Jump to content
cctv_007

Unbricking your Dahua IP camera (Tips, Tricks & Firmware)

Recommended Posts

Hi, I have a Dahua PTZ SD52C225U-HNI, after ptz bin upgrade ..dead and no ethernet.I tried to unbrick by tftp but lan go up just 1 second. Can you suggest unbrick by serial rs232 or sd card ? I can't use tftp.

I have uboot working by rs232

Thanks !

  • Like 1

Share this post


Link to post
Share on other sites

If eth interface comes up at least a very short period, then I am convinced the TFTP method should work.

Connect the device to a 100MBit/s switch and set up a pc according to unbricking guide.

Before doing the actual TFTP upgrade process, start wireshark on the pc and see it there is any tftp request from the device.

  • Like 1

Share this post


Link to post
Share on other sites

Hi, can anyone help me? I am trying to get my Dahua SD22204T-GN-W camera to boot up by updating the firmware via TFTP. I have run the run commands but camera still will not boot up. The U-Boot screen shows the below. Can anyone tell me how to fix the fail to load bootargs part. Thanks

U-Boot 2010.06-svn5163 (Jan 16 2018 - 05:03:02)
I2C:   ready
DRAM:  110 MiB
gBootLogPtr:00b80008.
NAND:  128 MiB
amb_nand_read_oob read page:49152 err
partition file version 2
rootfstype squashfs root /dev/mtdblock8
fail to load bootargsParametersV22.txt
fail to load bootargsParametersV21.txt
fail to init bootargsParametersV2
TEXT_BASE:01000000
Net:   Detected MACID:14:a7:8b:15:8c:23
PHY:0x001cc816,addr:0x00
phy RTL8201 init

partition file version 2
rootfstype squashfs root /dev/mtdblock8
MMC:   sdmmc init
Hit any key to stop autoboot:  0

Share this post


Link to post
Share on other sites

I need firmware for 

6MP IPC-HDBW4631R-S Dahua.

Anybody help?

i was upgrade this camera with [PAL]DH_IPC-HX5X3X-Rhea_Eng_P_Stream3_V2.622.0000000.18.R.20171110 (IPC-HDBW5631R-ZE-the same on picture like my) and it broke.

now I can login on this camera with smart pss on port 3800. there i found upgrade option. Is this good way to fix my camera?

Share this post


Link to post
Share on other sites

Hello. There are three cameras HFW4233K-AS-LED and two HFW4233F-ZSA with an interface in Chinese only. There are also two HFW4233F-ZSA with cracked firmware with Russian and English interfaces. Question:

  1. Is it possible to pull out the firmware from the merged dump of russified cameras for further use (Russification of Chinese cameras by uploading this firmware through the web)?
  2. How to edit the serial number and MAC of the camera in the merged dump in order to Russify by uploading the full dump?
    Both models belong to the same series, so if it is possible to pull out the firmware, then it will fit both cameras.

Share this post


Link to post
Share on other sites
On 2/21/2015 at 12:54 AM, cctv_007 said:

I am starting this thread to capture a bunch of information in one spot to assist those with "bricked" cameras due failed firmware upgrades. I bought my first Dahua IP camera just a couple weeks ago. I was impressed & pretty happy with it, but upon reading about new capabilities in newer firmware, I decided to upgrade it. Then like many others on here, I lost access to the Web GUI and the camera was no longer functioning. I spent the last two weeks getting to know everything about these cameras and this thread will capture all this information. It will take me several weeks to document all the information so please be patient.

 

There are a variety of problems that I will try my best to explain and share the possible solutions. I have gotten pretty comfortable with these cameras and have purposely bricked them to various degrees of severity just to validate the recovery process. Most people "brick" their cameras trying to upgrade the firmware. This is not a serious issue and it can be corrected very easily. The camera runs an upgrade service on port 3800. The configTool always shows a default port of 37777 but this is not an issue as it can do the upgrade on port 3800 anyway. Change your port to 3800 and use a firmware file lsted below and you are back in business.

 

I will keep updating this post as I get more time to write all the details around recovery. I will also post links to over 40+ firmware files that and which cameras they will work with. It will take me a bit of time to capture all this information, so please be patient.

 

 

 

BRICKED CAMERA? How can you tell?

 

There are several types of "BRICKED" camera conditions and they have varying levels of severity and also varying levels of complexity for recovery. Most are simple and caused by bad firmware uploads. The worst will require a full rebuild of the partitions which load the kernel, software and all other data.

 

1. The first step in identifying the severity of your issue is to determine what still working on your camera. In order to do that, lets remove as many variables as possible to the troubleshooting process. If possible, connect the camera ethernet and PC ethernet on it's own switch and make sure that no vlan tagging is enabled on the switch.

 

Next, you need to figure out if the IP address is still reacheable. Ping the last known ip address. The default address for most cameras is 192.168.1.108.

 

If you don't know it you can use the arp/ping method to configure which adds as startic arp entry to a new ip address. (This feature is enabled on the camera by default)

 

 

2. Once you have a pingable IP, you need to know what services are still active on the camera. This can be done with a simple port scanner. I have added a link to below in tools.

 

3. Run the port scanner and record which ports are still open. In many cases port 23 and port 3800 will still be open. If this is your situation, it is a very simple fix. If no ports are open, you will need to do a full image load which is more complex.

 

The typical ports that you would see are:

 

23 - Telnet access

80 - Web User interface

443 - SSL

554 - Real time streaming port

3800 - Upgrade Deamon

5000 - UPnP

37777 - TCP Video streaming

37778 - UDP Video Streaming

42323 - Real time remote runner

 

Plus a whole bunch more of UDP ports and more TCP ports

 

 

REPAIR WITH PORT 3800

 

Download a step by step guide (DAHUA IP Camera Recovery v1.0.pdf) with screen prints @ http://tinyurl.com/lbl3up7

 

1A. If port 3800 is open you can connect with the Dahua Config tool (link below in tools). I tdefault to port 37777 but change it to 3800 as this port where the upgrade daemon is listening. Port 37777 is a redirect but it won't work if your firmware has failed.

Launch the config tool and click on login button. Type the IP address , username and password then port 3800.

 

Open a know working firmware file and upload to the camera.

 

 

1B. If port 3800 is not open, go to the next step to enable port 3800.

 

2. If you have telnet access, you can login with putty. Link to putty below in tools. The default Web UI password is admin / admin.

 

In older firmware the telnet account is root / vizxv

In newer firmware the telnet account is admin / 7ujMko0+"web UI password" ---> 7ujmko0admin

 

 

Once connected you can execute a ps command to see running processes. /usr/sbin/upgraded process is what listens on port 3800 for the firmware binary file.

There is also another copy in /var/tmp/

 

A useful tip for watching the upgrade process is to kill the "upgraded" process that is running and re-launch it in the foreground to watch the upgrade.

 

~#>ps

 

625 root 0:00 [mtdblock3]

630 root 0:00 [mtdblock4]

635 root 0:00 [mtdblock5]

772 root 0:00 [ubi_bgt7d]

776 root 0:00 [ubifs_bgt7_0]

790 root 0:00 /sbin/telnetd

798 root 0:00 [OSA_796_1]

860 root 0:00 syshelper elper 60

861 root 0:00 /usr/sbin/upgraded

869 root 0:00 [dsplogd]

870 root 0:00 [encode_guard]

889 root 0:00 [flush-ubifs_6_0]

923 root 3:29 ./VideoDaemon AEWB AF TVOUT

 

~#> kill -9 861

~#> /usr/sbin/upgraded

 

[OSA-APP] OSA Build on Apr 19 2014 at 09:55:50.

[OSA-APP] SVN NUM: 1609.

 

[libpdi] libpdi.so Build on Apr 19 2014 at 10:06:34.

[libpdi] SVN NUM: 13790.

[libpdi] Flashtype = 4,patSize = 100000,rwSize = 800,ersSize = 20000

22:52:46|[crypt] crypt_open ok!

Name: upgraded, bulid date: Apr 19 2014 09:17:58, svn: 255

[libpdi] >-------getSystemInfo------->

Fail to get env authcode!

[libpdi] Get authcode error

@@@@ buf = PZC4MU056W00XXX

22:52:52|[pdc] WARN (MISC_ioctl|493): Get SdCard cfg failed !

[libpdi] deviceType: IPC-HFW4300S-V2

[libpdi] processor: A5S88

[libpdi] hardwareVersion: 1.00

[libpdi] appAutoStart: 1

[libpdi] serialNumber: PZC4MU056W00XXX

[libpdi] processorCount: 1

[libpdi] deviceClass: IPC

[libpdi] noPtz: 1

[libpdi] noSdCard: 1

[libpdi] bandWidth: 48

[libpdi] <-------getSystemInfo-------<

UPGRADED_MSG: Can't Open /mnt/mtd/Config/passwd

UPGRADED_MSG: Login success!

UPGRADED_MSG: Kill 976 successful

[libpdi] Read: blkIndex: 1,pageIndex: 0,byteIndex: 0 ,fLag: ff

[libpdi] Write: blkIndex: 1,pageIndex: 0,byteIndex: 0 ,fLag: 0

UPGRADED_MSG: reset_watchdog

UPGRADED_MSG: Receive A4(alarm)

UPGRADED_MSG: reset_watchdog

UPGRADED_MSG: Receive A1(alive package)

UPGRADED_MSG: reset_watchdog

UPGRADED_MSG: Received : 29868252, FileSize : 29868252

UPGRADED_MSG: Download Complete

UPGRADED_MSG: DoDownLoad success!

UPGRADED_MSG: Flash init success

UPGRADED_MSG: hwid file success!

Fail to get env native!

UPGRADED_ERR: LINE: 1074: invalid file: Install.lua

UPGRADED_MSG: zip file total size: 40900220

[libpdi] >-------getSystemInfo------->

Fail to get env authcode!

[libpdi] Get authcode error

@@@@ buf = PZC4MU056W00XXX

22:53:10|[pdc] WARN (MISC_ioctl|493): Get SdCard cfg failed !

[libpdi] deviceType: IPC-HFW4300S-V2

[libpdi] processor: A5S88

[libpdi] hardwareVersion: 1.00

[libpdi] appAutoStart: 1

[libpdi] serialNumber: PZC4MU056W00XXX

[libpdi] processorCount: 1

[libpdi] deviceClass: IPC

[libpdi] noPtz: 1

[libpdi] noSdCard: 1

[libpdi] bandWidth: 48

[libpdi] <-------getSystemInfo-------<

UPGRADED_MSG: packet.name: SD6XXX, board.name: IPC-HFW4300S-V2

UPGRADED_MSG: packet.hardver: , board.hardver:

UPGRADED_MSG: packet.name: IPC-HX3XXX, board.name: IPC-HFW4300S-V2

UPGRADED_MSG: packet.hardver: , board.hardver:

UPGRADED_MSG: Verify version success

 

Header CRC Checking ... OK

Image Name: kernel.img

Image Type: kernel.img (gzip compressed)

Data Size: 2546876 B, Bytes = 2.43 MB

Load Address: 0XC80000

Data CRC Checking ... OK

Programing start at: 0XC80000

 

[libpdi] write update Flag

[libpdi] Read: blkIndex: 0,pageIndex: 0,byteIndex: 0 ,fLag: ff

[libpdi] Write: blkIndex: 0,pageIndex: 0,byteIndex: 0 ,fLag: 55

[libpdi] Flash_createPartionTab:6

[libpdi] Erase Partion: 6

[libpdi] FlashErase: addr= 0x0xc80000,blkNum:44, blkSize:0x20000,len:0x580000

<5>UBIFS: un-mount UBI device 2, volume 0

<5>UBIFS: un-mount UBI device 4, volume 0

Upgrade : Complete Total 6%...

Header CRC Checking ... OK

Image Name: partition-x.cramfs.img

Image Type: partition-x.cramfs.img (gzip compressed)

Data Size: 4160 B, Bytes = 0.00 MB

Load Address: 0X500000

Data CRC Checking ... OK

Programing start at: 0X500000

 

[libpdi] Flash_createPartionTab:3

[libpdi] Erase Partion: 3

[libpdi] FlashErase: addr= 0x0x500000,blkNum:8, blkSize:0x20000,len:0x100000

Upgrade : Complete Total 6%...

Header CRC Checking ... OK

Image Name: romfs-x.ubifs.img

Image Type: romfs-x.ubifs.img (gzip compressed)

Data Size: 7340096 B, Bytes = 7.00 MB

Load Address: 0X1200000

Data CRC Checking ... OK

Programing start at: 0X1200000

 

[libpdi] Flash_createPartionTab:7

[libpdi] Erase Partion: 7

[libpdi] FlashErase: addr= 0x0x1200000,blkNum:64, blkSize:0x20000,len:0x800000

Upgrade : Complete Total 24%...

Header CRC Checking ... OK

Image Name: pd-x.ubifs.img

Image Type: pd-x.ubifs.img (gzip compressed)

Data Size: 1966144 B, Bytes = 1.88 MB

Load Address: 0X940000

Data CRC Checking ... OK

Programing start at: 0X940000

 

[libpdi] Flash_createPartionTab:5

[libpdi] Erase Partion: 5

[libpdi] FlashErase: addr= 0x0x940000,blkNum:26, blkSize:0x20000,len:0x340000

Upgrade : Complete Total 28%...

Header CRC Checking ... OK

Image Name: user-x.ubifs.img

Image Type: user-x.ubifs.img (gzip compressed)

Data Size: 21233728 B, Bytes = 20.25 MB

Load Address: 0X2200000

Data CRC Checking ... OK

Programing start at: 0X2200000

 

[libpdi] Flash_createPartionTab:9

[libpdi] Erase Partion: 9

[libpdi] FlashErase: addr= 0x0x2200000,blkNum:204, blkSize:0x20000,len:0x1980000

Upgrade : Complete Total 80%...

Header CRC Checking ... OK

Image Name: custom-x.ubifs.img

Image Type: custom-x.ubifs.img (gzip compressed)

Data Size: 1966144 B, Bytes = 1.88 MB

Load Address: 0X600000

Data CRC Checking ... OK

Programing start at: 0X600000

 

[libpdi] Flash_createPartionTab:4

[libpdi] Erase Partion: 4

[libpdi] FlashErase: addr= 0x0x600000,blkNum:26, blkSize:0x20000,len:0x340000

Upgrade : Complete Total 85%...

Header CRC Checking ... OK

Image Name: web-x.ubifs.img

Image Type: web-x.ubifs.img (gzip compressed)

Data Size: 5505088 B, Bytes = 5.25 MB

Load Address: 0X1A00000

Data CRC Checking ... OK

Programing start at: 0X1A00000

 

[libpdi] Flash_createPartionTab:8

[libpdi] Erase Partion: 8

[libpdi] FlashErase: addr= 0x0x1a00000,blkNum:64, blkSize:0x20000,len:0x800000

Upgrade : Complete Total 99%... [libpdi] Read: blkIndex: 0,pageIndex: 1,byteIndex: 0 ,fLag: ff

[libpdi] Write: blkIndex: 0,pageIndex: 1,byteIndex: 0 ,fLag: aa

Upgrade : Complete Total 100%... UPGRADED_MSG: will reboot system

[libpdi] rebootSystem: i will reboot

[libpdi] Read: blkIndex: 1,pageIndex: 0,byteIndex: 0 ,fLag: ff

[libpdi] Write: blkIndex: 1,pageIndex: 0,byteIndex: 0 ,fLag: 0

[libpdi] pdi:system will reboot!!

 

Here you can see each partition being loaded wit the individual img files. I will write a quick how to on loading each one individually at a later time.

 

If you chose a valid firmware file, you will be back in working order. If you still have problems, repeat with another firmware file till you have a valid file. The IPC-HFW4300S-V2 is not natively compatible with all other 4300S firmware. I am in the process of writing a how to that explains how to over come this issue.

 

UNBRICK WITH UBOOT via SERIAL

 

NOTE: This section is coming soon... I'm gathering all the images I need for various camera types

 

 

 

OTHER USEFUL INFORMATION (to be sorted later)

 

The firmware consists of several images that are loaded into various partitions in flash in a UBI file system. You can load each partition separately if needed. More on this later.... (I'll put a guide together on flashing and recovering partitions)

 

Once you telnet into the camera, there are number of useful binaries in the user shell that can help correct and diagnose some of the problems people are experiencing. One of the helpful steps is to kill the /var/tmp/upgraded process and run it in the foreground so you can see what is going on and easily capture error messaged. The /var/tmp/upgraded process is what opens the port 3800 and allows you to connect to the camera with the config tool if your web services have failed. There is also another copy in usr/sbin/.

 

Also, in there is a command to reset all the parameters back to factory defaults (username, password, ip address back to 192.168.1.108 etc.) This can be accomplished with /sbin/clearparam.

 

Another issue that people run into is the constant reboot issue. This can be caused by a failed process. The main application which provides all the camera capabilities (web interface, streaming, etc.) is /usr/bin/sonia. This process is what makes most firmware different from version to version (sort of). There are also changes to the web partition which contains the web server pages that /usr/bin sonia hosts on port 80. The sonia process is invoked by a shell script in init.d and if the process is killed, the camera reboots after a few minutes. This has cause many people issues when trying to "unbrick" the camera since you only have a few minutes between reboots.

 

To stop the reboots you can update the flash. There is a parameter called appauto that tells the camera to auto start /us/bin/sonia. If you want the camera to start and not invoke the shell script that launches sonia, you need to set appauto to 0. This will stop the camera from rebooting when sonia is not running. This cam be accomplished by running '/sbin/appauto 0'. To turn it back on, just run /sbin/appauto 1. This writes the boot parameter in flash that the kernel reads before starting the process. You can check the current status of the appauto bootparameter with 'cat /proc/dahua/bootpara' It will only show what the parameter was when you booted up, so if you changes it you need to reboot to see the change in /proc/dahua/bootpara.

 

Realtime streaming URL - rtsp://192.168.1.108/cam/realmonitor?channel=1&subtype=0&proto=Onvif

You can change the subtype to 1 for the secondary stream also you can add user:password@ in front of the IP address if you have the permissions set requiring it.

 

You can use the HTTP API to configure some parameters that are not yet in the web UI. For instance, another member discovered he could enable NFS through the web UI in addition to the local SD card. This config is not possible through the web interface as you need to pick one or the other.

These documents details the API of Dahua video products (links provided to some of the versions below). Programmers or users can access and configure Dahua video products through the API. Every setting of the camera is available through the API whereas only a small number are available through the WEB interface. The document with version 1.10 is available with firmware version 2.0 and above. This document with version 1.20, 1.21, 1.22, 1.23,1.24,1,25,1,26,1,27,1,28 is available with firmware 2.210 and above.This document with version 1. 29 ,1.30, 1.31, 1.32, 1.33, 1.34, 1.35,

1.36 is available with firmware 2.210 and above.This document with version 1.37 is available with firmware 2.212, 2.4 and above.

 

I have also done a bit of testing around the tftp process that is invoked in u-boot that looks for upgrade_info_7db780a713a4.txt and failed.txt. I think with a little more work, I'll figure out if there is a recovery method using tftp without serial access. This would be necessary if you lose telnet access and need to rebuild the kernel partition that hosts telnetd.

 

 

 

Tools

 

DAHUA IP Camera Recovery v1.0.pdf....................... http://tinyurl.com/lbl3up7

Port Scanner .................................................. http://tinyurl.com/q53pojg

Putty .............................................................. http://tinyurl.com/lvbbmsq

Tftp Server ..................................................... http://tinyurl.com/m46wnhe

 

 

Dahua Docs & Tools

 

DAHUA_HTTP_API 1.0 .pdf ................................................ http://tinyurl.com/lb43lga

DAHUA_HTTP_API_1.23.pdf ................................................ http://tinyurl.com/lrwye3k

DAHUA_HTTP_API_FOR_IPC 1.28.pdf ........................................ http://tinyurl.com/kskrcay

DAHUA_HTTP_API_FOR_IPC&SD-V1.36.pdf .................................... http://tinyurl.com/mooccf9

DAHUA_HTTP_API_FOR_IPC&SD-V1.37.pdf .................................... http://tinyurl.com/kvyddfp

DAHUA_HTTP_API_FOR_DVR_V1.29.pdf ....................................... http://tinyurl.com/klc72tr

 

General_ConfigTool_Eng_V1.0.5.R.120428.zip ........................ http://tinyurl.com/mwlzbb3

General_ConfigTool_Eng_V1.06.1.T.120807.zip ........................ http://tinyurl.com/leudphu

General_ConfigTool_Eng_V1.07.2.R.130304.zip ....................... http://tinyurl.com/obs5ud7

General_ConfigTool_Eng_V1.07.3.R.130701.zip ....................... http://tinyurl.com/o6p628f <---- Use this one

General_ConfigTool_Eng_V2.00.0.R.140410.zip ........................ http://tinyurl.com/nbqtgev

 

 

Firmware Files

 

Firmware files are grouped by camera type and video signal (NTSC --> Eng_N / PAL --> Eng_P / or BOTH --> Eng_NP)

Files are ordered by version number with the latest Firmware in blue.

Files with DH_ prefix are DAHUA direct firmware files and those with General_ prefix are general release for OEM cameras but I've had good luck with both.

 

 

DH_IPC-HX1100_Eng_NP_V2.210.0000.3.R.20140416.bin .................................................. http://tinyurl.com/m2jf3qv

 

 

General_IPC-HX3(2)XXX_Eng_N_V2.210.0001.0.R.20130517.bin ............................................... http://tinyurl.com/q98zg9x

General_IPC-HX3(2)XXX_Eng_P_V2.210.0001.0.R.20130517.bin ................................................ http://tinyurl.com/nekapn3

General_IPC-HX3(2)XXX_Eng_NP_V2.210.0001.0.R.20130517.bin ............................................. http://tinyurl.com/p59ym6z

General_IPC-HX3(2)XXX_Eng_P_V2.211.0000.0.R.20130726.bin ................................................ http://tinyurl.com/my54r9z

General_IPC-HX3(2)XXX_Eng_N_V2.212.0000.0.R.20131206.bin ............................................... http://tinyurl.com/lrvtm2z

General_IPC-HX3(2)XXX_Eng_P_V2.212.0000.0.R.20131206.bin ................................................ http://tinyurl.com/n9rv23n

General_IPC-HX3(2)XXX_Eng_N_V2.212.0001.0.R.20131224.bin ............................................... http://tinyurl.com/l5kg2d9

General_IPC-HX3(2)XXX_Eng_P_V2.212.0001.0.R.20131224.bin ................................................ http://tinyurl.com/q6c2gox

DH_IPC-HX3(2)XXX_Eng_NP_8M_V2.212.0000.4.R.20140307.bin ............................................... http://tinyurl.com/mnzx33h

DH_IPC-HX3(2)XXX_Eng_NP_8M_V2.212.0000.5.R.20140326.bin ............................................... http://tinyurl.com/ke285w5

DH_IPC-HX3(2)XXX_Eng_NP_8M_V2.212.0000.6.R.20140419.bin ............................................... http://tinyurl.com/mllzcox

General_IPC-HX3(2)XXX_Eng_P_V2.420.0000.0.R.20140414.bin ................................................ http://tinyurl.com/nftaogy

DH_IPC-HX3(2)XXX_Eng_N_V2.420.0000.0.R.20140414.bin .................................................... http://tinyurl.com/ma5q64d

 

 

General_IPC-HX5(4)XXX_Eng_P_V2.210.0000.2.R.20130821.bin ................................................. http://tinyurl.com/pdcdmdk

General_IPC-HX5(4)XXX_Eng_N_V2.210.0000.4.R.20130911.bin ........................................................ http://tinyurl.com/pdoxjzj

General_IPC-HX5(4)XXX_Eng_P_V2.210.0000.9.R.20131217.bin ........................................................ http://tinyurl.com/p3g4t54

General_IPC-HX5(4)XXX_Eng_N_V2.210.0000.10.R.20140111.bin ...................................................... http://tinyurl.com/mnjpd79

General_IPC-HX5(4)XXX_Eng_P_V2.210.0000.12.R.20140225.bin ...................................................... http://tinyurl.com/nssnph6

DH_IPC-HX5(4)XXX_Eng_NP_V2.210.0000.12.R.20140225.bin ..................................................... http://tinyurl.com/lcjr8xv

DH_IPC-HX5(4)XXX_Eng_NP_V2.210.0000.16.R.20140421.bin ..................................................... http://tinyurl.com/k67gu9u

DH_IPC-HX5(4)XXX_Eng_NP_V2.210.0000.18.R.20140429.bin .................................................... http://tinyurl.com/n779scx

General_IPC-HX5(4)XXX_Eng_N_V2.210.0000.21.R.20140613.bin ...................................................... http://tinyurl.com/qd2thhe

General_IPC-HX5(4)XXX_Eng_P_V2.210.0000.21.R.20140613.bin ...................................................... http://tinyurl.com/p8q75b4

General_IPC-HX5(4)XXX_Eng_N_V2.400.0000.0.R.20131231.bin ........................................................ http://tinyurl.com/kmd7hu9

DH_IPC-HX5(4)XXX_Eng_N_Stream3_V2.420.0000.0.R.20140419.bin .................................................. http://tinyurl.com/mb75g2n

DH_IPC-HX5(4)XXX_Eng_P_Stream3_V2.420.0002.0.R.20140621.bin ............................................ http://tinyurl.com/laj29k5

General_IPC-HX5(4)XXX_Eng_N_Stream3_V2.420.0000.0.R.20140419.bin ......................................... http://tinyurl.com/mzw85fz

General_IPC-HX5(4)XXX_Eng_P_Stream3_V2.420.0000.0.R.20140419.bin ......................................... http://tinyurl.com/ov6krph

General_IPC-HX5(4)XXX_Eng_P_Stream3_P2P_V2.420.0000.0.R.20140419.bin ................................. http://tinyurl.com/oxgblkq

General_IPC-HX5(4)XXX_Eng_N_Stream3_V2.420.0002.0.R.20140621.bin ......................................... http://tinyurl.com/kejg3fv

General_IPC-HX5(4)XXX_Eng_P_Stream3_V2.420.0002.0.R.20140621.bin ......................................... http://tinyurl.com/pfmevdu

General_IPC-HX5(4)XXX_Eng_N_Stream3_V2.420.0003.0.R.20140930.bin ............................................... http://tinyurl.com/kchslos

General_IPC-HX5(4)XXX_Eng_N_V2.420.0003.0.R.20140930.bin ........................................................ http://tinyurl.com/ok4f8fx

General_IPC-HX5(4)XXX_Eng_N_Stream3_V2.420.0005.0.R.20141205.bin .............................................. http://tinyurl.com/qbrfg3k

General_IPC-HX5(4)XXX_Eng_P_Stream3_V2.420.0005.0.R.20141205.bin ......................................... http://tinyurl.com/ot99vgw

 

 

DH_IPC-HX8XXX_Eng_NP_V2.400.0000.2.R.20140506.bin .......................................................... http://tinyurl.com/lbar98x

 

 

 

I will also post the bare metal img files when I get some time which contain the firmware and all the img files including the update.img that can be used for serial recovery.

 

 

 

 

 

 

 

I have just started the process of uploading firmware... There are much more to come as well as many more camera models.

Also if you have any you want to share please PM me what you have and where I can link them to this

Thanks to Euly for sharing firmware files!

Dear  sir  can  you tell me your contact I need to ask your some dahua fimware modify problem   my  contact it is  zhudeping2011@vip.163.com

___________________________________

 

IMPORTANT NOTE FOR IPC-HFW4300S-V2 CAMERAS

 

The new camera appears to have differences (a few that I already found) that makes some of the general firmware incompatible with them. I have found a workaround, but it is complex. I will try to summarize it in a separate thread in the following weeks. I will also repackage the newest firmware files in versions that will work for the V2 cameras. Stay tuned! In the meantime, you can use General_IPC-HX5(4)XXX_Eng_N_V2.210.0000.21.R.20140613.bin or the PAL equivalent to recover your camera.

 

 

Well, that's all I have time to share for now, but I'll do my best to put together a comprehensive guide to the inner workings of these cameras and a guide to unbrick in any failed software situation.

 

Thanks and take care.

 

Rob

 

Share this post


Link to post
Share on other sites

Hi,

I am not sure if I missed it. But does anybody know what's the process for flashing via TFTP?

I bought a DH-IPC-HDW4631C-A labeled IP cam. It did work, but I thought a firmware upgrade would be nice. I downloaded from Dahua and installed via web interface. Name of the bin was: "DH_IPC-HX5X3X-Rhea_Eng_P_Stream3_V2.622.0000000.18.R.20171110.bin"
I can't reach the cam via web interface, nor ssh or telnet. I can ping it with my old IP address, but just sometimes. When I give power to the cam it boots and after a couple of seconds I can ping it for maybe 1 minute. After that its gone. But I can repeat this process by unplugging it and plug it back in.

I hoped it would load a new firmware in this state via tftp. But I didn't find the post where it is explained how. I'd also need suggestions on what firmware I should install now, after the one from the Dahua website didn't work, obviously. Does it make a difference if I install PAL or NTSC? I am from Europe, so I thought PAL makes sense. But I realy don't know why there is this difference in the firmware and if there are hardware related dependencies or if its more by choice. 

Would be really happy if someone can help. Thanks.

Share this post


Link to post
Share on other sites

Hello,

 

About 4 month ago I bought a IPC-HDW4631C-A From amazon, great cam and worked perfect until yesterday.... Im connected to a managed  sg300 Cisco switch, and I can see that cam is getting power, but interface it self is never going up, not even for few seconds initially. I tried to switch the port, change jump cables(havent taken the camera yet near the switch). Any thoughts what might be going on?

Share this post


Link to post
Share on other sites

Greetings

Im trying the TFTP Method in another post, look for serial Pins and soldered some cables, conected to my USB TTL and its working, but i cant find the correct firmware for mi IPC-HFW1200S.

Looking the PRINTENV, see this:
 

HWID=IPC-HFW2200S-W (then lots of numbers, like octects of hardware)


And then

devalias=IPC-HFW1200S-W



So, i think the hardware is a HFW2200S-W but with a WiFi Module, clasic from china stuff, but i cant find that firmware too, so, i cant restore this device.

I have a Firmware who claims its for 1200S-W but does not have the uImage file, so 

Can i use another uImage file?

Thanks in advance

Share this post


Link to post
Share on other sites

I didn't see it listed (unless I missed it) but how can you pull off or backup the firmware currently loaded on the cameras? Thanks

Share this post


Link to post
Share on other sites

Google search engine brings me here when I try to unbrick my AMCREST IP camera IP2M-841B after I learnt the camera is actual from Dahua.  What a fruitive forum! I found so many knowledges, tips...

This 5 years ago thread about unbricking Dahua IP camera also gives many helps, but finally I guess I will need this unfinished part to guide me how to unbrick.

Quote

UNBRICK WITH UBOOT via SERIAL

 

NOTE: This section is coming soon... I'm gathering all the images I need for various camera types

Situation: 

1. Following the instruction by using TFTP to flash latest official seems ok, but uboot stopped at "Starting kernel ... "

in this phase, I can see uboot startuo loop, no PING response, no port listening; 

2. After several times reboot loop, it seems to be in recovery (?) mode; 

  • ping response is stable;
  • only 3800 port is listening;
  • No telnet port;
  • sometimes I can find it by amcrest/dahua config tool via port 3800, but not able to upgrade it. 

Here is my COM port output:

=~=~=~=~=~=~=~=~=~=~=~= MobaXterm log 2021.01.30 20:25:21 =~=~=~=~=~=~=~=~=~=~=~=


U-Boot 2010.06-svn4559 (May 27 2017 - 14:14:01)
I2C:   ready
DRAM:  110 MiB
gBootLogPtr:00b80008.
spinor flash ID is 0xc81840c8
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=110M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc.
gParameter[1]:node=sdupdate, parameter=gpio=33 offset=0 ledtype=state.
TEXT_BASE:01000000
Net:   Detected MACID:3c:ef:8c:60:f8:f7
PHY:0x001cc816,addr:0x00
phy RTL8201 init

gpio:33, offset:0x0, ledtype:state
MMC:   sdmmc init
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'upgrade_info_7db780a713a4.txt'.
Download to address: 0x5000000
Downloading: *#
done
Bytes transferred = 277 (115 hex)
bootdelay=3
baudrate=115200
ipaddr=192.168.1.108
serverip=192.168.1.1
autoload=yes
gatewayip=192.168.1.1
netmask=255.255.255.0
dh_keyboard=1
appauto=1
sysbackup=1
logserver=127.0.0.1
loglevel=4 
autosip=192.168.254.254
autolip=192.168.1.108
autogw=192.168.1.1
autonm=255.255.255.0
ethact=ambarella mac
BSN=1M0364BPAU02834
wifiaddr=3C:EF:8C:68:9D:83
HWID=IPC-AW25W-V2-Amcrest:01:02:08:33:18:00:01:06:01:01:04:258:03:02:00:00:00:00:00:00:100
hwidEx=04:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00
devalias=IP2M-841B
da=tftp 0x2000000 dhboot.bin.img; flwrite; tftp dhboot-min.bin.img;flwrite
dr=tftp 0x2000000 romfs-x.squashfs.img; flwrite
dk=tftp 0x2000000 kernel.img; flwrite
du=tftp 0x2000000 user-x.squashfs.img; flwrite
dw=tftp 0x2000000 web-x.squashfs.img; flwrite
dc=tftp 0x2000000 custom-x.squashfs.img; flwrite
dt=tftp 0x2000000 data-x.squashfs.img; flwrite
dp=tftp 0x02000000 partition-x.cramfs.img;flwrite
up=tftp 0x2000000 update.img; flwrite
tk=tftp 0x200100 hawthorn.dts.dtb;tftp 0x2000000 uImage;bootm 0x2000000
bootcmd=sf read 0x200100 0x8000 0x8000;sf read 0x2000000 0xf0000 0x180000;bootm 0x2000000
bootargs=console=ttyS0,115200 mem=110M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc
ID=AMC000R6510455T3J8
ethaddr=3C:EF:8C:60:F8:F7
stdin=serial
stdout=serial
stderr=serial
filesize=115
fileaddr=5000000

Environment size: 1326/131068 bytes
            name    cs   offset             size               flag   fs_flags      fs_type
         MinBoot    0 0x0000000000000000 0x0000000000040000 0x00000000 0x00000000 0x00000000
          U-Boot    0 0x0000000000080000 0x0000000000040000 0x00000000 0x00000000 0x00000000
            hwid    0 0x00000000000c0000 0x0000000000020000 0x00000000 0x00000000 0x00000000
       partition    0 0x00000000000e0000 0x0000000000010000 0x00000000 0x00000001 0x00000001
          Kernel    0 0x00000000000f0000 0x0000000000180000 0x00000000 0x00000000 0x00000000
           romfs    0 0x0000000000270000 0x0000000000150000 0x00000000 0x00000001 0x00000002
             web    0 0x00000000003c0000 0x0000000000240000 0x00000000 0x00000001 0x00000002
            user    0 0x0000000000600000 0x0000000000800000 0x00000000 0x00000001 0x00000002
      updateflag    0 0x0000000000e00000 0x0000000000030000 0x00000000 0x00000000 0x00000000
          config    0 0x0000000000e30000 0x0000000000070000 0x00000000 0x00000003 0x00000004
         product    0 0x0000000000ea0000 0x0000000000010000 0x00000000 0x00000001 0x00000002
          custom    0 0x0000000000eb0000 0x0000000000020000 0x00000000 0x00000001 0x00000002
       backupker    0 0x0000000000ed0000 0x00000000000e0000 0x00000000 0x00000001 0x00000002
        backupfs    0 0x0000000000fb0000 0x0000000000050000 0x00000000 0x00000001 0x00000002
         MinBoot mountcmd:
          U-Boot mountcmd:
            hwid mountcmd:
       partition mountcmd:
          Kernel mountcmd:
           romfs mountcmd:
             web mountcmd:mount /dev/mtdblock6 /mnt/web/
            user mountcmd:mount /dev/mtdblock7 /usr/
      updateflag mountcmd:
          config mountcmd:mnt_jffs2 /dev/mtdblock9 /mnt/mtd jffs2
         product mountcmd:mount /dev/mtdblock10 /mnt/pd/
          custom mountcmd:mount /dev/mtdblock11 /mnt/custom/
       backupker mountcmd:
        backupfs mountcmd:
HUSH_VERSION=0.01
usage: fatinfo <interface> <dev[:part]>
Base Address: 0x00000000
SPI probe: 16384 KiB GD25Q128C at 0:0 is now current device
### filesystem type is JFFS2
Scanning JFFS2 FS:    done.

Compression: NONE
frag count: 0
compressed sum: 0
uncompressed sum: 0
Compression: ZERO
frag count: 0
compressed sum: 0
uncompressed sum: 0
Compression: RTIME
frag count: 0
compressed sum: 0
uncompressed sum: 0
Compression: RUBINMIPS
frag count: 0
compressed sum: 0
uncompressed sum: 0
Compression: COPY
frag count: 0
compressed sum: 0
uncompressed sum: 0
Compression: DYNRUBIN
frag count: 0
compressed sum: 0
uncompressed sum: 0
Compression: ZLIB
frag count: 0
compressed sum: 0
uncompressed sum: 0
?       - alias for 'help'
backup  - backup- manual backup program.

base    - print or set address offset
bdinfo  - print Board Info structure
boot    - boot default, i.e., run 'bootcmd'
bootd   - boot default, i.e., run 'bootcmd'
bootf   - boot from flash
bootm   - boot application image from memory
bootp   - boot image via network using BOOTP/TFTP protocol
cfgRestore- erase  config and backup partition.

cmp     - memory compare
coninfo - print console devices and information
cp      - memory copy
crc32   - checksum calculation
dcache  - enable or disable data cache
dhcp    - boot image via network using DHCP/TFTP protocol
echo    - echo args to console
editenv - edit environment variable
erasepart- erasepart

exit    - exit script
false   - do nothing, unsuccessfully
fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls   - list files in a directory (default /)
fdt     - flattened device tree utility commands
flwrite - flwrite - write data into FLASH memory

fsinfo  - print information about filesystems
fsload  - load binary file from a filesystem image
go      - start application at address 'addr'
gpio    - gpio test
help    - print command description/usage
hwid    - hwid      - set hardware id and save to flash

i2c     - I2C sub-system
icache  - enable or disable instruction cache
iminfo  - print header information for application image
itest   - return true/false on integer compare
kload   - kload  - load uImage file from parttion

lip     - lip      - set local ip address but not save to flash

loadb   - load binary file over serial line (kermit mode)
loads   - load S-Record file over serial line
loady   - load binary file over serial line (ymodem mode)
logsend - get log buf
loop    - infinite loop on address range
ls      - list files in a directory (default /)
mac     - mac      - set mac address and save to flash

mcu     - mcu sub-system
md      - memory display
memsize - memsize- set mem size

mii     - MII utility commands
mm      - memory modify (auto-incrementing address)
mmc     - MMC sub system
mmcinfo - mmcinfo <dev num>-- display MMC info
mtest   - simple RAM read/write test
mw      - memory write (fill)
nfs     - boot image via network using NFS protocol
nm      - memory modify (constant address)
partition- print partition information
ping    - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
rarpboot- boot image via network using RARP/TFTP protocol
rdefault- rdefault-recover default env

reset   - Perform RESET of the CPU
run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv  - set environment variables
sf      - SPI flash sub-system
showvar - print local hushshell variables
sip     - sip      - set server ip address but not save to flash

sleep   - delay execution for some time
source  - run script from memory
sync_uboot- sync_uboot - sync uboot to uboot-bak

test    - minimal test like /bin/sh
tftpboot- tftpboot- boot image via network using TFTP protocol
true    - do nothing, successfully
usleep  - delay execution for some time
version - print monitor version
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'dhboot.bin.img'.
Download to address: 0x2000000
Downloading: *###################################################
done
Bytes transferred = 260160 (3f840 hex)
same boot, quit upgrade!current version=U-Boot 2010.06-svn4559, upgrade svn_version=4559, current time=14:14:01, upgrade timestamp=14:14:01
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'dhboot-min.bin.img'.
Download to address: 0x2000000
Downloading: *##########################
done
Bytes transferred = 131136 (20040 hex)
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'romfs-x.squashfs.img'.
Download to address: 0x2000000
Downloading: *#################################################################
 #################################################################
 #################################################################
 #########################################################
done
Bytes transferred = 1286208 (13a040 hex)

## Checking Image at 02000000 ...
   Legacy image found
   Image Name:   romfs
   Created:      2020-02-17  11:20:10 UTC
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    1286144 Bytes = 1.2 MiB
   Load Address: 00270000
   Entry Point:  003c0000
   Verifying Checksum ... OK
Programing start at: 0x00270000

write : 0%
write : 0%
write : 5%
write : 10%
write : 15%
write : 20%
write : 25%
write : 30%
write : 35%
write : 40%
write : 45%
write : 50%
write : 55%
write : 60%
write : 65%
write : 70%
write : 75%
write : 80%
write : 85%
write : 90%
write : 95%
write : 100%
done
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'kernel.img'.
Download to address: 0x2000000
Downloading: *#################################################################
 #################################################################
 #################################################################
 #################################################################
 #############################################
done
Bytes transferred = 1558880 (17c960 hex)

## Checking Image at 02000000 ...
   Legacy image found
   Image Name:   kernel
   Created:      2020-02-17  11:20:04 UTC
   Image Type:   ARM Linux Firmware (uncompressed)
   Data Size:    1558816 Bytes = 1.5 MiB
   Load Address: 000f0000
   Entry Point:  00270000
   Verifying Checksum ... OK
Programing start at: 0x000f0000

write : 0%
write : 0%
write : 4%
write : 8%
write : 12%
write : 16%
write : 20%
write : 25%
write : 29%
write : 33%
write : 37%
write : 41%
write : 45%
write : 50%
write : 54%
write : 58%
write : 62%
write : 66%
write : 70%
write : 75%
write : 79%
write : 83%
write : 87%
write : 91%
write : 95%
write : 100%
done
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'user-x.squashfs.img'.
Download to address: 0x2000000
Downloading: *#################################################################
 #################################################################
 #################################################################
 #################################################################
 #################################################################
 #################################################################
 #################################################################
 #################################################################
 #################################################################
 #################################################################
 #################################################################
 #################################################################
 #################################################################
 #################################################################
 #################################################################
 #################################################################
 #################################################################
 #################################################################
 #################################################################
 #################################################################
 #################################################################
 #################################################################
 #################################################################
 #################################################################
 #################################################################
 #########
done
Bytes transferred = 8364096 (7fa040 hex)

## Checking Image at 02000000 ...
   Legacy image found
   Image Name:   user
   Created:      2020-02-17  11:20:20 UTC
   Image Type:   ARM Linux Standalone Program (uncompressed)
   Data Size:    8364032 Bytes = 8 MiB
   Load Address: 00600000
   Entry Point:  00e00000
   Verifying Checksum ... OK
Programing start at: 0x00600000

write : 0%
write : 0%
write : 0%
write : 1%
write : 2%
write : 3%
write : 3%
write : 4%
write : 5%
write : 6%
write : 7%
write : 7%
write : 8%
write : 9%
write : 10%
write : 10%
write : 11%
write : 12%
write : 13%
write : 14%
write : 14%
write : 15%
write : 16%
write : 17%
write : 17%
write : 18%
write : 19%
write : 20%
write : 21%
write : 21%
write : 22%
write : 23%
write : 24%
write : 25%
write : 25%
write : 26%
write : 27%
write : 28%
write : 28%
write : 29%
write : 30%
write : 31%
write : 32%
write : 32%
write : 33%
write : 34%
write : 35%
write : 35%
write : 36%
write : 37%
write : 38%
write : 39%
write : 39%
write : 40%
write : 41%
write : 42%
write : 42%
write : 43%
write : 44%
write : 45%
write : 46%
write : 46%
write : 47%
write : 48%
write : 49%
write : 50%
write : 50%
write : 51%
write : 52%
write : 53%
write : 53%
write : 54%
write : 55%
write : 56%
write : 57%
write : 57%
write : 58%
write : 59%
write : 60%
write : 60%
write : 61%
write : 62%
write : 63%
write : 64%
write : 64%
write : 65%
write : 66%
write : 67%
write : 67%
write : 68%
write : 69%
write : 70%
write : 71%
write : 71%
write : 72%
write : 73%
write : 74%
write : 75%
write : 75%
write : 76%
write : 77%
write : 78%
write : 78%
write : 79%
write : 80%
write : 81%
write : 82%
write : 82%
write : 83%
write : 84%
write : 85%
write : 85%
write : 86%
write : 87%
write : 88%
write : 89%
write : 89%
write : 90%
write : 91%
write : 92%
write : 92%
write : 93%
write : 94%
write : 95%
write : 96%
write : 96%
write : 97%
write : 98%
write : 99%
write : 100%
done
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'web-x.squashfs.img'.
Download to address: 0x2000000
Downloading: *#################################################################
 #################################################################
 #################################################################
 #################################################################
 #################################################################
 #######################################
done
Bytes transferred = 1859648 (1c6040 hex)

## Checking Image at 02000000 ...
   Legacy image found
   Image Name:   web
   Created:      2020-02-17  11:20:12 UTC
   Image Type:   ARM Linux Standalone Program (uncompressed)
   Data Size:    1859584 Bytes = 1.8 MiB
   Load Address: 003c0000
   Entry Point:  00600000
   Verifying Checksum ... OK
Programing start at: 0x003c0000

write : 0%
write : 0%
write : 3%
write : 6%
write : 10%
write : 13%
write : 17%
write : 20%
write : 24%
write : 27%
write : 31%
write : 34%
write : 37%
write : 41%
write : 44%
write : 48%
write : 51%
write : 55%
write : 58%
write : 62%
write : 65%
write : 68%
write : 72%
write : 75%
write : 79%
write : 82%
write : 86%
write : 89%
write : 93%
write : 96%
write : 100%
done
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'partition-x.cramfs.img'.
Download to address: 0x2000000
Downloading: *#
done
Bytes transferred = 4160 (1040 hex)

## Checking Image at 02000000 ...
   Legacy image found
   Image Name:   partition
   Created:      2020-02-17  11:20:04 UTC
   Image Type:   ARM Linux Standalone Program (uncompressed)
   Data Size:    4096 Bytes = 4 KiB
   Load Address: 000e0000
   Entry Point:  000f0000
   Verifying Checksum ... OK
Programing start at: 0x000e0000

write : 0%
write : 0%
write : 100%
done
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'custom-x.squashfs.img'.
Download to address: 0x2000000
Downloading: *##############
done
Bytes transferred = 69696 (11040 hex)

## Checking Image at 02000000 ...
   Legacy image found
   Image Name:   custom
   Created:      2020-02-17  11:20:22 UTC
   Image Type:   ARM Linux Standalone Program (uncompressed)
   Data Size:    69632 Bytes = 68 KiB
   Load Address: 00eb0000
   Entry Point:  00ed0000
   Verifying Checksum ... OK
Programing start at: 0x00eb0000

write : 0%
write : 0%
write : 50%
write : 100%
done
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'pd-x.squashfs.img'.
Download to address: 0x2000000
Downloading: *#####
done
Bytes transferred = 20544 (5040 hex)

## Checking Image at 02000000 ...
   Legacy image found
   Image Name:   pd
   Created:      2020-02-17  11:20:21 UTC
   Image Type:   ARM Linux Standalone Program (uncompressed)
   Data Size:    20480 Bytes = 20 KiB
   Load Address: 00ea0000
   Entry Point:  00eb0000
   Verifying Checksum ... OK
Programing start at: 0x00ea0000

write : 0%
write : 0%
write : 100%
done
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename '.FLASHING_DONE_STOP_TFTP_NOW'.
Download to address: 0x2000000
Downloading: *#
done
config erased.
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'success.txt'.
Download to address: 0x2000000
Downloading: *
TFTP error: (512)Erasing SPI flash...
Writing to SPI flash...
done
Support backupVer:255
state:ff,err_count:01
## Booting kernel from Legacy Image at 02000000 ...
   Image Name:   Linux-3.10.50
   Created:      2017-06-06   8:17:43 UTC
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    1558752 Bytes = 1.5 MiB
   Load Address: 00208000
   Entry Point:  00208000
   Verifying Checksum ... OK
   Loading Kernel Image ...OK
OK
partition file version 2
rootfstype squashfs root /dev/mtdblock5
fail to load bootargsParameters.txt
fail to load bootargsParameters.txt file

Starting kernel ... 
crashflasg:1, logmagic:54410011.


U-Boot 2010.06-svn4559 (May 27 2017 - 14:14:01)
I2C:   ready
DRAM:  110 MiB
gBootLogPtr:00b80008.
spinor flash ID is 0xc81840c8
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=110M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc.
gParameter[1]:node=sdupdate, parameter=gpio=33 offset=0 ledtype=state.
TEXT_BASE:01000000
Net:   Detected MACID:3c:ef:8c:60:f8:f7
PHY:0x001cc816,addr:0x00
phy RTL8201 init

gpio:33, offset:0x0, ledtype:state
MMC:   sdmmc init
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'upgrade_info_7db780a713a4.txt'.
Download to address: 0x5000000
Downloading: *
Retry count exceeded; starting again
Try again use backup_serverip
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'upgrade_info_7db780a713a4.txt'.
Download to address: 0x5000000
Downloading: *
Retry count exceeded; starting again
string value is 0
AUF_getValidLine, the end of file
Failed to get a Line;Crc check error!
PreProcess data error!
Init error!
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'failed.txt'.
Download to address: 0x2000000
Downloading: *
Retry count exceeded; starting again
Support backupVer:255
state:ff,err_count:02
SPI probe: 16384 KiB GD25Q128C at 0:0 is now current device
## Booting kernel from Legacy Image at 02000000 ...
   Image Name:   Linux-3.10.50
   Created:      2017-06-06   8:17:43 UTC
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    1558752 Bytes = 1.5 MiB
   Load Address: 00208000
   Entry Point:  00208000
   Verifying Checksum ... OK
   Loading Kernel Image ...OK
OK
partition file version 2
rootfstype squashfs root /dev/mtdblock5
fail to load bootargsParameters.txt
fail to load bootargsParameters.txt file

Starting kernel ... 


U-Boot 2010.06-svn4559 (May 27 2017 - 14:14:01)
I2C:   ready
DRAM:  110 MiB
gBootLogPtr:00b80008.
spinor flash ID is 0xc81840c8
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=110M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc.
gParameter[1]:node=sdupdate, parameter=gpio=33 offset=0 ledtype=state.
TEXT_BASE:01000000
Net:   Detected MACID:3c:ef:8c:60:f8:f7
PHY:0x001cc816,addr:0x00
phy RTL8201 init

gpio:33, offset:0x0, ledtype:state
MMC:   sdmmc init
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'upgrade_info_7db780a713a4.txt'.
Download to address: 0x5000000
Downloading: *
Retry count exceeded; starting again
Try again use backup_serverip
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'upgrade_info_7db780a713a4.txt'.
Download to address: 0x5000000
Downloading: *
Retry count exceeded; starting again
string value is 0
AUF_getValidLine, the end of file
Failed to get a Line;Crc check error!
PreProcess data error!
Init error!
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'failed.txt'.
Download to address: 0x2000000
Downloading: *
Retry count exceeded; starting again
Support backupVer:255
state:ff,err_count:03
SPI probe: 16384 KiB GD25Q128C at 0:0 is now current device
## Booting kernel from Legacy Image at 02000000 ...
   Image Name:   Linux-3.10.50
   Created:      2017-06-06   8:17:43 UTC
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    1558752 Bytes = 1.5 MiB
   Load Address: 00208000
   Entry Point:  00208000
   Verifying Checksum ... OK
   Loading Kernel Image ...OK
OK
partition file version 2
rootfstype squashfs root /dev/mtdblock5
fail to load bootargsParameters.txt
fail to load bootargsParameters.txt file

Starting kernel ... 


U-Boot 2010.06-svn4559 (May 27 2017 - 14:14:01)
I2C:   ready
DRAM:  110 MiB
gBootLogPtr:00b80008.
spinor flash ID is 0xc81840c8
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=110M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc.
gParameter[1]:node=sdupdate, parameter=gpio=33 offset=0 ledtype=state.
TEXT_BASE:01000000
Net:   Detected MACID:3c:ef:8c:60:f8:f7
PHY:0x001cc816,addr:0x00
phy RTL8201 init

gpio:33, offset:0x0, ledtype:state
MMC:   sdmmc init
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'upgrade_info_7db780a713a4.txt'.
Download to address: 0x5000000
Downloading: *
Retry count exceeded; starting again
Try again use backup_serverip
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'upgrade_info_7db780a713a4.txt'.
Download to address: 0x5000000
Downloading: *
Retry count exceeded; starting again
string value is 0
AUF_getValidLine, the end of file
Failed to get a Line;Crc check error!
PreProcess data error!
Init error!
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'failed.txt'.
Download to address: 0x2000000
Downloading: *
Retry count exceeded; starting again
Support backupVer:255
state:ff,err_count:04
SPI probe: 16384 KiB GD25Q128C at 0:0 is now current device
## Booting kernel from Legacy Image at 02000000 ...
   Image Name:   Linux-3.10.50
   Created:      2017-06-06   8:17:43 UTC
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    1558752 Bytes = 1.5 MiB
   Load Address: 00208000
   Entry Point:  00208000
   Verifying Checksum ... OK
   Loading Kernel Image ...OK
OK
partition file version 2
rootfstype squashfs root /dev/mtdblock5
fail to load bootargsParameters.txt
fail to load bootargsParameters.txt file

Starting kernel ... 


U-Boot 2010.06-svn4559 (May 27 2017 - 14:14:01)
I2C:   ready
DRAM:  110 MiB
gBootLogPtr:00b80008.
spinor flash ID is 0xc81840c8
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=110M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc.
gParameter[1]:node=sdupdate, parameter=gpio=33 offset=0 ledtype=state.
TEXT_BASE:01000000
Net:   Detected MACID:3c:ef:8c:60:f8:f7
PHY:0x001cc816,addr:0x00
phy RTL8201 init

gpio:33, offset:0x0, ledtype:state
MMC:   sdmmc init
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'upgrade_info_7db780a713a4.txt'.
Download to address: 0x5000000
Downloading: *
Retry count exceeded; starting again
Try again use backup_serverip
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'upgrade_info_7db780a713a4.txt'.
Download to address: 0x5000000
Downloading: *
Retry count exceeded; starting again
string value is 0
AUF_getValidLine, the end of file
Failed to get a Line;Crc check error!
PreProcess data error!
Init error!
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'failed.txt'.
Download to address: 0x2000000
Downloading: *
Retry count exceeded; starting again
Support backupVer:255
state:ff,err_count:05
SPI probe: 16384 KiB GD25Q128C at 0:0 is now current device
## Booting kernel from Legacy Image at 02000000 ...
   Image Name:   Linux-3.10.50
   Created:      2014-12-15   5:29:43 UTC
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    888128 Bytes = 867.3 KiB
   Load Address: 00208000
   Entry Point:  00208000
   Verifying Checksum ... OK
   Loading Kernel Image ...OK
OK
partition file version 2
rootfstype squashfs root /dev/mtdblock5
fail to load bootargsParameters.txt
fail to load bootargsParameters.txt file
get bootargs info failed

Starting kernel ... 

init started: BusyBox v1.18.4 (2014-12-01 15:02:35 CST)
mount: mounting none on /proc/bus/usb failed: No such file or directory
mount: mounting tmpfs on /var failed: Invalid argument
mount: mounting /dev/mtdblock3 on /mnt/custom failed: Invalid argument
mount: mounting /dev/mtdblock4 on /mnt/pd failed: Invalid argument
mount: mounting /dev/mtdblock8 on /mnt/afix/autoFix failed: Invalid argument
mount: mounting /dev/mtdblock9 on /mnt/afix/autoFixBackup failed: Invalid argument


BusyBox v1.18.4 (2014-12-01 15:02:35 CST) built-in shell (ash)
Revision: 7312
Enter 'help' for a list of built-in commands.

/bin/sh: can't access tty; job control turned off
~ # UPGRADED_MSG: Do memlock
[libpdi] Support backup partition !!!
[libpdi]  Flashtype = 3,patSize = 40000,rwSize = 10000,ersSize = 10000 
pPartionId = 9
eth0:
MAC: <3c:ef:8c:60:f8:f7>
[libpdi] ERROR  (save_Attr_file|1269): open failed for PRIO[libpdi] ERROR  (save_Attr_file|1269): open failed for PRIO[libpdi] set eth0 as defaultEth
IP: <192.168.1.108>netmask: <255.255.255.0>
[libpdi] ERROR  (save_Attr_file|1269): open failed for HOSTIP[libpdi] ERROR  (PDI_rtcWriteSram|162): Fail to ioctl rtc
[libpdi] ERROR  (SaveEthAttrInFile|1368): Fail to write ip paramenters
[libpdi] ERROR  (save_Attr_file|1269): open failed for SUBMASK[libpdi] ERROR  (PDI_rtcWriteSram|162): Fail to ioctl rtc
[libpdi] ERROR  (SaveEthAttrInFile|1368): Fail to write ip paramenters
SOCK_PACKET: Address family not supported by protocol
[libpdi] [libPDI] Gateway: <192.168.1.1>
[libpdi] SetGateWay success
[libpdi] ERROR  (save_Attr_file|1269): open failed for GATEWAYIP[libpdi] ERROR  (PDI_rtcWriteSram|162): Fail to ioctl rtc
[libpdi] ERROR  (SaveEthAttrInFile|1368): Fail to write ip paramenters
SOCK_PACKET: Address family not supported by protocol
[libpdi] [libPDI] Name: upgraded, bulid date: Dec  1 2014 14:47:00, svn: 444
UPGRADED_MSG: start download file!

~ # ps
ps: applet not found
~ # help
Built-in commands:
------------------
. : alias bg break cd chdir continue eval exec exit export false
fg hash help jobs kill let local pwd read readonly return set
shift source times trap true type ulimit umask unalias unset
wait

~ # help -?
Built-in commands:
------------------
. : alias bg break cd chdir continue eval exec exit export false
fg hash help jobs kill let local pwd read readonly return set
shift source times trap true type ulimit umask unalias unset
wait

~ # mount
rootfs on / type rootfs (rw)
/dev/root on / type squashfs (ro,relatime)
devtmpfs on /dev type devtmpfs (rw,relatime,mode=0755)
proc on /proc type proc (rw,relatime)
sysfs on /sys type sysfs (rw,relatime)
devpts on /dev/pts type devpts (rw,relatime,mode=600)
/dev/mtdblock7 on /mnt/web type squashfs (ro,relatime)
/dev/mtdblock9 on /mnt/mtd type jffs2 (rw,relatime)
~ # 

Any idea how can I fix it? 

 

 

 

 

 

Share this post


Link to post
Share on other sites

Well well. First update-bricked Dahua so far I have seen. From a client who tried to update his DH-SD6CE445XA-HNR.

Update process went normally, progress bar reached the end, but after that no response from the camera.

So far tried

1) configtool. Does not find camera.

2) after 30mins from the update, power on-off by disconnecting the poe-cable

3) reset switch. No response at all.

4) appears that with Wireshark I can see cameras MAC is sending broadcast message to tell 192.168.1.108 who has 192.168.1.1.

5) port scan for 192.168.1.108 nor cameras pre-update ip-address does not find open ports.

 

 

Share this post


Link to post
Share on other sites

Hello guys, I bricked my Aliexpress IPC-HDW4631C-A. I have two of those and both had different firmware. One of em works great but the other has issues with FTP so decided to upgrade but failed.

I can still ping my camera and can only access it via Putty over SSH. Is there still hope to repair it?

 

(See attached) 

Dahua SSH.png

Share this post


Link to post
Share on other sites

Hi First of all thank you for this great guide I think only guide that I have found which at-least give us a  chance to recover the cams. I recently bricked one of mine. It is constantly restarting as it cannot get to WEB GUI..

I was wondering if anyone here can guide me I do not know how to use putty.. I will Be searching for some video if someone have any .. I do see camera do show up on config tool or the latest config tool but not the one which was linked here.. However it is on constant restart loop for me.


Anyhow Thank you anyways for this wonderful guide.

Share this post


Link to post
Share on other sites
9 hours ago, edicctv said:

 

See you only bought your website on March 2nd 

and it’s a template for furniture 

 

you might of spammed too early 

Share this post


Link to post
Share on other sites

Hello @all i read here a lot and didnt found a soloution to my problem. I coundt get it to accapt any input at all.

It is a NVR from Videra/Alhua/Dahua NVD5416 4k2 it wont send anything else over the serial connection.

 

Would be great if anyone could help me. Thanks 

 

 

Screenshot 2022-04-22 223550.png

Share this post


Link to post
Share on other sites

first of all Thanks for answering

 

It wont boot anymore. Updated it from 3.62 to 4.0 and something went wrong. Not it just shows NVR on my Monitor over HDMI. ConfigTool doesnt show it anymore. And the serial output it not very helpfull for me at all. Pressing * changes nothig. 

I want to be able to reflash the software to it via TFTP but i cant get to this point.

 

Lable on the side says Videra NVR 5416IP-16 4K2

Share this post


Link to post
Share on other sites

Here are some additional Pictures of my NVR. The problem is that i cant enter anything after the hisilicon# ....  

IMG-20220423-WA0002.jpg

IMG-20220423-WA0001.jpg

IMG-20220423-WA0000.jpg

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

×