Dahua Firmware Mod Kit + Modded Dahua Firmware

[cor35vet]

hey @cor35vet,
thanks for the hint to the right post. I tried to apply it to my 4431R-ZS and it seems to work, because I have the other languages too, now. But it's still the older Firmware from July. I hoped to get an actual one for the 4431R-ZS.
Also still have Problems with the plugin for IE. Does anyone else experience that? I also own a HFW1320S-W and a HDW4421EM-AS which work both with same plugin. If I connect to the HDBW4431R-ZS I have to install another plugin which overwrites the other one and which is not compatible with the other cams

If you can find a matching firmware for this camera then sure.
I couldn't find it anywhere, this camera has different size flash and partition layout.
I made the BUILD.bin using a modified firmware dump from another persons camera.

 

[Crazykiller]

h265 cameras use a different plugin, would require your old cameras to get a firmware update

OK, that makes sense to me, thanks for the hint. Both "old" cameras are new and latest firmware is installed, but they have no H265 ability. It's bad work from Dahua I think if this is not compatible with the other streams. In fact I actually use H264 on all cameras, so I don't understand why the new plugin does not support Gen. 2 models.


Gesendet von iPad mit Tapatalk

 

[nayr]

everything's in middle of migrating off the plugins right now; all the major browsers are dropping support for such plugins all together.. Chrome already did it, Firefox is doing it next month, Microsoft is pushing Edge which cant do em..

Your best bet is to use the apps right now; the security industry was not smart enough to get ANYONE into the html5 consortium and the got entirely left out of pluginless video support in HTML5.. and since 3rd party plugins have been a bane on internet security for decades the major browsers are nuking em from orbit.. The entire industry is in a tight spot right now, gotta start supporting new protocols just for browsers that nothing else is going to use, this will require more resources.. if they do, they wont go releasing new firmware for every camera they ever made, just new ones.

The WebUI works perfectly fine w/out the plugin loaded, just use your browser for easy setup/config and the apps for viewing/playback.. if you have multi-monitors this actually works better than before because now you can fullscreen the video while making changes to quality and see the differences alot better.

 

[Crazykiller]

If you can find a matching firmware for this camera then sure.
I couldn't find it anywhere, this camera has different size flash and partition layout.
I made the BUILD.bin using a modified firmware dump from another persons camera.

That sounds really great. Actually I'm in contact with the chinese seller who'll find me the actual chinese firmware. Hopefully he'll send me one.
I wondered about the size of the BUILD.bin, but this explains it at all. My version was already english, but yours is definitely better. Now I have to times english for selection, but the first is the customized simplified chinese i think. For example in the Playback tab i got still some chinese characters, also in error messages.
I would really appreciate if you'll do an extra Image for me if I get the actual, original one. I could imagine other people might also like an update for the 4431R-ZS.
Big thanks in advance

 

[Crazykiller]

everything's in middle of migrating off the plugins right now; all the major browsers are dropping support for such plugins all together.. Chrome already did it, Firefox is doing it next month, Microsoft is pushing Edge which cant do em..

Your best bet is to use the apps right now; the security industry was not smart enough to get ANYONE into the html5 consortium and the got entirely left out of pluginless video support in HTML5.. and since 3rd party plugins have been a bane on internet security for decades the major browsers are nuking em from orbit.. The entire industry is in a tight spot right now, gotta start supporting new protocols just for browsers that nothing else is going to use, this will require more resources.. if they do, they wont go releasing new firmware for every camera they ever made, just new ones.

The WebUI works perfectly fine w/out the plugin loaded, just use your browser for easy setup/config and the apps for viewing/playback.. if you have multi-monitors this actually works better than before because now you can fullscreen the video while making changes to quality and see the differences alot better.

Yes of Course, you are right. But I think it wouldn't have been a big deal to integrate support for "older" series 2 streams in the new plugin. Or maybe a different installpath to not overwrite the old one.
I already use the apps, but not everything works fine within the apps. I use Smart PSS 2.0, the NACL plugin for the other browsers and the apps for iOS. But if i wanna draw IVS stuff it didn't work with the NACL and i had to use the IE plugin. And of course i don't wanna change the app/plugin for every setting
Well, Overall I'm just starting with Dahua cams. My 4th one is arriving today, other three are still on their way. And i think I'll order more, because they are still much better than others, even with some bugs

 

[cor35vet]

Yes of Course, you are right. But I think it wouldn't have been a big deal to integrate support for "older" series 2 streams in the new plugin. Or maybe a different installpath to not overwrite the old one.
I already use the apps, but not everything works fine within the apps. I use Smart PSS 2.0, the NACL plugin for the other browsers and the apps for iOS. But if i wanna draw IVS stuff it didn't work with the NACL and i had to use the IE plugin. And of course i don't wanna change the app/plugin for every setting
Well, Overall I'm just starting with Dahua cams. My 4th one is arriving today, other three are still on their way. And i think I'll order more, because they are still much better than others, even with some bugs

If I get my hands on any firmware image for it (chinese or english) I'll make that happen.

Also: For me the NACL web plugin (for Chrome) doesn't even let me log into any camera anymore since a few months..

 

[Crazykiller]

Had the same issue with the NACL and with IE as well. With IE it helped to close all open browser and try again later. Maybe for NACL could be likewise. But I think you probably had a reboot within the last months
Sometimes users of Windows 10 are not aware that it does hybernating instead of shutdown, so after boot everything is reloaded into memory. But for sure this is not your problem


Gesendet von iPad mit Tapatalk

 

[cctvguynz]

The default for dh_keyboard is 1 which disables the serial UART on the camera that you could use to recover it when telnet is broken or the camera reboots right away (but still boots into linux).
So definitely set it to 0, there should be no drawbacks. (Unless you think it is a threat that someone takes apart your camera while it is running, solders two wires onto the pcb, gets root access and places a backdoor on it?? That they could do easier by unplugging the ethernet and flashing a modified firmware on it)


I will release 2016-12-09 soon with a proper crack that makes the camera think it is an English region one that will hopefully solve your problems.
Got it ready here but haven't written down the changes or done longer testing. Exams keeping me busy.

Thanks for your hard work! This works perfectly on my 4431R and solves the problem of the cameras not correctly working in my timezone with DST enabled.

 

[cor35vet]

Found something else, on successful TFTP connection the camera sends the log over UDP to 192.168.254.254 on port 5002.
So following line would let one see the output of the TFTP commands they executed: nc -u -l -p 5002 -k
Which gives following output:

gBootLogPtr:80b80008.
Check spi flash controller v350... Found
Spi(cs1) ID: 0xC8 0x40 0x18 0xC8 0x40 0x18
Spi(cs1): Block:64KB Chip:16MB Name:"GD25Q128"
partition file version 2
rootfstype squashfs root /dev/mtdblock7
In:    serial
Out:   serial
Err:   serial
TEXT_BASE:81000000
Net:   PHY found at 3
ETH0: PHY(phyaddr=-1, rmii) link UP: DUPLEX=FULL : SPEED=100M
MAC:   *SNIP*
Using gmac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'upgrade_info_7db780a713a4.txt'.Download to address: 0x84000000
Downloading: *
done
Bytes transferred = 114 (72 hex)
ETH0: PHY(phyaddr=-1, rmii) link UP: DUPLEX=FULL : SPEED=100M
MAC:   *SNIP*
Using gmac device
host 192.168.254.254 is alive
bootcmd=kload 0x82000000; bootm 0x82000000bootdelay=1baudrate=115200ipaddr=192.168.1.108serverip=192.168.1.1gatewayip=192.168.1.1netmask=255.255.255.0bootfile="uImage"wifiaddr=00:12:34:56:78:91appauto=1loglevel=4 pd=tftp 0x82000000 pd-x.squashfs.img; flwriteethact=gmacbootargs=mem=87M console=ttyS0,115200 root=/dev/mtdblock7 rootfstype=squashfsBSN=*SNIP*HWID=IPC-HDW4431C:01:02:05:23:1A:00:01:0A:01:00:00:258:00:00:00:00:00:01:00:00:100devalias=IPC-HDW4431C-Ada=tftp 0x82000000 dhboot.bin.img;flwrite;tftp 0x82000000 dhboot-min.bin.img;flwrite;dr=tftp 0x82000000 romfs-x.squashfs.img; flwrite;dk=tftp 0x82000000 kernel.img;flwrite;du=tftp 0x82000000 user-x.squashfs.img; flwritedw=tftp 0x82000000 web-x.squashfs.img; flwritedp=tftp 0x82000000 partition-x.cramfs.img;flwrite;dc=tftp 0x82000000 custom-x.squashfs.img; flwriteup=tftp 0x82000000 update.img;flwrite;tk=tftp 0x82000000 uImage;bootm;ID=*SNIP*ethaddr=*SNIP*stdin=serialstdout=serialstderr=serialverify=nver=U-Boot 2010.06-svn3089 (Jul 22 2016 - 19:15:59)filesize=72fileaddr=84000000dh_keyboard=0
Environment size: 1121/131068 bytes
partition file version 2
rootfstype squashfs root /dev/mtdblock7
fail to load bootargsParameters.txt
fail to load bootargsParameters.txt file
get bootargs info failed
cmdLine mem=87M console=ttyS0,115200 root=/dev/mtdblock7 rootfstype=squashfs
ETH0: PHY(phyaddr=-1, rmii) link UP: DUPLEX=FULL : SPEED=100M
MAC:   *SNIP*

for executing these commands:

ping 192.168.254.254
setenv dh_keyboard 0
printenv

It doesn't print "live" though, just before it loads the kernel I think.

Sadly this is not a netconsole but could come in handy still.

 

[Cyph]

I just received 4 more cameras from Aliexpress. And what do you know, the firmware is 12-09. It supports English, French, Spanish, and Russian. Any chance they're using @cor35vet's firmware? How can we tell if it's yours?



Also, easy4IP tab available. Default firmware doesn't have that right? =)

 

[cor35vet]

I just received 4 more cameras from Aliexpress. And what do you know, the firmware is 12-09. It supports English, French, Spanish, and Russian. Any chance they're using @cor35vet's firmware? How can we tell if it's yours?

View attachment 15482 View attachment 15483

Also, easy4IP tab available. Default firmware doesn't have that right? =)

Does look like mine judging by available languages and having easy4ip, access platform and auto register.
You can also check if they are running telnetd on port 2300.
Which seller/product link is this if I may know?

 

[Cyph]

Does look like mine judging by available languages and having easy4ip, access platform and auto register.
You can also check if they are running telnetd on port 2300.
Which seller/product link is this if I may know?

Yup. Telnet works on 2300. I'm unable to login as admin or root. Do you know what the login through telnet?

This is the store. WEB CAMERA - Small Orders Online Store, Hot Selling camera network,dahua 4mp,ip camera and more on Aliexpress.com | Alibaba Group

 

[Crazykiller]

Yup. Telnet works on 2300. I'm unable to login as admin or root. Do you know what the login through telnet?

This is the store. WEB CAMERA - Small Orders Online Store, Hot Selling camera network,dahua 4mp,ip camera and more on Aliexpress.com | Alibaba Group

Did you get the 4431R-ZS? If so you might get some trouble with it. I had with mine. Cor35vet did a new one for me from an original Chinese which I've got. Testing the next few days will show if this will run more stable than mine before, which caused some bootloops.

 

[cor35vet]

Yup. Telnet works on 2300. I'm unable to login as admin or root. Do you know what the login through telnet?

This is the store. WEB CAMERA - Small Orders Online Store, Hot Selling camera network,dahua 4mp,ip camera and more on Aliexpress.com | Alibaba Group

You need to prepend that stupid magic string for the password like said here: Dahua Enable Telnet

Did you get the 4431R-ZS? If so you might get some trouble with it. I had with mine. Cor35vet did a new one for me from an original Chinese which I've got. Testing the next few days will show if this will run more stable than mine before, which caused some bootloops.

I doubt it's the -ZS since I have not released firmware for that with russian language. (But will today since you've confirmed it works fine on your camera)

Lets hope this bring us even cheaper cameras from china hue hue.
If you guys know any other chinese dahua cameras (starlight/starvis for cheaper?) which lack english firmware you can request it here with the model + firmware.bin if you know it.
(But please no old or 1MP cameras, they have some stupid filesystems and motorola processors that I can't open in IDA :v)

 

[Crazykiller]

@cor35vet: I think i encountered a tiny bug with the translations. I've testet the one from your first post on a HDBW4431R-AS and HFW4431M-AS-I2. With both the timestamp overlay disapears if i select to Show weekday as well. With the firmware you've build for my HDBW4431R-ZS it only gets a little bit to the left and nothing else happens, but still doesn't show weekday, only if i select simplified chinese.

 

[cor35vet]

@cor35vet: I think i encountered a tiny bug with the translations. I've testet the one from your first post on a HDBW4431R-AS and HFW4431M-AS-I2. With both the timestamp overlay disapears if i select to Show weekday as well. With the firmware you've build for my HDBW4431R-ZS it only gets a little bit to the left and nothing else happens, but still doesn't show weekday, only if i select simplified chinese.

It's the same bug as with the emails missing the translation.
Tried on both chinese and english firmware -> works.
However the translation file in my firmware is not missing those strings, I'll investigate, thanks.

Edit: It seems to be my stripped down translation file, why I do not know though.

 

[Crazykiller]

Didn't recognize until yet. Just tried on both... the result is nearly the same:

&alarm_smtp.matter: &Mail_Test
&alarm_smtp.inchannel: 1
&alarm_smtp.starttime: 24/02/2017 17:26:34
&alarm_smtp.devicename: IPC-HDBW4431R-ZS
&com_str.alarminname:
&alarm_smtp.senderIP: 192.168.1.208

The only difference is, the firmware of your first post also have the sender MISSING_MAILBOX@SYNTAX_ERROR, the 4431R-ZS had my email address as sender as it's intended to be.

 

[cor35vet]

Okay, haha, very funny Dahua.
Their translation file is saved as UTF-8 with BOM header (three bytes at the start of the file: 0xEF 0xBB 0xBF)
Mine was saved as normal UTF-8 (without the BOM header/3 bytes).
What a weird bug..

Updated lang.py to save as utf-8-sig now, do the following to fix a language file if you must:
lang.py English.txt English.txt English.txt

I fixed the bug in the Eos image in the OP, will upload -ZS one soon too.
Also added "Video Clip" for Sub Stream 2:

Changes on GitHub: Commits · BotoX/DH_IPC-HX4XXX-Eos · GitHub

 

[onurcrzy]

hi
nvr7464-16p chinese config please
大华股份

mtd paste
dev: size erasesize name
mtd0: 00080000 00010000 "boot"
mtd1: 01700000 00010000 "rootfs"
mtd2: 00380000 00010000 "web"
mtd3: 00080000 00010000 "custom"
mtd4: 000c0000 00010000 "logo"
mtd5: 00140000 00010000 "config"
mtd6: 00280000 00010000 "misc"

 

[cor35vet]

hi
nvr7464-16p chinese config please
大华股份

mtd paste
dev: size erasesize name
mtd0: 00080000 00010000 "boot"
mtd1: 01700000 00010000 "rootfs"
mtd2: 00380000 00010000 "web"
mtd3: 00080000 00010000 "custom"
mtd4: 000c0000 00010000 "logo"
mtd5: 00140000 00010000 "config"
mtd6: 00280000 00010000 "misc"

Not an easy task without hardware, certainly...
But give it a try I guess: https://i.botox.bz/DH_NVR7xxx_Chn_P_V3.200.0000.0.R.20160412.bin
And please report if it works, maybe I can apply the same to other NVRs too.