cctv_007

<---------------------------------- Hold for Expanded post ------------------------------------->

<-------------------------------- hold for expanded post----------------------------->

<-------------------------------- hold for expanded post----------------------------->

Here is the simplest way I know to-date to load the newest firmware on IPC-HFW4300S-V2 and other Chinese Dahua cameras ordered on AliExpress.... I'm still working on a permanent fix, but I've had many emails about this so I thought I'd post a quick update. 1. Use the config tool or web UI to load the newest firmware (General_IPC-HX5(4)XXX_Eng_N_Stream3_V2.420.0005.0.R.20141205.bin) 2. Your camera will appear bricked (no web ui) but the only issue preventing it from working is the language settings (which prevents sonia from loading) 3. Login into the camera with Telnet (user: admin / password: 7ujMko0{web ui password} 4. You will need to perform a few edits, so you need to make mounts read/write \> mount -o remount rw /usr \> mount -o remount rw /mnt/custom 5. Rename files \> mv /usr/data/Strings/English.txt /usr/data/Strings/SimpChinese.txt \> mv /mnt/custom/English.txt /mnt/custom/SimpChinese.txt 6. Edit files with vi ---> /usr/data/Strings/i18n & /mnt/custom/i18n. Change the following: "DefaultLanguage" : "English", ------> SimpChinese "DefaultVideoStandard" : "NTSC", "DevStringFiles" : [ "StringsEn.txt" ], "HTMLStringFiles" : [ "webEN.json" ], "Languages" : [ "English" ], ------> SimpChinese "VideoStandards" : [ "NTSC" ], "WebStringFiles" : [ "webEN.lang" ] (Tips for using vi: press "i" for insert then ESC when done editing, then type :w to write then type :q! to exit) type reboot to restart the camera and you will have a working New English firmware. These changes will need to be repeated if you upgrade to another firmware since these partitions are erased an re-flashed during an upgrade. I'm really trying to get to the root cause of why the camera seems hard-coded to Chinese and I will update as I uncover more information. Thanks, Rob

I'm collecting data to help with my write-up on unbricking Dahua cameras using the serial port. If you have 10 minutes, please help out. Login to the camera with telnet and provide the output mentioned in the first post along with your current software version. Thanks, Rob

Here is the output from the help command.

It's already been done... It's called Big Brother. That's not a very helpful answer... This is serious, Not some stupid "Reality" TV show... Not trying to be an a-hole or anything, I just want some serious answers as to if this could be done by a person, Not some multi-billion dollar company. No ill will intended. I was just making a joke! Sure it's possible, but there are some serious considerations that would kill your budget not the least of which is internet bandwidth.

It's already been done... It's called Big Brother....or The Sureal Life

You can telnet into the camera and there are number of useful binaries in the user shell that can help correct and diagnose some of the problems people are experiencing. There is a command to reset all the parameters back to factory defaults (username, password, ip address back to 192.168.1.108 etc.) This can be accomplished with /sbin/clearparam. This is the same as the defaults button.

Here is the serial output from the U-Boot process. As you can see the TFTP process looks for a file called upgrade_info_7db780a713a4.txt When it reads the contents it's looking for a "Magic String". With this string, I suspect another TFTP process would then load the firmware files thus allowing a bare metal install of the firmware. When I get some time I'll work on trying to extract this info from the u-boot partition. At first boot, you have a second to interrupt the boot process and jump to the command line. You need to press and hold the * key (the one on the number pad) to interrupt the boot process. From there you can run >printenv to get a look at the env variables What's interesting on this particular camera is that the server IPs are all set including variables for autolip and autosip (which are likely tied to the TFTP recovery process and magic string) The HWID string is used during process to validate that the firmware is compatible. Also interesting are all the variables used to load various parts of the firmware. da=tftp 0xc2000000 dhboot.bin.img; flwrite; tftp dhboot-min.bin.img;nand protect off;flwrite;nand pro t on dr=tftp 0xc2000000 romfs-x.ubifs.img; flwrite dk=tftp 0xc2000000 kernel.img; flwrite du=tftp 0xc2000000 user-x.ubifs.img; flwrite dw=tftp 0xc2000000 web-x.ubifs.img; flwrite ds=tftp 0xc2000000 dsp-x.ubifs.img; flwrite dc=tftp 0xc2000000 custom-x.ubifs.img; flwrite dt=tftp 0xc2000000 data-x.ubifs.img; flwrite df=tftp 0xc2000000 fpga.img; flwrite up=tftp 0xc2000000 update.img; flwrite tk=tftp 0xc2000000 uImage; bootm You can execute the command run up which will tftp update.img from your serverip address specified in the env variables. You can also load individual files. I've successfully loaded firmware with this method and will post screen prints of the process later. Here, you can also modify the kernel boot arguments, as well as see which address space the boot command loads from.

Starting to document the U-Boot environment and the Serial interfaces on the various cameras. Using a USB to TLL interface,, you can connect to the cameras and use the TFTP process to load partition images files or upgrade.img to load firmware to the camera. You need only connect the TX, RX and GND connections to communicate with the serial interface. The serial config is 115200, 8, N, 1, N. Here is the serial interface on the IPC-HFW4300S. It seems they opted to leave out a built in connector. I suspect this is because of the new TFTP recovery process with the Magic string. I'll post the photos of the other cameras with the pin-outs once I get around to snapping some pictures.

I started a new thread @ viewtopic.php?f=19&t=44928 I will document in detail the recovery process for Dahua Cameras and will link in all necessary firmware files, tools, etc. If you want to contribute, please PM me what firmware files you might have and I will link them in to the post. Thanks, Rob

Is the v2 the version that has the ugly PoE brick on the pigtail like the other v2 models? The 4300S cameras we have all have the reset button on the IR board. Yes, the V2 has the weather proof POE pigtail and no reset button. I have another IPC-HFW4300S with no reset also. Could it be different Gen boards?

To begin with, in any case you have to disassemble the IPC Adapter and the cable connected to the PC, you need to control. You should have two buttons, one reset, the other magic !!! In 4100 series it's present in 4300 it's should be! There is no reset switch in the IPC-HFW4300S and V2.

That looks like a MAC address in the txt file. Yes, but it's arbitrary. This is just a filename that Tftp looks for during uboot. I am doing some testing as I believe this can bu used to load upgrade.img through tftp. THis would allow unbricking a camera even if telnet is lost. I'll update in a couple weeks once I have it all sorted out.

FYI. Here is some information that can hopefully assist someone else in recovering their failed camera. This information is all related to my IPC-HFW4300S-V2. I will write a longer post that describes the differences with other Dahua cameras in a couple weeks when I have had time to compile a detailed list. I also have IPC-HDBW2200E, IPC-HFW2200S and IPC-HFW3300C cameras that I will test with. The firmware consists of several images that are loaded into various partitions in flash in a UBI file system. You can load each partition separately if needed. More on this later.... (I'll put a guide together on flashing and recovering partitions) Once you telnet into the camera, there are number of useful binaries in the user shell that can help correct and diagnose some of the problems people are experiencing. One of the helpful steps is to kill the /var/tmp/upgraded process and run it in the foreground so you can see what is going on and easily capture error messaged. The /var/tmp/upgraded process is what opens the port 3800 and allows you to connect to the camera with the config tool if your web services have failed. There is also another copy in usr/sbin/. Also, in there is a command to reset all the parameters back to factory defaults (username, password, ip address back to 192.168.1.108 etc.) This can be accomplished with /sbin/clearparam. Another issue that people run into is the constant reboot issue. This can be caused by a failed process. The main application which provides all the camera capabilities (web interface, streaming, etc.) is /usr/bin/sonia. This process is what makes most firmware different from version to version (sort of). There are also changes to the web partition which contains the web server pages that /usr/bin sonia hosts on port 80. The sonia process is invoked by a shell script in init.d and if the process is killed, the camera reboots after a few minutes. Ths has cause many people issues when trying to unbrick the camera since you only have a few minutes between reboots. To stop the reboots you can update the flash. There is a parameter called appauto that tells the camera to auto start /us/bin/sonia. If you want the camera to start and not invoke the shell script that launches sonia, you need to set appauto to 0. This will stop the camera from rebooting when sonia is not running. This cam be accomplished by running '/sbin/appauto 0'. To turn it back on, just run /sbin/appauto 1. This writes the boot parameter in flash that the kernel reads before starting the process. You can check the current status of the appauto bootparameter with 'cat /proc/dahua/bootpara' It will only show what the parameter was when you booted up, so if you changes it you need to reboot to see the change in /proc/dahua/bootpara. I have also done a bit of testing around the tftp process that is invoked in u-boot that looks for upgrade_info_7db780a713a4.txt and failed.txt. I think with a little more work, I'll figure out if there is a recovery method using tftp without serial access. This would be necessary if you lose telnet access and need to rebuild the kernel partition that hosts telnetd. Well, that's all I have time to share for now, but I'll do my best to put together a comprehensive guide to the inner workings of these cameras and a guide to unbrick in any failed software situation. I will also post links to the 15-20 firmware files that I have collected. Thanks and take care. Rob

All is well in firmware land! I managed to get everything up and running and updated. Thanks for the feedback.

That is supposed to be true, but I know for a fact, that the firmware check does not always work. The firmware for IPC-HX3XXX will pass checks for some versions. I have made this mistake before, but have corrected it by using the config tool on port 3800 and reloading the correct firmware. for whatever reason, this time, it won't work. On to the task at hand....What options do I have for recovery?

I haven't tried to restore to factory with the serial yet. I don't have a cable yet, but will track one down soon. Is there another way to restore? I was attempting to update to the newest firmware to add NAS support. I should have used General_IPC-HX5(4)XXX_Eng_P_Stream3_V2.420.0005.0.R.20141205.bin, but somehow I chose the wrong file. I think I may have used a firmware meant for my 3300 series camera. Now the camera only has port 23 - (telnetd) and port 3800 - (upgraded) open. Normally connecting with the config tool to port 3800 and sending a new firmware should work, but in this case, it does not correct the issue. The camera reboots after update back with only port 23 and port 3800 open. I'm familiar enough with U-Boot, busybox, and linux to see some of what is going on here but I have just begun to try to resolve it. There appears to be a TFTP process built in to the u-boot that looks for a specific file upgrade_info_7db780a713a4.txt that may be another way of restoring without serial. Like I mentioned, I just started trying to fix this issue and I am just starting to see how this camera works on the inside. Any help to get it working would be appreciated. Thanks, Rob

Thanks for the feedback... how do you propose returning it to the original state? I have read and tried just about everything on this forum and have had no luck yet. Could these four pins be the serial port on the IPC-HFW4300S-V2 and possibly be used to reload the upgrade.img?

I have done more digging into the issue. Here is the output of /var/tmp/upgraded while using the config tool to perform the upgrade. This output is when using firmware DH_IPC-HX5(4)XXX_Eng_N_Stream3_V2.420.0000.0.R.20140419.bin Everything looks like it worked but there are a couple issues. I've highlighted the errors. Still looking into it, but any thoughts would be appreciated. Thanks, Rob _____________ [OSA-APP] OSA Build on Apr 19 2014 at 09:55:50. [OSA-APP] SVN NUM: 1609. [libpdi] libpdi.so Build on Apr 19 2014 at 10:06:34. [libpdi] SVN NUM: 13790. [libpdi] Flashtype = 4,patSize = 100000,rwSize = 800,ersSize = 20000 22:52:46|[crypt] crypt_open ok! Name: upgraded, bulid date: Apr 19 2014 09:17:58, svn: 255 [libpdi] >-------getSystemInfo-------> Fail to get env authcode! [libpdi] Get authcode error @@@@ buf = PZC4MU056W00XXX 22:52:52|[pdc] WARN (MISC_ioctl|493): Get SdCard cfg failed ! [libpdi] deviceType: IPC-HFW4300S-V2 [libpdi] processor: A5S88 [libpdi] hardwareVersion: 1.00 [libpdi] appAutoStart: 1 [libpdi] serialNumber: PZC4MU056W00XXX [libpdi] processorCount: 1 [libpdi] deviceClass: IPC [libpdi] noPtz: 1 [libpdi] noSdCard: 1 [libpdi] bandWidth: 48 [libpdi] <-------getSystemInfo-------< UPGRADED_MSG: Can't Open /mnt/mtd/Config/passwd UPGRADED_MSG: Login success! UPGRADED_MSG: Kill 976 successful [libpdi] Read: blkIndex: 1,pageIndex: 0,byteIndex: 0 ,fLag: ff [libpdi] Write: blkIndex: 1,pageIndex: 0,byteIndex: 0 ,fLag: 0 UPGRADED_MSG: reset_watchdog UPGRADED_MSG: Receive A4(alarm) UPGRADED_MSG: reset_watchdog UPGRADED_MSG: Receive A1(alive package) UPGRADED_MSG: reset_watchdog UPGRADED_MSG: Receive A4(alarm) UPGRADED_MSG: reset_watchdog UPGRADED_MSG: Receive A4(alarm) UPGRADED_MSG: reset_watchdog UPGRADED_MSG: Receive A4(alarm) UPGRADED_MSG: reset_watchdog UPGRADED_MSG: reset_watchdog UPGRADED_MSG: reset_watchdog UPGRADED_MSG: reset_watchdog UPGRADED_MSG: reset_watchdog UPGRADED_MSG: reset_watchdog UPGRADED_MSG: reset_watchdog UPGRADED_MSG: reset_watchdog UPGRADED_MSG: reset_watchdog UPGRADED_MSG: reset_watchdog UPGRADED_MSG: reset_watchdog UPGRADED_MSG: reset_watchdog UPGRADED_MSG: reset_watchdog UPGRADED_MSG: reset_watchdog UPGRADED_MSG: reset_watchdog UPGRADED_MSG: reset_watchdog UPGRADED_MSG: reset_watchdog UPGRADED_MSG: reset_watchdog UPGRADED_MSG: reset_watchdog UPGRADED_MSG: reset_watchdog UPGRADED_MSG: reset_watchdog UPGRADED_MSG: reset_watchdog UPGRADED_MSG: reset_watchdog UPGRADED_MSG: reset_watchdog UPGRADED_MSG: reset_watchdog UPGRADED_MSG: reset_watchdog UPGRADED_MSG: reset_watchdog UPGRADED_MSG: Receive A1(alive package) UPGRADED_MSG: reset_watchdog UPGRADED_MSG: reset_watchdog UPGRADED_MSG: reset_watchdog UPGRADED_MSG: reset_watchdog UPGRADED_MSG: reset_watchdog UPGRADED_MSG: Received : 29868252, FileSize : 29868252 UPGRADED_MSG: Download Complete UPGRADED_MSG: DoDownLoad success! UPGRADED_MSG: Flash init success UPGRADED_MSG: hwid file success! Fail to get env native! UPGRADED_ERR: LINE: 1074: invalid file: Install.lua UPGRADED_MSG: zip file total size: 40900220 [libpdi] >-------getSystemInfo-------> Fail to get env authcode! [libpdi] Get authcode error @@@@ buf = PZC4MU056W00XXX 22:53:10|[pdc] WARN (MISC_ioctl|493): Get SdCard cfg failed ! [libpdi] deviceType: IPC-HFW4300S-V2 [libpdi] processor: A5S88 [libpdi] hardwareVersion: 1.00 [libpdi] appAutoStart: 1 [libpdi] serialNumber: PZC4MU056W00XXX [libpdi] processorCount: 1 [libpdi] deviceClass: IPC [libpdi] noPtz: 1 [libpdi] noSdCard: 1 [libpdi] bandWidth: 48 [libpdi] <-------getSystemInfo-------< UPGRADED_MSG: packet.name: SD6XXX, board.name: IPC-HFW4300S-V2 UPGRADED_MSG: packet.hardver: , board.hardver: UPGRADED_MSG: packet.name: IPC-HX3XXX, board.name: IPC-HFW4300S-V2 UPGRADED_MSG: packet.hardver: , board.hardver: UPGRADED_MSG: Verify version success Header CRC Checking ... OK Image Name: kernel.img Image Type: kernel.img (gzip compressed) Data Size: 2546876 B, Bytes = 2.43 MB Load Address: 0XC80000 Data CRC Checking ... OK Programing start at: 0XC80000 [libpdi] write update Flag [libpdi] Read: blkIndex: 0,pageIndex: 0,byteIndex: 0 ,fLag: ff [libpdi] Write: blkIndex: 0,pageIndex: 0,byteIndex: 0 ,fLag: 55 [libpdi] Flash_createPartionTab:6 [libpdi] Erase Partion: 6 [libpdi] FlashErase: addr= 0x0xc80000,blkNum:44, blkSize:0x20000,len:0x580000 <5>UBIFS: un-mount UBI device 2, volume 0 <5>UBIFS: un-mount UBI device 4, volume 0 Upgrade : Complete Total 6%... Header CRC Checking ... OK Image Name: partition-x.cramfs.img Image Type: partition-x.cramfs.img (gzip compressed) Data Size: 4160 B, Bytes = 0.00 MB Load Address: 0X500000 Data CRC Checking ... OK Programing start at: 0X500000 [libpdi] Flash_createPartionTab:3 [libpdi] Erase Partion: 3 [libpdi] FlashErase: addr= 0x0x500000,blkNum:8, blkSize:0x20000,len:0x100000 Upgrade : Complete Total 6%... Header CRC Checking ... OK Image Name: romfs-x.ubifs.img Image Type: romfs-x.ubifs.img (gzip compressed) Data Size: 7340096 B, Bytes = 7.00 MB Load Address: 0X1200000 Data CRC Checking ... OK Programing start at: 0X1200000 [libpdi] Flash_createPartionTab:7 [libpdi] Erase Partion: 7 [libpdi] FlashErase: addr= 0x0x1200000,blkNum:64, blkSize:0x20000,len:0x800000 Upgrade : Complete Total 24%... Header CRC Checking ... OK Image Name: pd-x.ubifs.img Image Type: pd-x.ubifs.img (gzip compressed) Data Size: 1966144 B, Bytes = 1.88 MB Load Address: 0X940000 Data CRC Checking ... OK Programing start at: 0X940000 [libpdi] Flash_createPartionTab:5 [libpdi] Erase Partion: 5 [libpdi] FlashErase: addr= 0x0x940000,blkNum:26, blkSize:0x20000,len:0x340000 Upgrade : Complete Total 28%... Header CRC Checking ... OK Image Name: user-x.ubifs.img Image Type: user-x.ubifs.img (gzip compressed) Data Size: 21233728 B, Bytes = 20.25 MB Load Address: 0X2200000 Data CRC Checking ... OK Programing start at: 0X2200000 [libpdi] Flash_createPartionTab:9 [libpdi] Erase Partion: 9 [libpdi] FlashErase: addr= 0x0x2200000,blkNum:204, blkSize:0x20000,len:0x1980000 Upgrade : Complete Total 80%... Header CRC Checking ... OK Image Name: custom-x.ubifs.img Image Type: custom-x.ubifs.img (gzip compressed) Data Size: 1966144 B, Bytes = 1.88 MB Load Address: 0X600000 Data CRC Checking ... OK Programing start at: 0X600000 [libpdi] Flash_createPartionTab:4 [libpdi] Erase Partion: 4 [libpdi] FlashErase: addr= 0x0x600000,blkNum:26, blkSize:0x20000,len:0x340000 Upgrade : Complete Total 85%... Header CRC Checking ... OK Image Name: web-x.ubifs.img Image Type: web-x.ubifs.img (gzip compressed) Data Size: 5505088 B, Bytes = 5.25 MB Load Address: 0X1A00000 Data CRC Checking ... OK Programing start at: 0X1A00000 [libpdi] Flash_createPartionTab:8 [libpdi] Erase Partion: 8 [libpdi] FlashErase: addr= 0x0x1a00000,blkNum:64, blkSize:0x20000,len:0x800000 Upgrade : Complete Total 99%... [libpdi] Read: blkIndex: 0,pageIndex: 1,byteIndex: 0 ,fLag: ff [libpdi] Write: blkIndex: 0,pageIndex: 1,byteIndex: 0 ,fLag: aa Upgrade : Complete Total 100%... UPGRADED_MSG: will reboot system [libpdi] rebootSystem: i will reboot [libpdi] Read: blkIndex: 1,pageIndex: 0,byteIndex: 0 ,fLag: ff [libpdi] Write: blkIndex: 1,pageIndex: 0,byteIndex: 0 ,fLag: 0 [libpdi] pdi:system will reboot!!

I have the same issue. Where can I get the file.... IPC-HFW4300-V2 General_IPC-HX5(4)XXX_Eng_P_V2.210.0000.11.R.20140115.bin I have a HFW4300-V2 camera and the only ports open are 23 and 3800. I have tried all the files listed below with no luck. DH_IPC-HX5(4)XXX_Eng_NP_V2.210.0000.12.R.20140225 General_IPC-HX5(4)XXX_Eng_P_V2.210.0000.11.R.20140115 General_IPC-HX5(4)XXX_Eng_P_Stream3_V2.420.0000.0.R.20140419 General_IPC-HX5(4)XXX_Eng_P_Stream3_V2.420.0005.0.R.20141205 IPC4(5)XXX-9-30-14 General_IPC-HX5(4)XXX(SD-Adreia)_Eng_N_Stream3_V2.400.0000.0.R.20131231 When I telnet into the camera /usr/bin/sonia & /var/tmp/upgraded are running. upgraded provides the listener on port 3800. With the config tool, I can login to 3800 and load the firmware file... it says transmitting file, then updating camera the says success and reboots, but the camera still only comes up with port 23 and 3800 and the firmware is not applied. Any thoughts? Thanks, Rob