+1 on a how-to to flash Dahua firmware
+1 on a how-to on flashing firmware. I have the same NVR and would love IVS capabilities.
Lorex
- Thread starter DmaxDually
- Start date
mat200
IPCT Contributor
- Jan 17, 2017
- 15,363
- 25,894
Hi Arjun,
FYI - there is a version of the NVR5216-16P-4KS2 which comes with a fancy face plate... though typically most of us are OK w/o spending the extra $$ for it.
( iirc it was $80-100 more or something along those lines )
alastairstevenson
Staff member
If it's a Dahua in Lorex clothing, that's likely to be because the kernel is set to use the UART for other purposes such as PTZ control instead of debug / serial console.
On a Dahua, that behaviour can be set with a bootloader environment variable :
setenv dh_keyboard 0
saveenv
And use
reset
to reboot.
Another environment variable may be able to be used to gain access to a shell prompt in order to copy out the flash partitions as a backup of the as-is status.
setenv appauto 0
saveenv
Yes - the Lorex version does include a remote control.... and has the fancier face with all the buttons. Ok - this was a pain to document and write out....
First of all – I am not responsible for your warranty or if this somehow goes wrong and you brick your NVR. I cannot provide personal support for this. Much of what I learned on here regarding how this is done is thanks to cor35vet and others before me who ventured into modding firmware and unbricking Dahua IP cameras that have been bricked for various reasons. There was just not a lot of info on the NVR’s though and what info there is, is scattered all over the place. So it is quite difficult to put all the info you need in a short number of steps. This really is way far above the average person’s skill set in regards to computers and electronics. If you are not a typical computer nerdy type, you might need to just move on or find someone who is.
Ok – so here are instructions to cross-flash your Lorex NR9163 NVR over to Dahua NVR5216-16P-4KS2 firmware. I also should point out that it is possible that Lorex has changed the internals at some point and kept the same model number. I doubt it but be warned that your Lorex NVR should have the same general specs for this to work like 4K, POE ports, and potentially even take the top cover off and verify that the mainboard is identical to this one.
You will need a few things to do this as well as some grasp of TFTP, networking, and working in a terminal emulator. You will also need a null-modem serial cable, a computer with a serial port (sorry, I cannot help or vouch for the many USB to serial adapters available), and the correct firmware update file. I will also point out that the NVR firmware has what is called a watchdog program that runs in the earliest boot stages – I have no idea how to disable that. What the watchdog does is checks if the systems main software is running and if not it tries to start the main system software. This WILL interrupt you when you are working in the console mode. One thing you can do is extend the timer that it counts down when it tells you to press a key to interrupt the boot process.
I used the official firmware from the Dahua Wiki from here-
USA/NVR/Pro/DHI NVR52A16 16P 4KS2 - Dahua Wiki
This is an English, Spanish, French firmware which is also the same languages available in the stock Lorex firmware. In case the Wiki page gets updated, the zipped archive is named
DH_NVR5XXX-4KS2_EngSpnFrn_V3.215.0000000.3.R.20171211.zip
When extracted this firmware has the same firmware in several formats. One is used for updating firmware via the web interface, another for the recovery mode which is what we are going to use, and there are also the actual individual file system partition images as well. The one you want for this is update.img.
I used the terminal program that Dahua recommends which is NCOM which I downloaded from some thread or another around here – I have attached it to this post. You will need a TFTP server – I use the free one from SolarWinds.
Download and extract the firmware. Start the TFTP server and configure its folder. Copy the update.img to that folder. Have your serial cable connected to the NVR and have NCOM open and looking at COM1. Power up the NVR and you should start seeing some text in the NCOM window. When it gets to where it says Hit any key to stop autoboot you need to quickly press the asterisk * key. If it goes past you are too late, switch the power off and cut the NVR back on and try again. Also if you get nothing in the NCOM window then your serial connection is not right.
Anyways once you interrupt autoboot you will get a #Hisilicon prompt. The commands might be case sensitive and either way spelling is critical. First thing is to document your current boot environment variables. At the prompt type printenv and hit enter. Copy (select it in the windows and right click it to copy) and paste this output into a text document and save it. You can also type help for a list of valid commands. I’d strongly discourage typing ANY command that you are not 100% sure what it does. Another important command is saveenv – this will save the variables you change. The printenv command will list the default values for you to change back when you are done.
Now lets set the environment variables we need. Each command is started with setenv – for example, setenv bootdelay 9.
Now lets extend the auto boot timer so that you at least have a few more seconds to hit the * key to stop the auto boot - this the bootdelay variable. It defaults to 3 seconds. I set it to 9 which was plenty of time and you can set it back later. Realistically, you should not even need to bother with the boot delay. On boot it takes it about 10 seconds to get to where you interrupt the boot already.
Type each line exactly as below and hit enter after each. Warning – at some point it WILL try to start booting. You must hit the * key again to interrupt that or you will need to power it off and on again to start over. I typed saveenv after every several variables I changes because one you have to stop it with the * key again anything not saved is lost.
setenv bootdelay 9
saveenv
The next main things you need are the below – these are at their default values. You must type setenv before each one. Change the addresses to match your network configuration. Serverip is your computer that you have the TFTP server running on, ipaddr is the temporary IP you are assigning to the NVR, gateway is your networks gateway, netmask is your subnet. If this is beyond you, you should probably call someone who has more experience to help you through all of this.
setenv serverip 255.255.255.255
setenv ipaddr 255.255.255.255
setenv gatewayip 255.255.255.255
setenv netmask 255.255.0.0
saveenv
At this point everything should be ready for the firmware upgrade. Due to the timer I’d suggest at this point one final reboot of the unit. Type reset and hit enter. Stop it again when it gets to the wait timer with the * key. Time to upgrade – type
run up
Now wait and watch a bunch of programming and write commands go by. Once its done it will try to start the kernel. Mine then kicked out to a root prompt #. At this point, cut the power switch off and then on again. Stop the autoboot when prompted with the * key again. Now go and set the environment variables back to their original values using the same commands as before and saveenv.
Reboot the NVR one last time and hope that you eventually hear that beep. Give it another minute or so and login via the web ui. Now one final step is needed. The new firmware has a little wizard you go through. Do that. The final step will be to fully reset the NVR factory defaults. This is because during a firmware upgrade certain things are kept like logins and apparently some things Lorex puts in like their DDNS and email configuration. So go to the Setup>System>Default page and push the Factory Reset button.
Now once it finishes this reset you will have to find the NVR's IP address with the config tool. Then open that IP address in Internet Explorer and go through the Setup Wizard again. Now you can enjoy the new Dahua firmware.
Updated certain steps based on feedback on 07/15....
First of all – I am not responsible for your warranty or if this somehow goes wrong and you brick your NVR. I cannot provide personal support for this. Much of what I learned on here regarding how this is done is thanks to cor35vet and others before me who ventured into modding firmware and unbricking Dahua IP cameras that have been bricked for various reasons. There was just not a lot of info on the NVR’s though and what info there is, is scattered all over the place. So it is quite difficult to put all the info you need in a short number of steps. This really is way far above the average person’s skill set in regards to computers and electronics. If you are not a typical computer nerdy type, you might need to just move on or find someone who is.
Ok – so here are instructions to cross-flash your Lorex NR9163 NVR over to Dahua NVR5216-16P-4KS2 firmware. I also should point out that it is possible that Lorex has changed the internals at some point and kept the same model number. I doubt it but be warned that your Lorex NVR should have the same general specs for this to work like 4K, POE ports, and potentially even take the top cover off and verify that the mainboard is identical to this one.
You will need a few things to do this as well as some grasp of TFTP, networking, and working in a terminal emulator. You will also need a null-modem serial cable, a computer with a serial port (sorry, I cannot help or vouch for the many USB to serial adapters available), and the correct firmware update file. I will also point out that the NVR firmware has what is called a watchdog program that runs in the earliest boot stages – I have no idea how to disable that. What the watchdog does is checks if the systems main software is running and if not it tries to start the main system software. This WILL interrupt you when you are working in the console mode. One thing you can do is extend the timer that it counts down when it tells you to press a key to interrupt the boot process.
I used the official firmware from the Dahua Wiki from here-
USA/NVR/Pro/DHI NVR52A16 16P 4KS2 - Dahua Wiki
This is an English, Spanish, French firmware which is also the same languages available in the stock Lorex firmware. In case the Wiki page gets updated, the zipped archive is named
DH_NVR5XXX-4KS2_EngSpnFrn_V3.215.0000000.3.R.20171211.zip
When extracted this firmware has the same firmware in several formats. One is used for updating firmware via the web interface, another for the recovery mode which is what we are going to use, and there are also the actual individual file system partition images as well. The one you want for this is update.img.
I used the terminal program that Dahua recommends which is NCOM which I downloaded from some thread or another around here – I have attached it to this post. You will need a TFTP server – I use the free one from SolarWinds.
Download and extract the firmware. Start the TFTP server and configure its folder. Copy the update.img to that folder. Have your serial cable connected to the NVR and have NCOM open and looking at COM1. Power up the NVR and you should start seeing some text in the NCOM window. When it gets to where it says Hit any key to stop autoboot you need to quickly press the asterisk * key. If it goes past you are too late, switch the power off and cut the NVR back on and try again. Also if you get nothing in the NCOM window then your serial connection is not right.
Anyways once you interrupt autoboot you will get a #Hisilicon prompt. The commands might be case sensitive and either way spelling is critical. First thing is to document your current boot environment variables. At the prompt type printenv and hit enter. Copy (select it in the windows and right click it to copy) and paste this output into a text document and save it. You can also type help for a list of valid commands. I’d strongly discourage typing ANY command that you are not 100% sure what it does. Another important command is saveenv – this will save the variables you change. The printenv command will list the default values for you to change back when you are done.
Now lets set the environment variables we need. Each command is started with setenv – for example, setenv bootdelay 9.
Now lets extend the auto boot timer so that you at least have a few more seconds to hit the * key to stop the auto boot - this the bootdelay variable. It defaults to 3 seconds. I set it to 9 which was plenty of time and you can set it back later. Realistically, you should not even need to bother with the boot delay. On boot it takes it about 10 seconds to get to where you interrupt the boot already.
Type each line exactly as below and hit enter after each. Warning – at some point it WILL try to start booting. You must hit the * key again to interrupt that or you will need to power it off and on again to start over. I typed saveenv after every several variables I changes because one you have to stop it with the * key again anything not saved is lost.
setenv bootdelay 9
saveenv
The next main things you need are the below – these are at their default values. You must type setenv before each one. Change the addresses to match your network configuration. Serverip is your computer that you have the TFTP server running on, ipaddr is the temporary IP you are assigning to the NVR, gateway is your networks gateway, netmask is your subnet. If this is beyond you, you should probably call someone who has more experience to help you through all of this.
setenv serverip 255.255.255.255
setenv ipaddr 255.255.255.255
setenv gatewayip 255.255.255.255
setenv netmask 255.255.0.0
saveenv
At this point everything should be ready for the firmware upgrade. Due to the timer I’d suggest at this point one final reboot of the unit. Type reset and hit enter. Stop it again when it gets to the wait timer with the * key. Time to upgrade – type
run up
Now wait and watch a bunch of programming and write commands go by. Once its done it will try to start the kernel. Mine then kicked out to a root prompt #. At this point, cut the power switch off and then on again. Stop the autoboot when prompted with the * key again. Now go and set the environment variables back to their original values using the same commands as before and saveenv.
Reboot the NVR one last time and hope that you eventually hear that beep. Give it another minute or so and login via the web ui. Now one final step is needed. The new firmware has a little wizard you go through. Do that. The final step will be to fully reset the NVR factory defaults. This is because during a firmware upgrade certain things are kept like logins and apparently some things Lorex puts in like their DDNS and email configuration. So go to the Setup>System>Default page and push the Factory Reset button.
Now once it finishes this reset you will have to find the NVR's IP address with the config tool. Then open that IP address in Internet Explorer and go through the Setup Wizard again. Now you can enjoy the new Dahua firmware.
Updated certain steps based on feedback on 07/15....
Last edited:
As an update - I want to try and convert the cameras as well but turns out I need a TTL converter before I can get serial output that is not a garbled mess. Have one ordered from Amazon Prime... I'm thinking I should be able to get those on Dahua firmware as well. They upgraded the eyeball cameras in the kit as well. Was going to be LNE4163 and they shipped LNE4172 - only real difference is the 4172 has a 2.8mm lens (wider angle) than the 3.6mm lens which is actually fine with me.
Also another update is I loaded the newest firmware on the NVR through the web UI and it took that perfectly fine.
Also another update is I loaded the newest firmware on the NVR through the web UI and it took that perfectly fine.
So - I got the stock firmware pulled and good there. Got the TTL adapter in and went at one of the cameras. The LNE4172 - its firmware has the following in the PD-X image....
{
"DeviceTypeTransform" : {
"Dahua":{
"LNB4173SB" : "IPC-HFW1431S",
"LNE4172SB" : "IPC-HDW1431S"
}
},
"countryTransform": {
"Dahua": "America",
}
}
Okay - sweet! Now we know exactly which which model Dahua cameras they are. The same firmware applies to both the bullet and the eyeball cams in the kit. So - these use Rhea firmware. Easy enough, they have an older version 2.460 and there is a much newer 2.622 version. Tried loading it via the serial console using TFTP. It will only load some of the files. 
Some give an error about memory. So I did some comparing and both versions give you the partition and bootargs configs in the partition-x image files. Turns out Lorex has configured their custom firmware to use some different memory addresses and whatnot. That is getting a bit beyond my current skill level to figure out. I'm guessing I'd need to first erase the current partition, then change the environment arguments, then reboot the camera, then try loading the Dahua firmware? Both show the same amount of memory and all. I'm just venturing into unfamiliar territory with attempting any erase commands as I'm not sure if I might accidentally erase the uboot itself. I did update that too even though you generally should not do so. It did take that part of the firmware fine and works the same. I also tried loading just the firmware files it would take without an error but that does not fly. On reboot, once the kernel loads and it tries to start everything up it reboots. Loaded the stock back just fine and it still is no worse for the wear. As it is, it will not take the pd, partition, user, and custom images.
If I can find some time maybe later in the week or this weekend I might mess with it some more. At least I have the NVR running the fully enabled Dahua firmware instead of the crippled Lorex firmware. I'm just thinking that I might be missing some of the IVS features that require camera support if I cannot load the Dahua firmware onto the cameras. I'm plenty confident in changing the environement variables and even the "run command" type variables. I'm just uncertain on erasepartition stuff in that some of the partitions are mounted and whatnot. Some of the commands are just bizarre too like "true - do nothing, successfully" - LOL what? Typing true does, well, nothing, so I guess that command works.
{
"DeviceTypeTransform" : {
"Dahua":{
"LNB4173SB" : "IPC-HFW1431S",
"LNE4172SB" : "IPC-HDW1431S"
}
},
"countryTransform": {
"Dahua": "America",
}
}
Okay - sweet! Now we know exactly which which model Dahua cameras they are.
The same firmware applies to both the bullet and the eyeball cams in the kit. So - these use Rhea firmware. Easy enough, they have an older version 2.460 and there is a much newer 2.622 version. Tried loading it via the serial console using TFTP. It will only load some of the files. Some give an error about memory. So I did some comparing and both versions give you the partition and bootargs configs in the partition-x image files. Turns out Lorex has configured their custom firmware to use some different memory addresses and whatnot. That is getting a bit beyond my current skill level to figure out. I'm guessing I'd need to first erase the current partition, then change the environment arguments, then reboot the camera, then try loading the Dahua firmware? Both show the same amount of memory and all. I'm just venturing into unfamiliar territory with attempting any erase commands as I'm not sure if I might accidentally erase the uboot itself. I did update that too even though you generally should not do so. It did take that part of the firmware fine and works the same. I also tried loading just the firmware files it would take without an error but that does not fly. On reboot, once the kernel loads and it tries to start everything up it reboots. Loaded the stock back just fine and it still is no worse for the wear. As it is, it will not take the pd, partition, user, and custom images.If I can find some time maybe later in the week or this weekend I might mess with it some more. At least I have the NVR running the fully enabled Dahua firmware instead of the crippled Lorex firmware. I'm just thinking that I might be missing some of the IVS features that require camera support if I cannot load the Dahua firmware onto the cameras. I'm plenty confident in changing the environement variables and even the "run command" type variables. I'm just uncertain on erasepartition stuff in that some of the partitions are mounted and whatnot. Some of the commands are just bizarre too like "true - do nothing, successfully" - LOL what? Typing true does, well, nothing, so I guess that command works.
mat200
IPCT Contributor
- Jan 17, 2017
- 15,363
- 25,894
So - I got the stock firmware pulled and good there. Got the TTL adapter in and went at one of the cameras. The LNE4172 - its firmware has the following in the PD-X image....
{
"DeviceTypeTransform" : {
"Dahua":{
"LNB4173SB" : "IPC-HFW1431S",
"LNE4172SB" : "IPC-HDW1431S"
}
},
"countryTransform": {
"Dahua": "America",
}
}
Okay - sweet! Now we know exactly which which model Dahua cameras they are.
If I can find some time maybe later in the week or this weekend I might mess with it some more. At least I have the NVR running the fully enabled Dahua firmware instead of the crippled Lorex firmware. I'm just thinking that I might be missing some of the IVS features that require camera support if I cannot load the Dahua firmware onto the cameras. I'm plenty confident in changing the environement variables and even the "run command" type variables. I'm just uncertain on erasepartition stuff in that some of the partitions are mounted and whatnot. Some of the commands are just bizarre too like "true - do nothing, successfully" - LOL what? Typing true does, well, nothing, so I guess that command works.
Sweet MixMan
If you get a chance to show a few pictures how you connect to the cameras / nvr w/the TTL adapter and the related setup that imho would be of great interest for others learning here.
Thanks!
As far as connecting to the camera with a TTL/RS232 adapter that is covered very well in the unbrick your Dahua IPC and Dahua firmware mod threads. Rather than rewrite all that I'd refer any to this Dahua IPC unbricking / recovery over serial UART and TFTP to connect to their camera in this manner. That being said - I've still not had any luck getting the camera to take the Dahua firmware even though it is for the same model.
Now on the NVR - that is different and easier since you do not really have to take anything apart or try and connect directly to solder pads on a circuit board. In post #44 above I did give pretty good instructions on the NVR. That is pretty straightforward and you just need a null-modem adapter, and for most probably also a USB serial adapter since most modern residential class computers do not have serial ports anymore. I'd say for the NVR to get a regular serial cable and a null modem adapter that way you still have a regular serial cable for other things where you might not need the null-modem adapter. There are hundreds of choices for USB to serial cables and null-modem adapters.
Also forgot to mention. Of note - the hard drive that comes with the Lorex NR9163 NVR is a WD Purple 3TB. Below is a peek inside - 100% identical to a Dahua 5216. With the 15% off making at $679.99 this combo from Lorex cannot be beat. 2K IP Security Camera System with 16 Channel NVR and 8 HD IP Outdoor 4MP Cameras , 130FT Night Vision Especially considering you get the higher end Dahua NVR5216-16P-4KS2 NVR that has the upgraded face with the contorl buttons, wireless remote control, AND a 3TB WD Purple hard drive (still will want to add a second, I added a 4TB), and the fact that you can truly convert it to 100% Dahua firmware quite easily (and later convert it back to Lorex if you needed to for some reason). So at that $680 you also get eight 4MP cameras that are also Dahua (I just have not been able to change the firmware on these, yet). On the NVR with the cross-flashed firmware it does see the Lorex cameras just fine and it also sees the genuine Dahua PTZ cameras I have just fine and can now use the IVS features.
Also, I should add. The newest Dahua NVR firmware (and they will be implementing this across their product lines) has some new code that permanently blocks the ability to connect to devices intended for the China market. In other words is you have some of the dirt cheap cameras that are hacked to be in English (and cannot have the firmware upgraded because they are hacked to be in English) they will NOT work with the newest firmware. So if you are using any of those dirt cheap cameras then you will not wan to upgrade to the newest firmware. It looks like any of the 2017 firmware is safe but the newest 2018 firmware has this. The release notes and more info about this newest NVR firmware is here... NVR5XXX-4KS2 latest new firmware.
This is the firmware that I loaded on my Lorex. So I can 100% confirm that it IS a USA model and works fine. It does have some nice new functions. One that is great is it will now export in MP4 file format.
Now on the NVR - that is different and easier since you do not really have to take anything apart or try and connect directly to solder pads on a circuit board. In post #44 above I did give pretty good instructions on the NVR. That is pretty straightforward and you just need a null-modem adapter, and for most probably also a USB serial adapter since most modern residential class computers do not have serial ports anymore. I'd say for the NVR to get a regular serial cable and a null modem adapter that way you still have a regular serial cable for other things where you might not need the null-modem adapter. There are hundreds of choices for USB to serial cables and null-modem adapters.
Also forgot to mention. Of note - the hard drive that comes with the Lorex NR9163 NVR is a WD Purple 3TB.
Below is a peek inside - 100% identical to a Dahua 5216. With the 15% off making at $679.99 this combo from Lorex cannot be beat. 2K IP Security Camera System with 16 Channel NVR and 8 HD IP Outdoor 4MP Cameras , 130FT Night Vision Especially considering you get the higher end Dahua NVR5216-16P-4KS2 NVR that has the upgraded face with the contorl buttons, wireless remote control, AND a 3TB WD Purple hard drive (still will want to add a second, I added a 4TB), and the fact that you can truly convert it to 100% Dahua firmware quite easily (and later convert it back to Lorex if you needed to for some reason). So at that $680 you also get eight 4MP cameras that are also Dahua (I just have not been able to change the firmware on these, yet). On the NVR with the cross-flashed firmware it does see the Lorex cameras just fine and it also sees the genuine Dahua PTZ cameras I have just fine and can now use the IVS features.Also, I should add. The newest Dahua NVR firmware (and they will be implementing this across their product lines) has some new code that permanently blocks the ability to connect to devices intended for the China market. In other words is you have some of the dirt cheap cameras that are hacked to be in English (and cannot have the firmware upgraded because they are hacked to be in English) they will NOT work with the newest firmware. So if you are using any of those dirt cheap cameras then you will not wan to upgrade to the newest firmware. It looks like any of the 2017 firmware is safe but the newest 2018 firmware has this. The release notes and more info about this newest NVR firmware is here... NVR5XXX-4KS2 latest new firmware.
This is the firmware that I loaded on my Lorex. So I can 100% confirm that it IS a USA model and works fine. It does have some nice new functions. One that is great is it will now export in MP4 file format.
Last edited:
mat200
IPCT Contributor
- Jan 17, 2017
- 15,363
- 25,894
Hi MixManSC,
I would especially like to thank you for sharing this!
Q1: Do you know if the Lorex NVR w/Lorex firmware works w/Dahua OEM PTZ cameras? ( or do I have to reflash w/the Dahua OEM firmware for that )
Q2: Do we yet know how Dahua's new NVR firmware is blocking the Chinese market cameras?
1 - I have two PTZ cameras I bought from Andy, model SD1A203T-GN (pretty basic 2MP starlight ones) which are unbranded Dahua OEM, and those work perfectly fine with the newest NVR firmware.
2- I cannot help on that as I do not have any of the China market cameras....
I'd also say is that Dahua specifically states that about China market devices. However I am personally unsure if they have devices for other specific markets or if OEM products for other markets could be affected. One thing I'd say is to make sure you have to most recent firmware prior to this new one on hand in case you do find some issue and need to downgrade. Does Dahua make products specific for other regions as well or just China mainland, and then devices for the rest of the world? To me, seeing that the new firmware has 23 languages built in that my guess is just that. Devices specifically for China, and devices for everywhere else. So far I can assume that OEM (no Dahua branding) specific devices for "everywhere else" do work with the new NVR firmware too as the Lorex cameras I have seem to work just fine. That all being said, we have no way of know yet just how much, if any, of the new security related to that has been implemented in the new firmware.
Edit to add- the specific error I get on certain parts of the firmware when trying to update the Lorex camera is this
data lenght error.
Outside available Flash
flwrite error 1!
I've tried loading the partition file which is does take fine. Then reboot it to see if maybe that will reconfigure things but no go. So I'm assuming the only way will be to first erase the flash. Might get adventurous and try that this weekend.
2- I cannot help on that as I do not have any of the China market cameras....
I'd also say is that Dahua specifically states that about China market devices. However I am personally unsure if they have devices for other specific markets or if OEM products for other markets could be affected. One thing I'd say is to make sure you have to most recent firmware prior to this new one on hand in case you do find some issue and need to downgrade. Does Dahua make products specific for other regions as well or just China mainland, and then devices for the rest of the world? To me, seeing that the new firmware has 23 languages built in that my guess is just that. Devices specifically for China, and devices for everywhere else. So far I can assume that OEM (no Dahua branding) specific devices for "everywhere else" do work with the new NVR firmware too as the Lorex cameras I have seem to work just fine. That all being said, we have no way of know yet just how much, if any, of the new security related to that has been implemented in the new firmware.
Edit to add- the specific error I get on certain parts of the firmware when trying to update the Lorex camera is this
data lenght error.
Outside available Flash
flwrite error 1!
I've tried loading the partition file which is does take fine. Then reboot it to see if maybe that will reconfigure things but no go. So I'm assuming the only way will be to first erase the flash. Might get adventurous and try that this weekend.
Last edited:
Polyesterpenguin
n3wb
I bought the LN10802-168W package from lorex which includes the NR9163. Going to try flashing it to Dahua NVR5216-16P-4KS2 firmware. Thank you MixmanSC for your great writeup.
I don't currently have a serial port on my computers so I bought this USB to Serial Null Modem Adapter. (hopefully it will work)
@MixManSC if you have a few minutes I have a couple of questions.
The current firmware is: DH_NVR5XXX-4KS2_Internal_V3.216.0000000.0.R.20180530
Do you think this might work or should I try to find the version you used?
Once updated to Dahua NVR5216-16P-4KS2 are you able to update through the web interface?
Is the a way to revert back to Lorex firmware if needed?
Do you have a picture of the inside of your unit I could compare to and make sure they haven't made any changes?
If this works it seems like this is a great deal. I will add some starlight cameras to the system later.
I don't currently have a serial port on my computers so I bought this USB to Serial Null Modem Adapter. (hopefully it will work)
@MixManSC if you have a few minutes I have a couple of questions.
The current firmware is: DH_NVR5XXX-4KS2_Internal_V3.216.0000000.0.R.20180530
Do you think this might work or should I try to find the version you used?
Once updated to Dahua NVR5216-16P-4KS2 are you able to update through the web interface?
Is the a way to revert back to Lorex firmware if needed?
Do you have a picture of the inside of your unit I could compare to and make sure they haven't made any changes?
If this works it seems like this is a great deal. I will add some starlight cameras to the system later.
Last edited:
As an Amazon Associate IPCamTalk earns from qualifying purchases.
@Polyesterpenguin
That is essentially the same kit I bought. That null modem serial adapter should work fine.
I've actually updated mine to that same even newer 3.216 firmware using the web interface no problem from the first Dahua firmware I loaded using the serial cable.
I was able to get the original Lorex firmware in case it needs to be reverted for warranty purposes... I'll need to upload that somewhere for you.
Yes - I actually did take a picture...
Click for larger.
Aside from the NVR. I have tried and tried and literally have spent probably 8 hours trying to crossflash one of the cameras to Dahua firmware but not getting anywhere on those. Regardless, even if I did, that is much more invasive and diffucult to pull off as it requires a TTL serial adapter and tiny wires and pins to tied directly into the circuit board inside the camera. I've given up. It seems that Dahua has not put out a firmware that is specifically compatible. The eyeball cameras come up as Dahua IPC-HDW1431S-V2 in their firmware but..... the "V2" seems to have different file system partitioning and no Dahua firmware I've found shows the "V2" firmware. I've essentially given up on trying to crossflash the cameras for now.
That is essentially the same kit I bought. That null modem serial adapter should work fine.
I've actually updated mine to that same even newer 3.216 firmware using the web interface no problem from the first Dahua firmware I loaded using the serial cable.
I was able to get the original Lorex firmware in case it needs to be reverted for warranty purposes... I'll need to upload that somewhere for you.
Yes - I actually did take a picture...
Click for larger.Aside from the NVR. I have tried and tried and literally have spent probably 8 hours trying to crossflash one of the cameras to Dahua firmware but not getting anywhere on those. Regardless, even if I did, that is much more invasive and diffucult to pull off as it requires a TTL serial adapter and tiny wires and pins to tied directly into the circuit board inside the camera. I've given up. It seems that Dahua has not put out a firmware that is specifically compatible. The eyeball cameras come up as Dahua IPC-HDW1431S-V2 in their firmware but..... the "V2" seems to have different file system partitioning and no Dahua firmware I've found shows the "V2" firmware. I've essentially given up on trying to crossflash the cameras for now.
Polyesterpenguin
n3wb
Thank you so much for the picture! I don't have the unit yet but should get it next week. I'll let you know how it goes. Thank you again for all your hard work!
Happy to share. Thats what forums like this are about. I've gotten a tremendous amount of knowledge by reading on here thanks to the work others have done. Always good to try and give back.
mat200
IPCT Contributor
- Jan 17, 2017
- 15,363
- 25,894
Hi Polyester
Excellent looking forward to others trying this, please do review the instructions that MixManSC has made and feel free to proof them and note anything which needs further clarification. ( they look really good - just know when I do something along those lines I may have missed a few notes which may not be obvious to others )
A couple of tips and notes.
I have not done any of this using a monitor, keyboard, mouse, etc directly connected to the NVR so I cannot comment or help much from that view of things. I did connect one today just to see and it does work fine though but I'll never really be personally using it that way. It is a headless install in a closet and I just access the web UI.
Important Tip: After you have the Dahua firmware loaded, go into the settings to Setup>System>Default and click the <Factory Reset> button and wait for it to fully restart.
I was having some bugs, apparently from some Lorex configuration that it kept in place during the upgrade. Specifically I could not configure email and DDNS. Email had some bizarre text in one spot and I could not type anything in the SMTP server box, it was stuck on some lorex stuff. After I did the Factory Reset it comes back up on the normal default Dahua IP of 192.168.1.108 as "unconfigured". On going into the web UI at this point it walks you through a wizard to first configure a new password, password reset email address, and some security questions like what color was your first car. After the Factory Reset everything is fine....
Of interest. By default on the Lorex firmware (both on the NVR and the cameras) the MAXIMUM password length is 6 characters. Wtf would they set it that way for??? lol Hard to setup a complex password with just 6 characters. The Lorex firmware will call your password weak if you try to put on that short.
I have not done any of this using a monitor, keyboard, mouse, etc directly connected to the NVR so I cannot comment or help much from that view of things. I did connect one today just to see and it does work fine though but I'll never really be personally using it that way. It is a headless install in a closet and I just access the web UI.
Important Tip: After you have the Dahua firmware loaded, go into the settings to Setup>System>Default and click the <Factory Reset> button and wait for it to fully restart.
I was having some bugs, apparently from some Lorex configuration that it kept in place during the upgrade. Specifically I could not configure email and DDNS. Email had some bizarre text in one spot and I could not type anything in the SMTP server box, it was stuck on some lorex stuff. After I did the Factory Reset it comes back up on the normal default Dahua IP of 192.168.1.108 as "unconfigured". On going into the web UI at this point it walks you through a wizard to first configure a new password, password reset email address, and some security questions like what color was your first car. After the Factory Reset everything is fine....
Of interest. By default on the Lorex firmware (both on the NVR and the cameras) the MAXIMUM password length is 6 characters. Wtf would they set it that way for??? lol Hard to setup a complex password with just 6 characters. The Lorex firmware will call your password weak if you try to put on that short.
Polyesterpenguin
n3wb
Received the unit and opened it up and it looks exactly like yours. The adapter works great and I was able to connect to the NVR. Everything went smoothly until I got to "run up" then I get this:
hisilicon # run up
stmmac_init,550,0x70431,3
MAC: 00-40-7F-BC-DD-D6
TFTP from server 192.168.0.100; our IP address is 192.168.0.109
Download Filename 'update.img'.
Download to address: 0x42000000
Downloading: T T T T T
Retry count exceeded; starting again
Bad Magic Number
boottype=1:
dh_wdt_stop called
flash_do_flwrite,646,ret:-69,flash_sn:1
set_upgrade_update_state ok[set null,add by ll]
Bad Magic Number
flwrite error!
dh_wdt_start calledMAC: 00-00-23-34-45-66
Any ideas?
hisilicon # run up
stmmac_init,550,0x70431,3
MAC: 00-40-7F-BC-DD-D6
TFTP from server 192.168.0.100; our IP address is 192.168.0.109
Download Filename 'update.img'.
Download to address: 0x42000000
Downloading: T T T T T
Retry count exceeded; starting again
Bad Magic Number
boottype=1:
dh_wdt_stop called
flash_do_flwrite,646,ret:-69,flash_sn:1
set_upgrade_update_state ok[set null,add by ll]
Bad Magic Number
flwrite error!
dh_wdt_start calledMAC: 00-00-23-34-45-66
Any ideas?
alastairstevenson
Staff member
Polyesterpenguin
n3wb
It is 192.168.0.100
According to my router the NVR is 192.168.0.109
Router address is: 192.168.0.1
Doing this with the NVR connected to the router and the computer is on WAN. Might try with a computer with a LAN port.
Adapter and NCOM are set to COM3
According to my router the NVR is 192.168.0.109
Router address is: 192.168.0.1
Doing this with the NVR connected to the router and the computer is on WAN. Might try with a computer with a LAN port.
Adapter and NCOM are set to COM3