Dahua IPC unbricking / recovery over serial UART and TFTP

Discussion in 'Dahua' started by cor35vet, Jan 24, 2017.

Share This Page

  1. fred0503

    fred0503 n3wb

    Joined:
    Jan 10, 2019
    Messages:
    10
    Likes Received:
    0
    Location:
    Wales
    I have read the thread and others quite a few times and haven't seen anything to answer my problem. I admit i am not the best when it comes to doing this kind of stuff that's why i have come to this board hoping someone with knowledge could help me. I would not have got this far without the information from this thread. So if anyone can help please do. Thanks
     
  2. riogrande75

    riogrande75 Getting the hang of it

    Joined:
    Oct 19, 2017
    Messages:
    138
    Likes Received:
    32
    Sorry, but when I look at your posts, I guess you did not even understand how it is supposed to work.
    Your bootloader does not even try to download anything.
     
  3. fred0503

    fred0503 n3wb

    Joined:
    Jan 10, 2019
    Messages:
    10
    Likes Received:
    0
    Location:
    Wales
    I'm not very tech savvy. So do this mean the camera cannot be fixed? Your help and knowledge would be much appreciated
     
  4. riogrande75

    riogrande75 Getting the hang of it

    Joined:
    Oct 19, 2017
    Messages:
    138
    Likes Received:
    32
    I see. We dont even know what device it is. There is by far too many questions open: cam type, fw you are tryin to flash, pc setup, network setup, ... Your setup is for sure not as it should be.
    As I said, pls. read the tread again - I am convinced you did not understand it, sorry.
     
  5. stsm

    stsm n3wb

    Joined:
    Feb 13, 2019
    Messages:
    1
    Likes Received:
    0
    Location:
    Deutschland
    Have a problem when unbricking my VTO2000.
    Try to write this firmware 501655_General_Overseas_VTOXXX_Eng_P_16M_SIP_V1.000.00.0.R.20170425.
    TFTP is calling. ...
    Putty issue. ...
    At the end comes the error message: HWID error, please set hwid first !!!!!!!!!

    Code:
    Checking DDR......OK
    
    UBL Version: 1.46t(DM365)09:30:17 Sep  2 2014
     Oscillator: 24MHZ
     ARM Rate: 216 MHZ
     DDR Rate: 173 MHZ
     BootMode: SPI
    Starting SPI Memory Copy...
    DONE
    
    
    U-Boot 1.3.6 (jerry) (Sep  2 2014 - 09:44:01)
    
    DRAM:  128 MB
    SF: Got idcode c2 20 18 c2 20
    In:    serial
    Out:   serial
    Err:   serial
    Ethernet PHY: GENERIC @ 0x05,id:221513
    total gio 2
    gio[22]=1
    gio[25]=1
    TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
    Filename 'upgrade_info_7db780a713a4.txt'.
    Load address: 0x80100000
    Loading: #
    done
    Bytes transferred = 163 (a3 hex)
    TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
    Filename 'custom-x.cramfs.img'.
    Load address: 0x81a00000
    Loading: ##
    done
    Bytes transferred = 16448 (4040 hex)
    
    ## Checking Image at 0x81a00000 ...
       Header CRC Checking ... OK
       Image Name:   custom
       Image Type:   ARM Linux Standalone Program (gzip compressed)
       Data Size:    16384 Bytes = 16 kB
       Load Address: 02060000
       Entry Point:  02080000
       Data CRC Checking ... OK
    Programing start at: 0x00060000
    write : 100%
    done
    TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
    Filename 'kernel-x.cramfs.img'.
    Load address: 0x81a00000
    Loading: #################################################################
             ##################################################
    done
    Bytes transferred = 1682736 (19ad30 hex)
    
    ## Checking Image at 0x81a00000 ...
       Header CRC Checking ... OK
       Image Name:   linux
       Image Type:   ARM Linux Kernel Image (gzip compressed)
       Data Size:    1682672 Bytes =  1.6 MB
       Load Address: 02080000
       Entry Point:  02280000
       Data CRC Checking ... OK
    Programing start at: 0x00080000
    write : 100%
    done
    TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
    Filename 'romfs-x.cramfs.img'.
    Load address: 0x81a00000
    Loading: #################################################################
             #################################################################
             #################################################################
             ##################
    done
    Bytes transferred = 3117120 (2f9040 hex)
    
    ## Checking Image at 0x81a00000 ...
       Header CRC Checking ... OK
       Image Name:   romfs
       Image Type:   ARM Linux Kernel Image (gzip compressed)
       Data Size:    3117056 Bytes =  3 MB
       Load Address: 02280000
       Entry Point:  02580000
       Data CRC Checking ... OK
    Programing start at: 0x00280000
    write : 100%
    done
    TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
    Filename 'user-x.cramfs.img'.
    Load address: 0x81a00000
    Loading: #################################################################
             #################################################################
             #################################################################
             #################################################################
             #################################################################
             #################################################################
             #############
    done
    Bytes transferred = 5910592 (5a3040 hex)
    
    ## Checking Image at 0x81a00000 ...
       Header CRC Checking ... OK
       Image Name:   user
       Image Type:   ARM Linux Kernel Image (gzip compressed)
       Data Size:    5910528 Bytes =  5.6 MB
       Load Address: 028e0000
       Entry Point:  02ee0000
       Data CRC Checking ... OK
    Programing start at: 0x008e0000
    write : 100%
    done
    TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
    Filename 'web-x.cramfs.img'.
    Load address: 0x81a00000
    Loading: #################################################################
             #####################################
    done
    Bytes transferred = 1491008 (16c040 hex)
    
    ## Checking Image at 0x81a00000 ...
       Header CRC Checking ... OK
       Image Name:   web
       Image Type:   ARM Linux Standalone Program (gzip compressed)
       Data Size:    1490944 Bytes =  1.4 MB
       Load Address: 02580000
       Entry Point:  02780000
       Data CRC Checking ... OK
    Programing start at: 0x00580000
    write : 100%
    done
    TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
    Filename 'data-x.cramfs.img'.
    Load address: 0x81a00000
    Loading: ########################################################
    done
    Bytes transferred = 815168 (c7040 hex)
    
    ## Checking Image at 0x81a00000 ...
       Header CRC Checking ... OK
       Image Name:   data
       Image Type:   ARM Linux Kernel Image (gzip compressed)
       Data Size:    815104 Bytes = 796 kB
       Load Address: 02ee0000
       Entry Point:  03000000
       Data CRC Checking ... OK
    Programing start at: 0x00ee0000
    write : 100%
    done
    TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
    Filename '.FLASHING_DONE_STOP_TFTP_NOW'.
    Load address: 0x82000000
    Loading: #
    done
    string value is The end of file
    TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
    Filename 'success.txt'.
    Load address: 0x80200000
    Loading: #
    done
    Erasing SPI flash...Writing to SPI flash...done
    .......
    HWID : <NULL>
    HWID : ^
    HWID error, please set hwid first!!!!!!!!!
    DHBOOT#
    
     
  6. geyser86

    geyser86 n3wb

    Joined:
    Feb 17, 2019
    Messages:
    2
    Likes Received:
    0
    Location:
    RF
    Hi everyone. Looking for advice my intercom VTO1220 constantly reboots.
    I tried to reboot the firmware does not help what else can be done?
    The web interface does not work. Under connecting writes and reboots.

    Checking DDR......OK
    UBL Version: 1.46t(DM365)09:30:17 Sep 2 2014
    Oscillator: 24MHZ
    ARM Rate: 432 MHZ
    DDR Rate: 340 MHZ
    BootMode: SPI
    Starting SPI Memory Copy...
    DONE
    U-Boot 1.3.6 (jerry) (Sep 2 2014 - 09:44:01)
    DRAM: 128 MB
    SF: Got idcode 01 20 18 03 01
    In: serial
    Out: serial
    Err: serial
    Ethernet PHY: GENERIC @ 0x05,id:221513
    total gio 2
    gio[22]=1
    gio[25]=1
    TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
    Filename 'upgrade_info_7db780a713a4.txt'.
    Load address: 0x80100000
    Loading: *
    Retry count exceeded; starting again
    Fail to get info file!
    Init error!
    TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
    Filename 'failed.txt'.
    Load address: 0x80200000
    Loading: *
    Retry count exceeded; starting again
    ==>use default images
    .......
    ## Booting kernel from Legacy Image at 80007fc0 ...
    Image Name: Linux-2.6.18_pro500-davinci_evm-
    Image Type: ARM Linux Kernel Image (uncompressed)
    Data Size: 1771112 Bytes = 1.7 MB
    Load Address: 80008000
    Entry Point: 80008000
    Verifying Checksum ... OK
    XIP Kernel Image ... OK
    OK
    Starting kernel ...
    Uncompressing Linux...................................................................................................................... done, booting the kernel.
    Checking DDR......OK


    Code:
    Checking DDR......OK
    
    UBL Version: 1.46t(DM365)09:30:17 Sep  2 2014
     Oscillator: 24MHZ
     ARM Rate: 432 MHZ
     DDR Rate: 340 MHZ
     BootMode: SPI
    Starting SPI Memory Copy...
    DONE
    
    
    U-Boot 1.3.6 (jerry) (Sep  2 2014 - 09:44:01)
    
    DRAM:  128 MB
    SF: Got idcode 01 20 18 03 01
    In:    serial
    Out:   serial
    Err:   serial
    Ethernet PHY: GENERIC @ 0x05,id:221513
    total gio 2
    gio[22]=1
    gio[25]=1
    TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
    Filename 'upgrade_info_7db780a713a4.txt'.
    Load address: 0x80100000
    Loading: *
    Retry count exceeded; starting again
    Fail to get info file!
    Init error!
    TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
    Filename 'failed.txt'.
    Load address: 0x80200000
    Loading: *
    Retry count exceeded; starting again
    ==>use default images
    .DHBOOT# run up
    TFTP from server 192.168.1.1; our IP address is 192.168.1.108
    Filename 'update.img'.
    Load address: 0x81a00000
    Loading: #################################################################
             #################################################################
             #################################################################
             #################################################################
             #################################################################
             #################################################################
             #################################################################
             #################################################################
             #################################################################
             #################################################################
             #################################################################
             #################################################################
             #################################################################
             #####################################
    done
    Bytes transferred = 12933288 (c558a8 hex)
    
    ## Checking Image at 0x81a00040 ...
       Header CRC Checking ... OK
       Image Name:   linux
       Image Type:   ARM Linux Kernel Image (gzip compressed)
       Data Size:    1771176 Bytes =  1.7 MB
       Load Address: 02080000
       Entry Point:  02280000
       Data CRC Checking ... OK
    Programing start at: 0x00080000
    write : 100%
    done
    
    ## Checking Image at 0x81bb0728 ...
       Header CRC Checking ... OK
       Image Name:   romfs
       Image Type:   ARM Linux Kernel Image (gzip compressed)
       Data Size:    3100672 Bytes =  3 MB
       Load Address: 02280000
       Entry Point:  02580000
       Data CRC Checking ... OK
    Programing start at: 0x00280000
    write : 100%
    done
    
    ## Checking Image at 0x81ea5768 ...
       Header CRC Checking ... OK
       Image Name:   user
       Image Type:   ARM Linux Kernel Image (gzip compressed)
       Data Size:    6221824 Bytes =  5.9 MB
       Load Address: 028e0000
       Entry Point:  02ee0000
       Data CRC Checking ... OK
    Programing start at: 0x008e0000
    write : 100%
    done
    
    ## Checking Image at 0x824947a8 ...
       Header CRC Checking ... OK
       Image Name:   web
       Image Type:   ARM Linux Standalone Program (gzip compressed)
       Data Size:    1409024 Bytes =  1.3 MB
       Load Address: 02580000
       Entry Point:  02780000
       Data CRC Checking ... OK
    Programing start at: 0x00580000
    write : 100%
    done
    
    ## Checking Image at 0x825ec7e8 ...
       Header CRC Checking ... OK
       Image Name:   data
       Image Type:   ARM Linux Kernel Image (gzip compressed)
       Data Size:    372736 Bytes = 364 kB
       Load Address: 02ee0000
       Entry Point:  03000000
       Data CRC Checking ... OK
    Programing start at: 0x00ee0000
    write : 100%
    done
    
    ## Checking Image at 0x82647828 ...
       Header CRC Checking ... OK
       Image Name:   product
       Image Type:   ARM Linux Standalone Program (gzip compressed)
       Data Size:    45056 Bytes = 44 kB
       Load Address: 028c0000
       Entry Point:  028e0000
       Data CRC Checking ... OK
    Programing start at: 0x008c0000
    write : 100%
    done
    
    ## Checking Image at 0x82652868 ...
       Header CRC Checking ... OK
       Image Name:   custom
       Image Type:   ARM Linux Standalone Program (gzip compressed)
       Data Size:    12288 Bytes = 12 kB
       Load Address: 02060000
       Entry Point:  02080000
       Data CRC Checking ... OK
    Programing start at: 0x00060000
    write : 100%
    done
    
     
  7. geyser86

    geyser86 n3wb

    Joined:
    Feb 17, 2019
    Messages:
    2
    Likes Received:
    0
    Location:
    RF
    The issue has been resolved! Thank you for your forum. Helped to install the high version and then return the old one. It's working.
     
  8. Jude201186

    Jude201186 n3wb

    Joined:
    Jul 6, 2017
    Messages:
    13
    Likes Received:
    0
    can you tell me your contact information I need your help ?
     
  9. alastairstevenson

    alastairstevenson Staff Member

    Joined:
    Oct 28, 2014
    Messages:
    11,047
    Likes Received:
    3,490
    Location:
    Scotland
    Just post on the forum here - that also lets others contribute, and sharing the problem and solution publicly will also help others.
     
  10. Jude201186

    Jude201186 n3wb

    Joined:
    Jul 6, 2017
    Messages:
    13
    Likes Received:
    0
    NOW dahua also release new Chinese fimware DH_IPC-HX4XXX-Eos_Chn_PN_Stream3_V2.680.0000000.41.R.181212 Does anyone here can modify to English fimware ?if do please contact me :zhudeping2011@vip.163.com
     
  11. khangbn

    khangbn n3wb

    Joined:
    Mar 19, 2019
    Messages:
    1
    Likes Received:
    0
    Location:
    Việt Nam
    Hello , this is what i got and i can't type any thing , please help me .
     

    Attached Files:

  12. margan

    margan Young grasshopper

    Joined:
    Oct 27, 2018
    Messages:
    36
    Likes Received:
    1
    Location:
    Italy
    Hi,
    You can't modify any signed firmware !
     
  13. spring2017

    spring2017 n3wb

    Joined:
    Jun 4, 2017
    Messages:
    6
    Likes Received:
    0
    I have a broken camera ,and I fogot where I place , so I use a good hdw4433c-a to test , but when connected with serial port , it displays more information , how I interrupt it . as follows:



    U-Boot 2010.06-svn4537 (Dec 14 2017 - 05:06:35)
    DRAM: 1 GiB
    gBootLogPtr:80b80008.
    Check spi flash controller v350... Found
    Spi(cs1) ID: 0xC8 0x40 0x18 0xC8 0x40 0x18
    Spi(cs1): Block:64KB Chip:16MB Name:"GD25Q128"
    partition file version 2
    rootfstype squashfs root /dev/mtdblock7
    In: serial
    Out: serial
    Err: serial
    TEXT_BASE:81000000
    Net: PHY found at 3

    ETH0: PHY(phyaddr=-1, rmii) not link!
    Try again use backup_serverip
    ETH0: PHY(phyaddr=-1, rmii) not link!
    Failed to get info.txt
    Fail to get info file!
    Init error!
    ETH0: PHY(phyaddr=-1, rmii) not link!
    ## Booting kernel from Legacy Image at 82000000 ...
    Image Name: Linux-3.4.35
    Image Type: ARM Linux Kernel Image (uncompressed)
    Data Size: 1453664 Bytes = 1.4 MiB
    Load Address: 80008000
    Entry Point: 80008000
    Loading Kernel Image ...OK
    OK
    partition file version 2
    rootfstype squashfs root /dev/mtdblock7
    fail to load bootargsParameters.txt
    fail to load bootargsParameters.txt file
    get bootargs info failed
    cmdLine mem=85M console=ttyS0,115200 root=/dev/mtdblock7 rootfstype=squashfs
    crashflasg:1, logmagic:54410011.

    Starting kernel ...
    Uncompressing Linux... done, booting the kernel.



    U-Boot 2010.06-svn4537 (Dec 14 2017 - 05:06:35)
    DRAM: 1 GiB
    gBootLogPtr:80b80008.
    Check spi flash controller v350... Found
    Spi(cs1) ID: 0xC8 0x40 0x18 0xC8 0x40 0x18
    Spi(cs1): Block:64KB Chip:16MB Name:"GD25Q128"
    partition file version 2
    rootfstype squashfs root /dev/mtdblock7
    In: serial
    Out: serial
    Err: serial
    TEXT_BASE:81000000
    Net: PHY found at 3

    ETH0: PHY(phyaddr=-1, rmii) not link!
    Try again use backup_serverip
    ETH0: PHY(phyaddr=-1, rmii) not link!
    Failed to get info.txt
    Fail to get info file!
    Init error!
    ETH0: PHY(phyaddr=-1, rmii) not link!
    ## Booting kernel from Legacy Image at 82000000 ...
    Image Name: Linux-3.4.35
    Image Type: ARM Linux Kernel Image (uncompressed)
    Data Size: 1453664 Bytes = 1.4 MiB
    Load Address: 80008000
    Entry Point: 80008000
    Loading Kernel Image ...OK
    OK
    partition file version 2
    rootfstype squashfs root /dev/mtdblock7
    fail to load bootargsParameters.txt
    fail to load bootargsParameters.txt file
    get bootargs info failed
    cmdLine mem=85M console=ttyS0,115200 root=/dev/mtdblock7 rootfstype=squashfs
    crashflasg:1, logmagic:54410011.

    Starting kernel ...
    Uncompressing Linux... done, booting the kernel.
     
  14. Aleks_ars

    Aleks_ars n3wb

    Joined:
    Aug 29, 2018
    Messages:
    6
    Likes Received:
    0
    Location:
    Россия
    Привет родимые!
    Проблема с DVR Dahua DHI-NVR2104-S2 2016 года выпуска.
    Во время загрузки висит на Логотип Dahua затем через 2 минуты уходит в перезагрузку и так постоянно.
    Подключение к USB-TTL, и вот что он мне дал:

    U-Boot 2010,06-svn2926 (13 октября 2017 - 15:09:30)

    Проверка флэш-памяти контроллера V100 ... Найдено
    SPI-Нор (CS 0) ID: 0xC2 0x20 0x18
    Блок: 64KB Chip: 16Мб Название: "MX25L128XX"
    SPI Nor Общий размер: 16Мб
    Окружающая среда SPI флэш инициализируется
    В: последовательный
    Выход: последовательный
    Err: последовательный
    Тип чипа hi3520dv300
    ===============================================
    DPLL: 400Mhz DDR: 1600МГц
    APLL: 800Mhz VPLL0: 162Mhz
    ===============================================
    miiphy_link, 524,7849
    miiphy_duplex, 416,0
    miiphy_speed, 345,0
    Eth0: PHY (phyaddr = 0, rgmii) связать: ДУПЛЕКСА = HALF: СКОРОСТЬ = 10M
    MAC: 4C-11-BF-6F-9F-8B
    PHY ID: 0x1cc816
    хорошая находка PHY RTL8201 на higmac
    hwid_gpio_val = 0x18
    hwid_gpio_val = 0x18
    hwid_gpio_val = 0x18
    hwid_gpio_val = 0x18
    hwid_gpio_val = 0x18
    DDR: 256M
    Нажмите любую клавишу, чтобы остановить AutoBoot: 0
    USB-устройство не найдено
    ### Cramfs загрузки 'bmp_logo.bmp' в 0x81000000
    BMPW: 300 BMPH: 113 бит: 16 biSizeImage: 67802 bmp_size = 67802
    miiphy_link, 524,7849
    miiphy_duplex, 416,0
    miiphy_speed, 345,0
    Eth0: PHY (phyaddr = 0, RMII) связать: ДУПЛЕКСА = HALF: СКОРОСТЬ = 10M
    MAC: 4C-11-BF-6F-9F-8B
    TFTP с сервера 192.168.254.254; наш IP-адрес 192.168.1.108; отправка через шлюз 192.168.1.1
    Скачать файл «ID_2G02990PAZ00274.txt».
    Скачать по адресу: 0x82000000
    Загрузка: TTT
    Превышено допустимое число попыток; начиная снова
    TFTP получать не удалось, пожалуйста, проверьте чистую окружающую среду
    ### SquashFS загрузки '/ загрузки / uImage' для 0x82000000
    ## Загрузка ядра из Наследства изображения на 82000000 ...
    Название изображения: Linux-3.10.0
    Тип изображения: ARM Linux Kernel Image (несжатый)
    Размер данных: 2193464 байт = 2,1 MiB
    Нагрузка Адрес: 80008000
    Точка входа: 80008000
    Загрузка образа ядра ... OK
    Хорошо

    Запуск ядра ...

    Распаковка Linux ... сделано, загрузка ядра.

    Скажите мне, что вы можете делать с ним?
     
  15. iTuneDVR

    iTuneDVR Getting the hang of it

    Joined:
    Aug 23, 2014
    Messages:
    413
    Likes Received:
    47
    Location:
    www.iTuneDVR.ru
    Никаких проблем нет с этим уже давно, читай форум и инструкции по восстановлению или сбросу конфигов.
    Остановить загрузку
    Дальше
    setenv dh_keyboard 0
    saveenv
    reset
    Увидишь причину падения и работу watchdog
    А дальше помодульное восстановление или через update.img, специальный файл.
    Прошивки все доступны, как и русскоязычные форумы, а то тут админы и некоторые начнут ворчать, что ты бы еще на клингонском бы написал и т.п., .. ;)
     
  16. Aleks_ars

    Aleks_ars n3wb

    Joined:
    Aug 29, 2018
    Messages:
    6
    Likes Received:
    0
    Location:
    Россия
    Thanks friend! Tell me at least what topics to read to restore it?
     
  17. Alessio831

    Alessio831 n3wb

    Joined:
    Mar 28, 2019
    Messages:
    10
    Likes Received:
    0
    Location:
    Italy
    Does anyone know where to find the serial on sd59225u-hni?
     
  18. simonchan

    simonchan n3wb

    Joined:
    Jul 22, 2019
    Messages:
    8
    Likes Received:
    0
    Location:
    United States
    hello .i'm looking for rs232 port how know?
     

    Attached Files:

    • 1.jpg
      1.jpg
      File size:
      191.6 KB
      Views:
      6
    • 2.jpg
      2.jpg
      File size:
      217.4 KB
      Views:
      6
    • 3.jpg
      3.jpg
      File size:
      225.7 KB
      Views:
      6
  19. iTuneDVR

    iTuneDVR Getting the hang of it

    Joined:
    Aug 23, 2014
    Messages:
    413
    Likes Received:
    47
    Location:
    www.iTuneDVR.ru
  20. iTuneDVR

    iTuneDVR Getting the hang of it

    Joined:
    Aug 23, 2014
    Messages:
    413
    Likes Received:
    47
    Location:
    www.iTuneDVR.ru
    Possible this but test all 4-dot connector for +5(3), Gd, Rx,Tx
    Power & Gd together

    What is this?

    upload_2019-8-14_1-28-50.png