82
edits
Changes
Jump to navigation
Jump to search
m
==Dali D8X3N Thermal Camera Reverse Engineering==
===D8X3N Module closer look===
===Viewing the Video Stream===
===Viewing Raw Thermal Data from the Web API===
*<br />====Raw Viewer for PC (Python)====[[File:Dali D8X3N Raw Thermal viewer.png|thumb|Raw Data Viewer in python]]<code>Snap=[Yes/No]</code> - Enable snapshot mode
===Getting Root Terminal Access===To access the Terminal you performance may need to solder or plug in a UART connection to Connector J7 on the "Glue" boardimprovement. </blockquote>
Pinout is (left to right) RX TX GND 3.3V
Baud 115200 ==Getting Root Terminal Access==To access the Terminal you need to solder or plug in a UART connection to Connector J7 on the "Glue" board.
Then you should be able to connect to it via Telnet. the Login credentials are User: root Password: DLroot===Patching Device===
====to permanently enable Telnet, go to '''/etc/init.d ''' and edit '''S90app===='''
now press : and type wq, enter. this should be it.
<br />
====(optional) patching app.sh to prevent it from rebooting====
edit the app.sh in /app and remove all "reboot" occasions to prevent the camera from rebooting if onvifserver, httpd or daliServer arent running for debugging purposes.
<br /> ==Hardware Hacking==
a Flash dump of a original 640x480 model can be found [https://archive.org/details/d-843-n-640x-480 here]
======Settings offset 0x200000======
======Bad Pixel and Flatframe Maps 0x280000 and 0x4C0000======
There still needs to be work done ''See "Automatic Dead Pixels and Flatmap Correction" below how to create own maps new dead pixel and flatfields but flatmaps using the cameras are still very capable and useable with fully cleared mapssystem menu. To clear the maps, just go to these offsets and fill with values around 0x3F or 0x0 for total length of X Resolution x Y Resolution x 2 bytes (0x96000 for 640x480)''
===Dali Commands===
The breakout board files can be found [https://oshwlab*FPGA JTAG*UART 3.com/gamerpaddy/d8x3c3V with pin compatible FT232 socket*Power 5V over USB-backpack-usb here] but may be still work in progressC*5 Button inputs*Buffered video output and socket for USB Videograbber*Digital 14 bit video out header with hsync vsync and clk.*
===Sensor Pinout===
added professional pcb adapter
<br />
<br />
From now on, i will refer to the Thermal Imaging Module as TIM
[[File:Onvif Device Manager ODM.png|thumb|ODM streaming the Thermal view]]
when first connecting it to power and Ethernet, the camera will have 192.168.1.102 as a Static ip.
To acces some locked menus, press
+ - + - + -
The Password password for the locked System and Main menu are not known yet.is +-MC+-
there is a hidden endpoint in the stream.so file that could be found while decompiling
we are mainly interessted in Raw thermal data.
======'''Source''' (Stream Type)======
*<code>Major</code> - Main video stream (channel 0)
*<code>YUV</code> - YUV raw video stream
======'''Type''' (Data Format)======
*<code>H264</code> - H.264 video encoding
*<code>FRAME</code> - Frame-based format
======'''Mode''' (Transport Protocol)======
*<code>TCP</code> - TCP streaming (default)
*<code>MUL</code> - Multicast streaming
======'''Quality Parameters'''======
*<code>Quality=[1-100]</code> - Video quality level
*<code>Interval=[ms]</code> - Frame interval in milliseconds
======'''Network Parameters'''======
*<code>IPAddr=[ip]</code> - Client IP address for UDP/multicast
*<code>Heart-beat=[Yes/No]</code> - Enable/disable heartbeat
======'''Snapshot Parameters'''===== *<code>Snap=[Yes/No]</code> - Enable snapshot mode
it is low fps tho, due to bad optimizations.
rev1 first working version https://pastebin.com/dyNWDPT3 rev2 with temperature readout https://pastebin.com/u107Q85w rev3 and onward will only be available directly as a Webpage on the Device (see below). ====Raw Viewer for the internal Webserver (recommended)====It is also possible to use the Raw viewer directly in the browser. To achieve this, the stream had to be proxied from port 5000 to 80 due to CORS. luckily the internal lighttpd had the CGI module enabled, so piping it troug (using wget ... i know) worked with very low overhead. To install, you need '''Terminal access''' to the Camera. see below. optional for simplicity: '''ftp''' access [[File:Dali D8X3N Webviewer.png|thumb|Web Raw Viewer with histogram (rev3)]] Create the files and the code inside. '''/app/web/webpages/raw.html''' https://pastebin.com/kaiXwAgD and '''/app/web/webpages/cgi-bin/proxy.cgi''' https://pastebin.com/vii1HXcU then run chmod +x /app/web/webpages/cgi-bin/proxy.cgi'''restart''' your camera.
It should be accessible now trough '''http://<camera ip>/raw.html''' in the browser and click Start Stream
'''NOTE''': ''<u>If it does not work</u>'', check the contents of both files. FTP sometimes messes them up.
also run
dos2unix /app/web/webpages/cgi-bin/proxy.cgi
because linux <> windows difficulties that couldnt be resolved in over 30 years.
<blockquote>
Pinout is (left to right) '''RX TX GND 3.3VBaud 115200 3.3V!'''
But the system will spam with debug messages, making patching the files a hard job unless you use "tftp" or "sed"commands.
<br />
===(optional) =Enabling Telnet access to make patching easier====
[[File:Upgrade ici dali firmware updater.png|thumb|ICI Firmware updater software with modified firmware loaded]]
there is a easier way using a modified Firmware updater to enable Telnet temporarily to patch the Files.
Download the '''upgrade_ici.exe ''' form [https://archive.org/details/fwupdate here] and run it. Then you should be able to connect to it via Telnet. The Login credentials are '''User: roo'''t '''Password: DLroot''' <br />
===Patching the Web Server===
<br />
====Enabling Telnet and ftpd permanently====
This only works if you also patch the Thermal Camera module flash!
vi S90app
in vi, move your cursor to the '''# ''' at '''#telnetd ''' and press x<blockquote>optional: enable ftp by removing the '''#''' at '''ftpd''' and adjust the path to / </blockquote>now press ''':''' and type '''wq''' and hit '''enter'''. this should be it.
====patching Patching the decoder and streamer to 640x480:====
go to /app and edit the mach.cfg
repeat that procedure for the dali.cfg
=====(optional) patching app.sh to prevent it from rebooting=====
edit the app.sh in /app and remove all "reboot" occasions to prevent the camera from rebooting if onvifserver, httpd or daliServer arent running for debugging purposes.
<br />
====Patching the Thermal Camera module====
To patch it, you need to disassemble everything down to the FPGA Board,
on the bottom there is a SPI SOIC8 Flash.
Use a CH341 EEPROM programmer (be sure to have a fixed or modified version to not put out 5V!, set it to 3.3V) and SOIC8 clamp.
Dont forget to download a backup of your flash and save it !
Download the Binary "Dali 640x480 '''actual''' cleared pixelmap .bin" from #3 below and load it into NeoProgrammer, Click Erase, Program and Verify.
This can take a while.
Your imager should start up right after assembly by hearing the shutter click.
===Flash Contents===
On archive, click on show all files to download them. <nowiki>#</nowiki>1 a Flash dump of the original downgraded D8X3N can be found [https://archive.org/details/dali-d-843n-flash-dump here] <nowiki>#</nowiki>2 a Flash dump of a original 640x480 model can be found [https://archive.org/details/d-843-n-640x-480 here] <nowiki>#</nowiki>3 a modified Flash dump of a 640x480 with cleared dead pixel map, flat map etc. can be found [https://archive.org/details/d-843-n-640x-480-cleared-pixelmap here]
a Flash dump of the web server SPI flash W25Q256JV can be found [https://archive.org/details/dm-60-webserver-flash-dump here] in case a bad firmware update caused a bootloop.
<br />
</syntaxhighlight><br />
The settings are read and written every startup, aswell when you close the OSD, sporadically and when executing the command MSV
<br />
Thermal cameras require a bad pixel and flat frame map to compensate for manufacturing inconsistencies.
The [https://2477569.playcode.io/ Viewer Page] is written in JS and does not require any special dependencies, it can run as a plain html file offline.
To control the TIM you can either use Pelco or Dali command set. By default the Dali commandset is used at 38400 BAUD.
==Secret Menu Overview==
The secret menus Main and System can be openend with the password '''+-MC+-'''
Its structured like this, not all variables have been figured out yet.
The format is Menu: submenu: submenu:
and for menu entries: Name, default value, command, description or messages that pop up.
<br /><syntaxhighlight lang="vb">
MAIN & SYSTEM PASS: +-MC+-
entries are NAME VALUE COMMAND DESC or if its a folder its just ":"
System:
System:
Gain 255 SCO
Bright 102 IBR
BenDi 100 ?
BenDiContrase 80 ?
DisMode 0 ?
Frequency 48hz (24,25,48,50)
DigitalOut 8-14bit 14bit, BT656(_P), ?, BT601
AutoFocus N ?
Line 1 ?
Ltemp0 11800 ?
LTemp1 11000 ?
HTemp0 9500 ?
HTemp1 8700 ?
DelayTime 0 ?
Enhance 0-1 ?
Enhanced E1 230 ?
FPA_Gain 12pF ? between 4 and 18 at random.
NUCEn N ?
Area:
SE 2 ASN 0-4 "Partition"
INT 200 INT "Points time"
VS 3161 SVS
VF 2800 SVF
Vtemp 1401 VTP
VtempArea Low ?
VtempBase 13500 ?
VtempStep -1 ?
VsStep 8 ?
DeadPixelModel preset / calculate
DP: Cursor to select dead pixels
X 360 position
Y 288 position
AutoBP: 50 Press C to start automatic dotting
Quit? Number of bad pixels 961& "Blind element replacement in progress"
Undo
R2: Save data? blind pixel replacement in progress
Replace Y N = DPI, Y = API
L: Reading parameters
S: Saving parameters
Debug:
Rectify N
DisplayGary N
TE N SDT
AutoE ? ?
AutoVS Y ?
VSGrayH 8000 ?
VSGrayL 7000 ?
Trends 1 ?
Shelter N ?
MotorCon 3 ?
SaveFactoryPara:
LanTyp EN ? LANGUAGE
DisplayMT N ?
Version:
PRJ D843 DLD640 ImLib, MTlib, Soft, Logic
BackDispose:
GammaEN 1 ?
Gain 1 ?
EnhanceEN 0 ?
Hpf_shift 5 ?
Hpf_thrd 5 ?
Enhance 150 ?
Lthrd 50 ?
Monitor:
Opens normal OSD
Alarm Set:
Alarm Switch Y ?
Alarm Mode No ?
Alarm Temperature -1°C ?
Reference Gray Y ?
Alarm Level 1L ?
Alarm Gray 65535 ?
Alarm PointNum 0 ?
Correct Gray 0 ?
Thermometry:
Data Collection 0 SMS
Interval 60 SCP
Ammount 90 SCT
Environment normal ?
Export:
Displays: Exportin normal temperature MTC data
Correction -1 ?
Emissivity 100 SEM
Calibration:
BlackbodyTemp -10 grabs a val from GAB
Save CBS
Cancel CBD
Correction:
BlackbodyTemp -10 Picks from the list GAR
Grayscale 0 SLG
Confirm LRE
Save LRS
Cancel LRD
Ninepoint measurement SMV
Cursor:
Cur N DRC enable cursor
X 320 SRP set cursor position
Y 240 SRP set cursor position
Main:
Auto 2 SAG Auto gain
G 211 SVC
B 10002 SVB
P 1 SWP polarity
Z X ?
Settings:
Image:
FI Y ?
FIValue 0 ? 0-31
Freeze N Freeze image
VE N SMR Vertical flip
HO N SMR Horizontal flip
AutoCali L same as rectify?
O IN internal or external
COM:
Opens UART menu
AvoidburnSwitch OFF enable anti burn in
ProtectedTime 10S duration
AvoidBurn 16383 threshold to trigger antiburn
</syntaxhighlight>
===Automatic Dead Pixels and Flatmap Correction===
It it possible to generate a new flat and dead pixel map automatically within the camera after flashing the cleared-map binary.
<br />
=====Dead pixels:=====
In the secret menu "System", navigate to Area - DeadPixelModel and set the AutoBP (sensitivity for auto bad pixel finding) to 50 or so. Then press C Button
This can take a while.
[[File:High emissivity peltier black body.jpg|thumb|A Peltier / TEC coated in Candle sood to give it a high emissivity surface. It can be cooled or heated by swapping the polarity. ]]
Afterwards, navigate to S: and press + to save it.
<br />
=====Flatfield:=====In the Debug menu navigate to R2 and press + now place something '''Cold''' infront of the Camera with a high emissivity. (it needs to fill the whole image) Press '''+''', wait for it to says High temperature. Place something '''Hot''' infront and press '''+''' again. Afterwards, save with '''S:''' again. Flatfield should now be calibrated<br /><blockquote>Note: Not all dead pixels are auto detected or get removed. you can manually select them in the Dead pixel editor but its not known yet how to select and correct them.</blockquote> <br /> ==Using the Thermal module without Webserver===[[File:Dali D8X3C Breakout boardBreakoutboard d8x3c dali v1.1.png|alt=|thumb|Breakout board for D8X3C ]]
to use it, you need to interface it directly.
To interface, you need to make have a adapter board with a DF12-50DS-0.5V(86) Docking socket.
A open source project can be found here, it includes pin access to:
the pcb layout has been tested and seems to work.
<blockquote>Very basic fanout of pins to 2.54mm headers with a socket for a Video grabber and FT232 adapter and buttons. by gamerpaddy
https://oshwlab.com/gamerpaddy/d8x3c-backpack-usb</blockquote><blockquote>Professional adapter with integrated Video grabber and USB/UART bridge built in including a FFC connector for pin fanout and buttons. by TOA-HI / Killy.THI
https://github.com/TOA-HI/Dali-Tech-D8X3C-Thermal-Camera-Backpack</blockquote>
==Sending Serial Commands directly over UART==
Sending Serial commands directly over UART to the core requires some additional bytes.
The packet structure is as follows (Strip spaces, commands are allways uppercase and 3 chars)
<STX> <LENGTH1> <LENGTH2> Command, Value, Checksum <ETX>
Pseudocode to craft a command packet may look like this<syntaxhighlight lang="c">
//cmd is allways 3 byte uppercase chars
//values can be multiple comma seperated like 320,240
function make_packet(cmd, values):
payload = cmd + "," + join(values, ",") + ","
bytes = ascii(payload)
length = len(bytes)
checksum = sum(bytes) mod 256
return [0x02, length&0xFF, length>>8] + bytes + [checksum, 0x03]
</syntaxhighlight>
<br />
[[File:Dali DLD384 Sensor pinout basic.png|thumb|basic pinout of a DLD384]]
the pinout of the thermal sensor havent been analyzes much.
