Dahua IPC EASY unbricking / recovery over TFTP

Discussion in 'Dahua' started by cor35vet, Feb 22, 2017.

Share This Page

  1. iTuneDVR

    iTuneDVR Getting the hang of it

    Joined:
    Aug 23, 2014
    Messages:
    435
    Likes Received:
    53
    Location:
    www.iTuneDVR.ru
    ;)
     
  2. Raul Girard

    Raul Girard n3wb

    Joined:
    Aug 10, 2019
    Messages:
    15
    Likes Received:
    0
    Location:
    Argentina
    Dear, well although I could load the firmware (General_VTO2111D_Eng_P_16M_V1.000.0000.0.R.20170414)
    I could manage the device again, but the fault it generates is that it does not call the cell phone, I tried several Andriod (motorola and samsung) different internet providers and nothing.
    I tried to update the firmware to the version General_VTO2111D_Eng_P_16M_V3.120.0012000.0.R.20180731 is updated ok apparently but I can not access the management website does not take the username and password.
    What can be?? Will the bootloader be for version 1 ???
     
  3. Raul Girard

    Raul Girard n3wb

    Joined:
    Aug 10, 2019
    Messages:
    15
    Likes Received:
    0
    Location:
    Argentina
    Being with version 1 running halfway, I try to upgrade with the VDP to the version General_VTO2111D_Eng_P_16M_SIP_V4.300.0000000.6.R.20190320, and it is not working, the VDP sees it as the attached image, and I can not enter via web throws me loguin fail
     

    Attached Files:

  4. alastairstevenson

    alastairstevenson Staff Member

    Joined:
    Oct 28, 2014
    Messages:
    11,259
    Likes Received:
    3,581
    Location:
    Scotland
  5. Raul Girard

    Raul Girard n3wb

    Joined:
    Aug 10, 2019
    Messages:
    15
    Likes Received:
    0
    Location:
    Argentina
    Yes, How is it solved?
     
  6. iTuneDVR

    iTuneDVR Getting the hang of it

    Joined:
    Aug 23, 2014
    Messages:
    435
    Likes Received:
    53
    Location:
    www.iTuneDVR.ru
  7. Raul Girard

    Raul Girard n3wb

    Joined:
    Aug 10, 2019
    Messages:
    15
    Likes Received:
    0
    Location:
    Argentina
    Yes, my wide monitor did not allow to see the initialize button.
    I could already start it, now the problem I have is that when I enter via web it does not bring me the page correctly, it is blank.
    any suggestions ???
     
  8. Raul Girard

    Raul Girard n3wb

    Joined:
    Aug 10, 2019
    Messages:
    15
    Likes Received:
    0
    Location:
    Argentina
    adjunto imagen
     

    Attached Files:

  9. iTuneDVR

    iTuneDVR Getting the hang of it

    Joined:
    Aug 23, 2014
    Messages:
    435
    Likes Received:
    53
    Location:
    www.iTuneDVR.ru
  10. Raul Girard

    Raul Girard n3wb

    Joined:
    Aug 10, 2019
    Messages:
    15
    Likes Received:
    0
    Location:
    Argentina
    My VTO is in a boot loop and does not allow me to update any version
    help!!!

    "Data CRC Checking ... ERROR"

    DHBOOT# tftp 0x82000000 update.img; flwrite
    TFTP from server 192.168.1.1; our IP address is 192.168.1.108
    Filename 'update.img'.
    Load address: 0x82000000
    Loading: #################################################################
    #################################################################
    #################################################################
    #################################################################
    #################################################################
    #################################################################
    #################################################################
    #################################################################
    #################################################################
    #################################################################
    #################################################################
    #################################################################
    #################################################################
    #################################################################
    ########
    done
    Bytes transferred = 13468440 (cd8318 hex)

    ## Checking Image at 0x82000040 ...
    Header CRC Checking ... OK
    Image Name: linux
    Image Type: ARM Linux Kernel Image (gzip compressed)
    Data Size: 1798488 Bytes = 1.7 MB
    Load Address: 02060000
    Entry Point: 02260000
    Data CRC Checking ... ERROR
    flwrite error!
    DHBOOT# tftp 0x82000000 update.img; flwrite
    TFTP from server 192.168.1.1; our IP address is 192.168.1.108
    Filename 'update.img'.
    Load address: 0x82000000
    Loading: #################################################################
    #################################################################
    #################################################################
    #################################################################
    #################################################################
    #################################################################
    #################################################################
    #################################################################
    #################################################################
    #################################################################
    #################################################################
    #################################################################
    #################################################################
    #################################################################
    ########
    done
    Bytes transferred = 13468440 (cd8318 hex)

    ## Checking Image at 0x82000040 ...
    Header CRC Checking ... OK
    Image Name: linux
    Image Type: ARM Linux Kernel Image (gzip compressed)
    Data Size: 1798488 Bytes = 1.7 MB
    Load Address: 02060000
    Entry Point: 02260000
    Data CRC Checking ... ERROR
    flwrite error!
    DHBOOT# tftp 0x82000000 kernel-x.cramfs.img; flwrite
    TFTP from server 192.168.1.1; our IP address is 192.168.1.108
    Filename 'kernel-x.cramfs.img'.
    Load address: 0x82000000
    Loading: #################################################################
    ##########################################################
    done
    Bytes transferred = 1798552 (1b7198 hex)

    ## Checking Image at 0x82000000 ...
    Header CRC Checking ... OK
    Image Name: linux
    Image Type: ARM Linux Kernel Image (gzip compressed)
    Data Size: 1798488 Bytes = 1.7 MB
    Load Address: 02060000
    Entry Point: 02260000
    Data CRC Checking ... ERROR
    DHBOOT# tftp 0x82000000 romfs-x.cramfs.img; flwrite
    TFTP from server 192.168.1.1; our IP address is 192.168.1.108
    Filename 'romfs-x.cramfs.img'.
    Load address: 0x82000000
    Loading: #################################################################
    #################################################################
    #################################################################
    ####
    done
    Bytes transferred = 2912320 (2c7040 hex)

    ## Checking Image at 0x82000000 ...
    Header CRC Checking ... OK
    Image Name: romfs
    Image Type: ARM Linux Kernel Image (gzip compressed)
    Data Size: 2912256 Bytes = 2.8 MB
    Load Address: 023e0000
    Entry Point: 026e0000
    Data CRC Checking ... ERROR
    DHBOOT# tftp 0x82000000 user-x.cramfs.img; flwrite
    TFTP from server 192.168.1.1; our IP address is 192.168.1.108
    Filename 'user-x.cramfs.img'.
    Load address: 0x82000000
    Loading: #################################################################
    #################################################################
    #################################################################
    #################################################################
    #################################################################
    #################################################################
    #################################################################
    ###########
    done
    Bytes transferred = 6836288 (685040 hex)

    ## Checking Image at 0x82000000 ...
    Header CRC Checking ... OK
    Image Name: user
    Image Type: ARM Linux Kernel Image (gzip compressed)
    Data Size: 6836224 Bytes = 6.5 MB
    Load Address: 026f0000
    Entry Point: 02da0000
    Data CRC Checking ... ERROR
    DHBOOT# tftp 0x82000000 data-x.cramfs.img; flwrite
    TFTP from server 192.168.1.1; our IP address is 192.168.1.108
    Filename 'data-x.cramfs.img'.
    Load address: 0x82000000
    Loading: ##########################
    done
    Bytes transferred = 368704 (5a040 hex)

    ## Checking Image at 0x82000000 ...
    Header CRC Checking ... OK
    Image Name: data
    Image Type: ARM Linux Kernel Image (gzip compressed)
    Data Size: 368640 Bytes = 360 kB
    Load Address: 02da0000
    Entry Point: 02ec0000
    Data CRC Checking ... ERROR
    DHBOOT# tftp 0x82000000 sign.img; flwrite
    TFTP from server 192.168.1.1; our IP address is 192.168.1.108
    Filename 'sign.img'.
    Load address: 0x82000000
    Loading: #
    done
    Bytes transferred = 128 (80 hex)
    DestAddr=0xba364c03 invalid!
    DestAddr: 0x2000000~0x4200000
     
  11. iTuneDVR

    iTuneDVR Getting the hang of it

    Joined:
    Aug 23, 2014
    Messages:
    435
    Likes Received:
    53
    Location:
    www.iTuneDVR.ru
    Put here boot-start log & answer if you real update to General_VTO2111D_Eng_P_16M_SIP_V4.300.0000000.6.R.20190320, try to get back u-boot 1st manual.
     
  12. Raul Girard

    Raul Girard n3wb

    Joined:
    Aug 10, 2019
    Messages:
    15
    Likes Received:
    0
    Location:
    Argentina
    Good afternoon, I could finally make it work. First to cut the boot loop I followed these steps: RVi форум
    I don't know what it does but it worked.
    Then download this firmware:
    DAHUA - DESCARGA DE FIRMWARE CORREGIDOS 2018 VIDEOPORTEROS IP
    Install from VDP the first file and then the language pack, and they installed both without problems.
    And finally and I think the most important probe with iDMSS Plus and followed the steps to activate the push. I used to always try iDMSS Lite.
    Thanks for everything!!
     
  13. iTuneDVR

    iTuneDVR Getting the hang of it

    Joined:
    Aug 23, 2014
    Messages:
    435
    Likes Received:
    53
    Location:
    www.iTuneDVR.ru
  14. Focster

    Focster n3wb

    Joined:
    Aug 20, 2019
    Messages:
    1
    Likes Received:
    0
    Location:
    Украина
    Good day. My Dahua VTO-2111 Call Panel does not load. I can’t log in to the web interface. I can only see her address for some time through the VDP Config program. But when I try to reset its settings or flash it, I get a message that the connection with the device has been lost. The panel constantly loads and reboots. How can I restore the work of the calling panel?
    I see that the panel has a uart connector. I have an XGECU TL866 programmer || plus. But I don’t have such a small uart adapter .. I can flash the flash memory and flash it .. Will it help? How and how can I restore the operation of this call panel?
     
  15. Anzic

    Anzic n3wb

    Joined:
    Jun 29, 2018
    Messages:
    6
    Likes Received:
    1
    Location:
    Krasnodarskij kraj
    I can't get the NVR4416-16p to download files from the tftp server. wireshark catches a request for file ID_2G024C5PAMK588G.txt (507 57.576155 192.168.1.108 192.168.254.254 TFTP 104 Read Request, File: ID_2G024C5PAMK588G.txt, Transfer type: octet, timeout=1, tsize=0, blksize=1468). I corrected the command.txt but it does not help, the server window tftp does not show the connection.
    Commands.bat
    @echo off
    bin\upgrade_info.exe commands.txt root\ID_2G024C5PAMK588G.txt || (PAUSE >nul && EXIT /B 1)

    Dahua_TFTPBackup\root
    upload_2019-8-28_2-0-46.png
     

    Attached Files:

  16. iTuneDVR

    iTuneDVR Getting the hang of it

    Joined:
    Aug 23, 2014
    Messages:
    435
    Likes Received:
    53
    Location:
    www.iTuneDVR.ru
    Show your ID_2G024C5PAMK588G.txt inside
     
  17. Anzic

    Anzic n3wb

    Joined:
    Jun 29, 2018
    Messages:
    6
    Likes Received:
    1
    Location:
    Krasnodarskij kraj
    CRC:4050037456
    MagicString:c016dcd6-cdeb-45df-9fd0-e821bf0e1e62
    run dr
    run dk
    run du
    run dw
    run dp
    run dc
    tftp 0x82000000 pd-x.squashfs.img; flwrite
    tftp 0x82000000 .FLASHING_DONE_STOP_TFTP_NOW
    sleep 5
     
  18. Anzic

    Anzic n3wb

    Joined:
    Jun 29, 2018
    Messages:
    6
    Likes Received:
    1
    Location:
    Krasnodarskij kraj
    I found interesting information in the Install.lua file. Perhaps I need to change the command file?
    upload_2019-8-28_11-8-52.png
    managed to get the commands executed, now the NVR downloads the file. But for some reason it does not execute commands.
    First it say:
    Client 192.168.1.108:1615 root\ID_2G024C5PAMK588G.txt, 1 Blocks Served
    Client 192.168.1.108:3250 root\failed.txt, File not found or No Access
    made an File called failed.txt in root-Folder:
    Client 192.168.1.108:3521 root\ID_2G024C5PAMK588G.txt, 1 Blocks Served
    Client 192.168.1.108:1511 root\success.txt, File not found or No Access
    made an File called success.txt in root-Folder:
    Client 192.168.1.108:2643 root\ID_2G024C5PAMK588G.txt, 1 Blocks Served
    Client 192.168.1.108:3979 root\success.txt, 1 Blocks Served
    how to get the NVR to execute commands? Maybe a different set of commands is needed for NVR? And why doesn't it appear in the console? It starts up, but it doesn't return anything. Just shows that it is running.
     

    Attached Files:

    Last edited: Aug 28, 2019
  19. iTuneDVR

    iTuneDVR Getting the hang of it

    Joined:
    Aug 23, 2014
    Messages:
    435
    Likes Received:
    53
    Location:
    www.iTuneDVR.ru
    For ID_XXXXXXXXXXXXXXX.txt files must be this format. It' mean needed original image file name, not command ;)


    upload_2019-8-28_11-51-49.png
     
    Last edited: Aug 28, 2019
  20. Anzic

    Anzic n3wb

    Joined:
    Jun 29, 2018
    Messages:
    6
    Likes Received:
    1
    Location:
    Krasnodarskij kraj
    ID_2G024C5PAMK588G.txt
    custom-x.cramfs.img
    logo-x.cramfs.img
    web-x.cramfs.img
    romfs-x.cramfs.img
    return:
    Listening On: 192.168.254.254:69
    Client 192.168.1.108:3470 root\ID_2G024C5PAMK588G.txt, 1 Blocks Served
    Client 192.168.1.108:3336 root\custom-x.cramfs.img, 3 Blocks Served
    Client 192.168.1.108:1192 root\logo-x.cramfs.img, 26 Blocks Served
    Client 192.168.1.108:1467 root\web-x.cramfs.img, 1064 Blocks Served
    Client 192.168.1.108:3924 root\romfs-x.cramfs.img, 8776 Blocks Served
    Client 192.168.1.108:2623 root\success.txt, 1 Blocks Served
    But NVR won't boot.
    If
    CRC:4050037456
    MagicString:c016dcd6-cdeb-45df-9fd0-e821bf0e1e62
    present in file it return
    Client 192.168.1.108:3250 root\failed.txt, 1 Blocks Served