Something I do for fun and a little mental exercise is watch out for 'spares and repairs' IP surveillance items on eBay.
These can provide an interesting insight into how the different manufacturers do things, and is a bit self-funding if fixed-up items can be re-sold.
I recently bought for a pittance a Lorex LNB8005C 8MP mini-bullet which the seller described as 'Just stopped working. No link detect or PoE activity'.
I've not previously had my hands on a Lorex IP camera.
Sure enough, it appeared dead when powered either by 12V or PoE.
Luckily - some electronic fault-finding identified that a shorted ceramic capacitor was killing the first-level (12v to 5v) power convertor.
I fixed that and the camera came to life!
See this post :
ipcamtalk.com
A look around the web GUI showed a pretty bare-bones level of functionality.
No smart events, just motion. ONVIF didn't work. Limited video parameter configuration.
This was the firmware version :
I remembered this interesting and helpful thread :
ipcamtalk.com
with contributions from @Corellon @pozzello @hope__silent silent where the Lorex firmware was replaced by Dahua firmware to good effect.
So I thought I'd give it a try.
The thread gave some useful pointers to firmware that could be used, so I downloaded these candidates :
DH_IPC-HX5X3X-Rhea_MultiLang_NP_Stream3_V2.800.0000010.0.R.190807.bin
General_IPC-HX5(4)XXX_Eng_N_Stream3_V2.420.0005.0.R.20141205.bin
General_IPC-HX5X3X-Rhea_Eng_NP_Stream3_V2.800.0000010.0.R.190807.bin
And extracted the components.
It's known that the dahua firmware is packaged as a slighly modified zip file, with the first 2 bytes holding 'DH' instead of the usual 'PK' (Phil Katz RIP - remember him? A big loss to the coding community Phil Katz - Wikipedia)
If the DH is replaced by PK then the 'Install' update task list can be usefully extracted.
There are multiple threads explaining how the Dahua bootloader can be used to update the flash partitions so won't repeat them here.
One useful item of information that I haven't seen is an explanation of how the 'flwrite' commands in the bootloader macros know which flash offset to write the data to.
The firmware components are packaged in standard uImage format, and the 'Load Address' field specifies the flash offset that each file should be written to.
For example :
So when I hooked up the serial console to a USB to TTL serial USB adaptor I was ready to give the Lorex to dahua conversion a go.
Not wanting to risk creating a real brick, I didn't do any bootloader updates.
The next post has a transcript of the activity.
These can provide an interesting insight into how the different manufacturers do things, and is a bit self-funding if fixed-up items can be re-sold.
I recently bought for a pittance a Lorex LNB8005C 8MP mini-bullet which the seller described as 'Just stopped working. No link detect or PoE activity'.
I've not previously had my hands on a Lorex IP camera.
Sure enough, it appeared dead when powered either by 12V or PoE.
Luckily - some electronic fault-finding identified that a shorted ceramic capacitor was killing the first-level (12v to 5v) power convertor.
I fixed that and the camera came to life!
See this post :
Cable splitters and poe problems.
That looks good! I'm envious! What I did, to reduce the chance of damaging the solder pads, was to snip the legs off and desolder the stubs one by one. Not quite the same approach as removing an SMD device.
A look around the web GUI showed a pretty bare-bones level of functionality.
No smart events, just motion. ONVIF didn't work. Limited video parameter configuration.
This was the firmware version :
I remembered this interesting and helpful thread :
Lorex LNB8005B-C and Dahua firmware (Solved with instructions)
Have 6 Lorex LNB8005B-C Camera's but running my own NVR so the firmware is never able to be updated by Lorex, given the issues found I would like to update the firmware and was wondering if anyone has tired and been successful with the Dahua firmware? From what I can see the equivilent model...
with contributions from @Corellon @pozzello @hope__silent silent where the Lorex firmware was replaced by Dahua firmware to good effect.
So I thought I'd give it a try.
The thread gave some useful pointers to firmware that could be used, so I downloaded these candidates :
DH_IPC-HX5X3X-Rhea_MultiLang_NP_Stream3_V2.800.0000010.0.R.190807.bin
General_IPC-HX5(4)XXX_Eng_N_Stream3_V2.420.0005.0.R.20141205.bin
General_IPC-HX5X3X-Rhea_Eng_NP_Stream3_V2.800.0000010.0.R.190807.bin
And extracted the components.
It's known that the dahua firmware is packaged as a slighly modified zip file, with the first 2 bytes holding 'DH' instead of the usual 'PK' (Phil Katz RIP - remember him? A big loss to the coding community Phil Katz - Wikipedia)
If the DH is replaced by PK then the 'Install' update task list can be usefully extracted.
Code:
alastair@PC-I5 ~/cctv/other/Lorex/Lorex LNB8005-CP/misc_firmware/tmp $ ll
total 50496
drwxrwxr-x 2 alastair alastair 4096 Nov 26 16:00 ./
drwxrwxr-x 5 alastair alastair 4096 Nov 26 15:58 ../
-rw-rw-r-- 1 alastair alastair 25846976 Nov 26 15:59 DH_IPC-HX5X3X-Rhea_MultiLang_NP_Stream3_V2.800.0000010.0.R.190807.bin
-rw-rw-r-- 1 alastair alastair 25846976 Nov 26 16:00 modded_fw.bin
alastair@PC-I5 ~/cctv/other/Lorex/Lorex LNB8005-CP/misc_firmware/tmp $ hd -n 64 DH_IPC-HX5X3X-Rhea_MultiLang_NP_Stream3_V2.800.0000010.0.R.190807.bin
00000000 44 48 03 04 14 00 00 00 08 00 2c 56 07 4f bf c0 |DH........,V.O..|
00000010 e4 87 0b 01 00 00 fa 02 00 00 07 00 1c 00 49 6e |..............In|
00000020 73 74 61 6c 6c 55 54 09 00 03 34 3c 4a 5d 37 3c |stallUT...4<J]7<|
00000030 4a 5d 75 78 0b 00 01 04 71 fe 0f 00 04 71 fe 0f |J]ux....q....q..|
00000040
alastair@PC-I5 ~/cctv/other/Lorex/Lorex LNB8005-CP/misc_firmware/tmp $ hd -n 64 modded_fw.bin
00000000 50 4b 03 04 14 00 00 00 08 00 2c 56 07 4f bf c0 |PK........,V.O..|
00000010 e4 87 0b 01 00 00 fa 02 00 00 07 00 1c 00 49 6e |..............In|
00000020 73 74 61 6c 6c 55 54 09 00 03 34 3c 4a 5d 37 3c |stallUT...4<J]7<|
00000030 4a 5d 75 78 0b 00 01 04 71 fe 0f 00 04 71 fe 0f |J]ux....q....q..|
00000040
alastair@PC-I5 ~/cctv/other/Lorex/Lorex LNB8005-CP/misc_firmware/tmp $
alastair@PC-I5 ~/cctv/other/Lorex/Lorex LNB8005-CP/misc_firmware/tmp $ unzip modded_fw.bin
Archive: modded_fw.bin
inflating: Install
inflating: check.img
inflating: dhboot-min.bin.img
inflating: dhboot.bin.img
inflating: kernel.img
inflating: romfs-x.squashfs.img
inflating: user-x.squashfs.img
inflating: web-x.squashfs.img
inflating: pd-x.squashfs.img
inflating: custom-x.squashfs.img
inflating: partition-x.cramfs.img
inflating: dhboot-min-halfstart.bin.img
extracting: sign.img
alastair@PC-I5 ~/cctv/other/Lorex/Lorex LNB8005-CP/misc_firmware/tmp $
alastair@PC-I5 ~/cctv/other/Lorex/Lorex LNB8005-CP/misc_firmware/tmp $ cat Install
{
"Commands" : [
"burn dhboot-min.bin.img bootloader",
"burn dhboot.bin.img bootloader",
"burn kernel.img kernel",
"burn partition-x.cramfs.img partition",
"burn romfs-x.squashfs.img rootfs",
"burn pd-x.squashfs.img pd",
"burn user-x.squashfs.img user",
"burn custom-x.squashfs.img custom",
"burn web-x.squashfs.img web",
"burn user1-x.squashfs.img user1",
"burn blob.img blob",
"burn dhboot-min-halfstart.bin.img bootloader",
"burn mcu.bin.img mcu"
],
"Devices" : [
[ "SD6XXX", "1.00" ],
[ "IPC-HX3XXX", "1.00" ],
[ "IPC-HX4XXX", "1.00" ],
[ "IPC-HX5XXX", "1.00" ],
[ "IPC-HX8XXX", "1.00" ]
],
"Vendor" : "General"
}
/IPC_RestoreDefault
alastair@PC-I5 ~/cctv/other/Lorex/Lorex LNB8005-CP/misc_firmware/tmp $There are multiple threads explaining how the Dahua bootloader can be used to update the flash partitions so won't repeat them here.
One useful item of information that I haven't seen is an explanation of how the 'flwrite' commands in the bootloader macros know which flash offset to write the data to.
The firmware components are packaged in standard uImage format, and the 'Load Address' field specifies the flash offset that each file should be written to.
For example :
Code:
alastair@PC-I5 ~/cctv/other/Lorex/Lorex LNB8005-CP/misc_firmware/tmp $ dumpimage -l romfs-x.squashfs.img
Image Name: romfs
Created: Wed Aug 7 03:47:31 2019
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 2873528 Bytes = 2806.18 KiB = 2.74 MiB
Load Address: 01b80000
Entry Point: 01fd0000
alastair@PC-I5 ~/cctv/other/Lorex/Lorex LNB8005-CP/misc_firmware/tmp $So when I hooked up the serial console to a USB to TTL serial USB adaptor I was ready to give the Lorex to dahua conversion a go.
Not wanting to risk creating a real brick, I didn't do any bootloader updates.
The next post has a transcript of the activity.
Last edited:
