82
edits
Changes
Jump to navigation
Jump to search
m
==Dali D8X3N Thermal Camera Reverse Engineering==
===D8X3N Module closer look===
=== Viewing the Video Stream ===
=== Viewing Raw Thermal Data from the Web API ===
* <code>Major</code> - Main video stream ====Type (channel 0Data Format)* <code>Minor</code> - Sub video stream (channel 1)* <code>MinorAV</code> - Sub video + audio stream* <code>MajorAV</code> - Main video + audio stream* <code>Jpeg</code> - JPEG snapshot stream* <code>Raw</code> - Raw thermal data stream* <code>YUV</code> - YUV raw video stream====
=== '''Type''' (Data Format) ===*<code>H264</code> - H.264 video encoding*<code>JPEG</code> - JPEG image format*<code>RAW</code> - Raw sensor data*<code>QBOX</code> - Custom protocol format*<code>FRAME</code> - Frame-based format
* <code>H264</code> - H.264 video encoding* <code>JPEG</code> - JPEG image format* <code>RAW</code> - Raw sensor data* <code>QBOX</code> - Custom protocol format* <code>FRAME</code> - Frame-based format====Mode (Transport Protocol)====
=== '''Mode''' *<code>TCP</code> - TCP streaming (Transport Protocoldefault) ===*<code>UDP</code> - UDP streaming*<code>MUL</code> - Multicast streaming
* <code>TCP</code> - TCP streaming (default)* <code>UDP</code> - UDP streaming* <code>MUL</code> - Multicast streaming====Quality Parameters====
=== '''*<code>Quality Parameters''' =[1-100]</code> - Video quality level*<code>Frames=[number]</code> - Number of frames to send*<code>Interval=[ms]</code> - Frame interval in milliseconds
* <code>Quality=[1-100]</code> - Video quality level* <code>Frames=[number]</code> - Number of frames to send* <code>Interval=[ms]</code> - Frame interval in milliseconds=Network Parameters====
* <code>IPAddr=[ip]</code> - Client IP address for UDP/multicast* <code>Port=[port]</code> - Client port for UDP/multicast* <code>Heart-beat=[Yes/No]</code> - Enable/disable heartbeat=Snapshot Parameters====
* <br />====Raw Viewer for PC (Python)====[[File:Dali D8X3N Raw Thermal viewer.png|thumb|Raw Data Viewer in python]]<code>Snap=[Yes/No]</code> - Enable snapshot mode
=== Getting Root Terminal Access ===optional for simplicity: '''ftp''' access To access [[File:Dali D8X3N Webviewer.png|thumb|Web Raw Viewer with histogram (rev3)]] Create the files and the Terminal you need to solder or plug code inside. '''/app/web/webpages/raw.html''' https://pastebin.com/kaiXwAgD and '''/app/web/webpages/cgi-bin/proxy.cgi''' https://pastebin.com/vii1HXcU then run chmod +x /app/web/webpages/cgi-bin/proxy.cgi'''restart''' your camera. It should be accessible now trough '''http://<camera ip>/raw.html''' in a UART connection to Connector J7 on the "Glue" boardbrowser and click Start Stream '''NOTE''': ''<u>If it does not work</u>'', check the contents of both files. FTP sometimes messes them up. also run dos2unix /app/web/webpages/cgi-bin/proxy.cgibecause linux <> windows difficulties that couldnt be resolved in over 30 years. <blockquote> performance may need improvement. </blockquote>
Pinout is (left to right) RX TX GND 3.3V
Baud 115200 ==Getting Root Terminal Access==To access the Terminal you need to solder or plug in a UART connection to Connector J7 on the "Glue" board.
=== Patching the Web Server ===
==== to permanently enable Telnet, go to '''/etc/init.d ''' and edit '''S90app ===='''
now press : and type wq, enter. this should be it.
<br />
==== (optional) patching app.sh to prevent it from rebooting ====
edit the app.sh in /app and remove all "reboot" occasions to prevent the camera from rebooting if onvifserver, httpd or daliServer arent running for debugging purposes.
<br />
=== Flash Contents ===
a Flash dump of the original downgraded D8X3N can be found [https://archive.org/details/dali-d-843n-flash-dump here]
====== Settings offset 0x200000 ======
====== Bad Pixel and Flatframe Maps 0x280000 and 0x4C0000 ======
There still needs to be work done ''See "Automatic Dead Pixels and Flatmap Correction" below how to create own maps new dead pixel and flatfields but flatmaps using the cameras are still very capable and useable with fully cleared mapssystem menu. To clear the maps, just go to these offsets and fill with values around 0x3F or 0x0 for total length of X Resolution x Y Resolution x 2 bytes (0x96000 for 640x480)''
=== Dali Commands ===
=== Using the Thermal module without Webserver ===[[File:Dali D8X3C Breakout boardBreakoutboard d8x3c dali v1.1.png|alt=|thumb|Breakout board for D8X3C ]]
The breakout board files can be found [https://oshwlab.com/gamerpaddy/d8x3c-backpack-usb here] but may be still work in progress.
=== Sensor Pinout ===
added professional pcb adapter
<br />
<br />
From now on, i will refer to the Thermal Imaging Module as TIM
=== User Manual ===
including pinout diagram and important data
[[File:Onvif Device Manager ODM.png|thumb|ODM streaming the Thermal view]]
when first connecting it to power and Ethernet, the camera will have 192.168.1.102 as a Static ip.
=== Web Interface ===
[[File:Dali D8X3N web interface.png|thumb|Since browsers cant display RTSP anymore, open in Edge and select IE Compatibility Mode.]]
the web interface can be accessed by opening the camera IP in a browser
<br />
==== OSD ====
there is a debug-login with
user: super pass: 871897
To acces some locked menus, press
+ - + - + -
The Password password for the locked System and Main menu are not known yet.is +-MC+-
there is a hidden endpoint in the stream.so file that could be found while decompiling
we are mainly interessted in Raw thermal data.
=== '''=Source''' (Stream Type) ==== *<code>Major</code> - Main video stream (channel 0)*<code>Minor</code> - Sub video stream (channel 1)*<code>MinorAV</code> - Sub video + audio stream*<code>MajorAV</code> - Main video + audio stream*<code>Jpeg</code> - JPEG snapshot stream*<code>Raw</code> - Raw thermal data stream*<code>YUV</code> - YUV raw video stream
*<code>IPAddr=[ip]</code> - Client IP address for UDP/multicast*<code>Port=[port]</code> - Client port for UDP/multicast*<code>Heart-beat= '''Network Parameters''' ===[Yes/No]</code> - Enable/disable heartbeat
*<code>Snap=== '''Snapshot Parameters''' ===[Yes/No]</code> - Enable snapshot mode
it is low fps tho, due to bad optimizations.
rev1 first working version https://pastebin.com/dyNWDPT3
rev2 with temperature readout https://pastebin.com/u107Q85w
rev3 and onward will only be available directly as a Webpage on the Device (see below).
====Raw Viewer for the internal Webserver (recommended)====
It is also possible to use the Raw viewer directly in the browser.
To achieve this, the stream had to be proxied from port 5000 to 80 due to CORS.
luckily the internal lighttpd had the CGI module enabled, so piping it troug (using wget ... i know) worked with very low overhead.
To install, you need '''Terminal access''' to the Camera. see below.
Pinout is (left to right) '''RX TX GND 3.3VBaud 115200 3.3V!'''
But the system will spam with debug messages, making patching the files a hard job unless you use "tftp" or "sed"commands.
<br />
=== (optional) =Enabling Telnet access to make patching easier ====
[[File:Upgrade ici dali firmware updater.png|thumb|ICI Firmware updater software with modified firmware loaded]]
there is a easier way using a modified Firmware updater to enable Telnet temporarily to patch the Files.
Download the '''upgrade_ici.exe ''' form [https://archive.org/details/fwupdate here] and run it.
Then you should be able to connect to it via Telnet. the The Login credentials are '''User: root roo'''t '''Password: DLroot''' <br /> ===Patching Device=== ===Patching the Web Server===<br /> ====Enabling Telnet and ftpd permanently====
This only works if you also patch the Thermal Camera module flash!
vi S90app
in vi, move your cursor to the '''# ''' at '''#telnetd ''' and press x<blockquote>optional: enable ftp by removing the '''#''' at '''ftpd''' and adjust the path to / </blockquote>now press ''':''' and type '''wq''' and hit '''enter'''. this should be it.
==== patching Patching the decoder and streamer to 640x480: ====
go to /app and edit the mach.cfg
repeat that procedure for the dali.cfg
=====(optional) patching app.sh to prevent it from rebooting=====
edit the app.sh in /app and remove all "reboot" occasions to prevent the camera from rebooting if onvifserver, httpd or daliServer arent running for debugging purposes.
<br />
==== Patching the Thermal Camera module ====
To patch it, you need to disassemble everything down to the FPGA Board,
on the bottom there is a SPI SOIC8 Flash.
Use a CH341 EEPROM programmer (be sure to have a fixed or modified version to not put out 5V!, set it to 3.3V) and SOIC8 clamp.
Dont forget to download a backup of your flash and save it !
Download the Binary "Dali 640x480 '''actual''' cleared pixelmap .bin" from #3 below and load it into NeoProgrammer, Click Erase, Program and Verify.
This can take a while.
Your imager should start up right after assembly by hearing the shutter click.
==Hardware Hacking== ===Flash Contents===On archive, click on show all files to download them. <nowiki>#</nowiki>1 a Flash dump of the original downgraded D8X3N can be found [https://archive.org/details/dali-d-843n-flash-dump here] <nowiki>#</nowiki>2 a Flash dump of a original 640x480 model can be found [https://archive.org/details/d-843-n-640x-480 here] <nowiki>#</nowiki>3 a modified Flash dump of a 640x480 with cleared dead pixel map, flat map etc. can be found [https://archive.org/details/d-843-n-640x-480-cleared-pixelmap here]
a Flash dump of the web server SPI flash W25Q256JV can be found [https://archive.org/details/dm-60-webserver-flash-dump here] in case a bad firmware update caused a bootloop.
<br />
=== Flash Binary Analysis ===
The Flash IC is a Winbond 25Q128JV SPI Flash that contains the FPGA Bitstream, Deadpixel and Flatmap, aswell as the Device Settings.
a copy of the SPI Logic Capture at startup can be found [https://archive.org/details/dali-eeprom-capture here], the free software [https://www.dreamsourcelab.com/download/ DSView from DreamSourceLab] is required to view it.
[[File:Dali Thermal Imager SPI Flash capture.png|thumb|SPI Flash access while booting the Thermal Module]]
</syntaxhighlight><br />
The settings are read and written every startup, aswell when you close the OSD, sporadically and when executing the command MSV
<br />
Thermal cameras require a bad pixel and flat frame map to compensate for manufacturing inconsistencies.
The [https://2477569.playcode.io/ Viewer Page] is written in JS and does not require any special dependencies, it can run as a plain html file offline.
To control the TIM you can either use Pelco or Dali command set. By default the Dali commandset is used at 38400 BAUD.
Listening to the answer can be done while being in the Linux shell and typing
cat /dev/ttyAMA2 | strings
==Secret Menu Overview==
The secret menus Main and System can be openend with the password '''+-MC+-'''
Its structured like this, not all variables have been figured out yet.
The format is Menu: submenu: submenu:
and for menu entries: Name, default value, command, description or messages that pop up.
<br /><syntaxhighlight lang="vb">
MAIN & SYSTEM PASS: +-MC+-
entries are NAME VALUE COMMAND DESC or if its a folder its just ":"
System:
System:
Gain 255 SCO
Bright 102 IBR
BenDi 100 ?
BenDiContrase 80 ?
DisMode 0 ?
Frequency 48hz (24,25,48,50)
DigitalOut 8-14bit 14bit, BT656(_P), ?, BT601
AutoFocus N ?
Line 1 ?
Ltemp0 11800 ?
LTemp1 11000 ?
HTemp0 9500 ?
HTemp1 8700 ?
DelayTime 0 ?
Enhance 0-1 ?
Enhanced E1 230 ?
FPA_Gain 12pF ? between 4 and 18 at random.
NUCEn N ?
Area:
SE 2 ASN 0-4 "Partition"
INT 200 INT "Points time"
VS 3161 SVS
VF 2800 SVF
Vtemp 1401 VTP
VtempArea Low ?
VtempBase 13500 ?
VtempStep -1 ?
VsStep 8 ?
DeadPixelModel preset / calculate
DP: Cursor to select dead pixels
X 360 position
Y 288 position
AutoBP: 50 Press C to start automatic dotting
Quit? Number of bad pixels 961& "Blind element replacement in progress"
Undo
R2: Save data? blind pixel replacement in progress
Replace Y N = DPI, Y = API
L: Reading parameters
S: Saving parameters
Debug:
Rectify N
DisplayGary N
TE N SDT
AutoE ? ?
AutoVS Y ?
VSGrayH 8000 ?
VSGrayL 7000 ?
Trends 1 ?
Shelter N ?
MotorCon 3 ?
SaveFactoryPara:
LanTyp EN ? LANGUAGE
DisplayMT N ?
Version:
PRJ D843 DLD640 ImLib, MTlib, Soft, Logic
BackDispose:
GammaEN 1 ?
Gain 1 ?
EnhanceEN 0 ?
Hpf_shift 5 ?
Hpf_thrd 5 ?
Enhance 150 ?
Lthrd 50 ?
Monitor:
Opens normal OSD
Alarm Set:
Alarm Switch Y ?
Alarm Mode No ?
Alarm Temperature -1°C ?
Reference Gray Y ?
Alarm Level 1L ?
Alarm Gray 65535 ?
Alarm PointNum 0 ?
Correct Gray 0 ?
Thermometry:
Data Collection 0 SMS
Interval 60 SCP
Ammount 90 SCT
Environment normal ?
Export:
Displays: Exportin normal temperature MTC data
Correction -1 ?
Emissivity 100 SEM
Calibration:
BlackbodyTemp -10 grabs a val from GAB
Save CBS
Cancel CBD
Correction:
BlackbodyTemp -10 Picks from the list GAR
Grayscale 0 SLG
Confirm LRE
Save LRS
Cancel LRD
Ninepoint measurement SMV
Cursor:
Cur N DRC enable cursor
X 320 SRP set cursor position
Y 240 SRP set cursor position
Main:
Auto 2 SAG Auto gain
G 211 SVC
B 10002 SVB
P 1 SWP polarity
Z X ?
Settings:
Image:
FI Y ?
FIValue 0 ? 0-31
Freeze N Freeze image
VE N SMR Vertical flip
HO N SMR Horizontal flip
AutoCali L same as rectify?
O IN internal or external
COM:
Opens UART menu
AvoidburnSwitch OFF enable anti burn in
ProtectedTime 10S duration
AvoidBurn 16383 threshold to trigger antiburn
</syntaxhighlight>
===Automatic Dead Pixels and Flatmap Correction===
It it possible to generate a new flat and dead pixel map automatically within the camera after flashing the cleared-map binary.
<br />
=====Dead pixels:=====
In the secret menu "System", navigate to Area - DeadPixelModel and set the AutoBP (sensitivity for auto bad pixel finding) to 50 or so. Then press C Button
This can take a while.
[[File:High emissivity peltier black body.jpg|thumb|A Peltier / TEC coated in Candle sood to give it a high emissivity surface. It can be cooled or heated by swapping the polarity. ]]
Afterwards, navigate to S: and press + to save it.
<br />
=====Flatfield:=====
In the Debug menu navigate to R2 and press +
now place something '''Cold''' infront of the Camera with a high emissivity. (it needs to fill the whole image)
Press '''+''', wait for it to says High temperature.
Place something '''Hot''' infront and press '''+''' again.
Afterwards, save with '''S:''' again.
Flatfield should now be calibrated
<br /><blockquote>Note: Not all dead pixels are auto detected or get removed. you can manually select them in the Dead pixel editor but its not known yet how to select and correct them.</blockquote>
<br />
to use it, you need to interface it directly.
To interface, you need to make have a adapter board with a DF12-50DS-0.5V(86) Docking socket. A open source project can be found here, it includes pin access to: *FPGA JTAG*UART 3.3V with pin compatible FT232 socket*Power 5V over USB-C*5 Button inputs*Buffered video output and socket for USB Videograbber*Digital 14 bit video out header with hsync vsync and clk.* the pcb layout has been tested and seems to work. <blockquote>Very basic fanout of pins to 2.54mm headers with a socket for a Video grabber and FT232 adapter and buttons. by gamerpaddyhttps://oshwlab.com/gamerpaddy/d8x3c-backpack-usb</blockquote><blockquote>Professional adapter with integrated Video grabber and USB/UART bridge built in including a FFC connector for pin fanout and buttons. by TOA-HI / Killy.THI
https://github.com/TOA-HI/Dali-Tech-D8X3C-Thermal-Camera-Backpack</blockquote>
==Sending Serial Commands directly over UART==
Sending Serial commands directly over UART to the core requires some additional bytes.
The packet structure is as follows (Strip spaces, commands are allways uppercase and 3 chars)
<STX> <LENGTH1> <LENGTH2> Command, Value, Checksum <ETX>
Pseudocode to craft a command packet may look like this<syntaxhighlight lang="c">
//cmd is allways 3 byte uppercase chars
//values can be multiple comma seperated like 320,240
function make_packet(cmd, values):
payload = cmd + "," + join(values, ",") + ","
bytes = ascii(payload)
length = len(bytes)
checksum = sum(bytes) mod 256
return [0x02, length&0xFF, length>>8] + bytes + [checksum, 0x03]
</syntaxhighlight>
<br />
[[File:Dali DLD384 Sensor pinout basic.png|thumb|basic pinout of a DLD384]]
the pinout of the thermal sensor havent been analyzes much.
