Dahua IPC unbricking / recovery over serial UART and TFTP

[erdilmen]

nvt@na51090: setenv serverpip 192.168.31.141
serverpip=192.168.31.141
nvt@na51090: setenv ipaddr 192.168.31.201
ipaddr=192.168.31.201
nvt@na51090: setenv gateway 192.168.31.1
gateway=192.168.31.1
nvt@na51090: printenv
Unknown command 'printenv' - try 'help'
nvt@na51090: print env
Unknown command 'print' - try 'help'
nvt@na51090: saveenv
Saving Environment to NAND... Erasing NAND...
Erasing at 0x320000 -- 100% complete.
Writing to NAND... OK
Erasing at 0x340000 -- 100% complete.
Erasing at 0x3c0000 -- 100% complete.
OK
nvt@na51090: run da
Using eth0 device
TFTP from server 192.168.31.141; our IP address is 192.168.31.201
Filename 'u-boot.bin.img'.
timeout_count up to 10
Load address: 0x7800000
Loading: T T T T T T T T T T
Retry count exceeded; starting again
connect frondboard!

 

[iTuneDVR]

ping 192.168.31.1

192.168.31.141 is your PC?

 

[erdilmen]

my pc ands server ip 192.168.31.141
default gateway is 192.168.31.1
im defining xvr as 192.168.31.201
xvr connected router via cable
laptop connected same router via wifi

 

[Erik2b1]

I have a SD22404T-GN that is not accessible. With wireshark i see that it's advertising on the network but the easy Tftp solution is not working.

I have ordered a usb ttl dongle so i can try the uart solution.

1 part of the instructions is not clear for me.
do i need to connect all pins to the camera? so VCC, GND, TX, RX or only RX and TX?

 

[alastairstevenson]

do i need to connect all pins to the camera? so VCC, GND, TX, RX or only RX and TX?

Connect RX, TX, GND.
Don't connect VCC.

 

[Erik2b1]

Thanks, Will do that.

As soon as the adapter is in i will give it a go again (no luck with a RPi, but that could be a linux noob thing ;-) )

 

[qubit]

Please help,
three SD22404T-GN cameras suddenly stopped working, looks like they stuck in boot loop.
I connected CP210X dongle and tried to restore firmware, but it does not allow me to stop the autoboot and im not able to type anything.
any suggestions. tnx

Spoiler: Log

U-Boot 2010.06-svn5213 (Apr 04 2018 - 09:21:28)
I2C: ready
DRAM: 198 MiB
gBootLogPtr:00b80008.
NAND: 128 MiB
amb_nand_read_oob read page:49152 err
partition file version 2
rootfstype squashfs root /dev/mtdblock8
fail to load bootargsParametersV22.txt
fail to load bootargsParametersV21.txt
fail to init bootargsParametersV2
TEXT_BASE:01000000
Net: Detected MACID:38:af:29:35:8c:33
PHY:0x001cc816,addr:0x00
s3l phy RTL8201 init

partition file version 2
rootfstype squashfs root /dev/mtdblock8
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending throu gh gateway 192.168.1.1
Download Filename 'upgrade_info_7db780a713a4.txt'.
Download to address: 0x5000000
Downloading: *
Retry count exceeded; starting again
SD Product try auto upgrade times.
SD try times:1
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending throu gh gateway 192.168.1.1
Download Filename 'upgrade_info_7db780a713a4.txt'.
Download to address: 0x5000000
Downloading: *
Retry count exceeded; starting again
string value is 0
AUF_getValidLine, the end of file
Failed to get a Line;Crc check error!
PreProcess data error!
Init error!
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending throu gh gateway 192.168.1.1
Download Filename 'failed.txt'.
Download to address: 0x2000000
Downloading: *
Retry count exceeded; starting again
Support backupVer:255
state:ff,err_count:04

NAND read: device 0 offset 0x60000, size 0x00010000
65536 bytes read: OK
## Booting kernel from Legacy Image at 02000000 ...
Image Name: Linux-3.10.73
Created: 2018-04-04 0:27:13 UTC
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 1636644 Bytes = 1.6 MiB
Load Address: 00208000
Entry Point: 00208000
Verifying Checksum ... OK
Loading Kernel Image ...OK
OK
partition file version 2
rootfstype squashfs root /dev/mtdblock8
fail to load bootargsParameters.txt
fail to load bootargsParameters.txt file
get bootargs info failed
cmdLine console=ttyS0,115200 mem=150M root=/dev/mtdblock8 rootfstype=squashfs in it=/linuxrc
crashflasg:1, logmagic:54410011.

Starting kernel ...

backupbst magic err

managed to flash it with UART USB , its not rebooting any more and im able to access the web interface now.

firmware used : DH_SD-Mao-Rhea_Eng_P_Stream3_IVS_V2.622.0000000.7.R.180404.bin

this error still present in PuTTY, but camera is working

Spoiler

fail to load bootargsParameters.txt
fail to load bootargsParameters.txt file
get bootargs info failed
cmdLine console=ttyS0,115200 mem=150M root=/dev/mtdblock8 rootfstype=squashfs in it=/linuxrc
crashflasg:1, logmagic:54410011.

Starting kernel ...

backupbst magic err

 

[boxy]

U-Boot 2010.06-svn2134 (May 26 2014 - 16:15:03)
DRAM: 256 MiB
Check spi flash controller v350... Found
Spi(cs1) ID: 0xEF 0x40 0x18 0x00 0x00 0x00
reset/hold pin now is RESET
Spi(cs1): Block:64KB Chip:16MB Name:"W25Q128B"
boot from spi
partition file version 2
rootfstype squashfs root /dev/mtdblock7
In: serial
Out: serial
Err: serial
TEXT_BASE:81000000
Hisilicon ETH net controler
MAC: 14-07-08-09-81-F5
UP_PORT : phy status change : LINK=UP : DUPLEX=FULL : SPEED=100M
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending throu gh gateway 192.168.1.1
Download Filename 'upgrade_info_7db780a713a4.txt'.
Download to address: 0x84000000
Downloading: *
Retry count exceeded; starting again
Fail to get info file!
Init error!
Hisilicon ETH net controler
miiphy_register: non unique device name '0:1'
miiphy_register: non unique device name '0:2'
MAC: 14-07-08-09-81-F5
UP_PORT : phy status change : LINK=DOWN : DUPLEX=FULL : SPEED=100M
UP_PORT : phy status change : LINK=UP : DUPLEX=FULL : SPEED=100M
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'failed.txt'.
Download to address: 0x82000000
Downloading: *
Retry count exceeded; starting again
SPI probe: 16384 KiB hi_sfc at 0:0 is now current device
## Booting kernel from Legacy Image at 82000000 ...
Image Name: Linux-3.0.8
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 1337924 Bytes = 1.3 MiB
Load Address: 80008000
Entry Point: 80008000
Loading Kernel Image ...OK
OK
partition file version 2
rootfstype squashfs root /dev/mtdblock7
cmdLine mem=85M console=ttyS0,115200 root=/dev/mtdblock7 rootfstype=squashfs
crashflasg:1, logmagic:54410011.

Starting kernel ...
Uncompressing Linux... done, booting the kernel.


U-Boot 2010.06-svn2134 (May 26 2014 - 16:15:03)
DRAM: 256 MiB
Check spi flash controller v350... Found
Spi(cs1) ID: 0xEF 0x40 0x18 0x00 0x00 0x00
reset/hold pin now is RESET
Spi(cs1): Block:64KB Chip:16MB Name:"W25Q128B"
boot from spi
partition file version 2
rootfstype squashfs root /dev/mtdblock7
In: serial
Out: serial
Err: serial
TEXT_BASE:81000000
Hisilicon ETH net controler
MAC: 14-07-08-09-81-F5
UP_PORT : phy status change : LINK=DOWN : DUPLEX=FULL : SPEED=100M
UP_PORT : phy status change : LINK=UP : DUPLEX=FULL : SPEED=100M
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'upgrade_info_7db780a713a4.txt'.
Download to address: 0x84000000
Downloading: #################################################
done
Bytes transferred = 202 (ca hex)
Hisilicon ETH net controler
miiphy_register: non unique device name '0:1'
miiphy_register: non unique device name '0:2'
MAC: 14-07-08-09-81-F5
UP_PORT : phy status change : LINK=DOWN : DUPLEX=FULL : SPEED=100M
UP_PORT : phy status change : LINK=UP : DUPLEX=FULL : SPEED=100M
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'romfs-x.squashfs.img'.
Download to address: 0x82000000
Downloading: #################################################
done
Bytes transferred = 737344 (b4040 hex)

## Checking Image at 82000000 ...
Legacy image found
Image Name: romfs
Image Type: ARM Linux Standalone Program (gzip compressed)
Data Size: 737280 Bytes = 720 KiB
Load Address: 00500000
Entry Point: 006a0000
Verifying Checksum ... OK
Programing start at: 0x00500000
SPI probe: 16384 KiB hi_sfc at 0:0 is now current device
write : 100%
done


The camera does this again and again.

i took the eeprom out and flashed it with a programmer out of good camera still its doing this loop

 

[CChr]

I've done a Firmware Update to my
Dahua IPC-HUM8230P
I don't know if I took the the right firmware I'm not sure,

Since I've updatet I coudn't do any changes in the configuration.
The Cam does a reboot then.
It does also a reboot every 5 to 10 minutes.
So far I've confiigures a serial connection with a ft232rl usb to seriel conector and aftr many tries I got a connection.
I changed ip address and run a tftp server and could load files down but I got this message

>run dr
Using ambarella mac device
Download Filename 'romfs-x.squashfs.img'.
Downloading: #################################################################
         #################################################################
         #################################################################
         ###############################################################
  ## file size: 0 Bytes,        times: 3s,      speed: 358.4 KiB/s
done
Bytes transferred = 1310784 (140040 hex)
[ERR0002:]The img header be changed!

I've googeled the message and found this:
Dahua IPC EASY unbricking / recovery over TFTP
I think the problem is that the new firmware installed a new bootloader that doesn't allow firmwaredowngrades.
Please tell me how do I et the older firmware to my cam

To anyone that get the error message "[ERR0002:]The img header be changed!" the problem is that you have to flash first the kernel.img otherwise the camera will ignore anything you put in the commands.txt

Here is my commands.txt for the IPC-HDBW5231E-Z

"tftp 0x82000000 kernel.img; flwrite tftp 0x82000000 romfs-x.squashfs.img; flwrite tftp 0x82000000 web-x.squashfs.img; flwrite tftp 0x82000000 .FLASHING_DONE_STOP_TFTP_NOW sleep 5"
the latest files you need are inside the fw zip file with name DH_IPC-HX5X3X-Rhea_MultiLang_PN_Stream3_V2.800.0000029.0.R.221220.zip

 

[timoxa]

good day! I have a dh-ipc-hdw2231 camera.
I connected to it but I can't download the firmware. the commands described at the beginning are not suitable, and the output of "printenv" has a different appearance

SigmaStar # printenv
printenv
baudrate=115200
bootargs=mem=130840K console=ttyS0,115200 LX_MEM=0x7fc6000 mma_heap=mma_heap_name0,miu=0,sz=0x4000000 rootfstype=ramfs mtdparts=nand0:1536K(boot),512K(tech),5120K(kernel),16384K(app),-(config) hw_type=2011
bootcmd=nand read 0x22000000 0x200000 0x500000; bootm 0x22000000; setenv bootargs $(bootargs) bkp=1; nand read 0x22000000 0x700000 0x500000; bootm 0x22000000
bootdelay=0
ethact=sstar_emac
ethaddr=00:30:1b:ba:02:db
gatewayip=192.168.2.1
ipaddr=192.168.2.2
netmask=255.255.255.0
preboot=gpio output 12 1;gpio output 13 1;gpio output 52 0;gpio output 6 1;gpio output 7 1;gpio output 6 0; ; fwupdate mmc 0:1 firmware.bin --enable-legacy-fw --with-props
serverip=192.168.2.1
stderr=serial
stdin=serial
stdout=serial
usb_folder=images

Environment size: 782/131068 bytes
SigmaStar #
baudrate=115200
bootargs=mem=130840K console=ttyS0,115200 LX_MEM=0x7fc6000 mma_heap=mma_heap_name0,miu=0,sz=0x4000000 rootfstype=ramfs mtdparts=nand0:1536K(boot),512K(tech),5120K(kernel),16384K(app),-(config) hw_type=2011
bootcmd=nand read 0x22000000 0x200000 0x500000; bootm 0x22000000; setenv bootargs $(bootargs) bkp=1; nand read 0x22000000 0x700000 0x500000; bootm 0x22000000
bootdelay=0
ethact=sstar_emac
ethaddr=00:30:1b:ba:02:db
gatewayip=192.168.2.1
ipaddr=192.168.2.2
netmask=255.255.255.0
preboot=gpio output 12 1;gpio output 13 1;gpio output 52 0;gpio output 6 1;gpio output 7 1;gpio output 6 0; ; fwupdate mmc 0:1 firmware.bin --enable-legacy-fw --with-props
serverip=192.168.2.1
stderr=serial
stdin=serial
stdout=serial
usb_folder=images

SigmaStar # version
version

U-Boot 2015.01 (May 25 2021 - 15:27:57)
arm-linux-gnueabihf-gcc (GNU Toolchain for the A-profile Architecture 8.2-2018-08 (arm-rel-8.23)) 8.2.1 20180802
GNU ld (GNU Toolchain for the A-profile Architecture 8.2-2018-08 (arm-rel-8.23)) 2.30.0.20180625
SigmaStar #

U-Boot 2015.01 (May 25 2021 - 15:27:57)
arm-linux-gnueabihf-gcc (GNU Toolchain for the A-profile Architecture 8.2-2018-08 (arm-rel-8.23)) 8.2.1 20180802
GNU ld (GNU Toolchain for the A-profile Architecture 8.2-2018-08 (arm-rel-8.23)) 2.30.0.20180625
SigmaStar #

 

[javierfer]

Hello everyone, maybe someone could shed some light on my problem. I have a Dahua SD49225T-HN-S2 PTZ camera that stopped working from one day to the next, has entered a reboot loop and has returned to the factory IP 192.168.1.108 Unfortunately I can't fix it through TFTP It keeps rebooting and the connection cannot be established. I want to find the UART port of the camera but I can't find it. I've only found these single pins that seem to be the UART port but I can't get them to connect since nothing appears on the monitor when the power is connected to the camera Is there a way to activate the UART port?

 

[javierfer]

on usb adapter i conected tx with rx (on camera), rx on usb adapter with tx(on camera) gnd usb to gnd camera, vcc 3.3v usb to vcc 3.3v on camera.
Once you conected all that ( before there is two white conector 4(whires) to disable ptz check on camera boot (so it doesn`t start spinning and disabling your conection usb to camera)..
I will post later those pictures where those conectors are...

when you disconect pin to disable ptz movement conect rx,tx,gnd,vcc3.3v to usb adapter, open putty baud rate 115200, flow control to none. Putty window will open and then conect the camera to power supply - turn it on...

you will se uboot loader then press and hold * (on keyboard)....

All of this is fine for me, but there is no network connection from camera to my computer...i conected camera directly to my computer or switch. There is always a same problem no conection...

Should i connect camera with poe+ network switch and hope there will be a network conection on my computer

I have a Dahua SD49225T-HN ptz camera that stopped working overnight. I want to find the UART port and I see in your photographs that it is similar to the pins on your camera, but when I connect the ubs-ttl to it, nothing appears on it. monitor. My question is, what voltages do the Rx and TX pins of your camera have?

 

[VdjHouse]

I have a SD1A203T-GN that went unresponsive and is stuck in the boot cycle. I have set up the tftp server and the camera will connect to it and it seems like the files transfer and flash? I tried with the multiple commands with no success.


tftp 0x2000000 romfs-x.squashfs.img; flwrite
tftp 0x2000000 kernel.img; flwrite
tftp 0x2000000 user-x.squashfs.img; flwrite
tftp 0x2000000 web-x.squashfs.img; flwrite
tftp 0x2000000 pd-x.squashfs.img; flwrite
tftp 0x2000000 custom-x.squashfs.img; flwrite
tftp 0x2000000 partition-x.cramfs.img; flwrite
tftp 0x2000000 .FLASHING_DONE_STOP_TFTP_NOW


I also tried with the run up command since one of the firmware's had the update.img file.



I think the camera was on version DH_SD-Mao-Rhea_MultiLang_PN_Stream3_IVS_V2.800.0000000.4.R.191105

I have attached the output from the console any help would be greatly appreciated.

Spoiler: Console Output

Ncat: Version 7.40 ( Ncat - Netcat for the 21st Century )
Ncat: Listening on 192.168.254.254:5002
gBootLogPtr:00b80008.
NAND: 128 MiB
amb_nand_read_oob read page:49152 err
partition file version 2
rootfstype squashfs root /dev/mtdblock8
fail to load bootargsParametersV22.txt
fail to load bootargsParametersV21.txt
fail to init bootargsParametersV2
TEXT_BASE:01000000
Net: PHY:0x001cc816,addr:0x00
s3l phy RTL8201 init
partition file version 2
rootfstype squashfs root /dev/mtdblock8
Using ambarella mac device
Download Filename 'upgrade_info_7db780a713a4.txt'.Downloading: 100%
## file size: 78 Bytes, times: 0s, speed: 10.7 KiB/s
done
Bytes transferred = 78 (4e hex)
Using ambarella mac device
Download Filename 'update.img'.Downloading: ICMP Host Redirect to 192.168.1.29 ICMP Host Redirect to 192.168.1.29 100%

## file size: 28.4 MiB, times: 41s, speed: 701.2 KiB/s
done
Bytes transferred = 29770253 (1c6420d hex)
←[0;32mskip check secure Image!
←[0mErasing update flag partition.
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8

## Checking Image at 02000040 ...
Legacy image found
Image Name: romfs
Created: 2021-07-05 12:17:56 UTC
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 1458176 Bytes = 1.4 MiB
Load Address: 01200000
Entry Point: 01600000
Verifying Checksum ... OK
Programing start at: 0x01200000 for romfs
write : 100%
done
crc from program is :9aec38f4, crc from flash is :9aec38f4

## Checking Image at 02164080 ...
Legacy image found
Image Name: user
Created: 2021-07-05 12:18:19 UTC
Image Type: ARM Linux Standalone Program (uncompressed)
Data Size: 19464192 Bytes = 18.6 MiB
Load Address: 01e00000
Entry Point: 03a80000
Verifying Checksum ... OK
Programing start at: 0x01e00000 for user
write : 100%
done
crc from program is :562712ad, crc from flash is :562712ad

## Checking Image at 033f40c0 ...
Legacy image found
Image Name: web
Created: 2021-07-05 12:18:00 UTC
Image Type: ARM Linux Standalone Program (uncompressed)
Data Size: 5799936 Bytes = 5.5 MiB
Load Address: 01600000
Entry Point: 01e00000
Verifying Checksum ... OK
Programing start at: 0x01600000 for web
write : 100%
done
crc from program is :6e52a74f, crc from flash is :6e52a74f

## Checking Image at 0397c100 ...
Legacy image found
Image Name: pd
Created: 2021-07-05 12:18:34 UTC
Image Type: ARM Linux Standalone Program (uncompressed)
Data Size: 65536 Bytes = 64 KiB
Load Address: 00940000
Entry Point: 00c80000
Verifying Checksum ... OK
Programing start at: 0x00940000 for pd
write : 100%
done
crc from program is :74c6d22a, crc from flash is :74c6d22a

## Checking Image at 0398c140 ...
Legacy image found
Image Name: custom
Created: 2021-07-05 12:18:37 UTC
Image Type: ARM Linux Standalone Program (uncompressed)
Data Size: 1249280 Bytes = 1.2 MiB
Load Address: 00600000
Entry Point: 00940000
Verifying Checksum ... OK
Programing start at: 0x00600000 for custom
write : 100%
done
crc from program is :b8f86cd4, crc from flash is :b8f86cd4

## Checking Image at 03abd180 ...
Legacy image found
Image Name: partition
Created: 2021-07-05 12:17:54 UTC
Image Type: ARM Linux Standalone Program (uncompressed)
Data Size: 4096 Bytes = 4 KiB
Load Address: 00500000
Entry Point: 00600000
Verifying Checksum ... OK
Programing start at: 0x00500000 for partition
write : 100%
done
crc from program is :edc1d69a, crc from flash is :edc1d69a

## Checking Image at 03abe1c0 ...
Legacy image found
Image Name: kernel
Created: 2021-07-05 12:17:54 UTC
Image Type: ARM Linux Firmware (uncompressed)
Data Size: 1725328 Bytes = 1.6 MiB
Load Address: 00c80000
Entry Point: 01200000
Verifying Checksum ... OK
Programing start at: 0x00c80000 for kernel
write : 100%
done
crc from program is :5771ec83, crc from flash is :5771ec83

## Checking Image at 03c63590 ...
Legacy image found
Image Name: CmdScript
Created: 2021-07-05 12:18:39 UTC
Image Type: ARM Linux Standalone Program (uncompressed)
Data Size: 901 Bytes = 901 Bytes
Load Address: c0000000
Entry Point: c0001400
Verifying Checksum ... OK
exce update config script start!
set da 'tftp 0x2000000 dhboot.bin.img; flwrite; tftp dhboot-min.bin.img;nand protect off;flwrite;nand protect on'
set dr 'tftp 0x2000000 romfs-x.squashfs.img; flwrite'
set dk 'tftp 0x2000000 kernel.img; flwrite'
set du 'tftp 0x2000000 user-x.squashfs.img; flwrite'
set dw 'tftp 0x2000000 web-x.squashfs.img; flwrite'
set ds 'tftp 0x2000000 dsp-x.squashfs.img; flwrite'
set dc 'tftp 0x2000000 custom-x.squashfs.img; flwrite'
set dt 'tftp 0x2000000 data-x.squashfs.img; flwrite'
set df 'tftp 0x2000000 fpga.img; flwrite'
set up 'tftp 0x2000000 update.img; flwrite'
set tk 'tftp 0x200100 hawthorn.dts.dtb;tftp 0x2000000 uImage;bootm 0x2000000'
set bootcmd 'nand read 0x200100 0x60000 0x10000;kload 0x2000000; bootm 0x2000000'
setenv bootargs "console=ttyS0,115200 mem=150M root=/dev/mtdblock8 rootfstype=squashfs init=/linuxrc"
save
Saving Environment to NAND...
Erasing Nand...
Erasing at 0x360000 -- 100% complete.
Writing to Nand...
backupbst magic err
done
exce update config script complete!
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
fail to load bootargsParametersV22.txt
fail to load bootargsParametersV21.txt
WARNING: Fail to update bootargs!!!
partition file version 2
rootfstype squashfs root /dev/mtdblock8
fail to load bootargsParameters.txt
fail to load bootargsParameters.txt file
get bootargs info failed
cmdLine console=ttyS0,115200 mem=150M root=/dev/mtdblock8 rootfstype=squashfs init=/linuxrc