Dahua IPC EASY unbricking / recovery over TFTP

In the attempt I did (removing part of the commands , dp and tftp) It went through
I Will try wireshark
I do not have the USB uart connetted (yet....)
 
I have a modded IPC-HDW4433C-A camera which had some issues restarting on its own from the very beginning. I upgraded its firmware to Chinese version (DH_IPC-HX4XXX-Eos_Chn_PN_Stream3_V2.680.0000000.41.R.181212.bin). Since then the camera worked perfectly with my DH-NVR4104.
The problem came after I upgraded my Dahua NVR from official V3.215 to v3.216. Now the DH NVR doesn't recognize the camera anymore. Says "not compatible".
I've attempted to convert the camera back to the English modded version by using the file DH_IPC-HX4XXX-Eos_EngFraSpaRus_PN_Stream3_V2.420.0000.22.R.20161209.bin from the beginning of this tread. It failed.
Then I used TFTP by following the instructions from this tread. The process of sending files to camera fails after sending the fist img.


Error.jpg
Am I doing anything wrong?
Or, do I need to try to make different bin file?
Anybody? Please help advising with the step to convert the EOS camera to English version.

Update2:
I used the Mod Tool to extract the original DH_IPC-HX4XXX-Eos_Chn_PN_Stream3_V2.680.0000000.41.R.181212.bin file and -re-build it without doing any changes. Even after that it failed to download the "re-built" firmware using TFTP.
It seems that the firmware signature - is what causing the problem.
Any ideas on how to overcome the signature issue?
 
Last edited:
I use TFTP method to upload firmware ,but errors received as following.

fullerror.png



1.How should I fix the problem.
2.where can I find the UBOOT_commonSwRsaVerify function body.

Device model :IPC-HDW4631C-A
System version:v2.800.0000005.0.R

Thx a lot
 
Last edited:
katcha said:
I have a modded IPC-HDW4433C-A camera which had some issues restarting on its own from the very beginning. ........

Am I doing anything wrong?
Or, do I need to try to make different bin file?
Anybody? Please help advising with the step to convert the EOS camera to English version.
/QUOTE]
Update2:
I used the Mod Tool to extract the original DH_IPC-HX4XXX-Eos_Chn_PN_Stream3_V2.680.0000000.41.R.181212.bin file and -re-build it without doing any changes. Even after that it failed to download the "re-built" firmware using TFTP.
It seems that the firmware signature - is what causing the problem.
Any ideas on how to overcome the signature issue?
Click to expand...
 
I guess since my camera and NVR are both have signed firmware-I'm stuck. No help here.
I can't downgrade neither camera nor NVR. TFTP method won't work.:smash:
The serial method doesn't work either. Getting only gibberish.
upload_2019-4-25_21-5-37.png
Seems that I need to scrap this Chinese camera. :)
 
No. You either have not connected to the correct uart pins or you have wrong settings in putty (baudrate,etc.).
But looking on that, you are not too far away.
 
I tried different serial adapters: one FTDI USB to RS232, second PCMCIA. Also tried different boudrates.
Probably neither adaptet was suitable. I will try to buy a new one which was listed at the beginning of the tread.
Thanks a lot.
 
katcha said:
I tried different serial adapters: one FTDI USB to RS232
Click to expand...
That may have damaged the serial TTL interface on the camera.
An RS232 interface operates at + and - 3V-15V with a current limit of around 45mA.
That's plenty to damage a serial TTL interface from the camera board.
 
The serial interface is still OK.
I switched from PC to RPi. Now I don't see gibberish anymore. However when trying to send files over TFTP I'm getting the following message after sending completion: " ER0002:The IMG header be changed!"
upload_2019-4-26_22-52-42.png
Any ideas?
Thank you.
 
Last edited:
katcha said:
The serial interface is still OK.
I switched from PC to RPi. Now I don't see gibberish anymore. However when trying to send files over TFTP I'm getting the following message after sending completion: " ER0002:The IMG header be changed!"
View attachment 41859
Any ideas?
Thank you.
Click to expand...
Try to reverse the bootloader file and analysis the algorithm in the UBOOT_commonSwRsaVerify function.
 
ericleel said:
Try to reverse the bootloader file and analysis the algorithm in the UBOOT_commonSwRsaVerify function.
Click to expand...
How to reverse the bootloader?
I have found this "UBOOT_commonSwRsaVerify" function. Or at least was able to see this name when the camera booted.
I'm not sure what analysis I should be able to make?
Version 1.4 is the minimum one allowed to be loaded?
upload_2019-4-27_17-5-27.png
 
Last edited:
riogrande75 said:
You need USB to UART (serial 3.3v levels). RS232 is wrong!
Click to expand...

Now I have established connection between UART device (RPi) and the Camera. But I can't update (downgrade) the Chinese firmware back to English. Is that it? With the new signed firmware there would be no way to apply changes?
 
You must log in or register to reply here.
Top Bottom