Dahua IPC unbricking / recovery over serial UART and TFTP

mikelikes

n3wb
Joined
Apr 8, 2020
Messages
11
Reaction score
0
Location
AU
I recall there being a thread that talks about using an external programmer but I don't have a link to it handy, it was something I came across while researching my own problem, It's not a very convenient process and requires getting the write programmer for the right type of chip on your camera. Some have alligator clamps so you don't have to pull or desolder the chip but I can't speak much on the topic from my own experience other then it is possible as a last resort but not something I would like to attempt myself.
Thanks for the tip, I will do some more searching around the threads and see what I can find. I can only try before I totally give up and turn the camera into a door stop... :)
 

arni7

n3wb
Joined
Feb 28, 2017
Messages
12
Reaction score
0
It's been encountered before that at some point Dahua ran out of space on some of the partitions and realigned the partition boundaries. During a web upgrade it upgrades and aligns properly but during a TFTP flash it doesn't update the partition pointers so it actually overwrites portions.

See if you can flash an older version of the firm ware or locate the version just before the partition boundary changed.
Hi, I made another error, I uploaded IPC-HX5XXX-Volt_MultiLang_PN_Stream3_V2.800.0000000.16.R.200529.zip via www firmware and I was supposed to upload IPC-HX5X3X-Rhea_MultiLang_PN_Stream3_V2.800.0000013.0.zip and if it does not work now. the desired firmware do I have to change ubot to properly load the new firmware?
 

Corellon

Getting the hang of it
Joined
Mar 11, 2020
Messages
78
Reaction score
29
Location
Canada
Hi, I made another error, I uploaded IPC-HX5XXX-Volt_MultiLang_PN_Stream3_V2.800.0000000.16.R.200529.zip via www firmware and I was supposed to upload IPC-HX5X3X-Rhea_MultiLang_PN_Stream3_V2.800.0000013.0.zip and if it does not work now. the desired firmware do I have to change ubot to properly load the new firmware?
If the TFTP server loads up then you may not have to change the uboot, BUT you may have to do some work to reset all the enviroment variables to match the correct settings for the correct model. You may also not have the right tools if the HX5XXX uses different memory or flash then the HX5X3X to the point it may not be able to even read the right partitions, hopefully you will be able to write it back.... when you flash the wrong firmware it's usually a very bad thing.

You have a difficult choice in that you can try keeping the existing boot loader and seeing if you can get it to work with the correct firmware for the rest of the partitions
or
Flash the updated bootloaded and risk ending up with a door stop.

If it's the wrong firmware I would most likely do the bootloader myself, too much could be just slightly different that would cause a worse potential failure later on..... Like ripping off a bandage I would just do the bootloader with the correct firmware and see if it works and start back from there.
 

gabrieleb

n3wb
Joined
Sep 29, 2020
Messages
2
Reaction score
0
Location
italia
Non capisco come aggiornare il FIRMWARE DA QUI SI POTREBBE ESSERE PRECISE? Grazie

Estrarre l'immagine del firmware per la fotocamera da qualche parte, utilizzare qualche programma zip come 7zip. Si potrebbe lamentare il file zip non valido (dal momento che Dahua cambia l'intestazione zip da PK a DH) è possibile risolvere il file zip con un editor HEX o utilizzare un altro programma per decomprimerlo.

Avviare il server TFTP e puntare ai file estratti dall'immagine del firmware.

E ora per la parte finale: Lampeggiante il firmware!
Io lampeggiare le seguenti partizioni in ordine:
  • romfs (file system linux radice con busybox)
  • kernel (Il sacro kernel Linux)
  • utente (programmi Dahuas e moduli kernel)
  • web (interfaccia Web)
  • partizione ("Tabella partizionata" - file di testo che descrivono il layout sul chip flash)
  • personalizzato (file di lingua)
Non lampeggiare il bootloader! Non c'è bisogno di e quando si scopa che il recupero è molto più difficile.

Eseguire i seguenti comandi uno dopo l'altro:
[codice]
eseguire dr
eseguire dk
eseguire du
eseguire dw
eseguire dp
eseguire dc
[/codice]

Output di esempio:
[codice]
eseguire dr
ETH0: PHY(phyaddr-1, rmii) link UP: DUPLEX - FULL : SPEED
MAC: 3C-EF-8C-FA-E7-88
Utilizzo del dispositivo gmac
TFTP dal server 192.168.1.4; il nostro indirizzo IP è 192.168.1.108
Scaricare il nome file 'romfs-x.squashfs.img'.
Scarica all'indirizzo: 0x82000000
Scaricare: #################################################
Fatto
Byte trasferiti: 909376 (esadecimale de040)

Controllo dell'immagine a 82000000 ...
Immagine legacy trovata
Nome immagine: romfs
Tipo di immagine: ARM Linux Standalone Program (gzip compresso)
Dimensioni dei dati: 909312 Byte - 888 KiB
Indirizzo di carico: 002f0000
Punto di ingresso: 003d0000
Verifica del checksum in corso... Ok
Inizio programma su: 0x002f0000
Sonda SPI: 16384 KiB hi_sfc 0:0 è ora dispositivo corrente

write : 0%
write : 0%
write : 7%
scrivere : 14%
scrivere : 21%
scrivere : 28%
scrittura : 35%
scrivere : 42%
scrivere : 50%
scrivere : 57%
scrittura : 64%
scrivere : 71%
scrivere : 78%
scrivere : 85%
scrivere : 92%
scrivere : 100%
Fatto
[/codice]

È possibile eseguire salva se si desidera salvare le variabili di ambiente impostate (ipaddr, servip, ..).

Eseguire l'avvio per avviare la fotocamera :)
Congratulazioni!
(Se hai appena letto questo per divertimento e non hai una macchina fotografica in mattoni ti suggerisco ancora di acquistare un dongle seriale UART, sono più economici della maggior parte degli snack e puoi risparmiare un sacco di dispositivi con esso!)
(Se questo ti ha aiutato e hai un po 'di ricambio per uno studente: paypal.me/BotoX)
[/QUOTE]
 
Joined
Aug 24, 2019
Messages
10
Reaction score
1
Location
USA
I am using the Easy method with TFTP. Can anyone help resolve why my run dr, run dk, run du, run dw, run dp and run dc are not supported?

Here is my Console Info... NOT sure why it say run dr, run dk, run du, run dw, run dp and run dc are not supported. the tftp of the pd-x files seems to be working....

gBootLogPtr:00b80008.
spinor flash ID is 0x1940ef
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=116M root=/dev/m
tdblock5 rootfstype=squashfs init=/linuxrc.
TEXT_BASE:01000000
Net: PHY:0x03625cc6,addr:0x01
s3l 55k+bcm54811 init
partition file version 2
rootfstype squashfs root /dev/mtdblock5
MMC: sdmmc init
Using ambarella mac device
Download Filename 'upgrade_info_7db780a713a4.txt'.Downloading: 100%
## file size: 201 Bytes, times: 0s, speed: 21.5 KiB/s
done
Bytes transferred = 201 (c9 hex)
string value is 0
The end of file
cmd: (run dr) is not support!
cmd: (run dk) is not support!
cmd: (run du) is not support!
cmd: (run dw) is not support!
cmd: (run dp) is not support!
cmd: (run dc) is not support!
Using ambarella mac device
Download Filename 'pd-x.squashfs.img'.Downloading: 100%
## file size: 90.2 KiB, times: 0s, speed: 482.4 KiB/s
done
Bytes transferred = 92408 (168f8 hex)
curVer:V1.4 <= newVer:V2.0,verCompare success!
?[0;32mUBOOT_commonSwRsaVerify run successfully!
?[0m
## Checking Image at 02000000 ...
Legacy image found
Image Name: pd
Created: 2020-06-04 18:33:18 UTC
Image Type: ARM Linux Standalone Program (uncompressed)
Data Size: 90112 Bytes = 88 KiB
Load Address: 01880000
Entry Point: 018a0000
Verifying Checksum ... OK
Programing start at: 0x01880000 for pd
SPI probe: 32768 KiB W25Q256FV at 0:1 is now current device
write : 100%
done
crc from program is :0, crc from flash is :0
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=116M root=/dev/m
tdblock5 rootfstype=squashfs init=/linuxrc.
Using ambarella mac device
Download Filename '.FLASHING_DONE_STOP_TFTP_NOW'.Downloading: ##
## file size: 0 Bytes, times: 0s, speed: 0 Bytes/s
done
cmd: (sleep 5) is not support!
partition file version 2
rootfstype squashfs root /dev/mtdblock5
fail to load bootargsParameters.txt
fail to load bootargsParameters.txt file
cmdLine console=ttyS0,115200 mem=116M root=/dev/mtdblock5 rootfstype=squashfs in
it=/linuxrc



My Command.txt file:
run dr
run dk
run du
run dw
run dp
run dc
tftp 0x02000000 pd-x.squashfs.img; flwrite
tftp 0x02000000 .FLASHING_DONE_STOP_TFTP_NOW
sleep 5


My img files


1603296192945.png
 
Last edited:

pozzello

Known around here
Joined
Oct 7, 2015
Messages
2,270
Reaction score
1,117
those commands are essentially 'macros' or 'shortcuts' that are often pre-defined on the devices, but apparently not yours for whatever reason.
so you'll need to determine the equivalent full command line for each.

for example, from a previous post:

da=tftp 0x82000000 dhboot.bin.img;flwrite;tftp 0x82000000 dhboot-min.bin.img;nand protect off;flwrite;
dr=tftp 0x82000000 romfs-x.squashfs.img; flwrite;
dk=tftp 0x82000000 kernel.img;flwrite;

but do not try these until you verify the file names and locations match your system!
 

aloha984

Young grasshopper
Joined
Apr 23, 2020
Messages
33
Reaction score
0
Location
Selce
Can somebody tell me why is my network on camera dahua sd-50255u-hni not working when i connect it to computer or switch...i have a ttl to usb serial conection on putty.
I can see that network link is down,like there is no connection on my computer or a switch. I have conected it to a switch with blink indicator (there is no light on camera input on it but there is on my computer indicator flashing).
When i boot the camera there is no network conection, then i turn it off...
wait a minute or two plug it back in ...then there is network for a shor while and still no network...(notice i didn`touched anything in between two boot ups..


I have flashed camera with DH_SD-Eos_Eng_P_Stream3_V2.623.0000000.1.R.180627.bin
and it worked ok, it booted up - but then i flashed with the small file i tought it was for ptz controls (that was my mistacke - it got flashed with smaller file i it wont boot and won`t show on network..

My adapter is set to 192.168.1.1
mask:255.255.255.0
aditional adress aded in network adapter on computer 192.168.254.254 - subnet 255.255.255.0
....

nework link is once up and once down (for a second or two) why?
thank you

this is my boot log



U-Boot 2010.06-svn3089 (Jul 12 2016 - 21:13:31)
DRAM: 1 GiB
gBootLogPtr:80b80008.
NAND: Check nand flash controller v610. found
Special NAND id table Version 1.36
Nand ID: 0x92 0xF1 0x80 0x95 0x40 0x7F 0x7F 0x7F
NAND_ECC_NONE selected by board driver. This is not recommended !!
128 MiB
partition file version 2
rootfstype squashfs root /dev/mtdblock7
In: serial
Out: serial
Err: serial
TEXT_BASE:81000000
Net: PHY found at 1

ETH0: PHY(phyaddr=-1, rmii) not link!
Try again use backup_serverip
ETH0: PHY(phyaddr=-1, rmii) not link!
Failed to get info.txt
Fail to get info file!
Init error!
ETH0: PHY(phyaddr=-1, rmii) not link!
state:ff,err_count:00
## Booting kernel from Legacy Image at 82000000 ...
Image Name: Linux-3.4.35
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 2641032 Bytes = 2.5 MiB
Load Address: 80008000
Entry Point: 80008000
Loading Kernel Image ...OK
OK
partition file version 2
rootfstype squashfs root /dev/mtdblock7
fail to load bootargsParameters.txt
fail to load bootargsParameters.txt file
get bootargs info failed
cmdLine mem=256M console=ttyS0,115200 root=/dev/mtdblock7 rootfstype=squashfs

Starting kernel ...
Uncompressing Linux... done, booting the kernel.
--
___

U-Boot 2010.06-svn3089 (Jul 12 2016 - 21:13:31)
DRAM: 1 GiB
gBootLogPtr:80b80008.
NAND: Check nand flash controller v610. found
Special NAND id table Version 1.36
Nand ID: 0x92 0xF1 0x80 0x95 0x40 0x7F 0x7F 0x7F
NAND_ECC_NONE selected by board driver. This is not recommended !!
128 MiB
partition file version 2
rootfstype squashfs root /dev/mtdblock7
In: serial
Out: serial
Err: serial
TEXT_BASE:81000000
Net: PHY found at 1

ETH0: PHY(phyaddr=-1, rmii) link UP: DUPLEX=FULL : SPEED=100M
MAC: 00-12-34-56-78-9A
Using gmac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending throu gh gateway 192.168.1.1
Download Filename 'upgrade_info_7db780a713a4.txt'.
Download to address: 0x84000000
Downloading: *
Retry count exceeded; starting again
Try again use backup_serverip
ETH0: PHY(phyaddr=-1, rmii) not link!
Failed to get info.txt
Fail to get info file!
Init error!
ETH0: PHY(phyaddr=-1, rmii) not link!
state:ff,err_count:01
## Booting kernel from Legacy Image at 82000000 ...
Image Name: Linux-3.4.35
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 2641032 Bytes = 2.5 MiB
Load Address: 80008000
Entry Point: 80008000
Loading Kernel Image ...OK
OK
partition file version 2
rootfstype squashfs root /dev/mtdblock7
fail to load bootargsParameters.txt
fail to load bootargsParameters.txt file
get bootargs info failed
cmdLine mem=256M console=ttyS0,115200 root=/dev/mtdblock7 rootfstype=squashfs
crashflasg:1, logmagic:54410011.

Starting kernel ...
Uncompressing Linux... done, booting the kernel.
 

aloha984

Young grasshopper
Joined
Apr 23, 2020
Messages
33
Reaction score
0
Location
Selce
THis is my progress ...
help anybody ?

is it possible that i have to put a POE switch on camera since the network doesnt boot ? it doesn`t show any sign on switch or when I plug it on a router)
I have power adapter 24v - 2.2A


U-Boot 2010.06-svn3089 (Jul 12 2016 - 21:13:31)
DRAM: 1 GiB
gBootLogPtr:80b80008.
NAND: Check nand flash controller v610. found
Special NAND id table Version 1.36
Nand ID: 0x92 0xF1 0x80 0x95 0x40 0x7F 0x7F 0x7F
NAND_ECC_NONE selected by board driver. This is not recommended !!
128 MiB
partition file version 2
rootfstype squashfs root /dev/mtdblock7
In: serial
Out: serial
Err: serial
TEXT_BASE:81000000
Net: PHY found at 1

ETH0: PHY(phyaddr=-1, rmii) link UP: DUPLEX=FULL : SPEED=100M
MAC: 00-12-34-56-78-9A
Using gmac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending throgh gateway 192.168.1.1
Download Filename 'upgrade_info_7db780a713a4.txt'.
Download to address: 0x84000000
Downloading: #################################################
done
Bytes transferred = 202 (ca hex)
ETH0: PHY(phyaddr=-1, rmii) link UP: DUPLEX=FULL : SPEED=100M
MAC: 00-12-34-56-78-9A
Using gmac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending throgh gateway 192.168.1.1
Download Filename 'romfs-x.squashfs.img'.
Download to address: 0x82000000
Downloading: *
ARP Retry count exceeded; starting again
cmd Failed run dr!
partition file version 2
rootfstype squashfs root /dev/mtdblock7
fail to load bootargsParameters.txt
fail to load bootargsParameters.txt file
get bootargs info failed
cmdLine mem=256M console=ttyS0,115200 root=/dev/mtdblock7 rootfstype=squashfs
ETH0: PHY(phyaddr=-1, rmii) not link!
ETH0: PHY(phyaddr=-1, rmii) not link!
state:ff,err_count:03
## Booting kernel from Legacy Image at 82000000 ...
Image Name: Linux-3.4.35
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 2641032 Bytes = 2.5 MiB
Load Address: 80008000
Entry Point: 80008000
Loading Kernel Image ...OK
OK
partition file version 2
rootfstype squashfs root /dev/mtdblock7
fail to load bootargsParameters.txt
fail to load bootargsParameters.txt file
get bootargs info failed
cmdLine mem=256M console=ttyS0,115200 root=/dev/mtdblock7 rootfstype=squashfs
crashflasg:1, logmagic:54410011.

Starting kernel ...
Uncompressing Linux... done, booting the kernel.
 

Rory040

Young grasshopper
Joined
Feb 16, 2019
Messages
84
Reaction score
5
Location
Eindhoven
alaha can you put screens how you connected it to the camera with ttl to usb serial .

cannot connect to it either so i ordered a ttl to usb serial
 

aloha984

Young grasshopper
Joined
Apr 23, 2020
Messages
33
Reaction score
0
Location
Selce
on usb adapter i conected tx with rx (on camera), rx on usb adapter with tx(on camera) gnd usb to gnd camera, vcc 3.3v usb to vcc 3.3v on camera.
Once you conected all that ( before there is two white conector 4(whires) to disable ptz check on camera boot (so it doesn`t start spinning and disabling your conection usb to camera)..
I will post later those pictures where those conectors are...

when you disconect pin to disable ptz movement conect rx,tx,gnd,vcc3.3v to usb adapter, open putty baud rate 115200, flow control to none. Putty window will open and then conect the camera to power supply - turn it on...

you will se uboot loader then press and hold * (on keyboard)....

All of this is fine for me, but there is no network connection from camera to my computer...i conected camera directly to my computer or switch. There is always a same problem no conection...

Should i connect camera with poe+ network switch and hope there will be a network conection on my computer
 

Attachments

aloha984

Young grasshopper
Joined
Apr 23, 2020
Messages
33
Reaction score
0
Location
Selce
on usb adapter i conected tx with rx (on camera), rx on usb adapter with tx(on camera) gnd usb to gnd camera, vcc 3.3v usb to vcc 3.3v on camera.
Once you conected all that ( before there is two white conector 4(whires) to disable ptz check on camera boot (so it doesn`t start spinning and disabling your conection usb to camera)..
I will post later those pictures where those conectors are...

when you disconect pin to disable ptz movement conect rx,tx,gnd,vcc3.3v to usb adapter, open putty baud rate 115200, flow control to none. Putty window will open and then conect the camera to power supply - turn it on...

you will se uboot loader then press and hold * (on keyboard)....

All of this is fine for me, but there is no network connection from camera to my computer...i conected camera directly to my computer or switch. There is always a same problem no conection...

Should i connect camera with poe+ network switch and hope there will be a network conection on my computer


I uses needles to conect wires to camera i didn`t solder wires to camera
 

pozzello

Known around here
Joined
Oct 7, 2015
Messages
2,270
Reaction score
1,117
"I have flashed camera with DH_SD-Eos_Eng_P_Stream3_V2.623.0000000.1.R.180627.bin
and it worked ok, it booted up - but then i flashed with the small file i thought it was for ptz controls (that was my mistacke - it got flashed with smaller file i it wont boot and won`t show on network.."

which 'smaller file' exactly? and how did you flash that? from the serial console? and after that, no more networking?

have you tried re-flashing the original FW from the serial console?
 

aloha984

Young grasshopper
Joined
Apr 23, 2020
Messages
33
Reaction score
0
Location
Selce
"I have flashed camera with DH_SD-Eos_Eng_P_Stream3_V2.623.0000000.1.R.180627.bin
and it worked ok, it booted up - but then i flashed with the small file i thought it was for ptz controls (that was my mistacke - it got flashed with smaller file i it wont boot and won`t show on network.."

which 'smaller file' exactly? and how did you flash that? from the serial console? and after that, no more networking?

have you tried re-flashing the original FW from the serial console?
Camera has booted normaly. I got into the interface via gui in windows.
Then i flashed the smaller file as i tought it was for ptz control ...


In fast i flashed camera with file 2.5mb tthen for stock...I for into the camera via serial ttl connection but i don't have network connection to computer
 

aloha984

Young grasshopper
Joined
Apr 23, 2020
Messages
33
Reaction score
0
Location
Selce
Camera has booted normaly. I got into the interface via gui in windows.
Then i flashed the smaller file as i tought it was for ptz control ...


In fast i flashed camera with file 2.5mb tthen for stock...I for into the camera via serial ttl connection but i don't have network connection to computer
I have no reply when i ping camera from computer or from camera(from bootloader) to pc...they are on same network...switch only comp and camera on network - nothing , directly camera to pc nothing..
I tried on laptop and desktop pc - nothing.
I am using 24v 2.2A adapter.
 

Rory040

Young grasshopper
Joined
Feb 16, 2019
Messages
84
Reaction score
5
Location
Eindhoven
"I have flashed camera with DH_SD-Eos_Eng_P_Stream3_V2.623.0000000.1.R.180627.bin <------- is this for the camera the right file ??
 

aloha984

Young grasshopper
Joined
Apr 23, 2020
Messages
33
Reaction score
0
Location
Selce
"I have flashed camera with DH_SD-Eos_Eng_P_Stream3_V2.623.0000000.1.R.180627.bin <------- is this for the camera the right file ??
Yes it is it worked for me when i flashed it from windows graphic interface - update firmware..

Mine camera also reboots, when i make connection through serial...i says booting kernel...waits minut-two then resets...

I have put enviromental settings to default...

Is that a problem... I don't sad hwid as i used to when i type printenv...

Can you Rrory copy - paste your HWID

So i can i put on mine...

Other members on forum do I need to put myself hwid if i reset it to default...
It says now hwid: 00000
 

aloha984

Young grasshopper
Joined
Apr 23, 2020
Messages
33
Reaction score
0
Location
Selce
Yes it is it worked for me when i flashed it from windows graphic interface - update firmware..

Mine camera also reboots, when i make connection through serial...i says booting kernel...waits minut-two then resets...

I have put enviromental settings to default...

Is that a problem... I don't sad hwid as i used to when i type printenv...

Can you Rrory copy - paste your HWID

So i can i put on mine...

Other members on forum do I need to put myself hwid if i reset it to default...
It says now hwid: 00000
Rory how did you connect your camera power adapter (which) or through POE?
 

pozzello

Known around here
Joined
Oct 7, 2015
Messages
2,270
Reaction score
1,117
you still have not explained WHIHC small 2.5mb file you flashsed and how you did so. what was the file name and what command/process did you use to flash it?

and yes, if you have a 'printenv' dump from when things were working, you'll want to re-establish as many of those settings as possible, especially HWID...
 
Top