Dahua IPC EASY unbricking / recovery over TFTP
- Thread starter cor35vet
- Start date
YES!! It's BOOT!!!! I don't know what happened, but after the next power off and on, the NVR has boot! I conclude that the last file that I sent is a working option to restore the recorder. Thank you very much, iTuneDVR! I wouldn't be able to restore without you!
Hello!
This few lines to report successful unbricking of my VTO2000A-2 (stuck with an english-only firmware while I needed french) and VTH1550CH (with a V4 firmware I had to downgrade to the same version number than the french VTO firmware).
I pass over the network configuration, that is quite specific for everyone.
It seemed to me that depending on each network configuration, the devices don't connect to the TFTP server systematically: it takes sometimes several reboots to connect.
There's no need to create empty failed.txt file under the server's root: messages complaining about missing failed.txt or success.txt files are only for saying that something goes wrong or that everything is OK.
Depending to the step where I successively get the failed.txt error message, I had to slightly adapt commands.txt to each device.
For the VTO2000A-2 (don't keep what is in brackets):
run dr
run dk
run du
run dw
run dd (--> for data-x.cramfs.img, instead of 'run dp' by default in the 'Dahua_TFTPBackup.zip')
run dc
tftp 0x82000000 pd-x.cramfs.img; flwrite (instead of 'pd-x.squashfs.img')
tftp 0x82000000 .FLASHING_DONE_STOP_TFTP_NOW
sleep 5
and for the VTH1550CH:
run dr
run dk
run du
run dg (--> for gui-x.cramfs.img, instead of 'run dw' that is for web-x.cramfs.img on the VTO: VTO has a web interface, VTH has a GUI)
run dd
run dc
tftp 0x82000000 pd-x.cramfs.img; flwrite
tftp 0x82000000 .FLASHING_DONE_STOP_TFTP_NOW
sleep 5
I've first downgraded to the 3.2 firmwares, but the web interface of the VTO seemed to lack some options, and didn't work well in Firefox, had to use Edge. But I then was able to downgrade with ConfigTool to 3.1 firmwares, and finally got all in french: vocal announces, VTO web interface (but still have to use Edge, don't know why...) and VTH GUI. Maybe I will try later to get others 3.2 files...
Hope it helps, and many thanks to all of you
This few lines to report successful unbricking of my VTO2000A-2 (stuck with an english-only firmware while I needed french) and VTH1550CH (with a V4 firmware I had to downgrade to the same version number than the french VTO firmware).
I pass over the network configuration, that is quite specific for everyone.
It seemed to me that depending on each network configuration, the devices don't connect to the TFTP server systematically: it takes sometimes several reboots to connect.
There's no need to create empty failed.txt file under the server's root: messages complaining about missing failed.txt or success.txt files are only for saying that something goes wrong or that everything is OK.
Depending to the step where I successively get the failed.txt error message, I had to slightly adapt commands.txt to each device.
For the VTO2000A-2 (don't keep what is in brackets):
run dr
run dk
run du
run dw
run dd (--> for data-x.cramfs.img, instead of 'run dp' by default in the 'Dahua_TFTPBackup.zip')
run dc
tftp 0x82000000 pd-x.cramfs.img; flwrite (instead of 'pd-x.squashfs.img')
tftp 0x82000000 .FLASHING_DONE_STOP_TFTP_NOW
sleep 5
and for the VTH1550CH:
run dr
run dk
run du
run dg (--> for gui-x.cramfs.img, instead of 'run dw' that is for web-x.cramfs.img on the VTO: VTO has a web interface, VTH has a GUI)
run dd
run dc
tftp 0x82000000 pd-x.cramfs.img; flwrite
tftp 0x82000000 .FLASHING_DONE_STOP_TFTP_NOW
sleep 5
I've first downgraded to the 3.2 firmwares, but the web interface of the VTO seemed to lack some options, and didn't work well in Firefox, had to use Edge. But I then was able to downgrade with ConfigTool to 3.1 firmwares, and finally got all in french: vocal announces, VTO web interface (but still have to use Edge, don't know why...) and VTH GUI. Maybe I will try later to get others 3.2 files...
Hope it helps, and many thanks to all of you
Last edited:
Hi everyone, I have an IPC-HFW4431R-Z whose password I can't remember. I tried to reset with the jumper but it doesn't work. Can you help me?
Trying to downgrade a PTZ firmware that I am able to boot up and log into but the operation is almost unusable.
With the new firmware you can not roll back below base point 2 the normal way.
I used the TFTP mode with the run up command for a update.image file.
I have a failed to Updatr bootargs !!!
Any suggestions ?
With the new firmware you can not roll back below base point 2 the normal way.
I used the TFTP mode with the run up command for a update.image file.
I have a failed to Updatr bootargs !!!
Any suggestions ?
alastairstevenson
Staff member
I don't believe that's a fatal error.
It's commented out in the config script, and the optional files bootargsxxx presumably don't exist.
Use 'printenv' to inspect the value in bootargs and all the other variables, see if it matches the commented out value.
You haven't shown all the updates that were done.
All that's showing on the image are the kernel and the config script.
In PuTTY, use the 'Copy all to clipboard' top menu item to paste text into Notepad or similar to edit and copy here under the CODE tags. Easier than a screenshot.
Hello dear experts. I need some help with unbricking of my VTH 5221. I've loaded incorrect firmware and monitor became unresponsive.
I connected uart and the screen looks like that:
At the same time TFTP:
And Wireshark:
I've removed all antyviruses and firewals from my PC, but still unable to run neither "command.txt" not any "run xx". Always landing with message like that:
Where is the issue? how to flash the device? heeeelp...
I connected uart and the screen looks like that:
U-Boot 1.3.6 (jerry) (May 23 2018 - 17:21:42)
DRAM: 128 MB
SF: Got idcode 01 20 18 4d 01
SF: Read SPANSION second ID 0019
In: serial
Out: serial
Err: serial
Ethernet PHY: GENERIC @ 0x01,id:1cc816
total gio 2
gio[22]=1
gio[25]=1
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Filename 'upgrade_info_7db780a713a4.txt'.
Load address: 0x80100000
Loading: *
Retry count exceeded; starting again
Fail to get info file!
Init error!
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Filename 'failed.txt'.
Load address: 0x80200000
Loading: *
TFTP error: 'File not found or No Access' (1)
Not retrying...
==>use default images
APP_OFFSET_NEW test
DHBOOT#
At the same time TFTP:
accepting requests..
Open TFTP Server MultiThreaded Version 1.64 Windows Built 2001
starting TFTP...
alias / is mapped to root\
permitted clients: all
server port range: all
max blksize: 65464
default blksize: 512
default timeout: 60
file read allowed: Yes
file create allowed: No
file overwrite allowed: No
thread pool size: 1
Listening On: 192.168.254.254:69
Client 192.168.1.108:3153 root\failed.txt, File not found or No Access
And Wireshark:
I've removed all antyviruses and firewals from my PC, but still unable to run neither "command.txt" not any "run xx". Always landing with message like that:
DHBOOT# run up
TFTP from server 192.168.1.1; our IP address is 192.168.1.108
Filename 'update.img'.
Load address: 0x81a00000
Loading: T T T T T T T T T T
Retry count exceeded; starting again
DestAddr=0xffffffff invalid!
DestAddr: 0x2000000~0x4200000
Where is the issue? how to flash the device? heeeelp...
Hi guys,
Im trying to flash my A46, but got error fail to load bootargsParameters.txt and the device wont boot right now
upgrade_info
Can someone help me?
Thanks.
Im trying to flash my A46, but got error fail to load bootargsParameters.txt and the device wont boot right now
Code:
'.FLASHING_DONE_STOP_TFTP_NOW'.Download to address: 0x82000000
Downloading: #
done
partition file version 2
rootfstype squashfs root /dev/mtdblock5
fail to load bootargsParameters.txt
fail to load bootargsParameters.txt file
get bootargs info failed
Code:
CRC:35634230
MagicString:c016dcd6-cdeb-45df-9fd0-e821bf0e1e62
run dr
run dk
run du
run dw
run dp
run dc
run pd
tftp 0x82000000 .FLASHING_DONE_STOP_TFTP_NOW
sleep 5Thanks.
Last edited:
Dear Sirs,
Camera HDPW4220FP-W.
Firmware for Dahua site - DH_IPC-HX4X2X-Themis_Eng_P_Stream3_V2.620.0000003.0.R.190910
Trying to load firmware, TFTP server is started, Console also.
Here is an output of TFTP server:
accepting requests..
Open TFTP Server MultiThreaded Version 1.64 Windows Built 2001
starting TFTP...
alias / is mapped to root\
permitted clients: all
server port range: all
max blksize: 65464
default blksize: 512
default timeout: 60
file read allowed: Yes
file create allowed: No
file overwrite allowed: No
thread pool size: 1
Listening On: 192.168.254.254:69
Client 192.168.1.108:2734 root\upgrade_info_7db780a713a4.txt, 1 Blocks Served
Client 192.168.1.108:2893 root\romfs-x.squashfs.img, 930 Blocks Served
Client 192.168.1.108:1175 root\kernel.img, 1062 Blocks Served
Client 192.168.1.108:2026 root\user-x.squashfs.img, 5681 Blocks Served
Client 192.168.1.108:3302 root\web-x.squashfs.img, 1446 Blocks Served
Client 192.168.1.108:2443 root\partition-x.cramfs.img, 3 Blocks Served
Client 192.168.1.108:2825 root\custom-x.squashfs.img, 31 Blocks Served
Client 192.168.1.108:2523 root\upgrade_info_7db780a713a4.txt, 1 Blocks Served
Client 192.168.1.108:2682 root\romfs-x.squashfs.img, 930 Blocks Served
Client 192.168.1.108:3102 root\kernel.img, 1062 Blocks Served
Client 192.168.1.108:3245 root\pd-x.squashfs.img, Timeout
Then it starts again and again. What can be the problem with this file and what is this file responsible for?
Camera HDPW4220FP-W.
Firmware for Dahua site - DH_IPC-HX4X2X-Themis_Eng_P_Stream3_V2.620.0000003.0.R.190910
Trying to load firmware, TFTP server is started, Console also.
Here is an output of TFTP server:
accepting requests..
Open TFTP Server MultiThreaded Version 1.64 Windows Built 2001
starting TFTP...
alias / is mapped to root\
permitted clients: all
server port range: all
max blksize: 65464
default blksize: 512
default timeout: 60
file read allowed: Yes
file create allowed: No
file overwrite allowed: No
thread pool size: 1
Listening On: 192.168.254.254:69
Client 192.168.1.108:2734 root\upgrade_info_7db780a713a4.txt, 1 Blocks Served
Client 192.168.1.108:2893 root\romfs-x.squashfs.img, 930 Blocks Served
Client 192.168.1.108:1175 root\kernel.img, 1062 Blocks Served
Client 192.168.1.108:2026 root\user-x.squashfs.img, 5681 Blocks Served
Client 192.168.1.108:3302 root\web-x.squashfs.img, 1446 Blocks Served
Client 192.168.1.108:2443 root\partition-x.cramfs.img, 3 Blocks Served
Client 192.168.1.108:2825 root\custom-x.squashfs.img, 31 Blocks Served
Client 192.168.1.108:2523 root\upgrade_info_7db780a713a4.txt, 1 Blocks Served
Client 192.168.1.108:2682 root\romfs-x.squashfs.img, 930 Blocks Served
Client 192.168.1.108:3102 root\kernel.img, 1062 Blocks Served
Client 192.168.1.108:3245 root\pd-x.squashfs.img, Timeout
Then it starts again and again. What can be the problem with this file and what is this file responsible for?
ismaelivan
n3wb
[QUOTE = "iTuneDVR, publicación: 381583, miembro: 1150"]
En 2017 rom NVR4XXX ID_XXX dentro debe ser con CRC calculado y cadena mágica
Después de la actualización a través de TFTP, debe reiniciar manualmente con el servidor TFTP ya cerrado
Ejemplo en adjuntar. Util herramientas lo mismo.
Simplemente cambie XX.XXX a su SN
[/QUOTE]
Greetings from Mexico, Thank you for sharing this valuable information.
Good day, I followed the specific steps (do not use the command.txt), but my nvr is frozen in the logo (reason why I am updating it by this method) , after finishing it simply disconnects the power?
My model is: dhi-xvr4104c-b-s2
Thanks in advance.
UPDATE: Now i try with other firmware (s2) and too this, but with this file it only changes the resolution, tur on network led and restarts
UPDATE 2: I have several attempts with the same firmware and suddenly 5 beeps sounded every 10 seconds approximately with the logo frozen, but I was able to access the webservice
. After restarting it, he no longer allowed me, to continue restarting 
UPDATE 3: After several attempts I was allowed to enter the webservice again and this time from there I made the update of the same firmware and it worked !!!!!!!!!!!!!! 
, but now I have another problem 
there is no internet connection, if I do a test config from the dvr there is no answer (I already did tests connecting the cable to a pc and there is no problem, the cable and the modem are fine)
En 2017 rom NVR4XXX ID_XXX dentro debe ser con CRC calculado y cadena mágica
Después de la actualización a través de TFTP, debe reiniciar manualmente con el servidor TFTP ya cerrado
Ejemplo en adjuntar. Util herramientas lo mismo.
Simplemente cambie XX.XXX a su SN
[/QUOTE]
Greetings from Mexico, Thank you for sharing this valuable information
.Good day, I followed the specific steps (do not use the command.txt), but my nvr is frozen in the logo (reason why I am updating it by this method) , after finishing it simply disconnects the power?
My model is: dhi-xvr4104c-b-s2
Thanks in advance.
UPDATE: Now i try with other firmware (s2) and too this, but with this file it only changes the resolution, tur on network led and restarts
UPDATE 2: I have several attempts with the same firmware and suddenly 5 beeps sounded every 10 seconds approximately with the logo frozen, but I was able to access the webservice
. After restarting it, he no longer allowed me, to continue restarting UPDATE 3: After several attempts I was allowed to enter the webservice again and this time from there I made the update of the same firmware and it worked !!!!!!!!!!!!!!
, but now I have another problem there is no internet connection, if I do a test config from the dvr there is no answer (I already did tests connecting the cable to a pc and there is no problem, the cable and the modem are fine)Attachments
Last edited:
foxden
Getting the hang of it
Hello, I have a HDW5231R-ZE bought from Andy. Now it started not responding, IR does not power up at night, so I opened it up and tried the reset switch to no avail. Configtool can't find it.
There's a led on the bottom board, it lights up for about 15 seconds and then powers off 15 seconds and then repeat cycle.
Is this a good sign? Should I try with tftp?
There's a led on the bottom board, it lights up for about 15 seconds and then powers off 15 seconds and then repeat cycle.
Is this a good sign? Should I try with tftp?
Last edited:
Hello
Can someone help me, i have probably a chineese IPC-HDBW4631R-ZS, i tried to update with this FW (DH_IPC-HX5X3X-Rhea_MultiLang_PN_Stream3_V2.800.0000012.0.R.190808.zip)
But it dont let me connect to the web.
Device-Type: IPC-HDBW4631R-ZS
Firmware: 2.460.0000000.16.R, Build Date: 2017-09-04
WEB-Version: 3.2.1.491565
ONVIF Version: 16.12(V2.4.0.485616)
Ping is possible, i also tried with TFTP but without success. here is the log:
*******************************************************
Ncat: Version 7.40 ( Ncat - Netcat for the 21st Century )
Ncat: Listening on 192.168.254.254:5002
gBootLogPtr:00b80008.
spinor flash ID is 0x1940ef
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=130M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc.
TEXT_BASE:01000000
Net: PHY:0x001cc816,addr:0x00
s3l phy RTL8201 init
partition file version 2
rootfstype squashfs root /dev/mtdblock5
MMC: sdmmc init
Using ambarella mac device
Download Filename 'upgrade_info_7db780a713a4.txt'.Downloading: 100%
## file size: 202 Bytes, times: 0s, speed: 24.4 KiB/s
done
Bytes transferred = 202 (ca hex)
Using ambarella mac device
Download Filename 'romfs-x.squashfs.img'.Downloading: 100% 100%
## file size: 2.8 MiB, times: 2s, speed: 1 MiB/s
done
Bytes transferred = 2902264 (2c48f8 hex)
curVer:V1.4 <= newVer:V1.4,verCompare success!
[0;32mUBOOT_commonSwRsaVerify run successfully!
[0m
## Checking Image at 02000000 ...
Legacy image found
Image Name: romfs
Created: 2019-08-08 11:54:00 UTC
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 2899968 Bytes = 2.8 MiB
Load Address: 01b80000
Entry Point: 01fd0000
Verifying Checksum ... OK
Programing start at: 0x01b80000 for romfs
SPI probe: 32768 KiB W25Q256FV at 0:1 is now current device
write : 100%
done
crc from program is :f2749777, crc from flash is :f2749777
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=130M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc.
Using ambarella mac device
Download Filename 'kernel.img'.Downloading: 100%
## file size: 1.5 MiB, times: 1s, speed: 1018.6 KiB/s
done
Bytes transferred = 1575384 (1809d8 hex)
curVer:V1.4 <= newVer:V1.4,verCompare success!
[0;32mUBOOT_commonSwRsaVerify run successfully!
[0m
## Checking Image at 02000000 ...
Legacy image found
Image Name: kernel
Created: 2019-08-08 11:52:32 UTC
Image Type: ARM Linux Firmware (uncompressed)
Data Size: 1573088 Bytes = 1.5 MiB
Load Address: 01040000
Entry Point: 01200000
Verifying Checksum ... OK
Programing start at: 0x01040000 for kernel
SPI probe: 32768 KiB W25Q256FV at 0:1 is now current device
write : 100%
done
crc from program is :67fdba11, crc from flash is :67fdba11
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=130M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc.
Using ambarella mac device
Download Filename 'user-x.squashfs.img'.Downloading: 100%
## file size: 14.8 MiB, times: 14s, speed: 1 MiB/s
done
Bytes transferred = 15554808 (ed58f8 hex)
curVer:V1.4 <= newVer:V1.4,verCompare success!
[0;32mUBOOT_commonSwRsaVerify run successfully!
[0m
## Checking Image at 02000000 ...
Legacy image found
Image Name: user
Created: 2019-08-08 11:53:28 UTC
Image Type: ARM Linux Standalone Program (uncompressed)
Data Size: 15552512 Bytes = 14.8 MiB
Load Address: 000f0000
Entry Point: 01000000
Verifying Checksum ... OK
Programing start at: 0x000f0000 for user
write : 100%
done
crc from program is :ed82b853, crc from flash is :ed82b853
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=130M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc.
Using ambarella mac device
Download Filename 'web-x.squashfs.img'.Downloading: 100%
## file size: 4.8 MiB, times: 4s, speed: 1 MiB/s
done
Bytes transferred = 5064952 (4d48f8 hex)
curVer:V1.4 <= newVer:V1.4,verCompare success!
[0;32mUBOOT_commonSwRsaVerify run successfully!
[0m
## Checking Image at 02000000 ...
Legacy image found
Image Name: web
Created: 2019-08-08 11:53:07 UTC
Image Type: ARM Linux Standalone Program (uncompressed)
Data Size: 5062656 Bytes = 4.8 MiB
Load Address: 01200000
Entry Point: 01880000
Verifying Checksum ... OK
Programing start at: 0x01200000 for web
SPI probe: 32768 KiB W25Q256FV at 0:1 is now current device
write : 100%
done
crc from program is :35944947, crc from flash is :35944947
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=130M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc.
Using ambarella mac device
Download Filename 'partition-x.cramfs.img'.Downloading: 100%
## file size: 10.2 KiB, times: 0s, speed: 426.8 KiB/s
done
Bytes transferred = 10488 (28f8 hex)
curVer:V1.4 <= newVer:V1.4,verCompare success!
[0;32mUBOOT_commonSwRsaVerify run successfully!
[0m
## Checking Image at 02000000 ...
Legacy image found
Image Name: partition
Created: 2019-08-08 11:52:32 UTC
Image Type: ARM Linux Standalone Program (uncompressed)
Data Size: 8192 Bytes = 8 KiB
Load Address: 000e0000
Entry Point: 000f0000
Verifying Checksum ... OK
Programing start at: 0x000e0000 for partition
write : 100%
done
crc from program is :bfb829ac, crc from flash is :bfb829ac
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=130M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc.
Using ambarella mac device
Download Filename 'custom-x.squashfs.img'.Downloading: 100%
## file size: 734.2 KiB, times: 0s, speed: 987.3 KiB/s
done
Bytes transferred = 751864 (b78f8 hex)
curVer:V1.4 <= newVer:V1.4,verCompare success!
[0;32mUBOOT_commonSwRsaVerify run successfully!
[0m
## Checking Image at 02000000 ...
Legacy image found
Image Name: custom
Created: 2019-08-08 11:55:46 UTC
Image Type: ARM Linux Standalone Program (uncompressed)
Data Size: 749568 Bytes = 732 KiB
Load Address: 018a0000
Entry Point: 01970000
Verifying Checksum ... OK
Programing start at: 0x018a0000 for custom
SPI probe: 32768 KiB W25Q256FV at 0:1 is now current device
write : 100%
done
crc from program is :9276625c, crc from flash is :9276625c
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=130M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc.
Using ambarella mac device
Download Filename 'pd-x.squashfs.img'.Downloading: 100%
## file size: 82.2 KiB, times: 0s, speed: 733.4 KiB/s
done
Bytes transferred = 84216 (148f8 hex)
curVer:V1.4 <= newVer:V1.4,verCompare success!
[0;32mUBOOT_commonSwRsaVerify run successfully!
[0m
## Checking Image at 02000000 ...
Legacy image found
Image Name: pd
Created: 2019-08-08 11:55:43 UTC
Image Type: ARM Linux Standalone Program (uncompressed)
Data Size: 81920 Bytes = 80 KiB
Load Address: 01880000
Entry Point: 018a0000
Verifying Checksum ... OK
Programing start at: 0x01880000 for pd
SPI probe: 32768 KiB W25Q256FV at 0:1 is now current device
write : 100%
done
crc from program is :98e9a557, crc from flash is :98e9a557
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=130M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc.
Using ambarella mac device
Download Filename '.FLASHING_DONE_STOP_TFTP_NOW'.Downloading: ##
## file size: 0 Bytes, times: 0s, speed: 0 Bytes/s
done
partition file version 2
rootfstype squashfs root /dev/mtdblock5
fail to load bootargsParameters.txt
fail to load bootargsParameters.txt file
cmdLine console=ttyS0,115200 mem=130M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc
*******************************************************
Thanks for your help
ZHCIP
Can someone help me, i have probably a chineese IPC-HDBW4631R-ZS, i tried to update with this FW (DH_IPC-HX5X3X-Rhea_MultiLang_PN_Stream3_V2.800.0000012.0.R.190808.zip)
But it dont let me connect to the web.
Device-Type: IPC-HDBW4631R-ZS
Firmware: 2.460.0000000.16.R, Build Date: 2017-09-04
WEB-Version: 3.2.1.491565
ONVIF Version: 16.12(V2.4.0.485616)
Ping is possible, i also tried with TFTP but without success. here is the log:
*******************************************************
Ncat: Version 7.40 ( Ncat - Netcat for the 21st Century )
Ncat: Listening on 192.168.254.254:5002
gBootLogPtr:00b80008.
spinor flash ID is 0x1940ef
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=130M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc.
TEXT_BASE:01000000
Net: PHY:0x001cc816,addr:0x00
s3l phy RTL8201 init
partition file version 2
rootfstype squashfs root /dev/mtdblock5
MMC: sdmmc init
Using ambarella mac device
Download Filename 'upgrade_info_7db780a713a4.txt'.Downloading: 100%
## file size: 202 Bytes, times: 0s, speed: 24.4 KiB/s
done
Bytes transferred = 202 (ca hex)
Using ambarella mac device
Download Filename 'romfs-x.squashfs.img'.Downloading: 100% 100%
## file size: 2.8 MiB, times: 2s, speed: 1 MiB/s
done
Bytes transferred = 2902264 (2c48f8 hex)
curVer:V1.4 <= newVer:V1.4,verCompare success!
[0;32mUBOOT_commonSwRsaVerify run successfully!
[0m
## Checking Image at 02000000 ...
Legacy image found
Image Name: romfs
Created: 2019-08-08 11:54:00 UTC
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 2899968 Bytes = 2.8 MiB
Load Address: 01b80000
Entry Point: 01fd0000
Verifying Checksum ... OK
Programing start at: 0x01b80000 for romfs
SPI probe: 32768 KiB W25Q256FV at 0:1 is now current device
write : 100%
done
crc from program is :f2749777, crc from flash is :f2749777
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=130M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc.
Using ambarella mac device
Download Filename 'kernel.img'.Downloading: 100%
## file size: 1.5 MiB, times: 1s, speed: 1018.6 KiB/s
done
Bytes transferred = 1575384 (1809d8 hex)
curVer:V1.4 <= newVer:V1.4,verCompare success!
[0;32mUBOOT_commonSwRsaVerify run successfully!
[0m
## Checking Image at 02000000 ...
Legacy image found
Image Name: kernel
Created: 2019-08-08 11:52:32 UTC
Image Type: ARM Linux Firmware (uncompressed)
Data Size: 1573088 Bytes = 1.5 MiB
Load Address: 01040000
Entry Point: 01200000
Verifying Checksum ... OK
Programing start at: 0x01040000 for kernel
SPI probe: 32768 KiB W25Q256FV at 0:1 is now current device
write : 100%
done
crc from program is :67fdba11, crc from flash is :67fdba11
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=130M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc.
Using ambarella mac device
Download Filename 'user-x.squashfs.img'.Downloading: 100%
## file size: 14.8 MiB, times: 14s, speed: 1 MiB/s
done
Bytes transferred = 15554808 (ed58f8 hex)
curVer:V1.4 <= newVer:V1.4,verCompare success!
[0;32mUBOOT_commonSwRsaVerify run successfully!
[0m
## Checking Image at 02000000 ...
Legacy image found
Image Name: user
Created: 2019-08-08 11:53:28 UTC
Image Type: ARM Linux Standalone Program (uncompressed)
Data Size: 15552512 Bytes = 14.8 MiB
Load Address: 000f0000
Entry Point: 01000000
Verifying Checksum ... OK
Programing start at: 0x000f0000 for user
write : 100%
done
crc from program is :ed82b853, crc from flash is :ed82b853
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=130M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc.
Using ambarella mac device
Download Filename 'web-x.squashfs.img'.Downloading: 100%
## file size: 4.8 MiB, times: 4s, speed: 1 MiB/s
done
Bytes transferred = 5064952 (4d48f8 hex)
curVer:V1.4 <= newVer:V1.4,verCompare success!
[0;32mUBOOT_commonSwRsaVerify run successfully!
[0m
## Checking Image at 02000000 ...
Legacy image found
Image Name: web
Created: 2019-08-08 11:53:07 UTC
Image Type: ARM Linux Standalone Program (uncompressed)
Data Size: 5062656 Bytes = 4.8 MiB
Load Address: 01200000
Entry Point: 01880000
Verifying Checksum ... OK
Programing start at: 0x01200000 for web
SPI probe: 32768 KiB W25Q256FV at 0:1 is now current device
write : 100%
done
crc from program is :35944947, crc from flash is :35944947
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=130M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc.
Using ambarella mac device
Download Filename 'partition-x.cramfs.img'.Downloading: 100%
## file size: 10.2 KiB, times: 0s, speed: 426.8 KiB/s
done
Bytes transferred = 10488 (28f8 hex)
curVer:V1.4 <= newVer:V1.4,verCompare success!
[0;32mUBOOT_commonSwRsaVerify run successfully!
[0m
## Checking Image at 02000000 ...
Legacy image found
Image Name: partition
Created: 2019-08-08 11:52:32 UTC
Image Type: ARM Linux Standalone Program (uncompressed)
Data Size: 8192 Bytes = 8 KiB
Load Address: 000e0000
Entry Point: 000f0000
Verifying Checksum ... OK
Programing start at: 0x000e0000 for partition
write : 100%
done
crc from program is :bfb829ac, crc from flash is :bfb829ac
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=130M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc.
Using ambarella mac device
Download Filename 'custom-x.squashfs.img'.Downloading: 100%
## file size: 734.2 KiB, times: 0s, speed: 987.3 KiB/s
done
Bytes transferred = 751864 (b78f8 hex)
curVer:V1.4 <= newVer:V1.4,verCompare success!
[0;32mUBOOT_commonSwRsaVerify run successfully!
[0m
## Checking Image at 02000000 ...
Legacy image found
Image Name: custom
Created: 2019-08-08 11:55:46 UTC
Image Type: ARM Linux Standalone Program (uncompressed)
Data Size: 749568 Bytes = 732 KiB
Load Address: 018a0000
Entry Point: 01970000
Verifying Checksum ... OK
Programing start at: 0x018a0000 for custom
SPI probe: 32768 KiB W25Q256FV at 0:1 is now current device
write : 100%
done
crc from program is :9276625c, crc from flash is :9276625c
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=130M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc.
Using ambarella mac device
Download Filename 'pd-x.squashfs.img'.Downloading: 100%
## file size: 82.2 KiB, times: 0s, speed: 733.4 KiB/s
done
Bytes transferred = 84216 (148f8 hex)
curVer:V1.4 <= newVer:V1.4,verCompare success!
[0;32mUBOOT_commonSwRsaVerify run successfully!
[0m
## Checking Image at 02000000 ...
Legacy image found
Image Name: pd
Created: 2019-08-08 11:55:43 UTC
Image Type: ARM Linux Standalone Program (uncompressed)
Data Size: 81920 Bytes = 80 KiB
Load Address: 01880000
Entry Point: 018a0000
Verifying Checksum ... OK
Programing start at: 0x01880000 for pd
SPI probe: 32768 KiB W25Q256FV at 0:1 is now current device
write : 100%
done
crc from program is :98e9a557, crc from flash is :98e9a557
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=130M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc.
Using ambarella mac device
Download Filename '.FLASHING_DONE_STOP_TFTP_NOW'.Downloading: ##
## file size: 0 Bytes, times: 0s, speed: 0 Bytes/s
done
partition file version 2
rootfstype squashfs root /dev/mtdblock5
fail to load bootargsParameters.txt
fail to load bootargsParameters.txt file
cmdLine console=ttyS0,115200 mem=130M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc
*******************************************************
Thanks for your help
ZHCIP
Hi,
I have bricked my VTO2000. Therefore I want to load with TFTP new FW. In this process I have two problems:
1: Routing with my FritzBox 7490. Question is this correct (192.168.0.62 is my PC) ??
2: TFTP update process:
I downloaded the necessary files. To load the "pd-x..." I update the "commands.txt" to:
Then I run the commands.bat. Execution, no failure
Then I run the TFTPServer.bat. Result: endless loop:
What is my failure???
Stucking, without any idea. I tried it several times
I have bricked my VTO2000. Therefore I want to load with TFTP new FW. In this process I have two problems:
1: Routing with my FritzBox 7490. Question is this correct (192.168.0.62 is my PC) ??
2: TFTP update process:
I downloaded the necessary files. To load the "pd-x..." I update the "commands.txt" to:
run dr
run dk
run du
run dw
run dp
run dc
tftp 0x82000000 pd-x.cramfs.img; flwrite
tftp 0x82000000 .FLASHING_DONE_STOP_TFTP_NOW
sleep 5
Then I run the commands.bat. Execution, no failure
Then I run the TFTPServer.bat. Result: endless loop:
C:\tmp>tftpserver
accepting requests..
Open TFTP Server MultiThreaded Version 1.64 Windows Built 2001
starting TFTP...
alias / is mapped to root\
permitted clients: all
server port range: all
max blksize: 65464
default blksize: 512
default timeout: 60
file read allowed: Yes
file create allowed: No
file overwrite allowed: No
thread pool size: 1
192.168.254.254 Port 69 bind failed
No Static Interface ready, Waiting...
Retrying failed Listening Interfaces..
192.168.254.254 Port 69 bind failed
No Static Interface ready, Waiting...
Retrying failed Listening Interfaces..
192.168.254.254 Port 69 bind failed
No Static Interface ready, Waiting...
Retrying failed Listening Interfaces..
192.168.254.254 Port 69 bind failed
No Static Interface ready, Waiting...
Retrying failed Listening Interfaces..
192.168.254.254 Port 69 bind failed
No Static Interface ready, Waiting...
What is my failure???
Stucking, without any idea. I tried it several times
Last edited:
Hmmmm,
I read the intructions
again and again. Nothing forgotten - I hope. But I fear, that my FritzBox can Route only from the Internet to the local net. Therefore I re-try it with my TP-Link router:
But nothing changes....
To ensure, that I have all necessary file, here the complete content of the folder:
Is anything obvious incorrect?
I read the intructions
again and again. Nothing forgotten - I hope. But I fear, that my FritzBox can Route only from the Internet to the local net. Therefore I re-try it with my TP-Link router:
But nothing changes....
To ensure, that I have all necessary file, here the complete content of the folder:
14.12.2019 19:57 <DIR> .
14.12.2019 19:57 <DIR> ..
14.12.2019 19:57 2.375 all.txt
14.12.2019 13:27 <DIR> bin
22.02.2017 22:23 110 Commands.bat
14.12.2019 17:24 145 commands.txt
22.02.2017 22:46 43 Console.bat
14.12.2019 17:16 <DIR> FW
14.12.2019 18:34 <DIR> root
22.02.2017 22:23 24 TFTPServer.bat
5 Datei(en), 2.697 Bytes
Verzeichnis von c:\tmp\bin
14.12.2019 13:27 <DIR> .
14.12.2019 13:27 <DIR> ..
22.02.2017 15:16 1.265.664 libeay32.dll
22.02.2017 15:16 426.576 ncat.exe
22.02.2017 20:39 86.161 OpenTFTPServerMT.exe
22.02.2017 20:52 123 OpenTFTPServerMT.ini
22.02.2017 15:17 297.472 ssleay32.dll
22.02.2017 22:43 5.364 upgrade_info.c
22.02.2017 22:44 14.848 upgrade_info.exe
22.02.2017 19:53 402 upgrade_info.py
8 Datei(en), 2.096.610 Bytes
Verzeichnis von c:\tmp\FW
14.12.2019 17:16 <DIR> .
14.12.2019 17:16 <DIR> ..
14.12.2019 12:09 116.002.082 General_VTOXXX_Eng_P_16M_V3.120.0000.0.R.20190222.zip
1 Datei(en), 116.002.082 Bytes
Verzeichnis von c:\tmp\root
14.12.2019 18:34 <DIR> .
14.12.2019 18:34 <DIR> ..
23.02.2017 00:16 0 .FLASHING_DONE_STOP_TFTP_NOW
10.06.2017 13:48 12.352 custom-x.cramfs.img
10.06.2017 13:48 204.864 data-x.cramfs.img
11.05.2018 21:26 104.535.457 General_Multi3_VTO2000A_Eng_P_16M_V3.100.0000.0.R.20170401.zip
10.06.2017 13:48 1.771.240 kernel-x.cramfs.img
10.06.2017 13:48 45.120 pd-x.cramfs.img
10.06.2017 13:48 3.108.928 romfs-x.cramfs.img
14.12.2019 18:43 201 upgrade_info_7db780a713a4.txt
10.06.2017 13:48 6.221.888 user-x.cramfs.img
10.06.2017 13:48 1.409.088 web-x.cramfs.img
10 Datei(en), 117.309.138 Bytes
Is anything obvious incorrect?
Hi,
because I was not able to fix the problem with the router / switch, I organised last night a pc2pc LAN cable (same as normal LAN cable, but with twisted Tx and Rx).
Then I changed the IP address of my PC as stated on 1st page.
Then I changed the commands.txt to:
and run the commands.bat. Everything fine up to now.
Then I started TFTPServer and Console (in separate cmds).
After starting the VTO, the TFTPServer starts to transfer the files, but stuck at failed.txt:
O.k., so I created a file with 0 Bytes, but with the name "failed.txt". I redo the procedure. Result:
But then it is stucking. No further progress.
By-the-way: the console was quite silent - the STOP was done after long waiting and cancelling the complete procedure.
But I thing it might be o.k.
After rebooting the VTO
- no constant nameplate LED was on any more
- when pushing the bell, the nameplate LED was on for a second, then off again
- no voice, no sound, no alert
- with VDPconfig the VTO is not visible (hence no upload of the complete FW package is possible)
- with ping the VTO is not reachable:
It seems, that the file "failed.txt" might be the problem. All the FWs, which I have, have no "failed.txt". (4 versions, directly from DAHUA)
I was using the "General_Multi3_VTO2000A_Eng_P_16M_V3.100.0000.0.R.20170401.zip", because this was operating without any problems.
Not all img's were uploaded, which I put in the root phath.
Do somebody has any idea, how to overcome it?
because I was not able to fix the problem with the router / switch, I organised last night a pc2pc LAN cable (same as normal LAN cable, but with twisted Tx and Rx).
Then I changed the IP address of my PC as stated on 1st page.
Then I changed the commands.txt to:
run dr
run dk
run du
run dw
run dp
run dc
tftp 0x82000000 pd-x.cramfs.img; flwrite
tftp 0x82000000 .FLASHING_DONE_STOP_TFTP_NOW
sleep 5
and run the commands.bat. Everything fine up to now.
Then I started TFTPServer and Console (in separate cmds).
After starting the VTO, the TFTPServer starts to transfer the files, but stuck at failed.txt:
O.k., so I created a file with 0 Bytes, but with the name "failed.txt". I redo the procedure. Result:
But then it is stucking. No further progress.
By-the-way: the console was quite silent - the STOP was done after long waiting and cancelling the complete procedure.
But I thing it might be o.k.
After rebooting the VTO
- no constant nameplate LED was on any more
- when pushing the bell, the nameplate LED was on for a second, then off again
- no voice, no sound, no alert
- with VDPconfig the VTO is not visible (hence no upload of the complete FW package is possible)
- with ping the VTO is not reachable:
It seems, that the file "failed.txt" might be the problem. All the FWs, which I have, have no "failed.txt". (4 versions, directly from DAHUA)
I was using the "General_Multi3_VTO2000A_Eng_P_16M_V3.100.0000.0.R.20170401.zip", because this was operating without any problems.
Not all img's were uploaded, which I put in the root phath.
Do somebody has any idea, how to overcome it?
