Helloo warriors. I have a problem with SD6C3425GB-HNR-A-PV1 PTZ camera. It was working for like one year and somehow it stopped working after the night. There was no electric shock, I wasn't updating firmware, weather condition was normal. It seems to be stuck in bootloop. It appears in config tool for a few seconds and dissappears, I can't log in using web interface, I can't initialize camera from config tool. CMD Ping works, but after about 4 minutes ping dissappears for like 10 seconds and comes back. I can hear camera "tick" every ~4 minutes, it seems to be rebooting. I tried to rewrite firmware using TFTP method with lan cable, it seems to be successful, but situation doesn't change, except I can see in config tool for one second that firmware changed. I was following this thread
ipcamtalk.com
. My commands were:
tftp CONFIG_SYS_DEFAULT_LOAD_ADDR dhdtb.bin.img; flwrite.
tftp CONFIG_SYS_DEFAULT_LOAD_ADDR dhboot-min.bin.img; flwrite.
tftp CONFIG_SYS_DEFAULT_LOAD_ADDR dhboot.bin.img; flwrite.
tftp CONFIG_SYS_DEFAULT_LOAD_ADDR pd-x.squashfs.img; flwrite.
tftp CONFIG_SYS_DEFAULT_LOAD_ADDR romfs-x.squashfs.img; flwrite.
tftp CONFIG_SYS_DEFAULT_LOAD_ADDR kernel.img; flwrite.
tftp CONFIG_SYS_DEFAULT_LOAD_ADDR firmware-x.ext4_aa.img; flwrite.
tftp CONFIG_SYS_DEFAULT_LOAD_ADDR firmware-x.ext4_ab.img; flwrite.
tftp CONFIG_SYS_DEFAULT_LOAD_ADDR firmware-x.ext4_ac.img; flwrite.
tftp CONFIG_SYS_DEFAULT_LOAD_ADDR web-x.squashfs.img; flwrite.
tftp CONFIG_SYS_DEFAULT_LOAD_ADDR .FLASHING_DONE_STOP_TFTP_NOW.
sleep 5
Every file seems to go successfully.
I have uart ttl adapter too and tried tftp install using uart, also sd card upgrade, every file seems to go well, I tried fw from dahua web Dahua Technology - World-leading Video-centric AIoT Solution and Service Provide
My printenv:
upTool#printenv
bootdelay=2
baudrate=115200
ipaddr=192.168.1.108
gatewayip=192.168.1.1
netmask=255.255.255.0
bootfile=uImage
wifiaddr=00:12:34:56:78:91
da=tftp CONFIG_SYS_DEFAULT_LOAD_ADDR dhboot.bin.img; flwrite;tftp dhboot-min.bin.img;flwrite
dr=tftp CONFIG_SYS_DEFAULT_LOAD_ADDR romfs-x.squashfs.img; flwrite
dk=tftp CONFIG_SYS_DEFAULT_LOAD_ADDR kernel.img; flwrite
du=tftp CONFIG_SYS_DEFAULT_LOAD_ADDR user-x.squashfs.img; flwrite
dw=tftp CONFIG_SYS_DEFAULT_LOAD_ADDR web-x.squashfs.img; flwrite
ds=tftp CONFIG_SYS_DEFAULT_LOAD_ADDR dsp-x.cramfs.img; flwrite
dp=tftp CONFIG_SYS_DEFAULT_LOAD_ADDR partition-x.cramfs.img;flwrite
dc=tftp CONFIG_SYS_DEFAULT_LOAD_ADDR custom-x.squashfs.img; flwrite
up=tftp CONFIG_SYS_DEFAULT_LOAD_ADDR update.img; flwrite
tk=tftp CONFIG_SYS_DEFAULT_LOAD_ADDR uImage; bootm
loglevel=4
autolip=192.168.1.108
autogw=192.168.1.1
autonm=255.255.255.0
backupsip=192.168.1.100
nfssip=192.168.1.109
dpd=tftp CONFIG_SYS_DEFAULT_LOAD_ADDR pd-x.squashfs.img; flwrite
dfw=tftp CONFIG_SYS_DEFAULT_LOAD_ADDR firmware-x.squashfs.img;flwrite
BSN=9F0E0B8PAQ00542
HWID=CA-HZ4025GB-B:01:03:04:78:56:00:01:10:01:03:04:3E8_3E8:04:00:00:04:00:01:00:00:400
peripheral=1:6631:0:0:0:1:0:00:1:21:001:128:0:00:0:1:8
devalias=DH-SD6C3425GB-HNR-A-PV1
ID=9G0BC93PANDE30C
ethaddr=F4:B1:C2:E5:18:E4
dh_keyboard=1
mp_autotest=0
sysbackup=0
appauto=1
autosip=1.2.3.4
serverip=192.168.1.10
filesize=18340088
Help commands:
Support list cmd:
+++++++++++++++++++++++++++++++++
--- ? alias for 'help'.
--- help print command description/usage.
--- setenv set environment variables.
--- saveenv save environment variables to persistent storage.
--- tftp tftpboot- boot image via network using TFTP protocol.
--- flwrite flwrite - write data into EMMC memory.
--- run run commands in an environment variable.
--- printenv print environment variables.
--- otp_printf print OTP variables.
--- otpcmd otp operations, ex: otpcmd display.
--- partition print partition information.
--- erasepart erase partition.
--- ping ping ip [send_num].
--- sdupgrade upgrade img from sd card.
--- reset Perform RESET of the CPU.
--- uartUp uartUp- update image via uart.
--- clearparam ususally used in factory test step 1; clear config & backup (if exist) part by default.
--- quit quit out upTool view.
Partition:
upTool#partition
name offset size
mini-Boot 0x0000000000000000 0x0000000000100000
U-Boot 0x0000000000200000 0x0000000000100000
hwid 0x0000000000300000 0x0000000000100000
updateflag 0x0000000000400000 0x0000000000100000
dtb 0x0000000000500000 0x0000000000100000
lens 0x0000000000600000 0x0000000000200000
dgs 0x0000000000800000 0x0000000000200000
config 0x0000000000a00000 0x0000000001000000
backup 0x0000000001a00000 0x0000000001000000
syslog 0x0000000002a00000 0x0000000001000000
devconfig 0x0000000003a00000 0x0000000000800000
product 0x0000000004200000 0x0000000000800000
Kernel 0x0000000004a00000 0x0000000000c00000
web 0x0000000005600000 0x0000000002000000
romfs 0x0000000007600000 0x0000000006000000
backdtb 0x000000000d600000 0x0000000000100000
backproduct 0x000000000d700000 0x0000000000800000
backKernel 0x000000000df00000 0x0000000000c00000
backweb 0x000000000eb00000 0x0000000002000000
backromfs 0x0000000010b00000 0x0000000006000000
res 0x0000000016b00000 0x0000000004000000
firmware 0x000000001ab00000 0x0000000018000000
sfmw 0x0000000032b00000 0x000000001b000000
coredump 0x000000004db00000 0x0000000018000000
appdata 0x0000000065b00000 0x000fffff9a600000
upTool#
Uart log if I don't stop booting:
DH-Boot ver001.001.001-svn10032 (Mar 29 2022 - 00:10:56 +0800)
MMC: host init
dhboot flash register.
$Tch SpiNand
Tch SpiNor
Tch Mmc
Image flag error! read=0x00000000
DScan SpiNand
scan blk : 64
Image flag error! read=0x00000000
scan blk : 128
Image flag error! read=0x00000000
scan blk : 192
Image flag error! read=0x00000000
scan blk : 256
Image flag error! read=0x00000000
scan blk : 320
Image flag error! read=0x00000000
scan blk : 384
Image flag error! read=0x00000000
scan blk : 448
Image flag error! read=0x00000000
scan blk : 512
Image flag error! read=0x00000000
scan blk : 576
Image flag error! read=0x00000000
scan blk : 640
Image flag error! read=0x00000000
scan blk : 704
Image flag error! read=0x00000000
scan blk : 768
Image flag error! read=0x00000000
scan blk : 832
Image flag error! read=0x00000000
scan blk : 896
Image flag error! read=0x00000000
scan blk : 960
Image flag error! read=0x00000000
scan blk : 1024
Image flag error! read=0x00000000
DScan fail!
DScan SpiNor
Image flag error! read=0xFFFFFFFF
DScan fail!
DScan Mmc
Image flag error! read=0x00000000
Image flag error! read=0x00000000
Image flag error! read=0x00000000
Image flag error! read=0x00000000
Image flag error! read=0x00000000
Image flag error! read=0x00000000
Load 0x00000080 to 0x00100000,size=31004
imgcrc pass!
Jmp 0x00100000
Info: write leveling start
Info: write leveling done
Info: dqs gating start
Info: dqs gating done
Info: read train start
Info: bypass read train done
Info: write train start
ddr init done
simple ddr test
swap
ddr_clk: 599500
cpu_clk: 1000000
enc_clk: 400000
DDR32bit done!
B: Mar 29 2022 00:11:21
chip id is 0x0x7FB3804C
mac io keep 3.3v
PreImgHeaderBase = 0x0010FE78
Mmc : Scan Uimg @0x50200000
use 2 plane to read
Load 0x50200040 to 0x12000000,size=197584
Jmp 0x12000000
Looking for any advice what could I be doing wrong.
Dahua IPC EASY unbricking / recovery over TFTP
A successor of Dahua IPC unbricking / recovery over serial UART and TFTP I recommend you to read through the above thread first. If your camera still has a working bootloader (assume it does) then you can flash it easily, because: The camera tries to download a file called...
tftp CONFIG_SYS_DEFAULT_LOAD_ADDR dhdtb.bin.img; flwrite.
tftp CONFIG_SYS_DEFAULT_LOAD_ADDR dhboot-min.bin.img; flwrite.
tftp CONFIG_SYS_DEFAULT_LOAD_ADDR dhboot.bin.img; flwrite.
tftp CONFIG_SYS_DEFAULT_LOAD_ADDR pd-x.squashfs.img; flwrite.
tftp CONFIG_SYS_DEFAULT_LOAD_ADDR romfs-x.squashfs.img; flwrite.
tftp CONFIG_SYS_DEFAULT_LOAD_ADDR kernel.img; flwrite.
tftp CONFIG_SYS_DEFAULT_LOAD_ADDR firmware-x.ext4_aa.img; flwrite.
tftp CONFIG_SYS_DEFAULT_LOAD_ADDR firmware-x.ext4_ab.img; flwrite.
tftp CONFIG_SYS_DEFAULT_LOAD_ADDR firmware-x.ext4_ac.img; flwrite.
tftp CONFIG_SYS_DEFAULT_LOAD_ADDR web-x.squashfs.img; flwrite.
tftp CONFIG_SYS_DEFAULT_LOAD_ADDR .FLASHING_DONE_STOP_TFTP_NOW.
sleep 5
Every file seems to go successfully.
I have uart ttl adapter too and tried tftp install using uart, also sd card upgrade, every file seems to go well, I tried fw from dahua web Dahua Technology - World-leading Video-centric AIoT Solution and Service Provide
My printenv:
upTool#printenv
bootdelay=2
baudrate=115200
ipaddr=192.168.1.108
gatewayip=192.168.1.1
netmask=255.255.255.0
bootfile=uImage
wifiaddr=00:12:34:56:78:91
da=tftp CONFIG_SYS_DEFAULT_LOAD_ADDR dhboot.bin.img; flwrite;tftp dhboot-min.bin.img;flwrite
dr=tftp CONFIG_SYS_DEFAULT_LOAD_ADDR romfs-x.squashfs.img; flwrite
dk=tftp CONFIG_SYS_DEFAULT_LOAD_ADDR kernel.img; flwrite
du=tftp CONFIG_SYS_DEFAULT_LOAD_ADDR user-x.squashfs.img; flwrite
dw=tftp CONFIG_SYS_DEFAULT_LOAD_ADDR web-x.squashfs.img; flwrite
ds=tftp CONFIG_SYS_DEFAULT_LOAD_ADDR dsp-x.cramfs.img; flwrite
dp=tftp CONFIG_SYS_DEFAULT_LOAD_ADDR partition-x.cramfs.img;flwrite
dc=tftp CONFIG_SYS_DEFAULT_LOAD_ADDR custom-x.squashfs.img; flwrite
up=tftp CONFIG_SYS_DEFAULT_LOAD_ADDR update.img; flwrite
tk=tftp CONFIG_SYS_DEFAULT_LOAD_ADDR uImage; bootm
loglevel=4
autolip=192.168.1.108
autogw=192.168.1.1
autonm=255.255.255.0
backupsip=192.168.1.100
nfssip=192.168.1.109
dpd=tftp CONFIG_SYS_DEFAULT_LOAD_ADDR pd-x.squashfs.img; flwrite
dfw=tftp CONFIG_SYS_DEFAULT_LOAD_ADDR firmware-x.squashfs.img;flwrite
BSN=9F0E0B8PAQ00542
HWID=CA-HZ4025GB-B:01:03:04:78:56:00:01:10:01:03:04:3E8_3E8:04:00:00:04:00:01:00:00:400
peripheral=1:6631:0:0:0:1:0:00:1:21:001:128:0:00:0:1:8
devalias=DH-SD6C3425GB-HNR-A-PV1
ID=9G0BC93PANDE30C
ethaddr=F4:B1:C2:E5:18:E4
dh_keyboard=1
mp_autotest=0
sysbackup=0
appauto=1
autosip=1.2.3.4
serverip=192.168.1.10
filesize=18340088
Help commands:
Support list cmd:
+++++++++++++++++++++++++++++++++
--- ? alias for 'help'.
--- help print command description/usage.
--- setenv set environment variables.
--- saveenv save environment variables to persistent storage.
--- tftp tftpboot- boot image via network using TFTP protocol.
--- flwrite flwrite - write data into EMMC memory.
--- run run commands in an environment variable.
--- printenv print environment variables.
--- otp_printf print OTP variables.
--- otpcmd otp operations, ex: otpcmd display.
--- partition print partition information.
--- erasepart erase partition.
--- ping ping ip [send_num].
--- sdupgrade upgrade img from sd card.
--- reset Perform RESET of the CPU.
--- uartUp uartUp- update image via uart.
--- clearparam ususally used in factory test step 1; clear config & backup (if exist) part by default.
--- quit quit out upTool view.
Partition:
upTool#partition
name offset size
mini-Boot 0x0000000000000000 0x0000000000100000
U-Boot 0x0000000000200000 0x0000000000100000
hwid 0x0000000000300000 0x0000000000100000
updateflag 0x0000000000400000 0x0000000000100000
dtb 0x0000000000500000 0x0000000000100000
lens 0x0000000000600000 0x0000000000200000
dgs 0x0000000000800000 0x0000000000200000
config 0x0000000000a00000 0x0000000001000000
backup 0x0000000001a00000 0x0000000001000000
syslog 0x0000000002a00000 0x0000000001000000
devconfig 0x0000000003a00000 0x0000000000800000
product 0x0000000004200000 0x0000000000800000
Kernel 0x0000000004a00000 0x0000000000c00000
web 0x0000000005600000 0x0000000002000000
romfs 0x0000000007600000 0x0000000006000000
backdtb 0x000000000d600000 0x0000000000100000
backproduct 0x000000000d700000 0x0000000000800000
backKernel 0x000000000df00000 0x0000000000c00000
backweb 0x000000000eb00000 0x0000000002000000
backromfs 0x0000000010b00000 0x0000000006000000
res 0x0000000016b00000 0x0000000004000000
firmware 0x000000001ab00000 0x0000000018000000
sfmw 0x0000000032b00000 0x000000001b000000
coredump 0x000000004db00000 0x0000000018000000
appdata 0x0000000065b00000 0x000fffff9a600000
upTool#
Uart log if I don't stop booting:
DH-Boot ver001.001.001-svn10032 (Mar 29 2022 - 00:10:56 +0800)
MMC: host init
dhboot flash register.
$Tch SpiNand
Tch SpiNor
Tch Mmc
Image flag error! read=0x00000000
DScan SpiNand
scan blk : 64
Image flag error! read=0x00000000
scan blk : 128
Image flag error! read=0x00000000
scan blk : 192
Image flag error! read=0x00000000
scan blk : 256
Image flag error! read=0x00000000
scan blk : 320
Image flag error! read=0x00000000
scan blk : 384
Image flag error! read=0x00000000
scan blk : 448
Image flag error! read=0x00000000
scan blk : 512
Image flag error! read=0x00000000
scan blk : 576
Image flag error! read=0x00000000
scan blk : 640
Image flag error! read=0x00000000
scan blk : 704
Image flag error! read=0x00000000
scan blk : 768
Image flag error! read=0x00000000
scan blk : 832
Image flag error! read=0x00000000
scan blk : 896
Image flag error! read=0x00000000
scan blk : 960
Image flag error! read=0x00000000
scan blk : 1024
Image flag error! read=0x00000000
DScan fail!
DScan SpiNor
Image flag error! read=0xFFFFFFFF
DScan fail!
DScan Mmc
Image flag error! read=0x00000000
Image flag error! read=0x00000000
Image flag error! read=0x00000000
Image flag error! read=0x00000000
Image flag error! read=0x00000000
Image flag error! read=0x00000000
Load 0x00000080 to 0x00100000,size=31004
imgcrc pass!
Jmp 0x00100000
Info: write leveling start
Info: write leveling done
Info: dqs gating start
Info: dqs gating done
Info: read train start
Info: bypass read train done
Info: write train start
ddr init done
simple ddr test
swap
ddr_clk: 599500
cpu_clk: 1000000
enc_clk: 400000
DDR32bit done!
B: Mar 29 2022 00:11:21
chip id is 0x0x7FB3804C
mac io keep 3.3v
PreImgHeaderBase = 0x0010FE78
Mmc : Scan Uimg @0x50200000
use 2 plane to read
Load 0x50200040 to 0x12000000,size=197584
Jmp 0x12000000
Looking for any advice what could I be doing wrong.
Last edited: