Dahua IPC EASY unbricking / recovery over TFTP

Discussion in 'Dahua' started by cor35vet, Feb 22, 2017.

Share This Page

  1. intelcom

    intelcom n3wb

    Joined:
    Oct 12, 2016
    Messages:
    5
    Likes Received:
    0
    And that is my faulty start...

    Uncompressing Linux........................................................................................................................ done, booting the kernel.

    Checking DDR......OK

    UBL Version: 1.46t(DM365)10:21:32 Oct 30 2018
    Oscillator: 24MHZ
    ARM Rate: 432 MHZ
    DDR Rate: 340 MHZ
    BootMode: SPI
    Starting SPI Memory Copy...
    DONE


    U-Boot 1.3.6 (jerry) (Oct 30 2018 - 10:30:03)

    DRAM: 128 MB
    SF: Got idcode 01 20 18 03 01
    In: serial
    Out: serial
    Err: serial
    Ethernet PHY: GENERIC @ 0x05,id:221513
    total gio 2
    gio[22]=1
    gio[25]=1
    TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
    Filename 'upgrade_info_7db780a713a4.txt'.
    Load address: 0x80100000
    Loading:
    Retry count exceeded; starting again
    Fail to get info file!
    Init error!
    TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
    Filename 'failed.txt'.
    Load address: 0x80200000
    Loading:
    Retry count exceeded; starting again
    ==>use default images
    APP_OFFSET_NEW test
    .......
    ## Booting kernel from Legacy Image at 80007fc0 ...
    Image Name: Linux-2.6.18_pro500-davinci_evm-
    Image Type: ARM Linux Kernel Image (uncompressed)
    Data Size: 1799184 Bytes = 1.7 MB
    Load Address: 80008000
    Entry Point: 80008000
    Verifying Checksum ... OK
    XIP Kernel Image ... OK
    OK

    Starting kernel ...

    Uncompressing Linux........................................................................................................................ done, booting the kernel.
     
  2. intelcom

    intelcom n3wb

    Joined:
    Oct 12, 2016
    Messages:
    5
    Likes Received:
    0
  3. alastairstevenson

    alastairstevenson Staff Member

    Joined:
    Oct 28, 2014
    Messages:
    10,265
    Likes Received:
    3,120
    Location:
    Scotland
    What's the actual problem?
    That looks normal enough.
     
  4. intelcom

    intelcom n3wb

    Joined:
    Oct 12, 2016
    Messages:
    5
    Likes Received:
    0
    The problem are that i'm traying to downgrade a firmware but the doorphone is not access the upgrade_info_7db780a713a4.txt.

    Thanks.
     
  5. Felföldi László

    Felföldi László n3wb

    Joined:
    Feb 11, 2019
    Messages:
    1
    Likes Received:
    0
    Location:
    hun
    Hi, I would like to report a problem with my Dahua VTO2111D-WP. The device doesn't turn on after successfull firmware update.
    What chances do we have to restore the device?
    VDP Config doesn't see my device.
     
  6. aussiebish

    aussiebish n3wb

    Joined:
    Feb 12, 2019
    Messages:
    4
    Likes Received:
    2
    Location:
    Australia
    (edited below - I've self-solved this problem -details inline below for others)

    Hi Duvel (and others!),
    Well done and congratulations! I find myself in a similar predicament, only I have two bricked VTO2111D's (in my brilliance I flashed them both at once rather than seeing if it actually worked first).
    I've managed to get a connection to the device (via IP not serial), and it attempts to download/install. I'm wiresharking the connection as well. I've had various levels of success, but none that result in a happily booting device - there is always an error.
    Following your instructions below, I now have this error:
    upload_2019-2-19_19-42-40.png

    Here are the last few lines from wireshark:
    upload_2019-2-19_19-45-27.png

    Note that I have also tried to just use the single img upload file with the run up command, but it also timeout's similarly to the above.

    It seems that you needed to play around with the commands in the txt file to find the right combination. I'm not clear how you worked through the right combination of image file and commands.
    Do you have any advice or words of wisdom you'd care to impart please?
    Also...did you need press the reset switch after all of the img files successfully installed?
    And Finally... what do these timeouts mean? Is it a problem with the TFTP over IP (ie, a network slowdown issue) or a device issue?

    (edit below)
    So, I fixed this issue myself. It seems the timeout issues were all network related. Even though my PC and camera were connecting and listening, there was clearly something screwy in using my full network to perform this. I followed the original instructions and changed the network adapter settings, but kept all of my original (whole) network in place.
    What worked for me, was to follow the option2, and to place just my PC and the VTO2111D onto the same powered switch (and only those two devices). Setup the adapter per the instructions and then both VTO's flashed perfectly, first time.
    I flashed them with v1 firmware first, and then use the VDPConfig to perform an upgrade to v3 firmware.
    So happy to have not needed to bin a few $'s of device. :) Hope this helps someone else.



    Thanks in advance!
    Bish
     
    Last edited: Feb 21, 2019
    TheDude and mat200 like this.
  7. riogrande75

    riogrande75 Getting the hang of it

    Joined:
    Oct 19, 2017
    Messages:
    123
    Likes Received:
    32
    Great aussiebish!
    I remember I mentioned that somewhere, that I was lucky only when using a dedicated switch, too.
     
    aussiebish likes this.
  8. veterinator

    veterinator n3wb

    Joined:
    Sep 12, 2017
    Messages:
    3
    Likes Received:
    0
    Hello. There are three cameras HFW4233K-AS-LED and two HFW4233F-ZSA with an interface in Chinese only. There are also two HFW4233F-ZSA with cracked firmware with Russian and English interfaces. Question:
    1) Is it possible to pull out the firmware from the merged dump of russified cameras for further use (Russification of Chinese cameras by uploading this firmware through the web)?
    2) How to edit the serial number and MAC of the camera in the merged dump in order to Russify by uploading the full dump?
    Both models belong to the same series, so if it is possible to pull out the firmware, then it will fit both cameras.
     
  9. dvbit

    dvbit n3wb

    Joined:
    Feb 24, 2019
    Messages:
    13
    Likes Received:
    0
    Location:
    Italia
    Hi
    I have read through the thread and setup my environment to unbrick / downgrade a VTO-VTH.
    I have successfully setup everything.
    Run commands.bat to generate the file
    run tft.bat

    Devices are connected through dahua poe hub and when i plug in the vto/vth I see the tftp server senses it and sends succesfully the img files (extract from std non SIP 3.2 Version)
    However it all ends with a failed.txt not found and then no progress anymore
    nmap seems to not work (no traffic intercepted).
    I have not tried to use wireshark yet.

    Again I think communication is there but the process does not end successfully.

    Has someone faced that?
    Any advice?
    Thanks for this post . helping me out of the bricks
     
  10. dvbit

    dvbit n3wb

    Joined:
    Feb 24, 2019
    Messages:
    13
    Likes Received:
    0
    Location:
    Italia
    When running the TFTp.bat i get messag s of successfully sent differenti cramfs.img blabla packets
    Then a could not sensi failed.txt and nothing more happens.
    NCAP does not report anything (is this ok?)
     
  11. riogrande75

    riogrande75 Getting the hang of it

    Joined:
    Oct 19, 2017
    Messages:
    123
    Likes Received:
    32
    Pls. post what fw version you tried to flash and the whole flash log.
    Is the device up after powercycle? Any packets with mac from vto in wireshark after booting?
     
  12. dvbit

    dvbit n3wb

    Joined:
    Feb 24, 2019
    Messages:
    13
    Likes Received:
    0
    Location:
    Italia
    After rebooting the devices (vto vth) are not coming online (vth no screenshot).
    However network lights are on-flash.

    I have nonother log then the sequence of output from tftp.bat . And that Is saying 'sent x packets...' .

    As said ncap script Is silent.

    I tried to remove the dp line in Command file as per One of your previous post. No success.

    I have set up portable wireshark . What filter shall i use ? Udp on ip 192.168.1.108'? .
    i
     
  13. riogrande75

    riogrande75 Getting the hang of it

    Joined:
    Oct 19, 2017
    Messages:
    123
    Likes Received:
    32
    Actually just connect you pc directly to lan port of the device and filter for NOT pc's mac address (e.g. "!eth.addr==xx.xx.xx.xx").

    Then you should see almost everything coming from the device.
    If you don't see anything after the tftp request from 192.168.1.108 in bootloader, its still not flashed correcty. I suggest to connect to the UART port to see what's really going on. Descrioption here: Dahua IPC unbricking / recovery over serial UART and TFTP
     
  14. dvbit

    dvbit n3wb

    Joined:
    Feb 24, 2019
    Messages:
    13
    Likes Received:
    0
    Location:
    Italia
    As the vto Is Poe i should Power It as described earlier in this thread? Hope not Guess yes
     
  15. dvbit

    dvbit n3wb

    Joined:
    Feb 24, 2019
    Messages:
    13
    Likes Received:
    0
    Location:
    Italia
  16. dvbit

    dvbit n3wb

    Joined:
    Feb 24, 2019
    Messages:
    13
    Likes Received:
    0
    Location:
    Italia
    Actually the vto responds. The tag Windows lights when i Press the button
     
  17. dvbit

    dvbit n3wb

    Joined:
    Feb 24, 2019
    Messages:
    13
    Likes Received:
    0
    Location:
    Italia
    15537823256653478175405002692987.jpg 15537823256653478175405002692987.jpg 15537823784893129097276364098606.jpg
    This Is the come Window of console and Bat file.
     

    Attached Files:

  18. riogrande75

    riogrande75 Getting the hang of it

    Joined:
    Oct 19, 2017
    Messages:
    123
    Likes Received:
    32
    Obviously the tftp did not work out completely.
    You are missing data-x.cramfs.img, custom-x.cramfs.img and pd-x.cramds.img.

    As long as you don't flash all partitions it will not work stable.
    I guess the very common "network problem" did cause this. We discussed this in the thread earlier.
    Pls. power the VTO with external 12-24V DC and connect tftp server and VTO to a "good" network switch. A hub and some cheap crap switches did not work for me and caused similar issues.
     
    dvbit likes this.
  19. dvbit

    dvbit n3wb

    Joined:
    Feb 24, 2019
    Messages:
    13
    Likes Received:
    0
    Location:
    Italia
    I tried a few routers (proper ones, belkin, tplink, fritz)
    Tried also with dahua own poe
    Tried with direct power supply over pins
    removing the same lines from commands as you did (dp and tfp ...) resulted in success on the tftp screen but then nothing... no access to the vto.

    By the way my unpacked pd-x is a cramfs file.
    I changed in the commands the squash to cramfs , flashed succesfully (on screen writing at least) but no sucess in reality

    I am almost giving up :-(
    same story for the vth
     
  20. riogrande75

    riogrande75 Getting the hang of it

    Joined:
    Oct 19, 2017
    Messages:
    123
    Likes Received:
    32
    Did flashing with ALL partitions succeed? If yes, then it should be ok, but you might not know the device's IP after booting => wireshark will show you.
    What about the output of the UART? Can you post that?