On Dahua's latest v4 firmware

Rupert

n3wb
Joined
Jul 16, 2020
Messages
9
Reaction score
1
Location
DE
Hello,

Dahua's latest v4 firmware comes with a web console that no longer requires the infamous browser addon, so I wanted to upgrade and this is the origin of everything that follows.

References:
[1] [2]
My IKR-NVR5208-8P-4KS2 was fine until the update. I used a USB pen with the default FAT32 and the bin file retrieved at [1]. The original file is "DH_NVR5XXX-4KS2_MultiLang_V4.001.0000000.1.R.2003191.rar", so I unpacked it, and put the .bin file in the USB pen. Nothing else was inside. Pen plugged in, control panel directed towards the file, it starts doing its thing and then reboots. The screen now shows "Dahua 4.0", and reboots in a endless loop.

I contacted both the vendor and the national Dahua distributor. The vendor says they would have to either ship it to China or sell a new one. This is a deja-vue from lazy sellers. The distributor says the vendor is not an authorised dealer. The vendor is huge, so it may well import direct from the manufacturer. Both responses leave me with a sour taste, as I spent half a grand for this thing.

Wearing the elmet of the disappointer customer, I am trying to fix this problem myself. I did my homework, and used what I could find both from Dahua's site and this forum.

Leaving the USB pen inside did not do any good. The filename is "DH_NVR5XXX-4KS2_MultiLang_V4.001.0000000.1.R.200319.bin".

On the national Dahua site I spotted another firmware: it is a zip file containing the following:

DH_NVR5XXX-4KS2_MultiLang_V4.000.0000001.5.R.20191218.bin
install.lua
flash.bin
PartionTable.bin


The file "install.lua" contains the following code:

self:updatePart(flashPartions["boot"], "u-boot.bin.img");
--mtd.saveenv();
self:updatePart(flashPartions["uImage"], "uImage.img");
self:updatePart(flashPartions["rootfs"], "romfs-x.squashfs.img");
--self:updatePart(flashPartions["user"], "user-x.squashfs.img");
self:updatePart(flashPartions["bootslave"], "u-boot_slave.bin.img");
self:updatePart(flashPartions["uImageslave"], "uImage_slave.img");
self:updatePart(flashPartions["rootfsslave"], "romfs_slave-x.squashfs.img");
self:updatePart(flashPartions["web"], "web-x.squashfs.img");
self:updatePart(flashPartions["custom"], "custom-x.squashfs.img");
--²Á³ýlogoÐèÒªÔö¼ÓºóÃæµÄÌõ¼þÅжϣ¬¶Ô¿Í»§×Ô¶¨ÒåÉý¼¶µÄlogo²»É¾³ý
--self:updatePart(flashPartions["logo"], "logo-x.squashfs.img");
self:updatePart(flashPartions["pmfirmware"], "575S_PMX.bin.img");
self:updatePart(flashPartions["rootfs2"], "romfs2-x.squashfs.img");
--self:InstallPlayer("autoplayer.bin");


The above filenames are not in the folder.

Then I used [2] to enter the serial console and trigger the manual update.
It expects to find "update.img" in a local tftp server.

The required file is not in the folder.

UPDATE

Some of the img files happen to be inside the bin, which seems to be a renamed zip file.

> mv DH_NVR5XXX-4KS2_MultiLang_V4.001.0000000.1.R.200319.bin test.bin.zip;
> unzip test.bin.zip
Archive: test.bin.zip
file #1: bad zipfile offset (local header sig): 0
inflating: u-boot.bin.img
inflating: uImage.img
inflating: romfs-x.squashfs.img
inflating: u-boot_slave.bin.img
inflating: uImage_slave.img
inflating: romfs_slave-x.squashfs.img
inflating: web-x.squashfs.img
inflating: custom-x.squashfs.img
inflating: logo-x.squashfs.img
inflating: 575S_PMX.bin.img
inflating: romfs2-x.squashfs.img
extracting: sign.img

> rm -f test.bin.zip


The file "update.img" is still missing.

The file "update.img" must be inside the official ".bin" distribution, so I may have not unzipped it properly.

>file DH_NVR5XXX-4KS2_MultiLang_V4.001.0000000.1.R.200319.bin
DH_NVR5XXX-4KS2_MultiLang_V4.001.0000000.1.R.200319.bin: data

> xxd -l 32 DH_NVR5XXX-4KS2_MultiLang_V4.001.0000000.1.R.200319.bin
00000000: 4448 0304 1400 0000 0800 4e8b 7350 b66c DH........N.sP.l
00000010: 84f3 4f12 0000 6739 0000 0b00 1500 496e ..O...g9......In

> hexedit DH_NVR5XXX-4KS2_MultiLang_V4.001.0000000.1.R.200319.bin
[change the first two bytes from "DH" to "PK"]

> xxd -l 32 DH_NVR5XXX-4KS2_MultiLang_V4.001.0000000.1.R.200319.bin
00000000: 504b 0304 1400 0000 0800 4e8b 7350 b66c PK........N.sP.l
00000010: 84f3 4f12 0000 6739 0000 0b00 1500 496e ..O...g9......In

>file DH_NVR5XXX-4KS2_MultiLang_V4.001.0000000.1.R.200319.bin
DH_NVR5XXX-4KS2_MultiLang_V4.001.0000000.1.R.200319.bin: Zip archive data, at least v2.0 to extract

>unzip DH_NVR5XXX-4KS2_MultiLang_V4.001.0000000.1.R.200319.bin
Archive: DH_NVR5XXX-4KS2_MultiLang_V4.001.0000000.1.R.200319.bin
inflating: Install.lua
inflating: u-boot.bin.img
inflating: uImage.img
inflating: romfs-x.squashfs.img
inflating: u-boot_slave.bin.img
inflating: uImage_slave.img
inflating: romfs_slave-x.squashfs.img
inflating: web-x.squashfs.img
inflating: custom-x.squashfs.img
inflating: logo-x.squashfs.img
inflating: 575S_PMX.bin.img
inflating: romfs2-x.squashfs.img
extracting: sign.img


No joy.

UPDATE

This is the local tftp server on IP 192.168.1.13, delivering the contents of DH_NVR5XXX-4KS2_MultiLang_V4.001.0000000.1.R.200319.bin:

> ls -halF /var/tftp/
total 98104
drwxr-xr-x 14 root wheel 448B Jul 17 18:07 ./
drwxr-xr-x 43 root wheel 1.3K Jul 17 18:28 ../
-rw-r--r-- 1 root wheel 14K Mar 19 10:26 575S_PMX.bin.img
-rw-r--r-- 1 root wheel 4.1K Mar 19 10:26 custom-x.squashfs.img
-rw-r--r-- 1 root wheel 44K Mar 19 10:26 logo-x.squashfs.img
-rw-r--r-- 1 root wheel 19M Mar 19 10:26 romfs-x.squashfs.img
-rw-r--r-- 1 root wheel 13M Mar 19 10:26 romfs2-x.squashfs.img
-rw-r--r-- 1 root wheel 5.3M Mar 19 10:26 romfs_slave-x.squashfs.img
-rw-r--r-- 1 root wheel 128B Mar 19 10:26 sign.img
-rw-r--r-- 1 root wheel 362K Mar 19 10:26 u-boot.bin.img
-rw-r--r-- 1 root wheel 106K Mar 19 10:26 u-boot_slave.bin.img
-rw-r--r-- 1 root wheel 2.9M Mar 19 10:26 uImage.img
-rw-r--r-- 1 root wheel 1.7M Mar 19 10:26 uImage_slave.img
-rw-r--r-- 1 root wheel 5.3M Mar 19 10:26 web-x.squashfs.img

> sudo /usr/local/sbin/in.tftpd -4 -s -v -L /var/tftp


And this is a successful test from macos:

> tftp -4 -v 192.168.1.13 69 -c get sign.img
Connected to 192.168.1.13 (192.168.1.13), port 69
getting from 192.168.1.13:sign.img to sign.img [netascii]
Received 129 bytes in 0.1 seconds [20428 bit/s]


This is the dhcp server:

host dahua.local {
option host-name "dahua";
hardware ethernet [MAC ADDRESS];
fixed-address 192.168.1.26;
option domain-name "local";
option domain-name-servers 192.168.1.6;
option tftp-server-name "server.local";
}


and this is dahua responding to ping:

Request timeout for icmp_seq 1645
Request timeout for icmp_seq 1646
64 bytes from 192.168.1.26: icmp_seq=1647 ttl=64 time=1.702 ms
64 bytes from 192.168.1.26: icmp_seq=1648 ttl=64 time=0.875 ms
64 bytes from 192.168.1.26: icmp_seq=1649 ttl=64 time=0.910 ms
64 bytes from 192.168.1.26: icmp_seq=1650 ttl=64 time=0.887 ms
64 bytes from 192.168.1.26: icmp_seq=1651 ttl=64 time=0.881 ms
64 bytes from 192.168.1.26: icmp_seq=1652 ttl=64 time=0.875 ms
Request timeout for icmp_seq 1653
Request timeout for icmp_seq 1654


This is the serial console from dahua, shown from bootstrap:

Special NAND id table Version 1.36
Nand ID: 0xEF 0xF1 0x80 0x95 0x00 0x00 0x00 0x00
stmmac_init,550,0x70431,3
MAC: 00-00-23-34-45-66

U-Boot 2010.06-svn4440 (Jan 03 2020 - 14:54:14)

In: serial
Out: serial
Err: serial
squashfs use gzip
SCU: load slave image OK
spi env sysbackup=0
Read backup misc byte ... no env and backup env tc !!!
ok!
GpioI2cMcuRecvAck 114 err
__FUNCTION__ = GpioI2cReadByteMcu, __LINE__ = 244
GpioI2cReadByteMcu faield
[is2uProduct] get failed
PRODUCT:1U
stmmac_init,692,0x70431,3
Hit any key to stop autoboot: 0
stmmac_init,692,0x70431,3
stmmac_init,692,0x70431,3
NET_autoLipDetect timeout
stmmac_init,692,0x70431,3
T T T T T
Retry count exceeded; starting again
## Booting kernel from Legacy Image at 42000000 ...
Image Name: Linux-3.10.0_hi3536
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 3001632 Bytes = 2.9 MiB
Load Address: 40008000
Entry Point: 40008000
Loading Kernel Image ... OK
OK

Starting kernel ...
Uncompressing Linux... done, booting the kernel


At this point, dahua reboots by itself, in a endless loop.

When it says "Hit any key to stop autoboot: 0", press "*" and you are at the "hisilicon" console.

This is the help menu at the console.

hisilicon # help
? - alias for 'help'
autoup - load update file from server
boot - boot kernel from uboot
bootm - boot application image from memory
decjpg - jpgd - decode jpeg picture.
devid - devid - set hardware id and save to flash
eracfg - eracfg - erase config sectors
eralogo - eralogo - erase logo sectors
fb_set - fb_set - get shift key
fb_test - fb_test - frontboard read/write test
get_key - get_key - get shift key
help - print command description/usage
hwid - hwid - set hardware id and save to flash
kaimendaji- - kai men da ji
lock_otp- lock_otp - otp lock
lock_status- lock_status - get otp lock status
mac - mac - set mac address and save to flash
mac1 - mac1 - set mac1 address and save to flash
nand - NAND sub-system
nandops - flwrite - write img data into FLASH from memory
otp_printf- otp_printf - printf otp value
partload- partload - load binary file from a partition
ping - send ICMP ECHO_REQUEST to network host
reset - Perform RESET of the CPU
run - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv - set environment variables
show_hello- - hello world
showlogo- showlogo - show the logo picture on screen.
startgx - startgx - open graphics layer.
- startgx [layer addr stride x y w h]
startvl - startvl - open video layer.
- startvl [layer addr stride x y w h]
startvo - startvo - open interface of vo device.
- startvo [dev type sync]
stopgx - stopgx - close graphics layer.
- stopgx [layer]
stopvl - stopvl - close video layer.
- stopvl [layer]
stopvo - stopvo - close interface of vo device.
- stopvo [dev]
version - print monitor version
vobgset - setvobg - set vo backgroud color.
- setvobg [dev color]
xhprint - - hello world
xhprintenv- print environment variables
hisilicon #


The commands "printenv", "sip" and "lip" do not exist [2].
This means that [2] does not correspond to my version of hisilicon.
There are no other versions of [2].

It would be useful if the serial console would print the real MAC, the IP of the DHCP, its own IP, the IP of the DNS, and the IP of the tcpd server, just to show what's working.

hisilicon # ping 192.168.1.13
stmmac_init,692,0x70431,3
host 192.168.1.13 is alive

hisilicon # ping 192.168.1.6
stmmac_init,692,0x70431,3
host 192.168.1.6 is alive
hisilicon #



hisilicon # autoup
stmmac_init,692,0x70431,3
stmmac_init,692,0x70431,3
NET_autoLipDetect timeout
stmmac_init,692,0x70431,3
T T T T T
Retry count exceeded; starting again


UPDATE

hisilicon # run up
stmmac_init,692,0x70431,3

TFTP error: 'File not found' (1)
Not retrying...
do_tftp_secure failed


That's because the file "update.img" is missing.


hisilicon # run da
stmmac_init,692,0x70431,3
#################################################
done
Bytes transferred = 370896 (5a8d0 hex)
boottype=1:
dh_wdt_stop called
flash_do_flwrite,723,ret:-29,flash_sn:1
Header CRC Checking ... OK
Data CRC Checking ... OK
check ok
Image Name: NVR5XXX-4K
Image Type: ARM Linux Firmware (gzip compressed)
Data Size: 370832 Bytes = 362.1 KiB
Load Address: a0200000
Entry Point: a0300000
Programing start at: 0xa0200000
write : 66%
write : 100%
done
Erasing Nand...
Writing to Nand... done
dh_wdt_start called
hisilicon #


Odd, it does not say which file was installed, and the "da" option is supposed to install "armboot-x.bin.img", a file we do not have.
The only file with similar size is u-boot.bin.img.

Reboots by itself.

hisilicon # run dc
stmmac_init,692,0x70431,3
#################################################
done
Bytes transferred = 4160 (1040 hex)
boottype=1:
dh_wdt_stop called
flash_do_flwrite,723,ret:-29,flash_sn:1
Header CRC Checking ... OK
Data CRC Checking ... OK
check ok
Image Name: NVR5XXX-4K
Image Type: ARM Linux Standalone Program (gzip compressed)
Data Size: 4096 Bytes = 4 KiB
Load Address: a3800000
Entry Point: a3a00000
Programing start at: 0xa3800000
write : 0%
write : 100%
done
dh_wdt_start called
hisilicon #


This must be custom-x.squashfs.img.

Reboots by itself.

hisilicon # run dr
stmmac_init,692,0x70431,3
#################################################
done
Bytes transferred = 19841088 (12ec040 hex)
boottype=1:
dh_wdt_stop called
flash_do_flwrite,723,ret:-29,flash_sn:1
Header CRC Checking ... OK
Data CRC Checking ... OK
check ok
Image Name: NVR5XXX-4K
Image Type: ARM Linux Kernel Image (gzip compressed)
Data Size: 19841024 Bytes = 18.9 MiB
Load Address: a0700000
Entry Point: a2100000
Programing start at: 0xa0700000
write : 99%
write : 100%
done
dh_wdt_start called
hisilicon #


This is smaller than romfs-x.squashfs.img.

Reboots by itself.

hisilicon # run du
stmmac_init,692,0x70431,3

TFTP error: 'File not found' (1)
Not retrying...
do_tftp_secure failed
hisilicon #


Infact, I do not have user-x.cramfs.img.

Reboots, again.

hisilicon # run dl
stmmac_init,692,0x70431,3
#################################################
done
Bytes transferred = 45120 (b040 hex)
boottype=1:
dh_wdt_stop called
flash_do_flwrite,723,ret:-29,flash_sn:1
Header CRC Checking ... OK
Data CRC Checking ... OK
check ok
Image Name: NVR5XXX-4K
Image Type: ARM Linux Standalone Program (gzip compressed)
Data Size: 45056 Bytes = 44 KiB
Load Address: a3a00000
Entry Point: a3c00000
Programing start at: 0xa3a00000
write : 0%
write : 100%
done
dh_wdt_start called
hisilicon #


It reboots, again.

hisilicon # run dw
stmmac_init,692,0x70431,3
#################################################
done
Bytes transferred = 5578816 (552040 hex)
boottype=1:
dh_wdt_stop called
flash_do_flwrite,723,ret:-29,flash_sn:1
Header CRC Checking ... OK
Data CRC Checking ... OK
check ok
Image Name: NVR5XXX-4K
Image Type: ARM Linux Standalone Program (gzip compressed)
Data Size: 5578752 Bytes = 5.3 MiB
Load Address: a4000000
Entry Point: a5400000
Programing start at: 0xa4000000
write : 97%
write : 100%
done
dh_wdt_start called
hisilicon #


This was supposed to be web-x.squashfs.img.

It is not so bad, but there are many more to go, and it is not clear how to install them.
There does not seem to exist a manual for the hisilicon serial console, with an explanation of all possible "run" commands.

The key file "update.img" is still missing.

The unit keeps rebooting.

UPDATE

hisilicon # startgx 0 0x8AC00000 1920 50 50 1024 600
graphic layer 0 opened!


Draws a white 1024x600 window on a 1920x1080 display, shifted 50x50. OK

hisilicon # xprintenv

No data printed.

UPDATE

SmartPSS works on Windows, crashes on MacOS.

On Windows, it does not find the NVR.


STANDPOINT

The NVR is stuck in a loop.
The hisilicon serial console commands "printenv", "sip" and "lip" are not available [2].
The file "update.img" is not available.

However, basic functionality is there, as the console responds to commands and reads from the tftp server.

Installing previous firmware versions is not useful, because they all miss the "update.img" file.

Unsure what to do next.
 
Last edited:

Rupert

n3wb
Joined
Jul 16, 2020
Messages
9
Reaction score
1
Location
DE
I am now tryng to install the latest version 4.001.0000000.3.R.200519 from below, still via the serial console.


I need to map the dr da etc. variables against the img files in this latest .bin.

-rw-r--r-- 1 root wheel 13888 Jul 20 09:36 575S_PMX.bin.img
-rw-r--r-- 1 root wheel 49913211 Jul 20 09:36 DH_NVR5XXX-4KS2_MultiLang_V4.001.0000000.3.R.200519.bin
-rw-r--r-- 1 root wheel 12175 Jul 20 09:36 DH_NVR5XXX-4KS2_MultiLang_V4.001.0000000.3.R.200519.docx
-rw-r--r-- 1 root wheel 2062319 Jul 20 09:36 DH_NVR5XXX-4KS2_MultiLang_V4.001.0000000.3.R.200519.pdf
-rwxr-xr-x 1 root wheel 14695 Jul 20 09:36 Install.lua
-rw-r--r-- 1 root wheel 4160 Jul 20 09:36 custom-x.squashfs.img
-rw-r--r-- 1 root wheel 45120 Jul 20 09:36 logo-x.squashfs.img
-rw-r--r-- 1 root wheel 19755072 Jul 20 09:36 romfs-x.squashfs.img
-rw-r--r-- 1 root wheel 13979712 Jul 20 09:36 romfs2-x.squashfs.img
-rw-r--r-- 1 root wheel 5509248 Jul 20 09:36 romfs_slave-x.squashfs.img
-rw-r--r-- 1 root wheel 128 Jul 20 09:36 sign.img
-rw-r--r-- 1 root wheel 49913211 Jul 20 09:36 test.bin
-rw-r--r-- 1 root wheel 370896 Jul 20 09:36 u-boot.bin.img
-rw-r--r-- 1 root wheel 108444 Jul 20 09:36 u-boot_slave.bin.img
-rw-r--r-- 1 root wheel 3002208 Jul 20 09:36 uImage.img
-rw-r--r-- 1 root wheel 1824688 Jul 20 09:36 uImage_slave.img
-rw-r--r-- 1 root wheel 599 Jul 20 12:46 upgrade_info_7db780a713a4.txt
-rw-r--r-- 1 root wheel 310 Jul 20 12:33 upgrade_info_7db780a713a4.txt~
-rw-r--r-- 1 root wheel 5578816 Jul 20 09:36 web-x.squashfs.img


This is what I have so far (guesswork).

The tftp address (80800000 and 81a00000 below) is just a random number, for lack of the right one.


#-rw-r--r-- 1 root wheel 3002208 Jul 20 09:36 uImage.img
#-rw-r--r-- 1 root wheel 1824688 Jul 20 09:36 uImage_slave.img
#
# env: tk=tftp 80800000 uImage; bootm 80800000
#
setenv tk "tftp 80800000 uImage"
saveenv
run tk

stmmac_init,692,0x70431,3
TFTP error: 'File not found' (1)
Not retrying...
do_tftp_secure failed

#setenv ?? "tftp 80800000 uImage_slave"
#saveenv
#run ??

#-rw-r--r-- 1 root wheel 19755072 Jul 20 09:36 romfs-x.squashfs.img
#-rw-r--r-- 1 root wheel 13979712 Jul 20 09:36 romfs2-x.squashfs.img
#-rw-r--r-- 1 root wheel 5509248 Jul 20 09:36 romfs_slave-x.squashfs.img
#env: dr=tftp 81a00000 romfs-x.squashfs.img; flwrite
setenv dr "tftp 81a00000 romfs-x.squashfs.img"
saveenv
run dr

setenv dr "tftp 81a00000 romfs2_x.squashfs.img"
saveenv
run dr

setenv dr "tftp 81a00000 romfs_slave-x.squashfs.img"
saveenv
run dr

#-rw-r--r-- 1 root wheel 370896 Jul 20 09:36 u-boot.bin.img
#-rw-r--r-- 1 root wheel 108444 Jul 20 09:36 u-boot_slave.bin.img
setenv da "tftp 81a00000 u-boot.bin.img"
saveenv
run da

setenv da "tftp 81a00000 u-boot_slave.bin.img"
saveenv
run da

#-rw-r--r-- 1 root wheel 4160 Jul 20 09:36 custom-x.squashfs.img
setenv dc "tftp 81a00000 custom-x.squashfs.img"
saveenv

#-rw-r--r-- 1 root wheel 128 Jul 20 09:36 sign.img
setenv ?? "tftp 81a00000 sign.img"
saveenv
run ??

#-rw-r--r-- 1 root wheel 45120 Jul 20 09:36 logo-x.squashfs.img
setenv dl "tftp 81a00000 logo-x.squashfs.img"
saveenv
run dl

#-rw-r--r-- 1 root wheel 5578816 Jul 20 09:36 web-x.squashfs.img
setenv dw "tftp 81a00000 web-x.squashfs.img"
saveenv
run dw

#-rw-r--r-- 1 root wheel 13888 Jul 20 09:36 575S_PMX.bin.img
setenv pm "tftp 81a00000 575S_PMX.bin.img"
saveenv
run pm

stmmac_init,692,0x70431,3

TFTP error: 'File not found' (1)
Not retrying...
do_tftp_secure failed


The "File not foun" error is false, because the file is in the tftp server, just like the others who succeeded.

The address used in tftp calls seems to be stored in the variable "fdt_addr_r":


I am unable to tell the correct address, because Dahua/hisilicon uses a modified version of U-Boot where "printenv" is disabled.

The only address I see from the console is where the kernel boots:

## Booting kernel from Legacy Image at 42000000 ...
Image Name: Linux-3.10.0_hi3536
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 3001632 Bytes = 2.9 MiB
Load Address: 40008000
Entry Point: 40008000
Loading Kernel Image ... OK
OK
 
Last edited:

Rupert

n3wb
Joined
Jul 16, 2020
Messages
9
Reaction score
1
Location
DE
The text "Hit any key to stop autoboot: 0" is wrong. You can only stop it with a string of asterisks.
 
Last edited:

Rupert

n3wb
Joined
Jul 16, 2020
Messages
9
Reaction score
1
Location
DE
This is interesting. Is the "Load Address" the new address to be used on tftp commands?

./custom-x.squashfs.img: u-boot legacy uImage, NVR5XXX-4K, Linux/ARM, Standalone Program (gzip), 4096 bytes, Tue May 19 06:01:35 2020, Load Address: 0xA3800000, Entry Point: 0xA3A00000, Header CRC: 0x54DB1609, Data CRC: 0x02ABA28E
./uImage_slave.img: u-boot legacy uImage, NVR5XXX-4K, Linux/ARM, Firmware Image (gzip), 1824624 bytes, Tue May 19 06:01:29 2020, Load Address: 0xA2200000, Entry Point: 0xA2500000, Header CRC: 0xF6993314, Data CRC: 0xCDAE7B19
./Install.lua: ISO-8859 text
./romfs-x.squashfs.img: u-boot legacy uImage, NVR5XXX-4K, Linux/ARM, OS Kernel Image (gzip), 19755008 bytes, Tue May 19 06:01:32 2020, Load Address: 0xA0700000, Entry Point: 0xA2100000, Header CRC: 0x0BE99BEB, Data CRC: 0xC35C62A8
./u-boot.bin.img: u-boot legacy uImage, NVR5XXX-4K, Linux/ARM, Firmware Image (gzip), 370832 bytes, Tue May 19 06:01:29 2020, Load Address: 0xA0200000, Entry Point: 0xA0300000, Header CRC: 0x1E1545DA, Data CRC: 0x7FF4A14A
./romfs2-x.squashfs.img: u-boot legacy uImage, NVR5XXX-4K, Linux/ARM, OS Kernel Image (gzip), 13979648 bytes, Tue May 19 06:01:46 2020, Load Address: 0xA5400000, Entry Point: 0xA7200000, Header CRC: 0x62FCFD23, Data CRC: 0x47DC45B8
./u-boot_slave.bin.img: u-boot legacy uImage, NVR5XXX-4K, Linux/ARM, Firmware Image (gzip), 108380 bytes, Tue May 19 06:01:29 2020, Load Address: 0xA2100000, Entry Point: 0xA2200000, Header CRC: 0x6CC87989, Data CRC: 0x352A6452
./sign.img: data
./web-x.squashfs.img: u-boot legacy uImage, NVR5XXX-4K, Linux/ARM, Standalone Program (gzip), 5578752 bytes, Tue May 19 06:01:35 2020, Load Address: 0xA4000000, Entry Point: 0xA5400000, Header CRC: 0x12859AAB, Data CRC: 0xA0103B05
./uImage.img: u-boot legacy uImage, NVR5XXX-4K, Linux/ARM, Firmware Image (gzip), 3002144 bytes, Tue May 19 06:01:29 2020, Load Address: 0xA0300000, Entry Point: 0xA0700000, Header CRC: 0x53E826F2, Data CRC: 0xFC93D859
./logo-x.squashfs.img: u-boot legacy uImage, NVR5XXX-4K, Linux/ARM, Standalone Program (gzip), 45056 bytes, Tue May 19 06:01:35 2020, Load Address: 0xA3A00000, Entry Point: 0xA3C00000, Header CRC: 0x26C7D60A, Data CRC: 0xE8BD24EE
./575S_PMX.bin.img: u-boot legacy uImage, NVR5XXX-4K, Linux/ARM, Firmware Image (gzip), 13824 bytes, Tue May 19 06:01:35 2020, Load Address: 0xA3F00000, Entry Point: 0xA3F40000, Header CRC: 0xE9E1AC3B, Data CRC: 0x2E72D0A7
./romfs_slave-x.squashfs.img: u-boot legacy uImage, NVR5XXX-4K, Linux/ARM, OS Kernel Image (gzip), 5509184 bytes, Tue May 19 06:01:32 2020, Load Address: 0xA2500000, Entry Point: 0xA3300000, Header CRC: 0xC65655C0, Data CRC: 0x6F8211A7
 
Last edited:

Rupert

n3wb
Joined
Jul 16, 2020
Messages
9
Reaction score
1
Location
DE
I think the latest version was too new to be flashed. The one that was installed before the update is V2.616.VT00.0.R NVR5xxx DAHUA. The new version may have a completely different partition table. However, the update was triggered from the web interface. This is ultimately Dahua's fault.
 

tsviper

n3wb
Joined
Aug 4, 2020
Messages
9
Reaction score
2
Location
USA
I think the latest version was too new to be flashed. The one that was installed before the update is V2.616.VT00.0.R NVR5xxx DAHUA. The new version may have a completely different partition table. However, the update was triggered from the web interface. This is ultimately Dahua's fault.
Hi Rupert, were you able to update your NVR? I have the same one and going to try to attempt the update using TFTP as well.

Thanks
 

amineblack

n3wb
Joined
Nov 14, 2018
Messages
5
Reaction score
0
Location
tunisia
i try with this firmware DH_NVR5XXX-4KS2_MultiLang_NP_V4.000.0000000.1.R.20190809 but same problem the nvr can not start ,can you help me please
and what si this error 114 (
no env and backup env tc !!!
ok! GpioI2cMcuRecvAck 114 err FUNCTION = GpioI2cReadByteMcu, LINE = 244 GpioI2cReadByteMcu faield [is2uProduct] get failed )
 

phycle

n3wb
Joined
Sep 27, 2021
Messages
4
Reaction score
0
Location
Singapore
The file "install.lua" contains the following code:
You can use:

Bash:
 iconv --from-code=gbk Install.lua
to convert the comments to Chinese. Then google translate it to get more clues.

From what I can tell, update.img is just a concatenation of all the .img files into one large file (although u-boot is distributed separately). Therefore, if you have all the constituent files, it's equivalent to one large update.img.
 
Top