82
edits
Changes
m
==Dali D8X3N Thermal Camera Reverse Engineering==
===D8X3N Module closer look===
===Viewing the Video Stream===
===Viewing Raw Thermal Data from the Web API===
='''/app/web/webpages/cgi-bin/proxy.cgi''' https://pastebin.com/vii1HXcU then run chmod +x /app/web/webpages/cgi-bin/proxy.cgi'''restart''' your camera. It should be accessible now trough '''http://<camera ip>/raw.html''' in the browser and click Start Stream '''NOTE''': ''<u>If it does not work</u>'', check the contents of both files. FTP sometimes messes them up. also run dos2unix /app/web/webpages/cgi-bin/proxy.cgibecause linux <> windows difficulties that couldnt be resolved in over 30 years. <blockquote> performance may need improvement.</blockquote> ==Getting Root Terminal Access===
====to permanently enable Telnet, go to '''/etc/init.d''' and edit '''S90app'''====
<br />
<br />
======Bad Pixel and Flatframe Maps 0x280000 and 0x4C0000======
There still needs to be work done ''See "Automatic Dead Pixels and Flatmap Correction" below how to create own maps new dead pixel and flatfields but flatmaps using the cameras are still very capable and useable with fully cleared mapssystem menu. To clear the maps, just go to these offsets and fill with values around 0x3F or 0x0 for total length of X Resolution x Y Resolution x 2 bytes (0x96000 for 640x480)''
===Dali Commands===
===Secret Menu Overview===
===Using the Thermal module without Webserver===[[File:Dali D8X3C Breakout boardBreakoutboard d8x3c dali v1.1.png|alt=|thumb|Breakout board for D8X3C ]]
The breakout board files can be found [https://oshwlab*FPGA JTAG*UART 3.com/gamerpaddy/d8x3c3V with pin compatible FT232 socket*Power 5V over USB-backpack-usb here] but may be still work in progressC*5 Button inputs*Buffered video output and socket for USB Videograbber*Digital 14 bit video out header with hsync vsync and clk.*
===Sensor Pinout===
added professional pcb adapter
<br />
<br />
From now on, i will refer to the Thermal Imaging Module as TIM
[[File:Onvif Device Manager ODM.png|thumb|ODM streaming the Thermal view]]
when first connecting it to power and Ethernet, the camera will have 192.168.1.102 as a Static ip.
there is a hidden endpoint in the stream.so file that could be found while decompiling
====Snapshot Parameters====
*<code>Snap=[Yes/No]</code> - Enable snapshot mode <br />====Raw Viewer for PC (Python)====[[File:Dali D8X3N Raw Thermal viewer.png|thumb|Raw Data Viewer in python]]<code>Snap=[Yes/No]</code> - Enable snapshot mode
it is low fps tho, due to bad optimizations.
rev1 first working version https://pastebin.com/dyNWDPT3 rev2 with temperature readout https://pastebin.com/u107Q85w rev3 and onward will only be available directly as a Webpage on the Device (see below). ====Raw Viewer for the internal Webserver (recommended)====It is also possible to use the Raw viewer directly in the browser. To achieve this, the stream had to be proxied from port 5000 to 80 due to CORS. luckily the internal lighttpd had the CGI module enabled, so piping it troug (using wget ... i know) worked with very low overhead.
To install, you need '''Terminal access''' to the Camera. see below.
optional for simplicity: '''ftp''' access
[[File:Dali D8X3N Webviewer.png|thumb|Web Raw Viewer with histogram (rev3)]]
Create the files and the code inside.
'''/app/web/webpages/raw.html''' https://pastebin.com/kaiXwAgD
and
To access the Terminal you need to solder or plug in a UART connection to Connector J7 on the "Glue" board.
<br />
===(optional) =Enabling Telnet access to make patching easier====
[[File:Upgrade ici dali firmware updater.png|thumb|ICI Firmware updater software with modified firmware loaded]]
The Login credentials are '''User: roo'''t '''Password: DLroot'''
<br />
===Patching Device===
===Patching the Web Server===
<br />
====Enabling Telnet and ftpd permanently====
This only works if you also patch the Thermal Camera module flash!
vi S90app
in vi, move your cursor to the '''#''' at '''#telnetd''' and press x<blockquote>optional: enable ftp by removing the '''#''' at '''ftpd''' and adjust the path to / </blockquote>now press ''':''' and type '''wq''' and hit '''enter'''. this should be it.
====patching Patching the decoder and streamer to 640x480:====
go to /app and edit the mach.cfg
edit the app.sh in /app and remove all "reboot" occasions to prevent the camera from rebooting if onvifserver, httpd or daliServer arent running for debugging purposes.
<br /> ====Patching the Thermal Camera module====
To patch it, you need to disassemble everything down to the FPGA Board,
==Hardware Hacking==
===Flash Contents===
<br />
Thermal cameras require a bad pixel and flat frame map to compensate for manufacturing inconsistencies.
The [https://2477569.playcode.io/ Viewer Page] is written in JS and does not require any special dependencies, it can run as a plain html file offline.
To control the TIM you can either use Pelco or Dali command set. By default the Dali commandset is used at 38400 BAUD.
The secret menus Main and System can be openend with the password '''+-MC+-'''
=====Dead pixels:=====
In the secret menu "System", navigate to Debug Area - DeadPixelModel and set the AutoBP (sensitivity for auto bad pixel finding) to 50 or so. Then press C Button
This can take a while.
<br />
to use it, you need to interface it directly.
To interface, you need to make have a adapter board with a DF12-50DS-0.5V(86) Docking socket.
A open source project can be found here, it includes pin access to:
the pcb layout has been tested and seems to work.
<blockquote>Very basic fanout of pins to 2.54mm headers with a socket for a Video grabber and FT232 adapter and buttons. by gamerpaddy
https://oshwlab.com/gamerpaddy/d8x3c-backpack-usb</blockquote><blockquote>Professional adapter with integrated Video grabber and USB/UART bridge built in including a FFC connector for pin fanout and buttons. by TOA-HI / Killy.THI
https://github.com/TOA-HI/Dali-Tech-D8X3C-Thermal-Camera-Backpack</blockquote>
==Sending Serial Commands directly over UART==
Sending Serial commands directly over UART to the core requires some additional bytes.
The packet structure is as follows (Strip spaces, commands are allways uppercase and 3 chars)
<STX> <LENGTH1> <LENGTH2> Command, Value, Checksum <ETX>
Pseudocode to craft a command packet may look like this<syntaxhighlight lang="c">
//cmd is allways 3 byte uppercase chars
//values can be multiple comma seperated like 320,240
function make_packet(cmd, values):
payload = cmd + "," + join(values, ",") + ","
bytes = ascii(payload)
length = len(bytes)
checksum = sum(bytes) mod 256
return [0x02, length&0xFF, length>>8] + bytes + [checksum, 0x03]
</syntaxhighlight>
<br />
[[File:Dali DLD384 Sensor pinout basic.png|thumb|basic pinout of a DLD384]]
the pinout of the thermal sensor havent been analyzes much.