Dahua IPC EASY unbricking / recovery over TFTP

[4aki]

 

[Erik2b1]

I have TFTP finaley working for the Dahua SD22404T-GN but struggelinog to get the right firmware on it.

i have tried the oldest one I could find (was also in a post) and the latest one I could find, but I keeps going in a bootloop. I’m getting success every time but no go.

I think it’s a Chinese version but I don’t know it for sure.

anyone have ideas for what I can trie more? Tried the uart connection but that only fried my uart dongle

thanks!

 

[XrayDoc88]

I have apparently bricked my IPC-T5442T-ZE while doing an uncomplicated firmware update. I used the web interface of the camera (like I have done with 9 other cameras). The update progress bar went to completion and stated "rebooting". Since then I cannot connect to the camera with my assigned static IP. I did a factory reset twice and I can't connect using 192.168.1.108. Will option 2 on page one work in this situation? Should the direct connection to the computer be with a crossover cable? Or since the camera does not seem to be responding to ethernet contact, do I need to use a serial port type connection to the camera? Any help would be appreciated. This recovery is definitely outside my wheelhouse.

 

[XrayDoc88]

Anybody?

 

[EvanVanVan]

I have apparently bricked my IPC-T5442T-ZE while doing an uncomplicated firmware update. I used the web interface of the camera (like I have done with 9 other cameras). The update progress bar went to completion and stated "rebooting". Since then I cannot connect to the camera with my assigned static IP. I did a factory reset twice and I can't connect using 192.168.1.108. Will option 2 on page one work in this situation? Should the direct connection to the computer be with a crossover cable? Or since the camera does not seem to be responding to ethernet contact, do I need to use a serial port type connection to the camera? Any help would be appreciated. This recovery is definitely outside my wheelhouse.

Option 2 will work for you. You can flash the camera remotely while it's installed (without bringing it back to your computer). For safety, unplug your other cameras. Follow the PDF guide setting up the IP addresses on your computer. With your computer already plugged into the switch and the TFTP server running, plug the camera's ethernet into the PoE switch (or plug in the power cable) and the flashing should start automatically. Unplug the camera once you see the flashing done message. Like the guide says, have wireshark running to follow the process and see it try to conect to 192.168.254.254. As long as you don't flash the boot partition (dhboot.bin.img) you really can't hurt anything permanently.

Use these commands for your camera:

tftp 0x82000000 partition-x-bak.cramfs.img; flwrite
tftp 0x82000000 kernel_min.img; flwrite
tftp 0x82000000 romfs_min-x.squashfs.img; flwrite
tftp 0x82000000 kernel.img; flwrite
tftp 0x82000000 partition-x.cramfs.img; flwrite
tftp 0x82000000 romfs-x.squashfs.img; flwrite
tftp 0x82000000 pd-x.squashfs.img; flwrite
tftp 0x82000000 web-x.squashfs.img; flwrite
tftp 0x82000000 firmware-x.squashfs.img; flwrite
tftp 0x82000000 .FLASHING_DONE_STOP_TFTP_NOW
sleep 5

Good luck

 

[XrayDoc88]

Thank you EvanVanVan. I'll post back if I still have questions.

 

[XrayDoc88]

I guess I should ask now. I've never setup and used a TFTP server. Do I copy and paste your whole list of commands at once? Or do I wait for each command to finish before typing in the next command? Thanks again.

 

[EvanVanVan]

I guess I should ask now. I've never setup and used a TFTP server. Do I copy and paste your whole list of commands at once? Or do I wait for each command to finish before typing in the next command? Thanks again.

If you go back a few pages and find the working link for the files (originally from the OP), with the guide it's all pretty clear... You copy the commands into the commands.txt, run a .bat file which creates another .txt file in the folder you'll extract the fw files in. Then it's just launch the tftp server.

 

[Dre868]

Good day all, I am trying to get some advice pertaining to the use of TFTP.

I have a HDW4631C-A, which I am trying to factory reset as I can't recall the initial password on setting it up over 4yrs ago. I tried to flashed it using TFTP but the CMD screen remains on listening...... The camera is presently on a static IP address (10.1.1.22) that is not in the default 192.168.1.108 scheme. Due to my password issue, I cannot enter the web GUI to change th IP of reset.

Can anyone please advise how I can resolve this issue with TFTP. all assistance will be greatly appreciated

Attachments

 

[MrMatt68]

I know this is old but i am having a time trying to follow these instructions to unbrick my dahua ipc-hdw5231rp-ze. some of the links to files are dead but i tried both setting a static route and setting the ip directly to pc card and nether seem to produce any communications with the TFTP server. I see the camera on ip 192.168.1.251 when i plug into my switch but web interface doesn't load at 192.168.1.251 or the 192.168.1.108 that has been mentioned. I have tried both a windows and mac computer and its a no go.

Anyone with experience want to help me get this going. I am willing to send of and pay a small fee as well

 

[truglo]

That seems a bit odd, the 251 address. Maybe the camera firmware is not corrupted but just misconfigured? Have you tried a factory reset using the button (or jumper if button isn't installed)? See the document linked here if you are unsure how:

Dahua camera reset proceedure.

IMPORTANT: For organizational purposes, this original post will include the first two replies - 1) Intro and Dahua Wiki link, 2) specific to IPC-HDW5231R-Z, and 3) specific to IPC_HDW4231EM-AS. Sometimes it is necessary to reset camera back to factory spec which is the factory default. Examples...

ipcamtalk.com

 

[iandrews]

Woke up yesterday to no signal on my IPC-HFW1831C-PIR, a reboot didn't bring it back up, and it just has a solid red led on between what is the white leds on the front.

A bit of investigation shows that all cams on the same switch this one is plugged into all went down / rebooted about the same time. It was raining heavily at the time, and on another cam not connected to that switch there seemed to be a flash (of lightning) about the time this happened. SO suspect that caused this (however everything is on UPS, and as far as I know all my other equipment was ok).

I have tried the reset button on the IPC-HFW1831C-PIR, but no difference.

I have taken the camera down, connected it to a spare (isolated) poe switch, and also plugged a space pc into said switch. Got the Dahua_TFTPBackup.zip file, and extracted files to pc. Also installed Wireshark on pc. Set IP on pc to 192.168.254.254, and disabled Firewall. I can run TFTPServer.bat and Console.bat and it says they are listening on port 69 and 5002, however nothing else ever comes up on them (even when disconnecting and re-connecting the camera network wire to reboot it).

A wireshark scan shows ARP Broadcast messages saying:

who has 192.168.1.1? Tell 192.168.1.251

But nothing else from the camera.

Anyone have any ideas or seen this before. Any chance I can get the cam back, or just cut my losses and get a new one.

Thanks.

It's been a little while since I did mine, and I can't remember fully, but I did finally manage to get mine reflashed / working again via TFTP. From my first try I realised that I was missing an important step. I had to set the ip on my PC to 192.168.254.254 AND 192.168.1.1

Once I did that, the camera made a connection to the PC / TFTP server, and re-flashed.

 

[gbonny]

Is there a mirror of the file Dahua_TFTPBackup.zip? The link doesn't seem to work anymore. Nvm I found it here

https://ipcamtalk.com/attachments/dahua_tftpbackup-zip.157511/

I have a HDW5231R-Z which has some kind of a boot loop. When connected I can ping it shortly (2 or 3 times) after its booted or something and then it takes a minute or so to be able to ping it again shortly.

I cannot load the http interface, it doesn't show up in the configtool v5.0.1. I've tried the reset button, but still cannot connect to it..
The camera was working before, I have no clue what happened. I believe it was running DH_IPC-HX5X3X-Rhea_MultiLang_PN_Stream3_V2.800.0000018.0.R.210707.bin

Update: it wont connect to the tftp server so this doesn't seem to be the fix for my bootloop Dahua?!

 

[Nikolay1200]

Hate Dahua

I got camera from ali. Then i try to update it. Model from from WEB interface:

IPC-HFW3849T1-AS-PV.

I found firmware in dahua for IPC-HFW3849T1-AS-PV and got periodically reboot. Using lan update (big thanks) i tryed IPC-HFW3849T1-AS-PV, IPC-HFW3849T1-AS-PV -S3 .... nothing work

Then i found the box of camera and in box label was DH-IPC-HFW3849T1P-AS-PV. Using google i found interesting pdf with:

DH-IPC-HFW3849T1P-AS-PV-0 280B 2.6.01.05.30676 DH_IPC-HX3XXX-Dalton_MultiLang_PN_Stream3_V2.800.0000000. 9.R.201216.zip

I stopped searching DH-IPC-HFW3849T1 and start with "Dalton" results: Dahua Technology - World-leading Video-centric AIoT Solution and Service Provide

after updating camera start working

 

[Sirhans]

I now have console running.

The corect firware should be DH_VTHX421L_*** for this devices.

However all I get on Serial console is:

HELLO! BOOT0 is starting! Nov 16 2018 02:18:28
boot0 version : 4.0.0
boot0 commit : 8
DRAM DRIVE INFO: V0.7
DRAM Type = 3 (2DR2,3DR3,6:LPDDR2,7:LPDDR3)
DRAM CLK = 672 MHz
DRAM zq value: 000039bb
DRAM size = 128 MB
Succeed in reading Boot1 file head.
Ready to disable icache.
Jump to secend Boot.
[ 0.110]

U-Boot 2011.09-rc1-svn4146 (Aug 18 2019 - 03:11:44) Allwinner Technology

[ 0.119]version: 1.1.0
[ 0.123]uboot commit : 8
[ 0.129]pmbus: ready
[ 0.134]DRAM: OK
env import count 0


then nothing and device hangs.

Device takes img files on TFTP from correct firmware but not all files can be flashed. It refuses to flash uboot.img.bin for instance.

I had the same problem and I managed to unlock the VTH5221dw s2 by adding the environment variables
fileaddr=40007800
filesize=293000
ID="SERIAL VTH"
HWID="SERIAL HW"
the last two I'm not sure if they are necessary

greetings

 

[whatever000]

Just another data point. The model of my camera is IP9144-28. It is a dahua clone. It uses firmware General_IPC-HX4X2X-Themis_Eng_N_Stream3_V2.802.0000006Z.0.R.210907.bin from here. Attached is my command.txt. Note that I need to change the memory from 0x82000000 to 0x0200000 or else it won't work.

 

[kuzco]

It seems I bricked an IPC from Dahua wiht a wrong firmware - so far so bad.
Have now tried to upload an old version via UART and TFTP, but it seems the systems does not allow any longer an upgrade or a downgrade.
I have a successful connection via UART and TFTP, but each "run" commands ends up with an error message: "[ERR0002:]The img header be changed!"

Have compared the BL, and have seen that the old version was:
"U-Boot 2010.06-svn5354 (Jan 31 2018 - 21:02:02)"
now the new has:
U-Boot 2010.06-svn6470 (Dec 11 2018 - 16:27:39)

"run da" with an old version "(U-Boot 2010.06-svn3638 (Dec 09 2016 - 16:05:51)" ends up also with "[ERR0002:]The img header be changed!"

Any hint is welcome.

 

[ali.waqar]

One of the cameras has this double image or what you could call a ghost image. I looked through the settings and played with anything i thought was relevant, but nothing seems to get rid of this doubling of the image. Only one camera has this problem

 

[riogrande75]

@ali.waqar This is for sure the "right" thread for your kind of problem...

 

[alastairstevenson]

One of the cameras has this double image or what you could call a ghost image.

Is the camera looking through a window?