Dahua IPC EASY unbricking / recovery over TFTP

dvbit

n3wb
Joined
Feb 24, 2019
Messages
14
Reaction score
0
Location
Italia
In the attempt I did (removing part of the commands , dp and tftp) It went through
I Will try wireshark
I do not have the USB uart connetted (yet....)
 

katcha

Young grasshopper
Joined
Apr 7, 2019
Messages
34
Reaction score
3
Location
Canada
I have a modded IPC-HDW4433C-A camera which had some issues restarting on its own from the very beginning. I upgraded its firmware to Chinese version (DH_IPC-HX4XXX-Eos_Chn_PN_Stream3_V2.680.0000000.41.R.181212.bin). Since then the camera worked perfectly with my DH-NVR4104.
The problem came after I upgraded my Dahua NVR from official V3.215 to v3.216. Now the DH NVR doesn't recognize the camera anymore. Says "not compatible".
I've attempted to convert the camera back to the English modded version by using the file DH_IPC-HX4XXX-Eos_EngFraSpaRus_PN_Stream3_V2.420.0000.22.R.20161209.bin from the beginning of this tread. It failed.
Then I used TFTP by following the instructions from this tread. The process of sending files to camera fails after sending the fist img.


Error.jpg
Am I doing anything wrong?
Or, do I need to try to make different bin file?
Anybody? Please help advising with the step to convert the EOS camera to English version.

Update2:
I used the Mod Tool to extract the original DH_IPC-HX4XXX-Eos_Chn_PN_Stream3_V2.680.0000000.41.R.181212.bin file and -re-build it without doing any changes. Even after that it failed to download the "re-built" firmware using TFTP.
It seems that the firmware signature - is what causing the problem.
Any ideas on how to overcome the signature issue?
 
Last edited:

ericleel

n3wb
Joined
Apr 7, 2019
Messages
5
Reaction score
0
Location
HK
I use TFTP method to upload firmware ,but errors received as following.




1.How should I fix the problem.
2.where can I find the UBOOT_commonSwRsaVerify function body.

Device model :IPC-HDW4631C-A
System version:v2.800.0000005.0.R

Thx a lot
 
Last edited:

katcha

Young grasshopper
Joined
Apr 7, 2019
Messages
34
Reaction score
3
Location
Canada
I have a modded IPC-HDW4433C-A camera which had some issues restarting on its own from the very beginning. ........

Am I doing anything wrong?
Or, do I need to try to make different bin file?
Anybody? Please help advising with the step to convert the EOS camera to English version.
/QUOTE]
Update2:
I used the Mod Tool to extract the original DH_IPC-HX4XXX-Eos_Chn_PN_Stream3_V2.680.0000000.41.R.181212.bin file and -re-build it without doing any changes. Even after that it failed to download the "re-built" firmware using TFTP.
It seems that the firmware signature - is what causing the problem.
Any ideas on how to overcome the signature issue?
 

ericleel

n3wb
Joined
Apr 7, 2019
Messages
5
Reaction score
0
Location
HK
The method to overcome the signature may be founded by analyzing the UBOOT_commonSwRsaVerify function.
 

katcha

Young grasshopper
Joined
Apr 7, 2019
Messages
34
Reaction score
3
Location
Canada
I guess since my camera and NVR are both have signed firmware-I'm stuck. No help here.
I can't downgrade neither camera nor NVR. TFTP method won't work.:smash:
The serial method doesn't work either. Getting only gibberish.
upload_2019-4-25_21-5-37.png
Seems that I need to scrap this Chinese camera. :)
 

riogrande75

Pulling my weight
Joined
Oct 19, 2017
Messages
390
Reaction score
140
Location
AUSTRIA
No. You either have not connected to the correct uart pins or you have wrong settings in putty (baudrate,etc.).
But looking on that, you are not too far away.
 

katcha

Young grasshopper
Joined
Apr 7, 2019
Messages
34
Reaction score
3
Location
Canada
I tried different serial adapters: one FTDI USB to RS232, second PCMCIA. Also tried different boudrates.
Probably neither adaptet was suitable. I will try to buy a new one which was listed at the beginning of the tread.
Thanks a lot.
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,930
Reaction score
6,778
Location
Scotland
I tried different serial adapters: one FTDI USB to RS232
That may have damaged the serial TTL interface on the camera.
An RS232 interface operates at + and - 3V-15V with a current limit of around 45mA.
That's plenty to damage a serial TTL interface from the camera board.
 

katcha

Young grasshopper
Joined
Apr 7, 2019
Messages
34
Reaction score
3
Location
Canada
The serial interface is still OK.
I switched from PC to RPi. Now I don't see gibberish anymore. However when trying to send files over TFTP I'm getting the following message after sending completion: " ER0002:The IMG header be changed!"
upload_2019-4-26_22-52-42.png
Any ideas?
Thank you.
 
Last edited:

ericleel

n3wb
Joined
Apr 7, 2019
Messages
5
Reaction score
0
Location
HK
The serial interface is still OK.
I switched from PC to RPi. Now I don't see gibberish anymore. However when trying to send files over TFTP I'm getting the following message after sending completion: " ER0002:The IMG header be changed!"
View attachment 41859
Any ideas?
Thank you.
Try to reverse the bootloader file and analysis the algorithm in the UBOOT_commonSwRsaVerify function.
 

katcha

Young grasshopper
Joined
Apr 7, 2019
Messages
34
Reaction score
3
Location
Canada
Try to reverse the bootloader file and analysis the algorithm in the UBOOT_commonSwRsaVerify function.
How to reverse the bootloader?
I have found this "UBOOT_commonSwRsaVerify" function. Or at least was able to see this name when the camera booted.
I'm not sure what analysis I should be able to make?
Version 1.4 is the minimum one allowed to be loaded?
upload_2019-4-27_17-5-27.png
 
Last edited:

katcha

Young grasshopper
Joined
Apr 7, 2019
Messages
34
Reaction score
3
Location
Canada
You need USB to UART (serial 3.3v levels). RS232 is wrong!
Now I have established connection between UART device (RPi) and the Camera. But I can't update (downgrade) the Chinese firmware back to English. Is that it? With the new signed firmware there would be no way to apply changes?
 
Top