Dahua Firmware Mod Kit + Modded Dahua Firmware

So I just check serial... here is what i got

U-Boot 2010.06-svn3638 (Dec 09 2016 - 15:45:17)
DRAM: 1 GiB
gBootLogPtr:80b80008.
NAND: Check nand flash controller v610. found
Special NAND id table Version 1.36
Nand ID: 0x98 0xF1 0x80 0x15 0xF2 0x16 0x08 0x00
NAND_ECC_NONE selected by board driver. This is not recommended !!
128 MiB
partition file version 2
rootfstype squashfs root /dev/mtdblock7
In: serial
Out: serial
Err: serial
TEXT_BASE:81000000
Net: PHY found at 3

ETH0: PHY(phyaddr=-1, rmii) link UP: DUPLEX=FULL : SPEED=100M
MAC: E0-50-8B-4E-D6-50
Using gmac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'upgrade_info_7db780a713a4.txt'.
Download to address: 0x84000000
Downloading: *
Retry count exceeded; starting again
Try again use backup_serverip
ETH0: PHY(phyaddr=-1, rmii) link UP: DUPLEX=FULL : SPEED=100M
MAC: E0-50-8B-4E-D6-50
*** ERROR: `serverip' not set
Failed to get info.txt
Fail to get info file!
Init error!
ETH0: PHY(phyaddr=-1, rmii) link UP: DUPLEX=FULL : SPEED=100M
MAC: E0-50-8B-4E-D6-50
Using gmac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'failed.txt'.
Download to address: 0x82000000
Downloading: *
Retry count exceeded; starting again
state:ff,err_count:00
ETH0: PHY(phyaddr=-1, rmii) link UP: DUPLEX=FULL : SPEED=100M
MAC: E0-50-8B-4E-D6-50
## Booting kernel from Legacy Image at 82000000 ...
Image Name: Linux-3.4.35
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 2539952 Bytes = 2.4 MiB
Load Address: 80008000
Entry Point: 80008000
Loading Kernel Image ...OK
OK
partition file version 2
rootfstype squashfs root /dev/mtdblock7
fail to load bootargsParameters.txt
fail to load bootargsParameters.txt file
get bootargs info failed
cmdLine mem=93M console=ttyS0,115200 root=/dev/mtdblock7 rootfstype=squashfs
crashflasg:1, logmagic:54410011.

Starting kernel ...
Uncompressing Linux... done, booting the kernel.
Click to expand...

I try to "stop" to get the cmd line with the *, but it seems not possible, the cam is booting and don't let me in...
I Have connected Rx, TX and ground to the metal body of the cam
 
Last edited:
cor35vet said:
Hi,

I've been hacking around with my Dahua camera and made a script to unpack and rebuild the firmware upgrade images.
Check out the Github for more info: GitHub - BotoX/Dahua-Firmware-Mod-Kit: Unpack and repack Dahua IP camera firmware upgrade images.

Give me firmware for my camera!
You can download the firmware image that fits your camera below and flash it to your camera or unpack and modify it more.
It will work on both Chinese and international models.
International cameras can flash back to official English firmware after using my modded firmware.
Chinese cameras will never work with official English firmware - they need to be patched.

For Eos (3rd gen) cameras:
https://i.botox.bz/DH_IPC-HX4XXX-Eos_EngFraSpaRus_PN_Stream3_V2.420.0000.22.R.20161209.bin
Software Version: 2.420.0000.22.R, Build Date: 2016-12-09
MD5Sum: 1332430392def5d9becd4e883d26f7d8
SHASum: 1bc476b78fd706b225243c12a334631971ea6a7c

Compatible cameras according to Dahua:
DH-IPC-HDBW4231R,DH-IPC-HDBW4236R
DH-IPC-HDBW4431R,DH-IPC-HDBW4436R
DH-IPC-HDW4231C-A,DH-IPC-HDW4236C-A
DH-IPC-HDW4233C-A,DH-IPC-HDW4238C-A
DH-IPC-HDW4431C-A,DH-IPC-HDW4436C-A
DH-IPC-HDBW4431R-S,DH-IPC-HDBW4436R-S
DH-IPC-HDBW4233R-AS,DH-IPC-HDBW4238R-S
DH-IPC-HDBW4231R-AS,DH-IPC-HDBW4236R-AS
DH-IPC-HDBW4431R-AS,DH-IPC-HDBW4436R-AS
DH-IPC-HDBW4231R-VF,DH-IPC-HDBW4431R-VF
DH-IPC-HFW4231F,DH-IPC-HFW4236F,DH-IPC-HFW4431F,DH-IPC-HFW4436F
DH-IPC-HFW4231B,DH-IPC-HFW4236B,DH-IPC-HFW4431B,DH-IPC-HFW4436B
DH-IPC-HFW4231D,DH-IPC-HFW4236D,DH-IPC-HFW4431D,DH-IPC-HFW4436D
DH-IPC-HFW4231R-Z,DH-IPC-HFW4431R-Z,DH-IPC-HFW4231R-VF,DH-IPC-HFW4431R-VF
DH-IPC-HFW4231F-AS,DH-IPC-HFW4236F-AS,DH-IPC-HFW4431F-AS,DH-IPC-HFW4436F-AS
DH-IPC-HFW4231B-AS,DH-IPC-HFW4236B-AS,DH-IPC-HFW4431B-AS,DH-IPC-HFW4436B-AS
DH-IPC-HFW4231D-AS,DH-IPC-HFW4236D-AS,DH-IPC-HFW4431D-AS,DH-IPC-HFW4436D-AS
DH-IPC-HFW4231K-I4,DH-IPC-HFW4236K-I4,DH-IPC-HFW4431K-I4,DH-IPC-HFW4436K-I4
DH-IPC-HFW4231K-I6,DH-IPC-HFW4236K-I6,DH-IPC-HFW4431K-I6,DH-IPC-HFW4436K-I6
DH-IPC-HFW4233K-I4,DH-IPC-HFW4238K-I4,DH-IPC-HFW4233K-I6,DH-IPC-HFW4238K-I6
DH-IPC-HFW4231M-I1,DH-IPC-HFW4236M-I1,DH-IPC-HFW4431M-I1,DH-IPC-HFW4436M-I1
DH-IPC-HFW4231M-I2,DH-IPC-HFW4236M-I2,DH-IPC-HFW4431M-I2,DH-IPC-HFW4436M-I2
DH-IPC-HFW4233M-I1,DH-IPC-HFW4238M-I1,DH-IPC-HFW4233M-I2,DH-IPC-HFW4238M-I2
DH-IPC-HFW4233K-AS-I4,DH-IPC-HFW4238K-AS-I4,DH-IPC-HFW4233K-AS-I6,DH-IPC-HFW4238K-AS-I6
DH-IPC-HFW4431K-AS-I4,DH-IPC-HFW4436K-AS-I4,DH-IPC-HFW4431K-AS-I6,DH-IPC-HFW4436K-AS-I6
DH-IPC-HFW4233M-AS-I1,DH-IPC-HFW4238M-AS-I1,DH-IPC-HFW4233M-AS-I2,DH-IPC-HFW4238M-AS-I2
DH-IPC-HFW4431M-AS-I1,DH-IPC-HFW4436M-AS-I1,DH-IPC-HFW4431M-AS-I2,DH-IPC-HFW4436M-AS-I2

Based on official English firmware with following noteworthy changes:
  • English, French, Spanish and Russian language.
  • PAL/NTSC
  • Unlocked additional web GUI features/options.
    • Disable P2P: Network -> TCP/IP -> Easy4ip
  • Hacked Playback to also work with NAS/NFS.
    • Playback tab will be enabled when you have an SD card (default) or enabled NAS/NFS feature. (F5 after you added a NAS)
    • Added option to select NAS instead of SD, obviously...
    • I barely tested it but it seemed to play fine... feedback welcome.
    • FTP can not be supported, stop using it, it's awful.
  • Unlocked all IVS modes.
  • Disabled "CloudUpgradeServer".
  • Telnet enabled permanently on port 2300.

For NAND-Eos (-ZS) cameras:
https://i.botox.bz/General_IPC-HX4X...aRus_PN_Stream3_V2.420.0000.21.R.20160724.bin
Software Version: 2.420.0000.21.R, Build Date: 2016-07-24
MD5Sum: c9ce325783ef99f8c476e861ebd4f82a
SHASum: 119f03c9a35509fb81393aa6653ace884873e57d

Compatible cameras (guessed):
IPC-HDBW4231R-ZS
IPC-HDBW4431R-ZS
IPC-HDBW4231R-ZS
IPC-HDBW4431R-ZS
IPC-HDBW4231R-ZS
IPC-HDBW4431R-ZS

Based on Chinese firmware with following noteworthy changes:
  • English, Chinese, French, Spanish and Russian language.
  • PAL/NTSC
  • Unlocked additional web GUI features/options.
    • Disable P2P: Network -> TCP/IP -> Easy4ip
  • Unlocked all IVS modes.
  • Disabled "CloudUpgradeServer".

For Themis (2nd gen) cameras:
https://i.botox.bz/DH_IPC-HX4X2X-Themis.bin
Software Version: 2.400.0000.34.R, Build Date: 2016-08-01
MD5Sum: 3a6d937e453c91202ab64542d83f1a38
SHASum: c5bfae26ff027d5c3a2c03e73dcbb9cf3e978759

Compatible cameras according to Dahua:
DH-IPC-HDW4120C-A,DH-IPC-HDW4125C-A
DH-IPC-HDW4221C-A,DH-IPC-HDW4226C-A
DH-IPC-HDW4421C-A,DH-IPC-HDW4426C-A
DH-IPC-HDW4120C-A-V2,DH-IPC-HDW4125C-A-V2
DH-IPC-HDW4120S,DH-IPC-HDW4125S,DH-IPC-HDW4221S,DH-IPC-HDW4226S
DH-IPC-HDW4320S,DH-IPC-HDW4325S,DH-IPC-HDW4421S,DH-IPC-HDW4426S
DH-IPC-HDW4120C,DH-IPC-HDW4125C,DH-IPC-HDW4221C,DH-IPC-HDW4226C
DH-IPC-HDW4320C,DH-IPC-HDW4325C,DH-IPC-HDW4421C,DH-IPC-HDW4426C
DH-IPC-HDBW4120R,DH-IPC-HDBW4125R,DH-IPC-HDBW4120R-AS,DH-IPC-HDBW4125R-AS
DH-IPC-HDBW4221R,DH-IPC-HDBW4226R,DH-IPC-HDBW4221R-AS,DH-IPC-HDBW4226R-AS
DH-IPC-HDBW4421R,DH-IPC-HDBW4426R,DH-IPC-HDBW4421R-AS,DH-IPC-HDBW4426R-AS
DH-IPC-HFW4120B,DH-IPC-HFW4125B,DH-IPC-HFW4120D,DH-IPC-HFW4125D
DH-IPC-HFW4221B,DH-IPC-HFW4226B,DH-IPC-HFW4221D,DH-IPC-HFW4226D
DH-IPC-HFW4320B,DH-IPC-HFW4325B,DH-IPC-HFW4320D,DH-IPC-HFW4325D
DH-IPC-HFW4421B,DH-IPC-HFW4426B,DH-IPC-HFW4421D,DH-IPC-HFW4426D
DH-IPC-HFW4120F,DH-IPC-HFW4125F,DH-IPC-HFW4120F-AS,DH-IPC-HFW4125F-AS
DH-IPC-HFW4120B-AS,DH-IPC-HFW4125B-AS,DH-IPC-HFW4120D-AS,DH-IPC-HFW4125D-AS
DH-IPC-HFW4221B-AS,DH-IPC-HFW4226B-AS,DH-IPC-HFW4221D-AS,DH-IPC-HFW4226D-AS
DH-IPC-HFW4421B-AS,DH-IPC-HFW4426B-AS,DH-IPC-HFW4421D-AS,DH-IPC-HFW4426D-AS

NVRs:
NVR7xxx: https://i.botox.bz/DH_NVR7xxx_Eng_P_V3.200.0000.0.R.20160311.bin


TIP: Reset your camera to default config before updating, seems like Dahua messed something up so sonia will crash on certain configs...

PLEASE POST HERE IF YOU HAVE MORE LANGUAGES [OR A CAMERA WITH ANOTHER LANGUAGE]

These cameras have checks in place (HWID) so you can't flash the wrong firmware, hopefully this should prevent you from bricking your camera.

Experts can also use https://i.botox.bz/flashcp (from mtd-utils compiled with Hi3516a SDK) to flash .raw images to partitions on the camera from it's busybox shell.
This is useful while messing around, testing changes so you don't have to flash the full upgrade image every time.

WARNING: DO NOT FLASH THE OFFICIAL ENGLISH FIRMWARE ON CHINESE HARDWARE!
It won't start and you'll have to flash your camera back to the chinese one manually (over telnet or TFTP recovery)
And if you really want to try then at least do "appauto 0" to stop sonia from autostarting before flashing.
I personally always add permanent telnet to the image I am flashing with Dahua-Firmware-Mod-Kit, like so: Add utelnetd server · BotoX/DH_IPC-HX4XXX-Eos@2ddf0f5 · GitHub

Also, thanks to @nayr for chatting with me on IRC :v
(If this helped you and you have some spare for a student: paypal.me/BotoX)
(If shit hit the fan and you bricked your camera: Dahua IPC unbricking / recovery over serial UART and TFTP)
Click to expand...

What is Telnet PORT of dahua ip cameras?
 
I'm trying to unpack and repack "DH_HCVR7x08-4M_EngSpnFrn_NP_V3.210.0001.9.R.20170315" with a new logo in it for our customers since some of the new firmware doesn't let you upload a logo the normal way. Is there any help that can be given on this im getting these errors when i try to repack the bin :

"INFO Checking required files/directories.
ERROR Could not find required '.uImage' file for file: 'logo-x.cramfs.img'
Traceback (most recent call last):
File "./build.py", line 298, in <module>
builder.Build(args.source)
File "./build.py", line 65, in Build
raise Exception("Missing requirement!")
Exception: Missing requirement!

I can unpack the bin using the extract.py and try to repack it immediately and it gives me this. I am still learning this but i do need to get this working soon as possible.

Thank you in advance!
 
Nicko said:
Cor35vet, could please patch me this firmware with telnet please? I'm sorry the one is send you was not the good one!
It's not eos but rhea!
Index of /Dahua/kamerove_systemy/_Firmware/04IPC/05-Eco-savvy 3.0/DH/DH_IPC-HX5X3X-Rhea_Eng_P_Stream3_V2.460.0000.9.R.20170428

Many thanks
Click to expand...
Will do tomorrow.

Kryogen said:
I'm trying to unpack and repack "DH_HCVR7x08-4M_EngSpnFrn_NP_V3.210.0001.9.R.20170315" with a new logo in it for our customers since some of the new firmware doesn't let you upload a logo the normal way. Is there any help that can be given on this im getting these errors when i try to repack the bin :

"INFO Checking required files/directories.
ERROR Could not find required '.uImage' file for file: 'logo-x.cramfs.img'
Traceback (most recent call last):
File "./build.py", line 298, in <module>
builder.Build(args.source)
File "./build.py", line 65, in Build
raise Exception("Missing requirement!")
Exception: Missing requirement!

I can unpack the bin using the extract.py and try to repack it immediately and it gives me this. I am still learning this but i do need to get this working soon as possible.

Thank you in advance!
Click to expand...
Give me your config for HCVR7x08 and the firmware you used so I can try.
 
from .config import *

DAHUA_FILES = OrderedDict([
("Install.lua", {
"required": True,
"type": DAHUA_TYPE.Plain
}),
("u-boot.bin.img", {
"required": True,
"type": DAHUA_TYPE.Plain,
}),
("romfs-x.cramfs.img", {
"required": True,
"type": DAHUA_TYPE.uImage | DAHUA_TYPE.SquashFS
}),
("web-x.cramfs.img", {
"required": True,
"type": DAHUA_TYPE.uImage | DAHUA_TYPE.SquashFS
}),
("custom-x.cramfs.img", {
"required": True,
"type": DAHUA_TYPE.uImage | DAHUA_TYPE.CramFS
}),
("logo-x.cramfs.img", {
"required": True,
"type": DAHUA_TYPE.uImage | DAHUA_TYPE.CramFS
}),
("sign.img", {
"required": True,
"type": DAHUA_TYPE.Plain
}),
])
 

Attachments

Hi guys! I have a lot of firmware on the camera. Even on cameras from China. There are files for recovery through SPI. There are commands for working with the camera through the UART port. To whom it is interesting, I can help.

Why am I here, I need help. I have VTH1550 and firmware. I want to unpack for him. I do not know Linux and ask for help.

Tomorrow I will lay out the firmware for VTH1550 and make a config for it.

Are there any unpacking solutions for Windows? Or only Linux?

Thank you all! Tomorrow I will post some information on working with UART
 
Cor35vet, sorry to annoy you again but did you get time to patch this firmware with telnet?

http://ftp.asm.cz/Dahua/kamerove_sy...ea_Eng_P_Stream3_V2.460.0000.9.R.20170428.bin

I tryed again 'about 30 times) to connect with serial UART, but same, i can't stop booting and get my hands on the console. I tryed "*", "esc", "clear", "ctrl+c" before poe plugging... nothing change!

many thanks for your help, you do a great job!
 
  • Like
Reactions: J4m3s
Amazing that you are helping so many people out!

I have a HDBW4421R-AS which is a Chinese model which I wasn't aware of when buying and the seller does not reply to emails to help me out.

System->general->language dropdown only shows English. Video standard both PAL and NTSC.

Are you able to mod the latest firmware for this to have it in English?

http://download.dahuatech.com/kitDo...s_chn_pn_stream3_v2.606.0005.0.r.20170313.bin

Camera details:
Code: 
Version

Device TypeIPC-HDBW4421R-AS
Software Version2.400.0000.10.R, build : 2015-06-18
WEB Version3.2.1.277266
ONVIF Version2.4.1

Many thanks!
 
Hello guys! For repair some DAHUA devices, i uses this programms (for Windows)

In NCOM:

Select COM-port in Options tab, baund rate is 115200 => OK
Click on tab File => Connect
If you see in the upper left corner of the program where it is written: NCOM v1.02 [COM:x] - then the program can not open this port
If you see in the upper left corner of the program where it is written: NCOM v1.02 [COM1,115200bps] - then is OK

In TFTP Server

Click tab View => Option
Change TFTP server root directory (i used UPDATE folder in root directory TFTP programm)
OK
In the upper left corner of the program where it is written: Cisco TFTP Server (you IP)
Remember you IP please.

Procedure:

Run NCOM, select port.
Run TFTP Server, download FW for you device in UPDATE folder (bootloader in DAHUA devices understand only *.img files)
Connect LAN cable on device
If the device is powered only by PoE, do not connect the LAN cable
If the device is powered by 12v DC, connect the LAN cable
Connect you COM-cable (USB to UART on FT232/PL2303/CP2101-02 or RS232 to UART on MAX232/MAX3232) on device
All DAHUA devices have same pinouts: Rx Tx GND +3.3
Switch to the program NCOM
Turn on the 12V power or connect the PoE LAN cable
if all operations is right, in NCOM you see bootloader LOG

For example, my VTH1550 LOG:

Checking DDR......OK

UBL Version: 1.46t(DM365)09:30:17 Sep 2 2014
Oscillator: 24MHZ
ARM Rate: 432 MHZ
DDR Rate: 340 MHZ
BootMode: SPI
Starting SPI Memory Copy...
DONE


U-Boot 1.3.6 (jerry) (Sep 2 2014 - 09:44:01)

DRAM: 128 MB
SF: Got idcode c2 20 18 c2 20
In: serial
Out: serial
Err: serial
Ethernet PHY: GENERIC @ 0x05,id:221513
total gio 2
gio[22]=1
gio[25]=1
davinci_eth_open:no link
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Filename 'upgrade_info_7db780a713a4.txt'.
Load address: 0x80100000
Loading: WARN: emac_send_packet: No link

Retry count exceeded; starting again
Fail to get info file!
Init error!
davinci_eth_open:no link
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Filename 'failed.txt'.
Load address: 0x80200000
Loading: WARN: emac_send_packet: No link

Retry count exceeded; starting again
==>use default images
.......
## Booting kernel from Legacy Image at 80007fc0 ...
Image Name: Linux-2.6.18_pro500-davinci_evm-
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 1685840 Bytes = 1.6 MB
Load Address: 80008000
Entry Point: 80008000
Verifying Checksum ... OK
XIP Kernel Image ... OK
OK

Starting kernel ...

Uncompressing Linux................................................................................................................... done, booting the kernel.
 

Attachments

If you want STOP booting device, to point:
"Turn on the 12V power or connect the PoE LAN cable"

PRESS and HOLD "*"-button BEFORE turn on the 12V power or connect the PoE LAN cable while you don't see you "***********************************" in NCOM programm

For example, my VTH1550 LOG:

UBL Version: 1.46t(DM365)09:30:17 Sep 2 2014
Oscillator: 24MHZ
ARM Rate: 432 MHZ
DDR Rate: 340 MHZ
BootMode: SPI
Starting SPI Memory Copy...
DONE


U-Boot 1.3.6 (jerry) (Sep 2 2014 - 09:44:01)

DRAM: 128 MB
SF: Got idcode c2 20 18 c2 20
In: serial
Out: serial
Err: serial
Ethernet PHY: GENERIC @ 0x05,id:221513
total gio 2
gio[22]=1
gio[25]=1
davinci_eth_open:no link
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Filename 'upgrade_info_7db780a713a4.txt'.
Load address: 0x80100000
Loading: WARN: emac_send_packet: No link

Retry count exceeded; starting again
Fail to get info file!
Init error!
davinci_eth_open:no link
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Filename 'failed.txt'.
Load address: 0x80200000
Loading: WARN: emac_send_packet: No link

Retry count exceeded; starting again
==>use default images
DHBOOT# ***************
Checking DDR......OK

UBL Version: 1.46t(DM365)09:30:17 Sep 2 2014
Oscillator: 24MHZ
ARM Rate: 432 MHZ
DDR Rate: 340 MHZ
BootMode: SPI
Starting SPI Memory Copy...
DONE


U-Boot 1.3.6 (jerry) (Sep 2 2014 - 09:44:01)

DRAM: 128 MB
SF: Got idcode c2 20 18 c2 20
In: serial
Out: serial
Err: serial
Ethernet PHY: GENERIC @ 0x05,id:221513
total gio 2
gio[22]=1
gio[25]=1
davinci_eth_open:no link
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Filename 'upgrade_info_7db780a713a4.txt'.
Load address: 0x80100000
Loading: WARN: emac_send_packet: No link

Retry count exceeded; starting again
Fail to get info file!
Init error!
davinci_eth_open:no link
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Filename 'failed.txt'.
Load address: 0x80200000
Loading: WARN: emac_send_packet: No link

Retry count exceeded; starting again
==>use default images
DHBOOT# *****************

THIS IS MY "*********************************"
 
Congratulations!!! You stopped booting the device.

Press ENTER button after you "************"
You see: Unknown command '*****************' - try 'help'

Some commands:

help - is help list commands

lip - set Local IP address ex: lip 192.168.1.100
sip - set TFTP Server IP address ex: sip 192.168.1.200

printenv - printing all variable enviroment in device

For example, my VTH1550 LOG:

DHBOOT# printenv
bootcmd=fsload
bootdelay=3
baudrate=115200
eth1addr=00:01:5b:00:55:66
eth2addr=00:01:5b:00:77:88
netmask=255.255.255.0
bootfile="uImage"
single=0
da=protect off all;tftp 81a00000 dm365_ubl_boot_16M.bin.img;flwrite
dc=tftp 81a00000 custom-x.cramfs.img; flwrite
dr=tftp 81a00000 romfs-x.cramfs.img; flwrite
du=tftp 81a00000 user-x.cramfs.img; flwrite
dd=tftp 81a00000 data-x.cramfs.img; flwrite
dw=tftp 81a00000 web-x.cramfs.img; flwrite
dg=tftp 81a00000 gui-x.cramfs.img; flwrite
dk=tftp 81a00000 kernel-x.cramfs.img; flwrite
up=tftp 81a00000 update.img; flwrite
tk=tftp 80800000 uImage; bootm 80800000
gionum=22.25
gioval=1.1
dh_com=0
autosip=192.168.254.254
autolip=192.168.1.108
autogw=192.168.1.1
autonm=255.255.255.0
HWID=VTH1510CH:0:4:2:0:5:4:1:9:3:3:1:1B0:0:0:0:6:0:0:1
bootargs=console=ttyS0,115200n8 root=/dev/mtdblock4 rootfstype=cramfs,nolock mem=90M video=davincifb:vid0=OFF:vid1=OFF:osd0=OFF:osd1=OFF
ID=*********************
ethaddr=3C:EF:8C:1E:EA:E9
serverip=192.168.1.250
ipaddr=192.168.1.108
filesize=C98DE8
fileaddr=81A00000
appauto=1
dh_keybord=1
dh_keyboard=1
stdin=serial
stdout=serial
stderr=serial
ver=U-Boot 1.3.6 (jerry) (Sep 2 2014 - 09:44:01)

Environment size: 1164/16380 bytes
DHBOOT#
 
If write command

set ID 123456789 then the ID becomes 123456
set dh_keyboard 0 then the dh_keyboard becomes 0

After changing any variable, you need to write a command:

saveenv

This command save all variable in device

Command dh_keyboard 0 opened debug log on UART port
Command dh_keyboard 1 closed debug log on UART port, only starting log

Command appauto 0 only loads the bootloader only
Command appauto 1 is normal starting device

reset command is work

rebot or restart command is not work
 
But now, the most delicious!!!

da=protect off all;tftp 81a00000 dm365_ubl_boot_16M.bin.img;flwrite
dc=tftp 81a00000 custom-x.cramfs.img; flwrite
dr=tftp 81a00000 romfs-x.cramfs.img; flwrite
du=tftp 81a00000 user-x.cramfs.img; flwrite
dd=tftp 81a00000 data-x.cramfs.img; flwrite
dw=tftp 81a00000 web-x.cramfs.img; flwrite
dg=tftp 81a00000 gui-x.cramfs.img; flwrite
dk=tftp 81a00000 kernel-x.cramfs.img; flwrite
up=tftp 81a00000 update.img; flwrite
tk=tftp 80800000 uImage; bootm 80800000

Write in bootloader command^

run da

And start downloading and flashing the file dm365_ubl_boot_16M.bin.img from the TFTP server

run up

And start downloading and flashing the file update.img from the TFTP server

For example, my VTH1550 LOG:


Checking DDR......OK

UBL Version: 1.46t(DM365)09:30:17 Sep 2 2014
Oscillator: 24MHZ
ARM Rate: 432 MHZ
DDR Rate: 340 MHZ
BootMode: SPI
Starting SPI Memory Copy...
DONE


U-Boot 1.3.6 (jerry) (Sep 2 2014 - 09:44:01)

DRAM: 128 MB
SF: Got idcode c2 20 18 c2 20
In: serial
Out: serial
Err: serial
Ethernet PHY: GENERIC @ 0x05,id:221513
total gio 2
gio[22]=1
gio[25]=1
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Filename 'upgrade_info_7db780a713a4.txt'.
Load address: 0x80100000
Loading:
Retry count exceeded; starting again
Fail to get info file!
Init error!
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Filename 'failed.txt'.
Load address: 0x80200000
Loading:
Retry count exceeded; starting again
==>use default images
DHBOOT# ***
Unknown command '********************' - try 'help'

DHBOOT# lip 192.168.1.100
Set local address success!
Now local ip addr: 192.168.1.100

DHBOOT# sip 192.168.1.250
Set server ip address success!
Now server ip addr: 192.168.1.250

DHBOOT# saveenv
Saving Environment to SPI Flash...
Erasing SPI flash...Writing to SPI flash...done

DHBOOT# run da
TFTP from server 192.168.1.250; our IP address is 192.168.1.100
Filename 'dm365_ubl_boot_16M.bin.img'.
Load address: 0x81a00000
Loading:###################################################
done
Bytes transferred = 257984 (3efc0 hex)

## Checking Image at 0x81a00000 ...
Header CRC Checking ... OK
Image Name: uboot
Image Type: ARM Linux Firmware (uncompressed)
Data Size: 257920 Bytes = 251.9 kB
Load Address: 02000000
Entry Point: 02040000
Data CRC Checking ... OK
Programing start at: 0x00000000

write : 0
write : 25
write : 50
write : 75
write : 100
done
DHBOOT#
 
run up command log:


DHBOOT# run up
TFTP from server 192.168.1.250; our IP address is 192.168.1.100
Filename 'update.img'.
Load address: 0x81a00000
Loading: #################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
###
done
Bytes transferred = 12991376 (c63b90 hex)

## Checking Image at 0x81a00040 ...
Header CRC Checking ... OK
Image Name: linux
Image Type: ARM Linux Kernel Image (gzip compressed)
Data Size: 1685904 Bytes = 1.6 MB
Load Address: 02080000
Entry Point: 02280000
Data CRC Checking ... OK
Programing start at: 0x00080000

write : 0
write : 3
write : 7
write : 11
write : 15
write : 19
write : 23
write : 26
write : 30
write : 34
write : 38
write : 42
write : 46
write : 50
write : 53
write : 57
write : 61
write : 65
write : 69
write : 73
write : 76
write : 80
write : 84
write : 88
write : 92
write : 96
write : 100
done

## Checking Image at 0x81b9ba10 ...
Header CRC Checking ... OK
Image Name: romfs
Image Type: ARM Linux Kernel Image (gzip compressed)
Data Size: 3117056 Bytes = 3 MB
Load Address: 02280000
Entry Point: 02580000
Data CRC Checking ... OK
Programing start at: 0x00280000

write : 0
write : 2
write : 4
write : 6
write : 8
write : 10
write : 12
write : 14
write : 16
write : 18
write : 20
write : 22
write : 25
write : 27
write : 29
write : 31
write : 33
write : 35
write : 37
write : 39
write : 41
write : 43
write : 45
write : 47
write : 50
write : 52
write : 54
write : 56
write : 58
write : 60
write : 62
write : 64
write : 66
write : 68
write : 70
write : 72
write : 75
write : 77
write : 79
write : 81
write : 83
write : 85
write : 87
write : 89
write : 91
write : 93
write : 95
write : 97
write : 100
done

## Checking Image at 0x81e94a50 ...
Header CRC Checking ... OK
Image Name: user
Image Type: ARM Linux Kernel Image (gzip compressed)
Data Size: 6090752 Bytes = 5.8 MB
Load Address: 028e0000
Entry Point: 02ee0000
Data CRC Checking ... OK
Programing start at: 0x008e0000

write : 0
write : 1
write : 2
write : 3
write : 4
write : 5
write : 6
write : 7
write : 8
write : 9
write : 10
write : 11
write : 12
write : 13
write : 15
write : 16
write : 17
write : 18
write : 19
write : 20
write : 21
write : 22
write : 23
write : 24
write : 25
write : 26
write : 27
write : 29
write : 30
write : 31
write : 32
write : 33
write : 34
write : 35
write : 36
write : 37
write : 38
write : 39
write : 40
write : 41
write : 43
write : 44
write : 45
write : 46
write : 47
write : 48
write : 49
write : 50
write : 51
write : 52
write : 53
write : 54
write : 55
write : 56
write : 58
write : 59
write : 60
write : 61
write : 62
write : 63
write : 64
write : 65
write : 66
write : 67
write : 68
write : 69
write : 70
write : 72
write : 73
write : 74
write : 75
write : 76
write : 77
write : 78
write : 79
write : 80
write : 81
write : 82
write : 83
write : 84
write : 86
write : 87
write : 88
write : 89
write : 90
write : 91
write : 92
write : 93
write : 94
write : 95
write : 96
write : 97
write : 98
write : 100
done

## Checking Image at 0x82463a90 ...
Header CRC Checking ... OK
Image Name: gui
Image Type: ARM Linux Standalone Program (gzip compressed)
Data Size: 1044480 Bytes = 1020 kB
Load Address: 02580000
Entry Point: 02780000
Data CRC Checking ... OK
Programing start at: 0x00580000

write : 0
write : 6
write : 12
write : 18
write : 25
write : 31
write : 37
write : 43
write : 50
write : 56
write : 62
write : 68
write : 75
write : 81
write : 87
write : 93
write : 100
done

## Checking Image at 0x82562ad0 ...
Header CRC Checking ... OK
Image Name: data
Image Type: ARM Linux Kernel Image (gzip compressed)
Data Size: 1007616 Bytes = 984 kB
Load Address: 02ee0000
Entry Point: 03000000
Data CRC Checking ... OK
Programing start at: 0x00ee0000

write : 0
write : 6
write : 12
write : 18
write : 25
write : 31
write : 37
write : 43
write : 50
write : 56
write : 62
write : 68
write : 75
write : 81
write : 87
write : 93
write : 100
done

## Checking Image at 0x82658b10 ...
Header CRC Checking ... OK
Image Name: product
Image Type: ARM Linux Standalone Program (gzip compressed)
Data Size: 40960 Bytes = 40 kB
Load Address: 028c0000
Entry Point: 028e0000
Data CRC Checking ... OK
Programing start at: 0x008c0000

write : 0
write : 100
done

## Checking Image at 0x82662b50 ...
Header CRC Checking ... OK
Image Name: custom
Image Type: ARM Linux Standalone Program (gzip compressed)
Data Size: 4096 Bytes = 4 kB
Load Address: 02060000
Entry Point: 02080000
Data CRC Checking ... OK
Programing start at: 0x00060000

write : 0
write : 100
done
DHBOOT#
 
Guys, i create *****.py file for my VTH1550. I have a some problems.




from .config import *

DAHUA_FILES = OrderedDict([
("Install", {
"required": True,
"type": DAHUA_TYPE.Plain
}),
("dm365_ubl_boot_16M.bin.img", {
"required": True,
"type": DAHUA_TYPE.Plain,
"size": 0x00040000
}),
("kernel-x.cramfs.img", {
"required": True,
"type": DAHUA_TYPE.Plain,
"size": 0x00200000
}),
("romfs-x.cramfs.img", {
"required": True,
"type": DAHUA_TYPE.uImage | DAHUA_TYPE.CramFS,
"size": 0x00300000
}),
("user-x.cramfs.img", {
"required": True,
"type": DAHUA_TYPE.uImage | DAHUA_TYPE.SquashFS,
"size": 0x00600000
}),
("web-x.cramfs.img", {
"required": True,
"type": DAHUA_TYPE.uImage | DAHUA_TYPE.CramFS,
"size": 0x00200000
}),
("data-x.cramfs.img", {
"required": True,
"type": DAHUA_TYPE.uImage | DAHUA_TYPE.CramFS,
"size": 0x00120000
}),
("pd-x.cramfs.img", {
"required": True,
"type": DAHUA_TYPE.uImage | DAHUA_TYPE.CramFS,
"size": 0x00020000
}),
("custom-x.cramfs.img", {
"required": True,
"type": DAHUA_TYPE.uImage | DAHUA_TYPE.CramFS,
"size": 0x00020000
})
])



1) Where is take "size" for my files???
2) I have gui-x.cramfs.img"
need adding this filename in my config file?
 

Attachments

No matter what i try, i can't stop the boot.... i power my cam with poe, so i tryed with poe switch connected with the gateway, without, same!

and the *** don't seems to stop anything one mine!
 
Try it SHIFT+8 for print ****
Upload photo your motherboard here. I will see this photo and verifi whith my photo.
Only MACRO please
 
You must log in or register to reply here.
Top Bottom