Dahua IPC unbricking / recovery over serial UART and TFTP

Is SF write disabled in the latest firmware? I'm not able to use it, it just keep kicking me back the syntax even though it's correct (sf write 0x200000 0x80000 0x40000)
 
Hi all,
I'm trying to unbrick a cam and need some help. The cam has no network and when trying to connect using serial uart it is unable to communicate. The camera seems to power on as I can see the lens open and close but that's about it. Is it possible to brick a camera so far that it is not recoverable?
 
mikelikes said:
Hi all,
I'm trying to unbrick a cam and need some help. The cam has no network and when trying to connect using serial uart it is unable to communicate. The camera seems to power on as I can see the lens open and close but that's about it. Is it possible to brick a camera so far that it is not recoverable?
Click to expand...

Anyone got any ideas? Also please let me know if I am posting this in the wrong section, im still trying to work out things here as a newbie..
 
Have you made sure you have both the tx and rx feeds connected to the right leads? In my camera I wouldn't get a response with just the rx connected and gibberish or nothing if the tx was on the wrong pad. Does the lens open and close right on power on or how long after power is applied?
 
Corellon said:
Have you made sure you have both the tx and rx feeds connected to the right leads? In my camera I wouldn't get a response with just the rx connected and gibberish or nothing if the tx was on the wrong pad. Does the lens open and close right on power on or how long after power is applied?
Click to expand...
9

As soon as I connect the power using POE or a 12volt Plug Pack I can hear a faint click and I can see the lens open, nothing else happens and the IR illuminators do not power up. I have tried to connect both the TX and RX feeds including Ground with no success, I have also tried to use a multi meter to make sure I am connecting to the correct pins with no luck.
 
mikelikes said:
trying to connect using serial uart it is unable to communicate.
Click to expand...
Just to confirm :
You are using a 'serial TTL to USB convertor' as opposed to an RS232 interface?
Baud rate=115,200 8 bits no parity.
And apologies for the dumb question - you are connecting convertor RX to camera TX and vice versa?

mikelikes said:
I have also tried to use a multi meter to make sure I am connecting to the correct pins with no luck.
Click to expand...
Both RX and TX would normally show +3.3v when the camera is powered on.

mikelikes said:
The cam has no network
Click to expand...
If by that you mean that no 'link detect' light shows on the router/switch port that it is wired to, that's not a good sign, and I'd not expect a firmware update to do that unless it trashed the bootloader.
 
alastairstevenson said:
Just to confirm :
You are using a 'serial TTL to USB convertor' as opposed to an RS232 interface?
Baud rate=115,200 8 bits no parity.
And apologies for the dumb question - you are connecting convertor RX to camera TX and vice versa?
Click to expand...
I bought an "FT232RL 3.3V 5.5V FTDI USB to TTL Serial Adapter" like this one and configured Putty and the COM port in device manager with the settings you mentioned. I tired switching the RX and TX connections with no luck. PS no offence taken after all I am a noob :)

alastairstevenson said:
Both RX and TX would normally show +3.3v when the camera is powered on.

If by that you mean that no 'link detect' light shows on the router/switch port that it is wired to, that's not a good sign, and I'd not expect a firmware update to do that unless it trashed the bootloader.
Click to expand...
I haven't got the camera in front of me at the moment but from memory I was not getting a link light. I will check it next time including the voltage from the RX and TX pins.

Worst case, if the bootloader is trashed is there a way to restore it?
 
Your interface and it's configuration sounds ok.
How confident are you that you have hooked it up to the serial console pads? Is it a camera for which that's been documented?

When there is no bootloader, that requires some physical intervention. A bit trickier.
 
alastairstevenson said:
Your interface and it's configuration sounds ok.
How confident are you that you have hooked it up to the serial console pads? Is it a camera for which that's been documented?
Click to expand...

The camera I am working on is a Dahua IPC-HDW5431RP-Z. I checked the wiki and online but I don't believe it has been documented by anyone. Attached is a picture of the port inside of the camera including the voltages that I identified using a multi meter.

I now have soldiered in wires and tested again with no success and I have tried multiple combinations.

I can also confirm that I am receiving no link light on my network.

camera_uart.jpg
 
Hi I need help I have a Dahau SD1A203T-GN

It just continuously TFTP the same files over and over.

At the end it has

fail to load bootargsParameters.txt
fail to load bootargsParameters.txt file
get bootargs info failed

here's the capture from the console bat

Dahua_TFTPBackup>Console.bat
Ncat: Version 7.40 ( Ncat - Netcat for the 21st Century )
Ncat: Listening on 192.168.254.254:5002
gBootLogPtr:00b80008.
NAND: 128 MiB
amb_nand_read_oob read page:49152 err
Erasing Nand...
Erasing at 0x380000 -- 100% complete.
Writing to Nand...
partition file version 2
rootfstype squashfs root /dev/mtdblock8
fail to load bootargsParametersV22.txt
fail to load bootargsParametersV21.txt
fail to init bootargsParametersV2
TEXT_BASE:01000000
Net: Detected MACID:00:12:34:56:78:9a
PHY:0x001cc816,addr:0x00
s3l phy RTL8201 init
partition file version 2
rootfstype squashfs root /dev/mtdblock8
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'upgrade_info_7db780a713a4.txt'.Download to address: 0x5000000
Downloading: *
done
Bytes transferred = 203 (cb hex)
string value is 0
The end of file
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'romfs-x.squashfs.img'.Download to address: 0x2000000
Downloading: *
done
Bytes transferred = 1417280 (15a040 hex)
do not find BOOT_IMG_NAME!
Erasing update flag partition.
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8

## Checking Image at 02000000 ...
Legacy image found
Image Name: romfs
Created: 2018-09-13 7:06:44 UTC
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 1417216 Bytes = 1.4 MiB
Load Address: 01200000
Entry Point: 01600000
Verifying Checksum ... OK
Programing start at: 0x01200000
write : 100%
done
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
fail to load bootargsParametersV22.txt
fail to load bootargsParametersV21.txt
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'kernel.img'.Download to address: 0x2000000
Downloading: *
done
Bytes transferred = 1646244 (191ea4 hex)
do not find BOOT_IMG_NAME!
Erasing update flag partition.
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8

## Checking Image at 02000000 ...
Legacy image found
Image Name: kernel
Created: 2018-09-13 7:06:41 UTC
Image Type: ARM Linux Firmware (uncompressed)
Data Size: 1646180 Bytes = 1.6 MiB
Load Address: 00c80000
Entry Point: 01200000
Verifying Checksum ... OK
Programing start at: 0x00c80000
write : 100%
done
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
fail to load bootargsParametersV22.txt
fail to load bootargsParametersV21.txt
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'user-x.squashfs.img'.Download to address: 0x2000000
Downloading: *
done
Bytes transferred = 18538560 (11ae040 hex)
do not find BOOT_IMG_NAME!
Erasing update flag partition.
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8

## Checking Image at 02000000 ...
Legacy image found
Image Name: user
Created: 2018-09-13 7:07:04 UTC
Image Type: ARM Linux Standalone Program (uncompressed)
Data Size: 18538496 Bytes = 17.7 MiB
Load Address: 01e00000
Entry Point: 03a80000
Verifying Checksum ... OK
Programing start at: 0x01e00000
write : 100%
done
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
fail to load bootargsParametersV22.txt
fail to load bootargsParametersV21.txt
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'web-x.squashfs.img'.Download to address: 0x2000000
Downloading: *
done
Bytes transferred = 8335424 (7f3040 hex)
do not find BOOT_IMG_NAME!
Erasing update flag partition.
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8

## Checking Image at 02000000 ...
Legacy image found
Image Name: web
Created: 2018-09-13 7:06:46 UTC
Image Type: ARM Linux Standalone Program (uncompressed)
Data Size: 8335360 Bytes = 7.9 MiB
Load Address: 01600000
Entry Point: 01e00000
Verifying Checksum ... OK
Programing start at: 0x01600000
write : 100%
done
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
fail to load bootargsParametersV22.txt
fail to load bootargsParametersV21.txt
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'partition-x.cramfs.img'.Download to address: 0x2000000
Downloading: *
done
Bytes transferred = 4160 (1040 hex)
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'custom-x.squashfs.img'.Download to address: 0x2000000
Downloading: *
done
Bytes transferred = 57408 (e040 hex)
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'pd-x.squashfs.img'.Download to address: 0x2000000
Downloading: *
done
Bytes transferred = 73792 (12040 hex)
do not find BOOT_IMG_NAME!
Erasing update flag partition.
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8

## Checking Image at 02000000 ...
Legacy image found
Image Name: pd
Created: 2018-09-13 7:07:17 UTC
Image Type: ARM Linux Standalone Program (uncompressed)
Data Size: 73728 Bytes = 72 KiB
Load Address: 00940000
Entry Point: 00c80000
Verifying Checksum ... OK
Programing start at: 0x00940000
write : 100%
done
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
fail to load bootargsParametersV22.txt
fail to load bootargsParametersV21.txt
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename '.FLASHING_DONE_STOP_TFTP_NOW'.Download to address: 0x2000000
Downloading: #
done
partition file version 2
rootfstype squashfs root /dev/mtdblock8
fail to load bootargsParameters.txt
fail to load bootargsParameters.txt file
get bootargs info failed
cmdLine console=ttyS0,115200 mem=198M root=/dev/mtdblock8 rootfstype=squashfs init=/linuxrc
 
Create a success.txt and failed.txt file in the root directory of tftp server, see if it downloads either of those.

You should be getting one or the other to indicate if the process succeeded or failed, aside from that one line that stands out is:

amb_nand_read_oob read page:49152 err
That would incline me to lean to memory corruption or a bad block in the nand.

Ideally you also want to be TFTP'ing the same version of the firmware that you have on the camera, I helped one fella who was trying to flash the firmware and it was similar to yours and it would loop. Turned out that between the version on his camera and the version he was trying to patch they expanded one of the partitions to give more space but it wouldn't stick because the bootloader needed to be upgraded to register the new addresses to flash too. Flashing to the same version he had and then using the web gui to upgrade fixed the issue.
 
Corellon said:
Create a success.txt and failed.txt file in the root directory of tftp server, see if it downloads either of those.

You should be getting one or the other to indicate if the process succeeded or failed, aside from that one line that stands out is:

amb_nand_read_oob read page:49152 err
That would incline me to lean to memory corruption or a bad block in the nand.

Ideally you also want to be TFTP'ing the same version of the firmware that you have on the camera, I helped one fella who was trying to flash the firmware and it was similar to yours and it would loop. Turned out that between the version on his camera and the version he was trying to patch they expanded one of the partitions to give more space but it wouldn't stick because the bootloader needed to be upgraded to register the new addresses to flash too. Flashing to the same version he had and then using the web gui to upgrade fixed the issue.
Click to expand...
Thanks I get errors that it can't access both the success.txt and fail.txt.

TFTP shows
Client 192.168.1.108:3073 root\upgrade_info_7db780a713a4.txt, 1 Blocks Served
Client 192.168.1.108:1080 root\romfs-x.squashfs.img, 927 Blocks Served
Client 192.168.1.108:2204 root\kernel.img, 1062 Blocks Served
Client 192.168.1.108:3820 root\user-x.squashfs.img, 9535 Blocks Served
Client 192.168.1.108:2645 root\web-x.squashfs.img, 4155 Blocks Served
Client 192.168.1.108:3142 root\partition-x.cramfs.img, 3 Blocks Served
Client 192.168.1.108:3320 root\custom-x.squashfs.img, 23 Blocks Served
Client 192.168.1.108:3517 root\pd-x.squashfs.img, 48 Blocks Served
Client 192.168.1.108:1463 root\.FLASHING_DONE_STOP_TFTP_NOW, 1 Blocks Served
Client 192.168.1.108:3827 root\success.txt, File not found or No Access

Console show
done
partition file version 2
rootfstype squashfs root /dev/mtdblock8
fail to load bootargsParameters.txt
fail to load bootargsParameters.txt file
get bootargs info failed
cmdLine console=ttyS0,115200 mem=198M root=/dev/mtdblock8 rootfstype=squashfs init=/linuxrc

I don’t even know what firmware it was on previously because I just notice this camera fail a month ago (it went into the continuous rebooting) and I thought I could flash the firmware.

I’m trying to locate a firmware for this I tried the latest and that loops also. The current one I tired is from 2018 or 2017. So I need to somehow find another one beside the 2020.

Anyone know how I can find the previous firmware for SD1A203T-GN?
 
Last edited:
Client 192.168.1.108:3827 root\success.txt, File not found or No Access
That would indicate that the flash was a success, if you shutdown the TFTP server at that time the camera should boot normally.

fail to load bootargsParameters.txt
fail to load bootargsParameters.txt file
get bootargs info failed
These are pretty (to my knowledge) common messages when flashing through TFTP.

If it doesn't boot still then it would indicate that it's not strictly a flash failure and that there is something else going on, if you don't shut down the TFTP server the camera will see it and attempt to flash again over and over and if you shut it down to disconnect the camera in the middle of the flash it would likely cause it to not boot.

Also looking through the console log closely are you sure that is the complete copy and paste from the log? (Use the spoiler tag to keep formating easier and a shorter post) there are a few things that don't look right to me there that could contribute:
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'partition-x.cramfs.img'.Download to address: 0x2000000
Downloading: *
done
Bytes transferred = 4160 (1040 hex)
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'custom-x.squashfs.img'.Download to address: 0x2000000
Downloading: *
done
Bytes transferred = 57408 (e040 hex)
Using ambarella mac device

There is no output from flashing those files, it appear they were just downloaded but not flashed. make sure your using run dp, otherwise you might need to change the command.txt file (and run the bat afterwords) replacing run dp and run dc with:
tftp 0x2000000 partition-x.cramfs.img; flwrite
tftp 0x2000000 custom-x.squashfs.img; flwrite

It would help if you can post a copy of the commands.txt file that your using as well.

Thanks,
 
Corellon said:
Client 192.168.1.108:3827 root\success.txt, File not found or No Access
That would indicate that the flash was a success, if you shutdown the TFTP server at that time the camera should boot normally.

fail to load bootargsParameters.txt
fail to load bootargsParameters.txt file
get bootargs info failed
These are pretty (to my knowledge) common messages when flashing through TFTP.

If it doesn't boot still then it would indicate that it's not strictly a flash failure and that there is something else going on, if you don't shut down the TFTP server the camera will see it and attempt to flash again over and over and if you shut it down to disconnect the camera in the middle of the flash it would likely cause it to not boot.

Also looking through the console log closely are you sure that is the complete copy and paste from the log? (Use the spoiler tag to keep formating easier and a shorter post) there are a few things that don't look right to me there that could contribute:
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'partition-x.cramfs.img'.Download to address: 0x2000000
Downloading: *
done
Bytes transferred = 4160 (1040 hex)
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'custom-x.squashfs.img'.Download to address: 0x2000000
Downloading: *
done
Bytes transferred = 57408 (e040 hex)
Using ambarella mac device

There is no output from flashing those files, it appear they were just downloaded but not flashed. make sure your using run dp, otherwise you might need to change the command.txt file (and run the bat afterwords) replacing run dp and run dc with:
tftp 0x2000000 partition-x.cramfs.img; flwrite
tftp 0x2000000 custom-x.squashfs.img; flwrite

It would help if you can post a copy of the commands.txt file that your using as well.

Thanks,
Click to expand...

Do I need to use theroot\upgrade_info_7db780a713a4.txt?
I removed it and I get

TFTP error: (0)SD try times:2
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending throu gh gateway 192.168.1.1
Download Filename 'upgrade_info_7db780a713a4.txt'.
Download to address: 0x5000000
Downloading: *
TFTP error: (0)SD try times:3
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending throu gh gateway 192.168.1.1
Download Filename 'upgrade_info_7db780a713a4.txt'.
Download to address: 0x5000000
Downloading: *
TFTP error: (0)Fail to get info file!
Init error!
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending throu gh gateway 192.168.1.1
Download Filename 'failed.txt'.
Download to address: 0x2000000
Downloading: #
done
Support backupVer:255
state:ff,err_count:05
check partition....partition...custom...product...Kernel...romfs...web...user... Skip bad block 0x6000000
OK
restore partition from 0x3b80000 to 0x500000
write 100%
restore custom from 0x3c80000 to 0x600000
write 100%
restore product from 0x3fc0000 to 0x940000
write 100%
restore Kernel from 0x4300000 to 0xc80000
write 100%
restore romfs from 0x4880000 to 0x1200000
write 100%
restore web from 0x4c80000 to 0x1600000
write 100%
restore user from 0x5480000 to 0x1e00000
write 39%Skip bad block 0x6000000
write 100%
can't find uImage
resetting ...

the command.txt

tftp 0x02000000 romfs-x.squashfs.img
flwrite
tftp 0x02000000 kernel.img
flwrite
tftp 0x02000000 user-x.squashfs.img
flwrite
tftp 0x02000000 web-x.squashfs.img
flwrite
tftp 0x02000000 custom-x.squashfs.img
flwrite
tftp 0x02000000 pd-x.squashfs.img
flwrite
tftp 0x02000000 partition-x.cramfs.img
flwrite
tftp 0x02000000 .FLASHING_DONE_STOP_TFTP_NOW
sleep 5

the upgrade_info_7db780a713a4.txt
CRC:4168270762
MagicString:c016dcd6-cdeb-45df-9fd0-e821bf0e1e62
echo help
help
echo printenv
printenv
echo "partition"
partition
echo "bdinfo"
bdinfo
echo "fsinfo"
fsinfo
tftp 0x02000000 partition-x.cramfs.img
flwrite
tftp 0x02000000 romfs-x.squashfs.img
flwrite
tftp 0x02000000 kernel.img
flwrite
tftp 0x02000000 user-x.squashfs.img
flwrite
tftp 0x02000000 web-x.squashfs.img
flwrite
tftp 0x02000000 custom-x.squashfs.img
flwrite
tftp 0x02000000 pd-x.squashfs.img
flwrite
tftp 0x02000000 .FLASHING_DONE_STOP_TFTP_NOW
flwrite
sleep 5

log

U-Boot 2010.06-svn5213 (Sep 13 2018 - 14:55:04)
I2C: ready
DRAM: 198 MiB
gBootLogPtr:00b80008.
NAND: 128 MiB
amb_nand_read_oob read page:49152 err
Erasing Nand...
Erasing at 0x380000 -- 100% complete.
Writing to Nand...
partition file version 2
rootfstype squashfs root /dev/mtdblock8
fail to load bootargsParametersV22.txt
fail to load bootargsParametersV21.txt
fail to init bootargsParametersV2
TEXT_BASE:01000000
Net: Detected MACID:00:12:34:56:78:9a
PHY:0x001cc816,addr:0x00
s3l phy RTL8201 init

partition file version 2
rootfstype squashfs root /dev/mtdblock8
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'upgrade_info_7db780a713a4.txt'.
Download to address: 0x5000000
Downloading: #################################################
done
Bytes transferred = 533 (215 hex)
help
? - alias for 'help'
backup - backup - manual backup program.

base - print or set address offset
bdinfo - print Board Info structure
boot - boot default, i.e., run 'bootcmd'
bootd - boot default, i.e., run 'bootcmd'
bootf - boot from flash
bootm - boot application image from memory
bootp - boot image via network using BOOTP/TFTP protocol
cfgRestore- erase config and backup partition.

cmp - memory compare
coninfo - print console devices and information
cp - memory copy
crc32 - checksum calculation
dcache - enable or disable data cache
dhcp - boot image via network using DHCP/TFTP protocol
echo - echo args to console
editenv - edit environment variable
erasepart- erasepart

exit - exit script
false - do nothing, unsuccessfully
flwrite - flwrite - write data into FLASH memory

fsinfo - print information about filesystems
fsload - load binary file from a filesystem image
go - start application at address 'addr'
gpio - gpio test
help - print command description/usage
hwid - hwid - set hardware id and save to flash

i2c - I2C sub-system
icache - enable or disable instruction cache
iminfo - print header information for application image
itest - return true/false on integer compare
kload - kload - load uImage file from parttion

lip - lip - set local ip address but not save to flash

loadb - load binary file over serial line (kermit mode)
loads - load S-Record file over serial line
loady - load binary file over serial line (ymodem mode)
logsend - get log buf
loop - infinite loop on address range
ls - list files in a directory (default /)
mac - mac - set mac address and save to flash

md - memory display
memsize - memsize - set mem size

mii - MII utility commands
mm - memory modify (auto-incrementing address)
mtest - simple RAM read/write test
mw - memory write (fill)
nand - NAND sub-system
nboot - boot from NAND device
nfs - boot image via network using NFS protocol
nm - memory modify (constant address)
partition- print partition information
ping - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
rarpboot- boot image via network using RARP/TFTP protocol
rdefault- rdefault -recover default env

reset - Perform RESET of the CPU
run - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv - set environment variables
showvar - print local hushshell variables
sip - sip - set server ip address but not save to flash

sleep - delay execution for some time
source - run script from memory
sync_uboot- sync_uboot - sync uboot to uboot-bak

test - minimal test like /bin/sh
tftpboot- tftpboot- boot image via network using TFTP protocol
true - do nothing, successfully
uartUp - uartUp- update image via uart using uart4

upmh - mcu heat upgraded
usleep - delay execution for some time
version - print monitor version
printenv
bootargs=console=ttyS0,115200 mem=198M root=/dev/mtdblock8 rootfstype=squashfs init=/linuxrc
bootcmd=kload 0x02000000; bootm 0x02000000
bootdelay=3
baudrate=115200
ethaddr=00:12:34:56:78:9A
ipaddr=192.168.1.108
serverip=192.168.1.1
autoload=yes
gatewayip=192.168.1.1
netmask=255.255.255.0
ID=000000000000000000
da=tftp 0x02000000 dhboot.bin.img; flwrite;tftp dhboot-min.bin.img;nand protect off;flwrite
dr=tftp 0x02000000 romfs-x.squashfs.img; flwrite
dk=tftp 0x02000000 kernel.img; flwrite
du=tftp 0x02000000 user-x.squashfs.img; flwrite
dw=tftp 0x02000000 web-x.squashfs.img; flwrite
ds=tftp 0x02000000 dsp-x.squashfs.img; flwrite
dc=tftp 0x02000000 custom-x.squashfs.img; flwrite
dt=tftp 0x02000000 data-x.squashfs.img; flwrite
df=tftp 0x02000000 fpga.img; flwrite
up=tftp 0x02000000 update.img; flwrite
tk=tftp 0x02000000 uImage; bootm
dh_keyboard=1
appauto=1
sysbackup=1
logserver=127.0.0.1
loglevel=4
autosip=192.168.254.254
autolip=192.168.1.108
autogw=192.168.1.1
autonm=255.255.255.0
pd=tftp 0x02000000 pd-x.squashfs.img; flwrite
ethact=ambarella mac
stdin=serial
stdout=serial
stderr=serial
filesize=215
fileaddr=5000000

Environment size: 1132/131068 bytes
"partition"
name cs offset size flag fs_flags fs_type
MinBoot 0 0x0000000000000000 0x0000000000100000 0x00000000 0x00000000 0x00000000
U-Boot 0 0x0000000000200000 0x0000000000100000 0x00000000 0x00000000 0x00000000
hwid 0 0x0000000000300000 0x0000000000100000 0x00000000 0x00000000 0x00000000
updateflag 0 0x0000000000400000 0x0000000000100000 0x00000000 0x00000000 0x00000000
partition 0 0x0000000000500000 0x0000000000100000 0x00000000 0x00000001 0x00000001
custom 0 0x0000000000600000 0x0000000000340000 0x00000000 0x00000001 0x00000002
product 0 0x0000000000940000 0x0000000000340000 0x00000000 0x00000001 0x00000002
Kernel 0 0x0000000000c80000 0x0000000000580000 0x00000000 0x00000000 0x00000000
romfs 0 0x0000000001200000 0x0000000000400000 0x00000000 0x00000001 0x00000002
web 0 0x0000000001600000 0x0000000000800000 0x00000000 0x00000001 0x00000002
user 0 0x0000000001e00000 0x0000000001c80000 0x00000000 0x00000001 0x00000002
syslog 0 0x0000000007200000 0x0000000000400000 0x00000000 0x00000003 0x00000003
config 0 0x0000000007600000 0x0000000000400000 0x00000000 0x00000003 0x00000003
backup 0 0x0000000007a00000 0x0000000000400000 0x00000000 0x00000003 0x00000003
lens 0 0x0000000007100000 0x0000000000100000 0x00000000 0x00000000 0x00000000
MinBoot mountcmd:
U-Boot mountcmd:
hwid mountcmd:
updateflag mountcmd:
partition mountcmd:
custom mountcmd:mount /dev/mtdblock5 /mnt/custom/
product mountcmd:mount /dev/mtdblock6 /mnt/pd/
Kernel mountcmd:
romfs mountcmd:
web mountcmd:mount /dev/mtdblock9 /mnt/web/
user mountcmd:mount /dev/mtdblock10 /usr/
syslog mountcmd:/sbin/ubiattach /dev/ubi_ctrl -m 11
/sbin/ubimkvol /dev/ubi0 -s 2500000 -N syslog
mount -t ubifs ubi0_0 /mnt/syslog
if [ $? -ne 0 ];then
flash_eraseall /dev/mtd/11
/sbin/ubiattach /dev/ubi_ctrl -m 11
/sbin/ubimkvol /dev/ubi0 -s 2500000 -N syslog
mount -t ubifs ubi0_0 /mnt/syslog
fi
config mountcmd:/sbin/ubiattach /dev/ubi_ctrl -m 12
/sbin/ubimkvol /dev/ubi1 -s 2500000 -N config
mount -t ubifs ubi1_0 /mnt/mtd
if [ $? -ne 0 ];then
echo /mnt/config mount fail! >> /mnt/syslog/ubifsLog
sync
flash_eraseall /dev/mtd/12
/sbin/ubiattach /dev/ubi_ctrl -m 12
/sbin/ubimkvol /dev/ubi1 -s 2500000 -N config
mount -t ubifs ubi1_0 /mnt/mtd
fi
backup mountcmd:/sbin/ubiattach /dev/ubi_ctrl -m 13
/sbin/ubimkvol /dev/ubi2 -s 2500000 -N backup
mount -t ubifs ubi2_0 /mnt/backup
if [ $? -ne 0 ];then
echo /mnt/backup mount fail! >> /mnt/syslog/ubifsLog
sync
flash_eraseall /dev/mtd/13
/sbin/ubiattach /dev/ubi_ctrl -m 13
/sbin/ubimkvol /dev/ubi2 -s 2500000 -N backup
mount -t ubifs ubi2_0 /mnt/backup
fi
lens mountcmd:
"bdinfo"
arch_number = 0x23283041
env_t = 0x00000000
boot_params = 0x00200000
DRAM bank = 0x00000000
-> start = 0x00200000
-> size = 0x0C600000
ethaddr = 00:12:34:56:78:9A
ip_addr = 192.168.1.108
baudrate = 115200 bps
"fsinfo"
### filesystem type is JFFS2
Scanning JFFS2 FS: done.
Compression: NONE
frag count: 0
compressed sum: 0
uncompressed sum: 0
Compression: ZERO
frag count: 0
compressed sum: 0
uncompressed sum: 0
Compression: RTIME
frag count: 0
compressed sum: 0
uncompressed sum: 0
Compression: RUBINMIPS
frag count: 0
compressed sum: 0
uncompressed sum: 0
Compression: COPY
frag count: 0
compressed sum: 0
uncompressed sum: 0
Compression: DYNRUBIN
frag count: 0
compressed sum: 0
uncompressed sum: 0
Compression: ZLIB
frag count: 0
compressed sum: 0
uncompressed sum: 0
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'romfs-x.squashfs.img'.
Download to address: 0x2000000
Downloading: #################################################
done
Bytes transferred = 1417280 (15a040 hex)
do not find BOOT_IMG_NAME!
Erasing update flag partition.
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8

## Checking Image at 02000000 ...
Legacy image found
Image Name: romfs
Created: 2018-11-24 7:05:09 UTC
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 1417216 Bytes = 1.4 MiB
Load Address: 01200000
Entry Point: 01600000
Verifying Checksum ... OK
Programing start at: 0x01200000
write : 100%
done
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
fail to load bootargsParametersV22.txt
fail to load bootargsParametersV21.txt
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'kernel.img'.
Download to address: 0x2000000
Downloading: #################################################
done
Bytes transferred = 1709672 (1a1668 hex)
do not find BOOT_IMG_NAME!
Erasing update flag partition.
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8

## Checking Image at 02000000 ...
Legacy image found
Image Name: kernel
Created: 2018-11-24 7:05:07 UTC
Image Type: ARM Linux Firmware (uncompressed)
Data Size: 1709608 Bytes = 1.6 MiB
Load Address: 00c80000
Entry Point: 01200000
Verifying Checksum ... OK
Programing start at: 0x00c80000
write : 100%
done
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
fail to load bootargsParametersV22.txt
fail to load bootargsParametersV21.txt
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'user-x.squashfs.img'.
Download to address: 0x2000000
Downloading: #################################################
done
Bytes transferred = 20004928 (1314040 hex)
do not find BOOT_IMG_NAME!
Erasing update flag partition.
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8

## Checking Image at 02000000 ...
Legacy image found
Image Name: user
Created: 2018-11-24 7:05:37 UTC
Image Type: ARM Linux Standalone Program (uncompressed)
Data Size: 20004864 Bytes = 19.1 MiB
Load Address: 01e00000
Entry Point: 03a80000
Verifying Checksum ... OK
Programing start at: 0x01e00000
write : 100%
done
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
fail to load bootargsParametersV22.txt
fail to load bootargsParametersV21.txt
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'web-x.squashfs.img'.
Download to address: 0x2000000
Downloading: #################################################
done
Bytes transferred = 7852096 (77d040 hex)
do not find BOOT_IMG_NAME!
Erasing update flag partition.
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8

## Checking Image at 02000000 ...
Legacy image found
Image Name: web
Created: 2018-11-24 7:05:12 UTC
Image Type: ARM Linux Standalone Program (uncompressed)
Data Size: 7852032 Bytes = 7.5 MiB
Load Address: 01600000
Entry Point: 01e00000
Verifying Checksum ... OK
Programing start at: 0x01600000
write : 100%
done
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
fail to load bootargsParametersV22.txt
fail to load bootargsParametersV21.txt
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'partition-x.cramfs.img'.
Download to address: 0x2000000
Downloading: #################################################
done
Bytes transferred = 4160 (1040 hex)
do not find BOOT_IMG_NAME!
Erasing update flag partition.
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8

## Checking Image at 02000000 ...
Legacy image found
Image Name: partition
Created: 2018-11-24 7:05:07 UTC
Image Type: ARM Linux Standalone Program (uncompressed)
Data Size: 4096 Bytes = 4 KiB
Load Address: 00500000
Entry Point: 00600000
Verifying Checksum ... OK
Programing start at: 0x00500000
write : 100%
done
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
fail to load bootargsParametersV22.txt
fail to load bootargsParametersV21.txt
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'custom-x.squashfs.img'.
Download to address: 0x2000000
Downloading: #################################################
done
Bytes transferred = 1044544 (ff040 hex)
do not find BOOT_IMG_NAME!
Erasing update flag partition.
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8

## Checking Image at 02000000 ...
Legacy image found
Image Name: custom
Created: 2018-11-24 7:05:58 UTC
Image Type: ARM Linux Standalone Program (uncompressed)
Data Size: 1044480 Bytes = 1020 KiB
Load Address: 00600000
Entry Point: 00940000
Verifying Checksum ... OK
Programing start at: 0x00600000
write : 100%
done
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
fail to load bootargsParametersV22.txt
fail to load bootargsParametersV21.txt
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'pd-x.squashfs.img'.
Download to address: 0x2000000
Downloading: #################################################
done
Bytes transferred = 73792 (12040 hex)
do not find BOOT_IMG_NAME!
Erasing update flag partition.
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8

## Checking Image at 02000000 ...
Legacy image found
Image Name: pd
Created: 2018-11-24 7:05:54 UTC
Image Type: ARM Linux Standalone Program (uncompressed)
Data Size: 73728 Bytes = 72 KiB
Load Address: 00940000
Entry Point: 00c80000
Verifying Checksum ... OK
Programing start at: 0x00940000
write : 100%
done
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
fail to load bootargsParametersV22.txt
fail to load bootargsParametersV21.txt
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename '.FLASHING_DONE_STOP_TFTP_NOW'.
Download to address: 0x2000000
Downloading: #
done
do not find BOOT_IMG_NAME!
Erasing update flag partition.
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8

## Checking Image at 02000000 ...
Legacy image found
Image Name: pd
Created: 2018-11-24 7:05:54 UTC
Image Type: ARM Linux Standalone Program (uncompressed)
Data Size: 73728 Bytes = 72 KiB
Load Address: 00940000
Entry Point: 00c80000
Verifying Checksum ... OK
Programing start at: 0x00940000
write : 100%
done
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
fail to load bootargsParametersV22.txt
fail to load bootargsParametersV21.txt
partition file version 2
rootfstype squashfs root /dev/mtdblock8
fail to load bootargsParameters.txt
fail to load bootargsParameters.txt file
get bootargs info failed
cmdLine console=ttyS0,115200 mem=198M root=/dev/mtdblock8 rootfstype=squashfs init=/linuxrc
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'success.txt'.
Download to address: 0x2000000
Downloading: *
TFTP error: (0)Erasing Nand...
Erasing at 0x360000 -- 100% complete.
Writing to Nand... unknown core,use back
done
Support backupVer:255
state:5a,err_count:01
## Booting kernel from Legacy Image at 02000000 ...
Image Name: Linux-3.10.73
Created: 2018-11-24 6:57:01 UTC
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 1709544 Bytes = 1.6 MiB
Load Address: 00208000
Entry Point: 00208000
Verifying Checksum ... OK
Loading Kernel Image ...OK
OK
partition file version 2
rootfstype squashfs root /dev/mtdblock8
fail to load bootargsParameters.txt
fail to load bootargsParameters.txt file
get bootargs info failed
cmdLine console=ttyS0,115200 mem=198M root=/dev/mtdblock8 rootfstype=squashfs init=/linuxrc
unknown phy memory type, use default
crashflasg:1, logmagic:54410011.

Starting kernel ...
unknown core,use back
▒


With TFTP off

U-Boot 2010.06-svn5213 (Sep 13 2018 - 14:55:04)
I2C: ready
DRAM: 198 MiB
gBootLogPtr:00b80008.
NAND: 128 MiB
amb_nand_read_oob read page:49152 err
partition file version 2
rootfstype squashfs root /dev/mtdblock8
fail to load bootargsParametersV22.txt
fail to load bootargsParametersV21.txt
fail to init bootargsParametersV2
TEXT_BASE:01000000
Net: Detected MACID:00:12:34:56:78:9a
PHY:0x001cc816,addr:0x00
s3l phy RTL8201 init

partition file version 2
rootfstype squashfs root /dev/mtdblock8
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'upgrade_info_7db780a713a4.txt'.
Download to address: 0x5000000
Downloading: *
Retry count exceeded; starting again
SD Product try auto upgrade times.
SD try times:1
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'upgrade_info_7db780a713a4.txt'.
Download to address: 0x5000000
Downloading: *
Retry count exceeded; starting again
string value is 0
AUF_getValidLine, the end of file
Failed to get a Line;Crc check error!
PreProcess data error!
Init error!
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'failed.txt'.
Download to address: 0x2000000
Downloading: *
Retry count exceeded; starting again
Support backupVer:255
state:5a,err_count:05
check partition....partition...custom...product...Kernel...romfs...web...user...Skip bad block 0x6000000
OK
restore partition from 0x3b80000 to 0x500000
write 100%
restore custom from 0x3c80000 to 0x600000
write 100%
restore product from 0x3fc0000 to 0x940000
write 100%
restore Kernel from 0x4300000 to 0xc80000
write 100%
restore romfs from 0x4880000 to 0x1200000
write 100%
restore web from 0x4c80000 to 0x1600000
write 100%
restore user from 0x5480000 to 0x1e00000
write 39%Skip bad block 0x6000000
write 100%
can't find uImage
resetting ...
 
Last edited:
Yes you need the upgrade_info_7db780a713a4.txt as that is the secret file generated by command.bat (Based on the contents of command.txt) that tells the camera what to do over TFTP.

unknown core,use back can also indicate that you've flashed the wrong firmware, can you confirm what file you've extracted to get the firmware files on the TFTP? The firmware is being flashed so I think it's either the wrong firmware your flashing or it can't load the firmware because of the bad block.

I can confirm the latest firmware will not work as they realigned the partition table:

romfs, 0, 0x0000000001200000, 0x0000000000800000, RW
web, 0, 0x0000000001a00000, 0x0000000000800000, RW
user, 0, 0x0000000002200000, 0x0000000001980000, RW
syslog, 0, 0x0000000007200000, 0x0000000000400000, RW
config, 0, 0x0000000007600000, 0x0000000000400000, RW
backup, 0, 0x0000000007a00000, 0x0000000000400000, RW

web under your environment is supposed to start at 1600000 and now it's meant to start at 1a00000.

Check your camera model
I downloaded the oldest copy of the firmware I can find 2.422 and it still has the web partition starting at 1a00000 so either your camera has been flashed with the wrong firmware previously and corrupted or your trying to flash the wrong firmware for your camera.

If you can confirm the camera model and what firmware you are trying to flash it would be a good start.

I am worried the camera could be dead or failing regardless:

Skip bad block 0x6000000
It's indicating that the NAND has a bad block right at the entrypoint for the custom partition.
 
Corellon said:
Yes you need the upgrade_info_7db780a713a4.txt as that is the secret file generated by command.bat (Based on the contents of command.txt) that tells the camera what to do over TFTP.

unknown core,use back can also indicate that you've flashed the wrong firmware, can you confirm what file you've extracted to get the firmware files on the TFTP? The firmware is being flashed so I think it's either the wrong firmware your flashing or it can't load the firmware because of the bad block.

I can confirm the latest firmware will not work as they realigned the partition table:

romfs, 0, 0x0000000001200000, 0x0000000000800000, RW
web, 0, 0x0000000001a00000, 0x0000000000800000, RW
user, 0, 0x0000000002200000, 0x0000000001980000, RW
syslog, 0, 0x0000000007200000, 0x0000000000400000, RW
config, 0, 0x0000000007600000, 0x0000000000400000, RW
backup, 0, 0x0000000007a00000, 0x0000000000400000, RW

web under your environment is supposed to start at 1600000 and now it's meant to start at 1a00000.

Check your camera model
I downloaded the oldest copy of the firmware I can find 2.422 and it still has the web partition starting at 1a00000 so either your camera has been flashed with the wrong firmware previously and corrupted or your trying to flash the wrong firmware for your camera.

If you can confirm the camera model and what firmware you are trying to flash it would be a good start.

I am worried the camera could be dead or failing regardless:

Skip bad block 0x6000000
It's indicating that the NAND has a bad block right at the entrypoint for the custom partition.
Click to expand...

Thanks! I was trying to use now I'll trying
The camera keep rebooting previously.
 
I don't think that will work still, are you sure you have the right model for the camera?

2.422.0000 still has
web, 0, 0x0000000001a00000, 0x0000000000800000, RW
in the partition table and your camera is expecting
web, 0, 0x0000000001600000, 0x0000000000800000, RW
That means that the romfs partition before it is larger.

Since that is the earliest firmware I can find and was made in 2016, while your bootloader is dated 2018 that makes one of the below the issue:
You have the wrong model version and are flashing the wrong firmware (Bootloader is correct, firmware is wrong)
You have the right model version but have the wrong bootloader (Incorrect flash previously)
Your camera isn't the camera it says it is (Counterfeit, different brand, etc)

To determine what it could be we need the HWID, since it's not in any of the environments you'll likely have to read the partition to memory and then either print to console or upload to the tftp server.

Something is not right between your camera model and the firmware one of them is incorrect.
 
You must log in or register to reply here.
Top Bottom