Smartening up the Lorex LNB8005C 8MP mini bullet.

Tsu Ko

n3wb
Joined
Jan 17, 2019
Messages
25
Reaction score
4
Location
NY
I’ve updated other cameras such as Amcrest and LaView Saturn to the dahua firmware which opens up a lot more options and to also have updated firmware that will hopefully have less vulnerabilities to attacks. The ability to view the camera from the web directly is also a bonus as currently the only way I can view it directly is thru pss software. I’ve got 8 of these cameras so the payoff to successfully change the firmware is of value.
 

pozzello

Known around here
Joined
Oct 7, 2015
Messages
2,270
Reaction score
1,117
@Tsu Ko, I just got a used LNB8111 to play with. mine does report HWID IPC-HFW4830EP-S in the magicbox URL:


appAutoStart=true
deviceType=LNB8111
hardwareVersion=1.00
processor=S3LM
serialNumber=ND051812000996
updateSerial=IPC-HFW4830EP-S
updateSerialCloudUpgrade=IPC-HFW4830EP-S:01:02:03:50:21:00:01:00:00:00:04:2D0:00:00:00:00:00:01:00:00:200

currently on Lorex v20 fw:

lnb8111 version.PNG

will see what i can do about that...
 

pozzello

Known around here
Joined
Oct 7, 2015
Messages
2,270
Reaction score
1,117
for posterity, 'printenv' and 'help' commands before the update:

Ncat: Version 7.40 ( Ncat - Netcat for the 21st Century )
Ncat: Listening on 192.168.254.254:5002
gBootLogPtr:00b80008.
spinor flash ID is 0x1940ef
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=130M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc.
TEXT_BASE:01000000
Net: Detected MACID:00:1f:54:32:ca:98
PHY:0x001cc816,addr:0x00
s3l phy RTL8201 init
partition file version 2
rootfstype squashfs root /dev/mtdblock5
MMC: sdmmc init
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.251; sending through gateway 192.168.1.1Download Filename 'upgrade_info_7db780a713a4.txt'.Download to address: 0x5000000
Downloading: *
done
Bytes transferred = 132 (84 hex)
string value is 0
The end of file
bootargs=console=ttyS0,115200 mem=118M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrcbootcmd=sf read 0x2000000 0xf0000 0x180000;bootm 0x2000000bootdelay=3baudrate=115200ipaddr=192.168.1.108serverip=192.168.1.1autoload=yesgatewayip=192.168.1.1netmask=255.255.255.0da=tftp 0x02000000 dhboot.bin.img; flwrite;tftp dhboot-min.bin.img;flwritedr=tftp 0x02000000 romfs-x.squashfs.img; flwritedk=tftp 0x02000000 kernel.img; flwritedu=tftp 0x02000000 user-x.squashfs.img; flwritedw=tftp 0x02000000 web-x.squashfs.img; flwritedp=tftp 0x02000000 partition-x.cramfs.img;flwritedc=tftp 0x02000000 custom-x.squashfs.img; flwriteup=tftp 0x02000000 update.img; flwritetk=tftp 0x02000000 uImage; bootmdh_keyboard=1sysbackup=1logserver=127.0.0.1loglevel=4 autosip=192.168.254.254autogw=192.168.1.1autonm=255.255.255.0pd=tftp 0x02000000 pd-x.squashfs.img; flwriteethact=ambarella macBSN=4L04615PAX00125HWID=IPC-HFW4830EP-S:01:02:03:50:21:00:01:00:00:00:04:2D0:00:00:00:00:00:01:00:00:200hwidEx=00:02:00:00:00:00:00:00:00:00:00:00:00:00:00:00ID=ND051812000996devalias=LNB8111ethaddr=00:1F:54:32:CA:98appauto=1autolip=192.168.1.251mp_autotest=0stdin=serialstdout=serialstderr=serialfilesize=84fileaddr=5000000
Environment size: 1236/131068 bytes
? - alias for 'help'
backup - backup - manual backup program.

base - print or set address offset
bdinfo - print Board Info structure
boot - boot default, i.e., run 'bootcmd'
bootd - boot default, i.e., run 'bootcmd'
bootf - boot from flash
bootm - boot application image from memory
bootp - boot image via network using BOOTP/TFTP protocol
cfgRestore- erase config and backup partition.

cmp - memory compare
coninfo - print console devices and information
cp - memory copy
crc32 - checksum calculation
dcache - enable or disable data cache
dhcp - boot image via network using DHCP/TFTP protocol
echo - echo args to console
editenv - edit environment variable
erasepart- erasepart

exit - exit script
false - do nothing, unsuccessfully
fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls - list files in a directory (default /)
flwrite - flwrite - write data into FLASH memory

fsinfo - print information about filesystems
fsload - load binary file from a filesystem image
go - start application at address 'addr'
gpio - gpio test
help - print command description/usage
hwid - hwid - set hardware id and save to flash

i2c - I2C sub-system
icache - enable or disable instruction cache
iminfo - print header information for application image
itest - return true/false on integer compare
kload - kload - load uImage file from parttion

lip - lip - set local ip address but not save to flash

loadb - load binary file over serial line (kermit mode)
loads - load S-Record file over serial line
loady - load binary file over serial line (ymodem mode)
logsend - get log buf
loop - infinite loop on address range
ls - list files in a directory (default /)
mac - mac - set mac address and save to flash

md - memory display
memsize - memsize - set mem size

mii - MII utility commands
mm - memory modify (auto-incrementing address)
mmc - MMC sub system
mmcinfo - mmcinfo <dev num>-- display MMC info
mtest - simple RAM read/write test
mw - memory write (fill)
nfs - boot image via network using NFS protocol
nm - memory modify (constant address)
partition- print partition information
ping - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
rarpboot- boot image via network using RARP/TFTP protocol
rdefault- rdefault -recover default env

reset - Perform RESET of the CPU
run - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv - set environment variables
sf - SPI flash sub-system
showvar - print local hushshell variables
sip - sip - set server ip address but not save to flash

sleep - delay execution for some time
source - run script from memory
sync_uboot- sync_uboot - sync uboot to uboot-bak

test - minimal test like /bin/sh
tftpboot- tftpboot- boot image via network using TFTP protocol
true - do nothing, successfully
upmh - mcu heat upgraded
usleep - delay execution for some time
version - print monitor version
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.251; sending through gateway 192.168.1.1Download Filename '.FLASHING_DONE_STOP_TFTP_NOW'.Download to address: 0x2000000
Downloading: #
done
partition file version 2
rootfstype squashfs root /dev/mtdblock5
fail to load bootargsParameters.txt
fail to load bootargsParameters.txt file
cmdLine console=ttyS0,115200 mem=130M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc
Erasing SPI flash...
Writing to SPI flash...
partition file version 2
rootfstype squashfs root /dev/mtdblock5
half-boot found, check bst
done
 

pozzello

Known around here
Joined
Oct 7, 2015
Messages
2,270
Reaction score
1,117
The LNB8111 (on Lorex v20 fw) took the Dahua FW DH_IPC-HX5X3X-Rhea_MultiLang_PN_Stream3_V2.800.0000013.0.R.191202 directly via tftpd.
Didn't need to first flash the intermediary DH_IPC-HX5X3X-Rhea_EngSpnFrn_N_Stream3_V2.460.0000000.16.R.20170904.bin before going to v2.800.
I re-upgraded to the same from the GUI after TFTP, which may have updated the bootloader, but the result is a Dahua 4830EP-S (minus the SD card).
lorex lnb8111 now dahua.PNG

the DevAlias (which is shown the UI and Dahua config tool) can be set to whatever you like with a 'sentenv' in the tftp command file...

So the upshot is that the LNB8111 is for all intents and purposes identical to the LNB8005 and gets a few enhancements with update to Dahua firmware. Nice.
 
Last edited:

Tsu Ko

n3wb
Joined
Jan 17, 2019
Messages
25
Reaction score
4
Location
NY
The LNB8111 (on Lorex v20 fw) took the Dahua FW DH_IPC-HX5X3X-Rhea_MultiLang_PN_Stream3_V2.800.0000013.0.R.191202 directly via tftpd.
Didn't need to first flash the intermediary DH_IPC-HX5X3X-Rhea_EngSpnFrn_N_Stream3_V2.460.0000000.16.R.20170904.bin before going to v2.800.
I re-upgraded to the same from the GUI after TFTP, which may have updated the bootloader, but the result is a Dahua 4830EP-S (minus the SD card).
View attachment 80385

the DevAlias (which is shown the UI and Dahua config tool) can be set to whatever you like with a 'sentenv' in the tftp command file...

So the upshot is that the LNB8111 is for all intents and purposes identical to the LNB8005 and gets a few enhancemnents with update to Dahua firmware. nice.
so I should download something like tftpd64 and do the upgrade from there? It’s early and the brain is foggy.
 

Night-Owl

Pulling my weight
Joined
Jan 14, 2018
Messages
309
Reaction score
112
Do verify before upgrade!! Thank you !!
Hello

Sorry, I am trying to catch up with everything. Has a way been found to update a Lorex E891AB or Lorex NVR N841A8P aka with updateSerial=DHI-NVR4108HS-8P-4KS2 from the Web GUI or other method ?, Thank you
 

bitcaptain

n3wb
Joined
Mar 30, 2021
Messages
6
Reaction score
0
Location
Home
I have a silly question. How do I open up these things? (lnb8005c) Thanks in advance!
 

pozzello

Known around here
Joined
Oct 7, 2015
Messages
2,270
Reaction score
1,117
use a small flat screwdriver or spudger to pick up and peel off the front cover and reveal 4 philips screws. the adhesive is decent enuf that you can re-apply later.
 

bitcaptain

n3wb
Joined
Mar 30, 2021
Messages
6
Reaction score
0
Location
Home
After reading alastairstevenson post, I am guessing the the run commands are just uboot aliases to run other commands the it already knows about. In other words, having run command mixed with tftp commands is likely redundant.

These just run the env aliases:
run dk
run dp
run dr
run pd
run du
run dc
run dw

Which are just direct aliases to these:

tftp 0x02000000 kernel.img; flwrite
tftp 0x02000000 partition-x.cramfs.img;flwrite
tftp 0x02000000 romfs-x.squashfs.img; flwrite
tftp 0x02000000 pd-x.squashfs.img; flwrite
tftp 0x02000000 user-x.squashfs.img; flwrite
tftp 0x02000000 custom-x.squashfs.img; flwrite
tftp 0x02000000 web-x.squashfs.img; flwrite

I will report back what I find out. I will probably crack the case on one of these and grab the Lorex image if anyone wants it. Just a plain old SPI rom... W25Q256FV use these everyday.

Yes: the run commands are aliases and not required in the command file. Likely either will work, but the uboot env has to have them set to match.

 
Last edited:

pozzello

Known around here
Joined
Oct 7, 2015
Messages
2,270
Reaction score
1,117
yes, the run commands are aliases defined in the current bootloader environment and it's important to make sure the new FW has the same .img files as defined in the env, tho Not all of them need to be replaced (particularly the boot loader itself) tho.

and as for Lorex FW, we already have (some) versions posted here somewhere. I can't seem to find that post atm tho.

edit: found the post i was thinking of, but it's for the E891ab, not the lnb8005c. (stock lorex fw's from a Dahua Rep): Lorex E891AB (aka IPC-HFW1841EN-PV)
 
Last edited:
Top