Jump to content
cctv_007

Unbricking your Dahua IP camera (Tips, Tricks & Firmware)

Recommended Posts

i have 2 Chinese camera's DH-SD2904-GN for a long time it was a pain in the a.. to configure the camera's correctly

 

i tried to update the firmware to english but this was not working (not accepted by the camera)

 

so what i did is logged in via ssh and changed the following settings.

 

find . -name *.txt

check the result for ./mnt/web/debug/English.txt

 

./mnt/web/debug/English.txt
./mnt/web/debug/SimpChinese.txt
./mnt/custom/SimpChinese.txt
./usr/data/Strings/SimpChinese.txt

 

then do the following

 

mount -o remount rw /usr
mount -o remount rw /mnt/custom

 

now remove the chinese text

 

rm ./mnt/custom/SimpChinese.txt
rm ./usr/data/Strings/SimpChinese.txt

 

and replace it with english

 

cp ./mnt/web/debug/English.txt ./mnt/custom/SimpChinese.txt
cp ./mnt/web/debug/English.txt ./usr/data/Strings/SimpChinese.txt

 

and now reboot the machine.

 

reboot

 

tadaaaaa

 

this will change the language to english

Share this post


Link to post
Share on other sites

I just received a new DH-IPC-HFW2100S V2 from aly express, but this camera is not working from the beginning.

-Config tool doesn't detect the cam.

-it was pinging, but web interface was not working, port 80 not listening...

-then I telnet into the cam, kill /util/upgraded, and lanch it manually, and try to lanch an upgrade from config tool, but the upgrade immediatly failled because /mnt/mtd/Config/passwd was missing.

 

Then I find an other passwd file in an sub folder of /etc, so I decide to copy it into /mnt/mtd/Config/passwd, then reboot the cam.

 

Now When I Telnet, the cam refuse 7ujMko0admin password, so it's look like I have made a mistake... ttl is maybe the solution, but after opening the cam, I don't find connector like the picture from the first page.

 

Any Idea ??

Share this post


Link to post
Share on other sites

Just ran across a bunch of firmware for the cameras you have to dig a little but they are all there in the files there are xls and word files that actually give you the lists of what firmware goes with what camera haven't tried any of these yet but they look legit ftp://ftp.asm.cz/Dahua/

Share this post


Link to post
Share on other sites
i have 2 Chinese camera's DH-SD2904-GN for a long time it was a pain in the a.. to configure the camera's correctly

 

i tried to update the firmware to english but this was not working (not accepted by the camera)

 

so what i did is logged in via ssh and changed the following settings.

 

find . -name *.txt

check the result for ./mnt/web/debug/English.txt

 

./mnt/web/debug/English.txt
./mnt/web/debug/SimpChinese.txt
./mnt/custom/SimpChinese.txt
./usr/data/Strings/SimpChinese.txt

 

then do the following

 

mount -o remount rw /usr
mount -o remount rw /mnt/custom

 

now remove the chinese text

 

rm ./mnt/custom/SimpChinese.txt
rm ./usr/data/Strings/SimpChinese.txt

 

and replace it with english

 

cp ./mnt/web/debug/English.txt ./mnt/custom/SimpChinese.txt
cp ./mnt/web/debug/English.txt ./usr/data/Strings/SimpChinese.txt

 

and now reboot the machine.

 

reboot

 

tadaaaaa

 

this will change the language to english

 

I have the same problem with the language model camera hdbw4421r-as, as I solve? in the same way? how do I log in via ssh? I tried but I can not access via ssh you tell me how to do or which brings user and password should I use? I thank you, please let me know as soon as possible. good day guys

Share this post


Link to post
Share on other sites

buongiorno a tutti ho fatto di recente un aggiornameto mal riuscito, adesso mi si scollega di continuo e non riesco più ad aggiornare qualcuno ha una guida dettagliata su come fare^ io non sono tanto esperto con putty o telnet. grazie a tutti

Share this post


Link to post
Share on other sites
Here is the serial output from the U-Boot process. ...

From there you can run >printenv to get a look at the env variables

 

Well, I've had a bricked camera, which could only give me access to the bootloader. Using that and an extracted "clean" version of the firmware, I managed to get into the camera's filesystem and reset the accounts.

 

The problem was that I tried to set a password containing special chars, like '$' and brackets, which seemed to have somehow been expanded. Then, I was completely unable to access the usual services of the camera (modern firmwares have closed the telnet port).

 

The camera is a mini-bullet, has no reset button.

 

I've soldered the serial port, as seen in your photo (HFW.. model, same pinout).

 

Then, after loading the kernel, camera would NOT send anything on the serial port, would not provide a shell. Bad.

Then, by reading the "clean" firmware, I discovered two boot parameters, as provided by U-Boot to the Linux, which control the workflow of applications:

 

dh_keyboard:  1=no console (default), 0=use serial console
appauto: 1=launch video app (default), 0=no video app

 

Setting dh_keyboard=0 immediately caused the serial console to display all stderr of the userspace. There was some sort of login prompt "behind" that, but logs would scroll too often to let me type it. I tried, it seemed to require the same web-credentials I'd been locked out of.

Then, in despair, I pressed Ctrl+C . Voila! The video app stopped, and I had a busybox shell! Only problem, that also stopped the watchdog and camera rebooted in 2min.

 

Setting "appauto=0" fixed that, now, Linux would boot, initialize and immediately provide a busybox shell, root access. With this, I could unbrick the camera.

 

Summary: u-boot commands to achieve that:

printenv
setenv dh_keyboard 0
setenv appauto 0
boot

Share this post


Link to post
Share on other sites

Hi All,

I'm attempting to unbrick my camera IPC-HDW2100 via TFTP method after an unsuccessful firmware upgrade.

 

I have 9 of these and all the others upgraded fine using DH_IPC-HX3(2)XXX_Eng_N_V2.420.0000.0.R.20140414 except for 1.

 

The following is what shows up when connected via serial:

 

Puttty:-

Õëy½Þ¯UÛ

¿£75A-#3!A7;==£±£åëg!=7¿=77¿åëg!=7-#1¿«ïy½«ÓÑÔ¿9!#¿5955757£åë®j:ªºú»!¿15¿-#3!£åë¿åëY=¿Y_m¿e5%!

¿-79!75¿'åëa¿¿¿5'åëu¿¿¿5'åë]Ñ©Ú#5¿_oM¿qucu[my¿§-7åëQº=£1/¿1=5=-!I

5¿753='¿-%=15åënnÛ ££¿!m_¿=77¿-¿

5¿¿¿}[e¿g-#¿i5'¿m%=15¿¯#9!%57­åë¿¿¿w==¿Y-#9-A5¿{åë¿¿¿m%=15¿W

-#1¿y/59)%¿£££¿¯ºú»õ=¿y[yåëu[[a[¿9=#±¿15¿)5'¿-%=15½åëwo{aaW¹¿

 

Any idea what mite be going on here?

 

Any assistance will be greatly appreciated.

 

Thanks

Share this post


Link to post
Share on other sites

Hi sir!

I have a problem with two cameras IPC-F725p.

Cau u help me with any version of firmware for this model?

And some instructions in order to rewrite the firmware will be usefull.

Thank you !

Share this post


Link to post
Share on other sites
If I received a Dahua camera in Chinese, it only as PAL listed as the video format in the settings. If I upgrade to an English version of the firmware, must I use a PAL version, or can I switch to an NTSC version of the firmware? Anyone know?

 

Hi friend,

 

I have many dahua cameras with firmware of NTSC and PAL can be switched as you want.

the camera is HDW4431C-A. 4Mp dome. IP camera.

 

welcome to inquiry.

Share this post


Link to post
Share on other sites

Hi,

I am a cctv installer, I install dahua products, (supply and installation)

I am writing to you because I have a problem with my client, I installed a NVR under ref

DHI-NVR4232 with S.N: XXXXXXXXXXXXXXX. SmartPSS does not want to add the serial number of the NVR with:

User Name: admin

Password: admin

Note:

P2P setting: connect Success

Intranet connection with ip address: ok with SmartPss (it works)

 

But problem for remote connection with serial number and QR code:

SmartPss: message: failed to add device XXXXXXXXXXXXXXX!

IDMSS lite: Connection Failed (with Iphone When i scan QR code)

 

This is not the first time I install dahua with P2P, I have done at least 50 times. But with this NVR I think there is a problem with its serial number or firmware

 

Info:

Record Channel 32

Alarm In 4

Alarm out 2

System Version 3.200.0000.0

Data soft 2015-07-14

Web 3.1.0.4

SN XXXXXXXXXXXXXXX

 

Please help us,

 

 

Best regards,

Share this post


Link to post
Share on other sites

Hi, I got myself a bricked IPC-HFW4431M-I2. I have used a DH_IPC-HX4XXX-Eos_Eng_P_Stream3_V2.420.0000.22.R.20161209.bin file...

 

I have an open port 3800, but it's "dead", means that I can connect, but no respose is given, blank screen...

 

Any thoughts?

 

Thanks a lot!

Share this post


Link to post
Share on other sites

Hi , maybe someone of you can help me ! i have dahua vto6210bw intercom ! and since we try to updated! we bricked it ! we used to use telnet and now after the update failed the password of the telnet has been changed ! and we cant login anymore ! i can ping the vto is on 192.168.0.110 but when i try to login via telnet after 3 times doing the passwords ! i have to wait another 30min to try to login again! This has happened to me after i did this in Telnet.

 

cmd start

telnet 192.168.0.110

user:admin

Password:7*****0admin

rm /mnt/mtd/*-rf

rm / mnt/backup/*-rf

reboot

 

If someone knows a way please let me know Thanks.

Share this post


Link to post
Share on other sites

Hello guys,

i'm working to Unbrick my dahua hfw4300s V2 after fails during the firmware update.

Now i'm trying to flash the version General_IPC-HX5(4)XXX_Eng_N_V2.210.0000.21.R.20140613.bin but via TFTP i need to convert the .bin to update.img

Could helm me to convert this file or if somebody has available it.

Share this post


Link to post
Share on other sites
Hello guys,

i'm working to Unbrick my dahua hfw4300s V2 after fails during the firmware update.

Now i'm trying to flash the version General_IPC-HX5(4)XXX_Eng_N_V2.210.0000.21.R.20140613.bin but via TFTP i need to convert the .bin to update.img

Could helm me to convert this file or if somebody has available it.

 

 

It's a lot better if you start your own thread/post asking for help than posting here hijacking OP's...

Also makes it easier for others with the same problem to find... just my $0.02.

Share this post


Link to post
Share on other sites

Hello! I have four IPC-HFW4300r-z. I try to update firmware DH_IPC-HX5(4)XXX-Adreia_Eng_P_Stream3_V2.420.0009.0.R.20151106.zip

3 of them updated success, but 1 not.

I don`t now why HWID changes to another type camera. (HFW2300R-Z, my camera is HFW4300R-Z)

Firmware updating process is good, but camera not avalible on port 80. It`s going bootloop. There are open ports: 3800 and something like... 42375.

I think the trouble is wrong HWID. How can i change it to right one by telnet? Please, help me. And sorry for my English.

Here info:

ps

~ # ps

PID USER TIME COMMAND

1 root 0:03 init

2 root 0:00 [kthreadd]

3 root 0:00 [ksoftirqd/0]

4 root 0:00 [kworker/0:0]

5 root 0:00 [kworker/u:0]

6 root 0:00 [khelper]

7 root 0:00 [kworker/u:1]

462 root 0:00 [sync_supers]

464 root 0:00 [bdi-default]

466 root 0:00 [kblockd]

556 root 0:00 [rpciod]

557 root 0:08 [kworker/0:1]

565 root 0:00 [kswapd0]

566 root 0:00 [fsnotify_mark]

567 root 0:00 [aio]

568 root 0:00 [nfsiod]

570 root 0:00 [crypto]

610 root 0:00 [mtdblock0]

615 root 0:00 [mtdblock1]

620 root 0:00 [mtdblock2]

625 root 0:00 [mtdblock3]

630 root 0:00 [mtdblock4]

635 root 0:00 [mtdblock5]

640 root 0:00 [mtdblock6]

645 root 0:00 [mtdblock7]

650 root 0:00 [mtdblock8]

655 root 0:00 [mtdblock9]

660 root 0:00 [mtdblock10]

665 root 0:00 [mtdblock11]

670 root 0:00 [mtdblock12]

678 root 0:00 [ubi_bgt0d]

726 root 0:00 [ubi_bgt1d]

733 root 0:00 [ubi_bgt2d]

740 root 0:00 [ubi_bgt3d]

747 root 0:00 [ubi_bgt4d]

754 root 0:00 [ubi_bgt5d]

758 root 0:00 [ubifs_bgt5_0]

763 root 0:00 [ubi_bgt6d]

767 root 0:00 [ubifs_bgt6_0]

772 root 0:00 [ubi_bgt7d]

776 root 0:00 [ubifs_bgt7_0]

794 root 0:00 /var/tmp/telnetd

803 root 0:00 [OSA_801_1]

831 root 0:00 [OSA_823_3]

844 root 0:00 [OSA_823_4]

869 root 0:00 syshelper yshelper 60

870 root 0:00 /var/tmp/upgraded

878 root 0:00 [OSA_875_5]

879 root 0:00 [dsplogd]

880 root 0:00 [encode_guard]

898 root 0:00 [flush-ubifs_6_0]

917 root 0:00 [OSA_915_6]

951 root 4:38 ./VideoDaemon EX2 AEWB AF MOTOR TVOUT

953 root 4:38 ./VideoDaemon EX2 AEWB AF MOTOR TVOUT

954 root 4:38 ./VideoDaemon EX2 AEWB AF MOTOR TVOUT

955 root 4:38 ./VideoDaemon EX2 AEWB AF MOTOR TVOUT

956 root 4:38 ./VideoDaemon EX2 AEWB AF MOTOR TVOUT

957 root 4:38 ./VideoDaemon EX2 AEWB AF MOTOR TVOUT

959 root 4:38 ./VideoDaemon EX2 AEWB AF MOTOR TVOUT

960 root 4:38 ./VideoDaemon EX2 AEWB AF MOTOR TVOUT

961 root 4:38 ./VideoDaemon EX2 AEWB AF MOTOR TVOUT

962 root 4:38 ./VideoDaemon EX2 AEWB AF MOTOR TVOUT

964 root 4:38 ./VideoDaemon EX2 AEWB AF MOTOR TVOUT

970 root 4:38 ./VideoDaemon EX2 AEWB AF MOTOR TVOUT

971 root 4:38 ./VideoDaemon EX2 AEWB AF MOTOR TVOUT

972 root 4:38 ./VideoDaemon EX2 AEWB AF MOTOR TVOUT

973 root 4:38 ./VideoDaemon EX2 AEWB AF MOTOR TVOUT

976 root 4:38 ./VideoDaemon EX2 AEWB AF MOTOR TVOUT

977 root 4:38 ./VideoDaemon EX2 AEWB AF MOTOR TVOUT

978 root 4:38 ./VideoDaemon EX2 AEWB AF MOTOR TVOUT

988 root 0:00 /bin/sh /etc/init.d/appauto

992 root 0:00 pppd

998 root 0:00 pppd

1006 root 0:00 /bin/sh ./usr/etc/app.sh

1008 root 0:05 /usr/bin/sonia

1009 root 0:05 /usr/bin/sonia

1010 root 0:05 /usr/bin/sonia

1011 root 0:05 /usr/bin/sonia

1012 root 0:05 /usr/bin/sonia

1013 root 0:05 /usr/bin/sonia

1014 root 0:05 /usr/bin/sonia

1015 root 0:05 /usr/bin/sonia

1016 root 0:05 /usr/bin/sonia

1017 root 0:05 /usr/bin/sonia

1018 root 0:05 /usr/bin/sonia

1019 root 0:05 /usr/bin/sonia

1020 root 0:05 /usr/bin/sonia

1021 root 0:05 /usr/bin/sonia

1022 root 0:05 /usr/bin/sonia

1023 root 0:00 -sh

1049 root 0:00 ps

 

bootpara

~ # cat /proc/dahua/bootpara

Status: idle

appauto:1

dh_keyboard:1

ethaddr:3c:ef:8c:cb:f4:96:

ID:2G01237PAA00136

fd:-1

debug:0

HWID:IPC-HFW2300R-Z:01:02:02:1F:0A:00:01:00:00:00:00:210:00:00:02:00:00:00:06:00:100

 

Here is updating log (update by config tool using port 3800):

=~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2017.08.28 12:24:00 =~=~=~=~=~=~=~=~=~=~=~=

/usr/sbin/upgraded

[m

 

[m[0;32;32m[OSA-APP] OSA Build on Dec 5 2014 at 14:54:43.

[m[0;32;32m[OSA-APP] SVN NUM: 2587.

 

[m[0;32;32m[libpdi] libpdi.so Build on Dec 5 2014 at 15:08:45.

[m[0;32;32m[libpdi] SVN NUM: 17543.

[m[0;32;32m[libpdi] Support backup partition !!!

[m[0;32;32m[libpdi] Flashtype = 4,patSize = 100000,rwSize = 800,ersSize = 20000

[0;32;32m12:24:10|[crypt] crypt_open ok!

[m[0;32;32m12:24:10|[crypt]

 

Crypt Build on Dec 5 2014 at 14:23:54.

[m[0;32;32m12:24:10|[crypt] SVN NUM: 1797.

 

[m[m[0;32;32m[libpdi] phyaddr= 0xc8bfe000, memLen= 0x2000

[0;32;32m12:24:10|[pdc] Both of Chief and Backup File CRC check OK!

[m[mName: upgraded, bulid date: Dec 5 2014 14:11:56, svn: 255

[0;32;32m[libpdi] >-------getSystemInfo------->

[mFail to get env authcode!

[0;32;32m[libpdi] Get authcode error

[1;33m12:24:17|[pdc] WARN (MISC_ioctl|537): Get SdCard cfg failed !

[m[m[0;32;32m[libpdi] deviceType: IPC-HFW4300R-Z

[m[0;32;32m[libpdi] processorType: 10

[m[0;32;32m[libpdi] hardwareVersion: 1.60

[m[0;32;32m[libpdi] appAutoStart: 1

[m[0;32;32m[libpdi] serialNumber: 2G01237PAA00136

[m[0;32;32m[libpdi] deviceClass: IPC

[m[0;32;32m[libpdi] noPtz: 1

[m[0;32;32m[libpdi] noSdCard: 1

[m[0;32;32m[libpdi] bandWidth: 48

[m[0;32;32m[libpdi] <-------getSystemInfo-------<

[mUPGRADED_MSG: Can't Open /mnt/mtd/Config/passwd

UPGRADED_MSG: Login success!

UPGRADED_MSG: Kill 1008 successful

[0;32;32m[libpdi] Read: blkIndex: 1,pageIndex: 0,byteIndex: 0 ,fLag: ff

[m[0;32;32m[libpdi] Write: blkIndex: 1,pageIndex: 0,byteIndex: 0 ,fLag: 0

UPGRADED_MSG: Received : 31239456, FileSize : 31239456

UPGRADED_MSG: Download Complete

UPGRADED_MSG: DoDownLoad success!

UPGRADED_MSG: Flash init success

UPGRADED_MSG: hwid file success!

Fail to get env native!

UPGRADED_ERR: LINE: 1074: invalid file: Install.lua

UPGRADED_MSG: zip file total size: 41797380

[0;32;32m[libpdi] >-------getSystemInfo------->

[mFail to get env authcode!

[0;32;32m[libpdi] Get authcode error

[1;33m12:26:29|[pdc] WARN (MISC_ioctl|537): Get SdCard cfg failed !

[m[m[0;32;32m[libpdi] deviceType: IPC-HFW4300R-Z

[m[0;32;32m[libpdi] processorType: 10

[m[0;32;32m[libpdi] hardwareVersion: 1.60

[m[0;32;32m[libpdi] appAutoStart: 1

[m[0;32;32m[libpdi] serialNumber: 2G01237PAA00136

[m[0;32;32m[libpdi] deviceClass: IPC

[m[0;32;32m[libpdi] noPtz: 1

[m[0;32;32m[libpdi] noSdCard: 1

[m[0;32;32m[libpdi] bandWidth: 48

[m[0;32;32m[libpdi] <-------getSystemInfo-------<

[mUPGRADED_MSG: packet.name: SD6XXX, board.name: IPC-HFW4300R-Z

UPGRADED_MSG: packet.hardver: , board.hardver:

UPGRADED_MSG: packet.name: IPC-HX3XXX, board.name: IPC-HFW4300R-Z

UPGRADED_MSG: packet.hardver: , board.hardver:

UPGRADED_MSG: Verify version success

 

Header CRC Checking ... OK

Image Name: dhboot.bin.img

Image Type: dhboot.bin.img (gzip compressed)

Data Size: 317504 B, Bytes = 0.30 MB

Load Address: 0X200000

Data CRC Checking ... OK

Programing start at: 0X200000

 

[0;36m[libpdi] write update Flag

[m[0;32;32m[libpdi] Read: blkIndex: 0,pageIndex: 0,byteIndex: 0 ,fLag: ff

[m[0;32;32m[libpdi] Write: blkIndex: 0,pageIndex: 0,byteIndex: 0 ,fLag: 55

[m[0;36m[libpdi] Flash_createPartionTab:0

[m[0;36m[libpdi] Erase Partion: 0

[m[0;32;32m[libpdi] FlashErase: addr= 0x0x200000,blkNum:8, blkSize:0x20000,len:0x100000

<5>UBIFS: un-mount UBI device 2, volume 0

<5>UBIFS: un-mount UBI device 4, volume 0

[m

Upgrade : Complete Total 0%...

Upgrade : Complete Total 0%...

Upgrade : Complete Total 0%...

Header CRC Checking ... OK

Image Name: kernel.img

Image Type: kernel.img (gzip compressed)

Data Size: 2547012 B, Bytes = 2.43 MB

Load Address: 0XC80000

Data CRC Checking ... OK

Programing start at: 0XC80000

 

[0;36m[libpdi] Flash_createPartionTab:6

[m[0;36m[libpdi] Erase Partion: 6

[m[0;32;32m[libpdi] FlashErase: addr= 0x0xc80000,blkNum:44, blkSize:0x20000,len:0x580000

[m

Upgrade : Complete Total 1%...

Upgrade : Complete Total 1%...

Upgrade : Complete Total 1%...

Upgrade : Complete Total 2%...

Upgrade : Complete Total 2%...

Upgrade : Complete Total 2%...

Upgrade : Complete Total 2%...

Upgrade : Complete Total 3%...

Upgrade : Complete Total 3%...

Upgrade : Complete Total 3%...

Upgrade : Complete Total 4%...

Upgrade : Complete Total 4%...

Upgrade : Complete Total 4%...

Upgrade : Complete Total 5%...

Upgrade : Complete Total 5%...

Upgrade : Complete Total 5%...

Upgrade : Complete Total 6%...

Upgrade : Complete Total 6%...

Upgrade : Complete Total 6%...

Upgrade : Complete Total 6%...

Header CRC Checking ... OK

Image Name: partition-x.cramfs.img

Image Type: partition-x.cramfs.img (gzip compressed)

Data Size: 4160 B, Bytes = 0.00 MB

Load Address: 0X500000

Data CRC Checking ... OK

Programing start at: 0X500000

 

[0;36m[libpdi] Flash_createPartionTab:3

[m[0;36m[libpdi] Erase Partion: 3

[m[0;32;32m[libpdi] FlashErase: addr= 0x0x500000,blkNum:8, blkSize:0x20000,len:0x100000

[m

Upgrade : Complete Total 6%...

Header CRC Checking ... OK

Image Name: romfs-x.ubifs.img

Image Type: romfs-x.ubifs.img (gzip compressed)

Data Size: 7340096 B, Bytes = 7.00 MB

Load Address: 0X1200000

Data CRC Checking ... OK

Programing start at: 0X1200000

 

[0;36m[libpdi] Flash_createPartionTab:7

[m[0;36m[libpdi] Erase Partion: 7

[m[0;32;32m[libpdi] FlashErase: addr= 0x0x1200000,blkNum:64, blkSize:0x20000,len:0x800000

[m

Upgrade : Complete Total 7%...

Upgrade : Complete Total 7%...

Upgrade : Complete Total 7%...

Upgrade : Complete Total 8%...

Upgrade : Complete Total 8%...

Upgrade : Complete Total 8%...

Upgrade : Complete Total 9%...

Upgrade : Complete Total 9%...

Upgrade : Complete Total 9%...

Upgrade : Complete Total 9%...

Upgrade : Complete Total 10%...

Upgrade : Complete Total 10%...

Upgrade : Complete Total 10%...

Upgrade : Complete Total 11%...

Upgrade : Complete Total 11%...

Upgrade : Complete Total 11%...

Upgrade : Complete Total 12%...

Upgrade : Complete Total 12%...

Upgrade : Complete Total 12%...

Upgrade : Complete Total 13%...

Upgrade : Complete Total 13%...

Upgrade : Complete Total 13%...

Upgrade : Complete Total 14%...

Upgrade : Complete Total 14%...

Upgrade : Complete Total 14%...

Upgrade : Complete Total 15%...

Upgrade : Complete Total 15%...

Upgrade : Complete Total 15%...

Upgrade : Complete Total 15%...

Upgrade : Complete Total 16%...

Upgrade : Complete Total 16%...

Upgrade : Complete Total 16%...

Upgrade : Complete Total 17%...

Upgrade : Complete Total 17%...

Upgrade : Complete Total 17%...

Upgrade : Complete Total 18%...

Upgrade : Complete Total 18%...

Upgrade : Complete Total 18%...

Upgrade : Complete Total 19%...

Upgrade : Complete Total 19%...

Upgrade : Complete Total 19%...

Upgrade : Complete Total 20%...

Upgrade : Complete Total 20%...

Upgrade : Complete Total 20%...

Upgrade : Complete Total 20%...

Upgrade : Complete Total 21%...

Upgrade : Complete Total 21%...

Upgrade : Complete Total 21%...

Upgrade : Complete Total 22%...

Upgrade : Complete Total 22%...

Upgrade : Complete Total 22%...

Upgrade : Complete Total 23%...

Upgrade : Complete Total 23%...

Upgrade : Complete Total 23%...

Upgrade : Complete Total 24%...

Upgrade : Complete Total 24%...

Header CRC Checking ... OK

Image Name: pd-x.ubifs.img

Image Type: pd-x.ubifs.img (gzip compressed)

Data Size: 1704000 B, Bytes = 1.63 MB

Load Address: 0X940000

Data CRC Checking ... OK

Programing start at: 0X940000

 

[0;36m[libpdi] Flash_createPartionTab:5

[m[0;36m[libpdi] Erase Partion: 5

[m[0;32;32m[libpdi] FlashErase: addr= 0x0x940000,blkNum:26, blkSize:0x20000,len:0x340000

[m

Upgrade : Complete Total 24%...

Upgrade : Complete Total 25%...

Upgrade : Complete Total 25%...

Upgrade : Complete Total 25%...

Upgrade : Complete Total 25%...

Upgrade : Complete Total 26%...

Upgrade : Complete Total 26%...

Upgrade : Complete Total 26%...

Upgrade : Complete Total 27%...

Upgrade : Complete Total 27%...

Upgrade : Complete Total 27%...

Upgrade : Complete Total 28%...

Upgrade : Complete Total 28%...

Header CRC Checking ... OK

Image Name: user-x.ubifs.img

Image Type: user-x.ubifs.img (gzip compressed)

Data Size: 20447296 B, Bytes = 19.50 MB

Load Address: 0X2200000

Data CRC Checking ... OK

Programing start at: 0X2200000

 

[0;36m[libpdi] Flash_createPartionTab:9

[m[0;36m[libpdi] Erase Partion: 9

[m[0;32;32m[libpdi] FlashErase: addr= 0x0x2200000,blkNum:204, blkSize:0x20000,len:0x1980000

[m

Upgrade : Complete Total 28%...

Upgrade : Complete Total 29%...

Upgrade : Complete Total 29%...

Upgrade : Complete Total 29%...

Upgrade : Complete Total 30%...

Upgrade : Complete Total 30%...

Upgrade : Complete Total 30%...

Upgrade : Complete Total 31%...

Upgrade : Complete Total 31%...

Upgrade : Complete Total 31%...

Upgrade : Complete Total 31%...

Upgrade : Complete Total 32%...

Upgrade : Complete Total 32%...

Upgrade : Complete Total 32%...

Upgrade : Complete Total 33%...

Upgrade : Complete Total 33%...

Upgrade : Complete Total 33%...

Upgrade : Complete Total 34%...

Upgrade : Complete Total 34%...

Upgrade : Complete Total 34%...

Upgrade : Complete Total 35%...

Upgrade : Complete Total 35%...

Upgrade : Complete Total 35%...

Upgrade : Complete Total 36%...

Upgrade : Complete Total 36%...

Upgrade : Complete Total 36%...

Upgrade : Complete Total 36%...

Upgrade : Complete Total 37%...

Upgrade : Complete Total 37%...

Upgrade : Complete Total 37%...

Upgrade : Complete Total 38%...

Upgrade : Complete Total 38%...

Upgrade : Complete Total 38%...

Upgrade : Complete Total 39%...

Upgrade : Complete Total 39%...

Upgrade : Complete Total 39%...

Upgrade : Complete Total 40%...

Upgrade : Complete Total 40%...

Upgrade : Complete Total 40%...

Upgrade : Complete Total 41%...

Upgrade : Complete Total 41%...

Upgrade : Complete Total 41%...

Upgrade : Complete Total 41%...

Upgrade : Complete Total 42%...

Upgrade : Complete Total 42%...

Upgrade : Complete Total 42%...

Upgrade : Complete Total 43%...

Upgrade : Complete Total 43%...

Upgrade : Complete Total 43%...

Upgrade : Complete Total 44%...

Upgrade : Complete Total 44%...

Upgrade : Complete Total 44%...

Upgrade : Complete Total 45%...

Upgrade : Complete Total 45%...

Upgrade : Complete Total 45%...

Upgrade : Complete Total 46%...

Upgrade : Complete Total 46%...

Upgrade : Complete Total 46%...

Upgrade : Complete Total 47%...

Upgrade : Complete Total 47%...

Upgrade : Complete Total 47%...

Upgrade : Complete Total 47%...

Upgrade : Complete Total 48%...

Upgrade : Complete Total 48%...

Upgrade : Complete Total 48%...

Upgrade : Complete Total 49%...

Upgrade : Complete Total 49%...

Upgrade : Complete Total 49%...

Upgrade : Complete Total 50%...

Upgrade : Complete Total 50%...

Upgrade : Complete Total 50%...

Upgrade : Complete Total 51%...

Upgrade : Complete Total 51%...

Upgrade : Complete Total 51%...

Upgrade : Complete Total 52%...

Upgrade : Complete Total 52%...

Upgrade : Complete Total 52%...

Upgrade : Complete Total 52%...

Upgrade : Complete Total 53%...

Upgrade : Complete Total 53%...

Upgrade : Complete Total 53%...

Upgrade : Complete Total 54%...

Upgrade : Complete Total 54%...

Upgrade : Complete Total 54%...

Upgrade : Complete Total 55%...

Upgrade : Complete Total 55%...

Upgrade : Complete Total 55%...

Upgrade : Complete Total 56%...

Upgrade : Complete Total 56%...

Upgrade : Complete Total 56%...

Upgrade : Complete Total 57%...

Upgrade : Complete Total 57%...

Upgrade : Complete Total 57%...

Upgrade : Complete Total 57%...

Upgrade : Complete Total 58%...

Upgrade : Complete Total 58%...

Upgrade : Complete Total 58%...

Upgrade : Complete Total 59%...

Upgrade : Complete Total 59%...

Upgrade : Complete Total 59%...

Upgrade : Complete Total 60%...

Upgrade : Complete Total 60%...

Upgrade : Complete Total 60%...

Upgrade : Complete Total 61%...

Upgrade : Complete Total 61%...

Upgrade : Complete Total 61%...

Upgrade : Complete Total 62%...

Upgrade : Complete Total 62%...

Upgrade : Complete Total 62%...

Upgrade : Complete Total 62%...

Upgrade : Complete Total 63%...

Upgrade : Complete Total 63%...

Upgrade : Complete Total 63%...

Upgrade : Complete Total 64%...

Upgrade : Complete Total 64%...

Upgrade : Complete Total 64%...

Upgrade : Complete Total 65%...

Upgrade : Complete Total 65%...

Upgrade : Complete Total 65%...

Upgrade : Complete Total 66%...

Upgrade : Complete Total 66%...

Upgrade : Complete Total 66%...

Upgrade : Complete Total 67%...

Upgrade : Complete Total 67%...

Upgrade : Complete Total 67%...

Upgrade : Complete Total 68%...

Upgrade : Complete Total 68%...

Upgrade : Complete Total 68%...

Upgrade : Complete Total 68%...

Upgrade : Complete Total 69%...

Upgrade : Complete Total 69%...

Upgrade : Complete Total 69%...

Upgrade : Complete Total 70%...

Upgrade : Complete Total 70%...

Upgrade : Complete Total 70%...

Upgrade : Complete Total 71%...

Upgrade : Complete Total 71%...

Upgrade : Complete Total 71%...

Upgrade : Complete Total 72%...

Upgrade : Complete Total 72%...

Upgrade : Complete Total 72%...

Upgrade : Complete Total 73%...

Upgrade : Complete Total 73%...

Upgrade : Complete Total 73%...

Upgrade : Complete Total 73%...

Upgrade : Complete Total 74%...

Upgrade : Complete Total 74%...

Upgrade : Complete Total 74%...

Upgrade : Complete Total 75%...

Upgrade : Complete Total 75%...

Upgrade : Complete Total 75%...

Upgrade : Complete Total 76%...

Upgrade : Complete Total 76%...

Upgrade : Complete Total 76%...

Upgrade : Complete Total 77%...

Upgrade : Complete Total 77%...

Header CRC Checking ... OK

Image Name: custom-x.ubifs.img

Image Type: custom-x.ubifs.img (gzip compressed)

Data Size: 1704000 B, Bytes = 1.63 MB

Load Address: 0X600000

Data CRC Checking ... OK

Programing start at: 0X600000

 

[0;36m[libpdi] Flash_createPartionTab:4

[m[0;36m[libpdi] Erase Partion: 4

[m[0;32;32m[libpdi] FlashErase: addr= 0x0x600000,blkNum:26, blkSize:0x20000,len:0x340000

[m

Upgrade : Complete Total 77%...

Upgrade : Complete Total 78%...

Upgrade : Complete Total 78%...

Upgrade : Complete Total 78%...

Upgrade : Complete Total 78%...

Upgrade : Complete Total 79%...

Upgrade : Complete Total 79%...

Upgrade : Complete Total 79%...

Upgrade : Complete Total 80%...

Upgrade : Complete Total 80%...

Upgrade : Complete Total 80%...

Upgrade : Complete Total 81%...

Upgrade : Complete Total 81%...

Header CRC Checking ... OK

Image Name: web-x.ubifs.img

Image Type: web-x.ubifs.img (gzip compressed)

Data Size: 7733312 B, Bytes = 7.38 MB

Load Address: 0X1A00000

Data CRC Checking ... OK

Programing start at: 0X1A00000

 

[0;36m[libpdi] Flash_createPartionTab:8

[m[0;36m[libpdi] Erase Partion: 8

[m[0;32;32m[libpdi] FlashErase: addr= 0x0x1a00000,blkNum:64, blkSize:0x20000,len:0x800000

[m

Upgrade : Complete Total 81%...

Upgrade : Complete Total 82%...

Upgrade : Complete Total 82%...

Upgrade : Complete Total 82%...

Upgrade : Complete Total 83%...

Upgrade : Complete Total 83%...

Upgrade : Complete Total 83%...

Upgrade : Complete Total 84%...

Upgrade : Complete Total 84%...

Upgrade : Complete Total 84%...

Upgrade : Complete Total 84%...

Upgrade : Complete Total 85%...

Upgrade : Complete Total 85%...

Upgrade : Complete Total 85%...

Upgrade : Complete Total 86%...

Upgrade : Complete Total 86%...

Upgrade : Complete Total 86%...

Upgrade : Complete Total 87%...

Upgrade : Complete Total 87%...

Upgrade : Complete Total 87%...

Upgrade : Complete Total 88%...

Upgrade : Complete Total 88%...

Upgrade : Complete Total 88%...

Upgrade : Complete Total 89%...

Upgrade : Complete Total 89%...

Upgrade : Complete Total 89%...

Upgrade : Complete Total 89%...

Upgrade : Complete Total 90%...

Upgrade : Complete Total 90%...

Upgrade : Complete Total 90%...

Upgrade : Complete Total 91%...

Upgrade : Complete Total 91%...

Upgrade : Complete Total 91%...

Upgrade : Complete Total 92%...

Upgrade : Complete Total 92%...

Upgrade : Complete Total 92%...

Upgrade : Complete Total 93%...

Upgrade : Complete Total 93%...

Upgrade : Complete Total 93%...

Upgrade : Complete Total 94%...

Upgrade : Complete Total 94%...

Upgrade : Complete Total 94%...

Upgrade : Complete Total 94%...

Upgrade : Complete Total 95%...

Upgrade : Complete Total 95%...

Upgrade : Complete Total 95%...

Upgrade : Complete Total 96%...

Upgrade : Complete Total 96%...

Upgrade : Complete Total 96%...

Upgrade : Complete Total 97%...

Upgrade : Complete Total 97%...

Upgrade : Complete Total 97%...

Upgrade : Complete Total 98%...

Upgrade : Complete Total 98%...

Upgrade : Complete Total 98%...

Upgrade : Complete Total 99%...

Upgrade : Complete Total 99%...

Upgrade : Complete Total 99%...

Upgrade : Complete Total 100%... [0;32;32m[libpdi] Read: blkIndex: 0,pageIndex: 1,byteIndex: 0 ,fLag: ff

[m[0;32;32m[libpdi] Write: blkIndex: 0,pageIndex: 1,byteIndex: 0 ,fLag: aa

[mUPGRADED_MSG: will reboot system

[0;32;32m[libpdi] rebootSystem: i will reboot

[m[0;32;32m[libpdi] Read: blkIndex: 1,pageIndex: 0,byteIndex: 0 ,fLag: ff

[m[0;32;32m[libpdi] Write: blkIndex: 1,pageIndex: 0,byteIndex: 0 ,fLag: 0

[m[0;32;32m[libpdi] pdi:system will reboot!!

Share this post


Link to post
Share on other sites

I have a DH-IPC-HFW4300S which I unwisely attempted to upgrade using the Dahua tool "Firmware Kit for IPCPTZ". The tool reloaded the camera with some image, but not one that works and it left the camera semi-bricked.

 

I can access the camera using Telnet and the camera does respond to port 3800. However, when I try to login using the Dahua ConfigTool, the login fails even though I know the password and can use it (with the standard prefix as described in the first post in this thread) to login via telnet.

 

If I kill and start up /utils/upgraded from the telnet console I get the following when trying to connect from the configtool:

 

# /utils/upgraded
[libdvr] libdvr.so Build on May 22 2014 at 14:23:12.
[libdvr] SVN NUM: 5830.
[libdvr] ...dataBuf[0] 26, dataBuf[1] 4
[libdvr] Real fchip type is 21
[libdvr] WARN (../../src/misc/sys.c|getSystemInfo|430): get authcode error !
[libdvr] info->deviceType:IPC-HFW2200B-V2
[libdvr] devalias:IPC-HFW1200S
[libdvr] armrate = 486
[libdvr] @@@@ buf = 1A03212PAU00375
UPGRADED_MSG: Can't Open /mnt/mtd/Config/passwd
UPGRADED_MSG: Account not exist!

 

The config tool login attempt fails with the message "Login overtime" which I assume means "login timeout".

 

I think that if could just get logged in from the config tool I might be able to load a working image.

 

I'm unable to modify the i18n files described by cctv_007 earlier in this thread because they are on a ro squashfs filesystem that cannot be modified by mounting it rw.

 

Does anyone have a suggestion for how I can get a connection on port 3800 to try to load a different image?

Share this post


Link to post
Share on other sites

for DH-IPC-HFW4300S the correct firmware version DH_IPC-HX5 (4) XXX-Adreia_Eng_P_Stream3_V2.420.0009.0.R.20151106.zip

in this firmware, there is not squashfs filesystem, all in ubifs.img.

Probably you are using wrong version of firmware.

Share this post


Link to post
Share on other sites

Yes. I realize that the firmware is wrong. The question now it how to get it loaded given the camera's current state which I described in the post.

Share this post


Link to post
Share on other sites

oleglevsha: Thank you! That tool was able to reset the firmware in the camera even though configtool was unable to do so.

Share this post


Link to post
Share on other sites

Hello, I have bought a Dahua IPC-HFW2325S-W from AliExp. I upgraded the firmware with the one of the IPC-HFW1320S-W and now the camera is bricked. No ports are open, Ip is ok .108 Config.Tool can't reach the camera.

What can I do?

Thanks in advance

Share this post


Link to post
Share on other sites

Thanks for nice thread!

 

However, I have HFW4422EP which is not responding anymore. It has been connected directly to NVR4108-P recorder straight out from the box.

 

When I connect camera in PoE switch, I can see PoE light on and a bit later data light also. When I put the camera against table surface and block all the light,

night mode and IR lights are not switching on. Also Configtool cannot find camera.

 

I supplied direct 12V power in camera and connected it to PC, set my PC in 192.168.1.x subnet but still Configtool cannot find the camera.

With advanced port scanner - software I can found camera in 192.168.1.108 and it shows its MAC, but not any ports being open.

Also it does not respond in ping.

 

With telnet, http, ssh nothing.

 

There seems to be no physical reset - switch in the camera. Because the shape is not circular, also cannot screw open the lens element to expose

reset switch as it is possible in circular models.

 

Any ideas?

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

×