FYI - LeChange / Dahua 8x 8MP/4K UHD IP PoE cameras + 16 channel port PoE NVR 2/3TB HDD $899 7/13/18

Ok, in addition to what I noted above..

I added a dumb switch between the NVR and PC. No change in behavior.. the screens looked & behaved exactly like when the PC and NVR were directly connected.

I also noticed some more details around the custom-x bin file failing to transmit.
Attached is a picture of it. as you can see, the ID text file ahead of it, and the failed.txt file after it transmit fine. Something about the custom-x bin file is problematic?wireshark pic.jpg
 
Looks like it is just not "getting" the .img file.

Not sure if this will help, but move the flash/tftp files to the root of your hard drive (Place the fw root/tftp folder and files directly on the C:\ drive) and ensure you have admin privileges on that folder.

Also looking at your capture there is alot of activity going on there...

Try setting your NVR back to DHCP (or static to a different ip, x.1.155 or something), plug it back into your router and reboot, let it get an IP from your router and then unplug and plug back into the dumb switch and reboot again...

I am not sure if having it static'ed to the .108/24 IP is affecting something, but it will default to the .108 ip when it reboots anyway...

Also disable ipv6 on your nic, not sure what's talking on that (makes it a little easier to read).
 
Last edited:
  • Like
Reactions: Otown
@Otown I agree with @d.lux , you seem to have an issue on your machine for the TFTP server being able to access or transfer the .img file(s).

  • See the screenshot below, on No 5221 (left column) I see the contents of your "ID_4AXXX.txt" file being sent to the NVR successfully (you can see the contents at the far bottom).
  • It then requests "custom-x.squashfs.img" as expected on #5225
  • It looks like it's trying to send the file on the subsequent "Data Packet" lines (#5229, #5256, #5261) (But to validate this is the actual file you'd need to open "custom-x.squashfs.img" in a hex editor and compare the values, but at first glace it does appear to be the correct file being sent and the process looks to start successfully)
  • I believe your issue is that it times out (has a 1-second timeout, you can see that the time between #5261 and #5289 exceeds one whole second (looking at the time column), so is a valid error response).

So my suggestions are the following:
1) Attempt this with a different/shorter network cable (cable may be faulty)
2) Attempt to extend the timeout (I see a config file for the TFTP server under "Dahua_TFTPBackup > bin > OpenTFTPServerMT.ini" with a default "timeout=60", might want to bump this up to like 180), but this is assuming the NVR doesn't have a fixed timeout itself.
3) There may be a permission issue with your machine reading the extracted .img files. Follow the suggestions to fix this. I also would suggest 1) Ensuring that the Dahua_TFTPBackup file is somewhere very accessible to your users (Desktop, Documents, etc.) 2) DO NOT run this out of a flash drive (This will add a lot of overhead time and lead to a timeout, may have different permissions, run it from the local machine) 3) Perhaps re-extract the firmware files into "root" to ensure proper permissions are set with the new machine/user 4) Check the file/folder permissions to ensure they're open

Note: You can apply a filter to wireshark to cut out a lot of the extra noise, below I'm using the filter ip.host matches "^192\.168\.254\.*" in order to only look at the communication with the TFTP process.

ws1.jpg
 
Last edited:
  • Like
Reactions: Otown
d.lux said:
Looks like it is just not "getting" the .img file.

Not sure if this will help, but move the flash/tftp files to the root of your hard drive (Place the fw root/tftp folder and files directly on the C:\ drive) and ensure you have admin privileges on that folder.

Also looking at your capture there is alot of activity going on there...

Try setting your NVR back to DHCP (or static to a different ip, x.1.155 or something), plug it back into your router and reboot, let it get an IP from your router and then unplug and plug back into the dumb switch and reboot again...

I am not sure if having it static'ed to the .108/24 IP is affecting something, but it will default to the .108 ip when it reboots anyway...

Also disable ipv6 on your nic, not sure what's talking on that (makes it a little easier to read).
Click to expand...

@d.lux I tried all your suggestions and no success :(

1) moved the folder to c:\ and checked all the permissions. No change.. same time out issue.
2) moved the static IP to x.1.155 and rebooted multiple times. No change. same behavior/timeout as before.
3) disabled ipv6

ip_poe said:
@Otown I agree with @d.lux , you seem to have an issue on your machine for the TFTP server being able to access or transfer the .img file(s).

  • See the screenshot below, on No 5221 (left column) I see the contents of your "ID_4AXXX.txt" file being sent to the NVR successfully (you can see the contents at the far bottom).
  • It then requests "custom-x.squashfs.img" as expected on #5225
  • It looks like it's trying to send the file on the subsequent "Data Packet" lines (#5229, #5256, #5261) (But to validate this is the actual file you'd need to open "custom-x.squashfs.img" in a hex editor and compare the values, but at first glace it does appear to be the correct file being sent and the process looks to start successfully)
  • I believe your issue is that it times out (has a 1-second timeout, you can see that the time between #5261 and #5289 exceeds one whole second (looking at the time column), so is a valid error response).

So my suggestions are the following:
1) Attempt this with a different/shorter network cable (cable may be faulty)
2) Attempt to extend the timeout (I see a config file for the TFTP server under "Dahua_TFTPBackup > bin > OpenTFTPServerMT.ini" with a default "timeout=60", might want to bump this up to like 180), but this is assuming the NVR doesn't have a fixed timeout itself.
3) There may be a permission issue with your machine reading the extracted .img files. Follow the suggestions to fix this. I also would suggest 1) Ensuring that the Dahua_TFTPBackup file is somewhere very accessible to your users (Desktop, Documents, etc.) 2) DO NOT run this out of a flash drive (This will add a lot of overhead time and lead to a timeout, may have different permissions, run it from the local machine) 3) Perhaps re-extract the firmware files into "root" to ensure proper permissions are set with the new machine/user 4) Check the file/folder permissions to ensure they're open

Note: You can apply a filter to wireshark to cut out a lot of the extra noise, below I'm using the filter ip.host matches "^192\.168\.254\.*" in order to only look at the communication with the TFTP process.

View attachment 55070
Click to expand...

@ip_poe no luck with your suggestions either.

1) switched to a shorty cable (~24 ") no change..
2) changed the timeout in the .ini file to 180, no change.
3) re-extracted both the TFTP backup file & the NVR fw files. Ran them from both the C:\ drive and desktop (I never ran them off a thumbdrive). Checked all the permissions, all users had full authority.

attached are two wireshark files running during the various tries with all the suggested changes. (I ran the suggested filters, hope they saved..)

To add to the mystery, I was able to succesfully flash all the IP cameras with the TFTP tool and the appropriate firmware. That went smooth..

Thoughts?

Not sure if this is noteworthy, but the machine I borrowed is an older Win 7 machine (perhaps 5-10 years old.) Intel core i5 M 430 @2.27 GHz , 4 GB ram and x64 bit. It does seem to run slow, but wireshark and the .bat files seem to run reasonably fast. I assume this shouldn't be taxing for an older processor?

One other question, i still have all my cameras hooked into my NVR while attempting to update the NVR. do i need to disconnect them/are they causing me grief here?
 

Attachments

Last edited:
Hmm, now thinking about it, I flashed my NVR with no cameras attached...

Give that a try and let us know

(I'll take a peek at your pcaps later this evening)
 
Otown said:
@ip_poe no luck with your suggestions either.
One other question, i still have all my cameras hooked into my NVR while attempting to update the NVR. do i need to disconnect them/are they causing me grief here?
Click to expand...

Mine flashed fine with the cameras attached, however I already flashed all the cameras to dahua prior, so not sure that would make a difference. Wouldn't hurt to try it though.

Your PC flashed the cameras fine so perhaps there is something different with your NVR or your flash method. I'm curious:
  • Do you have the 8 or 16 channel LeChange NVR?
  • Do you have the latest LeChange Firmware installed? (I believe there was one firmware update before they called it quits, attempt the auto update feature while the NVR is online)
  • Do you have a monitor attached to the NVR to see what it's doing during the flash attempts? Does it appear to be rebooting on it's own when the flash is happening? Does it reboot after failure?
  • Are you giving adequate time for the NVR to be powered down before attempting to flash? If you just quickly flip the power switch off and back on quickly it may not be enough time for it to be fully purged and ready for the firmware flash steps (aka may be in a "warm boot" state and may bypass some steps), ensure at least 30 seconds before powering the NVR on (maybe even unplug the power cord and wait 30 seconds). Make sure the network cable is plugged in and the TFTP/Console scripts are running and ready on the PC and power from a cold boot.

Which version of "DH_NVR4XXX-4KS2_MultiLang_V3.216.0000003.0.R.190521.zip" did you download from Dahua's download site? I believe there were two with the same name but with different dates, I tried with the newest one, perhaps try with the version you haven't been using.

Yeah I'd say last resort try on another PC, I know that can be a hassle though. I'm running out of ideas because there seems to be no other factors or differences by this point and mine worked fine the first attempt :)
 
  • Like
Reactions: Otown
@ ip_poe

  • Do you have the 8 or 16 channel LeChange NVR?
    • I'm running the 16 channel
  • Do you have the latest LeChange Firmware installed? (I believe there was one firmware update before they called it quits, attempt the auto update feature while the NVR is online)
    • I believe I have the latest. when i request an auto-update it says I have the latest. (Do you happen to know what version it is, so I can double check it?)
  • Do you have a monitor attached to the NVR to see what it's doing during the flash attempts? Does it appear to be rebooting on it's own when the flash is happening? Does it reboot after failure?
    • I connected it to my TV via HDMI.
    • During the flash attempt, it stalls on the "Lechange" startup page. I've left it for up to ~ 30+ min and it's just stuck on that page.
  • Are you giving adequate time for the NVR to be powered down before attempting to flash? If you just quickly flip the power switch off and back on quickly it may not be enough time for it to be fully purged and ready for the firmware flash steps (aka may be in a "warm boot" state and may bypass some steps), ensure at least 30 seconds before powering the NVR on (maybe even unplug the power cord and wait 30 seconds). Make sure the network cable is plugged in and the TFTP/Console scripts are running and ready on the PC and power from a cold boot.
    • Good idea. I've usually only waited a few second, just long enough for the fan to spin down. I'll try unplugging it and leaving it off for longer. Fingers crossed..
  • Which version of "DH_NVR4XXX-4KS2_MultiLang_V3.216.0000003.0.R.190521.zip" did you download from Dahua's download site? I believe there were two with the same name but with different dates, I tried with the newest one, perhaps try with the version you haven't been using.
    • I'm using the latest version. I'll give the slightly older version a try tonight as well.
  • Trying a new PC..
    • If the earlier two ideas don't pan out, I'll see if I can source another laptop..

The saga continues!

BTW, thanks for the encouragement/tips on WS, very helpful now, especially watching a health flash of the cameras.. It's been a great learning ride so far, so no regrets of the ~12+ hrs I've sunk into it so far...
 
ip_poe has a good point, use the upper most FW file on the Dahua website, the 200+MB zip file...

Keep us posted...
 
  • Like
Reactions: Otown
@Otown Not sure on what the exact version of the latest LeChange firmware was, I recall it was released mid-to-late 2017 though, might want to search for the version number within this site to see if it's mentioned elsewhere (I recall it being installed when I first setup the NVR so you probably already have it). But yeah this is some good practice for becoming a power user and definitely good things to know especially if you continue to pursue anything related to computing. Plus the thrill of successfully hacking a device is very rewarding and addicting :)
 
  • Like
Reactions: Otown
@d.lux & @ip_poe

still no luck.

  1. tried leaving the nvr off for 1-2 minutes unplugged then running the steps.
  2. I am using the 200+ MB file (dated 02/08/2019)
  3. I looked at the other 4 files available on dahua's website, but they are all ~50mb and just bin files, so I don't think they'll work for me?
  4. my NVR is currently on firmware dated 2017-11-06 v3.215.0000000.3 (the web interface says this is the latest version)
    1. I searched lechanges website to see if this was the latest, but they seem to have removed reference to this product :(

I don't have a line on another computer quite yet, but that's next on my list to try.. IF this doesn't work, I'm stuck again :(
 
I finally got the NVR flash to work after several tries. Also thought I bricked it several times, but all is well and I can view from my phone as well.
My first few attempts was with the latest 4.0 version with the new GUI and it just hung on a dark boot screen. I only got it to work correctly after flashing a V3 version, then allowing it to upgrade to 4.0 within the setup.

Eventually I'll get around to the cameras, but my primary concern was the NVR. Thanks all for the detailed instructions. If you're afraid of bricking, it seems that it's salvageable regardless of how many times you pull out the cord in frustration.

Tips:
  • I didn't use wireshark, but monitored the trusty Windows Network Status to see how much data was being back and forth.
  • When data activity stopped, I unplugged/plugged back in and it started up with the new version, but rebooted several times sporadically. Be sure to have the newest 4.0 version handy and do the next upgrade (via USB stick) directly from the NVR.
 
Last edited:
  • Like
Reactions: ip_poe and d.lux
@ip_poe & @d.lux
Success!

I lined up a second PC and was able to load the fw on the NVR.
I got stuck in a reboot loop every 2-3 min like @Levin83 earlier, but used the thumbdrive method to recover.
Once running stable, I found one more update for a december 2019 FW update, applied it, and running happily ever since.

Thanks for the help!

Great learning experience :)
 
  • Like
Reactions: deshaun, ip_poe and d.lux
Congratulations @Otown! Glad we could help and that you didn't give up :) That's very strange that it just didn't work on that other PC, must have had bad NIC drivers or some other bad configuration.

To thread viewers: I suspect that going with the older of the two V3 firmware downloads dated 03/07/2018 may prevent the reboot loop. But it's no big hassle to be stuck in the reboot loop (besides some brief panic). I updated my original post with this note too.
 
  • Like
Reactions: Otown
Congrats @Otown

It would be interesting to find out "why" the other PC was blocking comms to the NVR and not the cams, but in the end you got it done..

Enjoy FW updates from Dahua and have fun
 
  • Like
Reactions: Otown
Has anyone been able to get Face Detection working post Dahua flash? Both the Cameras and the NVR have the feature available but for some reason I can't get it to work right, I saw some videos of people setting it up but it doesn't detect a face at all when I attempt it. I'm assuming it works like IVS in the AI menu, but it just doesn't detect the events at all.
 
Just to update this thread (might be useful to condense the meat of the FW flash to a separate thread?) but I recently had to flash a Lechange (same 8 port NVR) unit for my buddy to a Dahua setup and the process was a little different than when I did mine.

First, my camera commands.txt needs adjusted -- commands tk and up appears not needed.

These commands were used for first flash.

run da
run dr
run dk
run du
run dw
run dp
run dc
tftp 0x82000000 .FLASHING_DONE_STOP_TFTP_NOW
sleep 5

Although, after a flash the cams were in a boot loop. The console would display "unable to load bootArgsparameters.txt".

I then adjusted my cameras commands.txt -- removed da command and added the pd-x.squashfs.img; flwrite

run dr
run dk
run du
run dw
run dp
run dc
tftp 0x82000000 pd-x.squashfs.img; flwrite
tftp 0x82000000 .FLASHING_DONE_STOP_TFTP_NOW
sleep 5

The cameras would then boot to the assigned IP from the NVR monitored via wireshark (if you want to browse to this page, ensure you "lechange" your nic IP :p )

Onto the NVR --

I figured going in steps was a better procedure than going straight to Rev 4.0, although I hit a speed bump on the 3.216 Rev.

The NVR would reboot every few mins (Like @Levin83 had issues with)

I was nervous about flashing from USB, although after many attempts with TFTP and the NVR still power cycling I was at an impasse. (versions 3.216 and 4.0 were flashed multiple times from TFTP)

I booted up the NVR and logged into it, plugged in the flash and choose to upgrade the FW.

Luckily the FW flashed quick enough to take before the unit wanted to power cycle.

After the USB flash, the unit no longer power cycled.

Hope this update helps others in the future.
 
Nice follow up @d.lux . The updated commands.txt could be useful for others who need help. Also to others if you end up at the bootloop after NVR flash, dont't even attempt to reflash it again thru TFTP. By the time you can ping the NVR it would have rebooted. Just flash it again thru a flashdrive. From what i remember, i just inserted the flash drive in and upon reboot it asked if i wanted to update or not and it only takes a couple seconds.
 
  • Like
Reactions: d.lux
d.lux said:
Just to update this thread (might be useful to condense the meat of the FW flash to a separate thread?) but I recently had to flash a Lechange (same 8 port NVR) unit for my buddy to a Dahua setup and the process was a little different than when I did mine.

First, my camera commands.txt needs adjusted -- commands tk and up appears not needed.

These commands were used for first flash.

run da
run dr
run dk
run du
run dw
run dp
run dc
tftp 0x82000000 .FLASHING_DONE_STOP_TFTP_NOW
sleep 5

Although, after a flash the cams were in a boot loop. The console would display "unable to load bootArgsparameters.txt".

I then adjusted my cameras commands.txt -- removed da command and added the pd-x.squashfs.img; flwrite

run dr
run dk
run du
run dw
run dp
run dc
tftp 0x82000000 pd-x.squashfs.img; flwrite
tftp 0x82000000 .FLASHING_DONE_STOP_TFTP_NOW
sleep 5

The cameras would then boot to the assigned IP from the NVR monitored via wireshark (if you want to browse to this page, ensure you "lechange" your nic IP :p )

Onto the NVR --

I figured going in steps was a better procedure than going straight to Rev 4.0, although I hit a speed bump on the 3.216 Rev.

The NVR would reboot every few mins (Like @Levin83 had issues with)

I was nervous about flashing from USB, although after many attempts with TFTP and the NVR still power cycling I was at an impasse. (versions 3.216 and 4.0 were flashed multiple times from TFTP)

I booted up the NVR and logged into it, plugged in the flash and choose to upgrade the FW.

Luckily the FW flashed quick enough to take before the unit wanted to power cycle.

After the USB flash, the unit no longer power cycled.

Hope this update helps others in the future.
Click to expand...
Thank you very much. You saved the weekend. My Lechange cameras were on 2.622.0000001.18.R, Build Date: 2017-12-13 and the process was failing, looking for "update.img" but there was no such file. First I thought the Danua download is screwed up (or they removed this file) because the zip was only ~55mb. It was mentioned multiple times that it is 190.97 and Dahua site states so, but none of you bothered to upload that file or mention it's actual size. :angry:

New info about NVR update(old firmware files missing on dahua.com):
DH_NVR4XXX-4KS2_MultiLang_V3.216.0000003.0.R.190521 file was NOWHERE to be found. It is no longer on Dahua downloads. They only had one (the latest) version -DH_NVR4XXX-4KS2_MultiLang_V4.001.0000000.1.R.200319 (ATTACHED TO THIS POST). And of course, none of you had uploaded the 3.216 bin :angry:. So I took a deep breath and TFTP-ed the contents of 4.001.0000000.1.R.200319. That failed - got the Dahua logo but no boot and thus no option to image by flash drive.
So then I TFTP-ed the contents of DH_NVR4XX and it booted up with the already discussed reboot issue every 2-3 minutes. Then I popped up a flash drive with DH_NVR4XXX-4KS2_MultiLang_V4.001.0000000.1.R.200319.bin and update from there. Note: prepare easy to type with on screen/mouse password, unplug ethernet so it doesn't offer you online update; boot with flash drive already in; take your time and be familiar with the process and button process so you can start the USB update as quick as possible(so it does not reboot during the update).

All is good so far. One noticeable improvement for me was improved RTSP handshake. With the LeChange firmware, with a specific device (Linux propitiatory box), the RTSP stream would take 15-20 seconds to start. That is no longer the case. Details in this thread.

Thanks to everyone who risked their devices to make this guide possible. I hope my updates will help someone in the future.
@d.lux @Joby619 @Levin83 @ip_poe
 

Attachments

Last edited:
  • Like
Reactions: Purduephotog and d.lux
Hi All,
I read everything thoroughly in this thread so far but I still can't figure out how update my cameras to the Dahua fw.
I have download the Firmware from Dahua and even used the firmware posted it here but it is still not updating.
Where do I find the "romfs-x.squashfs.img" since it is not in the firmware zip that I download.

Thanks in advance.
 

Attachments

  • Capture.PNG
    Capture.PNG
    17.6 KB · Views: 16
You must log in or register to reply here.
Top Bottom