Dahua Firmware Mod Kit + Modded Dahua Firmware

cor35vet

IPCT Contributor
Joined
Jun 23, 2016
Messages
337
Reaction score
246
Hi,

I've been hacking around with my Dahua camera and made a script to unpack and rebuild the firmware upgrade images.
Check out the Github for more info: GitHub - BotoX/Dahua-Firmware-Mod-Kit: Unpack and repack Dahua IP camera firmware upgrade images.

Give me firmware for my camera!
You can download the firmware image that fits your camera below and flash it to your camera or unpack and modify it more.
It will work on both Chinese and international models.
International cameras can flash back to official English firmware after using my modded firmware.
Chinese cameras will never work with official English firmware - they need to be patched.

For IPC-HX4XXX-Eos ("Eco-savvy 2.0" 3rd gen) cameras:
Software Version: 2.420.0000.22.R, Build Date: 2016-12-09
MD5Sum: 1332430392def5d9becd4e883d26f7d8
SHASum: 1bc476b78fd706b225243c12a334631971ea6a7c

Compatible cameras according to Dahua:
DH-IPC-HDBW4231R,DH-IPC-HDBW4236R
DH-IPC-HDBW4431R,DH-IPC-HDBW4436R
DH-IPC-HDW4231C-A,DH-IPC-HDW4236C-A
DH-IPC-HDW4233C-A,DH-IPC-HDW4238C-A
DH-IPC-HDW4431C-A,DH-IPC-HDW4436C-A
DH-IPC-HDBW4431R-S,DH-IPC-HDBW4436R-S
DH-IPC-HDBW4233R-AS,DH-IPC-HDBW4238R-S
DH-IPC-HDBW4231R-AS,DH-IPC-HDBW4236R-AS
DH-IPC-HDBW4431R-AS,DH-IPC-HDBW4436R-AS
DH-IPC-HDBW4231R-VF,DH-IPC-HDBW4431R-VF
DH-IPC-HFW4231F,DH-IPC-HFW4236F,DH-IPC-HFW4431F,DH-IPC-HFW4436F
DH-IPC-HFW4231B,DH-IPC-HFW4236B,DH-IPC-HFW4431B,DH-IPC-HFW4436B
DH-IPC-HFW4231D,DH-IPC-HFW4236D,DH-IPC-HFW4431D,DH-IPC-HFW4436D
DH-IPC-HFW4231R-Z,DH-IPC-HFW4431R-Z,DH-IPC-HFW4231R-VF,DH-IPC-HFW4431R-VF
DH-IPC-HFW4231F-AS,DH-IPC-HFW4236F-AS,DH-IPC-HFW4431F-AS,DH-IPC-HFW4436F-AS
DH-IPC-HFW4231B-AS,DH-IPC-HFW4236B-AS,DH-IPC-HFW4431B-AS,DH-IPC-HFW4436B-AS
DH-IPC-HFW4231D-AS,DH-IPC-HFW4236D-AS,DH-IPC-HFW4431D-AS,DH-IPC-HFW4436D-AS
DH-IPC-HFW4231K-I4,DH-IPC-HFW4236K-I4,DH-IPC-HFW4431K-I4,DH-IPC-HFW4436K-I4
DH-IPC-HFW4231K-I6,DH-IPC-HFW4236K-I6,DH-IPC-HFW4431K-I6,DH-IPC-HFW4436K-I6
DH-IPC-HFW4233K-I4,DH-IPC-HFW4238K-I4,DH-IPC-HFW4233K-I6,DH-IPC-HFW4238K-I6
DH-IPC-HFW4231M-I1,DH-IPC-HFW4236M-I1,DH-IPC-HFW4431M-I1,DH-IPC-HFW4436M-I1
DH-IPC-HFW4231M-I2,DH-IPC-HFW4236M-I2,DH-IPC-HFW4431M-I2,DH-IPC-HFW4436M-I2
DH-IPC-HFW4233M-I1,DH-IPC-HFW4238M-I1,DH-IPC-HFW4233M-I2,DH-IPC-HFW4238M-I2
DH-IPC-HFW4233K-AS-I4,DH-IPC-HFW4238K-AS-I4,DH-IPC-HFW4233K-AS-I6,DH-IPC-HFW4238K-AS-I6
DH-IPC-HFW4431K-AS-I4,DH-IPC-HFW4436K-AS-I4,DH-IPC-HFW4431K-AS-I6,DH-IPC-HFW4436K-AS-I6
DH-IPC-HFW4233M-AS-I1,DH-IPC-HFW4238M-AS-I1,DH-IPC-HFW4233M-AS-I2,DH-IPC-HFW4238M-AS-I2
DH-IPC-HFW4431M-AS-I1,DH-IPC-HFW4436M-AS-I1,DH-IPC-HFW4431M-AS-I2,DH-IPC-HFW4436M-AS-I2

Based on official English firmware with following noteworthy changes:
  • English, French, Spanish and Russian language.
  • PAL/NTSC
  • Unlocked additional web GUI features/options.
    • Disable P2P: Network -> TCP/IP -> Easy4ip
  • Hacked Playback to also work with NAS/NFS.
    • Playback tab will be enabled when you have an SD card (default) or enabled NAS/NFS feature. (F5 after you added a NAS)
    • Added option to select NAS instead of SD, obviously...
    • I barely tested it but it seemed to play fine... feedback welcome.
    • FTP can not be supported, stop using it, it's awful.
  • Unlocked all IVS modes.
  • Disabled "CloudUpgradeServer".
  • Telnet enabled permanently on port 2300.

For IPC-HX4XXX-NAND-Eos (-ZS models) cameras:
Software Version: 2.420.0000.21.R, Build Date: 2016-07-24
MD5Sum: c9ce325783ef99f8c476e861ebd4f82a
SHASum: 119f03c9a35509fb81393aa6653ace884873e57d

Compatible cameras (guessed):
IPC-HDBW4231R-ZS
IPC-HDBW4431R-ZS

Based on Chinese firmware with following noteworthy changes:
  • English, Chinese, French, Spanish and Russian language.
  • PAL/NTSC
  • Unlocked additional web GUI features/options.
    • Disable P2P: Network -> TCP/IP -> Easy4ip
  • Unlocked all IVS modes.
  • Disabled "CloudUpgradeServer".

For IPC-HX4X2X-Themis ("Eco-savvy 2.0" 2nd gen) cameras:
Software Version: 2.400.0000.34.R, Build Date: 2016-08-01
MD5Sum: 3a6d937e453c91202ab64542d83f1a38
SHASum: c5bfae26ff027d5c3a2c03e73dcbb9cf3e978759

Compatible cameras according to Dahua:
DH-IPC-HDW4120C-A,DH-IPC-HDW4125C-A
DH-IPC-HDW4221C-A,DH-IPC-HDW4226C-A
DH-IPC-HDW4421C-A,DH-IPC-HDW4426C-A
DH-IPC-HDW4120C-A-V2,DH-IPC-HDW4125C-A-V2
DH-IPC-HDW4120S,DH-IPC-HDW4125S,DH-IPC-HDW4221S,DH-IPC-HDW4226S
DH-IPC-HDW4320S,DH-IPC-HDW4325S,DH-IPC-HDW4421S,DH-IPC-HDW4426S
DH-IPC-HDW4120C,DH-IPC-HDW4125C,DH-IPC-HDW4221C,DH-IPC-HDW4226C
DH-IPC-HDW4320C,DH-IPC-HDW4325C,DH-IPC-HDW4421C,DH-IPC-HDW4426C
DH-IPC-HDBW4120R,DH-IPC-HDBW4125R,DH-IPC-HDBW4120R-AS,DH-IPC-HDBW4125R-AS
DH-IPC-HDBW4221R,DH-IPC-HDBW4226R,DH-IPC-HDBW4221R-AS,DH-IPC-HDBW4226R-AS
DH-IPC-HDBW4421R,DH-IPC-HDBW4426R,DH-IPC-HDBW4421R-AS,DH-IPC-HDBW4426R-AS
DH-IPC-HFW4120B,DH-IPC-HFW4125B,DH-IPC-HFW4120D,DH-IPC-HFW4125D
DH-IPC-HFW4221B,DH-IPC-HFW4226B,DH-IPC-HFW4221D,DH-IPC-HFW4226D
DH-IPC-HFW4320B,DH-IPC-HFW4325B,DH-IPC-HFW4320D,DH-IPC-HFW4325D
DH-IPC-HFW4421B,DH-IPC-HFW4426B,DH-IPC-HFW4421D,DH-IPC-HFW4426D
DH-IPC-HFW4120F,DH-IPC-HFW4125F,DH-IPC-HFW4120F-AS,DH-IPC-HFW4125F-AS
DH-IPC-HFW4120B-AS,DH-IPC-HFW4125B-AS,DH-IPC-HFW4120D-AS,DH-IPC-HFW4125D-AS
DH-IPC-HFW4221B-AS,DH-IPC-HFW4226B-AS,DH-IPC-HFW4221D-AS,DH-IPC-HFW4226D-AS
DH-IPC-HFW4421B-AS,DH-IPC-HFW4426B-AS,DH-IPC-HFW4421D-AS,DH-IPC-HFW4426D-AS

For IPC-HX8XXX-Demeter (Pinhole) cameras:
MD5Sum: 21a05c0520a5e511cb476f1608505df1
SHASum: cdb1e0b219d4586c50e74ba80019b34e958f06cb

Compatible cameras according to HWID:
IPC-HDBW8281-PC
IPC-HDBW8281-Z
IPC-HF8101
IPC-HF8201
IPC-HF8281
IPC-HF8291E-4GT
IPC-HF8301
IPC-HF8351E-4GT
IPC-HFW8101
IPC-HFW8106
IPC-HFW8201
IPC-HFW8206
IPC-HFW8281
IPC-HFW8281E-IRA
IPC-HFW8286
IPC-HFW8301
IPC-HFW8306
IPC-HUM8101
IPC-HUM8101-0280B

NVRs:


TIP: Reset your camera to default config before updating, seems like Dahua messed something up so sonia will crash on certain configs...

PLEASE POST HERE IF YOU HAVE MORE LANGUAGES [OR A CAMERA WITH ANOTHER LANGUAGE]


These cameras have checks in place (HWID) so you can't flash the wrong firmware, hopefully this should prevent you from bricking your camera.

Experts can also use (from mtd-utils compiled with Hi3516a SDK) to flash .raw images to partitions on the camera from it's busybox shell.
This is useful while messing around, testing changes so you don't have to flash the full upgrade image every time.

WARNING: DO NOT FLASH THE OFFICIAL ENGLISH FIRMWARE ON CHINESE HARDWARE!
It won't start and you'll have to flash your camera back to the chinese one manually (over telnet or TFTP recovery)
And if you really want to try then at least do "appauto 0" to stop sonia from autostarting before flashing.
I personally always add permanent telnet to the image I am flashing with Dahua-Firmware-Mod-Kit, like so: Add utelnetd server · BotoX/DH_IPC-HX4XXX-Eos@2ddf0f5 · GitHub

Also, thanks to @nayr for chatting with me on IRC :v
(If this helped you and you have some spare for a student: paypal.me/BotoXbz)
(If shit hit the fan and you bricked your camera: Dahua IPC unbricking / recovery over serial UART and TFTP)
 
Last edited:

randyth

Young grasshopper
Joined
Aug 26, 2015
Messages
77
Reaction score
8
Awesome stuff. I have a 4421c so i can't use this, but I have to say it's very awesome that you succeeded in customizing your own Dahua firmware!
 

sumguy

Getting the hang of it
Joined
Jan 23, 2016
Messages
106
Reaction score
21
Is there any way you can mod the email SMTP part of the firmware so it will work properly? I'm finding that SMTP authentication can't be turned off on the HDW4431C. My SMTP server is set up for no authentication, no ssl or tls, and I can't get this camera to work properly with my mail server.
 

Warwick

n3wb
Joined
Apr 14, 2015
Messages
20
Reaction score
2
I tested the firmware ,but without Smart Function and IVS function.
 
Last edited by a moderator:

cor35vet

IPCT Contributor
Joined
Jun 23, 2016
Messages
337
Reaction score
246
Is there any way you can mod the email SMTP part of the firmware so it will work properly? I'm finding that SMTP authentication can't be turned off on the HDW4431C. My SMTP server is set up for no authentication, no ssl or tls, and I can't get this camera to work properly with my mail server.
That's probably in sonia as there is no sendmail binary on the camera.

I tested the firmware ,but without Smart Function and IVS function.
idk man, works for me™
Screenshot_2016-09-10_19-12-18.png
Which camera do you have?
 

BillG

Getting the hang of it
Joined
Nov 6, 2015
Messages
178
Reaction score
83
Everything seems to work fine on my 4431C-A
 

keithshlo

n3wb
Joined
Sep 11, 2016
Messages
21
Reaction score
3
Thanks a lot for the great firmware. It works pretty well so far. However, if I turn on "Smart codec", the IVS functions become disabled and inaccessible. Is this by design? Thanks.
 

cor35vet

IPCT Contributor
Joined
Jun 23, 2016
Messages
337
Reaction score
246
Thanks a lot for the great firmware. It works pretty well so far. However, if I turn on "Smart codec", the IVS functions become disabled and inaccessible. Is this by design? Thanks.
Well, I didn't make the software, I just added english language to it and patched the checks so I guess it is!
 

wiz1der

n3wb
Joined
Sep 2, 2016
Messages
1
Reaction score
0
Hi,


EDIT: DO NOT USE SMART CODEC WITH H265, THE CAMERA WILL BOOTLOOP (Dahua bug)
THanks for this! I just ordered these cams, and definitely want to upgrade the firmware. This is my first system and install. I will be using H265 for the compression, can you explain what smart codec is and If i need to sorry about it at all?

Thanks!
 

cor35vet

IPCT Contributor
Joined
Jun 23, 2016
Messages
337
Reaction score
246
THanks for this! I just ordered these cams, and definitely want to upgrade the firmware. This is my first system and install. I will be using H265 for the compression, can you explain what smart codec is and If i need to sorry about it at all?

Thanks!
I have no clue what smart codec does, but some user said that it improves compression with h264.
You shouldn't have to worry about it, they've added this feature recently (2 months ago?).
H265 compression is already insane, doubt you could improve that without pouring lots more of processing power at it...
 

nayr

IPCT Contributor
Joined
Jul 16, 2014
Messages
9,329
Reaction score
5,325
Location
Denver, CO
smartCodec disables all IVS features and the 3rd substream on my camera.. and then I didnt notice much improvement, oah and smartpss had no idea what the bitrate was so it said 0bps..

i dont think its anything you'll really miss and I could not find much documentation on it..

upgrading the firmware, just because you can is not advised.. unless you know something is fixed that your having issues with its best to leave it on what you got it with.. if you brick this you'll have to patch into the serial bus and force a tftp recovery, presuming you have a good image to restore.
 

nayr

IPCT Contributor
Joined
Jul 16, 2014
Messages
9,329
Reaction score
5,325
Location
Denver, CO
thanks to @cor35vet Ive managed to flash my NVR 4216-4k to a Chinese firmware, and then converted it back to english successfully.. now to hack all the features enabled if we can figure out how.

This is a great little tool, should be doable to change languages or rebrand devices without too much trouble.. if your determined and savvy enough.

attached proof, firmware was applied from: and was entirely Chinese before modification.
 

Attachments

Last edited by a moderator:

BLKMGK

Getting the hang of it
Joined
Jul 19, 2016
Messages
81
Reaction score
39
Seems like we could maybe extract English language files from some firmware while in operation to stick back after a factory reset maybe?
 

nayr

IPCT Contributor
Joined
Jul 16, 2014
Messages
9,329
Reaction score
5,325
Location
Denver, CO
looks like might be possible to build a firmware package that just lays down the english modifications.. I think its how the grey market vendors are dong it.
 

BLKMGK

Getting the hang of it
Joined
Jul 19, 2016
Messages
81
Reaction score
39
If they were doing that why do we lose the language with a factory reset? Firmware shouldn't lose anything. It seems like they must make a non-persistent change? Agree that simply making a persistant language change would be best.
 

nayr

IPCT Contributor
Joined
Jul 16, 2014
Messages
9,329
Reaction score
5,325
Location
Denver, CO
because the modifications are stored on a custom partition for branding and tweaking camera config out of the box; hard reset is likely formatting that and getting factory defaults..

Ive found firmware with only the update script and the custom partition image, indicating you can partially flash the firmware without changing everything.. depending on the partition u flash.. so in theory you can add the language files and over-ride to that custom branding image and just update that, leaving everything else intact.

for example on my NVR there is a custom.lua file in this partition that has the variables:
SupportedLanguage = "English",
SupportedLanguageDefault = "English",
that when I flashed those into my Chinese firmware, it became english.. that was all I had to do.
 

dobiwan

n3wb
Joined
Sep 11, 2016
Messages
5
Reaction score
3
Location
Germany
I was testing this with the SD-Zi-Themis_Chn_PN_Stream3_IVS_V2.400.0000.17 version but cant handle the tables in config.py
Anyone here who knows them .
maybe like this
dhboot.bin.img", {
"required": False,
"type": DAHUA_TYPE.Plain,
"size": 0x00030000

I had several errors because of th size,but i think its working with the Themis
 

cor35vet

IPCT Contributor
Joined
Jun 23, 2016
Messages
337
Reaction score
246
I was testing this with the SD-Zi-Themis_Chn_PN_Stream3_IVS_V2.400.0000.17 version but cant handle the tables in config.py
Anyone here who knows them .
maybe like this
dhboot.bin.img", {
"required": False,
"type": DAHUA_TYPE.Plain,
"size": 0x00030000

I had several errors because of th size,but i think its working with the Themis
You should've contacted me :v
This is the config for Themis: https://p.botox.bz/view/26279f91 (DH_IPC-HX4X2X-Themis not SD-Zi-Themis :v)
You should check the partition-x.cramfs.img image in the firmware upgrade image for the right sizes. Also Install for which files are actually flashed.

I am currently building a firmware image for Themis with the same modifications as for Eos.
This is completely untested DH_IPC-HX4X2X-Themis firmware http://i.botox.bz/DH_IPC-HX4X2X-Themis.bin if anyone wants to try it out.
I can't test it because I don't own such a device, compatibility list:
DH-IPC-HDW4120C-A,DH-IPC-HDW4125C-A
DH-IPC-HDW4221C-A,DH-IPC-HDW4226C-A
DH-IPC-HDW4421C-A,DH-IPC-HDW4426C-A
DH-IPC-HDW4120C-A-V2,DH-IPC-HDW4125C-A-V2
DH-IPC-HDW4120S,DH-IPC-HDW4125S,DH-IPC-HDW4221S,DH-IPC-HDW4226S
DH-IPC-HDW4320S,DH-IPC-HDW4325S,DH-IPC-HDW4421S,DH-IPC-HDW4426S
DH-IPC-HDW4120C,DH-IPC-HDW4125C,DH-IPC-HDW4221C,DH-IPC-HDW4226C
DH-IPC-HDW4320C,DH-IPC-HDW4325C,DH-IPC-HDW4421C,DH-IPC-HDW4426C
DH-IPC-HDBW4120R,DH-IPC-HDBW4125R,DH-IPC-HDBW4120R-AS,DH-IPC-HDBW4125R-AS
DH-IPC-HDBW4221R,DH-IPC-HDBW4226R,DH-IPC-HDBW4221R-AS,DH-IPC-HDBW4226R-AS
DH-IPC-HDBW4421R,DH-IPC-HDBW4426R,DH-IPC-HDBW4421R-AS,DH-IPC-HDBW4426R-AS
 
Last edited by a moderator:

BillG

Getting the hang of it
Joined
Nov 6, 2015
Messages
178
Reaction score
83
I just tried that Themis firmware on a 4421C that had the latest Chinese firmware, and it worked! Excellent..
 

sumguy

Getting the hang of it
Joined
Jan 23, 2016
Messages
106
Reaction score
21
I soldered a micro-SD socket to the board inside one of my HDW4431C-A cameras and installed a 32 gb card. Once the camera powered up, I browsed through the setup options, including STORAGE, but found nothing new. In other words, the camera is not seeing or recognizing the SD card.

So, if at all possible, if someone can create a modded firmware that might initialize or activate the SD card, I would volunteer to try it out.

If this means turning the camera from a HDW4431C-A into a HDW4431C-AS, then that's fine. Doesn't such a camera model already exist? Maybe this is as simple as dropping the -AS firmware into the -A camera?

Edit: Does this help?

http://download.dahuatech.com/kitDownload.php?filepath=DH_IPC-HX4XXX-Eos_Chn_PN_Stream3_V2.420.0000.21.R.20160724.bin

I got that from here: http://download.dahuatech.com/kit_det.php?cid=3877
 
Last edited by a moderator:
Top