Dahua based NVR5216-4k Bricked

[Angelo Di]

Hello @ all.. as written on topic, i have a problem with a X-Security NVR Dahua Based (Xsecurity model XS-NVR6216-4K, based on nvr5216 firmware).
I have tried everything, but bootloader seems to be corrupted. i have tried run up, run dr, run dc with every files, but reply is always the same.
Without any command, it reboot himself every 3-4 minutes.

Below Log of Serial COM:
Special NAND id table Version 1.36
Nand ID: 0xC8 0xD1 0x80 0x95 0x40 0x7F 0x7F 0x7F
stmmac_init,707,0x1cc916,3
MAC: 00-00-23-34-45-66
U-Boot 2010.06-svn4246 (Oct 14 2019 - 01:30:39)
In: serial
Out: serial
Err: serial
squashfs use gzip
SCU: load slave image
WARNING! unknown slave_kernel.img format!
OK
spi env sysbackup=0
Read backup misc byte ... no env and backup env tc !!!
ok!
PRODUCT:>1U
[openbmp 267]### CRAMFS LOAD ERROR<0> for /bmp_logo.bmp!
load log failed

hisilicon # printenv
bootargs=console=ttyAMA0,115200 mem=928M root=/dev/mtdblock4 rootfstype=squashfs init=/linuxrc
slave_autostart=1
slave_bootargs=mem=64M console=ttyAMA2,115200
bootcmd=autoup; nand read 0x42000000 0x300000 0x400000; bootm
slave_bootcmd=nand read 0x81000000 0x2100000 0x100000;nand read 0x82000000 0x2200000 0x300000;nand read 0x83000000 0x2500000 0xe00000;bootm 0x81000000 0x82000000 0x83000000
bootdelay=1
Verif_Code=00000000000000000000000000000000
baudrate=115200
netup_timeout=1000
bootnandflash=1
loadaddr=0x42000000
key=000000000000
deviceid=0000000000000000
bootargs_nvr=console=ttyAMA0,115200 mem=1056M root=/dev/mtdblock4 rootfstype=squashfs init=/linuxrc vmalloc=260M
slave_bootcmd_nvr=nand read 0x89000000 0x2100000 0x100000;nand read 0x8A000000 0x2200000 0x300000;nand read 0x8B000000 0x2500000 0xe00000;bootm 0x89000000 0x8A000000 0x8B000000
load_modules=1
da=tftp u-boot.bin.img; flwrite
dr=tftp romfs-x.squashfs.img; flwrite
du=tftp user-x.squashfs.img; flwrite
dw=tftp web-x.squashfs.img; flwrite
dl=tftp logo-x.squashfs.img; flwrite
ds=tftp slave-x.squashfs.img; flwrite
dc=tftp custom-x.squashfs.img; flwrite
up=tftp update.img; flwrite
tk=tftp uImage; bootm
pm=tftp 575s_PMX.bin.img; flwrite
dx=tftp u-boot_slave.bin.img; flwrite
autosip=192.168.254.254
autolip=192.168.1.108
autonm=255.255.255.0
autogw=192.168.1.1
netretry=no
updatetimeout=1000
tftptimeout=1000
eth1addr=00:00:23:34:45:77
eth2addr=00:00:23:34:45:88
restore=0
ver=U-Boot 2010.06-svn3003 (Dec 21 2017 - 23:33:04)
ethaddr=38:af:29:12:XX:XX (edited for security)
ID=4CXXXXXXXXXX (edited for security)
DEVID=XS-NVR6216-4K
netmask=255.255.255.0
gatewayip=192.168.178.1
autoip=192.168.178.200
serverip=192.168.1.1
ipaddr=192.168.1.108
hwid=2M014E1PAEYYM34
dh_keyboard=0
appauto=0
sysbackup=1
stdin=serial
stdout=serial
stderr=serial
verify=n
slave_cmd=bootm 8c000000 8d000000 8e000000
hisilicon # sip 192.168.1.1
Set server ip address success!
Now server ip addr: 192.168.1.1
hisilicon # lip 192.168.1.108
Set local address success!
Now local ip addr: 192.168.1.108
hisilicon # save
Saving Environment to NAND...
Erasing Nand...
Writing to Nand... done

hisilicon # run dr
#################################################
done
Bytes transferred = 22433856 (1565040 hex)
boottype=1:
dh_wdt_stop called
flash_do_flwrite,723,ret:-29,flash_sn:1
Header CRC Checking ... OK
Data CRC Checking ... OK
check failed
not support version.flwrite error!
dh_wdt_start called
secure flwrite error!
do_flwrite_secure failed

 

[lodeon1337]

Hi, same error here. But it works with the latest version of the nvr firmware. i think you cant flash an older firmware.

 

[DavidsonCGL]

Hi Lodeon, could you please tell me how you flashed the NVR with the latest version please ?

I do not know where to get the upgrade files and use the TFTP server.

Thanks for your help

 

[lodeon1337]

Hello, I had the same error when flashing as you. With the current firmware the error no longer came, but a different one.

My NVR is still dead.

The instructions here in the forum didn't help me either. I guess I don't understand some of the steps correctly. I'm sorry I can't help you.

 

[DavidsonCGL]

Ohhh, I still believe there is a way thought,

Thanks for getting back to me