Lorex E891AB (aka IPC-HFW1841EN-PV)

pozzello

Known around here
Oct 7, 2015
2,271
1,117

I picked up one of these 4k Lorex units cheap with a cut off ethernet/power dongle. My first few attempts to fix with a new ethernet jack resulted in no link light, tho it did power up over PoE, so I opened it up and hooked up the serial adapter here:
50542490776_1848750a48_k.jpg

(red probe connects to the white wire on the uart adapter, couldn't find my white one)

As the boot sequence and printenv all looked normal (see below) i tried again with an another ethernet jacks, and it's working now. yea!


So far, the only way i find to control the WHITE LED (warning light) is with the little light bulb icon in the cam's webUI Live view page.
here seem to be some controls in the IVS config page, but I have yet to be able to trigger the LED's with motion, which would be ideal.

Anyone familiar if this cam can do that (light up white LED's on motion at night)? (Lorex's documentation mentions it seems to require using their NVR...)
I'm not very familiar with Lorex/Dahua's IVS functions, as I use BI. I can readily have BI do it, but wondering if the cam itself has that capability standalone
Not sure i have it set u properly. Any tips appreciated...

lorex led.PNG

Aside: I have yet to find any Dahua firmware with HWID=HFW1841EN-PV in it's check file, so did not try re-flashing.
(I did find one for the 3841 that also has the string 'cayenne' in the HWID)
Of course, Lorex makes no firmware available (yet?) for this model, to compare against...

bootdelay=1
baudrate=115200
ipaddr=192.168.1.108
serverip=192.168.1.1
gatewayip=192.168.1.1
netmask=255.255.255.0
bootfile="uImage"
wifiaddr=00:12:34:56:78:91
dh_keyboard=1
sysbackup=1
loglevel=4
autosip=192.168.254.254
autogw=192.168.1.1
autonm=255.255.255.0
backupsip=192.168.1.100
nfssip=192.168.1.109
ethact=SynopGMAC-0
BSN=5C00597RAX00460
bootargs=mem=502M console=ttyS0,115200 root=/dev/mtdblock7 root_slv=/dev/mtdblock14 rootfstype=s quashfs mmz=256m@0xc4000000 mem_slv=80M rootflags=sync
HWID=IPC-HFW1841EN-PV-0280B-CAYENNE:01:02:02:72:2C:00:01:0F:01:01:00:3A5:00:00:00:00:00:01:00:02 :200
hwidEx=00:02:00:00:00:00:00:00:00:00:00:00:00:00:00:00
ID=ND011903099188
devalias=E891AB
ethaddr=00:1F:54:35:A0:CB
da=tftp 0x82000000 dhboot.bin.img;flwrite;tftp 0x82000000 dhboot-min.bin.img;nand protect off;fl write;
dr=tftp 0x82000000 romfs-x.squashfs.img; flwrite;
dk=tftp 0x82000000 kernel.img;flwrite;
du=tftp 0x82000000 user-x.squashfs.img; flwrite;
dw=tftp 0x82000000 web-x.squashfs.img; flwrite;
dp=tftp 0x82000000 partition-x.cramfs.img;flwrite;
up=tftp 0x82000000 update.img;flwrite;
dc=tftp 0x82000000 custom-x.squashfs.img; flwrite;
pd=tftp 0x82000000 pd-x.squashfs.img; flwrite;
tk=tftp 0x82000000 uImage;bootm;
bootcmd=boots 0x82000000;kload 0x84000000;bootm 0x84000000
sk=tftp 0x82000000 kernelslv.img;flwrite;
sr=tftp 0x82000000 romfsslv-x.squashfs.img; flwrite;
filesize=13040
fileaddr=82000000
appauto=1
autolip=192.168.1.251
mp_autotest=0
stdin=serial
stdout=serial
stderr=serial

Environment size: 1496/131068 bytes
 
I have like 7 of those cams. Now I start to replace with Dahua cams little by little. I got the lorex nvr and from there I can turn on or off and from the lorex app. But standalone idk. I would like to try and reflash with a different firmware.
 
To follow up on my own question regarding when the white LED's can be triggered, it seems that other than the 'warning light' icon/button on the 'live page, they only come on with the IVS intrusion detection enabled. On these particular Lorex cams, the only 'Smart Plan' available is 'IVS' and the only IVS feature available is 'Intrusion', but with those both enabled, and the 'warning light' checkbox enabled (see screen shot posted in OP,) the white led's DO come on when triggered. There's also a separate time frame setting for the warning lights specifically, in addition to the times for the intrusion detection to be enabled, I guess so as to have the lights only come on at 'night' time if so desired. I understand the 'intrusion detection' is different from simple 'motion detection' as it seems to involve an object moving into the box drawn as part of the rules configration. As such I'm having a hard time triggering it reliably, but will keep playing with it...
 
To follow up on my own question regarding when the white LED's can be triggered, it seems that other than the 'warning light' icon/button on the 'live page, they only come on with the IVS intrusion detection enabled. On these particular Lorex cams, the only 'Smart Plan' available is 'IVS' and the only IVS feature available is 'Intrusion', but with those both enabled, and the 'warning light' checkbox enabled (see screen shot posted in OP,) the white led's DO come on when triggered. There's also a separate time frame setting for the warning lights specifically, in addition to the times for the intrusion detection to be enabled, I guess so as to have the lights only come on at 'night' time if so desired. I understand the 'intrusion detection' is different from simple 'motion detection' as it seems to involve an object moving into the box drawn as part of the rules configration. As such I'm having a hard time triggering it reliably, but will keep playing with it...


I'm wondering if it's a one-off of this cam:
IPC-HFW1831E


Specs seem pretty similar.
 
The 1831 does appear to be it's closest living relative (and i have one), but it won't take the 1831 FW...
 
The 1831 does appear to be it's closest living relative (and i have one), but it won't take the 1831 FW...

I'll admit up front this feels like a dumb question given you went through the hassle of getting a serial connection into the camera - but I assume you tried over TFTP and not just the web interface?
 
but it won't take the 1831 FW.
Via Web GUI or the serial console?

Did you see this? :
A different camera, but stronger encouragement via the serial console.
 
sorry, can't remember now. i stopped when i determine no existing Dahua FW had the HWID I was looking for. Didn;t try any non-matching FW for fear of LOSING features... There may be a way, but I wasn;t brave enuf this time around... :-)
 
  • Like
Reactions: alastairstevenson
I've got one I'll give it a shot on next week. I just ordered some test hooks and a UART adapter, should be here Tuesday.
 
Hrmm, can't seem to get mine to actually let me in. Goes straight to uncompressing linux kernel then stops ouputting to serial:


hello world
DDR_SIZE:512M
LOAD DDR512M32bit_CFG...
DDR training start...
DDR training done.
Found a Narmal img
Load @ 0x00040000 to 0xC0800000, size = 56704
Done!
Jump to 0xC0800000

hello world
spi nand id=0x21aaef
Special Nand id table Version
Nand ID: 0xEF 0xAA 0x00 0x00 0x00 0x00 0x00 0x00
boot from spi_nand
uboot start address:200000.
find uboot




Uncompressing Linux...▒ done, booting the kernel.
 
assuming you've got the serial connections made properly for both input & output, you've gotta really spam the * (shift-8) key as it boots up.
 
Using SynopGMAC-0 device
Download Filename 'kernel.img'.
Downloading: #################################################################
#################################################################
#################################################################
#################################################################
#################################################################
############## times: 1s, speed: 1.3 MiB/s
done
Bytes transferred = 1734124 (1a75ec hex)
do not find BOOT_IMG_NAME!
Erasing update flag partition.
partition file version 2
rootfstype squashfs root /dev/mtdblock7
partition file version 2
rootfstype squashfs root /dev/mtdblock7

## Checking Image at 82000000 ...
Legacy image found
Image Name: kernel
Image Type: ARM Linux Firmware (uncompressed)
Data Size: 1734060 Bytes = 1.7 MiB
Load Address: 00800000
Entry Point: 00a80000
Verifying Checksum ... OK
Programing start at: 0x00800000 for kernel
write : 100%
done
crc from program is :4df954b9, crc from flash is :4df954b9
partition file version 2
rootfstype squashfs root /dev/mtdblock7
partition file version 2
rootfstype squashfs root /dev/mtdblock7
partition file version 2
rootfstype squashfs root /dev/mtdblock7
gParameter[0]:node=bootargs, parameter=mem=502M console=ttyS0,115200 root=/dev/mtdblock7 root_slv=/dev/mtdblock14 rootfstype=squashfs mmz=256m@0xc4000000 mem_slv=80M rootflags=sync.
Using SynopGMAC-0 device
Download Filename 'partition-x.cramfs.img'.
Downloading: # times: 0s, speed: 253.9 KiB/s
done
Bytes transferred = 4160 (1040 hex)
do not find BOOT_IMG_NAME!
Erasing update flag partition.
partition file version 2
rootfstype squashfs root /dev/mtdblock7
partition file version 2
rootfstype squashfs root /dev/mtdblock7

## Checking Image at 82000000 ...
Legacy image found
Image Name: partition
Image Type: ARM Linux Standalone Program (gzip compressed)
Data Size: 4096 Bytes = 4 KiB
Load Address: 00500000
Entry Point: 00600000
Verifying Checksum ... OK
Programing start at: 0x00500000 for partition
write : 100%
done
crc from program is :b01d398b, crc from flash is :b01d398b
partition file version 2
rootfstype squashfs root /dev/mtdblock7
partition file version 2
rootfstype squashfs root /dev/mtdblock7
partition file version 2
rootfstype squashfs root /dev/mtdblock7
can not search bootargs settings
fail to parse bootargsParametersV2.text info
WARNING: Fail to update bootargs!!!
Using SynopGMAC-0 device
Download Filename 'romfs-x.squashfs.img'.
Downloading: #################################################################
#################################################################
########################################################## times: 0s, speed: 1.3 MiB/s
done
Bytes transferred = 958528 (ea040 hex)
do not find BOOT_IMG_NAME!
Erasing update flag partition.
partition file version 2
rootfstype squashfs root /dev/mtdblock7
partition file version 2
rootfstype squashfs root /dev/mtdblock7

## Checking Image at 82000000 ...
Legacy image found
Image Name: romfs
Image Type: ARM Linux Standalone Program (gzip compressed)
Data Size: 958464 Bytes = 936 KiB
Load Address: 00a80000
Entry Point: 00c00000
Verifying Checksum ... OK
Programing start at: 0x00a80000 for romfs
write : 100%
done
crc from program is :8c52e7f2, crc from flash is :8c52e7f2
partition file version 2
rootfstype squashfs root /dev/mtdblock7
partition file version 2
rootfstype squashfs root /dev/mtdblock7
partition file version 2
rootfstype squashfs root /dev/mtdblock7
can not search bootargs settings
fail to parse bootargsParametersV2.text info
WARNING: Fail to update bootargs!!!
Using SynopGMAC-0 device
Download Filename 'pd-x.squashfs.img'.
Downloading: ########## times: 0s, speed: 942.4 KiB/s
done
Bytes transferred = 49216 (c040 hex)
do not find BOOT_IMG_NAME!
Erasing update flag partition.
partition file version 2
rootfstype squashfs root /dev/mtdblock7
partition file version 2
rootfstype squashfs root /dev/mtdblock7

## Checking Image at 82000000 ...
Legacy image found
Image Name: pd
Image Type: ARM Linux Standalone Program (gzip compressed)
Data Size: 49152 Bytes = 48 KiB
Load Address: 00700000
Entry Point: 00800000
Verifying Checksum ... OK
Programing start at: 0x00700000 for pd
write : 100%
done
crc from program is :fc1be5de, crc from flash is :fc1be5de
partition file version 2
rootfstype squashfs root /dev/mtdblock7
partition file version 2
rootfstype squashfs root /dev/mtdblock7
partition file version 2
rootfstype squashfs root /dev/mtdblock7
can not search bootargs settings
fail to parse bootargsParametersV2.text info
WARNING: Fail to update bootargs!!!
Using SynopGMAC-0 device
Download Filename 'user-x.squashfs.img'.
Downloading: #################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
################# times: 8s, speed: 1.3 MiB/s
done
Bytes transferred = 11399232 (adf040 hex)
do not find BOOT_IMG_NAME!
Erasing update flag partition.
partition file version 2
rootfstype squashfs root /dev/mtdblock7
partition file version 2
rootfstype squashfs root /dev/mtdblock7

## Checking Image at 82000000 ...
Legacy image found
Image Name: user
Image Type: ARM Linux Standalone Program (gzip compressed)
Data Size: 11399168 Bytes = 10.9 MiB
Load Address: 01400000
Entry Point: 02100000
Verifying Checksum ... OK
Programing start at: 0x01400000 for user
write : 100%
done
crc from program is :7e3b0766, crc from flash is :7e3b0766
partition file version 2
rootfstype squashfs root /dev/mtdblock7
partition file version 2
rootfstype squashfs root /dev/mtdblock7
partition file version 2
rootfstype squashfs root /dev/mtdblock7
can not search bootargs settings
fail to parse bootargsParametersV2.text info
WARNING: Fail to update bootargs!!!
Using SynopGMAC-0 device
Download Filename 'custom-x.squashfs.img'.
Downloading: ######################################### times: 0s, speed: 1.1 MiB/s
done
Bytes transferred = 208960 (33040 hex)
do not find BOOT_IMG_NAME!
Erasing update flag partition.
partition file version 2
rootfstype squashfs root /dev/mtdblock7
partition file version 2
rootfstype squashfs root /dev/mtdblock7

## Checking Image at 82000000 ...
Legacy image found
Image Name: custom
Image Type: ARM Linux Standalone Program (gzip compressed)
Data Size: 208896 Bytes = 204 KiB
Load Address: 00600000
Entry Point: 00700000
Verifying Checksum ... OK
Programing start at: 0x00600000 for custom
write : 100%
done
crc from program is :9299d144, crc from flash is :9299d144
partition file version 2
rootfstype squashfs root /dev/mtdblock7
partition file version 2
rootfstype squashfs root /dev/mtdblock7
partition file version 2
rootfstype squashfs root /dev/mtdblock7
can not search bootargs settings
fail to parse bootargsParametersV2.text info
WARNING: Fail to update bootargs!!!
Using SynopGMAC-0 device
Download Filename 'web-x.squashfs.img'.
Downloading: #################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
############################################################ times: 3s, speed: 1.3 MiB/s
done
Bytes transferred = 4964416 (4bc040 hex)
do not find BOOT_IMG_NAME!
Erasing update flag partition.
partition file version 2
rootfstype squashfs root /dev/mtdblock7
partition file version 2
rootfstype squashfs root /dev/mtdblock7

## Checking Image at 82000000 ...
Legacy image found
Image Name: web
Image Type: ARM Linux Standalone Program (gzip compressed)
Data Size: 4964352 Bytes = 4.7 MiB
Load Address: 00c00000
Entry Point: 01400000
Verifying Checksum ... OK
Programing start at: 0x00c00000 for web
write : 100%
done
crc from program is :3d2c0655, crc from flash is :3d2c0655
partition file version 2
rootfstype squashfs root /dev/mtdblock7
partition file version 2
rootfstype squashfs root /dev/mtdblock7
partition file version 2
rootfstype squashfs root /dev/mtdblock7
can not search bootargs settings
fail to parse bootargsParametersV2.text info
WARNING: Fail to update bootargs!!!
dh7200 start wdt ,period=120s
partition file version 2
rootfstype squashfs root /dev/mtdblock7
load slave-kernel from spi nand [0x2100040] to [0x82000000] len = 0x1a721c
partition file version 2
rootfstype squashfs root /dev/mtdblock7
can not search bootargs settings
fail to parse bootargsParameters.text info
get bootargs info failed
cmdLine mem=502M console=ttyS0,115200 root=/dev/mtdblock7 root_slv=/dev/mtdblock14 rootfstype=squashfs mmz=256m@0xc4000000 mem_slv=80M rootflags=sync
can not search bootargs settings
fail to parse bootargsParameters.text info
cmdLine mem=502M console=ttyS0,115200 root=/dev/mtdblock7 root_slv=/dev/mtdblock14 rootfstype=squashfs mmz=256m@0xc4000000 mem_slv=80M rootflags=sync
mem_addr = 82000000
Done.
Verifying Checksum ... OK
Loading Kernel Image ...OK
OK
partition file version 2
rootfstype squashfs root /dev/mtdblock7
can not search bootargs settings
fail to parse bootargsParameters.text info
get bootargs info failed
cmdLine mem=502M console=ttyS0,115200 root=/dev/mtdblock7 root_slv=/dev/mtdblock14 rootfstype=squashfs mmz=256m@0xc4000000 mem_slv=80M rootflags=sync
crashflasg:1, logmagic:54410011.
 
I didn't touch the bootloader so I would assume I could recover it if I can get lorex to send me the original firmware, but it doesn't seem to like what I loaded onto it. It'll get to the loading kernel, and about 30 seconds later reboots, never pulls a real IP and never fully comes online.
 
DH_IPC-HX2(1)XXX-Sag_EngSpnFrn_NP_V2.622.0000000.8.R.180731.bin

The 1831 firmware I saw floating around.
 
Tried a couple different 2.622 and 2.8. The 2.8 don't work at all, the 2.622 I think the main issue is the:
do not find BOOT_IMG_NAME!


In another thread I saw someone figured out it was due to misaligned partitions and found a different image that worked. I guess I'm not sure how they're determining partition alignment of the bin files.
 
attaching stock Lorex firmwares for E891AB (and possibly others, per HWID list in check.img files,)
thus facilitating further exploration by providing a way to recover if/when needed...

pozzello@sfo-lp82w:~$ strings check.img
check
"DefaultLanguage" : "English",
"DefaultVideoStandard" : "NTSC",
"SupportLanguages" : "English",
"hwid" : [
"IPC-HFW1841EN-PV-0280B-CAYENNE:01:02:02:72:2C:00:01:0F:01:01:00:3A5:00:00:00:00:00:01:00:02:200",
"IPC-HFW1831EN-A-0280B-CAYENNE:01:02:02:64:2C:00:01:0F:01:01:00:320:00:00:00:00:00:00:00:00:200",
"IPC-HFW2831TN-ZA-3711-CAYENNE:01:02:02:64:2C:00:01:0F:01:01:00:320:00:00:00:00:00:01:00:00:200",
"IPC-HDBW1831R:01:02:05:64:2C:00:01:00:00:00:00:320:00:00:00:00:00:01:00:00:200",
"IPC-HDBW1831R-S:01:02:05:64:2C:00:01:00:00:00:04:320:00:00:00:00:00:01:00:00:200",
"IPC-HFW1831E:01:02:02:64:2C:00:01:00:00:00:00:320:00:00:00:00:00:00:00:00:200",
"IPC-HFW2831T-ZS-3711:01:02:02:64:2C:00:01:00:00:00:04:320:00:00:00:00:00:01:00:00:200",
"IPC-HFW2831T-ZAS-3711:01:02:02:64:2C:00:01:0F:01:01:04:320:03:00:00:00:00:01:00:00:200",
"IPC-HDBW2831R-ZS-3711:01:02:05:64:2C:00:01:00:00:00:04:320:00:00:00:00:00:01:00:00:200",
"IPC-HDBW2831R-ZAS-3711:01:02:05:64:2C:00:01:0E:01:01:04:320:03:00:00:00:00:01:00:00:200"
]


edit: Since posting this, some users have reported these FW don't allow full functionality on the LNB9232S or LNB9272S, limiting frame rate to 15fps (from original 30) and losing zoom/focus control. It's odd , as the 9272's HWID is matched exactly in the check.img file, but perhaps just a mistake from Dahua/Lorex...
 

Attachments

Last edited:
  • Like
Reactions: SFC
attaching stock Lorex firmwares for E891AB (and possibly others, per HWID list in check.img files,)
thus facilitating further exploration by providing a way to recover if/when needed...


Thank you!!!! Assume you had to get these direct from support?
 
something like that... these are apparently the firmwares provided by Dahua to Lorex for these cams. Unclear if Lorex modifies them in any way from what we see here...
I can say my E891AB took the older 10.R version (same as I got it) via web UI with no apparent ill effects. Have yet to play with the newer (18.R) version. No idea what may have been updated...
 
something like that... these are apparently the firmwares provided by Dahua to Lorex for these cams. Unclear if Lorex modifies them in any way from what we see here...
I can say my E891AB took the older 10.R version (same as I got it) via web UI with no apparent ill effects. Have yet to play with the newer (18.R) version. No idea what may have been updated...

Well, just comparing it to the 1831 firmware that Andy has, I'm guessing the underlying Linux OS supports both, the Lorex firmware supports almost the same camera's, just adds the 1841.

Lorex Check file:

check
"DefaultLanguage" : "English",
"DefaultVideoStandard" : "NTSC",
"SupportLanguages" : "English",
"hwid" : [
"IPC-HFW1841EN-PV-0280B-CAYENNE:01:02:02:72:2C:00:01:0F:01:01:00:3A5:00:00:00:00:00:01:00:02:200",
"IPC-HFW1831EN-A-0280B-CAYENNE:01:02:02:64:2C:00:01:0F:01:01:00:320:00:00:00:00:00:00:00:00:200",
"IPC-HFW2831TN-ZA-3711-CAYENNE:01:02:02:64:2C:00:01:0F:01:01:00:320:00:00:00:00:00:01:00:00:200",
"IPC-HDBW1831R:01:02:05:64:2C:00:01:00:00:00:00:320:00:00:00:00:00:01:00:00:200",
"IPC-HDBW1831R-S:01:02:05:64:2C:00:01:00:00:00:04:320:00:00:00:00:00:01:00:00:200",
"IPC-HFW1831E:01:02:02:64:2C:00:01:00:00:00:00:320:00:00:00:00:00:00:00:00:200",
"IPC-HFW2831T-ZS-3711:01:02:02:64:2C:00:01:00:00:00:04:320:00:00:00:00:00:01:00:00:200",
"IPC-HFW2831T-ZAS-3711:01:02:02:64:2C:00:01:0F:01:01:04:320:03:00:00:00:00:01:00:00:200",
"IPC-HDBW2831R-ZS-3711:01:02:05:64:2C:00:01:00:00:00:04:320:00:00:00:00:00:01:00:00:200",
"IPC-HDBW2831R-ZAS-3711:01:02:05:64:2C:00:01:0E:01:01:04:320:03:00:00:00:00:01:00:00:200"
]


1831 Check File:

check
"DefaultLanguage" : "English",
"DefaultVideoStandard" : "NTSC",
"SupportLanguages" : "English,Spanish,French",
"hwid" : [
"IPC-HDBW1831R:01:02:05:64:2C:00:01:00:00:00:00:320:00:00:00:00:00:01:00:00:200",
"IPC-HDBW1831R-S:01:02:05:64:2C:00:01:00:00:00:04:320:00:00:00:00:00:01:00:00:200",
"IPC-HFW1831E:01:02:02:64:2C:00:01:00:00:00:00:320:00:00:00:00:00:00:00:00:200",
"IPC-HFW2831T-ZS-3711:01:02:02:64:2C:00:01:00:00:00:04:320:00:00:00:00:00:01:00:00:200",
"IPC-HFW2831T-ZAS-3711:01:02:02:64:2C:00:01:0F:01:01:04:320:03:00:00:00:00:01:00:00:200",
"IPC-HDBW2831R-ZS-3711:01:02:05:64:2C:00:01:00:00:00:04:320:00:00:00:00:00:01:00:00:200",
"IPC-HDBW2831R-ZAS-3711:01:02:05:64:2C:00:01:0E:01:01:04:320:03:00:00:00:00:01:00:00:200"
]