Lorex

Discussion in 'IP Cameras' started by DmaxDually, Feb 17, 2018.

Share This Page

  1. alastairstevenson

    alastairstevenson Known around here

    Joined:
    Oct 28, 2014
    Messages:
    9,210
    Likes Received:
    2,618
    Location:
    Scotland
    With respect, whilst picking a high random port does increase the level of effort required, that's an optimistic statement that may mislead, as the discovery process is often automated using a botnet collection.
    Humans have more interesting activities pursuing the found_list.
     
    looney2ns, fenderman and mat200 like this.
  2. MixManSC

    MixManSC Pulling my weight

    Joined:
    May 20, 2018
    Messages:
    132
    Likes Received:
    130
    Location:
    USA
    Oh I do agree..... it just a bit more secure than using any standard port is all. Like I said, ultimatley with all of these newer devices constantly trying to connect to update, cloud, and ddns services it is best to just block it totally and use a good encrypted VPN solution for any outside access. It slightly more tedious having to first connect to the VPN and then connect to what you want but its also the only real decent solution as the only port you need open is whatever one your particular choice of VPN needs (and ideally even change that to a non-standard one if your VPN supports it).
     
  3. mat200

    mat200 Known around here

    Joined:
    Jan 17, 2017
    Messages:
    3,019
    Likes Received:
    1,392
    Many script kiddies are just using tools to scan and find exposed systems... so better to just not port forward at all today. Too many malbots out there.
     
  4. MixManSC

    MixManSC Pulling my weight

    Joined:
    May 20, 2018
    Messages:
    132
    Likes Received:
    130
    Location:
    USA
    I should clarify my earlier post to add.

    I do NOT recommend anyone port forward. I was just pointing out that by at least changing from the default ports you are slightly better off than using standard ports. As pointed out in responses, which is very true, there is not shortage of bots on the web constantly scanning for every possible port on every possible IP address. It is really a matter of when, not if, your forwarded ports are discovered.... Best solution is to not forward ports at all and use a secure encrypted VPN connection. To illustrate the issue, our Checkpoint firewall logs well over 1500 port scans and attempts to connect to our primary external IP per hour that get blocked. Easy to see the bots too - we have 5 external static IP's and I can see the same source IP on the web try each of our 5 IP's one after the other probing for the same ports.

    The INternet Storm Center is always a good place to see what some of the most active attacks and botnets currently are. Internet Storm Center - SANS Internet Storm Center

    Interestingly this morning they posted that, specifically, CCTV DVR's are being targeted on port 81. o_O

    "Something Wicked this way comes
    Published
    : 2018-05-21
    Last Updated: 2018-05-21 15:03:29 UTC
    by Rick Wanner (Version: 1)
    0 comment(s)
    The latest Mirai-based botnet is Wicked. Unlike previous Mirai variants and sibilings, which compromised IoT devices with default credentials or brute forcing credentials, Wicked is targetting vulnerabilities contained in certain IoT devices.
    Wicked scans ports 8080, 8443, 80, and 81. Specifically it is targetting the following devices/vulnerabilities:
    • 80: Invoker Shell in compromised Web Servers
    • 81 - CCTV-DVR
    • 8443 - Netgear R7000 and R6400 (CVE-2016-6277)
    • 8080 - Netgear DGN1000 and DGN2200
    The Invoker Shell is interesting in that it does not exploit the device, but rather takes advantage of previously compromised web servers.
    After successful exploitation, it downloads what appears to be Omni Bot, the same code delivered by the attacks on the DASAN GPON home routers, providing at least some anecdotal evidence that the two are related."
     
    Arjun and mat200 like this.
  5. MixManSC

    MixManSC Pulling my weight

    Joined:
    May 20, 2018
    Messages:
    132
    Likes Received:
    130
    Location:
    USA
    Well - I ordered two of the SD1A203T-GN cameras from Empire (Andy). Now I get notice from Lorex that the two system packages I ordered will not ship for another week. Trying to work with Andy but wow - once I add everything in to match the Lorex kit it is coming out hundreds more. :(

    The Lorex kit is $679 and includes
    NVR NR9163 (same spec as NVR5216-16P-4KS2) thought at first it might be the 4216 but that is 200Mbps and the NR9163 is 320Mbs like the 5216.
    4 LNB4173B bullets, 4 LNE4162B turrets which spec identical to the IPC-HDW1431S and the IPC-HFW1431S
    Plus a bunch of (admittedly low grade) network cables.
    The Lorex NVR also includes a 3TB surveillance grade hard drive (So either the Seagate one or the WD Purple one) - so about $75 value there.

    Price on the NVR5216-16P-4KS2E (the newer version) is $299 plus $82 per camera and I dont think that includes a drive for the NVR.

    So thoughts? Right now I can cancel Lorex and roll my own but its looking like at a LOT higher cost. At least $950 and then still need to add a hard drive! :( I'm wondering if I need to just wait on the Lorex stuff. When I saw I had time to cancel on Lorex I contacted Andy but I was not expecting a $270+ increase in price ordering what will be technically less (probably would not get all the cables) with less of a warranty.

    I have two systems I need to get setup very soon.
     
  6. mat200

    mat200 Known around here

    Joined:
    Jan 17, 2017
    Messages:
    3,019
    Likes Received:
    1,392
    HI MixMan,

    Remember Lorex strips the IVS features out of their products, as well as sometimes also ONVIF functionality in some cameras.

    Normally the best value is to get significantly better quality cameras than the 1xxx series from Andy, for example the Dahua OEM starlights ( which are hard to find in kits ).

    The Dahua OEM 2MP starlight IPC-HDW42xx cameras will out perform those 4MP 1xxx series cameras in low light conditions and they only cost a fraction more, well worth the additional cost imho.

    Some new members have bought Lorex kits when they've gone on sale and augmented them with Dahua OEM starlights from Andy - which is one approach.

    Rolling your own kit can cost more, however as a result you will have a substantially better setup for your needs as you can customize the cameras to best suit what you are planning to do.

    PS - I recommend NOT using the cables in any of the kits - as they are often CCA and cabling is the most labor intensive job of your setup, so why skimp on cables when a good box of cat5e/6 cable is a reasonable price compared to your time.
     
    Arjun and looney2ns like this.
  7. MixManSC

    MixManSC Pulling my weight

    Joined:
    May 20, 2018
    Messages:
    132
    Likes Received:
    130
    Location:
    USA
    I know the NVR from them is fully ONVIF (profile S) compliant so that end is fine. If its their cameras that should not matter as long as I can still use other cameras as well. I'm also not scared to try and cross flash something to other firmware. If I brick something that will be on me (might try to ID a JTAG header and recover that way). For the one setup I'm thinking the crappy cables would even be fine for the most part, it is new commercial construction and I can walk around on the ceiling easy as pie right now. Once in place they will likely never be moved again. A few of the cameras will be on long runs of around 180ft though but already have a roll of cat6 for those. Several I'll be installing emergency exit sign/lights within a couple of feet as well as smoke detectors so I'm hoping to knock all out in one last trip up on the ceiling in there. On the other install I'm replacing an existing analog system which was all run with cat6 (using baluns) about 5 years ago so that one is even easier as I just need to pull the baluns and crimp RJ45's on (along with installing the new IP cameras). Certain features are not really critical, particularly on the new construction. That business is 24x7, most of the cameras are indoors with good lighting in not terribly large rooms. Even the few outside cameras have reasonably good lighting from the parking lot lights. All of the cameras on both setups are going to be setup as 24x7 record with overwrite oldest as it goes.
     
  8. MixManSC

    MixManSC Pulling my weight

    Joined:
    May 20, 2018
    Messages:
    132
    Likes Received:
    130
    Location:
    USA
    Ok - so an update. Get the kit in from Lorex and have been messing around with it some just testing things. I also have a couple of the SD1A203T cameras I ordered from Andy.

    So - here is the fun bit. The Lorex NR9163 NVR. It IS a NVR5216-16P-4KS2 with Lorex custom crippled firmware on it. Somewhat disappointing as I cannot get it to connect to the Dahua SD1A cameras in private mode. It does connect to the fine via ONVIF though. The catch there of course is you have very limited control from within the NVR. Of course as mentioned, the firmware has some things stripped out like IVS. So being the adventurous type I tried loading Dahua firmware on the NVR through the web interface. Tried a few different ways and 2 different versions. None work - it errors and then the NVR reboots. :( So lets dig deeper then. Just to be 100% sure I looked at every square inch of the mainboard and carefully compared with a video someone made of them installing a hard drive in a Dahua NVR5216-16P-4KS2. Everything is 100% identical right down to the screen printed numbers on the board. Feeling a bit more confident I started looking at that 9 pin serial port on the back of the NVR. Well it just happens I'm an IT guy and use a Dell Precision T7910 pro workstation that has a real serial port and I have piles of serial console cables for managing different devices on my shops network. So I connect a cable up, fire up Putty and power up the NVR and get nothing. Tried a few different speeds and no go. I read in some thread that someone said on some other model that the serial port is 12v TTL - yikes! Hoping I did not fry my serial port I pulled the cover on the NVR and checked with a meter and the serial port is 3v.... so all good. So I decided to see, just to be sure.... a null modem cable. Bam - console started spitting out data on booting the NVR. After a minute or so you see a starting linux message and the console then goes dead. Before then though - you can interrupt the boot process by pressing a key.

    That drops you to a Hisilicon uboot prompt. So digging some more and trying to glean some info online I figure some commands out and find that one is a manual firmware upgrade for Dahua devices, run up. Looking at the environment variables I see that run up is looking for update.img via TFTP. There are also several other run commands that can load individual parts of the firmware in the same manner. Well - went back the the firmware I downloaded and tried in the web interface and sure enough - all of the various files are in there including update.img. So I fired up a TFTP server and set the environment variables in the NVR for using TFTP, copied the update.img to the TFTP folder and then ran the run up command. It took it in just fine. Now my brand new Lorex NVR is a Dahua NVR5216-16P-4KS2 with all of the proper capabilities like IVS. It also sees the two Dahua cams just fine in private mode and also sees the Lorex cams just fine too (those are still running Lorex branded firmware - I might have to try this on those too and load proper Dahua english firmware on them.

    Anyways - I'm tired and am going home. I just spent the past 3 hours on this. I have not tried to match up the two Lorex camera models that came in the kit with their Dahua counterparts yet. I think those will be trickier to convert the Dahua firmware though since they do not have a easy to get to serial port and the Lorex firmware seems to not like being upgraded to Dahua firmware in the web UI. I have not tried that on a camera though - just the NVR. If this is doable on the cameras too, particularly without having to crack each one open to solder some wires on for serial access, then I will really be stoked.

    The one thing I really want to figure out though, is a way to backup the Lorex firmware FIRST. This way if there is an issue with something where I might need to send it back to Lorex under warranty I can load their firmware back on first.
     
    Last edited: Jul 15, 2018
    Farmer D, Arjun and mat200 like this.
  9. mat200

    mat200 Known around here

    Joined:
    Jan 17, 2017
    Messages:
    3,019
    Likes Received:
    1,392
    Hi MixManSC

    Very cool! Thanks for sharing!

    Would enjoy seeing a nice how-to on this.

    Wonder why Lorex stripped support for the cameras like the SD1A203T.
     
    Arjun likes this.
  10. Arjun

    Arjun Pulling my weight

    Joined:
    Feb 26, 2017
    Messages:
    736
    Likes Received:
    205
    Location:
    USA
    Those that purchased a 16-Channel Lorex System from Costco or Lorex-direct will be pleased. A colleague of mine mentioned that his system came with a remote for his NVR. However as far as I know NVR5216-16P-4KS2 doesn't have an IR emitter

    I mean just look at this picture,
    [​IMG]

     
    mat200 likes this.
  11. Farmer D

    Farmer D n3wb

    Joined:
    Oct 26, 2017
    Messages:
    14
    Likes Received:
    3
    +1 on a how-to to flash Dahua firmware
    +1 on a how-to on flashing firmware. I have the same NVR and would love IVS capabilities.
     
    mat200 likes this.
  12. mat200

    mat200 Known around here

    Joined:
    Jan 17, 2017
    Messages:
    3,019
    Likes Received:
    1,392
    Hi Arjun,

    FYI - there is a version of the NVR5216-16P-4KS2 which comes with a fancy face plate... though typically most of us are OK w/o spending the extra $$ for it.
    ( iirc it was $80-100 more or something along those lines )
     
    Arjun likes this.
  13. alastairstevenson

    alastairstevenson Known around here

    Joined:
    Oct 28, 2014
    Messages:
    9,210
    Likes Received:
    2,618
    Location:
    Scotland
    If it's a Dahua in Lorex clothing, that's likely to be because the kernel is set to use the UART for other purposes such as PTZ control instead of debug / serial console.
    On a Dahua, that behaviour can be set with a bootloader environment variable :
    setenv dh_keyboard 0
    saveenv

    And use
    reset
    to reboot.

    Another environment variable may be able to be used to gain access to a shell prompt in order to copy out the flash partitions as a backup of the as-is status.
    setenv appauto 0
    saveenv
     
    mat200 likes this.
  14. MixManSC

    MixManSC Pulling my weight

    Joined:
    May 20, 2018
    Messages:
    132
    Likes Received:
    130
    Location:
    USA
    Yes - the Lorex version does include a remote control.... and has the fancier face with all the buttons. Ok - this was a pain to document and write out....

    First of all – I am not responsible for your warranty or if this somehow goes wrong and you brick your NVR. I cannot provide personal support for this. Much of what I learned on here regarding how this is done is thanks to cor35vet and others before me who ventured into modding firmware and unbricking Dahua IP cameras that have been bricked for various reasons. There was just not a lot of info on the NVR’s though and what info there is, is scattered all over the place. So it is quite difficult to put all the info you need in a short number of steps. This really is way far above the average person’s skill set in regards to computers and electronics. If you are not a typical computer nerdy type, you might need to just move on or find someone who is.

    Ok – so here are instructions to cross-flash your Lorex NR9163 NVR over to Dahua NVR5216-16P-4KS2 firmware. I also should point out that it is possible that Lorex has changed the internals at some point and kept the same model number. I doubt it but be warned that your Lorex NVR should have the same general specs for this to work like 4K, POE ports, and potentially even take the top cover off and verify that the mainboard is identical to this one.

    You will need a few things to do this as well as some grasp of TFTP, networking, and working in a terminal emulator. You will also need a null-modem serial cable, a computer with a serial port (sorry, I cannot help or vouch for the many USB to serial adapters available), and the correct firmware update file. I will also point out that the NVR firmware has what is called a watchdog program that runs in the earliest boot stages – I have no idea how to disable that. What the watchdog does is checks if the systems main software is running and if not it tries to start the main system software. This WILL interrupt you when you are working in the console mode. One thing you can do is extend the timer that it counts down when it tells you to press a key to interrupt the boot process.

    I used the official firmware from the Dahua Wiki from here-

    USA/NVR/Pro/DHI NVR52A16 16P 4KS2 - Dahua Wiki

    This is an English, Spanish, French firmware which is also the same languages available in the stock Lorex firmware. In case the Wiki page gets updated, the zipped archive is named

    DH_NVR5XXX-4KS2_EngSpnFrn_V3.215.0000000.3.R.20171211.zip

    When extracted this firmware has the same firmware in several formats. One is used for updating firmware via the web interface, another for the recovery mode which is what we are going to use, and there are also the actual individual file system partition images as well. The one you want for this is update.img.

    I used the terminal program that Dahua recommends which is NCOM which I downloaded from some thread or another around here – I have attached it to this post. You will need a TFTP server – I use the free one from SolarWinds.

    Download and extract the firmware. Start the TFTP server and configure its folder. Copy the update.img to that folder. Have your serial cable connected to the NVR and have NCOM open and looking at COM1. Power up the NVR and you should start seeing some text in the NCOM window. When it gets to where it says Hit any key to stop autoboot you need to quickly press the asterisk * key. If it goes past you are too late, switch the power off and cut the NVR back on and try again. Also if you get nothing in the NCOM window then your serial connection is not right.

    Anyways once you interrupt autoboot you will get a #Hisilicon prompt. The commands might be case sensitive and either way spelling is critical. First thing is to document your current boot environment variables. At the prompt type printenv and hit enter. Copy (select it in the windows and right click it to copy) and paste this output into a text document and save it. You can also type help for a list of valid commands. I’d strongly discourage typing ANY command that you are not 100% sure what it does. Another important command is saveenv – this will save the variables you change. The printenv command will list the default values for you to change back when you are done.

    Now lets set the environment variables we need. Each command is started with setenv – for example, setenv bootdelay 9.

    Now lets extend the auto boot timer so that you at least have a few more seconds to hit the * key to stop the auto boot - this the bootdelay variable. It defaults to 3 seconds. I set it to 9 which was plenty of time and you can set it back later. Realistically, you should not even need to bother with the boot delay. On boot it takes it about 10 seconds to get to where you interrupt the boot already.

    Type each line exactly as below and hit enter after each. Warning – at some point it WILL try to start booting. You must hit the * key again to interrupt that or you will need to power it off and on again to start over. I typed saveenv after every several variables I changes because one you have to stop it with the * key again anything not saved is lost.

    setenv bootdelay 9
    saveenv

    The next main things you need are the below – these are at their default values. You must type setenv before each one. Change the addresses to match your network configuration. Serverip is your computer that you have the TFTP server running on, ipaddr is the temporary IP you are assigning to the NVR, gateway is your networks gateway, netmask is your subnet. If this is beyond you, you should probably call someone who has more experience to help you through all of this.

    setenv serverip 255.255.255.255
    setenv ipaddr 255.255.255.255
    setenv gatewayip 255.255.255.255
    setenv netmask 255.255.0.0
    saveenv

    At this point everything should be ready for the firmware upgrade. Due to the timer I’d suggest at this point one final reboot of the unit. Type reset and hit enter. Stop it again when it gets to the wait timer with the * key. Time to upgrade – type

    run up

    Now wait and watch a bunch of programming and write commands go by. Once its done it will try to start the kernel. Mine then kicked out to a root prompt #. At this point, cut the power switch off and then on again. Stop the autoboot when prompted with the * key again. Now go and set the environment variables back to their original values using the same commands as before and saveenv.

    Reboot the NVR one last time and hope that you eventually hear that beep. Give it another minute or so and login via the web ui. Now one final step is needed. The new firmware has a little wizard you go through. Do that. The final step will be to fully reset the NVR factory defaults. This is because during a firmware upgrade certain things are kept like logins and apparently some things Lorex puts in like their DDNS and email configuration. So go to the Setup>System>Default page and push the Factory Reset button.

    Now once it finishes this reset you will have to find the NVR's IP address with the config tool. Then open that IP address in Internet Explorer and go through the Setup Wizard again. Now you can enjoy the new Dahua firmware. :)

    Updated certain steps based on feedback on 07/15....
     

    Attached Files:

    Last edited: Jul 15, 2018
    Polyesterpenguin, Arjun and mat200 like this.
  15. MixManSC

    MixManSC Pulling my weight

    Joined:
    May 20, 2018
    Messages:
    132
    Likes Received:
    130
    Location:
    USA
    As an update - I want to try and convert the cameras as well but turns out I need a TTL converter before I can get serial output that is not a garbled mess. Have one ordered from Amazon Prime... I'm thinking I should be able to get those on Dahua firmware as well. They upgraded the eyeball cameras in the kit as well. Was going to be LNE4163 and they shipped LNE4172 - only real difference is the 4172 has a 2.8mm lens (wider angle) than the 3.6mm lens which is actually fine with me.

    Also another update is I loaded the newest firmware on the NVR through the web UI and it took that perfectly fine.
     
    Arjun and mat200 like this.
  16. MixManSC

    MixManSC Pulling my weight

    Joined:
    May 20, 2018
    Messages:
    132
    Likes Received:
    130
    Location:
    USA
    So - I got the stock firmware pulled and good there. Got the TTL adapter in and went at one of the cameras. The LNE4172 - its firmware has the following in the PD-X image....

    {
    "DeviceTypeTransform" : {
    "Dahua":{
    "LNB4173SB" : "IPC-HFW1431S",
    "LNE4172SB" : "IPC-HDW1431S"
    }
    },
    "countryTransform": {
    "Dahua": "America",
    }
    }

    Okay - sweet! Now we know exactly which which model Dahua cameras they are. :) The same firmware applies to both the bullet and the eyeball cams in the kit. So - these use Rhea firmware. Easy enough, they have an older version 2.460 and there is a much newer 2.622 version. Tried loading it via the serial console using TFTP. It will only load some of the files. :( Some give an error about memory. So I did some comparing and both versions give you the partition and bootargs configs in the partition-x image files. Turns out Lorex has configured their custom firmware to use some different memory addresses and whatnot. That is getting a bit beyond my current skill level to figure out. I'm guessing I'd need to first erase the current partition, then change the environment arguments, then reboot the camera, then try loading the Dahua firmware? Both show the same amount of memory and all. I'm just venturing into unfamiliar territory with attempting any erase commands as I'm not sure if I might accidentally erase the uboot itself. I did update that too even though you generally should not do so. It did take that part of the firmware fine and works the same. I also tried loading just the firmware files it would take without an error but that does not fly. On reboot, once the kernel loads and it tries to start everything up it reboots. Loaded the stock back just fine and it still is no worse for the wear. As it is, it will not take the pd, partition, user, and custom images.

    If I can find some time maybe later in the week or this weekend I might mess with it some more. At least I have the NVR running the fully enabled Dahua firmware instead of the crippled Lorex firmware. I'm just thinking that I might be missing some of the IVS features that require camera support if I cannot load the Dahua firmware onto the cameras. I'm plenty confident in changing the environement variables and even the "run command" type variables. I'm just uncertain on erasepartition stuff in that some of the partitions are mounted and whatnot. Some of the commands are just bizarre too like "true - do nothing, successfully" - LOL what? Typing true does, well, nothing, so I guess that command works. o_O
     
    Arjun and mat200 like this.
  17. mat200

    mat200 Known around here

    Joined:
    Jan 17, 2017
    Messages:
    3,019
    Likes Received:
    1,392
    Sweet MixMan

    If you get a chance to show a few pictures how you connect to the cameras / nvr w/the TTL adapter and the related setup that imho would be of great interest for others learning here.

    Thanks!
     
    Arjun likes this.
  18. Arjun

    Arjun Pulling my weight

    Joined:
    Feb 26, 2017
    Messages:
    736
    Likes Received:
    205
    Location:
    USA
    Definitely post a DIY tutorial here (step by step) when you get the chance @MixManSC
    Excellent stuff, hopefully this thread will be stickied once a clear and concise tutorial can be made. Cheers :)
     
    mat200 likes this.
  19. MixManSC

    MixManSC Pulling my weight

    Joined:
    May 20, 2018
    Messages:
    132
    Likes Received:
    130
    Location:
    USA
    As far as connecting to the camera with a TTL/RS232 adapter that is covered very well in the unbrick your Dahua IPC and Dahua firmware mod threads. Rather than rewrite all that I'd refer any to this Dahua IPC unbricking / recovery over serial UART and TFTP to connect to their camera in this manner. That being said - I've still not had any luck getting the camera to take the Dahua firmware even though it is for the same model.

    Now on the NVR - that is different and easier since you do not really have to take anything apart or try and connect directly to solder pads on a circuit board. In post #44 above I did give pretty good instructions on the NVR. That is pretty straightforward and you just need a null-modem adapter, and for most probably also a USB serial adapter since most modern residential class computers do not have serial ports anymore. I'd say for the NVR to get a regular serial cable and a null modem adapter that way you still have a regular serial cable for other things where you might not need the null-modem adapter. There are hundreds of choices for USB to serial cables and null-modem adapters.

    Also forgot to mention. Of note - the hard drive that comes with the Lorex NR9163 NVR is a WD Purple 3TB. :) Below is a peek inside - 100% identical to a Dahua 5216. With the 15% off making at $679.99 this combo from Lorex cannot be beat. 2K IP Security Camera System with 16 Channel NVR and 8 HD IP Outdoor 4MP Cameras , 130FT Night Vision Especially considering you get the higher end Dahua NVR5216-16P-4KS2 NVR that has the upgraded face with the contorl buttons, wireless remote control, AND a 3TB WD Purple hard drive (still will want to add a second, I added a 4TB), and the fact that you can truly convert it to 100% Dahua firmware quite easily (and later convert it back to Lorex if you needed to for some reason). So at that $680 you also get eight 4MP cameras that are also Dahua (I just have not been able to change the firmware on these, yet). On the NVR with the cross-flashed firmware it does see the Lorex cameras just fine and it also sees the genuine Dahua PTZ cameras I have just fine and can now use the IVS features.

    Also, I should add. The newest Dahua NVR firmware (and they will be implementing this across their product lines) has some new code that permanently blocks the ability to connect to devices intended for the China market. In other words is you have some of the dirt cheap cameras that are hacked to be in English (and cannot have the firmware upgraded because they are hacked to be in English) they will NOT work with the newest firmware. So if you are using any of those dirt cheap cameras then you will not wan to upgrade to the newest firmware. It looks like any of the 2017 firmware is safe but the newest 2018 firmware has this. The release notes and more info about this newest NVR firmware is here... NVR5XXX-4KS2 latest new firmware.

    This is the firmware that I loaded on my Lorex. So I can 100% confirm that it IS a USA model and works fine. It does have some nice new functions. One that is great is it will now export in MP4 file format. :)

    LorexNR9163.jpg
     
    Last edited: Jun 14, 2018
    Arjun and mat200 like this.
  20. mat200

    mat200 Known around here

    Joined:
    Jan 17, 2017
    Messages:
    3,019
    Likes Received:
    1,392
    Hi MixManSC,

    I would especially like to thank you for sharing this!

    Q1: Do you know if the Lorex NVR w/Lorex firmware works w/Dahua OEM PTZ cameras? ( or do I have to reflash w/the Dahua OEM firmware for that )

    Q2: Do we yet know how Dahua's new NVR firmware is blocking the Chinese market cameras?
     
  21. MixManSC

    MixManSC Pulling my weight

    Joined:
    May 20, 2018
    Messages:
    132
    Likes Received:
    130
    Location:
    USA
    1 - I have two PTZ cameras I bought from Andy, model SD1A203T-GN (pretty basic 2MP starlight ones) which are unbranded Dahua OEM, and those work perfectly fine with the newest NVR firmware.
    2- I cannot help on that as I do not have any of the China market cameras....

    I'd also say is that Dahua specifically states that about China market devices. However I am personally unsure if they have devices for other specific markets or if OEM products for other markets could be affected. One thing I'd say is to make sure you have to most recent firmware prior to this new one on hand in case you do find some issue and need to downgrade. Does Dahua make products specific for other regions as well or just China mainland, and then devices for the rest of the world? To me, seeing that the new firmware has 23 languages built in that my guess is just that. Devices specifically for China, and devices for everywhere else. So far I can assume that OEM (no Dahua branding) specific devices for "everywhere else" do work with the new NVR firmware too as the Lorex cameras I have seem to work just fine. That all being said, we have no way of know yet just how much, if any, of the new security related to that has been implemented in the new firmware.

    Edit to add- the specific error I get on certain parts of the firmware when trying to update the Lorex camera is this
    data lenght error.
    Outside available Flash
    flwrite error 1!

    I've tried loading the partition file which is does take fine. Then reboot it to see if maybe that will reconfigure things but no go. So I'm assuming the only way will be to first erase the flash. Might get adventurous and try that this weekend.
     
    Last edited: Jun 14, 2018
    Arjun and mat200 like this.
  22. Polyesterpenguin

    Polyesterpenguin n3wb

    Joined:
    Jul 5, 2018
    Messages:
    7
    Likes Received:
    2
    Location:
    Asheville, NC
    I bought the LN10802-168W package from lorex which includes the NR9163. Going to try flashing it to Dahua NVR5216-16P-4KS2 firmware. Thank you MixmanSC for your great writeup.

    I don't currently have a serial port on my computers so I bought this USB to Serial Null Modem Adapter. (hopefully it will work)


    @MixManSC if you have a few minutes I have a couple of questions.

    The current firmware is: DH_NVR5XXX-4KS2_Internal_V3.216.0000000.0.R.20180530
    Do you think this might work or should I try to find the version you used?

    Once updated to Dahua NVR5216-16P-4KS2 are you able to update through the web interface?

    Is the a way to revert back to Lorex firmware if needed?

    Do you have a picture of the inside of your unit I could compare to and make sure they haven't made any changes?

    If this works it seems like this is a great deal. I will add some starlight cameras to the system later.
     
    Last edited: Jul 12, 2018
    mat200 likes this.
  23. MixManSC

    MixManSC Pulling my weight

    Joined:
    May 20, 2018
    Messages:
    132
    Likes Received:
    130
    Location:
    USA
    @Polyesterpenguin

    That is essentially the same kit I bought. That null modem serial adapter should work fine.
    I've actually updated mine to that same even newer 3.216 firmware using the web interface no problem from the first Dahua firmware I loaded using the serial cable.
    I was able to get the original Lorex firmware in case it needs to be reverted for warranty purposes... I'll need to upload that somewhere for you.
    Yes - I actually did take a picture... ;) Click for larger.

    Aside from the NVR. I have tried and tried and literally have spent probably 8 hours trying to crossflash one of the cameras to Dahua firmware but not getting anywhere on those. Regardless, even if I did, that is much more invasive and diffucult to pull off as it requires a TTL serial adapter and tiny wires and pins to tied directly into the circuit board inside the camera. I've given up. It seems that Dahua has not put out a firmware that is specifically compatible. The eyeball cameras come up as Dahua IPC-HDW1431S-V2 in their firmware but..... the "V2" seems to have different file system partitioning and no Dahua firmware I've found shows the "V2" firmware. I've essentially given up on trying to crossflash the cameras for now.

    LorexNVR.jpg
     
    Arjun and mat200 like this.
  24. Polyesterpenguin

    Polyesterpenguin n3wb

    Joined:
    Jul 5, 2018
    Messages:
    7
    Likes Received:
    2
    Location:
    Asheville, NC
    Thank you so much for the picture! I don't have the unit yet but should get it next week. I'll let you know how it goes. Thank you again for all your hard work!
     
  25. MixManSC

    MixManSC Pulling my weight

    Joined:
    May 20, 2018
    Messages:
    132
    Likes Received:
    130
    Location:
    USA
    Happy to share. Thats what forums like this are about. I've gotten a tremendous amount of knowledge by reading on here thanks to the work others have done. Always good to try and give back.
     
    looney2ns and mat200 like this.
  26. mat200

    mat200 Known around here

    Joined:
    Jan 17, 2017
    Messages:
    3,019
    Likes Received:
    1,392
    Hi Polyester

    Excellent looking forward to others trying this, please do review the instructions that MixManSC has made and feel free to proof them and note anything which needs further clarification. ( they look really good - just know when I do something along those lines I may have missed a few notes which may not be obvious to others )
     
    MixManSC likes this.
  27. MixManSC

    MixManSC Pulling my weight

    Joined:
    May 20, 2018
    Messages:
    132
    Likes Received:
    130
    Location:
    USA
    A couple of tips and notes.
    I have not done any of this using a monitor, keyboard, mouse, etc directly connected to the NVR so I cannot comment or help much from that view of things. I did connect one today just to see and it does work fine though but I'll never really be personally using it that way. It is a headless install in a closet and I just access the web UI.

    Important Tip: After you have the Dahua firmware loaded, go into the settings to Setup>System>Default and click the <Factory Reset> button and wait for it to fully restart.

    I was having some bugs, apparently from some Lorex configuration that it kept in place during the upgrade. Specifically I could not configure email and DDNS. Email had some bizarre text in one spot and I could not type anything in the SMTP server box, it was stuck on some lorex stuff. After I did the Factory Reset it comes back up on the normal default Dahua IP of 192.168.1.108 as "unconfigured". On going into the web UI at this point it walks you through a wizard to first configure a new password, password reset email address, and some security questions like what color was your first car. After the Factory Reset everything is fine.... :D

    Of interest. By default on the Lorex firmware (both on the NVR and the cameras) the MAXIMUM password length is 6 characters. Wtf would they set it that way for??? lol Hard to setup a complex password with just 6 characters. The Lorex firmware will call your password weak if you try to put on that short.
     
    mat200 likes this.
  28. Polyesterpenguin

    Polyesterpenguin n3wb

    Joined:
    Jul 5, 2018
    Messages:
    7
    Likes Received:
    2
    Location:
    Asheville, NC
    Received the unit and opened it up and it looks exactly like yours. The adapter works great and I was able to connect to the NVR. Everything went smoothly until I got to "run up" then I get this:
    hisilicon # run up
    stmmac_init,550,0x70431,3
    MAC: 00-40-7F-BC-DD-D6
    TFTP from server 192.168.0.100; our IP address is 192.168.0.109
    Download Filename 'update.img'.
    Download to address: 0x42000000
    Downloading: T T T T T
    Retry count exceeded; starting again
    Bad Magic Number
    boottype=1:
    dh_wdt_stop called
    flash_do_flwrite,646,ret:-69,flash_sn:1
    set_upgrade_update_state ok[set null,add by ll]
    Bad Magic Number
    flwrite error!
    dh_wdt_start calledMAC: 00-00-23-34-45-66

    Any ideas?
     
  29. alastairstevenson

    alastairstevenson Known around here

    Joined:
    Oct 28, 2014
    Messages:
    9,210
    Likes Received:
    2,618
    Location:
    Scotland
    What's the IP address of the PC that's running the tftp server?
     
  30. Polyesterpenguin

    Polyesterpenguin n3wb

    Joined:
    Jul 5, 2018
    Messages:
    7
    Likes Received:
    2
    Location:
    Asheville, NC
    It is 192.168.0.100
    According to my router the NVR is 192.168.0.109
    Router address is: 192.168.0.1

    Doing this with the NVR connected to the router and the computer is on WAN. Might try with a computer with a LAN port.

    Adapter and NCOM are set to COM3