Bricked Dahua NVR DH-NVR5208

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,930
Reaction score
6,778
Location
Scotland
I thought I would share my very first foray into Dahua's products - it may be of interest, or maybe even of some use, to forum users.
What it will be though is a bit lengthy.

I'm quite fluent in some of Hikvision's products, and am always on the lookout for bricked devices to experiment with and learn from, and had thought for a while that it might be interesting to find out how Dahua engineers their products.
So when a forum member bricked his Dahua NVR with a firmware update, and @fenderman pointed him in my direction, he offered it and I bought it. The fixing-up was interesting, and I learned quite a bit.

When powering it up, I could see that it went out on the LAN looking for an update server, but beyond that, nothing, no services running.
As with any embedded Linux device, the serial console is the main problem-solving tool.
This NVR has an RS-232 DB9 interface on the back panel, so I hooked up an RS-232 to USB converter (not a serial TTL to USB converter, that's a different interface) and could see via PuTTY that the bootloader looked normal enough and started booting the kernel, but nothing after that.
Then I remembered one of @cor35vet 's very useful posts about the environment variable that inhibits the switch-over from console mode to RS-232 mode -
setenv dh_keyboard 0
saveenv
This gave loads more output - very chatty - and the first clue as to a possible cause where it crashes out:
Code:
usbserial: USB Serial Driver core
rtusb init rt2870 --->
rt3070_2.5.0.3 SVN_VERSION:46 Complie time Nov 21 2013 16:24:51
usbcore: registered new interface driver rt2870
*** This RDK version requires mem=270MM in bootargs ***
Kernel bootargs mismatch.!!!!ABORTING!!!
OsalDrv driver open: /dev/syslinkipc_Osal: No such file or directory
OsalDrv driver close: /dev/syslinkipc_Osal: Bad file descriptor
/dev/syslinkipc_MultiProc: No such file or directory
MultiProc driver close: : Bad file descriptor
SharedRegion driver open: : No such file or directory
This is what the current bootargs held, a mismatch to requirements shown above :
Code:
Kernel command line: mem=148M console=ttyO0,115200n8 rootfstype=cramfs root=/dev/mtdblock1 notifyk.vpssm3_sva=0xBFD00000 pcie=gen1 dh_keyboard=0
OK, so back to the bootloader to change bootargs to allocate 270MB RAM instead of the 148MB as originally set.
And the bootup goes much much further, loads of 'SUCCESS!' messages.
There was even a Dahua logo briefly on the monitor.
Until it eventually bombs with a continuous error and finally reboots :

Code:
**************************************************************
                 dvr_rdk_tilib.a(decoder816x) V1.00.05
                 Compile at Jul 31 2014 12:06:45 SVN:9222+
**************************************************************

useCase:4
tracepoint: multich_vdec_vdis.c,240 MultiCh_createVdecVdis


***************************************************************************************
*  dvr_rdk_link_api.a  Version: v1.0.0   Svn: 7212  Compile at: 14:52:40 Apr 26 2014  *
***************************************************************************************
 0: SYSTEM: System Common Init in progress !!!
 0: SYSTEM: IPC init in progress !!!
 12: SYSTEM: Opening MsgQ Heap [IPC_MSGQ_MSG_HEAP] ...
 46: SYSTEM: Creating MsgQ [HOST_MSGQ] ...
[RDK]ASSERT (System_ipcMsgQCreate|150)
[RDK]ASSERT (System_ipcMsgQCreate|150)
[RDK]ASSERT (System_ipcMsgQCreate|150)
[RDK]ASSERT (System_ipcMsgQCreate|150)
[RDK]ASSERT (System_ipcMsgQCreate|150)
Getting more serious now, so at this point I followed the very useful @cor35vet post on Dahua tftp recovery, and used the bootloader 'run' command definitions where the indivdual components of the firmware can be applied. Based on the guidance in the post, I avoided updating the bootloader as it did appear to be working OK.
By the way - the firmware is just a normal zipfile with the first 2 bytes switched from PK (Phil Katz - remember him? PKware) to DH, inside the zip archive are the various components.
I did the component-by-component tftp update using not just the current DH_NVR5xxx_Eng_P_V2.616.0000.0.R.20171102 version but several others I found on-line.
None of them succeeded in bringing the NVR back to life - though the type of failure varied between versions.

There is another useful trouble-shooting approach, and that's to explore via a command shell if you can get one.
For this NVR, the main app (called Challenge) can be commanded to sleep with an environment variable.
setenv appauto 0
saveenv
This gave me a command prompt, and I was able to mount an NFS share and extracted all the flash partitions so I could inspect them off-line.
I also pulled out the configuration files, and the log files, wondering if a mixed-up configuration was causing the NVR to fail.
Nothing stood out in the configuration. The logfiles went back to the first owner ... though nothing untoward showing.
I found a validate.sh script that's run during startup that checked out bootargs for the correct mem= parameter and one other, both were OK.

So, what next?
There had been a wrong value in the kernel bootargs, which improved but didn't fully fix the startup problem.
Updating the firmware (but not the bootloader) from various versions didn't fix it.
This does suggest some configuration-related aspect could be the cause.
But at first glance the configuration showed no problems.
What had I not yet done?

OK, so I used the bootloader to update u-boot with the image from the current firmware extract.
The PuTTY output showed the NVR 'booting the kernel ...' and then nothing. Odd. And worrying.
But a few seconds later there was a beep, the first I'd heard.
And about 20 seconds later the 3x3 Preview screen showed up on the monitor.
It was working!

On checking out the detail, the bootloader environment variables had all been reset to defaults - hence the console messages stopping as the kernel booted up, and the 'Challenge' main app starting up in normal mode.
And it turns out that the item that was causing the failure was a required parameter missing on the kernel bootargs, not one that's checked by the validate.sh script.
Wow! At that point I felt quite chuffed. The bricked NVR was unbricked.

I spent a little while exploring it.
It's possible to add Hikvision cameras via ONVIF, and get motion detection recording.
And to add other-brand cameras, and Hikvision NVR streams, via RTSP.
I checked out the Playback/Search options, and although quite different from Hikvision's style, they work pretty well.
Overall, I was impressed with this NVR.
When fully loaded with 8 channels it continued to respond well, no glitches, no freezes.
And the user interface - both the web GUI and especially the VGA/HDMI interface seem more refined and 'prettier' than Hikvision's.

Anyway - that's it. Thanks for reading.
And thank you to @cor35vet for some really helpful posts on the Dahua internals. This would have been much harder without those.
Questions and comments welcome.
 

marku2

Known around here
Joined
Dec 23, 2016
Messages
919
Reaction score
263
Location
Australia
Indeed as I am finding out with both brands
Now if another player got into the market and took the best from both brands
We would have one amazing system (bit like alpine car audio head units) they were untouchable lol
 

Eloy

n3wb
Joined
Mar 5, 2017
Messages
3
Reaction score
2
Alastair, hi you doing?, i ´m searching for users with the old generation of NVRs 52XX, mine in particular is NVR5216-P (PoE). I´m running this version General_NVR5xxx_Eng_P_V2.616.0000.0.R.20140110, and i was wondering if it is posible to upgrade it to the one you mention: DH_NVR5xxx_Eng_P_V2.616.0000.0.R.20171102

I´m not experiencing any issue with it, but it is nice to have the newest one installed. The thing is, i don´t wan´t to get the unit bricked, and i would like to know if anyone else have done it before.

Thanks.
Regards,
Eloy.
 

wasabi

Getting the hang of it
Joined
Apr 26, 2016
Messages
113
Reaction score
23
Location
Sydney
I just managed to brick mine today. How can I fix this? It’s just the NVR loading screen on repeat.
 

nim108

n3wb
Joined
Jul 31, 2020
Messages
2
Reaction score
0
Location
USA
I got a Dahua 4208-8P-ADT off Ebay that does not display any video (tried both HDMI and VGA). Is this something I can try on it? I'm not sure if it's worth the effort but other than that it seems to be brand new (maybe just DOA video units). However, it looks like to do any kind of setup, including network, you need video out so I'm kind of hosed otherwise. Any ideas? I'd pursue this TFTP route if I had the proper files with which to restore it.
 
Top