Dahua IPC EASY unbricking / recovery over TFTP

fa355115 said:
Duvel you do not want to do the procedure at the same time as I do using the VTO and computer connected to a switch ?
I will do it in a couple of days when My 2 questions above are answered.
Then we are 2 following the same procedure and will be easier to support each other ?

P.C. I will not use the USB-UART connection ... I think the connection through a switch as explained is better ...
Click to expand...

Hi there,

Yeah, sure.
Seems like I am stuck as I don't seem to get any reply from my VTO at all. So I don't even see the 192.168.1.108 address at boot time. Hence, not much happens, so I guess I will have to turn away from this EASY method and go for the SERIAL method.

What about you? Did it work yet?

Duvel
 
  • Like
Reactions: Cercis
192.168.1.108 is only active and requesting TFTP downloads a few seconds after poweron.
If you dont get serial (for monitoring whats going on) just start wireshark on your "server" and filter for tftp - you should see what files are requested and how the server answers immediately after poweron of the VTO.
 
  • Like
Reactions: TheDude
Correct.... the .108 ip will only be active for a few seconds. Unless it finds the TFTP server, gets the file and starts downloading the firmware in which case it will be active for a bit longer.

One critical element for this easy method is that your neworking must be configured correctly so that packets to 192.168.254.254 are getting your your computer as outlined in the start of the thread.
 
TheDude said:
Correct.... the .108 ip will only be active for a few seconds. Unless it finds the TFTP server, gets the file and starts downloading the firmware in which case it will be active for a bit longer.

One critical element for this easy method is that your neworking must be configured correctly so that packets to 192.168.254.254 are getting your your computer as outlined in the start of the thread.
Click to expand...

Well, so far no success. Tried already with two different DLINK switches, will check with a NETGEAR one later this evening.
I did indeed follow the instructions on configuring the network stack, so just wondering if the device is still alive and is going to be responsive at all.

Weird I even don't see a single ping reply, and nothing showing up in WireShark neither. This starts to worry me more and more.

Would you have any clue on the meaning of the red and green lights on the device? On PoE, the green light blinks, red stays on. On a 12V connection, both stay on. Not sure though what causes this, and what it might mean.

Duvel
 
riogrande75 said:
Check post #61. If you have a USB-UART interface just connect TX and GND from the VTO to RX and GND of your UART device, open putty 115200,8,n,1 and then you should see the boot messages.
Click to expand...

Hmm, thanks for reminding me about this connector!
However, with the cable connectors which I got delivered together with my UART CP2102, they are way to thick to connect onto that little device, so I guess I'll first have to find other connecting cables which fit onto that tiny connector first.

Crap.

connectors.jpg

Duvel
 
@riogrande75
@TheDude

When using the EASY method, just with the update.img file, I have exactly 10 ping replies as a window for the upgrade. As soon as the image.img file gets addressed, the pings stop, and all seems to fail.

See pic.

Suggestions?

10 pings.jpg
 
If it accepted the update.img file than it might be installing the firmware. It does take a few minutes to load it all.
 
TheDude said:
If it accepted the update.img file than it might be installing the firmware. It does take a few minutes to load it all.
Click to expand...

Well, when seeing the failed.txt showing up, it doesn't seem like it was a success, right?

Also, something I noticed is that I can get an IP address when I connect the whole lot to my PoE switch. When I connect the device to a dedicated switch and power it up with a 12V DC connector rather than over PoE, then I get nothing... Any plausible explanation for that?

I saw @riogrande75 said a dedicated switch was mandatory, however my recent testing seems to prove the opposite.

Ideas?
 
Last edited:
riogrande75 said:
Leave the bootloader (dm365_UBL_boot_16M) as it is, you do not need to touch it.
If something fails with that one, you need JTAG ($$$) to recover the VTO again. Then it is "really" bricked.
Click to expand...

At what point would one think of updating the bootloader? As soon as all other options are exhausted?
I can't seem to get mine unbricked with all advice I read here. I have been trying it over and over again, reading through the many posts already many times, and still no success. <sigh>

So I am tempted to try the bootloader update.
Grrrr....
 
Hard telling why it is failing without a serial console connection. You can always try not using the single file update.img method. That would mean update the commands.txt file, run the commands.bat which updates the other file. Then put the appropriate individual firmware img files in the root folder and try it that way.

The bootloader is working. If the boot loader dies the device is essentially bricked.
 
So, after many trial & error situations, I finally managed to get to see this in my TFTP window:

accepting requests..
Open TFTP Server MultiThreaded Version 1.64 Windows Built 2001
starting TFTP...
alias / is mapped to C:\Dahua_TFTPBackup\root\
permitted clients: all
server port range: all
max blksize: 65464
default blksize: 512
default timeout: 60
file read allowed: Yes
file create allowed: Yes
file overwrite allowed: No
thread pool size: 1
Listening On: 192.168.254.254:69
Client 192.168.1.108:3273 C:\Dahua_TFTPBackup\root\upgrade_info_7db780a713a4.txt, 1 Blocks Served
Client 192.168.1.108:3298 C:\Dahua_TFTPBackup\root\update.img, 8628 Blocks Served
Client 192.168.1.108:3498 C:\Dahua_TFTPBackup\root\.FLASHING_DONE_STOP_TFTP_NOW, 1 Blocks Served
Client 192.168.1.108:2362 C:\Dahua_TFTPBackup\root\success.txt, File not found or No Access

So this seems to be a success.
However, any further attempt to access the device seems to fail.

Suggestions? What is the next step?

Duvel.
 
That seems like a normal way for it to finish. Leave the device powered. Once it gets to that point you can exit the dos windows so it does not try to do the same process all over again. Wait for up to 5 minutes as the device will be loading the new firmware and re-starting on its own. After a few minutes it should be back up. I'd try the Config Tool and see if that can find it on your network and go from there.
 
Followed you advise, waited for 5' after flashing, however no success. I would at least expect I can ping it on 192.168.1.108, but nothing. Also, the VTO2000A documentation says that the default IP address is 192.168.1.110...

<Cut>
3.1 Modify IP Address


VTO default IP address is 192.168.1.110. Before using VTO, you shall modify VTO IP address to be designated IP address.
<Cut>

However, also on this one, no response.

Perhaps the update.img is not the good one. I tried with one from 13 Jun 2018, however no success. Now trying with one from 30 Oct 2018.

I read something about English not being compatible with Chinese products. Perhaps that's my issue here.
What firmware would you recommend? I fetched the most recent one from the Dahua site, however not sure if that is English or Chinese firmware. Guess the former.

Could anyone provide me links of VTO2000A software which is actually working? @riogrande75

Thanks (again).

Duvel
 
That I cannot help with..... if it is a China market device than yes a very good possibility English firmware will not work. I have no idea on what might as I do not have one of those. I would assume the Dahua Config Tool, you should have this as it gives quick confirmation if a device is active and what its IP address is, would be able to find it on your network. Once booted some devices, particular if previously configured, may not get the "default" IP address but will instead get whatever one your router gives it via DHCP.
 
Connect pc with running wireshark directly to vto to see what ip the vto uses.
If webif is still not reachable, you gotta flash all partitions (dc, dd,...) not just update.img.
Link for actual v4 image can be found in this forum in one of my latest posts.

Gesendet von meinem SM-T819 mit Tapatalk
 
HI @riogrande75

I fetched the v4 file you referred to in a previous post already (

The following files are in there:
riogrande75 said:
Connect pc with running wireshark directly to vto to see what ip the vto uses.
If webif is still not reachable, you gotta flash all partitions (dc, dd,...) not just update.img.
Link for actual v4 image can be found in this forum in one of my latest posts.

Gesendet von meinem SM-T819 mit Tapatalk
Click to expand...


When I am connected to my VTO via my VTN PoE switch, I get 192.168.1.108 entries in my Wireshark, and can easily follow the flash process. See the two Wireshark screenshots attached. So it seems all goes well. The last test was again with an update.img alone, where I get to see the success.txt.

Wireshark.png Wireshark 2.png

But after that, I cannot go to the next step, which I presume is to connect over a web interface to 192.168.1.108, login and setup the whole thing. It just doesn't work while connected to the PoE switch, as the IP address disappears after a while. And if I am trying to connect with a 12V DC connection, the green light doesn't blink anymore and stays on, not sure what this means, as over the PoE connection it blinks.

When connecting it to a 12V DC, I am wondering of this is a proper connector. Is the Amp (only 1A) enough actually? Don't know. Could this be the culprit?

PowerSupply.jpg

I have tried a zillion combinations and firmware, and I think I am at the point where there is only the give-it-all-up option which remains. I think my VTO is broken, and there is no hope anymore to recover it.

If you believe I overlooked something, let me know. I am still willing to give it another try, however after 5 days of trial & error, I feel I am done.



Thanks for all good advice though. It was a pleasure to see you all being that responsive and willing to help!

Take care!
Duvel.
 
  • Like
Reactions: dvbit
Did you check that it is on another IP address after it is powered on for a few minutes? It may very well not be on 192.168.1.108. I know that is the default it initializes as when first booting for the flashing processes but after that step the main operating software takes over which will potentially give it a different IP address. Did you try the Dahua Config tool to see if that can find it? That will also tell you what the current IP address is for a Dahua device as well as give you the ability to change its IP address to a static one if you want.

This is the most current version of the config tool > http://dahuawiki.com/images/Software/ConfigTool/General_ConfigTool_ChnEng_V4.09.0.R.20171010.zip
 
Absolutely Dude!

And yes, the power supply should be strong enough. Off course you never know from the sticker, if a ps is still good.

As I mentioned, you got to flash all partitions (I added the real image names after //):
Code: 
run dc //custom-x.cramfs.img
run dp //pd-x.cramfs.img
run dk //kernel-x.cramfs.img
run dr //romfs-x.cramfs.img
run du //user-x.cramfs.img
run dw //web-x.cramfs.img
run dd //data-x.cramfs.img
tftp 0x82000000 pd-x.squashfs.img; flwrite
tftp 0x82000000 .FLASHING_DONE_STOP_TFTP_NOW
sleep 5
Make sure that all files! get downloaded via TFTP, if not, start over again. I know, this can take a while. At my system, pd-x.cramds could not get flashed, so I guess it is not really neccessary.
For unbricking I would use an older image without signation (sign.im), this makes it way easier, e.g. this one which is pretty stable: http://ftp.asm.cz/Dahua/kamerove_sy...OXXX_Eng_P_16M_SIP_V1.000.00.0.R.20170425.zip
Flash all partitions, wait a few mintues, powercycle it and start wireshark. You will see 192.168.1.108 during boot and if it comes up, it will have another IP pretty sure. Just filte on the mac address of the VTO in wireshark (eth.addr==xx....).
If bootloader is still active it is for sure not bricked.

If it still does not work, connect UART as mentioned and you should see the bootup messages. If flashing went wrong, you should also see WHY it does not boot up.
 
You must log in or register to reply here.
Top Bottom