Dahua IPC EASY unbricking / recovery over TFTP

Discussion in 'Dahua' started by cor35vet, Feb 22, 2017.

Share This Page

  1. dvbit

    dvbit n3wb

    Joined:
    Feb 24, 2019
    Messages:
    13
    Likes Received:
    0
    Location:
    Italia
    In the attempt I did (removing part of the commands , dp and tftp) It went through
    I Will try wireshark
    I do not have the USB uart connetted (yet....)
     
  2. katcha

    katcha n3wb

    Joined:
    Apr 7, 2019
    Messages:
    18
    Likes Received:
    1
    Location:
    Canada
    I have a modded IPC-HDW4433C-A camera which had some issues restarting on its own from the very beginning. I upgraded its firmware to Chinese version (DH_IPC-HX4XXX-Eos_Chn_PN_Stream3_V2.680.0000000.41.R.181212.bin). Since then the camera worked perfectly with my DH-NVR4104.
    The problem came after I upgraded my Dahua NVR from official V3.215 to v3.216. Now the DH NVR doesn't recognize the camera anymore. Says "not compatible".
    I've attempted to convert the camera back to the English modded version by using the file DH_IPC-HX4XXX-Eos_EngFraSpaRus_PN_Stream3_V2.420.0000.22.R.20161209.bin from the beginning of this tread. It failed.
    Then I used TFTP by following the instructions from this tread. The process of sending files to camera fails after sending the fist img.


    Error.jpg
    Am I doing anything wrong?
    Or, do I need to try to make different bin file?
    Anybody? Please help advising with the step to convert the EOS camera to English version.

    Update2:
    I used the Mod Tool to extract the original DH_IPC-HX4XXX-Eos_Chn_PN_Stream3_V2.680.0000000.41.R.181212.bin file and -re-build it without doing any changes. Even after that it failed to download the "re-built" firmware using TFTP.
    It seems that the firmware signature - is what causing the problem.
    Any ideas on how to overcome the signature issue?
     
    Last edited: Apr 21, 2019
  3. ericleel

    ericleel n3wb

    Joined:
    Apr 7, 2019
    Messages:
    5
    Likes Received:
    0
    Location:
    HK
    I use TFTP method to upload firmware ,but errors received as following.

    [​IMG]


    1.How should I fix the problem.
    2.where can I find the UBOOT_commonSwRsaVerify function body.

    Device model :IPC-HDW4631C-A
    System version:v2.800.0000005.0.R

    Thx a lot
     
    Last edited: Apr 21, 2019
  4. iTuneDVR

    iTuneDVR Getting the hang of it

    Joined:
    Aug 23, 2014
    Messages:
    415
    Likes Received:
    47
    Location:
    www.iTuneDVR.ru
    What is your device model & onboard firmware version?
     
  5. ericleel

    ericleel n3wb

    Joined:
    Apr 7, 2019
    Messages:
    5
    Likes Received:
    0
    Location:
    HK
    Device model :IPC-HDW4631C-A
    System version:v2.800.0000005.0.R
     
  6. katcha

    katcha n3wb

    Joined:
    Apr 7, 2019
    Messages:
    18
    Likes Received:
    1
    Location:
    Canada
     
  7. ericleel

    ericleel n3wb

    Joined:
    Apr 7, 2019
    Messages:
    5
    Likes Received:
    0
    Location:
    HK
    The method to overcome the signature may be founded by analyzing the UBOOT_commonSwRsaVerify function.
     
  8. katcha

    katcha n3wb

    Joined:
    Apr 7, 2019
    Messages:
    18
    Likes Received:
    1
    Location:
    Canada
    How or where this fuction can be seen or loaded?
    Thank you.
     
  9. iTuneDVR

    iTuneDVR Getting the hang of it

    Joined:
    Aug 23, 2014
    Messages:
    415
    Likes Received:
    47
    Location:
    www.iTuneDVR.ru
    Share this new firmware version here.
     
  10. katcha

    katcha n3wb

    Joined:
    Apr 7, 2019
    Messages:
    18
    Likes Received:
    1
    Location:
    Canada
    I guess since my camera and NVR are both have signed firmware-I'm stuck. No help here.
    I can't downgrade neither camera nor NVR. TFTP method won't work.:smash:
    The serial method doesn't work either. Getting only gibberish.
    upload_2019-4-25_21-5-37.png
    Seems that I need to scrap this Chinese camera. :)
     
  11. riogrande75

    riogrande75 Getting the hang of it

    Joined:
    Oct 19, 2017
    Messages:
    138
    Likes Received:
    32
    No. You either have not connected to the correct uart pins or you have wrong settings in putty (baudrate,etc.).
    But looking on that, you are not too far away.
     
  12. katcha

    katcha n3wb

    Joined:
    Apr 7, 2019
    Messages:
    18
    Likes Received:
    1
    Location:
    Canada
    I tried different serial adapters: one FTDI USB to RS232, second PCMCIA. Also tried different boudrates.
    Probably neither adaptet was suitable. I will try to buy a new one which was listed at the beginning of the tread.
    Thanks a lot.
     
  13. riogrande75

    riogrande75 Getting the hang of it

    Joined:
    Oct 19, 2017
    Messages:
    138
    Likes Received:
    32
    You need USB to UART (serial 3.3v levels). RS232 is wrong!
     
  14. alastairstevenson

    alastairstevenson Staff Member

    Joined:
    Oct 28, 2014
    Messages:
    11,090
    Likes Received:
    3,503
    Location:
    Scotland
    That may have damaged the serial TTL interface on the camera.
    An RS232 interface operates at + and - 3V-15V with a current limit of around 45mA.
    That's plenty to damage a serial TTL interface from the camera board.
     
  15. katcha

    katcha n3wb

    Joined:
    Apr 7, 2019
    Messages:
    18
    Likes Received:
    1
    Location:
    Canada
    The serial interface is still OK.
    I switched from PC to RPi. Now I don't see gibberish anymore. However when trying to send files over TFTP I'm getting the following message after sending completion: " ER0002:The IMG header be changed!"
    upload_2019-4-26_22-52-42.png
    Any ideas?
    Thank you.
     
    Last edited: Apr 26, 2019
  16. ericleel

    ericleel n3wb

    Joined:
    Apr 7, 2019
    Messages:
    5
    Likes Received:
    0
    Location:
    HK
    Try to reverse the bootloader file and analysis the algorithm in the UBOOT_commonSwRsaVerify function.
     
  17. iTuneDVR

    iTuneDVR Getting the hang of it

    Joined:
    Aug 23, 2014
    Messages:
    415
    Likes Received:
    47
    Location:
    www.iTuneDVR.ru
    The new signed bootloader from December 2018 regularly accepts only new signed modules.
    Just an update or?
     
    alastairstevenson likes this.
  18. katcha

    katcha n3wb

    Joined:
    Apr 7, 2019
    Messages:
    18
    Likes Received:
    1
    Location:
    Canada
    How do I get to see the function?
     
  19. katcha

    katcha n3wb

    Joined:
    Apr 7, 2019
    Messages:
    18
    Likes Received:
    1
    Location:
    Canada
    How to reverse the bootloader?
    I have found this "UBOOT_commonSwRsaVerify" function. Or at least was able to see this name when the camera booted.
    I'm not sure what analysis I should be able to make?
    Version 1.4 is the minimum one allowed to be loaded?
    upload_2019-4-27_17-5-27.png
     
    Last edited: Apr 27, 2019
  20. katcha

    katcha n3wb

    Joined:
    Apr 7, 2019
    Messages:
    18
    Likes Received:
    1
    Location:
    Canada
    Now I have established connection between UART device (RPi) and the Camera. But I can't update (downgrade) the Chinese firmware back to English. Is that it? With the new signed firmware there would be no way to apply changes?