Dahua Firmware Mod Kit + Modded Dahua Firmware

Discussion in 'Dahua' started by cor35vet, Sep 5, 2016.

Share This Page

  1. cor35vet

    cor35vet Pulling my weight

    Joined:
    Jun 23, 2016
    Messages:
    337
    Likes Received:
    205
    Hi,

    I've been hacking around with my Dahua camera and made a script to unpack and rebuild the firmware upgrade images.
    Check out the Github for more info: GitHub - BotoX/Dahua-Firmware-Mod-Kit: Unpack and repack Dahua IP camera firmware upgrade images.

    Give me firmware for my camera!
    You can download the firmware image that fits your camera below and flash it to your camera or unpack and modify it more.
    It will work on both Chinese and international models.
    International cameras can flash back to official English firmware after using my modded firmware.
    Chinese cameras will never work with official English firmware - they need to be patched.

    For IPC-HX4XXX-Eos ("Eco-savvy 2.0" 3rd gen) cameras:
    https://i.botox.bz/DH_IPC-HX4XXX-Eos_EngFraSpaRus_PN_Stream3_V2.420.0000.22.R.20161209.bin
    Software Version: 2.420.0000.22.R, Build Date: 2016-12-09
    MD5Sum: 1332430392def5d9becd4e883d26f7d8
    SHASum: 1bc476b78fd706b225243c12a334631971ea6a7c

    Compatible cameras according to Dahua:
    DH-IPC-HDBW4231R,DH-IPC-HDBW4236R
    DH-IPC-HDBW4431R,DH-IPC-HDBW4436R
    DH-IPC-HDW4231C-A,DH-IPC-HDW4236C-A
    DH-IPC-HDW4233C-A,DH-IPC-HDW4238C-A
    DH-IPC-HDW4431C-A,DH-IPC-HDW4436C-A
    DH-IPC-HDBW4431R-S,DH-IPC-HDBW4436R-S
    DH-IPC-HDBW4233R-AS,DH-IPC-HDBW4238R-S
    DH-IPC-HDBW4231R-AS,DH-IPC-HDBW4236R-AS
    DH-IPC-HDBW4431R-AS,DH-IPC-HDBW4436R-AS
    DH-IPC-HDBW4231R-VF,DH-IPC-HDBW4431R-VF
    DH-IPC-HFW4231F,DH-IPC-HFW4236F,DH-IPC-HFW4431F,DH-IPC-HFW4436F
    DH-IPC-HFW4231B,DH-IPC-HFW4236B,DH-IPC-HFW4431B,DH-IPC-HFW4436B
    DH-IPC-HFW4231D,DH-IPC-HFW4236D,DH-IPC-HFW4431D,DH-IPC-HFW4436D
    DH-IPC-HFW4231R-Z,DH-IPC-HFW4431R-Z,DH-IPC-HFW4231R-VF,DH-IPC-HFW4431R-VF
    DH-IPC-HFW4231F-AS,DH-IPC-HFW4236F-AS,DH-IPC-HFW4431F-AS,DH-IPC-HFW4436F-AS
    DH-IPC-HFW4231B-AS,DH-IPC-HFW4236B-AS,DH-IPC-HFW4431B-AS,DH-IPC-HFW4436B-AS
    DH-IPC-HFW4231D-AS,DH-IPC-HFW4236D-AS,DH-IPC-HFW4431D-AS,DH-IPC-HFW4436D-AS
    DH-IPC-HFW4231K-I4,DH-IPC-HFW4236K-I4,DH-IPC-HFW4431K-I4,DH-IPC-HFW4436K-I4
    DH-IPC-HFW4231K-I6,DH-IPC-HFW4236K-I6,DH-IPC-HFW4431K-I6,DH-IPC-HFW4436K-I6
    DH-IPC-HFW4233K-I4,DH-IPC-HFW4238K-I4,DH-IPC-HFW4233K-I6,DH-IPC-HFW4238K-I6
    DH-IPC-HFW4231M-I1,DH-IPC-HFW4236M-I1,DH-IPC-HFW4431M-I1,DH-IPC-HFW4436M-I1
    DH-IPC-HFW4231M-I2,DH-IPC-HFW4236M-I2,DH-IPC-HFW4431M-I2,DH-IPC-HFW4436M-I2
    DH-IPC-HFW4233M-I1,DH-IPC-HFW4238M-I1,DH-IPC-HFW4233M-I2,DH-IPC-HFW4238M-I2
    DH-IPC-HFW4233K-AS-I4,DH-IPC-HFW4238K-AS-I4,DH-IPC-HFW4233K-AS-I6,DH-IPC-HFW4238K-AS-I6
    DH-IPC-HFW4431K-AS-I4,DH-IPC-HFW4436K-AS-I4,DH-IPC-HFW4431K-AS-I6,DH-IPC-HFW4436K-AS-I6
    DH-IPC-HFW4233M-AS-I1,DH-IPC-HFW4238M-AS-I1,DH-IPC-HFW4233M-AS-I2,DH-IPC-HFW4238M-AS-I2
    DH-IPC-HFW4431M-AS-I1,DH-IPC-HFW4436M-AS-I1,DH-IPC-HFW4431M-AS-I2,DH-IPC-HFW4436M-AS-I2

    Based on official English firmware with following noteworthy changes:
    • English, French, Spanish and Russian language.
    • PAL/NTSC
    • Unlocked additional web GUI features/options.
      • Disable P2P: Network -> TCP/IP -> Easy4ip
    • Hacked Playback to also work with NAS/NFS.
      • Playback tab will be enabled when you have an SD card (default) or enabled NAS/NFS feature. (F5 after you added a NAS)
      • Added option to select NAS instead of SD, obviously...
      • I barely tested it but it seemed to play fine... feedback welcome.
      • FTP can not be supported, stop using it, it's awful.
    • Unlocked all IVS modes.
    • Disabled "CloudUpgradeServer".
    • Telnet enabled permanently on port 2300.

    For IPC-HX4XXX-NAND-Eos (-ZS models) cameras:
    https://i.botox.bz/General_IPC-HX4X...aRus_PN_Stream3_V2.420.0000.21.R.20160724.bin
    Software Version: 2.420.0000.21.R, Build Date: 2016-07-24
    MD5Sum: c9ce325783ef99f8c476e861ebd4f82a
    SHASum: 119f03c9a35509fb81393aa6653ace884873e57d

    Compatible cameras (guessed):
    IPC-HDBW4231R-ZS
    IPC-HDBW4431R-ZS

    Based on Chinese firmware with following noteworthy changes:
    • English, Chinese, French, Spanish and Russian language.
    • PAL/NTSC
    • Unlocked additional web GUI features/options.
      • Disable P2P: Network -> TCP/IP -> Easy4ip
    • Unlocked all IVS modes.
    • Disabled "CloudUpgradeServer".

    For IPC-HX4X2X-Themis ("Eco-savvy 2.0" 2nd gen) cameras:
    https://i.botox.bz/DH_IPC-HX4X2X-Themis.bin
    Software Version: 2.400.0000.34.R, Build Date: 2016-08-01
    MD5Sum: 3a6d937e453c91202ab64542d83f1a38
    SHASum: c5bfae26ff027d5c3a2c03e73dcbb9cf3e978759

    Compatible cameras according to Dahua:
    DH-IPC-HDW4120C-A,DH-IPC-HDW4125C-A
    DH-IPC-HDW4221C-A,DH-IPC-HDW4226C-A
    DH-IPC-HDW4421C-A,DH-IPC-HDW4426C-A
    DH-IPC-HDW4120C-A-V2,DH-IPC-HDW4125C-A-V2
    DH-IPC-HDW4120S,DH-IPC-HDW4125S,DH-IPC-HDW4221S,DH-IPC-HDW4226S
    DH-IPC-HDW4320S,DH-IPC-HDW4325S,DH-IPC-HDW4421S,DH-IPC-HDW4426S
    DH-IPC-HDW4120C,DH-IPC-HDW4125C,DH-IPC-HDW4221C,DH-IPC-HDW4226C
    DH-IPC-HDW4320C,DH-IPC-HDW4325C,DH-IPC-HDW4421C,DH-IPC-HDW4426C
    DH-IPC-HDBW4120R,DH-IPC-HDBW4125R,DH-IPC-HDBW4120R-AS,DH-IPC-HDBW4125R-AS
    DH-IPC-HDBW4221R,DH-IPC-HDBW4226R,DH-IPC-HDBW4221R-AS,DH-IPC-HDBW4226R-AS
    DH-IPC-HDBW4421R,DH-IPC-HDBW4426R,DH-IPC-HDBW4421R-AS,DH-IPC-HDBW4426R-AS
    DH-IPC-HFW4120B,DH-IPC-HFW4125B,DH-IPC-HFW4120D,DH-IPC-HFW4125D
    DH-IPC-HFW4221B,DH-IPC-HFW4226B,DH-IPC-HFW4221D,DH-IPC-HFW4226D
    DH-IPC-HFW4320B,DH-IPC-HFW4325B,DH-IPC-HFW4320D,DH-IPC-HFW4325D
    DH-IPC-HFW4421B,DH-IPC-HFW4426B,DH-IPC-HFW4421D,DH-IPC-HFW4426D
    DH-IPC-HFW4120F,DH-IPC-HFW4125F,DH-IPC-HFW4120F-AS,DH-IPC-HFW4125F-AS
    DH-IPC-HFW4120B-AS,DH-IPC-HFW4125B-AS,DH-IPC-HFW4120D-AS,DH-IPC-HFW4125D-AS
    DH-IPC-HFW4221B-AS,DH-IPC-HFW4226B-AS,DH-IPC-HFW4221D-AS,DH-IPC-HFW4226D-AS
    DH-IPC-HFW4421B-AS,DH-IPC-HFW4426B-AS,DH-IPC-HFW4421D-AS,DH-IPC-HFW4426D-AS

    For IPC-HX8XXX-Demeter (Pinhole) cameras:
    https://i.botox.bz/DH_IPC-HX8XXX-Demeter_Eng_P_V2.400.0000.10.R.20160314.bin
    MD5Sum: 21a05c0520a5e511cb476f1608505df1
    SHASum: cdb1e0b219d4586c50e74ba80019b34e958f06cb

    Compatible cameras according to HWID:
    IPC-HDBW8281-PC
    IPC-HDBW8281-Z
    IPC-HF8101
    IPC-HF8201
    IPC-HF8281
    IPC-HF8291E-4GT
    IPC-HF8301
    IPC-HF8351E-4GT
    IPC-HFW8101
    IPC-HFW8106
    IPC-HFW8201
    IPC-HFW8206
    IPC-HFW8281
    IPC-HFW8281E-IRA
    IPC-HFW8286
    IPC-HFW8301
    IPC-HFW8306
    IPC-HUM8101
    IPC-HUM8101-0280B

    NVRs:


    TIP: Reset your camera to default config before updating, seems like Dahua messed something up so sonia will crash on certain configs...

    PLEASE POST HERE IF YOU HAVE MORE LANGUAGES [OR A CAMERA WITH ANOTHER LANGUAGE]


    These cameras have checks in place (HWID) so you can't flash the wrong firmware, hopefully this should prevent you from bricking your camera.

    Experts can also use https://i.botox.bz/flashcp (from mtd-utils compiled with Hi3516a SDK) to flash .raw images to partitions on the camera from it's busybox shell.
    This is useful while messing around, testing changes so you don't have to flash the full upgrade image every time.

    WARNING: DO NOT FLASH THE OFFICIAL ENGLISH FIRMWARE ON CHINESE HARDWARE!
    It won't start and you'll have to flash your camera back to the chinese one manually (over telnet or TFTP recovery)
    And if you really want to try then at least do "appauto 0" to stop sonia from autostarting before flashing.
    I personally always add permanent telnet to the image I am flashing with Dahua-Firmware-Mod-Kit, like so: Add utelnetd server · BotoX/DH_IPC-HX4XXX-Eos@2ddf0f5 · GitHub

    Also, thanks to @nayr for chatting with me on IRC :v
    (If this helped you and you have some spare for a student: paypal.me/BotoXbz)
    (If shit hit the fan and you bricked your camera: Dahua IPC unbricking / recovery over serial UART and TFTP)
     
    Last edited: May 12, 2018
    Dahuacamcctv, AR22, Arjun and 28 others like this.
  2. randyth

    randyth Young grasshopper

    Joined:
    Aug 26, 2015
    Messages:
    72
    Likes Received:
    6
    Awesome stuff. I have a 4421c so i can't use this, but I have to say it's very awesome that you succeeded in customizing your own Dahua firmware!
     
  3. sumguy

    sumguy Young grasshopper

    Joined:
    Jan 23, 2016
    Messages:
    71
    Likes Received:
    8
    Is there any way you can mod the email SMTP part of the firmware so it will work properly? I'm finding that SMTP authentication can't be turned off on the HDW4431C. My SMTP server is set up for no authentication, no ssl or tls, and I can't get this camera to work properly with my mail server.
     
  4. Warwick

    Warwick n3wb

    Joined:
    Apr 14, 2015
    Messages:
    19
    Likes Received:
    0
    I tested the firmware ,but without Smart Function and IVS function.
     
    Last edited by a moderator: Sep 10, 2016
  5. cor35vet

    cor35vet Pulling my weight

    Joined:
    Jun 23, 2016
    Messages:
    337
    Likes Received:
    205
    That's probably in sonia as there is no sendmail binary on the camera.

    idk man, works for me™
    Screenshot_2016-09-10_19-12-18.png
    Which camera do you have?
     
  6. BillG

    BillG Getting the hang of it

    Joined:
    Nov 6, 2015
    Messages:
    166
    Likes Received:
    73
    Everything seems to work fine on my 4431C-A
     
  7. keithshlo

    keithshlo n3wb

    Joined:
    Sep 11, 2016
    Messages:
    21
    Likes Received:
    3
    Thanks a lot for the great firmware. It works pretty well so far. However, if I turn on "Smart codec", the IVS functions become disabled and inaccessible. Is this by design? Thanks.
     
  8. cor35vet

    cor35vet Pulling my weight

    Joined:
    Jun 23, 2016
    Messages:
    337
    Likes Received:
    205
    Well, I didn't make the software, I just added english language to it and patched the checks so I guess it is!
     
  9. wiz1der

    wiz1der n3wb

    Joined:
    Sep 2, 2016
    Messages:
    1
    Likes Received:
    0
    THanks for this! I just ordered these cams, and definitely want to upgrade the firmware. This is my first system and install. I will be using H265 for the compression, can you explain what smart codec is and If i need to sorry about it at all?

    Thanks!
     
  10. cor35vet

    cor35vet Pulling my weight

    Joined:
    Jun 23, 2016
    Messages:
    337
    Likes Received:
    205
    I have no clue what smart codec does, but some user said that it improves compression with h264.
    You shouldn't have to worry about it, they've added this feature recently (2 months ago?).
    H265 compression is already insane, doubt you could improve that without pouring lots more of processing power at it...
     
  11. nayr

    nayr IPCT Contributor

    Joined:
    Jul 16, 2014
    Messages:
    9,347
    Likes Received:
    5,242
    Location:
    Denver, CO
    smartCodec disables all IVS features and the 3rd substream on my camera.. and then I didnt notice much improvement, oah and smartpss had no idea what the bitrate was so it said 0bps..

    i dont think its anything you'll really miss and I could not find much documentation on it..

    upgrading the firmware, just because you can is not advised.. unless you know something is fixed that your having issues with its best to leave it on what you got it with.. if you brick this you'll have to patch into the serial bus and force a tftp recovery, presuming you have a good image to restore.
     
  12. nayr

    nayr IPCT Contributor

    Joined:
    Jul 16, 2014
    Messages:
    9,347
    Likes Received:
    5,242
    Location:
    Denver, CO
    thanks to @cor35vet Ive managed to flash my NVR 4216-4k to a Chinese firmware, and then converted it back to english successfully.. now to hack all the features enabled if we can figure out how.

    This is a great little tool, should be doable to change languages or rebrand devices without too much trouble.. if your determined and savvy enough.

    attached proof, firmware was applied from: http://download.dahuatech.com/kit_det.php?cid=3963 and was entirely Chinese before modification.
     

    Attached Files:

    Last edited by a moderator: Sep 17, 2016
  13. BLKMGK

    BLKMGK Getting the hang of it

    Joined:
    Jul 19, 2016
    Messages:
    81
    Likes Received:
    38
    Seems like we could maybe extract English language files from some firmware while in operation to stick back after a factory reset maybe?
     
  14. nayr

    nayr IPCT Contributor

    Joined:
    Jul 16, 2014
    Messages:
    9,347
    Likes Received:
    5,242
    Location:
    Denver, CO
    looks like might be possible to build a firmware package that just lays down the english modifications.. I think its how the grey market vendors are dong it.
     
  15. BLKMGK

    BLKMGK Getting the hang of it

    Joined:
    Jul 19, 2016
    Messages:
    81
    Likes Received:
    38
    If they were doing that why do we lose the language with a factory reset? Firmware shouldn't lose anything. It seems like they must make a non-persistent change? Agree that simply making a persistant language change would be best.
     
  16. nayr

    nayr IPCT Contributor

    Joined:
    Jul 16, 2014
    Messages:
    9,347
    Likes Received:
    5,242
    Location:
    Denver, CO
    because the modifications are stored on a custom partition for branding and tweaking camera config out of the box; hard reset is likely formatting that and getting factory defaults..

    Ive found firmware with only the update script and the custom partition image, indicating you can partially flash the firmware without changing everything.. depending on the partition u flash.. so in theory you can add the language files and over-ride to that custom branding image and just update that, leaving everything else intact.

    for example on my NVR there is a custom.lua file in this partition that has the variables:
    that when I flashed those into my Chinese firmware, it became english.. that was all I had to do.
     
    spoonek likes this.
  17. dobiwan

    dobiwan n3wb

    Joined:
    Sep 11, 2016
    Messages:
    5
    Likes Received:
    2
    Location:
    Germany
    I was testing this with the SD-Zi-Themis_Chn_PN_Stream3_IVS_V2.400.0000.17 version but cant handle the tables in config.py
    Anyone here who knows them .
    maybe like this
    dhboot.bin.img", {
    "required": False,
    "type": DAHUA_TYPE.Plain,
    "size": 0x00030000

    I had several errors because of th size,but i think its working with the Themis
     
  18. cor35vet

    cor35vet Pulling my weight

    Joined:
    Jun 23, 2016
    Messages:
    337
    Likes Received:
    205
    You should've contacted me :v
    This is the config for Themis: https://p.botox.bz/view/26279f91 (DH_IPC-HX4X2X-Themis not SD-Zi-Themis :v)
    You should check the partition-x.cramfs.img image in the firmware upgrade image for the right sizes. Also Install for which files are actually flashed.

    I am currently building a firmware image for Themis with the same modifications as for Eos.
    This is completely untested DH_IPC-HX4X2X-Themis firmware http://i.botox.bz/DH_IPC-HX4X2X-Themis.bin if anyone wants to try it out.
    I can't test it because I don't own such a device, compatibility list:
    DH-IPC-HDW4120C-A,DH-IPC-HDW4125C-A
    DH-IPC-HDW4221C-A,DH-IPC-HDW4226C-A
    DH-IPC-HDW4421C-A,DH-IPC-HDW4426C-A
    DH-IPC-HDW4120C-A-V2,DH-IPC-HDW4125C-A-V2
    DH-IPC-HDW4120S,DH-IPC-HDW4125S,DH-IPC-HDW4221S,DH-IPC-HDW4226S
    DH-IPC-HDW4320S,DH-IPC-HDW4325S,DH-IPC-HDW4421S,DH-IPC-HDW4426S
    DH-IPC-HDW4120C,DH-IPC-HDW4125C,DH-IPC-HDW4221C,DH-IPC-HDW4226C
    DH-IPC-HDW4320C,DH-IPC-HDW4325C,DH-IPC-HDW4421C,DH-IPC-HDW4426C
    DH-IPC-HDBW4120R,DH-IPC-HDBW4125R,DH-IPC-HDBW4120R-AS,DH-IPC-HDBW4125R-AS
    DH-IPC-HDBW4221R,DH-IPC-HDBW4226R,DH-IPC-HDBW4221R-AS,DH-IPC-HDBW4226R-AS
    DH-IPC-HDBW4421R,DH-IPC-HDBW4426R,DH-IPC-HDBW4421R-AS,DH-IPC-HDBW4426R-AS
     
    Last edited by a moderator: Sep 18, 2016
    xbmcnut, ilrider78, randyth and 3 others like this.
  19. BillG

    BillG Getting the hang of it

    Joined:
    Nov 6, 2015
    Messages:
    166
    Likes Received:
    73
    I just tried that Themis firmware on a 4421C that had the latest Chinese firmware, and it worked! Excellent..
     
    randyth and cor35vet like this.
  20. sumguy

    sumguy Young grasshopper

    Joined:
    Jan 23, 2016
    Messages:
    71
    Likes Received:
    8
    I soldered a micro-SD socket to the board inside one of my HDW4431C-A cameras and installed a 32 gb card. Once the camera powered up, I browsed through the setup options, including STORAGE, but found nothing new. In other words, the camera is not seeing or recognizing the SD card.

    So, if at all possible, if someone can create a modded firmware that might initialize or activate the SD card, I would volunteer to try it out.

    If this means turning the camera from a HDW4431C-A into a HDW4431C-AS, then that's fine. Doesn't such a camera model already exist? Maybe this is as simple as dropping the -AS firmware into the -A camera?

    Edit: Does this help?

    http://download.dahuatech.com/kitDo..._Chn_PN_Stream3_V2.420.0000.21.R.20160724.bin

    I got that from here: http://download.dahuatech.com/kit_det.php?cid=3877
     
    Last edited by a moderator: Sep 23, 2016
    Purduephotog likes this.
Tags: