If it is responding to the network, I would suggest going the TFTP route, the arp for 192.168.1.1 is indicative of it looking for the gateway to contact 192.168.254.254. You can run most of the serial commands though the TFTP load file and view the output in the console, and while it doesn't give a live command prompt it would be a good indication of what is wrong, even with a serial connection you likely will need a TFTP server up and running anyways to reflash.I'm trying to recover a DH-TPC-SD8620N-B50Z30. It's an expensive camera, so I've been going slow. I have a USB to TTL (CP2102 STC) adapter and I made a cable to connect GND, RX, and TX to what I believe to be the UART port. Now, I have 4 similar ports in the vicinity so I'm not sure if I'm hitting the right one. I can get 1-2 characters of garbage but not the boot verbosity as previously mentioned.
I probed the ports and found VCC and GND, and swapped TX/RD multiple times on the UART port. I don't think it's totally dead since it does a PTZ sweep when it boots and if I sniff the network interface it's on its default IP of 192.168.1.108. It responds to ping, telnet, and SSH. I do not have login credentials. Attached is a picture of the port. I added 12" pigtails (before I took this pic) so it can rotate without chewing or shorting my USB TTL converter.
What're all the ports for? Anything else I can be doing? Input appreciated!
Yep, you're absolutely correct. I setup TFTP and I can see it requesting the upgrade_info file:If it is responding to the network, I would suggest going the TFTP route, the arp for 192.168.1.1 is indicative of it looking for the gateway to contact 192.168.254.254. You can run most of the serial commands though the TFTP load file and view the output in the console, and while it doesn't give a live command prompt it would be a good indication of what is wrong, even with a serial connection you likely will need a TFTP server up and running anyways to reflash.
01:35:59.654381 IP 192.168.1.108.netopia-vo3 > 192.168.254.254.tftp: 69 RRQ "upgrade_info_7db780a713a4.txt" octet timeout 1 tsize 0 blksize 1468
I didn't find the batch file in the TFTP download but I did try the one from Dahua IPC EASY unbricking / recovery over TFTP which includes a Python version which is what I'm using. Originally I was using Linux but I switched to Windows 10 to use the Hikvision TFTP tool you linked me to. I played around and realized my error is CRLF in upgrade_info text file, going back to Linux I'm able to TFTP update dr, dk, du, dw, and dc. However, my original symptom remains: only port 22 is open.By console I mean the console (Ncat) that is included in the TFTP (Click the link or check page one of this thread) package on this site, it reads the output from from the camera over the network during the tftp and displays the results.
It also has the batch file needed to generate the proper upgrade_info file by running commands.bat
Based on the other thread you should be able to do a TFTP recovery by installing the firmware again over TFTP, but you can also try using telnet since that seems to be open to you, with telnet you need to add "7ujMko0" (without the quotes) before the password you used example:
>printenv bootargs=console=ttyS0,115200 mem=118M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc bootcmd=sf read 0x2000000 0x1040000 0x1c0000;bootm 0x2000000 bootdelay=3 baudrate=115200 ethaddr=00:12:34:56:78:9A ipaddr=192.168.1.108 serverip=192.168.1.1 autoload=yes gatewayip=192.168.1.1 netmask=255.255.255.0 mp_autotest=0 ID=000000000000000000 da=tftp 0x02000000 dhboot.bin.img; flwrite;tftp dhboot-min.bin.img;flwrite dr=tftp 0x02000000 romfs-x.squashfs.img; flwrite dk=tftp 0x02000000 kernel.img; flwrite du=tftp 0x02000000 user-x.squashfs.img; flwrite dw=tftp 0x02000000 web-x.squashfs.img; flwrite dp=tftp 0x02000000 partition-x.cramfs.img;flwrite dc=tftp 0x02000000 custom-x.squashfs.img; flwrite up=tftp 0x02000000 update.img; flwrite tk=tftp 0x02000000 uImage; bootm dh_keyboard=1 appauto=1 sysbackup=1 logserver=127.0.0.1 loglevel=4 autosip=192.168.254.254 autolip=192.168.1.108 autogw=192.168.1.1 autonm=255.255.255.0 pd=tftp 0x02000000 pd-x.squashfs.img; flwrite stdin=serial stdout=serial stderr=serial ethact=ambarella mac Environment size: 1035/131068 bytes >
Ncat: Version 7.40 ( https://nmap.org/ncat ) Ncat: Listening on 192.168.254.254:5002 gBootLogPtr:00b80008. spinor flash ID is 0x1940ef *** Warning - bad CRC, using default environment sync.. buf no align with 8 bytes,len:0x800 Fail to write spi flash from :40000 in 0 chip. partition file version 2 rootfstype squashfs root /dev/mtdblock5 fail to parse HWID fail to parse bootargsParametersV2.text info fail to init bootargsParametersV2 TEXT_BASE:01000000 Net: PHY:0x03625cc6,addr:0x01 s3l 55k+bcm54811 init sd update init:HWID is missing! partition file version 2 rootfstype squashfs root /dev/mtdblock5 Using ambarella mac device Download Filename 'upgrade_info_7db780a713a4.txt'.Downloading: 100% ## file size: 202 Bytes, times: 0s, speed: 14.6 KiB/s done Bytes transferred = 202 (ca hex) Using ambarella mac device Download Filename 'romfs-x.squashfs.img'.Downloading: 100% ## file size: 3.2 MiB, times: 6s, speed: 474.6 KiB/s done Bytes transferred = 3303672 (3268f8 hex) curVer:V1.4 <= newVer:V1.4,verCompare success! [0;32mUBOOT_commonSwRsaVerify run successfully! [0m ## Checking Image at 02000000 ... Legacy image found Image Name: romfs Created: 2020-04-30 7:22:56 UTC Image Type: ARM Linux Kernel Image (uncompressed) Data Size: 3301376 Bytes = 3.1 MiB Load Address: 01b80000 Entry Point: 01fd0000 Verifying Checksum ... OK Programing start at: 0x01b80000 for romfs SPI probe: 32768 KiB W25Q256FV at 0:1 is now current device write : 96%__do_write_flashSpi: error! flwrite error 1! cmd Failed run dr! partition file version 2 rootfstype squashfs root /dev/mtdblock5 fail to load bootargsParameters.txt fail to load bootargsParameters.txt file get bootargs info failed cmdLine console=ttyS0,115200 mem=118M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc
U-Boot 2010.06-svn6390 (Feb 19 2020 - 12:04:41) [QUOTE]boot[/QUOTE] SPI probe: 32768 KiB W25Q256FV at 0:0 is now current device Verifying Checksum ... Bad Data CRC ERROR: can't get kernel image! try:kload 0x2000000 fail to get partinfo failed!
>partition fail to uncompress fail to load partition.txt from e0000 fail to load partition file partition isn't exist
>bdinfo arch_number = 0x23283041 env_t = 0x00000000 boot_params = 0x00200000 DRAM bank = 0x00000000 -> start = 0x00200000 -> size = 0x07600000 ethaddr = 00:12:34:56:78:9A ip_addr = 192.168.1.108 baudrate = 115200 bps
Hi Corellon, is there a thread thread that talks about the tools required to flash a chip with an external tool? I have an issue with a camera a few pages back on this thread and I would like to try this as a last resort.If I had to try something that's where I would start (aside from programming the flash chip with an external tool)
I recall there being a thread that talks about using an external programmer but I don't have a link to it handy, it was something I came across while researching my own problem, It's not a very convenient process and requires getting the write programmer for the right type of chip on your camera. Some have alligator clamps so you don't have to pull or desolder the chip but I can't speak much on the topic from my own experience other then it is possible as a last resort but not something I would like to attempt myself.
Using ambarella mac devicerun dr
Using ambarella mac devicerun dk
Using ambarella mac devicerun du
Using ambarella mac devicerun dw
Using ambarella mac devicerun dp
Using ambarella mac devicerun dc
Using ambarella mac device
Using ambarella mac devicetftp 0x2000000 .FLASHING_DONE_STOP_TFTP_NOW
Wrong Image Format for bootm commandsleep 5