Lorex

[faramirali25]

"Hit any key to stop autoboot" I can't stop at this

 

[faramirali25]

I connected via the serial port to try flashing it with the firmware again.
But I'm not Able to stop the U-Boot auto boot. It show me. Hit any key to stop autoboot (3 sec).
But I press key and it doesn't respond.

 

[bbmre]

Yes - the Lorex version does include a remote control.... and has the fancier face with all the buttons. Ok - this was a pain to document and write out....

First of all – I am not responsible for your warranty or if this somehow goes wrong and you brick your NVR. I cannot provide personal support for this. Much of what I learned on here regarding how this is done is thanks to cor35vet and others before me who ventured into modding firmware and unbricking Dahua IP cameras that have been bricked for various reasons. There was just not a lot of info on the NVR’s though and what info there is, is scattered all over the place. So it is quite difficult to put all the info you need in a short number of steps. This really is way far above the average person’s skill set in regards to computers and electronics. If you are not a typical computer nerdy type, you might need to just move on or find someone who is.

Ok – so here are instructions to cross-flash your Lorex NR9163 NVR over to Dahua NVR5216-16P-4KS2 firmware. I also should point out that it is possible that Lorex has changed the internals at some point and kept the same model number. I doubt it but be warned that your Lorex NVR should have the same general specs for this to work like 4K, POE ports, and potentially even take the top cover off and verify that the mainboard is identical to this one.

You will need a few things to do this as well as some grasp of TFTP, networking, and working in a terminal emulator. You will also need a null-modem serial cable, a computer with a serial port (sorry, I cannot help or vouch for the many USB to serial adapters available), and the correct firmware update file. I will also point out that the NVR firmware has what is called a watchdog program that runs in the earliest boot stages – I have no idea how to disable that. What the watchdog does is checks if the systems main software is running and if not it tries to start the main system software. This WILL interrupt you when you are working in the console mode. One thing you can do is extend the timer that it counts down when it tells you to press a key to interrupt the boot process.

I used the official firmware from the Dahua Wiki from here-

USA/NVR/Pro/DHI NVR52A16 16P 4KS2 - Dahua Wiki

This is an English, Spanish, French firmware which is also the same languages available in the stock Lorex firmware. In case the Wiki page gets updated, the zipped archive is named

DH_NVR5XXX-4KS2_EngSpnFrn_V3.215.0000000.3.R.20171211.zip

When extracted this firmware has the same firmware in several formats. One is used for updating firmware via the web interface, another for the recovery mode which is what we are going to use, and there are also the actual individual file system partition images as well. The one you want for this is update.img.

I used the terminal program that Dahua recommends which is NCOM which I downloaded from some thread or another around here – I have attached it to this post. You will need a TFTP server – I use the free one from SolarWinds.

Download and extract the firmware. Start the TFTP server and configure its folder. Copy the update.img to that folder. Have your serial cable connected to the NVR and have NCOM open and looking at COM1. Power up the NVR and you should start seeing some text in the NCOM window. When it gets to where it says Hit any key to stop autoboot you need to quickly press the asterisk * key. If it goes past you are too late, switch the power off and cut the NVR back on and try again. Also if you get nothing in the NCOM window then your serial connection is not right.

Anyways once you interrupt autoboot you will get a #Hisilicon prompt. The commands might be case sensitive and either way spelling is critical. First thing is to document your current boot environment variables. At the prompt type printenv and hit enter. Copy (select it in the windows and right click it to copy) and paste this output into a text document and save it. You can also type help for a list of valid commands. I’d strongly discourage typing ANY command that you are not 100% sure what it does. Another important command is saveenv – this will save the variables you change. The printenv command will list the default values for you to change back when you are done.

Now lets set the environment variables we need. Each command is started with setenv – for example, setenv bootdelay 9.

Now lets extend the auto boot timer so that you at least have a few more seconds to hit the * key to stop the auto boot - this the bootdelay variable. It defaults to 3 seconds. I set it to 9 which was plenty of time and you can set it back later. Realistically, you should not even need to bother with the boot delay. On boot it takes it about 10 seconds to get to where you interrupt the boot already.

Type each line exactly as below and hit enter after each. Warning – at some point it WILL try to start booting. You must hit the * key again to interrupt that or you will need to power it off and on again to start over. I typed saveenv after every several variables I changes because one you have to stop it with the * key again anything not saved is lost.

setenv bootdelay 9
saveenv

The next main things you need are the below – these are at their default values. You must type setenv before each one. Change the addresses to match your network configuration. Serverip is your computer that you have the TFTP server running on, ipaddr is the temporary IP you are assigning to the NVR, gateway is your networks gateway, netmask is your subnet. If this is beyond you, you should probably call someone who has more experience to help you through all of this.

setenv serverip 255.255.255.255
setenv ipaddr 255.255.255.255
setenv gatewayip 255.255.255.255
setenv netmask 255.255.0.0
saveenv

At this point everything should be ready for the firmware upgrade. Due to the timer I’d suggest at this point one final reboot of the unit. Type reset and hit enter. Stop it again when it gets to the wait timer with the * key. Time to upgrade – type

run up

Now wait and watch a bunch of programming and write commands go by. Once its done it will try to start the kernel. Mine then kicked out to a root prompt #. At this point, cut the power switch off and then on again. Stop the autoboot when prompted with the * key again. Now go and set the environment variables back to their original values using the same commands as before and saveenv.

Reboot the NVR one last time and hope that you eventually hear that beep. Give it another minute or so and login via the web ui. Now one final step is needed. The new firmware has a little wizard you go through. Do that. The final step will be to fully reset the NVR factory defaults. This is because during a firmware upgrade certain things are kept like logins and apparently some things Lorex puts in like their DDNS and email configuration. So go to the Setup>System>Default page and push the Factory Reset button.

Now once it finishes this reset you will have to find the NVR's IP address with the config tool. Then open that IP address in Internet Explorer and go through the Setup Wizard again. Now you can enjoy the new Dahua firmware.

Updated certain steps based on feedback on 07/15....

H, Im trying to upgrade a NR916n to dahua firmware, converting the cams was explained very well and help me convert all the cams to dahua.

So my question is should I use the same IP info on the PC which we use to upgrade the lorex cams to dahua ?

Also what are the folder names we have to create in the TFTP I have already downloaded the firmware and unzipped it.

Thanks a lot for any advice and guidence.

 

[exarkun]

H, Im trying to upgrade a NR916n to dahua firmware, converting the cams was explained very well and help me convert all the cams to dahua.

So my question is should I use the same IP info on the PC which we use to upgrade the lorex cams to dahua ?

Also what are the folder names we have to create in the TFTP I have already downloaded the firmware and unzipped it.

Thanks a lot for any advice and guidence.

I don't believe anyone has found a way to use the Dahua firmware on these Lorex cams.

 

[bbmre]

I don't believe anyone has found a way to use the Dahua firmware on these Lorex cams.

This is a NVR N916n.

 

[97JeepXJ]

Wanted to say thank you to MixManSC, even if he never sees it, along with everyone else who asked the questions I needed answers to. Managed to get this loaded on a NR908-N mfg 09 2016 and a NR908X-N mfg 09 2018. Both appear to be working on NVR 4.0 220322. Started with “update.img” extracted from

DH-NVR5XXX-4KS2_Eng_V3.215.0000000.3.R.20171211

then updated with ConfigTool to NVR 4.0



Neither of these are in use at the moment but I did plug a couple spare Lorex cams and a IPC-HFW5231E-Z12E in and everything appears to be working just as it is on the new NVR5232-16P-4KS2E from Andy.

A bit concerned about the 2016 model being too old to handle 4.0, again no extensive testing but I didn’t let any smoke out either.

Now I don’t feel like I’m offloading crap on my neighbor if sell one, plus the remote control still works.

https://www.amazon.com/gp/aw/d/B01MY9INHL?psc=1&ref=ppx_pop_mob_b_asin_title&th=1

 

[observant1]

I'd love to be able to upgrade this Lorex NVR with Dahua Firmware. I've had it in my basement for several years. Stole the purple 3T HDD out of it several years ago. It was working great, just got replaced during a camera upgrade.

I may even have some serial cables along with an ancient computer with a serial connector and hyper terminal on it or at lest putty. I wish i could grab the right firmware and upgrade it via a flash drive, cause thats about my skill level.

 

[observant1]

A good starting point would be what Dahua Firmware I need to install on this model Lorex NVR.

I may be able to do it myself, and would enjoy the experience...i think.

Sorry for bumping an old thread but when i ran accross it i pulled this NVR out of my basement.

 

[97JeepXJ]

Read the directions on page 3 post #44. A couple times. If you follow those directions with the firmware I listed and using the cable I linked to I’m confident that NVR should show a Dahua logo on startup. Read the directions again. I read them numerous times while waiting on the cable to show up

 

[observant1]

I'm waiting on a null modem cable. As many times Iv'e used them when I was installing CPE equipment using DB9, DB25 cables I couldn't find what i needed in the basement. I've foud db25 break out w/ leds , db25 connectors w/leds to screw terminals, couple of db9 to rj45 connectors that may work with a console cable, but went ahead and ordered a female to female db9 null modem that should work. I have a db9 com port on several computers. I even powerd up an old Dell precision M50 (win xp) that has a nice docking station. Probably hasn't been on the internet since AOL dial up was the way to connect! (dang i liked that old laptop) heavy as a brick. I'd even buy a battey for it for a reasonable price.

 

[exarkun]

You can get usb-serial adapters pretty cheap now-a-days.

 

[observant1]

I also ordered a usb to db9 that has a smart chip on one end that is supposed to reverse the tx and rx as necessary.

Now if someone could figure out how to flash a Hornbill NVR and cameras with Uniview firmware so it's got smarter features....

You can get usb-serial adapters pretty cheap now-a-days.

Yes. Both cables are suppoded to arive tomorrow. DBx connectors are really outdated.

 

[zigja]

hello, am trying to flash my Lorex DVR but have no clue of how to do it, can someone help, please
Firmware: oldDH_NVR5XXX-4KS2_Eng_V3.215.0000000.3.R.20171211.zip unzipped
NVR: NR916-N COSTCO MODEL: LNR616

this is how far i reached and getting errors

***
printenv and hit enter

setenv bootdelay 9
saveenv

setenv 192.168.0.100 255.255.255.255
setenv 192.168.0.101 255.255.255.255
setenv 192.168.0.1 255.255.255.255
setenv 255.255.255.0 255.255.0.0
saveenv

run up

ERROR

hisilicon # run up
stmmac_init,550,0x70431,3
miiphy_speed,366,1040
miiphy_speed,366,1040
MAC: 00-40-7F-98-42-08
TFTP from server 192.168.0.100; our IP address is 192.168.0.101; sending through gateway 255.255.255.0
Download Filename 'update.img'.
Download to address: 0x42000000
Downloading:
ARP Retry count exceeded; starting again
Bad Magic Number
boottype=1:
dh_wdt_stop called

flash_do_flwrite,646,ret:-69,flash_sn:1
set_upgrade_update_state ok[set null,add by ll]
Bad Magic Number
flwrite error!
dh_wdt_start called

 

[TheDude]

ARP Retry Count and Bad Magic Number are the issues. ARP retry is likely a networking thing. Not sure if it matters but when I did my setenv commands for the IP addresses I used this format which adds what each line is specifically for.

setenv serverip 255.255.255.255
setenv ipaddr 255.255.255.255
setenv gatewayip 255.255.255.255
setenv netmask 255.255.0.0

Those values are defaults so you need to still use your numbers but I did have the extra text serverip, etc.

Bad magic number generally in Unix systems indicates that something is incorrect in the file it is trying to process. Only thing I can think there is to be absolutely sure you have the correct firmware for the model NVR.

 

[zigja]

ARP Retry Count and Bad Magic Number are the issues. ARP retry is likely a networking thing. Not sure if it matters but when I did my setenv commands for the IP addresses I used this format which adds what each line is specifically for.

setenv serverip 255.255.255.255
setenv ipaddr 255.255.255.255
setenv gatewayip 255.255.255.255
setenv netmask 255.255.0.0

Those values are defaults so you need to still use your numbers but I did have the extra text serverip, etc.

Bad magic number generally in Unix systems indicates that something is incorrect in the file it is trying to process. Only thing I can think there is to be absolutely sure you have the correct firmware for the model NVR.

unfortunately i am not sure about the firmware and i have absolutely no idea what the commands am typing...



should i have typed this exactly

setenv serverip 255.255.255.255
setenv ipaddr 255.255.255.255
setenv gatewayip 255.255.255.255
setenv netmask 255.255.0.0


instead of

setenv 192.168.0.100 255.255.255.255
setenv 192.168.0.101 255.255.255.255
setenv 192.168.0.1 255.255.255.255
setenv 255.255.255.0 255.255.0.0
saveenv

Or should i have typed this "without what's in the quotes"

setenv serverip 192.168.0.100 "my pc ip address"
setenv ipaddr 192.168.0.101 "dvr ip address"
setenv gatewayip 255.255.255.0
setenv netmask 192.168.0.1
saveenv

 

[zigja]

my Lorex DVR

deviceType=31
processor=ST7108
serialNumber=ND031709013507
updateSerial=NVR5X-4K

 

[zigja]

how can i know how to and where to find the correct firmware

 

[Coachtech]

This might help you out

 

[zigja]

thanks, but already tried those v164 and the v166 firmware and its the same interface nothing substantially different or beneficial so had to revert back to the v138 because they were more buggy , hence why i would try a Dahua or even a Hikvision Firmware on this NVR...

 

[TheDude]

Did you follow the instructions here - Lorex

Another method - if trying to update using the "run up" command might be to try to update individual parts of the firmware one by one using this method - Lorex

I did compare and according to Lorex mine and yours use the same firmware. So one of the Dahua 4KS2 firmware versions should work for yours.

Also the firmware you are updating to is a very old one from 2017. That also might be the issue. The v164 Lorex firmware is from 2019 so it might be erroring out since you are trying to flash a much older version over a much newer version.

The most current 4KS2 version from Dahua is DH_NVR5XXX-4KS2_MultiLang_V4.002.0000000.6.R.221115.bin which I am running on mine now. The current versions do not have a single "update.img" file in them though so crossflashing directly to a current version would have to be done manually one file at a time.

I'd suggest maybe trying to go to a later version than the Lorex version. It looks like Dahua also stopped including the single command line file "update.img" in all of the firmware versions. That being said - I still have an early 4.x Dahua version that has that file. I've uploaded it here -
Once you do have an actual Dahua version running, then you can update to the latest Dahua version in the web interface.

Hard to say if any of this will help though.... maybe on later models they introduced something to the firmware to prevent crossflashing. I know they did this on later and current IP cameras - on the newest ones there is no way to crossflash.