Lorex
- Thread starter DmaxDually
- Start date
worked well but instead of pressing * once I had to press 3 times.
The following was also not 100% clear at first:
Reboot the NVR one last time and hope that you eventually hear that beep. Give it another minute or so and login via the web ui. Now one final step is needed. The new firmware has a little wizard you go through. Do that. The final step will be to fully reset the NVR factory defaults. This is because during a firmware upgrade certain things are kept like logins and apparently some things Lorex puts in like their DDNS and email configuration. So go to the Setup>System>Default page and push the Factory Reset button.
"Give it another minute or so and login via the web ui", I didnt see the need to login via web ui so I guess its just a suggestion
Also just to clarify: the reset has to be done on local software not through web ui
Polyesterpenguin
n3wb
Maybe mine was new , where can I see that ? on the model itself its NR916-N
Polyesterpenguin
n3wb
The Lorex NR916N is the older version. From what I can tell though, the newer version NR ones are physically identical which means to me they are just the newer version of the NVR5xxx=4KS2 which are now named N52xxx and N54xxx. If you check Dahua for firmware, the new N52/54 ones still use the same firmware as the NVR54xxx-4KS2 models.
I recently purchased this lorex kit from Costco.
It consists of an NVR (Lorex model LNR6164T/LNR616X) and 9x cameras (Lorex model LNB8105X - re-badged/crippled Dahua model IPC-HFW1831C-PIR)
I powered the NVR up and tested all the cameras to make sure everything was in working order before installing for real. During this setup, I found one of the cameras would not work/the NVR could not communicate with it.
I reset the camera and it still would not connect, so I connected it to my network directly after resetting it again. I got it to work this way and found that even though it is labeled as a LNB8105X-C, it is running the Dahua firmware (2.622.0000000.31.R, Build Date: 2018-08-13). IVS is even enabled.
Has anyone tested Dahua firmware on this NVR? What is the corresponding Dahua model? Maybe N52B3P?
Regarding the cameras, I don't see that anyone has successfully installed the Dahua firmware on Lorex versions. Would my camera running the Dahua firmware give any clues as to how to do this?
It consists of an NVR (Lorex model LNR6164T/LNR616X) and 9x cameras (Lorex model LNB8105X - re-badged/crippled Dahua model IPC-HFW1831C-PIR)
I powered the NVR up and tested all the cameras to make sure everything was in working order before installing for real. During this setup, I found one of the cameras would not work/the NVR could not communicate with it.
I reset the camera and it still would not connect, so I connected it to my network directly after resetting it again. I got it to work this way and found that even though it is labeled as a LNB8105X-C, it is running the Dahua firmware (2.622.0000000.31.R, Build Date: 2018-08-13). IVS is even enabled.
Has anyone tested Dahua firmware on this NVR? What is the corresponding Dahua model? Maybe N52B3P?
Regarding the cameras, I don't see that anyone has successfully installed the Dahua firmware on Lorex versions. Would my camera running the Dahua firmware give any clues as to how to do this?
mat200
IPCT Contributor
- Jan 17, 2017
- 15,365
- 25,896
Hi @exarkun
What did you need to do to get it to work? ( the camera with the Dahua firmware )
Re: Dahua firmware for Lorex NVRs - there should be some discussion of that in this thread. Note though that the kit you have may need slightly different firmware due to the new features in the cameras - lights, siren, 2-way chit-chat / talk...
To get the "dahua" camera to work, I just had to remove power, remove the cover on the top of the camera that has two screws holding it in, then hold in the reset button for a bit while powering it on. After that, power it up on the LAN, see what DHCP address it received, and login with admin/admin. Set new admin password and I can now connect it to the Lorex NVR and use it.
Also of note, the SD card slot has a silver metallic sticker over it that says "Attention Do not remove"
Needless to say, I removed it and there is just a normal sd card slot. I have not tested it yet on either version of the camera.
Regarding the NVR, it appears the firmware might be the same as the others like TheDude posted above. NVR5xxx=4KS2
I just want to find if I can back it up first.
Also of note, the SD card slot has a silver metallic sticker over it that says "Attention Do not remove"
Needless to say, I removed it and there is just a normal sd card slot. I have not tested it yet on either version of the camera.
Regarding the NVR, it appears the firmware might be the same as the others like TheDude posted above. NVR5xxx=4KS2
I just want to find if I can back it up first.
Minor update. I booted the NVR with the serial port hooked up. Interrupted the boot and everything is pretty much the same as mixmansc has in his post.
I haven't tried updating the comparable Dahua firmware yet as I would like a backup copy of the Lorex firmware, just in case. Does anyone know where I can get a copy of the Lorex firmware for LNR6164T/LNR616X?
The last updates on the lorex site are in September 2017 nothing is listed for the LNR600 series
Is this firmware last posted by thedude compatible since it is an LNR600 series? There has to be a newer version than 2017, no? All I can tell from the web ui is I am at "firmware version 00003" and "build date 06-28-2018"
Thanks
Edit: Found my firmware (and many others) on this site: Firmware - LorexWiki
I haven't tried updating the comparable Dahua firmware yet as I would like a backup copy of the Lorex firmware, just in case. Does anyone know where I can get a copy of the Lorex firmware for LNR6164T/LNR616X?
The last updates on the lorex site are in September 2017 nothing is listed for the LNR600 series
Is this firmware last posted by thedude compatible since it is an LNR600 series? There has to be a newer version than 2017, no? All I can tell from the web ui is I am at "firmware version 00003" and "build date 06-28-2018"
Thanks
Edit: Found my firmware (and many others) on this site: Firmware - LorexWiki
Last edited:
Thanks for your efforts and links! I am following along and wanting to do something similar
Do you know the Dahua equivalent model number for the LNR616X that you are dealing with? I used to have a LNR616 but have upgraded to a 916X. I do not know the model number equivalent for it, or even the difference between the two models. I have snapped pics of the internals, though.
Here is a link that was used to download a file named..... NR916X_20180727_00009.bin
from here LINK: http://dha.flirservices.com/NR916X/NR916X_20180727_00009.bin
And a file that is a firmware link for LNR600
Firmware version 0147
Box
LNR600_20180209_00147.bin
I hope that this helps you out.
Regards,
Great finds on the Lorex and Flir firmwares!
It can be tricky trying to match OEM to stock Dahua firmware. What I did was a combination of things.
1) I had found a couple of videos or pictures of someone installing a hard drive in a Dahua model that I figured was the same and carefully compared those main boards inside to mine for one. That is only but so helpful and only if you happen to be able to find a picture or video that shows the internal details close enough.
2) I downloaded and compared pdf manuals. Those can sometimes also give you clues but its usually more generalized in that it might at least help you confirm for sure that the subject is indeed a Dahua OEM device.
3) Using the serial console you might be able to find certain bits of info like a model/part number that matches a Dahua one or confirming that the individual parts of the firmware names match what you extract from a Dahua firmware file.
4) This is the trickier but most important bit and takes some detective work and know how of using some software. This is really how one gets started in firmware hacking... An important note up front. Dahua (and Lorex) sign their firmware now and create a sign.img file that is in the firmware. That includes a checksum that is encrypted with a 2048 bit key. You are not going to get the key from Dahua. As such you are not going to be hacking or modifying their newer signed firmware and be able to install it so forget that idea.
First get the Lorex firmware file either from that link exarkun found or possibly contact Lorex support and tell them you need it for a safety backup just in case (that is what I did and they emailed me a link to get it). One you have the Lorex firmware file you will need a couple of utilities to poke around a bit. Most file compression utilities will be able to extract the .bin firmware file into its individual parts. I use 7zip - it will give an error extracting but it still extracts most of it. You will also want a text editor a bit more capable than notepad but notepad will also work as you are not going to be modifying anything, you are just looking around for clues is all. When the main firmware image is extracted you will get several folders. What you are doing is you will then start looking for files and opening them with a text editor and looking at the raw code and hoping to find some in plain text that will give you some clues. You also want to get the Dahua firmware that you think is the right match and extract it as well. Also direct from Dahua, they generally include the firmware in multiple formats including already extracted into individual bin files as well as one big bin file... Anyways on my NVR a big clue was the presence of a file named 575S_PMX.bin.img. That does not extract any further but it was present in both the Lorex firmware and the Dahua firmware I thought was the right one. Opening that file in a text editor shows a ton of machine code but on that one, right near the top was a big clue..... A Dahua NVR part number... NVR5XXX-4K. So there you go... A little more poking on the Dahua firmware wiki Index of /images/Firmware confirmed to me that Dahua uses the same firmware on multiple models in a series like NVR5208, NVR5216, NVR5416, etc.... So based on finding that in the Lorex firmware in addition to seeing all the other clues that match up gave me the confidence to go ahead and try cross flashing the Lorex to the Dahua firmware. There are also a TON of other files in the fully extracted firmware files. The vast majority are not going to be helpful and are really not device specific as many devices use the same core Linux system and whatnot.
On the cameras there are some other files present that can make positive identification that the NVR's do not have as well but I've not had any luck trying to cross-flash any of the Lorex cameras I have though. That being said - I only have 2 pretty basic model Lorex cameras. Some of their other and/or newer cameras might be easier but getting at the serial console on the cameras is also much more difficult and requires a low level TTL serial connection and tying directly into points on the board inside the camera instead of a standard serial connection.
So there you have a bit more explanation on how I poked around to find more out to give me enough info and confidence to try it. Good luck and be sure to post results on here to help others in the future!
Oh and another clue I discovered on that Lorexwiki site is that it would appear as though the non-Dahual OEM products that Lorex carries are OEM Raysharp products. So anyone not finding that their Lorex device matched to anything from Dahua might want to look at Raysharp to see if it matches something from them...
It can be tricky trying to match OEM to stock Dahua firmware. What I did was a combination of things.
1) I had found a couple of videos or pictures of someone installing a hard drive in a Dahua model that I figured was the same and carefully compared those main boards inside to mine for one. That is only but so helpful and only if you happen to be able to find a picture or video that shows the internal details close enough.
2) I downloaded and compared pdf manuals. Those can sometimes also give you clues but its usually more generalized in that it might at least help you confirm for sure that the subject is indeed a Dahua OEM device.
3) Using the serial console you might be able to find certain bits of info like a model/part number that matches a Dahua one or confirming that the individual parts of the firmware names match what you extract from a Dahua firmware file.
4) This is the trickier but most important bit and takes some detective work and know how of using some software. This is really how one gets started in firmware hacking... An important note up front. Dahua (and Lorex) sign their firmware now and create a sign.img file that is in the firmware. That includes a checksum that is encrypted with a 2048 bit key. You are not going to get the key from Dahua. As such you are not going to be hacking or modifying their newer signed firmware and be able to install it so forget that idea.
First get the Lorex firmware file either from that link exarkun found or possibly contact Lorex support and tell them you need it for a safety backup just in case (that is what I did and they emailed me a link to get it). One you have the Lorex firmware file you will need a couple of utilities to poke around a bit. Most file compression utilities will be able to extract the .bin firmware file into its individual parts. I use 7zip - it will give an error extracting but it still extracts most of it. You will also want a text editor a bit more capable than notepad but notepad will also work as you are not going to be modifying anything, you are just looking around for clues is all. When the main firmware image is extracted you will get several folders. What you are doing is you will then start looking for files and opening them with a text editor and looking at the raw code and hoping to find some in plain text that will give you some clues. You also want to get the Dahua firmware that you think is the right match and extract it as well. Also direct from Dahua, they generally include the firmware in multiple formats including already extracted into individual bin files as well as one big bin file... Anyways on my NVR a big clue was the presence of a file named 575S_PMX.bin.img. That does not extract any further but it was present in both the Lorex firmware and the Dahua firmware I thought was the right one. Opening that file in a text editor shows a ton of machine code but on that one, right near the top was a big clue..... A Dahua NVR part number... NVR5XXX-4K. So there you go... A little more poking on the Dahua firmware wiki Index of /images/Firmware confirmed to me that Dahua uses the same firmware on multiple models in a series like NVR5208, NVR5216, NVR5416, etc.... So based on finding that in the Lorex firmware in addition to seeing all the other clues that match up gave me the confidence to go ahead and try cross flashing the Lorex to the Dahua firmware. There are also a TON of other files in the fully extracted firmware files. The vast majority are not going to be helpful and are really not device specific as many devices use the same core Linux system and whatnot.
On the cameras there are some other files present that can make positive identification that the NVR's do not have as well but I've not had any luck trying to cross-flash any of the Lorex cameras I have though. That being said - I only have 2 pretty basic model Lorex cameras. Some of their other and/or newer cameras might be easier but getting at the serial console on the cameras is also much more difficult and requires a low level TTL serial connection and tying directly into points on the board inside the camera instead of a standard serial connection.
So there you have a bit more explanation on how I poked around to find more out to give me enough info and confidence to try it. Good luck and be sure to post results on here to help others in the future!
Oh and another clue I discovered on that Lorexwiki site is that it would appear as though the non-Dahual OEM products that Lorex carries are OEM Raysharp products. So anyone not finding that their Lorex device matched to anything from Dahua might want to look at Raysharp to see if it matches something from them...
Last edited:
Thanks for the additional info. I had already extracted the .bin and found NVR5XXX-4K in the same file you mentioned TheDude
Is there a way to use the .bin file or the contents of it to flash the NVR with the Lorex firmware if something doesn't work out with the dahua firmware?
not now... where did you get those links to dahua firmware?
Is there a way to use the .bin file or the contents of it to flash the NVR with the Lorex firmware if something doesn't work out with the dahua firmware?
not now... where did you get those links to dahua firmware?
Last edited:
You should be able to revert it to the Lorex firmware using the same methods with the serial console if you wanted to. The Dahua Wiki - Index of /images/Firmware
To install the dahua firmware, it is upgrade.img. The directions for tftp firmware installs are also with upgrade.img There is no upgrade.img inside the .bin
How do I use XXX.bin?
Those are the instructions to install if you have an "upgrade.img" file. I do not have that for the lorex firmware, I have LNR616X_20180628_00003.bin which, once extracted, gives:
575S_PMX.bin.img
custom-x.squashfs.img
logo-x.squashfs.img
romfs_slave-x.squashfs.img
romfs-x.squashfs.img
sign.img
u-boot.bin.img
u-boot_slave.bin.img
uImage.img
uImage_slave.img
web-x.squashfs.img
Ah - then you have to individually update the files....
So instead of "run up"
You would need to upgrade each component individually. This is from the printenv on mine...
da=tftp u-boot.bin.img; flwrite
dr=tftp romfs-x.squashfs.img; updatepart; flwrite
du=tftp user-x.squashfs.img; flwrite
dw=tftp web-x.squashfs.img; updatepart; flwrite
dl=tftp logo-x.squashfs.img; updatepart; flwrite
ds=tftp slave-x.squashfs.img; updatepart; flwrite
dc=tftp custom-x.squashfs.img; updatepart; flwrite
up=tftp update.img; updatepart; flwrite
tk=tftp uImage; bootm
pm=tftp 575s_PMX.bin.img; flwrite
dx=tftp u-boot_slave.bin.img; updatepart; flwrite
So you can see the "up" command does the update.img method and you can see the other run commands and what individual file each relates to. So doing them individually one at a time you would skip that and run each that you have files for. So in your case (on the order you listed them) you would
run pm
run dc
run dl
run ds
run dr
run da
run dx
run tk
run dw
Notice a couple are skipped that you do not have files for and that is generally okay as sometimes they do not update everything is every firmware update. Some things they might never put out an update for. As you run each command you will have to wait for each to upload and then complete and then simply run the next one.
So instead of "run up"
You would need to upgrade each component individually. This is from the printenv on mine...
da=tftp u-boot.bin.img; flwrite
dr=tftp romfs-x.squashfs.img; updatepart; flwrite
du=tftp user-x.squashfs.img; flwrite
dw=tftp web-x.squashfs.img; updatepart; flwrite
dl=tftp logo-x.squashfs.img; updatepart; flwrite
ds=tftp slave-x.squashfs.img; updatepart; flwrite
dc=tftp custom-x.squashfs.img; updatepart; flwrite
up=tftp update.img; updatepart; flwrite
tk=tftp uImage; bootm
pm=tftp 575s_PMX.bin.img; flwrite
dx=tftp u-boot_slave.bin.img; updatepart; flwrite
So you can see the "up" command does the update.img method and you can see the other run commands and what individual file each relates to. So doing them individually one at a time you would skip that and run each that you have files for. So in your case (on the order you listed them) you would
run pm
run dc
run dl
run ds
run dr
run da
run dx
run tk
run dw
Notice a couple are skipped that you do not have files for and that is generally okay as sometimes they do not update everything is every firmware update. Some things they might never put out an update for. As you run each command you will have to wait for each to upload and then complete and then simply run the next one.
So I had a lot of fun here, but have it working with Dahua FW now.
I first tried the latest version (DH_NVR5XXX-4KS2_MultiLang_V3.216.0000006.0.R.20190223) After I upgraded it via TFTP, it would boot loop. So I disabled "dh_keyboard" so I could watch the OS boot and it would hang during OS load.
I tried many things but could not get it to work.
Next I tried reinstalling the Lorex firmware with the .img files I extracted from the Lorex FW .bin. using various run d* commands. Most of them installed fine, but it got me no where.
So I started trying successive older versions of the Dahua FW and finally got it to boot up with version DH_NVR5XXX-4KS2_MultiLang_V3.215.0000001.0.R.20180326.
Once logged in, I reset it to factory defaults, then went through the setup program. Then I upgraded (via the web interface using .bin file) to the latest version that I originally tried and it is now running the latest.
Does anyone know if I can reinstall the Lorex FW by using the web interface? Or will I need to get a full copy of the Lorex firmware zip that includes an update.img file?
I first tried the latest version (DH_NVR5XXX-4KS2_MultiLang_V3.216.0000006.0.R.20190223) After I upgraded it via TFTP, it would boot loop. So I disabled "dh_keyboard" so I could watch the OS boot and it would hang during OS load.
I tried many things but could not get it to work.
Next I tried reinstalling the Lorex firmware with the .img files I extracted from the Lorex FW .bin. using various run d* commands. Most of them installed fine, but it got me no where.
So I started trying successive older versions of the Dahua FW and finally got it to boot up with version DH_NVR5XXX-4KS2_MultiLang_V3.215.0000001.0.R.20180326.
Once logged in, I reset it to factory defaults, then went through the setup program. Then I upgraded (via the web interface using .bin file) to the latest version that I originally tried and it is now running the latest.
Does anyone know if I can reinstall the Lorex FW by using the web interface? Or will I need to get a full copy of the Lorex firmware zip that includes an update.img file?