Bricked Dahua NVR DH-NVR5232

D

divubi2004

n3wb
Jun 15, 2020
5
0
Italy
sorry for my very bad english

I'have a dahua nvr 5232 bricked
i can connect to uart and this is the u-boot version

Code: 
B2020> version

U-Boot 2013.01-svn1371 (Jan 30 2015 - 13:27:11)svn:1371
armv7-linux-gcc (GCC) 4.6.3 20120301 (STMicroelectronics/Linux Base 4.6.3-113)
GNU ld (GNU Binutils - STMicroelectronics/Linux Base) 2.22
B2020>

An this is the printenv

Code: 
B2020> printenv
DEVID=000000000000000000
HWID=00000000000000
ID=PA4CF203W00043
appauto=1
autogw=192.168.1.1
autolip=192.168.1.108
autonm=255.255.255.0
autosip=192.168.254.254
baudrate=115200
board=b2020
bootargs=console=ttyAS0,115200 root=/dev/mtdblock1 bpa2parts=bigphysarea|multicom:16M:0x4e600000,dhchallenge:121M:0x4f600000,video|video-ext:48M:0x59000000,vid-pic-mem0:64M:0x5c000000,coprocs:32M:0x80000000,coredisplay-video|blitter:96M:0x82000000,vid-enc-data-0:16M:0x88000000,audio|modules:16M:0x89000000,vid-dec-mem:160M:0x8a000000,vid-pic-mem1:192M:0x94000000,eram:32M:0x57000000 mem=368M@0x40000000
bootcmd=autoup;fsload;bootm
bootdelay=3
da=tftp 0x40000000 u-boot.bin.img; flwrite
dc=tftp 0x40000000 custom-x.cramfs.img; flwrite
dh_keyboard=1
dl=tftp 0x40000000 logo-x.cramfs.img; flwrite
dr=tftp 0x40000000 romfs-x.cramfs.img; flwrite
ds=tftp 0x40000000 slave-x.cramfs.img; flwrite
du=tftp 0x40000000 user-x.cramfs.img; flwrite
dw=tftp 0x40000000 web-x.cramfs.img; flwrite
eth1addr=20:13:10:14:09:23
ethact=stmac-0
ethaddr=90:02:A9:C1:44:06
gatewayip=255.255.255.255
ipaddr=255.255.255.255
load_addr=0x40000000
load_modules=1
logserver=127.0.0.1
matchinit_mode=160008
netmask=255.255.0.0
netretry=no
pcie=linkspeed:1
restore=0
serverip=255.255.255.255
stderr=serial
stdin=serial
stdout=serial
tftptimeout=1000
tk=tftp 0x40000000 uImage; bootm
up=tftp 0x40000000 update.img; flwrite
updatetimeout=0

Environment size: 1477/65532 bytes
B2020>

I have download this firmware DH_NVR5xxx_Eng_P_V2.616.0000.0.R.20171102

but I don't understand how I can recharge it


I have the possibility to write the SPI memory with a programmer, but I don't have the dump of a working NVR

Can you help me ?

thank's
 
Last edited:
I found a working dump and I flash the spi with the RT809H programmer. Now the NVR works fine but unfortunately I don't know the admin password and the other accounts are also locked.
There is a way to reset the unknow admin password without logging in ? Or there is hard reset procedure to delete all user data or factory reset the nvr ?
Thank you !
 
Glad you got it recovered!

Have you tried re-flashing the firmware via TFTP? that usually resets to factory (including passwords, etc)

Does 'printenv' now show a HWID configured? if not, you may need to set that in order to use TFTP.

in fact, i think the effective part there is the 'du' command, which re-writes the user parttion... "du=tftp 0x40000000 user-x.cramfs.img; flwrite"

see Dahua IPC EASY unbricking / recovery over TFTP for the basic procedure (written for cams, but pretty sure it applies to Dahua NVR's as well...)
 
I checked the flash memory dump with the hex editor and I have found all the partition data. The files are the same the only difference is that those present in the update file have an initial header

2020-06-28_092321.jpg
 
divubi2004 said:
I found a working dump and I flash the spi with the RT809H programmer. Now the NVR works fine but unfortunately I don't know the admin password and the other accounts are also locked.
There is a way to reset the unknow admin password without logging in ? Or there is hard reset procedure to delete all user data or factory reset the nvr ?
Thank you !
Click to expand...
 
You must log in or register to reply here.
Top Bottom