Help unbricking a Dahua NVR with TFTP and serial connection.

[Jim Kailey]

Tried asking in the NVR forum but no response so figured I'd try here.

I have a re-branded Dahua NVR (Q-See) that's stuck in a bootloop. It never beeps, just tries to start, the fan stops and it tries again. I've been reading here and elsewhere for days and done all the prelim stuff like disconnecting the HDD, trying another power adapter etc.

I'm pretty sure the firmware is corrupt (hacked?) and am trying to re-flash it with TFTP and a serial connection with Ncom as described here:

http://www1.dahuasecurity.com/download/TFTP upgrade instructor.pdf

I have the latest .bin file from Q-See (renamed it to update.bin as read somewhere) but think I need other files as shown on pg1 of the guide. Files found in 4XXX series (also 8 channel) in DH_NVR4xxx_Eng_P_V3.201.0000.0.R.20151120.zip here look very similar: Index of /images/Firmware

I'm using an old 32 bit XP machine with a serial port. I open TFTP and it has the XP machine's IP (127.0.0.1) in the header. I open Ncom and it shows "Com 1, 115200bps" in it's header. I have an ethernet cable connecting the two machines and it shows a connection when I power up the NVR but nothing happens in Ncom (no bootlog). I turned off Windows firewall but with it on it doesn't complain so there's no traffic from the NVR. I read someone needed a null modem cable for their NVR so I made an adapter but it didn't make any difference.

Is this thing really bricked? Is there anything else I can try? Thanks in advance for any and all input.

 

[Jim Kailey]

Well I had a knowledgeable buddy come over with his high end USB to serial cable and the best we could get out of it was {RXERR} when it was powered up. This only happened with null modem (cross over) cable.

Unless someone can add anything useful I think I'll pronounce this thing...

 

[alastairstevenson]

This only happened with null modem (cross over) cable.

Whilst admitting that I have no experience with that specific model - are you sure that the serial console is accessed via the RS-232 connection and not via the usual serial TTL connection on the mainboard, as it is on most of these embedded Linux NVRs and cameras?

 

[Jim Kailey]

I connected to the RS232 port on the back of the unit, inside it lead to just three wires that plugged into the board (tx, rx and grd I assume).

Not sure what you mean by "the usual serial TTL connection on the mainboard"? Is there usually another another spot on the board that is used for serial connections?

 

[eviveiro]

I think you have an older model than what I have been playing with lately, but I mistakenly tried using a RS232 to connect to my board and all I got was a bunch of {RXERR}. I bought a UART TTL usb adapter from amazon and when I connected that everything worked out. I think there is actually another adapter out there on amazon that actually has a switch that allows you to run the serial connection in other modes as well.

Something else I think may work is setting up a tftp server at 192.168.255.255 with a file in the form of ID_<YOUR SERIAL NUMBER>.txt replacing <YOUR SERIAL NUMBER> brackets and all as needed. Pretty much follow this guide which is actually meant for a camera, but I assume would work the same using the right .txt file name for your NVR and of course the right firmware.

 

[Jim Kailey]

Thanks for the reply but I really doubt it will work. We tried a direct serial to serial connection and also this bridge:

TUSB3410 UART/I2C/IrDA Serial Port to USB Bridge | TI.com

Going to set up Milestone with a VPN, no more NVR's for me!

 

[D.J.]

I can tell you I had success last night connecting to my Dahua NVR via RS232. I had to set my baud to 115200 in order to get anything readable. That had to be set on the com settings in device manager and the SecureCRT (program I used). Also, the network connection had to made through a switch or modem. It would not work connected directly. Try a cable test to find out if you have a good connection from send/receive inside the nvr (jumper those two). I switched them inside my nvr as I did not have a null modem cable handy. After that, reboot and I had good communication.

 

[AAMamun]

How to update dahua dvr in rs232 port.please help me.or send any video in dahua update

 

[Nike]

@D.J.
what is the voltage coming out of your RS232 cable? Which one did you purchase?
Check it at the DB-9 pin side after you have hooked it up to your computers USB port on the other end.
pin 5 is GRND, pins 2 and 3 are TX and RX. Check the voltage across those.
(you may need a oscilloscope now that I think about it more?)

RS232 sends information bidirectional from -13V to +13V; TTL sends it unidrectional from 0V to 3.3V or to 5V.

for example,
in RS232: a start bit is +13V, a stop bit is -13V
in TTL: a start bit is 3.3V, a stop bit is 0V (always stays on the positive end)

So what is your cable actually doing? Is it sending the information by RS232 or is it somehow converting it to TTL level and send it that way into the DVR.

@eviveiro said that he tried a RS232 wire and it didn't work, when he used a TTL/USB adapter, it worked. I think because the DVRs need TTL level input.

@D.J. said he used a RS232 cable and it worked?? - Did you mean you made your own cable, like a null-modem cable? or did you buy one that internally converts the RS232 signal to TTL? Or does it just straight pass the RS232 signal and maybe your DVR accepts RS232 input (some of the more expensive ones do, and still have DB-9 ports on the back)?

Interesting....

 

[TheDude]

I know on mine, last years model 5216-4KS2 you MUST use a null-modem serial cable. It is just a regular cable, no TTL adapter. My computer does have a real serial port as well which might help. I've had problems using some of the USB add on ones in the past for stuff like this. I used the Dahua NCOM program, set COM speed to 115,200. This is where I learned about it for mine. Lorex

 

[Nike]

okay the 5216-4KS2 has an RS232 port. Rock solid device, higher end.
So either use a USB-RS232 or a null modem cable (if your computer is old enough that it has a DB9 COM port). This should give you full serial console access.
Why did you have problems with the USB-R232 adapters?
Try using PuTTY instead of NCOM with the USB-RS232. I'll try that myself and see.

I have TTL adapters and the USB-RS232 cable. I don't have a null modem cable or a serial port on the computer.

 

[TheDude]

I work with a lot of industrial equipment as well as networking hardware that almost all have serial console access for things and it just seems that true hardware USB ports always seem to be far more reliable than software driver emulated ports. So I've always used a Dell Precision pro workstation for my PC as many of the pro commercial PC's still actually come with a true serial port. In general though, the USB-serial cables usually do work fine.

The serial port on the NVR is not hard mounted to the mainboard inside. It just has a small wired connector to the board so you should be able to just as easily change the pin order to make it not need a null modem adapter/cable. Its just a simple 3 pin serial port. When I get time tomorrow I'll meter it and take a couple of pics to make it easy for anyone to quickly repin the connector. I've been meaning to do that anyways on mine as rarely have any need for a null modem cable but almost always have a regular straight through one connected. I do use Putty and Teraterm Pro but I recommended Ncom because that is a lot less complicated for most people.

 

[TheDude]

Forgot to update... it was exactly as I thought it would be. Just disconnect the serial connector on the board inside. With the flat side of the connector facing you as shown in the photos, you just need to swap the middle and right wires. You can see the little tab that sticks up which retains the terminal in the connector. Just press that down with a tiny screwdriver, pick, etc and slide the terminal out of the connector. Then just make sure the little metal retaining tab is still sticking up, if not use an exact or something to bend it back up a little and push back into the connector. In the last pic you can see the middle and right wires are swapped. Plug it back in and the serial port is now normal and you can just connect a regular straight through serial cable up and go.

 

[Nike]

So this will allow you to use a straight through cable connected from your NVR to your Computer. No need for a null modem cable?
Nice detective work and great easy solution!

 

[TheDude]

Yes - that is exactly what it will do. Tested it too on mine. I have no idea why they configure it with the pins swapped but my guess is they have some sort of programming system that they use in the factory that needs it.

 

[weezer311]

I'm in the same boat here. I have the UART TTL usb adapter that @eviveiro mentioned. I'm connecting with Putty and not seeing anything. I'm going from the adapter straight to the pins on the board with ground on pin 3 and tried TX and RX both ways on the other pins. Am I missing something here? Thanks!

 

[TheDude]

All of the Dahua cameras use low voltage TTL RS232 but the NVR uses true RS232 serial which is much higher voltage. On the NVR you use a regular serial cable not a TTL cable.... It is even possible that the much higher voltage serial signals from the NVR could damage the TTL converter cable. While I think a TTL cable might in some cases work on a non-TTL port it might also cause problems.

 

[weezer311]

Thanks. I have non TTL serial adapter on the way. I know to swap the pins on the internal connector as you've described.

 

[weezer311]

I've tried the new serial adapter and still no luck. I'm not seeing anything on the terminal. I'm at 115200baud 8n1. What else could I be doing wrong? Thanks.

 

[TheDude]

Couple of potential issues. Did you flip the tx/rx pins on the port (posted about that above)? If so maybe newer ones or some are not wired as null modem and they did not need to be flipped. Try it with the speed set to maybe 9600 or some of the other speeds (still 8n1 though)? Can you confirm the serial adapter you bought it workign and set to the correct port? Is the NVR toasted the reason you are trying this? If it still boots at least partially you should be getting something on the serial port but if something has gone wrong that has corrupted the boot loader part of the firmware it might be beyond repair without physically reprogramming the actual firmware eeprom chip itself which is something far more complicated and beyond my skills.