Hello,
Dahua's latest v4 firmware comes with a web console that no longer requires the infamous browser addon, so I wanted to upgrade and this is the origin of everything that follows.
References:
[1] [2]
My IKR-NVR5208-8P-4KS2 was fine until the update. I used a USB pen with the default FAT32 and the bin file retrieved at [1]. The original file is "DH_NVR5XXX-4KS2_MultiLang_V4.001.0000000.1.R.2003191.rar", so I unpacked it, and put the .bin file in the USB pen. Nothing else was inside. Pen plugged in, control panel directed towards the file, it starts doing its thing and then reboots. The screen now shows "Dahua 4.0", and reboots in a endless loop.
I contacted both the vendor and the national Dahua distributor. The vendor says they would have to either ship it to China or sell a new one. This is a deja-vue from lazy sellers. The distributor says the vendor is not an authorised dealer. The vendor is huge, so it may well import direct from the manufacturer. Both responses leave me with a sour taste, as I spent half a grand for this thing.
Wearing the elmet of the disappointer customer, I am trying to fix this problem myself. I did my homework, and used what I could find both from Dahua's site and this forum.
Leaving the USB pen inside did not do any good. The filename is "DH_NVR5XXX-4KS2_MultiLang_V4.001.0000000.1.R.200319.bin".
On the national Dahua site I spotted another firmware: it is a zip file containing the following:
The file "install.lua" contains the following code:
The above filenames are not in the folder.
Then I used [2] to enter the serial console and trigger the manual update.
It expects to find "update.img" in a local tftp server.
The required file is not in the folder.
UPDATE
Some of the img files happen to be inside the bin, which seems to be a renamed zip file.
The file "update.img" is still missing.
The file "update.img" must be inside the official ".bin" distribution, so I may have not unzipped it properly.
No joy.
UPDATE
This is the local tftp server on IP 192.168.1.13, delivering the contents of DH_NVR5XXX-4KS2_MultiLang_V4.001.0000000.1.R.200319.bin:
And this is a successful test from macos:
This is the dhcp server:
and this is dahua responding to ping:
This is the serial console from dahua, shown from bootstrap:
At this point, dahua reboots by itself, in a endless loop.
When it says "Hit any key to stop autoboot: 0", press "*" and you are at the "hisilicon" console.
This is the help menu at the console.
The commands "printenv", "sip" and "lip" do not exist [2].
This means that [2] does not correspond to my version of hisilicon.
There are no other versions of [2].
It would be useful if the serial console would print the real MAC, the IP of the DHCP, its own IP, the IP of the DNS, and the IP of the tcpd server, just to show what's working.
UPDATE
That's because the file "update.img" is missing.
Odd, it does not say which file was installed, and the "da" option is supposed to install "armboot-x.bin.img", a file we do not have.
The only file with similar size is u-boot.bin.img.
Reboots by itself.
This must be custom-x.squashfs.img.
Reboots by itself.
This is smaller than romfs-x.squashfs.img.
Reboots by itself.
Infact, I do not have user-x.cramfs.img.
Reboots, again.
It reboots, again.
This was supposed to be web-x.squashfs.img.
It is not so bad, but there are many more to go, and it is not clear how to install them.
There does not seem to exist a manual for the hisilicon serial console, with an explanation of all possible "run" commands.
The key file "update.img" is still missing.
The unit keeps rebooting.
UPDATE
Draws a white 1024x600 window on a 1920x1080 display, shifted 50x50. OK
No data printed.
UPDATE
SmartPSS works on Windows, crashes on MacOS.
On Windows, it does not find the NVR.
dahuawiki.com
STANDPOINT
The NVR is stuck in a loop.
The hisilicon serial console commands "printenv", "sip" and "lip" are not available [2].
The file "update.img" is not available.
However, basic functionality is there, as the console responds to commands and reads from the tftp server.
Installing previous firmware versions is not useful, because they all miss the "update.img" file.
Unsure what to do next.
Dahua's latest v4 firmware comes with a web console that no longer requires the infamous browser addon, so I wanted to upgrade and this is the origin of everything that follows.
References:
[1] [2]
My IKR-NVR5208-8P-4KS2 was fine until the update. I used a USB pen with the default FAT32 and the bin file retrieved at [1]. The original file is "DH_NVR5XXX-4KS2_MultiLang_V4.001.0000000.1.R.2003191.rar", so I unpacked it, and put the .bin file in the USB pen. Nothing else was inside. Pen plugged in, control panel directed towards the file, it starts doing its thing and then reboots. The screen now shows "Dahua 4.0", and reboots in a endless loop.
I contacted both the vendor and the national Dahua distributor. The vendor says they would have to either ship it to China or sell a new one. This is a deja-vue from lazy sellers. The distributor says the vendor is not an authorised dealer. The vendor is huge, so it may well import direct from the manufacturer. Both responses leave me with a sour taste, as I spent half a grand for this thing.
Wearing the elmet of the disappointer customer, I am trying to fix this problem myself. I did my homework, and used what I could find both from Dahua's site and this forum.
Leaving the USB pen inside did not do any good. The filename is "DH_NVR5XXX-4KS2_MultiLang_V4.001.0000000.1.R.200319.bin".
On the national Dahua site I spotted another firmware: it is a zip file containing the following:
DH_NVR5XXX-4KS2_MultiLang_V4.000.0000001.5.R.20191218.bin
install.lua
flash.bin
PartionTable.binThe file "install.lua" contains the following code:
self:updatePart(flashPartions["boot"], "u-boot.bin.img");
--mtd.saveenv();
self:updatePart(flashPartions["uImage"], "uImage.img");
self:updatePart(flashPartions["rootfs"], "romfs-x.squashfs.img");
--self:updatePart(flashPartions["user"], "user-x.squashfs.img");
self:updatePart(flashPartions["bootslave"], "u-boot_slave.bin.img");
self:updatePart(flashPartions["uImageslave"], "uImage_slave.img");
self:updatePart(flashPartions["rootfsslave"], "romfs_slave-x.squashfs.img");
self:updatePart(flashPartions["web"], "web-x.squashfs.img");
self:updatePart(flashPartions["custom"], "custom-x.squashfs.img");
--²Á³ýlogoÐèÒªÔö¼ÓºóÃæµÄÌõ¼þÅжϣ¬¶Ô¿Í»§×Ô¶¨ÒåÉý¼¶µÄlogo²»É¾³ý
--self:updatePart(flashPartions["logo"], "logo-x.squashfs.img");
self:updatePart(flashPartions["pmfirmware"], "575S_PMX.bin.img");
self:updatePart(flashPartions["rootfs2"], "romfs2-x.squashfs.img");
--self:InstallPlayer("autoplayer.bin");The above filenames are not in the folder.
Then I used [2] to enter the serial console and trigger the manual update.
It expects to find "update.img" in a local tftp server.
The required file is not in the folder.
UPDATE
Some of the img files happen to be inside the bin, which seems to be a renamed zip file.
> mv DH_NVR5XXX-4KS2_MultiLang_V4.001.0000000.1.R.200319.bin test.bin.zip;
> unzip test.bin.zip
Archive: test.bin.zip
file #1: bad zipfile offset (local header sig): 0
inflating: u-boot.bin.img
inflating: uImage.img
inflating: romfs-x.squashfs.img
inflating: u-boot_slave.bin.img
inflating: uImage_slave.img
inflating: romfs_slave-x.squashfs.img
inflating: web-x.squashfs.img
inflating: custom-x.squashfs.img
inflating: logo-x.squashfs.img
inflating: 575S_PMX.bin.img
inflating: romfs2-x.squashfs.img
extracting: sign.img
> rm -f test.bin.zip
The file "update.img" is still missing.
The file "update.img" must be inside the official ".bin" distribution, so I may have not unzipped it properly.
>file DH_NVR5XXX-4KS2_MultiLang_V4.001.0000000.1.R.200319.bin
DH_NVR5XXX-4KS2_MultiLang_V4.001.0000000.1.R.200319.bin: data
> xxd -l 32 DH_NVR5XXX-4KS2_MultiLang_V4.001.0000000.1.R.200319.bin
00000000: 4448 0304 1400 0000 0800 4e8b 7350 b66c DH........N.sP.l
00000010: 84f3 4f12 0000 6739 0000 0b00 1500 496e ..O...g9......In
> hexedit DH_NVR5XXX-4KS2_MultiLang_V4.001.0000000.1.R.200319.bin
[change the first two bytes from "DH" to "PK"]
> xxd -l 32 DH_NVR5XXX-4KS2_MultiLang_V4.001.0000000.1.R.200319.bin
00000000: 504b 0304 1400 0000 0800 4e8b 7350 b66c PK........N.sP.l
00000010: 84f3 4f12 0000 6739 0000 0b00 1500 496e ..O...g9......In
>file DH_NVR5XXX-4KS2_MultiLang_V4.001.0000000.1.R.200319.bin
DH_NVR5XXX-4KS2_MultiLang_V4.001.0000000.1.R.200319.bin: Zip archive data, at least v2.0 to extract
>unzip DH_NVR5XXX-4KS2_MultiLang_V4.001.0000000.1.R.200319.bin
Archive: DH_NVR5XXX-4KS2_MultiLang_V4.001.0000000.1.R.200319.bin
inflating: Install.lua
inflating: u-boot.bin.img
inflating: uImage.img
inflating: romfs-x.squashfs.img
inflating: u-boot_slave.bin.img
inflating: uImage_slave.img
inflating: romfs_slave-x.squashfs.img
inflating: web-x.squashfs.img
inflating: custom-x.squashfs.img
inflating: logo-x.squashfs.img
inflating: 575S_PMX.bin.img
inflating: romfs2-x.squashfs.img
extracting: sign.img
No joy.
UPDATE
This is the local tftp server on IP 192.168.1.13, delivering the contents of DH_NVR5XXX-4KS2_MultiLang_V4.001.0000000.1.R.200319.bin:
> ls -halF /var/tftp/
total 98104
drwxr-xr-x 14 root wheel 448B Jul 17 18:07 ./
drwxr-xr-x 43 root wheel 1.3K Jul 17 18:28 ../
-rw-r--r-- 1 root wheel 14K Mar 19 10:26 575S_PMX.bin.img
-rw-r--r-- 1 root wheel 4.1K Mar 19 10:26 custom-x.squashfs.img
-rw-r--r-- 1 root wheel 44K Mar 19 10:26 logo-x.squashfs.img
-rw-r--r-- 1 root wheel 19M Mar 19 10:26 romfs-x.squashfs.img
-rw-r--r-- 1 root wheel 13M Mar 19 10:26 romfs2-x.squashfs.img
-rw-r--r-- 1 root wheel 5.3M Mar 19 10:26 romfs_slave-x.squashfs.img
-rw-r--r-- 1 root wheel 128B Mar 19 10:26 sign.img
-rw-r--r-- 1 root wheel 362K Mar 19 10:26 u-boot.bin.img
-rw-r--r-- 1 root wheel 106K Mar 19 10:26 u-boot_slave.bin.img
-rw-r--r-- 1 root wheel 2.9M Mar 19 10:26 uImage.img
-rw-r--r-- 1 root wheel 1.7M Mar 19 10:26 uImage_slave.img
-rw-r--r-- 1 root wheel 5.3M Mar 19 10:26 web-x.squashfs.img
> sudo /usr/local/sbin/in.tftpd -4 -s -v -L /var/tftp
And this is a successful test from macos:
> tftp -4 -v 192.168.1.13 69 -c get sign.img
Connected to 192.168.1.13 (192.168.1.13), port 69
getting from 192.168.1.13:sign.img to sign.img [netascii]
Received 129 bytes in 0.1 seconds [20428 bit/s]This is the dhcp server:
host dahua.local {
option host-name "dahua";
hardware ethernet [MAC ADDRESS];
fixed-address 192.168.1.26;
option domain-name "local";
option domain-name-servers 192.168.1.6;
option tftp-server-name "server.local";
}and this is dahua responding to ping:
Request timeout for icmp_seq 1645
Request timeout for icmp_seq 1646
64 bytes from 192.168.1.26: icmp_seq=1647 ttl=64 time=1.702 ms
64 bytes from 192.168.1.26: icmp_seq=1648 ttl=64 time=0.875 ms
64 bytes from 192.168.1.26: icmp_seq=1649 ttl=64 time=0.910 ms
64 bytes from 192.168.1.26: icmp_seq=1650 ttl=64 time=0.887 ms
64 bytes from 192.168.1.26: icmp_seq=1651 ttl=64 time=0.881 ms
64 bytes from 192.168.1.26: icmp_seq=1652 ttl=64 time=0.875 ms
Request timeout for icmp_seq 1653
Request timeout for icmp_seq 1654This is the serial console from dahua, shown from bootstrap:
Special NAND id table Version 1.36
Nand ID: 0xEF 0xF1 0x80 0x95 0x00 0x00 0x00 0x00
stmmac_init,550,0x70431,3
MAC: 00-00-23-34-45-66
U-Boot 2010.06-svn4440 (Jan 03 2020 - 14:54:14)
In: serial
Out: serial
Err: serial
squashfs use gzip
SCU: load slave image OK
spi env sysbackup=0
Read backup misc byte ... no env and backup env tc !!!
ok!
GpioI2cMcuRecvAck 114 err
__FUNCTION__ = GpioI2cReadByteMcu, __LINE__ = 244
GpioI2cReadByteMcu faield
[is2uProduct] get failed
PRODUCT:1U
stmmac_init,692,0x70431,3
Hit any key to stop autoboot: 0
stmmac_init,692,0x70431,3
stmmac_init,692,0x70431,3
NET_autoLipDetect timeout
stmmac_init,692,0x70431,3
T T T T T
Retry count exceeded; starting again
## Booting kernel from Legacy Image at 42000000 ...
Image Name: Linux-3.10.0_hi3536
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 3001632 Bytes = 2.9 MiB
Load Address: 40008000
Entry Point: 40008000
Loading Kernel Image ... OK
OK
Starting kernel ...
Uncompressing Linux... done, booting the kernelAt this point, dahua reboots by itself, in a endless loop.
When it says "Hit any key to stop autoboot: 0", press "*" and you are at the "hisilicon" console.
This is the help menu at the console.
hisilicon # help
? - alias for 'help'
autoup - load update file from server
boot - boot kernel from uboot
bootm - boot application image from memory
decjpg - jpgd - decode jpeg picture.
devid - devid - set hardware id and save to flash
eracfg - eracfg - erase config sectors
eralogo - eralogo - erase logo sectors
fb_set - fb_set - get shift key
fb_test - fb_test - frontboard read/write test
get_key - get_key - get shift key
help - print command description/usage
hwid - hwid - set hardware id and save to flash
kaimendaji- - kai men da ji
lock_otp- lock_otp - otp lock
lock_status- lock_status - get otp lock status
mac - mac - set mac address and save to flash
mac1 - mac1 - set mac1 address and save to flash
nand - NAND sub-system
nandops - flwrite - write img data into FLASH from memory
otp_printf- otp_printf - printf otp value
partload- partload - load binary file from a partition
ping - send ICMP ECHO_REQUEST to network host
reset - Perform RESET of the CPU
run - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv - set environment variables
show_hello- - hello world
showlogo- showlogo - show the logo picture on screen.
startgx - startgx - open graphics layer.
- startgx [layer addr stride x y w h]
startvl - startvl - open video layer.
- startvl [layer addr stride x y w h]
startvo - startvo - open interface of vo device.
- startvo [dev type sync]
stopgx - stopgx - close graphics layer.
- stopgx [layer]
stopvl - stopvl - close video layer.
- stopvl [layer]
stopvo - stopvo - close interface of vo device.
- stopvo [dev]
version - print monitor version
vobgset - setvobg - set vo backgroud color.
- setvobg [dev color]
xhprint - - hello world
xhprintenv- print environment variables
hisilicon #The commands "printenv", "sip" and "lip" do not exist [2].
This means that [2] does not correspond to my version of hisilicon.
There are no other versions of [2].
It would be useful if the serial console would print the real MAC, the IP of the DHCP, its own IP, the IP of the DNS, and the IP of the tcpd server, just to show what's working.
hisilicon # ping 192.168.1.13
stmmac_init,692,0x70431,3
host 192.168.1.13 is alive
hisilicon # ping 192.168.1.6
stmmac_init,692,0x70431,3
host 192.168.1.6 is alive
hisilicon #
hisilicon # autoup
stmmac_init,692,0x70431,3
stmmac_init,692,0x70431,3
NET_autoLipDetect timeout
stmmac_init,692,0x70431,3
T T T T T
Retry count exceeded; starting againUPDATE
hisilicon # run up
stmmac_init,692,0x70431,3
TFTP error: 'File not found' (1)
Not retrying...
do_tftp_secure failedThat's because the file "update.img" is missing.
hisilicon # run da
stmmac_init,692,0x70431,3
#################################################
done
Bytes transferred = 370896 (5a8d0 hex)
boottype=1:
dh_wdt_stop called
flash_do_flwrite,723,ret:-29,flash_sn:1
Header CRC Checking ... OK
Data CRC Checking ... OK
check ok
Image Name: NVR5XXX-4K
Image Type: ARM Linux Firmware (gzip compressed)
Data Size: 370832 Bytes = 362.1 KiB
Load Address: a0200000
Entry Point: a0300000
Programing start at: 0xa0200000
write : 66%
write : 100%
done
Erasing Nand...
Writing to Nand... done
dh_wdt_start called
hisilicon #Odd, it does not say which file was installed, and the "da" option is supposed to install "armboot-x.bin.img", a file we do not have.
The only file with similar size is u-boot.bin.img.
Reboots by itself.
hisilicon # run dc
stmmac_init,692,0x70431,3
#################################################
done
Bytes transferred = 4160 (1040 hex)
boottype=1:
dh_wdt_stop called
flash_do_flwrite,723,ret:-29,flash_sn:1
Header CRC Checking ... OK
Data CRC Checking ... OK
check ok
Image Name: NVR5XXX-4K
Image Type: ARM Linux Standalone Program (gzip compressed)
Data Size: 4096 Bytes = 4 KiB
Load Address: a3800000
Entry Point: a3a00000
Programing start at: 0xa3800000
write : 0%
write : 100%
done
dh_wdt_start called
hisilicon # This must be custom-x.squashfs.img.
Reboots by itself.
hisilicon # run dr
stmmac_init,692,0x70431,3
#################################################
done
Bytes transferred = 19841088 (12ec040 hex)
boottype=1:
dh_wdt_stop called
flash_do_flwrite,723,ret:-29,flash_sn:1
Header CRC Checking ... OK
Data CRC Checking ... OK
check ok
Image Name: NVR5XXX-4K
Image Type: ARM Linux Kernel Image (gzip compressed)
Data Size: 19841024 Bytes = 18.9 MiB
Load Address: a0700000
Entry Point: a2100000
Programing start at: 0xa0700000
write : 99%
write : 100%
done
dh_wdt_start called
hisilicon #This is smaller than romfs-x.squashfs.img.
Reboots by itself.
hisilicon # run du
stmmac_init,692,0x70431,3
TFTP error: 'File not found' (1)
Not retrying...
do_tftp_secure failed
hisilicon # Infact, I do not have user-x.cramfs.img.
Reboots, again.
hisilicon # run dl
stmmac_init,692,0x70431,3
#################################################
done
Bytes transferred = 45120 (b040 hex)
boottype=1:
dh_wdt_stop called
flash_do_flwrite,723,ret:-29,flash_sn:1
Header CRC Checking ... OK
Data CRC Checking ... OK
check ok
Image Name: NVR5XXX-4K
Image Type: ARM Linux Standalone Program (gzip compressed)
Data Size: 45056 Bytes = 44 KiB
Load Address: a3a00000
Entry Point: a3c00000
Programing start at: 0xa3a00000
write : 0%
write : 100%
done
dh_wdt_start called
hisilicon #It reboots, again.
hisilicon # run dw
stmmac_init,692,0x70431,3
#################################################
done
Bytes transferred = 5578816 (552040 hex)
boottype=1:
dh_wdt_stop called
flash_do_flwrite,723,ret:-29,flash_sn:1
Header CRC Checking ... OK
Data CRC Checking ... OK
check ok
Image Name: NVR5XXX-4K
Image Type: ARM Linux Standalone Program (gzip compressed)
Data Size: 5578752 Bytes = 5.3 MiB
Load Address: a4000000
Entry Point: a5400000
Programing start at: 0xa4000000
write : 97%
write : 100%
done
dh_wdt_start called
hisilicon #This was supposed to be web-x.squashfs.img.
It is not so bad, but there are many more to go, and it is not clear how to install them.
There does not seem to exist a manual for the hisilicon serial console, with an explanation of all possible "run" commands.
The key file "update.img" is still missing.
The unit keeps rebooting.
UPDATE
hisilicon # startgx 0 0x8AC00000 1920 50 50 1024 600
graphic layer 0 opened!Draws a white 1024x600 window on a 1920x1080 display, shifted 50x50. OK
hisilicon # xprintenvNo data printed.
UPDATE
SmartPSS works on Windows, crashes on MacOS.
On Windows, it does not find the NVR.
DahuaWiki
dahuawiki.com
STANDPOINT
The NVR is stuck in a loop.
The hisilicon serial console commands "printenv", "sip" and "lip" are not available [2].
The file "update.img" is not available.
However, basic functionality is there, as the console responds to commands and reads from the tftp server.
Installing previous firmware versions is not useful, because they all miss the "update.img" file.
Unsure what to do next.
Last edited:
