SD22404DB-GNY / firmware issue - bricked

[nekinick]

I have bricked the PTZ camera model DH-SD22404DB-GNY. This happened by updating with the latest firmware DH_SD-Gauss_MultiLang_PN_Stream3-xiaobei_V3.200.0000006.0.R.231221.bin.

Also got a previous factory original firmware version DH_SD-Gauss_MultiLang_PN_Stream3-xiaobei_V2.821.0000006.1.R.230316.bin.
I've uncompressed most of the BIN files (except boot files, according to the instructions in Dahua_TFTPBackup archive) to the root directory.

Here is my commands.txt that I've used to create upgrade_info_7db780a713a4.txt by running Commands.bat:

printenv
run dr
run dk
run du
run dw
run dp
run dc
tftp 0x82000000 pd-x.squashfs.img; flwrite
tftp 0x82000000 .FLASHING_DONE_STOP_TFTP_NOW
sleep 5

Unfortunatelly, seems nothing happens on the TFTP console when running the "run" commands (even no error message is returned for these "run" commands). Also I do not know how to view the printenv output, except by TTL serial connection (currently not available to me, as camera is on another location).
Only the pd-x.squashfs.img is requested, uploaded and the success.txt file is then requested. Of course, this didn't solve the issue, the camera keeps rebooting itself.
Seems something should be done differently, but I do not know what to replace. I do not want to continue experimenting as I could overwrite the boot.

Here is the output from TFTP console:
Listening On: 192.168.254.254:69
Client 192.168.254.250:1107 root\upgrade_info_7db780a713a4.txt, 1 Blocks Served
Client 192.168.254.250:1258 root\.FLASHING_DONE_STOP_TFTP_NOW, 1 Blocks Served
Client 192.168.254.250:1634 root\success.txt, File not found or No Access

I also don't know what to do with the sign.img file?

I also have another issue - the Ncat window is opened, but nothing happens there, no output except these

Ncat: Version 7.40 ( https://nmap.org/ncat )
Ncat: Listening on 192.168.254.254:5002

are written in the console window.


What I did to prepare?

By replacing first 2 bytes (DH with PK) I managed to uncompress the last known working firmware version 230316.
Here is the list of files:
View attachment 185853

Here is the content of the hwid file

Spoiler: HWID file

{
"hwid" : [
"SD22404DB-A:01:03:04:BF:5B:00:01:10:01:01:04:3E8:04:00:00:04:00:01:00:00:200",
"SD-MT3E4005DB-A:01:03:04:BF:5B:00:01:10:03:03:04:3E8:04:00:00:04:00:01:00:00:200",
"SD-MT3E2005DB-A:01:03:04:CF:5B:00:01:10:03:03:04:3E8:04:00:00:04:00:01:00:00:200",
"SD-MT3A4004DB-A:01:03:04:BF:5B:00:01:10:03:03:04:3E8:04:00:00:04:00:01:00:00:200",
"SD-MT1A4004DB-B:01:03:047:5B:00:01:10:01:01:04:3E8:04:00:00:00:00:01:00:00:200",
"SD-MT1A4004DB-A:01:03:047:5B:00:01:10:01:03:04:3E8:04:00:00:00:00:01:00:00:200",
"SD-MT2A4000DB-A:01:03:04:BF:5B:00:01:10:03:03:04:3E8:04:00:00:04:00:01:00:00:200"
]
}

Here is the content of the Install file.

Spoiler: Install file

{
"Commands" : [
"burn kernel-aol.img web",
"burn rollback-aol.squashfs.img web",
"burn kernel.img kernel",
"burn dhdtb.bin.img dtb",
"burn pd-x.squashfs.img pd",
"burn romfs-x.squashfs.img rootfs",
"burn firmware-x.squashfs.img firmware",
"burn custom-x.squashfs.img custom",
"burn web-x.squashfs.img web",
"burn dhboot.bin.img bootloader",
"burn dhboot-min.bin.img mini-boot"
],
"Devices" : [
[ "IPC-HX3XXX", "1.00" ]
],
"Vendor" : "Dahua",
"fileInfo" : [
"kernel-aol.img 2693368",
"rollback-aol.squashfs.img 11741432",
"kernel.img 2693368",
"dhdtb.bin.img 70064",
"pd-x.squashfs.img 309496",
"romfs-x.squashfs.img 32463096",
"firmware-x.squashfs.img 34912504",
"custom-x.squashfs.img 2492664",
"web-x.squashfs.img 14153976",
"dhboot.bin.img 549296",
"dhboot-min.bin.img 200396"
],
"spilteSize" : "34912504"
}

Can anybody provide support for these issues?

Is there a way how to issue a printenv command over TFTP?

What to place in commands.txt?

Thanks!