Dahua IPC unbricking / recovery over serial UART and TFTP

AAMamun

n3wb
Joined
Oct 4, 2018
Messages
3
Reaction score
0
Location
Bangladesh.Dhaka
Something is still wrong?
Code:
▒

U-Boot 2010.06-svn4911 (Sep 04 2017 - 11:31:28)
I2C:   ready
DRAM:  118 MiB
gBootLogPtr:00b80008.
spinor flash ID is 0x1940ef
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=118M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc.
TEXT_BASE:01000000
Net:   Detected MACID:e0:50:8b:11:04:11
PHY:0x001cc816,addr:0x00
s3l phy RTL8201 init

MMC:   sdmmc init
link down
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'upgrade_info_7db780a713a4.txt'.
Download to address: 0x5000000
Downloading: *
Retry count exceeded; starting again
Try again use backup_serverip
*** ERROR: `serverip' not set
Failed to get info.txt
Fail to get info file!
Init error!
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'failed.txt'.
Download to address: 0x2000000
Downloading: *
Retry count exceeded; starting again
Support backupVer:255
state:ff,err_count:04
SPI probe: 32768 KiB W25Q256FV at 0:0 is now current device
## Booting kernel from Legacy Image at 02000000 ...
   Image Name:   Linux-3.10.73
   Created:      2017-09-04   2:58:37 UTC
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    1534196 Bytes = 1.5 MiB
   Load Address: 00208000
   Entry Point:  00208000
   Verifying Checksum ... OK
   Loading Kernel Image ...OK
OK
partition file version 2
rootfstype squashfs root /dev/mtdblock5
fail to load bootargsParameters.txt
fail to load bootargsParameters.txt file
crashflasg:1, logmagic:54410011.

Starting kernel ...
▒

U-Boot 2010.06-svn4911 (Sep 04 2017 - 11:31:28)
I2C:   ready
DRAM:  118 MiB
gBootLogPtr:00b80008.
spinor flash ID is 0x1940ef
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=118M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc.
TEXT_BASE:01000000
Net:   Detected MACID:e0:50:8b:11:04:11
PHY:0x001cc816,addr:0x00
s3l phy RTL8201 init

MMC:   sdmmc init
Hit any key to stop autoboot:  0
>*********************************************
Unknown command '*********************************************' - try 'help'
>setenv ipaddr 192.168.0.19
>setenv gatewayip 192.168.0.1
>setenv netmask 255.255.255.0
>setenv serverip 192.168.0.78
>ping $serverip
Using ambarella mac device

Abort
ping failed; host 192.168.0.78 is not alive
>run dr
Using ambarella mac device
TFTP from server 192.168.0.78; our IP address is 192.168.0.19
Download Filename 'romfs-x.squashfs.img'.
Download to address: 0x2000000
Downloading: #################################################################
         #################################################################
         #################################################################
         ##############################################################
done
Bytes transferred = 1310784 (140040 hex)

## Checking Image at 02000000 ...
   Legacy image found
   Image Name:   romfs
   Created:      2017-09-04   7:52:44 UTC
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    1310720 Bytes = 1.3 MiB
   Load Address: 00270000
   Entry Point:  003c0000
   Verifying Checksum ... OK
Programing start at: 0x00270000
SPI probe: 32768 KiB W25Q256FV at 0:0 is now current device
write : 100%
done
>run dk
Using ambarella mac device
TFTP from server 192.168.0.78; our IP address is 192.168.0.19
Download Filename 'kernel.img'.
Download to address: 0x2000000
Downloading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         ########################################
done
Bytes transferred = 1534324 (176974 hex)

## Checking Image at 02000000 ...
   Legacy image found
   Image Name:   kernel
   Created:      2017-09-04   7:52:39 UTC
   Image Type:   ARM Linux Firmware (uncompressed)
   Data Size:    1534260 Bytes = 1.5 MiB
   Load Address: 000f0000
   Entry Point:  00270000
   Verifying Checksum ... OK
Programing start at: 0x000f0000
write : 100%
done
>run du
Using ambarella mac device
TFTP from server 192.168.0.78; our IP address is 192.168.0.19
Download Filename 'user-x.squashfs.img'.
Download to address: 0x2000000
Downloading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################
done
Bytes transferred = 15224896 (e85040 hex)

## Checking Image at 02000000 ...
   Legacy image found
   Image Name:   user
   Created:      2017-09-04   7:53:00 UTC
   Image Type:   ARM Linux Standalone Program (uncompressed)
   Data Size:    15224832 Bytes = 14.5 MiB
   Load Address: 00a40000
   Entry Point:  01a70000
   Verifying Checksum ... OK
Programing start at: 0x00a40000
write : 100%
done
>run dw
Using ambarella mac device
TFTP from server 192.168.0.78; our IP address is 192.168.0.19
Download Filename 'web-x.squashfs.img'.
Download to address: 0x2000000
Downloading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ######################
done
Bytes transferred = 6434880 (623040 hex)

## Checking Image at 02000000 ...
   Legacy image found
   Image Name:   web
   Created:      2017-09-04   7:52:46 UTC
   Image Type:   ARM Linux Standalone Program (uncompressed)
   Data Size:    6434816 Bytes = 6.1 MiB
   Load Address: 003c0000
   Entry Point:  00a40000
   Verifying Checksum ... OK
Programing start at: 0x003c0000
write : 100%
done
>run dp
Using ambarella mac device
TFTP from server 192.168.0.78; our IP address is 192.168.0.19
Download Filename 'partition-x.cramfs.img'.
Download to address: 0x2000000
Downloading: *
ARP Retry count exceeded; starting again
>run dc
Using ambarella mac device
TFTP from server 192.168.0.78; our IP address is 192.168.0.19
Download Filename 'custom-x.squashfs.img'.
Download to address: 0x2000000
Downloading: *
ARP Retry count exceeded; starting again
>save
Saving Environment to SPI Flash...
Erasing SPI flash...
Writing to SPI flash...
done
>
run dp and run dc looks strange.

after reboot it shows only starting kernel and nothing else, so I thought it hasn´t sucseeded. But I was wrong. After loading defaults with camera button it can configure it through config tool.
I didn´t checked if the serial output shows more than loading kernel and if this behavior is normal.


Please send me your update instruction .or video
thank you
 

margan

Young grasshopper
Joined
Oct 27, 2018
Messages
37
Reaction score
1
Location
Italy
Hi,
trying to unbrick my VTO with the tools described here, following is the code I read:
Code:
U-Boot 2010.06-svn2661 (Jul 10 2015 - 17:23:04)
DRAM:  1 GiB
gBootLogPtr:80b80008.
NAND:  Check nand flash controller v610. found
Special NAND id table Version 1.36
Nand ID: 0x98 0xF1 0x80 0x15 0xF2 0x16 0x08 0x00
NAND_ECC_NONE selected by board driver. This is not recommended !!
128 MiB
partition file version 2
rootfstype squashfs root /dev/mtdblock7
In:    serial
Out:   serial
Err:   serial
TEXT_BASE:81000000
Net:   PHY found at 3

state:ff,err_count:02
ETH0: PHY(phyaddr=-1, rmii) not link!
Try again use backup_serverip
ETH0: PHY(phyaddr=-1, rmii) not link!
Failed to get info.txt
Fail to get info file!
Init error!
ETH0: PHY(phyaddr=-1, rmii) not link!
## Booting kernel from Legacy Image at 82000000 ...
   Image Name:   Linux-3.4.35
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    2232408 Bytes = 2.1 MiB
   Load Address: 80008000
   Entry Point:  80008000
   Loading Kernel Image ...OK
OK
partition file version 2
rootfstype squashfs root /dev/mtdblock7
fail to load bootargsParameters.txt
fail to load bootargsParameters.txt file
get bootargs info failed
cmdLine mem=349M console=ttyS0,115200 root=/dev/mtdblock7 rootfstype=squashfs
crashflasg:1, logmagic:54410011.

Starting kernel ...
Uncompressing Linux... done, booting the kernel.
And nothing happens :blankstare:
 

riogrande75

Pulling my weight
Joined
Oct 19, 2017
Messages
390
Reaction score
140
Location
AUSTRIA
Obviously you do not get a ethernet link
Code:
ETH0: PHY(phyaddr=-1, rmii) not link!
- try different switchport settings.
Unless you do not get a eth link, you can off course not flash anything via tftp.
 

margan

Young grasshopper
Joined
Oct 27, 2018
Messages
37
Reaction score
1
Location
Italy
Thanks for answer. That attempt was made without ethernet cable plugged in, using a software called terminal, because putty initially was unable to connect.
Yesterday finally putty worked fine. With * pushed I was able to obtain what show us on first post of this thread. This evening I'll try further steps. Finally I have to add that in VTO3221/3211 model the uart is different and when my work reaches the espected results, as I hope, I will post pictures that could be useful for others. Meantime I hope for an help here for the further steps.
 

margan

Young grasshopper
Joined
Oct 27, 2018
Messages
37
Reaction score
1
Location
Italy
Extract the firmware image for your camera somewhere, use some ZIP program like 7zip. It might complain about invalid ZIP file (since Dahua changes the ZIP header from PK to DH) you can either fix the ZIP with a HEX editor or use another program to unzip it.
First of all I need to understand exactly what does it mean:
my firmware image is a file .bin, is this file to be "extracted" ? File .bin to me is not an archive. Or it means that in this image.bin I can find subset of image files to do this?:
Start the TFTP server and point it to the files you have extracted from the firmware image.

And now for the final part: Flashing the firmware!
I'll flash following partitions in order:
  • romfs (root linux filesystem with busybox)
  • kernel (The holy Linux Kernel)
  • user (Dahuas programs and kernel modules)
  • web (Webinterface)
  • partition ("Partition table" - text files which describe the layout on the flash chip)
  • custom (Language files)
Sorry, but how can I extract these files from my image.bin file ?
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,930
Reaction score
6,778
Location
Scotland
Sorry, but how can I extract these files from my image.bin file ?
Are you referring to the original firmware distribution, or a full flash image recovery file?

The firmware is just a normal zipfile with the first 2 bytes switched from PK (Phil Katz - remember him? PKware) to DH, inside the zip archive are the various components.
Change DH to PK
 

margan

Young grasshopper
Joined
Oct 27, 2018
Messages
37
Reaction score
1
Location
Italy
I don't have firmwares in zip format. I have only .bin files downloaded also from a dahua repository and from other websites. All are bin files. How can figure out if they are full flash recovery files ? Maybe the size could suggest something ( they are about 25mb) ? Or the name, i.e: General_VTO3211D_Eng_P_32M_V3.200.0012000.0.R.20180615.bin ?


edit: in the same repository you can find bin files for IPC, no ZIP files avalaible there:
Index of /Firmware/Dahua Firmware/Baseline Firmware/IP/IP Cameras/IPC-HX8XXX-Eos
So for mine VTO all files are bin also.
 
Last edited:

catcamstar

Known around here
Joined
Jan 28, 2018
Messages
1,659
Reaction score
1,193
Within the aforementionned .zip file, your .bin file is alotted as well, however tons of other files (like cramfs/sonia.zip etc) too, which you would need if you flash by TFTP. If you flash by Configtool/VDPConfig, only the .BIN file is enough. Works like a charm for VTO/VTH.

Hope this helps!
CC
 

margan

Young grasshopper
Joined
Oct 27, 2018
Messages
37
Reaction score
1
Location
Italy
Sure, but unfortunately my VTO is still unreachable from lan with those tools ( config or vdp) because only two ports are still open, the 21 and 22 ! So I could try to recovery my VTO only with uart. I'm looking to understand how !
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,930
Reaction score
6,778
Location
Scotland
I have only .bin files downloaded also from a dahua repository and from other websites
The firmware is just a normal zipfile with the first 2 bytes switched from PK (Phil Katz - remember him? PKware) to DH, inside the zip archive are the various components.
Change DH to PK
The .bin files are actually slightly modified ZIP files, with the first 2 bytes changed as above, and without the .zip extension.
 

margan

Young grasshopper
Joined
Oct 27, 2018
Messages
37
Reaction score
1
Location
Italy
Ah, now had finally files ! I'll try the work. Thanks for support.
 

margan

Young grasshopper
Joined
Oct 27, 2018
Messages
37
Reaction score
1
Location
Italy
Very disappointed but I have at least a question for each step ! I have the VTO connected with an ethernet cable directly to the laptop but it find always my gateway as a server. Do I to switch off the wifi of the laptop?
Code:
U-Boot 2010.06-svn2661 (Jul 10 2015 - 17:23:04)
DRAM:  1 GiB
gBootLogPtr:80b80008.
NAND:  Check nand flash controller v610. found
Special NAND id table Version 1.36
Nand ID: 0x98 0xF1 0x80 0x15 0xF2 0x16 0x08 0x00
NAND_ECC_NONE selected by board driver. This is not recommended !!
128 MiB
partition file version 2
rootfstype squashfs root /dev/mtdblock7
In:    serial
Out:   serial
Err:   serial
TEXT_BASE:81000000
Net:   PHY found at 3

state:ff,err_count:03
Hit any key to stop autoboot:  0
> printenv
bootcmd=kload 0x82000000; bootm 0x82000000
bootdelay=1
baudrate=115200
ipaddr=192.168.1.108
serverip=192.168.1.1
gatewayip=192.168.1.1
netmask=255.255.255.0
bootfile="uImage"
wifiaddr=00:12:34:56:78:91
dh_keyboard=1
sysbackup=1
loglevel=4
ethact=gmac
filesize=1A595C5
fileaddr=82000000
da=tftp 0x82000000 dhboot.bin.img;flwrite;tftp 0x82000000 dhboot-min.bin.img;nand protect off;flwrite;
dr=tftp 0x82000000 romfs-x.squashfs.img; flwrite;
dk=tftp 0x82000000 kernel.img;flwrite;
du=tftp 0x82000000 user-x.squashfs.img; flwrite
dw=tftp 0x82000000 web-x.squashfs.img; flwrite
dp=tftp 0x82000000 partition-x.cramfs.img;flwrite;
dc=tftp 0x82000000 custom-x.squashfs.img; flwrite
up=tftp 0x82000000 update.img;flwrite;
tk=tftp 0x82000000 uImage;bootm;
HWID=VTO3221D:01:04:01:36:1A:17:01:11:03:03:04:258:00:02:00:00:00:00:00:00:200:FF
appauto=1
ID=4E05687PAZD2581
ethaddr=38:AF:29:65:B9:F0
bootargs=mem=349M console=ttyS0,115200 root=/dev/mtdblock7 rootfstype=squashfs
stdin=serial
stdout=serial
stderr=serial
verify=n
ver=U-Boot 2010.06-svn2661 (Jul 10 2015 - 17:23:04)

Environment size: 1065/131068 bytes
>
Can't believe that this VTO has a wifi board, so what means this line : wifiaddr=00:12:34:56:78:91
 

margan

Young grasshopper
Joined
Oct 27, 2018
Messages
37
Reaction score
1
Location
Italy
Hi,
as you can see here finally did the work:
Code:
> run dr
ETH0: PHY(phyaddr=-1, rmii) link UP: DUPLEX=FULL : SPEED=100M
MAC:   38-AF-29-65-B9-F0
Using gmac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.254.254
Download Filename 'romfs-x.squashfs.img'.
Download to address: 0x82000000
Downloading:#################################################
done
Bytes transferred = 1204288 (126040 hex)

## Checking Image at 82000000 ...
   Legacy image found
   Image Name:   romfs
   Image Type:   ARM Linux Standalone Program (gzip compressed)
   Data Size:    1204224 Bytes = 1.1 MiB
   Load Address: 01200000
   Entry Point:  01a00000
   Verifying Checksum ... OK
Programing start at: 0x01200000
write : 100%
done
> run dk
ETH0: PHY(phyaddr=-1, rmii) link UP: DUPLEX=FULL : SPEED=100M
MAC:   38-AF-29-65-B9-F0
Using gmac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.254.254
Download Filename 'kernel.img'.
Download to address: 0x82000000
Downloading: #################################################
done
Bytes transferred = 2232536 (2210d8 hex)

## Checking Image at 82000000 ...
   Legacy image found
   Image Name:   kernel
   Image Type:   ARM Linux Firmware (uncompressed)
   Data Size:    2232472 Bytes = 2.1 MiB
   Load Address: 00d00000
   Entry Point:  01200000
   Verifying Checksum ... OK
Programing start at: 0x00d00000
write : 100%
done
> run du
ETH0: PHY(phyaddr=-1, rmii) link UP: DUPLEX=FULL : SPEED=100M
MAC:   38-AF-29-65-B9-F0
Using gmac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.254.254
Download Filename 'user-x.squashfs.img'.
Download to address: 0x82000000
Downloading: #################################################
done
Bytes transferred = 22237248 (1535040 hex)

## Checking Image at 82000000 ...
   Legacy image found
   Image Name:   user
   Image Type:   ARM Linux Standalone Program (gzip compressed)
   Data Size:    22237184 Bytes = 21.2 MiB
   Load Address: 02200000
   Entry Point:  03b80000
   Verifying Checksum ... OK
Programing start at: 0x02200000
write : 100%
done
> run dw
ETH0: PHY(phyaddr=-1, rmii) link UP: DUPLEX=FULL : SPEED=100M
MAC:   38-AF-29-65-B9-F0
Using gmac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.254.254
Download Filename 'web-x.squashfs.img'.
Download to address: 0x82000000
Downloading: #################################################
done
Bytes transferred = 1355840 (14b040 hex)

## Checking Image at 82000000 ...
   Legacy image found
   Image Name:   web
   Image Type:   ARM Linux Standalone Program (gzip compressed)
   Data Size:    1355776 Bytes = 1.3 MiB
   Load Address: 01a00000
   Entry Point:  01e00000
   Verifying Checksum ... OK
Programing start at: 0x01a00000
write : 100%
done
> run dp
ETH0: PHY(phyaddr=-1, rmii) link UP: DUPLEX=FULL : SPEED=100M
MAC:   38-AF-29-65-B9-F0
Using gmac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.254.254
Download Filename 'partition-x.cramfs.img'.
Download to address: 0x82000000
Downloading: #################################################
done
Bytes transferred = 4160 (1040 hex)

## Checking Image at 82000000 ...
   Legacy image found
   Image Name:   partition
   Image Type:   ARM Linux Standalone Program (gzip compressed)
   Data Size:    4096 Bytes = 4 KiB
   Load Address: 00500000
   Entry Point:  00600000
   Verifying Checksum ... OK
Programing start at: 0x00500000
write : 100%
done
> run dc
ETH0: PHY(phyaddr=-1, rmii) link UP: DUPLEX=FULL : SPEED=100M
MAC:   38-AF-29-65-B9-F0
Using gmac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.254.254
Download Filename 'custom-x.squashfs.img'.
Download to address: 0x82000000
Downloading: #################################################
done
Bytes transferred = 16448 (4040 hex)

## Checking Image at 82000000 ...
   Legacy image found
   Image Name:   custom
   Image Type:   ARM Linux Standalone Program (gzip compressed)
   Data Size:    16384 Bytes = 16 KiB
   Load Address: 00600000
   Entry Point:  00980000
   Verifying Checksum ... OK
Programing start at: 0x00600000
write : 100%
done
>
But the VTO is still in a boot loop. On boot I see always errors like bootargsParameters. Can anyone suggets something to do ( non the waste pls) ?
 

riogrande75

Pulling my weight
Joined
Oct 19, 2017
Messages
390
Reaction score
140
Location
AUSTRIA
What firmware image did you try to install? I miss "pd-x.cramfs.img" but I never hat found "partition-x.cramfs.img" in one of the firware images I flashed so far.
Can you post the logs from the bootloop?
 

margan

Young grasshopper
Joined
Oct 27, 2018
Messages
37
Reaction score
1
Location
Italy
Thanks Riogrande fro interesting to. Here is the booloop code:
Code:
▒


U-Boot 2010.06-svn2661 (Jul 10 2015 - 17:23:04)
DRAM:  1 GiB
gBootLogPtr:80b80008.
NAND:  Check nand flash controller v610. found
Special NAND id table Version 1.36
Nand ID: 0x98 0xF1 0x80 0x15 0xF2 0x16 0x08 0x00
NAND_ECC_NONE selected by board driver. This is not recommended !!
128 MiB
partition file version 2
rootfstype squashfs root /dev/mtdblock7
In:    serial
Out:   serial
Err:   serial
TEXT_BASE:81000000
Net:   PHY found at 3

state:ff,err_count:01
Hit any key to stop autoboot:  0
> boot
## Booting kernel from Legacy Image at 82000000 ...
   Image Name:   Linux-3.4.35
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    2232408 Bytes = 2.1 MiB
   Load Address: 80008000
   Entry Point:  80008000
   Loading Kernel Image ...OK
OK
partition file version 2
rootfstype squashfs root /dev/mtdblock7
fail to load bootargsParameters.txt
fail to load bootargsParameters.txt file
get bootargs info failed
cmdLine mem=349M console=ttyS0,115200 root=/dev/mtdblock7 rootfstype=squashfs
crashflasg:1, logmagic:54410011.

Starting kernel ...
Uncompressing Linux... done, booting the kernel.



U-Boot 2010.06-svn2661 (Jul 10 2015 - 17:23:04)
DRAM:  1 GiB
gBootLogPtr:80b80008.
NAND:  Check nand flash controller v610. found
Special NAND id table Version 1.36
Nand ID: 0x98 0xF1 0x80 0x15 0xF2 0x16 0x08 0x00
NAND_ECC_NONE selected by board driver. This is not recommended !!
128 MiB
partition file version 2
rootfstype squashfs root /dev/mtdblock7
In:    serial
Out:   serial
Err:   serial
TEXT_BASE:81000000
Net:   PHY found at 3

state:ff,err_count:02
ETH0: PHY(phyaddr=-1, rmii) link UP: DUPLEX=FULL : SPEED=100M
MAC:   38-AF-29-65-B9-F0
Using gmac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'upgrade_info_7db780a713a4.txt'.
Download to address: 0x84000000
Downloading: *
Retry count exceeded; starting again
Try again use backup_serverip
ETH0: PHY(phyaddr=-1, rmii) link UP: DUPLEX=FULL : SPEED=100M
MAC:   38-AF-29-65-B9-F0
*** ERROR: `serverip' not set
Failed to get info.txt
Fail to get info file!
Init error!
ETH0: PHY(phyaddr=-1, rmii) link UP: DUPLEX=FULL : SPEED=100M
MAC:   38-AF-29-65-B9-F0
Using gmac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'failed.txt'.
Download to address: 0x82000000
Downloading: *
Retry count exceeded; starting again
## Booting kernel from Legacy Image at 82000000 ...
   Image Name:   Linux-3.4.35
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    2232408 Bytes = 2.1 MiB
   Load Address: 80008000
   Entry Point:  80008000
   Loading Kernel Image ...OK
OK
partition file version 2
rootfstype squashfs root /dev/mtdblock7
fail to load bootargsParameters.txt
fail to load bootargsParameters.txt file
get bootargs info failed
cmdLine mem=349M console=ttyS0,115200 root=/dev/mtdblock7 rootfstype=squashfs

Starting kernel ...
Uncompressing Linux... done, booting the kernel.
Trying three different firmwares, the result it's the same. Names of firmwares are:
General_VTO3211D_Eng_P_32M_V3.200.0012000.0.R.20180615
General_VTO3221D_Eng_P_32M_SIP_V3.200.0012001.0.R.20180330
General_VTO3221D_EngItlSpnFrnDthGetPtg_P_32M_V3.200.9999000.0.R.20180421

I have to add that I've bought the VTO3211D P2, but when I connected it the first time to config tool the hardware device recognized was VTO3221D, so I desume they are different versions of the same hardware. Anyway doesn't work 3211 nor 3221 firmware.
 

riogrande75

Pulling my weight
Joined
Oct 19, 2017
Messages
390
Reaction score
140
Location
AUSTRIA
Ahh... you must flash ALL partitions! Without flashing the signature partition (sign.img) the system will remain in a reboot loop.
Sonia (the main program on the device) checks signatures and if there is something wrong it will reboot the device.
I do not really know the abbreviation code ("run xx") for the sign.img partition, so do the following:
Get a old (unsigned) firmware for your device (from 2017), maybe this one: http://ftp.tdtorus.ru/Firmware/VDP/Main FW/VTO3211P/General_VTO3221D_Eng_P_32M_V1.000.0000.0.R.20171009.bin
Extract it and flash it as usual. Then your device should come up and you should be able to upgrade it to latest version 2018.06.15 the official way with VDPconfig.
 
Top