Dahua Firmware Mod Kit + Modded Dahua Firmware

Chris12 · Aug 1, 2017

@Crazykiller or @cor35vet .... where to find this specific firmware? Is it specialy compiled for the IPC-HDBW4431R-ZS ?
(I cannot find any official firmware on the Dahua site)

cor35vet · Aug 1, 2017

Chris12 said:
@Crazykiller or @cor35vet .... where to find this specific firmware? Is it specialy compiled for the IPC-HDBW4431R-ZS ?
(I cannot find any official firmware on the Dahua site)

In the OP....
For NAND-Eos (-ZS) cameras:

Crazykiller · Aug 1, 2017

cor35vet said:
Probably best to test it on a bench then, bad wiring or power delivery could also be at fault.

Yeah they ended a month ago
However also kinda tired of dealing with hardware I don't own and shitty SoCs without SDKs, it's not fun.
(I only own HDW4431C Eos cameras btw.)
I'll probably update the Themis firmware soon however.

Maybe some more guys which are using your efforts should donate a little bit, then you could get some more / different models. Maybe @EMPIRETECANDY could send you one for testing if he starts dealing with Chinese models

EMPIRETECANDY · Aug 1, 2017

Crazykiller said:
Maybe some more guys which are using your efforts should donate a little bit, then you could get some more / different models. Maybe @EMPIRETECANDY could send you one for testing if he starts dealing with Chinese models

Ok,which model wants to do? Lol

cor35vet · Aug 2, 2017

EMPIRETECANDY said:
Ok,which model wants to do? Lol

The newest Eco-savvy 3.0 cameras DH_IPC-HX5X3X-Rhea are very popular.
The modified firmware I made is already confirmed working by someone here, except for telnet which is not too important.
Is there a chinese equivalent model of the IPC-HDW5231R-Z and what is the price difference?

I am wondering about these Eos4 cameras: IPC-HDW4431C-A-V2 etc.
They have more flash (finally) but also the sign.img check, I wonder if the bootloader still supports upgrade.txt on those.
I think I'd like one of these V2, maybe they have models with 2MP starvis sensor too so I can see how they compare to my 4MP.

Basically the question is which models are the best sellers and do they have a cheaper chinese equivalent?

Btw. a friend of mine is in hong kong right now

EMPIRETECANDY · Aug 2, 2017

cor35vet said:
The newest Eco-savvy 3.0 cameras DH_IPC-HX5X3X-Rhea are very popular.
The modified firmware I made is already confirmed working by someone here, except for telnet which is not too important.
Is there a chinese equivalent model of the IPC-HDW5231R-Z and what is the price difference?

I am wondering about these Eos4 cameras: IPC-HDW4431C-A-V2 etc.
They have more flash (finally) but also the sign.img check, I wonder if the bootloader still supports upgrade.txt on those.
I think I'd like one of these V2, maybe they have models with 2MP starvis sensor too so I can see how they compare to my 4MP.

Basically the question is which models are the best sellers and do they have a cheaper chinese equivalent?

Btw. a friend of mine is in hong kong right now

IPC-HDW4431C-A-V2 this model already has some guys hacked. So i am thinking the new models, Chinese models are cheaper than the English models. DH_IPC-HX5X3X-Rhea yes, they are very popular and seems the chinese models not looks as good as the turret ones. I have to find a good channel get these models, right now we mostly sell the original English ones. Maybe a good choice to make find some cheap and good cams, who knows, right? Sample no problem at all, if i find some good models just ship you.

Chris12 · Aug 2, 2017

This afternoon I hard-resetted the IPC-HDBW4431R-ZS camera on the PCB, after that I was able to login again.
Loaded the firmware of @cor35vet out of the 1st post of this thread, configured some settings and now the camera is up&running again.

Thanks for your help!

netprince · Aug 3, 2017

cor35vet said:
I am wondering about these Eos4 cameras: IPC-HDW4431C-A-V2 etc.
They have more flash (finally) but also the sign.img check, I wonder if the bootloader still supports upgrade.txt on those.
I think I'd like one of these V2, maybe they have models with 2MP starvis sensor too so I can see how they compare to my 4MP.

I bought a HDW4431C recently, and it came with a Chinese language firmware. Before I realized there are multiple versions I installed your english version image from the OP. It rebooted and seemed fine except only the lowest quality video settings work reliably, the higher resolutions and frame rates stutter and run at about half speed...

So browsing around the image, Device Type reports IPC-HDW4431C-A-V2... which is a newer hardware version if I understand correctly?

I guess I'm lucky I didn't brick it already... I have telnet access if there is any details which might be helpful...

cor35vet · Aug 3, 2017

netprince said:
I bought a HDW4431C recently, and it came with a Chinese language firmware. Before I realized there are multiple versions I installed your english version image from the OP. It rebooted and seemed fine except only the lowest quality video settings work reliably, the higher resolutions and frame rates stutter and run at about half speed...

So browsing around the image, Device Type reports IPC-HDW4431C-A-V2... which is a newer hardware version if I understand correctly?

I guess I'm lucky I didn't brick it already... I have telnet access if there is any details which might be helpful...

cat /proc/cpuinfo

Also try to reset to default.

netprince · Aug 3, 2017

Some details from telnet on a IPC-HDW4431C-A-V2

Code:

# cat /proc/cpuinfo
Processor       : ARMv7 Processor rev 5 (v7l)
BogoMIPS        : 1196.85
Features        : swp half fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt
CPU implementer : 0x41
CPU architecture: 7
CPU variant     : 0x0
CPU part        : 0xc07
CPU revision    : 5

Hardware        : hi3516a
Revision        : 0000
Serial          : 0000000000000000

# df -h
Filesystem                Size      Used Available Use% Mounted on
/dev/root               896.0K    896.0K         0 100% /
tmpfs                    40.0M      4.0K     40.0M   0% /dev
tmpfs                    40.0M    860.0K     39.1M   2% /var
/dev/mtdblock4          128.0K    128.0K         0 100% /mnt/custom
/dev/mtdblock5          128.0K    128.0K         0 100% /mnt/pd
/dev/mtdblock8            2.5M      2.5M         0 100% /mnt/web
/dev/mtdblock9            8.8M      8.8M         0 100% /usr
/dev/mtdblock10         320.0K    256.0K     64.0K  80% /mnt/syslog
/dev/mtdblock11         320.0K    248.0K     72.0K  78% /mnt/mtd
/dev/mtdblock12         320.0K    220.0K    100.0K  69% /mnt/backup

uname -a
Linux (none) 3.4.35 #2 Fri Dec 9 16:48:14 CST 2016 armv7l GNU/Linux

# dmesg
Booting Linux on physical CPU 0
Linux version 3.4.35 (jenkins@coverity-analyzer0.dahuatech.com) (gcc version 4.8.3 20131202 (prerelease) (Hisilicon_v300) ) #2 Fri Dec 9 16:48:14 CST 2016
CPU: ARMv7 Processor [410fc075] revision 5 (ARMv7), cr=10c53c7d
CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
Machine: hi3516a
appauto=1
dh_keyboard=1
ethaddr0=e0:50:8b:80:8a:b
ethaddr1=0:0:0:0:0:0
lip0=192.168.1.108
lip1=0.0.0.0
id=3D00A85PAA00972
U-Boot 0x30000 0x90000 0x0
hwid 0x20000 0xc0000 0x0
updateflag 0x30000 0xe0000 0x0
partition 0x20000 0x110000 0x0
custom 0x20000 0x130000 0x0
product 0x20000 0x150000 0x0
Kernel 0x180000 0x170000 0x0
romfs 0xe0000 0x2f0000 0x0
web 0x280000 0x3d0000 0x0
user 0x8c0000 0x650000 0x0
syslog 0x50000 0xf10000 0x0
config 0x50000 0xf60000 0x0
backup 0x50000 0xfb0000 0x0
gLogRamRes: start=0x8547e000;size=0x80000
mem_relimitAddr:0x854fe000
init gLogRamRes: start=0x8547e000;size=0x80000
init mem_relimitAddr:0x854fe000
Memory policy: ECC disabled, Data cache writeback
On node 0 totalpages: 21760
free_area_init_node: node 0, pgdat c03aeb34, node_mem_map c03ca000
  Normal zone: 170 pages used for memmap
  Normal zone: 0 pages reserved
  Normal zone: 21590 pages, LIFO batch:3
pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
pcpu-alloc: [0] 0
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 21590
Kernel command line: mem=85M console=ttyS0,115200 root=/dev/mtdblock7 rootfstype=squashfs
dh_keyboard:1
PID hash table entries: 512 (order: -1, 2048 bytes)
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Memory: 85MB = 85MB total
Memory: 81792k/81792k available, 5248k reserved, 0K highmem
Virtual kernel memory layout:
    vector  : 0xffff0000 - 0xffff1000   (   4 kB)
    fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
    vmalloc : 0xc5800000 - 0xff000000   ( 920 MB)
    lowmem  : 0xc0000000 - 0xc5500000   (  85 MB)
    modules : 0xbf000000 - 0xc0000000   (  16 MB)
      .text : 0xc0008000 - 0xc036d000   (3476 kB)
      .init : 0xc036d000 - 0xc0387674   ( 106 kB)
      .data : 0xc0388000 - 0xc03af240   ( 157 kB)
       .bss : 0xc03af264 - 0xc03c9c88   ( 107 kB)
SLUB: Genslabs=11, HWalign=64, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
NR_IRQS:128
sched_clock: 32 bits at 49MHz, resolution 20ns, wraps every 86767ms
Console: colour dummy device 80x30
console [tty0] enabled
Calibrating delay loop... 1196.85 BogoMIPS (lpj=5984256)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
Initializing cgroup subsys freezer
CPU: Testing write buffer coherency: ok
Setting up static identity map for 0x80295d30 - 0x80295d88
NET: Registered protocol family 16
Serial: AMBA PL011 UART driver
uart:0: ttyAMA0 at MMIO 0x20080000 (irq = 40) is a PL011 rev2
uart:1: ttyAMA1 at MMIO 0x20090000 (irq = 41) is a PL011 rev2
uart:2: ttyAMA2 at MMIO 0x200a0000 (irq = 42) is a PL011 rev2
bio: create slab <bio-0> at 0
Switching to clocksource timer0
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP: reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
RPC: Registered named UNIX socket transport module.
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
RPC: Registered tcp NFSv4.1 backchannel transport module.
VFS: Disk quotas dquot_6.5.2
Dquot-cache hash table entries: 1024 (order 0, 4096 bytes)
squashfs: version 4.0 (2009/01/31) Phillip Lougher
NFS: Registering the id_resolver key type
jffs2: version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
msgmni has been set to 159
Block layer SCSI generic (bsg) driver version 0.4 loaded (major 254)
io scheduler noop registered
io scheduler deadline registered (default)
io scheduler cfq registered
Spi id table Version 1.22
Hisfc350 Device Driver, Version 1.10
Spi(cs1) ID: 0xC8 0x40 0x18 0xC8 0x40 0x18
SPI FLASH start_up_mode is 3 Bytes
Spi(cs1):
Block:64KB
Chip:16MB
Name:"GD25Q128"
spi size: 16MB
chip num: 1
Creating 13 MTD partitions on "hi_sfc":
0x000000090000-0x0000000c0000 : "U-Boot"
0x0000000c0000-0x0000000e0000 : "hwid"
0x0000000e0000-0x000000110000 : "updateflag"
0x000000110000-0x000000130000 : "partition"
0x000000130000-0x000000150000 : "custom"
0x000000150000-0x000000170000 : "product"
0x000000170000-0x0000002f0000 : "Kernel"
0x0000002f0000-0x0000003d0000 : "romfs"
0x0000003d0000-0x000000650000 : "web"
0x000000650000-0x000000f10000 : "user"
0x000000f10000-0x000000f60000 : "syslog"
0x000000f60000-0x000000fb0000 : "config"
0x000000fb0000-0x000001000000 : "backup"
Higmac dma_sg_phy: 0x851c0000
higmac_mdio_bus: probed
ETH0: rmii, phy_addr=0, mii_name=mdio0
PPP generic driver version 2.4.2
NET: Registered protocol family 24
TCP: cubic registered
Initializing XFRM netlink socket
NET: Registered protocol family 10
IPv6 over IPv4 tunneling driver
NET: Registered protocol family 17
NET: Registered protocol family 15
lib80211: common routines for IEEE802.11 drivers
lib80211_crypt: registered algorithm 'NULL'
Registering the dns_resolver key type
VFP support v0.3: implementor 41 architecture 2 part 30 variant 7 rev 5
VFS: Mounted root (squashfs filesystem) readonly on device 31:7.
Freeing init memory: 104K
udev[410]: starting version 164
Hisilicon Media Memory Zone Manager
address is 0x8d300000 ,length is 24117248
address is 0x8ea00000 ,length is 10485760
address is 0x8f400000 ,length is 5242880
address is 0x8f900000 ,length is 7340032
Module himedia: init ok
hi3516a_base: module license 'Proprietary' taints kernel.
Disabling lock debugging due to kernel taint
load sys.ko for Hi3516A...OK!
load tde.ko ...OK!
load region.ko ....OK!
load vgs.ko for Hi3516A...OK!
ISP Mod init!
load viu.ko for Hi3516A...OK!
load vpss.ko ....OK!
load vou.ko ....OK!
load rc.ko for Hi3516A...OK!
load venc.ko for Hi3516A...OK!
load chnl.ko for Hi3516A...OK!
load h264e.ko for Hi3516A...OK!
load h265e.ko for Hi3516A...OK!
load jpege.ko for Hi3516A...OK!
load vda.ko ....OK!
load ive.ko for Hi3516A...OK!


[OSA-DRV] OSA Build on Dec  9 2016 at 19:26:10.
[OSA-DRV] SVN NUM: 7611.

[OSA-DRV] Monitor    Task   pid=785   tid=785


[LOG-DRV] LOG Build on Dec  9 2016 at 19:45:00.
[LOG-DRV] SVN NUM: 10273.

[LOG-DRV] ramStart:0x8547e000;ramSize:0x80000;select:1
[OSA-DRV] Char device create OK !
[LOG-DRV] coreId = 0, logLevel = 2
[LOG-DRV] coreId = 1, logLevel = 2
[LOG-DRV] coreId = 2, logLevel = 2
[LOG-DRV] coreId = 3, logLevel = 2
[LOG-DRV] coreId = 4, logLevel = 2
[LOG-DRV] coreId = 5, logLevel = 2
acodec inited!
mipi_init
init phy power successful!
load hi_mipi driver successful!
ADDRCONF(NETDEV_UP): eth0: link is not ready
netinit uses obsolete (PF_INET,SOCK_PACKET)
PHY: mdio0:00 - Link is Up - 100/Full
ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready

# ps
PID   USER     TIME   COMMAND
    1 root       0:00 init
    2 root       0:00 [kthreadd]
    3 root       0:02 [ksoftirqd/0]
    4 root       0:00 [kworker/0:0]
    5 root       0:00 [kworker/u:0]
    6 root       0:00 [khelper]
    7 root       0:00 [kworker/u:1]
   82 root       0:00 [sync_supers]
   84 root       0:00 [bdi-default]
   85 root       0:00 [kintegrityd]
   87 root       0:00 [kblockd]
  177 root       0:00 [rpciod]
  179 root       0:01 [kworker/0:1]
  184 root       0:00 [kswapd0]
  234 root       0:00 [fsnotify_mark]
  240 root       0:00 [nfsiod]
  280 root       0:00 [mtdblock0]
  285 root       0:00 [mtdblock1]
  290 root       0:00 [mtdblock2]
  295 root       0:00 [mtdblock3]
  300 root       0:00 [mtdblock4]
  305 root       0:00 [mtdblock5]
  310 root       0:00 [mtdblock6]
  315 root       0:00 [mtdblock7]
  320 root       0:00 [mtdblock8]
  325 root       0:01 [mtdblock9]
  330 root       0:00 [mtdblock10]
  335 root       0:00 [mtdblock11]
  340 root       0:00 [mtdblock12]
  378 root       0:00 [deferwq]
  410 root       0:00 udevd --daemon
  412 root       0:00 udevd --daemon
  585 root       0:00 [jffs2_gcd_mtd10]
  587 root       0:00 [jffs2_gcd_mtd11]
  589 root       0:00 [jffs2_gcd_mtd12]
  606 root       0:01 /sbin/utelnetd -p 2300 -l /bin/login
  785 root       0:00 [OSA_783_1]
  845 root       0:00 [OSA_825_2]
  865 root       0:02 syshelper elper 60
  866 root       0:00 /usr/sbin/upgraded
  869 root       0:00 [OSA_867_3]
  920 root       9:21 VideoDaemon AEWB DSP
  938 root       0:00 /bin/sh /etc/init.d/appauto
  954 root       0:00 /bin/sh ./usr/etc/app.sh
  960 root      12:07 /usr/bin/sonia
 1033 root       0:00 -sh
 1043 root       0:00 [flush-mtd-unmap]
 1052 root       0:00 ps

I have tried the 'Default' button from the web interface... that as recommended somewhere... is that what you are referring to?

cor35vet · Aug 3, 2017

netprince said:
I have tried the 'Default' button from the web interface... that as recommended somewhere... is that what you are referring to?

Yeah, the Default button. Your hardware is identical with the V1.
Are you sure it's the camera at fault and not maybe your PC?

netprince · Aug 3, 2017

cor35vet said:
Yeah, the Default button. Your hardware is identical with the V1.
Are you sure it's the camera at fault and not maybe your PC?

It is possible I am pretty new at this... I will try another machine in little while...

I updated my post with dmesg info above.

netprince · Aug 3, 2017

Using straight default video settings, the live viewer on the webinterface runs a 1/2 speed on my work machine. (i7-4770)

Seems to me like perhaps the h264 encoder is not initialized properly. I'm not sure how to check that kind of thing...

cor35vet · Aug 3, 2017

netprince said:
Using straight default video settings, the live viewer on the webinterface runs a 1/2 speed on my work machine. (i7-4770)

Seems to me like perhaps the h264 encoder is not initialized properly. I'm not sure how to check that kind of thing...

have you tried the Dahua SmartPSS software?

netprince · Aug 3, 2017

cor35vet said:
have you tried the Dahua SmartPSS software?

I have not, will try and report back a little later...

netprince · Aug 3, 2017

Just to update... tried another pc and things are working much better, kudos to cor35vet... sorry for the noise... and thanks!

scorpi00n · Aug 6, 2017

I just got delivery of 10x 4431C-A V2 cameras which were suppose to have IVS working, but it seems it doesnt. The firmware was English 2.420.0000.21.R Build Date: 2016-07-24.

I flashed with your firmware and everything seems fine, IVS functions are available but.. They are not working

IVS preview on the NVR does not show them nor does the browser UI. Did I miss something?

UPDATE: I got it working and showing the rules on live preview by turning on IVS in Event>Smart Plan

marigo · Aug 13, 2017

kilodeltakilo said:
Hi guys, hopefully some can help me/point me in the right direction.
I bought a IPC-HDBW4431R-ZS (Chinese version right?) from Ali. The firmware it came with did not have the Easy4IP option, so I flashed the modded NAND-eos firmware provided in the first post.
After flashing the Easy4IP is available, but when opening the settings page it says "Operate failed". Since then I am also unable to change the Video settings. When saving it says "Failed to save, unable to encode!". This behaviour stays the same even after hard resetting with the reset button on the PCB.
What am I doing wrong?

I have exactly the same on my HDBW4431R-ZS. It came with the 20161209 firmware and I downgraded it with the NAND-Eos firmware from the OP.
The easy4IP and DDNS services are not working. That's weird because I used this firmware before and not had any troubles.

I have hard reset the camera, loaded the modified firmware and cleared the webcache but that didn't do the trick.
Everything else is working as expected.

Any thoughts?

EDIT:
I have still one camera operational with the modified firmware and have DDNS and easy4IP working. Can I do something with this?

marigo · Aug 15, 2017

Triggering this thread...

Is it possible to backup a working camera with the image (firmware) it's holding?
If yes, then how can this be accomplished?

I have telnet access to the camera.

cor35vet · Aug 15, 2017

marigo said:
Triggering this thread...

Is it possible to backup a working camera with the image (firmware) it's holding?
If yes, then how can this be accomplished?

I have telnet access to the camera.

backup_mtd.sh

Code:

#!/bin/bash

echo "Backing up to: $(pwd)"
echo "Enter to continue, CTRL-C to abort."
read

cp /proc/mtd ./layout.txt

# List remote mtd devices from /proc/mtd.
# The first line is just a table header, so skip it (using tail)
cat /proc/mtd | tail -n+2 | while read; do
    MTD_DEV=$(echo $REPLY | cut -f1 -d:)
    MTD_NAME=$(echo $REPLY | cut -f2 -d\")

    echo "Backing up $MTD_DEV ($MTD_NAME)"
    cp "/dev/${MTD_DEV}ro" "./${MTD_DEV}_${MTD_NAME}"
done

echo "MTD backup complete."

Search

Dahua Firmware Mod Kit + Modded Dahua Firmware

Chris12

n3wb

cor35vet

Crazykiller

Getting comfortable

EMPIRETECANDY

IPCT Vendor

cor35vet

EMPIRETECANDY

IPCT Vendor

Chris12

n3wb

netprince

n3wb

cor35vet

netprince

n3wb

cor35vet

netprince

n3wb

netprince

n3wb

cor35vet

netprince

n3wb

netprince

n3wb

scorpi00n

n3wb

marigo

Getting the hang of it

marigo

Getting the hang of it

cor35vet