Dahua IPC EASY unbricking / recovery over TFTP

Discussion in 'Dahua' started by cor35vet, Feb 22, 2017.

Share This Page

  1. Duvel

    Duvel n3wb

    Joined:
    Dec 11, 2018
    Messages:
    20
    Likes Received:
    6
    Location:
    USA
    Hi there,

    Yeah, sure.
    Seems like I am stuck as I don't seem to get any reply from my VTO at all. So I don't even see the 192.168.1.108 address at boot time. Hence, not much happens, so I guess I will have to turn away from this EASY method and go for the SERIAL method.

    What about you? Did it work yet?

    Duvel
     
  2. riogrande75

    riogrande75 Getting the hang of it

    Joined:
    Oct 19, 2017
    Messages:
    123
    Likes Received:
    32
    192.168.1.108 is only active and requesting TFTP downloads a few seconds after poweron.
    If you dont get serial (for monitoring whats going on) just start wireshark on your "server" and filter for tftp - you should see what files are requested and how the server answers immediately after poweron of the VTO.
     
    TheDude likes this.
  3. TheDude

    TheDude Young grasshopper

    Joined:
    Sep 4, 2018
    Messages:
    55
    Likes Received:
    21
    Location:
    USA
    Correct.... the .108 ip will only be active for a few seconds. Unless it finds the TFTP server, gets the file and starts downloading the firmware in which case it will be active for a bit longer.

    One critical element for this easy method is that your neworking must be configured correctly so that packets to 192.168.254.254 are getting your your computer as outlined in the start of the thread.
     
  4. Duvel

    Duvel n3wb

    Joined:
    Dec 11, 2018
    Messages:
    20
    Likes Received:
    6
    Location:
    USA
    Well, so far no success. Tried already with two different DLINK switches, will check with a NETGEAR one later this evening.
    I did indeed follow the instructions on configuring the network stack, so just wondering if the device is still alive and is going to be responsive at all.

    Weird I even don't see a single ping reply, and nothing showing up in WireShark neither. This starts to worry me more and more.

    Would you have any clue on the meaning of the red and green lights on the device? On PoE, the green light blinks, red stays on. On a 12V connection, both stay on. Not sure though what causes this, and what it might mean.

    Duvel
     
  5. Duvel

    Duvel n3wb

    Joined:
    Dec 11, 2018
    Messages:
    20
    Likes Received:
    6
    Location:
    USA
    Hmm, thanks for reminding me about this connector!
    However, with the cable connectors which I got delivered together with my UART CP2102, they are way to thick to connect onto that little device, so I guess I'll first have to find other connecting cables which fit onto that tiny connector first.

    Crap.

    connectors.jpg

    Duvel
     
  6. Duvel

    Duvel n3wb

    Joined:
    Dec 11, 2018
    Messages:
    20
    Likes Received:
    6
    Location:
    USA
    @riogrande75
    @TheDude

    When using the EASY method, just with the update.img file, I have exactly 10 ping replies as a window for the upgrade. As soon as the image.img file gets addressed, the pings stop, and all seems to fail.

    See pic.

    Suggestions?

    10 pings.jpg
     
  7. TheDude

    TheDude Young grasshopper

    Joined:
    Sep 4, 2018
    Messages:
    55
    Likes Received:
    21
    Location:
    USA
    If it accepted the update.img file than it might be installing the firmware. It does take a few minutes to load it all.
     
  8. Duvel

    Duvel n3wb

    Joined:
    Dec 11, 2018
    Messages:
    20
    Likes Received:
    6
    Location:
    USA
    Well, when seeing the failed.txt showing up, it doesn't seem like it was a success, right?

    Also, something I noticed is that I can get an IP address when I connect the whole lot to my PoE switch. When I connect the device to a dedicated switch and power it up with a 12V DC connector rather than over PoE, then I get nothing... Any plausible explanation for that?

    I saw @riogrande75 said a dedicated switch was mandatory, however my recent testing seems to prove the opposite.

    Ideas?
     
    Last edited: Dec 14, 2018
  9. Duvel

    Duvel n3wb

    Joined:
    Dec 11, 2018
    Messages:
    20
    Likes Received:
    6
    Location:
    USA
    At what point would one think of updating the bootloader? As soon as all other options are exhausted?
    I can't seem to get mine unbricked with all advice I read here. I have been trying it over and over again, reading through the many posts already many times, and still no success. <sigh>

    So I am tempted to try the bootloader update.
    Grrrr....
     
  10. alastairstevenson

    alastairstevenson Staff Member

    Joined:
    Oct 28, 2014
    Messages:
    10,265
    Likes Received:
    3,120
    Location:
    Scotland
    As advised, best avoided.

    Maybe see why the tftp upload can't write the failed.txt back.
    Maybe there is useful content. (Disclosure - I don't know if there will be, just guessing).
     
  11. TheDude

    TheDude Young grasshopper

    Joined:
    Sep 4, 2018
    Messages:
    55
    Likes Received:
    21
    Location:
    USA
    Hard telling why it is failing without a serial console connection. You can always try not using the single file update.img method. That would mean update the commands.txt file, run the commands.bat which updates the other file. Then put the appropriate individual firmware img files in the root folder and try it that way.

    The bootloader is working. If the boot loader dies the device is essentially bricked.
     
  12. Duvel

    Duvel n3wb

    Joined:
    Dec 11, 2018
    Messages:
    20
    Likes Received:
    6
    Location:
    USA
    So, after many trial & error situations, I finally managed to get to see this in my TFTP window:

    accepting requests..
    Open TFTP Server MultiThreaded Version 1.64 Windows Built 2001
    starting TFTP...
    alias / is mapped to C:\Dahua_TFTPBackup\root\
    permitted clients: all
    server port range: all
    max blksize: 65464
    default blksize: 512
    default timeout: 60
    file read allowed: Yes
    file create allowed: Yes
    file overwrite allowed: No
    thread pool size: 1
    Listening On: 192.168.254.254:69
    Client 192.168.1.108:3273 C:\Dahua_TFTPBackup\root\upgrade_info_7db780a713a4.txt, 1 Blocks Served
    Client 192.168.1.108:3298 C:\Dahua_TFTPBackup\root\update.img, 8628 Blocks Served
    Client 192.168.1.108:3498 C:\Dahua_TFTPBackup\root\.FLASHING_DONE_STOP_TFTP_NOW, 1 Blocks Served
    Client 192.168.1.108:2362 C:\Dahua_TFTPBackup\root\success.txt, File not found or No Access

    So this seems to be a success.
    However, any further attempt to access the device seems to fail.

    Suggestions? What is the next step?

    Duvel.
     
  13. TheDude

    TheDude Young grasshopper

    Joined:
    Sep 4, 2018
    Messages:
    55
    Likes Received:
    21
    Location:
    USA
    That seems like a normal way for it to finish. Leave the device powered. Once it gets to that point you can exit the dos windows so it does not try to do the same process all over again. Wait for up to 5 minutes as the device will be loading the new firmware and re-starting on its own. After a few minutes it should be back up. I'd try the Config Tool and see if that can find it on your network and go from there.
     
  14. Duvel

    Duvel n3wb

    Joined:
    Dec 11, 2018
    Messages:
    20
    Likes Received:
    6
    Location:
    USA
    Followed you advise, waited for 5' after flashing, however no success. I would at least expect I can ping it on 192.168.1.108, but nothing. Also, the VTO2000A documentation says that the default IP address is 192.168.1.110...

    <Cut>
    3.1 Modify IP Address


    VTO default IP address is 192.168.1.110. Before using VTO, you shall modify VTO IP address to be designated IP address.
    <Cut>

    However, also on this one, no response.

    Perhaps the update.img is not the good one. I tried with one from 13 Jun 2018, however no success. Now trying with one from 30 Oct 2018.

    I read something about English not being compatible with Chinese products. Perhaps that's my issue here.
    What firmware would you recommend? I fetched the most recent one from the Dahua site, however not sure if that is English or Chinese firmware. Guess the former.

    Could anyone provide me links of VTO2000A software which is actually working? @riogrande75

    Thanks (again).

    Duvel
     
  15. TheDude

    TheDude Young grasshopper

    Joined:
    Sep 4, 2018
    Messages:
    55
    Likes Received:
    21
    Location:
    USA
    That I cannot help with..... if it is a China market device than yes a very good possibility English firmware will not work. I have no idea on what might as I do not have one of those. I would assume the Dahua Config Tool, you should have this as it gives quick confirmation if a device is active and what its IP address is, would be able to find it on your network. Once booted some devices, particular if previously configured, may not get the "default" IP address but will instead get whatever one your router gives it via DHCP.
     
  16. riogrande75

    riogrande75 Getting the hang of it

    Joined:
    Oct 19, 2017
    Messages:
    123
    Likes Received:
    32
    Connect pc with running wireshark directly to vto to see what ip the vto uses.
    If webif is still not reachable, you gotta flash all partitions (dc, dd,...) not just update.img.
    Link for actual v4 image can be found in this forum in one of my latest posts.

    Gesendet von meinem SM-T819 mit Tapatalk
     
  17. Duvel

    Duvel n3wb

    Joined:
    Dec 11, 2018
    Messages:
    20
    Likes Received:
    6
    Location:
    USA
    HI @riogrande75

    I fetched the v4 file you referred to in a previous post already (

    The following files are in there:

    When I am connected to my VTO via my VTN PoE switch, I get 192.168.1.108 entries in my Wireshark, and can easily follow the flash process. See the two Wireshark screenshots attached. So it seems all goes well. The last test was again with an update.img alone, where I get to see the success.txt.

    Wireshark.png Wireshark 2.png

    But after that, I cannot go to the next step, which I presume is to connect over a web interface to 192.168.1.108, login and setup the whole thing. It just doesn't work while connected to the PoE switch, as the IP address disappears after a while. And if I am trying to connect with a 12V DC connection, the green light doesn't blink anymore and stays on, not sure what this means, as over the PoE connection it blinks.

    When connecting it to a 12V DC, I am wondering of this is a proper connector. Is the Amp (only 1A) enough actually? Don't know. Could this be the culprit?

    PowerSupply.jpg

    I have tried a zillion combinations and firmware, and I think I am at the point where there is only the give-it-all-up option which remains. I think my VTO is broken, and there is no hope anymore to recover it.

    If you believe I overlooked something, let me know. I am still willing to give it another try, however after 5 days of trial & error, I feel I am done.



    Thanks for all good advice though. It was a pleasure to see you all being that responsive and willing to help!

    Take care!
    Duvel.
     
    dvbit likes this.
  18. TheDude

    TheDude Young grasshopper

    Joined:
    Sep 4, 2018
    Messages:
    55
    Likes Received:
    21
    Location:
    USA
    Did you check that it is on another IP address after it is powered on for a few minutes? It may very well not be on 192.168.1.108. I know that is the default it initializes as when first booting for the flashing processes but after that step the main operating software takes over which will potentially give it a different IP address. Did you try the Dahua Config tool to see if that can find it? That will also tell you what the current IP address is for a Dahua device as well as give you the ability to change its IP address to a static one if you want.

    This is the most current version of the config tool > http://dahuawiki.com/images/Software/ConfigTool/General_ConfigTool_ChnEng_V4.09.0.R.20171010.zip
     
  19. riogrande75

    riogrande75 Getting the hang of it

    Joined:
    Oct 19, 2017
    Messages:
    123
    Likes Received:
    32
    Absolutely Dude!

    And yes, the power supply should be strong enough. Off course you never know from the sticker, if a ps is still good.

    As I mentioned, you got to flash all partitions (I added the real image names after //):
    Code:
    run dc //custom-x.cramfs.img
    run dp //pd-x.cramfs.img
    run dk //kernel-x.cramfs.img
    run dr //romfs-x.cramfs.img
    run du //user-x.cramfs.img
    run dw //web-x.cramfs.img
    run dd //data-x.cramfs.img
    
    
    
    tftp 0x82000000 pd-x.squashfs.img; flwrite
    tftp 0x82000000 .FLASHING_DONE_STOP_TFTP_NOW
    sleep 5
    
    Make sure that all files! get downloaded via TFTP, if not, start over again. I know, this can take a while. At my system, pd-x.cramds could not get flashed, so I guess it is not really neccessary.
    For unbricking I would use an older image without signation (sign.im), this makes it way easier, e.g. this one which is pretty stable: http://ftp.asm.cz/Dahua/kamerove_sy...OXXX_Eng_P_16M_SIP_V1.000.00.0.R.20170425.zip
    Flash all partitions, wait a few mintues, powercycle it and start wireshark. You will see 192.168.1.108 during boot and if it comes up, it will have another IP pretty sure. Just filte on the mac address of the VTO in wireshark (eth.addr==xx....).
    If bootloader is still active it is for sure not bricked.

    If it still does not work, connect UART as mentioned and you should see the bootup messages. If flashing went wrong, you should also see WHY it does not boot up.
     
  20. Duvel

    Duvel n3wb

    Joined:
    Dec 11, 2018
    Messages:
    20
    Likes Received:
    6
    Location:
    USA
    YESSSSSSSSSSSSSSSSSSSSSSSSSSS!!

    I did it. ;-)

    And then you suddenly look at the brand new Web Interface!
    Newest version.jpg
     
    TheDude likes this.