Smartening up the Lorex LNB8005C 8MP mini bullet.

[Tsu Ko]

I’ve updated other cameras such as Amcrest and LaView Saturn to the dahua firmware which opens up a lot more options and to also have updated firmware that will hopefully have less vulnerabilities to attacks. The ability to view the camera from the web directly is also a bonus as currently the only way I can view it directly is thru pss software. I’ve got 8 of these cameras so the payoff to successfully change the firmware is of value.

 

[pozzello]

@Tsu Ko, I just got a used LNB8111 to play with. mine does report HWID IPC-HFW4830EP-S in the magicbox URL:

http://192.168.0.170/cgi-bin/magicBox.cgi?action=getSystemInfo

appAutoStart=true
deviceType=LNB8111
hardwareVersion=1.00
processor=S3LM
serialNumber=ND051812000996
updateSerial=IPC-HFW4830EP-S
updateSerialCloudUpgrade=IPC-HFW4830EP-S:01:02:03:50:21:00:01:00:00:00:04:2D0:00:00:00:00:00:01:00:00:200

currently on Lorex v20 fw:



will see what i can do about that...

 

[pozzello]

for posterity, 'printenv' and 'help' commands before the update:

Spoiler: printenv

Ncat: Version 7.40 ( Ncat - Netcat for the 21st Century )
Ncat: Listening on 192.168.254.254:5002
gBootLogPtr:00b80008.
spinor flash ID is 0x1940ef
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=130M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc.
TEXT_BASE:01000000
Net: Detected MACID:00:1f:54:32:ca:98
PHY:0x001cc816,addr:0x00
s3l phy RTL8201 init
partition file version 2
rootfstype squashfs root /dev/mtdblock5
MMC: sdmmc init
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.251; sending through gateway 192.168.1.1Download Filename 'upgrade_info_7db780a713a4.txt'.Download to address: 0x5000000
Downloading: *
done
Bytes transferred = 132 (84 hex)
string value is 0
The end of file
bootargs=console=ttyS0,115200 mem=118M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrcbootcmd=sf read 0x2000000 0xf0000 0x180000;bootm 0x2000000bootdelay=3baudrate=115200ipaddr=192.168.1.108serverip=192.168.1.1autoload=yesgatewayip=192.168.1.1netmask=255.255.255.0da=tftp 0x02000000 dhboot.bin.img; flwrite;tftp dhboot-min.bin.img;flwritedr=tftp 0x02000000 romfs-x.squashfs.img; flwritedk=tftp 0x02000000 kernel.img; flwritedu=tftp 0x02000000 user-x.squashfs.img; flwritedw=tftp 0x02000000 web-x.squashfs.img; flwritedp=tftp 0x02000000 partition-x.cramfs.img;flwritedc=tftp 0x02000000 custom-x.squashfs.img; flwriteup=tftp 0x02000000 update.img; flwritetk=tftp 0x02000000 uImage; bootmdh_keyboard=1sysbackup=1logserver=127.0.0.1loglevel=4 autosip=192.168.254.254autogw=192.168.1.1autonm=255.255.255.0pd=tftp 0x02000000 pd-x.squashfs.img; flwriteethact=ambarella macBSN=4L04615PAX00125HWID=IPC-HFW4830EP-S:01:02:03:50:21:00:01:00:00:00:04:2D0:00:00:00:00:00:01:00:00:200hwidEx=00:02:00:00:00:00:00:00:00:00:00:00:00:00:00:00ID=ND051812000996devalias=LNB8111ethaddr=00:1F:54:32:CA:98appauto=1autolip=192.168.1.251mp_autotest=0stdin=serialstdout=serialstderr=serialfilesize=84fileaddr=5000000
Environment size: 1236/131068 bytes
? - alias for 'help'
backup - backup - manual backup program.

base - print or set address offset
bdinfo - print Board Info structure
boot - boot default, i.e., run 'bootcmd'
bootd - boot default, i.e., run 'bootcmd'
bootf - boot from flash
bootm - boot application image from memory
bootp - boot image via network using BOOTP/TFTP protocol
cfgRestore- erase config and backup partition.

cmp - memory compare
coninfo - print console devices and information
cp - memory copy
crc32 - checksum calculation
dcache - enable or disable data cache
dhcp - boot image via network using DHCP/TFTP protocol
echo - echo args to console
editenv - edit environment variable
erasepart- erasepart

exit - exit script
false - do nothing, unsuccessfully
fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls - list files in a directory (default /)
flwrite - flwrite - write data into FLASH memory

fsinfo - print information about filesystems
fsload - load binary file from a filesystem image
go - start application at address 'addr'
gpio - gpio test
help - print command description/usage
hwid - hwid - set hardware id and save to flash

i2c - I2C sub-system
icache - enable or disable instruction cache
iminfo - print header information for application image
itest - return true/false on integer compare
kload - kload - load uImage file from parttion

lip - lip - set local ip address but not save to flash

loadb - load binary file over serial line (kermit mode)
loads - load S-Record file over serial line
loady - load binary file over serial line (ymodem mode)
logsend - get log buf
loop - infinite loop on address range
ls - list files in a directory (default /)
mac - mac - set mac address and save to flash

md - memory display
memsize - memsize - set mem size

mii - MII utility commands
mm - memory modify (auto-incrementing address)
mmc - MMC sub system
mmcinfo - mmcinfo <dev num>-- display MMC info
mtest - simple RAM read/write test
mw - memory write (fill)
nfs - boot image via network using NFS protocol
nm - memory modify (constant address)
partition- print partition information
ping - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
rarpboot- boot image via network using RARP/TFTP protocol
rdefault- rdefault -recover default env

reset - Perform RESET of the CPU
run - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv - set environment variables
sf - SPI flash sub-system
showvar - print local hushshell variables
sip - sip - set server ip address but not save to flash

sleep - delay execution for some time
source - run script from memory
sync_uboot- sync_uboot - sync uboot to uboot-bak

test - minimal test like /bin/sh
tftpboot- tftpboot- boot image via network using TFTP protocol
true - do nothing, successfully
upmh - mcu heat upgraded
usleep - delay execution for some time
version - print monitor version
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.251; sending through gateway 192.168.1.1Download Filename '.FLASHING_DONE_STOP_TFTP_NOW'.Download to address: 0x2000000
Downloading: #
done
partition file version 2
rootfstype squashfs root /dev/mtdblock5
fail to load bootargsParameters.txt
fail to load bootargsParameters.txt file
cmdLine console=ttyS0,115200 mem=130M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc
Erasing SPI flash...
Writing to SPI flash...
partition file version 2
rootfstype squashfs root /dev/mtdblock5
half-boot found, check bst
done

 

[pozzello]

The LNB8111 (on Lorex v20 fw) took the Dahua FW DH_IPC-HX5X3X-Rhea_MultiLang_PN_Stream3_V2.800.0000013.0.R.191202 directly via tftpd.
Didn't need to first flash the intermediary DH_IPC-HX5X3X-Rhea_EngSpnFrn_N_Stream3_V2.460.0000000.16.R.20170904.bin before going to v2.800.
I re-upgraded to the same from the GUI after TFTP, which may have updated the bootloader, but the result is a Dahua 4830EP-S (minus the SD card).


the DevAlias (which is shown the UI and Dahua config tool) can be set to whatever you like with a 'sentenv' in the tftp command file...

So the upshot is that the LNB8111 is for all intents and purposes identical to the LNB8005 and gets a few enhancements with update to Dahua firmware. Nice.

 

[Tsu Ko]

The LNB8111 (on Lorex v20 fw) took the Dahua FW DH_IPC-HX5X3X-Rhea_MultiLang_PN_Stream3_V2.800.0000013.0.R.191202 directly via tftpd.
Didn't need to first flash the intermediary DH_IPC-HX5X3X-Rhea_EngSpnFrn_N_Stream3_V2.460.0000000.16.R.20170904.bin before going to v2.800.
I re-upgraded to the same from the GUI after TFTP, which may have updated the bootloader, but the result is a Dahua 4830EP-S (minus the SD card).
View attachment 80385

the DevAlias (which is shown the UI and Dahua config tool) can be set to whatever you like with a 'sentenv' in the tftp command file...

So the upshot is that the LNB8111 is for all intents and purposes identical to the LNB8005 and gets a few enhancemnents with update to Dahua firmware. nice.

so I should download something like tftpd64 and do the upgrade from there? It’s early and the brain is foggy.

 

[pozzello]

all the needed info is in the first post at Dahua IPC EASY unbricking / recovery over TFTP

 

[Night-Owl]

Do verify before upgrade!! Thank you !!

Hello

Sorry, I am trying to catch up with everything. Has a way been found to update a Lorex E891AB or Lorex NVR N841A8P aka with updateSerial=DHI-NVR4108HS-8P-4KS2 from the Web GUI or other method ?, Thank you

 

[pozzello]

dunno about the NVR, but i have found no Dahua fw that works on the E891ab...

my major gripe with the Lorex fw is the gui won't let you set the I-frame interval, but there's a workaround for that:
Set GOP (I-frame interval) on Lorex cams that don't have this exposed in the web UI.

 

[Night-Owl]

dunno about the NVR, but i have found no Dahua fw that works on the E891ab...

my major gripe with the Lorex fw is the gui won't let you set the I-frame interval, but there's a workaround for that:
Set GOP (I-frame interval) on Lorex cams that don't have this exposed in the web UI.

Much appreciated, thank you

 

[bitcaptain]

I have a silly question. How do I open up these things? (lnb8005c) Thanks in advance!

 

[pozzello]

use a small flat screwdriver or spudger to pick up and peel off the front cover and reveal 4 philips screws. the adhesive is decent enuf that you can re-apply later.

 

[bitcaptain]

use a small flat screwdriver or spudger to pick up and peel off the front cover and reveal 4 philips screws. the adhesive is decent enuf that you can re-apply later.

Thank you.

 

[bitcaptain]

After reading alastairstevenson post, I am guessing the the run commands are just uboot aliases to run other commands the it already knows about. In other words, having run command mixed with tftp commands is likely redundant.

These just run the env aliases:
run dk
run dp
run dr
run pd
run du
run dc
run dw

Which are just direct aliases to these:

tftp 0x02000000 kernel.img; flwrite
tftp 0x02000000 partition-x.cramfs.img;flwrite
tftp 0x02000000 romfs-x.squashfs.img; flwrite
tftp 0x02000000 pd-x.squashfs.img; flwrite
tftp 0x02000000 user-x.squashfs.img; flwrite
tftp 0x02000000 custom-x.squashfs.img; flwrite
tftp 0x02000000 web-x.squashfs.img; flwrite

I will report back what I find out. I will probably crack the case on one of these and grab the Lorex image if anyone wants it. Just a plain old SPI rom... W25Q256FV use these everyday.

Yes: the run commands are aliases and not required in the command file. Likely either will work, but the uboot env has to have them set to match.

Dahua IPC EASY unbricking / recovery over TFTP

Here is the tftp server answer : accepting requests.. Open TFTP Server MultiThreaded Version 1.64 Windows Built 2001 starting TFTP... alias / is mapped to root\ permitted clients: all server port range: all max blksize: 65464 default blksize: 512 default timeout: 60 file read allowed: Yes file...

ipcamtalk.com

 

[pozzello]

yes, the run commands are aliases defined in the current bootloader environment and it's important to make sure the new FW has the same .img files as defined in the env, tho Not all of them need to be replaced (particularly the boot loader itself) tho.

and as for Lorex FW, we already have (some) versions posted here somewhere. I can't seem to find that post atm tho.

edit: found the post i was thinking of, but it's for the E891ab, not the lnb8005c. (stock lorex fw's from a Dahua Rep): Lorex E891AB (aka IPC-HFW1841EN-PV)

 

[gregorio]

What firmware did you all end up using? Mine does not have a few thing like IVS, Face Detection, Smart Plan

I was only able to get to this level without issues
2.800.0000010.0.R, Build Date: 2019-08-07
DH_IPC-HX5X3X-Rhea_MultiLang_NP_Stream3_V2.800.0000010.0.R.190807