Jump to content

Interesting Dahua DVR developments

Recommended Posts

Not sure if this is old hat, but I finally stumbled upon the telnet password for most dahua ip cameras and DVRs. This was posted on Rory's board.




Also, neat development:




I poked around the dvr, seems to be a lot of stuff based on LUA. Bulk of running processes are /var/Challenge buf


interesting output:





Build date:Aug 15 2011 08:52:44






Build date:May 9 2011 10:07:01

Desc:thread Release





Build date:May 10 2011 10:46:26

Desc:buffer Relese





Build date:Feb 7 2012 18:15:14

Desc:GUI ctrls Relese





Build date:Dec 5 2011 15:07:51






Build date:Feb 3 2012 11:21:37

Desc:user release


17:16:38|trace CPacketManager::CPacketManager()>>>>>>>>>




Build date:Dec 6 2011 09:56:49

Desc:DriverManager release


17:16:38|trace main(2, /var/Challenge buf)

LIBDVR : Version : V6V5V4:000

LIBDVR : dvr3116E product init

LIBDVR : 2012-9-19, today is weekday 3 time:17:16:38

LIBDVR : DvrShowInformation

LIBDVR : DvrGetHwidInformation(PRODUCT_TYPE) = 0



| N52 libdvr version: 1.06.0 - Jan 19 2012 09:15:49

| DVR ID: 0U812

| product type: DVR

| video channel: 16

| audio channel: 1

| alarm in: 0

| alarm out: 0

| frontboard type: 1U

| video chip: TW2868

| DSP chip: HI3520

| analog audio mode: tw28XX control

| audio surpport: Yes

| matrix surpport: No

| loop surpport: No

| video tour surpport: Yes

| real time: No

| disk interface: SATA

| LCD surpport: No

| CDRW surpport: Yes

| hardware version: 1

| audio interface: alt

| disk num: 1

| net card: 0

| dsp num: 1

| playback num: 16


17:16:38|trace CVersion::CVersion()>>>>>>>>>

17:16:38|trace Challenge Version Info:2.608.0000.1 BuildDate 2012-02-15 12:02:44

17:16:38|trace CChallenger::CChallenger()>>>>>>>>>

17:16:38|debug tracepoint: ../../Challenger.cpp, 256.



* Lua Engine Version: Lua 5.0.2

* Supported Language: English

* SupportedVideoStand: NTSC



17:16:38|trace path1:/mnt/mtd/Config/Config1 path2:/mnt/mtd/Config/Config2

17:16:38|trace libkeyboard.a::CFrontboardImp::CFrontboardImp()>>>>

LIBDVR : Frontboard use ttyAS2


17:16:38|trace libkeyboard.a::FrontboardCreate :0


libkeyboard.a::CKeyboardDefault::getCommand keepalive

libkeyboard.a::get def comm!


>>>>>>>>>>>>>has audio 1 , MatrixBoard has 0 loop


Still looking for my holy grail of a CGI dir or JPEGs.... none found...

Share this post

Link to post
Share on other sites

wow, awesome info.

Telnet works great on my DVR, just snooping around for now.... nothing interesting to find.


But, that TaniDVR looks like something I could use. I was looking for a Linux program (or as they call it on the sourceforge page, "aproper OS". I'll be loading that up tonight


Thanks for the info!


(Unfortunately, there is no /var/log/messages file)



Share this post

Link to post
Share on other sites



hello I try to connect with telnet, I logged in as root vizxv, ok.

you know the commands to change the bmp files?

forgiveness for English it is translated by google ... I am French

your topic interests me a lot

thank you

Share this post

Link to post
Share on other sites

I tried to go in and change the main logo, can probably get more for the DVR or IP camera if it said Axis or Mobotix. OK, only kidding, I want to my name up there. I got my logo.jpg file in the /tmp directory, same pixels (256x55) but I can't find a way to copy it to the /mnt/web/image directory. It's read-only, not usually an obsticle for me but this one is SquashFS format that I'm not familiar with. I believe this is some sort of compressed read only file system. So my guess is I would have to un-squash it somehow, mount it as read/wite, copy my logo.jpg file and then squash it back.


Anyone tried this yet? I know it's possible because Q-See puts their logo in there over the Dahua logo.

Share this post

Link to post
Share on other sites

What program are you using to FTP to the DVR? I tried ports 21, 22, 23 and was unable.


When I telnet in, my images are located here: /usr/data/Data I have no images in /tmp

Share this post

Link to post
Share on other sites

I don't have a Dahua DVR but I just got a Dahua Camera and started looking around a bit. From what I read here the camera and the DVR appears to be running the same software... On my camera there is no FTP server installed, so you need to telnet into your DVR and FTP out files that you wish to look at, using 'ftpput'. To do this you need a FTP server running somewhere where you can upload files. There is also some basic unix commands that are implemented in Busybox but to which Dahua didn't put symlinks, like df and top. To run them you need to issue 'busybox df' and 'busybox top'. Useful to find out how much space is left on the camera, or how much CPU is used.


Buellwinkle, you seem to have it right with SquashFS, it looks like you'll have to dd the partition in a temp file, ftpput it somewhere, unsquash it, change the logo, re-squash it, ftpget the new file on the dvr/camera, and dd again the file to the partition. I don't have the camera running right now but with df it's easy to find the mount point. BTW you work in IT?


On a side note, if anybody is interested, there is a way to get a snapshot of the camera in HTTP, it's not a MJPEG feed, only a still JPEG. But anyway it's not that bad, I was able to get about 3fps out of the snapshot URL with ZoneMinder. It's definately better to go with the RTSP feed but it's quick & dirty if you want to have an idea of what's going on at home while you're away. Here it is:




I believe you can add ?channel= to the URL if you want to select which camera you want on the DVR, it doesn't do anything on my camera for obvious reasons Oh and it appears to require NO PASSWORD, so draw your own conclusions!!

Share this post

Link to post
Share on other sites

Thanks to soksavda for the url


Now I have connection via telnet to my VTO2000A IP Intercom.


Are there other commands which I can send via URL? Exists an list with commands?


Is it possible to connect with WinSCP for copying files and analyse them?

Share this post

Link to post
Share on other sites

I would also like to know if there's a list of commands which can be sent via telnet to the DVR. I would like the ability to change the display output so you can show the different views output to the HDMI interface. This should be a straight forward command set.


Any pointers appreciated.

Share this post

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now