Dahua IPC unbricking / recovery over serial UART and TFTP

@djlp
Now I got my bricked VTO back and tried the solution of your linked procedure but I got an Problem.
With wireshark I see that the VTO is trying to get Firmware over TFTP. So far so good :)

But when I run the Console.bat NCat starts and nothing more happens :(
I tried this to get correct information for Command.txt

Do you have an right Command.txt so that I could begin to Flash Firmware?

Thx Forward :)
 
Allodo said:
@djlp
Thx for the link :)

I tried it with "No Risk, No Fun" and now my VTO works again :)
Click to expand...

I'm glad you got your VTO working again.

Here is the contents of my commands.txt for future reference:

run dc
run dr
run du
run dd
run dw
run dk
run up
tftp 0x82000000 pd-x.cramfs.img; flwrite
tftp 0x82000000 .FLASHING_DONE_STOP_TFTP_NOW
sleep 5
 
Unbriked a brand new XVR5116HE using this post , thank you very much you have a lots of free beer when you come to Spain :)
 
Hi,
I am trying to recover a hdbw-5231r-z after bricking by using SmartPSS and p2p connected device the newest firmware upgrade. (This is generally working, the first cam has upgraded fine, the second has gone).

But I press * all time long, nothing changed. I see the led on the RS232 USB Stick is flashing fast when I constant press *.

what can this be?
Code: 
▒

U-Boot 2010.06-svn4911 (Sep 04 2017 - 11:31:28)
I2C:   ready
DRAM:  118 MiB
gBootLogPtr:00b80008.
spinor flash ID is 0x1940ef
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=118M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc.
TEXT_BASE:01000000
Net:   Detected MACID:e0:50:8b:11:04:11
PHY:0x001cc816,addr:0x00
s3l phy RTL8201 init

MMC:   sdmmc init
link down
link down
Try again use backup_serverip
link down
Failed to get info.txt
Fail to get info file!
Init error!
link down
Support backupVer:255
state:ff,err_count:01
SPI probe: 32768 KiB W25Q256FV at 0:0 is now current device
## Booting kernel from Legacy Image at 02000000 ...
   Image Name:   Linux-3.10.73
   Created:      2017-09-04   2:58:37 UTC
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    1534196 Bytes = 1.5 MiB
   Load Address: 00208000
   Entry Point:  00208000
   Verifying Checksum ... OK
   Loading Kernel Image ...OK
OK
partition file version 2
rootfstype squashfs root /dev/mtdblock5
fail to load bootargsParameters.txt
fail to load bootargsParameters.txt file
crashflasg:1, logmagic:54410011.

Starting kernel ...
▒
 
really strange the hole thing. I got it. But I don´t understand why. Maybe because of mobaxterm?
First of all:
Maybe because of the newer boatloader? I did those steps to stop autoboot:
- Try connection over serial until you see the posting above.
- disconnect cam (Is there a difference if the cam is only powered by poe or also connected to lan? I suppose not) don´t close terminal window
- Hold Star Key all time long then connect poe lan cable again, hold star key until you see ▒▒▒▒ ! It last a around a minute
- Press again star key and connect poe powered cable again, press star key all time long till you see stars. Don´t stop pressing till no stars are comming up.
- Disconnect again poe powered lan cable.
- hold star key again, connect poe powered cable again
- Now I see the next messages with press key to stop autoboot!
Now I can try to use tftp.
▒▒▒▒********************************************************************************************************************************************************************************************************************************************************************************************************************************************▒

U-Boot 2010.06-svn4911 (Sep 04 2017 - 11:31:28)
I2C: ready
DRAM: 118 MiB
gBootLogPtr:00b80008.
spinor flash ID is 0x1940ef
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=118M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc.
TEXT_BASE:01000000
Net: Detected MACID:e0:50:8b:11:04:11
PHY:0x001cc816,addr:0x00
s3l phy RTL8201 init

MMC: sdmmc init
Hit any key to stop autoboot: 0
>********************************************************************
Unknown command '********************************************************************' - try 'help'
Click to expand...
 
It seems to be a bad wire connection I fixed gnd now to the cardreader for having a perfect fixed ground. I tried to reproduce it, after several testings and fixing the cables again its now working normaly, just press only star key during connecting poe powered cable and after a few seconds without stop pressing star you see "hit any key to stop autoboot"
 
Something is still wrong?
Code: 
▒

U-Boot 2010.06-svn4911 (Sep 04 2017 - 11:31:28)
I2C:   ready
DRAM:  118 MiB
gBootLogPtr:00b80008.
spinor flash ID is 0x1940ef
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=118M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc.
TEXT_BASE:01000000
Net:   Detected MACID:e0:50:8b:11:04:11
PHY:0x001cc816,addr:0x00
s3l phy RTL8201 init

MMC:   sdmmc init
link down
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'upgrade_info_7db780a713a4.txt'.
Download to address: 0x5000000
Downloading: *
Retry count exceeded; starting again
Try again use backup_serverip
*** ERROR: `serverip' not set
Failed to get info.txt
Fail to get info file!
Init error!
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'failed.txt'.
Download to address: 0x2000000
Downloading: *
Retry count exceeded; starting again
Support backupVer:255
state:ff,err_count:04
SPI probe: 32768 KiB W25Q256FV at 0:0 is now current device
## Booting kernel from Legacy Image at 02000000 ...
   Image Name:   Linux-3.10.73
   Created:      2017-09-04   2:58:37 UTC
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    1534196 Bytes = 1.5 MiB
   Load Address: 00208000
   Entry Point:  00208000
   Verifying Checksum ... OK
   Loading Kernel Image ...OK
OK
partition file version 2
rootfstype squashfs root /dev/mtdblock5
fail to load bootargsParameters.txt
fail to load bootargsParameters.txt file
crashflasg:1, logmagic:54410011.

Starting kernel ...
▒

U-Boot 2010.06-svn4911 (Sep 04 2017 - 11:31:28)
I2C:   ready
DRAM:  118 MiB
gBootLogPtr:00b80008.
spinor flash ID is 0x1940ef
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=118M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc.
TEXT_BASE:01000000
Net:   Detected MACID:e0:50:8b:11:04:11
PHY:0x001cc816,addr:0x00
s3l phy RTL8201 init

MMC:   sdmmc init
Hit any key to stop autoboot:  0
>*********************************************
Unknown command '*********************************************' - try 'help'
>setenv ipaddr 192.168.0.19
>setenv gatewayip 192.168.0.1
>setenv netmask 255.255.255.0
>setenv serverip 192.168.0.78
>ping $serverip
Using ambarella mac device

Abort
ping failed; host 192.168.0.78 is not alive
>run dr
Using ambarella mac device
TFTP from server 192.168.0.78; our IP address is 192.168.0.19
Download Filename 'romfs-x.squashfs.img'.
Download to address: 0x2000000
Downloading: #################################################################
         #################################################################
         #################################################################
         ##############################################################
done
Bytes transferred = 1310784 (140040 hex)

## Checking Image at 02000000 ...
   Legacy image found
   Image Name:   romfs
   Created:      2017-09-04   7:52:44 UTC
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    1310720 Bytes = 1.3 MiB
   Load Address: 00270000
   Entry Point:  003c0000
   Verifying Checksum ... OK
Programing start at: 0x00270000
SPI probe: 32768 KiB W25Q256FV at 0:0 is now current device
write : 100%
done
>run dk
Using ambarella mac device
TFTP from server 192.168.0.78; our IP address is 192.168.0.19
Download Filename 'kernel.img'.
Download to address: 0x2000000
Downloading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         ########################################
done
Bytes transferred = 1534324 (176974 hex)

## Checking Image at 02000000 ...
   Legacy image found
   Image Name:   kernel
   Created:      2017-09-04   7:52:39 UTC
   Image Type:   ARM Linux Firmware (uncompressed)
   Data Size:    1534260 Bytes = 1.5 MiB
   Load Address: 000f0000
   Entry Point:  00270000
   Verifying Checksum ... OK
Programing start at: 0x000f0000
write : 100%
done
>run du
Using ambarella mac device
TFTP from server 192.168.0.78; our IP address is 192.168.0.19
Download Filename 'user-x.squashfs.img'.
Download to address: 0x2000000
Downloading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################
done
Bytes transferred = 15224896 (e85040 hex)

## Checking Image at 02000000 ...
   Legacy image found
   Image Name:   user
   Created:      2017-09-04   7:53:00 UTC
   Image Type:   ARM Linux Standalone Program (uncompressed)
   Data Size:    15224832 Bytes = 14.5 MiB
   Load Address: 00a40000
   Entry Point:  01a70000
   Verifying Checksum ... OK
Programing start at: 0x00a40000
write : 100%
done
>run dw
Using ambarella mac device
TFTP from server 192.168.0.78; our IP address is 192.168.0.19
Download Filename 'web-x.squashfs.img'.
Download to address: 0x2000000
Downloading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ######################
done
Bytes transferred = 6434880 (623040 hex)

## Checking Image at 02000000 ...
   Legacy image found
   Image Name:   web
   Created:      2017-09-04   7:52:46 UTC
   Image Type:   ARM Linux Standalone Program (uncompressed)
   Data Size:    6434816 Bytes = 6.1 MiB
   Load Address: 003c0000
   Entry Point:  00a40000
   Verifying Checksum ... OK
Programing start at: 0x003c0000
write : 100%
done
>run dp
Using ambarella mac device
TFTP from server 192.168.0.78; our IP address is 192.168.0.19
Download Filename 'partition-x.cramfs.img'.
Download to address: 0x2000000
Downloading: *
ARP Retry count exceeded; starting again
>run dc
Using ambarella mac device
TFTP from server 192.168.0.78; our IP address is 192.168.0.19
Download Filename 'custom-x.squashfs.img'.
Download to address: 0x2000000
Downloading: *
ARP Retry count exceeded; starting again
>save
Saving Environment to SPI Flash...
Erasing SPI flash...
Writing to SPI flash...
done
>

run dp and run dc looks strange.

after reboot it shows only starting kernel and nothing else, so I thought it hasn´t sucseeded. But I was wrong. After loading defaults with camera button it can configure it through config tool.
I didn´t checked if the serial output shows more than loading kernel and if this behavior is normal.
 
  • Like
Reactions: AAMamun
Hi !
Thanks a lot for all information.
howerver, i need more help :-)
i have a Dahua SD52C225U-HNI. i have uopgrade a wrong firmware last week and now, the cam won't start.

I have buy an USB/TTL key and find the RX and TX on the cam. GND is connected to a screw of the cam.

Connect over Serial with NCOM works fine. Its detect the * and i can enter command as setenv. But my problem is network !!!!

I set ipaddr, netmask and gateway... :

Printenv =>
ipaddr=192.168.1.108
serverip=192.168.1.1
gatewayip=192.168.1.1
netmask=

My computer is running TFTP Backup (computer ip is 1.108)
I see TFTP Request when the camera starts without press *

The big problem is when i launch commands via NCOM.
Commands likes "ping 192.168.108" or "run dr" returns :
=>ETH0: PHY(phyaddr=-1, rmii) not link!

I don't undestrand because my camera is powered by a 24V DC and my network is connected directly to my computer with a network crossed cable. And when the camera is powered normally (without *), i see the TFTP request on 192.168.254.254.

Strange but in this way, i can't do anything with my PTZ Dome.

Someone know command to activate Network card with shell UBoot commands ? or how to update firmware over serial (good ?!!)

Thanks a lot !
 
i have change gatewayip but nothing's better!

It's strange because on camera boot, it's detect network link and few seconds after, it's return no link.

Log of the cam boot with NCOM :

U-Boot 2010.06-svn3089 (Sep 12 2016 - 12:15:29)
DRAM: 1 GiB
gBootLogPtr:80b80008.
NAND: Check nand flash controller v610. found
Special NAND id table Version 1.36
Nand ID: 0x92 0xF1 0x80 0x95 0x40 0x7F 0x7F 0x7F
NAND_ECC_NONE selected by board driver. This is not recommended !!
128 MiB
partition file version 2
rootfstype squashfs root /dev/mtdblock7
In: serial
Out: serial
Err: serial
TEXT_BASE:81000000
Net: PHY found at 1

ETH0: PHY(phyaddr=-1, rmii) link UP: DUPLEX=FULL : SPEED=100M
MAC: 00-12-34-56-78-9A
Using gmac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'upgrade_info_7db780a713a4.txt'.
Download to address: 0x84000000
Downloading: #################################################
done
Bytes transferred = 69 (45 hex)
ETH0: PHY(phyaddr=-1, rmii) not link!
cmd Failed run dr!
partition file version 2
rootfstype squashfs root /dev/mtdblock7
fail to load bootargsParameters.txt
fail to load bootargsParameters.txt file
get bootargs info failed
cmdLine mem=256M console=ttyS0,115200 root=/dev/mtdblock7 rootfstype=squashfs
ETH0: PHY(phyaddr=-1, rmii) not link!
ETH0: PHY(phyaddr=-1, rmii) not link!
state:ff,err_count:01
## Booting kernel from Legacy Image at 82000000 ...
Image Name: Linux-3.4.35
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 2618288 Bytes = 2.5 MiB
Load Address: 80008000
Entry Point: 80008000
Loading Kernel Image ...OK
OK
partition file version 2
rootfstype squashfs root /dev/mtdblock7
fail to load bootargsParameters.txt
fail to load bootargsParameters.txt file
get bootargs info failed
cmdLine mem=256M console=ttyS0,115200 root=/dev/mtdblock7 rootfstype=squashfs
crashflasg:1, logmagic:54410011.

Starting kernel ...
Uncompressing Linux... done, booting the kernel.​
 
@neketom22 verify status of link light on computer. use a switch of no link light.
You mention using a crossover cable I think. try a normal ethernet cable. crossovers aren't needed with pretty much any computer from the last 10-15 years.
 
hi, can you post your printenv information please ? because mine seems to be wrond due to to wrong firmware ?
Thanks
 
neketom22 said:
hi, can you post your printenv information please ? because mine seems to be wrond due to to wrong firmware ?
Thanks
Click to expand...
I don't have this camera. Based on what you posed above, part of your problem is that you're setting the camera and your computer to the same exact ip address.
 
no, i have 192.168.1.1 on computer and 192.168.1.108 on cam. i have check via printenv, all network's parameters are OK

The problem is the cam have ethernet link up 2 sec on boot and stop immediatly after TFTP file check (upgrade_XXXXX.txt)

Strange !
 
neketom22 said:
no, i have 192.168.1.1 on computer and 192.168.1.108 on cam. i have check via printenv, all network's parameters are OK

The problem is the cam have ethernet link up 2 sec on boot and stop immediatly after TFTP file check (upgrade_XXXXX.txt)

Strange !
Click to expand...
Give this approach a try:
Dahua IPC EASY unbricking / recovery over TFTP
haha... oops this is what you were doing, but you may have missed a few steps.
 
Last edited:
Suggestion:
Interrupt the bootloader, and enable the ability to see the serial console for the full boot process, as far as it goes.

setenv dh_keyboard 0
saveenv
reset
 
  • Like
Reactions: tangent
neketom22 said:
no, i have 192.168.1.1 on computer and 192.168.1.108 on cam. i have check via printenv, all network's parameters are OK

The problem is the cam have ethernet link up 2 sec on boot and stop immediatly after TFTP file check (upgrade_XXXXX.txt)

Strange !
Click to expand...
Do you have the extracted images from the firmware for each partition in the root folder of your tftp server?
It looks like it just fails to run the first tftp command and aborts.

I think it would be better to keep most of the discussion of the specific issues you're having in the thread you created: Camera Unreachable after firmware upgrade (no network)
 
Last edited:
You must log in or register to reply here.
Top Bottom