FYI - LeChange / Dahua 8x 8MP/4K UHD IP PoE cameras + 16 channel port PoE NVR 2/3TB HDD $899 7/13/18

[Joby619]

Excellent!

So you just pushed the camera FW via the NVR interface, or did you have to use uart cable? (Like stated from a different user above?)

Thanks for the replies, much appreciated sir

I used the method describe in the following thread: Dahua IPC EASY unbricking / recovery over TFTP

Only hardware used was a laptop for TFTP, a standard cat5 Ethernet cable and power supplies for cameras and nvr.

 

[d.lux]

Awesome, appreciate the info, very helpful!

 

[d.lux]

Wow, after much trial and error, I came up with this command.txt file (for those interested) for flashing my NK168P083-IPC (Lechange) cams to IPC-HFW4831E-SE (Dahua) cams --

Spoiler

run da
run dr
run dk
run du
run dw
run dp
run dc
run up
run tk
tftp 0x82000000 .FLASHING_DONE_STOP_TFTP_NOW
sleep 5

Just for reference, my bench setup is an unmanaged 4-port switch, a POE injector, a couple long ethernet cables , a female-female ethernet coupler and my NUC pc...

I tried many many different iterations of command.txt and finally found a combination that worked.

I would monitor wireshark and note what appeared to be a boot loop during failed attempts, but after the above command.txt, I finally saw the camera attempt to reach google dns for the Dahua "P2P" service.

I then attempted to browse to 192.168.1.108 (default ip) and it landed on a page...

Then, after plugging it into my "Lechange" NVR, the NVR picked it up, but would not stream the video...

I popped off the SD card/reset cover, held reset for 10-15 secs and let it reboot.

Then the NVR picked it up again and then I could see the video stream...

Just to confirm, this cam flashed as a Dahua IPC-HFW4831E-SE (V2.800.0000008.0.R, Build Date: 2019-06-19) appears to work fine with the Lechange NVR FW (3.215.0000000.3Build Date:2017-11-06)
Thanks for all the helpful posts and here's to cross-flashing your Lechange cams to Dahua...

I'll report back when I spend some time on the NVR and my roadblocks.

Time for another beer.......................

Edit - Cam FW attached (Full filename from Dahua is - DH_IPC-HX5X3X-Rhea_MultiLang_NP_Stream3_V2.800.0000008.0.R.190619)

Edit edit -- The above was done on a cam that was never "registered" with my NVR. After preforming a flash to one that was previously attached to the NVR, I noted (via wireshark) that the IP assigned to it from the NVR will return after a flash...The NVR picked it up automagically...
After manually flashing the cam, I returned to the browser page of the cam (change static IP) and "re-ran" the firmware update from the browser being I noted various little hiccups during the manual flash, not sure if this is necessary, but gave me warm and fuzzies (thanks @Joby619 for the pointer)

 

[d.lux]

Wellp, the NVR flashed just fine to FW - DH_NVR4XXX-4KS2_MultiLang_V3.216.0000003.0.R.190521

Just need the txt file "ID_YourSerialNumberHere.txt in the root folder with the following lines - (be sure to blow out the other image files from the camera and copy in the files from the nvr binaries)

Spoiler

custom-x.squashfs.img
logo-x.squashfs.img
web-x.squashfs.img
romfs-x.squashfs.img

After the success.txt message, I let is sit for 4-5 mins then hard power cycled the unit, all came up just fine and is now a Dahua branded NVR.

 

[Levin83]

Congrats d.lux! Is there any improved benefit you noticed after flashing the latest firmware?

 

[d.lux]

I don't see anything "new" from the cross-flash, but I believe the benefit now is I can get future firmware updates from Dahua

 

[Joby619]

Wow, after much trial and error, I came up with this command.txt file (for those interested) for flashing my NK168P083-IPC (Lechange) cams to IPC-HFW4831E-SE (Dahua) cams --

Spoiler

run da
run dr
run dk
run du
run dw
run dp
run dc
run up
run tk
tftp 0x82000000 .FLASHING_DONE_STOP_TFTP_NOW
sleep 5

Just for reference, my bench setup is an unmanaged 4-port switch, a POE injector, a couple long ethernet cables , a female-female ethernet coupler and my NUC pc...

I tried many many different iterations of command.txt and finally found a combination that worked.

I would monitor wireshark and note what appeared to be a boot loop during failed attempts, but after the above command.txt, I finally saw the camera attempt to reach google dns for the Dahua "P2P" service.

I then attempted to browse to 192.168.1.108 (default ip) and it landed on a page...

Then, after plugging it into my "Lechange" NVR, the NVR picked it up, but would not stream the video...

I popped off the SD card/reset cover, held reset for 10-15 secs and let it reboot.

Then the NVR picked it up again and then I could see the video stream...

Just to confirm, this cam flashed as a Dahua IPC-HFW4831E-SE (V2.800.0000008.0.R, Build Date: 2019-06-19) appears to work fine with the Lechange NVR FW (3.215.0000000.3Build Date:2017-11-06)
Thanks for all the helpful posts and here's to cross-flashing your Lechange cams to Dahua...

I'll report back when I spend some time on the NVR and my roadblocks.

Time for another beer.......................

Edit - Cam FW attached (Full filename from Dahua is - DH_IPC-HX5X3X-Rhea_MultiLang_NP_Stream3_V2.800.0000008.0.R.190619)

Edit edit -- The above was done on a cam that was never "registered" with my NVR. After preforming a flash to one that was previously attached to the NVR, I noted (via wireshark) that the IP assigned to it from the NVR will return after a flash...The NVR picked it up automagically...
After manually flashing the cam, I returned to the browser page of the cam (change static IP) and "re-ran" the firmware update from the browser being I noted various little hiccups during the manual flash, not sure if this is necessary, but gave me warm and fuzzies (thanks @Joby619 for the pointer)

Great job d.lux!!! Thanks for sharing your experience with everyone. My cross flashed Lechange to Dahua system has been running strong.

 

[d.lux]

Sorry to keep bumping this thread, but for those interested, I went ahead and flashed the NVR to the new v4.0 (4.000.0000001.4.R.191129) and all is well...

 

[Joby619]

Sorry to keep bumping this thread, but for those interested, I went ahead and flashed the NVR to the new v4.0 (4.000.0000001.4.R.191129) and all is well...

Thanks for the heads up. I didn’t realize there was updated FW available.

 

[MarkS11]

Wow, after much trial and error, I came up with this command.txt file (for those interested) for flashing my NK168P083-IPC (Lechange) cams to IPC-HFW4831E-SE (Dahua) cams --

Spoiler

run da
run dr
run dk
run du
run dw
run dp
run dc
run up
run tk
tftp 0x82000000 .FLASHING_DONE_STOP_TFTP_NOW
sleep 5

Just for reference, my bench setup is an unmanaged 4-port switch, a POE injector, a couple long ethernet cables , a female-female ethernet coupler and my NUC pc...

I tried many many different iterations of command.txt and finally found a combination that worked.

I would monitor wireshark and note what appeared to be a boot loop during failed attempts, but after the above command.txt, I finally saw the camera attempt to reach google dns for the Dahua "P2P" service.

I then attempted to browse to 192.168.1.108 (default ip) and it landed on a page...

Then, after plugging it into my "Lechange" NVR, the NVR picked it up, but would not stream the video...

I popped off the SD card/reset cover, held reset for 10-15 secs and let it reboot.

Then the NVR picked it up again and then I could see the video stream...

Just to confirm, this cam flashed as a Dahua IPC-HFW4831E-SE (V2.800.0000008.0.R, Build Date: 2019-06-19) appears to work fine with the Lechange NVR FW (3.215.0000000.3Build Date:2017-11-06)
Thanks for all the helpful posts and here's to cross-flashing your Lechange cams to Dahua...

I'll report back when I spend some time on the NVR and my roadblocks.

Time for another beer.......................

Edit - Cam FW attached (Full filename from Dahua is - DH_IPC-HX5X3X-Rhea_MultiLang_NP_Stream3_V2.800.0000008.0.R.190619)

Edit edit -- The above was done on a cam that was never "registered" with my NVR. After preforming a flash to one that was previously attached to the NVR, I noted (via wireshark) that the IP assigned to it from the NVR will return after a flash...The NVR picked it up automagically...
After manually flashing the cam, I returned to the browser page of the cam (change static IP) and "re-ran" the firmware update from the browser being I noted various little hiccups during the manual flash, not sure if this is necessary, but gave me warm and fuzzies (thanks @Joby619 for the pointer)

WoW d.lux Fantastic Job!! Thanks for sharing your scripts that worked

I had decided after reading through the linked forums the first time to put off my attempt until after the Holidays were settled

After reading your second edit I wanted to get your suggestion for moving forward after Christmas. I bench tested my cameras when I first got them on my laptop, but I never even pulled the NVR out of the box yet - I have a couple of questions to ask you

1) From your comment it sounds like I should hook the cameras up to the NVR and register them to that unit first before I flash the Dahua FW to each of them .. is this what you would recommend?

2) When you returned to the browser page and "re-ran" the firmware update - was this using the standard method for updating firmware like it was an OEM Dahua camera or were you still following instructions from the unbricking/recovery threads?

Sorry to keep bumping this thread, but for those interested, I went ahead and flashed the NVR to the new v4.0 (4.000.0000001.4.R.191129) and all is well...

3) Was this update to the FW run through the normal update method just like it was OEM Dahua NVR?

Thanks so much for updating and posting - I don't feel as intimidated now that I know the road has been traveled successfully a couple times before

 

[d.lux]

Question 1 - Yes, I would recommend letting the cam get an IP first from the NVR, seemed to be easier AFTER the flashing that the cam would "revert" to the NVR assigned IP after the flash...

I could walk away from the TFTP server and check on it after the flash was complete (view wireshark and watch the broadcast comms) and note the 10.1.x subnet ip.

Question 2 - After the manual flash, I would simply "re-flash" from the browser of the cam/nvr to ensure the flash was sucessful.

Question 3 - The first iteration of the flash was done manually as with the first iteration of V4.0...This morning I ran a manual firmware check and found that a new version of V4.0 has been released and was picked up automagically by the NVR and I applied it. (12/09/19)

As a tip of advice, the BIN files I attached are not the "complete" set of files you need for a manual flash, visit the Dahua Firmware section and get the complete file name I provided (Thanks @Levin83 for the pointer)

Hope this helps!

 

[Levin83]

Hey there Mark here's how the flashing went down for me. First off you want to grab the 190.97 MB firmware update DH_IPC-HX5X3X-Rhea_MultiLang_NP_Stream3_V2.800.0000008.0.R.190619 from Support - Dahua Technology - Leading Video Surveillance Solution Provider with CCTV Product . When you get there click on Download center and search DH_IPC-HX5X3X . If you don't see download center after you clicked on it, close the site and try again. After you get that file, unzip, and copy/move all the .img files to the folder named "Root" of Dahua_TFTPBackup which you should acquire from Dahua IPC EASY unbricking / recovery over TFTP After 5 min or so, i saw a failed.txt file not found or no access appear and nothing happened after that. I heard my camera turning on, navigated to 192.168.1.108 and it loaded right up. I never saw the .FLASHING_DONE_STOP_TFTP_NOW message. I later then reflashed the camera with the .bin firmware thru the camera's webpage. Originally i used the firmware d.lux provided, for me It would go in to a infinite flash loop because update.img was missing. It was running for 15 min and i looked at the TFTP command window and noticed it was reuploading the same files again and again.

As for the NVR, i followed d.lux's steps, its then same thing as the camera except don't run commands.bat and acquire your serial number from the webpage of the NVR to a text tile named "ID_YourSerialNumberHere.txt" place that in the Root folder and add these lines in it

custom-x.squashfs.img
logo-x.squashfs.img
web-x.squashfs.img
romfs-x.squashfs.img

Extract the files from DH_NVR4XXX-4KS2_MultiLang_V3.216.0000003.0.R.190521.bin and copy/move those files to the "root" folder of TFTP

After flashing, i did see a Success message but nothing was happening. I'm standing in front of my NVR connected to a monitor and it's sitting at the Lechange logo for 10 minutes. I decided to unplug it and plug it back in and i saw the Dahua logo. However for me the NVR was rebooting every 2-3 min on it's own. I decided to flash the firmware again but i couldn't risk doing it thru the webpage because of the rebooting so i copied the .bin to a flash drive and stuck it in the front usb port of the nvr and updated it that way. After that its been rock solid for me. Again thank you @d.lux for your help.

 

[Joby619]

Just a quick update on my NVR that was cross flashed to Dahua. In the IMOU app it showed new firmware was available and it let me update the NVR to the new v4.0 (4.000.0000001.4.R.191129) directly from the app. This makes updating to the latest OEM FW even easier!

 

[ip_poe]

Wellp, the NVR flashed just fine to FW - DH_NVR4XXX-4KS2_MultiLang_V3.216.0000003.0.R.190521

Edit: I've successfully flashed my cameras and NVR, I'll update the following steps with what I actually did and what I observed.

• Notes on the differences between the two types of firmware files to apply: One is a packaged type that contains the individual lib/img files, this format is needed when performing initial flashes and to actually migrate over to Dahua firmware. The second is a larger .bin file (one each for the cams/nvr), which can be applied after the fact to either fix an issue or to ensure a successful flash. The latter .bin file method is done on the cams via their web interface, or on the NVR either through the web interface or via a USB drive (an option comes up to let you pick the .bin to update to).

Here's my breakdown of the steps I actually took, and I left in my initial questions/assumptions to maybe help clear up any confusion for someone new to this (Like I was). This first section describes the process to convert/flash the Cams. I'm going based off of the main post on page one here.

1) Obtain network access to the camera as described in the post, to/from a windows machine. Run wireshark to monitor the network traffic.
Steps I took / my setup:

• Physical Connection: I used a separate machine as I would lose internet access, I used a flash drive to transfer needed files to/from this machine as needed. I used a single network cable to go from the PC to the camera, and powered the cameras using a spare 12-volt power adapter. My cameras are partially installed and easily accessible, if yours are not accessible I recommend using a POE injector and getting setup near your NVR.
• Follow step 1 here to configure the PC to communicate to the camera properly.
• I strongly recommend first accessing the NVR and taking note of all the camera's IP addresses (Registration page).
• If the camera is brand new or has not been registered to the NVR it should have the default 192.168.1.108 IP address (and will prompt to set a password, I suggest setting the same as the NVR password) and you don't need to do anything else. If it has been registered to the NVR it will be in the 10.1.1.X subnet and address, and you'll need to change it to the 192.168.1.108 IP address (or at least within the 192.168.1.X subnet I suspect, Else will fail to access the TFTPServer, FYI I tried it) and the default gateway to 192.168.1.1 , keep the same subnet mask.
• To change the cameras IP address (easy method, assuming you're ready to flash right away): access the NVR via a Internet Explorer (on a machine that still has network access) (Install/allow all plugins and prompts), go to the Registration page and find the cam to be upgraded, click the IE icon to access that camera's web interface, log in (should be NVR creds), access the network settings and change the IP to 192.168.1.108 and the default gateway to 192.168.1.1, once you hit "save" the page will go blank (since you'll no longer be communicating to the right IP), but the camera is then ready for the next steps.
• To change the cameras IP address (longer more tedious method): Follow the step 1 instructions in the post, except set your PCs IP to 10.1.1.1 and then ensure you can access the camera at its 10.1.1.X IP address (which you hopefully took note of prior), Change the camera's IP to 192.168.1.108 and default gateway to 192.168.1.1 , save it, and then set your PCs IP address back to 192.168.1.1 as described in the linked post. (This is tedious, just do it the right/easy way first ).
• It will help to ensure that you're able to access the camera's login page via IE to ensure proper setup and to see where it's at in the process, and also to have wireshark running to ensure it can reach it and to see when the 192.168.254.254 destination packets are being sent (indicates successfully sending the files in subsequent steps).
• Note: You can probably bypass the needs to manually set the IP address by doing a hard reset on the camera, I'd just do that if you're stuck.

2) Download and extract the "Dahua_TFTPBackup.zip" from the post

• Note: You probably DO NOT want to run this from a flash drive, extract it somewhere on disk that the user has very readable access to (ex; Desktop, Documents, etc.)

3) Replace the contents of "commands.txt" with what @d.lux provided in his post.
4) Run "Command.bat" to generate a "upgrade_info_7db780a713a4.txt" file from the "commands.txt" file? (Edit: Confirmed this to work as described, do not run as Administrator on this .bat, else will fail to find "root" path)

• Note: the output "upgrade_info_7db780a713a4.txt" file is generated differently on different machines, I noticed on my desktop it generated the file on a single line with all the command jumbled together (I thought this was invalid but it actually turned out to be correct). Do not attempt to modify the output file and just leave it at whatever it's defaulted to, only use the version generated on the machine you're running the flash on.

5) Place the unzipped .img files from the zip obtained as part of the steps @Levin83 mentions at the start of his post into the "root" directory of "Dahua_TFTPBackup"? Or does it mean the literal root of "Dahua_TFTPBackup" that contains the .bat and .txt files? (Edit: No, confirmed it's the former "root" directory)

• Note: The zipped package "DH_IPC-HX5X3X-Rhea_MultiLang_NP_Stream3_V2.800.0000008.0.R.190619 " is in the download center (Direct link here, must click multiple times as first attempt redirects to wrong page, but link may be dead in the future though).
• Note: Windows see the .img files as a "Disk Image File", in case you don't have file extensions enabled.

6) Launch "TFTPServer.bat", I'm assuming as Administrator?

• Note: Do not run any of the .bat scripts as admin, with these they'll just open and close right away and are likely running in the background which will really throw you off. Just double click them and you'll be able to see the status output in the running console for each, which is really helpful.
• Note: You may likely need to perform this process on a machine as a user with full Admin rights

7) Launch "Console.bat", I'm assuming as Administrator?
8) The camera should automatically apply the firmware update once powered on and with the TFTP server/Console running? (Yes! it's part of the startup process) Wait until all activity is done on the TFTP output and in wireshark (see notes)

• Note: Make sure both the TFTPServer and Console command windows are up, plug the camera in when ready. If not running as POE plug in the network cable first, as the firmware update process is part of the camera's startup operation.
• Note: The first time I noticed that the TFTP console complained about a missing "failed.txt" file, I created that in the "root" directory (an empty file), probably not needed but it could help with the script workflow.
• If everything is running right you should start to see activity in wireshark right after plugging in the camera, and there will be output on the TFTPServer console. You should see packets in wireshark to 192.168.254.254 as the files are being uploaded to the camera.
• I just let the script keep running, eventually there will be a burst of output on the "Console" script after some time, with a final command of "write: " followed by some percentage less than 100 (Mine frequently showed "write: 49%") just as the process is done and right before the camera resets.
• It took roughly 10 minutes for the above steps.
• If you're near the camera you should be able to hear it click as it resets. Attempt to access the camera at 192.168.1.108 in IE and if all is well you should see the Dahua login page instead of "LeChange". From here you'll want to kill the running scripts (Else on subsequent restart it may attempt to flash when you don't want it to)

9) Attempt to re-connect the camera to the NVR, a hard-reset on the camera may be necessary

• If you intend on following step 10 you'll probably want do do that first as you still have access to the camera on the machine you flashed it with.
• Note: a hard reset is probably not needed unless you have a different password set on the camera vs what is set on the NVR. Mine actually re-assigned the same 10.1.1.x subnet IP and maintained it's existing registration settings (Probably tracked by the MAC anyways), just by plugging it back into the NVR.

10) Apply the same firmware update but this time via the provided "DH_IPC-HX5X3X.bin" file within the web GUI of the camera? Just to make sure everything was applied correctly?

• I really think this is optional, but it's good to get the feel-goods and to follow best practice
• Notes on subsequent cameras: They're easier after you get the first one done and learn the process, and then you'll be able to quickly do step 1, 6-9 (and 10 if you're paranoid/thorough ).

Basically similar steps to upgrade the NVR... But with these caveats:
1) Obtain network access to the NVR via the network port on the NVR? This should be on the IP address it's already set/assigned to on the network or within the NVR settings right? (edit: Yes, the same IP Address it's set to and what you access it to on your network, I'm assuming it's within the 192.168.1.X subnet as with most home networks).

• Again I did this via a direct ethernet connection from my PC to the NVR's WAN port. If your computer's IP address is still the static 192.168.1.1 from the previous step 1 you should be able to access the NVR at it's set IP address. You should probably make sure the NVR has a set static IP address and not DHCP.

2) Purge any extra files from "Dahua_TFTPBackup" so that it's at its default state.

• Note: Was suggested (and a good idea) to just maintain a separate copy for the NVR files.

3) Create the text file named "ID_YourSerialNumberHere.txt" that I'm assuming I fill in the literal serial number of my NVR into, example if the serial is 123456 the file is to be named "ID_123456.txt"? (Yes!) Make its contents the 4 lines mentioned and place this into the "root" folder?

• Yes, and should be the actual Serial Number found within the NVR info area (May be abbreviated as just SN)

4) Obtain the "DH_NVR4XXX-4KS2_MultiLang_V3.216.0000003.0.R.190521" package from the download center (see other section/post for how/where to get this) for the NVR, extract all the files into the "root" directory.

• note: I found two versions of "DH_NVR4XXX-4KS2_MultiLang_V3.216.0000003.0.R.190521" on the site, I went with the latest one. Download page link here (must click multiple times, first attempt redirects to wrong page, but link may be dead in the future).
• note: I suspect that going with the older of the two V3 firmware downloads dated 03/07/2018 may prevent the reboot loop (step 8 below).
• note: the posted "DH_NVR4XX.bin" file is the "all-in-one"/recovery firmware file that cannot be used in this step, but may come into play later.

5) Launch "TFTPServer.bat", I'm assuming as Administrator? (edit: No, don't run any of the batch files as admin, see previous notes on step 6 above)
6) Launch "Console.bat", I'm assuming as Administrator?
7) The NVR should automatically upgrade the firmware through the TFTP Server? (Yes, upon power up, if all is setup right)

• On the TFTPServer output you should see your "ID_YourSerialNumberHere.txt" file being sent to the NVR, followed by the 4 other files listed within the file. This should then be followed by a "success.txt" response, I actually got 4 total lines of "success.txt". After some time the NVR should reboot itself. The whole process took about 20-25 minutes until it rebooted on its own)
• You should probably have the NVR displayed on a separate monitor to see what it's doing, as soon as it reboots and you see the "Dahua" start screen instead of the "LeChange" login screen you'll probably want to kill the running Console/TFTPServer batch processes.
• I made the mistake of not killing the batch scripts and it looks like the firmware update process started again on the NVR. I panicked and killed the scripts probably at the wrong time. The NVR was then in a startup/initialization loop, it would start loading a few cameras and then just restart, so I proceeded to the step below.
• I recommend a COLD BOOT (attempting the process after the NVR has been powered down for at least 20-30 seconds)

8) If the flash isn't successful and is stuck in a reboot loop then put the .bin file (from step 4) into the root of a flash drive and plug it into the USB port of the NVR... and it should automatically apply the firmware with that step alone? @Levin83 ?

• This is where the "DH_NVR4XX.bin" file will come into use, place it on a flash drive (it doesn't need to be blank or be setup any way special, just place it someone accessible like on the root of the flash drive).
• When the NVR boots it will come up with a different small menu that asks you what you want to do (when a USB drive is plugged in), I don't remember the exact option but it was obvious, I believe it was "update" or "upgrade", there were only like 4 to choose from. From there it brings up the content of your flash drive, just select the "DH_NVR4XX.bin" file and proceed, give it plenty of time to do its thing.
• It will reboot after some time, probably not as time-sensitive but you should just remove the flash drive after reboot.
• After this everything was stable and it brought back all the cameras and settings perfectly, all the old video content was there too.

And just to confirm, we can't just do step 10 on the cameras and step 8 on the NVR to bypass all this right?

• I highly doubt it, there are probably safeguards in place to prevent it from going back to OEM easily, but I'd be highly curious if someone were to just try

 

[Levin83]

Wondering if you (OR anyone familiar) could kindly provide a step-by-step guide to flash the cameras and NVR for someone who isn't familiar with the entire process? There's a lot of steps and details, and I really don't want to brick my devices

Here's what I gather from my initial review of the steps for the cameras, please chime in where assumptions aren't correct. I'm going based off of the main post on page one here.
1) Obtain network access to the cameras as described in the post, to/from a windows machine. Run wireshark to monitor the network traffic.
2) Download and extract the "Dahua_TFTPBackup.zip" from the post
3) Replace the contents of "commands.txt" with what you provided
4) Run "Command.bat" to generate a "upgrade_info_7db780a713a4.txt" file from the "commands.txt" file?
5) Place the unzipped .img files from the zip obtained as part of the steps @Levin83 mentions at the start of his post into the "root" directory of "Dahua_TFTPBackup"? Or does it mean the literal root of "Dahua_TFTPBackup" that contains the .bat and .txt files?
6) Launch "TFTPServer.bat", I'm assuming as Administrator?
7) Launch "Console.bat", I'm assuming as Administrator?
8) The camera should automatically apply the firmware update once powered on and with the TFTP server/Console running? Wait until all activity is done on the TFTP output and in wireshark
9) Attempt to re-connect the camera to the NVR, a hard-reset on the camera may be necessary
10) Apply the same firmware update but this time via the provided "DH_IPC-HX5X3X.bin" file within the web GUI of the camera? Just to make sure everything was applied correctly?

Is it basically similar steps to upgrade the NVR? But with these caveats?
1) Obtain network access to the NVR via the network port on the NVR? This should be on the IP address it's already set/assigned to on the network or within the NVR settings right?
2) Purge any extra files from "Dahua_TFTPBackup" so that it's at its default state
3) Create the text file named "ID_YourSerialNumberHere.txt" that I'm assuming I fill in the literal serial number of my NVR into, example if the serial is 123456 the file is to be named "ID_123456.txt"? Make its contents the 4 lines mentioned and place this into the "root" folder?
4) Place the "DH_NVR4XXX-4KS2_MultiLang_V3.216.0000003.0.R.190521.bin" file (Which I'm assuming is the same as the posted "DH_NVR4XX.bin" file?) into the "root" folder?
5) Launch "TFTPServer.bat", I'm assuming as Administrator?
6) Launch "Console.bat", I'm assuming as Administrator?
7) The NVR should automatically upgrade the firmware through the TFTP Server?
8) If the flash isn't successful and is stuck in a reboot loop then put the .bin file (from step 4) into the root of a flash drive and plug it into the USB port of the NVR... and it should automatically apply the firmware with that step alone? @Levin83 ?

And just to confirm, we can't just do step 10 on the cameras and step 8 on the NVR to bypass all this right?

I'm at work right now so I'll summarize my answers. Yes to everything you asked about flashing the camera. There is a folder named Root. Place the files there.

As for the NVR part, yes rename ID_YourSerialNumberHere.txt with your serial number. It's located in the web interface of your NVR under information. When running the .bat sure you can do as administrator.

If you're scared about mixing files for the TFTP folder, just make two copies of it one for the cameras one for the NVR that's what I did.

 

[ip_poe]

I'm at work right now so I'll summarize my answers. Yes to everything you asked about flashing the camera. There is a folder named Root. Place the files there.

As for the NVR part, yes rename ID_YourSerialNumberHere.txt with your serial number. It's located in the web interface of your NVR under information. When running the .bat sure you can do as administrator.

If you're scared about mixing files for the TFTP folder, just make two copies of it one for the cameras one for the NVR that's what I did.

Thank you for the initial overview, and that's a great suggestion to maintain a separate "Dahua_TFTPBackup" for the cameras and NVR. If you have more time to review the details of each step to confirm their accuracy that would be greatly appreciated. @d.lux If you could confirm my steps as well that would be very reassuring. I just really don't want to brick because I've spent countless hours fixing bricked routers so I know what's involved

 

[d.lux]

Hi @ip_poe

Sorry for the delay, busy week at the poop plant...

Here is some answers to your questions --

1) Obtain network access to the cameras as described in the post, to/from a windows machine. Run wireshark to monitor the network traffic.
- The cameras always default to 192.168.1.108 (when you power cycle them, cool idea if you ask me), once you have the TFTP server running (and you are on the same subnet) your TFTP server will pick it up
- I liked having wireshark running since I use this at work all the time and I like to see "what's going on", but probably not really necessary unless you think there is an issue somewhere along the line.

2) Download and extract the "Dahua_TFTPBackup.zip" from the post
-Yes sir

3) Replace the contents of "commands.txt" with what you provided
- I don't think you need the TK command, but that list I provided was a list (at that time) that finally worked for me

4) Run "Command.bat" to generate a "upgrade_info_7db780a713a4.txt" file from the "commands.txt" file? (Edit: Confirmed this to work as described, do not run as Administrator on this .bat, else will fail to find "root" path)
- Yep, it simply adds the "commands" we previously put in there to that "upgrade_xxx" file...

5) Place the unzipped .img files from the zip obtained as part of the steps @Levin83 mentions at the start of his post into the "root" directory of "Dahua_TFTPBackup"? Or does it mean the literal root of "Dahua_TFTPBackup" that contains the .bat and .txt files? (Edit: No, confirmed it's the former "root" directory)
- Get the FW zip file from Dahua, it has all the files you need.

6) Launch "TFTPServer.bat", I'm assuming as Administrator?
- Unless you are not an admin on your box, sure. Always a good idea to run "as admin"

7) Launch "Console.bat", I'm assuming as Administrator?
- Sure thing

8) The camera should automatically apply the firmware update once powered on and with the TFTP server/Console running? Wait until all activity is done on the TFTP output and in wireshark
- The console window will display "stuff happening"...Wireshark is simply to see the communication traffic and can help find various things when you think there is an issue (ie a rogue ip address)

9) Attempt to re-connect the camera to the NVR, a hard-reset on the camera may be necessary
- I would try to connect to 192.168.1.108 after the flash and see what you see

10) Apply the same firmware update but this time via the provided "DH_IPC-HX5X3X.bin" file within the web GUI of the camera? Just to make sure everything was applied correctly?
- If you connect to the IP cam (like in step 9 right above) you can "re-apply" the firmware from the web gui, this is more than likely best practice to make sure it takes the fw "completely"

I hope these answered your questions and I don't think you can really mess it up...I flashed my 1st cam several times (incorrectly) before I found the magical command list that worked for me...

I would simply power cycle the camera and then it would broadcast 192.168.1.108, the TFTP server would pick it up and run the command set...

Hope this helps....

 

[Levin83]

One more thing that neither of us mentioned but it was implied you know if you already read the instructions for TFTP server from the unbricking thread is for the cameras, you cannot flash them while they are connected to your NVR. I had my camera connected to my PC via a wired 5 port Ethernet switch and powered the camera using a power supply from a Western digital external hard drive. The whole time I was flashing, Internet was disconnected.

 

[d.lux]

I stated my bench setup earlier up there

Just for reference, my bench setup is an unmanaged 4-port switch, a POE injector, a couple long ethernet cables , a female-female ethernet coupler and my NUC pc...

I guess I didn't explicitly state they aren't connected to the NVR

The reason for the POE injector was so I didn't have to take my cams down (off the house) to flash them

 

[ip_poe]

I had some time and updated to Dahua firmware on my cameras and NVR successfully. I updated my original post with the detailed steps I took. Big thanks to @d.lux and @Levin83 ! I've been hoping for a method to flash to OEM since I bought it.

For those curious it took roughly 3 hours (NVR + 8 cameras), probably another 1-hour to get all my equipment setup properly. I think it's fairly fool-proof and difficult to brick the devices unless you're really doing something wrong. I think it's worth it to get the new UI, the added stability, the additional native browser support (Works in chrome and Firefox with no plugins! goodbye IE! And the UI/layout isn't all messed up like it was before!!), and the ability to easily update later with the Dahua updates (because you know they actually do updates , unlike "LeChange").

I've actually been very pleased with the purchase, and especially due to the IMOU app, and now being able to get native Dahua firmware is fantastic.
As a bonus, after I flashed I logged back in to the IMOU app (iPhone) right away everything was just synced up, it actually prompted to upgrade the NVR within the app itself It went surprisingly well and updated the whole user interface of the NVR to something very slick looking. I now have a feature in IMOU where it displays a screenshot of the frame that triggered an event, and you can swipe through these screenshots, also you can see the screenshot directly on the notification itself! And as the thumbnail of the video event! No need to load/watch a whole clip to see what triggered it! it's very useful!!! There's a couple new features on the NVR but I'm not sure if they're compatible with the bundled cameras though (ex: AI Face capturing / search).