Dahua IPC EASY unbricking / recovery over TFTP

[iTuneDVR]

All thanks to iTuneDVR, thank you very much, greetings from Argentina!

 

[Raul Girard]

Dear, well although I could load the firmware (General_VTO2111D_Eng_P_16M_V1.000.0000.0.R.20170414)
I could manage the device again, but the fault it generates is that it does not call the cell phone, I tried several Andriod (motorola and samsung) different internet providers and nothing.
I tried to update the firmware to the version General_VTO2111D_Eng_P_16M_V3.120.0012000.0.R.20180731 is updated ok apparently but I can not access the management website does not take the username and password.
What can be?? Will the bootloader be for version 1 ???

 

[Raul Girard]

Being with version 1 running halfway, I try to upgrade with the VDP to the version General_VTO2111D_Eng_P_16M_SIP_V4.300.0000000.6.R.20190320, and it is not working, the VDP sees it as the attached image, and I can not enter via web throws me loguin fail

 

[alastairstevenson]

"status uninitialised"

 

[Raul Girard]

"status uninitialised"

Yes, How is it solved?

 

[iTuneDVR]

init it!

 

[Raul Girard]

init it!

Yes, my wide monitor did not allow to see the initialize button.
I could already start it, now the problem I have is that when I enter via web it does not bring me the page correctly, it is blank.
any suggestions ???

 

[Raul Girard]

Yes, my wide monitor did not allow to see the initialize button.
I could already start it, now the problem I have is that when I enter via web it does not bring me the page correctly, it is blank.
any suggestions ???

adjunto imagen

 

[iTuneDVR]

 

[Raul Girard]

My VTO is in a boot loop and does not allow me to update any version
help!!!

"Data CRC Checking ... ERROR"

DHBOOT# tftp 0x82000000 update.img; flwrite
TFTP from server 192.168.1.1; our IP address is 192.168.1.108
Filename 'update.img'.
Load address: 0x82000000
Loading: #################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
########
done
Bytes transferred = 13468440 (cd8318 hex)

## Checking Image at 0x82000040 ...
Header CRC Checking ... OK
Image Name: linux
Image Type: ARM Linux Kernel Image (gzip compressed)
Data Size: 1798488 Bytes = 1.7 MB
Load Address: 02060000
Entry Point: 02260000
Data CRC Checking ... ERROR
flwrite error!
DHBOOT# tftp 0x82000000 update.img; flwrite
TFTP from server 192.168.1.1; our IP address is 192.168.1.108
Filename 'update.img'.
Load address: 0x82000000
Loading: #################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
########
done
Bytes transferred = 13468440 (cd8318 hex)

## Checking Image at 0x82000040 ...
Header CRC Checking ... OK
Image Name: linux
Image Type: ARM Linux Kernel Image (gzip compressed)
Data Size: 1798488 Bytes = 1.7 MB
Load Address: 02060000
Entry Point: 02260000
Data CRC Checking ... ERROR
flwrite error!
DHBOOT# tftp 0x82000000 kernel-x.cramfs.img; flwrite
TFTP from server 192.168.1.1; our IP address is 192.168.1.108
Filename 'kernel-x.cramfs.img'.
Load address: 0x82000000
Loading: #################################################################
##########################################################
done
Bytes transferred = 1798552 (1b7198 hex)

## Checking Image at 0x82000000 ...
Header CRC Checking ... OK
Image Name: linux
Image Type: ARM Linux Kernel Image (gzip compressed)
Data Size: 1798488 Bytes = 1.7 MB
Load Address: 02060000
Entry Point: 02260000
Data CRC Checking ... ERROR
DHBOOT# tftp 0x82000000 romfs-x.cramfs.img; flwrite
TFTP from server 192.168.1.1; our IP address is 192.168.1.108
Filename 'romfs-x.cramfs.img'.
Load address: 0x82000000
Loading: #################################################################
#################################################################
#################################################################
####
done
Bytes transferred = 2912320 (2c7040 hex)

## Checking Image at 0x82000000 ...
Header CRC Checking ... OK
Image Name: romfs
Image Type: ARM Linux Kernel Image (gzip compressed)
Data Size: 2912256 Bytes = 2.8 MB
Load Address: 023e0000
Entry Point: 026e0000
Data CRC Checking ... ERROR
DHBOOT# tftp 0x82000000 user-x.cramfs.img; flwrite
TFTP from server 192.168.1.1; our IP address is 192.168.1.108
Filename 'user-x.cramfs.img'.
Load address: 0x82000000
Loading: #################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
###########
done
Bytes transferred = 6836288 (685040 hex)

## Checking Image at 0x82000000 ...
Header CRC Checking ... OK
Image Name: user
Image Type: ARM Linux Kernel Image (gzip compressed)
Data Size: 6836224 Bytes = 6.5 MB
Load Address: 026f0000
Entry Point: 02da0000
Data CRC Checking ... ERROR
DHBOOT# tftp 0x82000000 data-x.cramfs.img; flwrite
TFTP from server 192.168.1.1; our IP address is 192.168.1.108
Filename 'data-x.cramfs.img'.
Load address: 0x82000000
Loading: ##########################
done
Bytes transferred = 368704 (5a040 hex)

## Checking Image at 0x82000000 ...
Header CRC Checking ... OK
Image Name: data
Image Type: ARM Linux Kernel Image (gzip compressed)
Data Size: 368640 Bytes = 360 kB
Load Address: 02da0000
Entry Point: 02ec0000
Data CRC Checking ... ERROR
DHBOOT# tftp 0x82000000 sign.img; flwrite
TFTP from server 192.168.1.1; our IP address is 192.168.1.108
Filename 'sign.img'.
Load address: 0x82000000
Loading: #
done
Bytes transferred = 128 (80 hex)
DestAddr=0xba364c03 invalid!
DestAddr: 0x2000000~0x4200000

 

[iTuneDVR]

Put here boot-start log & answer if you real update to General_VTO2111D_Eng_P_16M_SIP_V4.300.0000000.6.R.20190320, try to get back u-boot 1st manual.

 

[Raul Girard]

Put here boot-start log & answer if you real update to General_VTO2111D_Eng_P_16M_SIP_V4.300.0000000.6.R.20190320, try to get back u-boot 1st manual.

Good afternoon, I could finally make it work. First to cut the boot loop I followed these steps: RVi форум
I don't know what it does but it worked.
Then download this firmware:
DAHUA - DESCARGA DE FIRMWARE CORREGIDOS 2018 VIDEOPORTEROS IP
Install from VDP the first file and then the language pack, and they installed both without problems.
And finally and I think the most important probe with iDMSS Plus and followed the steps to activate the push. I used to always try iDMSS Lite.
Thanks for everything!!

 

[iTuneDVR]

 

[Focster]

Good day. My Dahua VTO-2111 Call Panel does not load. I can’t log in to the web interface. I can only see her address for some time through the VDP Config program. But when I try to reset its settings or flash it, I get a message that the connection with the device has been lost. The panel constantly loads and reboots. How can I restore the work of the calling panel?
I see that the panel has a uart connector. I have an XGECU TL866 programmer || plus. But I don’t have such a small uart adapter .. I can flash the flash memory and flash it .. Will it help? How and how can I restore the operation of this call panel?

 

[Anzic]

I can't get the NVR4416-16p to download files from the tftp server. wireshark catches a request for file ID_2G024C5PAMK588G.txt (507 57.576155 192.168.1.108 192.168.254.254 TFTP 104 Read Request, File: ID_2G024C5PAMK588G.txt, Transfer type: octet, timeout=1, tsize=0, blksize=1468). I corrected the command.txt but it does not help, the server window tftp does not show the connection.
Commands.bat
@echo off
bin\upgrade_info.exe commands.txt root\ID_2G024C5PAMK588G.txt || (PAUSE >nul && EXIT /B 1)

Dahua_TFTPBackup\root

 

[iTuneDVR]

Show your ID_2G024C5PAMK588G.txt inside

 

[Anzic]

Show your ID_2G024C5PAMK588G.txt inside

CRC:4050037456
MagicString:c016dcd6-cdeb-45df-9fd0-e821bf0e1e62
run dr
run dk
run du
run dw
run dp
run dc
tftp 0x82000000 pd-x.squashfs.img; flwrite
tftp 0x82000000 .FLASHING_DONE_STOP_TFTP_NOW
sleep 5

 

[Anzic]

I found interesting information in the Install.lua file. Perhaps I need to change the command file?

managed to get the commands executed, now the NVR downloads the file. But for some reason it does not execute commands.
First it say:
Client 192.168.1.108:1615 root\ID_2G024C5PAMK588G.txt, 1 Blocks Served
Client 192.168.1.108:3250 root\failed.txt, File not found or No Access
made an File called failed.txt in root-Folder:
Client 192.168.1.108:3521 root\ID_2G024C5PAMK588G.txt, 1 Blocks Served
Client 192.168.1.108:1511 root\success.txt, File not found or No Access
made an File called success.txt in root-Folder:
Client 192.168.1.108:2643 root\ID_2G024C5PAMK588G.txt, 1 Blocks Served
Client 192.168.1.108:3979 root\success.txt, 1 Blocks Served
how to get the NVR to execute commands? Maybe a different set of commands is needed for NVR? And why doesn't it appear in the console? It starts up, but it doesn't return anything. Just shows that it is running.

 

[iTuneDVR]

For ID_XXXXXXXXXXXXXXX.txt files must be this format. It' mean needed original image file name, not command

 

[Anzic]

For ID_XXXXXXXXXXXXXXX.txt files must be this format. It' mean needed original image file name, not command


View attachment 46588

ID_2G024C5PAMK588G.txt
custom-x.cramfs.img
logo-x.cramfs.img
web-x.cramfs.img
romfs-x.cramfs.img
return:
Listening On: 192.168.254.254:69
Client 192.168.1.108:3470 root\ID_2G024C5PAMK588G.txt, 1 Blocks Served
Client 192.168.1.108:3336 root\custom-x.cramfs.img, 3 Blocks Served
Client 192.168.1.108:1192 root\logo-x.cramfs.img, 26 Blocks Served
Client 192.168.1.108:1467 root\web-x.cramfs.img, 1064 Blocks Served
Client 192.168.1.108:3924 root\romfs-x.cramfs.img, 8776 Blocks Served
Client 192.168.1.108:2623 root\success.txt, 1 Blocks Served
But NVR won't boot.
If
CRC:4050037456
MagicString:c016dcd6-cdeb-45df-9fd0-e821bf0e1e62
present in file it return
Client 192.168.1.108:3250 root\failed.txt, 1 Blocks Served