Dahua Firmware Mod Kit + Modded Dahua Firmware

catcamstar

Known around here
Joined
Jan 28, 2018
Messages
1,551
Reaction score
1,022
From a long time history, try running: binwalk -Me web-x.squashfs.img

Edit: if that does not work, have a look at devttys0/sasquatch
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
13,892
Reaction score
5,042
Location
Scotland
It looks like the data is now encrypted
A look at the kernel on the DH_IPC-HX5X3X-Rhea_MultiLang_NP_Stream3_V2.800.0000016.0.R.200605.bin firmware confirms this :
Code:
alastair@PC-I5 ~/cctv/other/Lorex/Lorex LNB8005-CP/misc_firmware/16_ML/kernel $ grep decrypt kallsyms.txt
80008A24 T block_aes_decrypt
80009430 T SecUnit_AES_set_decrypt_key
800099F8 T SecUnit_AES_decrypt
80125CE4 t cipher_decrypt_unaligned
80127654 t aead_null_givdecrypt
80127F78 T skcipher_null_givdecrypt
80127FF0 t no_givdecrypt
80128D28 t async_decrypt
80133BA8 T decrypt
80139644 t crypto_ecb_decrypt
80139A9C t crypto_cbc_decrypt
8013A6F8 t des_decrypt
8013AE88 t des3_ede_decrypt
8013CFE0 t aes_decrypt
801A23C4 T mtd_read_without_decrypto
801A2610 T mtdblock_decrypto
80381EA0 r __ksymtab_block_aes_decrypt
80387EC0 r __ksymtab_mtd_read_without_decrypto
80389D97 r __kstrtab_block_aes_decrypt
8039628D r __kstrtab_mtd_read_without_decrypto
alastair@PC-I5 ~/cctv/other/Lorex/Lorex LNB8005-CP/misc_firmware/16_ML/kernel $
 

Graatz

n3wb
Joined
Jul 17, 2016
Messages
23
Reaction score
3
Are there full dumps available ? I already flashed it to the "new" version.
since I have a new nvr he won't accept the chinese cam, the old one did fine.
You can load the Chinese cam by RTSP stream
 

kobebeef

n3wb
Joined
Mar 13, 2016
Messages
13
Reaction score
1
Hello, i have this Dahua DH-IPC-HFW1230M-I2-V2. Anyone can help me change this camera Language from Chinese to English? I found on Dahua Chinese site seem as this link is firmware for it DH-IPC-HFW12XX系列 -浙江大华技术股份有限公司

View attachment 77861
And can change P2P server from chinese cn to International?
View attachment 77862

Can't, The firmware has sing and AES encryption

firmware code
Code:
local newRegion = "Inland";                  /"Inland" China; "Abroad"

    if(type(curRegion) ~= "nil" and curRegion ~= newRegion) then
        return false, "Regional conflict";
    end
fbc.png
If the value is greater than V1.4, restrict foreign and Chinese firmware Not interchangeable
 
Last edited:

bixpii

n3wb
Joined
Feb 14, 2020
Messages
13
Reaction score
1
Location
hai duong
Can't, The firmware has sing and AES encryption

firmware code
Code:
local newRegion = "Inland";                  /"Inland" China; "Abroad"

    if(type(curRegion) ~= "nil" and curRegion ~= newRegion) then
        return false, "Regional conflict";
    end
View attachment 77915
If the value is greater than V1.4, restrict foreign and Chinese firmware Not interchangeable
So if the value is lower V1.4 can interchangeable?
Can I mod P2P server to international?
 

TBrazing

n3wb
Joined
Dec 28, 2020
Messages
1
Reaction score
0
Location
Usa
Will this work on Amcrest cams?
Excuse the ignorance.I’ve read guys doing this to unlock power of the 4K cams,
Thanks I’m advance

assuming I have a “American” camera?
 

masoduco

n3wb
Joined
Jan 2, 2021
Messages
10
Reaction score
0
Location
iran
Hello, I managed to unpack the firmware but it gives me the following error:

[root@localhost Dahua-Firmware-Mod-Kit]# ./extract.py dvr.bin -c NVR4xxx
WARNING Found config: NVR4xxx
INFO Extracting 7 files to: 'dvr.bin.extracted'
INFO Processing 'Install.lua'.
INFO Processing 'u-boot.bin.img'.
INFO Processing 'romfs-x.cramfs.img'.
INFO Processing 'web-x.cramfs.img'.
INFO Processing 'custom-x.cramfs.img'.
CRITICAL Missing dependency: 'cramfsck'
ERROR 'CramFS' handler returned non-zero return value for file: 'custom-x.cramfs.img.raw'
Traceback (most recent call last):
File "./extract.py", line 238, in <module>
extractor.Extract(args.source)
File "./extract.py", line 113, in Extract
raise Exception("Handler returned non-zero return value!")
Exception: Handler returned non-zero return value!


how can I solve it?
how to fix error ???
 

masoduco

n3wb
Joined
Jan 2, 2021
Messages
10
Reaction score
0
Location
iran
Your NVR in original europe or chinese?
What firmware file you use?
hi
firmware use : DH_NVR4xxx_Eng_P_V3.202.0000.1.R.20170221.bin
Your NVR in original europe or chinese? chinese
 
Last edited:

iTuneDVR

Pulling my weight
Joined
Aug 23, 2014
Messages
614
Reaction score
101
Location
www.iTuneDVR.ru
If you realy have pure europe device you need do this

Using TTL2USB adapter connect your NVR to PC via PuTTY, stop bootloading, next
setenv dh_keyboard 0
setenv appauto 0
saveenv
reboot

After loading your NVR will stop and you need erase config files
rm /mnt/* -rf
reboot

Stop bootloading again, and return back appauto value

setenv appauto 1
saveenv
reboot

OR
try connect via telnet to NVR and remove config from them

If no access, so try more early firmware
 

masoduco

n3wb
Joined
Jan 2, 2021
Messages
10
Reaction score
0
Location
iran
(((( try connect via telnet to NVR and remove config from them ))))

can you help me for use ?
learning video ?
learning image ?
learning document ?
about telnet ????????
 

iTuneDVR

Pulling my weight
Joined
Aug 23, 2014
Messages
614
Reaction score
101
Location
www.iTuneDVR.ru
One moment before telnet: Delete all cache from IE & try to login. Then try to find preLanguage.txt
telnet ip
admin
7ujMko0admin
if account admin admin

If no access or something else try downgrade
 

goblin

n3wb
Joined
Jan 26, 2021
Messages
5
Reaction score
0
Location
Italy
thanks, but I have been prescribed, it is a
4631r-zs. Meanwhile she runs again with Chinese language, now I would only have to do that in english.
Hello, did you solve the problem? unfortunately I tried to update the firmware of the camera (4631r-zs) and now is blocked. i can only ping the camera.
Did you find the solution? unfortunately I have 6 to repair ....:( :( :( thank you
 
Top