TFTP Rescue with signed firmware

alekslyse · Jun 3, 2019

Is it not possible to do a TFTP rescue with a camera that is flashed with the >2019 firmwares? I see its a signed file, and the camera try to load the TFTP file, but fails right away

riogrande75 · Jun 4, 2019

If you flash ALL images (sign.img as well) it should work.
If not, just flash an old non-signed image (if available) and then upgrade the official way.

alekslyse · Jun 4, 2019

riogrande75 said:
If you flash ALL images (sign.img as well) it should work.
If not, just flash an old non-signed image (if available) and then upgrade the official way.

Im a bit confused how to setup the configuration file. Do you have an example on how the file actually should look for that camera?

riogrande75 · Jun 4, 2019

Depends on your device. Open firmware image with 7zip and check what .img files are in there.

alekslyse · Jun 4, 2019

Hmm. Attached is a screenshot of the content of the latest image file. the install file fails to extract correctly when using 7zip, dunno if its relevant.

How should the config look for this setup?

riogrande75 · Jun 4, 2019

Well, this is in fact the most relevant file.
Exchange the first 2 bytes in the header of the image from DH to PK - save it - then you should be able to extract "Install".
Then you have a clue, what images the upgrade process would install. Here a example of a VTO2000A:

Code:

{
   "Commands" : [
      "burn dm365_ubl_boot_16M.bin.img bootloader",
      "burn custom-x.cramfs.img custom",
      "burn pd-x.cramfs.img pd",
      "burn kernel-x.cramfs.img kernel",
      "burn romfs-x.cramfs.img rootfs",
      "burn user-x.cramfs.img user",
      "burn web-x.cramfs.img web",
      "burn data-x.cramfs.img data",
      "burn gui-x.cramfs.img gui",
      "burn pcm-x.cramfs.img pcm"
   ],
   "Devices" : [
      [ "VTO2000A", "1.00" ],
      [ "VTO2000A-2", "1.00" ]
   ],
   "Vendor" : "General"
}

alekslyse · Jun 4, 2019

If I open the file and change from DH to PK the archive fails with "Can not open file as archive" - what software / method do you use to change them?

riogrande75 · Jun 4, 2019

Simply open .bin file with a editor (e.g. notepad++), replace DH at the beginning with PK and save it. Rename it as .zip and extract Install from it.

VorlonFrog · Jun 4, 2019

Better to use a dedicated hex editor, like Frhed or others.
It won't strip out or filter characters when saving the edited file.

alekslyse · Jun 4, 2019

I really cant get anything out of this. It just fails. Could anyone please just look at this firmware?

alekslyse · Jun 4, 2019

I even tried the "all in one" updater - any ideas why the camera refuse to take the update?

alekslyse · Jun 4, 2019

Ok I managed to extract the install file. How do I use this?

{
"Commands" : [
"burn dhboot-min.bin.img bootloader",
"burn dhboot.bin.img bootloader",
"burn kernel.img kernel",
"burn partition-x.cramfs.img partition",
"burn romfs-x.squashfs.img rootfs",
"burn pd-x.squashfs.img pd",
"burn user-x.squashfs.img user",
"burn custom-x.squashfs.img custom",
"burn web-x.squashfs.img web",
"burn user1-x.squashfs.img user1",
"burn blob.img blob",
"burn dhboot-min-halfstart.bin.img bootloader",
"burn mcu.bin.img mcu"
],
"Devices" : [
[ "SD6XXX", "1.00" ],
[ "IPC-HX3XXX", "1.00" ],
[ "IPC-HX4XXX", "1.00" ],
[ "IPC-HX5XXX", "1.00" ],
[ "IPC-HX8XXX", "1.00" ]
],
"Vendor" : "General"
}
//IPC_RestoreDefault

riogrande75 · Jun 5, 2019

Now follow the TFTP unbricking guide. Create a commands.txt file from the info extracted from "Install"-file.

alekslyse · Jun 5, 2019

I got it working; It was very important to add the signed file to the config file. Seem like the tftp is picking up one file at each reboot, but after 10 reboots it seems to have be rescued.

riogrande75 · Jun 5, 2019

Great!

mtcl1 · Jun 5, 2019

alekslyse said:
I got it working; It was very important to add the signed file to the config file. Seem like the tftp is picking up one file at each reboot, but after 10 reboots it seems to have be rescued.

Hi,

May I know how you manage to do it? I was trying many times without success. May you share your ''Commands.txt'' file?

Regards

alekslyse · Jun 5, 2019

Here is the config - add the latest firmware to the root folder (the one published on this forum).

After running the commands.bat to create the new, start the tftp server and if you see the camera pull the first file, just let it run, on next boot it will do the next one

run dr
run dk
run du
run dw
run dp
run dc
tftp 0x82000000 sign.img; flwrite
tftp 0x82000000 .FLASHING_DONE_STOP_TFTP_NOW
sleep 5

PgXme2 · May 1, 2023

Hello,

I have the problem with a VTO2000-2 that it is in an infinite boot loop. With logging enabled (dh_keyboard 0) it seems to have a problem with the signature. Thanks to @riogrande75 for the hint

Booting:
<ESC>[0;32;31m[libdvr] ERROR (../src/net/net.c|SetGateWay|906): SIOCADDRT
SIOCADDRT: Network is unreachable
<ESC>[m<ESC>[0;32;31m[libdvr] ERROR (../src/net/net.c|SetEthAttr|123netinit uses obsolete (PF_INET,SOCK_PACKET)
2): SetGateWay error
IP: <192.168.178.11> netmask: <255.255.255.0>
Gateway: <192.168.178.1>
<ESC>[m[libdvr] set success

<ESC>[0;32;32m[libdvr]
libdvr.so Build time: Jun 13 2018 at 00:24:14.
<ESC>[m<ESC>[0;32;32m[libdvr] SVN NUM: 7773.
<ESC>[mIPV6: only init eth0
"netinit6 help" for help
eth0:
MAC: <38:af:29:ba:e3:45>
IPV6: <2008::6> preFixLen: <112>
<ESC>[1;33m[libdvr] WARN (../src/net/network6.c|NetWorkDelIP|981): del ip failed:No such device or address
<ESC>[mIPV6 Gateway: <2008::1>

/usr/etc/imod: line 271: /var/usr/VideoDaemon: not found
... crypto start ....
DH:: [reliableenvvalidate:951] crypto dir=/usr/SigFileList,buf pos=4

ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
<ESC>[0;32;32m[libdvr]
libdvr.so Build time: Jun 13 2018 at 00:24:14.
<ESC>[m<ESC>[0;32;32m[libdvr] SVN NUM: 7773.
<ESC>[monly init eth2"netinit help" for help
/proc/sys/vm/drop_caches
imod end...
falied---filename:[/usr/SigFileList] signfile [/usr/Data_Signature]
Restarting system.

Following commands were executed with the software V3.120:
run dr
run dk
run du
run dw
run dd
tftp 0x82000000 pd-x.cramfs.img; flwrite
run da
tftp 0x82000000 sign.img; flwrite

While last command I received the following error:

tftp 0x82000000 sign.img; flwrite
TFTP from server 192.168.178.96; our IP address is 192.168.178.150
Filename 'sign.img'.
Load address: 0x82000000
Loading: #
done
Bytes transferred = 128 (80 hex)
DestAddr=0x523e0823 invalid!
DestAddr: 0x2000000~0x4200000
DHBOOT#

The destination address is defined in the sign.img file itself. So the question is, where are the valid ranges (0x2000000~0x4200000) defined? Is there a partition for definition of the addresses which could be corrupted?

I would be grateful for any hints on how to fix this, thank you in advance.

Environment
printenv
bootcmd=fsload
bootdelay=3
baudrate=115200
eth1addr=00:01:5b:00:55:66
eth2addr=00:01:5b:00:77:88
netmask=255.255.255.0
bootfile="uImage"
single=0
da=protect off all;tftp 81a00000 dm365_ubl_boot_16M.bin.img;flwrite
dc=tftp 81a00000 custom-x.cramfs.img; flwrite
dr=tftp 81a00000 romfs-x.cramfs.img; flwrite
du=tftp 81a00000 user-x.cramfs.img; flwrite
dd=tftp 81a00000 data-x.cramfs.img; flwrite
dw=tftp 81a00000 web-x.cramfs.img; flwrite
dg=tftp 81a00000 gui-x.cramfs.img; flwrite
dk=tftp 81a00000 kernel-x.cramfs.img; flwrite
up=tftp 81a00000 update.img; flwrite
tk=tftp 80800000 uImage; bootm 80800000
gionum=22.25
gioval=1.1
dh_com=0
autosip=192.168.254.254
autolip=192.168.1.108
autogw=192.168.1.1
autonm=255.255.255.0
ID=4H008F1PAZ97C61
ethaddr=38:AF:29:BA:E3:45
HWID=VTO2000A:0:4:1:3:5:0:1:9:3:3:0:1B0:0:0:0:0:0:0:0
bootargs=console=ttyS0,115200n8 root=/dev/mtdblock4 rootfstype=cramfs,nolock mem=90M newmem=90M video=davincifb:vid0=OFF:vid1=OFF

sd0=OFF

sd1=OFF
dh_keyboard=0
serverip=192.168.178.96
ipaddr=192.168.178.150
filesize=B040
fileaddr=81A00000
appauto=0
stdin=serial
stdout=serial
stderr=serial
ver=U-Boot 1.3.6 (jerry) (Jul 24 2017 - 11:11:23)

riogrande75 · May 1, 2023

I'd use FW 4.3 since 3.120 was not even signed. All parts need to fit together - very important is off course the bootloader.

nawe18 · Feb 12, 2024

riogrande75 said:
Well, this is in fact the most relevant file.
Exchange the first 2 bytes in the header of the image from DH to PK - save it - then you should be able to extract "Install".
Then you have a clue, what images the upgrade process would install. Here a example of a VTO2000A:

Code:

{ "Commands" : [ "burn dm365_ubl_boot_16M.bin.img bootloader", "burn custom-x.cramfs.img custom", "burn pd-x.cramfs.img pd", "burn kernel-x.cramfs.img kernel", "burn romfs-x.cramfs.img rootfs", "burn user-x.cramfs.img user", "burn web-x.cramfs.img web", "burn data-x.cramfs.img data", "burn gui-x.cramfs.img gui", "burn pcm-x.cramfs.img pcm" ], "Devices" : [ [ "VTO2000A", "1.00" ], [ "VTO2000A-2", "1.00" ] ], "Vendor" : "General" }

[/CITA

sorry for my english!

updating my vto2000a it seems that it has died... it gives light but it doesn't do anything else...

everything came out updating to this firmware:
General_VTOXXX-data_EngTurSlkPldHgrFinCzeBul_P_16M_SIP_PART_V4.300.0000003.0.R.20190612

but from configtool it gave no problems, the update was ok

Do you have any manual to try to rescue?

thank you

TFTP Rescue with signed firmware

Getting the hang of it

Pulling my weight

Getting the hang of it

Pulling my weight

Getting the hang of it

Attachments

Pulling my weight

Getting the hang of it

Pulling my weight

Getting the hang of it

Attachments

Getting the hang of it

Attachments

Getting the hang of it

Pulling my weight

Getting the hang of it

Pulling my weight

n3wb

Getting the hang of it

n3wb

Attachments

Pulling my weight

n3wb