Dahua IPC unbricking / recovery over serial UART and TFTP

Wael · Dec 14, 2022

n0xlf said:
Any suggestions on where to look for the serial header? I have a SD6AL830V-HNI and Dahua claims it should be next to the microSD slot but clearly that isn't the case.

View attachment 148191

I don't see any other 4 pin headers/holes, but this thing is packed full of PCBs with the laser module and all..

At $1400, I'd rather not throw this one away! I had to TFTP flash it about a year ago so it's possible that the NAND is bad, but I'd feel better knowing that via a serial connection.

I don't see it in the photo you provided. Maybe look on the bottom side of that board or check the other boards? From my experience of other models it's usually 4 holes where a connector should be

mastec · Dec 15, 2022

n0xlf said:
Any suggestions on where to look for the serial header? I have a SD6AL830V-HNI and Dahua claims it should be next to the microSD slot but clearly that isn't the case.

View attachment 148191

I don't see any other 4 pin headers/holes, but this thing is packed full of PCBs with the laser module and all..

At $1400, I'd rather not throw this one away! I had to TFTP flash it about a year ago so it's possible that the NAND is bad, but I'd feel better knowing that via a serial connection.

I think it might be in the board bellow the microSD board.

n0xlf · Dec 15, 2022

Thought it might be this but these all have power on them, ranging from 2-7.9VDC..

mastec · Dec 26, 2022

n0xlf said:
might be this but these all have power on them, ranging from 2-7.9VDC

}

If there is more then 5 Volts on any of the contacts , it can´t be it. It has to have the following voltage on the board

Wael · Dec 27, 2022

n0xlf said:
Thought it might be this but these all have power on them, ranging from 2-7.9VDC..

View attachment 148336

I’m going to say no on these pins. They are labeled “H_Motor”

n0xlf · Dec 27, 2022

Yeah, I figured out pretty quickly that it wasn't it. H_MOTOR aside, I'm getting desperate. There's just nothing left to try...I've metered everything I can see.

The next step is to start tearing things even further apart - I was trying to avoid that step!

marcus85 · Feb 23, 2023

Hi, I've problem with my camera HFW-4631M-AS. Connection UART should be correct but command "help" not working and show me "
Built-in commands:
------------------
. : alias bg break cd chdir continue eval exec exit export false
fg hash help jobs kill let local pwd read readonly return set
shift source times trap true type ulimit umask unalias unset
wait "

U-Boot 2010.06-svn4911 (Sep 20 2017 - 17:22:29)
I2C: ready
DRAM: 118 MiB
gBootLogPtr:00b80008.
spinor flash ID is 0x1940ef
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=130M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc.
TEXT_BASE:01000000
Net: Detected MACID:14:a7:8b:82:e0:58
PHY:0x001cc816,addr:0x00
s3l phy RTL8201 init

MMC: sdmmc init
link down
link down
Try again use backup_serverip
link down
Failed to get info.txt
Fail to get info file!
Init error!
link down
Support backupVer:255
state:ff,err_count:01
SPI probe: 32768 KiB W25Q256FV at 0:0 is now current device
## Booting kernel from Legacy Image at 02000000 ...
Image Name: Linux-3.10.73
Created: 2017-11-09 22:03:10 UTC
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 1569588 Bytes = 1.5 MiB
Load Address: 00208000
Entry Point: 00208000
Verifying Checksum ... Bad Data CRC
ERROR: can't get kernel image!
try:kload 0x2000000 succeed!
## Booting kernel from Legacy Image at 02000000 ...
Image Name: Linux-3.10.73
Created: 2017-11-09 22:03:10 UTC
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 1569588 Bytes = 1.5 MiB
Load Address: 00208000
Entry Point: 00208000
Verifying Checksum ... Bad Data CRC
ERROR:kload failed!resetting ...
▒

U-Boot 2010.06-svn4911 (Sep 20 2017 - 17:22:29)
I2C: ready
DRAM: 118 MiB
gBootLogPtr:00b80008.
spinor flash ID is 0x1940ef
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=130M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc.
TEXT_BASE:01000000
Net: Detected MACID:14:a7:8b:82:e0:58
PHY:0x001cc816,addr:0x00
s3l phy RTL8201 init

MMC: sdmmc init
link down
link down
Try again use backup_serverip
link down
Failed to get info.txt
Fail to get info file!
Init error!
link down
Support backupVer:255
state:ff,err_count:02
SPI probe: 32768 KiB W25Q256FV at 0:0 is now current device
## Booting kernel from Legacy Image at 02000000 ...
Image Name: Linux-3.10.73
Created: 2017-11-09 22:03:10 UTC
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 1569588 Bytes = 1.5 MiB
Load Address: 00208000
Entry Point: 00208000
Verifying Checksum ... Bad Data CRC
ERROR: can't get kernel image!
try:kload 0x2000000 succeed!
## Booting kernel from Legacy Image at 02000000 ...
Image Name: Linux-3.10.73
Created: 2017-11-09 22:03:10 UTC
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 1569588 Bytes = 1.5 MiB
Load Address: 00208000
Entry Point: 00208000
Verifying Checksum ... Bad Data CRC
ERROR:kload failed!resetting ...
▒

U-Boot 2010.06-svn4911 (Sep 20 2017 - 17:22:29)
I2C: ready
DRAM: 118 MiB
gBootLogPtr:00b80008.
spinor flash ID is 0x1940ef
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=130M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc.
TEXT_BASE:01000000
Net: Detected MACID:14:a7:8b:82:e0:58
PHY:0x001cc816,addr:0x00
s3l phy RTL8201 init

MMC: sdmmc init
link down
link down
Try again use backup_serverip
link down
Failed to get info.txt
Fail to get info file!
Init error!
link down
Support backupVer:255
state:ff,err_count:03
SPI probe: 32768 KiB W25Q256FV at 0:0 is now current device
## Booting kernel from Legacy Image at 02000000 ...
Image Name: Linux-3.10.73
Created: 2017-11-09 22:03:10 UTC
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 1569588 Bytes = 1.5 MiB
Load Address: 00208000
Entry Point: 00208000
Verifying Checksum ... Bad Data CRC
ERROR: can't get kernel image!
try:kload 0x2000000 succeed!
## Booting kernel from Legacy Image at 02000000 ...
Image Name: Linux-3.10.73
Created: 2017-11-09 22:03:10 UTC
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 1569588 Bytes = 1.5 MiB
Load Address: 00208000
Entry Point: 00208000
Verifying Checksum ... Bad Data CRC
ERROR:kload failed!resetting ...
▒

U-Boot 2010.06-svn4911 (Sep 20 2017 - 17:22:29)
I2C: ready
DRAM: 118 MiB
gBootLogPtr:00b80008.
spinor flash ID is 0x1940ef
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=130M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc.
TEXT_BASE:01000000
Net: Detected MACID:14:a7:8b:82:e0:58
PHY:0x001cc816,addr:0x00
s3l phy RTL8201 init

MMC: sdmmc init
link down
link down
Try again use backup_serverip
link down
Failed to get info.txt
Fail to get info file!
Init error!
link down
Support backupVer:255
state:ff,err_count:04
SPI probe: 32768 KiB W25Q256FV at 0:0 is now current device
## Booting kernel from Legacy Image at 02000000 ...
Image Name: Linux-3.10.73
Created: 2017-11-09 22:03:10 UTC
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 1569588 Bytes = 1.5 MiB
Load Address: 00208000
Entry Point: 00208000
Verifying Checksum ... Bad Data CRC
ERROR: can't get kernel image!
try:kload 0x2000000 succeed!
## Booting kernel from Legacy Image at 02000000 ...
Image Name: Linux-3.10.73
Created: 2017-11-09 22:03:10 UTC
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 1569588 Bytes = 1.5 MiB
Load Address: 00208000
Entry Point: 00208000
Verifying Checksum ... Bad Data CRC
ERROR:kload failed!resetting ...
▒

U-Boot 2010.06-svn4911 (Sep 20 2017 - 17:22:29)
I2C: ready
DRAM: 118 MiB
gBootLogPtr:00b80008.
spinor flash ID is 0x1940ef
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=130M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc.
TEXT_BASE:01000000
Net: Detected MACID:14:a7:8b:82:e0:58
PHY:0x001cc816,addr:0x00
s3l phy RTL8201 init

MMC: sdmmc init
link down
link down
Try again use backup_serverip
link down
Failed to get info.txt
Fail to get info file!
Init error!
link down
Support backupVer:255
state:ff,err_count:05
SPI probe: 32768 KiB W25Q256FV at 0:0 is now current device
## Booting kernel from Legacy Image at 02000000 ...
Image Name: Linux-3.10.73
Created: 2017-05-19 0:18:18 UTC
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 916644 Bytes = 895.2 KiB
Load Address: 00208000
Entry Point: 00208000
Verifying Checksum ... OK
Loading Kernel Image ...OK
OK
partition file version 2
rootfstype squashfs root /dev/mtdblock5
fail to load bootargsParameters.txt
fail to load bootargsParameters.txt file
get bootargs info failed
Adjust Memory Allocation, dram_size=0x8200000, dsp_ram.start=0x8400000, dsp_ram.size=0x17c00000
crashflasg:1, logmagic:54410011.

Starting kernel ...
init started: BusyBox v1.18.4 (2016-11-14 11:17:47 CST)
mount: mounting none on /proc/bus/usb failed: No such file or directory
mount: mounting tmpfs on /var failed: Invalid argument
mount: mounting /dev/mtdblock3 on /mnt/custom failed: Invalid argument
mount: mounting /dev/mtdblock4 on /mnt/pd failed: Invalid argument
mount: mounting /dev/mtdblock7 on /mnt/web failed: Invalid argument
mount: mounting /dev/mtdblock8 on /mnt/afix/autoFix failed: Invalid argument
mount: mounting /dev/mtdblock9 on /mnt/afix/autoFixBackup failed: Invalid argument

BusyBox v1.18.4 (2016-11-14 11:17:47 CST) built-in shell (ash)
Revision: 20442
Enter 'help' for a list of built-in commands.

/bin/sh: can't access tty; job control turned off
~ # UPGRADED_MSG: Do memlock
[libpdi] Support backup partition !!!
[libpdi] Flashtype = 3,patSize = 40000,rwSize = 10000,ersSize = 10000
pPartionId = 9
eth0:
MAC: <14:a7:8b:82:e0:58>
[libpdi] ERROR (save_Attr_file|1269): open failed for PRIO[libpdi] set eth0 as defaultEth
IP: <192.168.1.108> netmask: <255.255.255.0>
[libpdi] ERROR (save_Attr_file|1269): open failed for HOSTIP[libpdi] ERROR (PDI_rtcWriteSram|162): Fail to ioctl rtc
[libpdi] ERROR (SaveEthAttrInFile|1368): Fail to write ip paramenters
[libpdi] ERROR (save_Attr_file|1269): open failed for SUBMASK[libpdi] ERROR (PDI_rtcWriteSram|162): Fail to ioctl rtc
[libpdi] ERROR (SaveEthAttrInFile|1368): Fail to write ip paramenters
SOCK_PACKET: Address family not supported by protocol
[libpdi] [libPDI] Gateway: <192.168.1.1>
[libpdi] SetGateWay success
[libpdi] ERROR (save_Attr_file|1269): open failed for GATEWAYIP[libpdi] ERROR (PDI_rtcWriteSram|162): Fail to ioctl rtc
[libpdi] ERROR (SaveEthAttrInFile|1368): Fail to write ip paramenters
SOCK_PACKET: Address family not supported by protocol
[libpdi] [libPDI] Name: upgraded, bulid date: Apr 13 2015 15:03:44, svn: 492
UPGRADED_MSG: start download file!

Do you have something idea? or solutions?

alastairstevenson · Feb 23, 2023

marcus85 said:
Connection UART should be correct but command "help" not working

You need to interrupt the bootloader in order to get bootloader command line.
Keep * pressed till it autorepeats then power the camera on.

marcus85 · Feb 23, 2023

THANKs

I must click shift+8. Ok next step change firmware

jazzy1 · Feb 23, 2023

Anyone been able to revive a 5231?? I’ve had a couple kind of die. But upon opening them I can see the power light on and know they’re powering up. My suspicion is a bad firmware flash. Would be a waste to throw them away. Hopefully can bring them back to life !

marcus85 · Feb 23, 2023

Next my problem with:

ping $serverip

Using ambarella mac device

ARP Retry count exceeded; starting again
ping failed; host 192.168.1.4 is not alive

printenv

bootargs=console=ttyS0,115200 mem=118M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc
bootcmd=sf read 0x2000000 0xf0000 0x180000;bootm 0x2000000
bootdelay=3
baudrate=115200
autoload=yes
da=tftp 0x02000000 dhboot.bin.img; flwrite;tftp dhboot-min.bin.img;flwrite
dr=tftp 0x02000000 romfs-x.squashfs.img; flwrite
dk=tftp 0x02000000 kernel.img; flwrite
du=tftp 0x02000000 user-x.squashfs.img; flwrite
dw=tftp 0x02000000 web-x.squashfs.img; flwrite
dp=tftp 0x02000000 partition-x.cramfs.img;flwrite
dc=tftp 0x02000000 custom-x.squashfs.img; flwrite
up=tftp 0x02000000 update.img; flwrite
tk=tftp 0x02000000 uImage; bootm
dh_keyboard=1
sysbackup=1
logserver=127.0.0.1
loglevel=4
autosip=192.168.254.254
autolip=192.168.1.108
autogw=192.168.1.1
autonm=255.255.255.0
pd=tftp 0x02000000 pd-x.squashfs.img; flwrite
ethact=ambarella mac
BSN=3F01884YAQ00015
HWID=IPC-HFW5631MK-AS:01:02:02:5F:21:00:01:0E:01:01:04:2D0:08:00:00:00:00:01:00:00:200
hwidEx=00:02:00:00:00:00:00:01:00:00:00:00:00:00:00:00
devalias=IPC-HFW4631M-AS-I2
ID=3K00C98PAU00001
ethaddr=14:A7:8B:82:E0:58
appauto=1
filesize=20040
fileaddr=2000000
gatewayip=192.168.1.1
netmask=255.255.255.0
ipaddr=192.168.1.108
stdin=serial
stdout=serial
stderr=serial
serverip=192.168.1.4

Environment size: 1238/131068 bytes

alastairstevenson · Feb 23, 2023

What's the problem?
Looks like your tftp server is not accessible.

marcus85 · Feb 25, 2023

Ok, I'm write commend's and nothing. Where is problem?? firmware name: DH_IPC-HX5X3X-Rhea_Chn_PN_Stream3_V2.800.0000024.0.R.211122 with chinese web.

▒UBL_loadImg bakVersion=20, bootVersion=20

U-Boot 2010.06-svn8545 (Nov 24 2020 - 13:51:18)
▒UBL_loadImg bakVersion=20, bootVersion=20

U-Boot 2010.06-svn8545 (Nov 24 2020 - 13:51:18)

run dr

Using ambarella mac device
Download Filename 'romfs-x.squashfs.img'.
Downloading: 100%
## file size: 3.9 MiB, times: 3s, speed: 1.1 MiB/s
done
Bytes transferred = 4073720 (3e28f8 hex)
curVer:V1.4 <= newVer:V2.0,verCompare success!
UBOOT_commonSwRsaVerify run successfully!

## Checking Image at 02000000 ...
Legacy image found
Image Name: romfs
Created: 2021-11-22 2:29:51 UTC
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 4071424 Bytes = 3.9 MiB
Load Address: 01b80000
Entry Point: 01fd0000
Verifying Checksum ... OK
Programing start at: 0x01b80000 for romfs
SPI probe: 32768 KiB W25Q256FV at 0:1 is now current device
write : 100%
done
crc from program is :0, crc from flash is :0
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=130M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc.

run dk

Using ambarella mac device
Download Filename 'kernel.img'.
Downloading: 100%
## file size: 1.5 MiB, times: 4s, speed: 313.5 KiB/s
done
Bytes transferred = 1589296 (184030 hex)
curVer:V1.4 <= newVer:V2.0,verCompare success!
UBOOT_commonSwRsaVerify run successfully!

## Checking Image at 02000000 ...
Legacy image found
Image Name: kernel
Created: 2021-11-22 2:22:55 UTC
Image Type: ARM Linux Firmware (uncompressed)
Data Size: 1587000 Bytes = 1.5 MiB
Load Address: 01040000
Entry Point: 01200000
Verifying Checksum ... OK
Programing start at: 0x01040000 for kernel
SPI probe: 32768 KiB W25Q256FV at 0:1 is now current device
write : 100%
done
crc from program is :0, crc from flash is :0
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=130M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc.

run du

Using ambarella mac device
Download Filename 'user-x.squashfs.img'.
Downloading: 100% 100%
## file size: 14.7 MiB, times: 23s, speed: 653.3 KiB/s
done
Bytes transferred = 15436024 (eb88f8 hex)
curVer:V1.4 <= newVer:V2.0,verCompare success!
UBOOT_commonSwRsaVerify run successfully!

## Checking Image at 02000000 ...
Legacy image found
Image Name: user
Created: 2021-11-22 2:29:37 UTC
Image Type: ARM Linux Standalone Program (uncompressed)
Data Size: 15433728 Bytes = 14.7 MiB
Load Address: 000f0000
Entry Point: 01000000
Verifying Checksum ... OK
Programing start at: 0x000f0000 for user
write : 100%
done
crc from program is :0, crc from flash is :0
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=130M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc.

run dw

Using ambarella mac device
Download Filename 'web-x.squashfs.img'.
Downloading: 100%
## file size: 5.2 MiB, times: 11s, speed: 459 KiB/s
done
Bytes transferred = 5413112 (5298f8 hex)
curVer:V1.4 <= newVer:V2.0,verCompare success!
UBOOT_commonSwRsaVerify run successfully!

## Checking Image at 02000000 ...
Legacy image found
Image Name: web
Created: 2021-11-22 2:29:14 UTC
Image Type: ARM Linux Standalone Program (uncompressed)
Data Size: 5410816 Bytes = 5.2 MiB
Load Address: 01200000
Entry Point: 01880000
Verifying Checksum ... OK
Programing start at: 0x01200000 for web
SPI probe: 32768 KiB W25Q256FV at 0:1 is now current device
write : 100%
done
crc from program is :0, crc from flash is :0
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=130M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc.

run dp

Using ambarella mac device
Download Filename 'partition-x.cramfs.img'.
Downloading: 100%
## file size: 10.2 KiB, times: 0s, speed: 787.1 KiB/s
done
Bytes transferred = 10488 (28f8 hex)
curVer:V1.4 <= newVer:V2.0,verCompare success!
UBOOT_commonSwRsaVerify run successfully!

## Checking Image at 02000000 ...
Legacy image found
Image Name: partition
Created: 2021-11-22 2:22:54 UTC
Image Type: ARM Linux Standalone Program (uncompressed)
Data Size: 8192 Bytes = 8 KiB
Load Address: 000e0000
Entry Point: 000f0000
Verifying Checksum ... OK
Programing start at: 0x000e0000 for partition
write : 100%
done
crc from program is :0, crc from flash is :0
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=130M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc.

run dc

Using ambarella mac device
Download Filename 'custom-x.squashfs.img'.
Downloading: 100%
## file size: 82.2 KiB, times: 1s, speed: 63.5 KiB/s
done
Bytes transferred = 84216 (148f8 hex)
curVer:V1.4 <= newVer:V2.0,verCompare success!
UBOOT_commonSwRsaVerify run successfully!

## Checking Image at 02000000 ...
Legacy image found
Image Name: custom
Created: 2021-11-22 2:32:17 UTC
Image Type: ARM Linux Standalone Program (uncompressed)
Data Size: 81920 Bytes = 80 KiB
Load Address: 018a0000
Entry Point: 01970000
Verifying Checksum ... OK
Programing start at: 0x018a0000 for custom
SPI probe: 32768 KiB W25Q256FV at 0:1 is now current device
write : 100%
done
crc from program is :0, crc from flash is :0
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=130M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc.

boot

Wrong Image Format for bootm command
ERROR: can't get kernel image!
try:kload 0x2000000 succeed!
Verifying Checksum ... OK
partition file version 2
rootfstype squashfs root /dev/mtdblock5
curVer:V1.4 <= newVer:V2.0,verCompare success!
UBOOT_commonSwRsaVerify run successfully!
Loading Kernel Image ...OK
OK
partition file version 2
rootfstype squashfs root /dev/mtdblock5
fail to load bootargsParameters.txt
fail to load bootargsParameters.txt file
Adjust Memory Allocation, dram_size=0x8200000, dsp_ram.start=0x8400000, dsp_ram.size=0x17c00000
Adjust Memory Allocation, dram_size=0x8200000, dsp_ram.start=0x8400000, dsp_ram.size=0x17c00000
fail to load bootargsParameters.txt
fail to load bootargsParameters.txt file

Starting kernel ...
partition file version 2
rootfstype squashfs root /dev/mtdblock5
half-boot found, check bst
▒UBL_loadImg bakVersion=20, bootVersion=20

U-Boot 2010.06-svn8545 (Nov 24 2020 - 13:51:18)

Ok, I'm find solution

only one missing commend "run pd" maybe help this sugestion

erdilmen · Feb 28, 2023

Dear friends
im have dahua xvr5216an-i3
I need do downgrade firmware , im communicating via putty without problem.But im unable write bin file with tftp server.
Can anyone please asist me?
Best Regards

alastairstevenson · Feb 28, 2023

erdilmen said:
im unable write bin file with tftp server.
Can anyone please asist me?

We need to know some actual detail of what you are trying before we can provide useful suggestions.

iTuneDVR · Feb 28, 2023

erdilmen said:
Dear friends
im have dahua xvr5216an-i3
I need do downgrade firmware , im communicating via putty without problem.But im unable write bin file with tftp server.
Can anyone please asist me?
Best Regards

unpack firmware bin using winrar and use part's fo tftp update using template run <command>
printenv
and you see this
or you need update.img file
what firmware version?

erdilmen · Feb 28, 2023

iTuneDVR said:
unpack firmware bin using winrar and use part's fo tftp update using template run <command>
printenv
and you see this
or you need update.img file
what firmware version?

DH_XVR5x16-I3_MultiLang_V4.001.0000001.5.R.220630 on xvr
i want to make it DH_XVR5x16-I3_MultiLang_V4.001.0000000.17.R.211230.
i have files , im using putty , setting ips .But not writing fw via tftp

iTuneDVR · Feb 28, 2023

erdilmen said:
i want to make it DH_XVR5x16-I3_MultiLang_V4.001.0000000.17.R.211230.

if security the same unpack attach as update.img to the tftp dir, setup env ip & type at bootloader
run up

erdilmen · Feb 28, 2023

nvt@na51090: setenv serverip 192.168.31.141
serverip=192.168.31.141
nvt@na51090: setenv ipaddr 192.168.31.199
ipaddr=192.168.31.199
nvt@na51090: saveenv
Saving Environment to NAND... Erasing NAND...
Erasing at 0x320000 -- 100% complete.
Writing to NAND... OK
Erasing at 0x340000 -- 100% complete.
Erasing at 0x3c0000 -- 100% complete.
OK
nvt@na51090: run da
Using eth0 device
TFTP from server 192.168.31.141; our IP address is 192.168.31.199
Filename 'u-boot.bin.img'.
timeout_count up to 10
Load address: 0x7800000
Loading: T T T T T T T T T T
Retry count exceeded; starting again
connect frondboard!
resetting ...

iTuneDVR · Feb 28, 2023

erdilmen said:
Loading: T T T T T T T T T T

printenv

setenv gateway ....

Dahua IPC unbricking / recovery over serial UART and TFTP

Getting the hang of it

n3wb

Getting the hang of it

n3wb

Getting the hang of it

Getting the hang of it

n3wb

n3wb

Getting the hang of it

n3wb

n3wb

Attachments

n3wb

Pulling my weight

n3wb

Pulling my weight

Attachments

n3wb

Pulling my weight