Dahua IPC EASY unbricking / recovery over TFTP

tibimakai

Known around here
Joined
May 8, 2017
Messages
1,005
Reaction score
513
Location
Los Angeles
rrands1 I have installed it, but there is no change.
How the Console should show, when you click on it? What it suppose to do?
If I run it with administrator rights, the image blinks for a second, but at least that error does not show up.
Cawauk, I have the same issue, I don't understand the whole process what exactly I have to do.
Thanks to you, at least I know now, which files I have to remove. Another step forward.
 

rrands1

n3wb
Joined
Oct 16, 2020
Messages
19
Reaction score
8
Location
Mesa, az
rrands1 I have installed it, but there is no change.
How the Console should show, when you click on it? What it suppose to do?
If I run it with administrator rights, the image blinks for a second, but at least that error does not show up.
Cawauk, I have the same issue, I don't understand the whole process what exactly I have to do.
Thanks to you, at least I know now, which files I have to remove. Another step forward.
I am not sure I am following you - at the top you say "no change", but then you say below that "that error does not show up" - I thought your main issue was the 'MSVCR120.dll was not found' error - have you gotten past that?
 

cawauk

n3wb
Joined
Feb 3, 2021
Messages
3
Reaction score
1
Location
UK
rrands1 I have installed it, but there is no change.
How the Console should show, when you click on it? What it suppose to do?
If I run it with administrator rights, the image blinks for a second, but at least that error does not show up.
Cawauk, I have the same issue, I don't understand the whole process what exactly I have to do.
Thanks to you, at least I know now, which files I have to remove. Another step forward.
Here's exactly what I did, which might help (whilst it's still fresh in my mind):

Prepare files:
1. Download the zip file from Step 2 (https://i.botox.bz/Dahua_TFTPBackup.zip)
2. Unzip the files to C:\Temp such that I have in C:\Temp the files, bin folder and root folder (i.e. without the Dahua_TFTPBackup folder)
3. Download amcrest firmware from Amcrest wesbite. For my IP2M-841 it was: Amcrest_IPC-AWXX_Eng_N_AMCREST_V2.420.AC00.18.R.20200217.bin
4. Make a copy of the file and rename it to .zip
5. Open the zip file
5. Copy all the .img files in the zip to C:\Temp\root (install for some reason won't unzip, it gave me an error, but it can be ignored)
6. Remove dhboot.bin.img and dhboot-min.bin.img from C:\Temp\root

Prepare instructions:
1. Open this forum's page to follow instructions (as computer was going to be without internet)

Prepare network
1. I followed Step 1 Option 2 in the instructions (I can do option 1 with my router, but wanted to be sure nothing was on the network so opted for option 2). This meant, only Computer and Camera plugged into a Switch (not router) with nothing else. Note: make sure you add the two IP addresses in the network configuration.
camera is unpowered at this stage
2. Typed "CMD" in windows search, right clicked run as administrator
3. Typed "cd c:\temp" in CMD
4. Typed "Commands.bat" in CMD (nothing happens, comes back to c:\temp)
5. Typed "TFTPServer.bat" in CMD which loads up and waits for camera to connect
6. Typed "CMD" in windows search again, right clicked run as administrator
7. Typed "cd c:\temp" in CMD
8. Typed "Console.bat" in CMD which loads up and waits for the camera log files (note: nothing ever happened here because of the loop problem I had with the TFTPServer)

With both CMD windows open and listening
1. Plugged in my camera to power supply
2. Activity starts showing up in the two CMD windows
3. I can't remember when, but at one point, Windows firewall appeared for the CMD scripts. Both times, I checked the tickboxes allow 'public' and 'private' access. This didn't seem to cause any interference with the activity going on with the CMD windows.

This is what I saw on my screen (took a screenshot for my record, luckily I did and can now share!):

amcrest save crop.png

As you can see on the left, the firmware upgrade wasn't particularly smooth:
1. It was looping (I never saw the message FLASHING_DONE_STOP_TFTP_NOW)
2. pd-x.squashfs.img was timing out during every loop

With wireshark open and filtered on my camera's IP address, I waited until I saw the network "Read Request, File: upgrade_info_7db780a713a4.txt" (the first instruction during a TFTP request) to immediately close TFTPServer (top right cmd x).
The camera then rebooted itself shorly after and the PTZ finally came to life!
I waited a minute then checked Amcrest's IP Tool and it was now detecting the camera.

Final steps
1. I logged into the camera via Amcrest's IP tool (not the web - in case the TFTP update didn't work fully due to the issues I had)
2. Updated the camera with the same firmware (original .bin file I had downloaded from Amcrest "Amcrest_IPC-AWXX_Eng_N_AMCREST_V2.420.AC00.18.R.20200217.bin")
3. Firmware update was successful and the camera now works perfectly.

I cannot thank cor35vet enough as Amcrest support told me nothing could be done and a RMA could not be processed as the camera was out of warranty.

I hope my experience with these steps might help others.

My exact camera model is IP2M-841W-UK
 

tibimakai

Known around here
Joined
May 8, 2017
Messages
1,005
Reaction score
513
Location
Los Angeles
Thank you for all that. I have a Dahua camera, though. But the steps will help out a lot, I'm at work right now.
I will look at these, when I will be home.
 

cawauk

n3wb
Joined
Feb 3, 2021
Messages
3
Reaction score
1
Location
UK
Thank you for all that. I have a Dahua camera, though. But the steps will help out a lot, I'm at work right now.
I will look at these, when I will be home.
My Amcrest is a branded Dahua camera, which is how I ended up on this forum for Dahua cameras. The steps worked, so hopefully you'll get your IP camera up and running again! Note: whilst I quote Amcrest's IP Config Tool to reflash, it's effectively identical to Dahua's Config Tool.
 

tibimakai

Known around here
Joined
May 8, 2017
Messages
1,005
Reaction score
513
Location
Los Angeles
I'm trying, but nothing works for me. Can't fined any files, and console won't open, it shows a ncat.exe error a few times.
It seems like, somebody has to hold my hand, and go with me step by step.
The IP addresses I have to use the ones in the pictures?
Usually, I'm good at following steps like this, but this one, is way to complicated.
I have a feeling, that first of all, I have to deal with this MSVCR120.dll error.
 

tibimakai

Known around here
Joined
May 8, 2017
Messages
1,005
Reaction score
513
Location
Los Angeles
When you say "copy all the .img files in the zip" you refer to the "Disc Image files"? That is all the content, right?
I have to create a Temp folder in the C drive? There is no Temp folder right now. Also, I don't understand from where do I have that root file?
The root folder is from the Dahua TFTPBackup.zip folder?
 

antibill

n3wb
Joined
Feb 8, 2021
Messages
1
Reaction score
0
Location
France
Hi. My Dahua VTO2111D-WP is bricked...

TFTP said that :

accepting requests..
Open TFTP Server MultiThreaded Version 1.64 Windows Built 2001

starting TFTP...
alias / is mapped to root\
permitted clients: all
server port range: all
max blksize: 65464
default blksize: 512
default timeout: 60
file read allowed: Yes
file create allowed: No
file overwrite allowed: No
thread pool size: 1
Listening On: 192.168.254.254:69
Client 192.168.1.108:3136 root\failed.txt, File not found or No Access


and in console i can do nothing...



Checking DDR......OK

UBL Version: 1.46t(DM365)18:02:25 Jun 15 2016
Oscillator: 24MHZ
ARM Rate: 432 MHZ
DDR Rate: 340 MHZ
BootMode: SPI
Starting SPI Memory Copy...
DONE


U-Boot 1.3.6 (jerry) (Jun 15 2016 - 18:12:41)

DRAM: 128 MB
SF: Got idcode c2 20 18 c2 20
In: serial
Out: serial
Err: serial
Ethernet PHY: GENERIC @ 0x01,id:1cc816
total gio 2
gio[22]=1
gio[25]=1
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Filename 'upgrade_info_7db780a713a4.txt'.
Load address: 0x80100000
Loading: *
Retry count exceeded; starting again
Fail to get info file!
Init error!
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Filename 'failed.txt'.
Load address: 0x80200000
Loading: *
Retry count exceeded; starting again
==>use default images
.......
## Booting kernel from Legacy Image at 80007fc0 ...
Image Name: Linux-2.6.18_pro500-davinci_evm-
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 1771460 Bytes = 1.7 MB
Load Address: 80008000
Entry Point: 80008000
Verifying Checksum ... OK
XIP Kernel Image ... OK
OK

Starting kernel ...

Uncompressing Linux...................................................................................................................... done, booting the kernel.

Date&Time: Sep 18 2017 08:44:37
Revision: 32273
Enter 'help' for a list of commands (dsh)

#help

Support Commands:

shell help getDateInfo
diagnose gethwid

P Image Type: ARM Linux Kernel Image (uncompressed)for displaying Qrcode
Data Size: 1771460 Bytes = 1.7 MB
Load Address:
80008000
Entry Point: 80008000
Verifying Checksum ... OK
XIP Kernel Image ... OK
OK



Can you help me please?

Thanks.


EDIT : It's OK for me, I missed to press "*" key at startup.

Thanks a lot, all is working for me :)
 
Last edited:

snowidun

n3wb
Joined
Feb 3, 2020
Messages
9
Reaction score
1
Location
Malaysia
Hi all, need some help pleaseeee

I bricked my chinese nvr by upgrading using global firmware ...now it just shows "Illegal firmware" after finish loading

my nvr model is DH4216-16p-HDS2
I upgraded using web interface to DH_NVR4XXX-4KS2_MultiLang_V4.001.0000005.1.R.201126

so I downloaded the firmware new chinese firmware DH_NVR4XXX-4KS2_Chn_V4.001.0000006.1.R.201126.bin
extracted using 7zip, changed header, placed into root folder
custom-x.squashfs.img
Install.lua
logo-x.squashfs.img
romfs-x.squashfs.img
sign.img
u-boot.bin.img
uImage.img
web-x.squashfs.img

edited commands.bat by replacing to ID_3K05B9EPAZ26155.txt (obtained from wireshark)
commands.txt default

ran commands.bat and generated ID_3K05B9EPAZ26155.txt in root with following
-------
CRC:4050037456
MagicString:c016dcd6-cdeb-45df-9fd0-e821bf0e1e62
run dr
run dk
run du
run dw
run dp
run dc
tftp 0x82000000 pd-x.squashfs.img; flwrite
tftp 0x82000000 .FLASHING_DONE_STOP_TFTP_NOW
sleep 5
-------
and then ran TFTP server and console.bat

TFTP as follow:
accepting requests..
Open TFTP Server MultiThreaded Version 1.64 Windows Built 2001

starting TFTP...
alias / is mapped to root\
permitted clients: all
server port range: all
max blksize: 65464
default blksize: 512
default timeout: 60
file read allowed: Yes
file create allowed: No
file overwrite allowed: No
thread pool size: 1
Listening On: 192.168.254.254:69
Client 192.168.1.108:1935 root\ID_3K05B9EPAZ26155.txt, 1 Blocks Served
Client 192.168.1.108:2113 root\failed.txt, 1 Blocks Served

(I created empty failed.txt because it was just requesting for failed.txt after few tries)

console.bat is just listening and no response
Ncat: Version 7.40 ( Ncat - Netcat for the 21st Century )
Ncat: Listening on 192.168.254.254:5002
=================================


Am I missing something here cause it seems it read the ID_3K05B9EPAZ26155.txt and it fail to do anything

is it because firmware v4.0 tftp is not usable anymore?
 

tibimakai

Known around here
Joined
May 8, 2017
Messages
1,005
Reaction score
513
Location
Los Angeles
I'm having issues getting that install file, when I'm unzipping it(tried Winrar as well). When it finally shows up, it is 0 kb file(type is File). What has to contain that file?
Also in the command file, what worked for others?
I have a HDBW4231F-AS(wedge camera)
 

myk3le

n3wb
Joined
Dec 4, 2019
Messages
25
Reaction score
7
Location
italy
I'm having issues getting that install file, when I'm unzipping it(tried Winrar as well). When it finally shows up, it is 0 kb file(type is File). What has to contain that file?
Also in the command file, what worked for others?
I have a HDBW4231F-AS(wedge camera)
yes I know you have to find a way to extract correctly the install file. under Mac OS you can rename the .bin file in .zip and extract this using The Unarchiver.
Tru the same procedure on windows using The Unarchiver for windows
 

myk3le

n3wb
Joined
Dec 4, 2019
Messages
25
Reaction score
7
Location
italy
{
"Commands" : [
"burn dhboot-min.bin.img bootloader",
"burn dhboot.bin.img bootloader",
"burn kernel.img kernel",
"burn partition-x.cramfs.img partition",
"burn romfs-x.squashfs.img rootfs",
"burn pd-x.squashfs.img pd",
"burn user-x.squashfs.img user",
"burn custom-x.squashfs.img custom",
"burn web-x.squashfs.img web",
"burn user1-x.squashfs.img user1"
],
"Devices" : [
[ "SD6XXX", "1.00" ],
[ "IPC-HX3XXX", "1.00" ],
[ "IPC-HX4XXX", "1.00" ],
[ "IPC-HX5XXX", "1.00" ],
[ "IPC-HX8XXX", "1.00" ]
],
"Vendor" : "General"
}
/IPC_RestoreDefault
 

myk3le

n3wb
Joined
Dec 4, 2019
Messages
25
Reaction score
7
Location
italy
@tibimakai probably this is your command.txt

tftp 0x82000000 dhboot-min.bin.img; flwrite
tftp 0x82000000 dhboot.bin.img; flwrite
tftp 0x82000000 kernel.img; flwrite
tftp 0x82000000 partition-x.cramfs.img; flwrite
tftp 0x82000000 romfs-x.squashfs.img; flwrite
tftp 0x82000000 pd-x.squashfs.img; flwrite
tftp 0x82000000 user-x.squashfs.img; flwrite
tftp 0x82000000 custom-x.squashfs.img; flwrite
tftp 0x82000000 web-x.squashfs.img; flwrite
tftp 0x82000000 user1-x.squashfs.img; flwrite
tftp 0x82000000 .FLASHING_DONE_STOP_TFTP_NOW
sleep 5
 

tibimakai

Known around here
Joined
May 8, 2017
Messages
1,005
Reaction score
513
Location
Los Angeles
Thanks, I will give it a shot, but I think that I have tried that already. Somebody earlier mentioned that he has to change the 0x082000000, to 0x02000000. I have tried both ways. It works when I do the CMD, but something is still missing, because the camera is still rebooting.
I understand, that I don't have to use(I have to remove) the dhboot-min.bin and dhboot.bin from that folder.
I will try with The Unarchiver.
Also, Wordpad from Windows should do the trick, or this WordpadMFC is special version of the Wordpad?
 

myk3le

n3wb
Joined
Dec 4, 2019
Messages
25
Reaction score
7
Location
italy
Post screenshot did you receive succes.txt?
I think that wordpad is ok. On xp i have wordpadmfc by default.
Why you have to remove dhboot-min.bin? Try all my commands in the same sequence i have posted.
 

tibimakai

Known around here
Joined
May 8, 2017
Messages
1,005
Reaction score
513
Location
Los Angeles
That is what I have read earlier, that you don't have to reload the bootloader part of the firmware. The success.txt showed up, but with error at the end.
 
Top