yrambler2001

Firmware · WebUSB · LPC43xx

Seek Thermal

Tools and research for Seek Thermal cameras: read and decrypt the firmware over WebUSB, study C reconstructions of their first-stage bootloaders, and unlock a Seek Nano for use with third-party software.

  1. Seek Thermal Firmware Dump

    HTML

    yrambler2001/seek-thermal-firmware-dump

    Dump and decrypt Seek Thermal camera firmware straight from the browser over WebUSB. Everything runs locally; the dump never leaves your machine.

    • Reads the 4 MiB SPIFI flash and returns one .zip with the image and decrypted firmware
    • Read-only by design: the dump view can issue exactly five vendor commands
    • Offline mode decrypts an existing flash image in any browser, including Safari and iOS
    • A separate view reports the running firmware and flashes a new image
    • No install, no drivers on macOS or Linux, no SDK, no J-Link
    Open the tool View on GitHub

  2. Seek Thermal Bootloader

    C

    yrambler2001/seek-thermal-bootloader

    Reverse-engineered C reconstructions of the first-stage secure bootloaders of Seek Thermal cameras (NXP LPC43xx, ARM Cortex-M4), recovered from SPI-NOR flash dumps.

    • Four bootloaders: Compact Pro (2016), Compact (2018), Compact Pro FF (2019), Nano 300 (2021)
    • Documents the xorshift128 stream cipher that protects the application firmware
    • Includes a Node.js tool that finds the keys and decrypts firmware from a raw flash dump
    View on GitHub

  3. Seek Nano unlock

    Sends a USB control transfer to a Seek Nano 300 or 200 so that it works with ThermoVision by JoeC and possibly other software. The same tool in two languages.

    ThermoVision by JoeC