Dahua firmware

Rodrigo_V_U · February 13, 2015

Yes Please! I don't think I've tried that one.

Edit:

It didn't work but thanks anyway!

This one's different - most of the ones I've tried had the file extension ".bin", where this one was ".rar", I'm not entirely sure what all that means.

the .rar file is compressed. You need to uncompress it (using WINRAR, freeware) to extract the .bin file inside of it.

Dirk_D · February 13, 2015

Thanks Rodrigo...... tried it but:

"Illegal upgrade package, upgrade failed! Cause the device to shut down part of the function, requiring immediate reboot" OK Cancel x

ericq · February 13, 2015

kingwood you have the NTSC latest version for a 3200 series?

Rodrigo_V_U · February 13, 2015

Dirk

take a look here:

http://ingenieria.tvc.mx/kb/a1207/dahua-descarga-de-firmware-para-camaras-ip.aspx

there are two 4300C models, one of them is 4300C and the other one is 4300C-A

maybe if you try the other file...

rgds,

Rodrigo

Dirk_D · February 14, 2015

Nope!

I tried:

DH_IPC-HX5(4)XXX_Eng_NP_V2.210.0000.12.R.20140225

General_IPC-HX5(4)XXX_Eng_P_Stream3_V2.420.0000.0.R.20140419

General_IPC-HX5(4)XXX_Eng_P_Stream3_V2.420.0005.0.R.20141205

General_IPC-HX5(4)XXX_Eng_P_V2.210.0000.11.R.20140115

QSee_IPC-HX2XXX_Eng_N_V2.100.QS00.9.R.20121207

IPC4(5)XXX-9-30-14

General_IPC-HX5(4)XXX(SD-Adreia)_Eng_N_Stream3_V2.400.0000.0.R.20131231

General_IPC-HX3(2)XXX_Eng_P_V2.420.0000.0.R.20140414

General_IPC-HX3(2)XXX_Eng_P_V2.212.0001.0.R.20131224

iTuneDVR · February 14, 2015

Dirk_D!

Share your IPC.

23,80,37777 ports

I'll see

Kingwood · February 14, 2015

kingwood you have the NTSC latest version for a 3200 series?

Sorry,I have only PAL version,have no NTSC version.

cctv_007 · February 16, 2015

I have the same issue.

Where can I get the file.... IPC-HFW4300-V2 General_IPC-HX5(4)XXX_Eng_P_V2.210.0000.11.R.20140115.bin

I have a HFW4300-V2 camera and the only ports open are 23 and 3800. I have tried all the files listed below with no luck.

DH_IPC-HX5(4)XXX_Eng_NP_V2.210.0000.12.R.20140225

General_IPC-HX5(4)XXX_Eng_P_V2.210.0000.11.R.20140115

General_IPC-HX5(4)XXX_Eng_P_Stream3_V2.420.0000.0.R.20140419

General_IPC-HX5(4)XXX_Eng_P_Stream3_V2.420.0005.0.R.20141205

IPC4(5)XXX-9-30-14

General_IPC-HX5(4)XXX(SD-Adreia)_Eng_N_Stream3_V2.400.0000.0.R.20131231

When I telnet into the camera /usr/bin/sonia & /var/tmp/upgraded are running. upgraded provides the listener on port 3800.

With the config tool, I can login to 3800 and load the firmware file... it says transmitting file, then updating camera the says success and reboots, but the camera still only comes up with port 23 and 3800 and the firmware is not applied.

Any thoughts?

Thanks,

Rob

lukiszyszka · February 16, 2015

Did you do some print screen or note software version from Info page, when camera was working. Before any upgrades?.

cctv_007 · February 16, 2015

I have done more digging into the issue. Here is the output of /var/tmp/upgraded while using the config tool to perform the upgrade.

This output is when using firmware DH_IPC-HX5(4)XXX_Eng_N_Stream3_V2.420.0000.0.R.20140419.bin

Everything looks like it worked but there are a couple issues. I've highlighted the errors. Still looking into it, but any thoughts would be appreciated.

Thanks,

Rob

_____________

[OSA-APP] OSA Build on Apr 19 2014 at 09:55:50.

[OSA-APP] SVN NUM: 1609.

[libpdi] libpdi.so Build on Apr 19 2014 at 10:06:34.

[libpdi] SVN NUM: 13790.

[libpdi] Flashtype = 4,patSize = 100000,rwSize = 800,ersSize = 20000

22:52:46|[crypt] crypt_open ok!

Name: upgraded, bulid date: Apr 19 2014 09:17:58, svn: 255

[libpdi] >-------getSystemInfo------->

Fail to get env authcode!

[libpdi] Get authcode error

@@@@ buf = PZC4MU056W00XXX

22:52:52|[pdc] WARN (MISC_ioctl|493): Get SdCard cfg failed !

[libpdi] deviceType: IPC-HFW4300S-V2

[libpdi] processor: A5S88

[libpdi] hardwareVersion: 1.00

[libpdi] appAutoStart: 1

[libpdi] serialNumber: PZC4MU056W00XXX

[libpdi] processorCount: 1

[libpdi] deviceClass: IPC

[libpdi] noPtz: 1

[libpdi] noSdCard: 1

[libpdi] bandWidth: 48

[libpdi] <-------getSystemInfo-------<

UPGRADED_MSG: Can't Open /mnt/mtd/Config/passwd

UPGRADED_MSG: Login success!

UPGRADED_MSG: Kill 976 successful

[libpdi] Read: blkIndex: 1,pageIndex: 0,byteIndex: 0 ,fLag: ff

[libpdi] Write: blkIndex: 1,pageIndex: 0,byteIndex: 0 ,fLag: 0

UPGRADED_MSG: reset_watchdog

UPGRADED_MSG: Receive A4(alarm)

UPGRADED_MSG: reset_watchdog

UPGRADED_MSG: Receive A1(alive package)

UPGRADED_MSG: reset_watchdog

UPGRADED_MSG: Receive A4(alarm)

UPGRADED_MSG: reset_watchdog

UPGRADED_MSG: Receive A4(alarm)

UPGRADED_MSG: reset_watchdog

UPGRADED_MSG: Receive A4(alarm)

UPGRADED_MSG: reset_watchdog

UPGRADED_MSG: Receive A1(alive package)

UPGRADED_MSG: reset_watchdog

UPGRADED_MSG: Received : 29868252, FileSize : 29868252

UPGRADED_MSG: Download Complete

UPGRADED_MSG: DoDownLoad success!

UPGRADED_MSG: Flash init success

UPGRADED_MSG: hwid file success!

Fail to get env native!

UPGRADED_ERR: LINE: 1074: invalid file: Install.lua

UPGRADED_MSG: zip file total size: 40900220

[libpdi] >-------getSystemInfo------->

Fail to get env authcode!

[libpdi] Get authcode error

@@@@ buf = PZC4MU056W00XXX

22:53:10|[pdc] WARN (MISC_ioctl|493): Get SdCard cfg failed !

[libpdi] deviceType: IPC-HFW4300S-V2

[libpdi] processor: A5S88

[libpdi] hardwareVersion: 1.00

[libpdi] appAutoStart: 1

[libpdi] serialNumber: PZC4MU056W00XXX

[libpdi] processorCount: 1

[libpdi] deviceClass: IPC

[libpdi] noPtz: 1

[libpdi] noSdCard: 1

[libpdi] bandWidth: 48

[libpdi] <-------getSystemInfo-------<

UPGRADED_MSG: packet.name: SD6XXX, board.name: IPC-HFW4300S-V2

UPGRADED_MSG: packet.hardver: , board.hardver:

UPGRADED_MSG: packet.name: IPC-HX3XXX, board.name: IPC-HFW4300S-V2

UPGRADED_MSG: packet.hardver: , board.hardver:

UPGRADED_MSG: Verify version success

Header CRC Checking ... OK

Image Name: kernel.img

Image Type: kernel.img (gzip compressed)

Data Size: 2546876 B, Bytes = 2.43 MB

Load Address: 0XC80000

Data CRC Checking ... OK

Programing start at: 0XC80000

[libpdi] write update Flag

[libpdi] Read: blkIndex: 0,pageIndex: 0,byteIndex: 0 ,fLag: ff

[libpdi] Write: blkIndex: 0,pageIndex: 0,byteIndex: 0 ,fLag: 55

[libpdi] Flash_createPartionTab:6

[libpdi] Erase Partion: 6

[libpdi] FlashErase: addr= 0x0xc80000,blkNum:44, blkSize:0x20000,len:0x580000

<5>UBIFS: un-mount UBI device 2, volume 0

<5>UBIFS: un-mount UBI device 4, volume 0

Upgrade : Complete Total 6%...

Header CRC Checking ... OK

Image Name: partition-x.cramfs.img

Image Type: partition-x.cramfs.img (gzip compressed)

Data Size: 4160 B, Bytes = 0.00 MB

Load Address: 0X500000

Data CRC Checking ... OK

Programing start at: 0X500000

[libpdi] Flash_createPartionTab:3

[libpdi] Erase Partion: 3

[libpdi] FlashErase: addr= 0x0x500000,blkNum:8, blkSize:0x20000,len:0x100000

Upgrade : Complete Total 6%...

Header CRC Checking ... OK

Image Name: romfs-x.ubifs.img

Image Type: romfs-x.ubifs.img (gzip compressed)

Data Size: 7340096 B, Bytes = 7.00 MB

Load Address: 0X1200000

Data CRC Checking ... OK

Programing start at: 0X1200000

[libpdi] Flash_createPartionTab:7

[libpdi] Erase Partion: 7

[libpdi] FlashErase: addr= 0x0x1200000,blkNum:64, blkSize:0x20000,len:0x800000

Upgrade : Complete Total 24%...

Header CRC Checking ... OK

Image Name: pd-x.ubifs.img

Image Type: pd-x.ubifs.img (gzip compressed)

Data Size: 1966144 B, Bytes = 1.88 MB

Load Address: 0X940000

Data CRC Checking ... OK

Programing start at: 0X940000

[libpdi] Flash_createPartionTab:5

[libpdi] Erase Partion: 5

[libpdi] FlashErase: addr= 0x0x940000,blkNum:26, blkSize:0x20000,len:0x340000

Upgrade : Complete Total 28%...

Header CRC Checking ... OK

Image Name: user-x.ubifs.img

Image Type: user-x.ubifs.img (gzip compressed)

Data Size: 21233728 B, Bytes = 20.25 MB

Load Address: 0X2200000

Data CRC Checking ... OK

Programing start at: 0X2200000

[libpdi] Flash_createPartionTab:9

[libpdi] Erase Partion: 9

[libpdi] FlashErase: addr= 0x0x2200000,blkNum:204, blkSize:0x20000,len:0x1980000

Upgrade : Complete Total 80%...

Header CRC Checking ... OK

Image Name: custom-x.ubifs.img

Image Type: custom-x.ubifs.img (gzip compressed)

Data Size: 1966144 B, Bytes = 1.88 MB

Load Address: 0X600000

Data CRC Checking ... OK

Programing start at: 0X600000

[libpdi] Flash_createPartionTab:4

[libpdi] Erase Partion: 4

[libpdi] FlashErase: addr= 0x0x600000,blkNum:26, blkSize:0x20000,len:0x340000

Upgrade : Complete Total 85%...

Header CRC Checking ... OK

Image Name: web-x.ubifs.img

Image Type: web-x.ubifs.img (gzip compressed)

Data Size: 5505088 B, Bytes = 5.25 MB

Load Address: 0X1A00000

Data CRC Checking ... OK

Programing start at: 0X1A00000

[libpdi] Flash_createPartionTab:8

[libpdi] Erase Partion: 8

[libpdi] FlashErase: addr= 0x0x1a00000,blkNum:64, blkSize:0x20000,len:0x800000

Upgrade : Complete Total 99%... [libpdi] Read: blkIndex: 0,pageIndex: 1,byteIndex: 0 ,fLag: ff

[libpdi] Write: blkIndex: 0,pageIndex: 1,byteIndex: 0 ,fLag: aa

Upgrade : Complete Total 100%... UPGRADED_MSG: will reboot system

[libpdi] rebootSystem: i will reboot

[libpdi] Read: blkIndex: 1,pageIndex: 0,byteIndex: 0 ,fLag: ff

[libpdi] Write: blkIndex: 1,pageIndex: 0,byteIndex: 0 ,fLag: 0

[libpdi] pdi:system will reboot!!

iTuneDVR · February 16, 2015

I have done more digging into the issue. Here is the output of /var/tmp/upgraded while using the config tool to perform the upgrade.
This output is when using firmware DH_IPC-HX5(4)XXX_Eng_N_Stream3_V2.420.0000.0.R.20140419.bin

Everything looks like it worked but there are a couple issues. I've highlighted the errors. Still looking into it, but any thoughts would be appreciated.

Thanks,

Rob

Rob!

You're digging in the wrong direction.

I would even say too deeply for who made the first post on the forum!

However, this problem has a solution, only returning to its original state!

cctv_007 · February 16, 2015

Thanks for the feedback... how do you propose returning it to the original state? I have read and tried just about everything on this forum and have had no luck yet.

Could these four pins be the serial port on the IPC-HFW4300S-V2 and possibly be used to reload the upgrade.img?

iTuneDVR · February 16, 2015

You know how to do it, so why ask?

Such IPC restored without it!

Better say why did you update the firmware?

cctv_007 · February 16, 2015

I haven't tried to restore to factory with the serial yet. I don't have a cable yet, but will track one down soon. Is there another way to restore?

I was attempting to update to the newest firmware to add NAS support. I should have used General_IPC-HX5(4)XXX_Eng_P_Stream3_V2.420.0005.0.R.20141205.bin, but somehow I chose the wrong file. I think I may have used a firmware meant for my 3300 series camera. Now the camera only has port 23 - (telnetd) and port 3800 - (upgraded) open. Normally connecting with the config tool to port 3800 and sending a new firmware should work, but in this case, it does not correct the issue. The camera reboots after update back with only port 23 and port 3800 open.

I'm familiar enough with U-Boot, busybox, and linux to see some of what is going on here but I have just begun to try to resolve it. There appears to be a TFTP process built in to the u-boot that looks for a specific file upgrade_info_7db780a713a4.txt that may be another way of restoring without serial.

Like I mentioned, I just started trying to fix this issue and I am just starting to see how this camera works on the inside.

Any help to get it working would be appreciated.

Thanks,

Rob

iTuneDVR · February 16, 2015

The firmware file was correct or you would have not updated them.

There is another problem.

cctv_007 · February 16, 2015

That is supposed to be true, but I know for a fact, that the firmware check does not always work. The firmware for IPC-HX3XXX will pass checks for some versions. I have made this mistake before, but have corrected it by using the config tool on port 3800 and reloading the correct firmware. for whatever reason, this time, it won't work.

On to the task at hand....What options do I have for recovery?

iTuneDVR · February 16, 2015

That is supposed to be true, but I know for a fact, that the firmware check does not always work. The firmware for IPC-HX3XXX will pass checks for some versions. I have made this mistake before, but have corrected it by using the config tool on port 3800 and reloading the correct firmware. for whatever reason, this time, it won't work.
On to the task at hand....What options do I have for recovery?

QED! You are in this case not a beginner!

What else you need to learn?

Try and your efforts can bring the desired result.

The next time you'll be more careful with firmware.

cctv_007 · February 17, 2015

All is well in firmware land! I managed to get everything up and running and updated.

Thanks for the feedback.

iTuneDVR · February 18, 2015

All is well in firmware land! I managed to get everything up and running and updated.
Thanks for the feedback.

MaxIcon · February 18, 2015

All is well in firmware land! I managed to get everything up and running and updated.

Thanks for the feedback.

So, what worked?

brian89gp · February 18, 2015

There appears to be a TFTP process built in to the u-boot that looks for a specific file upgrade_info_7db780a713a4.txt that may be another way of restoring without serial.

That looks like a MAC address in the txt file.

lukiszyszka · February 18, 2015

Dahua's MAC addresses start:

4C11BF

9002A9

and only those two. Any other.

cctv_007 · February 18, 2015

FYI. Here is some information that can hopefully assist someone else in recovering their failed camera.

This information is all related to my IPC-HFW4300S-V2. I will write a longer post that describes the differences with other Dahua cameras in a couple weeks when I have had time to compile a detailed list. I also have IPC-HDBW2200E, IPC-HFW2200S and IPC-HFW3300C cameras that I will test with.

The firmware consists of several images that are loaded into various partitions in flash in a UBI file system. You can load each partition separately if needed. More on this later.... (I'll put a guide together on flashing and recovering partitions)

Once you telnet into the camera, there are number of useful binaries in the user shell that can help correct and diagnose some of the problems people are experiencing. One of the helpful steps is to kill the /var/tmp/upgraded process and run it in the foreground so you can see what is going on and easily capture error messaged. The /var/tmp/upgraded process is what opens the port 3800 and allows you to connect to the camera with the config tool if your web services have failed. There is also another copy in usr/sbin/.

Also, in there is a command to reset all the parameters back to factory defaults (username, password, ip address back to 192.168.1.108 etc.) This can be accomplished with /sbin/clearparam.

Another issue that people run into is the constant reboot issue. This can be caused by a failed process. The main application which provides all the camera capabilities (web interface, streaming, etc.) is /usr/bin/sonia. This process is what makes most firmware different from version to version (sort of). There are also changes to the web partition which contains the web server pages that /usr/bin sonia hosts on port 80. The sonia process is invoked by a shell script in init.d and if the process is killed, the camera reboots after a few minutes. Ths has cause many people issues when trying to unbrick the camera since you only have a few minutes between reboots.

To stop the reboots you can update the flash. There is a parameter called appauto that tells the camera to auto start /us/bin/sonia. If you want the camera to start and not invoke the shell script that launches sonia, you need to set appauto to 0. This will stop the camera from rebooting when sonia is not running. This cam be accomplished by running '/sbin/appauto 0'. To turn it back on, just run /sbin/appauto 1. This writes the boot parameter in flash that the kernel reads before starting the process. You can check the current status of the appauto bootparameter with 'cat /proc/dahua/bootpara' It will only show what the parameter was when you booted up, so if you changes it you need to reboot to see the change in /proc/dahua/bootpara.

I have also done a bit of testing around the tftp process that is invoked in u-boot that looks for upgrade_info_7db780a713a4.txt and failed.txt. I think with a little more work, I'll figure out if there is a recovery method using tftp without serial access. This would be necessary if you lose telnet access and need to rebuild the kernel partition that hosts telnetd.

Well, that's all I have time to share for now, but I'll do my best to put together a comprehensive guide to the inner workings of these cameras and a guide to unbrick in any failed software situation.

I will also post links to the 15-20 firmware files that I have collected.

Thanks and take care.

Rob

Edited February 19, 2015 by Guest

cctv_007 · February 18, 2015

There appears to be a TFTP process built in to the u-boot that looks for a specific file upgrade_info_7db780a713a4.txt that may be another way of restoring without serial.

That looks like a MAC address in the txt file.

Yes, but it's arbitrary. This is just a filename that Tftp looks for during uboot. I am doing some testing as I believe this can bu used to load upgrade.img through tftp. THis would allow unbricking a camera even if telnet is lost.

I'll update in a couple weeks once I have it all sorted out.

Securame · February 19, 2015

Well, that's all I have time to share for now, but I'll do my best to put together a comprehensive guide to the inner workings of these cameras and a guide to unbrick in any failed software situation.

" title="Applause" /> " title="Applause" /> " title="Applause" />

Thanks for taking the time to share!

Sign In

Dahua firmware

Recommended Posts

Rodrigo_V_U 0

Share this post

Link to post

Share on other sites

Dirk_D 0

Share this post

Link to post

Share on other sites

ericq 0

Share this post

Link to post

Share on other sites

Rodrigo_V_U 0

Share this post

Link to post

Share on other sites

Dirk_D 0

Share this post

Link to post

Share on other sites

iTuneDVR 2

Share this post

Link to post

Share on other sites

Kingwood 0

Share this post

Link to post

Share on other sites

cctv_007 3

Share this post

Link to post

Share on other sites

lukiszyszka 0

Share this post

Link to post

Share on other sites

cctv_007 3

Share this post

Link to post

Share on other sites

iTuneDVR 2

Share this post

Link to post

Share on other sites

cctv_007 3

Share this post

Link to post

Share on other sites

iTuneDVR 2

Share this post

Link to post

Share on other sites

cctv_007 3

Share this post

Link to post

Share on other sites

iTuneDVR 2

Share this post

Link to post

Share on other sites

cctv_007 3

Share this post

Link to post

Share on other sites

iTuneDVR 2

Share this post

Link to post

Share on other sites

cctv_007 3

Share this post

Link to post

Share on other sites

iTuneDVR 2

Share this post

Link to post

Share on other sites

MaxIcon 0