Dahua IPC EASY unbricking / recovery over TFTP

I've tried everything ...
I get him to go back to china but in ntsc, not in pal.

before it was like this:
Device Type IPC-HDW4631C-A
System version 2.460.GP01.16.R, Build Date: 2017-09-04
WEB3.2.1.491565 version
ONVIF version 16.12 (V2.4.0.485616)


After updating, blocked, only ping, I used the ttl and I managed to restore to China, but I cannot get the pal to work, any charity that can give me a class of what firmware I can put back by TTL / 232
 
Just chiming in here to show my appreciation.

I have an amcrest IP8M-T2499E that is brand new. I updated the firmware to the latest Amcrest and then powered it off for a week until installed and it was dead.

Since this has model has no reset switch i would have to RMA at mostly my expense which was not a fun idea given its like 60% the cost of the camera. Took a packet capture and noticed it was trying to connect TFTP at 192.168.254.254, searched for it and led me here.
Followed the instructions at the beginning and bam i now have a functional camera again. Not sure if i power it off for a week again if it will crap out but will wait and see but at least i can make it usable instead of a paper weight.
 
  • Like
Reactions: BGChicago
Just chiming in here to show my appreciation.

I have an amcrest IP8M-T2499E that is brand new. I updated the firmware to the latest Amcrest and then powered it off for a week until installed and it was dead.

Since this has model has no reset switch i would have to RMA at mostly my expense which was not a fun idea given its like 60% the cost of the camera. Took a packet capture and noticed it was trying to connect TFTP at 192.168.254.254, searched for it and led me here.
Followed the instructions at the beginning and bam i now have a functional camera again. Not sure if i power it off for a week again if it will crap out but will wait and see but at least i can make it usable instead of a paper weight.

What firmware did you flash on it?
 
What firmware did you flash on it?

I re-flashed Amcrest_IPC-HX5X3X-Rhea_Eng_NP_Stream3_AMCREST_V2.622.00AC000.0.R.200320.bin just in case i still needed to RMA as i wasnt sure the above would work. (This is what i upgraded it to initially and was working before the powering off)
Once it powered up and was working again i then flashed the Dahua version DH_IPC-HX5X3X-Rhea_MultiLang_NP_Stream3_V2.800.0000013.0.R.191202.bin to match the other cameras.
 
after reading this I get to the conslusion you can't tftp flash a chinese cam to the modded enlish firmware back, right ?
Due to the newer boot loader

Ncat: Version 7.40 ( Ncat - Netcat for the 21st Century )
Ncat: Listening on 192.168.254.254:5002
gBootLogPtr:80b80008.
Check spi flash controller v350... Found
Spi(cs1) ID: 0xC8 0x40 0x18 0xC8 0x40 0x18
Spi(cs1): Block:64KB Chip:16MB Name:"GD25Q128"
partition file version 2
rootfstype squashfs root /dev/mtdblock7
gParameter[0]:node=bootargs, parameter=mem=85M console=ttyS0,115200 root=/dev/mtdblock7 rootfstype=squashfs.
In: serial
Out: serial
Err: serial
TEXT_BASE:81000000
Net: PHY found at 3
ETH0: PHY(phyaddr=-1, rmii) link UP: DUPLEX=FULL : SPEED=100M
Using gmac device
Download Filename 'upgrade_info_7db780a713a4.txt'.Downloading: 100%
## file size: 202 Bytes, times: 0s, speed: 0 Bytes/s
done
Bytes transferred = 202 (ca hex)
ETH0: PHY(phyaddr=-1, rmii) link UP: DUPLEX=FULL : SPEED=100M
Using gmac device
Download Filename 'romfs-x.squashfs.img'.Downloading: 100%
## file size: 888.1 KiB, times: 0s, speed: 1.2 MiB/s
done
Bytes transferred = 909376 (de040 hex)
[ERR0002:]The img header be changed!
cmd Failed run dr!
partition file version 2
rootfstype squashfs root /dev/mtdblock7
fail to load bootargsParameters.txt
fail to load bootargsParameters.txt file
cmdLine mem=85M console=ttyS0,115200 root=/dev/mtdblock7 rootfstype=squashfs
ETH0: PHY(phyaddr=-1, rmii) link UP: DUPLEX=FULL : SPEED=100M
 
Bonjour à tous,

Après avoir planté mon VTO 2111D en prenant un mauvais fichier de mise à jour, je suis tombé sur votre forum.

je suis mauvais en informatique (et en anglais aussi, sorry ;)) et malgré tout après une petite journée de travail, j'ai réussi à redémarrer mon appareil.

Sincèrement merci à tous pour votre message qui ont marqué à ma réussite et surtout une grande reconnaissance à Cor35vet pour son message initial!

Thanks you very much!
 
I have set up my computer with connection to the camera via POE switch. Nothing else on the network except my camera and computer. I have used option 2 in the setup. I am trying to unbrick and IPC-HDW5231R-ZE. I have a copy of the latest firmware and I unzipped it and it has the following img files (see attachment) I downloaded the TFTP folder from page 1 and placed the unzipped filed into the root folder. I did not need to modify the command.txt file because all the files were there.

I then run Command.bat file, followed by the TFTPServer.bat file and lastly the Console.bat file. I then plug in the camera to the switch....

I am running wireshark and I see the following message from the camera which for some reason has an ip of 192.168.1.251 not the default of 192.168.1.108. (I have tried to reset the camera with the internal reset switch but the ip does not change.)

Message on Wireshark:
Who has 192.168.1.1? Tell 192.168.1.251

The message above just repeats and no files are uploaded to the camera...



Any help as to what I need to change/fix would be greatly appreciated.


My Command.txt file:

run dr
un dk
run du
run dw
run dp
run dc
tftp 0x82000000 pd-x.squashfs.img; flwrite
tftp 0x82000000 .FLASHING_DONE_STOP_TFTP_NOW
sleep 5

My TFTP window shows the following:
starting TFTP ...
alias / is mapped to root\
permitted clients: all
server port range: all
max blksize: 65464
defalt blksize: 512
default timeout: 60
file read allowed: yes
file create alllowed: No
file overwrite allowed: No
thred poolsize: 1
Listening On: 192.168.254.254:69

My Console window shows the following:
NCAT version 7.4 (Ncat - Netcat for the 21st Century
Ncat: Listening on 192.168.254.254:5002

My unzipped firmware files in the root folder:
Screen Shot 2020-10-20 at 4.01.55 PM.png
 
Last edited:
ok tried it again after a reset and I got the following.... but the camera still has ip of 192.168.1.251?? No web access or other access?4610F145-2FC7-406D-84D9-43EA55DDB001_1_105_c.jpeg
 
Here is my Console Info... NOT sure why it say rundr, run dk, run du, run dw, run dp and run dc are not supported

gBootLogPtr:00b80008.
spinor flash ID is 0x1940ef
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=116M root=/dev/m
tdblock5 rootfstype=squashfs init=/linuxrc.
TEXT_BASE:01000000
Net: PHY:0x03625cc6,addr:0x01
s3l 55k+bcm54811 init
partition file version 2
rootfstype squashfs root /dev/mtdblock5
MMC: sdmmc init
Using ambarella mac device
Download Filename 'upgrade_info_7db780a713a4.txt'.Downloading: 100%
## file size: 201 Bytes, times: 0s, speed: 21.5 KiB/s
done
Bytes transferred = 201 (c9 hex)
string value is 0
The end of file
cmd: (run dr) is not support!
cmd: (run dk) is not support!
cmd: (run du) is not support!
cmd: (run dw) is not support!
cmd: (run dp) is not support!
cmd: (run dc) is not support!
Using ambarella mac device
Download Filename 'pd-x.squashfs.img'.Downloading: 100%
## file size: 90.2 KiB, times: 0s, speed: 482.4 KiB/s
done
Bytes transferred = 92408 (168f8 hex)
curVer:V1.4 <= newVer:V2.0,verCompare success!
?[0;32mUBOOT_commonSwRsaVerify run successfully!
?[0m
## Checking Image at 02000000 ...
Legacy image found
Image Name: pd
Created: 2020-06-04 18:33:18 UTC
Image Type: ARM Linux Standalone Program (uncompressed)
Data Size: 90112 Bytes = 88 KiB
Load Address: 01880000
Entry Point: 018a0000
Verifying Checksum ... OK
Programing start at: 0x01880000 for pd
SPI probe: 32768 KiB W25Q256FV at 0:1 is now current device
write : 100%
done
crc from program is :0, crc from flash is :0
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=116M root=/dev/m
tdblock5 rootfstype=squashfs init=/linuxrc.
Using ambarella mac device
Download Filename '.FLASHING_DONE_STOP_TFTP_NOW'.Downloading: ##
## file size: 0 Bytes, times: 0s, speed: 0 Bytes/s
done
cmd: (sleep 5) is not support!
partition file version 2
rootfstype squashfs root /dev/mtdblock5
fail to load bootargsParameters.txt
fail to load bootargsParameters.txt file
cmdLine console=ttyS0,115200 mem=116M root=/dev/mtdblock5 rootfstype=squashfs in
it=/linuxrc
 
Last edited:
Hello,
I have a VTO3211D-P which I managed to brick after a firmware update. I read all the posts here and tried the easy solution but unfortunately I can't manage to succeed.
I attach my console log.
Also this is my commands.bat:
run dc
run dd
run dk
run dp
run dr
run du
run dw
tftp 0x82000000 pd-x.squashfs.img; flwrite
tftp 0x82000000 .FLASHING_DONE_STOP_TFTP_NOW
sleep 5

Can anyone have any idea what am I doing wrong?
Thank you very much.
 

Attachments

Greetings, a small contribution for those who serve you:

My VTH5221DW-S2 Unit was bricked, after reading all this thread there was no success. always having the problem [ERR0002:] The img header be changed! in an infinite loop.
What was I doing wrong, trying to install a firmware that does not correspond to it. solution here!

After that the unit came back to life using tftp.

My commands.txt was:

run up
tftp 0x82000000 .FLASHING_DONE_STOP_TFTP_NOW
sleep 5
 
Hello,
I hope somebody can help me.
I have a VTO2000a-2 (Generation 1) that I can't revive after a bad flash.
I have already tried the firmware and commands that have helped colleagues with a similar device, but unfortunately it doesn't work.
The last thing I have tried is to execute command by command, with the General_VTO2000A-2_Eng_P_16M_V3.120.0000.0.
I have connected the VTO directly to the computer; through the router I have also tested it with the same result.
Is there something wrong with it?
Can someone help me?
Attached is the capture of Wireshark and what the TFTP Server tells me
 

Attachments

  • Wireshark.JPG
    Wireshark.JPG
    120.8 KB · Views: 37
  • TFTP.JPG
    TFTP.JPG
    39.7 KB · Views: 37
Show your files & it will be better if you connect to the panel directly to ttl.
 
@iTuneDVR Thank you for prompt reply,
I will now order a USB to TTL and post the result, keep you updated
-------------------------------------------------------------------------------------------------------
Finally I have been able to recover the VTO, with the TTL method.
I have had a curious problem that I have not been able to solve, it was that although everything was running in order, but the VTO did not record the data.
Finally I tried it with another computer and voila, VTO revived.
I suspect some kind of conflict on my network card, but I can't be sure.
I hope this information can help someone
Thank for your support :thumb:
 
Last edited:
I bricked a VTH1550-S2 I am trying despretaly to flash with tftp.
However the device does only accept the romfs-x.img other IMG parts (like kernel, usr) always fail after being pushed. (Tries to load fail.txt)

Did someone successfully unbrick such device?

Tried firmware: DH_VTHX421H_MultiLang_SIP_V4.410.0000000.4.R.20200221 which failed in first place.
Also tried extracted files from BIN: DH_VTHX421H_MultiLang_SIP_V4.401.0000000.4.R.20191206
 
I bricked a VTH1550-S2 I am trying despretaly to flash with tftp.
However the device does only accept the romfs-x.img other IMG parts (like kernel, usr) always fail after being pushed. (Tries to load fail.txt)

Did someone successfully unbrick such device?

Tried firmware: DH_VTHX421H_MultiLang_SIP_V4.410.0000000.4.R.20200221 which failed in first place.
Also tried extracted files from BIN: DH_VTHX421H_MultiLang_SIP_V4.401.0000000.4.R.20191206

I now have console running.

The corect firware should be DH_VTHX421L_*** for this devices.

However all I get on Serial console is:

HELLO! BOOT0 is starting! Nov 16 2018 02:18:28
boot0 version : 4.0.0
boot0 commit : 8
DRAM DRIVE INFO: V0.7
DRAM Type = 3 (2:DDR2,3:DDR3,6:LPDDR2,7:LPDDR3)
DRAM CLK = 672 MHz
DRAM zq value: 000039bb
DRAM size = 128 MB
Succeed in reading Boot1 file head.
Ready to disable icache.
Jump to secend Boot.
[ 0.110]

U-Boot 2011.09-rc1-svn4146 (Aug 18 2019 - 03:11:44) Allwinner Technology

[ 0.119]version: 1.1.0
[ 0.123]uboot commit : 8
[ 0.129]pmbus: ready
[ 0.134]DRAM: OK
env import count 0


then nothing and device hangs.

Device takes img files on TFTP from correct firmware but not all files can be flashed. It refuses to flash uboot.img.bin for instance.
 
I am reporting a success today using Dahua Easy unbricking / recovery over TFTP on a Dahua varifocal DH-IPC-HDW5231R-Z. I know I should have resisted a firmware update, the camera had been working well for 18 months but I thought I'd go for a modest update, there seemed too many issues with V2.800.0000016.0.R.200605, as others have experienced.

From running on V2.622.0000000.31.R.180813 I chose to update to V2.800.0000013.0.R.191202 however, the update stalled at about 95% and the web interface timed out. I was left with a camera that rebooted every 50 seconds. Hardware resetting made no difference, it needed unbricking.

I ran the Easy Tool on an old small XP notebook. On my Ubuntu desktop with the bin firmware files, I used Bless Hex Editor to change DH to PK as Alistair S. has described. Saving the change creates a zip file which when extracted gives all the img files which can be copies to the root directory in the Easy Tool. A double click on Commands.bat reads commands.txt and generates the upgrade so creating the 7db780a713a4.txt in the root directory of the Easy Tool.

I connected a POE switch to make sure my notebook's wired ethernet port was activated (with its IP reconfigured as described), then fired up in Easy Tool's TFTPServer.bat, when the window appeared showing it was waiting I connected my HDW5231R-Z to the POE switch. ...and I could have said all went well and the firmware was updated to V2.800.0000005.0.R.190325.bin, which it eventually was.

I'd had many goes with earlier firmware versions, the unsigned 2017's V2.460.0000.3.R.20170105.bin, no, the 622.0000000.24.R.180403.bin, no, the V2.622.0000000.31.R.180813.bin, no, the V2.640.0000002.0.R.180523.bin, no, V2.800.0000005.0.R.190325.bin, yes.

I think I'll stick with this working firmware, for now!!

I should add a post script. Two days earlier for the reasons above I had to remove this faulty camera and in its place put up another DH-IPC-HDW5231R-Z, not before I'd updated the replacement camera's firmware also to V2.800.0000005.0.R.190325. It all seemed to go well. My Hikvision NVR recognized the replacement camera and local host enabled me to view the RTSP stream using VLC on my PC, so the camera went up onto the wall. I then found BI didn't find the camera, neither could I access the the camera using IE on my W10 BI PC with its dual NIC. All the other of my cameras were reachable. For reasons I can't explain suddently after about 2 hours the replacement camera was suddenly firing up and been recognized, things were back to normal. I have no explanation apart from thinking the DH-IPC-HDW5231R-Z is something of an odd beast.

I wasn't able to run Console.bat, it threw up an error, "ncat.exe is not a W32 application". This might have been real disadvantage as I couldn't input commands like printenv, as it is was I was able to upload some new firmware and my camera now works again. Maybe others can suggest how this might happen, just in case in future I brick another Dahua camera with a firmware update!
 
Last edited:
Hi! Just wanted to share my thanks for this forum and specific instructions provided by @cor35vet, @riogrande75, @TheDude and @Duvel. I am by no means a CCTV expert so the information on this forum was invaluable.

I have a VTO2000A and three VTH1560 (VDPConfig shows them as VTH1510) which I’ve managed to upgrade to the latest SIP firmware. If it helps others, my summary process/details are below.

Problem: with the originally installed firmware, I was not not successful in updating the VTO or VTH using ConfigTool or VDPConfig. In fact, the VTO was not able to be discovered by either of the two programs.

Solution:
  1. First, read this post - twice if you have to - there is a lot of good info here that can help you prepare and get to know your choices/options.
  2. I chose to isolate my network and update one device at a time. I had my laptop directly connected to the POE switch with only one of the VTO or VTHs connected at any one time. I chose to use Option 2 as described by @cor35vet in post #1 of this thread.
  3. With the TFTP server and Console started, the VTO and subsequent VTH connected on power-up without any issues, and installed the firmware from the root directory. My setup for VTO and VTH are provided below.
  4. I used the TFTP process to flash an initial version of the firmware, and then used the VDPConfig tool to upgrade to the latest. That worked for me after a few trial-and-error attempts.

VTO firmware upgrade process:
(1) VTO - commands.txt:
run dc
run dk
run dr
run du
run dw
run dd
tftp 0x82000000 .FLASHING_DONE_STOP_TFTP_NOW
sleep 5

(2) using initial firmware: General_VTO2000A_Eng_P_16M_SIP_V1.000.00.0.T.20170112.bin, extracted the following files from the .bin and put into the root directory:
custom-x.cramfs.img
data-x.cramfs.img
kernel-x.cramfs.img
romfs-x.cramfs.img
upgrade_info_7db780a713a4.txt
user-x.cramfs.img
web-x.cramfs.img

(3) After executing Commands.bat, started the TFTP and Console and plugged in the VTO. Immediate connection was made to TFTP and files were uploaded. Once the process completed, stopped the TFTP and Console and rebooted the VTO.

(4) Used VDPConfig to update to firmware: General_VTOXXX_Eng_P_16M_SIP_V4.300.0000000.1.R.20190305.bin

VTH firmware upgrade process:

(1) VTH - commands.txt:
run dc
run dk
run dr
run du
run dg
run dd
tftp 0x82000000 .FLASHING_DONE_STOP_TFTP_NOW
sleep 5
Note: “dg” is one file which is different and replaces “dw” from the VTO update process

(2) using initial firmware: General_Multi3_VTH1510_Eng_P_V3.100.0000.0.R.20170401.bin, extracted the following files from the .bin and put into the root directory:
custom-x.cramfs.img
data-x.cramfs.img
gui-x.cramfs.img
kernel-x.cramfs.img
romfs-x.cramfs.img
upgrade_info_7db780a713a4.txt
user-x.cramfs.img
Note: “gui-x” is one file which is different and replaces “web-x” from the VTO update process as noted in other posts.

(3) After executing Commands.bat, started the TFTP and Console and plugged in the VTH. Immediate connection was made to TFTP and files were uploaded. Once the process completed, stopped the TFTP and Console and rebooted the VTH.

(4) Used VDPConfig to update to firmware: General_VTH151X_Eng_SIP_V4.300.0000000.8.R.20190316.bin

Once all the devices were upgraded, connected them all on the POE switch together and setup them up with the instructions provided from Dahua and various youtube videos to get the VTO and VTHs all communicating.

Hope this helps others!
 
Anyone with a IPC-HDW5231R-Z , I bricked my cam with the "DH_IPC-HX5X3X-Rhea_MultiLang_NP_Stream3_V2.800.0000016.0.R.200605" firmware, camera went in to a boot loop and would reset every so many seconds, could ping but could not access video or the login page. I tried resetting it and also tried the uart dongle, but I may have been doing that wrong.
Luckily I came across codes that worked for me in the Dahua IPC unbricking / recovery over serial UART and TFTP thread, thanks to radionerd's printenv. The below is my commands.txt , i then ran commands.bat to generate new upgrade_info_7db780a713a4.txt. Even though TFTPserver said it failed.txt, I was finally able to access the cameras login page, I then upgraded it again with the same firmware and it seem to take it this time without boot looping. So far so good. This is what worked for me, I hope it helps someone out or at least leads them in the right direction, just remember to read read read everything in these threads.

commands.txt
Code:
run dr
run dk
run du
run dw
run dp
run dc
tftp 0x02000000 romfs-x.squashfs.img; flwrite
tftp 0x02000000 kernel.img; flwrite
tftp 0x02000000 user-x.squashfs.img; flwrite
tftp 0x02000000 web-x.squashfs.img; flwrite
tftp 0x02000000 partition-x.cramfs.img;flwrite
tftp 0x02000000 custom-x.squashfs.img; flwrite
tftp 0x02000000 update.img; flwrite
tftp 0x82000000 pd-x.squashfs.img; flwrite
tftp 0x82000000 .FLASHING_DONE_STOP_TFTP_NOW
sleep 5
 
Last edited:
  • Like
Reactions: tibimakai and Grn1z
Hi all - I have the Lorex LNB8921, which seems to map to the Dahua N84CB34, and want to update it to the Dahua FW. I have been through the instructions on this site and several of the mods to the commands.txt file, but am stuck. I see the camera boot ok, and it seems to want to start the FW update, but always times out.

here is one of the Commands.txt I tried:
run dr
run dk
run du
run dw
run dp
run dc
tftp 0x02000000 pd-x.squashfs.img; flwrite
tftp 0x82000000 .FLASHING_DONE_STOP_TFTP_NOW
sleep 5

With that, Here is what I see on the TFTP server:

starting TFTP...
alias / is mapped to root\
permitted clients: all
server port range: all
max blksize: 65464
default blksize: 512
default timeout: 60
file read allowed: Yes
file create allowed: No
file overwrite allowed: No
thread pool size: 1
Listening On: 192.168.254.254:69
Client 192.168.1.251:3281 root\upgrade_info_7db780a713a4.txt, 1 Blocks Served
Client 192.168.1.251:3445 root\romfs-x.squashfs.img, Timeout
Client 192.168.1.251:3464 root\failed.txt, 1 Blocks Served

NOTE the "Timeout" above.

Here is what I see in the console:

Ncat: Version 7.40 ( Ncat - Netcat for the 21st Century )
Ncat: Listening on 192.168.254.254:5002
gBootLogPtr:00b80008.
spinor flash ID is 0x1940ef
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=118M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc.
TEXT_BASE:01000000
Net: Detected MACID:00:40:7f:be:23:15
PHY:0x001cc816,addr:0x00
s3l phy RTL8201 init
MMC: sdmmc init
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.251; sending through gateway 192.168.1.1Download Filename 'upgrade_info_7db780a713a4.txt'.Download to address: 0x5000000
Downloading: *
done
Bytes transferred = 501 (1f5 hex)
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.251; sending through gateway 192.168.1.1Download Filename 'romfs-x.squashfs.img'.Download to address: 0x2000000
Downloading: T T T
TFTP error: (0)cmd Failed run dr!
partition file version 2
rootfstype squashfs root /dev/mtdblock5
fail to load bootargsParameters.txt
fail to load bootargsParameters.txt file
cmdLine console=ttyS0,115200 mem=118M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc

NOTE the "Failed run dr!" above,

So I changed the Commands.txt file (removed all the RUN commands & added in the individual file names per one of the posts above that worked for someone else...)

tftp 0x02000000 romfs-x.squashfs.img; flwrite
tftp 0x02000000 kernel.img; flwrite
tftp 0x02000000 user-x.squashfs.img; flwrite
tftp 0x02000000 web-x.squashfs.img; flwrite
tftp 0x02000000 partition-x.cramfs.img;flwrite
tftp 0x02000000 custom-x.squashfs.img; flwrite
tftp 0x02000000 update.img; flwrite
tftp 0x82000000 pd-x.squashfs.img; flwrite
tftp 0x82000000 .FLASHING_DONE_STOP_TFTP_NOW
sleep 5

The output from the TFTP server is the same - here is the console:
gBootLogPtr:00b80008.
spinor flash ID is 0x1940ef
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=118M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc.
TEXT_BASE:01000000
Net: Detected MACID:00:40:7f:be:23:15
PHY:0x001cc816,addr:0x00
s3l phy RTL8201 init
MMC: sdmmc init
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.251; sending through gateway 192.168.1.1Download Filename 'upgrade_info_7db780a713a4.txt'.Download to address: 0x5000000
Downloading: *
done
Bytes transferred = 463 (1cf hex)
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.251; sending through gateway 192.168.1.1Download Filename 'romfs-x.squashfs.img'.Download to address: 0x2000000
Downloading: T T T
TFTP error: (0)
## Checking Image at 02000000 ...
Legacy image found
Image Name: romfs
Created: 2019-12-02 7:54:53 UTC
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 3303608 Bytes = 3.2 MiB
Load Address: 01b80000
Entry Point: 01fd0000
Verifying Checksum ... Bad Data CRC
Bad Image Info
flwrite error 1!
cmd Failed tftp 0x02000000 romfs-x.squashfs.img; flwrite!
partition file version 2
rootfstype squashfs root /dev/mtdblock5
fail to load bootargsParameters.txt
fail to load bootargsParameters.txt file
cmdLine console=ttyS0,115200 mem=118M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc

note the checksum error above - I re-downloaded the file from Dahua (), but got the same error - WinZip does have a screen when I am unzipping it:
1610524300436.png
But I am not sure what that means, and I don't think we are using that file anyway...


I am connecting to the camera using method 1 (adding the route table to my router for 192.168.254.254, redirecting to the IP of my laptop, and adding an additional IP to said laptop). The only other thing that is odd in my setup is that I already have a device on 192.168.1.108 (this is apparently some default for the cameras, though I can't see it trying to connect on that IP in the logs, just on 192.168.1.251 - if I have to, I can take that out temporarily, but didn't think it was an issue at this point. The camera's current IP is 192.168.1.123.


Any help? I appreciate it very much!

-randy