This is an old revision of the document!
Thermal camera transmits udp
packets to a windows application.
we recorded a raw ethernet packet stream between the camera (source) and the windows (target) pc
bootloginplay.zip - pcap file recording of camera boot, stream request follwed by ~100 frames of thermal video. we used wireshark to filter and capture the handshake.
we noticed the stream gets initiated by a short udp packet from the target
we saved that packet and replayed it to the source using scapy lib for python.
#replay the "trigger" packet. #this packets will start the source broadcasting its packets. import base64 from scapy.all import * # Base64 encoded packet data encoded_packet = "////////AAFsWfAKCABFAAA4KB0AAIARkEfAqAABwKgA/x+bH5wA2QAAASABgBtAACAAAAAAAAAADwAAAAEAAAEAACArAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP//////////////////////////////////////////AAAAAAAAAAIBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" # Decode the Base64 encoded packet decoded_packet = base64.b64decode(encoded_packet) # Load packet with Scapy packet = Ether(decoded_packet) # (packet) sendp(packet, iface="Ethernet")
this then started a network stream
the data stream was ordered and looked clean.
every frame starts with the following.
T=(-1.665884e-08)*X^4+(1.347094e-05)*X^3+(-4.396264e-03)*X^2+(9.506939e-01)*X+(-6.353247e+01)
that got our interest in that packet but from then we noticed each has a sequential header that we can follow.
we then decoded to video > https://git.telavivmakers.space/tami/thermalcam_decoder
here is a video (mp4,h264,8bpp) and an image (png,raw,16bpp)
raw data of single frame, in pcap format (TODO: not the same data as the png above.), frame2.7z
we don't know the camera's conversion formula or lookup table
the spec mentions 8-14µm
According to Wien's Displacement Law, objects at different temperatures emit peak radiation at different wavelengths. The range of 8-14 µm is well-suited for detecting temperatures commonly encountered in industrial and environmental applications, typically ranging from about -20°C to 500°C or more. This range is sensitive enough to detect the radiation emitted by most objects under normal conditions.
i asked gpt if the formula we found in the first udp packet makes sense as a lookup table. he said no
then decided to capture a calibration sequence using our ANET printer hotbed and tip as a commendable temperature source.
set the hotbed to 100c (but its hardcoded to 90C tops on the merlin firmware) and 200deg for the hotend tip.
then “showed” it a piece of ice from the fridge. all measurements verified using a infrared thermometer. 90C,200C and 0C.
and revisiting that formula, what do you know!? it is legit…
check this rust thingy out (more at the repo)
let frame = data .iter() .copied() .map(|x| { let x: f64 = x.into(); let x = x / 256.0; ((-1.665884e-08) * x.powf(4.) + (1.347094e-05) * x.powf(3.) + (-4.396264e-03) * x.powf(2.) + (9.506939e-01) * x + (-6.353247e+01)) as u8 }) .collect::<Vec<u8>>();
fridge frost - 0c
the heatbed at the back is ramping down from 90c (cam saturates well before)
TODO:
camera connects over 1Gb ethernet adaptor (make sure to enable Jumbo Frame 9k in adapter settings)
123
ax88772c_772b_772a_772_win11_64bit_driver_v3.22.0.0.zip - apple usb ethernet dongle