Dahua VTO2000A, SIP Firmware and Asterisk

[bassbumper 0]

Hi,

 

I try to mod my VTH SIP Firmware as well. Currently there is no config file in Firmware-Mod-Kit available for the VTH.

@Foxi: How you created the file for the VTO? I want to do the same for the VTH.

 

Maybe you can support me a little bit

 

Thanks

[DigiLife 0]

Hello my friends

 

I need the SIP firmware for dahua video intercoms, especially VTO2000A-C

Could you please help me !!!

Please give me a download link for the Firmware !

 

Thanks

[bassbumper 0]

Check out Dahua FTP. Current FW version is April 2017

[bassbumper 0]

http://ftp.asm.cz/Dahua/kamerove_systemy/_Firmware/06VDP/SIP_firmware/

 

In the parent directory you can also find special versions

[Allodo 0]

@bassbumper

Dahua has removed the Telnet-Access in newer Firmware

 

If anything is strange after changing firmware, old settings are visible and something like that, clear your browsercache.

 

I think that firmware of VTO and VTH are nearby the same and has the same structure. You could try to unpack the firmware the same way you do it for VTO.

If this will work fine, the rebuild should also work. But I've not tested it, so if you do it, try it on your own risk. And if it works well, let us know about it

 

Oh, by the way, if anyone should try to modify the firmware and want to use Debian. Only try it with Debian Jessie (8.xxx) not with Stitch (9.xxx)

[bassbumper 0]

Dahua has removed the Telnet-Access in newer Firmware

I know. It is just uncomment in the start script

 

I think that firmware of VTO and VTH are nearby the same and has the same structure. You could try to unpack the firmware the same way you do it for VTO.

Yes. They are. There is just one more partition. Thanks to Botox " title="Applause" /> . He supported me to generate a config file for the VTH to extract the firmware.

 

If this will work fine, the rebuild should also work. But I've not tested it, so if you do it, try it on your own risk. And if it works well, let us know about it

I already built a new one. I will test it the next days. Fingers crossed

 

Oh, by the way, if anyone should try to modify the firmware and want to use Debian. Only try it with Debian Jessie (8.xxx) not with Stitch (9.xxx)

What is the issue? I already built a new firmware for the VTO with Stitch. No issues so far.

[Allodo 0]

@bassbumper

What is the issue?

Well I got a lot of problems with Stitch, but good to know that it will run

 

Could you please post here the Script so anyone should use it, or is it in newer version of Dahua-Firmware-Mod-Kit included?

 

For testing I've just copied the VTO2000A-Script an changed one line in it and unpacking works well so far. But I couldn't find any Sound-Files only *.pcm.

But these Files I couldn't play. If the rebuild works well, then I wanna change these terrible Soundfiles of VTH with nice ones and Speech to German

 

I'm just a little bit scrarry by flashing modded firmware because I've bricked my first VTO. But now there is an easy way to unbrick it and maybe the same solution will work for VTH. But therefor I have to sniff with Wireshark what happens when VTH is started.

[bassbumper 0]

@Allodo

 

Well I got a lot of problems with Stitch, but good to know that it will run

Any example? I want to prevent to run into issues as well Even if I already successfully uploaded modded firmware to my VTO using Stitch

 

Could you please post here the Script so anyone should use it, or is it in newer version of Dahua-Firmware-Mod-Kit included?

Here we are. Name it "VTH1510.py". I kicked one partition, added a new one and doublechecked all types and sizes. I will ask if Botox can include the file into the Mod Kit.

from .config import *

DAHUA_FILES = OrderedDict([
("Install", {
	"required": True,
	"type": DAHUA_TYPE.Plain
}),
("dm365_ubl_boot_16M.bin.img", {
	"required": True,
	"type": DAHUA_TYPE.Plain,
	"size": 0x00040000
}),
("kernel-x.cramfs.img", {
	"required": True,
	"type": DAHUA_TYPE.Plain,
	"size": 0x00200000
}),
("gui-x.cramfs.img", {
	"required": True,
	"type": DAHUA_TYPE.uImage | DAHUA_TYPE.CramFS,
	"size": 0x00200000
}),
("romfs-x.cramfs.img", {
	"required": True,
	"type": DAHUA_TYPE.uImage | DAHUA_TYPE.CramFS,
	"size": 0x00300000
}),
("user-x.cramfs.img", {
	"required": True,
	"type": DAHUA_TYPE.uImage | DAHUA_TYPE.SquashFS,
	"size": 0x00600000
}),
("data-x.cramfs.img", {
	"required": True,
	"type": DAHUA_TYPE.uImage | DAHUA_TYPE.CramFS,
	"size": 0x00120000
}),
("pd-x.cramfs.img", {
	"required": True,
	"type": DAHUA_TYPE.uImage | DAHUA_TYPE.CramFS,
	"size": 0x00020000
}),
("custom-x.cramfs.img", {
	"required": True,
	"type": DAHUA_TYPE.uImage | DAHUA_TYPE.CramFS,
	"size": 0x00020000
})
])

 

But I couldn't find any Sound-Files only *.pcm. But these Files I couldn't play.

I am just working on that. Same for me, change sound and display language to German

 

But now there is an easy way to unbrick it and maybe the same solution will work for VTH.

Which way? Maybe we can check if this works for VTH as well before I upload the new firware

[Allodo 0]

@bassbumper

I created the VTH1510.py like you did. For everyone who wanna try this, you have to insert the VTH1510 also in configs.py. In configs.py is every Hardwarescript listed.

 

I've posted the link to the Unbricking tutorial two times, but my posts seems to be eliminated

 

With this turorial I've unbricked my bricked VTO. The magic seems to be that the VTO at startup tries to update firmware by looking over TFTP.

But you have to build an own existing network, like discribed in the turorial. Within the VTO could connect to your PC und upload the extracted firmware-packages. Magic Words in G**Gle: Dahua IPC EASY unbricking / recovery over TFTP (Use the third link)

You could see this with Wireshark. Maybe the VTH has the same behaviour

[Allodo 0]

Well good news " title="Applause" />

 

It seems that the VTH has the same behaviour as VTO on startup. The IP-Address of VTH1510 at startup is 192.168.1.108 and it's looking for an update-firmware over TFTP. Because of this, the Unbricking-Method should also work on VTH

 

But I've not tested it

 

I've analyzed the Sounds with Cool Edit Pro 2.1.

They have an Sampling Rate of 16000

8-Bit Signed

Stereo

And the only channel which is OK is the right. On the left channel is only noise.

But when I open it only with Mono, there is only noise.

 

Maybe someone knows better about analyzing PCM-Sound-Files

[bassbumper 0]

@Allodo:

 

Yes, very good news.

 

I had the same issue with the PCM files. I will play around with the PCM files today. Let's see if I can find the magic

[bassbumper 0]

Heureka

 

I flashed my VTH with my own firmware mod including SIP, new ring tones and multilanguage (eng, deu) based on the current SIP Eng firmware 04.2017

 

I found the magic tip for the sound files in another forum:

 

You need to convert your sound file to a raw headerless format, signed 16bit PCM, 16KHz sampling frequency mono channel.

You can do this in Audacity by selecting export audio and choosing other uncompressed files then RAW.

[Allodo 0]

@bassbumper

Very good news for all of us

How you get multilanguage and is there a limit in length for ringtones? Could you upload your firmware as example?

 

 

There is now only one big problem left in firmware. If the VTO could react on "183 Session Progress" which the AVM Fritz!Box is answering over SIP when ringing, we don't need Asterisk anymore because the VTO could be working with Fritz!Box directly. But I really don't know where to find anything about it and how to change the behaviour of VTO.

[bassbumper 0]

@Allodo

How you get multilanguage and is there a limit in length for ringtones?

There are 2 options. Either you take an old (non-sip) firmware which includes multilanguage or you use one of the "Config" firmwares which Dahua provides on the firmware website. In both cases you extract the firmware/Config the same way and copy the included language (txt) files to your mod firmware. In addition you have to adapt "i18n" and "ProductInfo" file in your mod firmware (data-x and custom-x partition) to accept the new files.

 

Could you upload your firmware as example?

Where is a good place to upload?

 

There is now only one big problem left in firmware. If the VTO could react on "183 Session Progress" which the AVM Fritz!Box is answering over SIP when ringing, we don't need Asterisk anymore because the VTO could be working with Fritz!Box directly. But I really don't know where to find anything about it and how to change the behaviour of VTO.

Yes, you are right. I guess there is not chance as long as we cannot decompile sonia file

But asterisk is also necessary if you want to include other devices and automate actions.

I use asterisk in my current scenario with:

 

- VTO

- VTH

- Fritzbox with Fritzphones

- Asterisk

- Homeautomation (Outdoor Lights, etc)

- Mobile Phones

- Snapshots

 

All devices with sound and Picture/Video and door unlock functionality

[bassbumper 0]

is there a limit in length for ringtones?

I forgot to answer that

I haven't tested this yet. But all files included in the "Sounds" folder will be displayed in the VTH for selection.

I guess the only thing is that the size of all files in the partition (including new sound files) must not exceed the partition size which is currently about 420K of 1200K. I added two new sounds. So currently I have 580K partition size.

[bassbumper 0]

@Allodo:

My final challenge: How to switch on the f... background light???

 

I have a VTO with fingerprint module, so background light is switched off all the time.

It is switched on after you pressed the doorbell botton

 

But how to find the right one in the dark without light

 

Any ideas?

[Allodo 0]

Where is a good place to upload?

Maybe there: uploadfiles.io/

 

You mean the light of the bell sign? Typically this is always on. But I don't have a fingerprint, because of that I don't know if the light only goes on, when someone is ringing.

And I don't know where you can manage it, sorry

[lanticster 0]

I am so in doubt either jumping in the dahua pool. (vto,fingerprint,vth,fritzfon...) Or just brake the bank and buy 2N or loxone SIP outdoor.(hoping it will integrate better and reliable)

How are is the dahua hardware proving itself in the end after all the tweaking?

[melocoton 0]

How are is the dahua hardware proving itself in the end after all the tweaking?

 

I've did the tweaking and it still doesn't work as well as it could. I wouldn't buy another one, not for use with Asterisk anyway, but there's nothing comparable at that price. Working now for 3 months continuously. Well built.

[riogrande75 3]

I use asterisk in my current scenario with:

 

- VTO

- VTH

- Fritzbox with Fritzphones

- Asterisk

- Homeautomation (Outdoor Lights, etc)

- Mobile Phones

- Snapshots

 

All devices with sound and Picture/Video and door unlock functionality

What app do you use on the mobile phones to get video? So far I only had success with BriaMobile($).

Where do you register the Mobile phones - asterisk or fritzbox?

[vukasin.nikolic 0]

Hello all

 

Maybe someone can help me.

 

I have setup dahua 6210b unit with SIP firmware and Asterisk server everything works well ,

except open door function.

When call is placed from door unit I answer on a SIP phone and enter 123,

but nothing happens (no relay function).

I use standard RFC2833 dtmf mode.

Any ideas?

[bassbumper 0]

I use standard RFC2833 dtmf mode.

 

Setting all devices to dtmfmode=info in your sip.conf should help.

[bassbumper 0]

What app do you use on the mobile phones to get video? So far I only had success with BriaMobile($).

Where do you register the Mobile phones - asterisk or fritzbox?

 

I use AntiSIP. This works well on Andriod.

I registered all my mobiles on asterisk. I guess fritzbox is not able to forward H264 RTP calls.

[vukasin.nikolic 0]

I use standard RFC2833 dtmf mode.

 

Setting all devices to dtmfmode=info in your sip.conf should help.

 

No luck

[riogrande75 3]

I managed to replace all sound files in the actual SIP firmware (20170425) and installed my VTO2000A finaly at my house' door.

I receive emails with pics when someone rings the door and added the cam in my synology's surveillance station. Off course my physical phones ring with a special sound (distinctive ringing) while my soft phones (windows/android) show video too.

Nice goody from a russian site: when I get a visitor while I watch TV, my linux based satellite-receiver switches the channel to my VTO's cam automatically.

I am very happy with it so far.

 

There is only thing I was not able to figure out so far: How does the sabotage contact work? Is it just this noisy sound outside my door, or does anything happen on the network too (FTP-Upload, SIP-call,...)?