Help unbricking a Dahua NVR with TFTP and serial connection.

[weezer311]

I've flipped the pins and tried it both ways. I'll mess around with the speed. Windows seems to recognize the adapter and the software shows that it connects on COM6.

The NVR died after an attempt to update the firmware via USB. It seems to be stuck in a boot loop now. It may be totally corrupt but I wanted to try a few things before pronouncing it dead.

 

[TheDude]

Ah okay. If it initializes the network port you might also be able to use the TFTP method used here.... Dahua IPC EASY unbricking / recovery over TFTP

Just like the cameras (at least my 5216-4ks2) it attempts to connect to a TFTP server at 192.168.254.254 BUT instead of the same generic txt file with the same name that all of the IP cameras use it is looking for a txt file based on the NVR's serial number. So if it is initializing the network port and you have the TFTP server running and ncat logging you should see where it tries to connect and download the file. That will tell you exactly what you would need to name the file. Basically you would use the instructions in that other thread but edit the commands.bat to change upgrade_info_7db780a713a4.txt to whatever the exact filename is hat the NVR is looking for. Of course this is counting that the boot loader is still there enough to at least initialize the network port. That does happen very early in the boot process and it is only for a few seconds for it to try and grab that file. Then the jack goes dead again until the main operating software loads and initializes.

 

[lodeon1337]

Hello, I have bricked my NVR5216 and am trying to recover it.
Unfortunately I don't understand the meaning of command.bat. This creates the appropriate file (MySerialNumber-DH5416-K4S2.txt) that the NVR is looking for.
So far so good, but where do I get the content of Commands.txt from?
The file pd-x.squashfs.img named in the commant.txt does not exist in the firmware for my NVR either.

I understand it like this:
The NVR is looking for the corresponding TXT file containing the commands for the recovery.
But why doesn't it execute the commands in the MySerialNumber-DH5416-K4S2.txt and what are they?

I would be very happy if someone could help. Greetings and thanks Michael

 

[djramc]

After i auto upgrade DHI-NVR5216-16P-4KS2E never started , just keep rebooting. i've succesfully connected by com port. and send upgrade file by tftp succesfully but after install i get this error

done
Bytes transferred = 49908159 (2f989bf hex)
boottype=1:
dh_wdt_stop called
flash_do_flwrite,723,ret:-42,flash_sn:1
Bad Magic Number
flwrite error!
dh_wdt_start called
secure flwrite error!
do_flwrite_secure failed
hisilico▒▒

 

[kobebeef]

DH-NVR4208-8P-HDS2
如何恢復TFTP或備份

 

[djramc]

what about nvr4104HS-4P-4KS2
there is no rsr232 serial port on backend .

 

[faramirali25]

Hi,

I'm new to this forum hope somebody on here can help me.

I have Lorex lorex n882a3b-z NVR.i am trying to change dahua nvr firmware

I connected via the serial port to try flashing it with the firmware again.

But I'm not Able to stop the U-Boot auto boot. It show me.

But I press key and it doesn't respond.

 

[hossein_aghaie]

i have a xvr5108hs.i3
that brick and wont boot after update
when i connect to serial terminal ,it display:
U-Boot 2016.07-svn5384 (Jun 21 2021 - 09:47:58 +0800), Build: jenkins-GSP_DH3.RD
003604_X3_linux-336

CPU: Novatek NT @ 1200 MHz
Watchdog enabled
DRAM: 1 GiB
NAND: id = 0xef 0xaa 0x21 0x00
nvt spinand 4-bit mode @ 80000000 Hz
128 MiB
MMC: NA51068_SDC: 0
Firmware name: FW98323A.bin FW98323T.bin FW98323A.fdt.bin
nvt_detect_fw_tbin Boot from flash or emmc
Open SD fail: No SD device?
DTS find cpu freq clock 1400MHz
Read power trim = 0x0000000d
cpu 1400 remap_data 14
Set CPU clk 1400MHz
Read power trim = 0x0000000d
ddr 2128 remap_data 30
run change to emb phy command
chang to emb eth phy
Net: na51068_eth_initialize 1.0.2.0
na51068_eth_initialize: dtb node /eth0@fcc00000 found
eqos_initialize 0xfcc00000
eth_parse_phy_intf: get IO MEM 0xfcc00000
DTS /eth0@fcc00000 found
LED1 pinmux 0x100046
eth_parse_phy_intf: phy_clk:1 ref-clk-out 0
eth_parse_phy_intf: pinmux detect emb phy 0x100
na51068_eth_initialize(1938) nodeoffset < 0
na51068_eth_initialize: path /eth1@fcd00000 not found
eth0
.... done
Error -3 while decompressing!
1faacdd8(26879)->1faf0f68
gzip uncompress failed with error code 0
read_block: failed to read block @0xffffffff
acor1await

what can i do?