Dahua IPC EASY unbricking / recovery over TFTP

And that is my faulty start...

Uncompressing Linux........................................................................................................................ done, booting the kernel.

Checking DDR......OK

UBL Version: 1.46t(DM365)10:21:32 Oct 30 2018
Oscillator: 24MHZ
ARM Rate: 432 MHZ
DDR Rate: 340 MHZ
BootMode: SPI
Starting SPI Memory Copy...
DONE


U-Boot 1.3.6 (jerry) (Oct 30 2018 - 10:30:03)

DRAM: 128 MB
SF: Got idcode 01 20 18 03 01
In: serial
Out: serial
Err: serial
Ethernet PHY: GENERIC @ 0x05,id:221513
total gio 2
gio[22]=1
gio[25]=1
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Filename 'upgrade_info_7db780a713a4.txt'.
Load address: 0x80100000
Loading:
Retry count exceeded; starting again
Fail to get info file!
Init error!
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Filename 'failed.txt'.
Load address: 0x80200000
Loading:
Retry count exceeded; starting again
==>use default images
APP_OFFSET_NEW test
.......
## Booting kernel from Legacy Image at 80007fc0 ...
Image Name: Linux-2.6.18_pro500-davinci_evm-
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 1799184 Bytes = 1.7 MB
Load Address: 80008000
Entry Point: 80008000
Verifying Checksum ... OK
XIP Kernel Image ... OK
OK

Starting kernel ...

Uncompressing Linux........................................................................................................................ done, booting the kernel.
 
The problem are that i'm traying to downgrade a firmware but the doorphone is not access the upgrade_info_7db780a713a4.txt.

Thanks.
 
Hi, I would like to report a problem with my Dahua VTO2111D-WP. The device doesn't turn on after successfull firmware update.
What chances do we have to restore the device?
VDP Config doesn't see my device.
 
(edited below - I've self-solved this problem -details inline below for others)
Duvel said:
Well, many thanks to @riogrande75 and @TheDude for their persistance in helping me out here!!

Actually, the last post from @riogrande75 did it. I fetched his suggested 501655_General_Overseas_VTOXXX_Eng_P_16M_SIP_V1.000.00.0.R.20170425.zip file, and modified my comments.txt file like this:

run dc
run dk
run dr
run du
run dw
run dd
tftp 0x82000000 .FLASHING_DONE_STOP_TFTP_NOW
sleep 5

As @riogrande75 mentioned, I omitted pd-x.cramfs.img to be in my root folder as well as in my commands.txt, as he told me it was not working for him neither to get this one flashed.

So this gave me back my old environment, which I was able to access via 192.168.1.110 (so yes, the manual is correct, this is the default IP the device gets).

Once I got my old environment back, I used the new VDCConfig tool to search for the device. It was found instantly, hence I tried to flash it immediately with the newest firmware version: General_VTOXXX_Eng_P_16M_SIP_V4.000.0000000.5.R.20181030

And, well, also this worked well, and showed in turn the newest Webservice 2.0 interface.
This is great news, and good also to see I was able to revive my device.



Wife will be happy. ;-))
LOL.

Again, many thanks for your persistence in helping me out here.
Many kudos to all, and especially @riogrande75 and @TheDude who kept me going.

Have all a nice weekend folks.
Greetings.

Duvel
Click to expand...


Hi Duvel (and others!),
Well done and congratulations! I find myself in a similar predicament, only I have two bricked VTO2111D's (in my brilliance I flashed them both at once rather than seeing if it actually worked first).
I've managed to get a connection to the device (via IP not serial), and it attempts to download/install. I'm wiresharking the connection as well. I've had various levels of success, but none that result in a happily booting device - there is always an error.
Following your instructions below, I now have this error:
upload_2019-2-19_19-42-40.png

Here are the last few lines from wireshark:
upload_2019-2-19_19-45-27.png

Note that I have also tried to just use the single img upload file with the run up command, but it also timeout's similarly to the above.

It seems that you needed to play around with the commands in the txt file to find the right combination. I'm not clear how you worked through the right combination of image file and commands.
Do you have any advice or words of wisdom you'd care to impart please?
Also...did you need press the reset switch after all of the img files successfully installed?
And Finally... what do these timeouts mean? Is it a problem with the TFTP over IP (ie, a network slowdown issue) or a device issue?

(edit below)
So, I fixed this issue myself. It seems the timeout issues were all network related. Even though my PC and camera were connecting and listening, there was clearly something screwy in using my full network to perform this. I followed the original instructions and changed the network adapter settings, but kept all of my original (whole) network in place.
What worked for me, was to follow the option2, and to place just my PC and the VTO2111D onto the same powered switch (and only those two devices). Setup the adapter per the instructions and then both VTO's flashed perfectly, first time.
I flashed them with v1 firmware first, and then use the VDPConfig to perform an upgrade to v3 firmware.
So happy to have not needed to bin a few $'s of device. :) Hope this helps someone else.



Thanks in advance!
Bish
 
Last edited:
  • Like
Reactions: TheDude and mat200
Hello. There are three cameras HFW4233K-AS-LED and two HFW4233F-ZSA with an interface in Chinese only. There are also two HFW4233F-ZSA with cracked firmware with Russian and English interfaces. Question:
1) Is it possible to pull out the firmware from the merged dump of russified cameras for further use (Russification of Chinese cameras by uploading this firmware through the web)?
2) How to edit the serial number and MAC of the camera in the merged dump in order to Russify by uploading the full dump?
Both models belong to the same series, so if it is possible to pull out the firmware, then it will fit both cameras.
 
Hi
I have read through the thread and setup my environment to unbrick / downgrade a VTO-VTH.
I have successfully setup everything.
Run commands.bat to generate the file
run tft.bat

Devices are connected through dahua poe hub and when i plug in the vto/vth I see the tftp server senses it and sends succesfully the img files (extract from std non SIP 3.2 Version)
However it all ends with a failed.txt not found and then no progress anymore
nmap seems to not work (no traffic intercepted).
I have not tried to use wireshark yet.

Again I think communication is there but the process does not end successfully.

Has someone faced that?
Any advice?
Thanks for this post . helping me out of the bricks
 
When running the TFTp.bat i get messag s of successfully sent differenti cramfs.img blabla packets
Then a could not sensi failed.txt and nothing more happens.
NCAP does not report anything (is this ok?)
 
Pls. post what fw version you tried to flash and the whole flash log.
Is the device up after powercycle? Any packets with mac from vto in wireshark after booting?
 
After rebooting the devices (vto vth) are not coming online (vth no screenshot).
However network lights are on-flash.

I have nonother log then the sequence of output from tftp.bat . And that Is saying 'sent x packets...' .

As said ncap script Is silent.

I tried to remove the dp line in Command file as per One of your previous post. No success.

I have set up portable wireshark . What filter shall i use ? Udp on ip 192.168.1.108'? .
i
 
Actually just connect you pc directly to lan port of the device and filter for NOT pc's mac address (e.g. "!eth.addr==xx.xx.xx.xx").

Then you should see almost everything coming from the device.
If you don't see anything after the tftp request from 192.168.1.108 in bootloader, its still not flashed correcty. I suggest to connect to the UART port to see what's really going on. Descrioption here: Dahua IPC unbricking / recovery over serial UART and TFTP
 
15537823256653478175405002692987.jpg 15537823256653478175405002692987.jpg 15537823784893129097276364098606.jpg
This Is the come Window of console and Bat file.
 

Attachments

  • 15537823027766979405680404123044.jpg
    15537823027766979405680404123044.jpg
    1.8 MB · Views: 72
Obviously the tftp did not work out completely.
You are missing data-x.cramfs.img, custom-x.cramfs.img and pd-x.cramds.img.

As long as you don't flash all partitions it will not work stable.
I guess the very common "network problem" did cause this. We discussed this in the thread earlier.
Pls. power the VTO with external 12-24V DC and connect tftp server and VTO to a "good" network switch. A hub and some cheap crap switches did not work for me and caused similar issues.
 
  • Like
Reactions: dvbit
I tried a few routers (proper ones, belkin, tplink, fritz)
Tried also with dahua own poe
Tried with direct power supply over pins
removing the same lines from commands as you did (dp and tfp ...) resulted in success on the tftp screen but then nothing... no access to the vto.

By the way my unpacked pd-x is a cramfs file.
I changed in the commands the squash to cramfs , flashed succesfully (on screen writing at least) but no sucess in reality

I am almost giving up :-(
same story for the vth
 
Did flashing with ALL partitions succeed? If yes, then it should be ok, but you might not know the device's IP after booting => wireshark will show you.
What about the output of the UART? Can you post that?
 
You must log in or register to reply here.
Top Bottom