Hpf_shift 5 ?
Hpf_thrd 5 ?
Enhance 150 ?
Lthrd 50 ?

Monitor:
Opens normal OSD

Alarm Set:
Alarm Switch Y ?
Alarm Mode No ?
Alarm Temperature -1°C ?
Reference Gray Y ?
Alarm Level 1L ?
Alarm Gray 65535 ?
Alarm PointNum 0 ?
Correct Gray 0 ?

Thermometry:
Data Collection 0 SMS
Interval 60 SCP
Ammount 90 SCT
Environment normal ?
Export:
Displays: Exportin normal temperature MTC data
Correction -1 ?
Emissivity 100 SEM
Calibration:
BlackbodyTemp -10 grabs a val from GAB
Save CBS
Cancel CBD
Correction:
BlackbodyTemp -10 Picks from the list GAR
Grayscale 0 SLG
Confirm LRE
Save LRS
Cancel LRD
Ninepoint measurement SMV

Cursor:
Cur N DRC enable cursor
X 320 SRP set cursor position
Y 240 SRP set cursor position

Main:
Auto 2 SAG Auto gain
G 211 SVC
B 10002 SVB
P 1 SWP polarity
Z X ?
Settings:
Image:
FI Y ?
FIValue 0 ? 0-31
Freeze N Freeze image
VE N SMR Vertical flip
HO N SMR Horizontal flip
AutoCali L same as rectify?
O IN internal or external
COM:
Opens UART menu
AvoidburnSwitch OFF enable anti burn in
ProtectedTime 10S duration
AvoidBurn 16383 threshold to trigger antiburn

</syntaxhighlight>

===Automatic Dead Pixels and Flatmap Correction===

It it possible to generate a new flat and dead pixel map automatically within the camera after flashing the cleared-map binary.
 

=====Dead pixels:=====
In the secret menu "System", navigate to Area - DeadPixelModel and set the AutoBP (sensitivity for auto bad pixel finding) to 50 or so. Then press C Button

This can take a while.
[[File:High emissivity peltier black body.jpg|thumb|A Peltier / TEC coated in Candle sood to give it a high emissivity surface. It can be cooled or heated by swapping the polarity. ]]

Afterwards, navigate to S: and press + to save it.
 

=====Flatfield:=====
In the Debug menu navigate to R2 and press +

now place something '''Cold''' infront of the Camera with a high emissivity. (it needs to fill the whole image)

Press '''+''', wait for it to says High temperature.

Place something '''Hot''' infront and press '''+''' again.

Afterwards, save with '''S:''' again.

Flatfield should now be calibrated
 <blockquote>Note: Not all dead pixels are auto detected or get removed. you can manually select them in the Dead pixel editor but its not known yet how to select and correct them.</blockquote>

 

==Using the Thermal module without Webserver==
[[File:Dali D8X3C Breakout board.png|thumb|Breakout board for D8X3C ]]
to use it, you need to interface it directly.

The module will put out a Analog video signal (High-Z, need to buffer when connecting it to 75Ohm Video input)

Also a 8 or 14bit or 8-bit BT656 output.

the header exposes the FPGA JTAG and UART aswell as 6 Hardware Keys to Navigate the OSD.

To interface, you need to make a adapter board with a DF12-50DS-0.5V(86) Docking socket.

The breakout board files can be found [https://oshwlab.com/gamerpaddy/d8x3c-backpack-usb here] but may be still work in progress.

 

==Sensor Pinout==
[[File:Dali DLD384 Sensor pinout basic.png|thumb|basic pinout of a DLD384]]
the pinout of the thermal sensor havent been analyzes much.

besides some supply and Control voltages, 3 clocks and a analog output have been found.

17.5MHz

14.705KHz

50Hz

Dali D8X3N Thermal Camera

2025-08-04T16:27:04Z

Gamerpaddy: /* Raw Viewer for the internal Webserver (recommended) */

=Dali D8X3N Thermal Camera Reverse Engineering=
 

===Introduction===
The [https://www.dali-irtech.com/productinfo/741567.html Dali D8X3N] Thermal Camera module comes in two versions, a 384x288 and 640x480 resolution, utilizing the [http://www.dali-tech.us/products/dld64017m-uncooled-infrared-fpa-detector-86.html DLD Series] of amorphous-Silicon Microbolometers.

They were mainly used in [http://www.dali-tech.us/products/dm60-w--online-body-temperature-thermal-imaging-camera-55.html Dali DM60-W] or WS-1 Body Temperature screening cameras in conjunction with a Black Body radiator set to 37°C to detect infected individuals at the start of the 2020 Covid Pandemic.
[[File:ICI FM320P Innerts.jpg|thumb|Internals. A TP-Link Switch, HikVision Visible Camera and the D8x3N Network thermal camera module]]
[https://infraredcameras.com/ ICI] rebranded these models as FM 320 P and FM 640 P, and distributed them on the local US market, but as the need for such Cameras exploded, those models were built with what was in stock.

So happens, that some of the FM 320 P Models had a DLD640 640x480 instead of a DLD384 384x288 Microbolometer in them, and just got their Firmware modified.

It also could be, because they have excessive amounts of bad pixels outside the 384x288 area, that they were binned to a lower grade.

Discussions about these Cameras started around 2022 in the [https://www.eevblog.com/forum/thermal-imaging/ici-and-dali-thermal-camera-software/ EEVBlog Forums.] when they started to appear secondhand and affordable.

Originally they were priced around US$ 20... 30.000 by ICI, and a unknown amount by Dali Tech.

The Modules specs according to the manufacturer are:

≤50..60mK@F1，300K，50Hz

17 or 25µm pixel pitch

Hisilicon SoC running Linux to provide Onvif and RTSP streams, analysis and a Web UI

 
[[File:Dali D8X3N Module.jpg|thumb|A real 384x288 model with a DLD384 sensor. notice the Productnumber ]]
ICI FM Cameras are found all over Online secondhand marketplaces for scrap Prices, as they are no longer needed.

But you never know, what are you getting. It could be a real DLD384 or the better DLD640 inside. Its a gamble.
 

======640x480 Imagers======
are labeled 22D843 Nxxxx and have a DLD640 sensor in it, they can be upgraded if they run the 384x288 firmware.

======384x288 Imagers======
are labeled 22D883Nxxxx and have a DLD384 sensor in it, they cannot be upgraded

 

==D8X3N Module closer look==
From now on, i will refer to the Thermal Imaging Module as TIM

On the front there is a 2 Element Germanium Lens of a unknown focal length and aperture.

It can be focus-adjusted when unscrewing the clamp around the housing. It can be focussed from infinity down to 10..20cm with some quality loss.
 The outter diameter of the Lens is 42mm with a 1 1/3 inch thread diameter of undetermined pitch.

Dimensions of the germanium elements are 21mm to 3 and 6mm and 14grams in weight.
[[File:Disassembled Thermal Camera Lens.jpg|thumb|Two element Germanium Lens of unknown focal length and aperture]]

The TIM is composed of 6 Stacked PCB modules, 3 of which are for the Web Server functionality. taking them off will give you the basic configuration of a [https://www.dalithermal.com/productinfo/741568.html Dali D8X3C] TIM<gallery>
File:Dali DLD640 Thermal Image Sensor.jpeg|DLD640 Sensor
File:Dali DLD384 Thermal Imaging Sensor.jpeg|DLD384 Sensor
File:Dali D8X3N Board1 Back.jpeg|Network & GPIO Board Back
File:Dali D8X3N Board1 Front.jpeg|Network & GPIO Board Front
File:Dali D8X3N Glue Board Back.jpeg|Board between Logic and IO Back
File:Dali D8X3N Glue Board Front.jpeg|Board between Logic and IO Front
File:Dali D8X3N SoC Board Back.jpeg|SoC Board back
File:Dali D8X3N SoC Board front.jpeg|SoC board front
File:Dali D8X3N FPGA Board Back.jpeg|FPGA Board of the D8X3C Thermal Imager including a PMIC
File:Dali D8X3N FPGA Board Front.jpeg|FPGA Board Front with Video DAC and SPI Flash
File:Dali D8X3N Sensor Power and ADC Board.jpeg|Sensor control and ADC board
File:Dali D8X3N Thermal Core Debug wiring.jpeg|Debug wiring for sniffing SPI and UART
</gallery>

===User Manual===
including pinout diagram and important data

can be found here https://archive.org/details/dali-d-8-x-3-cuser-manualen-v-1.0-1

==Viewing the Video Stream==
[[File:Onvif Device Manager ODM.png|thumb|ODM streaming the Thermal view]]
when first connecting it to power and Ethernet, the camera will have 192.168.1.102 as a Static ip.

If you are running a 192.168.0.x or .178.x net, you need to change it or add a subnet under windows ipv4 settings.

to view it, you can use VLC and the stream URL
rtsp://admin@admin:<camera ip>/ONVIFMedia
there is /ONVIFMedia /ONVIFMediaM and /ONVIFMediaS for different stream Profiles.

VLC is quite slow and delayed, rather use Onvif Device Manager ODM,

it has no delay and auto-detects cameras in the network.

Be sure to log in as user: admin pass: admin in ODM.

in there, you can also set you camera to DHCP under Network settings.

===Web Interface===
[[File:Dali D8X3N web interface.png|thumb|Since browsers cant display RTSP anymore, open in Edge and select IE Compatibility Mode.]]
the web interface can be accessed by opening the camera IP in a browser

login is:
user: admin pass: admin
You can set Temperature markers and areas, but without using the Black Body calibration source, your readings may be way off or not working.

 

====OSD====
there is a debug-login with
user: super pass: 871897
that lets you send Key commands to the Imager to navigate the OSD.

Setting the OSD to english is accomplished with option #11
[[File:Dali D8X3C OSD.png|thumb|OSD in english, if yours is Chinese. go to option #11 and click + or -]]

To acces some locked menus, press
+ - + - + -

The password for the locked System and Main menu is
+-MC+-

Be careful in the UART menu to not change the BAUD rate or Protocol, as your ability to control it via the Web API gets lost.

You need to reflash or solder buttons on the thermal core then.

==Viewing Raw Thermal Data from the Web API==
there is a hidden endpoint in the stream.so file that could be found while decompiling

accessing
[[File:Arduino Nano blink sketch thermal gif.gif|thumb|Arduino Nano running blink sketch while thermally recording it, notice the led and resistor on the right]]
<ip of camera>:5000/stream?Type=JPEG&Source=Jpeg&Mode=TCP
lets you download a JPEG. but there are more options available (not all have been tested)

we are mainly interessted in Raw thermal data.

====Source (Stream Type)====

*<code>Major</code> - Main video stream (channel 0)
*<code>Minor</code> - Sub video stream (channel 1)
*<code>MinorAV</code> - Sub video + audio stream
*<code>MajorAV</code> - Main video + audio stream
*<code>Jpeg</code> - JPEG snapshot stream
*<code>Raw</code> - Raw thermal data stream
*<code>YUV</code> - YUV raw video stream

====Type (Data Format)====

*<code>H264</code> - H.264 video encoding
*<code>JPEG</code> - JPEG image format
*<code>RAW</code> - Raw sensor data
*<code>QBOX</code> - Custom protocol format
*<code>FRAME</code> - Frame-based format

====Mode (Transport Protocol)====

*<code>TCP</code> - TCP streaming (default)
*<code>UDP</code> - UDP streaming
*<code>MUL</code> - Multicast streaming

====Quality Parameters====

*<code>Quality=[1-100]</code> - Video quality level
*<code>Frames=[number]</code> - Number of frames to send
*<code>Interval=[ms]</code> - Frame interval in milliseconds

====Network Parameters====

*<code>IPAddr=[ip]</code> - Client IP address for UDP/multicast
*<code>Port=[port]</code> - Client port for UDP/multicast
*<code>Heart-beat=[Yes/No]</code> - Enable/disable heartbeat

====Snapshot Parameters====

*<code>Snap=[Yes/No]</code> - Enable snapshot mode

 
====Raw Viewer for PC (Python)====
[[File:Dali D8X3N Raw Thermal viewer.png|thumb|Raw Data Viewer in python]]

To view the raw stream, i made a python program that converts the 14bit thermal data to a visible image.

it is low fps tho, due to bad optimizations.

rev1 first working version https://pastebin.com/dyNWDPT3

rev2 with temperature readout https://pastebin.com/u107Q85w

rev3 and onward will only be available directly as a Webpage on the Device (see below).

====Raw Viewer for the internal Webserver (recommended)====
It is also possible to use the Raw viewer directly in the browser.

To achieve this, the stream had to be proxied from port 5000 to 80 due to CORS.

luckily the internal lighttpd had the CGI module enabled, so piping it troug (using wget ... i know) worked with very low overhead.

To install, you need '''Terminal access''' to the Camera. see below.

optional for simplicity: '''ftp''' access

[[File:Dali D8X3N Webviewer.png|thumb|Web Raw Viewer with histogram (rev3)]]

Create the files and the code inside.

'''/app/web/webpages/raw.html''' https://pastebin.com/kaiXwAgD

and

'''/app/web/webpages/cgi-bin/proxy.cgi''' https://pastebin.com/vii1HXcU

then run
chmod +x /app/web/webpages/cgi-bin/proxy.cgi
'''restart''' your camera.

It should be accessible now trough '''http://<camera ip>/raw.html''' in the browser and click Start Stream

 <blockquote>performance may need improvement.</blockquote>

==Getting Root Terminal Access==
To access the Terminal you need to solder or plug in a UART connection to Connector J7 on the "Glue" board.

Pinout is (left to right) '''RX TX GND 3.3V Baud 115200 3.3V!'''

But the system will spam with debug messages, making patching the files a hard job unless you use "tftp" or "sed" commands.
 

====Enabling Telnet access to make patching easier====
[[File:Upgrade ici dali firmware updater.png|thumb|ICI Firmware updater software with modified firmware loaded]]

there is a easier way using a modified Firmware updater to enable Telnet temporarily to patch the Files.

Download the '''upgrade_ici.exe''' form [https://archive.org/details/fwupdate here] and run it.

Then you should be able to connect to it via Telnet.

The Login credentials are '''User: roo'''t '''Password: DLroot'''

 

===Patching Device===

===Patching the Web Server===
 

====Enabling Telnet and ftpd permanently====

This only works if you also patch the Thermal Camera module flash!

to permanently enable Telnet, go to '''/etc/init.d''' and edit '''S90app'''
vi S90app
in vi, move your cursor to the '''#''' at '''#telnetd''' and press x<blockquote>optional: enable ftp by removing the '''#''' at '''ftpd''' and adjust the path to / </blockquote>now press ''':''' and type '''wq''' and hit '''enter'''. this should be it.

====Patching the decoder and streamer to 640x480:====
go to /app and edit the mach.cfg

replace DL384 with D640 and edit the resolution to 640 480

(press i in vi to enter edit mode, press ESC to exit edit mode. :wq to write and quit.)

repeat that procedure for the dali.cfg

=====(optional) patching app.sh to prevent it from rebooting=====
edit the app.sh in /app and remove all "reboot" occasions to prevent the camera from rebooting if onvifserver, httpd or daliServer arent running for debugging purposes.

 

====Patching the Thermal Camera module====
To patch it, you need to disassemble everything down to the FPGA Board,

on the bottom there is a SPI SOIC8 Flash.

Use a CH341 EEPROM programmer (be sure to have a fixed or modified version to not put out 5V!, set it to 3.3V) and SOIC8 clamp.

Use NeoProgrammer (i used 2.2.0.10 but there are newer available, use the latest) and click Detect. It should find W25Q128 chips, select the FV one.

Dont forget to download a backup of your flash and save it !

Download the Binary "Dali 640x480 '''actual''' cleared pixelmap.bin" from #3 below and load it into NeoProgrammer,

Click Erase, Program and Verify.

This can take a while.

Your imager should start up right after assembly by hearing the shutter click.

==Hardware Hacking==

===Flash Contents===
On archive, click on show all files to download them.

<nowiki>#</nowiki>1 a Flash dump of the original downgraded D8X3N can be found [https://archive.org/details/dali-d-843n-flash-dump here]

<nowiki>#</nowiki>2 a Flash dump of a original 640x480 model can be found [https://archive.org/details/d-843-n-640x-480 here]

<nowiki>#</nowiki>3 a modified Flash dump of a 640x480 with cleared dead pixel map, flat map etc. can be found [https://archive.org/details/d-843-n-640x-480-cleared-pixelmap here]

a Flash dump of the web server SPI flash W25Q256JV can be found [https://archive.org/details/dm-60-webserver-flash-dump here] in case a bad firmware update caused a bootloop.

 

===Flash Binary Analysis===
The Flash IC is a Winbond 25Q128JV SPI Flash that contains the FPGA Bitstream, Deadpixel and Flatmap, aswell as the Device Settings.

a copy of the SPI Logic Capture at startup can be found [https://archive.org/details/dali-eeprom-capture here], the free software [https://www.dreamsourcelab.com/download/ DSView from DreamSourceLab] is required to view it.
[[File:Dali Thermal Imager SPI Flash capture.png|thumb|SPI Flash access while booting the Thermal Module]]

a approximation of the offsets resulted in this list:<syntaxhighlight lang="vb">
0x000000 - altera cyclone iv stuff
0x200000 - settings
0x280000 - Flat field correction map
0x4C0000 - Bad Pixel correctio nmap
0x580000 - image aswell? 36010 bytes
0x740000 - GUIX?
0x7C0000 - Strings for Gui?
0x800000 - another shorter GUIX
0x880000 - Strings for second gui?
0x8C0000 - GUIX
0x940000 - Strings for gui
0xE00000 - ?
0xE80000 - dzxg? short
0xEC0000 - crosshair.bmp
0xF40000 - 3DTM?
0xF80000 - fake? Bad pixel map BPRP
</syntaxhighlight> 

====Settings offset 0x200000====
The settings are read and written every startup, aswell when you close the OSD, sporadically and when executing the command MSV

these are some of the settings i could figure out by changing and watching the logic capture what changed.
 <syntaxhighlight lang="vb">
offset size Cmd
0x0 1 SAG (0-2) auto gain
0x2 2 SVB (0-16383) saved value is 16383 - SVB
0x4 2 SVC (0-1023) set exposure or gain
0x6 1 SSM image filtering
0x8 1 SEH image enhancement
0xA 1 SWP invert b/w polarity
0x14 1 SMR Flip
0x16 1 SMR Mirror
0x20 1 MENU Cal source 0 IN, 1 OUT
0x3A 1 MENU Enhance value 0-100
0x40 1 MENU Rectify (shutter 0 OFF, 1 L, 2 H)
0x50 1 MENU Language 0 english, 1 chinese, 2 russian
0xA2 - SCO set contrast gain
0xA4 - IBR set brightness
0xAE 2 MENU Fire Threshold
0xAC 1 SPA set color palette
0xE2 1 SMS display "collected 0/80" enabled
0xF8 1 SEM set emissivity
0x110 1 SRT set revise temp
0x116 1 SHD set humidity
0x118 1 SET set ambient temp
0x11A 1 STD set temp range
0x120 2 SLG -500 to 500?
0x124 2 SRD set distance
0x12C 1 SCP ???
0x130 2 SCT ???
</syntaxhighlight> 
[[File:Dali D8X3N Bad Pixel Map Viewer.png|thumb|Bad pixel map of a 640x512 sensor, about 0.56% of dead pixels in this map]]
So i let the AI create a [https://2476424.playcode.io/ Configurator page] that lets you change the Settings in your Flashdump to your liking
 

====Bad Pixel and Flatframe Maps 0x280000 and 0x4C0000====
Thermal cameras require a bad pixel and flat frame map to compensate for manufacturing inconsistencies.

unfourtainly, the maps of the downgraded cameras only contain enough data for a 384 model, not the full 640.

at offset 0xF80000 there is a BPRP which was mistaken at first as the Bad pixel map, it could just be a mask to where to apply the offset maps, as its either 0x0 or 0x1.

The [https://2477569.playcode.io/ Viewer Page] is written in JS and does not require any special dependencies, it can run as a plain html file offline.

There still needs to be work done to create own maps and flatfields but the cameras are still very capable and useable with fully cleared maps.

To clear the maps, just go to these offsets and fill with values around 0x3F or 0x0 for total length of X Resolution x Y Resolution x 2 bytes (0x96000 for 640x480)

[[File:Dali D8X3N Flat Field Map Viewer.png|thumb|Flat Field viewer]]

==Dali Commands==
To control the TIM you can either use Pelco or Dali command set. By default the Dali commandset is used at 38400 BAUD.

Those commands consist of a 0x02 start byte followed by two length Bytes, then the actual command which is allways 3 uppercase Letters in ASCII (eg. KBD for keyboard) followed by a comma and the values.

Some commands take multiple values, some dont. But you allways have to send the comma after the Command.

The camera will answer with the Command and 0, 1 or 2. Sending no value counts as zero.
0 is invalid parameters, too few or out of range

1 is OK, valid command

2 is Invalid command

Commands can be sent trough the Web server using the URL Api endpoint or directly trough the UART port.

(keyboard, C button, causes the shutter to do a calibration)
<camera ip>/cgi-bin/dmcmd?Command=KBD,C
Listening to the answer can be done while being in the Linux shell and typing
cat /dev/ttyAMA2 | strings

By bruteforcing the UART with AAA to ZZZ a list of Commands could be obtained, but some with unknown Parameters or functionality yet. including some from a decompiled DM60comm.so module found in /app/modules folder.<syntaxhighlight lang="vb">
KBD KEY Keyboard (F S M C + -)
SSM 0-1 Image Filtering Off/On
GSM 0 Image filter status
SEH 0-1 Image Enhancement Off/On
GEH 0-1 Image enhancer status
SCO 0-255 Set Gain (locked when SAG auto gain is on)
GCO 0-255 Get gain
INT 15-320 set actual gain? not just contrast sometimes disabled?
IBR 0-255 Set brightness
GBR 0-255 Get brightness
SMR 0-3 Mirror mode bit0=horizontal, bit1=vertical
GMR 0 Get rotation/flip
SDT 0-1 displays temp=44.65°C osd, but webserver sends date/time to the cam there....
GDT 0-1 Get temp display active?
GPT Display temp oft SDT
GNU 0-1 Get Shutter closed/open
SNU 0-1 Shutter close / open
STD 0-1 Set Range 0: -20-180°C 1: 100-600°C
GTD 0-1 Get Range
SET °C Set Ambient temperature
GET °C Get Ambient temperature
SEM 0-100 0-1 set emissivity x100
GEM 0-100 Get Emissivity
SRT °C Set revise temperature -100-100 -10-10°
GRT °C Get revise temperature
SRD 100 Set Distance 4.4m x100
GRD 100 Get Distance
SHD 0-100 Set Humidity
GHD 55 Get Humidity
SWP 0-1 invert s/w polarity image
GWP 1 is inverted?
SPA 0-10? Set color palette
GPA 3 white hot
SMV 0-1 Show temperature 3x3 grid?? in combination with GTV maybe
GMV 0
SMS 0-1 displays "collected 0/<number set by SCT>" by SCP delay "saves the daily number of highest temperatures?"
GMS 0
SCT 1-500 sets the amount of "collected" points for SMS
GCT 80
SCP 5-60 "collected" delay in seconds for SMS
GCP 60
SAG 0-2 Auto brightness / gain
GAG 0
SLR 0-9 ???
GLR 0
SRP 0,0 - 639,479 set crosshair position
GRP 320,240 get crosshair position
DRC 0-1 Show crosshair
SLG -500-500 ??
GLG
SCE text ??
GCE 0
SCB text ??
GCB 0
SVB 0-16383 adc offset, exposure? good at 9650
GVB 6733 value is 16383 minus SVB
SVC 1-1023 set contrast but better
GVC 260
SVF 100-? ?? video freaks out 3400 seems good
SVS 100-? ?? video freaks out 3300 seems good
SOT 0-1 ?? sensor supply, looks weird when off.
SZM 1-4 ?
GZM 1
MSV save settings too eeprom
ASV Saves something aswell?
GCS 0 Get Core status & faults
ALD 0,2? video blanks lots of eeprom activity. reload pixel map??
SAV 0-9999 set Fire threshold
GAV 2100 get Fire Threshold
BAC change uart protocol? careful
CBD Displays Recovery successful?
CBS Displays Saved successfully
LRD Displays Recovery successful?
LRS Displays Saved successfully?
LRE Displays Temperature Repair successful?
CBT Displays Calibration successful?
DBP ??? shutter clicks
DPI Show weird pixels
API Hide weird pixels
CCM ??
ASN 0-4 ??
GAB 4 vals ?? 3,-10,50,150
GAN 1 ??
GAR 11 vals ?? 10,10,5,20,35,50,70,90,120,150,180,,
GCM 6 values ??
GFV prints screen gray value?
GIT 200 ??
GTV Get the collected temp values?
PTS echoes but with extra stuff??
QYA 7170 Query Gray Info (information mode)
QYI 7124 Query Gray Average mode
QYM 7512 Query Gray Minimum mode
VTP 400-4000 ??
MTD U/S,0,0 ?? S answers with bytes, U upload bytes?
MTC U/S? ?? S answers with U,0,0, S doesnt.

return 0 invalid params:
STS ??
STT ??
SAC ??
SAH ??
SAS ??
SAT ??
SCX ?? displays crosshair but invalid params
SCY ?? displays crosshair but invalid params
GAC ??
GAH ??
GAS ??
GAT ??
GME ??
GPC ??
GPI ??
GPM ??
GTA ??
GTC ??
GTI ??
GTM ??
GTS ??
GTT ??

answer only:

BPM 0-1 stream ready? answers with 0 stop, 1 go, 2 when prompted
AVS 0,1
MEH
PWI 0-1 changing palette from wh to fire

unconfirmed (from dm60comm.so):
SDT 2024,03,15,14,30,25 Set Date Time with year,month,day,hour,minute,second
STS 1 Set Temperature Show display (0=off, 1=on)
SVA 2 Set Video Auto mode (0=manual, 2=auto)
SMP 0,1,1,0,100,150,200,250,300,350,90,25 Set Measurement Point (type,index,enable,mode,startX,startY,endX,endY,anchorX,anchorY,threshold,color)
STV Stop Temperature View measurements
SPF 5 Set Profile parameter
SVL -10 Set Video Left pan movement (signed value)
SVU -5 Set Video Up tilt movement (signed value)
SVD 5 Set Video Down tilt movement (signed value)
SSP 17,1,0 Set System Parameter (param_id,value,index) #46 temperature format 0 °C, 1 °F, 2 K
SCP Set Current Preset (save current position)
GCP Get Current Preset
STT 300,350 Set Temperature Threshold (low,high values *10)
SDC 1 Set Display Configuration parameter
GCS Get Current Status
GMM Get Memory Map information
GFV Get Frame Value (grayscale data)
GFZ Get Freeze Status
GSI 1 Get System Information (parameter=1)
GSS Get System Status
GSP 21,0 Get System Parameter (param_21=surround temp, value=0)
GTT Get Temperature Threshold range
GTV 1,3,10 Get Temperature Values (enable,type,count)
GNU Get Network Update status (response command)
FRZ Freeze current display frame
LIV Live mode (unfreeze display)
CAL Calibrate system
CCP 3 Call Current Preset (preset number 0-9)
APF 100 Auto Profile setting
MEH Measure Enhancement
BPT Built-in Test
MTC S,0 Measure Temperature Capture (S=start, 0=sequence)
MTG U,0,1024,<data> Measure Temperature Gray data transfer
MTD U,0,1024,<data> Measure Temperature Data transfer
UFP S,0,2048 Update Firmware Prepare (S=start, 0=offset, 2048=size)
UFD S,0,1024 Update Firmware Data transfer
BAB U Buffer operation (U=update)
TTH S,0 Temperature Threshold operation
IPP 192.168.001.102,255.255.255.000,192.168.001.001,192.168.000.001,9989,9998 IP Parameters (IP,netmask,gateway,DNS,port1,port2)
MAC 00:60:A9:10:00:01 MAC Address setting
SNP Set Network Parameters (response command)
QYI Query Gray Info (information mode)
QYA Query Gray Average mode
QYM Query Gray Minimum mode
GAI Get Alarm Info (response command)
YTC <data> Unknown command with data parameter
HTH
LRS
LRD
GAR
DRC
PTS
SCX
SCY
CBT
LRE
CBD
CBS
XXX
GSP
GTT
QYI
QYA
QYM

</syntaxhighlight>

==Secret Menu Overview==
The secret menus Main and System can be openend with the password '''+-MC+-'''

Its structured like this, not all variables have been figured out yet.

The format is Menu: submenu: submenu:

and for menu entries: Name, default value, command, description or messages that pop up.
 <syntaxhighlight lang="vb">
MAIN & SYSTEM PASS: +-MC+-

entries are NAME VALUE COMMAND DESC or if its a folder its just ":"

System:
System:
Gain 255 SCO
Bright 102 IBR
BenDi 100 ?
BenDiContrase 80 ?
DisMode 0 ?
Frequency 48hz (24,25,48,50)
DigitalOut 8-14bit 14bit, BT656(_P), ?, BT601
AutoFocus N ?
Line 1 ?
Ltemp0 11800 ?
LTemp1 11000 ?
HTemp0 9500 ?
HTemp1 8700 ?
DelayTime 0 ?
Enhance 0-1 ?
Enhanced E1 230 ?
FPA_Gain 12pF ? between 4 and 18 at random.
NUCEn N ?

Area:
SE 2 ASN 0-4 "Partition"
INT 200 INT "Points time"
VS 3161 SVS
VF 2800 SVF
Vtemp 1401 VTP
VtempArea Low ?
VtempBase 13500 ?
VtempStep -1 ?
VsStep 8 ?
DeadPixelModel preset / calculate
DP: Cursor to select dead pixels
X 360 position
Y 288 position
AutoBP: 50 Press C to start automatic dotting
Quit? Number of bad pixels 961& "Blind element replacement in progress"
Undo
R2: Save data? blind pixel replacement in progress
Replace Y N = DPI, Y = API
L: Reading parameters
S: Saving parameters

Debug:
Rectify N
DisplayGary N
TE N SDT
AutoE ? ?
AutoVS Y ?
VSGrayH 8000 ?
VSGrayL 7000 ?
Trends 1 ?
Shelter N ?
MotorCon 3 ?
SaveFactoryPara:
LanTyp EN ? LANGUAGE
DisplayMT N ?
Version:
PRJ D843 DLD640 ImLib, MTlib, Soft, Logic

BackDispose:
GammaEN 1 ?
Gain 1 ?
EnhanceEN 0 ?
Hpf_shift 5 ?
Hpf_thrd 5 ?
Enhance 150 ?
Lthrd 50 ?

Monitor:
Opens normal OSD

Alarm Set:
Alarm Switch Y ?
Alarm Mode No ?
Alarm Temperature -1°C ?
Reference Gray Y ?
Alarm Level 1L ?
Alarm Gray 65535 ?
Alarm PointNum 0 ?
Correct Gray 0 ?

Thermometry:
Data Collection 0 SMS
Interval 60 SCP
Ammount 90 SCT
Environment normal ?
Export:
Displays: Exportin normal temperature MTC data
Correction -1 ?
Emissivity 100 SEM
Calibration:
BlackbodyTemp -10 grabs a val from GAB
Save CBS
Cancel CBD
Correction:
BlackbodyTemp -10 Picks from the list GAR
Grayscale 0 SLG
Confirm LRE
Save LRS
Cancel LRD
Ninepoint measurement SMV

Cursor:
Cur N DRC enable cursor
X 320 SRP set cursor position
Y 240 SRP set cursor position

Main:
Auto 2 SAG Auto gain
G 211 SVC
B 10002 SVB
P 1 SWP polarity
Z X ?
Settings:
Image:
FI Y ?
FIValue 0 ? 0-31
Freeze N Freeze image
VE N SMR Vertical flip
HO N SMR Horizontal flip
AutoCali L same as rectify?
O IN internal or external
COM:
Opens UART menu
AvoidburnSwitch OFF enable anti burn in
ProtectedTime 10S duration
AvoidBurn 16383 threshold to trigger antiburn

</syntaxhighlight>

===Automatic Dead Pixels and Flatmap Correction===

It it possible to generate a new flat and dead pixel map automatically within the camera after flashing the cleared-map binary.
 

=====Dead pixels:=====
In the secret menu "System", navigate to Debug - DeadPixelModel and set the AutoBP (sensitivity for auto bad pixel finding) to 50 or so. Then press C Button

This can take a while.
[[File:High emissivity peltier black body.jpg|thumb|A Peltier / TEC coated in Candle sood to give it a high emissivity surface. It can be cooled or heated by swapping the polarity. ]]

Afterwards, navigate to S: and press + to save it.
 

=====Flatfield:=====
In the Debug menu navigate to R2 and press +

now place something '''Cold''' infront of the Camera with a high emissivity. (it needs to fill the whole image)

Press '''+''', wait for it to says High temperature.

Place something '''Hot''' infront and press '''+''' again.

Afterwards, save with '''S:''' again.

Flatfield should now be calibrated
 <blockquote>Note: Not all dead pixels are auto detected or get removed. you can manually select them in the Dead pixel editor but its not known yet how to select and correct them.</blockquote>

 

==Using the Thermal module without Webserver==
[[File:Dali D8X3C Breakout board.png|thumb|Breakout board for D8X3C ]]
to use it, you need to interface it directly.

The module will put out a Analog video signal (High-Z, need to buffer when connecting it to 75Ohm Video input)

Also a 8 or 14bit or 8-bit BT656 output.

the header exposes the FPGA JTAG and UART aswell as 6 Hardware Keys to Navigate the OSD.

To interface, you need to make a adapter board with a DF12-50DS-0.5V(86) Docking socket.

The breakout board files can be found [https://oshwlab.com/gamerpaddy/d8x3c-backpack-usb here] but may be still work in progress.

 

==Sensor Pinout==
[[File:Dali DLD384 Sensor pinout basic.png|thumb|basic pinout of a DLD384]]
the pinout of the thermal sensor havent been analyzes much.

besides some supply and Control voltages, 3 clocks and a analog output have been found.

17.5MHz

14.705KHz

50Hz

Dali D8X3N Thermal Camera

2025-08-04T16:20:49Z

Gamerpaddy: /* Raw Viewer for the internal Webserver (recommended) */

=Dali D8X3N Thermal Camera Reverse Engineering=
 

===Introduction===
The [https://www.dali-irtech.com/productinfo/741567.html Dali D8X3N] Thermal Camera module comes in two versions, a 384x288 and 640x480 resolution, utilizing the [http://www.dali-tech.us/products/dld64017m-uncooled-infrared-fpa-detector-86.html DLD Series] of amorphous-Silicon Microbolometers.

They were mainly used in [http://www.dali-tech.us/products/dm60-w--online-body-temperature-thermal-imaging-camera-55.html Dali DM60-W] or WS-1 Body Temperature screening cameras in conjunction with a Black Body radiator set to 37°C to detect infected individuals at the start of the 2020 Covid Pandemic.
[[File:ICI FM320P Innerts.jpg|thumb|Internals. A TP-Link Switch, HikVision Visible Camera and the D8x3N Network thermal camera module]]
[https://infraredcameras.com/ ICI] rebranded these models as FM 320 P and FM 640 P, and distributed them on the local US market, but as the need for such Cameras exploded, those models were built with what was in stock.

So happens, that some of the FM 320 P Models had a DLD640 640x480 instead of a DLD384 384x288 Microbolometer in them, and just got their Firmware modified.

It also could be, because they have excessive amounts of bad pixels outside the 384x288 area, that they were binned to a lower grade.

Discussions about these Cameras started around 2022 in the [https://www.eevblog.com/forum/thermal-imaging/ici-and-dali-thermal-camera-software/ EEVBlog Forums.] when they started to appear secondhand and affordable.

Originally they were priced around US$ 20... 30.000 by ICI, and a unknown amount by Dali Tech.

The Modules specs according to the manufacturer are:

≤50..60mK@F1，300K，50Hz

17 or 25µm pixel pitch

Hisilicon SoC running Linux to provide Onvif and RTSP streams, analysis and a Web UI

 
[[File:Dali D8X3N Module.jpg|thumb|A real 384x288 model with a DLD384 sensor. notice the Productnumber ]]
ICI FM Cameras are found all over Online secondhand marketplaces for scrap Prices, as they are no longer needed.

But you never know, what are you getting. It could be a real DLD384 or the better DLD640 inside. Its a gamble.
 

======640x480 Imagers======
are labeled 22D843 Nxxxx and have a DLD640 sensor in it, they can be upgraded if they run the 384x288 firmware.

======384x288 Imagers======
are labeled 22D883Nxxxx and have a DLD384 sensor in it, they cannot be upgraded

 

==D8X3N Module closer look==
From now on, i will refer to the Thermal Imaging Module as TIM

On the front there is a 2 Element Germanium Lens of a unknown focal length and aperture.

It can be focus-adjusted when unscrewing the clamp around the housing. It can be focussed from infinity down to 10..20cm with some quality loss.
 The outter diameter of the Lens is 42mm with a 1 1/3 inch thread diameter of undetermined pitch.

Dimensions of the germanium elements are 21mm to 3 and 6mm and 14grams in weight.
[[File:Disassembled Thermal Camera Lens.jpg|thumb|Two element Germanium Lens of unknown focal length and aperture]]

The TIM is composed of 6 Stacked PCB modules, 3 of which are for the Web Server functionality. taking them off will give you the basic configuration of a [https://www.dalithermal.com/productinfo/741568.html Dali D8X3C] TIM<gallery>
File:Dali DLD640 Thermal Image Sensor.jpeg|DLD640 Sensor
File:Dali DLD384 Thermal Imaging Sensor.jpeg|DLD384 Sensor
File:Dali D8X3N Board1 Back.jpeg|Network & GPIO Board Back
File:Dali D8X3N Board1 Front.jpeg|Network & GPIO Board Front
File:Dali D8X3N Glue Board Back.jpeg|Board between Logic and IO Back
File:Dali D8X3N Glue Board Front.jpeg|Board between Logic and IO Front
File:Dali D8X3N SoC Board Back.jpeg|SoC Board back
File:Dali D8X3N SoC Board front.jpeg|SoC board front
File:Dali D8X3N FPGA Board Back.jpeg|FPGA Board of the D8X3C Thermal Imager including a PMIC
File:Dali D8X3N FPGA Board Front.jpeg|FPGA Board Front with Video DAC and SPI Flash
File:Dali D8X3N Sensor Power and ADC Board.jpeg|Sensor control and ADC board
File:Dali D8X3N Thermal Core Debug wiring.jpeg|Debug wiring for sniffing SPI and UART
</gallery>

===User Manual===
including pinout diagram and important data

can be found here https://archive.org/details/dali-d-8-x-3-cuser-manualen-v-1.0-1

==Viewing the Video Stream==
[[File:Onvif Device Manager ODM.png|thumb|ODM streaming the Thermal view]]
when first connecting it to power and Ethernet, the camera will have 192.168.1.102 as a Static ip.

If you are running a 192.168.0.x or .178.x net, you need to change it or add a subnet under windows ipv4 settings.

to view it, you can use VLC and the stream URL
rtsp://admin@admin:<camera ip>/ONVIFMedia
there is /ONVIFMedia /ONVIFMediaM and /ONVIFMediaS for different stream Profiles.

VLC is quite slow and delayed, rather use Onvif Device Manager ODM,

it has no delay and auto-detects cameras in the network.

Be sure to log in as user: admin pass: admin in ODM.

in there, you can also set you camera to DHCP under Network settings.

===Web Interface===
[[File:Dali D8X3N web interface.png|thumb|Since browsers cant display RTSP anymore, open in Edge and select IE Compatibility Mode.]]
the web interface can be accessed by opening the camera IP in a browser

login is:
user: admin pass: admin
You can set Temperature markers and areas, but without using the Black Body calibration source, your readings may be way off or not working.

 

====OSD====
there is a debug-login with
user: super pass: 871897
that lets you send Key commands to the Imager to navigate the OSD.

Setting the OSD to english is accomplished with option #11
[[File:Dali D8X3C OSD.png|thumb|OSD in english, if yours is Chinese. go to option #11 and click + or -]]

To acces some locked menus, press
+ - + - + -

The password for the locked System and Main menu is
+-MC+-

Be careful in the UART menu to not change the BAUD rate or Protocol, as your ability to control it via the Web API gets lost.

You need to reflash or solder buttons on the thermal core then.

==Viewing Raw Thermal Data from the Web API==
there is a hidden endpoint in the stream.so file that could be found while decompiling

accessing
[[File:Arduino Nano blink sketch thermal gif.gif|thumb|Arduino Nano running blink sketch while thermally recording it, notice the led and resistor on the right]]
<ip of camera>:5000/stream?Type=JPEG&Source=Jpeg&Mode=TCP
lets you download a JPEG. but there are more options available (not all have been tested)

we are mainly interessted in Raw thermal data.

====Source (Stream Type)====

*<code>Major</code> - Main video stream (channel 0)
*<code>Minor</code> - Sub video stream (channel 1)
*<code>MinorAV</code> - Sub video + audio stream
*<code>MajorAV</code> - Main video + audio stream
*<code>Jpeg</code> - JPEG snapshot stream
*<code>Raw</code> - Raw thermal data stream
*<code>YUV</code> - YUV raw video stream

====Type (Data Format)====

*<code>H264</code> - H.264 video encoding
*<code>JPEG</code> - JPEG image format
*<code>RAW</code> - Raw sensor data
*<code>QBOX</code> - Custom protocol format
*<code>FRAME</code> - Frame-based format

====Mode (Transport Protocol)====

*<code>TCP</code> - TCP streaming (default)
*<code>UDP</code> - UDP streaming
*<code>MUL</code> - Multicast streaming

====Quality Parameters====

*<code>Quality=[1-100]</code> - Video quality level
*<code>Frames=[number]</code> - Number of frames to send
*<code>Interval=[ms]</code> - Frame interval in milliseconds

====Network Parameters====

*<code>IPAddr=[ip]</code> - Client IP address for UDP/multicast
*<code>Port=[port]</code> - Client port for UDP/multicast
*<code>Heart-beat=[Yes/No]</code> - Enable/disable heartbeat

====Snapshot Parameters====

*<code>Snap=[Yes/No]</code> - Enable snapshot mode

 
====Raw Viewer for PC (Python)====
[[File:Dali D8X3N Raw Thermal viewer.png|thumb|Raw Data Viewer in python]]

To view the raw stream, i made a python program that converts the 14bit thermal data to a visible image.

it is low fps tho, due to bad optimizations.

rev1 first working version https://pastebin.com/dyNWDPT3

rev2 with temperature readout https://pastebin.com/u107Q85w

rev3 and onward will only be available directly as a Webpage on the Device (see below).

====Raw Viewer for the internal Webserver (recommended)====
It is also possible to use the Raw viewer directly in the browser.

To achieve this, the stream had to be proxied from port 5000 to 80 due to CORS.

luckily the internal lighttpd had the CGI module enabled, so piping it troug (using wget ... i know) worked with very low overhead.

To install, you need '''Terminal access''' to the Camera. see below.

optional for simplicity: '''ftp''' access

[[File:Dali D8X3N Webviewer.png|thumb|Web Raw Viewer with histogram (rev3)]]

Download both files:
(Rev3, with histogram):

raw.html https://pastebin.com/kaiXwAgD

proxy.cgi https://pastebin.com/vii1HXcU

then copy the '''raw.html''' into '''/app/web/webpages/'''

the '''proxy.cgi''' into '''/app/web/webpages/cgi-bin'''

and run
chmod +x /app/web/webpages/cgi-bin/proxy.cgi

then '''restart''' your camera.

It should be accessible now trough '''http://<camera ip>/raw.html''' in the browser and click '''Start Stream'''
 <blockquote>performance may need improvement.</blockquote>

==Getting Root Terminal Access==
To access the Terminal you need to solder or plug in a UART connection to Connector J7 on the "Glue" board.

Pinout is (left to right) '''RX TX GND 3.3V Baud 115200 3.3V!'''

But the system will spam with debug messages, making patching the files a hard job unless you use "tftp" or "sed" commands.
 

====Enabling Telnet access to make patching easier====
[[File:Upgrade ici dali firmware updater.png|thumb|ICI Firmware updater software with modified firmware loaded]]

there is a easier way using a modified Firmware updater to enable Telnet temporarily to patch the Files.

Download the '''upgrade_ici.exe''' form [https://archive.org/details/fwupdate here] and run it.

Then you should be able to connect to it via Telnet.

The Login credentials are '''User: roo'''t '''Password: DLroot'''

 

===Patching Device===

===Patching the Web Server===
 

====Enabling Telnet and ftpd permanently====

This only works if you also patch the Thermal Camera module flash!

to permanently enable Telnet, go to '''/etc/init.d''' and edit '''S90app'''
vi S90app
in vi, move your cursor to the '''#''' at '''#telnetd''' and press x<blockquote>optional: enable ftp by removing the '''#''' at '''ftpd''' and adjust the path to / </blockquote>now press ''':''' and type '''wq''' and hit '''enter'''. this should be it.

====Patching the decoder and streamer to 640x480:====
go to /app and edit the mach.cfg

replace DL384 with D640 and edit the resolution to 640 480

(press i in vi to enter edit mode, press ESC to exit edit mode. :wq to write and quit.)

repeat that procedure for the dali.cfg

=====(optional) patching app.sh to prevent it from rebooting=====
edit the app.sh in /app and remove all "reboot" occasions to prevent the camera from rebooting if onvifserver, httpd or daliServer arent running for debugging purposes.

 

====Patching the Thermal Camera module====
To patch it, you need to disassemble everything down to the FPGA Board,

on the bottom there is a SPI SOIC8 Flash.

Use a CH341 EEPROM programmer (be sure to have a fixed or modified version to not put out 5V!, set it to 3.3V) and SOIC8 clamp.

Use NeoProgrammer (i used 2.2.0.10 but there are newer available, use the latest) and click Detect. It should find W25Q128 chips, select the FV one.

Dont forget to download a backup of your flash and save it !

Download the Binary "Dali 640x480 '''actual''' cleared pixelmap.bin" from #3 below and load it into NeoProgrammer,

Click Erase, Program and Verify.

This can take a while.

Your imager should start up right after assembly by hearing the shutter click.

==Hardware Hacking==

===Flash Contents===
On archive, click on show all files to download them.

<nowiki>#</nowiki>1 a Flash dump of the original downgraded D8X3N can be found [https://archive.org/details/dali-d-843n-flash-dump here]

<nowiki>#</nowiki>2 a Flash dump of a original 640x480 model can be found [https://archive.org/details/d-843-n-640x-480 here]

<nowiki>#</nowiki>3 a modified Flash dump of a 640x480 with cleared dead pixel map, flat map etc. can be found [https://archive.org/details/d-843-n-640x-480-cleared-pixelmap here]

a Flash dump of the web server SPI flash W25Q256JV can be found [https://archive.org/details/dm-60-webserver-flash-dump here] in case a bad firmware update caused a bootloop.

 

===Flash Binary Analysis===
The Flash IC is a Winbond 25Q128JV SPI Flash that contains the FPGA Bitstream, Deadpixel and Flatmap, aswell as the Device Settings.

a copy of the SPI Logic Capture at startup can be found [https://archive.org/details/dali-eeprom-capture here], the free software [https://www.dreamsourcelab.com/download/ DSView from DreamSourceLab] is required to view it.
[[File:Dali Thermal Imager SPI Flash capture.png|thumb|SPI Flash access while booting the Thermal Module]]

a approximation of the offsets resulted in this list:<syntaxhighlight lang="vb">
0x000000 - altera cyclone iv stuff
0x200000 - settings
0x280000 - Flat field correction map
0x4C0000 - Bad Pixel correctio nmap
0x580000 - image aswell? 36010 bytes
0x740000 - GUIX?
0x7C0000 - Strings for Gui?
0x800000 - another shorter GUIX
0x880000 - Strings for second gui?
0x8C0000 - GUIX
0x940000 - Strings for gui
0xE00000 - ?
0xE80000 - dzxg? short
0xEC0000 - crosshair.bmp
0xF40000 - 3DTM?
0xF80000 - fake? Bad pixel map BPRP
</syntaxhighlight> 

====Settings offset 0x200000====
The settings are read and written every startup, aswell when you close the OSD, sporadically and when executing the command MSV

these are some of the settings i could figure out by changing and watching the logic capture what changed.
 <syntaxhighlight lang="vb">
offset size Cmd
0x0 1 SAG (0-2) auto gain
0x2 2 SVB (0-16383) saved value is 16383 - SVB
0x4 2 SVC (0-1023) set exposure or gain
0x6 1 SSM image filtering
0x8 1 SEH image enhancement
0xA 1 SWP invert b/w polarity
0x14 1 SMR Flip
0x16 1 SMR Mirror
0x20 1 MENU Cal source 0 IN, 1 OUT
0x3A 1 MENU Enhance value 0-100
0x40 1 MENU Rectify (shutter 0 OFF, 1 L, 2 H)
0x50 1 MENU Language 0 english, 1 chinese, 2 russian
0xA2 - SCO set contrast gain
0xA4 - IBR set brightness
0xAE 2 MENU Fire Threshold
0xAC 1 SPA set color palette
0xE2 1 SMS display "collected 0/80" enabled
0xF8 1 SEM set emissivity
0x110 1 SRT set revise temp
0x116 1 SHD set humidity
0x118 1 SET set ambient temp
0x11A 1 STD set temp range
0x120 2 SLG -500 to 500?
0x124 2 SRD set distance
0x12C 1 SCP ???
0x130 2 SCT ???
</syntaxhighlight> 
[[File:Dali D8X3N Bad Pixel Map Viewer.png|thumb|Bad pixel map of a 640x512 sensor, about 0.56% of dead pixels in this map]]
So i let the AI create a [https://2476424.playcode.io/ Configurator page] that lets you change the Settings in your Flashdump to your liking
 

====Bad Pixel and Flatframe Maps 0x280000 and 0x4C0000====
Thermal cameras require a bad pixel and flat frame map to compensate for manufacturing inconsistencies.

unfourtainly, the maps of the downgraded cameras only contain enough data for a 384 model, not the full 640.

at offset 0xF80000 there is a BPRP which was mistaken at first as the Bad pixel map, it could just be a mask to where to apply the offset maps, as its either 0x0 or 0x1.

The [https://2477569.playcode.io/ Viewer Page] is written in JS and does not require any special dependencies, it can run as a plain html file offline.

There still needs to be work done to create own maps and flatfields but the cameras are still very capable and useable with fully cleared maps.

To clear the maps, just go to these offsets and fill with values around 0x3F or 0x0 for total length of X Resolution x Y Resolution x 2 bytes (0x96000 for 640x480)

[[File:Dali D8X3N Flat Field Map Viewer.png|thumb|Flat Field viewer]]

==Dali Commands==
To control the TIM you can either use Pelco or Dali command set. By default the Dali commandset is used at 38400 BAUD.

Those commands consist of a 0x02 start byte followed by two length Bytes, then the actual command which is allways 3 uppercase Letters in ASCII (eg. KBD for keyboard) followed by a comma and the values.

Some commands take multiple values, some dont. But you allways have to send the comma after the Command.

The camera will answer with the Command and 0, 1 or 2. Sending no value counts as zero.
0 is invalid parameters, too few or out of range

1 is OK, valid command

2 is Invalid command

Commands can be sent trough the Web server using the URL Api endpoint or directly trough the UART port.

(keyboard, C button, causes the shutter to do a calibration)
<camera ip>/cgi-bin/dmcmd?Command=KBD,C
Listening to the answer can be done while being in the Linux shell and typing
cat /dev/ttyAMA2 | strings

By bruteforcing the UART with AAA to ZZZ a list of Commands could be obtained, but some with unknown Parameters or functionality yet. including some from a decompiled DM60comm.so module found in /app/modules folder.<syntaxhighlight lang="vb">
KBD KEY Keyboard (F S M C + -)
SSM 0-1 Image Filtering Off/On
GSM 0 Image filter status
SEH 0-1 Image Enhancement Off/On
GEH 0-1 Image enhancer status
SCO 0-255 Set Gain (locked when SAG auto gain is on)
GCO 0-255 Get gain
INT 15-320 set actual gain? not just contrast sometimes disabled?
IBR 0-255 Set brightness
GBR 0-255 Get brightness
SMR 0-3 Mirror mode bit0=horizontal, bit1=vertical
GMR 0 Get rotation/flip
SDT 0-1 displays temp=44.65°C osd, but webserver sends date/time to the cam there....
GDT 0-1 Get temp display active?
GPT Display temp oft SDT
GNU 0-1 Get Shutter closed/open
SNU 0-1 Shutter close / open
STD 0-1 Set Range 0: -20-180°C 1: 100-600°C
GTD 0-1 Get Range
SET °C Set Ambient temperature
GET °C Get Ambient temperature
SEM 0-100 0-1 set emissivity x100
GEM 0-100 Get Emissivity
SRT °C Set revise temperature -100-100 -10-10°
GRT °C Get revise temperature
SRD 100 Set Distance 4.4m x100
GRD 100 Get Distance
SHD 0-100 Set Humidity
GHD 55 Get Humidity
SWP 0-1 invert s/w polarity image
GWP 1 is inverted?
SPA 0-10? Set color palette
GPA 3 white hot
SMV 0-1 Show temperature 3x3 grid?? in combination with GTV maybe
GMV 0
SMS 0-1 displays "collected 0/<number set by SCT>" by SCP delay "saves the daily number of highest temperatures?"
GMS 0
SCT 1-500 sets the amount of "collected" points for SMS
GCT 80
SCP 5-60 "collected" delay in seconds for SMS
GCP 60
SAG 0-2 Auto brightness / gain
GAG 0
SLR 0-9 ???
GLR 0
SRP 0,0 - 639,479 set crosshair position
GRP 320,240 get crosshair position
DRC 0-1 Show crosshair
SLG -500-500 ??
GLG
SCE text ??
GCE 0
SCB text ??
GCB 0
SVB 0-16383 adc offset, exposure? good at 9650
GVB 6733 value is 16383 minus SVB
SVC 1-1023 set contrast but better
GVC 260
SVF 100-? ?? video freaks out 3400 seems good
SVS 100-? ?? video freaks out 3300 seems good
SOT 0-1 ?? sensor supply, looks weird when off.
SZM 1-4 ?
GZM 1
MSV save settings too eeprom
ASV Saves something aswell?
GCS 0 Get Core status & faults
ALD 0,2? video blanks lots of eeprom activity. reload pixel map??
SAV 0-9999 set Fire threshold
GAV 2100 get Fire Threshold
BAC change uart protocol? careful
CBD Displays Recovery successful?
CBS Displays Saved successfully
LRD Displays Recovery successful?
LRS Displays Saved successfully?
LRE Displays Temperature Repair successful?
CBT Displays Calibration successful?
DBP ??? shutter clicks
DPI Show weird pixels
API Hide weird pixels
CCM ??
ASN 0-4 ??
GAB 4 vals ?? 3,-10,50,150
GAN 1 ??
GAR 11 vals ?? 10,10,5,20,35,50,70,90,120,150,180,,
GCM 6 values ??
GFV prints screen gray value?
GIT 200 ??
GTV Get the collected temp values?
PTS echoes but with extra stuff??
QYA 7170 Query Gray Info (information mode)
QYI 7124 Query Gray Average mode
QYM 7512 Query Gray Minimum mode
VTP 400-4000 ??
MTD U/S,0,0 ?? S answers with bytes, U upload bytes?
MTC U/S? ?? S answers with U,0,0, S doesnt.

return 0 invalid params:
STS ??
STT ??
SAC ??
SAH ??
SAS ??
SAT ??
SCX ?? displays crosshair but invalid params
SCY ?? displays crosshair but invalid params
GAC ??
GAH ??
GAS ??
GAT ??
GME ??
GPC ??
GPI ??
GPM ??
GTA ??
GTC ??
GTI ??
GTM ??
GTS ??
GTT ??

answer only:

BPM 0-1 stream ready? answers with 0 stop, 1 go, 2 when prompted
AVS 0,1
MEH
PWI 0-1 changing palette from wh to fire

unconfirmed (from dm60comm.so):
SDT 2024,03,15,14,30,25 Set Date Time with year,month,day,hour,minute,second
STS 1 Set Temperature Show display (0=off, 1=on)
SVA 2 Set Video Auto mode (0=manual, 2=auto)
SMP 0,1,1,0,100,150,200,250,300,350,90,25 Set Measurement Point (type,index,enable,mode,startX,startY,endX,endY,anchorX,anchorY,threshold,color)
STV Stop Temperature View measurements
SPF 5 Set Profile parameter
SVL -10 Set Video Left pan movement (signed value)
SVU -5 Set Video Up tilt movement (signed value)
SVD 5 Set Video Down tilt movement (signed value)
SSP 17,1,0 Set System Parameter (param_id,value,index) #46 temperature format 0 °C, 1 °F, 2 K
SCP Set Current Preset (save current position)
GCP Get Current Preset
STT 300,350 Set Temperature Threshold (low,high values *10)
SDC 1 Set Display Configuration parameter
GCS Get Current Status
GMM Get Memory Map information
GFV Get Frame Value (grayscale data)
GFZ Get Freeze Status
GSI 1 Get System Information (parameter=1)
GSS Get System Status
GSP 21,0 Get System Parameter (param_21=surround temp, value=0)
GTT Get Temperature Threshold range
GTV 1,3,10 Get Temperature Values (enable,type,count)
GNU Get Network Update status (response command)
FRZ Freeze current display frame
LIV Live mode (unfreeze display)
CAL Calibrate system
CCP 3 Call Current Preset (preset number 0-9)
APF 100 Auto Profile setting
MEH Measure Enhancement
BPT Built-in Test
MTC S,0 Measure Temperature Capture (S=start, 0=sequence)
MTG U,0,1024,<data> Measure Temperature Gray data transfer
MTD U,0,1024,<data> Measure Temperature Data transfer
UFP S,0,2048 Update Firmware Prepare (S=start, 0=offset, 2048=size)
UFD S,0,1024 Update Firmware Data transfer
BAB U Buffer operation (U=update)
TTH S,0 Temperature Threshold operation
IPP 192.168.001.102,255.255.255.000,192.168.001.001,192.168.000.001,9989,9998 IP Parameters (IP,netmask,gateway,DNS,port1,port2)
MAC 00:60:A9:10:00:01 MAC Address setting
SNP Set Network Parameters (response command)
QYI Query Gray Info (information mode)
QYA Query Gray Average mode
QYM Query Gray Minimum mode
GAI Get Alarm Info (response command)
YTC <data> Unknown command with data parameter
HTH
LRS
LRD
GAR
DRC
PTS
SCX
SCY
CBT
LRE
CBD
CBS
XXX
GSP
GTT
QYI
QYA
QYM

</syntaxhighlight>

==Secret Menu Overview==
The secret menus Main and System can be openend with the password '''+-MC+-'''

Its structured like this, not all variables have been figured out yet.

The format is Menu: submenu: submenu:

and for menu entries: Name, default value, command, description or messages that pop up.
 <syntaxhighlight lang="vb">
MAIN & SYSTEM PASS: +-MC+-

entries are NAME VALUE COMMAND DESC or if its a folder its just ":"

System:
System:
Gain 255 SCO
Bright 102 IBR
BenDi 100 ?
BenDiContrase 80 ?
DisMode 0 ?
Frequency 48hz (24,25,48,50)
DigitalOut 8-14bit 14bit, BT656(_P), ?, BT601
AutoFocus N ?
Line 1 ?
Ltemp0 11800 ?
LTemp1 11000 ?
HTemp0 9500 ?
HTemp1 8700 ?
DelayTime 0 ?
Enhance 0-1 ?
Enhanced E1 230 ?
FPA_Gain 12pF ? between 4 and 18 at random.
NUCEn N ?

Area:
SE 2 ASN 0-4 "Partition"
INT 200 INT "Points time"
VS 3161 SVS
VF 2800 SVF
Vtemp 1401 VTP
VtempArea Low ?
VtempBase 13500 ?
VtempStep -1 ?
VsStep 8 ?
DeadPixelModel preset / calculate
DP: Cursor to select dead pixels
X 360 position
Y 288 position
AutoBP: 50 Press C to start automatic dotting
Quit? Number of bad pixels 961& "Blind element replacement in progress"
Undo
R2: Save data? blind pixel replacement in progress
Replace Y N = DPI, Y = API
L: Reading parameters
S: Saving parameters

Debug:
Rectify N
DisplayGary N
TE N SDT
AutoE ? ?
AutoVS Y ?
VSGrayH 8000 ?
VSGrayL 7000 ?
Trends 1 ?
Shelter N ?
MotorCon 3 ?
SaveFactoryPara:
LanTyp EN ? LANGUAGE
DisplayMT N ?
Version:
PRJ D843 DLD640 ImLib, MTlib, Soft, Logic

BackDispose:
GammaEN 1 ?
Gain 1 ?
EnhanceEN 0 ?
Hpf_shift 5 ?
Hpf_thrd 5 ?
Enhance 150 ?
Lthrd 50 ?

Monitor:
Opens normal OSD

Alarm Set:
Alarm Switch Y ?
Alarm Mode No ?
Alarm Temperature -1°C ?
Reference Gray Y ?
Alarm Level 1L ?
Alarm Gray 65535 ?
Alarm PointNum 0 ?
Correct Gray 0 ?

Thermometry:
Data Collection 0 SMS
Interval 60 SCP
Ammount 90 SCT
Environment normal ?
Export:
Displays: Exportin normal temperature MTC data
Correction -1 ?
Emissivity 100 SEM
Calibration:
BlackbodyTemp -10 grabs a val from GAB
Save CBS
Cancel CBD
Correction:
BlackbodyTemp -10 Picks from the list GAR
Grayscale 0 SLG
Confirm LRE
Save LRS
Cancel LRD
Ninepoint measurement SMV

Cursor:
Cur N DRC enable cursor
X 320 SRP set cursor position
Y 240 SRP set cursor position

Main:
Auto 2 SAG Auto gain
G 211 SVC
B 10002 SVB
P 1 SWP polarity
Z X ?
Settings:
Image:
FI Y ?
FIValue 0 ? 0-31
Freeze N Freeze image
VE N SMR Vertical flip
HO N SMR Horizontal flip
AutoCali L same as rectify?
O IN internal or external
COM:
Opens UART menu
AvoidburnSwitch OFF enable anti burn in
ProtectedTime 10S duration
AvoidBurn 16383 threshold to trigger antiburn

</syntaxhighlight>

===Automatic Dead Pixels and Flatmap Correction===

It it possible to generate a new flat and dead pixel map automatically within the camera after flashing the cleared-map binary.
 

=====Dead pixels:=====
In the secret menu "System", navigate to Debug - DeadPixelModel and set the AutoBP (sensitivity for auto bad pixel finding) to 50 or so. Then press C Button

This can take a while.
[[File:High emissivity peltier black body.jpg|thumb|A Peltier / TEC coated in Candle sood to give it a high emissivity surface. It can be cooled or heated by swapping the polarity. ]]

Afterwards, navigate to S: and press + to save it.
 

=====Flatfield:=====
In the Debug menu navigate to R2 and press +

now place something '''Cold''' infront of the Camera with a high emissivity. (it needs to fill the whole image)

Press '''+''', wait for it to says High temperature.

Place something '''Hot''' infront and press '''+''' again.

Afterwards, save with '''S:''' again.

Flatfield should now be calibrated
 <blockquote>Note: Not all dead pixels are auto detected or get removed. you can manually select them in the Dead pixel editor but its not known yet how to select and correct them.</blockquote>

 

==Using the Thermal module without Webserver==
[[File:Dali D8X3C Breakout board.png|thumb|Breakout board for D8X3C ]]
to use it, you need to interface it directly.

The module will put out a Analog video signal (High-Z, need to buffer when connecting it to 75Ohm Video input)

Also a 8 or 14bit or 8-bit BT656 output.

the header exposes the FPGA JTAG and UART aswell as 6 Hardware Keys to Navigate the OSD.

To interface, you need to make a adapter board with a DF12-50DS-0.5V(86) Docking socket.

The breakout board files can be found [https://oshwlab.com/gamerpaddy/d8x3c-backpack-usb here] but may be still work in progress.

 

==Sensor Pinout==
[[File:Dali DLD384 Sensor pinout basic.png|thumb|basic pinout of a DLD384]]
the pinout of the thermal sensor havent been analyzes much.

besides some supply and Control voltages, 3 clocks and a analog output have been found.

17.5MHz

14.705KHz

50Hz

Dali D8X3N Thermal Camera

2025-08-04T15:56:49Z

Gamerpaddy: /* Raw Viewer for the internal Webserver (recommended) */

=Dali D8X3N Thermal Camera Reverse Engineering=
 

===Introduction===
The [https://www.dali-irtech.com/productinfo/741567.html Dali D8X3N] Thermal Camera module comes in two versions, a 384x288 and 640x480 resolution, utilizing the [http://www.dali-tech.us/products/dld64017m-uncooled-infrared-fpa-detector-86.html DLD Series] of amorphous-Silicon Microbolometers.

They were mainly used in [http://www.dali-tech.us/products/dm60-w--online-body-temperature-thermal-imaging-camera-55.html Dali DM60-W] or WS-1 Body Temperature screening cameras in conjunction with a Black Body radiator set to 37°C to detect infected individuals at the start of the 2020 Covid Pandemic.
[[File:ICI FM320P Innerts.jpg|thumb|Internals. A TP-Link Switch, HikVision Visible Camera and the D8x3N Network thermal camera module]]
[https://infraredcameras.com/ ICI] rebranded these models as FM 320 P and FM 640 P, and distributed them on the local US market, but as the need for such Cameras exploded, those models were built with what was in stock.

So happens, that some of the FM 320 P Models had a DLD640 640x480 instead of a DLD384 384x288 Microbolometer in them, and just got their Firmware modified.

It also could be, because they have excessive amounts of bad pixels outside the 384x288 area, that they were binned to a lower grade.

Discussions about these Cameras started around 2022 in the [https://www.eevblog.com/forum/thermal-imaging/ici-and-dali-thermal-camera-software/ EEVBlog Forums.] when they started to appear secondhand and affordable.

Originally they were priced around US$ 20... 30.000 by ICI, and a unknown amount by Dali Tech.

The Modules specs according to the manufacturer are:

≤50..60mK@F1，300K，50Hz

17 or 25µm pixel pitch

Hisilicon SoC running Linux to provide Onvif and RTSP streams, analysis and a Web UI

 
[[File:Dali D8X3N Module.jpg|thumb|A real 384x288 model with a DLD384 sensor. notice the Productnumber ]]
ICI FM Cameras are found all over Online secondhand marketplaces for scrap Prices, as they are no longer needed.

But you never know, what are you getting. It could be a real DLD384 or the better DLD640 inside. Its a gamble.
 

======640x480 Imagers======
are labeled 22D843 Nxxxx and have a DLD640 sensor in it, they can be upgraded if they run the 384x288 firmware.

======384x288 Imagers======
are labeled 22D883Nxxxx and have a DLD384 sensor in it, they cannot be upgraded

 

==D8X3N Module closer look==
From now on, i will refer to the Thermal Imaging Module as TIM

On the front there is a 2 Element Germanium Lens of a unknown focal length and aperture.

It can be focus-adjusted when unscrewing the clamp around the housing. It can be focussed from infinity down to 10..20cm with some quality loss.
 The outter diameter of the Lens is 42mm with a 1 1/3 inch thread diameter of undetermined pitch.

Dimensions of the germanium elements are 21mm to 3 and 6mm and 14grams in weight.
[[File:Disassembled Thermal Camera Lens.jpg|thumb|Two element Germanium Lens of unknown focal length and aperture]]

The TIM is composed of 6 Stacked PCB modules, 3 of which are for the Web Server functionality. taking them off will give you the basic configuration of a [https://www.dalithermal.com/productinfo/741568.html Dali D8X3C] TIM<gallery>
File:Dali DLD640 Thermal Image Sensor.jpeg|DLD640 Sensor
File:Dali DLD384 Thermal Imaging Sensor.jpeg|DLD384 Sensor
File:Dali D8X3N Board1 Back.jpeg|Network & GPIO Board Back
File:Dali D8X3N Board1 Front.jpeg|Network & GPIO Board Front
File:Dali D8X3N Glue Board Back.jpeg|Board between Logic and IO Back
File:Dali D8X3N Glue Board Front.jpeg|Board between Logic and IO Front
File:Dali D8X3N SoC Board Back.jpeg|SoC Board back
File:Dali D8X3N SoC Board front.jpeg|SoC board front
File:Dali D8X3N FPGA Board Back.jpeg|FPGA Board of the D8X3C Thermal Imager including a PMIC
File:Dali D8X3N FPGA Board Front.jpeg|FPGA Board Front with Video DAC and SPI Flash
File:Dali D8X3N Sensor Power and ADC Board.jpeg|Sensor control and ADC board
File:Dali D8X3N Thermal Core Debug wiring.jpeg|Debug wiring for sniffing SPI and UART
</gallery>

===User Manual===
including pinout diagram and important data

can be found here https://archive.org/details/dali-d-8-x-3-cuser-manualen-v-1.0-1

==Viewing the Video Stream==
[[File:Onvif Device Manager ODM.png|thumb|ODM streaming the Thermal view]]
when first connecting it to power and Ethernet, the camera will have 192.168.1.102 as a Static ip.

If you are running a 192.168.0.x or .178.x net, you need to change it or add a subnet under windows ipv4 settings.

to view it, you can use VLC and the stream URL
rtsp://admin@admin:<camera ip>/ONVIFMedia
there is /ONVIFMedia /ONVIFMediaM and /ONVIFMediaS for different stream Profiles.

VLC is quite slow and delayed, rather use Onvif Device Manager ODM,

it has no delay and auto-detects cameras in the network.

Be sure to log in as user: admin pass: admin in ODM.

in there, you can also set you camera to DHCP under Network settings.

===Web Interface===
[[File:Dali D8X3N web interface.png|thumb|Since browsers cant display RTSP anymore, open in Edge and select IE Compatibility Mode.]]
the web interface can be accessed by opening the camera IP in a browser

login is:
user: admin pass: admin
You can set Temperature markers and areas, but without using the Black Body calibration source, your readings may be way off or not working.

 

====OSD====
there is a debug-login with
user: super pass: 871897
that lets you send Key commands to the Imager to navigate the OSD.

Setting the OSD to english is accomplished with option #11
[[File:Dali D8X3C OSD.png|thumb|OSD in english, if yours is Chinese. go to option #11 and click + or -]]

To acces some locked menus, press
+ - + - + -

The password for the locked System and Main menu is
+-MC+-

Be careful in the UART menu to not change the BAUD rate or Protocol, as your ability to control it via the Web API gets lost.

You need to reflash or solder buttons on the thermal core then.

==Viewing Raw Thermal Data from the Web API==
there is a hidden endpoint in the stream.so file that could be found while decompiling

accessing
[[File:Arduino Nano blink sketch thermal gif.gif|thumb|Arduino Nano running blink sketch while thermally recording it, notice the led and resistor on the right]]
<ip of camera>:5000/stream?Type=JPEG&Source=Jpeg&Mode=TCP
lets you download a JPEG. but there are more options available (not all have been tested)

we are mainly interessted in Raw thermal data.

====Source (Stream Type)====

*<code>Major</code> - Main video stream (channel 0)
*<code>Minor</code> - Sub video stream (channel 1)
*<code>MinorAV</code> - Sub video + audio stream
*<code>MajorAV</code> - Main video + audio stream
*<code>Jpeg</code> - JPEG snapshot stream
*<code>Raw</code> - Raw thermal data stream
*<code>YUV</code> - YUV raw video stream

====Type (Data Format)====

*<code>H264</code> - H.264 video encoding
*<code>JPEG</code> - JPEG image format
*<code>RAW</code> - Raw sensor data
*<code>QBOX</code> - Custom protocol format
*<code>FRAME</code> - Frame-based format

====Mode (Transport Protocol)====

*<code>TCP</code> - TCP streaming (default)
*<code>UDP</code> - UDP streaming
*<code>MUL</code> - Multicast streaming

====Quality Parameters====

*<code>Quality=[1-100]</code> - Video quality level
*<code>Frames=[number]</code> - Number of frames to send
*<code>Interval=[ms]</code> - Frame interval in milliseconds

====Network Parameters====

*<code>IPAddr=[ip]</code> - Client IP address for UDP/multicast
*<code>Port=[port]</code> - Client port for UDP/multicast
*<code>Heart-beat=[Yes/No]</code> - Enable/disable heartbeat

====Snapshot Parameters====

*<code>Snap=[Yes/No]</code> - Enable snapshot mode

====Raw Viewer for PC (Python)====
[[File:Dali D8X3N Raw Thermal viewer.png|thumb|Raw Data Viewer in python]]

To view the raw stream, i made a python program that converts the 14bit thermal data to a visible image.

it is low fps tho, due to bad optimizations.

rev1 first working version https://pastebin.com/dyNWDPT3

rev2 with temperature readout https://pastebin.com/u107Q85w

rev3 and onward will only be available directly as a Webpage on the Device (see below).

====Raw Viewer for the internal Webserver (recommended)====
It is also possible to use the Raw viewer directly in the browser.

To achieve this, the stream had to be proxied from port 5000 to 80 due to CORS.

luckily the internal lighttpd had the CGI module enabled, so piping it troug (using wget ... i know) worked with very low overhead.

To install, you need '''Terminal access''' to the Camera. see below.

optional for simplicity: '''ftp''' access

Then download the '''rawviewer.zip''' from [https://archive.org/details/rawviewer_202508 here] (rev3 with histogram, javascript)
[[File:Dali D8X3N Webviewer.png|thumb|Web Raw Viewer with histogram (rev3)]]

unpack the web folder into '''/app''' and run
chmod +x /app/web/webpages/proxy.cgi
then edit the '''dali.cfg''' and change '''WEB_SERVER''' to '''lighttpd'''

and then '''restart''' your camera.

It should be accessible now trough '''http://<camera ip>/raw.html''' in the browser and click '''Start Stream'''
 <blockquote>performance may need improvement.</blockquote>

==Getting Root Terminal Access==
To access the Terminal you need to solder or plug in a UART connection to Connector J7 on the "Glue" board.

Pinout is (left to right) '''RX TX GND 3.3V Baud 115200 3.3V!'''

But the system will spam with debug messages, making patching the files a hard job unless you use "tftp" or "sed" commands.
 

====Enabling Telnet access to make patching easier====
[[File:Upgrade ici dali firmware updater.png|thumb|ICI Firmware updater software with modified firmware loaded]]

there is a easier way using a modified Firmware updater to enable Telnet temporarily to patch the Files.

Download the '''upgrade_ici.exe''' form [https://archive.org/details/fwupdate here] and run it.

Then you should be able to connect to it via Telnet.

The Login credentials are '''User: roo'''t '''Password: DLroot'''

 

===Patching Device===

===Patching the Web Server===
 

====Enabling Telnet and ftpd permanently====

This only works if you also patch the Thermal Camera module flash!

to permanently enable Telnet, go to '''/etc/init.d''' and edit '''S90app'''
vi S90app
in vi, move your cursor to the '''#''' at '''#telnetd''' and press x<blockquote>optional: enable ftp by removing the '''#''' at '''ftpd''' and adjust the path to / </blockquote>now press ''':''' and type '''wq''' and hit '''enter'''. this should be it.

====Patching the decoder and streamer to 640x480:====
go to /app and edit the mach.cfg

replace DL384 with D640 and edit the resolution to 640 480

(press i in vi to enter edit mode, press ESC to exit edit mode. :wq to write and quit.)

repeat that procedure for the dali.cfg

=====(optional) patching app.sh to prevent it from rebooting=====
edit the app.sh in /app and remove all "reboot" occasions to prevent the camera from rebooting if onvifserver, httpd or daliServer arent running for debugging purposes.

 

====Patching the Thermal Camera module====
To patch it, you need to disassemble everything down to the FPGA Board,

on the bottom there is a SPI SOIC8 Flash.

Use a CH341 EEPROM programmer (be sure to have a fixed or modified version to not put out 5V!, set it to 3.3V) and SOIC8 clamp.

Use NeoProgrammer (i used 2.2.0.10 but there are newer available, use the latest) and click Detect. It should find W25Q128 chips, select the FV one.

Dont forget to download a backup of your flash and save it !

Download the Binary "Dali 640x480 '''actual''' cleared pixelmap.bin" from #3 below and load it into NeoProgrammer,

Click Erase, Program and Verify.

This can take a while.

Your imager should start up right after assembly by hearing the shutter click.

==Hardware Hacking==

===Flash Contents===
On archive, click on show all files to download them.

<nowiki>#</nowiki>1 a Flash dump of the original downgraded D8X3N can be found [https://archive.org/details/dali-d-843n-flash-dump here]

<nowiki>#</nowiki>2 a Flash dump of a original 640x480 model can be found [https://archive.org/details/d-843-n-640x-480 here]

<nowiki>#</nowiki>3 a modified Flash dump of a 640x480 with cleared dead pixel map, flat map etc. can be found [https://archive.org/details/d-843-n-640x-480-cleared-pixelmap here]

a Flash dump of the web server SPI flash W25Q256JV can be found [https://archive.org/details/dm-60-webserver-flash-dump here] in case a bad firmware update caused a bootloop.

 

===Flash Binary Analysis===
The Flash IC is a Winbond 25Q128JV SPI Flash that contains the FPGA Bitstream, Deadpixel and Flatmap, aswell as the Device Settings.

a copy of the SPI Logic Capture at startup can be found [https://archive.org/details/dali-eeprom-capture here], the free software [https://www.dreamsourcelab.com/download/ DSView from DreamSourceLab] is required to view it.
[[File:Dali Thermal Imager SPI Flash capture.png|thumb|SPI Flash access while booting the Thermal Module]]

a approximation of the offsets resulted in this list:<syntaxhighlight lang="vb">
0x000000 - altera cyclone iv stuff
0x200000 - settings
0x280000 - Flat field correction map
0x4C0000 - Bad Pixel correctio nmap
0x580000 - image aswell? 36010 bytes
0x740000 - GUIX?
0x7C0000 - Strings for Gui?
0x800000 - another shorter GUIX
0x880000 - Strings for second gui?
0x8C0000 - GUIX
0x940000 - Strings for gui
0xE00000 - ?
0xE80000 - dzxg? short
0xEC0000 - crosshair.bmp
0xF40000 - 3DTM?
0xF80000 - fake? Bad pixel map BPRP
</syntaxhighlight> 

====Settings offset 0x200000====
The settings are read and written every startup, aswell when you close the OSD, sporadically and when executing the command MSV

these are some of the settings i could figure out by changing and watching the logic capture what changed.
 <syntaxhighlight lang="vb">
offset size Cmd
0x0 1 SAG (0-2) auto gain
0x2 2 SVB (0-16383) saved value is 16383 - SVB
0x4 2 SVC (0-1023) set exposure or gain
0x6 1 SSM image filtering
0x8 1 SEH image enhancement
0xA 1 SWP invert b/w polarity
0x14 1 SMR Flip
0x16 1 SMR Mirror
0x20 1 MENU Cal source 0 IN, 1 OUT
0x3A 1 MENU Enhance value 0-100
0x40 1 MENU Rectify (shutter 0 OFF, 1 L, 2 H)
0x50 1 MENU Language 0 english, 1 chinese, 2 russian
0xA2 - SCO set contrast gain
0xA4 - IBR set brightness
0xAE 2 MENU Fire Threshold
0xAC 1 SPA set color palette
0xE2 1 SMS display "collected 0/80" enabled
0xF8 1 SEM set emissivity
0x110 1 SRT set revise temp
0x116 1 SHD set humidity
0x118 1 SET set ambient temp
0x11A 1 STD set temp range
0x120 2 SLG -500 to 500?
0x124 2 SRD set distance
0x12C 1 SCP ???
0x130 2 SCT ???
</syntaxhighlight> 
[[File:Dali D8X3N Bad Pixel Map Viewer.png|thumb|Bad pixel map of a 640x512 sensor, about 0.56% of dead pixels in this map]]
So i let the AI create a [https://2476424.playcode.io/ Configurator page] that lets you change the Settings in your Flashdump to your liking
 

====Bad Pixel and Flatframe Maps 0x280000 and 0x4C0000====
Thermal cameras require a bad pixel and flat frame map to compensate for manufacturing inconsistencies.

unfourtainly, the maps of the downgraded cameras only contain enough data for a 384 model, not the full 640.

at offset 0xF80000 there is a BPRP which was mistaken at first as the Bad pixel map, it could just be a mask to where to apply the offset maps, as its either 0x0 or 0x1.

The [https://2477569.playcode.io/ Viewer Page] is written in JS and does not require any special dependencies, it can run as a plain html file offline.

There still needs to be work done to create own maps and flatfields but the cameras are still very capable and useable with fully cleared maps.

To clear the maps, just go to these offsets and fill with values around 0x3F or 0x0 for total length of X Resolution x Y Resolution x 2 bytes (0x96000 for 640x480)

[[File:Dali D8X3N Flat Field Map Viewer.png|thumb|Flat Field viewer]]

==Dali Commands==
To control the TIM you can either use Pelco or Dali command set. By default the Dali commandset is used at 38400 BAUD.

Those commands consist of a 0x02 start byte followed by two length Bytes, then the actual command which is allways 3 uppercase Letters in ASCII (eg. KBD for keyboard) followed by a comma and the values.

Some commands take multiple values, some dont. But you allways have to send the comma after the Command.

The camera will answer with the Command and 0, 1 or 2. Sending no value counts as zero.
0 is invalid parameters, too few or out of range

1 is OK, valid command

2 is Invalid command

Commands can be sent trough the Web server using the URL Api endpoint or directly trough the UART port.

(keyboard, C button, causes the shutter to do a calibration)
<camera ip>/cgi-bin/dmcmd?Command=KBD,C
Listening to the answer can be done while being in the Linux shell and typing
cat /dev/ttyAMA2 | strings

By bruteforcing the UART with AAA to ZZZ a list of Commands could be obtained, but some with unknown Parameters or functionality yet. including some from a decompiled DM60comm.so module found in /app/modules folder.<syntaxhighlight lang="vb">
KBD KEY Keyboard (F S M C + -)
SSM 0-1 Image Filtering Off/On
GSM 0 Image filter status
SEH 0-1 Image Enhancement Off/On
GEH 0-1 Image enhancer status
SCO 0-255 Set Gain (locked when SAG auto gain is on)
GCO 0-255 Get gain
INT 15-320 set actual gain? not just contrast sometimes disabled?
IBR 0-255 Set brightness
GBR 0-255 Get brightness
SMR 0-3 Mirror mode bit0=horizontal, bit1=vertical
GMR 0 Get rotation/flip
SDT 0-1 displays temp=44.65°C osd, but webserver sends date/time to the cam there....
GDT 0-1 Get temp display active?
GPT Display temp oft SDT
GNU 0-1 Get Shutter closed/open
SNU 0-1 Shutter close / open
STD 0-1 Set Range 0: -20-180°C 1: 100-600°C
GTD 0-1 Get Range
SET °C Set Ambient temperature
GET °C Get Ambient temperature
SEM 0-100 0-1 set emissivity x100
GEM 0-100 Get Emissivity
SRT °C Set revise temperature -100-100 -10-10°
GRT °C Get revise temperature
SRD 100 Set Distance 4.4m x100
GRD 100 Get Distance
SHD 0-100 Set Humidity
GHD 55 Get Humidity
SWP 0-1 invert s/w polarity image
GWP 1 is inverted?
SPA 0-10? Set color palette
GPA 3 white hot
SMV 0-1 Show temperature 3x3 grid?? in combination with GTV maybe
GMV 0
SMS 0-1 displays "collected 0/<number set by SCT>" by SCP delay "saves the daily number of highest temperatures?"
GMS 0
SCT 1-500 sets the amount of "collected" points for SMS
GCT 80
SCP 5-60 "collected" delay in seconds for SMS
GCP 60
SAG 0-2 Auto brightness / gain
GAG 0
SLR 0-9 ???
GLR 0
SRP 0,0 - 639,479 set crosshair position
GRP 320,240 get crosshair position
DRC 0-1 Show crosshair
SLG -500-500 ??
GLG
SCE text ??
GCE 0
SCB text ??
GCB 0
SVB 0-16383 adc offset, exposure? good at 9650
GVB 6733 value is 16383 minus SVB
SVC 1-1023 set contrast but better
GVC 260
SVF 100-? ?? video freaks out 3400 seems good
SVS 100-? ?? video freaks out 3300 seems good
SOT 0-1 ?? sensor supply, looks weird when off.
SZM 1-4 ?
GZM 1
MSV save settings too eeprom
ASV Saves something aswell?
GCS 0 Get Core status & faults
ALD 0,2? video blanks lots of eeprom activity. reload pixel map??
SAV 0-9999 set Fire threshold
GAV 2100 get Fire Threshold
BAC change uart protocol? careful
CBD Displays Recovery successful?
CBS Displays Saved successfully
LRD Displays Recovery successful?
LRS Displays Saved successfully?
LRE Displays Temperature Repair successful?
CBT Displays Calibration successful?
DBP ??? shutter clicks
DPI Show weird pixels
API Hide weird pixels
CCM ??
ASN 0-4 ??
GAB 4 vals ?? 3,-10,50,150
GAN 1 ??
GAR 11 vals ?? 10,10,5,20,35,50,70,90,120,150,180,,
GCM 6 values ??
GFV prints screen gray value?
GIT 200 ??
GTV Get the collected temp values?
PTS echoes but with extra stuff??
QYA 7170 Query Gray Info (information mode)
QYI 7124 Query Gray Average mode
QYM 7512 Query Gray Minimum mode
VTP 400-4000 ??
MTD U/S,0,0 ?? S answers with bytes, U upload bytes?
MTC U/S? ?? S answers with U,0,0, S doesnt.

return 0 invalid params:
STS ??
STT ??
SAC ??
SAH ??
SAS ??
SAT ??
SCX ?? displays crosshair but invalid params
SCY ?? displays crosshair but invalid params
GAC ??
GAH ??
GAS ??
GAT ??
GME ??
GPC ??
GPI ??
GPM ??
GTA ??
GTC ??
GTI ??
GTM ??
GTS ??
GTT ??

answer only:

BPM 0-1 stream ready? answers with 0 stop, 1 go, 2 when prompted
AVS 0,1
MEH
PWI 0-1 changing palette from wh to fire

unconfirmed (from dm60comm.so):
SDT 2024,03,15,14,30,25 Set Date Time with year,month,day,hour,minute,second
STS 1 Set Temperature Show display (0=off, 1=on)
SVA 2 Set Video Auto mode (0=manual, 2=auto)
SMP 0,1,1,0,100,150,200,250,300,350,90,25 Set Measurement Point (type,index,enable,mode,startX,startY,endX,endY,anchorX,anchorY,threshold,color)
STV Stop Temperature View measurements
SPF 5 Set Profile parameter
SVL -10 Set Video Left pan movement (signed value)
SVU -5 Set Video Up tilt movement (signed value)
SVD 5 Set Video Down tilt movement (signed value)
SSP 17,1,0 Set System Parameter (param_id,value,index) #46 temperature format 0 °C, 1 °F, 2 K
SCP Set Current Preset (save current position)
GCP Get Current Preset
STT 300,350 Set Temperature Threshold (low,high values *10)
SDC 1 Set Display Configuration parameter
GCS Get Current Status
GMM Get Memory Map information
GFV Get Frame Value (grayscale data)
GFZ Get Freeze Status
GSI 1 Get System Information (parameter=1)
GSS Get System Status
GSP 21,0 Get System Parameter (param_21=surround temp, value=0)
GTT Get Temperature Threshold range
GTV 1,3,10 Get Temperature Values (enable,type,count)
GNU Get Network Update status (response command)
FRZ Freeze current display frame
LIV Live mode (unfreeze display)
CAL Calibrate system
CCP 3 Call Current Preset (preset number 0-9)
APF 100 Auto Profile setting
MEH Measure Enhancement
BPT Built-in Test
MTC S,0 Measure Temperature Capture (S=start, 0=sequence)
MTG U,0,1024,<data> Measure Temperature Gray data transfer
MTD U,0,1024,<data> Measure Temperature Data transfer
UFP S,0,2048 Update Firmware Prepare (S=start, 0=offset, 2048=size)
UFD S,0,1024 Update Firmware Data transfer
BAB U Buffer operation (U=update)
TTH S,0 Temperature Threshold operation
IPP 192.168.001.102,255.255.255.000,192.168.001.001,192.168.000.001,9989,9998 IP Parameters (IP,netmask,gateway,DNS,port1,port2)
MAC 00:60:A9:10:00:01 MAC Address setting
SNP Set Network Parameters (response command)
QYI Query Gray Info (information mode)
QYA Query Gray Average mode
QYM Query Gray Minimum mode
GAI Get Alarm Info (response command)
YTC <data> Unknown command with data parameter
HTH
LRS
LRD
GAR
DRC
PTS
SCX
SCY
CBT
LRE
CBD
CBS
XXX
GSP
GTT
QYI
QYA
QYM

</syntaxhighlight>

==Secret Menu Overview==
The secret menus Main and System can be openend with the password '''+-MC+-'''

Its structured like this, not all variables have been figured out yet.

The format is Menu: submenu: submenu:

and for menu entries: Name, default value, command, description or messages that pop up.
 <syntaxhighlight lang="vb">
MAIN & SYSTEM PASS: +-MC+-

entries are NAME VALUE COMMAND DESC or if its a folder its just ":"

System:
System:
Gain 255 SCO
Bright 102 IBR
BenDi 100 ?
BenDiContrase 80 ?
DisMode 0 ?
Frequency 48hz (24,25,48,50)
DigitalOut 8-14bit 14bit, BT656(_P), ?, BT601
AutoFocus N ?
Line 1 ?
Ltemp0 11800 ?
LTemp1 11000 ?
HTemp0 9500 ?
HTemp1 8700 ?
DelayTime 0 ?
Enhance 0-1 ?
Enhanced E1 230 ?
FPA_Gain 12pF ? between 4 and 18 at random.
NUCEn N ?

Area:
SE 2 ASN 0-4 "Partition"
INT 200 INT "Points time"
VS 3161 SVS
VF 2800 SVF
Vtemp 1401 VTP
VtempArea Low ?
VtempBase 13500 ?
VtempStep -1 ?
VsStep 8 ?
DeadPixelModel preset / calculate
DP: Cursor to select dead pixels
X 360 position
Y 288 position
AutoBP: 50 Press C to start automatic dotting
Quit? Number of bad pixels 961& "Blind element replacement in progress"
Undo
R2: Save data? blind pixel replacement in progress
Replace Y N = DPI, Y = API
L: Reading parameters
S: Saving parameters

Debug:
Rectify N
DisplayGary N
TE N SDT
AutoE ? ?
AutoVS Y ?
VSGrayH 8000 ?
VSGrayL 7000 ?
Trends 1 ?
Shelter N ?
MotorCon 3 ?
SaveFactoryPara:
LanTyp EN ? LANGUAGE
DisplayMT N ?
Version:
PRJ D843 DLD640 ImLib, MTlib, Soft, Logic

BackDispose:
GammaEN 1 ?
Gain 1 ?
EnhanceEN 0 ?
Hpf_shift 5 ?
Hpf_thrd 5 ?
Enhance 150 ?
Lthrd 50 ?

Monitor:
Opens normal OSD

Alarm Set:
Alarm Switch Y ?
Alarm Mode No ?
Alarm Temperature -1°C ?
Reference Gray Y ?
Alarm Level 1L ?
Alarm Gray 65535 ?
Alarm PointNum 0 ?
Correct Gray 0 ?

Thermometry:
Data Collection 0 SMS
Interval 60 SCP
Ammount 90 SCT
Environment normal ?
Export:
Displays: Exportin normal temperature MTC data
Correction -1 ?
Emissivity 100 SEM
Calibration:
BlackbodyTemp -10 grabs a val from GAB
Save CBS
Cancel CBD
Correction:
BlackbodyTemp -10 Picks from the list GAR
Grayscale 0 SLG
Confirm LRE
Save LRS
Cancel LRD
Ninepoint measurement SMV

Cursor:
Cur N DRC enable cursor
X 320 SRP set cursor position
Y 240 SRP set cursor position

Main:
Auto 2 SAG Auto gain
G 211 SVC
B 10002 SVB
P 1 SWP polarity
Z X ?
Settings:
Image:
FI Y ?
FIValue 0 ? 0-31
Freeze N Freeze image
VE N SMR Vertical flip
HO N SMR Horizontal flip
AutoCali L same as rectify?
O IN internal or external
COM:
Opens UART menu
AvoidburnSwitch OFF enable anti burn in
ProtectedTime 10S duration
AvoidBurn 16383 threshold to trigger antiburn

</syntaxhighlight>

===Automatic Dead Pixels and Flatmap Correction===

It it possible to generate a new flat and dead pixel map automatically within the camera after flashing the cleared-map binary.
 

=====Dead pixels:=====
In the secret menu "System", navigate to Debug - DeadPixelModel and set the AutoBP (sensitivity for auto bad pixel finding) to 50 or so. Then press C Button

This can take a while.
[[File:High emissivity peltier black body.jpg|thumb|A Peltier / TEC coated in Candle sood to give it a high emissivity surface. It can be cooled or heated by swapping the polarity. ]]

Afterwards, navigate to S: and press + to save it.
 

=====Flatfield:=====
In the Debug menu navigate to R2 and press +

now place something '''Cold''' infront of the Camera with a high emissivity. (it needs to fill the whole image)

Press '''+''', wait for it to says High temperature.

Place something '''Hot''' infront and press '''+''' again.

Afterwards, save with '''S:''' again.

Flatfield should now be calibrated
 <blockquote>Note: Not all dead pixels are auto detected or get removed. you can manually select them in the Dead pixel editor but its not known yet how to select and correct them.</blockquote>

 

==Using the Thermal module without Webserver==
[[File:Dali D8X3C Breakout board.png|thumb|Breakout board for D8X3C ]]
to use it, you need to interface it directly.

The module will put out a Analog video signal (High-Z, need to buffer when connecting it to 75Ohm Video input)

Also a 8 or 14bit or 8-bit BT656 output.

the header exposes the FPGA JTAG and UART aswell as 6 Hardware Keys to Navigate the OSD.

To interface, you need to make a adapter board with a DF12-50DS-0.5V(86) Docking socket.

The breakout board files can be found [https://oshwlab.com/gamerpaddy/d8x3c-backpack-usb here] but may be still work in progress.

 

==Sensor Pinout==
[[File:Dali DLD384 Sensor pinout basic.png|thumb|basic pinout of a DLD384]]
the pinout of the thermal sensor havent been analyzes much.

besides some supply and Control voltages, 3 clocks and a analog output have been found.

17.5MHz

14.705KHz

50Hz

Dali D8X3N Thermal Camera

2025-08-04T15:43:01Z

Gamerpaddy: chmod x forgot..

=Dali D8X3N Thermal Camera Reverse Engineering=
 

===Introduction===
The [https://www.dali-irtech.com/productinfo/741567.html Dali D8X3N] Thermal Camera module comes in two versions, a 384x288 and 640x480 resolution, utilizing the [http://www.dali-tech.us/products/dld64017m-uncooled-infrared-fpa-detector-86.html DLD Series] of amorphous-Silicon Microbolometers.

They were mainly used in [http://www.dali-tech.us/products/dm60-w--online-body-temperature-thermal-imaging-camera-55.html Dali DM60-W] or WS-1 Body Temperature screening cameras in conjunction with a Black Body radiator set to 37°C to detect infected individuals at the start of the 2020 Covid Pandemic.
[[File:ICI FM320P Innerts.jpg|thumb|Internals. A TP-Link Switch, HikVision Visible Camera and the D8x3N Network thermal camera module]]
[https://infraredcameras.com/ ICI] rebranded these models as FM 320 P and FM 640 P, and distributed them on the local US market, but as the need for such Cameras exploded, those models were built with what was in stock.

So happens, that some of the FM 320 P Models had a DLD640 640x480 instead of a DLD384 384x288 Microbolometer in them, and just got their Firmware modified.

It also could be, because they have excessive amounts of bad pixels outside the 384x288 area, that they were binned to a lower grade.

Discussions about these Cameras started around 2022 in the [https://www.eevblog.com/forum/thermal-imaging/ici-and-dali-thermal-camera-software/ EEVBlog Forums.] when they started to appear secondhand and affordable.

Originally they were priced around US$ 20... 30.000 by ICI, and a unknown amount by Dali Tech.

The Modules specs according to the manufacturer are:

≤50..60mK@F1，300K，50Hz

17 or 25µm pixel pitch

Hisilicon SoC running Linux to provide Onvif and RTSP streams, analysis and a Web UI

 
[[File:Dali D8X3N Module.jpg|thumb|A real 384x288 model with a DLD384 sensor. notice the Productnumber ]]
ICI FM Cameras are found all over Online secondhand marketplaces for scrap Prices, as they are no longer needed.

But you never know, what are you getting. It could be a real DLD384 or the better DLD640 inside. Its a gamble.
 

======640x480 Imagers======
are labeled 22D843 Nxxxx and have a DLD640 sensor in it, they can be upgraded if they run the 384x288 firmware.

======384x288 Imagers======
are labeled 22D883Nxxxx and have a DLD384 sensor in it, they cannot be upgraded

 

==D8X3N Module closer look==
From now on, i will refer to the Thermal Imaging Module as TIM

On the front there is a 2 Element Germanium Lens of a unknown focal length and aperture.

It can be focus-adjusted when unscrewing the clamp around the housing. It can be focussed from infinity down to 10..20cm with some quality loss.
 The outter diameter of the Lens is 42mm with a 1 1/3 inch thread diameter of undetermined pitch.

Dimensions of the germanium elements are 21mm to 3 and 6mm and 14grams in weight.
[[File:Disassembled Thermal Camera Lens.jpg|thumb|Two element Germanium Lens of unknown focal length and aperture]]

The TIM is composed of 6 Stacked PCB modules, 3 of which are for the Web Server functionality. taking them off will give you the basic configuration of a [https://www.dalithermal.com/productinfo/741568.html Dali D8X3C] TIM<gallery>
File:Dali DLD640 Thermal Image Sensor.jpeg|DLD640 Sensor
File:Dali DLD384 Thermal Imaging Sensor.jpeg|DLD384 Sensor
File:Dali D8X3N Board1 Back.jpeg|Network & GPIO Board Back
File:Dali D8X3N Board1 Front.jpeg|Network & GPIO Board Front
File:Dali D8X3N Glue Board Back.jpeg|Board between Logic and IO Back
File:Dali D8X3N Glue Board Front.jpeg|Board between Logic and IO Front
File:Dali D8X3N SoC Board Back.jpeg|SoC Board back
File:Dali D8X3N SoC Board front.jpeg|SoC board front
File:Dali D8X3N FPGA Board Back.jpeg|FPGA Board of the D8X3C Thermal Imager including a PMIC
File:Dali D8X3N FPGA Board Front.jpeg|FPGA Board Front with Video DAC and SPI Flash
File:Dali D8X3N Sensor Power and ADC Board.jpeg|Sensor control and ADC board
File:Dali D8X3N Thermal Core Debug wiring.jpeg|Debug wiring for sniffing SPI and UART
</gallery>

===User Manual===
including pinout diagram and important data

can be found here https://archive.org/details/dali-d-8-x-3-cuser-manualen-v-1.0-1

==Viewing the Video Stream==
[[File:Onvif Device Manager ODM.png|thumb|ODM streaming the Thermal view]]
when first connecting it to power and Ethernet, the camera will have 192.168.1.102 as a Static ip.

If you are running a 192.168.0.x or .178.x net, you need to change it or add a subnet under windows ipv4 settings.

to view it, you can use VLC and the stream URL
rtsp://admin@admin:<camera ip>/ONVIFMedia
there is /ONVIFMedia /ONVIFMediaM and /ONVIFMediaS for different stream Profiles.

VLC is quite slow and delayed, rather use Onvif Device Manager ODM,

it has no delay and auto-detects cameras in the network.

Be sure to log in as user: admin pass: admin in ODM.

in there, you can also set you camera to DHCP under Network settings.

===Web Interface===
[[File:Dali D8X3N web interface.png|thumb|Since browsers cant display RTSP anymore, open in Edge and select IE Compatibility Mode.]]
the web interface can be accessed by opening the camera IP in a browser

login is:
user: admin pass: admin
You can set Temperature markers and areas, but without using the Black Body calibration source, your readings may be way off or not working.

 

====OSD====
there is a debug-login with
user: super pass: 871897
that lets you send Key commands to the Imager to navigate the OSD.

Setting the OSD to english is accomplished with option #11
[[File:Dali D8X3C OSD.png|thumb|OSD in english, if yours is Chinese. go to option #11 and click + or -]]

To acces some locked menus, press
+ - + - + -

The password for the locked System and Main menu is
+-MC+-

Be careful in the UART menu to not change the BAUD rate or Protocol, as your ability to control it via the Web API gets lost.

You need to reflash or solder buttons on the thermal core then.

==Viewing Raw Thermal Data from the Web API==
there is a hidden endpoint in the stream.so file that could be found while decompiling

accessing
[[File:Arduino Nano blink sketch thermal gif.gif|thumb|Arduino Nano running blink sketch while thermally recording it, notice the led and resistor on the right]]
<ip of camera>:5000/stream?Type=JPEG&Source=Jpeg&Mode=TCP
lets you download a JPEG. but there are more options available (not all have been tested)

we are mainly interessted in Raw thermal data.

====Source (Stream Type)====

*<code>Major</code> - Main video stream (channel 0)
*<code>Minor</code> - Sub video stream (channel 1)
*<code>MinorAV</code> - Sub video + audio stream
*<code>MajorAV</code> - Main video + audio stream
*<code>Jpeg</code> - JPEG snapshot stream
*<code>Raw</code> - Raw thermal data stream
*<code>YUV</code> - YUV raw video stream

====Type (Data Format)====

*<code>H264</code> - H.264 video encoding
*<code>JPEG</code> - JPEG image format
*<code>RAW</code> - Raw sensor data
*<code>QBOX</code> - Custom protocol format
*<code>FRAME</code> - Frame-based format

====Mode (Transport Protocol)====

*<code>TCP</code> - TCP streaming (default)
*<code>UDP</code> - UDP streaming
*<code>MUL</code> - Multicast streaming

====Quality Parameters====

*<code>Quality=[1-100]</code> - Video quality level
*<code>Frames=[number]</code> - Number of frames to send
*<code>Interval=[ms]</code> - Frame interval in milliseconds

====Network Parameters====

*<code>IPAddr=[ip]</code> - Client IP address for UDP/multicast
*<code>Port=[port]</code> - Client port for UDP/multicast
*<code>Heart-beat=[Yes/No]</code> - Enable/disable heartbeat

====Snapshot Parameters====

*<code>Snap=[Yes/No]</code> - Enable snapshot mode

====Raw Viewer for PC (Python)====
[[File:Dali D8X3N Raw Thermal viewer.png|thumb|Raw Data Viewer in python]]

To view the raw stream, i made a python program that converts the 14bit thermal data to a visible image.

it is low fps tho, due to bad optimizations.

rev1 first working version https://pastebin.com/dyNWDPT3

rev2 with temperature readout https://pastebin.com/u107Q85w

rev3 and onward will only be available directly as a Webpage on the Device (see below).

====Raw Viewer for the internal Webserver (recommended)====
It is also possible to use the Raw viewer directly in the browser.

To achieve this, the stream had to be proxied from port 5000 to 80 due to CORS.

luckily the internal lighttpd had the CGI module enabled, so piping it troug (using wget ... i know) worked with very low overhead.

To install, you need '''Terminal access''' to the Camera. see below.

optional for simplicity: '''ftp''' access

Then download the '''rawviewer.zip''' from [https://archive.org/details/rawviewer_202508 here] (rev3 with histogram, javascript)
[[File:Dali D8X3N Webviewer.png|thumb|Web Raw Viewer with histogram (rev3)]]

unpack the web folder into '''/app''' and run
chmod +x /app/web/webpages/proxy.cgi
and then '''restart''' your camera.

It should be accessible now trough '''http://<camera ip>/raw.html''' in the browser and click '''Start Stream'''
 <blockquote>performance may need improvement.</blockquote>

==Getting Root Terminal Access==
To access the Terminal you need to solder or plug in a UART connection to Connector J7 on the "Glue" board.

Pinout is (left to right) '''RX TX GND 3.3V Baud 115200 3.3V!'''

But the system will spam with debug messages, making patching the files a hard job unless you use "tftp" or "sed" commands.
 

====Enabling Telnet access to make patching easier====
[[File:Upgrade ici dali firmware updater.png|thumb|ICI Firmware updater software with modified firmware loaded]]

there is a easier way using a modified Firmware updater to enable Telnet temporarily to patch the Files.

Download the '''upgrade_ici.exe''' form [https://archive.org/details/fwupdate here] and run it.

Then you should be able to connect to it via Telnet.

The Login credentials are '''User: roo'''t '''Password: DLroot'''

 

===Patching Device===

===Patching the Web Server===
 

====Enabling Telnet and ftpd permanently====

This only works if you also patch the Thermal Camera module flash!

to permanently enable Telnet, go to '''/etc/init.d''' and edit '''S90app'''
vi S90app
in vi, move your cursor to the '''#''' at '''#telnetd''' and press x<blockquote>optional: enable ftp by removing the '''#''' at '''ftpd''' and adjust the path to / </blockquote>now press ''':''' and type '''wq''' and hit '''enter'''. this should be it.

====Patching the decoder and streamer to 640x480:====
go to /app and edit the mach.cfg

replace DL384 with D640 and edit the resolution to 640 480

(press i in vi to enter edit mode, press ESC to exit edit mode. :wq to write and quit.)

repeat that procedure for the dali.cfg

=====(optional) patching app.sh to prevent it from rebooting=====
edit the app.sh in /app and remove all "reboot" occasions to prevent the camera from rebooting if onvifserver, httpd or daliServer arent running for debugging purposes.

 

====Patching the Thermal Camera module====
To patch it, you need to disassemble everything down to the FPGA Board,

on the bottom there is a SPI SOIC8 Flash.

Use a CH341 EEPROM programmer (be sure to have a fixed or modified version to not put out 5V!, set it to 3.3V) and SOIC8 clamp.

Use NeoProgrammer (i used 2.2.0.10 but there are newer available, use the latest) and click Detect. It should find W25Q128 chips, select the FV one.

Dont forget to download a backup of your flash and save it !

Download the Binary "Dali 640x480 '''actual''' cleared pixelmap.bin" from #3 below and load it into NeoProgrammer,

Click Erase, Program and Verify.

This can take a while.

Your imager should start up right after assembly by hearing the shutter click.

==Hardware Hacking==

===Flash Contents===
On archive, click on show all files to download them.

<nowiki>#</nowiki>1 a Flash dump of the original downgraded D8X3N can be found [https://archive.org/details/dali-d-843n-flash-dump here]

<nowiki>#</nowiki>2 a Flash dump of a original 640x480 model can be found [https://archive.org/details/d-843-n-640x-480 here]

<nowiki>#</nowiki>3 a modified Flash dump of a 640x480 with cleared dead pixel map, flat map etc. can be found [https://archive.org/details/d-843-n-640x-480-cleared-pixelmap here]

a Flash dump of the web server SPI flash W25Q256JV can be found [https://archive.org/details/dm-60-webserver-flash-dump here] in case a bad firmware update caused a bootloop.

 

===Flash Binary Analysis===
The Flash IC is a Winbond 25Q128JV SPI Flash that contains the FPGA Bitstream, Deadpixel and Flatmap, aswell as the Device Settings.

a copy of the SPI Logic Capture at startup can be found [https://archive.org/details/dali-eeprom-capture here], the free software [https://www.dreamsourcelab.com/download/ DSView from DreamSourceLab] is required to view it.
[[File:Dali Thermal Imager SPI Flash capture.png|thumb|SPI Flash access while booting the Thermal Module]]

a approximation of the offsets resulted in this list:<syntaxhighlight lang="vb">
0x000000 - altera cyclone iv stuff
0x200000 - settings
0x280000 - Flat field correction map
0x4C0000 - Bad Pixel correctio nmap
0x580000 - image aswell? 36010 bytes
0x740000 - GUIX?
0x7C0000 - Strings for Gui?
0x800000 - another shorter GUIX
0x880000 - Strings for second gui?
0x8C0000 - GUIX
0x940000 - Strings for gui
0xE00000 - ?
0xE80000 - dzxg? short
0xEC0000 - crosshair.bmp
0xF40000 - 3DTM?
0xF80000 - fake? Bad pixel map BPRP
</syntaxhighlight> 

====Settings offset 0x200000====
The settings are read and written every startup, aswell when you close the OSD, sporadically and when executing the command MSV

these are some of the settings i could figure out by changing and watching the logic capture what changed.
 <syntaxhighlight lang="vb">
offset size Cmd
0x0 1 SAG (0-2) auto gain
0x2 2 SVB (0-16383) saved value is 16383 - SVB
0x4 2 SVC (0-1023) set exposure or gain
0x6 1 SSM image filtering
0x8 1 SEH image enhancement
0xA 1 SWP invert b/w polarity
0x14 1 SMR Flip
0x16 1 SMR Mirror
0x20 1 MENU Cal source 0 IN, 1 OUT
0x3A 1 MENU Enhance value 0-100
0x40 1 MENU Rectify (shutter 0 OFF, 1 L, 2 H)
0x50 1 MENU Language 0 english, 1 chinese, 2 russian
0xA2 - SCO set contrast gain
0xA4 - IBR set brightness
0xAE 2 MENU Fire Threshold
0xAC 1 SPA set color palette
0xE2 1 SMS display "collected 0/80" enabled
0xF8 1 SEM set emissivity
0x110 1 SRT set revise temp
0x116 1 SHD set humidity
0x118 1 SET set ambient temp
0x11A 1 STD set temp range
0x120 2 SLG -500 to 500?
0x124 2 SRD set distance
0x12C 1 SCP ???
0x130 2 SCT ???
</syntaxhighlight> 
[[File:Dali D8X3N Bad Pixel Map Viewer.png|thumb|Bad pixel map of a 640x512 sensor, about 0.56% of dead pixels in this map]]
So i let the AI create a [https://2476424.playcode.io/ Configurator page] that lets you change the Settings in your Flashdump to your liking
 

====Bad Pixel and Flatframe Maps 0x280000 and 0x4C0000====
Thermal cameras require a bad pixel and flat frame map to compensate for manufacturing inconsistencies.

unfourtainly, the maps of the downgraded cameras only contain enough data for a 384 model, not the full 640.

at offset 0xF80000 there is a BPRP which was mistaken at first as the Bad pixel map, it could just be a mask to where to apply the offset maps, as its either 0x0 or 0x1.

The [https://2477569.playcode.io/ Viewer Page] is written in JS and does not require any special dependencies, it can run as a plain html file offline.

There still needs to be work done to create own maps and flatfields but the cameras are still very capable and useable with fully cleared maps.

To clear the maps, just go to these offsets and fill with values around 0x3F or 0x0 for total length of X Resolution x Y Resolution x 2 bytes (0x96000 for 640x480)

[[File:Dali D8X3N Flat Field Map Viewer.png|thumb|Flat Field viewer]]

==Dali Commands==
To control the TIM you can either use Pelco or Dali command set. By default the Dali commandset is used at 38400 BAUD.

Those commands consist of a 0x02 start byte followed by two length Bytes, then the actual command which is allways 3 uppercase Letters in ASCII (eg. KBD for keyboard) followed by a comma and the values.

Some commands take multiple values, some dont. But you allways have to send the comma after the Command.

The camera will answer with the Command and 0, 1 or 2. Sending no value counts as zero.
0 is invalid parameters, too few or out of range

1 is OK, valid command

2 is Invalid command

Commands can be sent trough the Web server using the URL Api endpoint or directly trough the UART port.

(keyboard, C button, causes the shutter to do a calibration)
<camera ip>/cgi-bin/dmcmd?Command=KBD,C
Listening to the answer can be done while being in the Linux shell and typing
cat /dev/ttyAMA2 | strings

By bruteforcing the UART with AAA to ZZZ a list of Commands could be obtained, but some with unknown Parameters or functionality yet. including some from a decompiled DM60comm.so module found in /app/modules folder.<syntaxhighlight lang="vb">
KBD KEY Keyboard (F S M C + -)
SSM 0-1 Image Filtering Off/On
GSM 0 Image filter status
SEH 0-1 Image Enhancement Off/On
GEH 0-1 Image enhancer status
SCO 0-255 Set Gain (locked when SAG auto gain is on)
GCO 0-255 Get gain
INT 15-320 set actual gain? not just contrast sometimes disabled?
IBR 0-255 Set brightness
GBR 0-255 Get brightness
SMR 0-3 Mirror mode bit0=horizontal, bit1=vertical
GMR 0 Get rotation/flip
SDT 0-1 displays temp=44.65°C osd, but webserver sends date/time to the cam there....
GDT 0-1 Get temp display active?
GPT Display temp oft SDT
GNU 0-1 Get Shutter closed/open
SNU 0-1 Shutter close / open
STD 0-1 Set Range 0: -20-180°C 1: 100-600°C
GTD 0-1 Get Range
SET °C Set Ambient temperature
GET °C Get Ambient temperature
SEM 0-100 0-1 set emissivity x100
GEM 0-100 Get Emissivity
SRT °C Set revise temperature -100-100 -10-10°
GRT °C Get revise temperature
SRD 100 Set Distance 4.4m x100
GRD 100 Get Distance
SHD 0-100 Set Humidity
GHD 55 Get Humidity
SWP 0-1 invert s/w polarity image
GWP 1 is inverted?
SPA 0-10? Set color palette
GPA 3 white hot
SMV 0-1 Show temperature 3x3 grid?? in combination with GTV maybe
GMV 0
SMS 0-1 displays "collected 0/<number set by SCT>" by SCP delay "saves the daily number of highest temperatures?"
GMS 0
SCT 1-500 sets the amount of "collected" points for SMS
GCT 80
SCP 5-60 "collected" delay in seconds for SMS
GCP 60
SAG 0-2 Auto brightness / gain
GAG 0
SLR 0-9 ???
GLR 0
SRP 0,0 - 639,479 set crosshair position
GRP 320,240 get crosshair position
DRC 0-1 Show crosshair
SLG -500-500 ??
GLG
SCE text ??
GCE 0
SCB text ??
GCB 0
SVB 0-16383 adc offset, exposure? good at 9650
GVB 6733 value is 16383 minus SVB
SVC 1-1023 set contrast but better
GVC 260
SVF 100-? ?? video freaks out 3400 seems good
SVS 100-? ?? video freaks out 3300 seems good
SOT 0-1 ?? sensor supply, looks weird when off.
SZM 1-4 ?
GZM 1
MSV save settings too eeprom
ASV Saves something aswell?
GCS 0 Get Core status & faults
ALD 0,2? video blanks lots of eeprom activity. reload pixel map??
SAV 0-9999 set Fire threshold
GAV 2100 get Fire Threshold
BAC change uart protocol? careful
CBD Displays Recovery successful?
CBS Displays Saved successfully
LRD Displays Recovery successful?
LRS Displays Saved successfully?
LRE Displays Temperature Repair successful?
CBT Displays Calibration successful?
DBP ??? shutter clicks
DPI Show weird pixels
API Hide weird pixels
CCM ??
ASN 0-4 ??
GAB 4 vals ?? 3,-10,50,150
GAN 1 ??
GAR 11 vals ?? 10,10,5,20,35,50,70,90,120,150,180,,
GCM 6 values ??
GFV prints screen gray value?
GIT 200 ??
GTV Get the collected temp values?
PTS echoes but with extra stuff??
QYA 7170 Query Gray Info (information mode)
QYI 7124 Query Gray Average mode
QYM 7512 Query Gray Minimum mode
VTP 400-4000 ??
MTD U/S,0,0 ?? S answers with bytes, U upload bytes?
MTC U/S? ?? S answers with U,0,0, S doesnt.

return 0 invalid params:
STS ??
STT ??
SAC ??
SAH ??
SAS ??
SAT ??
SCX ?? displays crosshair but invalid params
SCY ?? displays crosshair but invalid params
GAC ??
GAH ??
GAS ??
GAT ??
GME ??
GPC ??
GPI ??
GPM ??
GTA ??
GTC ??
GTI ??
GTM ??
GTS ??
GTT ??

answer only:

BPM 0-1 stream ready? answers with 0 stop, 1 go, 2 when prompted
AVS 0,1
MEH
PWI 0-1 changing palette from wh to fire

unconfirmed (from dm60comm.so):
SDT 2024,03,15,14,30,25 Set Date Time with year,month,day,hour,minute,second
STS 1 Set Temperature Show display (0=off, 1=on)
SVA 2 Set Video Auto mode (0=manual, 2=auto)
SMP 0,1,1,0,100,150,200,250,300,350,90,25 Set Measurement Point (type,index,enable,mode,startX,startY,endX,endY,anchorX,anchorY,threshold,color)
STV Stop Temperature View measurements
SPF 5 Set Profile parameter
SVL -10 Set Video Left pan movement (signed value)
SVU -5 Set Video Up tilt movement (signed value)
SVD 5 Set Video Down tilt movement (signed value)
SSP 17,1,0 Set System Parameter (param_id,value,index) #46 temperature format 0 °C, 1 °F, 2 K
SCP Set Current Preset (save current position)
GCP Get Current Preset
STT 300,350 Set Temperature Threshold (low,high values *10)
SDC 1 Set Display Configuration parameter
GCS Get Current Status
GMM Get Memory Map information
GFV Get Frame Value (grayscale data)
GFZ Get Freeze Status
GSI 1 Get System Information (parameter=1)
GSS Get System Status
GSP 21,0 Get System Parameter (param_21=surround temp, value=0)
GTT Get Temperature Threshold range
GTV 1,3,10 Get Temperature Values (enable,type,count)
GNU Get Network Update status (response command)
FRZ Freeze current display frame
LIV Live mode (unfreeze display)
CAL Calibrate system
CCP 3 Call Current Preset (preset number 0-9)
APF 100 Auto Profile setting
MEH Measure Enhancement
BPT Built-in Test
MTC S,0 Measure Temperature Capture (S=start, 0=sequence)
MTG U,0,1024,<data> Measure Temperature Gray data transfer
MTD U,0,1024,<data> Measure Temperature Data transfer
UFP S,0,2048 Update Firmware Prepare (S=start, 0=offset, 2048=size)
UFD S,0,1024 Update Firmware Data transfer
BAB U Buffer operation (U=update)
TTH S,0 Temperature Threshold operation
IPP 192.168.001.102,255.255.255.000,192.168.001.001,192.168.000.001,9989,9998 IP Parameters (IP,netmask,gateway,DNS,port1,port2)
MAC 00:60:A9:10:00:01 MAC Address setting
SNP Set Network Parameters (response command)
QYI Query Gray Info (information mode)
QYA Query Gray Average mode
QYM Query Gray Minimum mode
GAI Get Alarm Info (response command)
YTC <data> Unknown command with data parameter
HTH
LRS
LRD
GAR
DRC
PTS
SCX
SCY
CBT
LRE
CBD
CBS
XXX
GSP
GTT
QYI
QYA
QYM

</syntaxhighlight>

==Secret Menu Overview==
The secret menus Main and System can be openend with the password '''+-MC+-'''

Its structured like this, not all variables have been figured out yet.

The format is Menu: submenu: submenu:

and for menu entries: Name, default value, command, description or messages that pop up.
 <syntaxhighlight lang="vb">
MAIN & SYSTEM PASS: +-MC+-

entries are NAME VALUE COMMAND DESC or if its a folder its just ":"

System:
System:
Gain 255 SCO
Bright 102 IBR
BenDi 100 ?
BenDiContrase 80 ?
DisMode 0 ?
Frequency 48hz (24,25,48,50)
DigitalOut 8-14bit 14bit, BT656(_P), ?, BT601
AutoFocus N ?
Line 1 ?
Ltemp0 11800 ?
LTemp1 11000 ?
HTemp0 9500 ?
HTemp1 8700 ?
DelayTime 0 ?
Enhance 0-1 ?
Enhanced E1 230 ?
FPA_Gain 12pF ? between 4 and 18 at random.
NUCEn N ?

Area:
SE 2 ASN 0-4 "Partition"
INT 200 INT "Points time"
VS 3161 SVS
VF 2800 SVF
Vtemp 1401 VTP
VtempArea Low ?
VtempBase 13500 ?
VtempStep -1 ?
VsStep 8 ?
DeadPixelModel preset / calculate
DP: Cursor to select dead pixels
X 360 position
Y 288 position
AutoBP: 50 Press C to start automatic dotting
Quit? Number of bad pixels 961& "Blind element replacement in progress"
Undo
R2: Save data? blind pixel replacement in progress
Replace Y N = DPI, Y = API
L: Reading parameters
S: Saving parameters

Debug:
Rectify N
DisplayGary N
TE N SDT
AutoE ? ?
AutoVS Y ?
VSGrayH 8000 ?
VSGrayL 7000 ?
Trends 1 ?
Shelter N ?
MotorCon 3 ?
SaveFactoryPara:
LanTyp EN ? LANGUAGE
DisplayMT N ?
Version:
PRJ D843 DLD640 ImLib, MTlib, Soft, Logic

BackDispose:
GammaEN 1 ?
Gain 1 ?
EnhanceEN 0 ?
Hpf_shift 5 ?
Hpf_thrd 5 ?
Enhance 150 ?
Lthrd 50 ?

Monitor:
Opens normal OSD

Alarm Set:
Alarm Switch Y ?
Alarm Mode No ?
Alarm Temperature -1°C ?
Reference Gray Y ?
Alarm Level 1L ?
Alarm Gray 65535 ?
Alarm PointNum 0 ?
Correct Gray 0 ?

Thermometry:
Data Collection 0 SMS
Interval 60 SCP
Ammount 90 SCT
Environment normal ?
Export:
Displays: Exportin normal temperature MTC data
Correction -1 ?
Emissivity 100 SEM
Calibration:
BlackbodyTemp -10 grabs a val from GAB
Save CBS
Cancel CBD
Correction:
BlackbodyTemp -10 Picks from the list GAR
Grayscale 0 SLG
Confirm LRE
Save LRS
Cancel LRD
Ninepoint measurement SMV

Cursor:
Cur N DRC enable cursor
X 320 SRP set cursor position
Y 240 SRP set cursor position

Main:
Auto 2 SAG Auto gain
G 211 SVC
B 10002 SVB
P 1 SWP polarity
Z X ?
Settings:
Image:
FI Y ?
FIValue 0 ? 0-31
Freeze N Freeze image
VE N SMR Vertical flip
HO N SMR Horizontal flip
AutoCali L same as rectify?
O IN internal or external
COM:
Opens UART menu
AvoidburnSwitch OFF enable anti burn in
ProtectedTime 10S duration
AvoidBurn 16383 threshold to trigger antiburn

</syntaxhighlight>

===Automatic Dead Pixels and Flatmap Correction===

It it possible to generate a new flat and dead pixel map automatically within the camera after flashing the cleared-map binary.
 

=====Dead pixels:=====
In the secret menu "System", navigate to Debug - DeadPixelModel and set the AutoBP (sensitivity for auto bad pixel finding) to 50 or so. Then press C Button

This can take a while.
[[File:High emissivity peltier black body.jpg|thumb|A Peltier / TEC coated in Candle sood to give it a high emissivity surface. It can be cooled or heated by swapping the polarity. ]]

Afterwards, navigate to S: and press + to save it.
 

=====Flatfield:=====
In the Debug menu navigate to R2 and press +

now place something '''Cold''' infront of the Camera with a high emissivity. (it needs to fill the whole image)

Press '''+''', wait for it to says High temperature.

Place something '''Hot''' infront and press '''+''' again.

Afterwards, save with '''S:''' again.

Flatfield should now be calibrated
 <blockquote>Note: Not all dead pixels are auto detected or get removed. you can manually select them in the Dead pixel editor but its not known yet how to select and correct them.</blockquote>

 

==Using the Thermal module without Webserver==
[[File:Dali D8X3C Breakout board.png|thumb|Breakout board for D8X3C ]]
to use it, you need to interface it directly.

The module will put out a Analog video signal (High-Z, need to buffer when connecting it to 75Ohm Video input)

Also a 8 or 14bit or 8-bit BT656 output.

the header exposes the FPGA JTAG and UART aswell as 6 Hardware Keys to Navigate the OSD.

To interface, you need to make a adapter board with a DF12-50DS-0.5V(86) Docking socket.

The breakout board files can be found [https://oshwlab.com/gamerpaddy/d8x3c-backpack-usb here] but may be still work in progress.

 

==Sensor Pinout==
[[File:Dali DLD384 Sensor pinout basic.png|thumb|basic pinout of a DLD384]]
the pinout of the thermal sensor havent been analyzes much.

besides some supply and Control voltages, 3 clocks and a analog output have been found.

17.5MHz

14.705KHz

50Hz

Dali D8X3N Thermal Camera

2025-08-04T01:31:45Z

Gamerpaddy: /* Bad Pixel and Flatframe Maps 0x280000 and 0x4C0000 */

=Dali D8X3N Thermal Camera Reverse Engineering=
 

===Introduction===
The [https://www.dali-irtech.com/productinfo/741567.html Dali D8X3N] Thermal Camera module comes in two versions, a 384x288 and 640x480 resolution, utilizing the [http://www.dali-tech.us/products/dld64017m-uncooled-infrared-fpa-detector-86.html DLD Series] of amorphous-Silicon Microbolometers.

They were mainly used in [http://www.dali-tech.us/products/dm60-w--online-body-temperature-thermal-imaging-camera-55.html Dali DM60-W] or WS-1 Body Temperature screening cameras in conjunction with a Black Body radiator set to 37°C to detect infected individuals at the start of the 2020 Covid Pandemic.
[[File:ICI FM320P Innerts.jpg|thumb|Internals. A TP-Link Switch, HikVision Visible Camera and the D8x3N Network thermal camera module]]
[https://infraredcameras.com/ ICI] rebranded these models as FM 320 P and FM 640 P, and distributed them on the local US market, but as the need for such Cameras exploded, those models were built with what was in stock.

So happens, that some of the FM 320 P Models had a DLD640 640x480 instead of a DLD384 384x288 Microbolometer in them, and just got their Firmware modified.

It also could be, because they have excessive amounts of bad pixels outside the 384x288 area, that they were binned to a lower grade.

Discussions about these Cameras started around 2022 in the [https://www.eevblog.com/forum/thermal-imaging/ici-and-dali-thermal-camera-software/ EEVBlog Forums.] when they started to appear secondhand and affordable.

Originally they were priced around US$ 20... 30.000 by ICI, and a unknown amount by Dali Tech.

The Modules specs according to the manufacturer are:

≤50..60mK@F1，300K，50Hz

17 or 25µm pixel pitch

Hisilicon SoC running Linux to provide Onvif and RTSP streams, analysis and a Web UI

 
[[File:Dali D8X3N Module.jpg|thumb|A real 384x288 model with a DLD384 sensor. notice the Productnumber ]]
ICI FM Cameras are found all over Online secondhand marketplaces for scrap Prices, as they are no longer needed.

But you never know, what are you getting. It could be a real DLD384 or the better DLD640 inside. Its a gamble.
 

======640x480 Imagers======
are labeled 22D843 Nxxxx and have a DLD640 sensor in it, they can be upgraded if they run the 384x288 firmware.

======384x288 Imagers======
are labeled 22D883Nxxxx and have a DLD384 sensor in it, they cannot be upgraded

 

==D8X3N Module closer look==
From now on, i will refer to the Thermal Imaging Module as TIM

On the front there is a 2 Element Germanium Lens of a unknown focal length and aperture.

It can be focus-adjusted when unscrewing the clamp around the housing. It can be focussed from infinity down to 10..20cm with some quality loss.
 The outter diameter of the Lens is 42mm with a 1 1/3 inch thread diameter of undetermined pitch.

Dimensions of the germanium elements are 21mm to 3 and 6mm and 14grams in weight.
[[File:Disassembled Thermal Camera Lens.jpg|thumb|Two element Germanium Lens of unknown focal length and aperture]]

The TIM is composed of 6 Stacked PCB modules, 3 of which are for the Web Server functionality. taking them off will give you the basic configuration of a [https://www.dalithermal.com/productinfo/741568.html Dali D8X3C] TIM<gallery>
File:Dali DLD640 Thermal Image Sensor.jpeg|DLD640 Sensor
File:Dali DLD384 Thermal Imaging Sensor.jpeg|DLD384 Sensor
File:Dali D8X3N Board1 Back.jpeg|Network & GPIO Board Back
File:Dali D8X3N Board1 Front.jpeg|Network & GPIO Board Front
File:Dali D8X3N Glue Board Back.jpeg|Board between Logic and IO Back
File:Dali D8X3N Glue Board Front.jpeg|Board between Logic and IO Front
File:Dali D8X3N SoC Board Back.jpeg|SoC Board back
File:Dali D8X3N SoC Board front.jpeg|SoC board front
File:Dali D8X3N FPGA Board Back.jpeg|FPGA Board of the D8X3C Thermal Imager including a PMIC
File:Dali D8X3N FPGA Board Front.jpeg|FPGA Board Front with Video DAC and SPI Flash
File:Dali D8X3N Sensor Power and ADC Board.jpeg|Sensor control and ADC board
File:Dali D8X3N Thermal Core Debug wiring.jpeg|Debug wiring for sniffing SPI and UART
</gallery>

===User Manual===
including pinout diagram and important data

can be found here https://archive.org/details/dali-d-8-x-3-cuser-manualen-v-1.0-1

==Viewing the Video Stream==
[[File:Onvif Device Manager ODM.png|thumb|ODM streaming the Thermal view]]
when first connecting it to power and Ethernet, the camera will have 192.168.1.102 as a Static ip.

If you are running a 192.168.0.x or .178.x net, you need to change it or add a subnet under windows ipv4 settings.

to view it, you can use VLC and the stream URL
rtsp://admin@admin:<camera ip>/ONVIFMedia
there is /ONVIFMedia /ONVIFMediaM and /ONVIFMediaS for different stream Profiles.

VLC is quite slow and delayed, rather use Onvif Device Manager ODM,

it has no delay and auto-detects cameras in the network.

Be sure to log in as user: admin pass: admin in ODM.

in there, you can also set you camera to DHCP under Network settings.

===Web Interface===
[[File:Dali D8X3N web interface.png|thumb|Since browsers cant display RTSP anymore, open in Edge and select IE Compatibility Mode.]]
the web interface can be accessed by opening the camera IP in a browser

login is:
user: admin pass: admin
You can set Temperature markers and areas, but without using the Black Body calibration source, your readings may be way off or not working.

 

====OSD====
there is a debug-login with
user: super pass: 871897
that lets you send Key commands to the Imager to navigate the OSD.

Setting the OSD to english is accomplished with option #11
[[File:Dali D8X3C OSD.png|thumb|OSD in english, if yours is Chinese. go to option #11 and click + or -]]

To acces some locked menus, press
+ - + - + -

The password for the locked System and Main menu is
+-MC+-

Be careful in the UART menu to not change the BAUD rate or Protocol, as your ability to control it via the Web API gets lost.

You need to reflash or solder buttons on the thermal core then.

==Viewing Raw Thermal Data from the Web API==
there is a hidden endpoint in the stream.so file that could be found while decompiling

accessing
[[File:Arduino Nano blink sketch thermal gif.gif|thumb|Arduino Nano running blink sketch while thermally recording it, notice the led and resistor on the right]]
<ip of camera>:5000/stream?Type=JPEG&Source=Jpeg&Mode=TCP
lets you download a JPEG. but there are more options available (not all have been tested)

we are mainly interessted in Raw thermal data.

====Source (Stream Type)====

*<code>Major</code> - Main video stream (channel 0)
*<code>Minor</code> - Sub video stream (channel 1)
*<code>MinorAV</code> - Sub video + audio stream
*<code>MajorAV</code> - Main video + audio stream
*<code>Jpeg</code> - JPEG snapshot stream
*<code>Raw</code> - Raw thermal data stream
*<code>YUV</code> - YUV raw video stream

====Type (Data Format)====

*<code>H264</code> - H.264 video encoding
*<code>JPEG</code> - JPEG image format
*<code>RAW</code> - Raw sensor data
*<code>QBOX</code> - Custom protocol format
*<code>FRAME</code> - Frame-based format

====Mode (Transport Protocol)====

*<code>TCP</code> - TCP streaming (default)
*<code>UDP</code> - UDP streaming
*<code>MUL</code> - Multicast streaming

====Quality Parameters====

*<code>Quality=[1-100]</code> - Video quality level
*<code>Frames=[number]</code> - Number of frames to send
*<code>Interval=[ms]</code> - Frame interval in milliseconds

====Network Parameters====

*<code>IPAddr=[ip]</code> - Client IP address for UDP/multicast
*<code>Port=[port]</code> - Client port for UDP/multicast
*<code>Heart-beat=[Yes/No]</code> - Enable/disable heartbeat

====Snapshot Parameters====

*<code>Snap=[Yes/No]</code> - Enable snapshot mode

====Raw Viewer for PC (Python)====
[[File:Dali D8X3N Raw Thermal viewer.png|thumb|Raw Data Viewer in python]]

To view the raw stream, i made a python program that converts the 14bit thermal data to a visible image.

it is low fps tho, due to bad optimizations.

rev1 first working version https://pastebin.com/dyNWDPT3

rev2 with temperature readout https://pastebin.com/u107Q85w

rev3 and onward will only be available directly as a Webpage on the Device (see below).

====Raw Viewer for the internal Webserver (recommended)====
It is also possible to use the Raw viewer directly in the browser.

To achieve this, the stream had to be proxied from port 5000 to 80 due to CORS.

luckily the internal lighttpd had the CGI module enabled, so piping it troug (using wget ... i know) worked with very low overhead.

To install, you need '''Terminal access''' to the Camera. see below.

optional for simplicity: '''ftp''' access

Then download the '''rawviewer.zip''' from [https://archive.org/details/rawviewer_202508 here] (rev3 with histogram, javascript)
[[File:Dali D8X3N Webviewer.png|thumb|Web Raw Viewer with histogram (rev3)]]

unpack the web folder into '''/app''' and '''restart''' your camera.

It should be accessible now trough '''http://<camera ip>/raw.html''' in the browser and click '''Start Stream'''
 <blockquote>performance may need improvement.</blockquote>

==Getting Root Terminal Access==
To access the Terminal you need to solder or plug in a UART connection to Connector J7 on the "Glue" board.

Pinout is (left to right) '''RX TX GND 3.3V Baud 115200 3.3V!'''

But the system will spam with debug messages, making patching the files a hard job unless you use "tftp" or "sed" commands.
 

====Enabling Telnet access to make patching easier====
[[File:Upgrade ici dali firmware updater.png|thumb|ICI Firmware updater software with modified firmware loaded]]

there is a easier way using a modified Firmware updater to enable Telnet temporarily to patch the Files.

Download the '''upgrade_ici.exe''' form [https://archive.org/details/fwupdate here] and run it.

Then you should be able to connect to it via Telnet.

The Login credentials are '''User: roo'''t '''Password: DLroot'''

 

===Patching Device===

===Patching the Web Server===
 

====Enabling Telnet and ftpd permanently====

This only works if you also patch the Thermal Camera module flash!

to permanently enable Telnet, go to '''/etc/init.d''' and edit '''S90app'''
vi S90app
in vi, move your cursor to the '''#''' at '''#telnetd''' and press x<blockquote>optional: enable ftp by removing the '''#''' at '''ftpd''' and adjust the path to / </blockquote>now press ''':''' and type '''wq''' and hit '''enter'''. this should be it.

====Patching the decoder and streamer to 640x480:====
go to /app and edit the mach.cfg

replace DL384 with D640 and edit the resolution to 640 480

(press i in vi to enter edit mode, press ESC to exit edit mode. :wq to write and quit.)

repeat that procedure for the dali.cfg

=====(optional) patching app.sh to prevent it from rebooting=====
edit the app.sh in /app and remove all "reboot" occasions to prevent the camera from rebooting if onvifserver, httpd or daliServer arent running for debugging purposes.

 

====Patching the Thermal Camera module====
To patch it, you need to disassemble everything down to the FPGA Board,

on the bottom there is a SPI SOIC8 Flash.

Use a CH341 EEPROM programmer (be sure to have a fixed or modified version to not put out 5V!, set it to 3.3V) and SOIC8 clamp.

Use NeoProgrammer (i used 2.2.0.10 but there are newer available, use the latest) and click Detect. It should find W25Q128 chips, select the FV one.

Dont forget to download a backup of your flash and save it !

Download the Binary "Dali 640x480 '''actual''' cleared pixelmap.bin" from #3 below and load it into NeoProgrammer,

Click Erase, Program and Verify.

This can take a while.

Your imager should start up right after assembly by hearing the shutter click.

==Hardware Hacking==

===Flash Contents===
On archive, click on show all files to download them.

<nowiki>#</nowiki>1 a Flash dump of the original downgraded D8X3N can be found [https://archive.org/details/dali-d-843n-flash-dump here]

<nowiki>#</nowiki>2 a Flash dump of a original 640x480 model can be found [https://archive.org/details/d-843-n-640x-480 here]

<nowiki>#</nowiki>3 a modified Flash dump of a 640x480 with cleared dead pixel map, flat map etc. can be found [https://archive.org/details/d-843-n-640x-480-cleared-pixelmap here]

a Flash dump of the web server SPI flash W25Q256JV can be found [https://archive.org/details/dm-60-webserver-flash-dump here] in case a bad firmware update caused a bootloop.

 

===Flash Binary Analysis===
The Flash IC is a Winbond 25Q128JV SPI Flash that contains the FPGA Bitstream, Deadpixel and Flatmap, aswell as the Device Settings.

a copy of the SPI Logic Capture at startup can be found [https://archive.org/details/dali-eeprom-capture here], the free software [https://www.dreamsourcelab.com/download/ DSView from DreamSourceLab] is required to view it.
[[File:Dali Thermal Imager SPI Flash capture.png|thumb|SPI Flash access while booting the Thermal Module]]

a approximation of the offsets resulted in this list:<syntaxhighlight lang="vb">
0x000000 - altera cyclone iv stuff
0x200000 - settings
0x280000 - Flat field correction map
0x4C0000 - Bad Pixel correctio nmap
0x580000 - image aswell? 36010 bytes
0x740000 - GUIX?
0x7C0000 - Strings for Gui?
0x800000 - another shorter GUIX
0x880000 - Strings for second gui?
0x8C0000 - GUIX
0x940000 - Strings for gui
0xE00000 - ?
0xE80000 - dzxg? short
0xEC0000 - crosshair.bmp
0xF40000 - 3DTM?
0xF80000 - fake? Bad pixel map BPRP
</syntaxhighlight> 

====Settings offset 0x200000====
The settings are read and written every startup, aswell when you close the OSD, sporadically and when executing the command MSV

these are some of the settings i could figure out by changing and watching the logic capture what changed.
 <syntaxhighlight lang="vb">
offset size Cmd
0x0 1 SAG (0-2) auto gain
0x2 2 SVB (0-16383) saved value is 16383 - SVB
0x4 2 SVC (0-1023) set exposure or gain
0x6 1 SSM image filtering
0x8 1 SEH image enhancement
0xA 1 SWP invert b/w polarity
0x14 1 SMR Flip
0x16 1 SMR Mirror
0x20 1 MENU Cal source 0 IN, 1 OUT
0x3A 1 MENU Enhance value 0-100
0x40 1 MENU Rectify (shutter 0 OFF, 1 L, 2 H)
0x50 1 MENU Language 0 english, 1 chinese, 2 russian
0xA2 - SCO set contrast gain
0xA4 - IBR set brightness
0xAE 2 MENU Fire Threshold
0xAC 1 SPA set color palette
0xE2 1 SMS display "collected 0/80" enabled
0xF8 1 SEM set emissivity
0x110 1 SRT set revise temp
0x116 1 SHD set humidity
0x118 1 SET set ambient temp
0x11A 1 STD set temp range
0x120 2 SLG -500 to 500?
0x124 2 SRD set distance
0x12C 1 SCP ???
0x130 2 SCT ???
</syntaxhighlight> 
[[File:Dali D8X3N Bad Pixel Map Viewer.png|thumb|Bad pixel map of a 640x512 sensor, about 0.56% of dead pixels in this map]]
So i let the AI create a [https://2476424.playcode.io/ Configurator page] that lets you change the Settings in your Flashdump to your liking
 

====Bad Pixel and Flatframe Maps 0x280000 and 0x4C0000====
Thermal cameras require a bad pixel and flat frame map to compensate for manufacturing inconsistencies.

unfourtainly, the maps of the downgraded cameras only contain enough data for a 384 model, not the full 640.

at offset 0xF80000 there is a BPRP which was mistaken at first as the Bad pixel map, it could just be a mask to where to apply the offset maps, as its either 0x0 or 0x1.

The [https://2477569.playcode.io/ Viewer Page] is written in JS and does not require any special dependencies, it can run as a plain html file offline.

There still needs to be work done to create own maps and flatfields but the cameras are still very capable and useable with fully cleared maps.

To clear the maps, just go to these offsets and fill with values around 0x3F or 0x0 for total length of X Resolution x Y Resolution x 2 bytes (0x96000 for 640x480)

[[File:Dali D8X3N Flat Field Map Viewer.png|thumb|Flat Field viewer]]

==Dali Commands==
To control the TIM you can either use Pelco or Dali command set. By default the Dali commandset is used at 38400 BAUD.

Those commands consist of a 0x02 start byte followed by two length Bytes, then the actual command which is allways 3 uppercase Letters in ASCII (eg. KBD for keyboard) followed by a comma and the values.

Some commands take multiple values, some dont. But you allways have to send the comma after the Command.

The camera will answer with the Command and 0, 1 or 2. Sending no value counts as zero.
0 is invalid parameters, too few or out of range

1 is OK, valid command

2 is Invalid command

Commands can be sent trough the Web server using the URL Api endpoint or directly trough the UART port.

(keyboard, C button, causes the shutter to do a calibration)
<camera ip>/cgi-bin/dmcmd?Command=KBD,C
Listening to the answer can be done while being in the Linux shell and typing
cat /dev/ttyAMA2 | strings

By bruteforcing the UART with AAA to ZZZ a list of Commands could be obtained, but some with unknown Parameters or functionality yet. including some from a decompiled DM60comm.so module found in /app/modules folder.<syntaxhighlight lang="vb">
KBD KEY Keyboard (F S M C + -)
SSM 0-1 Image Filtering Off/On
GSM 0 Image filter status
SEH 0-1 Image Enhancement Off/On
GEH 0-1 Image enhancer status
SCO 0-255 Set Gain (locked when SAG auto gain is on)
GCO 0-255 Get gain
INT 15-320 set actual gain? not just contrast sometimes disabled?
IBR 0-255 Set brightness
GBR 0-255 Get brightness
SMR 0-3 Mirror mode bit0=horizontal, bit1=vertical
GMR 0 Get rotation/flip
SDT 0-1 displays temp=44.65°C osd, but webserver sends date/time to the cam there....
GDT 0-1 Get temp display active?
GPT Display temp oft SDT
GNU 0-1 Get Shutter closed/open
SNU 0-1 Shutter close / open
STD 0-1 Set Range 0: -20-180°C 1: 100-600°C
GTD 0-1 Get Range
SET °C Set Ambient temperature
GET °C Get Ambient temperature
SEM 0-100 0-1 set emissivity x100
GEM 0-100 Get Emissivity
SRT °C Set revise temperature -100-100 -10-10°
GRT °C Get revise temperature
SRD 100 Set Distance 4.4m x100
GRD 100 Get Distance
SHD 0-100 Set Humidity
GHD 55 Get Humidity
SWP 0-1 invert s/w polarity image
GWP 1 is inverted?
SPA 0-10? Set color palette
GPA 3 white hot
SMV 0-1 Show temperature 3x3 grid?? in combination with GTV maybe
GMV 0
SMS 0-1 displays "collected 0/<number set by SCT>" by SCP delay "saves the daily number of highest temperatures?"
GMS 0
SCT 1-500 sets the amount of "collected" points for SMS
GCT 80
SCP 5-60 "collected" delay in seconds for SMS
GCP 60
SAG 0-2 Auto brightness / gain
GAG 0
SLR 0-9 ???
GLR 0
SRP 0,0 - 639,479 set crosshair position
GRP 320,240 get crosshair position
DRC 0-1 Show crosshair
SLG -500-500 ??
GLG
SCE text ??
GCE 0
SCB text ??
GCB 0
SVB 0-16383 adc offset, exposure? good at 9650
GVB 6733 value is 16383 minus SVB
SVC 1-1023 set contrast but better
GVC 260
SVF 100-? ?? video freaks out 3400 seems good
SVS 100-? ?? video freaks out 3300 seems good
SOT 0-1 ?? sensor supply, looks weird when off.
SZM 1-4 ?
GZM 1
MSV save settings too eeprom
ASV Saves something aswell?
GCS 0 Get Core status & faults
ALD 0,2? video blanks lots of eeprom activity. reload pixel map??
SAV 0-9999 set Fire threshold
GAV 2100 get Fire Threshold
BAC change uart protocol? careful
CBD Displays Recovery successful?
CBS Displays Saved successfully
LRD Displays Recovery successful?
LRS Displays Saved successfully?
LRE Displays Temperature Repair successful?
CBT Displays Calibration successful?
DBP ??? shutter clicks
DPI Show weird pixels
API Hide weird pixels
CCM ??
ASN 0-4 ??
GAB 4 vals ?? 3,-10,50,150
GAN 1 ??
GAR 11 vals ?? 10,10,5,20,35,50,70,90,120,150,180,,
GCM 6 values ??
GFV prints screen gray value?
GIT 200 ??
GTV Get the collected temp values?
PTS echoes but with extra stuff??
QYA 7170 Query Gray Info (information mode)
QYI 7124 Query Gray Average mode
QYM 7512 Query Gray Minimum mode
VTP 400-4000 ??
MTD U/S,0,0 ?? S answers with bytes, U upload bytes?
MTC U/S? ?? S answers with U,0,0, S doesnt.

return 0 invalid params:
STS ??
STT ??
SAC ??
SAH ??
SAS ??
SAT ??
SCX ?? displays crosshair but invalid params
SCY ?? displays crosshair but invalid params
GAC ??
GAH ??
GAS ??
GAT ??
GME ??
GPC ??
GPI ??
GPM ??
GTA ??
GTC ??
GTI ??
GTM ??
GTS ??
GTT ??

answer only:

BPM 0-1 stream ready? answers with 0 stop, 1 go, 2 when prompted
AVS 0,1
MEH
PWI 0-1 changing palette from wh to fire

unconfirmed (from dm60comm.so):
SDT 2024,03,15,14,30,25 Set Date Time with year,month,day,hour,minute,second
STS 1 Set Temperature Show display (0=off, 1=on)
SVA 2 Set Video Auto mode (0=manual, 2=auto)
SMP 0,1,1,0,100,150,200,250,300,350,90,25 Set Measurement Point (type,index,enable,mode,startX,startY,endX,endY,anchorX,anchorY,threshold,color)
STV Stop Temperature View measurements
SPF 5 Set Profile parameter
SVL -10 Set Video Left pan movement (signed value)
SVU -5 Set Video Up tilt movement (signed value)
SVD 5 Set Video Down tilt movement (signed value)
SSP 17,1,0 Set System Parameter (param_id,value,index) #46 temperature format 0 °C, 1 °F, 2 K
SCP Set Current Preset (save current position)
GCP Get Current Preset
STT 300,350 Set Temperature Threshold (low,high values *10)
SDC 1 Set Display Configuration parameter
GCS Get Current Status
GMM Get Memory Map information
GFV Get Frame Value (grayscale data)
GFZ Get Freeze Status
GSI 1 Get System Information (parameter=1)
GSS Get System Status
GSP 21,0 Get System Parameter (param_21=surround temp, value=0)
GTT Get Temperature Threshold range
GTV 1,3,10 Get Temperature Values (enable,type,count)
GNU Get Network Update status (response command)
FRZ Freeze current display frame
LIV Live mode (unfreeze display)
CAL Calibrate system
CCP 3 Call Current Preset (preset number 0-9)
APF 100 Auto Profile setting
MEH Measure Enhancement
BPT Built-in Test
MTC S,0 Measure Temperature Capture (S=start, 0=sequence)
MTG U,0,1024,<data> Measure Temperature Gray data transfer
MTD U,0,1024,<data> Measure Temperature Data transfer
UFP S,0,2048 Update Firmware Prepare (S=start, 0=offset, 2048=size)
UFD S,0,1024 Update Firmware Data transfer
BAB U Buffer operation (U=update)
TTH S,0 Temperature Threshold operation
IPP 192.168.001.102,255.255.255.000,192.168.001.001,192.168.000.001,9989,9998 IP Parameters (IP,netmask,gateway,DNS,port1,port2)
MAC 00:60:A9:10:00:01 MAC Address setting
SNP Set Network Parameters (response command)
QYI Query Gray Info (information mode)
QYA Query Gray Average mode
QYM Query Gray Minimum mode
GAI Get Alarm Info (response command)
YTC <data> Unknown command with data parameter
HTH
LRS
LRD
GAR
DRC
PTS
SCX
SCY
CBT
LRE
CBD
CBS
XXX
GSP
GTT
QYI
QYA
QYM

</syntaxhighlight>

==Secret Menu Overview==
The secret menus Main and System can be openend with the password '''+-MC+-'''

Its structured like this, not all variables have been figured out yet.

The format is Menu: submenu: submenu:

and for menu entries: Name, default value, command, description or messages that pop up.
 <syntaxhighlight lang="vb">
MAIN & SYSTEM PASS: +-MC+-

entries are NAME VALUE COMMAND DESC or if its a folder its just ":"

System:
System:
Gain 255 SCO
Bright 102 IBR
BenDi 100 ?
BenDiContrase 80 ?
DisMode 0 ?
Frequency 48hz (24,25,48,50)
DigitalOut 8-14bit 14bit, BT656(_P), ?, BT601
AutoFocus N ?
Line 1 ?
Ltemp0 11800 ?
LTemp1 11000 ?
HTemp0 9500 ?
HTemp1 8700 ?
DelayTime 0 ?
Enhance 0-1 ?
Enhanced E1 230 ?
FPA_Gain 12pF ? between 4 and 18 at random.
NUCEn N ?

Area:
SE 2 ASN 0-4 "Partition"
INT 200 INT "Points time"
VS 3161 SVS
VF 2800 SVF
Vtemp 1401 VTP
VtempArea Low ?
VtempBase 13500 ?
VtempStep -1 ?
VsStep 8 ?
DeadPixelModel preset / calculate
DP: Cursor to select dead pixels
X 360 position
Y 288 position
AutoBP: 50 Press C to start automatic dotting
Quit? Number of bad pixels 961& "Blind element replacement in progress"
Undo
R2: Save data? blind pixel replacement in progress
Replace Y N = DPI, Y = API
L: Reading parameters
S: Saving parameters

Debug:
Rectify N
DisplayGary N
TE N SDT
AutoE ? ?
AutoVS Y ?
VSGrayH 8000 ?
VSGrayL 7000 ?
Trends 1 ?
Shelter N ?
MotorCon 3 ?
SaveFactoryPara:
LanTyp EN ? LANGUAGE
DisplayMT N ?
Version:
PRJ D843 DLD640 ImLib, MTlib, Soft, Logic

BackDispose:
GammaEN 1 ?
Gain 1 ?
EnhanceEN 0 ?
Hpf_shift 5 ?
Hpf_thrd 5 ?
Enhance 150 ?
Lthrd 50 ?

Monitor:
Opens normal OSD

Alarm Set:
Alarm Switch Y ?
Alarm Mode No ?
Alarm Temperature -1°C ?
Reference Gray Y ?
Alarm Level 1L ?
Alarm Gray 65535 ?
Alarm PointNum 0 ?
Correct Gray 0 ?

Thermometry:
Data Collection 0 SMS
Interval 60 SCP
Ammount 90 SCT
Environment normal ?
Export:
Displays: Exportin normal temperature MTC data
Correction -1 ?
Emissivity 100 SEM
Calibration:
BlackbodyTemp -10 grabs a val from GAB
Save CBS
Cancel CBD
Correction:
BlackbodyTemp -10 Picks from the list GAR
Grayscale 0 SLG
Confirm LRE
Save LRS
Cancel LRD
Ninepoint measurement SMV

Cursor:
Cur N DRC enable cursor
X 320 SRP set cursor position
Y 240 SRP set cursor position

Main:
Auto 2 SAG Auto gain
G 211 SVC
B 10002 SVB
P 1 SWP polarity
Z X ?
Settings:
Image:
FI Y ?
FIValue 0 ? 0-31
Freeze N Freeze image
VE N SMR Vertical flip
HO N SMR Horizontal flip
AutoCali L same as rectify?
O IN internal or external
COM:
Opens UART menu
AvoidburnSwitch OFF enable anti burn in
ProtectedTime 10S duration
AvoidBurn 16383 threshold to trigger antiburn

</syntaxhighlight>

===Automatic Dead Pixels and Flatmap Correction===

It it possible to generate a new flat and dead pixel map automatically within the camera after flashing the cleared-map binary.
 

=====Dead pixels:=====
In the secret menu "System", navigate to Debug - DeadPixelModel and set the AutoBP (sensitivity for auto bad pixel finding) to 50 or so. Then press C Button

This can take a while.
[[File:High emissivity peltier black body.jpg|thumb|A Peltier / TEC coated in Candle sood to give it a high emissivity surface. It can be cooled or heated by swapping the polarity. ]]

Afterwards, navigate to S: and press + to save it.
 

=====Flatfield:=====
In the Debug menu navigate to R2 and press +

now place something '''Cold''' infront of the Camera with a high emissivity. (it needs to fill the whole image)

Press '''+''', wait for it to says High temperature.

Place something '''Hot''' infront and press '''+''' again.

Afterwards, save with '''S:''' again.

Flatfield should now be calibrated
 <blockquote>Note: Not all dead pixels are auto detected or get removed. you can manually select them in the Dead pixel editor but its not known yet how to select and correct them.</blockquote>

 

==Using the Thermal module without Webserver==
[[File:Dali D8X3C Breakout board.png|thumb|Breakout board for D8X3C ]]
to use it, you need to interface it directly.

The module will put out a Analog video signal (High-Z, need to buffer when connecting it to 75Ohm Video input)

Also a 8 or 14bit or 8-bit BT656 output.

the header exposes the FPGA JTAG and UART aswell as 6 Hardware Keys to Navigate the OSD.

To interface, you need to make a adapter board with a DF12-50DS-0.5V(86) Docking socket.

The breakout board files can be found [https://oshwlab.com/gamerpaddy/d8x3c-backpack-usb here] but may be still work in progress.

 

==Sensor Pinout==
[[File:Dali DLD384 Sensor pinout basic.png|thumb|basic pinout of a DLD384]]
the pinout of the thermal sensor havent been analyzes much.

besides some supply and Control voltages, 3 clocks and a analog output have been found.

17.5MHz

14.705KHz

50Hz

Dali D8X3N Thermal Camera

2025-08-04T01:31:07Z

Gamerpaddy:

=Dali D8X3N Thermal Camera Reverse Engineering=
 

===Introduction===
The [https://www.dali-irtech.com/productinfo/741567.html Dali D8X3N] Thermal Camera module comes in two versions, a 384x288 and 640x480 resolution, utilizing the [http://www.dali-tech.us/products/dld64017m-uncooled-infrared-fpa-detector-86.html DLD Series] of amorphous-Silicon Microbolometers.

They were mainly used in [http://www.dali-tech.us/products/dm60-w--online-body-temperature-thermal-imaging-camera-55.html Dali DM60-W] or WS-1 Body Temperature screening cameras in conjunction with a Black Body radiator set to 37°C to detect infected individuals at the start of the 2020 Covid Pandemic.
[[File:ICI FM320P Innerts.jpg|thumb|Internals. A TP-Link Switch, HikVision Visible Camera and the D8x3N Network thermal camera module]]
[https://infraredcameras.com/ ICI] rebranded these models as FM 320 P and FM 640 P, and distributed them on the local US market, but as the need for such Cameras exploded, those models were built with what was in stock.

So happens, that some of the FM 320 P Models had a DLD640 640x480 instead of a DLD384 384x288 Microbolometer in them, and just got their Firmware modified.

It also could be, because they have excessive amounts of bad pixels outside the 384x288 area, that they were binned to a lower grade.

Discussions about these Cameras started around 2022 in the [https://www.eevblog.com/forum/thermal-imaging/ici-and-dali-thermal-camera-software/ EEVBlog Forums.] when they started to appear secondhand and affordable.

Originally they were priced around US$ 20... 30.000 by ICI, and a unknown amount by Dali Tech.

The Modules specs according to the manufacturer are:

≤50..60mK@F1，300K，50Hz

17 or 25µm pixel pitch

Hisilicon SoC running Linux to provide Onvif and RTSP streams, analysis and a Web UI

 
[[File:Dali D8X3N Module.jpg|thumb|A real 384x288 model with a DLD384 sensor. notice the Productnumber ]]
ICI FM Cameras are found all over Online secondhand marketplaces for scrap Prices, as they are no longer needed.

But you never know, what are you getting. It could be a real DLD384 or the better DLD640 inside. Its a gamble.
 

======640x480 Imagers======
are labeled 22D843 Nxxxx and have a DLD640 sensor in it, they can be upgraded if they run the 384x288 firmware.

======384x288 Imagers======
are labeled 22D883Nxxxx and have a DLD384 sensor in it, they cannot be upgraded

 

==D8X3N Module closer look==
From now on, i will refer to the Thermal Imaging Module as TIM

On the front there is a 2 Element Germanium Lens of a unknown focal length and aperture.

It can be focus-adjusted when unscrewing the clamp around the housing. It can be focussed from infinity down to 10..20cm with some quality loss.
 The outter diameter of the Lens is 42mm with a 1 1/3 inch thread diameter of undetermined pitch.

Dimensions of the germanium elements are 21mm to 3 and 6mm and 14grams in weight.
[[File:Disassembled Thermal Camera Lens.jpg|thumb|Two element Germanium Lens of unknown focal length and aperture]]

The TIM is composed of 6 Stacked PCB modules, 3 of which are for the Web Server functionality. taking them off will give you the basic configuration of a [https://www.dalithermal.com/productinfo/741568.html Dali D8X3C] TIM<gallery>
File:Dali DLD640 Thermal Image Sensor.jpeg|DLD640 Sensor
File:Dali DLD384 Thermal Imaging Sensor.jpeg|DLD384 Sensor
File:Dali D8X3N Board1 Back.jpeg|Network & GPIO Board Back
File:Dali D8X3N Board1 Front.jpeg|Network & GPIO Board Front
File:Dali D8X3N Glue Board Back.jpeg|Board between Logic and IO Back
File:Dali D8X3N Glue Board Front.jpeg|Board between Logic and IO Front
File:Dali D8X3N SoC Board Back.jpeg|SoC Board back
File:Dali D8X3N SoC Board front.jpeg|SoC board front
File:Dali D8X3N FPGA Board Back.jpeg|FPGA Board of the D8X3C Thermal Imager including a PMIC
File:Dali D8X3N FPGA Board Front.jpeg|FPGA Board Front with Video DAC and SPI Flash
File:Dali D8X3N Sensor Power and ADC Board.jpeg|Sensor control and ADC board
File:Dali D8X3N Thermal Core Debug wiring.jpeg|Debug wiring for sniffing SPI and UART
</gallery>

===User Manual===
including pinout diagram and important data

can be found here https://archive.org/details/dali-d-8-x-3-cuser-manualen-v-1.0-1

==Viewing the Video Stream==
[[File:Onvif Device Manager ODM.png|thumb|ODM streaming the Thermal view]]
when first connecting it to power and Ethernet, the camera will have 192.168.1.102 as a Static ip.

If you are running a 192.168.0.x or .178.x net, you need to change it or add a subnet under windows ipv4 settings.

to view it, you can use VLC and the stream URL
rtsp://admin@admin:<camera ip>/ONVIFMedia
there is /ONVIFMedia /ONVIFMediaM and /ONVIFMediaS for different stream Profiles.

VLC is quite slow and delayed, rather use Onvif Device Manager ODM,

it has no delay and auto-detects cameras in the network.

Be sure to log in as user: admin pass: admin in ODM.

in there, you can also set you camera to DHCP under Network settings.

===Web Interface===
[[File:Dali D8X3N web interface.png|thumb|Since browsers cant display RTSP anymore, open in Edge and select IE Compatibility Mode.]]
the web interface can be accessed by opening the camera IP in a browser

login is:
user: admin pass: admin
You can set Temperature markers and areas, but without using the Black Body calibration source, your readings may be way off or not working.

 

====OSD====
there is a debug-login with
user: super pass: 871897
that lets you send Key commands to the Imager to navigate the OSD.

Setting the OSD to english is accomplished with option #11
[[File:Dali D8X3C OSD.png|thumb|OSD in english, if yours is Chinese. go to option #11 and click + or -]]

To acces some locked menus, press
+ - + - + -

The password for the locked System and Main menu is
+-MC+-

Be careful in the UART menu to not change the BAUD rate or Protocol, as your ability to control it via the Web API gets lost.

You need to reflash or solder buttons on the thermal core then.

==Viewing Raw Thermal Data from the Web API==
there is a hidden endpoint in the stream.so file that could be found while decompiling

accessing
[[File:Arduino Nano blink sketch thermal gif.gif|thumb|Arduino Nano running blink sketch while thermally recording it, notice the led and resistor on the right]]
<ip of camera>:5000/stream?Type=JPEG&Source=Jpeg&Mode=TCP
lets you download a JPEG. but there are more options available (not all have been tested)

we are mainly interessted in Raw thermal data.

====Source (Stream Type)====

*<code>Major</code> - Main video stream (channel 0)
*<code>Minor</code> - Sub video stream (channel 1)
*<code>MinorAV</code> - Sub video + audio stream
*<code>MajorAV</code> - Main video + audio stream
*<code>Jpeg</code> - JPEG snapshot stream
*<code>Raw</code> - Raw thermal data stream
*<code>YUV</code> - YUV raw video stream

====Type (Data Format)====

*<code>H264</code> - H.264 video encoding
*<code>JPEG</code> - JPEG image format
*<code>RAW</code> - Raw sensor data
*<code>QBOX</code> - Custom protocol format
*<code>FRAME</code> - Frame-based format

====Mode (Transport Protocol)====

*<code>TCP</code> - TCP streaming (default)
*<code>UDP</code> - UDP streaming
*<code>MUL</code> - Multicast streaming

====Quality Parameters====

*<code>Quality=[1-100]</code> - Video quality level
*<code>Frames=[number]</code> - Number of frames to send
*<code>Interval=[ms]</code> - Frame interval in milliseconds

====Network Parameters====

*<code>IPAddr=[ip]</code> - Client IP address for UDP/multicast
*<code>Port=[port]</code> - Client port for UDP/multicast
*<code>Heart-beat=[Yes/No]</code> - Enable/disable heartbeat

====Snapshot Parameters====

*<code>Snap=[Yes/No]</code> - Enable snapshot mode

====Raw Viewer for PC (Python)====
[[File:Dali D8X3N Raw Thermal viewer.png|thumb|Raw Data Viewer in python]]

To view the raw stream, i made a python program that converts the 14bit thermal data to a visible image.

it is low fps tho, due to bad optimizations.

rev1 first working version https://pastebin.com/dyNWDPT3

rev2 with temperature readout https://pastebin.com/u107Q85w

rev3 and onward will only be available directly as a Webpage on the Device (see below).

====Raw Viewer for the internal Webserver (recommended)====
It is also possible to use the Raw viewer directly in the browser.

To achieve this, the stream had to be proxied from port 5000 to 80 due to CORS.

luckily the internal lighttpd had the CGI module enabled, so piping it troug (using wget ... i know) worked with very low overhead.

To install, you need '''Terminal access''' to the Camera. see below.

optional for simplicity: '''ftp''' access

Then download the '''rawviewer.zip''' from [https://archive.org/details/rawviewer_202508 here] (rev3 with histogram, javascript)
[[File:Dali D8X3N Webviewer.png|thumb|Web Raw Viewer with histogram (rev3)]]

unpack the web folder into '''/app''' and '''restart''' your camera.

It should be accessible now trough '''http://<camera ip>/raw.html''' in the browser and click '''Start Stream'''
 <blockquote>performance may need improvement.</blockquote>

==Getting Root Terminal Access==
To access the Terminal you need to solder or plug in a UART connection to Connector J7 on the "Glue" board.

Pinout is (left to right) '''RX TX GND 3.3V Baud 115200 3.3V!'''

But the system will spam with debug messages, making patching the files a hard job unless you use "tftp" or "sed" commands.
 

====Enabling Telnet access to make patching easier====
[[File:Upgrade ici dali firmware updater.png|thumb|ICI Firmware updater software with modified firmware loaded]]

there is a easier way using a modified Firmware updater to enable Telnet temporarily to patch the Files.

Download the '''upgrade_ici.exe''' form [https://archive.org/details/fwupdate here] and run it.

Then you should be able to connect to it via Telnet.

The Login credentials are '''User: roo'''t '''Password: DLroot'''

 

===Patching Device===

===Patching the Web Server===
 

====Enabling Telnet and ftpd permanently====

This only works if you also patch the Thermal Camera module flash!

to permanently enable Telnet, go to '''/etc/init.d''' and edit '''S90app'''
vi S90app
in vi, move your cursor to the '''#''' at '''#telnetd''' and press x<blockquote>optional: enable ftp by removing the '''#''' at '''ftpd''' and adjust the path to / </blockquote>now press ''':''' and type '''wq''' and hit '''enter'''. this should be it.

====Patching the decoder and streamer to 640x480:====
go to /app and edit the mach.cfg

replace DL384 with D640 and edit the resolution to 640 480

(press i in vi to enter edit mode, press ESC to exit edit mode. :wq to write and quit.)

repeat that procedure for the dali.cfg

=====(optional) patching app.sh to prevent it from rebooting=====
edit the app.sh in /app and remove all "reboot" occasions to prevent the camera from rebooting if onvifserver, httpd or daliServer arent running for debugging purposes.

 

====Patching the Thermal Camera module====
To patch it, you need to disassemble everything down to the FPGA Board,

on the bottom there is a SPI SOIC8 Flash.

Use a CH341 EEPROM programmer (be sure to have a fixed or modified version to not put out 5V!, set it to 3.3V) and SOIC8 clamp.

Use NeoProgrammer (i used 2.2.0.10 but there are newer available, use the latest) and click Detect. It should find W25Q128 chips, select the FV one.

Dont forget to download a backup of your flash and save it !

Download the Binary "Dali 640x480 '''actual''' cleared pixelmap.bin" from #3 below and load it into NeoProgrammer,

Click Erase, Program and Verify.

This can take a while.

Your imager should start up right after assembly by hearing the shutter click.

==Hardware Hacking==

===Flash Contents===
On archive, click on show all files to download them.

<nowiki>#</nowiki>1 a Flash dump of the original downgraded D8X3N can be found [https://archive.org/details/dali-d-843n-flash-dump here]

<nowiki>#</nowiki>2 a Flash dump of a original 640x480 model can be found [https://archive.org/details/d-843-n-640x-480 here]

<nowiki>#</nowiki>3 a modified Flash dump of a 640x480 with cleared dead pixel map, flat map etc. can be found [https://archive.org/details/d-843-n-640x-480-cleared-pixelmap here]

a Flash dump of the web server SPI flash W25Q256JV can be found [https://archive.org/details/dm-60-webserver-flash-dump here] in case a bad firmware update caused a bootloop.

 

===Flash Binary Analysis===
The Flash IC is a Winbond 25Q128JV SPI Flash that contains the FPGA Bitstream, Deadpixel and Flatmap, aswell as the Device Settings.

a copy of the SPI Logic Capture at startup can be found [https://archive.org/details/dali-eeprom-capture here], the free software [https://www.dreamsourcelab.com/download/ DSView from DreamSourceLab] is required to view it.
[[File:Dali Thermal Imager SPI Flash capture.png|thumb|SPI Flash access while booting the Thermal Module]]

a approximation of the offsets resulted in this list:<syntaxhighlight lang="vb">
0x000000 - altera cyclone iv stuff
0x200000 - settings
0x280000 - Flat field correction map
0x4C0000 - Bad Pixel correctio nmap
0x580000 - image aswell? 36010 bytes
0x740000 - GUIX?
0x7C0000 - Strings for Gui?
0x800000 - another shorter GUIX
0x880000 - Strings for second gui?
0x8C0000 - GUIX
0x940000 - Strings for gui
0xE00000 - ?
0xE80000 - dzxg? short
0xEC0000 - crosshair.bmp
0xF40000 - 3DTM?
0xF80000 - fake? Bad pixel map BPRP
</syntaxhighlight> 

====Settings offset 0x200000====
The settings are read and written every startup, aswell when you close the OSD, sporadically and when executing the command MSV

these are some of the settings i could figure out by changing and watching the logic capture what changed.
 <syntaxhighlight lang="vb">
offset size Cmd
0x0 1 SAG (0-2) auto gain
0x2 2 SVB (0-16383) saved value is 16383 - SVB
0x4 2 SVC (0-1023) set exposure or gain
0x6 1 SSM image filtering
0x8 1 SEH image enhancement
0xA 1 SWP invert b/w polarity
0x14 1 SMR Flip
0x16 1 SMR Mirror
0x20 1 MENU Cal source 0 IN, 1 OUT
0x3A 1 MENU Enhance value 0-100
0x40 1 MENU Rectify (shutter 0 OFF, 1 L, 2 H)
0x50 1 MENU Language 0 english, 1 chinese, 2 russian
0xA2 - SCO set contrast gain
0xA4 - IBR set brightness
0xAE 2 MENU Fire Threshold
0xAC 1 SPA set color palette
0xE2 1 SMS display "collected 0/80" enabled
0xF8 1 SEM set emissivity
0x110 1 SRT set revise temp
0x116 1 SHD set humidity
0x118 1 SET set ambient temp
0x11A 1 STD set temp range
0x120 2 SLG -500 to 500?
0x124 2 SRD set distance
0x12C 1 SCP ???
0x130 2 SCT ???
</syntaxhighlight> 
[[File:Dali D8X3N Bad Pixel Map Viewer.png|thumb|Bad pixel map of a 640x512 sensor, about 0.56% of dead pixels in this map]]
So i let the AI create a [https://2476424.playcode.io/ Configurator page] that lets you change the Settings in your Flashdump to your liking
 

======Bad Pixel and Flatframe Maps 0x280000 and 0x4C0000======
Thermal cameras require a bad pixel and flat frame map to compensate for manufacturing inconsistencies.

unfourtainly, the maps of the downgraded cameras only contain enough data for a 384 model, not the full 640.

at offset 0xF80000 there is a BPRP which was mistaken at first as the Bad pixel map, it could just be a mask to where to apply the offset maps, as its either 0x0 or 0x1.

The [https://2477569.playcode.io/ Viewer Page] is written in JS and does not require any special dependencies, it can run as a plain html file offline.

There still needs to be work done to create own maps and flatfields but the cameras are still very capable and useable with fully cleared maps.

To clear the maps, just go to these offsets and fill with values around 0x3F or 0x0 for total length of X Resolution x Y Resolution x 2 bytes (0x96000 for 640x480)

[[File:Dali D8X3N Flat Field Map Viewer.png|thumb|Flat Field viewer]]

==Dali Commands==
To control the TIM you can either use Pelco or Dali command set. By default the Dali commandset is used at 38400 BAUD.

Those commands consist of a 0x02 start byte followed by two length Bytes, then the actual command which is allways 3 uppercase Letters in ASCII (eg. KBD for keyboard) followed by a comma and the values.

Some commands take multiple values, some dont. But you allways have to send the comma after the Command.

The camera will answer with the Command and 0, 1 or 2. Sending no value counts as zero.
0 is invalid parameters, too few or out of range

1 is OK, valid command

2 is Invalid command

Commands can be sent trough the Web server using the URL Api endpoint or directly trough the UART port.

(keyboard, C button, causes the shutter to do a calibration)
<camera ip>/cgi-bin/dmcmd?Command=KBD,C
Listening to the answer can be done while being in the Linux shell and typing
cat /dev/ttyAMA2 | strings

By bruteforcing the UART with AAA to ZZZ a list of Commands could be obtained, but some with unknown Parameters or functionality yet. including some from a decompiled DM60comm.so module found in /app/modules folder.<syntaxhighlight lang="vb">
KBD KEY Keyboard (F S M C + -)
SSM 0-1 Image Filtering Off/On
GSM 0 Image filter status
SEH 0-1 Image Enhancement Off/On
GEH 0-1 Image enhancer status
SCO 0-255 Set Gain (locked when SAG auto gain is on)
GCO 0-255 Get gain
INT 15-320 set actual gain? not just contrast sometimes disabled?
IBR 0-255 Set brightness
GBR 0-255 Get brightness
SMR 0-3 Mirror mode bit0=horizontal, bit1=vertical
GMR 0 Get rotation/flip
SDT 0-1 displays temp=44.65°C osd, but webserver sends date/time to the cam there....
GDT 0-1 Get temp display active?
GPT Display temp oft SDT
GNU 0-1 Get Shutter closed/open
SNU 0-1 Shutter close / open
STD 0-1 Set Range 0: -20-180°C 1: 100-600°C
GTD 0-1 Get Range
SET °C Set Ambient temperature
GET °C Get Ambient temperature
SEM 0-100 0-1 set emissivity x100
GEM 0-100 Get Emissivity
SRT °C Set revise temperature -100-100 -10-10°
GRT °C Get revise temperature
SRD 100 Set Distance 4.4m x100
GRD 100 Get Distance
SHD 0-100 Set Humidity
GHD 55 Get Humidity
SWP 0-1 invert s/w polarity image
GWP 1 is inverted?
SPA 0-10? Set color palette
GPA 3 white hot
SMV 0-1 Show temperature 3x3 grid?? in combination with GTV maybe
GMV 0
SMS 0-1 displays "collected 0/<number set by SCT>" by SCP delay "saves the daily number of highest temperatures?"
GMS 0
SCT 1-500 sets the amount of "collected" points for SMS
GCT 80
SCP 5-60 "collected" delay in seconds for SMS
GCP 60
SAG 0-2 Auto brightness / gain
GAG 0
SLR 0-9 ???
GLR 0
SRP 0,0 - 639,479 set crosshair position
GRP 320,240 get crosshair position
DRC 0-1 Show crosshair
SLG -500-500 ??
GLG
SCE text ??
GCE 0
SCB text ??
GCB 0
SVB 0-16383 adc offset, exposure? good at 9650
GVB 6733 value is 16383 minus SVB
SVC 1-1023 set contrast but better
GVC 260
SVF 100-? ?? video freaks out 3400 seems good
SVS 100-? ?? video freaks out 3300 seems good
SOT 0-1 ?? sensor supply, looks weird when off.
SZM 1-4 ?
GZM 1
MSV save settings too eeprom
ASV Saves something aswell?
GCS 0 Get Core status & faults
ALD 0,2? video blanks lots of eeprom activity. reload pixel map??
SAV 0-9999 set Fire threshold
GAV 2100 get Fire Threshold
BAC change uart protocol? careful
CBD Displays Recovery successful?
CBS Displays Saved successfully
LRD Displays Recovery successful?
LRS Displays Saved successfully?
LRE Displays Temperature Repair successful?
CBT Displays Calibration successful?
DBP ??? shutter clicks
DPI Show weird pixels
API Hide weird pixels
CCM ??
ASN 0-4 ??
GAB 4 vals ?? 3,-10,50,150
GAN 1 ??
GAR 11 vals ?? 10,10,5,20,35,50,70,90,120,150,180,,
GCM 6 values ??
GFV prints screen gray value?
GIT 200 ??
GTV Get the collected temp values?
PTS echoes but with extra stuff??
QYA 7170 Query Gray Info (information mode)
QYI 7124 Query Gray Average mode
QYM 7512 Query Gray Minimum mode
VTP 400-4000 ??
MTD U/S,0,0 ?? S answers with bytes, U upload bytes?
MTC U/S? ?? S answers with U,0,0, S doesnt.

return 0 invalid params:
STS ??
STT ??
SAC ??
SAH ??
SAS ??
SAT ??
SCX ?? displays crosshair but invalid params
SCY ?? displays crosshair but invalid params
GAC ??
GAH ??
GAS ??
GAT ??
GME ??
GPC ??
GPI ??
GPM ??
GTA ??
GTC ??
GTI ??
GTM ??
GTS ??
GTT ??

answer only:

BPM 0-1 stream ready? answers with 0 stop, 1 go, 2 when prompted
AVS 0,1
MEH
PWI 0-1 changing palette from wh to fire

unconfirmed (from dm60comm.so):
SDT 2024,03,15,14,30,25 Set Date Time with year,month,day,hour,minute,second
STS 1 Set Temperature Show display (0=off, 1=on)
SVA 2 Set Video Auto mode (0=manual, 2=auto)
SMP 0,1,1,0,100,150,200,250,300,350,90,25 Set Measurement Point (type,index,enable,mode,startX,startY,endX,endY,anchorX,anchorY,threshold,color)
STV Stop Temperature View measurements
SPF 5 Set Profile parameter
SVL -10 Set Video Left pan movement (signed value)
SVU -5 Set Video Up tilt movement (signed value)
SVD 5 Set Video Down tilt movement (signed value)
SSP 17,1,0 Set System Parameter (param_id,value,index) #46 temperature format 0 °C, 1 °F, 2 K
SCP Set Current Preset (save current position)
GCP Get Current Preset
STT 300,350 Set Temperature Threshold (low,high values *10)
SDC 1 Set Display Configuration parameter
GCS Get Current Status
GMM Get Memory Map information
GFV Get Frame Value (grayscale data)
GFZ Get Freeze Status
GSI 1 Get System Information (parameter=1)
GSS Get System Status
GSP 21,0 Get System Parameter (param_21=surround temp, value=0)
GTT Get Temperature Threshold range
GTV 1,3,10 Get Temperature Values (enable,type,count)
GNU Get Network Update status (response command)
FRZ Freeze current display frame
LIV Live mode (unfreeze display)
CAL Calibrate system
CCP 3 Call Current Preset (preset number 0-9)
APF 100 Auto Profile setting
MEH Measure Enhancement
BPT Built-in Test
MTC S,0 Measure Temperature Capture (S=start, 0=sequence)
MTG U,0,1024,<data> Measure Temperature Gray data transfer
MTD U,0,1024,<data> Measure Temperature Data transfer
UFP S,0,2048 Update Firmware Prepare (S=start, 0=offset, 2048=size)
UFD S,0,1024 Update Firmware Data transfer
BAB U Buffer operation (U=update)
TTH S,0 Temperature Threshold operation
IPP 192.168.001.102,255.255.255.000,192.168.001.001,192.168.000.001,9989,9998 IP Parameters (IP,netmask,gateway,DNS,port1,port2)
MAC 00:60:A9:10:00:01 MAC Address setting
SNP Set Network Parameters (response command)
QYI Query Gray Info (information mode)
QYA Query Gray Average mode
QYM Query Gray Minimum mode
GAI Get Alarm Info (response command)
YTC <data> Unknown command with data parameter
HTH
LRS
LRD
GAR
DRC
PTS
SCX
SCY
CBT
LRE
CBD
CBS
XXX
GSP
GTT
QYI
QYA
QYM

</syntaxhighlight>

==Secret Menu Overview==
The secret menus Main and System can be openend with the password '''+-MC+-'''

Its structured like this, not all variables have been figured out yet.

The format is Menu: submenu: submenu:

and for menu entries: Name, default value, command, description or messages that pop up.
 <syntaxhighlight lang="vb">
MAIN & SYSTEM PASS: +-MC+-

entries are NAME VALUE COMMAND DESC or if its a folder its just ":"

System:
System:
Gain 255 SCO
Bright 102 IBR
BenDi 100 ?
BenDiContrase 80 ?
DisMode 0 ?
Frequency 48hz (24,25,48,50)
DigitalOut 8-14bit 14bit, BT656(_P), ?, BT601
AutoFocus N ?
Line 1 ?
Ltemp0 11800 ?
LTemp1 11000 ?
HTemp0 9500 ?
HTemp1 8700 ?
DelayTime 0 ?
Enhance 0-1 ?
Enhanced E1 230 ?
FPA_Gain 12pF ? between 4 and 18 at random.
NUCEn N ?

Area:
SE 2 ASN 0-4 "Partition"
INT 200 INT "Points time"
VS 3161 SVS
VF 2800 SVF
Vtemp 1401 VTP
VtempArea Low ?
VtempBase 13500 ?
VtempStep -1 ?
VsStep 8 ?
DeadPixelModel preset / calculate
DP: Cursor to select dead pixels
X 360 position
Y 288 position
AutoBP: 50 Press C to start automatic dotting
Quit? Number of bad pixels 961& "Blind element replacement in progress"
Undo
R2: Save data? blind pixel replacement in progress
Replace Y N = DPI, Y = API
L: Reading parameters
S: Saving parameters

Debug:
Rectify N
DisplayGary N
TE N SDT
AutoE ? ?
AutoVS Y ?
VSGrayH 8000 ?
VSGrayL 7000 ?
Trends 1 ?
Shelter N ?
MotorCon 3 ?
SaveFactoryPara:
LanTyp EN ? LANGUAGE
DisplayMT N ?
Version:
PRJ D843 DLD640 ImLib, MTlib, Soft, Logic

BackDispose:
GammaEN 1 ?
Gain 1 ?
EnhanceEN 0 ?
Hpf_shift 5 ?
Hpf_thrd 5 ?
Enhance 150 ?
Lthrd 50 ?

Monitor:
Opens normal OSD

Alarm Set:
Alarm Switch Y ?
Alarm Mode No ?
Alarm Temperature -1°C ?
Reference Gray Y ?
Alarm Level 1L ?
Alarm Gray 65535 ?
Alarm PointNum 0 ?
Correct Gray 0 ?

Thermometry:
Data Collection 0 SMS
Interval 60 SCP
Ammount 90 SCT
Environment normal ?
Export:
Displays: Exportin normal temperature MTC data
Correction -1 ?
Emissivity 100 SEM
Calibration:
BlackbodyTemp -10 grabs a val from GAB
Save CBS
Cancel CBD
Correction:
BlackbodyTemp -10 Picks from the list GAR
Grayscale 0 SLG
Confirm LRE
Save LRS
Cancel LRD
Ninepoint measurement SMV

Cursor:
Cur N DRC enable cursor
X 320 SRP set cursor position
Y 240 SRP set cursor position

Main:
Auto 2 SAG Auto gain
G 211 SVC
B 10002 SVB
P 1 SWP polarity
Z X ?
Settings:
Image:
FI Y ?
FIValue 0 ? 0-31
Freeze N Freeze image
VE N SMR Vertical flip
HO N SMR Horizontal flip
AutoCali L same as rectify?
O IN internal or external
COM:
Opens UART menu
AvoidburnSwitch OFF enable anti burn in
ProtectedTime 10S duration
AvoidBurn 16383 threshold to trigger antiburn

</syntaxhighlight>

===Automatic Dead Pixels and Flatmap Correction===

It it possible to generate a new flat and dead pixel map automatically within the camera after flashing the cleared-map binary.
 

=====Dead pixels:=====
In the secret menu "System", navigate to Debug - DeadPixelModel and set the AutoBP (sensitivity for auto bad pixel finding) to 50 or so. Then press C Button

This can take a while.
[[File:High emissivity peltier black body.jpg|thumb|A Peltier / TEC coated in Candle sood to give it a high emissivity surface. It can be cooled or heated by swapping the polarity. ]]

Afterwards, navigate to S: and press + to save it.
 

=====Flatfield:=====
In the Debug menu navigate to R2 and press +

now place something '''Cold''' infront of the Camera with a high emissivity. (it needs to fill the whole image)

Press '''+''', wait for it to says High temperature.

Place something '''Hot''' infront and press '''+''' again.

Afterwards, save with '''S:''' again.

Flatfield should now be calibrated
 <blockquote>Note: Not all dead pixels are auto detected or get removed. you can manually select them in the Dead pixel editor but its not known yet how to select and correct them.</blockquote>

 

==Using the Thermal module without Webserver==
[[File:Dali D8X3C Breakout board.png|thumb|Breakout board for D8X3C ]]
to use it, you need to interface it directly.

The module will put out a Analog video signal (High-Z, need to buffer when connecting it to 75Ohm Video input)

Also a 8 or 14bit or 8-bit BT656 output.

the header exposes the FPGA JTAG and UART aswell as 6 Hardware Keys to Navigate the OSD.

To interface, you need to make a adapter board with a DF12-50DS-0.5V(86) Docking socket.

The breakout board files can be found [https://oshwlab.com/gamerpaddy/d8x3c-backpack-usb here] but may be still work in progress.

 

==Sensor Pinout==
[[File:Dali DLD384 Sensor pinout basic.png|thumb|basic pinout of a DLD384]]
the pinout of the thermal sensor havent been analyzes much.

besides some supply and Control voltages, 3 clocks and a analog output have been found.

17.5MHz

14.705KHz

50Hz

Dali D8X3N Thermal Camera

2025-08-04T01:30:21Z

Gamerpaddy: heading pagetitle im confused

=Dali D8X3N Thermal Camera Reverse Engineering=
 

===Introduction===
The [https://www.dali-irtech.com/productinfo/741567.html Dali D8X3N] Thermal Camera module comes in two versions, a 384x288 and 640x480 resolution, utilizing the [http://www.dali-tech.us/products/dld64017m-uncooled-infrared-fpa-detector-86.html DLD Series] of amorphous-Silicon Microbolometers.

They were mainly used in [http://www.dali-tech.us/products/dm60-w--online-body-temperature-thermal-imaging-camera-55.html Dali DM60-W] or WS-1 Body Temperature screening cameras in conjunction with a Black Body radiator set to 37°C to detect infected individuals at the start of the 2020 Covid Pandemic.
[[File:ICI FM320P Innerts.jpg|thumb|Internals. A TP-Link Switch, HikVision Visible Camera and the D8x3N Network thermal camera module]]
[https://infraredcameras.com/ ICI] rebranded these models as FM 320 P and FM 640 P, and distributed them on the local US market, but as the need for such Cameras exploded, those models were built with what was in stock.

So happens, that some of the FM 320 P Models had a DLD640 640x480 instead of a DLD384 384x288 Microbolometer in them, and just got their Firmware modified.

It also could be, because they have excessive amounts of bad pixels outside the 384x288 area, that they were binned to a lower grade.

Discussions about these Cameras started around 2022 in the [https://www.eevblog.com/forum/thermal-imaging/ici-and-dali-thermal-camera-software/ EEVBlog Forums.] when they started to appear secondhand and affordable.

Originally they were priced around US$ 20... 30.000 by ICI, and a unknown amount by Dali Tech.

The Modules specs according to the manufacturer are:

≤50..60mK@F1，300K，50Hz

17 or 25µm pixel pitch

Hisilicon SoC running Linux to provide Onvif and RTSP streams, analysis and a Web UI

 
[[File:Dali D8X3N Module.jpg|thumb|A real 384x288 model with a DLD384 sensor. notice the Productnumber ]]
ICI FM Cameras are found all over Online secondhand marketplaces for scrap Prices, as they are no longer needed.

But you never know, what are you getting. It could be a real DLD384 or the better DLD640 inside. Its a gamble.
 

======640x480 Imagers======
are labeled 22D843 Nxxxx and have a DLD640 sensor in it, they can be upgraded if they run the 384x288 firmware.

======384x288 Imagers======
are labeled 22D883Nxxxx and have a DLD384 sensor in it, they cannot be upgraded

 

==D8X3N Module closer look==
From now on, i will refer to the Thermal Imaging Module as TIM

On the front there is a 2 Element Germanium Lens of a unknown focal length and aperture.

It can be focus-adjusted when unscrewing the clamp around the housing. It can be focussed from infinity down to 10..20cm with some quality loss.
 The outter diameter of the Lens is 42mm with a 1 1/3 inch thread diameter of undetermined pitch.

Dimensions of the germanium elements are 21mm to 3 and 6mm and 14grams in weight.
[[File:Disassembled Thermal Camera Lens.jpg|thumb|Two element Germanium Lens of unknown focal length and aperture]]

The TIM is composed of 6 Stacked PCB modules, 3 of which are for the Web Server functionality. taking them off will give you the basic configuration of a [https://www.dalithermal.com/productinfo/741568.html Dali D8X3C] TIM<gallery>
File:Dali DLD640 Thermal Image Sensor.jpeg|DLD640 Sensor
File:Dali DLD384 Thermal Imaging Sensor.jpeg|DLD384 Sensor
File:Dali D8X3N Board1 Back.jpeg|Network & GPIO Board Back
File:Dali D8X3N Board1 Front.jpeg|Network & GPIO Board Front
File:Dali D8X3N Glue Board Back.jpeg|Board between Logic and IO Back
File:Dali D8X3N Glue Board Front.jpeg|Board between Logic and IO Front
File:Dali D8X3N SoC Board Back.jpeg|SoC Board back
File:Dali D8X3N SoC Board front.jpeg|SoC board front
File:Dali D8X3N FPGA Board Back.jpeg|FPGA Board of the D8X3C Thermal Imager including a PMIC
File:Dali D8X3N FPGA Board Front.jpeg|FPGA Board Front with Video DAC and SPI Flash
File:Dali D8X3N Sensor Power and ADC Board.jpeg|Sensor control and ADC board
File:Dali D8X3N Thermal Core Debug wiring.jpeg|Debug wiring for sniffing SPI and UART
</gallery>

===User Manual===
including pinout diagram and important data

can be found here https://archive.org/details/dali-d-8-x-3-cuser-manualen-v-1.0-1

==Viewing the Video Stream==
[[File:Onvif Device Manager ODM.png|thumb|ODM streaming the Thermal view]]
when first connecting it to power and Ethernet, the camera will have 192.168.1.102 as a Static ip.

If you are running a 192.168.0.x or .178.x net, you need to change it or add a subnet under windows ipv4 settings.

to view it, you can use VLC and the stream URL
rtsp://admin@admin:<camera ip>/ONVIFMedia
there is /ONVIFMedia /ONVIFMediaM and /ONVIFMediaS for different stream Profiles.

VLC is quite slow and delayed, rather use Onvif Device Manager ODM,

it has no delay and auto-detects cameras in the network.

Be sure to log in as user: admin pass: admin in ODM.

in there, you can also set you camera to DHCP under Network settings.

===Web Interface===
[[File:Dali D8X3N web interface.png|thumb|Since browsers cant display RTSP anymore, open in Edge and select IE Compatibility Mode.]]
the web interface can be accessed by opening the camera IP in a browser

login is:
user: admin pass: admin
You can set Temperature markers and areas, but without using the Black Body calibration source, your readings may be way off or not working.

 

====OSD====
there is a debug-login with
user: super pass: 871897
that lets you send Key commands to the Imager to navigate the OSD.

Setting the OSD to english is accomplished with option #11
[[File:Dali D8X3C OSD.png|thumb|OSD in english, if yours is Chinese. go to option #11 and click + or -]]

To acces some locked menus, press
+ - + - + -

The password for the locked System and Main menu is
+-MC+-

Be careful in the UART menu to not change the BAUD rate or Protocol, as your ability to control it via the Web API gets lost.

You need to reflash or solder buttons on the thermal core then.

==Viewing Raw Thermal Data from the Web API==
there is a hidden endpoint in the stream.so file that could be found while decompiling

accessing
[[File:Arduino Nano blink sketch thermal gif.gif|thumb|Arduino Nano running blink sketch while thermally recording it, notice the led and resistor on the right]]
<ip of camera>:5000/stream?Type=JPEG&Source=Jpeg&Mode=TCP
lets you download a JPEG. but there are more options available (not all have been tested)

we are mainly interessted in Raw thermal data.

====Source (Stream Type)====

*<code>Major</code> - Main video stream (channel 0)
*<code>Minor</code> - Sub video stream (channel 1)
*<code>MinorAV</code> - Sub video + audio stream
*<code>MajorAV</code> - Main video + audio stream
*<code>Jpeg</code> - JPEG snapshot stream
*<code>Raw</code> - Raw thermal data stream
*<code>YUV</code> - YUV raw video stream

====Type (Data Format)====

*<code>H264</code> - H.264 video encoding
*<code>JPEG</code> - JPEG image format
*<code>RAW</code> - Raw sensor data
*<code>QBOX</code> - Custom protocol format
*<code>FRAME</code> - Frame-based format

====Mode (Transport Protocol)====

*<code>TCP</code> - TCP streaming (default)
*<code>UDP</code> - UDP streaming
*<code>MUL</code> - Multicast streaming

====Quality Parameters====

*<code>Quality=[1-100]</code> - Video quality level
*<code>Frames=[number]</code> - Number of frames to send
*<code>Interval=[ms]</code> - Frame interval in milliseconds

====Network Parameters====

*<code>IPAddr=[ip]</code> - Client IP address for UDP/multicast
*<code>Port=[port]</code> - Client port for UDP/multicast
*<code>Heart-beat=[Yes/No]</code> - Enable/disable heartbeat

====Snapshot Parameters====

*<code>Snap=[Yes/No]</code> - Enable snapshot mode

====Raw Viewer for PC (Python)====
[[File:Dali D8X3N Raw Thermal viewer.png|thumb|Raw Data Viewer in python]]

To view the raw stream, i made a python program that converts the 14bit thermal data to a visible image.

it is low fps tho, due to bad optimizations.

rev1 first working version https://pastebin.com/dyNWDPT3

rev2 with temperature readout https://pastebin.com/u107Q85w

rev3 and onward will only be available directly as a Webpage on the Device (see below).

====Raw Viewer for the internal Webserver (recommended)====
It is also possible to use the Raw viewer directly in the browser.

To achieve this, the stream had to be proxied from port 5000 to 80 due to CORS.

luckily the internal lighttpd had the CGI module enabled, so piping it troug (using wget ... i know) worked with very low overhead.

To install, you need '''Terminal access''' to the Camera. see below.

optional for simplicity: '''ftp''' access

Then download the '''rawviewer.zip''' from [https://archive.org/details/rawviewer_202508 here] (rev3 with histogram, javascript)
[[File:Dali D8X3N Webviewer.png|thumb|Web Raw Viewer with histogram (rev3)]]

unpack the web folder into '''/app''' and '''restart''' your camera.

It should be accessible now trough '''http://<camera ip>/raw.html''' in the browser and click '''Start Stream'''
 <blockquote>performance may need improvement.</blockquote>

==Getting Root Terminal Access==
To access the Terminal you need to solder or plug in a UART connection to Connector J7 on the "Glue" board.

Pinout is (left to right) '''RX TX GND 3.3V Baud 115200 3.3V!'''

But the system will spam with debug messages, making patching the files a hard job unless you use "tftp" or "sed" commands.
 

====Enabling Telnet access to make patching easier====
[[File:Upgrade ici dali firmware updater.png|thumb|ICI Firmware updater software with modified firmware loaded]]

there is a easier way using a modified Firmware updater to enable Telnet temporarily to patch the Files.

Download the '''upgrade_ici.exe''' form [https://archive.org/details/fwupdate here] and run it.

Then you should be able to connect to it via Telnet.

The Login credentials are '''User: roo'''t '''Password: DLroot'''

 

===Patching Device===

===Patching the Web Server===
 

====Enabling Telnet and ftpd permanently====

This only works if you also patch the Thermal Camera module flash!

====to permanently enable Telnet, go to '''/etc/init.d''' and edit '''S90app'''====
vi S90app
in vi, move your cursor to the '''#''' at '''#telnetd''' and press x<blockquote>optional: enable ftp by removing the '''#''' at '''ftpd''' and adjust the path to / </blockquote>now press ''':''' and type '''wq''' and hit '''enter'''. this should be it.

====Patching the decoder and streamer to 640x480:====
go to /app and edit the mach.cfg

replace DL384 with D640 and edit the resolution to 640 480

(press i in vi to enter edit mode, press ESC to exit edit mode. :wq to write and quit.)

repeat that procedure for the dali.cfg

=====(optional) patching app.sh to prevent it from rebooting=====
edit the app.sh in /app and remove all "reboot" occasions to prevent the camera from rebooting if onvifserver, httpd or daliServer arent running for debugging purposes.

 

====Patching the Thermal Camera module====
To patch it, you need to disassemble everything down to the FPGA Board,

on the bottom there is a SPI SOIC8 Flash.

Use a CH341 EEPROM programmer (be sure to have a fixed or modified version to not put out 5V!, set it to 3.3V) and SOIC8 clamp.

Use NeoProgrammer (i used 2.2.0.10 but there are newer available, use the latest) and click Detect. It should find W25Q128 chips, select the FV one.

Dont forget to download a backup of your flash and save it !

Download the Binary "Dali 640x480 '''actual''' cleared pixelmap.bin" from #3 below and load it into NeoProgrammer,

Click Erase, Program and Verify.

This can take a while.

Your imager should start up right after assembly by hearing the shutter click.

==Hardware Hacking==

===Flash Contents===
On archive, click on show all files to download them.

<nowiki>#</nowiki>1 a Flash dump of the original downgraded D8X3N can be found [https://archive.org/details/dali-d-843n-flash-dump here]

<nowiki>#</nowiki>2 a Flash dump of a original 640x480 model can be found [https://archive.org/details/d-843-n-640x-480 here]

<nowiki>#</nowiki>3 a modified Flash dump of a 640x480 with cleared dead pixel map, flat map etc. can be found [https://archive.org/details/d-843-n-640x-480-cleared-pixelmap here]

a Flash dump of the web server SPI flash W25Q256JV can be found [https://archive.org/details/dm-60-webserver-flash-dump here] in case a bad firmware update caused a bootloop.

 

===Flash Binary Analysis===
The Flash IC is a Winbond 25Q128JV SPI Flash that contains the FPGA Bitstream, Deadpixel and Flatmap, aswell as the Device Settings.

a copy of the SPI Logic Capture at startup can be found [https://archive.org/details/dali-eeprom-capture here], the free software [https://www.dreamsourcelab.com/download/ DSView from DreamSourceLab] is required to view it.
[[File:Dali Thermal Imager SPI Flash capture.png|thumb|SPI Flash access while booting the Thermal Module]]

a approximation of the offsets resulted in this list:<syntaxhighlight lang="vb">
0x000000 - altera cyclone iv stuff
0x200000 - settings
0x280000 - Flat field correction map
0x4C0000 - Bad Pixel correctio nmap
0x580000 - image aswell? 36010 bytes
0x740000 - GUIX?
0x7C0000 - Strings for Gui?
0x800000 - another shorter GUIX
0x880000 - Strings for second gui?
0x8C0000 - GUIX
0x940000 - Strings for gui
0xE00000 - ?
0xE80000 - dzxg? short
0xEC0000 - crosshair.bmp
0xF40000 - 3DTM?
0xF80000 - fake? Bad pixel map BPRP
</syntaxhighlight> 

====Settings offset 0x200000====
The settings are read and written every startup, aswell when you close the OSD, sporadically and when executing the command MSV

these are some of the settings i could figure out by changing and watching the logic capture what changed.
 <syntaxhighlight lang="vb">
offset size Cmd
0x0 1 SAG (0-2) auto gain
0x2 2 SVB (0-16383) saved value is 16383 - SVB
0x4 2 SVC (0-1023) set exposure or gain
0x6 1 SSM image filtering
0x8 1 SEH image enhancement
0xA 1 SWP invert b/w polarity
0x14 1 SMR Flip
0x16 1 SMR Mirror
0x20 1 MENU Cal source 0 IN, 1 OUT
0x3A 1 MENU Enhance value 0-100
0x40 1 MENU Rectify (shutter 0 OFF, 1 L, 2 H)
0x50 1 MENU Language 0 english, 1 chinese, 2 russian
0xA2 - SCO set contrast gain
0xA4 - IBR set brightness
0xAE 2 MENU Fire Threshold
0xAC 1 SPA set color palette
0xE2 1 SMS display "collected 0/80" enabled
0xF8 1 SEM set emissivity
0x110 1 SRT set revise temp
0x116 1 SHD set humidity
0x118 1 SET set ambient temp
0x11A 1 STD set temp range
0x120 2 SLG -500 to 500?
0x124 2 SRD set distance
0x12C 1 SCP ???
0x130 2 SCT ???
</syntaxhighlight> 
[[File:Dali D8X3N Bad Pixel Map Viewer.png|thumb|Bad pixel map of a 640x512 sensor, about 0.56% of dead pixels in this map]]
So i let the AI create a [https://2476424.playcode.io/ Configurator page] that lets you change the Settings in your Flashdump to your liking
 

======Bad Pixel and Flatframe Maps 0x280000 and 0x4C0000======
Thermal cameras require a bad pixel and flat frame map to compensate for manufacturing inconsistencies.

unfourtainly, the maps of the downgraded cameras only contain enough data for a 384 model, not the full 640.

at offset 0xF80000 there is a BPRP which was mistaken at first as the Bad pixel map, it could just be a mask to where to apply the offset maps, as its either 0x0 or 0x1.

The [https://2477569.playcode.io/ Viewer Page] is written in JS and does not require any special dependencies, it can run as a plain html file offline.

There still needs to be work done to create own maps and flatfields but the cameras are still very capable and useable with fully cleared maps.

To clear the maps, just go to these offsets and fill with values around 0x3F or 0x0 for total length of X Resolution x Y Resolution x 2 bytes (0x96000 for 640x480)

[[File:Dali D8X3N Flat Field Map Viewer.png|thumb|Flat Field viewer]]

==Dali Commands==
To control the TIM you can either use Pelco or Dali command set. By default the Dali commandset is used at 38400 BAUD.

Those commands consist of a 0x02 start byte followed by two length Bytes, then the actual command which is allways 3 uppercase Letters in ASCII (eg. KBD for keyboard) followed by a comma and the values.

Some commands take multiple values, some dont. But you allways have to send the comma after the Command.

The camera will answer with the Command and 0, 1 or 2. Sending no value counts as zero.
0 is invalid parameters, too few or out of range

1 is OK, valid command

2 is Invalid command

Commands can be sent trough the Web server using the URL Api endpoint or directly trough the UART port.

(keyboard, C button, causes the shutter to do a calibration)
<camera ip>/cgi-bin/dmcmd?Command=KBD,C
Listening to the answer can be done while being in the Linux shell and typing
cat /dev/ttyAMA2 | strings

By bruteforcing the UART with AAA to ZZZ a list of Commands could be obtained, but some with unknown Parameters or functionality yet. including some from a decompiled DM60comm.so module found in /app/modules folder.<syntaxhighlight lang="vb">
KBD KEY Keyboard (F S M C + -)
SSM 0-1 Image Filtering Off/On
GSM 0 Image filter status
SEH 0-1 Image Enhancement Off/On
GEH 0-1 Image enhancer status
SCO 0-255 Set Gain (locked when SAG auto gain is on)
GCO 0-255 Get gain
INT 15-320 set actual gain? not just contrast sometimes disabled?
IBR 0-255 Set brightness
GBR 0-255 Get brightness
SMR 0-3 Mirror mode bit0=horizontal, bit1=vertical
GMR 0 Get rotation/flip
SDT 0-1 displays temp=44.65°C osd, but webserver sends date/time to the cam there....
GDT 0-1 Get temp display active?
GPT Display temp oft SDT
GNU 0-1 Get Shutter closed/open
SNU 0-1 Shutter close / open
STD 0-1 Set Range 0: -20-180°C 1: 100-600°C
GTD 0-1 Get Range
SET °C Set Ambient temperature
GET °C Get Ambient temperature
SEM 0-100 0-1 set emissivity x100
GEM 0-100 Get Emissivity
SRT °C Set revise temperature -100-100 -10-10°
GRT °C Get revise temperature
SRD 100 Set Distance 4.4m x100
GRD 100 Get Distance
SHD 0-100 Set Humidity
GHD 55 Get Humidity
SWP 0-1 invert s/w polarity image
GWP 1 is inverted?
SPA 0-10? Set color palette
GPA 3 white hot
SMV 0-1 Show temperature 3x3 grid?? in combination with GTV maybe
GMV 0
SMS 0-1 displays "collected 0/<number set by SCT>" by SCP delay "saves the daily number of highest temperatures?"
GMS 0
SCT 1-500 sets the amount of "collected" points for SMS
GCT 80
SCP 5-60 "collected" delay in seconds for SMS
GCP 60
SAG 0-2 Auto brightness / gain
GAG 0
SLR 0-9 ???
GLR 0
SRP 0,0 - 639,479 set crosshair position
GRP 320,240 get crosshair position
DRC 0-1 Show crosshair
SLG -500-500 ??
GLG
SCE text ??
GCE 0
SCB text ??
GCB 0
SVB 0-16383 adc offset, exposure? good at 9650
GVB 6733 value is 16383 minus SVB
SVC 1-1023 set contrast but better
GVC 260
SVF 100-? ?? video freaks out 3400 seems good
SVS 100-? ?? video freaks out 3300 seems good
SOT 0-1 ?? sensor supply, looks weird when off.
SZM 1-4 ?
GZM 1
MSV save settings too eeprom
ASV Saves something aswell?
GCS 0 Get Core status & faults
ALD 0,2? video blanks lots of eeprom activity. reload pixel map??
SAV 0-9999 set Fire threshold
GAV 2100 get Fire Threshold
BAC change uart protocol? careful
CBD Displays Recovery successful?
CBS Displays Saved successfully
LRD Displays Recovery successful?
LRS Displays Saved successfully?
LRE Displays Temperature Repair successful?
CBT Displays Calibration successful?
DBP ??? shutter clicks
DPI Show weird pixels
API Hide weird pixels
CCM ??
ASN 0-4 ??
GAB 4 vals ?? 3,-10,50,150
GAN 1 ??
GAR 11 vals ?? 10,10,5,20,35,50,70,90,120,150,180,,
GCM 6 values ??
GFV prints screen gray value?
GIT 200 ??
GTV Get the collected temp values?
PTS echoes but with extra stuff??
QYA 7170 Query Gray Info (information mode)
QYI 7124 Query Gray Average mode
QYM 7512 Query Gray Minimum mode
VTP 400-4000 ??
MTD U/S,0,0 ?? S answers with bytes, U upload bytes?
MTC U/S? ?? S answers with U,0,0, S doesnt.

return 0 invalid params:
STS ??
STT ??
SAC ??
SAH ??
SAS ??
SAT ??
SCX ?? displays crosshair but invalid params
SCY ?? displays crosshair but invalid params
GAC ??
GAH ??
GAS ??
GAT ??
GME ??
GPC ??
GPI ??
GPM ??
GTA ??
GTC ??
GTI ??
GTM ??
GTS ??
GTT ??

answer only:

BPM 0-1 stream ready? answers with 0 stop, 1 go, 2 when prompted
AVS 0,1
MEH
PWI 0-1 changing palette from wh to fire

unconfirmed (from dm60comm.so):
SDT 2024,03,15,14,30,25 Set Date Time with year,month,day,hour,minute,second
STS 1 Set Temperature Show display (0=off, 1=on)
SVA 2 Set Video Auto mode (0=manual, 2=auto)
SMP 0,1,1,0,100,150,200,250,300,350,90,25 Set Measurement Point (type,index,enable,mode,startX,startY,endX,endY,anchorX,anchorY,threshold,color)
STV Stop Temperature View measurements
SPF 5 Set Profile parameter
SVL -10 Set Video Left pan movement (signed value)
SVU -5 Set Video Up tilt movement (signed value)
SVD 5 Set Video Down tilt movement (signed value)
SSP 17,1,0 Set System Parameter (param_id,value,index) #46 temperature format 0 °C, 1 °F, 2 K
SCP Set Current Preset (save current position)
GCP Get Current Preset
STT 300,350 Set Temperature Threshold (low,high values *10)
SDC 1 Set Display Configuration parameter
GCS Get Current Status
GMM Get Memory Map information
GFV Get Frame Value (grayscale data)
GFZ Get Freeze Status
GSI 1 Get System Information (parameter=1)
GSS Get System Status
GSP 21,0 Get System Parameter (param_21=surround temp, value=0)
GTT Get Temperature Threshold range
GTV 1,3,10 Get Temperature Values (enable,type,count)
GNU Get Network Update status (response command)
FRZ Freeze current display frame
LIV Live mode (unfreeze display)
CAL Calibrate system
CCP 3 Call Current Preset (preset number 0-9)
APF 100 Auto Profile setting
MEH Measure Enhancement
BPT Built-in Test
MTC S,0 Measure Temperature Capture (S=start, 0=sequence)
MTG U,0,1024,<data> Measure Temperature Gray data transfer
MTD U,0,1024,<data> Measure Temperature Data transfer
UFP S,0,2048 Update Firmware Prepare (S=start, 0=offset, 2048=size)
UFD S,0,1024 Update Firmware Data transfer
BAB U Buffer operation (U=update)
TTH S,0 Temperature Threshold operation
IPP 192.168.001.102,255.255.255.000,192.168.001.001,192.168.000.001,9989,9998 IP Parameters (IP,netmask,gateway,DNS,port1,port2)
MAC 00:60:A9:10:00:01 MAC Address setting
SNP Set Network Parameters (response command)
QYI Query Gray Info (information mode)
QYA Query Gray Average mode
QYM Query Gray Minimum mode
GAI Get Alarm Info (response command)
YTC <data> Unknown command with data parameter
HTH
LRS
LRD
GAR
DRC
PTS
SCX
SCY
CBT
LRE
CBD
CBS
XXX
GSP
GTT
QYI
QYA
QYM

</syntaxhighlight>

==Secret Menu Overview==
The secret menus Main and System can be openend with the password '''+-MC+-'''

Its structured like this, not all variables have been figured out yet.

The format is Menu: submenu: submenu:

and for menu entries: Name, default value, command, description or messages that pop up.
 <syntaxhighlight lang="vb">
MAIN & SYSTEM PASS: +-MC+-

entries are NAME VALUE COMMAND DESC or if its a folder its just ":"

System:
System:
Gain 255 SCO
Bright 102 IBR
BenDi 100 ?
BenDiContrase 80 ?
DisMode 0 ?
Frequency 48hz (24,25,48,50)
DigitalOut 8-14bit 14bit, BT656(_P), ?, BT601
AutoFocus N ?
Line 1 ?
Ltemp0 11800 ?
LTemp1 11000 ?
HTemp0 9500 ?
HTemp1 8700 ?
DelayTime 0 ?
Enhance 0-1 ?
Enhanced E1 230 ?
FPA_Gain 12pF ? between 4 and 18 at random.
NUCEn N ?

Area:
SE 2 ASN 0-4 "Partition"
INT 200 INT "Points time"
VS 3161 SVS
VF 2800 SVF
Vtemp 1401 VTP
VtempArea Low ?
VtempBase 13500 ?
VtempStep -1 ?
VsStep 8 ?
DeadPixelModel preset / calculate
DP: Cursor to select dead pixels
X 360 position
Y 288 position
AutoBP: 50 Press C to start automatic dotting
Quit? Number of bad pixels 961& "Blind element replacement in progress"
Undo
R2: Save data? blind pixel replacement in progress
Replace Y N = DPI, Y = API
L: Reading parameters
S: Saving parameters

Debug:
Rectify N
DisplayGary N
TE N SDT
AutoE ? ?
AutoVS Y ?
VSGrayH 8000 ?
VSGrayL 7000 ?
Trends 1 ?
Shelter N ?
MotorCon 3 ?
SaveFactoryPara:
LanTyp EN ? LANGUAGE
DisplayMT N ?
Version:
PRJ D843 DLD640 ImLib, MTlib, Soft, Logic

BackDispose:
GammaEN 1 ?
Gain 1 ?
EnhanceEN 0 ?
Hpf_shift 5 ?
Hpf_thrd 5 ?
Enhance 150 ?
Lthrd 50 ?

Monitor:
Opens normal OSD

Alarm Set:
Alarm Switch Y ?
Alarm Mode No ?
Alarm Temperature -1°C ?
Reference Gray Y ?
Alarm Level 1L ?
Alarm Gray 65535 ?
Alarm PointNum 0 ?
Correct Gray 0 ?

Thermometry:
Data Collection 0 SMS
Interval 60 SCP
Ammount 90 SCT
Environment normal ?
Export:
Displays: Exportin normal temperature MTC data
Correction -1 ?
Emissivity 100 SEM
Calibration:
BlackbodyTemp -10 grabs a val from GAB
Save CBS
Cancel CBD
Correction:
BlackbodyTemp -10 Picks from the list GAR
Grayscale 0 SLG
Confirm LRE
Save LRS
Cancel LRD
Ninepoint measurement SMV

Cursor:
Cur N DRC enable cursor
X 320 SRP set cursor position
Y 240 SRP set cursor position

Main:
Auto 2 SAG Auto gain
G 211 SVC
B 10002 SVB
P 1 SWP polarity
Z X ?
Settings:
Image:
FI Y ?
FIValue 0 ? 0-31
Freeze N Freeze image
VE N SMR Vertical flip
HO N SMR Horizontal flip
AutoCali L same as rectify?
O IN internal or external
COM:
Opens UART menu
AvoidburnSwitch OFF enable anti burn in
ProtectedTime 10S duration
AvoidBurn 16383 threshold to trigger antiburn

</syntaxhighlight>

===Automatic Dead Pixels and Flatmap Correction===

It it possible to generate a new flat and dead pixel map automatically within the camera after flashing the cleared-map binary.
 

=====Dead pixels:=====
In the secret menu "System", navigate to Debug - DeadPixelModel and set the AutoBP (sensitivity for auto bad pixel finding) to 50 or so. Then press C Button

This can take a while.
[[File:High emissivity peltier black body.jpg|thumb|A Peltier / TEC coated in Candle sood to give it a high emissivity surface. It can be cooled or heated by swapping the polarity. ]]

Afterwards, navigate to S: and press + to save it.
 

=====Flatfield:=====
In the Debug menu navigate to R2 and press +

now place something '''Cold''' infront of the Camera with a high emissivity. (it needs to fill the whole image)

Press '''+''', wait for it to says High temperature.

Place something '''Hot''' infront and press '''+''' again.

Afterwards, save with '''S:''' again.

Flatfield should now be calibrated
 <blockquote>Note: Not all dead pixels are auto detected or get removed. you can manually select them in the Dead pixel editor but its not known yet how to select and correct them.</blockquote>

 

==Using the Thermal module without Webserver==
[[File:Dali D8X3C Breakout board.png|thumb|Breakout board for D8X3C ]]
to use it, you need to interface it directly.

The module will put out a Analog video signal (High-Z, need to buffer when connecting it to 75Ohm Video input)

Also a 8 or 14bit or 8-bit BT656 output.

the header exposes the FPGA JTAG and UART aswell as 6 Hardware Keys to Navigate the OSD.

To interface, you need to make a adapter board with a DF12-50DS-0.5V(86) Docking socket.

The breakout board files can be found [https://oshwlab.com/gamerpaddy/d8x3c-backpack-usb here] but may be still work in progress.

 

==Sensor Pinout==
[[File:Dali DLD384 Sensor pinout basic.png|thumb|basic pinout of a DLD384]]
the pinout of the thermal sensor havent been analyzes much.

besides some supply and Control voltages, 3 clocks and a analog output have been found.

17.5MHz

14.705KHz

50Hz

Dali D8X3N Thermal Camera

2025-08-04T01:29:02Z

Gamerpaddy: fixes

==Dali D8X3N Thermal Camera Reverse Engineering==
 

===Introduction===
The [https://www.dali-irtech.com/productinfo/741567.html Dali D8X3N] Thermal Camera module comes in two versions, a 384x288 and 640x480 resolution, utilizing the [http://www.dali-tech.us/products/dld64017m-uncooled-infrared-fpa-detector-86.html DLD Series] of amorphous-Silicon Microbolometers.

They were mainly used in [http://www.dali-tech.us/products/dm60-w--online-body-temperature-thermal-imaging-camera-55.html Dali DM60-W] or WS-1 Body Temperature screening cameras in conjunction with a Black Body radiator set to 37°C to detect infected individuals at the start of the 2020 Covid Pandemic.
[[File:ICI FM320P Innerts.jpg|thumb|Internals. A TP-Link Switch, HikVision Visible Camera and the D8x3N Network thermal camera module]]
[https://infraredcameras.com/ ICI] rebranded these models as FM 320 P and FM 640 P, and distributed them on the local US market, but as the need for such Cameras exploded, those models were built with what was in stock.

So happens, that some of the FM 320 P Models had a DLD640 640x480 instead of a DLD384 384x288 Microbolometer in them, and just got their Firmware modified.

It also could be, because they have excessive amounts of bad pixels outside the 384x288 area, that they were binned to a lower grade.

Discussions about these Cameras started around 2022 in the [https://www.eevblog.com/forum/thermal-imaging/ici-and-dali-thermal-camera-software/ EEVBlog Forums.] when they started to appear secondhand and affordable.

Originally they were priced around US$ 20... 30.000 by ICI, and a unknown amount by Dali Tech.

The Modules specs according to the manufacturer are:

≤50..60mK@F1，300K，50Hz

17 or 25µm pixel pitch

Hisilicon SoC running Linux to provide Onvif and RTSP streams, analysis and a Web UI

 
[[File:Dali D8X3N Module.jpg|thumb|A real 384x288 model with a DLD384 sensor. notice the Productnumber ]]
ICI FM Cameras are found all over Online secondhand marketplaces for scrap Prices, as they are no longer needed.

But you never know, what are you getting. It could be a real DLD384 or the better DLD640 inside. Its a gamble.
 

======640x480 Imagers======
are labeled 22D843 Nxxxx and have a DLD640 sensor in it, they can be upgraded if they run the 384x288 firmware.

======384x288 Imagers======
are labeled 22D883Nxxxx and have a DLD384 sensor in it, they cannot be upgraded

 

==D8X3N Module closer look==
From now on, i will refer to the Thermal Imaging Module as TIM

On the front there is a 2 Element Germanium Lens of a unknown focal length and aperture.

It can be focus-adjusted when unscrewing the clamp around the housing. It can be focussed from infinity down to 10..20cm with some quality loss.
 The outter diameter of the Lens is 42mm with a 1 1/3 inch thread diameter of undetermined pitch.

Dimensions of the germanium elements are 21mm to 3 and 6mm and 14grams in weight.
[[File:Disassembled Thermal Camera Lens.jpg|thumb|Two element Germanium Lens of unknown focal length and aperture]]

The TIM is composed of 6 Stacked PCB modules, 3 of which are for the Web Server functionality. taking them off will give you the basic configuration of a [https://www.dalithermal.com/productinfo/741568.html Dali D8X3C] TIM<gallery>
File:Dali DLD640 Thermal Image Sensor.jpeg|DLD640 Sensor
File:Dali DLD384 Thermal Imaging Sensor.jpeg|DLD384 Sensor
File:Dali D8X3N Board1 Back.jpeg|Network & GPIO Board Back
File:Dali D8X3N Board1 Front.jpeg|Network & GPIO Board Front
File:Dali D8X3N Glue Board Back.jpeg|Board between Logic and IO Back
File:Dali D8X3N Glue Board Front.jpeg|Board between Logic and IO Front
File:Dali D8X3N SoC Board Back.jpeg|SoC Board back
File:Dali D8X3N SoC Board front.jpeg|SoC board front
File:Dali D8X3N FPGA Board Back.jpeg|FPGA Board of the D8X3C Thermal Imager including a PMIC
File:Dali D8X3N FPGA Board Front.jpeg|FPGA Board Front with Video DAC and SPI Flash
File:Dali D8X3N Sensor Power and ADC Board.jpeg|Sensor control and ADC board
File:Dali D8X3N Thermal Core Debug wiring.jpeg|Debug wiring for sniffing SPI and UART
</gallery>

===User Manual===
including pinout diagram and important data

can be found here https://archive.org/details/dali-d-8-x-3-cuser-manualen-v-1.0-1

=Viewing the Video Stream=
[[File:Onvif Device Manager ODM.png|thumb|ODM streaming the Thermal view]]
when first connecting it to power and Ethernet, the camera will have 192.168.1.102 as a Static ip.

If you are running a 192.168.0.x or .178.x net, you need to change it or add a subnet under windows ipv4 settings.

to view it, you can use VLC and the stream URL
rtsp://admin@admin:<camera ip>/ONVIFMedia
there is /ONVIFMedia /ONVIFMediaM and /ONVIFMediaS for different stream Profiles.

VLC is quite slow and delayed, rather use Onvif Device Manager ODM,

it has no delay and auto-detects cameras in the network.

Be sure to log in as user: admin pass: admin in ODM.

in there, you can also set you camera to DHCP under Network settings.

===Web Interface===
[[File:Dali D8X3N web interface.png|thumb|Since browsers cant display RTSP anymore, open in Edge and select IE Compatibility Mode.]]
the web interface can be accessed by opening the camera IP in a browser

login is:
user: admin pass: admin
You can set Temperature markers and areas, but without using the Black Body calibration source, your readings may be way off or not working.

 

====OSD====
there is a debug-login with
user: super pass: 871897
that lets you send Key commands to the Imager to navigate the OSD.

Setting the OSD to english is accomplished with option #11
[[File:Dali D8X3C OSD.png|thumb|OSD in english, if yours is Chinese. go to option #11 and click + or -]]

To acces some locked menus, press
+ - + - + -

The password for the locked System and Main menu is
+-MC+-

Be careful in the UART menu to not change the BAUD rate or Protocol, as your ability to control it via the Web API gets lost.

You need to reflash or solder buttons on the thermal core then.

==Viewing Raw Thermal Data from the Web API==
there is a hidden endpoint in the stream.so file that could be found while decompiling

accessing
[[File:Arduino Nano blink sketch thermal gif.gif|thumb|Arduino Nano running blink sketch while thermally recording it, notice the led and resistor on the right]]
<ip of camera>:5000/stream?Type=JPEG&Source=Jpeg&Mode=TCP
lets you download a JPEG. but there are more options available (not all have been tested)

we are mainly interessted in Raw thermal data.

====Source (Stream Type)====

*<code>Major</code> - Main video stream (channel 0)
*<code>Minor</code> - Sub video stream (channel 1)
*<code>MinorAV</code> - Sub video + audio stream
*<code>MajorAV</code> - Main video + audio stream
*<code>Jpeg</code> - JPEG snapshot stream
*<code>Raw</code> - Raw thermal data stream
*<code>YUV</code> - YUV raw video stream

====Type (Data Format)====

*<code>H264</code> - H.264 video encoding
*<code>JPEG</code> - JPEG image format
*<code>RAW</code> - Raw sensor data
*<code>QBOX</code> - Custom protocol format
*<code>FRAME</code> - Frame-based format

====Mode (Transport Protocol)====

*<code>TCP</code> - TCP streaming (default)
*<code>UDP</code> - UDP streaming
*<code>MUL</code> - Multicast streaming

====Quality Parameters====

*<code>Quality=[1-100]</code> - Video quality level
*<code>Frames=[number]</code> - Number of frames to send
*<code>Interval=[ms]</code> - Frame interval in milliseconds

====Network Parameters====

*<code>IPAddr=[ip]</code> - Client IP address for UDP/multicast
*<code>Port=[port]</code> - Client port for UDP/multicast
*<code>Heart-beat=[Yes/No]</code> - Enable/disable heartbeat

====Snapshot Parameters====

*<code>Snap=[Yes/No]</code> - Enable snapshot mode

====Raw Viewer for PC (Python)====
[[File:Dali D8X3N Raw Thermal viewer.png|thumb|Raw Data Viewer in python]]

To view the raw stream, i made a python program that converts the 14bit thermal data to a visible image.

it is low fps tho, due to bad optimizations.

rev1 first working version https://pastebin.com/dyNWDPT3

rev2 with temperature readout https://pastebin.com/u107Q85w

rev3 and onward will only be available directly as a Webpage on the Device (see below).

====Raw Viewer for the internal Webserver (recommended)====
It is also possible to use the Raw viewer directly in the browser.

To achieve this, the stream had to be proxied from port 5000 to 80 due to CORS.

luckily the internal lighttpd had the CGI module enabled, so piping it troug (using wget ... i know) worked with very low overhead.

To install, you need '''Terminal access''' to the Camera. see below.

optional for simplicity: '''ftp''' access

Then download the '''rawviewer.zip''' from [https://archive.org/details/rawviewer_202508 here] (rev3 with histogram, javascript)
[[File:Dali D8X3N Webviewer.png|thumb|Web Raw Viewer with histogram (rev3)]]

unpack the web folder into '''/app''' and '''restart''' your camera.

It should be accessible now trough '''http://<camera ip>/raw.html''' in the browser and click '''Start Stream'''
 <blockquote>performance may need improvement.</blockquote>

==Getting Root Terminal Access==
To access the Terminal you need to solder or plug in a UART connection to Connector J7 on the "Glue" board.

Pinout is (left to right) '''RX TX GND 3.3V Baud 115200 3.3V!'''

But the system will spam with debug messages, making patching the files a hard job unless you use "tftp" or "sed" commands.
 

====Enabling Telnet access to make patching easier====
[[File:Upgrade ici dali firmware updater.png|thumb|ICI Firmware updater software with modified firmware loaded]]

there is a easier way using a modified Firmware updater to enable Telnet temporarily to patch the Files.

Download the '''upgrade_ici.exe''' form [https://archive.org/details/fwupdate here] and run it.

Then you should be able to connect to it via Telnet.

The Login credentials are '''User: roo'''t '''Password: DLroot'''

 

===Patching Device===

===Patching the Web Server===
 

====Enabling Telnet and ftpd permanently====

This only works if you also patch the Thermal Camera module flash!

====to permanently enable Telnet, go to '''/etc/init.d''' and edit '''S90app'''====
vi S90app
in vi, move your cursor to the '''#''' at '''#telnetd''' and press x<blockquote>optional: enable ftp by removing the '''#''' at '''ftpd''' and adjust the path to / </blockquote>now press ''':''' and type '''wq''' and hit '''enter'''. this should be it.

====Patching the decoder and streamer to 640x480:====
go to /app and edit the mach.cfg

replace DL384 with D640 and edit the resolution to 640 480

(press i in vi to enter edit mode, press ESC to exit edit mode. :wq to write and quit.)

repeat that procedure for the dali.cfg

=====(optional) patching app.sh to prevent it from rebooting=====
edit the app.sh in /app and remove all "reboot" occasions to prevent the camera from rebooting if onvifserver, httpd or daliServer arent running for debugging purposes.

 

====Patching the Thermal Camera module====
To patch it, you need to disassemble everything down to the FPGA Board,

on the bottom there is a SPI SOIC8 Flash.

Use a CH341 EEPROM programmer (be sure to have a fixed or modified version to not put out 5V!, set it to 3.3V) and SOIC8 clamp.

Use NeoProgrammer (i used 2.2.0.10 but there are newer available, use the latest) and click Detect. It should find W25Q128 chips, select the FV one.

Dont forget to download a backup of your flash and save it !

Download the Binary "Dali 640x480 '''actual''' cleared pixelmap.bin" from #3 below and load it into NeoProgrammer,

Click Erase, Program and Verify.

This can take a while.

Your imager should start up right after assembly by hearing the shutter click.

= Hardware Hacking =

===Flash Contents===
On archive, click on show all files to download them.

<nowiki>#</nowiki>1 a Flash dump of the original downgraded D8X3N can be found [https://archive.org/details/dali-d-843n-flash-dump here]

<nowiki>#</nowiki>2 a Flash dump of a original 640x480 model can be found [https://archive.org/details/d-843-n-640x-480 here]

<nowiki>#</nowiki>3 a modified Flash dump of a 640x480 with cleared dead pixel map, flat map etc. can be found [https://archive.org/details/d-843-n-640x-480-cleared-pixelmap here]

a Flash dump of the web server SPI flash W25Q256JV can be found [https://archive.org/details/dm-60-webserver-flash-dump here] in case a bad firmware update caused a bootloop.

 

===Flash Binary Analysis===
The Flash IC is a Winbond 25Q128JV SPI Flash that contains the FPGA Bitstream, Deadpixel and Flatmap, aswell as the Device Settings.

a copy of the SPI Logic Capture at startup can be found [https://archive.org/details/dali-eeprom-capture here], the free software [https://www.dreamsourcelab.com/download/ DSView from DreamSourceLab] is required to view it.
[[File:Dali Thermal Imager SPI Flash capture.png|thumb|SPI Flash access while booting the Thermal Module]]

a approximation of the offsets resulted in this list:<syntaxhighlight lang="vb">
0x000000 - altera cyclone iv stuff
0x200000 - settings
0x280000 - Flat field correction map
0x4C0000 - Bad Pixel correctio nmap
0x580000 - image aswell? 36010 bytes
0x740000 - GUIX?
0x7C0000 - Strings for Gui?
0x800000 - another shorter GUIX
0x880000 - Strings for second gui?
0x8C0000 - GUIX
0x940000 - Strings for gui
0xE00000 - ?
0xE80000 - dzxg? short
0xEC0000 - crosshair.bmp
0xF40000 - 3DTM?
0xF80000 - fake? Bad pixel map BPRP
</syntaxhighlight> 

====Settings offset 0x200000====
The settings are read and written every startup, aswell when you close the OSD, sporadically and when executing the command MSV

these are some of the settings i could figure out by changing and watching the logic capture what changed.
 <syntaxhighlight lang="vb">
offset size Cmd
0x0 1 SAG (0-2) auto gain
0x2 2 SVB (0-16383) saved value is 16383 - SVB
0x4 2 SVC (0-1023) set exposure or gain
0x6 1 SSM image filtering
0x8 1 SEH image enhancement
0xA 1 SWP invert b/w polarity
0x14 1 SMR Flip
0x16 1 SMR Mirror
0x20 1 MENU Cal source 0 IN, 1 OUT
0x3A 1 MENU Enhance value 0-100
0x40 1 MENU Rectify (shutter 0 OFF, 1 L, 2 H)
0x50 1 MENU Language 0 english, 1 chinese, 2 russian
0xA2 - SCO set contrast gain
0xA4 - IBR set brightness
0xAE 2 MENU Fire Threshold
0xAC 1 SPA set color palette
0xE2 1 SMS display "collected 0/80" enabled
0xF8 1 SEM set emissivity
0x110 1 SRT set revise temp
0x116 1 SHD set humidity
0x118 1 SET set ambient temp
0x11A 1 STD set temp range
0x120 2 SLG -500 to 500?
0x124 2 SRD set distance
0x12C 1 SCP ???
0x130 2 SCT ???
</syntaxhighlight> 
[[File:Dali D8X3N Bad Pixel Map Viewer.png|thumb|Bad pixel map of a 640x512 sensor, about 0.56% of dead pixels in this map]]
So i let the AI create a [https://2476424.playcode.io/ Configurator page] that lets you change the Settings in your Flashdump to your liking
 

======Bad Pixel and Flatframe Maps 0x280000 and 0x4C0000======
Thermal cameras require a bad pixel and flat frame map to compensate for manufacturing inconsistencies.

unfourtainly, the maps of the downgraded cameras only contain enough data for a 384 model, not the full 640.

at offset 0xF80000 there is a BPRP which was mistaken at first as the Bad pixel map, it could just be a mask to where to apply the offset maps, as its either 0x0 or 0x1.

The [https://2477569.playcode.io/ Viewer Page] is written in JS and does not require any special dependencies, it can run as a plain html file offline.

There still needs to be work done to create own maps and flatfields but the cameras are still very capable and useable with fully cleared maps.

To clear the maps, just go to these offsets and fill with values around 0x3F or 0x0 for total length of X Resolution x Y Resolution x 2 bytes (0x96000 for 640x480)

[[File:Dali D8X3N Flat Field Map Viewer.png|thumb|Flat Field viewer]]

==Dali Commands==
To control the TIM you can either use Pelco or Dali command set. By default the Dali commandset is used at 38400 BAUD.

Those commands consist of a 0x02 start byte followed by two length Bytes, then the actual command which is allways 3 uppercase Letters in ASCII (eg. KBD for keyboard) followed by a comma and the values.

Some commands take multiple values, some dont. But you allways have to send the comma after the Command.

The camera will answer with the Command and 0, 1 or 2. Sending no value counts as zero.
0 is invalid parameters, too few or out of range

1 is OK, valid command

2 is Invalid command

Commands can be sent trough the Web server using the URL Api endpoint or directly trough the UART port.

(keyboard, C button, causes the shutter to do a calibration)
<camera ip>/cgi-bin/dmcmd?Command=KBD,C
Listening to the answer can be done while being in the Linux shell and typing
cat /dev/ttyAMA2 | strings

By bruteforcing the UART with AAA to ZZZ a list of Commands could be obtained, but some with unknown Parameters or functionality yet. including some from a decompiled DM60comm.so module found in /app/modules folder.<syntaxhighlight lang="vb">
KBD KEY Keyboard (F S M C + -)
SSM 0-1 Image Filtering Off/On
GSM 0 Image filter status
SEH 0-1 Image Enhancement Off/On
GEH 0-1 Image enhancer status
SCO 0-255 Set Gain (locked when SAG auto gain is on)
GCO 0-255 Get gain
INT 15-320 set actual gain? not just contrast sometimes disabled?
IBR 0-255 Set brightness
GBR 0-255 Get brightness
SMR 0-3 Mirror mode bit0=horizontal, bit1=vertical
GMR 0 Get rotation/flip
SDT 0-1 displays temp=44.65°C osd, but webserver sends date/time to the cam there....
GDT 0-1 Get temp display active?
GPT Display temp oft SDT
GNU 0-1 Get Shutter closed/open
SNU 0-1 Shutter close / open
STD 0-1 Set Range 0: -20-180°C 1: 100-600°C
GTD 0-1 Get Range
SET °C Set Ambient temperature
GET °C Get Ambient temperature
SEM 0-100 0-1 set emissivity x100
GEM 0-100 Get Emissivity
SRT °C Set revise temperature -100-100 -10-10°
GRT °C Get revise temperature
SRD 100 Set Distance 4.4m x100
GRD 100 Get Distance
SHD 0-100 Set Humidity
GHD 55 Get Humidity
SWP 0-1 invert s/w polarity image
GWP 1 is inverted?
SPA 0-10? Set color palette
GPA 3 white hot
SMV 0-1 Show temperature 3x3 grid?? in combination with GTV maybe
GMV 0
SMS 0-1 displays "collected 0/<number set by SCT>" by SCP delay "saves the daily number of highest temperatures?"
GMS 0
SCT 1-500 sets the amount of "collected" points for SMS
GCT 80
SCP 5-60 "collected" delay in seconds for SMS
GCP 60
SAG 0-2 Auto brightness / gain
GAG 0
SLR 0-9 ???
GLR 0
SRP 0,0 - 639,479 set crosshair position
GRP 320,240 get crosshair position
DRC 0-1 Show crosshair
SLG -500-500 ??
GLG
SCE text ??
GCE 0
SCB text ??
GCB 0
SVB 0-16383 adc offset, exposure? good at 9650
GVB 6733 value is 16383 minus SVB
SVC 1-1023 set contrast but better
GVC 260
SVF 100-? ?? video freaks out 3400 seems good
SVS 100-? ?? video freaks out 3300 seems good
SOT 0-1 ?? sensor supply, looks weird when off.
SZM 1-4 ?
GZM 1
MSV save settings too eeprom
ASV Saves something aswell?
GCS 0 Get Core status & faults
ALD 0,2? video blanks lots of eeprom activity. reload pixel map??
SAV 0-9999 set Fire threshold
GAV 2100 get Fire Threshold
BAC change uart protocol? careful
CBD Displays Recovery successful?
CBS Displays Saved successfully
LRD Displays Recovery successful?
LRS Displays Saved successfully?
LRE Displays Temperature Repair successful?
CBT Displays Calibration successful?
DBP ??? shutter clicks
DPI Show weird pixels
API Hide weird pixels
CCM ??
ASN 0-4 ??
GAB 4 vals ?? 3,-10,50,150
GAN 1 ??
GAR 11 vals ?? 10,10,5,20,35,50,70,90,120,150,180,,
GCM 6 values ??
GFV prints screen gray value?
GIT 200 ??
GTV Get the collected temp values?
PTS echoes but with extra stuff??
QYA 7170 Query Gray Info (information mode)
QYI 7124 Query Gray Average mode
QYM 7512 Query Gray Minimum mode
VTP 400-4000 ??
MTD U/S,0,0 ?? S answers with bytes, U upload bytes?
MTC U/S? ?? S answers with U,0,0, S doesnt.

return 0 invalid params:
STS ??
STT ??
SAC ??
SAH ??
SAS ??
SAT ??
SCX ?? displays crosshair but invalid params
SCY ?? displays crosshair but invalid params
GAC ??
GAH ??
GAS ??
GAT ??
GME ??
GPC ??
GPI ??
GPM ??
GTA ??
GTC ??
GTI ??
GTM ??
GTS ??
GTT ??

answer only:

BPM 0-1 stream ready? answers with 0 stop, 1 go, 2 when prompted
AVS 0,1
MEH
PWI 0-1 changing palette from wh to fire

unconfirmed (from dm60comm.so):
SDT 2024,03,15,14,30,25 Set Date Time with year,month,day,hour,minute,second
STS 1 Set Temperature Show display (0=off, 1=on)
SVA 2 Set Video Auto mode (0=manual, 2=auto)
SMP 0,1,1,0,100,150,200,250,300,350,90,25 Set Measurement Point (type,index,enable,mode,startX,startY,endX,endY,anchorX,anchorY,threshold,color)
STV Stop Temperature View measurements
SPF 5 Set Profile parameter
SVL -10 Set Video Left pan movement (signed value)
SVU -5 Set Video Up tilt movement (signed value)
SVD 5 Set Video Down tilt movement (signed value)
SSP 17,1,0 Set System Parameter (param_id,value,index) #46 temperature format 0 °C, 1 °F, 2 K
SCP Set Current Preset (save current position)
GCP Get Current Preset
STT 300,350 Set Temperature Threshold (low,high values *10)
SDC 1 Set Display Configuration parameter
GCS Get Current Status
GMM Get Memory Map information
GFV Get Frame Value (grayscale data)
GFZ Get Freeze Status
GSI 1 Get System Information (parameter=1)
GSS Get System Status
GSP 21,0 Get System Parameter (param_21=surround temp, value=0)
GTT Get Temperature Threshold range
GTV 1,3,10 Get Temperature Values (enable,type,count)
GNU Get Network Update status (response command)
FRZ Freeze current display frame
LIV Live mode (unfreeze display)
CAL Calibrate system
CCP 3 Call Current Preset (preset number 0-9)
APF 100 Auto Profile setting
MEH Measure Enhancement
BPT Built-in Test
MTC S,0 Measure Temperature Capture (S=start, 0=sequence)
MTG U,0,1024,<data> Measure Temperature Gray data transfer
MTD U,0,1024,<data> Measure Temperature Data transfer
UFP S,0,2048 Update Firmware Prepare (S=start, 0=offset, 2048=size)
UFD S,0,1024 Update Firmware Data transfer
BAB U Buffer operation (U=update)
TTH S,0 Temperature Threshold operation
IPP 192.168.001.102,255.255.255.000,192.168.001.001,192.168.000.001,9989,9998 IP Parameters (IP,netmask,gateway,DNS,port1,port2)
MAC 00:60:A9:10:00:01 MAC Address setting
SNP Set Network Parameters (response command)
QYI Query Gray Info (information mode)
QYA Query Gray Average mode
QYM Query Gray Minimum mode
GAI Get Alarm Info (response command)
YTC <data> Unknown command with data parameter
HTH
LRS
LRD
GAR
DRC
PTS
SCX
SCY
CBT
LRE
CBD
CBS
XXX
GSP
GTT
QYI
QYA
QYM

</syntaxhighlight>

==Secret Menu Overview==
The secret menus Main and System can be openend with the password '''+-MC+-'''

Its structured like this, not all variables have been figured out yet.

The format is Menu: submenu: submenu:

and for menu entries: Name, default value, command, description or messages that pop up.
 <syntaxhighlight lang="vb">
MAIN & SYSTEM PASS: +-MC+-

entries are NAME VALUE COMMAND DESC or if its a folder its just ":"

System:
System:
Gain 255 SCO
Bright 102 IBR
BenDi 100 ?
BenDiContrase 80 ?
DisMode 0 ?
Frequency 48hz (24,25,48,50)
DigitalOut 8-14bit 14bit, BT656(_P), ?, BT601
AutoFocus N ?
Line 1 ?
Ltemp0 11800 ?
LTemp1 11000 ?
HTemp0 9500 ?
HTemp1 8700 ?
DelayTime 0 ?
Enhance 0-1 ?
Enhanced E1 230 ?
FPA_Gain 12pF ? between 4 and 18 at random.
NUCEn N ?

Area:
SE 2 ASN 0-4 "Partition"
INT 200 INT "Points time"
VS 3161 SVS
VF 2800 SVF
Vtemp 1401 VTP
VtempArea Low ?
VtempBase 13500 ?
VtempStep -1 ?
VsStep 8 ?
DeadPixelModel preset / calculate
DP: Cursor to select dead pixels
X 360 position
Y 288 position
AutoBP: 50 Press C to start automatic dotting
Quit? Number of bad pixels 961& "Blind element replacement in progress"
Undo
R2: Save data? blind pixel replacement in progress
Replace Y N = DPI, Y = API
L: Reading parameters
S: Saving parameters

Debug:
Rectify N
DisplayGary N
TE N SDT
AutoE ? ?
AutoVS Y ?
VSGrayH 8000 ?
VSGrayL 7000 ?
Trends 1 ?
Shelter N ?
MotorCon 3 ?
SaveFactoryPara:
LanTyp EN ? LANGUAGE
DisplayMT N ?
Version:
PRJ D843 DLD640 ImLib, MTlib, Soft, Logic

BackDispose:
GammaEN 1 ?
Gain 1 ?
EnhanceEN 0 ?
Hpf_shift 5 ?
Hpf_thrd 5 ?
Enhance 150 ?
Lthrd 50 ?

Monitor:
Opens normal OSD

Alarm Set:
Alarm Switch Y ?
Alarm Mode No ?
Alarm Temperature -1°C ?
Reference Gray Y ?
Alarm Level 1L ?
Alarm Gray 65535 ?
Alarm PointNum 0 ?
Correct Gray 0 ?

Thermometry:
Data Collection 0 SMS
Interval 60 SCP
Ammount 90 SCT
Environment normal ?
Export:
Displays: Exportin normal temperature MTC data
Correction -1 ?
Emissivity 100 SEM
Calibration:
BlackbodyTemp -10 grabs a val from GAB
Save CBS
Cancel CBD
Correction:
BlackbodyTemp -10 Picks from the list GAR
Grayscale 0 SLG
Confirm LRE
Save LRS
Cancel LRD
Ninepoint measurement SMV

Cursor:
Cur N DRC enable cursor
X 320 SRP set cursor position
Y 240 SRP set cursor position

Main:
Auto 2 SAG Auto gain
G 211 SVC
B 10002 SVB
P 1 SWP polarity
Z X ?
Settings:
Image:
FI Y ?
FIValue 0 ? 0-31
Freeze N Freeze image
VE N SMR Vertical flip
HO N SMR Horizontal flip
AutoCali L same as rectify?
O IN internal or external
COM:
Opens UART menu
AvoidburnSwitch OFF enable anti burn in
ProtectedTime 10S duration
AvoidBurn 16383 threshold to trigger antiburn

</syntaxhighlight>

===Automatic Dead Pixels and Flatmap Correction===

It it possible to generate a new flat and dead pixel map automatically within the camera after flashing the cleared-map binary.
 

=====Dead pixels:=====
In the secret menu "System", navigate to Debug - DeadPixelModel and set the AutoBP (sensitivity for auto bad pixel finding) to 50 or so. Then press C Button

This can take a while.
[[File:High emissivity peltier black body.jpg|thumb|A Peltier / TEC coated in Candle sood to give it a high emissivity surface. It can be cooled or heated by swapping the polarity. ]]

Afterwards, navigate to S: and press + to save it.
 

=====Flatfield:=====
In the Debug menu navigate to R2 and press +

now place something '''Cold''' infront of the Camera with a high emissivity. (it needs to fill the whole image)

Press '''+''', wait for it to says High temperature.

Place something '''Hot''' infront and press '''+''' again.

Afterwards, save with '''S:''' again.

Flatfield should now be calibrated
 <blockquote>Note: Not all dead pixels are auto detected or get removed. you can manually select them in the Dead pixel editor but its not known yet how to select and correct them.</blockquote>

 

=Using the Thermal module without Webserver=
[[File:Dali D8X3C Breakout board.png|thumb|Breakout board for D8X3C ]]
to use it, you need to interface it directly.

The module will put out a Analog video signal (High-Z, need to buffer when connecting it to 75Ohm Video input)

Also a 8 or 14bit or 8-bit BT656 output.

the header exposes the FPGA JTAG and UART aswell as 6 Hardware Keys to Navigate the OSD.

To interface, you need to make a adapter board with a DF12-50DS-0.5V(86) Docking socket.

The breakout board files can be found [https://oshwlab.com/gamerpaddy/d8x3c-backpack-usb here] but may be still work in progress.

 

=Sensor Pinout=
[[File:Dali DLD384 Sensor pinout basic.png|thumb|basic pinout of a DLD384]]
the pinout of the thermal sensor havent been analyzes much.

besides some supply and Control voltages, 3 clocks and a analog output have been found.

17.5MHz

14.705KHz

50Hz

Dali D8X3N Thermal Camera

2025-08-04T01:27:49Z

Gamerpaddy: Added web raw viewer

==Dali D8X3N Thermal Camera Reverse Engineering==
 

===Introduction===
The [https://www.dali-irtech.com/productinfo/741567.html Dali D8X3N] Thermal Camera module comes in two versions, a 384x288 and 640x480 resolution, utilizing the [http://www.dali-tech.us/products/dld64017m-uncooled-infrared-fpa-detector-86.html DLD Series] of amorphous-Silicon Microbolometers.

They were mainly used in [http://www.dali-tech.us/products/dm60-w--online-body-temperature-thermal-imaging-camera-55.html Dali DM60-W] or WS-1 Body Temperature screening cameras in conjunction with a Black Body radiator set to 37°C to detect infected individuals at the start of the 2020 Covid Pandemic.
[[File:ICI FM320P Innerts.jpg|thumb|Internals. A TP-Link Switch, HikVision Visible Camera and the D8x3N Network thermal camera module]]
[https://infraredcameras.com/ ICI] rebranded these models as FM 320 P and FM 640 P, and distributed them on the local US market, but as the need for such Cameras exploded, those models were built with what was in stock.

So happens, that some of the FM 320 P Models had a DLD640 640x480 instead of a DLD384 384x288 Microbolometer in them, and just got their Firmware modified.

It also could be, because they have excessive amounts of bad pixels outside the 384x288 area, that they were binned to a lower grade.

Discussions about these Cameras started around 2022 in the [https://www.eevblog.com/forum/thermal-imaging/ici-and-dali-thermal-camera-software/ EEVBlog Forums.] when they started to appear secondhand and affordable.

Originally they were priced around US$ 20... 30.000 by ICI, and a unknown amount by Dali Tech.

The Modules specs according to the manufacturer are:

≤50..60mK@F1，300K，50Hz

17 or 25µm pixel pitch

Hisilicon SoC running Linux to provide Onvif and RTSP streams, analysis and a Web UI

 
[[File:Dali D8X3N Module.jpg|thumb|A real 384x288 model with a DLD384 sensor. notice the Productnumber ]]
ICI FM Cameras are found all over Online secondhand marketplaces for scrap Prices, as they are no longer needed.

But you never know, what are you getting. It could be a real DLD384 or the better DLD640 inside. Its a gamble.
 

======640x480 Imagers======
are labeled 22D843 Nxxxx and have a DLD640 sensor in it, they can be upgraded if they run the 384x288 firmware.

======384x288 Imagers======
are labeled 22D883Nxxxx and have a DLD384 sensor in it, they cannot be upgraded

 

==D8X3N Module closer look==
From now on, i will refer to the Thermal Imaging Module as TIM

On the front there is a 2 Element Germanium Lens of a unknown focal length and aperture.

It can be focus-adjusted when unscrewing the clamp around the housing. It can be focussed from infinity down to 10..20cm with some quality loss.
 The outter diameter of the Lens is 42mm with a 1 1/3 inch thread diameter of undetermined pitch.

Dimensions of the germanium elements are 21mm to 3 and 6mm and 14grams in weight.
[[File:Disassembled Thermal Camera Lens.jpg|thumb|Two element Germanium Lens of unknown focal length and aperture]]

The TIM is composed of 6 Stacked PCB modules, 3 of which are for the Web Server functionality. taking them off will give you the basic configuration of a [https://www.dalithermal.com/productinfo/741568.html Dali D8X3C] TIM<gallery>
File:Dali DLD640 Thermal Image Sensor.jpeg|DLD640 Sensor
File:Dali DLD384 Thermal Imaging Sensor.jpeg|DLD384 Sensor
File:Dali D8X3N Board1 Back.jpeg|Network & GPIO Board Back
File:Dali D8X3N Board1 Front.jpeg|Network & GPIO Board Front
File:Dali D8X3N Glue Board Back.jpeg|Board between Logic and IO Back
File:Dali D8X3N Glue Board Front.jpeg|Board between Logic and IO Front
File:Dali D8X3N SoC Board Back.jpeg|SoC Board back
File:Dali D8X3N SoC Board front.jpeg|SoC board front
File:Dali D8X3N FPGA Board Back.jpeg|FPGA Board of the D8X3C Thermal Imager including a PMIC
File:Dali D8X3N FPGA Board Front.jpeg|FPGA Board Front with Video DAC and SPI Flash
File:Dali D8X3N Sensor Power and ADC Board.jpeg|Sensor control and ADC board
File:Dali D8X3N Thermal Core Debug wiring.jpeg|Debug wiring for sniffing SPI and UART
</gallery>

===User Manual===
including pinout diagram and important data

can be found here https://archive.org/details/dali-d-8-x-3-cuser-manualen-v-1.0-1

=Viewing the Video Stream=
[[File:Onvif Device Manager ODM.png|thumb|ODM streaming the Thermal view]]
when first connecting it to power and Ethernet, the camera will have 192.168.1.102 as a Static ip.

If you are running a 192.168.0.x or .178.x net, you need to change it or add a subnet under windows ipv4 settings.

to view it, you can use VLC and the stream URL
rtsp://admin@admin:<camera ip>/ONVIFMedia
there is /ONVIFMedia /ONVIFMediaM and /ONVIFMediaS for different stream Profiles.

VLC is quite slow and delayed, rather use Onvif Device Manager ODM,

it has no delay and auto-detects cameras in the network.

Be sure to log in as user: admin pass: admin in ODM.

in there, you can also set you camera to DHCP under Network settings.

===Web Interface===
[[File:Dali D8X3N web interface.png|thumb|Since browsers cant display RTSP anymore, open in Edge and select IE Compatibility Mode.]]
the web interface can be accessed by opening the camera IP in a browser

login is:
user: admin pass: admin
You can set Temperature markers and areas, but without using the Black Body calibration source, your readings may be way off or not working.

 

====OSD====
there is a debug-login with
user: super pass: 871897
that lets you send Key commands to the Imager to navigate the OSD.

Setting the OSD to english is accomplished with option #11
[[File:Dali D8X3C OSD.png|thumb|OSD in english, if yours is Chinese. go to option #11 and click + or -]]

To acces some locked menus, press
+ - + - + -

The password for the locked System and Main menu is
+-MC+-

Be careful in the UART menu to not change the BAUD rate or Protocol, as your ability to control it via the Web API gets lost.

You need to reflash or solder buttons on the thermal core then.

==Viewing Raw Thermal Data from the Web API==
there is a hidden endpoint in the stream.so file that could be found while decompiling

accessing
[[File:Arduino Nano blink sketch thermal gif.gif|thumb|Arduino Nano running blink sketch while thermally recording it, notice the led and resistor on the right]]
<ip of camera>:5000/stream?Type=JPEG&Source=Jpeg&Mode=TCP
lets you download a JPEG. but there are more options available (not all have been tested)

we are mainly interessted in Raw thermal data.

====Source (Stream Type)====

*<code>Major</code> - Main video stream (channel 0)
*<code>Minor</code> - Sub video stream (channel 1)
*<code>MinorAV</code> - Sub video + audio stream
*<code>MajorAV</code> - Main video + audio stream
*<code>Jpeg</code> - JPEG snapshot stream
*<code>Raw</code> - Raw thermal data stream
*<code>YUV</code> - YUV raw video stream

====Type (Data Format)====

*<code>H264</code> - H.264 video encoding
*<code>JPEG</code> - JPEG image format
*<code>RAW</code> - Raw sensor data
*<code>QBOX</code> - Custom protocol format
*<code>FRAME</code> - Frame-based format

====Mode (Transport Protocol)====

*<code>TCP</code> - TCP streaming (default)
*<code>UDP</code> - UDP streaming
*<code>MUL</code> - Multicast streaming

====Quality Parameters====

*<code>Quality=[1-100]</code> - Video quality level
*<code>Frames=[number]</code> - Number of frames to send
*<code>Interval=[ms]</code> - Frame interval in milliseconds

====Network Parameters====

*<code>IPAddr=[ip]</code> - Client IP address for UDP/multicast
*<code>Port=[port]</code> - Client port for UDP/multicast
*<code>Heart-beat=[Yes/No]</code> - Enable/disable heartbeat

====Snapshot Parameters====

*<code>Snap=[Yes/No]</code> - Enable snapshot mode

==== Raw Viewer for PC (Python) ====
[[File:Dali D8X3N Raw Thermal viewer.png|thumb|Raw Data Viewer in python]]

To view the raw stream, i made a python program that converts the 14bit thermal data to a visible image.

it is low fps tho, due to bad optimizations.

rev1 first working version https://pastebin.com/dyNWDPT3

rev2 with temperature readout https://pastebin.com/u107Q85w

rev3 and onward will only be available directly as a Webpage on the Device (see below).

==== Raw Viewer for the internal Webserver (recommended) ====
It is also possible to use the Raw viewer directly in the browser.

To achieve this, the stream had to be proxied from port 5000 to 80 due to CORS.

luckily the internal lighttpd had the CGI module enabled, so piping it troug (using wget ... i know) worked with very low overhead.

To install, you need '''Terminal access''' to the Camera. see below.

optional for simplicity: '''ftp''' access

Then download the '''rawviewer.zip''' from [https://archive.org/details/rawviewer_202508 here] (rev3 with histogram, javascript)
[[File:Dali D8X3N Webviewer.png|thumb|Web Raw Viewer with histogram (rev3)]]

unpack the web folder into '''/app''' and '''restart''' your camera.

It should be accessible now trough '''http://<camera ip>/raw.html''' in the browser and click '''Start Stream'''
 <blockquote>performance may need improvement.</blockquote>

==Getting Root Terminal Access==
To access the Terminal you need to solder or plug in a UART connection to Connector J7 on the "Glue" board.

Pinout is (left to right) '''RX TX GND 3.3V Baud 115200 3.3V!'''

But the system will spam with debug messages, making patching the files a hard job unless you use "tftp" or "sed" commands.
 

====Enabling Telnet access to make patching easier====
[[File:Upgrade ici dali firmware updater.png|thumb|ICI Firmware updater software with modified firmware loaded]]

there is a easier way using a modified Firmware updater to enable Telnet temporarily to patch the Files.

Download the '''upgrade_ici.exe''' form [https://archive.org/details/fwupdate here] and run it.

Then you should be able to connect to it via Telnet.

The Login credentials are '''User: roo'''t '''Password: DLroot'''

 

=== Patching Device ===

===Patching the Web Server===
 

==== Enabling Telnet and ftpd permanently ====

This only works if you also patch the Thermal Camera module flash!

====to permanently enable Telnet, go to '''/etc/init.d''' and edit '''S90app'''====
vi S90app
in vi, move your cursor to the '''#''' at '''#telnetd''' and press x<blockquote>optional: enable ftp by removing the '''#''' at '''ftpd''' and adjust the path to / </blockquote>now press ''':''' and type '''wq''' and hit '''enter'''. this should be it.

====Patching the decoder and streamer to 640x480:====
go to /app and edit the mach.cfg

replace DL384 with D640 and edit the resolution to 640 480

(press i in vi to enter edit mode, press ESC to exit edit mode. :wq to write and quit.)

repeat that procedure for the dali.cfg

=====(optional) patching app.sh to prevent it from rebooting=====
edit the app.sh in /app and remove all "reboot" occasions to prevent the camera from rebooting if onvifserver, httpd or daliServer arent running for debugging purposes.

 

====Patching the Thermal Camera module====
To patch it, you need to disassemble everything down to the FPGA Board,

on the bottom there is a SPI SOIC8 Flash.

Use a CH341 EEPROM programmer (be sure to have a fixed or modified version to not put out 5V!, set it to 3.3V) and SOIC8 clamp.

Use NeoProgrammer (i used 2.2.0.10 but there are newer available, use the latest) and click Detect. It should find W25Q128 chips, select the FV one.

Dont forget to download a backup of your flash and save it !

Download the Binary "Dali 640x480 '''actual''' cleared pixelmap.bin" from #3 below and load it into NeoProgrammer,

Click Erase, Program and Verify.

This can take a while.

Your imager should start up right after assembly by hearing the shutter click.

 

===Flash Contents===
On archive, click on show all files to download them.

<nowiki>#</nowiki>1 a Flash dump of the original downgraded D8X3N can be found [https://archive.org/details/dali-d-843n-flash-dump here]

<nowiki>#</nowiki>2 a Flash dump of a original 640x480 model can be found [https://archive.org/details/d-843-n-640x-480 here]

<nowiki>#</nowiki>3 a modified Flash dump of a 640x480 with cleared dead pixel map, flat map etc. can be found [https://archive.org/details/d-843-n-640x-480-cleared-pixelmap here]

a Flash dump of the web server SPI flash W25Q256JV can be found [https://archive.org/details/dm-60-webserver-flash-dump here] in case a bad firmware update caused a bootloop.

 

===Flash Binary Analysis===
The Flash IC is a Winbond 25Q128JV SPI Flash that contains the FPGA Bitstream, Deadpixel and Flatmap, aswell as the Device Settings.

a copy of the SPI Logic Capture at startup can be found [https://archive.org/details/dali-eeprom-capture here], the free software [https://www.dreamsourcelab.com/download/ DSView from DreamSourceLab] is required to view it.
[[File:Dali Thermal Imager SPI Flash capture.png|thumb|SPI Flash access while booting the Thermal Module]]

a approximation of the offsets resulted in this list:<syntaxhighlight lang="vb">
0x000000 - altera cyclone iv stuff
0x200000 - settings
0x280000 - Flat field correction map
0x4C0000 - Bad Pixel correctio nmap
0x580000 - image aswell? 36010 bytes
0x740000 - GUIX?
0x7C0000 - Strings for Gui?
0x800000 - another shorter GUIX
0x880000 - Strings for second gui?
0x8C0000 - GUIX
0x940000 - Strings for gui
0xE00000 - ?
0xE80000 - dzxg? short
0xEC0000 - crosshair.bmp
0xF40000 - 3DTM?
0xF80000 - fake? Bad pixel map BPRP
</syntaxhighlight> 

====Settings offset 0x200000====
The settings are read and written every startup, aswell when you close the OSD, sporadically and when executing the command MSV

these are some of the settings i could figure out by changing and watching the logic capture what changed.
 <syntaxhighlight lang="vb">
offset size Cmd
0x0 1 SAG (0-2) auto gain
0x2 2 SVB (0-16383) saved value is 16383 - SVB
0x4 2 SVC (0-1023) set exposure or gain
0x6 1 SSM image filtering
0x8 1 SEH image enhancement
0xA 1 SWP invert b/w polarity
0x14 1 SMR Flip
0x16 1 SMR Mirror
0x20 1 MENU Cal source 0 IN, 1 OUT
0x3A 1 MENU Enhance value 0-100
0x40 1 MENU Rectify (shutter 0 OFF, 1 L, 2 H)
0x50 1 MENU Language 0 english, 1 chinese, 2 russian
0xA2 - SCO set contrast gain
0xA4 - IBR set brightness
0xAE 2 MENU Fire Threshold
0xAC 1 SPA set color palette
0xE2 1 SMS display "collected 0/80" enabled
0xF8 1 SEM set emissivity
0x110 1 SRT set revise temp
0x116 1 SHD set humidity
0x118 1 SET set ambient temp
0x11A 1 STD set temp range
0x120 2 SLG -500 to 500?
0x124 2 SRD set distance
0x12C 1 SCP ???
0x130 2 SCT ???
</syntaxhighlight> 
[[File:Dali D8X3N Bad Pixel Map Viewer.png|thumb|Bad pixel map of a 640x512 sensor, about 0.56% of dead pixels in this map]]
So i let the AI create a [https://2476424.playcode.io/ Configurator page] that lets you change the Settings in your Flashdump to your liking
 

======Bad Pixel and Flatframe Maps 0x280000 and 0x4C0000======
Thermal cameras require a bad pixel and flat frame map to compensate for manufacturing inconsistencies.

unfourtainly, the maps of the downgraded cameras only contain enough data for a 384 model, not the full 640.

at offset 0xF80000 there is a BPRP which was mistaken at first as the Bad pixel map, it could just be a mask to where to apply the offset maps, as its either 0x0 or 0x1.

The [https://2477569.playcode.io/ Viewer Page] is written in JS and does not require any special dependencies, it can run as a plain html file offline.

There still needs to be work done to create own maps and flatfields but the cameras are still very capable and useable with fully cleared maps.

To clear the maps, just go to these offsets and fill with values around 0x3F or 0x0 for total length of X Resolution x Y Resolution x 2 bytes (0x96000 for 640x480)

[[File:Dali D8X3N Flat Field Map Viewer.png|thumb|Flat Field viewer]]

===Dali Commands===
To control the TIM you can either use Pelco or Dali command set. By default the Dali commandset is used at 38400 BAUD.

Those commands consist of a 0x02 start byte followed by two length Bytes, then the actual command which is allways 3 uppercase Letters in ASCII (eg. KBD for keyboard) followed by a comma and the values.

Some commands take multiple values, some dont. But you allways have to send the comma after the Command.

The camera will answer with the Command and 0, 1 or 2. Sending no value counts as zero.
0 is invalid parameters, too few or out of range

1 is OK, valid command

2 is Invalid command

Commands can be sent trough the Web server using the URL Api endpoint or directly trough the UART port.

(keyboard, C button, causes the shutter to do a calibration)
<camera ip>/cgi-bin/dmcmd?Command=KBD,C
Listening to the answer can be done while being in the Linux shell and typing
cat /dev/ttyAMA2 | strings

By bruteforcing the UART with AAA to ZZZ a list of Commands could be obtained, but some with unknown Parameters or functionality yet. including some from a decompiled DM60comm.so module found in /app/modules folder.<syntaxhighlight lang="vb">
KBD KEY Keyboard (F S M C + -)
SSM 0-1 Image Filtering Off/On
GSM 0 Image filter status
SEH 0-1 Image Enhancement Off/On
GEH 0-1 Image enhancer status
SCO 0-255 Set Gain (locked when SAG auto gain is on)
GCO 0-255 Get gain
INT 15-320 set actual gain? not just contrast sometimes disabled?
IBR 0-255 Set brightness
GBR 0-255 Get brightness
SMR 0-3 Mirror mode bit0=horizontal, bit1=vertical
GMR 0 Get rotation/flip
SDT 0-1 displays temp=44.65°C osd, but webserver sends date/time to the cam there....
GDT 0-1 Get temp display active?
GPT Display temp oft SDT
GNU 0-1 Get Shutter closed/open
SNU 0-1 Shutter close / open
STD 0-1 Set Range 0: -20-180°C 1: 100-600°C
GTD 0-1 Get Range
SET °C Set Ambient temperature
GET °C Get Ambient temperature
SEM 0-100 0-1 set emissivity x100
GEM 0-100 Get Emissivity
SRT °C Set revise temperature -100-100 -10-10°
GRT °C Get revise temperature
SRD 100 Set Distance 4.4m x100
GRD 100 Get Distance
SHD 0-100 Set Humidity
GHD 55 Get Humidity
SWP 0-1 invert s/w polarity image
GWP 1 is inverted?
SPA 0-10? Set color palette
GPA 3 white hot
SMV 0-1 Show temperature 3x3 grid?? in combination with GTV maybe
GMV 0
SMS 0-1 displays "collected 0/<number set by SCT>" by SCP delay "saves the daily number of highest temperatures?"
GMS 0
SCT 1-500 sets the amount of "collected" points for SMS
GCT 80
SCP 5-60 "collected" delay in seconds for SMS
GCP 60
SAG 0-2 Auto brightness / gain
GAG 0
SLR 0-9 ???
GLR 0
SRP 0,0 - 639,479 set crosshair position
GRP 320,240 get crosshair position
DRC 0-1 Show crosshair
SLG -500-500 ??
GLG
SCE text ??
GCE 0
SCB text ??
GCB 0
SVB 0-16383 adc offset, exposure? good at 9650
GVB 6733 value is 16383 minus SVB
SVC 1-1023 set contrast but better
GVC 260
SVF 100-? ?? video freaks out 3400 seems good
SVS 100-? ?? video freaks out 3300 seems good
SOT 0-1 ?? sensor supply, looks weird when off.
SZM 1-4 ?
GZM 1
MSV save settings too eeprom
ASV Saves something aswell?
GCS 0 Get Core status & faults
ALD 0,2? video blanks lots of eeprom activity. reload pixel map??
SAV 0-9999 set Fire threshold
GAV 2100 get Fire Threshold
BAC change uart protocol? careful
CBD Displays Recovery successful?
CBS Displays Saved successfully
LRD Displays Recovery successful?
LRS Displays Saved successfully?
LRE Displays Temperature Repair successful?
CBT Displays Calibration successful?
DBP ??? shutter clicks
DPI Show weird pixels
API Hide weird pixels
CCM ??
ASN 0-4 ??
GAB 4 vals ?? 3,-10,50,150
GAN 1 ??
GAR 11 vals ?? 10,10,5,20,35,50,70,90,120,150,180,,
GCM 6 values ??
GFV prints screen gray value?
GIT 200 ??
GTV Get the collected temp values?
PTS echoes but with extra stuff??
QYA 7170 Query Gray Info (information mode)
QYI 7124 Query Gray Average mode
QYM 7512 Query Gray Minimum mode
VTP 400-4000 ??
MTD U/S,0,0 ?? S answers with bytes, U upload bytes?
MTC U/S? ?? S answers with U,0,0, S doesnt.

return 0 invalid params:
STS ??
STT ??
SAC ??
SAH ??
SAS ??
SAT ??
SCX ?? displays crosshair but invalid params
SCY ?? displays crosshair but invalid params
GAC ??
GAH ??
GAS ??
GAT ??
GME ??
GPC ??
GPI ??
GPM ??
GTA ??
GTC ??
GTI ??
GTM ??
GTS ??
GTT ??

answer only:

BPM 0-1 stream ready? answers with 0 stop, 1 go, 2 when prompted
AVS 0,1
MEH
PWI 0-1 changing palette from wh to fire

unconfirmed (from dm60comm.so):
SDT 2024,03,15,14,30,25 Set Date Time with year,month,day,hour,minute,second
STS 1 Set Temperature Show display (0=off, 1=on)
SVA 2 Set Video Auto mode (0=manual, 2=auto)
SMP 0,1,1,0,100,150,200,250,300,350,90,25 Set Measurement Point (type,index,enable,mode,startX,startY,endX,endY,anchorX,anchorY,threshold,color)
STV Stop Temperature View measurements
SPF 5 Set Profile parameter
SVL -10 Set Video Left pan movement (signed value)
SVU -5 Set Video Up tilt movement (signed value)
SVD 5 Set Video Down tilt movement (signed value)
SSP 17,1,0 Set System Parameter (param_id,value,index) #46 temperature format 0 °C, 1 °F, 2 K
SCP Set Current Preset (save current position)
GCP Get Current Preset
STT 300,350 Set Temperature Threshold (low,high values *10)
SDC 1 Set Display Configuration parameter
GCS Get Current Status
GMM Get Memory Map information
GFV Get Frame Value (grayscale data)
GFZ Get Freeze Status
GSI 1 Get System Information (parameter=1)
GSS Get System Status
GSP 21,0 Get System Parameter (param_21=surround temp, value=0)
GTT Get Temperature Threshold range
GTV 1,3,10 Get Temperature Values (enable,type,count)
GNU Get Network Update status (response command)
FRZ Freeze current display frame
LIV Live mode (unfreeze display)
CAL Calibrate system
CCP 3 Call Current Preset (preset number 0-9)
APF 100 Auto Profile setting
MEH Measure Enhancement
BPT Built-in Test
MTC S,0 Measure Temperature Capture (S=start, 0=sequence)
MTG U,0,1024,<data> Measure Temperature Gray data transfer
MTD U,0,1024,<data> Measure Temperature Data transfer
UFP S,0,2048 Update Firmware Prepare (S=start, 0=offset, 2048=size)
UFD S,0,1024 Update Firmware Data transfer
BAB U Buffer operation (U=update)
TTH S,0 Temperature Threshold operation
IPP 192.168.001.102,255.255.255.000,192.168.001.001,192.168.000.001,9989,9998 IP Parameters (IP,netmask,gateway,DNS,port1,port2)
MAC 00:60:A9:10:00:01 MAC Address setting
SNP Set Network Parameters (response command)
QYI Query Gray Info (information mode)
QYA Query Gray Average mode
QYM Query Gray Minimum mode
GAI Get Alarm Info (response command)
YTC <data> Unknown command with data parameter
HTH
LRS
LRD
GAR
DRC
PTS
SCX
SCY
CBT
LRE
CBD
CBS
XXX
GSP
GTT
QYI
QYA
QYM

</syntaxhighlight>

===Secret Menu Overview===
The secret menus Main and System can be openend with the password '''+-MC+-'''

Its structured like this, not all variables have been figured out yet.

The format is Menu: submenu: submenu:

and for menu entries: Name, default value, command, description or messages that pop up.
 <syntaxhighlight lang="vb">
MAIN & SYSTEM PASS: +-MC+-

entries are NAME VALUE COMMAND DESC or if its a folder its just ":"

System:
System:
Gain 255 SCO
Bright 102 IBR
BenDi 100 ?
BenDiContrase 80 ?
DisMode 0 ?
Frequency 48hz (24,25,48,50)
DigitalOut 8-14bit 14bit, BT656(_P), ?, BT601
AutoFocus N ?
Line 1 ?
Ltemp0 11800 ?
LTemp1 11000 ?
HTemp0 9500 ?
HTemp1 8700 ?
DelayTime 0 ?
Enhance 0-1 ?
Enhanced E1 230 ?
FPA_Gain 12pF ? between 4 and 18 at random.
NUCEn N ?

Area:
SE 2 ASN 0-4 "Partition"
INT 200 INT "Points time"
VS 3161 SVS
VF 2800 SVF
Vtemp 1401 VTP
VtempArea Low ?
VtempBase 13500 ?
VtempStep -1 ?
VsStep 8 ?
DeadPixelModel preset / calculate
DP: Cursor to select dead pixels
X 360 position
Y 288 position
AutoBP: 50 Press C to start automatic dotting
Quit? Number of bad pixels 961& "Blind element replacement in progress"
Undo
R2: Save data? blind pixel replacement in progress
Replace Y N = DPI, Y = API
L: Reading parameters
S: Saving parameters

Debug:
Rectify N
DisplayGary N
TE N SDT
AutoE ? ?
AutoVS Y ?
VSGrayH 8000 ?
VSGrayL 7000 ?
Trends 1 ?
Shelter N ?
MotorCon 3 ?
SaveFactoryPara:
LanTyp EN ? LANGUAGE
DisplayMT N ?
Version:
PRJ D843 DLD640 ImLib, MTlib, Soft, Logic

BackDispose:
GammaEN 1 ?
Gain 1 ?
EnhanceEN 0 ?
Hpf_shift 5 ?
Hpf_thrd 5 ?
Enhance 150 ?
Lthrd 50 ?

Monitor:
Opens normal OSD

Alarm Set:
Alarm Switch Y ?
Alarm Mode No ?
Alarm Temperature -1°C ?
Reference Gray Y ?
Alarm Level 1L ?
Alarm Gray 65535 ?
Alarm PointNum 0 ?
Correct Gray 0 ?

Thermometry:
Data Collection 0 SMS
Interval 60 SCP
Ammount 90 SCT
Environment normal ?
Export:
Displays: Exportin normal temperature MTC data
Correction -1 ?
Emissivity 100 SEM
Calibration:
BlackbodyTemp -10 grabs a val from GAB
Save CBS
Cancel CBD
Correction:
BlackbodyTemp -10 Picks from the list GAR
Grayscale 0 SLG
Confirm LRE
Save LRS
Cancel LRD
Ninepoint measurement SMV

Cursor:
Cur N DRC enable cursor
X 320 SRP set cursor position
Y 240 SRP set cursor position

Main:
Auto 2 SAG Auto gain
G 211 SVC
B 10002 SVB
P 1 SWP polarity
Z X ?
Settings:
Image:
FI Y ?
FIValue 0 ? 0-31
Freeze N Freeze image
VE N SMR Vertical flip
HO N SMR Horizontal flip
AutoCali L same as rectify?
O IN internal or external
COM:
Opens UART menu
AvoidburnSwitch OFF enable anti burn in
ProtectedTime 10S duration
AvoidBurn 16383 threshold to trigger antiburn

</syntaxhighlight>

===Automatic Dead Pixels and Flatmap Correction===

It it possible to generate a new flat and dead pixel map automatically within the camera after flashing the cleared-map binary.
 

=====Dead pixels:=====
In the secret menu "System", navigate to Debug - DeadPixelModel and set the AutoBP (sensitivity for auto bad pixel finding) to 50 or so. Then press C Button

This can take a while.
[[File:High emissivity peltier black body.jpg|thumb|A Peltier / TEC coated in Candle sood to give it a high emissivity surface. It can be cooled or heated by swapping the polarity. ]]

Afterwards, navigate to S: and press + to save it.
 

=====Flatfield:=====
In the Debug menu navigate to R2 and press +

now place something '''Cold''' infront of the Camera with a high emissivity. (it needs to fill the whole image)

Press '''+''', wait for it to says High temperature.

Place something '''Hot''' infront and press '''+''' again.

Afterwards, save with '''S:''' again.

Flatfield should now be calibrated
 <blockquote>Note: Not all dead pixels are auto detected or get removed. you can manually select them in the Dead pixel editor but its not known yet how to select and correct them.</blockquote>

 

===Using the Thermal module without Webserver===
[[File:Dali D8X3C Breakout board.png|thumb|Breakout board for D8X3C ]]
to use it, you need to interface it directly.

The module will put out a Analog video signal (High-Z, need to buffer when connecting it to 75Ohm Video input)

Also a 8 or 14bit or 8-bit BT656 output.

the header exposes the FPGA JTAG and UART aswell as 6 Hardware Keys to Navigate the OSD.

To interface, you need to make a adapter board with a DF12-50DS-0.5V(86) Docking socket.

The breakout board files can be found [https://oshwlab.com/gamerpaddy/d8x3c-backpack-usb here] but may be still work in progress.

 

===Sensor Pinout===
[[File:Dali DLD384 Sensor pinout basic.png|thumb|basic pinout of a DLD384]]
the pinout of the thermal sensor havent been analyzes much.

besides some supply and Control voltages, 3 clocks and a analog output have been found.

17.5MHz

14.705KHz

50Hz

File:Dali D8X3N Webviewer.png

2025-08-04T01:20:15Z

Gamerpaddy:

web page to view raw video stream

File:Dali D8X3N Raw webviewer.zip

2025-08-04T01:10:38Z

Gamerpaddy:

files to patch the web server for raw viewer

Dali D8X3N Thermal Camera

2025-08-03T19:49:29Z

Gamerpaddy: /* Viewing Raw Thermal Data from the Web API */

==Dali D8X3N Thermal Camera Reverse Engineering==
 

===Introduction===
The [https://www.dali-irtech.com/productinfo/741567.html Dali D8X3N] Thermal Camera module comes in two versions, a 384x288 and 640x480 resolution, utilizing the [http://www.dali-tech.us/products/dld64017m-uncooled-infrared-fpa-detector-86.html DLD Series] of amorphous-Silicon Microbolometers.

They were mainly used in [http://www.dali-tech.us/products/dm60-w--online-body-temperature-thermal-imaging-camera-55.html Dali DM60-W] or WS-1 Body Temperature screening cameras in conjunction with a Black Body radiator set to 37°C to detect infected individuals at the start of the 2020 Covid Pandemic.
[[File:ICI FM320P Innerts.jpg|thumb|Internals. A TP-Link Switch, HikVision Visible Camera and the D8x3N Network thermal camera module]]
[https://infraredcameras.com/ ICI] rebranded these models as FM 320 P and FM 640 P, and distributed them on the local US market, but as the need for such Cameras exploded, those models were built with what was in stock.

So happens, that some of the FM 320 P Models had a DLD640 640x480 instead of a DLD384 384x288 Microbolometer in them, and just got their Firmware modified.

It also could be, because they have excessive amounts of bad pixels outside the 384x288 area, that they were binned to a lower grade.

Discussions about these Cameras started around 2022 in the [https://www.eevblog.com/forum/thermal-imaging/ici-and-dali-thermal-camera-software/ EEVBlog Forums.] when they started to appear secondhand and affordable.

Originally they were priced around US$ 20... 30.000 by ICI, and a unknown amount by Dali Tech.

The Modules specs according to the manufacturer are:

≤50..60mK@F1，300K，50Hz

17 or 25µm pixel pitch

Hisilicon SoC running Linux to provide Onvif and RTSP streams, analysis and a Web UI

 
[[File:Dali D8X3N Module.jpg|thumb|A real 384x288 model with a DLD384 sensor. notice the Productnumber ]]
ICI FM Cameras are found all over Online secondhand marketplaces for scrap Prices, as they are no longer needed.

But you never know, what are you getting. It could be a real DLD384 or the better DLD640 inside. Its a gamble.
 

======640x480 Imagers======
are labeled 22D843 Nxxxx and have a DLD640 sensor in it, they can be upgraded if they run the 384x288 firmware.

======384x288 Imagers======
are labeled 22D883Nxxxx and have a DLD384 sensor in it, they cannot be upgraded

 

===D8X3N Module closer look===
From now on, i will refer to the Thermal Imaging Module as TIM

On the front there is a 2 Element Germanium Lens of a unknown focal length and aperture.

It can be focus-adjusted when unscrewing the clamp around the housing. It can be focussed from infinity down to 10..20cm with some quality loss.
 The outter diameter of the Lens is 42mm with a 1 1/3 inch thread diameter of undetermined pitch.

Dimensions of the germanium elements are 21mm to 3 and 6mm and 14grams in weight.
[[File:Disassembled Thermal Camera Lens.jpg|thumb|Two element Germanium Lens of unknown focal length and aperture]]

The TIM is composed of 6 Stacked PCB modules, 3 of which are for the Web Server functionality. taking them off will give you the basic configuration of a [https://www.dalithermal.com/productinfo/741568.html Dali D8X3C] TIM<gallery>
File:Dali DLD640 Thermal Image Sensor.jpeg|DLD640 Sensor
File:Dali DLD384 Thermal Imaging Sensor.jpeg|DLD384 Sensor
File:Dali D8X3N Board1 Back.jpeg|Network & GPIO Board Back
File:Dali D8X3N Board1 Front.jpeg|Network & GPIO Board Front
File:Dali D8X3N Glue Board Back.jpeg|Board between Logic and IO Back
File:Dali D8X3N Glue Board Front.jpeg|Board between Logic and IO Front
File:Dali D8X3N SoC Board Back.jpeg|SoC Board back
File:Dali D8X3N SoC Board front.jpeg|SoC board front
File:Dali D8X3N FPGA Board Back.jpeg|FPGA Board of the D8X3C Thermal Imager including a PMIC
File:Dali D8X3N FPGA Board Front.jpeg|FPGA Board Front with Video DAC and SPI Flash
File:Dali D8X3N Sensor Power and ADC Board.jpeg|Sensor control and ADC board
File:Dali D8X3N Thermal Core Debug wiring.jpeg|Debug wiring for sniffing SPI and UART
</gallery>

===User Manual===
including pinout diagram and important data

can be found here https://archive.org/details/dali-d-8-x-3-cuser-manualen-v-1.0-1

===Viewing the Video Stream===
[[File:Onvif Device Manager ODM.png|thumb|ODM streaming the Thermal view]]
when first connecting it to power and Ethernet, the camera will have 192.168.1.102 as a Static ip.

If you are running a 192.168.0.x or .178.x net, you need to change it or add a subnet under windows ipv4 settings.

to view it, you can use VLC and the stream URL
rtsp://admin@admin:<camera ip>/ONVIFMedia
there is /ONVIFMedia /ONVIFMediaM and /ONVIFMediaS for different stream Profiles.

VLC is quite slow and delayed, rather use Onvif Device Manager ODM,

it has no delay and auto-detects cameras in the network.

Be sure to log in as user: admin pass: admin in ODM.

in there, you can also set you camera to DHCP under Network settings.

===Web Interface===
[[File:Dali D8X3N web interface.png|thumb|Since browsers cant display RTSP anymore, open in Edge and select IE Compatibility Mode.]]
the web interface can be accessed by opening the camera IP in a browser

login is:
user: admin pass: admin
You can set Temperature markers and areas, but without using the Black Body calibration source, your readings may be way off or not working.

 

====OSD====
there is a debug-login with
user: super pass: 871897
that lets you send Key commands to the Imager to navigate the OSD.

Setting the OSD to english is accomplished with option #11
[[File:Dali D8X3C OSD.png|thumb|OSD in english, if yours is Chinese. go to option #11 and click + or -]]

To acces some locked menus, press
+ - + - + -

The password for the locked System and Main menu is
+-MC+-

Be careful in the UART menu to not change the BAUD rate or Protocol, as your ability to control it via the Web API gets lost.

You need to reflash or solder buttons on the thermal core then.

===Viewing Raw Thermal Data from the Web API===
there is a hidden endpoint in the stream.so file that could be found while decompiling

accessing
[[File:Arduino Nano blink sketch thermal gif.gif|thumb|Arduino Nano running blink sketch while thermally recording it, notice the led and resistor on the right]]
<ip of camera>:5000/stream?Type=JPEG&Source=Jpeg&Mode=TCP
lets you download a JPEG. but there are more options available (not all have been tested)

we are mainly interessted in Raw thermal data.

====Source (Stream Type)====

*<code>Major</code> - Main video stream (channel 0)
*<code>Minor</code> - Sub video stream (channel 1)
*<code>MinorAV</code> - Sub video + audio stream
*<code>MajorAV</code> - Main video + audio stream
*<code>Jpeg</code> - JPEG snapshot stream
*<code>Raw</code> - Raw thermal data stream
*<code>YUV</code> - YUV raw video stream

====Type (Data Format)====

*<code>H264</code> - H.264 video encoding
*<code>JPEG</code> - JPEG image format
*<code>RAW</code> - Raw sensor data
*<code>QBOX</code> - Custom protocol format
*<code>FRAME</code> - Frame-based format

====Mode (Transport Protocol)====

*<code>TCP</code> - TCP streaming (default)
*<code>UDP</code> - UDP streaming
*<code>MUL</code> - Multicast streaming

====Quality Parameters====

*<code>Quality=[1-100]</code> - Video quality level
*<code>Frames=[number]</code> - Number of frames to send
*<code>Interval=[ms]</code> - Frame interval in milliseconds

====Network Parameters====

*<code>IPAddr=[ip]</code> - Client IP address for UDP/multicast
*<code>Port=[port]</code> - Client port for UDP/multicast
*<code>Heart-beat=[Yes/No]</code> - Enable/disable heartbeat

====Snapshot Parameters====

*[[File:Dali D8X3N Raw Thermal viewer.png|thumb|Raw Data Viewer in python]]<code>Snap=[Yes/No]</code> - Enable snapshot mode

To view the raw stream, i made a python program that converts the 14bit thermal data to a visible image.

it is low fps tho, due to bad optimizations.

rev1 first working version https://pastebin.com/dyNWDPT3

rev2 with temperature readout https://pastebin.com/u107Q85w

===Getting Root Terminal Access===
To access the Terminal you need to solder or plug in a UART connection to Connector J7 on the "Glue" board.

Pinout is (left to right) '''RX TX GND 3.3V Baud 115200 3.3V!'''

But the system will spam with debug messages, making patching the files a hard job unless you use "tftp" or "sed" commands.
 

===(optional) Enabling Telnet access to make patching easier===
[[File:Upgrade ici dali firmware updater.png|thumb|ICI Firmware updater software with modified firmware loaded]]

there is a easier way using a modified Firmware updater to enable Telnet temporarily to patch the Files.

Download the '''upgrade_ici.exe''' form [https://archive.org/details/fwupdate here] and run it.

Then you should be able to connect to it via Telnet.

The Login credentials are '''User: roo'''t '''Password: DLroot'''

===Patching the Web Server===
This only works if you also patch the Thermal Camera module flash!

====to permanently enable Telnet, go to '''/etc/init.d''' and edit '''S90app'''====
vi S90app
in vi, move your cursor to the '''#''' at '''#telnetd''' and press x<blockquote>optional: enable ftp by removing the '''#''' at '''ftpd''' and adjust the path to / </blockquote>now press ''':''' and type '''wq''' and hit '''enter'''. this should be it.

 

====patching the decoder and streamer to 640x480:====
go to /app and edit the mach.cfg

replace DL384 with D640 and edit the resolution to 640 480

(press i in vi to enter edit mode, press ESC to exit edit mode. :wq to write and quit.)

repeat that procedure for the dali.cfg

=====(optional) patching app.sh to prevent it from rebooting=====
edit the app.sh in /app and remove all "reboot" occasions to prevent the camera from rebooting if onvifserver, httpd or daliServer arent running for debugging purposes.

===Patching the Thermal Camera module===
To patch it, you need to disassemble everything down to the FPGA Board,

on the bottom there is a SPI SOIC8 Flash.

Use a CH341 EEPROM programmer (be sure to have a fixed or modified version to not put out 5V!, set it to 3.3V) and SOIC8 clamp.

Use NeoProgrammer (i used 2.2.0.10 but there are newer available, use the latest) and click Detect. It should find W25Q128 chips, select the FV one.

Dont forget to download a backup of your flash and save it !

Download the Binary "Dali 640x480 '''actual''' cleared pixelmap.bin" from #3 below and load it into NeoProgrammer,

Click Erase, Program and Verify.

This can take a while.

Your imager should start up right after assembly by hearing the shutter click.

 

===Flash Contents===
On archive, click on show all files to download them.

<nowiki>#</nowiki>1 a Flash dump of the original downgraded D8X3N can be found [https://archive.org/details/dali-d-843n-flash-dump here]

<nowiki>#</nowiki>2 a Flash dump of a original 640x480 model can be found [https://archive.org/details/d-843-n-640x-480 here]

<nowiki>#</nowiki>3 a modified Flash dump of a 640x480 with cleared dead pixel map, flat map etc. can be found [https://archive.org/details/d-843-n-640x-480-cleared-pixelmap here]

a Flash dump of the web server SPI flash W25Q256JV can be found [https://archive.org/details/dm-60-webserver-flash-dump here] in case a bad firmware update caused a bootloop.

 

===Flash Binary Analysis===
The Flash IC is a Winbond 25Q128JV SPI Flash that contains the FPGA Bitstream, Deadpixel and Flatmap, aswell as the Device Settings.

a copy of the SPI Logic Capture at startup can be found [https://archive.org/details/dali-eeprom-capture here], the free software [https://www.dreamsourcelab.com/download/ DSView from DreamSourceLab] is required to view it.
[[File:Dali Thermal Imager SPI Flash capture.png|thumb|SPI Flash access while booting the Thermal Module]]

a approximation of the offsets resulted in this list:<syntaxhighlight lang="vb">
0x000000 - altera cyclone iv stuff
0x200000 - settings
0x280000 - Flat field correction map
0x4C0000 - Bad Pixel correctio nmap
0x580000 - image aswell? 36010 bytes
0x740000 - GUIX?
0x7C0000 - Strings for Gui?
0x800000 - another shorter GUIX
0x880000 - Strings for second gui?
0x8C0000 - GUIX
0x940000 - Strings for gui
0xE00000 - ?
0xE80000 - dzxg? short
0xEC0000 - crosshair.bmp
0xF40000 - 3DTM?
0xF80000 - fake? Bad pixel map BPRP
</syntaxhighlight> 

====Settings offset 0x200000====
The settings are read and written every startup, aswell when you close the OSD, sporadically and when executing the command MSV

these are some of the settings i could figure out by changing and watching the logic capture what changed.
 <syntaxhighlight lang="vb">
offset size Cmd
0x0 1 SAG (0-2) auto gain
0x2 2 SVB (0-16383) saved value is 16383 - SVB
0x4 2 SVC (0-1023) set exposure or gain
0x6 1 SSM image filtering
0x8 1 SEH image enhancement
0xA 1 SWP invert b/w polarity
0x14 1 SMR Flip
0x16 1 SMR Mirror
0x20 1 MENU Cal source 0 IN, 1 OUT
0x3A 1 MENU Enhance value 0-100
0x40 1 MENU Rectify (shutter 0 OFF, 1 L, 2 H)
0x50 1 MENU Language 0 english, 1 chinese, 2 russian
0xA2 - SCO set contrast gain
0xA4 - IBR set brightness
0xAE 2 MENU Fire Threshold
0xAC 1 SPA set color palette
0xE2 1 SMS display "collected 0/80" enabled
0xF8 1 SEM set emissivity
0x110 1 SRT set revise temp
0x116 1 SHD set humidity
0x118 1 SET set ambient temp
0x11A 1 STD set temp range
0x120 2 SLG -500 to 500?
0x124 2 SRD set distance
0x12C 1 SCP ???
0x130 2 SCT ???
</syntaxhighlight> 
[[File:Dali D8X3N Bad Pixel Map Viewer.png|thumb|Bad pixel map of a 640x512 sensor, about 0.56% of dead pixels in this map]]
So i let the AI create a [https://2476424.playcode.io/ Configurator page] that lets you change the Settings in your Flashdump to your liking
 

======Bad Pixel and Flatframe Maps 0x280000 and 0x4C0000======
Thermal cameras require a bad pixel and flat frame map to compensate for manufacturing inconsistencies.

unfourtainly, the maps of the downgraded cameras only contain enough data for a 384 model, not the full 640.

at offset 0xF80000 there is a BPRP which was mistaken at first as the Bad pixel map, it could just be a mask to where to apply the offset maps, as its either 0x0 or 0x1.

The [https://2477569.playcode.io/ Viewer Page] is written in JS and does not require any special dependencies, it can run as a plain html file offline.

There still needs to be work done to create own maps and flatfields but the cameras are still very capable and useable with fully cleared maps.

To clear the maps, just go to these offsets and fill with values around 0x3F or 0x0 for total length of X Resolution x Y Resolution x 2 bytes (0x96000 for 640x480)

[[File:Dali D8X3N Flat Field Map Viewer.png|thumb|Flat Field viewer]]

===Dali Commands===
To control the TIM you can either use Pelco or Dali command set. By default the Dali commandset is used at 38400 BAUD.

Those commands consist of a 0x02 start byte followed by two length Bytes, then the actual command which is allways 3 uppercase Letters in ASCII (eg. KBD for keyboard) followed by a comma and the values.

Some commands take multiple values, some dont. But you allways have to send the comma after the Command.

The camera will answer with the Command and 0, 1 or 2. Sending no value counts as zero.
0 is invalid parameters, too few or out of range

1 is OK, valid command

2 is Invalid command

Commands can be sent trough the Web server using the URL Api endpoint or directly trough the UART port.

(keyboard, C button, causes the shutter to do a calibration)
<camera ip>/cgi-bin/dmcmd?Command=KBD,C
Listening to the answer can be done while being in the Linux shell and typing
cat /dev/ttyAMA2 | strings

By bruteforcing the UART with AAA to ZZZ a list of Commands could be obtained, but some with unknown Parameters or functionality yet. including some from a decompiled DM60comm.so module found in /app/modules folder.<syntaxhighlight lang="vb">
KBD KEY Keyboard (F S M C + -)
SSM 0-1 Image Filtering Off/On
GSM 0 Image filter status
SEH 0-1 Image Enhancement Off/On
GEH 0-1 Image enhancer status
SCO 0-255 Set Gain (locked when SAG auto gain is on)
GCO 0-255 Get gain
INT 15-320 set actual gain? not just contrast sometimes disabled?
IBR 0-255 Set brightness
GBR 0-255 Get brightness
SMR 0-3 Mirror mode bit0=horizontal, bit1=vertical
GMR 0 Get rotation/flip
SDT 0-1 displays temp=44.65°C osd, but webserver sends date/time to the cam there....
GDT 0-1 Get temp display active?
GPT Display temp oft SDT
GNU 0-1 Get Shutter closed/open
SNU 0-1 Shutter close / open
STD 0-1 Set Range 0: -20-180°C 1: 100-600°C
GTD 0-1 Get Range
SET °C Set Ambient temperature
GET °C Get Ambient temperature
SEM 0-100 0-1 set emissivity x100
GEM 0-100 Get Emissivity
SRT °C Set revise temperature -100-100 -10-10°
GRT °C Get revise temperature
SRD 100 Set Distance 4.4m x100
GRD 100 Get Distance
SHD 0-100 Set Humidity
GHD 55 Get Humidity
SWP 0-1 invert s/w polarity image
GWP 1 is inverted?
SPA 0-10? Set color palette
GPA 3 white hot
SMV 0-1 Show temperature 3x3 grid?? in combination with GTV maybe
GMV 0
SMS 0-1 displays "collected 0/<number set by SCT>" by SCP delay "saves the daily number of highest temperatures?"
GMS 0
SCT 1-500 sets the amount of "collected" points for SMS
GCT 80
SCP 5-60 "collected" delay in seconds for SMS
GCP 60
SAG 0-2 Auto brightness / gain
GAG 0
SLR 0-9 ???
GLR 0
SRP 0,0 - 639,479 set crosshair position
GRP 320,240 get crosshair position
DRC 0-1 Show crosshair
SLG -500-500 ??
GLG
SCE text ??
GCE 0
SCB text ??
GCB 0
SVB 0-16383 adc offset, exposure? good at 9650
GVB 6733 value is 16383 minus SVB
SVC 1-1023 set contrast but better
GVC 260
SVF 100-? ?? video freaks out 3400 seems good
SVS 100-? ?? video freaks out 3300 seems good
SOT 0-1 ?? sensor supply, looks weird when off.
SZM 1-4 ?
GZM 1
MSV save settings too eeprom
ASV Saves something aswell?
GCS 0 Get Core status & faults
ALD 0,2? video blanks lots of eeprom activity. reload pixel map??
SAV 0-9999 set Fire threshold
GAV 2100 get Fire Threshold
BAC change uart protocol? careful
CBD Displays Recovery successful?
CBS Displays Saved successfully
LRD Displays Recovery successful?
LRS Displays Saved successfully?
LRE Displays Temperature Repair successful?
CBT Displays Calibration successful?
DBP ??? shutter clicks
DPI Show weird pixels
API Hide weird pixels
CCM ??
ASN 0-4 ??
GAB 4 vals ?? 3,-10,50,150
GAN 1 ??
GAR 11 vals ?? 10,10,5,20,35,50,70,90,120,150,180,,
GCM 6 values ??
GFV prints screen gray value?
GIT 200 ??
GTV Get the collected temp values?
PTS echoes but with extra stuff??
QYA 7170 Query Gray Info (information mode)
QYI 7124 Query Gray Average mode
QYM 7512 Query Gray Minimum mode
VTP 400-4000 ??
MTD U/S,0,0 ?? S answers with bytes, U upload bytes?
MTC U/S? ?? S answers with U,0,0, S doesnt.

return 0 invalid params:
STS ??
STT ??
SAC ??
SAH ??
SAS ??
SAT ??
SCX ?? displays crosshair but invalid params
SCY ?? displays crosshair but invalid params
GAC ??
GAH ??
GAS ??
GAT ??
GME ??
GPC ??
GPI ??
GPM ??
GTA ??
GTC ??
GTI ??
GTM ??
GTS ??
GTT ??

answer only:

BPM 0-1 stream ready? answers with 0 stop, 1 go, 2 when prompted
AVS 0,1
MEH
PWI 0-1 changing palette from wh to fire

unconfirmed (from dm60comm.so):
SDT 2024,03,15,14,30,25 Set Date Time with year,month,day,hour,minute,second
STS 1 Set Temperature Show display (0=off, 1=on)
SVA 2 Set Video Auto mode (0=manual, 2=auto)
SMP 0,1,1,0,100,150,200,250,300,350,90,25 Set Measurement Point (type,index,enable,mode,startX,startY,endX,endY,anchorX,anchorY,threshold,color)
STV Stop Temperature View measurements
SPF 5 Set Profile parameter
SVL -10 Set Video Left pan movement (signed value)
SVU -5 Set Video Up tilt movement (signed value)
SVD 5 Set Video Down tilt movement (signed value)
SSP 17,1,0 Set System Parameter (param_id,value,index) #46 temperature format 0 °C, 1 °F, 2 K
SCP Set Current Preset (save current position)
GCP Get Current Preset
STT 300,350 Set Temperature Threshold (low,high values *10)
SDC 1 Set Display Configuration parameter
GCS Get Current Status
GMM Get Memory Map information
GFV Get Frame Value (grayscale data)
GFZ Get Freeze Status
GSI 1 Get System Information (parameter=1)
GSS Get System Status
GSP 21,0 Get System Parameter (param_21=surround temp, value=0)
GTT Get Temperature Threshold range
GTV 1,3,10 Get Temperature Values (enable,type,count)
GNU Get Network Update status (response command)
FRZ Freeze current display frame
LIV Live mode (unfreeze display)
CAL Calibrate system
CCP 3 Call Current Preset (preset number 0-9)
APF 100 Auto Profile setting
MEH Measure Enhancement
BPT Built-in Test
MTC S,0 Measure Temperature Capture (S=start, 0=sequence)
MTG U,0,1024,<data> Measure Temperature Gray data transfer
MTD U,0,1024,<data> Measure Temperature Data transfer
UFP S,0,2048 Update Firmware Prepare (S=start, 0=offset, 2048=size)
UFD S,0,1024 Update Firmware Data transfer
BAB U Buffer operation (U=update)
TTH S,0 Temperature Threshold operation
IPP 192.168.001.102,255.255.255.000,192.168.001.001,192.168.000.001,9989,9998 IP Parameters (IP,netmask,gateway,DNS,port1,port2)
MAC 00:60:A9:10:00:01 MAC Address setting
SNP Set Network Parameters (response command)
QYI Query Gray Info (information mode)
QYA Query Gray Average mode
QYM Query Gray Minimum mode
GAI Get Alarm Info (response command)
YTC <data> Unknown command with data parameter
HTH
LRS
LRD
GAR
DRC
PTS
SCX
SCY
CBT
LRE
CBD
CBS
XXX
GSP
GTT
QYI
QYA
QYM

</syntaxhighlight>

===Secret Menu Overview===
The secret menus Main and System can be openend with the password '''+-MC+-'''

Its structured like this, not all variables have been figured out yet.

The format is Menu: submenu: submenu:

and for menu entries: Name, default value, command, description or messages that pop up.
 <syntaxhighlight lang="vb">
MAIN & SYSTEM PASS: +-MC+-

entries are NAME VALUE COMMAND DESC or if its a folder its just ":"

System:
System:
Gain 255 SCO
Bright 102 IBR
BenDi 100 ?
BenDiContrase 80 ?
DisMode 0 ?
Frequency 48hz (24,25,48,50)
DigitalOut 8-14bit 14bit, BT656(_P), ?, BT601
AutoFocus N ?
Line 1 ?
Ltemp0 11800 ?
LTemp1 11000 ?
HTemp0 9500 ?
HTemp1 8700 ?
DelayTime 0 ?
Enhance 0-1 ?
Enhanced E1 230 ?
FPA_Gain 12pF ? between 4 and 18 at random.
NUCEn N ?

Area:
SE 2 ASN 0-4 "Partition"
INT 200 INT "Points time"
VS 3161 SVS
VF 2800 SVF
Vtemp 1401 VTP
VtempArea Low ?
VtempBase 13500 ?
VtempStep -1 ?
VsStep 8 ?
DeadPixelModel preset / calculate
DP: Cursor to select dead pixels
X 360 position
Y 288 position
AutoBP: 50 Press C to start automatic dotting
Quit? Number of bad pixels 961& "Blind element replacement in progress"
Undo
R2: Save data? blind pixel replacement in progress
Replace Y N = DPI, Y = API
L: Reading parameters
S: Saving parameters

Debug:
Rectify N
DisplayGary N
TE N SDT
AutoE ? ?
AutoVS Y ?
VSGrayH 8000 ?
VSGrayL 7000 ?
Trends 1 ?
Shelter N ?
MotorCon 3 ?
SaveFactoryPara:
LanTyp EN ? LANGUAGE
DisplayMT N ?
Version:
PRJ D843 DLD640 ImLib, MTlib, Soft, Logic

BackDispose:
GammaEN 1 ?
Gain 1 ?
EnhanceEN 0 ?
Hpf_shift 5 ?
Hpf_thrd 5 ?
Enhance 150 ?
Lthrd 50 ?

Monitor:
Opens normal OSD

Alarm Set:
Alarm Switch Y ?
Alarm Mode No ?
Alarm Temperature -1°C ?
Reference Gray Y ?
Alarm Level 1L ?
Alarm Gray 65535 ?
Alarm PointNum 0 ?
Correct Gray 0 ?

Thermometry:
Data Collection 0 SMS
Interval 60 SCP
Ammount 90 SCT
Environment normal ?
Export:
Displays: Exportin normal temperature MTC data
Correction -1 ?
Emissivity 100 SEM
Calibration:
BlackbodyTemp -10 grabs a val from GAB
Save CBS
Cancel CBD
Correction:
BlackbodyTemp -10 Picks from the list GAR
Grayscale 0 SLG
Confirm LRE
Save LRS
Cancel LRD
Ninepoint measurement SMV

Cursor:
Cur N DRC enable cursor
X 320 SRP set cursor position
Y 240 SRP set cursor position

Main:
Auto 2 SAG Auto gain
G 211 SVC
B 10002 SVB
P 1 SWP polarity
Z X ?
Settings:
Image:
FI Y ?
FIValue 0 ? 0-31
Freeze N Freeze image
VE N SMR Vertical flip
HO N SMR Horizontal flip
AutoCali L same as rectify?
O IN internal or external
COM:
Opens UART menu
AvoidburnSwitch OFF enable anti burn in
ProtectedTime 10S duration
AvoidBurn 16383 threshold to trigger antiburn

</syntaxhighlight>

===Automatic Dead Pixels and Flatmap Correction===

It it possible to generate a new flat and dead pixel map automatically within the camera after flashing the cleared-map binary.
 

=====Dead pixels:=====
In the secret menu "System", navigate to Debug - DeadPixelModel and set the AutoBP (sensitivity for auto bad pixel finding) to 50 or so. Then press C Button

This can take a while.
[[File:High emissivity peltier black body.jpg|thumb|A Peltier / TEC coated in Candle sood to give it a high emissivity surface. It can be cooled or heated by swapping the polarity. ]]

Afterwards, navigate to S: and press + to save it.
 

=====Flatfield:=====
In the Debug menu navigate to R2 and press +

now place something '''Cold''' infront of the Camera with a high emissivity. (it needs to fill the whole image)

Press '''+''', wait for it to says High temperature.

Place something '''Hot''' infront and press '''+''' again.

Afterwards, save with '''S:''' again.

Flatfield should now be calibrated
 <blockquote>Note: Not all dead pixels are auto detected or get removed. you can manually select them in the Dead pixel editor but its not known yet how to select and correct them.</blockquote>

 

===Using the Thermal module without Webserver===
[[File:Dali D8X3C Breakout board.png|thumb|Breakout board for D8X3C ]]
to use it, you need to interface it directly.

The module will put out a Analog video signal (High-Z, need to buffer when connecting it to 75Ohm Video input)

Also a 8 or 14bit or 8-bit BT656 output.

the header exposes the FPGA JTAG and UART aswell as 6 Hardware Keys to Navigate the OSD.

To interface, you need to make a adapter board with a DF12-50DS-0.5V(86) Docking socket.

The breakout board files can be found [https://oshwlab.com/gamerpaddy/d8x3c-backpack-usb here] but may be still work in progress.

 

===Sensor Pinout===
[[File:Dali DLD384 Sensor pinout basic.png|thumb|basic pinout of a DLD384]]
the pinout of the thermal sensor havent been analyzes much.

besides some supply and Control voltages, 3 clocks and a analog output have been found.

17.5MHz

14.705KHz

50Hz

Dali D8X3N Thermal Camera

2025-08-03T19:34:22Z

Gamerpaddy: /* Viewing Raw Thermal Data from the Web API */ formatting fix

==Dali D8X3N Thermal Camera Reverse Engineering==
 

===Introduction===
The [https://www.dali-irtech.com/productinfo/741567.html Dali D8X3N] Thermal Camera module comes in two versions, a 384x288 and 640x480 resolution, utilizing the [http://www.dali-tech.us/products/dld64017m-uncooled-infrared-fpa-detector-86.html DLD Series] of amorphous-Silicon Microbolometers.

They were mainly used in [http://www.dali-tech.us/products/dm60-w--online-body-temperature-thermal-imaging-camera-55.html Dali DM60-W] or WS-1 Body Temperature screening cameras in conjunction with a Black Body radiator set to 37°C to detect infected individuals at the start of the 2020 Covid Pandemic.
[[File:ICI FM320P Innerts.jpg|thumb|Internals. A TP-Link Switch, HikVision Visible Camera and the D8x3N Network thermal camera module]]
[https://infraredcameras.com/ ICI] rebranded these models as FM 320 P and FM 640 P, and distributed them on the local US market, but as the need for such Cameras exploded, those models were built with what was in stock.

So happens, that some of the FM 320 P Models had a DLD640 640x480 instead of a DLD384 384x288 Microbolometer in them, and just got their Firmware modified.

It also could be, because they have excessive amounts of bad pixels outside the 384x288 area, that they were binned to a lower grade.

Discussions about these Cameras started around 2022 in the [https://www.eevblog.com/forum/thermal-imaging/ici-and-dali-thermal-camera-software/ EEVBlog Forums.] when they started to appear secondhand and affordable.

Originally they were priced around US$ 20... 30.000 by ICI, and a unknown amount by Dali Tech.

The Modules specs according to the manufacturer are:

≤50..60mK@F1，300K，50Hz

17 or 25µm pixel pitch

Hisilicon SoC running Linux to provide Onvif and RTSP streams, analysis and a Web UI

 
[[File:Dali D8X3N Module.jpg|thumb|A real 384x288 model with a DLD384 sensor. notice the Productnumber ]]
ICI FM Cameras are found all over Online secondhand marketplaces for scrap Prices, as they are no longer needed.

But you never know, what are you getting. It could be a real DLD384 or the better DLD640 inside. Its a gamble.
 

======640x480 Imagers======
are labeled 22D843 Nxxxx and have a DLD640 sensor in it, they can be upgraded if they run the 384x288 firmware.

======384x288 Imagers======
are labeled 22D883Nxxxx and have a DLD384 sensor in it, they cannot be upgraded

 

===D8X3N Module closer look===
From now on, i will refer to the Thermal Imaging Module as TIM

On the front there is a 2 Element Germanium Lens of a unknown focal length and aperture.

It can be focus-adjusted when unscrewing the clamp around the housing. It can be focussed from infinity down to 10..20cm with some quality loss.
 The outter diameter of the Lens is 42mm with a 1 1/3 inch thread diameter of undetermined pitch.

Dimensions of the germanium elements are 21mm to 3 and 6mm and 14grams in weight.
[[File:Disassembled Thermal Camera Lens.jpg|thumb|Two element Germanium Lens of unknown focal length and aperture]]

The TIM is composed of 6 Stacked PCB modules, 3 of which are for the Web Server functionality. taking them off will give you the basic configuration of a [https://www.dalithermal.com/productinfo/741568.html Dali D8X3C] TIM<gallery>
File:Dali DLD640 Thermal Image Sensor.jpeg|DLD640 Sensor
File:Dali DLD384 Thermal Imaging Sensor.jpeg|DLD384 Sensor
File:Dali D8X3N Board1 Back.jpeg|Network & GPIO Board Back
File:Dali D8X3N Board1 Front.jpeg|Network & GPIO Board Front
File:Dali D8X3N Glue Board Back.jpeg|Board between Logic and IO Back
File:Dali D8X3N Glue Board Front.jpeg|Board between Logic and IO Front
File:Dali D8X3N SoC Board Back.jpeg|SoC Board back
File:Dali D8X3N SoC Board front.jpeg|SoC board front
File:Dali D8X3N FPGA Board Back.jpeg|FPGA Board of the D8X3C Thermal Imager including a PMIC
File:Dali D8X3N FPGA Board Front.jpeg|FPGA Board Front with Video DAC and SPI Flash
File:Dali D8X3N Sensor Power and ADC Board.jpeg|Sensor control and ADC board
File:Dali D8X3N Thermal Core Debug wiring.jpeg|Debug wiring for sniffing SPI and UART
</gallery>

===User Manual===
including pinout diagram and important data

can be found here https://archive.org/details/dali-d-8-x-3-cuser-manualen-v-1.0-1

===Viewing the Video Stream===
[[File:Onvif Device Manager ODM.png|thumb|ODM streaming the Thermal view]]
when first connecting it to power and Ethernet, the camera will have 192.168.1.102 as a Static ip.

If you are running a 192.168.0.x or .178.x net, you need to change it or add a subnet under windows ipv4 settings.

to view it, you can use VLC and the stream URL
rtsp://admin@admin:<camera ip>/ONVIFMedia
there is /ONVIFMedia /ONVIFMediaM and /ONVIFMediaS for different stream Profiles.

VLC is quite slow and delayed, rather use Onvif Device Manager ODM,

it has no delay and auto-detects cameras in the network.

Be sure to log in as user: admin pass: admin in ODM.

in there, you can also set you camera to DHCP under Network settings.

===Web Interface===
[[File:Dali D8X3N web interface.png|thumb|Since browsers cant display RTSP anymore, open in Edge and select IE Compatibility Mode.]]
the web interface can be accessed by opening the camera IP in a browser

login is:
user: admin pass: admin
You can set Temperature markers and areas, but without using the Black Body calibration source, your readings may be way off or not working.

 

====OSD====
there is a debug-login with
user: super pass: 871897
that lets you send Key commands to the Imager to navigate the OSD.

Setting the OSD to english is accomplished with option #11
[[File:Dali D8X3C OSD.png|thumb|OSD in english, if yours is Chinese. go to option #11 and click + or -]]

To acces some locked menus, press
+ - + - + -

The password for the locked System and Main menu is
+-MC+-

Be careful in the UART menu to not change the BAUD rate or Protocol, as your ability to control it via the Web API gets lost.

You need to reflash or solder buttons on the thermal core then.

===Viewing Raw Thermal Data from the Web API===
there is a hidden endpoint in the stream.so file that could be found while decompiling

accessing
[[File:Arduino Nano blink sketch thermal gif.gif|thumb|Arduino Nano running blink sketch while thermally recording it, notice the led and resistor on the right]]
<ip of camera>:5000/stream?Type=JPEG&Source=Jpeg&Mode=TCP
lets you download a JPEG. but there are more options available (not all have been tested)

we are mainly interessted in Raw thermal data.

====Source (Stream Type)====

*<code>Major</code> - Main video stream (channel 0)
*<code>Minor</code> - Sub video stream (channel 1)
*<code>MinorAV</code> - Sub video + audio stream
*<code>MajorAV</code> - Main video + audio stream
*<code>Jpeg</code> - JPEG snapshot stream
*<code>Raw</code> - Raw thermal data stream
*<code>YUV</code> - YUV raw video stream

====Type (Data Format)====

*<code>H264</code> - H.264 video encoding
*<code>JPEG</code> - JPEG image format
*<code>RAW</code> - Raw sensor data
*<code>QBOX</code> - Custom protocol format
*<code>FRAME</code> - Frame-based format

====Mode (Transport Protocol)====

*<code>TCP</code> - TCP streaming (default)
*<code>UDP</code> - UDP streaming
*<code>MUL</code> - Multicast streaming

====Quality Parameters====

*<code>Quality=[1-100]</code> - Video quality level
*<code>Frames=[number]</code> - Number of frames to send
*<code>Interval=[ms]</code> - Frame interval in milliseconds

====Network Parameters====

*<code>IPAddr=[ip]</code> - Client IP address for UDP/multicast
*<code>Port=[port]</code> - Client port for UDP/multicast
*<code>Heart-beat=[Yes/No]</code> - Enable/disable heartbeat

====Snapshot Parameters====

*[[File:Dali D8X3N Raw Thermal viewer.png|thumb|Raw Data Viewer in python]]<code>Snap=[Yes/No]</code> - Enable snapshot mode

To view the raw stream, i made a python program that converts the 14bit thermal data to a visible image.

it is low fps tho, due to bad optimizations.

https://pastebin.com/dyNWDPT3

===Getting Root Terminal Access===
To access the Terminal you need to solder or plug in a UART connection to Connector J7 on the "Glue" board.

Pinout is (left to right) '''RX TX GND 3.3V Baud 115200 3.3V!'''

But the system will spam with debug messages, making patching the files a hard job unless you use "tftp" or "sed" commands.
 

===(optional) Enabling Telnet access to make patching easier===
[[File:Upgrade ici dali firmware updater.png|thumb|ICI Firmware updater software with modified firmware loaded]]

there is a easier way using a modified Firmware updater to enable Telnet temporarily to patch the Files.

Download the '''upgrade_ici.exe''' form [https://archive.org/details/fwupdate here] and run it.

Then you should be able to connect to it via Telnet.

The Login credentials are '''User: roo'''t '''Password: DLroot'''

===Patching the Web Server===
This only works if you also patch the Thermal Camera module flash!

====to permanently enable Telnet, go to '''/etc/init.d''' and edit '''S90app'''====
vi S90app
in vi, move your cursor to the '''#''' at '''#telnetd''' and press x<blockquote>optional: enable ftp by removing the '''#''' at '''ftpd''' and adjust the path to / </blockquote>now press ''':''' and type '''wq''' and hit '''enter'''. this should be it.

 

====patching the decoder and streamer to 640x480:====
go to /app and edit the mach.cfg

replace DL384 with D640 and edit the resolution to 640 480

(press i in vi to enter edit mode, press ESC to exit edit mode. :wq to write and quit.)

repeat that procedure for the dali.cfg

=====(optional) patching app.sh to prevent it from rebooting=====
edit the app.sh in /app and remove all "reboot" occasions to prevent the camera from rebooting if onvifserver, httpd or daliServer arent running for debugging purposes.

===Patching the Thermal Camera module===
To patch it, you need to disassemble everything down to the FPGA Board,

on the bottom there is a SPI SOIC8 Flash.

Use a CH341 EEPROM programmer (be sure to have a fixed or modified version to not put out 5V!, set it to 3.3V) and SOIC8 clamp.

Use NeoProgrammer (i used 2.2.0.10 but there are newer available, use the latest) and click Detect. It should find W25Q128 chips, select the FV one.

Dont forget to download a backup of your flash and save it !

Download the Binary "Dali 640x480 '''actual''' cleared pixelmap.bin" from #3 below and load it into NeoProgrammer,

Click Erase, Program and Verify.

This can take a while.

Your imager should start up right after assembly by hearing the shutter click.

 

===Flash Contents===
On archive, click on show all files to download them.

<nowiki>#</nowiki>1 a Flash dump of the original downgraded D8X3N can be found [https://archive.org/details/dali-d-843n-flash-dump here]

<nowiki>#</nowiki>2 a Flash dump of a original 640x480 model can be found [https://archive.org/details/d-843-n-640x-480 here]

<nowiki>#</nowiki>3 a modified Flash dump of a 640x480 with cleared dead pixel map, flat map etc. can be found [https://archive.org/details/d-843-n-640x-480-cleared-pixelmap here]

a Flash dump of the web server SPI flash W25Q256JV can be found [https://archive.org/details/dm-60-webserver-flash-dump here] in case a bad firmware update caused a bootloop.

 

===Flash Binary Analysis===
The Flash IC is a Winbond 25Q128JV SPI Flash that contains the FPGA Bitstream, Deadpixel and Flatmap, aswell as the Device Settings.

a copy of the SPI Logic Capture at startup can be found [https://archive.org/details/dali-eeprom-capture here], the free software [https://www.dreamsourcelab.com/download/ DSView from DreamSourceLab] is required to view it.
[[File:Dali Thermal Imager SPI Flash capture.png|thumb|SPI Flash access while booting the Thermal Module]]

a approximation of the offsets resulted in this list:<syntaxhighlight lang="vb">
0x000000 - altera cyclone iv stuff
0x200000 - settings
0x280000 - Flat field correction map
0x4C0000 - Bad Pixel correctio nmap
0x580000 - image aswell? 36010 bytes
0x740000 - GUIX?
0x7C0000 - Strings for Gui?
0x800000 - another shorter GUIX
0x880000 - Strings for second gui?
0x8C0000 - GUIX
0x940000 - Strings for gui
0xE00000 - ?
0xE80000 - dzxg? short
0xEC0000 - crosshair.bmp
0xF40000 - 3DTM?
0xF80000 - fake? Bad pixel map BPRP
</syntaxhighlight> 

====Settings offset 0x200000====
The settings are read and written every startup, aswell when you close the OSD, sporadically and when executing the command MSV

these are some of the settings i could figure out by changing and watching the logic capture what changed.
 <syntaxhighlight lang="vb">
offset size Cmd
0x0 1 SAG (0-2) auto gain
0x2 2 SVB (0-16383) saved value is 16383 - SVB
0x4 2 SVC (0-1023) set exposure or gain
0x6 1 SSM image filtering
0x8 1 SEH image enhancement
0xA 1 SWP invert b/w polarity
0x14 1 SMR Flip
0x16 1 SMR Mirror
0x20 1 MENU Cal source 0 IN, 1 OUT
0x3A 1 MENU Enhance value 0-100
0x40 1 MENU Rectify (shutter 0 OFF, 1 L, 2 H)
0x50 1 MENU Language 0 english, 1 chinese, 2 russian
0xA2 - SCO set contrast gain
0xA4 - IBR set brightness
0xAE 2 MENU Fire Threshold
0xAC 1 SPA set color palette
0xE2 1 SMS display "collected 0/80" enabled
0xF8 1 SEM set emissivity
0x110 1 SRT set revise temp
0x116 1 SHD set humidity
0x118 1 SET set ambient temp
0x11A 1 STD set temp range
0x120 2 SLG -500 to 500?
0x124 2 SRD set distance
0x12C 1 SCP ???
0x130 2 SCT ???
</syntaxhighlight> 
[[File:Dali D8X3N Bad Pixel Map Viewer.png|thumb|Bad pixel map of a 640x512 sensor, about 0.56% of dead pixels in this map]]
So i let the AI create a [https://2476424.playcode.io/ Configurator page] that lets you change the Settings in your Flashdump to your liking
 

======Bad Pixel and Flatframe Maps 0x280000 and 0x4C0000======
Thermal cameras require a bad pixel and flat frame map to compensate for manufacturing inconsistencies.

unfourtainly, the maps of the downgraded cameras only contain enough data for a 384 model, not the full 640.

at offset 0xF80000 there is a BPRP which was mistaken at first as the Bad pixel map, it could just be a mask to where to apply the offset maps, as its either 0x0 or 0x1.

The [https://2477569.playcode.io/ Viewer Page] is written in JS and does not require any special dependencies, it can run as a plain html file offline.

There still needs to be work done to create own maps and flatfields but the cameras are still very capable and useable with fully cleared maps.

To clear the maps, just go to these offsets and fill with values around 0x3F or 0x0 for total length of X Resolution x Y Resolution x 2 bytes (0x96000 for 640x480)

[[File:Dali D8X3N Flat Field Map Viewer.png|thumb|Flat Field viewer]]

===Dali Commands===
To control the TIM you can either use Pelco or Dali command set. By default the Dali commandset is used at 38400 BAUD.

Those commands consist of a 0x02 start byte followed by two length Bytes, then the actual command which is allways 3 uppercase Letters in ASCII (eg. KBD for keyboard) followed by a comma and the values.

Some commands take multiple values, some dont. But you allways have to send the comma after the Command.

The camera will answer with the Command and 0, 1 or 2. Sending no value counts as zero.
0 is invalid parameters, too few or out of range

1 is OK, valid command

2 is Invalid command

Commands can be sent trough the Web server using the URL Api endpoint or directly trough the UART port.

(keyboard, C button, causes the shutter to do a calibration)
<camera ip>/cgi-bin/dmcmd?Command=KBD,C
Listening to the answer can be done while being in the Linux shell and typing
cat /dev/ttyAMA2 | strings

By bruteforcing the UART with AAA to ZZZ a list of Commands could be obtained, but some with unknown Parameters or functionality yet. including some from a decompiled DM60comm.so module found in /app/modules folder.<syntaxhighlight lang="vb">
KBD KEY Keyboard (F S M C + -)
SSM 0-1 Image Filtering Off/On
GSM 0 Image filter status
SEH 0-1 Image Enhancement Off/On
GEH 0-1 Image enhancer status
SCO 0-255 Set Gain (locked when SAG auto gain is on)
GCO 0-255 Get gain
INT 15-320 set actual gain? not just contrast sometimes disabled?
IBR 0-255 Set brightness
GBR 0-255 Get brightness
SMR 0-3 Mirror mode bit0=horizontal, bit1=vertical
GMR 0 Get rotation/flip
SDT 0-1 displays temp=44.65°C osd, but webserver sends date/time to the cam there....
GDT 0-1 Get temp display active?
GPT Display temp oft SDT
GNU 0-1 Get Shutter closed/open
SNU 0-1 Shutter close / open
STD 0-1 Set Range 0: -20-180°C 1: 100-600°C
GTD 0-1 Get Range
SET °C Set Ambient temperature
GET °C Get Ambient temperature
SEM 0-100 0-1 set emissivity x100
GEM 0-100 Get Emissivity
SRT °C Set revise temperature -100-100 -10-10°
GRT °C Get revise temperature
SRD 100 Set Distance 4.4m x100
GRD 100 Get Distance
SHD 0-100 Set Humidity
GHD 55 Get Humidity
SWP 0-1 invert s/w polarity image
GWP 1 is inverted?
SPA 0-10? Set color palette
GPA 3 white hot
SMV 0-1 Show temperature 3x3 grid?? in combination with GTV maybe
GMV 0
SMS 0-1 displays "collected 0/<number set by SCT>" by SCP delay "saves the daily number of highest temperatures?"
GMS 0
SCT 1-500 sets the amount of "collected" points for SMS
GCT 80
SCP 5-60 "collected" delay in seconds for SMS
GCP 60
SAG 0-2 Auto brightness / gain
GAG 0
SLR 0-9 ???
GLR 0
SRP 0,0 - 639,479 set crosshair position
GRP 320,240 get crosshair position
DRC 0-1 Show crosshair
SLG -500-500 ??
GLG
SCE text ??
GCE 0
SCB text ??
GCB 0
SVB 0-16383 adc offset, exposure? good at 9650
GVB 6733 value is 16383 minus SVB
SVC 1-1023 set contrast but better
GVC 260
SVF 100-? ?? video freaks out 3400 seems good
SVS 100-? ?? video freaks out 3300 seems good
SOT 0-1 ?? sensor supply, looks weird when off.
SZM 1-4 ?
GZM 1
MSV save settings too eeprom
ASV Saves something aswell?
GCS 0 Get Core status & faults
ALD 0,2? video blanks lots of eeprom activity. reload pixel map??
SAV 0-9999 set Fire threshold
GAV 2100 get Fire Threshold
BAC change uart protocol? careful
CBD Displays Recovery successful?
CBS Displays Saved successfully
LRD Displays Recovery successful?
LRS Displays Saved successfully?
LRE Displays Temperature Repair successful?
CBT Displays Calibration successful?
DBP ??? shutter clicks
DPI Show weird pixels
API Hide weird pixels
CCM ??
ASN 0-4 ??
GAB 4 vals ?? 3,-10,50,150
GAN 1 ??
GAR 11 vals ?? 10,10,5,20,35,50,70,90,120,150,180,,
GCM 6 values ??
GFV prints screen gray value?
GIT 200 ??
GTV Get the collected temp values?
PTS echoes but with extra stuff??
QYA 7170 Query Gray Info (information mode)
QYI 7124 Query Gray Average mode
QYM 7512 Query Gray Minimum mode
VTP 400-4000 ??
MTD U/S,0,0 ?? S answers with bytes, U upload bytes?
MTC U/S? ?? S answers with U,0,0, S doesnt.

return 0 invalid params:
STS ??
STT ??
SAC ??
SAH ??
SAS ??
SAT ??
SCX ?? displays crosshair but invalid params
SCY ?? displays crosshair but invalid params
GAC ??
GAH ??
GAS ??
GAT ??
GME ??
GPC ??
GPI ??
GPM ??
GTA ??
GTC ??
GTI ??
GTM ??
GTS ??
GTT ??

answer only:

BPM 0-1 stream ready? answers with 0 stop, 1 go, 2 when prompted
AVS 0,1
MEH
PWI 0-1 changing palette from wh to fire

unconfirmed (from dm60comm.so):
SDT 2024,03,15,14,30,25 Set Date Time with year,month,day,hour,minute,second
STS 1 Set Temperature Show display (0=off, 1=on)
SVA 2 Set Video Auto mode (0=manual, 2=auto)
SMP 0,1,1,0,100,150,200,250,300,350,90,25 Set Measurement Point (type,index,enable,mode,startX,startY,endX,endY,anchorX,anchorY,threshold,color)
STV Stop Temperature View measurements
SPF 5 Set Profile parameter
SVL -10 Set Video Left pan movement (signed value)
SVU -5 Set Video Up tilt movement (signed value)
SVD 5 Set Video Down tilt movement (signed value)
SSP 17,1,0 Set System Parameter (param_id,value,index) #46 temperature format 0 °C, 1 °F, 2 K
SCP Set Current Preset (save current position)
GCP Get Current Preset
STT 300,350 Set Temperature Threshold (low,high values *10)
SDC 1 Set Display Configuration parameter
GCS Get Current Status
GMM Get Memory Map information
GFV Get Frame Value (grayscale data)
GFZ Get Freeze Status
GSI 1 Get System Information (parameter=1)
GSS Get System Status
GSP 21,0 Get System Parameter (param_21=surround temp, value=0)
GTT Get Temperature Threshold range
GTV 1,3,10 Get Temperature Values (enable,type,count)
GNU Get Network Update status (response command)
FRZ Freeze current display frame
LIV Live mode (unfreeze display)
CAL Calibrate system
CCP 3 Call Current Preset (preset number 0-9)
APF 100 Auto Profile setting
MEH Measure Enhancement
BPT Built-in Test
MTC S,0 Measure Temperature Capture (S=start, 0=sequence)
MTG U,0,1024,<data> Measure Temperature Gray data transfer
MTD U,0,1024,<data> Measure Temperature Data transfer
UFP S,0,2048 Update Firmware Prepare (S=start, 0=offset, 2048=size)
UFD S,0,1024 Update Firmware Data transfer
BAB U Buffer operation (U=update)
TTH S,0 Temperature Threshold operation
IPP 192.168.001.102,255.255.255.000,192.168.001.001,192.168.000.001,9989,9998 IP Parameters (IP,netmask,gateway,DNS,port1,port2)
MAC 00:60:A9:10:00:01 MAC Address setting
SNP Set Network Parameters (response command)
QYI Query Gray Info (information mode)
QYA Query Gray Average mode
QYM Query Gray Minimum mode
GAI Get Alarm Info (response command)
YTC <data> Unknown command with data parameter
HTH
LRS
LRD
GAR
DRC
PTS
SCX
SCY
CBT
LRE
CBD
CBS
XXX
GSP
GTT
QYI
QYA
QYM

</syntaxhighlight>

===Secret Menu Overview===
The secret menus Main and System can be openend with the password '''+-MC+-'''

Its structured like this, not all variables have been figured out yet.

The format is Menu: submenu: submenu:

and for menu entries: Name, default value, command, description or messages that pop up.
 <syntaxhighlight lang="vb">
MAIN & SYSTEM PASS: +-MC+-

entries are NAME VALUE COMMAND DESC or if its a folder its just ":"

System:
System:
Gain 255 SCO
Bright 102 IBR
BenDi 100 ?
BenDiContrase 80 ?
DisMode 0 ?
Frequency 48hz (24,25,48,50)
DigitalOut 8-14bit 14bit, BT656(_P), ?, BT601
AutoFocus N ?
Line 1 ?
Ltemp0 11800 ?
LTemp1 11000 ?
HTemp0 9500 ?
HTemp1 8700 ?
DelayTime 0 ?
Enhance 0-1 ?
Enhanced E1 230 ?
FPA_Gain 12pF ? between 4 and 18 at random.
NUCEn N ?

Area:
SE 2 ASN 0-4 "Partition"
INT 200 INT "Points time"
VS 3161 SVS
VF 2800 SVF
Vtemp 1401 VTP
VtempArea Low ?
VtempBase 13500 ?
VtempStep -1 ?
VsStep 8 ?
DeadPixelModel preset / calculate
DP: Cursor to select dead pixels
X 360 position
Y 288 position
AutoBP: 50 Press C to start automatic dotting
Quit? Number of bad pixels 961& "Blind element replacement in progress"
Undo
R2: Save data? blind pixel replacement in progress
Replace Y N = DPI, Y = API
L: Reading parameters
S: Saving parameters

Debug:
Rectify N
DisplayGary N
TE N SDT
AutoE ? ?
AutoVS Y ?
VSGrayH 8000 ?
VSGrayL 7000 ?
Trends 1 ?
Shelter N ?
MotorCon 3 ?
SaveFactoryPara:
LanTyp EN ? LANGUAGE
DisplayMT N ?
Version:
PRJ D843 DLD640 ImLib, MTlib, Soft, Logic

BackDispose:
GammaEN 1 ?
Gain 1 ?
EnhanceEN 0 ?
Hpf_shift 5 ?
Hpf_thrd 5 ?
Enhance 150 ?
Lthrd 50 ?

Monitor:
Opens normal OSD

Alarm Set:
Alarm Switch Y ?
Alarm Mode No ?
Alarm Temperature -1°C ?
Reference Gray Y ?
Alarm Level 1L ?
Alarm Gray 65535 ?
Alarm PointNum 0 ?
Correct Gray 0 ?

Thermometry:
Data Collection 0 SMS
Interval 60 SCP
Ammount 90 SCT
Environment normal ?
Export:
Displays: Exportin normal temperature MTC data
Correction -1 ?
Emissivity 100 SEM
Calibration:
BlackbodyTemp -10 grabs a val from GAB
Save CBS
Cancel CBD
Correction:
BlackbodyTemp -10 Picks from the list GAR
Grayscale 0 SLG
Confirm LRE
Save LRS
Cancel LRD
Ninepoint measurement SMV

Cursor:
Cur N DRC enable cursor
X 320 SRP set cursor position
Y 240 SRP set cursor position

Main:
Auto 2 SAG Auto gain
G 211 SVC
B 10002 SVB
P 1 SWP polarity
Z X ?
Settings:
Image:
FI Y ?
FIValue 0 ? 0-31
Freeze N Freeze image
VE N SMR Vertical flip
HO N SMR Horizontal flip
AutoCali L same as rectify?
O IN internal or external
COM:
Opens UART menu
AvoidburnSwitch OFF enable anti burn in
ProtectedTime 10S duration
AvoidBurn 16383 threshold to trigger antiburn

</syntaxhighlight>

===Automatic Dead Pixels and Flatmap Correction===

It it possible to generate a new flat and dead pixel map automatically within the camera after flashing the cleared-map binary.
 

=====Dead pixels:=====
In the secret menu "System", navigate to Debug - DeadPixelModel and set the AutoBP (sensitivity for auto bad pixel finding) to 50 or so. Then press C Button

This can take a while.
[[File:High emissivity peltier black body.jpg|thumb|A Peltier / TEC coated in Candle sood to give it a high emissivity surface. It can be cooled or heated by swapping the polarity. ]]

Afterwards, navigate to S: and press + to save it.
 

=====Flatfield:=====
In the Debug menu navigate to R2 and press +

now place something '''Cold''' infront of the Camera with a high emissivity. (it needs to fill the whole image)

Press '''+''', wait for it to says High temperature.

Place something '''Hot''' infront and press '''+''' again.

Afterwards, save with '''S:''' again.

Flatfield should now be calibrated
 <blockquote>Note: Not all dead pixels are auto detected or get removed. you can manually select them in the Dead pixel editor but its not known yet how to select and correct them.</blockquote>

 

===Using the Thermal module without Webserver===
[[File:Dali D8X3C Breakout board.png|thumb|Breakout board for D8X3C ]]
to use it, you need to interface it directly.

The module will put out a Analog video signal (High-Z, need to buffer when connecting it to 75Ohm Video input)

Also a 8 or 14bit or 8-bit BT656 output.

the header exposes the FPGA JTAG and UART aswell as 6 Hardware Keys to Navigate the OSD.

To interface, you need to make a adapter board with a DF12-50DS-0.5V(86) Docking socket.

The breakout board files can be found [https://oshwlab.com/gamerpaddy/d8x3c-backpack-usb here] but may be still work in progress.

 

===Sensor Pinout===
[[File:Dali DLD384 Sensor pinout basic.png|thumb|basic pinout of a DLD384]]
the pinout of the thermal sensor havent been analyzes much.

besides some supply and Control voltages, 3 clocks and a analog output have been found.

17.5MHz

14.705KHz

50Hz

Dali D8X3N Thermal Camera

2025-08-03T19:33:11Z

Gamerpaddy: added secret menu tree

==Dali D8X3N Thermal Camera Reverse Engineering==
 

===Introduction===
The [https://www.dali-irtech.com/productinfo/741567.html Dali D8X3N] Thermal Camera module comes in two versions, a 384x288 and 640x480 resolution, utilizing the [http://www.dali-tech.us/products/dld64017m-uncooled-infrared-fpa-detector-86.html DLD Series] of amorphous-Silicon Microbolometers.

They were mainly used in [http://www.dali-tech.us/products/dm60-w--online-body-temperature-thermal-imaging-camera-55.html Dali DM60-W] or WS-1 Body Temperature screening cameras in conjunction with a Black Body radiator set to 37°C to detect infected individuals at the start of the 2020 Covid Pandemic.
[[File:ICI FM320P Innerts.jpg|thumb|Internals. A TP-Link Switch, HikVision Visible Camera and the D8x3N Network thermal camera module]]
[https://infraredcameras.com/ ICI] rebranded these models as FM 320 P and FM 640 P, and distributed them on the local US market, but as the need for such Cameras exploded, those models were built with what was in stock.

So happens, that some of the FM 320 P Models had a DLD640 640x480 instead of a DLD384 384x288 Microbolometer in them, and just got their Firmware modified.

It also could be, because they have excessive amounts of bad pixels outside the 384x288 area, that they were binned to a lower grade.

Discussions about these Cameras started around 2022 in the [https://www.eevblog.com/forum/thermal-imaging/ici-and-dali-thermal-camera-software/ EEVBlog Forums.] when they started to appear secondhand and affordable.

Originally they were priced around US$ 20... 30.000 by ICI, and a unknown amount by Dali Tech.

The Modules specs according to the manufacturer are:

≤50..60mK@F1，300K，50Hz

17 or 25µm pixel pitch

Hisilicon SoC running Linux to provide Onvif and RTSP streams, analysis and a Web UI

 
[[File:Dali D8X3N Module.jpg|thumb|A real 384x288 model with a DLD384 sensor. notice the Productnumber ]]
ICI FM Cameras are found all over Online secondhand marketplaces for scrap Prices, as they are no longer needed.

But you never know, what are you getting. It could be a real DLD384 or the better DLD640 inside. Its a gamble.
 

======640x480 Imagers======
are labeled 22D843 Nxxxx and have a DLD640 sensor in it, they can be upgraded if they run the 384x288 firmware.

======384x288 Imagers======
are labeled 22D883Nxxxx and have a DLD384 sensor in it, they cannot be upgraded

 

===D8X3N Module closer look===
From now on, i will refer to the Thermal Imaging Module as TIM

On the front there is a 2 Element Germanium Lens of a unknown focal length and aperture.

It can be focus-adjusted when unscrewing the clamp around the housing. It can be focussed from infinity down to 10..20cm with some quality loss.
 The outter diameter of the Lens is 42mm with a 1 1/3 inch thread diameter of undetermined pitch.

Dimensions of the germanium elements are 21mm to 3 and 6mm and 14grams in weight.
[[File:Disassembled Thermal Camera Lens.jpg|thumb|Two element Germanium Lens of unknown focal length and aperture]]

The TIM is composed of 6 Stacked PCB modules, 3 of which are for the Web Server functionality. taking them off will give you the basic configuration of a [https://www.dalithermal.com/productinfo/741568.html Dali D8X3C] TIM<gallery>
File:Dali DLD640 Thermal Image Sensor.jpeg|DLD640 Sensor
File:Dali DLD384 Thermal Imaging Sensor.jpeg|DLD384 Sensor
File:Dali D8X3N Board1 Back.jpeg|Network & GPIO Board Back
File:Dali D8X3N Board1 Front.jpeg|Network & GPIO Board Front
File:Dali D8X3N Glue Board Back.jpeg|Board between Logic and IO Back
File:Dali D8X3N Glue Board Front.jpeg|Board between Logic and IO Front
File:Dali D8X3N SoC Board Back.jpeg|SoC Board back
File:Dali D8X3N SoC Board front.jpeg|SoC board front
File:Dali D8X3N FPGA Board Back.jpeg|FPGA Board of the D8X3C Thermal Imager including a PMIC
File:Dali D8X3N FPGA Board Front.jpeg|FPGA Board Front with Video DAC and SPI Flash
File:Dali D8X3N Sensor Power and ADC Board.jpeg|Sensor control and ADC board
File:Dali D8X3N Thermal Core Debug wiring.jpeg|Debug wiring for sniffing SPI and UART
</gallery>

===User Manual===
including pinout diagram and important data

can be found here https://archive.org/details/dali-d-8-x-3-cuser-manualen-v-1.0-1

===Viewing the Video Stream===
[[File:Onvif Device Manager ODM.png|thumb|ODM streaming the Thermal view]]
when first connecting it to power and Ethernet, the camera will have 192.168.1.102 as a Static ip.

If you are running a 192.168.0.x or .178.x net, you need to change it or add a subnet under windows ipv4 settings.

to view it, you can use VLC and the stream URL
rtsp://admin@admin:<camera ip>/ONVIFMedia
there is /ONVIFMedia /ONVIFMediaM and /ONVIFMediaS for different stream Profiles.

VLC is quite slow and delayed, rather use Onvif Device Manager ODM,

it has no delay and auto-detects cameras in the network.

Be sure to log in as user: admin pass: admin in ODM.

in there, you can also set you camera to DHCP under Network settings.

===Web Interface===
[[File:Dali D8X3N web interface.png|thumb|Since browsers cant display RTSP anymore, open in Edge and select IE Compatibility Mode.]]
the web interface can be accessed by opening the camera IP in a browser

login is:
user: admin pass: admin
You can set Temperature markers and areas, but without using the Black Body calibration source, your readings may be way off or not working.

 

====OSD====
there is a debug-login with
user: super pass: 871897
that lets you send Key commands to the Imager to navigate the OSD.

Setting the OSD to english is accomplished with option #11
[[File:Dali D8X3C OSD.png|thumb|OSD in english, if yours is Chinese. go to option #11 and click + or -]]

To acces some locked menus, press
+ - + - + -

The password for the locked System and Main menu is
+-MC+-

Be careful in the UART menu to not change the BAUD rate or Protocol, as your ability to control it via the Web API gets lost.

You need to reflash or solder buttons on the thermal core then.

===Viewing Raw Thermal Data from the Web API===
there is a hidden endpoint in the stream.so file that could be found while decompiling

accessing
[[File:Arduino Nano blink sketch thermal gif.gif|thumb|Arduino Nano running blink sketch while thermally recording it, notice the led and resistor on the right]]
<ip of camera>:5000/stream?Type=JPEG&Source=Jpeg&Mode=TCP
lets you download a JPEG. but there are more options available (not all have been tested)

we are mainly interessted in Raw thermal data.

======'''Source''' (Stream Type)======

*<code>Major</code> - Main video stream (channel 0)
*<code>Minor</code> - Sub video stream (channel 1)
*<code>MinorAV</code> - Sub video + audio stream
*<code>MajorAV</code> - Main video + audio stream
*<code>Jpeg</code> - JPEG snapshot stream
*<code>Raw</code> - Raw thermal data stream
*<code>YUV</code> - YUV raw video stream

======'''Type''' (Data Format)======

*<code>H264</code> - H.264 video encoding
*<code>JPEG</code> - JPEG image format
*<code>RAW</code> - Raw sensor data
*<code>QBOX</code> - Custom protocol format
*<code>FRAME</code> - Frame-based format

======'''Mode''' (Transport Protocol)======

*<code>TCP</code> - TCP streaming (default)
*<code>UDP</code> - UDP streaming
*<code>MUL</code> - Multicast streaming

======'''Quality Parameters'''======

*<code>Quality=[1-100]</code> - Video quality level
*<code>Frames=[number]</code> - Number of frames to send
*<code>Interval=[ms]</code> - Frame interval in milliseconds

======'''Network Parameters'''======

*<code>IPAddr=[ip]</code> - Client IP address for UDP/multicast
*<code>Port=[port]</code> - Client port for UDP/multicast
*<code>Heart-beat=[Yes/No]</code> - Enable/disable heartbeat

======'''Snapshot Parameters'''======

*[[File:Dali D8X3N Raw Thermal viewer.png|thumb|Raw Data Viewer in python]]<code>Snap=[Yes/No]</code> - Enable snapshot mode

To view the raw stream, i made a python program that converts the 14bit thermal data to a visible image.

it is low fps tho, due to bad optimizations.

https://pastebin.com/dyNWDPT3

===Getting Root Terminal Access===
To access the Terminal you need to solder or plug in a UART connection to Connector J7 on the "Glue" board.

Pinout is (left to right) '''RX TX GND 3.3V Baud 115200 3.3V!'''

But the system will spam with debug messages, making patching the files a hard job unless you use "tftp" or "sed" commands.
 

===(optional) Enabling Telnet access to make patching easier===
[[File:Upgrade ici dali firmware updater.png|thumb|ICI Firmware updater software with modified firmware loaded]]

there is a easier way using a modified Firmware updater to enable Telnet temporarily to patch the Files.

Download the '''upgrade_ici.exe''' form [https://archive.org/details/fwupdate here] and run it.

Then you should be able to connect to it via Telnet.

The Login credentials are '''User: roo'''t '''Password: DLroot'''

===Patching the Web Server===
This only works if you also patch the Thermal Camera module flash!

====to permanently enable Telnet, go to '''/etc/init.d''' and edit '''S90app'''====
vi S90app
in vi, move your cursor to the '''#''' at '''#telnetd''' and press x<blockquote>optional: enable ftp by removing the '''#''' at '''ftpd''' and adjust the path to / </blockquote>now press ''':''' and type '''wq''' and hit '''enter'''. this should be it.

 

====patching the decoder and streamer to 640x480:====
go to /app and edit the mach.cfg

replace DL384 with D640 and edit the resolution to 640 480

(press i in vi to enter edit mode, press ESC to exit edit mode. :wq to write and quit.)

repeat that procedure for the dali.cfg

===== (optional) patching app.sh to prevent it from rebooting =====
edit the app.sh in /app and remove all "reboot" occasions to prevent the camera from rebooting if onvifserver, httpd or daliServer arent running for debugging purposes.

===Patching the Thermal Camera module===
To patch it, you need to disassemble everything down to the FPGA Board,

on the bottom there is a SPI SOIC8 Flash.

Use a CH341 EEPROM programmer (be sure to have a fixed or modified version to not put out 5V!, set it to 3.3V) and SOIC8 clamp.

Use NeoProgrammer (i used 2.2.0.10 but there are newer available, use the latest) and click Detect. It should find W25Q128 chips, select the FV one.

Dont forget to download a backup of your flash and save it !

Download the Binary "Dali 640x480 '''actual''' cleared pixelmap.bin" from #3 below and load it into NeoProgrammer,

Click Erase, Program and Verify.

This can take a while.

Your imager should start up right after assembly by hearing the shutter click.

 

===Flash Contents===
On archive, click on show all files to download them.

<nowiki>#</nowiki>1 a Flash dump of the original downgraded D8X3N can be found [https://archive.org/details/dali-d-843n-flash-dump here]

<nowiki>#</nowiki>2 a Flash dump of a original 640x480 model can be found [https://archive.org/details/d-843-n-640x-480 here]

<nowiki>#</nowiki>3 a modified Flash dump of a 640x480 with cleared dead pixel map, flat map etc. can be found [https://archive.org/details/d-843-n-640x-480-cleared-pixelmap here]

a Flash dump of the web server SPI flash W25Q256JV can be found [https://archive.org/details/dm-60-webserver-flash-dump here] in case a bad firmware update caused a bootloop.

 

===Flash Binary Analysis===
The Flash IC is a Winbond 25Q128JV SPI Flash that contains the FPGA Bitstream, Deadpixel and Flatmap, aswell as the Device Settings.

a copy of the SPI Logic Capture at startup can be found [https://archive.org/details/dali-eeprom-capture here], the free software [https://www.dreamsourcelab.com/download/ DSView from DreamSourceLab] is required to view it.
[[File:Dali Thermal Imager SPI Flash capture.png|thumb|SPI Flash access while booting the Thermal Module]]

a approximation of the offsets resulted in this list:<syntaxhighlight lang="vb">
0x000000 - altera cyclone iv stuff
0x200000 - settings
0x280000 - Flat field correction map
0x4C0000 - Bad Pixel correctio nmap
0x580000 - image aswell? 36010 bytes
0x740000 - GUIX?
0x7C0000 - Strings for Gui?
0x800000 - another shorter GUIX
0x880000 - Strings for second gui?
0x8C0000 - GUIX
0x940000 - Strings for gui
0xE00000 - ?
0xE80000 - dzxg? short
0xEC0000 - crosshair.bmp
0xF40000 - 3DTM?
0xF80000 - fake? Bad pixel map BPRP
</syntaxhighlight> 

====Settings offset 0x200000====
The settings are read and written every startup, aswell when you close the OSD, sporadically and when executing the command MSV

these are some of the settings i could figure out by changing and watching the logic capture what changed.
 <syntaxhighlight lang="vb">
offset size Cmd
0x0 1 SAG (0-2) auto gain
0x2 2 SVB (0-16383) saved value is 16383 - SVB
0x4 2 SVC (0-1023) set exposure or gain
0x6 1 SSM image filtering
0x8 1 SEH image enhancement
0xA 1 SWP invert b/w polarity
0x14 1 SMR Flip
0x16 1 SMR Mirror
0x20 1 MENU Cal source 0 IN, 1 OUT
0x3A 1 MENU Enhance value 0-100
0x40 1 MENU Rectify (shutter 0 OFF, 1 L, 2 H)
0x50 1 MENU Language 0 english, 1 chinese, 2 russian
0xA2 - SCO set contrast gain
0xA4 - IBR set brightness
0xAE 2 MENU Fire Threshold
0xAC 1 SPA set color palette
0xE2 1 SMS display "collected 0/80" enabled
0xF8 1 SEM set emissivity
0x110 1 SRT set revise temp
0x116 1 SHD set humidity
0x118 1 SET set ambient temp
0x11A 1 STD set temp range
0x120 2 SLG -500 to 500?
0x124 2 SRD set distance
0x12C 1 SCP ???
0x130 2 SCT ???
</syntaxhighlight> 
[[File:Dali D8X3N Bad Pixel Map Viewer.png|thumb|Bad pixel map of a 640x512 sensor, about 0.56% of dead pixels in this map]]
So i let the AI create a [https://2476424.playcode.io/ Configurator page] that lets you change the Settings in your Flashdump to your liking
 

======Bad Pixel and Flatframe Maps 0x280000 and 0x4C0000======
Thermal cameras require a bad pixel and flat frame map to compensate for manufacturing inconsistencies.

unfourtainly, the maps of the downgraded cameras only contain enough data for a 384 model, not the full 640.

at offset 0xF80000 there is a BPRP which was mistaken at first as the Bad pixel map, it could just be a mask to where to apply the offset maps, as its either 0x0 or 0x1.

The [https://2477569.playcode.io/ Viewer Page] is written in JS and does not require any special dependencies, it can run as a plain html file offline.

There still needs to be work done to create own maps and flatfields but the cameras are still very capable and useable with fully cleared maps.

To clear the maps, just go to these offsets and fill with values around 0x3F or 0x0 for total length of X Resolution x Y Resolution x 2 bytes (0x96000 for 640x480)

[[File:Dali D8X3N Flat Field Map Viewer.png|thumb|Flat Field viewer]]

===Dali Commands===
To control the TIM you can either use Pelco or Dali command set. By default the Dali commandset is used at 38400 BAUD.

Those commands consist of a 0x02 start byte followed by two length Bytes, then the actual command which is allways 3 uppercase Letters in ASCII (eg. KBD for keyboard) followed by a comma and the values.

Some commands take multiple values, some dont. But you allways have to send the comma after the Command.

The camera will answer with the Command and 0, 1 or 2. Sending no value counts as zero.
0 is invalid parameters, too few or out of range

1 is OK, valid command

2 is Invalid command

Commands can be sent trough the Web server using the URL Api endpoint or directly trough the UART port.

(keyboard, C button, causes the shutter to do a calibration)
<camera ip>/cgi-bin/dmcmd?Command=KBD,C
Listening to the answer can be done while being in the Linux shell and typing
cat /dev/ttyAMA2 | strings

By bruteforcing the UART with AAA to ZZZ a list of Commands could be obtained, but some with unknown Parameters or functionality yet. including some from a decompiled DM60comm.so module found in /app/modules folder.<syntaxhighlight lang="vb">
KBD KEY Keyboard (F S M C + -)
SSM 0-1 Image Filtering Off/On
GSM 0 Image filter status
SEH 0-1 Image Enhancement Off/On
GEH 0-1 Image enhancer status
SCO 0-255 Set Gain (locked when SAG auto gain is on)
GCO 0-255 Get gain
INT 15-320 set actual gain? not just contrast sometimes disabled?
IBR 0-255 Set brightness
GBR 0-255 Get brightness
SMR 0-3 Mirror mode bit0=horizontal, bit1=vertical
GMR 0 Get rotation/flip
SDT 0-1 displays temp=44.65°C osd, but webserver sends date/time to the cam there....
GDT 0-1 Get temp display active?
GPT Display temp oft SDT
GNU 0-1 Get Shutter closed/open
SNU 0-1 Shutter close / open
STD 0-1 Set Range 0: -20-180°C 1: 100-600°C
GTD 0-1 Get Range
SET °C Set Ambient temperature
GET °C Get Ambient temperature
SEM 0-100 0-1 set emissivity x100
GEM 0-100 Get Emissivity
SRT °C Set revise temperature -100-100 -10-10°
GRT °C Get revise temperature
SRD 100 Set Distance 4.4m x100
GRD 100 Get Distance
SHD 0-100 Set Humidity
GHD 55 Get Humidity
SWP 0-1 invert s/w polarity image
GWP 1 is inverted?
SPA 0-10? Set color palette
GPA 3 white hot
SMV 0-1 Show temperature 3x3 grid?? in combination with GTV maybe
GMV 0
SMS 0-1 displays "collected 0/<number set by SCT>" by SCP delay "saves the daily number of highest temperatures?"
GMS 0
SCT 1-500 sets the amount of "collected" points for SMS
GCT 80
SCP 5-60 "collected" delay in seconds for SMS
GCP 60
SAG 0-2 Auto brightness / gain
GAG 0
SLR 0-9 ???
GLR 0
SRP 0,0 - 639,479 set crosshair position
GRP 320,240 get crosshair position
DRC 0-1 Show crosshair
SLG -500-500 ??
GLG
SCE text ??
GCE 0
SCB text ??
GCB 0
SVB 0-16383 adc offset, exposure? good at 9650
GVB 6733 value is 16383 minus SVB
SVC 1-1023 set contrast but better
GVC 260
SVF 100-? ?? video freaks out 3400 seems good
SVS 100-? ?? video freaks out 3300 seems good
SOT 0-1 ?? sensor supply, looks weird when off.
SZM 1-4 ?
GZM 1
MSV save settings too eeprom
ASV Saves something aswell?
GCS 0 Get Core status & faults
ALD 0,2? video blanks lots of eeprom activity. reload pixel map??
SAV 0-9999 set Fire threshold
GAV 2100 get Fire Threshold
BAC change uart protocol? careful
CBD Displays Recovery successful?
CBS Displays Saved successfully
LRD Displays Recovery successful?
LRS Displays Saved successfully?
LRE Displays Temperature Repair successful?
CBT Displays Calibration successful?
DBP ??? shutter clicks
DPI Show weird pixels
API Hide weird pixels
CCM ??
ASN 0-4 ??
GAB 4 vals ?? 3,-10,50,150
GAN 1 ??
GAR 11 vals ?? 10,10,5,20,35,50,70,90,120,150,180,,
GCM 6 values ??
GFV prints screen gray value?
GIT 200 ??
GTV Get the collected temp values?
PTS echoes but with extra stuff??
QYA 7170 Query Gray Info (information mode)
QYI 7124 Query Gray Average mode
QYM 7512 Query Gray Minimum mode
VTP 400-4000 ??
MTD U/S,0,0 ?? S answers with bytes, U upload bytes?
MTC U/S? ?? S answers with U,0,0, S doesnt.

return 0 invalid params:
STS ??
STT ??
SAC ??
SAH ??
SAS ??
SAT ??
SCX ?? displays crosshair but invalid params
SCY ?? displays crosshair but invalid params
GAC ??
GAH ??
GAS ??
GAT ??
GME ??
GPC ??
GPI ??
GPM ??
GTA ??
GTC ??
GTI ??
GTM ??
GTS ??
GTT ??

answer only:

BPM 0-1 stream ready? answers with 0 stop, 1 go, 2 when prompted
AVS 0,1
MEH
PWI 0-1 changing palette from wh to fire

unconfirmed (from dm60comm.so):
SDT 2024,03,15,14,30,25 Set Date Time with year,month,day,hour,minute,second
STS 1 Set Temperature Show display (0=off, 1=on)
SVA 2 Set Video Auto mode (0=manual, 2=auto)
SMP 0,1,1,0,100,150,200,250,300,350,90,25 Set Measurement Point (type,index,enable,mode,startX,startY,endX,endY,anchorX,anchorY,threshold,color)
STV Stop Temperature View measurements
SPF 5 Set Profile parameter
SVL -10 Set Video Left pan movement (signed value)
SVU -5 Set Video Up tilt movement (signed value)
SVD 5 Set Video Down tilt movement (signed value)
SSP 17,1,0 Set System Parameter (param_id,value,index) #46 temperature format 0 °C, 1 °F, 2 K
SCP Set Current Preset (save current position)
GCP Get Current Preset
STT 300,350 Set Temperature Threshold (low,high values *10)
SDC 1 Set Display Configuration parameter
GCS Get Current Status
GMM Get Memory Map information
GFV Get Frame Value (grayscale data)
GFZ Get Freeze Status
GSI 1 Get System Information (parameter=1)
GSS Get System Status
GSP 21,0 Get System Parameter (param_21=surround temp, value=0)
GTT Get Temperature Threshold range
GTV 1,3,10 Get Temperature Values (enable,type,count)
GNU Get Network Update status (response command)
FRZ Freeze current display frame
LIV Live mode (unfreeze display)
CAL Calibrate system
CCP 3 Call Current Preset (preset number 0-9)
APF 100 Auto Profile setting
MEH Measure Enhancement
BPT Built-in Test
MTC S,0 Measure Temperature Capture (S=start, 0=sequence)
MTG U,0,1024,<data> Measure Temperature Gray data transfer
MTD U,0,1024,<data> Measure Temperature Data transfer
UFP S,0,2048 Update Firmware Prepare (S=start, 0=offset, 2048=size)
UFD S,0,1024 Update Firmware Data transfer
BAB U Buffer operation (U=update)
TTH S,0 Temperature Threshold operation
IPP 192.168.001.102,255.255.255.000,192.168.001.001,192.168.000.001,9989,9998 IP Parameters (IP,netmask,gateway,DNS,port1,port2)
MAC 00:60:A9:10:00:01 MAC Address setting
SNP Set Network Parameters (response command)
QYI Query Gray Info (information mode)
QYA Query Gray Average mode
QYM Query Gray Minimum mode
GAI Get Alarm Info (response command)
YTC <data> Unknown command with data parameter
HTH
LRS
LRD
GAR
DRC
PTS
SCX
SCY
CBT
LRE
CBD
CBS
XXX
GSP
GTT
QYI
QYA
QYM

</syntaxhighlight>

=== Secret Menu Overview ===
The secret menus Main and System can be openend with the password '''+-MC+-'''

Its structured like this, not all variables have been figured out yet.

The format is Menu: submenu: submenu:

and for menu entries: Name, default value, command, description or messages that pop up.
 <syntaxhighlight lang="vb">
MAIN & SYSTEM PASS: +-MC+-

entries are NAME VALUE COMMAND DESC or if its a folder its just ":"

System:
System:
Gain 255 SCO
Bright 102 IBR
BenDi 100 ?
BenDiContrase 80 ?
DisMode 0 ?
Frequency 48hz (24,25,48,50)
DigitalOut 8-14bit 14bit, BT656(_P), ?, BT601
AutoFocus N ?
Line 1 ?
Ltemp0 11800 ?
LTemp1 11000 ?
HTemp0 9500 ?
HTemp1 8700 ?
DelayTime 0 ?
Enhance 0-1 ?
Enhanced E1 230 ?
FPA_Gain 12pF ? between 4 and 18 at random.
NUCEn N ?

Area:
SE 2 ASN 0-4 "Partition"
INT 200 INT "Points time"
VS 3161 SVS
VF 2800 SVF
Vtemp 1401 VTP
VtempArea Low ?
VtempBase 13500 ?
VtempStep -1 ?
VsStep 8 ?
DeadPixelModel preset / calculate
DP: Cursor to select dead pixels
X 360 position
Y 288 position
AutoBP: 50 Press C to start automatic dotting
Quit? Number of bad pixels 961& "Blind element replacement in progress"
Undo
R2: Save data? blind pixel replacement in progress
Replace Y N = DPI, Y = API
L: Reading parameters
S: Saving parameters

Debug:
Rectify N
DisplayGary N
TE N SDT
AutoE ? ?
AutoVS Y ?
VSGrayH 8000 ?
VSGrayL 7000 ?
Trends 1 ?
Shelter N ?
MotorCon 3 ?
SaveFactoryPara:
LanTyp EN ? LANGUAGE
DisplayMT N ?
Version:
PRJ D843 DLD640 ImLib, MTlib, Soft, Logic

BackDispose:
GammaEN 1 ?
Gain 1 ?
EnhanceEN 0 ?
Hpf_shift 5 ?
Hpf_thrd 5 ?
Enhance 150 ?
Lthrd 50 ?

Monitor:
Opens normal OSD

Alarm Set:
Alarm Switch Y ?
Alarm Mode No ?
Alarm Temperature -1°C ?
Reference Gray Y ?
Alarm Level 1L ?
Alarm Gray 65535 ?
Alarm PointNum 0 ?
Correct Gray 0 ?

Thermometry:
Data Collection 0 SMS
Interval 60 SCP
Ammount 90 SCT
Environment normal ?
Export:
Displays: Exportin normal temperature MTC data
Correction -1 ?
Emissivity 100 SEM
Calibration:
BlackbodyTemp -10 grabs a val from GAB
Save CBS
Cancel CBD
Correction:
BlackbodyTemp -10 Picks from the list GAR
Grayscale 0 SLG
Confirm LRE
Save LRS
Cancel LRD
Ninepoint measurement SMV

Cursor:
Cur N DRC enable cursor
X 320 SRP set cursor position
Y 240 SRP set cursor position

Main:
Auto 2 SAG Auto gain
G 211 SVC
B 10002 SVB
P 1 SWP polarity
Z X ?
Settings:
Image:
FI Y ?
FIValue 0 ? 0-31
Freeze N Freeze image
VE N SMR Vertical flip
HO N SMR Horizontal flip
AutoCali L same as rectify?
O IN internal or external
COM:
Opens UART menu
AvoidburnSwitch OFF enable anti burn in
ProtectedTime 10S duration
AvoidBurn 16383 threshold to trigger antiburn

</syntaxhighlight>

=== Automatic Dead Pixels and Flatmap Correction ===

It it possible to generate a new flat and dead pixel map automatically within the camera after flashing the cleared-map binary.
 

===== Dead pixels: =====
In the secret menu "System", navigate to Debug - DeadPixelModel and set the AutoBP (sensitivity for auto bad pixel finding) to 50 or so. Then press C Button

This can take a while.
[[File:High emissivity peltier black body.jpg|thumb|A Peltier / TEC coated in Candle sood to give it a high emissivity surface. It can be cooled or heated by swapping the polarity. ]]

Afterwards, navigate to S: and press + to save it.
 

===== Flatfield: =====
In the Debug menu navigate to R2 and press +

now place something '''Cold''' infront of the Camera with a high emissivity. (it needs to fill the whole image)

Press '''+''', wait for it to says High temperature.

Place something '''Hot''' infront and press '''+''' again.

Afterwards, save with '''S:''' again.

Flatfield should now be calibrated
 <blockquote>Note: Not all dead pixels are auto detected or get removed. you can manually select them in the Dead pixel editor but its not known yet how to select and correct them.</blockquote>

 

===Using the Thermal module without Webserver===
[[File:Dali D8X3C Breakout board.png|thumb|Breakout board for D8X3C ]]
to use it, you need to interface it directly.

The module will put out a Analog video signal (High-Z, need to buffer when connecting it to 75Ohm Video input)

Also a 8 or 14bit or 8-bit BT656 output.

the header exposes the FPGA JTAG and UART aswell as 6 Hardware Keys to Navigate the OSD.

To interface, you need to make a adapter board with a DF12-50DS-0.5V(86) Docking socket.

The breakout board files can be found [https://oshwlab.com/gamerpaddy/d8x3c-backpack-usb here] but may be still work in progress.

 

===Sensor Pinout===
[[File:Dali DLD384 Sensor pinout basic.png|thumb|basic pinout of a DLD384]]
the pinout of the thermal sensor havent been analyzes much.

besides some supply and Control voltages, 3 clocks and a analog output have been found.

17.5MHz

14.705KHz

50Hz

File:High emissivity peltier black body.jpg

2025-08-03T19:22:27Z

Gamerpaddy:

Peltier with high emissivity coating for thermal calibration

Dali D8X3N Thermal Camera

2025-08-03T16:56:49Z

Gamerpaddy: /* Patching the Thermal Camera module */

==Dali D8X3N Thermal Camera Reverse Engineering==
 

===Introduction===
The [https://www.dali-irtech.com/productinfo/741567.html Dali D8X3N] Thermal Camera module comes in two versions, a 384x288 and 640x480 resolution, utilizing the [http://www.dali-tech.us/products/dld64017m-uncooled-infrared-fpa-detector-86.html DLD Series] of amorphous-Silicon Microbolometers.

They were mainly used in [http://www.dali-tech.us/products/dm60-w--online-body-temperature-thermal-imaging-camera-55.html Dali DM60-W] or WS-1 Body Temperature screening cameras in conjunction with a Black Body radiator set to 37°C to detect infected individuals at the start of the 2020 Covid Pandemic.
[[File:ICI FM320P Innerts.jpg|thumb|Internals. A TP-Link Switch, HikVision Visible Camera and the D8x3N Network thermal camera module]]
[https://infraredcameras.com/ ICI] rebranded these models as FM 320 P and FM 640 P, and distributed them on the local US market, but as the need for such Cameras exploded, those models were built with what was in stock.

So happens, that some of the FM 320 P Models had a DLD640 640x480 instead of a DLD384 384x288 Microbolometer in them, and just got their Firmware modified.

It also could be, because they have excessive amounts of bad pixels outside the 384x288 area, that they were binned to a lower grade.

Discussions about these Cameras started around 2022 in the [https://www.eevblog.com/forum/thermal-imaging/ici-and-dali-thermal-camera-software/ EEVBlog Forums.] when they started to appear secondhand and affordable.

Originally they were priced around US$ 20... 30.000 by ICI, and a unknown amount by Dali Tech.

The Modules specs according to the manufacturer are:

≤50..60mK@F1，300K，50Hz

17 or 25µm pixel pitch

Hisilicon SoC running Linux to provide Onvif and RTSP streams, analysis and a Web UI

 
[[File:Dali D8X3N Module.jpg|thumb|A real 384x288 model with a DLD384 sensor. notice the Productnumber ]]
ICI FM Cameras are found all over Online secondhand marketplaces for scrap Prices, as they are no longer needed.

But you never know, what are you getting. It could be a real DLD384 or the better DLD640 inside. Its a gamble.
 

======640x480 Imagers======
are labeled 22D843 Nxxxx and have a DLD640 sensor in it, they can be upgraded if they run the 384x288 firmware.

======384x288 Imagers======
are labeled 22D883Nxxxx and have a DLD384 sensor in it, they cannot be upgraded

 

===D8X3N Module closer look===
From now on, i will refer to the Thermal Imaging Module as TIM

On the front there is a 2 Element Germanium Lens of a unknown focal length and aperture.

It can be focus-adjusted when unscrewing the clamp around the housing. It can be focussed from infinity down to 10..20cm with some quality loss.
 The outter diameter of the Lens is 42mm with a 1 1/3 inch thread diameter of undetermined pitch.

Dimensions of the germanium elements are 21mm to 3 and 6mm and 14grams in weight.
[[File:Disassembled Thermal Camera Lens.jpg|thumb|Two element Germanium Lens of unknown focal length and aperture]]

The TIM is composed of 6 Stacked PCB modules, 3 of which are for the Web Server functionality. taking them off will give you the basic configuration of a [https://www.dalithermal.com/productinfo/741568.html Dali D8X3C] TIM<gallery>
File:Dali DLD640 Thermal Image Sensor.jpeg|DLD640 Sensor
File:Dali DLD384 Thermal Imaging Sensor.jpeg|DLD384 Sensor
File:Dali D8X3N Board1 Back.jpeg|Network & GPIO Board Back
File:Dali D8X3N Board1 Front.jpeg|Network & GPIO Board Front
File:Dali D8X3N Glue Board Back.jpeg|Board between Logic and IO Back
File:Dali D8X3N Glue Board Front.jpeg|Board between Logic and IO Front
File:Dali D8X3N SoC Board Back.jpeg|SoC Board back
File:Dali D8X3N SoC Board front.jpeg|SoC board front
File:Dali D8X3N FPGA Board Back.jpeg|FPGA Board of the D8X3C Thermal Imager including a PMIC
File:Dali D8X3N FPGA Board Front.jpeg|FPGA Board Front with Video DAC and SPI Flash
File:Dali D8X3N Sensor Power and ADC Board.jpeg|Sensor control and ADC board
File:Dali D8X3N Thermal Core Debug wiring.jpeg|Debug wiring for sniffing SPI and UART
</gallery>

===User Manual===
including pinout diagram and important data

can be found here https://archive.org/details/dali-d-8-x-3-cuser-manualen-v-1.0-1

===Viewing the Video Stream===
[[File:Onvif Device Manager ODM.png|thumb|ODM streaming the Thermal view]]
when first connecting it to power and Ethernet, the camera will have 192.168.1.102 as a Static ip.

If you are running a 192.168.0.x or .178.x net, you need to change it or add a subnet under windows ipv4 settings.

to view it, you can use VLC and the stream URL
rtsp://admin@admin:<camera ip>/ONVIFMedia
there is /ONVIFMedia /ONVIFMediaM and /ONVIFMediaS for different stream Profiles.

VLC is quite slow and delayed, rather use Onvif Device Manager ODM,

it has no delay and auto-detects cameras in the network.

Be sure to log in as user: admin pass: admin in ODM.

in there, you can also set you camera to DHCP under Network settings.

===Web Interface===
[[File:Dali D8X3N web interface.png|thumb|Since browsers cant display RTSP anymore, open in Edge and select IE Compatibility Mode.]]
the web interface can be accessed by opening the camera IP in a browser

login is:
user: admin pass: admin
You can set Temperature markers and areas, but without using the Black Body calibration source, your readings may be way off or not working.

 

====OSD====
there is a debug-login with
user: super pass: 871897
that lets you send Key commands to the Imager to navigate the OSD.

Setting the OSD to english is accomplished with option #11
[[File:Dali D8X3C OSD.png|thumb|OSD in english, if yours is Chinese. go to option #11 and click + or -]]

To acces some locked menus, press
+ - + - + -

The password for the locked System and Main menu is
+-MC+-

Be careful in the UART menu to not change the BAUD rate or Protocol, as your ability to control it via the Web API gets lost.

You need to reflash or solder buttons on the thermal core then.

===Viewing Raw Thermal Data from the Web API===
there is a hidden endpoint in the stream.so file that could be found while decompiling

accessing
[[File:Arduino Nano blink sketch thermal gif.gif|thumb|Arduino Nano running blink sketch while thermally recording it, notice the led and resistor on the right]]
<ip of camera>:5000/stream?Type=JPEG&Source=Jpeg&Mode=TCP
lets you download a JPEG. but there are more options available (not all have been tested)

we are mainly interessted in Raw thermal data.

======'''Source''' (Stream Type)======

*<code>Major</code> - Main video stream (channel 0)
*<code>Minor</code> - Sub video stream (channel 1)
*<code>MinorAV</code> - Sub video + audio stream
*<code>MajorAV</code> - Main video + audio stream
*<code>Jpeg</code> - JPEG snapshot stream
*<code>Raw</code> - Raw thermal data stream
*<code>YUV</code> - YUV raw video stream

======'''Type''' (Data Format)======

*<code>H264</code> - H.264 video encoding
*<code>JPEG</code> - JPEG image format
*<code>RAW</code> - Raw sensor data
*<code>QBOX</code> - Custom protocol format
*<code>FRAME</code> - Frame-based format

======'''Mode''' (Transport Protocol)======

*<code>TCP</code> - TCP streaming (default)
*<code>UDP</code> - UDP streaming
*<code>MUL</code> - Multicast streaming

======'''Quality Parameters'''======

*<code>Quality=[1-100]</code> - Video quality level
*<code>Frames=[number]</code> - Number of frames to send
*<code>Interval=[ms]</code> - Frame interval in milliseconds

======'''Network Parameters'''======

*<code>IPAddr=[ip]</code> - Client IP address for UDP/multicast
*<code>Port=[port]</code> - Client port for UDP/multicast
*<code>Heart-beat=[Yes/No]</code> - Enable/disable heartbeat

======'''Snapshot Parameters'''======

*[[File:Dali D8X3N Raw Thermal viewer.png|thumb|Raw Data Viewer in python]]<code>Snap=[Yes/No]</code> - Enable snapshot mode

To view the raw stream, i made a python program that converts the 14bit thermal data to a visible image.

it is low fps tho, due to bad optimizations.

https://pastebin.com/dyNWDPT3

===Getting Root Terminal Access===
To access the Terminal you need to solder or plug in a UART connection to Connector J7 on the "Glue" board.

Pinout is (left to right) RX TX GND 3.3V

Baud 115200

3.3V

But the system will spam with debug messages, making patching the files a hard job unless you use "tftp" or "sed".
 

===(optional) Enabling Telnet access to make patching easier===
[[File:Upgrade ici dali firmware updater.png|thumb|ICI Firmware updater software with modified firmware loaded]]

there is a easier way using a modified Firmware updater to enable Telnet temporarily to patch the Files.

Download the upgrade_ici.exe form [https://archive.org/details/fwupdate here] and run it.

Then you should be able to connect to it via Telnet. the Login credentials are User: root Password: DLroot

===Patching the Web Server===
This only works if you also patch the Thermal Camera module flash!

====to permanently enable Telnet, go to /etc/init.d and edit S90app====
vi S90app
in vi, move your cursor to the # at #telnetd and press x

now press : and type wq, enter. this should be it.
 

====patching the decoder and streamer to 640x480:====
go to /app and edit the mach.cfg

replace DL384 with D640 and edit the resolution to 640 480

(press i in vi to enter edit mode, press ESC to exit edit mode. :wq to write and quit.)

repeat that procedure for the dali.cfg

====(optional) patching app.sh to prevent it from rebooting====
edit the app.sh in /app and remove all "reboot" occasions to prevent the camera from rebooting if onvifserver, httpd or daliServer arent running for debugging purposes.

===Patching the Thermal Camera module===
To patch it, you need to disassemble everything down to the FPGA Board,

on the bottom there is a SPI SOIC8 Flash.

Use a CH341 EEPROM programmer (be sure to have a fixed or modified version to not put out 5V!, set it to 3.3V) and SOIC8 clamp.

Use NeoProgrammer (i used 2.2.0.10 but there are newer available, use the latest) and click Detect. It should find W25Q128 chips, select the FV one.

Dont forget to download a backup of your flash and save it !

Download the Binary "Dali 640x480 '''actual''' cleared pixelmap.bin" from #3 below and load it into NeoProgrammer,

Click Erase, Program and Verify.

This can take a while.

Your imager should start up right after assembly by hearing the shutter click.

 

===Flash Contents===
On archive, click on show all files to download them.

<nowiki>#</nowiki>1 a Flash dump of the original downgraded D8X3N can be found [https://archive.org/details/dali-d-843n-flash-dump here]

<nowiki>#</nowiki>2 a Flash dump of a original 640x480 model can be found [https://archive.org/details/d-843-n-640x-480 here]

<nowiki>#</nowiki>3 a modified Flash dump of a 640x480 with cleared dead pixel map, flat map etc. can be found [https://archive.org/details/d-843-n-640x-480-cleared-pixelmap here]

a Flash dump of the web server SPI flash W25Q256JV can be found [https://archive.org/details/dm-60-webserver-flash-dump here] in case a bad firmware update caused a bootloop.

 

===Flash Binary Analysis===
The Flash IC is a Winbond 25Q128JV SPI Flash that contains the FPGA Bitstream, Deadpixel and Flatmap, aswell as the Device Settings.

a copy of the SPI Logic Capture at startup can be found [https://archive.org/details/dali-eeprom-capture here], the free software [https://www.dreamsourcelab.com/download/ DSView from DreamSourceLab] is required to view it.
[[File:Dali Thermal Imager SPI Flash capture.png|thumb|SPI Flash access while booting the Thermal Module]]

a approximation of the offsets resulted in this list:<syntaxhighlight lang="vb">
0x000000 - altera cyclone iv stuff
0x200000 - settings
0x280000 - Flat field correction map
0x4C0000 - Bad Pixel correctio nmap
0x580000 - image aswell? 36010 bytes
0x740000 - GUIX?
0x7C0000 - Strings for Gui?
0x800000 - another shorter GUIX
0x880000 - Strings for second gui?
0x8C0000 - GUIX
0x940000 - Strings for gui
0xE00000 - ?
0xE80000 - dzxg? short
0xEC0000 - crosshair.bmp
0xF40000 - 3DTM?
0xF80000 - fake? Bad pixel map BPRP
</syntaxhighlight> 

======Settings offset 0x200000======
The settings are read and written every startup, aswell when you close the OSD, sporadically and when executing the command MSV

these are some of the settings i could figure out by changing and watching the logic capture what changed.
 <syntaxhighlight lang="vb">
offset size Cmd
0x0 1 SAG (0-2) auto gain
0x2 2 SVB (0-16383) saved value is 16383 - SVB
0x4 2 SVC (0-1023) set exposure or gain
0x6 1 SSM image filtering
0x8 1 SEH image enhancement
0xA 1 SWP invert b/w polarity
0x14 1 SMR Flip
0x16 1 SMR Mirror
0x20 1 MENU Cal source 0 IN, 1 OUT
0x3A 1 MENU Enhance value 0-100
0x40 1 MENU Rectify (shutter 0 OFF, 1 L, 2 H)
0x50 1 MENU Language 0 english, 1 chinese, 2 russian
0xA2 - SCO set contrast gain
0xA4 - IBR set brightness
0xAE 2 MENU Fire Threshold
0xAC 1 SPA set color palette
0xE2 1 SMS display "collected 0/80" enabled
0xF8 1 SEM set emissivity
0x110 1 SRT set revise temp
0x116 1 SHD set humidity
0x118 1 SET set ambient temp
0x11A 1 STD set temp range
0x120 2 SLG -500 to 500?
0x124 2 SRD set distance
0x12C 1 SCP ???
0x130 2 SCT ???
</syntaxhighlight> 
[[File:Dali D8X3N Bad Pixel Map Viewer.png|thumb|Bad pixel map of a 640x512 sensor, about 0.56% of dead pixels in this map]]
So i let the AI create a [https://2476424.playcode.io/ Configurator page] that lets you change the Settings in your Flashdump to your liking
 

======Bad Pixel and Flatframe Maps 0x280000 and 0x4C0000======
Thermal cameras require a bad pixel and flat frame map to compensate for manufacturing inconsistencies.

unfourtainly, the maps of the downgraded cameras only contain enough data for a 384 model, not the full 640.

at offset 0xF80000 there is a BPRP which was mistaken at first as the Bad pixel map, it could just be a mask to where to apply the offset maps, as its either 0x0 or 0x1.

The [https://2477569.playcode.io/ Viewer Page] is written in JS and does not require any special dependencies, it can run as a plain html file offline.

There still needs to be work done to create own maps and flatfields but the cameras are still very capable and useable with fully cleared maps.

To clear the maps, just go to these offsets and fill with values around 0x3F or 0x0 for total length of X Resolution x Y Resolution x 2 bytes (0x96000 for 640x480)

[[File:Dali D8X3N Flat Field Map Viewer.png|thumb|Flat Field viewer]]

===Dali Commands===
To control the TIM you can either use Pelco or Dali command set. By default the Dali commandset is used at 38400 BAUD.

Those commands consist of a 0x02 start byte followed by two length Bytes, then the actual command which is allways 3 uppercase Letters in ASCII (eg. KBD for keyboard) followed by a comma and the values.

Some commands take multiple values, some dont. But you allways have to send the comma after the Command.

The camera will answer with the Command and 0, 1 or 2. Sending no value counts as zero.
0 is invalid parameters, too few or out of range

1 is OK, valid command

2 is Invalid command

Commands can be sent trough the Web server using the URL Api endpoint or directly trough the UART port.

(keyboard, C button, causes the shutter to do a calibration)
<camera ip>/cgi-bin/dmcmd?Command=KBD,C
Listening to the answer can be done while being in the Linux shell and typing
cat /dev/ttyAMA2 | strings

By bruteforcing the UART with AAA to ZZZ a list of Commands could be obtained, but some with unknown Parameters or functionality yet. including some from a decompiled DM60comm.so module found in /app/modules folder.<syntaxhighlight lang="vb">
KBD KEY Keyboard (F S M C + -)
SSM 0-1 Image Filtering Off/On
GSM 0 Image filter status
SEH 0-1 Image Enhancement Off/On
GEH 0-1 Image enhancer status
SCO 0-255 Set Gain (locked when SAG auto gain is on)
GCO 0-255 Get gain
INT 15-320 set actual gain? not just contrast sometimes disabled?
IBR 0-255 Set brightness
GBR 0-255 Get brightness
SMR 0-3 Mirror mode bit0=horizontal, bit1=vertical
GMR 0 Get rotation/flip
SDT 0-1 displays temp=44.65°C osd, but webserver sends date/time to the cam there....
GDT 0-1 Get temp display active?
GPT Display temp oft SDT
GNU 0-1 Get Shutter closed/open
SNU 0-1 Shutter close / open
STD 0-1 Set Range 0: -20-180°C 1: 100-600°C
GTD 0-1 Get Range
SET °C Set Ambient temperature
GET °C Get Ambient temperature
SEM 0-100 0-1 set emissivity x100
GEM 0-100 Get Emissivity
SRT °C Set revise temperature -100-100 -10-10°
GRT °C Get revise temperature
SRD 100 Set Distance 4.4m x100
GRD 100 Get Distance
SHD 0-100 Set Humidity
GHD 55 Get Humidity
SWP 0-1 invert s/w polarity image
GWP 1 is inverted?
SPA 0-10? Set color palette
GPA 3 white hot
SMV 0-1 Show temperature 3x3 grid?? in combination with GTV maybe
GMV 0
SMS 0-1 displays "collected 0/<number set by SCT>" by SCP delay "saves the daily number of highest temperatures?"
GMS 0
SCT 1-500 sets the amount of "collected" points for SMS
GCT 80
SCP 5-60 "collected" delay in seconds for SMS
GCP 60
SAG 0-2 Auto brightness / gain
GAG 0
SLR 0-9 ???
GLR 0
SRP 0,0 - 639,479 set crosshair position
GRP 320,240 get crosshair position
DRC 0-1 Show crosshair
SLG -500-500 ??
GLG
SCE text ??
GCE 0
SCB text ??
GCB 0
SVB 0-16383 adc offset, exposure? good at 9650
GVB 6733 value is 16383 minus SVB
SVC 1-1023 set contrast but better
GVC 260
SVF 100-? ?? video freaks out 3400 seems good
SVS 100-? ?? video freaks out 3300 seems good
SOT 0-1 ?? sensor supply, looks weird when off.
SZM 1-4 ?
GZM 1
MSV save settings too eeprom
ASV Saves something aswell?
GCS 0 Get Core status & faults
ALD 0,2? video blanks lots of eeprom activity. reload pixel map??
SAV 0-9999 set Fire threshold
GAV 2100 get Fire Threshold
BAC change uart protocol? careful
CBD Displays Recovery successful?
CBS Displays Saved successfully
LRD Displays Recovery successful?
LRS Displays Saved successfully?
LRE Displays Temperature Repair successful?
CBT Displays Calibration successful?
DBP ??? shutter clicks
DPI Show weird pixels
API Hide weird pixels
CCM ??
ASN 0-4 ??
GAB 4 vals ?? 3,-10,50,150
GAN 1 ??
GAR 11 vals ?? 10,10,5,20,35,50,70,90,120,150,180,,
GCM 6 values ??
GFV prints screen gray value?
GIT 200 ??
GTV Get the collected temp values?
PTS echoes but with extra stuff??
QYA 7170 Query Gray Info (information mode)
QYI 7124 Query Gray Average mode
QYM 7512 Query Gray Minimum mode
VTP 400-4000 ??
MTD U/S,0,0 ?? S answers with bytes, U upload bytes?
MTC U/S? ?? S answers with U,0,0, S doesnt.

return 0 invalid params:
STS ??
STT ??
SAC ??
SAH ??
SAS ??
SAT ??
SCX ?? displays crosshair but invalid params
SCY ?? displays crosshair but invalid params
GAC ??
GAH ??
GAS ??
GAT ??
GME ??
GPC ??
GPI ??
GPM ??
GTA ??
GTC ??
GTI ??
GTM ??
GTS ??
GTT ??

answer only:

BPM 0-1 stream ready? answers with 0 stop, 1 go, 2 when prompted
AVS 0,1
MEH
PWI 0-1 changing palette from wh to fire

unconfirmed (from dm60comm.so):
SDT 2024,03,15,14,30,25 Set Date Time with year,month,day,hour,minute,second
STS 1 Set Temperature Show display (0=off, 1=on)
SVA 2 Set Video Auto mode (0=manual, 2=auto)
SMP 0,1,1,0,100,150,200,250,300,350,90,25 Set Measurement Point (type,index,enable,mode,startX,startY,endX,endY,anchorX,anchorY,threshold,color)
STV Stop Temperature View measurements
SPF 5 Set Profile parameter
SVL -10 Set Video Left pan movement (signed value)
SVU -5 Set Video Up tilt movement (signed value)
SVD 5 Set Video Down tilt movement (signed value)
SSP 17,1,0 Set System Parameter (param_id,value,index) #46 temperature format 0 °C, 1 °F, 2 K
SCP Set Current Preset (save current position)
GCP Get Current Preset
STT 300,350 Set Temperature Threshold (low,high values *10)
SDC 1 Set Display Configuration parameter
GCS Get Current Status
GMM Get Memory Map information
GFV Get Frame Value (grayscale data)
GFZ Get Freeze Status
GSI 1 Get System Information (parameter=1)
GSS Get System Status
GSP 21,0 Get System Parameter (param_21=surround temp, value=0)
GTT Get Temperature Threshold range
GTV 1,3,10 Get Temperature Values (enable,type,count)
GNU Get Network Update status (response command)
FRZ Freeze current display frame
LIV Live mode (unfreeze display)
CAL Calibrate system
CCP 3 Call Current Preset (preset number 0-9)
APF 100 Auto Profile setting
MEH Measure Enhancement
BPT Built-in Test
MTC S,0 Measure Temperature Capture (S=start, 0=sequence)
MTG U,0,1024,<data> Measure Temperature Gray data transfer
MTD U,0,1024,<data> Measure Temperature Data transfer
UFP S,0,2048 Update Firmware Prepare (S=start, 0=offset, 2048=size)
UFD S,0,1024 Update Firmware Data transfer
BAB U Buffer operation (U=update)
TTH S,0 Temperature Threshold operation
IPP 192.168.001.102,255.255.255.000,192.168.001.001,192.168.000.001,9989,9998 IP Parameters (IP,netmask,gateway,DNS,port1,port2)
MAC 00:60:A9:10:00:01 MAC Address setting
SNP Set Network Parameters (response command)
QYI Query Gray Info (information mode)
QYA Query Gray Average mode
QYM Query Gray Minimum mode
GAI Get Alarm Info (response command)
YTC <data> Unknown command with data parameter
HTH
LRS
LRD
GAR
DRC
PTS
SCX
SCY
CBT
LRE
CBD
CBS
XXX
GSP
GTT
QYI
QYA
QYM

</syntaxhighlight>

 

===Using the Thermal module without Webserver===
[[File:Dali D8X3C Breakout board.png|thumb|Breakout board for D8X3C ]]
to use it, you need to interface it directly.

The module will put out a Analog video signal (High-Z, need to buffer when connecting it to 75Ohm Video input)

Also a 8 or 14bit or 8-bit BT656 output.

the header exposes the FPGA JTAG and UART aswell as 6 Hardware Keys to Navigate the OSD.

To interface, you need to make a adapter board with a DF12-50DS-0.5V(86) Docking socket.

The breakout board files can be found [https://oshwlab.com/gamerpaddy/d8x3c-backpack-usb here] but may be still work in progress.

 

===Sensor Pinout===
[[File:Dali DLD384 Sensor pinout basic.png|thumb|basic pinout of a DLD384]]
the pinout of the thermal sensor havent been analyzes much.

besides some supply and Control voltages, 3 clocks and a analog output have been found.

17.5MHz

14.705KHz

50Hz

Dali D8X3N Thermal Camera

2025-08-03T16:51:19Z

Gamerpaddy: /* Flash Contents */ added actual cleared pixelmap bin

==Dali D8X3N Thermal Camera Reverse Engineering==
 

===Introduction===
The [https://www.dali-irtech.com/productinfo/741567.html Dali D8X3N] Thermal Camera module comes in two versions, a 384x288 and 640x480 resolution, utilizing the [http://www.dali-tech.us/products/dld64017m-uncooled-infrared-fpa-detector-86.html DLD Series] of amorphous-Silicon Microbolometers.

They were mainly used in [http://www.dali-tech.us/products/dm60-w--online-body-temperature-thermal-imaging-camera-55.html Dali DM60-W] or WS-1 Body Temperature screening cameras in conjunction with a Black Body radiator set to 37°C to detect infected individuals at the start of the 2020 Covid Pandemic.
[[File:ICI FM320P Innerts.jpg|thumb|Internals. A TP-Link Switch, HikVision Visible Camera and the D8x3N Network thermal camera module]]
[https://infraredcameras.com/ ICI] rebranded these models as FM 320 P and FM 640 P, and distributed them on the local US market, but as the need for such Cameras exploded, those models were built with what was in stock.

So happens, that some of the FM 320 P Models had a DLD640 640x480 instead of a DLD384 384x288 Microbolometer in them, and just got their Firmware modified.

It also could be, because they have excessive amounts of bad pixels outside the 384x288 area, that they were binned to a lower grade.

Discussions about these Cameras started around 2022 in the [https://www.eevblog.com/forum/thermal-imaging/ici-and-dali-thermal-camera-software/ EEVBlog Forums.] when they started to appear secondhand and affordable.

Originally they were priced around US$ 20... 30.000 by ICI, and a unknown amount by Dali Tech.

The Modules specs according to the manufacturer are:

≤50..60mK@F1，300K，50Hz

17 or 25µm pixel pitch

Hisilicon SoC running Linux to provide Onvif and RTSP streams, analysis and a Web UI

 
[[File:Dali D8X3N Module.jpg|thumb|A real 384x288 model with a DLD384 sensor. notice the Productnumber ]]
ICI FM Cameras are found all over Online secondhand marketplaces for scrap Prices, as they are no longer needed.

But you never know, what are you getting. It could be a real DLD384 or the better DLD640 inside. Its a gamble.
 

======640x480 Imagers======
are labeled 22D843 Nxxxx and have a DLD640 sensor in it, they can be upgraded if they run the 384x288 firmware.

======384x288 Imagers======
are labeled 22D883Nxxxx and have a DLD384 sensor in it, they cannot be upgraded

 

===D8X3N Module closer look===
From now on, i will refer to the Thermal Imaging Module as TIM

On the front there is a 2 Element Germanium Lens of a unknown focal length and aperture.

It can be focus-adjusted when unscrewing the clamp around the housing. It can be focussed from infinity down to 10..20cm with some quality loss.
 The outter diameter of the Lens is 42mm with a 1 1/3 inch thread diameter of undetermined pitch.

Dimensions of the germanium elements are 21mm to 3 and 6mm and 14grams in weight.
[[File:Disassembled Thermal Camera Lens.jpg|thumb|Two element Germanium Lens of unknown focal length and aperture]]

The TIM is composed of 6 Stacked PCB modules, 3 of which are for the Web Server functionality. taking them off will give you the basic configuration of a [https://www.dalithermal.com/productinfo/741568.html Dali D8X3C] TIM<gallery>
File:Dali DLD640 Thermal Image Sensor.jpeg|DLD640 Sensor
File:Dali DLD384 Thermal Imaging Sensor.jpeg|DLD384 Sensor
File:Dali D8X3N Board1 Back.jpeg|Network & GPIO Board Back
File:Dali D8X3N Board1 Front.jpeg|Network & GPIO Board Front
File:Dali D8X3N Glue Board Back.jpeg|Board between Logic and IO Back
File:Dali D8X3N Glue Board Front.jpeg|Board between Logic and IO Front
File:Dali D8X3N SoC Board Back.jpeg|SoC Board back
File:Dali D8X3N SoC Board front.jpeg|SoC board front
File:Dali D8X3N FPGA Board Back.jpeg|FPGA Board of the D8X3C Thermal Imager including a PMIC
File:Dali D8X3N FPGA Board Front.jpeg|FPGA Board Front with Video DAC and SPI Flash
File:Dali D8X3N Sensor Power and ADC Board.jpeg|Sensor control and ADC board
File:Dali D8X3N Thermal Core Debug wiring.jpeg|Debug wiring for sniffing SPI and UART
</gallery>

===User Manual===
including pinout diagram and important data

can be found here https://archive.org/details/dali-d-8-x-3-cuser-manualen-v-1.0-1

===Viewing the Video Stream===
[[File:Onvif Device Manager ODM.png|thumb|ODM streaming the Thermal view]]
when first connecting it to power and Ethernet, the camera will have 192.168.1.102 as a Static ip.

If you are running a 192.168.0.x or .178.x net, you need to change it or add a subnet under windows ipv4 settings.

to view it, you can use VLC and the stream URL
rtsp://admin@admin:<camera ip>/ONVIFMedia
there is /ONVIFMedia /ONVIFMediaM and /ONVIFMediaS for different stream Profiles.

VLC is quite slow and delayed, rather use Onvif Device Manager ODM,

it has no delay and auto-detects cameras in the network.

Be sure to log in as user: admin pass: admin in ODM.

in there, you can also set you camera to DHCP under Network settings.

===Web Interface===
[[File:Dali D8X3N web interface.png|thumb|Since browsers cant display RTSP anymore, open in Edge and select IE Compatibility Mode.]]
the web interface can be accessed by opening the camera IP in a browser

login is:
user: admin pass: admin
You can set Temperature markers and areas, but without using the Black Body calibration source, your readings may be way off or not working.

 

====OSD====
there is a debug-login with
user: super pass: 871897
that lets you send Key commands to the Imager to navigate the OSD.

Setting the OSD to english is accomplished with option #11
[[File:Dali D8X3C OSD.png|thumb|OSD in english, if yours is Chinese. go to option #11 and click + or -]]

To acces some locked menus, press
+ - + - + -

The password for the locked System and Main menu is
+-MC+-

Be careful in the UART menu to not change the BAUD rate or Protocol, as your ability to control it via the Web API gets lost.

You need to reflash or solder buttons on the thermal core then.

===Viewing Raw Thermal Data from the Web API===
there is a hidden endpoint in the stream.so file that could be found while decompiling

accessing
[[File:Arduino Nano blink sketch thermal gif.gif|thumb|Arduino Nano running blink sketch while thermally recording it, notice the led and resistor on the right]]
<ip of camera>:5000/stream?Type=JPEG&Source=Jpeg&Mode=TCP
lets you download a JPEG. but there are more options available (not all have been tested)

we are mainly interessted in Raw thermal data.

======'''Source''' (Stream Type)======

*<code>Major</code> - Main video stream (channel 0)
*<code>Minor</code> - Sub video stream (channel 1)
*<code>MinorAV</code> - Sub video + audio stream
*<code>MajorAV</code> - Main video + audio stream
*<code>Jpeg</code> - JPEG snapshot stream
*<code>Raw</code> - Raw thermal data stream
*<code>YUV</code> - YUV raw video stream

======'''Type''' (Data Format)======

*<code>H264</code> - H.264 video encoding
*<code>JPEG</code> - JPEG image format
*<code>RAW</code> - Raw sensor data
*<code>QBOX</code> - Custom protocol format
*<code>FRAME</code> - Frame-based format

======'''Mode''' (Transport Protocol)======

*<code>TCP</code> - TCP streaming (default)
*<code>UDP</code> - UDP streaming
*<code>MUL</code> - Multicast streaming

======'''Quality Parameters'''======

*<code>Quality=[1-100]</code> - Video quality level
*<code>Frames=[number]</code> - Number of frames to send
*<code>Interval=[ms]</code> - Frame interval in milliseconds

======'''Network Parameters'''======

*<code>IPAddr=[ip]</code> - Client IP address for UDP/multicast
*<code>Port=[port]</code> - Client port for UDP/multicast
*<code>Heart-beat=[Yes/No]</code> - Enable/disable heartbeat

======'''Snapshot Parameters'''======

*[[File:Dali D8X3N Raw Thermal viewer.png|thumb|Raw Data Viewer in python]]<code>Snap=[Yes/No]</code> - Enable snapshot mode

To view the raw stream, i made a python program that converts the 14bit thermal data to a visible image.

it is low fps tho, due to bad optimizations.

https://pastebin.com/dyNWDPT3

===Getting Root Terminal Access===
To access the Terminal you need to solder or plug in a UART connection to Connector J7 on the "Glue" board.

Pinout is (left to right) RX TX GND 3.3V

Baud 115200

3.3V

But the system will spam with debug messages, making patching the files a hard job unless you use "tftp" or "sed".
 

===(optional) Enabling Telnet access to make patching easier===
[[File:Upgrade ici dali firmware updater.png|thumb|ICI Firmware updater software with modified firmware loaded]]

there is a easier way using a modified Firmware updater to enable Telnet temporarily to patch the Files.

Download the upgrade_ici.exe form [https://archive.org/details/fwupdate here] and run it.

Then you should be able to connect to it via Telnet. the Login credentials are User: root Password: DLroot

===Patching the Web Server===
This only works if you also patch the Thermal Camera module flash!

====to permanently enable Telnet, go to /etc/init.d and edit S90app====
vi S90app
in vi, move your cursor to the # at #telnetd and press x

now press : and type wq, enter. this should be it.
 

====patching the decoder and streamer to 640x480:====
go to /app and edit the mach.cfg

replace DL384 with D640 and edit the resolution to 640 480

(press i in vi to enter edit mode, press ESC to exit edit mode. :wq to write and quit.)

repeat that procedure for the dali.cfg

====(optional) patching app.sh to prevent it from rebooting====
edit the app.sh in /app and remove all "reboot" occasions to prevent the camera from rebooting if onvifserver, httpd or daliServer arent running for debugging purposes.

===Patching the Thermal Camera module===
To patch it, you need to disassemble everything down to the FPGA Board,

on the bottom there is a SPI SOIC8 Flash.

Use a CH341 EEPROM programmer (be sure to have a fixed or modified version to not put out 5V!, set it to 3.3V) and SOIC8 clamp.

Use NeoProgrammer (i used 2.2.0.10 but there are newer available, use the latest) and click Detect. It should find W25Q128 chips, select the FV one.

Dont forget to download a backup of your flash and save it !

Download the Binary 640x480 cleared pixelmap from below and load it into NeoProgrammer, Click Erase, Program and Verify.

This can take a while.

Your imager should start up right after assembly by hearing the shutter click.
 

===Flash Contents===
a Flash dump of the original downgraded D8X3N can be found [https://archive.org/details/dali-d-843n-flash-dump here]

a Flash dump of a original 640x480 model can be found [https://archive.org/details/d-843-n-640x-480 here]

(use the actual cleared pixelmap for a clean BPRP, Flat and Offsetmap.)

a Flash dump of the web server SPI flash W25Q256JV can be found [https://archive.org/details/dm-60-webserver-flash-dump here] in case a bad firmware update caused a bootloop.

 

===Flash Binary Analysis===
The Flash IC is a Winbond 25Q128JV SPI Flash that contains the FPGA Bitstream, Deadpixel and Flatmap, aswell as the Device Settings.

a copy of the SPI Logic Capture at startup can be found [https://archive.org/details/dali-eeprom-capture here], the free software [https://www.dreamsourcelab.com/download/ DSView from DreamSourceLab] is required to view it.
[[File:Dali Thermal Imager SPI Flash capture.png|thumb|SPI Flash access while booting the Thermal Module]]

a approximation of the offsets resulted in this list:<syntaxhighlight lang="vb">
0x000000 - altera cyclone iv stuff
0x200000 - settings
0x280000 - Flat field correction map
0x4C0000 - Bad Pixel correctio nmap
0x580000 - image aswell? 36010 bytes
0x740000 - GUIX?
0x7C0000 - Strings for Gui?
0x800000 - another shorter GUIX
0x880000 - Strings for second gui?
0x8C0000 - GUIX
0x940000 - Strings for gui
0xE00000 - ?
0xE80000 - dzxg? short
0xEC0000 - crosshair.bmp
0xF40000 - 3DTM?
0xF80000 - fake? Bad pixel map BPRP
</syntaxhighlight> 

======Settings offset 0x200000======
The settings are read and written every startup, aswell when you close the OSD, sporadically and when executing the command MSV

these are some of the settings i could figure out by changing and watching the logic capture what changed.
 <syntaxhighlight lang="vb">
offset size Cmd
0x0 1 SAG (0-2) auto gain
0x2 2 SVB (0-16383) saved value is 16383 - SVB
0x4 2 SVC (0-1023) set exposure or gain
0x6 1 SSM image filtering
0x8 1 SEH image enhancement
0xA 1 SWP invert b/w polarity
0x14 1 SMR Flip
0x16 1 SMR Mirror
0x20 1 MENU Cal source 0 IN, 1 OUT
0x3A 1 MENU Enhance value 0-100
0x40 1 MENU Rectify (shutter 0 OFF, 1 L, 2 H)
0x50 1 MENU Language 0 english, 1 chinese, 2 russian
0xA2 - SCO set contrast gain
0xA4 - IBR set brightness
0xAE 2 MENU Fire Threshold
0xAC 1 SPA set color palette
0xE2 1 SMS display "collected 0/80" enabled
0xF8 1 SEM set emissivity
0x110 1 SRT set revise temp
0x116 1 SHD set humidity
0x118 1 SET set ambient temp
0x11A 1 STD set temp range
0x120 2 SLG -500 to 500?
0x124 2 SRD set distance
0x12C 1 SCP ???
0x130 2 SCT ???
</syntaxhighlight> 
[[File:Dali D8X3N Bad Pixel Map Viewer.png|thumb|Bad pixel map of a 640x512 sensor, about 0.56% of dead pixels in this map]]
So i let the AI create a [https://2476424.playcode.io/ Configurator page] that lets you change the Settings in your Flashdump to your liking
 

======Bad Pixel and Flatframe Maps 0x280000 and 0x4C0000======
Thermal cameras require a bad pixel and flat frame map to compensate for manufacturing inconsistencies.

unfourtainly, the maps of the downgraded cameras only contain enough data for a 384 model, not the full 640.

at offset 0xF80000 there is a BPRP which was mistaken at first as the Bad pixel map, it could just be a mask to where to apply the offset maps, as its either 0x0 or 0x1.

The [https://2477569.playcode.io/ Viewer Page] is written in JS and does not require any special dependencies, it can run as a plain html file offline.

There still needs to be work done to create own maps and flatfields but the cameras are still very capable and useable with fully cleared maps.

To clear the maps, just go to these offsets and fill with values around 0x3F or 0x0 for total length of X Resolution x Y Resolution x 2 bytes (0x96000 for 640x480)

[[File:Dali D8X3N Flat Field Map Viewer.png|thumb|Flat Field viewer]]

===Dali Commands===
To control the TIM you can either use Pelco or Dali command set. By default the Dali commandset is used at 38400 BAUD.

Those commands consist of a 0x02 start byte followed by two length Bytes, then the actual command which is allways 3 uppercase Letters in ASCII (eg. KBD for keyboard) followed by a comma and the values.

Some commands take multiple values, some dont. But you allways have to send the comma after the Command.

The camera will answer with the Command and 0, 1 or 2. Sending no value counts as zero.
0 is invalid parameters, too few or out of range

1 is OK, valid command

2 is Invalid command

Commands can be sent trough the Web server using the URL Api endpoint or directly trough the UART port.

(keyboard, C button, causes the shutter to do a calibration)
<camera ip>/cgi-bin/dmcmd?Command=KBD,C
Listening to the answer can be done while being in the Linux shell and typing
cat /dev/ttyAMA2 | strings

By bruteforcing the UART with AAA to ZZZ a list of Commands could be obtained, but some with unknown Parameters or functionality yet. including some from a decompiled DM60comm.so module found in /app/modules folder.<syntaxhighlight lang="vb">
KBD KEY Keyboard (F S M C + -)
SSM 0-1 Image Filtering Off/On
GSM 0 Image filter status
SEH 0-1 Image Enhancement Off/On
GEH 0-1 Image enhancer status
SCO 0-255 Set Gain (locked when SAG auto gain is on)
GCO 0-255 Get gain
INT 15-320 set actual gain? not just contrast sometimes disabled?
IBR 0-255 Set brightness
GBR 0-255 Get brightness
SMR 0-3 Mirror mode bit0=horizontal, bit1=vertical
GMR 0 Get rotation/flip
SDT 0-1 displays temp=44.65°C osd, but webserver sends date/time to the cam there....
GDT 0-1 Get temp display active?
GPT Display temp oft SDT
GNU 0-1 Get Shutter closed/open
SNU 0-1 Shutter close / open
STD 0-1 Set Range 0: -20-180°C 1: 100-600°C
GTD 0-1 Get Range
SET °C Set Ambient temperature
GET °C Get Ambient temperature
SEM 0-100 0-1 set emissivity x100
GEM 0-100 Get Emissivity
SRT °C Set revise temperature -100-100 -10-10°
GRT °C Get revise temperature
SRD 100 Set Distance 4.4m x100
GRD 100 Get Distance
SHD 0-100 Set Humidity
GHD 55 Get Humidity
SWP 0-1 invert s/w polarity image
GWP 1 is inverted?
SPA 0-10? Set color palette
GPA 3 white hot
SMV 0-1 Show temperature 3x3 grid?? in combination with GTV maybe
GMV 0
SMS 0-1 displays "collected 0/<number set by SCT>" by SCP delay "saves the daily number of highest temperatures?"
GMS 0
SCT 1-500 sets the amount of "collected" points for SMS
GCT 80
SCP 5-60 "collected" delay in seconds for SMS
GCP 60
SAG 0-2 Auto brightness / gain
GAG 0
SLR 0-9 ???
GLR 0
SRP 0,0 - 639,479 set crosshair position
GRP 320,240 get crosshair position
DRC 0-1 Show crosshair
SLG -500-500 ??
GLG
SCE text ??
GCE 0
SCB text ??
GCB 0
SVB 0-16383 adc offset, exposure? good at 9650
GVB 6733 value is 16383 minus SVB
SVC 1-1023 set contrast but better
GVC 260
SVF 100-? ?? video freaks out 3400 seems good
SVS 100-? ?? video freaks out 3300 seems good
SOT 0-1 ?? sensor supply, looks weird when off.
SZM 1-4 ?
GZM 1
MSV save settings too eeprom
ASV Saves something aswell?
GCS 0 Get Core status & faults
ALD 0,2? video blanks lots of eeprom activity. reload pixel map??
SAV 0-9999 set Fire threshold
GAV 2100 get Fire Threshold
BAC change uart protocol? careful
CBD Displays Recovery successful?
CBS Displays Saved successfully
LRD Displays Recovery successful?
LRS Displays Saved successfully?
LRE Displays Temperature Repair successful?
CBT Displays Calibration successful?
DBP ??? shutter clicks
DPI Show weird pixels
API Hide weird pixels
CCM ??
ASN 0-4 ??
GAB 4 vals ?? 3,-10,50,150
GAN 1 ??
GAR 11 vals ?? 10,10,5,20,35,50,70,90,120,150,180,,
GCM 6 values ??
GFV prints screen gray value?
GIT 200 ??
GTV Get the collected temp values?
PTS echoes but with extra stuff??
QYA 7170 Query Gray Info (information mode)
QYI 7124 Query Gray Average mode
QYM 7512 Query Gray Minimum mode
VTP 400-4000 ??
MTD U/S,0,0 ?? S answers with bytes, U upload bytes?
MTC U/S? ?? S answers with U,0,0, S doesnt.

return 0 invalid params:
STS ??
STT ??
SAC ??
SAH ??
SAS ??
SAT ??
SCX ?? displays crosshair but invalid params
SCY ?? displays crosshair but invalid params
GAC ??
GAH ??
GAS ??
GAT ??
GME ??
GPC ??
GPI ??
GPM ??
GTA ??
GTC ??
GTI ??
GTM ??
GTS ??
GTT ??

answer only:

BPM 0-1 stream ready? answers with 0 stop, 1 go, 2 when prompted
AVS 0,1
MEH
PWI 0-1 changing palette from wh to fire

unconfirmed (from dm60comm.so):
SDT 2024,03,15,14,30,25 Set Date Time with year,month,day,hour,minute,second
STS 1 Set Temperature Show display (0=off, 1=on)
SVA 2 Set Video Auto mode (0=manual, 2=auto)
SMP 0,1,1,0,100,150,200,250,300,350,90,25 Set Measurement Point (type,index,enable,mode,startX,startY,endX,endY,anchorX,anchorY,threshold,color)
STV Stop Temperature View measurements
SPF 5 Set Profile parameter
SVL -10 Set Video Left pan movement (signed value)
SVU -5 Set Video Up tilt movement (signed value)
SVD 5 Set Video Down tilt movement (signed value)
SSP 17,1,0 Set System Parameter (param_id,value,index) #46 temperature format 0 °C, 1 °F, 2 K
SCP Set Current Preset (save current position)
GCP Get Current Preset
STT 300,350 Set Temperature Threshold (low,high values *10)
SDC 1 Set Display Configuration parameter
GCS Get Current Status
GMM Get Memory Map information
GFV Get Frame Value (grayscale data)
GFZ Get Freeze Status
GSI 1 Get System Information (parameter=1)
GSS Get System Status
GSP 21,0 Get System Parameter (param_21=surround temp, value=0)
GTT Get Temperature Threshold range
GTV 1,3,10 Get Temperature Values (enable,type,count)
GNU Get Network Update status (response command)
FRZ Freeze current display frame
LIV Live mode (unfreeze display)
CAL Calibrate system
CCP 3 Call Current Preset (preset number 0-9)
APF 100 Auto Profile setting
MEH Measure Enhancement
BPT Built-in Test
MTC S,0 Measure Temperature Capture (S=start, 0=sequence)
MTG U,0,1024,<data> Measure Temperature Gray data transfer
MTD U,0,1024,<data> Measure Temperature Data transfer
UFP S,0,2048 Update Firmware Prepare (S=start, 0=offset, 2048=size)
UFD S,0,1024 Update Firmware Data transfer
BAB U Buffer operation (U=update)
TTH S,0 Temperature Threshold operation
IPP 192.168.001.102,255.255.255.000,192.168.001.001,192.168.000.001,9989,9998 IP Parameters (IP,netmask,gateway,DNS,port1,port2)
MAC 00:60:A9:10:00:01 MAC Address setting
SNP Set Network Parameters (response command)
QYI Query Gray Info (information mode)
QYA Query Gray Average mode
QYM Query Gray Minimum mode
GAI Get Alarm Info (response command)
YTC <data> Unknown command with data parameter
HTH
LRS
LRD
GAR
DRC
PTS
SCX
SCY
CBT
LRE
CBD
CBS
XXX
GSP
GTT
QYI
QYA
QYM

</syntaxhighlight>

 

===Using the Thermal module without Webserver===
[[File:Dali D8X3C Breakout board.png|thumb|Breakout board for D8X3C ]]
to use it, you need to interface it directly.

The module will put out a Analog video signal (High-Z, need to buffer when connecting it to 75Ohm Video input)

Also a 8 or 14bit or 8-bit BT656 output.

the header exposes the FPGA JTAG and UART aswell as 6 Hardware Keys to Navigate the OSD.

To interface, you need to make a adapter board with a DF12-50DS-0.5V(86) Docking socket.

The breakout board files can be found [https://oshwlab.com/gamerpaddy/d8x3c-backpack-usb here] but may be still work in progress.

 

===Sensor Pinout===
[[File:Dali DLD384 Sensor pinout basic.png|thumb|basic pinout of a DLD384]]
the pinout of the thermal sensor havent been analyzes much.

besides some supply and Control voltages, 3 clocks and a analog output have been found.

17.5MHz

14.705KHz

50Hz

Dali D8X3N Thermal Camera

2025-08-03T15:42:38Z

Gamerpaddy: add secret keycombination

==Dali D8X3N Thermal Camera Reverse Engineering==
 

===Introduction===
The [https://www.dali-irtech.com/productinfo/741567.html Dali D8X3N] Thermal Camera module comes in two versions, a 384x288 and 640x480 resolution, utilizing the [http://www.dali-tech.us/products/dld64017m-uncooled-infrared-fpa-detector-86.html DLD Series] of amorphous-Silicon Microbolometers.

They were mainly used in [http://www.dali-tech.us/products/dm60-w--online-body-temperature-thermal-imaging-camera-55.html Dali DM60-W] or WS-1 Body Temperature screening cameras in conjunction with a Black Body radiator set to 37°C to detect infected individuals at the start of the 2020 Covid Pandemic.
[[File:ICI FM320P Innerts.jpg|thumb|Internals. A TP-Link Switch, HikVision Visible Camera and the D8x3N Network thermal camera module]]
[https://infraredcameras.com/ ICI] rebranded these models as FM 320 P and FM 640 P, and distributed them on the local US market, but as the need for such Cameras exploded, those models were built with what was in stock.

So happens, that some of the FM 320 P Models had a DLD640 640x480 instead of a DLD384 384x288 Microbolometer in them, and just got their Firmware modified.

It also could be, because they have excessive amounts of bad pixels outside the 384x288 area, that they were binned to a lower grade.

Discussions about these Cameras started around 2022 in the [https://www.eevblog.com/forum/thermal-imaging/ici-and-dali-thermal-camera-software/ EEVBlog Forums.] when they started to appear secondhand and affordable.

Originally they were priced around US$ 20... 30.000 by ICI, and a unknown amount by Dali Tech.

The Modules specs according to the manufacturer are:

≤50..60mK@F1，300K，50Hz

17 or 25µm pixel pitch

Hisilicon SoC running Linux to provide Onvif and RTSP streams, analysis and a Web UI

 
[[File:Dali D8X3N Module.jpg|thumb|A real 384x288 model with a DLD384 sensor. notice the Productnumber ]]
ICI FM Cameras are found all over Online secondhand marketplaces for scrap Prices, as they are no longer needed.

But you never know, what are you getting. It could be a real DLD384 or the better DLD640 inside. Its a gamble.
 

======640x480 Imagers======
are labeled 22D843 Nxxxx and have a DLD640 sensor in it, they can be upgraded if they run the 384x288 firmware.

======384x288 Imagers======
are labeled 22D883Nxxxx and have a DLD384 sensor in it, they cannot be upgraded

 

===D8X3N Module closer look===
From now on, i will refer to the Thermal Imaging Module as TIM

On the front there is a 2 Element Germanium Lens of a unknown focal length and aperture.

It can be focus-adjusted when unscrewing the clamp around the housing. It can be focussed from infinity down to 10..20cm with some quality loss.
 The outter diameter of the Lens is 42mm with a 1 1/3 inch thread diameter of undetermined pitch.

Dimensions of the germanium elements are 21mm to 3 and 6mm and 14grams in weight.
[[File:Disassembled Thermal Camera Lens.jpg|thumb|Two element Germanium Lens of unknown focal length and aperture]]

The TIM is composed of 6 Stacked PCB modules, 3 of which are for the Web Server functionality. taking them off will give you the basic configuration of a [https://www.dalithermal.com/productinfo/741568.html Dali D8X3C] TIM<gallery>
File:Dali DLD640 Thermal Image Sensor.jpeg|DLD640 Sensor
File:Dali DLD384 Thermal Imaging Sensor.jpeg|DLD384 Sensor
File:Dali D8X3N Board1 Back.jpeg|Network & GPIO Board Back
File:Dali D8X3N Board1 Front.jpeg|Network & GPIO Board Front
File:Dali D8X3N Glue Board Back.jpeg|Board between Logic and IO Back
File:Dali D8X3N Glue Board Front.jpeg|Board between Logic and IO Front
File:Dali D8X3N SoC Board Back.jpeg|SoC Board back
File:Dali D8X3N SoC Board front.jpeg|SoC board front
File:Dali D8X3N FPGA Board Back.jpeg|FPGA Board of the D8X3C Thermal Imager including a PMIC
File:Dali D8X3N FPGA Board Front.jpeg|FPGA Board Front with Video DAC and SPI Flash
File:Dali D8X3N Sensor Power and ADC Board.jpeg|Sensor control and ADC board
File:Dali D8X3N Thermal Core Debug wiring.jpeg|Debug wiring for sniffing SPI and UART
</gallery>

===User Manual===
including pinout diagram and important data

can be found here https://archive.org/details/dali-d-8-x-3-cuser-manualen-v-1.0-1

===Viewing the Video Stream===
[[File:Onvif Device Manager ODM.png|thumb|ODM streaming the Thermal view]]
when first connecting it to power and Ethernet, the camera will have 192.168.1.102 as a Static ip.

If you are running a 192.168.0.x or .178.x net, you need to change it or add a subnet under windows ipv4 settings.

to view it, you can use VLC and the stream URL
rtsp://admin@admin:<camera ip>/ONVIFMedia
there is /ONVIFMedia /ONVIFMediaM and /ONVIFMediaS for different stream Profiles.

VLC is quite slow and delayed, rather use Onvif Device Manager ODM,

it has no delay and auto-detects cameras in the network.

Be sure to log in as user: admin pass: admin in ODM.

in there, you can also set you camera to DHCP under Network settings.

===Web Interface===
[[File:Dali D8X3N web interface.png|thumb|Since browsers cant display RTSP anymore, open in Edge and select IE Compatibility Mode.]]
the web interface can be accessed by opening the camera IP in a browser

login is:
user: admin pass: admin
You can set Temperature markers and areas, but without using the Black Body calibration source, your readings may be way off or not working.

 

====OSD====
there is a debug-login with
user: super pass: 871897
that lets you send Key commands to the Imager to navigate the OSD.

Setting the OSD to english is accomplished with option #11
[[File:Dali D8X3C OSD.png|thumb|OSD in english, if yours is Chinese. go to option #11 and click + or -]]

To acces some locked menus, press
+ - + - + -

The password for the locked System and Main menu is
+-MC+-

Be careful in the UART menu to not change the BAUD rate or Protocol, as your ability to control it via the Web API gets lost.

You need to reflash or solder buttons on the thermal core then.

===Viewing Raw Thermal Data from the Web API===
there is a hidden endpoint in the stream.so file that could be found while decompiling

accessing
[[File:Arduino Nano blink sketch thermal gif.gif|thumb|Arduino Nano running blink sketch while thermally recording it, notice the led and resistor on the right]]
<ip of camera>:5000/stream?Type=JPEG&Source=Jpeg&Mode=TCP
lets you download a JPEG. but there are more options available (not all have been tested)

we are mainly interessted in Raw thermal data.

======'''Source''' (Stream Type)======

*<code>Major</code> - Main video stream (channel 0)
*<code>Minor</code> - Sub video stream (channel 1)
*<code>MinorAV</code> - Sub video + audio stream
*<code>MajorAV</code> - Main video + audio stream
*<code>Jpeg</code> - JPEG snapshot stream
*<code>Raw</code> - Raw thermal data stream
*<code>YUV</code> - YUV raw video stream

======'''Type''' (Data Format)======

*<code>H264</code> - H.264 video encoding
*<code>JPEG</code> - JPEG image format
*<code>RAW</code> - Raw sensor data
*<code>QBOX</code> - Custom protocol format
*<code>FRAME</code> - Frame-based format

======'''Mode''' (Transport Protocol)======

*<code>TCP</code> - TCP streaming (default)
*<code>UDP</code> - UDP streaming
*<code>MUL</code> - Multicast streaming

======'''Quality Parameters'''======

*<code>Quality=[1-100]</code> - Video quality level
*<code>Frames=[number]</code> - Number of frames to send
*<code>Interval=[ms]</code> - Frame interval in milliseconds

======'''Network Parameters'''======

*<code>IPAddr=[ip]</code> - Client IP address for UDP/multicast
*<code>Port=[port]</code> - Client port for UDP/multicast
*<code>Heart-beat=[Yes/No]</code> - Enable/disable heartbeat

======'''Snapshot Parameters'''======

*[[File:Dali D8X3N Raw Thermal viewer.png|thumb|Raw Data Viewer in python]]<code>Snap=[Yes/No]</code> - Enable snapshot mode

To view the raw stream, i made a python program that converts the 14bit thermal data to a visible image.

it is low fps tho, due to bad optimizations.

https://pastebin.com/dyNWDPT3

===Getting Root Terminal Access===
To access the Terminal you need to solder or plug in a UART connection to Connector J7 on the "Glue" board.

Pinout is (left to right) RX TX GND 3.3V

Baud 115200

3.3V

But the system will spam with debug messages, making patching the files a hard job unless you use "tftp" or "sed".
 

===(optional) Enabling Telnet access to make patching easier===
[[File:Upgrade ici dali firmware updater.png|thumb|ICI Firmware updater software with modified firmware loaded]]

there is a easier way using a modified Firmware updater to enable Telnet temporarily to patch the Files.

Download the upgrade_ici.exe form [https://archive.org/details/fwupdate here] and run it.

Then you should be able to connect to it via Telnet. the Login credentials are User: root Password: DLroot

===Patching the Web Server===
This only works if you also patch the Thermal Camera module flash!

====to permanently enable Telnet, go to /etc/init.d and edit S90app====
vi S90app
in vi, move your cursor to the # at #telnetd and press x

now press : and type wq, enter. this should be it.
 

====patching the decoder and streamer to 640x480:====
go to /app and edit the mach.cfg

replace DL384 with D640 and edit the resolution to 640 480

(press i in vi to enter edit mode, press ESC to exit edit mode. :wq to write and quit.)

repeat that procedure for the dali.cfg

====(optional) patching app.sh to prevent it from rebooting====
edit the app.sh in /app and remove all "reboot" occasions to prevent the camera from rebooting if onvifserver, httpd or daliServer arent running for debugging purposes.

===Patching the Thermal Camera module===
To patch it, you need to disassemble everything down to the FPGA Board,

on the bottom there is a SPI SOIC8 Flash.

Use a CH341 EEPROM programmer (be sure to have a fixed or modified version to not put out 5V!, set it to 3.3V) and SOIC8 clamp.

Use NeoProgrammer (i used 2.2.0.10 but there are newer available, use the latest) and click Detect. It should find W25Q128 chips, select the FV one.

Dont forget to download a backup of your flash and save it !

Download the Binary 640x480 cleared pixelmap from below and load it into NeoProgrammer, Click Erase, Program and Verify.

This can take a while.

Your imager should start up right after assembly by hearing the shutter click.
 

===Flash Contents===
a Flash dump of the original downgraded D8X3N can be found [https://archive.org/details/dali-d-843n-flash-dump here]

a Flash dump of a original 640x480 model can be found [https://archive.org/details/d-843-n-640x-480 here]

a Flash dump of the web server SPI flash W25Q256JV can be found [https://archive.org/details/dm-60-webserver-flash-dump here] in case a bad firmware update caused a bootloop.
 

===Flash Binary Analysis===
The Flash IC is a Winbond 25Q128JV SPI Flash that contains the FPGA Bitstream, Deadpixel and Flatmap, aswell as the Device Settings.

a copy of the SPI Logic Capture at startup can be found [https://archive.org/details/dali-eeprom-capture here], the free software [https://www.dreamsourcelab.com/download/ DSView from DreamSourceLab] is required to view it.
[[File:Dali Thermal Imager SPI Flash capture.png|thumb|SPI Flash access while booting the Thermal Module]]

a approximation of the offsets resulted in this list:<syntaxhighlight lang="vb">
0x000000 - altera cyclone iv stuff
0x200000 - settings
0x280000 - Flat field correction map
0x4C0000 - Bad Pixel correctio nmap
0x580000 - image aswell? 36010 bytes
0x740000 - GUIX?
0x7C0000 - Strings for Gui?
0x800000 - another shorter GUIX
0x880000 - Strings for second gui?
0x8C0000 - GUIX
0x940000 - Strings for gui
0xE00000 - ?
0xE80000 - dzxg? short
0xEC0000 - crosshair.bmp
0xF40000 - 3DTM?
0xF80000 - fake? Bad pixel map BPRP
</syntaxhighlight> 

======Settings offset 0x200000======
The settings are read and written every startup, aswell when you close the OSD, sporadically and when executing the command MSV

these are some of the settings i could figure out by changing and watching the logic capture what changed.
 <syntaxhighlight lang="vb">
offset size Cmd
0x0 1 SAG (0-2) auto gain
0x2 2 SVB (0-16383) saved value is 16383 - SVB
0x4 2 SVC (0-1023) set exposure or gain
0x6 1 SSM image filtering
0x8 1 SEH image enhancement
0xA 1 SWP invert b/w polarity
0x14 1 SMR Flip
0x16 1 SMR Mirror
0x20 1 MENU Cal source 0 IN, 1 OUT
0x3A 1 MENU Enhance value 0-100
0x40 1 MENU Rectify (shutter 0 OFF, 1 L, 2 H)
0x50 1 MENU Language 0 english, 1 chinese, 2 russian
0xA2 - SCO set contrast gain
0xA4 - IBR set brightness
0xAE 2 MENU Fire Threshold
0xAC 1 SPA set color palette
0xE2 1 SMS display "collected 0/80" enabled
0xF8 1 SEM set emissivity
0x110 1 SRT set revise temp
0x116 1 SHD set humidity
0x118 1 SET set ambient temp
0x11A 1 STD set temp range
0x120 2 SLG -500 to 500?
0x124 2 SRD set distance
0x12C 1 SCP ???
0x130 2 SCT ???
</syntaxhighlight> 
[[File:Dali D8X3N Bad Pixel Map Viewer.png|thumb|Bad pixel map of a 640x512 sensor, about 0.56% of dead pixels in this map]]
So i let the AI create a [https://2476424.playcode.io/ Configurator page] that lets you change the Settings in your Flashdump to your liking
 

======Bad Pixel and Flatframe Maps 0x280000 and 0x4C0000======
Thermal cameras require a bad pixel and flat frame map to compensate for manufacturing inconsistencies.

unfourtainly, the maps of the downgraded cameras only contain enough data for a 384 model, not the full 640.

at offset 0xF80000 there is a BPRP which was mistaken at first as the Bad pixel map, it could just be a mask to where to apply the offset maps, as its either 0x0 or 0x1.

The [https://2477569.playcode.io/ Viewer Page] is written in JS and does not require any special dependencies, it can run as a plain html file offline.

There still needs to be work done to create own maps and flatfields but the cameras are still very capable and useable with fully cleared maps.

To clear the maps, just go to these offsets and fill with values around 0x3F or 0x0 for total length of X Resolution x Y Resolution x 2 bytes (0x96000 for 640x480)

[[File:Dali D8X3N Flat Field Map Viewer.png|thumb|Flat Field viewer]]

===Dali Commands===
To control the TIM you can either use Pelco or Dali command set. By default the Dali commandset is used at 38400 BAUD.

Those commands consist of a 0x02 start byte followed by two length Bytes, then the actual command which is allways 3 uppercase Letters in ASCII (eg. KBD for keyboard) followed by a comma and the values.

Some commands take multiple values, some dont. But you allways have to send the comma after the Command.

The camera will answer with the Command and 0, 1 or 2. Sending no value counts as zero.
0 is invalid parameters, too few or out of range

1 is OK, valid command

2 is Invalid command

Commands can be sent trough the Web server using the URL Api endpoint or directly trough the UART port.

(keyboard, C button, causes the shutter to do a calibration)
<camera ip>/cgi-bin/dmcmd?Command=KBD,C
Listening to the answer can be done while being in the Linux shell and typing
cat /dev/ttyAMA2 | strings

By bruteforcing the UART with AAA to ZZZ a list of Commands could be obtained, but some with unknown Parameters or functionality yet. including some from a decompiled DM60comm.so module found in /app/modules folder.<syntaxhighlight lang="vb">
KBD KEY Keyboard (F S M C + -)
SSM 0-1 Image Filtering Off/On
GSM 0 Image filter status
SEH 0-1 Image Enhancement Off/On
GEH 0-1 Image enhancer status
SCO 0-255 Set Gain (locked when SAG auto gain is on)
GCO 0-255 Get gain
INT 15-320 set actual gain? not just contrast sometimes disabled?
IBR 0-255 Set brightness
GBR 0-255 Get brightness
SMR 0-3 Mirror mode bit0=horizontal, bit1=vertical
GMR 0 Get rotation/flip
SDT 0-1 displays temp=44.65°C osd, but webserver sends date/time to the cam there....
GDT 0-1 Get temp display active?
GPT Display temp oft SDT
GNU 0-1 Get Shutter closed/open
SNU 0-1 Shutter close / open
STD 0-1 Set Range 0: -20-180°C 1: 100-600°C
GTD 0-1 Get Range
SET °C Set Ambient temperature
GET °C Get Ambient temperature
SEM 0-100 0-1 set emissivity x100
GEM 0-100 Get Emissivity
SRT °C Set revise temperature -100-100 -10-10°
GRT °C Get revise temperature
SRD 100 Set Distance 4.4m x100
GRD 100 Get Distance
SHD 0-100 Set Humidity
GHD 55 Get Humidity
SWP 0-1 invert s/w polarity image
GWP 1 is inverted?
SPA 0-10? Set color palette
GPA 3 white hot
SMV 0-1 Show temperature 3x3 grid?? in combination with GTV maybe
GMV 0
SMS 0-1 displays "collected 0/<number set by SCT>" by SCP delay "saves the daily number of highest temperatures?"
GMS 0
SCT 1-500 sets the amount of "collected" points for SMS
GCT 80
SCP 5-60 "collected" delay in seconds for SMS
GCP 60
SAG 0-2 Auto brightness / gain
GAG 0
SLR 0-9 ???
GLR 0
SRP 0,0 - 639,479 set crosshair position
GRP 320,240 get crosshair position
DRC 0-1 Show crosshair
SLG -500-500 ??
GLG
SCE text ??
GCE 0
SCB text ??
GCB 0
SVB 0-16383 adc offset, exposure? good at 9650
GVB 6733 value is 16383 minus SVB
SVC 1-1023 set contrast but better
GVC 260
SVF 100-? ?? video freaks out 3400 seems good
SVS 100-? ?? video freaks out 3300 seems good
SOT 0-1 ?? sensor supply, looks weird when off.
SZM 1-4 ?
GZM 1
MSV save settings too eeprom
ASV Saves something aswell?
GCS 0 Get Core status & faults
ALD 0,2? video blanks lots of eeprom activity. reload pixel map??
SAV 0-9999 set Fire threshold
GAV 2100 get Fire Threshold
BAC change uart protocol? careful
CBD Displays Recovery successful?
CBS Displays Saved successfully
LRD Displays Recovery successful?
LRS Displays Saved successfully?
LRE Displays Temperature Repair successful?
CBT Displays Calibration successful?
DBP ??? shutter clicks
DPI Show weird pixels
API Hide weird pixels
CCM ??
ASN 0-4 ??
GAB 4 vals ?? 3,-10,50,150
GAN 1 ??
GAR 11 vals ?? 10,10,5,20,35,50,70,90,120,150,180,,
GCM 6 values ??
GFV prints screen gray value?
GIT 200 ??
GTV Get the collected temp values?
PTS echoes but with extra stuff??
QYA 7170 Query Gray Info (information mode)
QYI 7124 Query Gray Average mode
QYM 7512 Query Gray Minimum mode
VTP 400-4000 ??
MTD U/S,0,0 ?? S answers with bytes, U upload bytes?
MTC U/S? ?? S answers with U,0,0, S doesnt.

return 0 invalid params:
STS ??
STT ??
SAC ??
SAH ??
SAS ??
SAT ??
SCX ?? displays crosshair but invalid params
SCY ?? displays crosshair but invalid params
GAC ??
GAH ??
GAS ??
GAT ??
GME ??
GPC ??
GPI ??
GPM ??
GTA ??
GTC ??
GTI ??
GTM ??
GTS ??
GTT ??

answer only:

BPM 0-1 stream ready? answers with 0 stop, 1 go, 2 when prompted
AVS 0,1
MEH
PWI 0-1 changing palette from wh to fire

unconfirmed (from dm60comm.so):
SDT 2024,03,15,14,30,25 Set Date Time with year,month,day,hour,minute,second
STS 1 Set Temperature Show display (0=off, 1=on)
SVA 2 Set Video Auto mode (0=manual, 2=auto)
SMP 0,1,1,0,100,150,200,250,300,350,90,25 Set Measurement Point (type,index,enable,mode,startX,startY,endX,endY,anchorX,anchorY,threshold,color)
STV Stop Temperature View measurements
SPF 5 Set Profile parameter
SVL -10 Set Video Left pan movement (signed value)
SVU -5 Set Video Up tilt movement (signed value)
SVD 5 Set Video Down tilt movement (signed value)
SSP 17,1,0 Set System Parameter (param_id,value,index) #46 temperature format 0 °C, 1 °F, 2 K
SCP Set Current Preset (save current position)
GCP Get Current Preset
STT 300,350 Set Temperature Threshold (low,high values *10)
SDC 1 Set Display Configuration parameter
GCS Get Current Status
GMM Get Memory Map information
GFV Get Frame Value (grayscale data)
GFZ Get Freeze Status
GSI 1 Get System Information (parameter=1)
GSS Get System Status
GSP 21,0 Get System Parameter (param_21=surround temp, value=0)
GTT Get Temperature Threshold range
GTV 1,3,10 Get Temperature Values (enable,type,count)
GNU Get Network Update status (response command)
FRZ Freeze current display frame
LIV Live mode (unfreeze display)
CAL Calibrate system
CCP 3 Call Current Preset (preset number 0-9)
APF 100 Auto Profile setting
MEH Measure Enhancement
BPT Built-in Test
MTC S,0 Measure Temperature Capture (S=start, 0=sequence)
MTG U,0,1024,<data> Measure Temperature Gray data transfer
MTD U,0,1024,<data> Measure Temperature Data transfer
UFP S,0,2048 Update Firmware Prepare (S=start, 0=offset, 2048=size)
UFD S,0,1024 Update Firmware Data transfer
BAB U Buffer operation (U=update)
TTH S,0 Temperature Threshold operation
IPP 192.168.001.102,255.255.255.000,192.168.001.001,192.168.000.001,9989,9998 IP Parameters (IP,netmask,gateway,DNS,port1,port2)
MAC 00:60:A9:10:00:01 MAC Address setting
SNP Set Network Parameters (response command)
QYI Query Gray Info (information mode)
QYA Query Gray Average mode
QYM Query Gray Minimum mode
GAI Get Alarm Info (response command)
YTC <data> Unknown command with data parameter
HTH
LRS
LRD
GAR
DRC
PTS
SCX
SCY
CBT
LRE
CBD
CBS
XXX
GSP
GTT
QYI
QYA
QYM

</syntaxhighlight>

 

===Using the Thermal module without Webserver===
[[File:Dali D8X3C Breakout board.png|thumb|Breakout board for D8X3C ]]
to use it, you need to interface it directly.

The module will put out a Analog video signal (High-Z, need to buffer when connecting it to 75Ohm Video input)

Also a 8 or 14bit or 8-bit BT656 output.

the header exposes the FPGA JTAG and UART aswell as 6 Hardware Keys to Navigate the OSD.

To interface, you need to make a adapter board with a DF12-50DS-0.5V(86) Docking socket.

The breakout board files can be found [https://oshwlab.com/gamerpaddy/d8x3c-backpack-usb here] but may be still work in progress.

 

===Sensor Pinout===
[[File:Dali DLD384 Sensor pinout basic.png|thumb|basic pinout of a DLD384]]
the pinout of the thermal sensor havent been analyzes much.

besides some supply and Control voltages, 3 clocks and a analog output have been found.

17.5MHz

14.705KHz

50Hz

Dali D8X3N Thermal Camera

2025-07-29T14:56:43Z

Gamerpaddy: /* change heading format */

==Dali D8X3N Thermal Camera Reverse Engineering==
 

===Introduction===
The [https://www.dali-irtech.com/productinfo/741567.html Dali D8X3N] Thermal Camera module comes in two versions, a 384x288 and 640x480 resolution, utilizing the [http://www.dali-tech.us/products/dld64017m-uncooled-infrared-fpa-detector-86.html DLD Series] of amorphous-Silicon Microbolometers.

They were mainly used in [http://www.dali-tech.us/products/dm60-w--online-body-temperature-thermal-imaging-camera-55.html Dali DM60-W] or WS-1 Body Temperature screening cameras in conjunction with a Black Body radiator set to 37°C to detect infected individuals at the start of the 2020 Covid Pandemic.
[[File:ICI FM320P Innerts.jpg|thumb|Internals. A TP-Link Switch, HikVision Visible Camera and the D8x3N Network thermal camera module]]
[https://infraredcameras.com/ ICI] rebranded these models as FM 320 P and FM 640 P, and distributed them on the local US market, but as the need for such Cameras exploded, those models were built with what was in stock.

So happens, that some of the FM 320 P Models had a DLD640 640x480 instead of a DLD384 384x288 Microbolometer in them, and just got their Firmware modified.

It also could be, because they have excessive amounts of bad pixels outside the 384x288 area, that they were binned to a lower grade.

Discussions about these Cameras started around 2022 in the [https://www.eevblog.com/forum/thermal-imaging/ici-and-dali-thermal-camera-software/ EEVBlog Forums.] when they started to appear secondhand and affordable.

Originally they were priced around US$ 20... 30.000 by ICI, and a unknown amount by Dali Tech.

The Modules specs according to the manufacturer are:

≤50..60mK@F1，300K，50Hz

17 or 25µm pixel pitch

Hisilicon SoC running Linux to provide Onvif and RTSP streams, analysis and a Web UI

 
[[File:Dali D8X3N Module.jpg|thumb|A real 384x288 model with a DLD384 sensor. notice the Productnumber ]]
ICI FM Cameras are found all over Online secondhand marketplaces for scrap Prices, as they are no longer needed.

But you never know, what are you getting. It could be a real DLD384 or the better DLD640 inside. Its a gamble.
 

======640x480 Imagers======
are labeled 22D843 Nxxxx and have a DLD640 sensor in it, they can be upgraded if they run the 384x288 firmware.

======384x288 Imagers======
are labeled 22D883Nxxxx and have a DLD384 sensor in it, they cannot be upgraded

 

===D8X3N Module closer look===
From now on, i will refer to the Thermal Imaging Module as TIM

On the front there is a 2 Element Germanium Lens of a unknown focal length and aperture.

It can be focus-adjusted when unscrewing the clamp around the housing. It can be focussed from infinity down to 10..20cm with some quality loss.
 The outter diameter of the Lens is 42mm with a 1 1/3 inch thread diameter of undetermined pitch.

Dimensions of the germanium elements are 21mm to 3 and 6mm and 14grams in weight.
[[File:Disassembled Thermal Camera Lens.jpg|thumb|Two element Germanium Lens of unknown focal length and aperture]]

The TIM is composed of 6 Stacked PCB modules, 3 of which are for the Web Server functionality. taking them off will give you the basic configuration of a [https://www.dalithermal.com/productinfo/741568.html Dali D8X3C] TIM<gallery>
File:Dali DLD640 Thermal Image Sensor.jpeg|DLD640 Sensor
File:Dali DLD384 Thermal Imaging Sensor.jpeg|DLD384 Sensor
File:Dali D8X3N Board1 Back.jpeg|Network & GPIO Board Back
File:Dali D8X3N Board1 Front.jpeg|Network & GPIO Board Front
File:Dali D8X3N Glue Board Back.jpeg|Board between Logic and IO Back
File:Dali D8X3N Glue Board Front.jpeg|Board between Logic and IO Front
File:Dali D8X3N SoC Board Back.jpeg|SoC Board back
File:Dali D8X3N SoC Board front.jpeg|SoC board front
File:Dali D8X3N FPGA Board Back.jpeg|FPGA Board of the D8X3C Thermal Imager including a PMIC
File:Dali D8X3N FPGA Board Front.jpeg|FPGA Board Front with Video DAC and SPI Flash
File:Dali D8X3N Sensor Power and ADC Board.jpeg|Sensor control and ADC board
File:Dali D8X3N Thermal Core Debug wiring.jpeg|Debug wiring for sniffing SPI and UART
</gallery>

===User Manual===
including pinout diagram and important data

can be found here https://archive.org/details/dali-d-8-x-3-cuser-manualen-v-1.0-1

===Viewing the Video Stream===
[[File:Onvif Device Manager ODM.png|thumb|ODM streaming the Thermal view]]
when first connecting it to power and Ethernet, the camera will have 192.168.1.102 as a Static ip.

If you are running a 192.168.0.x or .178.x net, you need to change it or add a subnet under windows ipv4 settings.

to view it, you can use VLC and the stream URL
rtsp://admin@admin:<camera ip>/ONVIFMedia
there is /ONVIFMedia /ONVIFMediaM and /ONVIFMediaS for different stream Profiles.

VLC is quite slow and delayed, rather use Onvif Device Manager ODM,

it has no delay and auto-detects cameras in the network.

Be sure to log in as user: admin pass: admin in ODM.

in there, you can also set you camera to DHCP under Network settings.

===Web Interface===
[[File:Dali D8X3N web interface.png|thumb|Since browsers cant display RTSP anymore, open in Edge and select IE Compatibility Mode.]]
the web interface can be accessed by opening the camera IP in a browser

login is:
user: admin pass: admin
You can set Temperature markers and areas, but without using the Black Body calibration source, your readings may be way off or not working.

 

====OSD====
there is a debug-login with
user: super pass: 871897
that lets you send Key commands to the Imager to navigate the OSD.

Setting the OSD to english is accomplished with option #11
[[File:Dali D8X3C OSD.png|thumb|OSD in english, if yours is Chinese. go to option #11 and click + or -]]

To acces some locked menus, press
+ - + - + -
The Password for System and Main menu are not known yet.

Be careful in the UART menu to not change the BAUD rate or Protocol, as your ability to control it via the Web API gets lost.

You need to reflash or solder buttons on the thermal core then.

===Viewing Raw Thermal Data from the Web API===
there is a hidden endpoint in the stream.so file that could be found while decompiling

accessing
[[File:Arduino Nano blink sketch thermal gif.gif|thumb|Arduino Nano running blink sketch while thermally recording it, notice the led and resistor on the right]]
<ip of camera>:5000/stream?Type=JPEG&Source=Jpeg&Mode=TCP
lets you download a JPEG. but there are more options available (not all have been tested)

we are mainly interessted in Raw thermal data.

======'''Source''' (Stream Type)======

*<code>Major</code> - Main video stream (channel 0)
*<code>Minor</code> - Sub video stream (channel 1)
*<code>MinorAV</code> - Sub video + audio stream
*<code>MajorAV</code> - Main video + audio stream
*<code>Jpeg</code> - JPEG snapshot stream
*<code>Raw</code> - Raw thermal data stream
*<code>YUV</code> - YUV raw video stream

======'''Type''' (Data Format)======

*<code>H264</code> - H.264 video encoding
*<code>JPEG</code> - JPEG image format
*<code>RAW</code> - Raw sensor data
*<code>QBOX</code> - Custom protocol format
*<code>FRAME</code> - Frame-based format

======'''Mode''' (Transport Protocol)======

*<code>TCP</code> - TCP streaming (default)
*<code>UDP</code> - UDP streaming
*<code>MUL</code> - Multicast streaming

======'''Quality Parameters'''======

*<code>Quality=[1-100]</code> - Video quality level
*<code>Frames=[number]</code> - Number of frames to send
*<code>Interval=[ms]</code> - Frame interval in milliseconds

======'''Network Parameters'''======

*<code>IPAddr=[ip]</code> - Client IP address for UDP/multicast
*<code>Port=[port]</code> - Client port for UDP/multicast
*<code>Heart-beat=[Yes/No]</code> - Enable/disable heartbeat

======'''Snapshot Parameters'''======

*[[File:Dali D8X3N Raw Thermal viewer.png|thumb|Raw Data Viewer in python]]<code>Snap=[Yes/No]</code> - Enable snapshot mode

To view the raw stream, i made a python program that converts the 14bit thermal data to a visible image.

it is low fps tho, due to bad optimizations.

https://pastebin.com/dyNWDPT3

===Getting Root Terminal Access===
To access the Terminal you need to solder or plug in a UART connection to Connector J7 on the "Glue" board.

Pinout is (left to right) RX TX GND 3.3V

Baud 115200

3.3V

But the system will spam with debug messages, making patching the files a hard job unless you use "tftp" or "sed".
 

===(optional) Enabling Telnet access to make patching easier===
[[File:Upgrade ici dali firmware updater.png|thumb|ICI Firmware updater software with modified firmware loaded]]

there is a easier way using a modified Firmware updater to enable Telnet temporarily to patch the Files.

Download the upgrade_ici.exe form [https://archive.org/details/fwupdate here] and run it.

Then you should be able to connect to it via Telnet. the Login credentials are User: root Password: DLroot

===Patching the Web Server===
This only works if you also patch the Thermal Camera module flash!

====to permanently enable Telnet, go to /etc/init.d and edit S90app====
vi S90app
in vi, move your cursor to the # at #telnetd and press x

now press : and type wq, enter. this should be it.
 

====patching the decoder and streamer to 640x480:====
go to /app and edit the mach.cfg

replace DL384 with D640 and edit the resolution to 640 480

(press i in vi to enter edit mode, press ESC to exit edit mode. :wq to write and quit.)

repeat that procedure for the dali.cfg

====(optional) patching app.sh to prevent it from rebooting====
edit the app.sh in /app and remove all "reboot" occasions to prevent the camera from rebooting if onvifserver, httpd or daliServer arent running for debugging purposes.

===Patching the Thermal Camera module===
To patch it, you need to disassemble everything down to the FPGA Board,

on the bottom there is a SPI SOIC8 Flash.

Use a CH341 EEPROM programmer (be sure to have a fixed or modified version to not put out 5V!, set it to 3.3V) and SOIC8 clamp.

Use NeoProgrammer (i used 2.2.0.10 but there are newer available, use the latest) and click Detect. It should find W25Q128 chips, select the FV one.

Dont forget to download a backup of your flash and save it !

Download the Binary 640x480 cleared pixelmap from below and load it into NeoProgrammer, Click Erase, Program and Verify.

This can take a while.

Your imager should start up right after assembly by hearing the shutter click.
 

===Flash Contents===
a Flash dump of the original downgraded D8X3N can be found [https://archive.org/details/dali-d-843n-flash-dump here]

a Flash dump of a original 640x480 model can be found [https://archive.org/details/d-843-n-640x-480 here]

a Flash dump of the web server SPI flash W25Q256JV can be found [https://archive.org/details/dm-60-webserver-flash-dump here] in case a bad firmware update caused a bootloop.
 

===Flash Binary Analysis===
The Flash IC is a Winbond 25Q128JV SPI Flash that contains the FPGA Bitstream, Deadpixel and Flatmap, aswell as the Device Settings.

a copy of the SPI Logic Capture at startup can be found [https://archive.org/details/dali-eeprom-capture here], the free software [https://www.dreamsourcelab.com/download/ DSView from DreamSourceLab] is required to view it.
[[File:Dali Thermal Imager SPI Flash capture.png|thumb|SPI Flash access while booting the Thermal Module]]

a approximation of the offsets resulted in this list:<syntaxhighlight lang="vb">
0x000000 - altera cyclone iv stuff
0x200000 - settings
0x280000 - Flat field correction map
0x4C0000 - Bad Pixel correctio nmap
0x580000 - image aswell? 36010 bytes
0x740000 - GUIX?
0x7C0000 - Strings for Gui?
0x800000 - another shorter GUIX
0x880000 - Strings for second gui?
0x8C0000 - GUIX
0x940000 - Strings for gui
0xE00000 - ?
0xE80000 - dzxg? short
0xEC0000 - crosshair.bmp
0xF40000 - 3DTM?
0xF80000 - fake? Bad pixel map BPRP
</syntaxhighlight> 

======Settings offset 0x200000======
The settings are read and written every startup, aswell when you close the OSD, sporadically and when executing the command MSV

these are some of the settings i could figure out by changing and watching the logic capture what changed.
 <syntaxhighlight lang="vb">
offset size Cmd
0x0 1 SAG (0-2) auto gain
0x2 2 SVB (0-16383) saved value is 16383 - SVB
0x4 2 SVC (0-1023) set exposure or gain
0x6 1 SSM image filtering
0x8 1 SEH image enhancement
0xA 1 SWP invert b/w polarity
0x14 1 SMR Flip
0x16 1 SMR Mirror
0x20 1 MENU Cal source 0 IN, 1 OUT
0x3A 1 MENU Enhance value 0-100
0x40 1 MENU Rectify (shutter 0 OFF, 1 L, 2 H)
0x50 1 MENU Language 0 english, 1 chinese, 2 russian
0xA2 - SCO set contrast gain
0xA4 - IBR set brightness
0xAE 2 MENU Fire Threshold
0xAC 1 SPA set color palette
0xE2 1 SMS display "collected 0/80" enabled
0xF8 1 SEM set emissivity
0x110 1 SRT set revise temp
0x116 1 SHD set humidity
0x118 1 SET set ambient temp
0x11A 1 STD set temp range
0x120 2 SLG -500 to 500?
0x124 2 SRD set distance
0x12C 1 SCP ???
0x130 2 SCT ???
</syntaxhighlight> 
[[File:Dali D8X3N Bad Pixel Map Viewer.png|thumb|Bad pixel map of a 640x512 sensor, about 0.56% of dead pixels in this map]]
So i let the AI create a [https://2476424.playcode.io/ Configurator page] that lets you change the Settings in your Flashdump to your liking
 

======Bad Pixel and Flatframe Maps 0x280000 and 0x4C0000======
Thermal cameras require a bad pixel and flat frame map to compensate for manufacturing inconsistencies.

unfourtainly, the maps of the downgraded cameras only contain enough data for a 384 model, not the full 640.

at offset 0xF80000 there is a BPRP which was mistaken at first as the Bad pixel map, it could just be a mask to where to apply the offset maps, as its either 0x0 or 0x1.

The [https://2477569.playcode.io/ Viewer Page] is written in JS and does not require any special dependencies, it can run as a plain html file offline.

There still needs to be work done to create own maps and flatfields but the cameras are still very capable and useable with fully cleared maps.

To clear the maps, just go to these offsets and fill with values around 0x3F or 0x0 for total length of X Resolution x Y Resolution x 2 bytes (0x96000 for 640x480)

[[File:Dali D8X3N Flat Field Map Viewer.png|thumb|Flat Field viewer]]

===Dali Commands===
To control the TIM you can either use Pelco or Dali command set. By default the Dali commandset is used at 38400 BAUD.

Those commands consist of a 0x02 start byte followed by two length Bytes, then the actual command which is allways 3 uppercase Letters in ASCII (eg. KBD for keyboard) followed by a comma and the values.

Some commands take multiple values, some dont. But you allways have to send the comma after the Command.

The camera will answer with the Command and 0, 1 or 2. Sending no value counts as zero.
0 is invalid parameters, too few or out of range

1 is OK, valid command

2 is Invalid command

Commands can be sent trough the Web server using the URL Api endpoint or directly trough the UART port.

(keyboard, C button, causes the shutter to do a calibration)
<camera ip>/cgi-bin/dmcmd?Command=KBD,C
Listening to the answer can be done while being in the Linux shell and typing
cat /dev/ttyAMA2 | strings

By bruteforcing the UART with AAA to ZZZ a list of Commands could be obtained, but some with unknown Parameters or functionality yet. including some from a decompiled DM60comm.so module found in /app/modules folder.<syntaxhighlight lang="vb">
KBD KEY Keyboard (F S M C + -)
SSM 0-1 Image Filtering Off/On
GSM 0 Image filter status
SEH 0-1 Image Enhancement Off/On
GEH 0-1 Image enhancer status
SCO 0-255 Set Gain (locked when SAG auto gain is on)
GCO 0-255 Get gain
INT 15-320 set actual gain? not just contrast sometimes disabled?
IBR 0-255 Set brightness
GBR 0-255 Get brightness
SMR 0-3 Mirror mode bit0=horizontal, bit1=vertical
GMR 0 Get rotation/flip
SDT 0-1 displays temp=44.65°C osd, but webserver sends date/time to the cam there....
GDT 0-1 Get temp display active?
GPT Display temp oft SDT
GNU 0-1 Get Shutter closed/open
SNU 0-1 Shutter close / open
STD 0-1 Set Range 0: -20-180°C 1: 100-600°C
GTD 0-1 Get Range
SET °C Set Ambient temperature
GET °C Get Ambient temperature
SEM 0-100 0-1 set emissivity x100
GEM 0-100 Get Emissivity
SRT °C Set revise temperature -100-100 -10-10°
GRT °C Get revise temperature
SRD 100 Set Distance 4.4m x100
GRD 100 Get Distance
SHD 0-100 Set Humidity
GHD 55 Get Humidity
SWP 0-1 invert s/w polarity image
GWP 1 is inverted?
SPA 0-10? Set color palette
GPA 3 white hot
SMV 0-1 Show temperature 3x3 grid?? in combination with GTV maybe
GMV 0
SMS 0-1 displays "collected 0/<number set by SCT>" by SCP delay "saves the daily number of highest temperatures?"
GMS 0
SCT 1-500 sets the amount of "collected" points for SMS
GCT 80
SCP 5-60 "collected" delay in seconds for SMS
GCP 60
SAG 0-2 Auto brightness / gain
GAG 0
SLR 0-9 ???
GLR 0
SRP 0,0 - 639,479 set crosshair position
GRP 320,240 get crosshair position
DRC 0-1 Show crosshair
SLG -500-500 ??
GLG
SCE text ??
GCE 0
SCB text ??
GCB 0
SVB 0-16383 adc offset, exposure? good at 9650
GVB 6733 value is 16383 minus SVB
SVC 1-1023 set contrast but better
GVC 260
SVF 100-? ?? video freaks out 3400 seems good
SVS 100-? ?? video freaks out 3300 seems good
SOT 0-1 ?? sensor supply, looks weird when off.
SZM 1-4 ?
GZM 1
MSV save settings too eeprom
ASV Saves something aswell?
GCS 0 Get Core status & faults
ALD 0,2? video blanks lots of eeprom activity. reload pixel map??
SAV 0-9999 set Fire threshold
GAV 2100 get Fire Threshold
BAC change uart protocol? careful
CBD Displays Recovery successful?
CBS Displays Saved successfully
LRD Displays Recovery successful?
LRS Displays Saved successfully?
LRE Displays Temperature Repair successful?
CBT Displays Calibration successful?
DBP ??? shutter clicks
DPI Show weird pixels
API Hide weird pixels
CCM ??
ASN 0-4 ??
GAB 4 vals ?? 3,-10,50,150
GAN 1 ??
GAR 11 vals ?? 10,10,5,20,35,50,70,90,120,150,180,,
GCM 6 values ??
GFV prints screen gray value?
GIT 200 ??
GTV Get the collected temp values?
PTS echoes but with extra stuff??
QYA 7170 Query Gray Info (information mode)
QYI 7124 Query Gray Average mode
QYM 7512 Query Gray Minimum mode
VTP 400-4000 ??
MTD U/S,0,0 ?? S answers with bytes, U upload bytes?
MTC U/S? ?? S answers with U,0,0, S doesnt.

return 0 invalid params:
STS ??
STT ??
SAC ??
SAH ??
SAS ??
SAT ??
SCX ?? displays crosshair but invalid params
SCY ?? displays crosshair but invalid params
GAC ??
GAH ??
GAS ??
GAT ??
GME ??
GPC ??
GPI ??
GPM ??
GTA ??
GTC ??
GTI ??
GTM ??
GTS ??
GTT ??

answer only:

BPM 0-1 stream ready? answers with 0 stop, 1 go, 2 when prompted
AVS 0,1
MEH
PWI 0-1 changing palette from wh to fire

unconfirmed (from dm60comm.so):
SDT 2024,03,15,14,30,25 Set Date Time with year,month,day,hour,minute,second
STS 1 Set Temperature Show display (0=off, 1=on)
SVA 2 Set Video Auto mode (0=manual, 2=auto)
SMP 0,1,1,0,100,150,200,250,300,350,90,25 Set Measurement Point (type,index,enable,mode,startX,startY,endX,endY,anchorX,anchorY,threshold,color)
STV Stop Temperature View measurements
SPF 5 Set Profile parameter
SVL -10 Set Video Left pan movement (signed value)
SVU -5 Set Video Up tilt movement (signed value)
SVD 5 Set Video Down tilt movement (signed value)
SSP 17,1,0 Set System Parameter (param_id,value,index) #46 temperature format 0 °C, 1 °F, 2 K
SCP Set Current Preset (save current position)
GCP Get Current Preset
STT 300,350 Set Temperature Threshold (low,high values *10)
SDC 1 Set Display Configuration parameter
GCS Get Current Status
GMM Get Memory Map information
GFV Get Frame Value (grayscale data)
GFZ Get Freeze Status
GSI 1 Get System Information (parameter=1)
GSS Get System Status
GSP 21,0 Get System Parameter (param_21=surround temp, value=0)
GTT Get Temperature Threshold range
GTV 1,3,10 Get Temperature Values (enable,type,count)
GNU Get Network Update status (response command)
FRZ Freeze current display frame
LIV Live mode (unfreeze display)
CAL Calibrate system
CCP 3 Call Current Preset (preset number 0-9)
APF 100 Auto Profile setting
MEH Measure Enhancement
BPT Built-in Test
MTC S,0 Measure Temperature Capture (S=start, 0=sequence)
MTG U,0,1024,<data> Measure Temperature Gray data transfer
MTD U,0,1024,<data> Measure Temperature Data transfer
UFP S,0,2048 Update Firmware Prepare (S=start, 0=offset, 2048=size)
UFD S,0,1024 Update Firmware Data transfer
BAB U Buffer operation (U=update)
TTH S,0 Temperature Threshold operation
IPP 192.168.001.102,255.255.255.000,192.168.001.001,192.168.000.001,9989,9998 IP Parameters (IP,netmask,gateway,DNS,port1,port2)
MAC 00:60:A9:10:00:01 MAC Address setting
SNP Set Network Parameters (response command)
QYI Query Gray Info (information mode)
QYA Query Gray Average mode
QYM Query Gray Minimum mode
GAI Get Alarm Info (response command)
YTC <data> Unknown command with data parameter
HTH
LRS
LRD
GAR
DRC
PTS
SCX
SCY
CBT
LRE
CBD
CBS
XXX
GSP
GTT
QYI
QYA
QYM

</syntaxhighlight>

 

===Using the Thermal module without Webserver===
[[File:Dali D8X3C Breakout board.png|thumb|Breakout board for D8X3C ]]
to use it, you need to interface it directly.

The module will put out a Analog video signal (High-Z, need to buffer when connecting it to 75Ohm Video input)

Also a 8 or 14bit or 8-bit BT656 output.

the header exposes the FPGA JTAG and UART aswell as 6 Hardware Keys to Navigate the OSD.

To interface, you need to make a adapter board with a DF12-50DS-0.5V(86) Docking socket.

The breakout board files can be found [https://oshwlab.com/gamerpaddy/d8x3c-backpack-usb here] but may be still work in progress.

 

===Sensor Pinout===
[[File:Dali DLD384 Sensor pinout basic.png|thumb|basic pinout of a DLD384]]
the pinout of the thermal sensor havent been analyzes much.

besides some supply and Control voltages, 3 clocks and a analog output have been found.

17.5MHz

14.705KHz

50Hz

Dali D8X3N Thermal Camera

2025-07-29T14:55:57Z

Gamerpaddy: Refinement milestone

==Dali D8X3N Thermal Camera Reverse Engineering==
 

===Introduction===
The [https://www.dali-irtech.com/productinfo/741567.html Dali D8X3N] Thermal Camera module comes in two versions, a 384x288 and 640x480 resolution, utilizing the [http://www.dali-tech.us/products/dld64017m-uncooled-infrared-fpa-detector-86.html DLD Series] of amorphous-Silicon Microbolometers.

They were mainly used in [http://www.dali-tech.us/products/dm60-w--online-body-temperature-thermal-imaging-camera-55.html Dali DM60-W] or WS-1 Body Temperature screening cameras in conjunction with a Black Body radiator set to 37°C to detect infected individuals at the start of the 2020 Covid Pandemic.
[[File:ICI FM320P Innerts.jpg|thumb|Internals. A TP-Link Switch, HikVision Visible Camera and the D8x3N Network thermal camera module]]
[https://infraredcameras.com/ ICI] rebranded these models as FM 320 P and FM 640 P, and distributed them on the local US market, but as the need for such Cameras exploded, those models were built with what was in stock.

So happens, that some of the FM 320 P Models had a DLD640 640x480 instead of a DLD384 384x288 Microbolometer in them, and just got their Firmware modified.

It also could be, because they have excessive amounts of bad pixels outside the 384x288 area, that they were binned to a lower grade.

Discussions about these Cameras started around 2022 in the [https://www.eevblog.com/forum/thermal-imaging/ici-and-dali-thermal-camera-software/ EEVBlog Forums.] when they started to appear secondhand and affordable.

Originally they were priced around US$ 20... 30.000 by ICI, and a unknown amount by Dali Tech.

The Modules specs according to the manufacturer are:

≤50..60mK@F1，300K，50Hz

17 or 25µm pixel pitch

Hisilicon SoC running Linux to provide Onvif and RTSP streams, analysis and a Web UI

 
[[File:Dali D8X3N Module.jpg|thumb|A real 384x288 model with a DLD384 sensor. notice the Productnumber ]]
ICI FM Cameras are found all over Online secondhand marketplaces for scrap Prices, as they are no longer needed.

But you never know, what are you getting. It could be a real DLD384 or the better DLD640 inside. Its a gamble.
 

======640x480 Imagers======
are labeled 22D843 Nxxxx and have a DLD640 sensor in it, they can be upgraded if they run the 384x288 firmware.

======384x288 Imagers======
are labeled 22D883Nxxxx and have a DLD384 sensor in it, they cannot be upgraded

 

===D8X3N Module closer look===
From now on, i will refer to the Thermal Imaging Module as TIM

On the front there is a 2 Element Germanium Lens of a unknown focal length and aperture.

It can be focus-adjusted when unscrewing the clamp around the housing. It can be focussed from infinity down to 10..20cm with some quality loss.
 The outter diameter of the Lens is 42mm with a 1 1/3 inch thread diameter of undetermined pitch.

Dimensions of the germanium elements are 21mm to 3 and 6mm and 14grams in weight.
[[File:Disassembled Thermal Camera Lens.jpg|thumb|Two element Germanium Lens of unknown focal length and aperture]]

The TIM is composed of 6 Stacked PCB modules, 3 of which are for the Web Server functionality. taking them off will give you the basic configuration of a [https://www.dalithermal.com/productinfo/741568.html Dali D8X3C] TIM<gallery>
File:Dali DLD640 Thermal Image Sensor.jpeg|DLD640 Sensor
File:Dali DLD384 Thermal Imaging Sensor.jpeg|DLD384 Sensor
File:Dali D8X3N Board1 Back.jpeg|Network & GPIO Board Back
File:Dali D8X3N Board1 Front.jpeg|Network & GPIO Board Front
File:Dali D8X3N Glue Board Back.jpeg|Board between Logic and IO Back
File:Dali D8X3N Glue Board Front.jpeg|Board between Logic and IO Front
File:Dali D8X3N SoC Board Back.jpeg|SoC Board back
File:Dali D8X3N SoC Board front.jpeg|SoC board front
File:Dali D8X3N FPGA Board Back.jpeg|FPGA Board of the D8X3C Thermal Imager including a PMIC
File:Dali D8X3N FPGA Board Front.jpeg|FPGA Board Front with Video DAC and SPI Flash
File:Dali D8X3N Sensor Power and ADC Board.jpeg|Sensor control and ADC board
File:Dali D8X3N Thermal Core Debug wiring.jpeg|Debug wiring for sniffing SPI and UART
</gallery>

=== User Manual ===
including pinout diagram and important data

can be found here https://archive.org/details/dali-d-8-x-3-cuser-manualen-v-1.0-1

=== Viewing the Video Stream ===
[[File:Onvif Device Manager ODM.png|thumb|ODM streaming the Thermal view]]
when first connecting it to power and Ethernet, the camera will have 192.168.1.102 as a Static ip.

If you are running a 192.168.0.x or .178.x net, you need to change it or add a subnet under windows ipv4 settings.

to view it, you can use VLC and the stream URL
rtsp://admin@admin:<camera ip>/ONVIFMedia
there is /ONVIFMedia /ONVIFMediaM and /ONVIFMediaS for different stream Profiles.

VLC is quite slow and delayed, rather use Onvif Device Manager ODM,

it has no delay and auto-detects cameras in the network.

Be sure to log in as user: admin pass: admin in ODM.

in there, you can also set you camera to DHCP under Network settings.

=== Web Interface ===
[[File:Dali D8X3N web interface.png|thumb|Since browsers cant display RTSP anymore, open in Edge and select IE Compatibility Mode.]]
the web interface can be accessed by opening the camera IP in a browser

login is:
user: admin pass: admin
You can set Temperature markers and areas, but without using the Black Body calibration source, your readings may be way off or not working.

 

==== OSD ====
there is a debug-login with
user: super pass: 871897
that lets you send Key commands to the Imager to navigate the OSD.

Setting the OSD to english is accomplished with option #11
[[File:Dali D8X3C OSD.png|thumb|OSD in english, if yours is Chinese. go to option #11 and click + or -]]

To acces some locked menus, press
+ - + - + -
The Password for System and Main menu are not known yet.

Be careful in the UART menu to not change the BAUD rate or Protocol, as your ability to control it via the Web API gets lost.

You need to reflash or solder buttons on the thermal core then.

=== Viewing Raw Thermal Data from the Web API ===
there is a hidden endpoint in the stream.so file that could be found while decompiling

accessing
[[File:Arduino Nano blink sketch thermal gif.gif|thumb|Arduino Nano running blink sketch while thermally recording it, notice the led and resistor on the right]]
<ip of camera>:5000/stream?Type=JPEG&Source=Jpeg&Mode=TCP
lets you download a JPEG. but there are more options available (not all have been tested)

we are mainly interessted in Raw thermal data.

=== '''Source''' (Stream Type) ===

* <code>Major</code> - Main video stream (channel 0)
* <code>Minor</code> - Sub video stream (channel 1)
* <code>MinorAV</code> - Sub video + audio stream
* <code>MajorAV</code> - Main video + audio stream
* <code>Jpeg</code> - JPEG snapshot stream
* <code>Raw</code> - Raw thermal data stream
* <code>YUV</code> - YUV raw video stream

=== '''Type''' (Data Format) ===

* <code>H264</code> - H.264 video encoding
* <code>JPEG</code> - JPEG image format
* <code>RAW</code> - Raw sensor data
* <code>QBOX</code> - Custom protocol format
* <code>FRAME</code> - Frame-based format

=== '''Mode''' (Transport Protocol) ===

* <code>TCP</code> - TCP streaming (default)
* <code>UDP</code> - UDP streaming
* <code>MUL</code> - Multicast streaming

=== '''Quality Parameters''' ===

* <code>Quality=[1-100]</code> - Video quality level
* <code>Frames=[number]</code> - Number of frames to send
* <code>Interval=[ms]</code> - Frame interval in milliseconds

=== '''Network Parameters''' ===

* <code>IPAddr=[ip]</code> - Client IP address for UDP/multicast
* <code>Port=[port]</code> - Client port for UDP/multicast
* <code>Heart-beat=[Yes/No]</code> - Enable/disable heartbeat

=== '''Snapshot Parameters''' ===

* [[File:Dali D8X3N Raw Thermal viewer.png|thumb|Raw Data Viewer in python]]<code>Snap=[Yes/No]</code> - Enable snapshot mode

To view the raw stream, i made a python program that converts the 14bit thermal data to a visible image.

it is low fps tho, due to bad optimizations.

https://pastebin.com/dyNWDPT3

=== Getting Root Terminal Access ===
To access the Terminal you need to solder or plug in a UART connection to Connector J7 on the "Glue" board.

Pinout is (left to right) RX TX GND 3.3V

Baud 115200

3.3V

But the system will spam with debug messages, making patching the files a hard job unless you use "tftp" or "sed".
 

=== (optional) Enabling Telnet access to make patching easier ===
[[File:Upgrade ici dali firmware updater.png|thumb|ICI Firmware updater software with modified firmware loaded]]

there is a easier way using a modified Firmware updater to enable Telnet temporarily to patch the Files.

Download the upgrade_ici.exe form [https://archive.org/details/fwupdate here] and run it.

Then you should be able to connect to it via Telnet. the Login credentials are User: root Password: DLroot

=== Patching the Web Server ===
This only works if you also patch the Thermal Camera module flash!

==== to permanently enable Telnet, go to /etc/init.d and edit S90app ====
vi S90app
in vi, move your cursor to the # at #telnetd and press x

now press : and type wq, enter. this should be it.
 

==== patching the decoder and streamer to 640x480: ====
go to /app and edit the mach.cfg

replace DL384 with D640 and edit the resolution to 640 480

(press i in vi to enter edit mode, press ESC to exit edit mode. :wq to write and quit.)

repeat that procedure for the dali.cfg

==== (optional) patching app.sh to prevent it from rebooting ====
edit the app.sh in /app and remove all "reboot" occasions to prevent the camera from rebooting if onvifserver, httpd or daliServer arent running for debugging purposes.

=== Patching the Thermal Camera module ===
To patch it, you need to disassemble everything down to the FPGA Board,

on the bottom there is a SPI SOIC8 Flash.

Use a CH341 EEPROM programmer (be sure to have a fixed or modified version to not put out 5V!, set it to 3.3V) and SOIC8 clamp.

Use NeoProgrammer (i used 2.2.0.10 but there are newer available, use the latest) and click Detect. It should find W25Q128 chips, select the FV one.

Dont forget to download a backup of your flash and save it !

Download the Binary 640x480 cleared pixelmap from below and load it into NeoProgrammer, Click Erase, Program and Verify.

This can take a while.

Your imager should start up right after assembly by hearing the shutter click.
 

=== Flash Contents ===
a Flash dump of the original downgraded D8X3N can be found [https://archive.org/details/dali-d-843n-flash-dump here]

a Flash dump of a original 640x480 model can be found [https://archive.org/details/d-843-n-640x-480 here]

a Flash dump of the web server SPI flash W25Q256JV can be found [https://archive.org/details/dm-60-webserver-flash-dump here] in case a bad firmware update caused a bootloop.
 

=== Flash Binary Analysis ===
The Flash IC is a Winbond 25Q128JV SPI Flash that contains the FPGA Bitstream, Deadpixel and Flatmap, aswell as the Device Settings.

a copy of the SPI Logic Capture at startup can be found [https://archive.org/details/dali-eeprom-capture here], the free software [https://www.dreamsourcelab.com/download/ DSView from DreamSourceLab] is required to view it.
[[File:Dali Thermal Imager SPI Flash capture.png|thumb|SPI Flash access while booting the Thermal Module]]

a approximation of the offsets resulted in this list:<syntaxhighlight lang="vb">
0x000000 - altera cyclone iv stuff
0x200000 - settings
0x280000 - Flat field correction map
0x4C0000 - Bad Pixel correctio nmap
0x580000 - image aswell? 36010 bytes
0x740000 - GUIX?
0x7C0000 - Strings for Gui?
0x800000 - another shorter GUIX
0x880000 - Strings for second gui?
0x8C0000 - GUIX
0x940000 - Strings for gui
0xE00000 - ?
0xE80000 - dzxg? short
0xEC0000 - crosshair.bmp
0xF40000 - 3DTM?
0xF80000 - fake? Bad pixel map BPRP
</syntaxhighlight> 

====== Settings offset 0x200000 ======
The settings are read and written every startup, aswell when you close the OSD, sporadically and when executing the command MSV

these are some of the settings i could figure out by changing and watching the logic capture what changed.
 <syntaxhighlight lang="vb">
offset size Cmd
0x0 1 SAG (0-2) auto gain
0x2 2 SVB (0-16383) saved value is 16383 - SVB
0x4 2 SVC (0-1023) set exposure or gain
0x6 1 SSM image filtering
0x8 1 SEH image enhancement
0xA 1 SWP invert b/w polarity
0x14 1 SMR Flip
0x16 1 SMR Mirror
0x20 1 MENU Cal source 0 IN, 1 OUT
0x3A 1 MENU Enhance value 0-100
0x40 1 MENU Rectify (shutter 0 OFF, 1 L, 2 H)
0x50 1 MENU Language 0 english, 1 chinese, 2 russian
0xA2 - SCO set contrast gain
0xA4 - IBR set brightness
0xAE 2 MENU Fire Threshold
0xAC 1 SPA set color palette
0xE2 1 SMS display "collected 0/80" enabled
0xF8 1 SEM set emissivity
0x110 1 SRT set revise temp
0x116 1 SHD set humidity
0x118 1 SET set ambient temp
0x11A 1 STD set temp range
0x120 2 SLG -500 to 500?
0x124 2 SRD set distance
0x12C 1 SCP ???
0x130 2 SCT ???
</syntaxhighlight> 
[[File:Dali D8X3N Bad Pixel Map Viewer.png|thumb|Bad pixel map of a 640x512 sensor, about 0.56% of dead pixels in this map]]
So i let the AI create a [https://2476424.playcode.io/ Configurator page] that lets you change the Settings in your Flashdump to your liking
 

====== Bad Pixel and Flatframe Maps 0x280000 and 0x4C0000 ======
Thermal cameras require a bad pixel and flat frame map to compensate for manufacturing inconsistencies.

unfourtainly, the maps of the downgraded cameras only contain enough data for a 384 model, not the full 640.

at offset 0xF80000 there is a BPRP which was mistaken at first as the Bad pixel map, it could just be a mask to where to apply the offset maps, as its either 0x0 or 0x1.

The [https://2477569.playcode.io/ Viewer Page] is written in JS and does not require any special dependencies, it can run as a plain html file offline.

There still needs to be work done to create own maps and flatfields but the cameras are still very capable and useable with fully cleared maps.

To clear the maps, just go to these offsets and fill with values around 0x3F or 0x0 for total length of X Resolution x Y Resolution x 2 bytes (0x96000 for 640x480)

[[File:Dali D8X3N Flat Field Map Viewer.png|thumb|Flat Field viewer]]

=== Dali Commands ===
To control the TIM you can either use Pelco or Dali command set. By default the Dali commandset is used at 38400 BAUD.

Those commands consist of a 0x02 start byte followed by two length Bytes, then the actual command which is allways 3 uppercase Letters in ASCII (eg. KBD for keyboard) followed by a comma and the values.

Some commands take multiple values, some dont. But you allways have to send the comma after the Command.

The camera will answer with the Command and 0, 1 or 2. Sending no value counts as zero.
0 is invalid parameters, too few or out of range

1 is OK, valid command

2 is Invalid command

Commands can be sent trough the Web server using the URL Api endpoint or directly trough the UART port.

(keyboard, C button, causes the shutter to do a calibration)
<camera ip>/cgi-bin/dmcmd?Command=KBD,C
Listening to the answer can be done while being in the Linux shell and typing
cat /dev/ttyAMA2 | strings

By bruteforcing the UART with AAA to ZZZ a list of Commands could be obtained, but some with unknown Parameters or functionality yet. including some from a decompiled DM60comm.so module found in /app/modules folder.<syntaxhighlight lang="vb">
KBD KEY Keyboard (F S M C + -)
SSM 0-1 Image Filtering Off/On
GSM 0 Image filter status
SEH 0-1 Image Enhancement Off/On
GEH 0-1 Image enhancer status
SCO 0-255 Set Gain (locked when SAG auto gain is on)
GCO 0-255 Get gain
INT 15-320 set actual gain? not just contrast sometimes disabled?
IBR 0-255 Set brightness
GBR 0-255 Get brightness
SMR 0-3 Mirror mode bit0=horizontal, bit1=vertical
GMR 0 Get rotation/flip
SDT 0-1 displays temp=44.65°C osd, but webserver sends date/time to the cam there....
GDT 0-1 Get temp display active?
GPT Display temp oft SDT
GNU 0-1 Get Shutter closed/open
SNU 0-1 Shutter close / open
STD 0-1 Set Range 0: -20-180°C 1: 100-600°C
GTD 0-1 Get Range
SET °C Set Ambient temperature
GET °C Get Ambient temperature
SEM 0-100 0-1 set emissivity x100
GEM 0-100 Get Emissivity
SRT °C Set revise temperature -100-100 -10-10°
GRT °C Get revise temperature
SRD 100 Set Distance 4.4m x100
GRD 100 Get Distance
SHD 0-100 Set Humidity
GHD 55 Get Humidity
SWP 0-1 invert s/w polarity image
GWP 1 is inverted?
SPA 0-10? Set color palette
GPA 3 white hot
SMV 0-1 Show temperature 3x3 grid?? in combination with GTV maybe
GMV 0
SMS 0-1 displays "collected 0/<number set by SCT>" by SCP delay "saves the daily number of highest temperatures?"
GMS 0
SCT 1-500 sets the amount of "collected" points for SMS
GCT 80
SCP 5-60 "collected" delay in seconds for SMS
GCP 60
SAG 0-2 Auto brightness / gain
GAG 0
SLR 0-9 ???
GLR 0
SRP 0,0 - 639,479 set crosshair position
GRP 320,240 get crosshair position
DRC 0-1 Show crosshair
SLG -500-500 ??
GLG
SCE text ??
GCE 0
SCB text ??
GCB 0
SVB 0-16383 adc offset, exposure? good at 9650
GVB 6733 value is 16383 minus SVB
SVC 1-1023 set contrast but better
GVC 260
SVF 100-? ?? video freaks out 3400 seems good
SVS 100-? ?? video freaks out 3300 seems good
SOT 0-1 ?? sensor supply, looks weird when off.
SZM 1-4 ?
GZM 1
MSV save settings too eeprom
ASV Saves something aswell?
GCS 0 Get Core status & faults
ALD 0,2? video blanks lots of eeprom activity. reload pixel map??
SAV 0-9999 set Fire threshold
GAV 2100 get Fire Threshold
BAC change uart protocol? careful
CBD Displays Recovery successful?
CBS Displays Saved successfully
LRD Displays Recovery successful?
LRS Displays Saved successfully?
LRE Displays Temperature Repair successful?
CBT Displays Calibration successful?
DBP ??? shutter clicks
DPI Show weird pixels
API Hide weird pixels
CCM ??
ASN 0-4 ??
GAB 4 vals ?? 3,-10,50,150
GAN 1 ??
GAR 11 vals ?? 10,10,5,20,35,50,70,90,120,150,180,,
GCM 6 values ??
GFV prints screen gray value?
GIT 200 ??
GTV Get the collected temp values?
PTS echoes but with extra stuff??
QYA 7170 Query Gray Info (information mode)
QYI 7124 Query Gray Average mode
QYM 7512 Query Gray Minimum mode
VTP 400-4000 ??
MTD U/S,0,0 ?? S answers with bytes, U upload bytes?
MTC U/S? ?? S answers with U,0,0, S doesnt.

return 0 invalid params:
STS ??
STT ??
SAC ??
SAH ??
SAS ??
SAT ??
SCX ?? displays crosshair but invalid params
SCY ?? displays crosshair but invalid params
GAC ??
GAH ??
GAS ??
GAT ??
GME ??
GPC ??
GPI ??
GPM ??
GTA ??
GTC ??
GTI ??
GTM ??
GTS ??
GTT ??

answer only:

BPM 0-1 stream ready? answers with 0 stop, 1 go, 2 when prompted
AVS 0,1
MEH
PWI 0-1 changing palette from wh to fire

unconfirmed (from dm60comm.so):
SDT 2024,03,15,14,30,25 Set Date Time with year,month,day,hour,minute,second
STS 1 Set Temperature Show display (0=off, 1=on)
SVA 2 Set Video Auto mode (0=manual, 2=auto)
SMP 0,1,1,0,100,150,200,250,300,350,90,25 Set Measurement Point (type,index,enable,mode,startX,startY,endX,endY,anchorX,anchorY,threshold,color)
STV Stop Temperature View measurements
SPF 5 Set Profile parameter
SVL -10 Set Video Left pan movement (signed value)
SVU -5 Set Video Up tilt movement (signed value)
SVD 5 Set Video Down tilt movement (signed value)
SSP 17,1,0 Set System Parameter (param_id,value,index) #46 temperature format 0 °C, 1 °F, 2 K
SCP Set Current Preset (save current position)
GCP Get Current Preset
STT 300,350 Set Temperature Threshold (low,high values *10)
SDC 1 Set Display Configuration parameter
GCS Get Current Status
GMM Get Memory Map information
GFV Get Frame Value (grayscale data)
GFZ Get Freeze Status
GSI 1 Get System Information (parameter=1)
GSS Get System Status
GSP 21,0 Get System Parameter (param_21=surround temp, value=0)
GTT Get Temperature Threshold range
GTV 1,3,10 Get Temperature Values (enable,type,count)
GNU Get Network Update status (response command)
FRZ Freeze current display frame
LIV Live mode (unfreeze display)
CAL Calibrate system
CCP 3 Call Current Preset (preset number 0-9)
APF 100 Auto Profile setting
MEH Measure Enhancement
BPT Built-in Test
MTC S,0 Measure Temperature Capture (S=start, 0=sequence)
MTG U,0,1024,<data> Measure Temperature Gray data transfer
MTD U,0,1024,<data> Measure Temperature Data transfer
UFP S,0,2048 Update Firmware Prepare (S=start, 0=offset, 2048=size)
UFD S,0,1024 Update Firmware Data transfer
BAB U Buffer operation (U=update)
TTH S,0 Temperature Threshold operation
IPP 192.168.001.102,255.255.255.000,192.168.001.001,192.168.000.001,9989,9998 IP Parameters (IP,netmask,gateway,DNS,port1,port2)
MAC 00:60:A9:10:00:01 MAC Address setting
SNP Set Network Parameters (response command)
QYI Query Gray Info (information mode)
QYA Query Gray Average mode
QYM Query Gray Minimum mode
GAI Get Alarm Info (response command)
YTC <data> Unknown command with data parameter
HTH
LRS
LRD
GAR
DRC
PTS
SCX
SCY
CBT
LRE
CBD
CBS
XXX
GSP
GTT
QYI
QYA
QYM

</syntaxhighlight>

 

=== Using the Thermal module without Webserver ===
[[File:Dali D8X3C Breakout board.png|thumb|Breakout board for D8X3C ]]
to use it, you need to interface it directly.

The module will put out a Analog video signal (High-Z, need to buffer when connecting it to 75Ohm Video input)

Also a 8 or 14bit or 8-bit BT656 output.

the header exposes the FPGA JTAG and UART aswell as 6 Hardware Keys to Navigate the OSD.

To interface, you need to make a adapter board with a DF12-50DS-0.5V(86) Docking socket.

The breakout board files can be found [https://oshwlab.com/gamerpaddy/d8x3c-backpack-usb here] but may be still work in progress.

 

=== Sensor Pinout ===
[[File:Dali DLD384 Sensor pinout basic.png|thumb|basic pinout of a DLD384]]
the pinout of the thermal sensor havent been analyzes much.

besides some supply and Control voltages, 3 clocks and a analog output have been found.

17.5MHz

14.705KHz

50Hz

File:Dali D8X3C Breakout board.png

2025-07-29T14:51:35Z

Gamerpaddy:

breakout board for thermal camera module to acces io

File:Dali DLD384 Sensor pinout basic.png

2025-07-29T14:42:38Z

Gamerpaddy:

still needs work to find out the pinout of a DLD384 Thermal sensor

File:Arduino Nano blink sketch thermal gif.gif

2025-07-29T14:39:02Z

Gamerpaddy:

GIF of a arduino nano running blink sketch and components heating up

File:Dali D8X3N Raw Thermal viewer.png

2025-07-29T14:38:08Z

Gamerpaddy:

python program to view raw thermal data stream

File:Dali D8X3N web interface.png

2025-07-29T14:27:28Z

Gamerpaddy:

to view the stream, open in Edge and select IE compatibility mode

File:Dali D8X3C OSD.png

2025-07-29T14:26:08Z

Gamerpaddy:

OSD of a thermal camera

File:Onvif Device Manager ODM.png

2025-07-29T14:23:19Z

Gamerpaddy:

for viewing ip camera streams

File:Upgrade ici dali firmware updater.png

2025-07-29T14:03:59Z

Gamerpaddy:

software to upgrade webserver firmware

File:Dali D8X3N Flat Field Map Viewer.png

2025-07-29T13:48:59Z

Gamerpaddy:

software to view flatfield correction maps for dali d8x3n camera

File:Dali D8X3N Bad Pixel Map Viewer.png

2025-07-29T13:47:23Z

Gamerpaddy:

Bad pixel map viewer software

File:Dali Thermal Imager SPI Flash capture.png

2025-07-29T13:37:51Z

Gamerpaddy:

logic capture of the SPI bus while booting up

File:Dali D8X3N Thermal Core Debug wiring.jpeg

2025-07-29T13:25:21Z

Gamerpaddy: For sniffing SPI and UART

== Summary ==
For sniffing SPI and UART

File:Dali D8X3N Sensor Power and ADC Board.jpeg

2025-07-29T13:24:02Z

Gamerpaddy: Power and ADC board for control and pixel data acquisition

== Summary ==
Power and ADC board for control and pixel data acquisition

File:Dali D8X3N FPGA Board Front.jpeg

2025-07-29T13:22:26Z

Gamerpaddy: the Front of the FPGA board including RAM, Video DAC and SPI Flash

== Summary ==
the Front of the FPGA board including RAM, Video DAC and SPI Flash

File:Dali D8X3N FPGA Board Back.jpeg

2025-07-29T13:20:57Z

Gamerpaddy: the part where Dali D8X3N becomes D8X3C

== Summary ==
the part where Dali D8X3N becomes D8X3C

File:Dali D8X3N SoC Board front.jpeg

2025-07-29T13:20:02Z

Gamerpaddy: front SoC board with RAM and PMIC

== Summary ==
front SoC board with RAM and PMIC

File:Dali D8X3N SoC Board Back.jpeg

2025-07-29T13:18:59Z

Gamerpaddy: SoC board with SPI Flash

== Summary ==
SoC board with SPI Flash

File:Dali D8X3N Glue Board Front.jpeg

2025-07-29T13:17:30Z

Gamerpaddy: Front Glue Board (between Logic and IO)

== Summary ==
Front Glue Board (between Logic and IO)

File:Dali D8X3N Glue Board Back.jpeg

2025-07-29T13:16:03Z

Gamerpaddy: Dali D8X3N Glue (Board inbetween Logic and IO) Board back side

== Summary ==
Dali D8X3N Glue (Board inbetween Logic and IO) Board back side

File:Dali D8X3N Board1 Front.jpeg

2025-07-29T13:14:40Z

Gamerpaddy: Dali D8X3N Network & GPIO Board Front

== Summary ==
Dali D8X3N Network & GPIO Board Front

File:Dali D8X3N Board1 Back.jpeg

2025-07-29T13:13:38Z

Gamerpaddy: Network Port & GPIO Board of a Dali D8X3N

== Summary ==
Network Port & GPIO Board of a Dali D8X3N

File:Dali DLD384 Thermal Imaging Sensor.jpeg

2025-07-29T13:12:24Z

Gamerpaddy: 384x288 60mK amorphous-Silicon 50Hz thermal image sensor

== Summary ==
384x288 60mK amorphous-Silicon 50Hz thermal image sensor