Lorex LNB8005B-C and Dahua firmware (Solved with instructions)

[Corellon]

Have 6 Lorex LNB8005B-C Camera's but running my own NVR so the firmware is never able to be updated by Lorex, given the issues found I would like to update the firmware and was wondering if anyone has tired and been successful with the Dahua firmware?

From what I can see the equivilent model would be the IPC-HFW4830E-S and latest firmware would be: [NTSC]DH_IPC-HX5X3X-Rhea_EngSpnFrn_N_Stream3_V2.622.0000000.18.R.20171110

Been reading the forums for a long time now but first time I've had a need to ask something I couldn't find already answered.

Thanks

 

[pozzello]

I tried it on one of my LNB8005c's. the 'upgrade' just stops a few bars in and the cam is un-upgraded after rebooting. not bricked at least.
would love to find a Dahua firmware that works on these puppies, as I miss the ability to set the Iframe interval and wouldn't mind the fourth option for day/night in profile management, but Lorex may have locked us out there...

 

[pozzello]

Apparently, it's possible, per Lorex
i'll poke around with it when i get some more time...

 

[Corellon]

i've tried many things, I can't get TFTP to work as it's not trying to connect to 192.168.254.254, all the firmware files get rejected due to signing I believe.

I don't have the means to try a serial connection but would rather keep it to something external anyways.

Anyone have suggestions on the TFTP route?

 

[Corellon]

Ok some success here in getting TFTP running, it's rather screwy and different from the guide....

No matter what IP you assign the camera boots up with an IP of 192.168.1.108 and looks for the gateway 192.168.1.1, it will then TFTP into 192.168.254.254 and start retrieving files.

Had to reconfigure my whole network to get the subnet, gateways and VLANS to align but now it's TFTP'ing. Will update with the results afterwards

Results: Mostly a Success..... TFTP'ing the files semi-bricked the Camera I'm not sure if it was because I didn't remove the line "tftp 0x82000000 pd-x.squashfs.img; flwrite" from the commands.txt file but it would fail to transfer that file. After removing it and reflashing the device was still non-responsive on HTTP/S but did respond to the Dahua config tool and ping. Once I used the config tool to reset the IP information on the camera the web interface came back online and it's now a Dahau device but it seems to reboot or restart the web interface at times? Not behaving consistent...

Update 2: I'll call it a Success now... reflashed with "tftp 0x2000000 pd-x.squashfs.img; flwrite" (Removed the "8") and the x.squashfs.img succeeded, login in working fine (Even asked if I wanted auto updates!) and no longer seems to kick me out and the menu's function properly from what I can see. SSH is also enabled in this firmware, just need to add "7ujMko0" to your password such as "7ujMko0PASSWORD"

Update 3: Can also confirm that this corrects the broken ONVIF profile on the Lorex firmware, device is now ONVIF compliant, gives 2 sub streams at H265 instead of 1 and supports customized bitrates for VBR and CBR as well as IFrame interval as well as supports SNMP V1,2 and 3. Still trying to locate the color night vision setting it seems to default to B/W even when it's fairly lit still.

A Big thanks to pozzello for taking the initial plunge and inspiring me to do a deeper dive

 

[Corellon]

Update 5: (Since previous update are awaiting moderation now?) after TFTP to 2.622 I used the web interface to flash DH_IPC-HX5X3X-Rhea_MultiLang_NP_Stream3_V2.800.0000008.0.R.190619 and it's enabled further options (4th day/night profile, access control, RTMP, etc) but best of all fixes the video feed in the interface so you can view the video naively in chrome (without plugin) even at H265, useful for setting up privacy zones, Facial recongnition, IVS, etc as those didn't work previously unless you used a mobile to view the stream while you adjusted.

If anyone has any questions on the process hit me up, have to say the Dahua firmware is a huge step up from the lorex.

 

[WoodsRanger]

I'd love to know more. I have several of these from a Costco kit a couple of years ago. I don't how much time I could dedicate to actually coding (let alone, I have no experience in that - I'm a hardware person), but I might be willing to give it a go since I got a bit more time nowadays.

 

[Corellon]

There's actually nothing coding involved but there is some network configuration needed, windows 10 has changed a few things so if your still on windows 7 or linux then would be much easier for you. This guide was my inspiration to attempting TFTP: Dahua IPC EASY unbricking / recovery over TFTP

Once you have the network configured, the TFTP software running on your computer updating camera's is pretty straight forward (you have to do each one at a time though). The main change from the guide is the firmware used (Can be gotten from the Dahua website, files are listed in my posts) and the command.txt file. Copy the below into the command.txt file (Part of the patch from the guide):

run dr
run dk
run du
run dw
run dp
run dc
tftp 0x2000000 pd-x.squashfs.img; flwrite
tftp 0x2000000 .FLASHING_DONE_STOP_TFTP_NOW
sleep 5

Save it and run command.bat to update the actual config file and now the camera will flash fully, once flashed it will take the stock Dahua firmware from the web interface (I'm not sure if you can do direct to V2.800 firmware, but from Lorex->V2.622 through TFTP and V2.622 to V2.800 through the web interface worked perfectly)

 

[mat200]

Thanks @Corellon for this thread and sharing your experiences with this.

 

[hope__silent]

@Corellon,

Trying to do the same thing to my LNB8005-C's, any idea where to go from here? Default TFTP server didn't work (failed.txt error) so I'm serving from TFTPD64 and it's definitely transferring files I just keep perpetually running into this. I'm trying to follow your same path, tftp v2.622 with your shared command.txt and then v2.800 via gui. Really don't know what I'm missing...

Spoiler: Error

Ncat: Version 7.40 ( https://nmap.org/ncat )
Ncat: Listening on 192.168.254.254:5002
gBootLogPtr:00b80008.
spinor flash ID is 0x1940ef
partition file version 2
rootfstype squashfs root /dev/mtdblock5
can not search bootargs settings
fail to parse bootargsParametersV2.text info
fail to init bootargsParametersV2
TEXT_BASE:01000000
Net:   Detected MACID:00:40:7f:93:ef:49
PHY:0x001cc816,addr:0x00
s3l phy RTL8201 init
MMC:   sdmmc init
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'upgrade_info_7db780a713a4.txt'.Download to address: 0x5000000
Downloading: *
done
Bytes transferred = 199 (c7 hex)
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'romfs-x.squashfs.img'.Download to address: 0x2000000
Downloading: *
TFTP error: (0)cmd Failed run dr!
partition file version 2
rootfstype squashfs root /dev/mtdblock5
fail to load bootargsParameters.txt
fail to load bootargsParameters.txt file
get bootargs info failed
cmdLine console=ttyS0,115200 mem=118M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc

Appreciate any help,
Ryan

 

[Corellon]

After you used the command.txt file did you also run commands.bat file and use the newly generate upgrade_info_7db780a713a4.txt file? Another possibility is that Error code 0 for TFTP is a permissions error, perhaps the path is too long or the tftp server is timing out (I did have to increase the time out value on the default TFTP server to prevent it from timing out)

The other thing I can think of is did you extract the bin file completely and place all files on the TFTP server? I used 7-Zip to extract the bin file, not sure if another extractor could be corrupting the file or not extracting fully.

 

[hope__silent]

Well, I got it partly squared away. I never got a success message and then the default credentials didn't work so I factory reset it. Then I used the config tool to initialize it and I can login to it and from what I can tell it seems to be functional. I did some more reading in the easy upgrade thread and, thanks to @TheDude, figured out exactly what you mentioned above, in his detailed explanation regarding the bin file and each code along with its according file. Now that I'm on 2.622, I'm having issues getting upgraded to 2.800. Tried the web gui and the config tool. Web gives me a "File Unmatch, Upgrade failed!" I'm loading "DH_IPC-HX5X3X-Rhea_MultiLang_NP_Stream3_V2.800.0000008.0.R.190619.bin", my understand is this is likely a "signed" firmware as it's dated after 2017. There was a "sign.img" file with the 2.622 version but I followed the advice of others and removed everything but the files called out in the upgrade text file of the root. Could it have been required? Below is my code from the flash in case you suspect the failure has something to do with this.

Spoiler: Failure

Connection received from 192.168.1.108 on port 3539 [06/04 21:58:59.840]
Read request for file <upgrade_info_7db780a713a4.txt>. Mode octet [06/04 21:58:59.840]
OACK: <timeout=1,tsize=199,blksize=1468,> [06/04 21:58:59.840]
Using local port 51782 [06/04 21:58:59.840]
<upgrade_info_7db780a713a4.txt>: sent 1 blk, 199 bytes in 0 s. 0 blk resent [06/04 21:58:59.844]
Connection received from 192.168.1.108 on port 3694 [06/04 21:58:59.994]
Read request for file <romfs-x.squashfs.img>. Mode octet [06/04 21:58:59.994]
OACK: <timeout=5,tsize=1335360,blksize=1468,> [06/04 21:58:59.994]
Using local port 51783 [06/04 21:58:59.994]
<romfs-x.squashfs.img>: sent 910 blks, 1335360 bytes in 2 s. 0 blk resent [06/04 21:59:01.429]
Connection received from 192.168.1.108 on port 1188 [06/04 21:59:03.632]
Read request for file <kernel.img>. Mode octet [06/04 21:59:03.632]
OACK: <timeout=5,tsize=1569716,blksize=1468,> [06/04 21:59:03.633]
Using local port 51784 [06/04 21:59:03.633]
<kernel.img>: sent 1070 blks, 1569716 bytes in 2 s. 0 blk resent [06/04 21:59:05.365]
Connection received from 192.168.1.108 on port 2335 [06/04 21:59:07.851]
Read request for file <user-x.squashfs.img>. Mode octet [06/04 21:59:07.851]
OACK: <timeout=5,tsize=15523904,blksize=1468,> [06/04 21:59:07.851]
Using local port 61351 [06/04 21:59:07.851]
<user-x.squashfs.img>: sent 10575 blks, 15523904 bytes in 17 s. 0 blk resent [06/04 21:59:24.837]
Connection received from 192.168.1.108 on port 1489 [06/04 21:59:46.941]
Read request for file <web-x.squashfs.img>. Mode octet [06/04 21:59:46.941]
OACK: <timeout=5,tsize=6529088,blksize=1468,> [06/04 21:59:46.941]
Using local port 61359 [06/04 21:59:46.941]
<web-x.squashfs.img>: sent 4448 blks, 6529088 bytes in 8 s. 0 blk resent [06/04 21:59:54.049]
Connection received from 192.168.1.108 on port 2723 [06/04 22:00:03.535]
Read request for file <partition-x.cramfs.img>. Mode octet [06/04 22:00:03.535]
OACK: <timeout=5,tsize=8256,blksize=1468,> [06/04 22:00:03.535]
Using local port 61363 [06/04 22:00:03.535]
<partition-x.cramfs.img>: sent 6 blks, 8256 bytes in 0 s. 0 blk resent [06/04 22:00:03.548]
Connection received from 192.168.1.108 on port 3091 [06/04 22:00:03.902]
Read request for file <custom-x.squashfs.img>. Mode octet [06/04 22:00:03.902]
OACK: <timeout=5,tsize=102464,blksize=1468,> [06/04 22:00:03.902]
Using local port 61364 [06/04 22:00:03.902]
<custom-x.squashfs.img>: sent 70 blks, 102464 bytes in 1 s. 0 blk resent [06/04 22:00:04.028]
Connection received from 192.168.1.108 on port 3673 [06/04 22:00:04.485]
Read request for file <pd-x.squashfs.img>. Mode octet [06/04 22:00:04.485]
OACK: <timeout=5,tsize=45120,blksize=1468,> [06/04 22:00:04.485]
Using local port 61365 [06/04 22:00:04.485]
<pd-x.squashfs.img>: sent 31 blks, 45120 bytes in 0 s. 0 blk resent [06/04 22:00:04.536]
Connection received from 192.168.1.108 on port 4089 [06/04 22:00:04.900]
Read request for file <pd-x.squashfs.img>. Mode octet [06/04 22:00:04.900]
OACK: <timeout=5,tsize=45120,blksize=1468,> [06/04 22:00:04.901]
Using local port 61366 [06/04 22:00:04.901]
<pd-x.squashfs.img>: sent 31 blks, 45120 bytes in 0 s. 0 blk resent [06/04 22:00:04.951]
Connection received from 192.168.1.108 on port 1493 [06/04 22:00:05.377]
Read request for file <failed.txt>. Mode octet [06/04 22:00:05.377]
File <failed.txt> : error 2 in system call CreateFile The system cannot find the file specified. [06/04 22:00:05.378]

My upgrade text file...

Spoiler: Upgrade

CRC:1720558748
MagicString:c016dcd6-cdeb-45df-9fd0-e821bf0e1e62
run dr
run dk
run du
run dw
run dp
run dc
tftp 0x2000000 pd-x.squashfs.img; flwrite
tftp 0x2000000
.FLASHING_DONE_STOP_TFTP_NOW
sleep 5

 

[hope__silent]

Okay, did some further exploration and gethwid via SSH reports the device as IPC-HFW4830EP-S. I used 7-zip to decompress the v2.800 bin and opened the check.img with HxD wherein I found the IPC-HFW4830EP-S listed in it. Don't understand how my HWID could report that and it be listed in the check.img and yet the upgrade still fail for that reason. Tried to get telnet up using instructions I found on here to watch the upgrade process and see if it told me in greater specificity what the issue was but it isn't working. I can open the webpage and enter my credentials and then a text box at the top of the windows says "ok", however telnet connection remains denied.

 

[Corellon]

Sorry for the delay was a busy day yesterday, the file I used to upgrade was: DH_IPC-HX5X3X-Rhea_MultiLang_NP_Stream3_V2.800.0000008.0.R.190619.

I would suspect that the failed.txt is the reason, pd-x-squashfs.img is being transferred but may not be being applied? When you log into the unit do you see the Lorex login or the Dahua? I'm not sure if it's the spoiler code either, but in the command.txt file you posted you have
tftp 0x2000000
.FLASHING_DONE_STOP_TFTP_NOW

It should be a single line ( tftp 0x2000000 .FLASHING_DONE_STOP_TFTP_NOW) as that is what tells the camera to finalize the process I think,

Can you also share a copy of the ncat?

I suspect it's partially flashed but the image signature doesn't match

 

[Corellon]

I just updated the one camera to the latest firmware DH_IPC-HX5X3X-Rhea_MultiLang_PN_Stream3_Market_V2.800.0000014.0.R.191203 through the web interface so it is working, let me know how it worked out for you.

 

[pozzello]

Attempted to update one of my Flir/Lorex LNB8005B-C's to better Dahua FW as described above.

Got and unzipped the suggested FW
DH_IPC-HX5X3X-Rhea_MultiLang_PN_Stream3_V2.800.0000008.0.R.190619
from
Firmwares

TFTP transfer appeared to complete (saw the FLASHING_DONE_STOP_TFPD_NOW message and did so.)

Camera is now not booting, tho wireshark shows it is still ARPing for 192.168.1.1, so i can keep trying, just not sure what I did wrong or how to proceed...

• since the instructions say to NOT update the bootloader, I removed 3 boot-* .bin files from the 'root' dir. Perhaps those should stay for this update?
• changed 0x82000000 to 0x2000000 as instructed (but why?) and ran the Commands batch file.
• screen shot of my 'root' folder and 'commands' text file attached

any ideas?

thanx, Paul.

 

[pozzello]

Maybe I just don't have the same hardware as the OP and others who have succeeded here? I notice now the OP has LNB8005B-C, but mine is LNB8005-C (from its non-dead twin - no B).
perhaps the HWID is different. I didn't know how to check before TFTP'ing. Time to find the serial port, but I see no obvious way to open this puppy up. it's always something...

 

[pozzello]

tried again, with the console up after disabling windows firewall...

 

[Corellon]

Attempted to update one of my Flir/Lorex LNB8005B-C's to better Dahua FW as described above.

Got and unzipped the suggested FW
DH_IPC-HX5X3X-Rhea_MultiLang_PN_Stream3_V2.800.0000008.0.R.190619
from
Firmwares

TFTP transfer appeared to complete (saw the FLASHING_DONE_STOP_TFPD_NOW message and did so.)

Camera is now not booting, tho wireshark shows it is still ARPing for 192.168.1.1, so i can keep trying, just not sure what I did wrong or how to proceed...

• since the instructions say to NOT update the bootloader, I removed 3 boot-* .bin files from the 'root' dir. Perhaps those should stay for this update?
• changed 0x82000000 to 0x2000000 as instructed (but why?) and ran the Commands batch file.
• screen shot of my 'root' folder and 'commands' text file attached

any ideas?

thanx, Paul.

-x820.... to 0x200... was changed due to the flash location used by the specific model, each model is a little different and may have a different flash layout and a different address to flash to.
Do you have a complete console to post? From the looks of it something prior to the line failed, it looks like perhaps from the previous line you need to change 0x2000000 to 0x01880000 as that is where the other images are being flashed too. You can also change the line "tftp 0x2000000 pd-x.squashfs.img; flwrite" to "run pd" as that works on my camera and doesn't need you to set a memory address

 

[pozzello]

got a serial connection on it. repeated tftpd using 'run pd' and 0x01880000 as suggested. command file now has:

printenv
run dr
run dk
run du
run dw
run dp
run dc
run pd
tftp 0x01880000 .FLASHING_DONE_STOP_TFTP_NOW
sleep 5

console boot sequence shows:


Starting kernel ...
▒

U-Boot 2010.06-svn3845 (Dec 18 2016 - 09:32:48)
I2C: ready
DRAM: 118 MiB
gBootLogPtr:00b80008.
spinor flash ID is 0x1940ef
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=130M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc.
TEXT_BASE:01000000
Net: Detected MACID:00:40:7f:8e:d2:8e
PHY:0x001cc816,addr:0x00
s3l phy RTL8201 init

MMC: sdmmc init
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'upgrade_info_7db780a713a4.txt'.
Download to address: 0x5000000
Downloading: *
Retry count exceeded; starting again
Try again use backup_serverip
*** ERROR: `serverip' not set
Failed to get info.txt
Fail to get info file!
Init error!
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'failed.txt'.
Download to address: 0x2000000
Downloading: *
Retry count exceeded; starting again
state:ff,err_count:05
SPI probe: 32768 KiB W25Q256FV at 0:0 is now current device
Wrong Image Format for bootm command
ERROR: can't get kernel image!
try:kload 0x2000000 succeed!
## Booting kernel from Legacy Image at 02000000 ...
Image Name: Linux-3.10.73
Created: 2019-03-06 18:42:53 UTC
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 1570432 Bytes = 1.5 MiB
Load Address: 00208000
Entry Point: 00208000
Verifying Checksum ... OK
Loading Kernel Image ...OK
OK
partition file version 2
rootfstype squashfs root /dev/mtdblock5
fail to load bootargsParameters.txt
fail to load bootargsParameters.txt file
get bootargs info failed
crashflasg:1, logmagic:54410011.

Starting kernel ...


and then repeats after some time. no "Hit any key to stop autoboot" prompt. :-(