Anyone got any ideas? Also please let me know if I am posting this in the wrong section, im still trying to work out things here as a newbie..Hi all,
I'm trying to unbrick a cam and need some help. The cam has no network and when trying to connect using serial uart it is unable to communicate. The camera seems to power on as I can see the lens open and close but that's about it. Is it possible to brick a camera so far that it is not recoverable?
9Have you made sure you have both the tx and rx feeds connected to the right leads? In my camera I wouldn't get a response with just the rx connected and gibberish or nothing if the tx was on the wrong pad. Does the lens open and close right on power on or how long after power is applied?
Just to confirm :trying to connect using serial uart it is unable to communicate.
Both RX and TX would normally show +3.3v when the camera is powered on.I have also tried to use a multi meter to make sure I am connecting to the correct pins with no luck.
If by that you mean that no 'link detect' light shows on the router/switch port that it is wired to, that's not a good sign, and I'd not expect a firmware update to do that unless it trashed the bootloader.The cam has no network
I bought an "FT232RL 3.3V 5.5V FTDI USB to TTL Serial Adapter" like this one and configured Putty and the COM port in device manager with the settings you mentioned. I tired switching the RX and TX connections with no luck. PS no offence taken after all I am a noobJust to confirm :
You are using a 'serial TTL to USB convertor' as opposed to an RS232 interface?
Baud rate=115,200 8 bits no parity.
And apologies for the dumb question - you are connecting convertor RX to camera TX and vice versa?
I haven't got the camera in front of me at the moment but from memory I was not getting a link light. I will check it next time including the voltage from the RX and TX pins.Both RX and TX would normally show +3.3v when the camera is powered on.
If by that you mean that no 'link detect' light shows on the router/switch port that it is wired to, that's not a good sign, and I'd not expect a firmware update to do that unless it trashed the bootloader.
The camera I am working on is a Dahua IPC-HDW5431RP-Z. I checked the wiki and online but I don't believe it has been documented by anyone. Attached is a picture of the port inside of the camera including the voltages that I identified using a multi meter.Your interface and it's configuration sounds ok.
How confident are you that you have hooked it up to the serial console pads? Is it a camera for which that's been documented?
Thanks I get errors that it can't access both the success.txt and fail.txt.Create a success.txt and failed.txt file in the root directory of tftp server, see if it downloads either of those.
You should be getting one or the other to indicate if the process succeeded or failed, aside from that one line that stands out is:
amb_nand_read_oob read page:49152 err
That would incline me to lean to memory corruption or a bad block in the nand.
Ideally you also want to be TFTP'ing the same version of the firmware that you have on the camera, I helped one fella who was trying to flash the firmware and it was similar to yours and it would loop. Turned out that between the version on his camera and the version he was trying to patch they expanded one of the partitions to give more space but it wouldn't stick because the bootloader needed to be upgraded to register the new addresses to flash too. Flashing to the same version he had and then using the web gui to upgrade fixed the issue.
Do I need to use theroot\upgrade_info_7db780a713a4.txt?Client 192.168.1.108:3827 root\success.txt, File not found or No Access
That would indicate that the flash was a success, if you shutdown the TFTP server at that time the camera should boot normally.
fail to load bootargsParameters.txt
fail to load bootargsParameters.txt file
get bootargs info failed
These are pretty (to my knowledge) common messages when flashing through TFTP.
If it doesn't boot still then it would indicate that it's not strictly a flash failure and that there is something else going on, if you don't shut down the TFTP server the camera will see it and attempt to flash again over and over and if you shut it down to disconnect the camera in the middle of the flash it would likely cause it to not boot.
Also looking through the console log closely are you sure that is the complete copy and paste from the log? (Use the spoiler tag to keep formating easier and a shorter post) there are a few things that don't look right to me there that could contribute:
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'partition-x.cramfs.img'.Download to address: 0x2000000
Bytes transferred = 4160 (1040 hex)
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'custom-x.squashfs.img'.Download to address: 0x2000000
Bytes transferred = 57408 (e040 hex)
Using ambarella mac device
There is no output from flashing those files, it appear they were just downloaded but not flashed. make sure your using run dp, otherwise you might need to change the command.txt file (and run the bat afterwords) replacing run dp and run dc with:
tftp 0x2000000 partition-x.cramfs.img; flwrite
tftp 0x2000000 custom-x.squashfs.img; flwrite
It would help if you can post a copy of the commands.txt file that your using as well.
Thanks! I was trying to useYes you need the upgrade_info_7db780a713a4.txt as that is the secret file generated by command.bat (Based on the contents of command.txt) that tells the camera what to do over TFTP.
unknown core,use back can also indicate that you've flashed the wrong firmware, can you confirm what file you've extracted to get the firmware files on the TFTP? The firmware is being flashed so I think it's either the wrong firmware your flashing or it can't load the firmware because of the bad block.
I can confirm the latest firmware will not work as they realigned the partition table:
romfs, 0, 0x0000000001200000, 0x0000000000800000, RW
web, 0, 0x0000000001a00000, 0x0000000000800000, RW
user, 0, 0x0000000002200000, 0x0000000001980000, RW
syslog, 0, 0x0000000007200000, 0x0000000000400000, RW
config, 0, 0x0000000007600000, 0x0000000000400000, RW
backup, 0, 0x0000000007a00000, 0x0000000000400000, RW
web under your environment is supposed to start at 1600000 and now it's meant to start at 1a00000.
Check your camera model
I downloaded the oldest copy of the firmware I can find 2.422 and it still has the web partition starting at 1a00000 so either your camera has been flashed with the wrong firmware previously and corrupted or your trying to flash the wrong firmware for your camera.
If you can confirm the camera model and what firmware you are trying to flash it would be a good start.
I am worried the camera could be dead or failing regardless:
Skip bad block 0x6000000
It's indicating that the NAND has a bad block right at the entrypoint for the custom partition.