Dahua IPC unbricking / recovery over serial UART and TFTP

[mtriggiano]

Hello community, I have a VTO1510CH which I want to recover ... I am trying to establish the connection and I only receive strange characters, could you give me a hand with this? I leave a capture of my configurations and what I get in addition to the connections

 

[PgXme2]

@mtriggiano Are you trying to connect it through the com port?
If so, that will not work. You need a USB2TTL converter

 

[Pseudoreal]

Dear all:

I have a question - I am trying to fix a VTO2000A-C, which cannot be found in VDPConfig. However the VTO boots up (lights go on) and also reacts on pressing the ring with replies (no device found, etc.).
So I was trying to flash via UART.

I bought an USB to TTL stick and it looks installed properly (Silicon Labs CP210x USB to UART Bridge on COM3). However, I did not get any result in NCOM booting up the VTO (it simply gives a blank screen). And I tried all pins of VTO with RX or TX at the stick.
Then I figured that something might be wrong with the stick, so I connected RX and TX of the stick and started NCOM (and afterwards Putty), but I do not see an Echo when I write in the field, which means I write "echo", but I do not see a second "echo". So something to be broken with the USB stick.

Any idea what I can try to fix this?

 

[shour0v]

How can I flash firmware of imou Ranger 2 ?

 

[jazzy1]

hi! I have a 49225 PTZ that has gotten bricked/messed up....I'm trying to locate the serial connection point on the cam....has anyone connected to it? any photos or advice would be much appreciated!...I've got it open where you can see the SD card slot etc, but am not seeing
any sort of spot that would be the serial connection point.

thanks!

 

[ralliartevo6]

View attachment 15276 View attachment 15277 View attachment 15278 View attachment 15279



I'm still unsuccessful. I've tried (looking left to right) RX TX GND VCC as well as (looking right to left) VCC GND TX RX. I was able to get a continuous scrolling of gibberish but nothing in english. This continues as long as there is power. I've tried making a GND connection from the Dongle to an UART pin as well as from the dongle to a ground connection on the camera. My camera has a 4 pin micro molex - I wish there was some way to identify the pins so I would at least know that I am toying with correct pins.

Hi,

how did you solve your problem ?
I im in the same case.

Thank's in advance
Bye

 

[jazzy1]

Hi. Checking in again. Has anybody connected and unbricked a 49225 PTZ? I’m still trying to locate where the pins are to connect with my serial cable

 

[nikos1671]

Hi,

I am new here.
i have bricked my camera and i am trying to bring it back to live.
My camera its not a Dahua but i think someone can help me. My camera its a Reolink.
I have try to update it with wrong firmware. Now i cannot access the camera from the app or from the lan cable. the stranger is the camera its still working, i can see in the sd card new video records when i move my hand over the camera lens.
i have connect over the serial port and i can see how the linux boot and loading. i make a screenshot of the uboot.


The firmware file from reolink its a .pak file, there inside there a lot of files and folders and i dont know how to start to flash again the firmware.
I will appreciate if someone can guide me.

 

[mastec]

Hi , I have a XVR5116HE conected to console but I can´t flash the firmware, because I don´t have the update.img file. instead I have the Customer_XVR5x16_Internal_13Languages_P_V3.218.9996001.0.R.180820.bin File. Can anyone help me on how to choose that file for the upgrade ?
Thanks in advance

 

[Corellon]

@mastec if you open the .bin7 file with 7zip you should be able to extract it's contents and inside there should be the .img files you need (there are many) do you also have the SFTP setup to be able to upload the files?

@nikos1671 try seeing if uboot has a "help" variation activated, your looking for an alias command such as "run dr" that will start the transfer and updated, otherwise you could use the tftp command (if it's enabled) and see if the sf write command is the same as ours. The good news is that the enviro args show you the memory addresses of the individual partitions you'll need to flash just need to find what the command is in your version of uboot.Attach files

Note: I'm going out of town so might now have consistent answers to replying for a week or so

 

[PgXme2]

Hi guys,

I am trying to recover a Dahua IPCAM that seems to have some problems with the network. I have it connected via UART but cannot connect to the TFTserver. I have restored some Dahua devices in the past, so far the tools and environment should be fine.

The problem seems to be the Ethernet interface of the IPCAM.

run dr;run dk;run du;run dw;run dd;run dc;tftp 0x82000000 pd-x.cramfs.img; flwrite;run da
ETH0: PHY(phyaddr=-1, rmii) link UP: DUPLEX=FULL : SPEED=100M
MAC: 00-12-34-56-78-9A
Using gmac device
TFTP from server 192.168.178.37; our IP address is 192.168.178.199
Download Filename 'romfs-x.squashfs.img'.
Download to address: 0x82000000
Downloading:
ARP Retry count exceeded; starting again

Does anybody know the meaning of the message below?

ARP Retry count exceeded; starting again

One further strange thing is that after normal booting it shows the message:

All Eth is not on line?

Spoiler: Boot procedure

<ESC>[0m<ESC>[36;40m01:28:49|[NetApp-466560] [ver:] debug tid:1003 tid:1003, CRegCliNew::doRegister()>>>>DoNddnsRegister falied! [Src/P2P/ASRegister.cpp:333]
<ESC>[0m<ESC>[33;40m01:28:49|[NetProt-455258] [ver:] warn tid:1017 [getByNet:132]getAddrInfo failed, request[0] timeout,www.dahuap2pcloud.com ref 1 times!
<ESC>[0m<ESC>[31;40m01:28:49|[NetApp-466560] [ver:] error tid:1017 tid:1017, IDNSManager::instance()->getaddrinfo failed! [Src/P2P/P2P.cpp:899]
<ESC>[0m<ESC>[31;40m01:28:51|[NetApp-466560] [ver:] error tid:1003 tid:1003, All Eth is not on line? [Src/NetworkManager/RouteManager.cpp:721]
<ESC>[0m<ESC>[31;40m01:28:51|[NetApp-466560] [ver:] error tid:1003 tid:1003, All Eth is not on line? [Src/NetworkManager/RouteManager.cpp:854]
<ESC>[0m<ESC>[31;40m01:28:51|[NetApp-466560] [ver:] error tid:1003 tid:1003, All Eth is not on line? [Src/NetworkManager/RouteManager.cpp:887]
<ESC>[0;32;32m01:28:51|[libpdi] Get default ip failed
<ESC>[m<ESC>[0m<ESC>[36;40m01:28:51|[NetApp-466560] [ver:] debug tid:1015 tid:1015, Config changed! [Src/P2P/P2P.cpp:670]
<ESC>[0m<ESC>[31;40m01:28:53|[NetApp-466560] [ver:] error tid:1003 tid:1003, All Eth is not on line? [Src/NetworkManager/RouteManager.cpp:721]
<ESC>[0m<ESC>[31;40m01:28:53|[NetApp-466560] [ver:] error tid:1003 tid:1003, All Eth is not on line? [Src/NetworkManager/RouteManager.cpp:854]
<ESC>[0m<ESC>[31;40m01:28:53|[NetApp-466560] [ver:] error tid:1003 tid:1003, All Eth is not on line? [Src/NetworkManager/RouteManager.cpp:887]
<ESC>[0m<ESC>[33;40m01:28:54|[NetProt-455258] [ver:] warn tid:1015 [getByNet:132]getAddrInfo failed, request[0] timeout,www.dahuap2pcloud.com ref 1 times!
<ESC>[0m<ESC>[31;40m01:28:54|[NetApp-466560] [ver:] error tid:1015 tid:1015, IDNSManager::instance()->getaddrinfo failed! [Src/P2P/P2P.cpp:899]
<ESC>[0m<ESC>[31;40m01:28:54|[NetApp-466560] [ver:] error tid:1017 tid:1017, All Eth is not on line? [Src/NetworkManager/RouteManager.cpp:721]
<ESC>[0m<ESC>[31;40m01:28:54|[NetApp-466560] [ver:] error tid:1017 tid:1017, All Eth is not on line? [Src/NetworkManager/RouteManager.cpp:854]
<ESC>[0m<ESC>[31;40m01:28:54|[NetApp-466560] [ver:] error tid:1017 tid:1017, All Eth is not on line? [Src/NetworkManager/RouteManager.cpp:887]
<ESC>[0m<ESC>[36;40m01:28:56|[NetApp-466560] [ver:] debug tid:1015 tid:1015, Check()>>>> cha=[10], m_lastRegStatus=[1], m_portchanged=[0] [Src/P2P/ASRegister.cpp:574]
<ESC>[0m<ESC>[36;40m01:28:56|[NetApp-466560] [ver:] debug tid:1015 tid:1015, CRegCliNew::checkRegisterState()>>>>Need to Register! [Src/P2P/ASRegister.cpp:579]
<ESC>[0m<ESC>[36;40m01:28:56|[NetApp-466560] [ver:] debug tid:1015 tid:1015, type IPC devid 5A042D5PAA5CFFA mac 00123456789A oemid 0 username version 2.621 privPort 37777 rtspPort 554 httpPort 80 server dhp2p webver 2.420.0 TLSSupport Disable Code Not Supported [Src/P2P/ASRegister.cpp:399]
<ESC>[0m<ESC>[32;40m01:28:56|[NetProt-455258] [ver:] info tid:1015 [tid:1015] Code is NULL! [Src/DdnsPrivateP2p.cpp:259]
<ESC>[0m<ESC>[36;40m01:28:56|[NetProt-455258] [ver:] debug tid:1015 [tid:1015] httpsEnable is true [Src/DdnsPrivateP2p.cpp:263]
<ESC>[0m<ESC>[36;40m01:28:56|[NetApp-466560] [ver:] debug tid:1018 tid:1018, Config changed! [Src/P2P/P2P.cpp:670]
<ESC>[0m<ESC>[31;40m01:28:56|[NetApp-466560] [ver:] error tid:1016 tid:1016, All Eth is not on line? [Src/NetworkManager/RouteManager.cpp:721]
<ESC>[0m<ESC>[31;40m01:28:56|[NetApp-466560] [ver:] error tid:1016 tid:1016, All Eth is not on line? [Src/NetworkManager/RouteManager.cpp:854]
<ESC>[0m<ESC>[31;40m01:28:56|[NetApp-466560] [ver:] error tid:1016 tid:1016, All Eth is not on line? [Src/NetworkManager/RouteManager.cpp:887]
<ESC>[0m<ESC>[31;40m01:28:59|[NetApp-466560] [ver:] error tid:1003 tid:1003, All Eth is not on line? [Src/NetworkManager/RouteManager.cpp:721]
<ESC>[0m<ESC>[31;40m01:28:59|[NetApp-466560] [ver:] error tid:1003 tid:1003, All Eth is not on line? [Src/NetworkManager/RouteManager.cpp:854]
<ESC>[0m<ESC>[31;40m01:28:59|[NetApp-466560] [ver:] error tid:1003 tid:1003, All Eth is not on line? [Src/NetworkManager/RouteManager.cpp:887]
<ESC>[0m<ESC>[33;40m01:28:59|[NetProt-455258] [ver:] warn tid:1015 [getByNet:132]getAddrInfo failed, request[1] timeout,www.dahuap2p.com ref 1 times!
<ESC>[0m<ESC>[33;40m01:28:59|[NetProt-455258] [ver:] warn tid:1015 [tid:1015] Resolv server domain name www.dahuap2p.com failed! [Src/DdnsPrivateP2p.cpp:93]
<ESC>[0m<ESC>[36;40m01:28:59|[NetApp-466560] [ver:] debug tid:1015 tid:1015, CRegCliNew::doRegister()>>>>DoNddnsRegister falied! [Src/P2P/ASRegister.cpp:333]
<ESC>[0m<ESC>[33;40m01:28:59|[NetProt-455258] [ver:] warn tid:1018 [getByNet:132]getAddrInfo failed, request[0] timeout,www.dahuap2pcloud.com ref 1 times!
<ESC>[0m<ESC>[31;40m01:28:59|[NetApp-466560] [ver:] error tid:1018 tid:1018, IDNSManager::instance()->getaddrinfo failed! [Src/P2P/P2P.cpp:899]
<ESC>[0m<ESC>[31;40m01:29:01|[NetApp-466560] [ver:] error tid:1003 tid:1003, All Eth is not on line? [Src/NetworkManager/RouteManager.cpp:721]
<ESC>[0m<ESC>[31;40m01:29:01|[NetApp-466560] [ver:] error tid:1003 tid:1003, All Eth is not on line? [Src/NetworkManager/RouteManager.cpp:854]
<ESC>[0m<ESC>[31;40m01:29:01|[NetApp-466560] [ver:] error tid:1003 tid:1003, All Eth is not on line? [Src/NetworkManager/RouteManager.cpp:887]
<ESC>[0m<ESC>[36;40m01:29:01|[NetApp-466560] [ver:] debug tid:1017 tid:1017, Config changed! [Src/P2P/P2P.cpp:670]

For any help thanks in advance.

Spoiler: Environment

bootcmd=kload 0x82000000; bootm 0x82000000
bootdelay=1
baudrate=115200
ethaddr=00:12:34:56:78:9A
gatewayip=192.168.1.1
netmask=255.255.255.0
bootfile="uImage"
wifiaddr=00:12:34:56:78:91
mp_autotest=0
da=tftp 0x82000000 dhboot.bin.img; flwrite;tftp dhboot-min.bin.img;flwrite
dr=tftp 0x82000000 romfs-x.squashfs.img; flwrite
dk=tftp 0x82000000 kernel.img; flwrite
du=tftp 0x82000000 user-x.squashfs.img; flwrite
dw=tftp 0x82000000 web-x.squashfs.img; flwrite
dp=tftp 0x82000000 partition-x.cramfs.img;flwrite
dc=tftp 0x82000000 custom-x.squashfs.img; flwrite
up=tftp 0x82000000 update.img; flwrite
tk=tftp 0x82000000 uImage; bootm
appauto=1
loglevel=4
pd=tftp 0x82000000 pd-x.squashfs.img; flwrite
ethact=gmac
dh_keyboard=0
backup_serverip=192.168.178.37
ID=5A042D5PAA5CFXX
HWID=IPC-HDBW4431R-ZS-27135:01:02:05:63:1A:00:01:00:00:00:04:258:00:00:00:00:00:01:00:00:XXX
bootargs=mem=85M console=ttyS0,115200 root=/dev/mtdblock7 rootfstype=squashfs
serverip=192.168.178.37
ipaddr=192.168.178.199
stdin=serial
stdout=serial
stderr=serial
verify=n
ver=U-Boot 2010.06-svn5895 (Jun 29 2018 - 04:58:40)

Environment size: 1094/131068 bytes

 

[alastairstevenson]

Does anybody know the meaning of the message below?
ARP Retry count exceeded; starting again

One further strange thing is that after normal booting it shows the message?:
All Eth is not on line?

These, and the tftp update problem, suggest that the ethernet connection is not working.
Presumably there is no link detect LED on the switch port it's connected to.

Could the RJ45 connector be corroded?
Any other things that might damage the ethernet connection?

 

[tripster-2022]

Hi, I have IPC-HDBW4631E-ASE that suddenly stopped working. It went into boot loop. I've connected the serial port and I can see it is freezing on "Starting kernel …"
I have tried to upload different firmware:
DH_IPC-HX5X3X-Rhea_MultiLang_PN_Stream3_V2.800.0000008.0.R.190619.bin
DH_IPC-HX5X3X-Rhea_Eng_P_Stream3_V2.460.0000000.16.R.20170904.bin
DH_IPC-HX5X3X-Rhea_Eng_P_Stream3_V2.622.0000000.31.R.180813.bin
dh_ipc-hx5x3x-rhea_eng_p_stream3_v2.622.0000000.21.r.180203.bin
DH_IPC-HX5X3X-Rhea_Eng_P_Stream3_V2.460.0000.14.R.20170720.bin
unfortunately it didn't help - still freeze at "Starting kernel"

Here is the printenv output:

>printenv
bootcmd=sf read 0x2000000 0x1040000 0x1c0000;bootm 0x2000000
bootdelay=3
baudrate=115200
ipaddr=192.168.1.108
autoload=yes
gatewayip=192.168.1.1
netmask=255.255.255.0
da=tftp 0x02000000 dhboot.bin.img; flwrite;tftp dhboot-min.bin.img;flwrite
dr=tftp 0x02000000 romfs-x.squashfs.img; flwrite
dk=tftp 0x02000000 kernel.img; flwrite
du=tftp 0x02000000 user-x.squashfs.img; flwrite
dw=tftp 0x02000000 web-x.squashfs.img; flwrite
dp=tftp 0x02000000 partition-x.cramfs.img;flwrite
dc=tftp 0x02000000 custom-x.squashfs.img; flwrite
up=tftp 0x02000000 update.img; flwrite
tk=tftp 0x02000000 uImage; bootm
dh_keyboard=1
sysbackup=1
logserver=127.0.0.1
loglevel=4
autosip=192.168.254.254
autogw=192.168.1.1
autonm=255.255.255.0
pd=tftp 0x02000000 pd-x.squashfs.img; flwrite
ethact=ambarella mac
BSN=4F06D4BPAQ00034
HWID=IPC-HDBW4631E-AS:01:02:05:5F:21:00:01:0E:01:01:04:2D0:03:00:00:00:00:01:00:00:200
hwidEx=00:02:00:00:00:00:00:00:00:00:00:00:00:00:00:00
devalias=IPC-HDBW4631E-ASE
ID=4F06484PAG4ECD0
bootargs=console=ttyS0,115200 mem=130M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc
ethaddr=38:AF:29:9A:E6:2D
filesize=63A040
fileaddr=2000000
appauto=1
autolip=192.168.1.251
quickstart=0
serverip=192.168.1.2
stdin=serial
stdout=serial
stderr=serial

Environment size: 1253/131068 bytes

and the boot log:

>boot
SPI probe: 32768 KiB W25Q256FV at 0:0 is now current device
## Booting kernel from Legacy Image at 02000000 …
   Image Name:   Linux-3.10.73
   Created:      2018-01-24  13:25:17 UTC
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    1569484 Bytes = 1.5 MiB
   Load Address: 00208000
   Entry Point:  00208000
   Verifying Checksum … OK
   Loading Kernel Image …OK
OK
partition file version 2
rootfstype squashfs root /dev/mtdblock5
fail to load bootargsParameters.txt
fail to load bootargsParameters.txt file
Adjust Memory Allocation, dram_size=0x8200000, dsp_ram.start=0x8400000, dsp_ram.size=0x17c00000
crashflasg:1, logmagic:54410011.

Starting kernel …
þ

U-Boot 2010.06-svn4911 (Sep 20 2017 - 17:22:29)
I2C:   ready
DRAM:  118 MiB
gBootLogPtr:00b80008.
spinor flash ID is 0x1940ef
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=130M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc.
TEXT_BASE:01000000
Net:   Detected MACID:38:af:29:9a:e6:2d
PHY:0x03625cc6,addr:0x01
s3l 55k+bcm54811 init

MMC:   sdmmc init
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.251; sending through gateway 192.168.1.1
Download Filename ‘upgrade_info_7db780a713a4.txt’.
Download to address: 0x5000000
Downloading: *
Retry count exceeded; starting again
Try again use backup_serverip
*** ERROR: `serverip’ not set
Failed to get info.txt
Fail to get info file!
Init error!
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.251; sending through gateway 192.168.1.1
Download Filename ‘failed.txt’.
Download to address: 0x2000000
Downloading: *
Retry count exceeded; starting again
Support backupVer:255
state:ff,err_count:01
SPI probe: 32768 KiB W25Q256FV at 0:0 is now current device
## Booting kernel from Legacy Image at 02000000 …
   Image Name:   Linux-3.10.73
   Created:      2018-01-24  13:25:17 UTC
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    1569484 Bytes = 1.5 MiB
   Load Address: 00208000
   Entry Point:  00208000
   Verifying Checksum … OK
   Loading Kernel Image …OK
OK
partition file version 2
rootfstype squashfs root /dev/mtdblock5
fail to load bootargsParameters.txt
fail to load bootargsParameters.txt file
Adjust Memory Allocation, dram_size=0x8200000, dsp_ram.start=0x8400000, dsp_ram.size=0x17c00000

Starting kernel …
ÿ

U-Boot 2010.06-svn4911 (Sep 20 2017 - 17:22:29)
I2C:   ready
DRAM:  118 MiB
gBootLogPtr:00b80008.
spinor flash ID is 0x1940ef
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=130M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc.
TEXT_BASE:01000000
Net:   Detected MACID:38:af:29:9a:e6:2d
PHY:0x03625cc6,addr:0x01
s3l 55k+bcm54811 init

MMC:   sdmmc init
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.251; sending through gateway 192.168.1.1
Download Filename ‘upgrade_info_7db780a713a4.txt’.
Download to address: 0x5000000
Downloading: *
Retry count exceeded; starting again
Try again use backup_serverip
*** ERROR: `serverip’ not set
Failed to get info.txt
Fail to get info file!
Init error!
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.251; sending through gateway 192.168.1.1
Download Filename ‘failed.txt’.
Download to address: 0x2000000
Downloading: *
Retry count exceeded; starting again
Support backupVer:255
state:ff,err_count:02
SPI probe: 32768 KiB W25Q256FV at 0:0 is now current device
## Booting kernel from Legacy Image at 02000000 …
   Image Name:   Linux-3.10.73
   Created:      2018-01-24  13:25:17 UTC
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    1569484 Bytes = 1.5 MiB
   Load Address: 00208000
   Entry Point:  00208000
   Verifying Checksum … OK
   Loading Kernel Image …OK
OK
partition file version 2
rootfstype squashfs root /dev/mtdblock5
fail to load bootargsParameters.txt
fail to load bootargsParameters.txt file
Adjust Memory Allocation, dram_size=0x8200000, dsp_ram.start=0x8400000, dsp_ram.size=0x17c00000

Starting kernel …
þ

U-Boot 2010.06-svn4911 (Sep 20 2017 - 17:22:29)
I2C:   ready
DRAM:  118 MiB
gBootLogPtr:00b80008.
spinor flash ID is 0x1940ef
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=130M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc.
TEXT_BASE:01000000
Net:   Detected MACID:38:af:29:9a:e6:2d
PHY:0x03625cc6,addr:0x01
s3l 55k+bcm54811 init

MMC:   sdmmc init
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.251; sending through gateway 192.168.1.1
Download Filename ‘upgrade_info_7db780a713a4.txt’.
Download to address: 0x5000000
Downloading: *
Retry count exceeded; starting again
Try again use backup_serverip
*** ERROR: `serverip’ not set
Failed to get info.txt
Fail to get info file!
Init error!
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.251; sending through gateway 192.168.1.1
Download Filename ‘failed.txt’.
Download to address: 0x2000000
Downloading: *
Retry count exceeded; starting again
Support backupVer:255
state:ff,err_count:03
SPI probe: 32768 KiB W25Q256FV at 0:0 is now current device
## Booting kernel from Legacy Image at 02000000 …
   Image Name:   Linux-3.10.73
   Created:      2018-01-24  13:25:17 UTC
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    1569484 Bytes = 1.5 MiB
   Load Address: 00208000
   Entry Point:  00208000
   Verifying Checksum … OK
   Loading Kernel Image …OK
OK
partition file version 2
rootfstype squashfs root /dev/mtdblock5
fail to load bootargsParameters.txt
fail to load bootargsParameters.txt file
Adjust Memory Allocation, dram_size=0x8200000, dsp_ram.start=0x8400000, dsp_ram.size=0x17c00000

Starting kernel …
þ

U-Boot 2010.06-svn4911 (Sep 20 2017 - 17:22:29)
I2C:   ready
DRAM:  118 MiB
gBootLogPtr:00b80008.
spinor flash ID is 0x1940ef
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=130M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc.
TEXT_BASE:01000000
Net:   Detected MACID:38:af:29:9a:e6:2d
PHY:0x03625cc6,addr:0x01
s3l 55k+bcm54811 init

MMC:   sdmmc init
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.251; sending through gateway 192.168.1.1
Download Filename ‘upgrade_info_7db780a713a4.txt’.
Download to address: 0x5000000
Downloading: *
Retry count exceeded; starting again
Try again use backup_serverip
*** ERROR: `serverip’ not set
Failed to get info.txt
Fail to get info file!
Init error!
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.251; sending through gateway 192.168.1.1
Download Filename ‘failed.txt’.
Download to address: 0x2000000
Downloading: *
Retry count exceeded; starting again
Support backupVer:255
state:ff,err_count:04
SPI probe: 32768 KiB W25Q256FV at 0:0 is now current device
## Booting kernel from Legacy Image at 02000000 …
   Image Name:   Linux-3.10.73
   Created:      2018-01-24  13:25:17 UTC
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    1569484 Bytes = 1.5 MiB
   Load Address: 00208000
   Entry Point:  00208000
   Verifying Checksum … OK
   Loading Kernel Image …OK
OK
partition file version 2
rootfstype squashfs root /dev/mtdblock5
fail to load bootargsParameters.txt
fail to load bootargsParameters.txt file
Adjust Memory Allocation, dram_size=0x8200000, dsp_ram.start=0x8400000, dsp_ram.size=0x17c00000

Starting kernel …
ÿ

U-Boot 2010.06-svn4911 (Sep 20 2017 - 17:22:29)
I2C:   ready
DRAM:  118 MiB
gBootLogPtr:00b80008.
spinor flash ID is 0x1940ef
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=130M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc.
TEXT_BASE:01000000
Net:   Detected MACID:38:af:29:9a:e6:2d
PHY:0x03625cc6,addr:0x01
s3l 55k+bcm54811 init

MMC:   sdmmc init
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.251; sending through gateway 192.168.1.1
Download Filename ‘upgrade_info_7db780a713a4.txt’.
Download to address: 0x5000000
Downloading: *
Retry count exceeded; starting again
Try again use backup_serverip
*** ERROR: `serverip’ not set
Failed to get info.txt
Fail to get info file!
Init error!
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.251; sending through gateway 192.168.1.1
Download Filename ‘failed.txt’.
Download to address: 0x2000000
Downloading: *
Retry count exceeded; starting again
Support backupVer:255
state:ff,err_count:05
SPI probe: 32768 KiB W25Q256FV at 0:0 is now current device
Wrong Image Format for bootm command
ERROR: can’t get kernel image!
try:kload 0x2000000 succeed!
## Booting kernel from Legacy Image at 02000000 …
   Image Name:   Linux-3.10.73
   Created:      2018-01-24  13:25:17 UTC
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    1569484 Bytes = 1.5 MiB
   Load Address: 00208000
   Entry Point:  00208000
   Verifying Checksum … OK
   Loading Kernel Image …OK
OK
partition file version 2
rootfstype squashfs root /dev/mtdblock5
fail to load bootargsParameters.txt
fail to load bootargsParameters.txt file
get bootargs info failed
Adjust Memory Allocation, dram_size=0x8200000, dsp_ram.start=0x8400000, dsp_ram.size=0x17c00000
crashflasg:1, logmagic:54410011.

Starting kernel …

I did the memtest ("mtest" command) and it didn't show any errors. There are no damaged components on the pcb. I've replaced 2 electrolytic caps. Checked all the capacitors for shorts. Everything looks good.

What else should I check/try?

Edit:
I have found new firmware (DH_IPC-HX5X3X-Rhea_MultiLang_PN_Stream3_V2.800.0000015.0.R.200430.zip) which included update.img and I was able to run:
run up

and it installed all needed software and the camera is up and running

 

[PgXme2]

These, and the tftp update problem, suggest that the ethernet connection is not working.
Presumably there is no link detect LED on the switch port it's connected to.

Could the RJ45 connector be corroded?
Any other things that might damage the ethernet connection?

I checked the Rj45 connector and measured all pins from the Rj45 connector to the PCB, it seems all to be fine. I see that the yellow switch led blinks on the switch port in a 3-4 seconds delay.

I assume that the network IC on the PCB has a malfunction. Does anybody know if it can be replaced? Solder station is available on my side.

Thanks

 

[DionV]

Hi Guys,

Can anyone help me with this, please?
My main issue is that my camera is in a boot loop. I can verify that with pings and serial. Because serial repeats the boot message after a few seconds.
I connected the UART with serial but when I power up the camera I only got this from putty:

Spoiler: Output

IPL 3b490ba
D-0a
128MB
BIST0_0001-OK
Load IPL_CUST from SPINAND
CIS in Block00
Match CIS ID( c8 01 )

BlSize 00004780
Checksum OK

IPL_CUST 3b490ba
runUBOOT()
CIS in Block00
Match CIS ID( c8 01 )
ChkHealthy: 0003: 0007: 0000
ChkHealthy: 0004: 0007: 0000
ChkHealthy: 0005: 0007: 0000

Load BL from SPINAND
-Verify CRC32 passed!
-Decompress XZ
u32HeaderSize=0x00000040
u32Loadsize=0x00006a10
decomp_size=0x0000f47c
Disable MMU and D-cache before jump to UBOOT

U-Boot 2010.06-svn8930 (Apr 14 2021 - 22:06:06)

After the U-Boot line there come a few spaces and then it stops displaying. I also tried holding down the * button but nothing happens.
After a few seconds, the camera restarts and gives the same information.

 

[cooleach]

Is it possible to flash from sd cards ?

Spoiler: Output

IPL fd8e347
D-0a
128MB
BIST0_0001-OK
Load IPL_CUST from SPINAND
CIS in Block00
Match CIS ID( c8 01 )

BlSize 00004780
Checksum OK

IPL_CUST fd8e347
runUBOOT()
CIS in Block00
Match CIS ID( c8 01 )
ChkHealthy: 0003: 0007: 0000
ChkHealthy: 0004: 0007: 0000
ChkHealthy: 0005: 0007: 0000

Load BL from SPINAND
-Verify CRC32 passed!
-Decompress XZ
u32HeaderSize=0x00000040
u32Loadsize=0x00006948
decomp_size=0x0000f294
Disable MMU and D-cache before jump to UBOOT

camera imou-IPC-K42P.

 

[pjotr_weliki]

I also tried holding down the * button

Try hold down shift button and the * button at the same time.

here is my manual in german. Use Google Translate to help. Link

 

[DionV]

Try hold down shift button and the * button at the same time.
here is my manual in german. Use Google Translate to help. Link

Hi,

Yes for the asterisk you need to hold down shift. It's not working.

 

[DionV]

Also when I connect the ground to the metal casing I get no input. With no ground, I get the input as above. Still not going further then the uboot messege

 

[n0xlf]

Any suggestions on where to look for the serial header? I have a SD6AL830V-HNI and Dahua claims it should be next to the microSD slot but clearly that isn't the case.



I don't see any other 4 pin headers/holes, but this thing is packed full of PCBs with the laser module and all..

At $1400, I'd rather not throw this one away! I had to TFTP flash it about a year ago so it's possible that the NAND is bad, but I'd feel better knowing that via a serial connection.