Unbricking your Dahua IP camera (Tips, Tricks & Firmware)

[MaxIcon 0]

Note that newer firmware doesn't use vizxv any more, per this post:

 

viewtopic.php?p=253713#p253713

 

i've been in the forums as a passive member for quite a while and now i like

to contribute some little information to this forum.

 

I noticed that with the v2.4x baseline firmware releases the well known

telnet access root/vizxv is gone

 

For me as a linux guy i wasn't happy with it at all so i took some

time to reverse enginieer the firmware of my HFW4200s camera.

 

I manage to analyse the telnet authorization

part in the firmware. The /etc/passwd is still the same so

the old password should work as always but the engineers

at dahua changed the authorization so this file is never read

for login. First i was able to patch the busybox binary to

accept any passwords but a couple of hours later i was

able to enter a valid password.

 

In fact the secret login/password consists of a valid

user with administrator privileges to the web interface

(e.g. admin) and a password with a 'secret' prefix.

 

Long story short as in my case with login 'admin' and password 'admin'

my telnet login is like this:

 

login: admin

password: 7ujMko0admin

 

So the prefix '7ujMko0' is the important part here.

 

Finally i'm able to telnet login to my cameras again

 

Can any of you double check on that?

[Chris-L 2]

Ah I see.

 

I was able to follows the (easier) process on my 2.212 firmware. I wasn't aware that the telnet password had now changed.

 

If you can get in as the 888888 user, can you force a 'set to factory defaults' from the GUI - that option is available from the 2.212 GUI ?

 

 

-- Chris

[dopalgangr 1]

I didn't see it listed (unless I missed it) but how can you pull off or backup the firmware currently loaded on the cameras? Thanks

[weirdaljr 0]

Would anyone happen to know where the Web UI password is stored? Mine will not seem to reset to admin on a bricked HFW4100s. I have tried the reset button many times as well as flashed new update.img firmware via the serial TTL console but I can never get into the telnet or the config utility as I do not have the correct web ui password. All I can think of at this point it to find where the Web UI password may be stored to try and edit it, or maybe brute force it if it is a hash, but first I would have to find it and so far I haven't been able to.

 

P.S. Thanks so much OP for your post. It was extremely helpful in getting the TTL console access for me.

[Terminator4u 0]

Thanx CCTV_007

[Succatash 0]

Can anyone tell me if the firmware listed here for HDW-4300S works with Version 1? Or is it only for V2 versions? I see all the firmware mentions V2 in the filename. Example: General_IPC-HX5(4)XXX_Eng_N_Stream3_V2.420.0005.0.R.20141205

 

I just picked up a 4300S from Alixpress. Good seller, camera works great. But its not V2. Came with nice new English firmware, but I don't know how to go about obtaining the .bin file on the camera, or I would share. Seller won't send it to me.

 

It's running 2.420.0004.0.R, build : 2014-11-03. Hoping to find firmware for version 1 so I can mess around with this camera. I'm afraid to install the V2 files listed here without knowing if they are only for V2. Thanks.

[dopalgangr 1]

Can anyone tell me if the firmware listed here for HDW-4300S works with Version 1? Or is it only for V2 versions? I see all the firmware mentions V2 in the filename. Example: General_IPC-HX5(4)XXX_Eng_N_Stream3_V2.420.0005.0.R.20141205

 

I just picked up a 4300S from Alixpress. Good seller, camera works great. But its not V2. Came with nice new English firmware, but I don't know how to go about obtaining the .bin file on the camera, or I would share. Seller won't send it to me.

 

It's running 2.420.0004.0.R, build : 2014-11-03. Hoping to find firmware for version 1 so I can mess around with this camera. I'm afraid to install the V2 files listed here without knowing if they are only for V2. Thanks.

 

 

although I have not tested it, the firmware should work fine, as far as I know the only difference in cameras is that the V2 had POE, all I have are V2's so I cant test it. Did your V1 come with POE?

[fancom 0]

Hallo

 

Can the ip camera DH-CA-FW481I work with mobotix Software.

 

Every time opening with mobotix Software the Picture become black Pixel and the Settings of the camera are overwrite.

 

any idea ?

[Borsti92 0]

The cameras have Axis compatible URL structure.

[Succatash 0]

I have both v1 and v2. V2 has the external poe on the cable and v1 has it built in. See hdtvjeff's post above to see the box on the cable for the poe. Firmware is "NOT" interchangeable. Firmware for v1 comes out more often and v2 less often for major updates only 2-3 times slower than v1's.

 

They look and work virtually the same. I have not seen a difference other than different ir reflectors and firmware which by now v1 is better... my opinion only

 

 

Hmm, thanks for the response. I don't suppose anyone has a link to HDW-4300S V1 firmware? I can't seem to find it anywhere....

[Succatash 0]

I just bought a IPC-HDW4300S V2 from AliExpress, and trying the latest firmware didn't brick it at all. I'm very surprised, as I was expecting to need the Telnet method to fix it, or revert to 20140613.bin.

 

LOL, I'm a noob and got all mentally prepared for a big Dahua challenge, and I was excited. I downloaded the newest firmware listed General_IPC-HX5(4)XXX_Eng_N_Stream3_V2.420.0005.0.R.20141205.bin -- and took a courageous plunge using the config tool. I was ready for battle, determined to hack my Dahua camera to make this work.

 

Geez, it installed fine and nothing bricked. Now my IPC-HDW4300S V2 is running the 20141205 NTSC English, and I didn't even have to do anything tricky. What gives?

[Nathanmf 0]

Hey Guys,

 

*Urgent help needed*

 

I am in Papua New Guinea, and I am supposed to fly out tomorrow but I have 5 cameras not working....

 

I can ping their IP address but in Smart PSS I only see 1192.168.1.108 and Port:0

 

I have pressed the reset button and they have reset... What confuses me is they were working, then we moved the lenses and they stopped.. 3 of them. I am not sure if it is due to moving the Lenses (how could it be) or plugging my PC into the switch (not sure how this could cause it either).

 

Anyway....

 

I can see the IR leds on, but the green light to show they are working is off.

 

What I want to know is will this firmware upgrading procedure you have provided work? Or will I need to do something else? Is there something more simple that I am missing?

 

Please whats app me: +61402233316 as I may not be able to get on here while trying to fix this (****ty internet and infrastructure over here). Alternatively if you can post replies here I will be checking back when I get a chance.

 

Thank, Any help is much appreciated.

[Boogieman 1]

Hey Guys,

 

*Urgent help needed*

 

I am in Papua New Guinea, and I am supposed to fly out tomorrow but I have 5 cameras not working....

 

I can ping their IP address but in Smart PSS I only see 1192.168.1.108 and Port:0

 

I have pressed the reset button and they have reset... What confuses me is they were working, then we moved the lenses and they stopped.. 3 of them. I am not sure if it is due to moving the Lenses (how could it be) or plugging my PC into the switch (not sure how this could cause it either).

 

Anyway....

 

I can see the IR leds on, but the green light to show they are working is off.

 

What I want to know is will this firmware upgrading procedure you have provided work? Or will I need to do something else? Is there something more simple that I am missing?

 

Please whats app me: +61402233316 as I may not be able to get on here while trying to fix this (****** internet and infrastructure over here). Alternatively if you can post replies here I will be checking back when I get a chance.

 

Thank, Any help is much appreciated.

you probably reset them...they all have a fixed ip ending in .108...plug one in at a time and change the ip address...so that they wont conflict.

[Nathanmf 0]

Hey Guys,

 

*Urgent help needed*

 

I am in Papua New Guinea, and I am supposed to fly out tomorrow but I have 5 cameras not working....

 

I can ping their IP address but in Smart PSS I only see 1192.168.1.108 and Port:0

 

I have pressed the reset button and they have reset... What confuses me is they were working, then we moved the lenses and they stopped.. 3 of them. I am not sure if it is due to moving the Lenses (how could it be) or plugging my PC into the switch (not sure how this could cause it either).

 

Anyway....

 

I can see the IR leds on, but the green light to show they are working is off.

 

What I want to know is will this firmware upgrading procedure you have provided work? Or will I need to do something else? Is there something more simple that I am missing?

 

Please whats app me: +61402233316 as I may not be able to get on here while trying to fix this (****** internet and infrastructure over here). Alternatively if you can post replies here I will be checking back when I get a chance.

 

Thank, Any help is much appreciated.

you probably reset them...they all have a fixed ip ending in .108...plug one in at a time and change the ip address...so that they wont conflict.

 

I have reset them.

 

IP is .108 however they don't work at all even when plugged in 1 at a time.

 

I was mid writing this when we found out that the cable inside the camera had come out. I will upload pictures later.

[Boogieman 1]

Hey Guys,

 

*Urgent help needed*

 

I am in Papua New Guinea, and I am supposed to fly out tomorrow but I have 5 cameras not working....

 

I can ping their IP address but in Smart PSS I only see 1192.168.1.108 and Port:0

 

I have pressed the reset button and they have reset... What confuses me is they were working, then we moved the lenses and they stopped.. 3 of them. I am not sure if it is due to moving the Lenses (how could it be) or plugging my PC into the switch (not sure how this could cause it either).

 

Anyway....

 

I can see the IR leds on, but the green light to show they are working is off.

 

What I want to know is will this firmware upgrading procedure you have provided work? Or will I need to do something else? Is there something more simple that I am missing?

 

Please whats app me: +61402233316 as I may not be able to get on here while trying to fix this (****** internet and infrastructure over here). Alternatively if you can post replies here I will be checking back when I get a chance.

 

Thank, Any help is much appreciated.

you probably reset them...they all have a fixed ip ending in .108...plug one in at a time and change the ip address...so that they wont conflict.

 

I have reset them.

 

IP is .108 however they don't work at all even when plugged in 1 at a time.

 

I was mid writing this when we found out that the cable inside the camera had come out. I will upload pictures later.

That is your problem. After you reset them, they all have the same ip address. Clear the routers dhcp lease..it might be trying hold the 108 address for the first device..

[searle 0]

Here is the simplest way I know to-date to load the newest firmware on IPC-HFW4300S-V2 and other Chinese Dahua cameras ordered on AliExpress.... I'm still working on a permanent fix, but I've had many emails about this so I thought I'd post a quick update.

 

1. Use the config tool or web UI to load the newest firmware (General_IPC-HX5(4)XXX_Eng_N_Stream3_V2.420.0005.0.R.20141205.bin)

2. Your camera will appear bricked (no web ui) but the only issue preventing it from working is the language settings (which prevents sonia from loading)

3. Login into the camera with Telnet (user: admin / password: 7ujMko0{web ui password}

4. You will need to perform a few edits, so you need to make mounts read/write

\> mount -o remount rw /usr

\> mount -o remount rw /mnt/custom

 

5. Rename files

\> mv /usr/data/Strings/English.txt /usr/data/Strings/SimpChinese.txt

\> mv /mnt/custom/English.txt /mnt/custom/SimpChinese.txt

 

6. Edit files with vi ---> /usr/data/Strings/i18n & /mnt/custom/i18n. Change the following:

 

"DefaultLanguage" : "English", ------> SimpChinese

"DefaultVideoStandard" : "NTSC",

"DevStringFiles" : [ "StringsEn.txt" ],

"HTMLStringFiles" : [ "webEN.json" ],

"Languages" : [ "English" ], ------> SimpChinese

"VideoStandards" : [ "NTSC" ],

"WebStringFiles" : [ "webEN.lang" ]

 

(Tips for using vi: press "i" for insert then ESC when done editing, then type :w to write then type :q! to exit)

 

type reboot to restart the camera and you will have a working New English firmware. These changes will need to be repeated if you upgrade to another firmware since these partitions are erased an re-flashed during an upgrade.

 

I'm really trying to get to the root cause of why the camera seems hard-coded to Chinese and I will update as I uncover more information.

 

Thanks,

Rob

[searle 0]

Here is the simplest way I know to-date to load the newest firmware on IPC-HFW4300S-V2 and other Chinese Dahua cameras ordered on AliExpress.... I'm still working on a permanent fix, but I've had many emails about this so I thought I'd post a quick update.

 

1. Use the config tool or web UI to load the newest firmware (General_IPC-HX5(4)XXX_Eng_N_Stream3_V2.420.0005.0.R.20141205.bin)

2. Your camera will appear bricked (no web ui) but the only issue preventing it from working is the language settings (which prevents sonia from loading)

3. Login into the camera with Telnet (user: admin / password: 7ujMko0{web ui password}

4. You will need to perform a few edits, so you need to make mounts read/write

\> mount -o remount rw /usr

\> mount -o remount rw /mnt/custom

 

5. Rename files

\> mv /usr/data/Strings/English.txt /usr/data/Strings/SimpChinese.txt

\> mv /mnt/custom/English.txt /mnt/custom/SimpChinese.txt

 

6. Edit files with vi ---> /usr/data/Strings/i18n & /mnt/custom/i18n. Change the following:

 

"DefaultLanguage" : "English", ------> SimpChinese

"DefaultVideoStandard" : "NTSC",

"DevStringFiles" : [ "StringsEn.txt" ],

"HTMLStringFiles" : [ "webEN.json" ],

"Languages" : [ "English" ], ------> SimpChinese

"VideoStandards" : [ "NTSC" ],

"WebStringFiles" : [ "webEN.lang" ]

 

(Tips for using vi: press "i" for insert then ESC when done editing, then type :w to write then type :q! to exit)

 

type reboot to restart the camera and you will have a working New English firmware. These changes will need to be repeated if you upgrade to another firmware since these partitions are erased an re-flashed during an upgrade.

 

I'm really trying to get to the root cause of why the camera seems hard-coded to Chinese and I will update as I uncover more information.

 

Thanks,

Rob

 

in the hcvr5104h ,can't find /usr/data/Strings/i18n &/mnt/custom/i18n

 

and find English.txt & SimpChinese.txt in /usr/data/Data

[linhdx123 0]

Can you help me with dahua hcvr 4104hs-v3 ?

[justinmiller16 0]

Hi,

 

Great thread. Thanks for posting. I have the HFW4300S and the most recent firmware, according to your thread, is from 12/2014. Is that the most recent firmware for this camera?

 

Also, out of the box, my camera UI is in English, but all the help is in Chinese. Does that sound right?

 

Thanks,

Justin

[Si4 0]

Hello everyone !

I post may not be in the right séction but it is a fact similar to Brick.

 

Sorry in advance for my English, I do not speak it at all. (Google Taduction)

French site and no one talks about my problem.

 

Recently, we had a power outage.

One of my cameras is delivered zero ...

 

It is a Dahua Ipc-Hfw4300s (Recente, 1 month, China)

 

On my router, I see Connected (IP: 192.168.1.108) Whereas before the power failure was 192.168.1.109.

 

The indicator on the camera is on but not connected me with a browser.

I made a ping to this IP, 100% or 50% of success, it varies.

I tried the reset button on the camera, she restarts well but still the same problem.

 

Unable to me connected with General ConfigTool.

 

I do not have time to test all ports the camera, no doubt, restarts ...

 

Is that connecting it in another way, I have a chance of the recovered?

If yes, what equipment do I need? or find it?

 

Thank you in advance.

Many greetings !

 

U-Boot 2010.06-svn503 (Dec 05 2014 - 14:11:35)

DRAM: 254 MiB

NAND: 128 MiB

state:ff,err_count:02

Net: Detected MACID:4c:11:bf:cd:00:2d

PHY:0x00221513,addr:0x00

 

TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1

Filename 'upgrade_info_7db780a713a4.txt'.

Load address: 0xc5000000

Loading:

Retry count exceeded; starting again

Fail to get info file!

Init error!

TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1

Filename 'failed.txt'.

Load address: 0xc2000000

Loading:

Retry count exceeded; starting again

 

NAND read: device 0 offset 0xc80000, size 0x00580000

5767168 bytes read: OK

## Booting kernel from Legacy Image at c2000000 ...

Image Name: Linux-2.6.38.8

Created: 2014-12-05 7:39:45 UTC

Image Type: ARM Linux Kernel Image (uncompressed)

Data Size: 2546892 Bytes = 2.4 MiB

Load Address: c0208000

Entry Point: c0208000

Verifying Checksum ... OK

Loading Kernel Image ...OK

OK

Edited November 13, 2015 by Guest

[helbet 0]

Hi,

 

Great thread. Thanks for posting. I have the HFW4300S and the most recent firmware, according to your thread, is from 12/2014. Is that the most recent firmware for this camera?

 

Also, out of the box, my camera UI is in English, but all the help is in Chinese. Does that sound right?

 

Thanks,

Justin

 

Hi there! These V2 are made only for China market. To be sold outside China, sellers only invert interface language from SimpChinesse to English. If you need English help, I can post a simple method using Telnet to solve this problem.

 

Also, I was able to write 2014.12 firmware in my camera. After that I tried to burn 2015.07 firmware, but, after that, my camera was broken..I managed to recover it using a serial TTL interface..

[justinmiller16 0]

Thanks for the reply. So it sounds like the 12/2014 is probably the latest then for the 4300s? After you flashed the 7/2015 and recovered it, are you still running the 7/2015 or did you have to downgrade?

 

Thanks for the offer. I think the guy who started this thread has instructions on the telnet method to flip the language.

[helbet 0]

I recoverded it using 12.2014. Unfortunately.. But I heard from other users that it is possible to use some 2015 versions..

[jasonkhonlaw 0]

If I received a Dahua camera in Chinese, it only as PAL listed as the video format in the settings. If I upgrade to an English version of the firmware, must I use a PAL version, or can I switch to an NTSC version of the firmware? Anyone know?

[Succatash 0]

If I received a Dahua camera in Chinese, it only as PAL listed as the video format in the settings. If I upgrade to an English version of the firmware, must I use a PAL version, or can I switch to an NTSC version of the firmware? Anyone know?

 

Yeah, just find an NTSC English firmware that works for your camera, and NTSC will be the format that it shows in settings.