Dahua IPC EASY unbricking / recovery over TFTP

I have to double check but yes.
After the last event the nvr is rebooting due to a software reboot :

Code: 
#Load STORAGE SPINAND
ROSC: 0103 threshold: 0100
D-03 Infinity2_DDR3_32_8X_CL14_2133_EXT_Nanya_20181203-F6.h
EXT_NYA2133_20181203-F6
CPU_1400Mhz
Set CPUCORE to 1.05V
BootSource: SW reset
 
Hello guys, could someone help me salvage my VTO2000A or tell if it's time for a new one?
I have gone through every single page on this thread (1-28) and still can't get my VTO working. Here is what I've done:
  1. I am unable to ping the camera regardless the connection method (PoE switch, unmanaged switch with 12v power to camera etc, direct p2p connection etc.)
  2. I'm able to access the camera via USB-TTL and ST-LINKv2 (see attached log from U-Boot I've also added the complete startup dump)
  3. Using ST-LINKv2 I was able to change the firmware using a HEX file (instructions found here)
  4. I know step 2 worked because my language changed from Dutch to English
  5. Following the instruction on page 1 of this thread, I got everything setup - see attached image
  6. When I power up my VTO after everything is connected (tftp and console running), nothing at all happens. No network activity whatsoever
  7. When I run a command such us "run dr" in DHBOOT# I get the following message
    T WARN: emac_send_packet: No link
  8. I also see the following messages in a more verbose log:
    davinci_eth_open:no link
    WARN: emac_send_packet: No link
    Retry count exceeded; starting again
    IP-Config: No network devices available.
  9. I also don't see any lights burning when I connect the camera to the switch - not sure this is important
Now my biggest fear.
Could this be a hardware issue with my network interface? PoE connection still powers on the VTO by the way.
Could this be a hardware issue or perhaps a software issue that can still be fixed.
Any help or pointers in the right direction will be greatly appreciated. Thanks in advance.
 

Attachments

  • netip.png
    netip.png
    36.8 KB · Views: 0
Hello,
I have a VTH2421FB(W)-P which I tried to upgrade with DH_VTHX421H_MultiLang_SIP_EMEA_V4.800.0000000.0.R.241114.zip.
But I made a mistake and give to ConfigTool 2 times the DH_VTHX421H_MultiLang_SIP_EMEA_V4.800.0000000.0.R.241114_part1.bin ...

Now my VTH screen is black, and when I look to my switch POE status is ON but Port status is OFF.

I tried the Dahua_TFTPBackup.zip (which it already rescued one of my camera) but, nothing happen. I guess the Ethernet port is not running?

There is a COM port behind the VTH with 12 pin (IN1 IN2 IN3 IN4 GND IN5 IN6 N/A N/A GND NO COM), is there a way to use it ?

Any thought ?

EDIT : COM port is an ALARM PORT
EDIT2 : I plug 12V directly in the VTH and it start, it appears POE is not working anymore on the VTH (I tried 3 differents POE switch with different cable, which work with my POE Camera)
Is it possible a firmware issue cause POE stop working ?

Thanks
 
Last edited:
Focster said:
Hey, everybody.
I got a DH-IPC-HFW4433F-ZSA camera.

View attachment 200862

Received it in a state of not booting.
I managed to download the firmware DH_IPC-HX4XXX-Eos_Chn_PN_Stream3_V2.680.0000000.46.R.231027.bin via tftp.

The camera started up, I can access its web interface (only in Chinese) or configure it via SmartPSS.

I can add the camera to the Dahua recorder (Europe) on the old firmware of the recorder.
I can NOT add a camera to Dahua (Europe) on the new firmware of the recorder 4+....

Is there any broken firmware for this camera, so that it works with Dahua recorders (not Chinese) with firmware version 4+...??
Click to expand...
I have the same camera, not booting, like yours. Could you please post here the firmware you got? thank you.
 
Hello there!

My situation is that I have VTH1560B on v4.000.0000.0.R.20180622 firmware right now. I need to downgrade it to v2.100 or even v1.000 to get it to work with my household. And of course I cant make it through configtool.
I have read this thread about TFTPtools and etc. and prepared all necessary files and commands like described but I cant make devices to start TFTP session...

I have tried to create environment (like option 2) in which VTH is 192.168.1.108 (255.255.0.0 and gateway 192.168.1.1) is connected directly to single notebook with IP 192.168.254.254 (255.255.0.0 and gateway 192.168.1.1).
Then I start TFTPServer.bat and Console.bat. TFTP-server says something like "Listening to 192.168.254.254:69"
Then I powerup the VTH...

And nothing happens. VTH is just starting main program and TFTP-server standing still...

What am I doing wrong?
 
Hello Guys!

i have old AV-VTI03W Dahua VTH1550CH with brick firmware - totaly blank screen.


ChatGPT, after scanning the sticker, indicated that this is a 1510, not a 1550?? Strange. I tried flashing that firmware and a bunch of others from the 1550 and 1510 series too... everything ended with 'failed' right after this:


kernel-x.cramfs.img, 1149 block served
failed.txt


Please advise what could have happened here or which firmware I need to load because i have new silver hair on my head :)
 
Hello,
I have a Dahua 1431 that doesn't save settings. Restore to factory with inside button doesn't work.
When I try update via TFTP i get the message as below. What am I doing wrong?

Using ambarella mac device
TFTP from server 192.168.1.9; our IP address is 192.168.1.241
Download Filename 'romfs-x.squashfs.img'.
Download to address: 0x2000000
Downloading: #################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#############################################################
done
Bytes transferred = 3303672 (3268f8 hex)

## Checking Image at 02000000 ...
Legacy image found
Image Name: romfs
Created: 2019-12-02 7:54:50 UTC
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 3303608 Bytes = 3.2 MiB
Load Address: 01b80000
Entry Point: 01fd0000
Verifying Checksum ... OK
Programing start at: 0x01b80000
SPI probe: 32768 KiB W25Q256FV at 0:1 is now current device
write : 0%__do_write_flashSpi: error!
flwrite error 1!
 
I downloaded the firmware for the IPC-Color4K-T180 from empiretech website, then used 7zip to decompress that .bin file which then gave me a list of files:
1747585469926.png

the "install" file lists all file that I believe need to be written to flash:
{
"Commands" : [
"burn kernel-aol.img kernel-aol",
"burn romfs-x-aol.squashfs.img rootfs-aol",
"burn dhdtb-bak.bin.img dtb-bak",
"burn dhdtb.bin.img dtb",
"burn kernel.img kernel",
"burn romfs-x.squashfs.img rootfs",
"burn pd-x.squashfs.img pd",
"burn web-x.squashfs.img web",
"burn firmware-x.squashfs.img firmware",
"burn dhboot-min.bin.img mini-boot",
"burn dhboot.bin.img U-Boot"
],
"Devices" : [
[ "IPC-HX3XXX", "1.00" ]
],
"Vendor" : "General",
"Version" : {
"SoftwareVersion" : "V3.140.0000000.32.R.250115"
}
}
/IPC_RestoreDefault


I guess I need to put this information inside the upgrade_info_7db780a713a4.txt that the camera looks for when booting up via tftp?
 
Andy from empiretech sent me a zip with all .img to flash, I just need to figure out how to build the command text file to flash the following:

dhboot-min.bin.img
dhboot.bin.img
kernel.img
romfs-x.squashfs.img
web-x.squashfs.img
pd-x.squashfs.img
dhdtb.bin.img
firmware-x.squashfs.img
CmdScript.img
 
Hopefully this helps someone, but I think I found the TFTP backup tool archive.

If anyone has hot tips for recovering a DH-IPC-HDBW4631R-S purchased years ago from Aliexpress, please let me know! Still not sure what firmware I should be trying to restore.
 

Attachments

  • Like
Reactions: mephisto_uk
Hey all.

Got a Dahua rebranded camera with failed firmware. Rebrand company does not have its firmware anymore.

Here's the details:

Code: 
UBL Version: 1.43t(DM368 12/25/2012)
 Oscillator: 24MHZ
 ARM Rate: 432 MHZ
 DDR Rate: 340 MHZ
start watchdog
 BootMode: SPI
Starting SPI Memory Copy...
DONE


U-Boot 1.3.6 (jerry) (Mar  7 2014 - 17:23:47)

DRAM:  128 MB
SF: Got idcode ef 40 17
SF: Detected W25Q64 with page size 256, total  8 MB
In:    serial
Out:   serial
Err:   serial
Ethernet PHY: GENERIC @ 0x03,id:221513
total gio 2
gio[22]=1
gio[25]=1
Loading...Fail: inflate() returned [-3]
uncompress fail

TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Filename 'upgrade_info_7db780a713a4.txt'.
Load address: 0x80100000
Loading: *
Retry count exceeded; starting again
Fail to get info file!
Init error!
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Filename 'failed.txt'.
Load address: 0x80200000
Loading: *
Retry count exceeded; starting again
==>use default images
## Booting kernel from Legacy Image at 80800000 ...
   Image Name:   boot
   Image Type:   ARM Linux Kernel Image (lzma compressed)
   Data Size:    1041397 Bytes = 1017 kB
   Load Address: 80008000
   Entry Point:  80008000
   Verifying Checksum ... Bad Data CRC
ERROR: can't get kernel image!

Code: 
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Filename 'upgrade_info_7db780a713a4.txt'.
Load address: 0x80100000
Loading: #
done
Bytes transferred = 82 (52 hex)
bootdelay=3
baudrate=115200
eth2addr=00:01:5b:00:77:88
ipaddr=10.12.10.28
serverip=10.12.9.27
bootfile="uImage"
dh_keyboard=1
appauto=1
single=0
dc=tftp 81a00000 custom-x.cramfs.img; flwrite
dr=tftp 81a00000 romfs-x.cramfs.img; flwrite
du=tftp 81a00000 user-x.cramfs.img; flwrite
dd=tftp 81a00000 data-x.cramfs.img; flwrite
dw=tftp 81a00000 web-x.cramfs.img; flwrite
up=tftp 81a00000 update.img; flwrite
tk=tftp 80800000 uImage; bootm 80800000
gionum=22.25
gioval=1.1
dh_com=0
autosip=192.168.254.254
autolip=192.168.1.108
autogw=192.168.1.1
autonm=255.255.255.0
HWID=IPC-HFW2200B-V2:01:02:02:03:05:00:01:00:00:00:00:1B0:00:00:02:00:00:00:00:00:80
devalias=IPC-HFW2200S-V2
bootcmd=fsload 0x80800000 0x00060000;bootm 0x80800000
bootargs=console=ttyS0,115200n8 root=/dev/mtdblock4 rootfstype=squashfs ,nolock mem=78M video=davincifb:vid0=OFF:vid1=OFF:osd0=OFF:osd1=OFF
da=protect off all;tftp 81a00000 dm365_ubl_boot_8M_spiflash.bin.img;flwrite
ID=TZC4GU234W02872
ethaddr=90:02:A9:5D:36:79
stdin=serial
stdout=serial
stderr=serial
ver=U-Boot 1.3.6 (jerry) (Mar  7 2014 - 17:23:47)
filesize=52
fileaddr=80100000

I've found OEM firmware with matching HWID IPC-HFW2200B-V2:01:02:02:03:05:00:01:00:00:00:00:1B0:00:00:02:00:00:00:00:00:80 listed within its check.img:
Code: 
check.img
data-x.cramfs.img
dm365_ubl_boot_8M_spiflash.bin.img
Install
kernel-x.cramfs.img
romfs-x.cramfs.img
sign.img
web-x.cramfs.img

The problem is this fimware install commands are different from the ones listed in original ones' printenv:
Code: 
   "Commands" : [
      "burn kernel-x.cramfs.img kernel",
      "burn romfs-x.cramfs.img rootfs",
      "burn web-x.cramfs.img web",
      "burn data-x.cramfs.img data"
   ],

Additinally it does have a sign.img file, suggesting that firmware is signed.

EDIT:

Managed to acquire unsigned compatible firmware. Updated bootloader (probably wasn't needed, but didn't hurt) with "run da" command.

And then ran:

Code: 
tftp 81a00000 kernel-x.cramfs.img; flwrite
tftp 81a00000 romfs-x.cramfs.img; flwrite
tftp 81a00000 web-x.cramfs.img; flwrite
tftp 81a00000 data-x.cramfs.img; flwrite

And camera rebooted just fine. Hope somebody else will find this useful.
 
Last edited:
  • Like
Reactions: alastairstevenson
Okay, I finally got my camera to work. It's the DH-IPC-HDBW4631R-S, purchased off of Alibaba years and years ago, accidentally flashed with a firmware that bricked the device. I'm fine with a Chinese web UI since I can just translate the page on the fly using my browser. FWIW, the new Chinese firmware I ended up using (V2.800.0000030.0.R, Build Date: 2024-06-14) is quite nice, especially compared to the old firmware from 2018 that the camera shipped with.

I was having issues not being able to run printenv or any other "run" commands. So I just tried things until I found something that would work. I'm posting this here should I, or anyone else, ever run into this miserable situation.

I have Unifi networking hardware, so I had to ssh in and edit the routing manually.
iptables -t nat -A PREROUTING -d 192.168.254.254 -j DNAT --to-destination 192.168.1.MY_IP
iptables -A FORWARD -d 192.168.1.MY_IP -j ACCEPT
Click to expand...

Since I don't really run windows much, I used this python script to generate the upgrade_info_7db780a713a4.txt file.
github.com

dahua-tftp-recover-docker/tools/upgrade_info.py at main · ayushin/dahua-tftp-recover-docker

Docker compose setup to recover/"unbrick" a Dahua VHC15xx - ayushin/dahua-tftp-recover-docker
github.com github.com
Click to expand...
Here's what I did for commands.txt:
tftp 0x82000000 kernel.img; flwrite; flwrite
tftp 0x82000000 partition-x.cramfs.img; flwrite
tftp 0x82000000 romfs-x.squashfs.img; flwrite
tftp 0x82000000 user-x.squashfs.img; flwrite
tftp 0x82000000 custom-x.squashfs.img; flwrite
tftp 0x82000000 web-x.squashfs.img; flwrite
Click to expand...

Resulting in upgrade_info_7db780a713a4.txt of
CRC:1110528513
MagicString:c016dcd6-cdeb-45df-9fd0-e821bf0e1e62
tftp 0x82000000 kernel.img; flwrite; flwrite
tftp 0x82000000 partition-x.cramfs.img; flwrite
tftp 0x82000000 romfs-x.squashfs.img; flwrite
tftp 0x82000000 user-x.squashfs.img; flwrite
tftp 0x82000000 custom-x.squashfs.img; flwrite
tftp 0x82000000 web-x.squashfs.img; flwrite
Click to expand...

As for the firmware used, I found this DH_IPC-HX5X3X-Rhea_Chn_PN_Stream3_V2.800.0000030.0.R.240614.bin worked but the MultiLang version unfortunately doesn't. I even tried taking the custom-x.squashfs.img file from a different MultiLang firmware, but no dice. Translators for the win. I'd link it, but who knows when anyone will visit this post, so I've attached it.

gBootLogPtr:00b80008.
spinor flash ID is 0x1940ef
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=130M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc.
TEXT_BASE:01000000
Net: PHY:0x001cc816,addr:0x00
s3l phy RTL8201 init
partition file version 2
rootfstype squashfs root /dev/mtdblock5
MMC: sdmmc init
Using ambarella mac device
Download Filename 'upgrade_info_7db780a713a4.txt'.Downloading: 100%
## file size: 340 Bytes, times: 0s, speed: 0 Bytes/s
done
Bytes transferred = 340 (154 hex)
string value is 0
The end of file
Using ambarella mac device
Download Filename 'kernel.img'.Downloading: 100%
## file size: 1.5 MiB, times: 1s, speed: 1.4 MiB/s
done
Bytes transferred = 1588752 (183e10 hex)
curVer:V1.4 <= newVer:V2.0,verCompare success!
UBOOT_commonSwRsaVerify run successfully!

## Checking Image at 02000000 ...
Legacy image found
Image Name: kernel
Created: 2024-06-14 7:56:12 UTC
Image Type: ARM Linux Firmware (uncompressed)
Data Size: 1586456 Bytes = 1.5 MiB
Load Address: 01040000
Entry Point: 01200000
Verifying Checksum ... OK
Programing start at: 0x01040000 for kernel
SPI probe: 32768 KiB W25Q256FV at 0:1 is now current device
write : 100%
done
crc from program is :2720cfc1, crc from flash is :2720cfc1
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=130M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc.
Using ambarella mac device
Download Filename 'partition-x.cramfs.img'.Downloading: 100%
## file size: 10.2 KiB, times: 0s, speed: 930.7 KiB/s
done
Bytes transferred = 10488 (28f8 hex)
curVer:V1.4 <= newVer:V2.0,verCompare success!
UBOOT_commonSwRsaVerify run successfully!

## Checking Image at 02000000 ...
Legacy image found
Image Name: partition
Created: 2024-06-14 7:56:12 UTC
Image Type: ARM Linux Standalone Program (uncompressed)
Data Size: 8192 Bytes = 8 KiB
Load Address: 000e0000
Entry Point: 000f0000
Verifying Checksum ... OK
Programing start at: 0x000e0000 for partition
write : 100%
done
crc from program is :504e71b6, crc from flash is :504e71b6
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=130M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc.
Using ambarella mac device
Download Filename 'romfs-x.squashfs.img'.Downloading: 100%
## file size: 3.9 MiB, times: 2s, speed: 1.4 MiB/s
done
Bytes transferred = 4118776 (3ed8f8 hex)
curVer:V1.4 <= newVer:V2.0,verCompare success!
UBOOT_commonSwRsaVerify run successfully!

## Checking Image at 02000000 ...
Legacy image found
Image Name: romfs
Created: 2024-06-14 7:57:15 UTC
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 4116480 Bytes = 3.9 MiB
Load Address: 01b80000
Entry Point: 01fd0000
Verifying Checksum ... OK
Programing start at: 0x01b80000 for romfs
SPI probe: 32768 KiB W25Q256FV at 0:1 is now current device
write : 100%
done
crc from program is :8e866e13, crc from flash is :8e866e13
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=130M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc.
Using ambarella mac device
Download Filename 'user-x.squashfs.img'.Downloading: 100%
## file size: 14.8 MiB, times: 10s, speed: 1.4 MiB/s
done
Bytes transferred = 15554808 (ed58f8 hex)
curVer:V1.4 <= newVer:V2.0,verCompare success!
UBOOT_commonSwRsaVerify run successfully!

## Checking Image at 02000000 ...
Legacy image found
Image Name: user
Created: 2024-06-14 7:57:05 UTC
Image Type: ARM Linux Standalone Program (uncompressed)
Data Size: 15552512 Bytes = 14.8 MiB
Load Address: 000f0000
Entry Point: 01000000
Verifying Checksum ... OK
Programing start at: 0x000f0000 for user
write : 100%
done
crc from program is :9c23f9d1, crc from flash is :9c23f9d1
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=130M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc.
Using ambarella mac device
Download Filename 'custom-x.squashfs.img'.Downloading: 100%
## file size: 82.2 KiB, times: 0s, speed: 1.3 MiB/s
done
Bytes transferred = 84216 (148f8 hex)
curVer:V1.4 <= newVer:V2.0,verCompare success!
UBOOT_commonSwRsaVerify run successfully!

## Checking Image at 02000000 ...
Legacy image found
Image Name: custom
Created: 2024-06-14 7:58:03 UTC
Image Type: ARM Linux Standalone Program (uncompressed)
Data Size: 81920 Bytes = 80 KiB
Load Address: 018a0000
Entry Point: 01970000
Verifying Checksum ... OK
Programing start at: 0x018a0000 for custom
SPI probe: 32768 KiB W25Q256FV at 0:1 is now current device
write : 100%
done
crc from program is :c410f828, crc from flash is :c410f828
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=130M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc.
Using ambarella mac device
Download Filename 'web-x.squashfs.img'.Downloading: 100%
## file size: 5.8 MiB, times: 4s, speed: 1.4 MiB/s
done
Bytes transferred = 6035704 (5c18f8 hex)
curVer:V1.4 <= newVer:V2.0,verCompare success!
UBOOT_commonSwRsaVerify run successfully!

## Checking Image at 02000000 ...
Legacy image found
Image Name: web
Created: 2024-06-14 7:56:40 UTC
Image Type: ARM Linux Standalone Program (uncompressed)
Data Size: 6033408 Bytes = 5.8 MiB
Load Address: 01200000
Entry Point: 01880000
Verifying Checksum ... OK
Programing start at: 0x01200000 for web
SPI probe: 32768 KiB W25Q256FV at 0:1 is now current device
write : 100%
done
crc from program is :ded91669, crc from flash is :ded91669
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=130M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc.
cmd:(printenv) is not support!
partition file version 2
rootfstype squashfs root /dev/mtdblock5
fail to load bootargsParameters.txt
fail to load bootargsParameters.txt file
cmdLine console=ttyS0,115200 mem=130M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc
Click to expand...
 

Attachments

You must log in or register to reply here.
Top Bottom