Dahua IPC unbricking / recovery over serial UART and TFTP

I haven't attempted any of this stuff yet. Just trying to read up and get educated before I attempt. I have a few questions if someone would be kind enough to help me out:
What TFTP Server application do you folks recommend?
Are there any specific IP settings for that TFTP server?
In Putty, under the "Basic Options" tab, what IP and port settings should be here?

Thanks!!
 
Sorry couple more questions:
When I launch TFTPD32, I get an error (screenshot attached)
What would be the proper settings for TFTPD32 (also screenshot attached)

Thank you!
 

Attachments

  • 2019-08-25 (1).png
    2019-08-25 (1).png
    6 KB · Views: 91
  • 2019-08-25.png
    2019-08-25.png
    7.3 KB · Views: 94
You can use tftpd64 too.
Close your antivirus, firewall.
Be shure that your PC is work well with normal file system.
Try run as Administrator your tftpd application
 
Last edited:
  • Like
Reactions: Wael
Thank you kind sir! I got it working. I just had to reboot my computer because previously I had another TFTP server running that was already binding to port 69 I think. Possibly that application caused this conflict.

Under "server interfaces", do I have to put my computer IP here or just leave it as is?
 
Ok another question. Sorry this might be a dumb question.
I take it that using this method of unbricking, there is no ethernet connection to the camera during the process. Basically all communications are via serial.
Is this correct?
 
No.
You operate your ipc via serial, put command to get some data from LAN if it connected & work (of course need setup 1st adresses)

Of course you can upload some data via Serial at Hyper Terminal program, but it longer & not this time i think.
 
I've done a Firmware Update to my
Dahua IPC-HUM8230P
I don't know if I took the the right firmware I'm not sure,

Since I've updatet I coudn't do any changes in the configuration.
The Cam does a reboot then.
It does also a reboot every 5 to 10 minutes.
So far I've confiigures a serial connection with a ft232rl usb to seriel conector and aftr many tries I got a connection.
I changed ip address and run a tftp server and could load files down but I got this message
Code: 
>run dr
Using ambarella mac device
Download Filename 'romfs-x.squashfs.img'.
Downloading: #################################################################
         #################################################################
         #################################################################
         ###############################################################
  ## file size: 0 Bytes,        times: 3s,      speed: 358.4 KiB/s
done
Bytes transferred = 1310784 (140040 hex)
[ERR0002:]The img header be changed!
I've googeled the message and found this:
Dahua IPC EASY unbricking / recovery over TFTP
I think the problem is that the new firmware installed a new bootloader that doesn't allow firmwaredowngrades.
Please tell me how do I et the older firmware to my cam
 
  • Like
Reactions: CChr
yes, you managed to update your bootloader that now checks for signing before writing an image to the flash. I dont think you have a path forward, unless you manage to read the whole partition from another camera, upload it to a tftp server and then try to see if your bootloader still has the flash subsytem write command still enabled and go that route. Another option is to find the correct firmware for the camera which is compatible with the new signing verification (like v2.800 or something).
 
thats a bit unsatisfying, I don't think someone will read out his complete partition, so I'll have to wait for a new Firmware, thanks for answering
 

Attachments

  • pingfromcam.png
    pingfromcam.png
    5.9 KB · Views: 21
  • putty1.png
    putty1.png
    48.2 KB · Views: 25
Last edited:
As an eBay Associate IPCamTalk earns from qualifying purchases.
Trying to flash DH_IPC-HX5X3X-Rhea_EngSpnFrn_N_Stream3_V2_622_0000000_18_R_201711102 to a Lorex LNB8005-C (Dahua OEM, matches the Dahua IPC-HFW4830E-S from what I've read/found). @Corellon previously did this in this thread. I've followed the steps precisely and am getting the following error.

Code: 
Ncat: Version 7.40 ( https://nmap.org/ncat )
Ncat: Listening on 192.168.254.254:5002
gBootLogPtr:00b80008.
spinor flash ID is 0x1940ef
partition file version 2
rootfstype squashfs root /dev/mtdblock5
can not search bootargs settings
fail to parse bootargsParametersV2.text info
fail to init bootargsParametersV2
TEXT_BASE:01000000
Net:   Detected MACID:00:40:7f:93:ef:49
PHY:0x001cc816,addr:0x00
s3l phy RTL8201 init
MMC:   sdmmc init
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'upgrade_info_7db780a713a4.txt'.Download to address: 0x5000000
Downloading: *
done
Bytes transferred = 199 (c7 hex)
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'romfs-x.squashfs.img'.Download to address: 0x2000000
Downloading: *
TFTP error: (0)cmd Failed run dr!
partition file version 2
rootfstype squashfs root /dev/mtdblock5
fail to load bootargsParameters.txt
fail to load bootargsParameters.txt file
get bootargs info failed
cmdLine console=ttyS0,115200 mem=118M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc

I am using TFTPD64 instead of the TFTP server provided in the original link, I kept getting failed.txt errors with the other. This one definitely transfers until it hits the "TFTP error: (0)cmd Failed run dr!" I'm using the commands.txt used in the linked post and my upgrade_info looks like this:

CRC:1720558748
MagicString:c016dcd6-cdeb-45df-9fd0-e821bf0e1e62
run dr
run dk
run du
run dw
run dp
run dc
tftp 0x2000000 pd-x.squashfs.img; flwrite
tftp 0x2000000
.FLASHING_DONE_STOP_TFTP_NOW
sleep 5

Really don't know what I'm missing and everywhere I search other people who have run into this issue never posted any solution, if there was one.

Appreciate any help,
Ryan
 
How would one extract the various images from a working camera through the serial console as a backup firmware image?

Are you able to reverse the signed bootloader through a serial connection? If so how would you do that? Booting through tftp?

Thanks
 
So i found I can read the image with SF read 0x0200000 [Memorytoread] [lenghttoread] and on new bootloaders I can upload via tftp with a put, but it doesn't work on older boot loaders, anyway to get that info back over serial?
 
You must log in or register to reply here.
Top Bottom