Dahua IPC unbricking / recovery over serial UART and TFTP

i dont have the usb adapter yet which one i need to order and where
 
i dont have the usb adapter yet which one i need to order and where
I have flashed with this



The file name is
General_SD59XXX-HN-MAIN_MCU_V2.300.0000000.10.R.170926.bin


How do i set new hwid I know that that a is company in bootloader help...
What do i white in hwid company...
I didnt white my own hwid...
 
I have flashed with this



The file name is
General_SD59XXX-HN-MAIN_MCU_V2.300.0000000.10.R.170926.bin


How do i set new hwid I know that that a is company in bootloader help...
What do i white in hwid company...
I didnt white my own hwid...
i have flashed it through windows dahua gui windows explorer interface...
Update firmware...
Which was odd it took file and flashed it...like it is normal big size 25mb~
 
Hello I have IPC-HDW4433C-A. Ehernet not working. I'm connecting via uart and why Net: PHY found at 3 but trying start on phyaddr=-1 ?



U-Boot 2010.06-svn4537 (Sep 08 2017 - 06:33:55)
DRAM: 1 GiB
gBootLogPtr:80b80008.
Check spi flash controller v350... Found
Spi(cs1) ID: 0xC8 0x40 0x18 0xC8 0x40 0x18
Spi(cs1): Block:64KB Chip:16MB Name:"GD25Q128"
partition file version 2
rootfstype squashfs root /dev/mtdblock7
In: serial
Out: serial
Err: serial
TEXT_BASE:81000000
Net: PHY found at 3

ETH0: PHY(phyaddr=-1, rmii) not link!
Try again use backup_serverip
ETH0: PHY(phyaddr=-1, rmii) not link!
Failed to get info.txt
Fail to get info file!
Init error!
ETH0: PHY(phyaddr=-1, rmii) not link!
## Booting kernel from Legacy Image at 82000000 ...
Image Name: Linux-3.4.35
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 1453664 Bytes = 1.4 MiB
Load Address: 80008000
Entry Point: 80008000
Loading Kernel Image ...OK
OK
partition file version 2
rootfstype squashfs root /dev/mtdblock7
fail to load bootargsParameters.txt
fail to load bootargsParameters.txt file
get bootargs info failed
cmdLine mem=85M console=ttyS0,115200 root=/dev/mtdblock7 rootfstype=squashfs
crashflasg:1, logmagic:54410011.

Starting kernel ...
Uncompressing Linux... done, booting the kernel.



U-Boot 2010.06-svn4537 (Sep 08 2017 - 06:33:55)
DRAM: 1 GiB
gBootLogPtr:80b80008.
Check spi flash controller v350... Found
Spi(cs1) ID: 0xC8 0x40 0x18 0xC8 0x40 0x18
Spi(cs1): Block:64KB Chip:16MB Name:"GD25Q128"
partition file version 2
rootfstype squashfs root /dev/mtdblock7
In: serial
Out: serial
Err: serial
TEXT_BASE:81000000
Net: PHY found at 3

ETH0: PHY(phyaddr=-1, rmii) not link!
Try again use backup_serverip
ETH0: PHY(phyaddr=-1, rmii) not link!
Failed to get info.txt
Fail to get info file!
Init error!



U-Boot 2010.06-svn4537 (Sep 08 2017 - 06:33:55)
DRAM: 1 GiB
gBootLogPtr:80b80008.
Check spi flash controller v350... Found
Spi(cs1) ID: 0xC8 0x40 0x18 0xC8 0x40 0x18
Spi(cs1): Block:64KB Chip:16MB Name:"GD25Q128"
partition file version 2
rootfstype squashfs root /dev/mtdblock7
In: serial
Out: serial
Err: serial
TEXT_BASE:81000000
Net: PHY found at 3

Hit any key to stop autoboot: 0
bootcmd=kload 0x82000000; bootm 0x82000000
bootdelay=1
baudrate=115200
ipaddr=192.168.1.108
serverip=192.168.1.1
gatewayip=192.168.1.1
netmask=255.255.255.0
bootfile="uImage"
wifiaddr=00:12:34:56:78:91
da=tftp 0x82000000 dhboot.bin.img; flwrite;tftp dhboot-min.bin.img;flwrite
dr=tftp 0x82000000 romfs-x.squashfs.img; flwrite
dk=tftp 0x82000000 kernel.img; flwrite
du=tftp 0x82000000 user-x.squashfs.img; flwrite
dw=tftp 0x82000000 web-x.squashfs.img; flwrite
dp=tftp 0x82000000 partition-x.cramfs.img;flwrite
dc=tftp 0x82000000 custom-x.squashfs.img; flwrite
up=tftp 0x82000000 update.img; flwrite
tk=tftp 0x82000000 uImage; bootm
dh_keyboard=1
loglevel=4
pd=tftp 0x82000000 pd-x.squashfs.img; flwrite
ethact=gmac
BSN=4M015D5PAQ06841
bootargs=mem=85M console=ttyS0,115200 root=/dev/mtdblock7 rootfstype=squashfs
HWID=IPC-HDW4431C-A-V3:01:02:06:63:1A:00:01:10:01:00:00:258:00:00:00:00:00:01:00:00:100
devalias=IPC-HDW4433C-A
hwidEx=00:03:00:00:00:00:00:00:00:00:00:00:00:00:00:00
appauto=1
autolip=192.168.1.251
mp_autotest=0
filesize=30040
fileaddr=82000000
ID=5H013E3PAA318BC
ethaddr=A0:BD:1D:7D:8E:26
stdin=serial
stdout=serial
stderr=serial
verify=n
ver=U-Boot 2010.06-svn4537 (Sep 08 2017 - 06:33:55)

Environment size: 1207/131068 bytes
 
I have VTH1550-S2 hanging at uboot

HELLO! BOOT0 is starting! Nov 16 2018 02:18:28
boot0 version : 4.0.0
boot0 commit : 8
DRAM DRIVE INFO: V0.7
DRAM Type = 3 (2:DDR2,3:DDR3,6:LPDDR2,7:LPDDR3)
DRAM CLK = 672 MHz
DRAM zq value: 000039bb
DRAM size = 128 MB
Succeed in reading Boot1 file head.
Ready to disable icache.
Jump to secend Boot.
[ 0.110]

U-Boot 2011.09-rc1-svn4146 (Aug 18 2019 - 03:11:44) Allwinner Technology

[ 0.119]version: 1.1.0
[ 0.122]uboot commit : 8
[ 0.129]pmbus: ready
[ 0.134]DRAM: OK
env import count 0



It takes files through TFTP but I don't get any command line on UART Connection. Also the console of TFTP does not give an output.

The problem was caused by flashing:

DH_VTHX421H_MultiLang_SIP_V4.410.0000000.4.R.20200221.bin
instead of
DH_VTHX421L... which is for this device.


Anyone can help?

I have tftp running and uart console.
 
Hello All,

I have on the desk camera ipc-hfw4631h-zsa I'm trying to revive via tftp
after uploading the image camera giving this error:



gBootLogPtr:00b80008.
spinor flash ID is 0x1940ef
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=130M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc.
TEXT_BASE:01000000
Net: Detected MACID:bc:32:5f:3f:ec:c1
PHY:0x001cc816,addr:0x00
s3l phy RTL8201 init

MMC: sdmmc init
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.251; sending through gateway 192.168.1.1
Download Filename 'upgrade_info_7db780a713a4.txt'.
Download to address: 0x5000000
Downloading: *
Retry count exceeded; starting again
Try again use backup_serverip
*** ERROR: `serverip' not set
Failed to get info.txt
Fail to get info file!
Init error!
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.251; sending through gateway 192.168.1.1
Download Filename 'failed.txt'.
Download to address: 0x2000000
Downloading: *
Retry count exceeded; starting again
Support backupVer:255
state:ff,err_count:03
SPI probe: 32768 KiB W25Q256FV at 0:0 is now current device
## Booting kernel from Legacy Image at 02000000 ...
Image Name: Linux-3.10.73
Created: 2019-03-06 18:42:53 UTC
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 1570432 Bytes = 1.5 MiB
Load Address: 00208000
Entry Point: 00208000
Verifying Checksum ... OK
Loading Kernel Image ...OK
OK
partition file version 2
rootfstype squashfs root /dev/mtdblock5
fail to load bootargsParameters.txt
fail to load bootargsParameters.txt file
Adjust Memory Allocation, dram_size=0x8200000, dsp_ram.start=0x8400000, dsp_ram.size=0x17c00000
crashflasg:1, logmagic:54410011.

Starting kernel ...

here is the log of the TFTP :




thank you all for any advice.


Best regards Radim
 
I'm not sure I have the correct firmware for ipc-hfw4631h-zsa, if anyone has a link to download I will be happy.
I used this DH_IPC-HX5X3X-Rhea_Chn_PN_Stream3_V2.800.0000015.0.R.200430.bin , but I am not sure that is correct.,

thanks Radim
 
Hello,
I probably know where is the problem. Problem is bad HWID
on this moment I have this:

HWID: IPC-HFW4631F-ZS-27135:01:02:02:5F:21:00:01:0F:01:00:04:2D0:00:00:00:00:00:01:00:00:200

but my camera is ipc-hfw4631h-zsa any idea how to fi, so I need for proper HWID will someone provide it ??

thank you for help
 
If I get only the first two lines of the U-boot, and the camera keeps restarting, what that means?

UBL_loadImg bakVersion=20, bootversion=20

U-boot 2010.6-svn8102 (Jun 4 2020 - 20:44:05)
 
Anybody? The bootloader is not working?
 
hi i have same problem with my VTO 3211d-p2 I try to install new firmware but it fail at 50% and now I have vto in loop reboot and I don't know what to do I'm trying to resolve with tftp server. suggestion?
 
any idea why when I was running "run dr" it uploads halfway and the NVR restarts itself before uploading complete? ..it keeps restarting each time after a set period of time like few minutes?

Nand: WINBOND W25N01GV

SDK Version: HiSTBLinuxV100R005C00SPC031_20160601

logo........... Logo_Main!
--LT8612_Reset Success! Reset Count:0.
BMP_GetPixelFmt : 32
getenv bootnandflash fail
squashfs use gzip
Hit any key to stop autoboot: 0
#*
Unknown command '*' - try 'help'
#run dr
switch init success!
T T T # [ Connected ]
################################ [ 1.000 MB]
################################ [ 2.000 MB]
################################ [ 3.000 MB]
################################ [ 4.000 MB]
################################ [ 5.000 MB]
################################ [ 6.000 MB]
################################ [ 7.000 MB]
################################ [ 8.000 MB]
################################ [ 9.000 MB]
#################
Bootrom start
Boot Media: SPI_NAND
Decrypt auxiliary code ...OK
Entry boot auxiliary code

Auxiliary code - v1.00
DDR code - V1.1.2 20160205
Build: Apr 19 2016 - 20:18:19

Reg Version: v1.5.1\
Reg Time: 2017/04/10 14:34:20
Reg Name: hi3798cv2dmd_hi3798cv200_DDR3-1866_1GB_16bitx2_4layers.reg

Boot auxiliary code success
Bootrom success


System startup


Relocate Boot

Jump to C code


Compressed-boot v1.0.0
Uncompress......................Ok


System startup


Relocate Boot

Jump to C code


Fastboot 3.3.0-svn4784 (jenkins@3a6b5acb4427) (Jul 30 2020 - 03:57:06)



Nand: WINBOND W25N01GV

SDK Version: HiSTBLinuxV100R005C00SPC031_20160601

logo........... Logo_Main!
--LT8612_Reset Success! Reset Count:0.
BMP_GetPixelFmt : 32
getenv bootnandflash fail
squashfs use gzip
Hit any key to stop autoboot: 0
#****
Unknown command '****' - try 'help'
#run dr
switch init success!
T T T # [ Connected ]
################################ [ 1.000 MB]
################################ [ 2.000 MB]
################################ [ 3.000 MB]
################################ [ 4.000 MB]
################################ [ 5.000 MB]
################################ [ 6.000 MB]
################################ [ 7.000 MB]
#######################
Bootrom start
Boot Media: SPI_NAND
Decrypt auxiliary code ...OK
Entry boot auxiliary code

Auxiliary code - v1.00
DDR code - V1.1.2 20160205
Build: Apr 19 2016 - 20:18:19

Reg Version: v1.5.1\
Reg Time: 2017/04/10 14:34:20
Reg Name: hi3798cv2dmd_hi3798cv200_DDR3-1866_1GB_16bitx2_4layers.reg

Boot auxiliary code success
Bootrom success


System startup


Relocate Boot

Jump to C code


Compressed-boot v1.0.0
Uncompress......................Ok


System startup


Relocate Boot

Jump to C code


Fastboot 3.3.0-svn4784 (jenkins@3a6b5acb4427) (Jul 30 2020 - 03:57:06)



Nand: WINBOND W25N01GV

SDK Version: HiSTBLinuxV100R005C00SPC031_20160601

logo........... Logo_Main!
--LT8612_Reset Success! Reset Count:0.
BMP_GetPixelFmt : 32
getenv bootnandflash fail
squashfs use gzip
Hit any key to stop autoboot: 0
#****
Unknown command '****' - try 'help'
#run dr
switch init success!
T T T # [ Connected ]
################################ [ 1.000 MB]
################################ [ 2.000 MB]
################################ [ 3.000 MB]
################################ [ 4.000 MB]
################################ [ 5.000 MB]
################################ [ 6.000 MB]
################################ [ 7.000 MB]
##############################
Bootrom start
Boot Media: SPI_NAND
Decrypt auxiliary code ...OK
Entry boot auxiliary code

Auxiliary code - v1.00
DDR code - V1.1.2 20160205
Build: Apr 19 2016 - 20:18:19

Reg Version: v1.5.1\
Reg Time: 2017/04/10 14:34:20
Reg Name: hi3798cv2dmd_hi3798cv200_DDR3-1866_1GB_16bitx2_4layers.reg

Boot auxiliary code success
Bootrom success


System startup


Relocate Boot

Jump to C code


Compressed-boot v1.0.0
Uncompress......................Ok


System startup


Relocate Boot

Jump to C code


Fastboot 3.3.0-svn4784 (jenkins@3a6b5acb4427) (Jul 30 2020 - 03:57:06)



Nand: WINBOND W25N01GV

SDK Version: HiSTBLinuxV100R005C00SPC031_20160601

logo........... Logo_Main!
--LT8612_Reset Success! Reset Count:0.
BMP_GetPixelFmt : 32
getenv bootnandflash fail
squashfs use gzip
Hit any key to stop autoboot: 0
#*
Unknown command '*' - try 'help'
 
Dahua NVR4216-16p-HDS2 chinese version

came over from tftp thread... upgraded the firmware using smartpss and loaded the english firmware. didnt know they were not interchangeable. after upgraded to v4, it finished loading and just displayed "Illegal firmware" on screen and nothing else. console just showed starting kernel and then ended there...

tried with tftp initially but it failed after receiving the file "command" file ...so i ordered rs232 cable and used putty ..so far it was pretty successful while i tested the run command on other files i.e. run dk dw dc as they were pretty small file size ...but run dr romfs-x.squashfs is 43mb ....the longest it ever downloaded was 9mb+ and then it just restarted ...tried it over 10 times and it just keeps resetting for no reason after few minutes


now im scratching my head again as to how to get it to flash the chinese firmware back into it