Dahua IPC unbricking / recovery over serial UART and TFTP

[Corellon]

If there is a sticker on the unit you can check then can verify on that, if you are absolutely sure that it's the right camera you can try updating the boot loader...... But if that goes wrong you can't go back (without physically accessing the camera and programming the chip with specialized tools).

I don't have a camera with NAND but you can try using the following command in the commands.txt file and then run commands.bat

nand read 0x2000000 0x300000 0x100000
md 0x2000000 0x1000000

That should print the contents of the HWID partition to the console, in there might be something of value to solve this mystery

 

[pozzello]

After executing the commands in the commands.txt file, my bootloader was always asking for file "success.txt." via tftp.

As I was faithfully closing out the TFTP server when i saw that ".FLASHING_DONE_STOP_TFTP_NOW", my tftpserver was never around to answer the
request for file "success.txt". It would try a few times, then apparently give up, which I thought was normal, but it turns out,
IT REALLY WANTS TO GET THE SUCCESS.TXT FILE!.

I created a blank file by that name in the 'root directory and let the camera grab it after all the other commands completed.

Thanks I get errors that it can't access both the success.txt and fail.txt.

TFTP shows
Client 192.168.1.108:3073 root\upgrade_info_7db780a713a4.txt, 1 Blocks Served
Client 192.168.1.108:1080 root\romfs-x.squashfs.img, 927 Blocks Served
Client 192.168.1.108:2204 root\kernel.img, 1062 Blocks Served
Client 192.168.1.108:3820 root\user-x.squashfs.img, 9535 Blocks Served
Client 192.168.1.108:2645 root\web-x.squashfs.img, 4155 Blocks Served
Client 192.168.1.108:3142 root\partition-x.cramfs.img, 3 Blocks Served
Client 192.168.1.108:3320 root\custom-x.squashfs.img, 23 Blocks Served
Client 192.168.1.108:3517 root\pd-x.squashfs.img, 48 Blocks Served
Client 192.168.1.108:1463 root\.FLASHING_DONE_STOP_TFTP_NOW, 1 Blocks Served
Client 192.168.1.108:3827 root\success.txt, File not found or No Access

Console show
done
partition file version 2
rootfstype squashfs root /dev/mtdblock8
fail to load bootargsParameters.txt
fail to load bootargsParameters.txt file
get bootargs info failed
cmdLine console=ttyS0,115200 mem=198M root=/dev/mtdblock8 rootfstype=squashfs init=/linuxrc

I don’t even know what firmware it was on previously because I just notice this camera fail a month ago (it went into the continuous rebooting) and I thought I could flash the firmware.

I’m trying to locate a firmware for this I tried the latest and that loops also. The current one I tired is from 2018 or 2017. So I need to somehow find another one beside the 2020.

Anyone know how I can find the previous firmware for SD1A203T-GN?

 

[anthonys650]

Thanks the camera sticker does have
SD1A203T-GN

I run the DH_SD-Mao-Rhea_MultiLang_NP_Stream3_IVS_Market_V2.800.0000000.4.R.191105 the partitionV2.txt shows.

web, 0, 0x0000000001600000, 0x0000000000800000, RW, R, squashfs, "mount /dev/mtdblock9 /mnt/web/", 0x0000000004c80000

but after I ran that firmware

Spoiler

U-Boot 2010.06-svn5213 (Sep 13 2018 - 14:55:04)
I2C: ready
DRAM: 198 MiB
gBootLogPtr:00b80008.
NAND: 128 MiB
amb_nand_read_oob read page:49152 err
partition file version 2
rootfstype squashfs root /dev/mtdblock8
fail to load bootargsParametersV22.txt
fail to load bootargsParametersV21.txt
fail to init bootargsParametersV2
TEXT_BASE:01000000
Net: Detected MACID:00:12:34:56:78:9a
PHY:0x001cc816,addr:0x00
s3l phy RTL8201 init

partition file version 2
rootfstype squashfs root /dev/mtdblock8
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'upgrade_info_7db780a713a4.txt'.
Download to address: 0x5000000
Downloading: #################################################
done
Bytes transferred = 534 (216 hex)
help
? - alias for 'help'
backup - backup - manual backup program.

base - print or set address offset
bdinfo - print Board Info structure
boot - boot default, i.e., run 'bootcmd'
bootd - boot default, i.e., run 'bootcmd'
bootf - boot from flash
bootm - boot application image from memory
bootp - boot image via network using BOOTP/TFTP protocol
cfgRestore- erase config and backup partition.

cmp - memory compare
coninfo - print console devices and information
cp - memory copy
crc32 - checksum calculation
dcache - enable or disable data cache
dhcp - boot image via network using DHCP/TFTP protocol
echo - echo args to console
editenv - edit environment variable
erasepart- erasepart

exit - exit script
false - do nothing, unsuccessfully
flwrite - flwrite - write data into FLASH memory

fsinfo - print information about filesystems
fsload - load binary file from a filesystem image
go - start application at address 'addr'
gpio - gpio test
help - print command description/usage
hwid - hwid - set hardware id and save to flash

i2c - I2C sub-system
icache - enable or disable instruction cache
iminfo - print header information for application image
itest - return true/false on integer compare
kload - kload - load uImage file from parttion

lip - lip - set local ip address but not save to flash

loadb - load binary file over serial line (kermit mode)
loads - load S-Record file over serial line
loady - load binary file over serial line (ymodem mode)
logsend - get log buf
loop - infinite loop on address range
ls - list files in a directory (default /)
mac - mac - set mac address and save to flash

md - memory display
memsize - memsize - set mem size

mii - MII utility commands
mm - memory modify (auto-incrementing address)
mtest - simple RAM read/write test
mw - memory write (fill)
nand - NAND sub-system
nboot - boot from NAND device
nfs - boot image via network using NFS protocol
nm - memory modify (constant address)
partition- print partition information
ping - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
rarpboot- boot image via network using RARP/TFTP protocol
rdefault- rdefault -recover default env

reset - Perform RESET of the CPU
run - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv - set environment variables
showvar - print local hushshell variables
sip - sip - set server ip address but not save to flash

sleep - delay execution for some time
source - run script from memory
sync_uboot- sync_uboot - sync uboot to uboot-bak

test - minimal test like /bin/sh
tftpboot- tftpboot- boot image via network using TFTP protocol
true - do nothing, successfully
uartUp - uartUp- update image via uart using uart4

upmh - mcu heat upgraded
usleep - delay execution for some time
version - print monitor version
printenv
bootargs=console=ttyS0,115200 mem=198M root=/dev/mtdblock8 rootfstype=squashfs init=/linuxrc
bootcmd=kload 0x02000000; bootm 0x02000000
bootdelay=3
baudrate=115200
ethaddr=00:12:34:56:78:9A
ipaddr=192.168.1.108
serverip=192.168.1.1
autoload=yes
gatewayip=192.168.1.1
netmask=255.255.255.0
ID=000000000000000000
da=tftp 0x02000000 dhboot.bin.img; flwrite;tftp dhboot-min.bin.img;nand protect off;flwrite
dr=tftp 0x02000000 romfs-x.squashfs.img; flwrite
dk=tftp 0x02000000 kernel.img; flwrite
du=tftp 0x02000000 user-x.squashfs.img; flwrite
dw=tftp 0x02000000 web-x.squashfs.img; flwrite
ds=tftp 0x02000000 dsp-x.squashfs.img; flwrite
dc=tftp 0x02000000 custom-x.squashfs.img; flwrite
dt=tftp 0x02000000 data-x.squashfs.img; flwrite
df=tftp 0x02000000 fpga.img; flwrite
up=tftp 0x02000000 update.img; flwrite
tk=tftp 0x02000000 uImage; bootm
dh_keyboard=1
appauto=1
sysbackup=1
logserver=127.0.0.1
loglevel=4
autosip=192.168.254.254
autolip=192.168.1.108
autogw=192.168.1.1
autonm=255.255.255.0
pd=tftp 0x02000000 pd-x.squashfs.img; flwrite
ethact=ambarella mac
stdin=serial
stdout=serial
stderr=serial
filesize=216
fileaddr=5000000

Environment size: 1132/131068 bytes
"partition"
name cs offset size flag fs_flags fs_type
MinBoot 0 0x0000000000000000 0x0000000000100000 0x00000000 0x00000000 0x00000000
U-Boot 0 0x0000000000200000 0x0000000000100000 0x00000000 0x00000000 0x00000000
hwid 0 0x0000000000300000 0x0000000000100000 0x00000000 0x00000000 0x00000000
updateflag 0 0x0000000000400000 0x0000000000100000 0x00000000 0x00000000 0x00000000
partition 0 0x0000000000500000 0x0000000000100000 0x00000000 0x00000001 0x00000001
custom 0 0x0000000000600000 0x0000000000340000 0x00000000 0x00000001 0x00000002
product 0 0x0000000000940000 0x0000000000340000 0x00000000 0x00000001 0x00000002
Kernel 0 0x0000000000c80000 0x0000000000580000 0x00000000 0x00000000 0x00000000
romfs 0 0x0000000001200000 0x0000000000400000 0x00000000 0x00000001 0x00000002
web 0 0x0000000001600000 0x0000000000800000 0x00000000 0x00000001 0x00000002
user 0 0x0000000001e00000 0x0000000001c80000 0x00000000 0x00000001 0x00000002
syslog 0 0x0000000007200000 0x0000000000400000 0x00000000 0x00000003 0x00000003
config 0 0x0000000007600000 0x0000000000400000 0x00000000 0x00000003 0x00000003
backup 0 0x0000000007a00000 0x0000000000400000 0x00000000 0x00000003 0x00000003
lens 0 0x0000000007100000 0x0000000000100000 0x00000000 0x00000000 0x00000000
MinBoot mountcmd:
U-Boot mountcmd:
hwid mountcmd:
updateflag mountcmd:
partition mountcmd:
custom mountcmd:mount /dev/mtdblock5 /mnt/custom/
product mountcmd:mount /dev/mtdblock6 /mnt/pd/
Kernel mountcmd:
romfs mountcmd:
web mountcmd:mount /dev/mtdblock9 /mnt/web/
user mountcmd:mount /dev/mtdblock10 /usr/
syslog mountcmd:/sbin/ubiattach /dev/ubi_ctrl -m 11
/sbin/ubimkvol /dev/ubi0 -s 2500000 -N syslog
mount -t ubifs ubi0_0 /mnt/syslog
if [ $? -ne 0 ];then
flash_eraseall /dev/mtd/11
/sbin/ubiattach /dev/ubi_ctrl -m 11
/sbin/ubimkvol /dev/ubi0 -s 2500000 -N syslog
mount -t ubifs ubi0_0 /mnt/syslog
fi
config mountcmd:/sbin/ubiattach /dev/ubi_ctrl -m 12
/sbin/ubimkvol /dev/ubi1 -s 2500000 -N config
mount -t ubifs ubi1_0 /mnt/mtd
if [ $? -ne 0 ];then
echo /mnt/config mount fail! >> /mnt/syslog/ubifsLog
sync
flash_eraseall /dev/mtd/12
/sbin/ubiattach /dev/ubi_ctrl -m 12
/sbin/ubimkvol /dev/ubi1 -s 2500000 -N config
mount -t ubifs ubi1_0 /mnt/mtd
fi
backup mountcmd:/sbin/ubiattach /dev/ubi_ctrl -m 13
/sbin/ubimkvol /dev/ubi2 -s 2500000 -N backup
mount -t ubifs ubi2_0 /mnt/backup
if [ $? -ne 0 ];then
echo /mnt/backup mount fail! >> /mnt/syslog/ubifsLog
sync
flash_eraseall /dev/mtd/13
/sbin/ubiattach /dev/ubi_ctrl -m 13
/sbin/ubimkvol /dev/ubi2 -s 2500000 -N backup
mount -t ubifs ubi2_0 /mnt/backup
fi
lens mountcmd:
"bdinfo"
arch_number = 0x23283041
env_t = 0x00000000
boot_params = 0x00200000
DRAM bank = 0x00000000
-> start = 0x00200000
-> size = 0x0C600000
ethaddr = 00:12:34:56:78:9A
ip_addr = 192.168.1.108
baudrate = 115200 bps
"fsinfo"
### filesystem type is JFFS2
Scanning JFFS2 FS: done.
Compression: NONE
frag count: 0
compressed sum: 0
uncompressed sum: 0
Compression: ZERO
frag count: 0
compressed sum: 0
uncompressed sum: 0
Compression: RTIME
frag count: 0
compressed sum: 0
uncompressed sum: 0
Compression: RUBINMIPS
frag count: 0
compressed sum: 0
uncompressed sum: 0
Compression: COPY
frag count: 0
compressed sum: 0
uncompressed sum: 0
Compression: DYNRUBIN
frag count: 0
compressed sum: 0
uncompressed sum: 0
Compression: ZLIB
frag count: 0
compressed sum: 0
uncompressed sum: 0
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'romfs-x.squashfs.img'.
Download to address: 0x2000000
Downloading: #################################################
done
Bytes transferred = 1427704 (15c8f8 hex)
do not find BOOT_IMG_NAME!
Erasing update flag partition.
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8

## Checking Image at 02000000 ...
Legacy image found
Image Name: romfs
Created: 2019-11-05 9:03:08 UTC
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 1427640 Bytes = 1.4 MiB
Load Address: 01200000
Entry Point: 01600000
Verifying Checksum ... OK
Programing start at: 0x01200000
write : 100%
done
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
fail to load bootargsParametersV22.txt
fail to load bootargsParametersV21.txt
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'kernel.img'.
Download to address: 0x2000000
Downloading: #################################################
done
Bytes transferred = 1728248 (1a5ef8 hex)
do not find BOOT_IMG_NAME!
Erasing update flag partition.
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8

## Checking Image at 02000000 ...
Legacy image found
Image Name: kernel
Created: 2019-11-05 9:03:06 UTC
Image Type: ARM Linux Firmware (uncompressed)
Data Size: 1728184 Bytes = 1.6 MiB
Load Address: 00c80000
Entry Point: 01200000
Verifying Checksum ... OK
Programing start at: 0x00c80000
write : 100%
done
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
fail to load bootargsParametersV22.txt
fail to load bootargsParametersV21.txt
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'user-x.squashfs.img'.
Download to address: 0x2000000
Downloading: #################################################
done
Bytes transferred = 19536120 (12a18f8 hex)
do not find BOOT_IMG_NAME!
Erasing update flag partition.
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8

## Checking Image at 02000000 ...
Legacy image found
Image Name: user
Created: 2019-11-05 9:03:29 UTC
Image Type: ARM Linux Standalone Program (uncompressed)
Data Size: 19536056 Bytes = 18.6 MiB
Load Address: 01e00000
Entry Point: 03a80000
Verifying Checksum ... OK
Programing start at: 0x01e00000
write : 100%
done
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
fail to load bootargsParametersV22.txt
fail to load bootargsParametersV21.txt
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'web-x.squashfs.img'.
Download to address: 0x2000000
Downloading: #################################################
done
Bytes transferred = 5802232 (5888f8 hex)
do not find BOOT_IMG_NAME!
Erasing update flag partition.
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8

## Checking Image at 02000000 ...
Legacy image found
Image Name: web
Created: 2019-11-05 9:03:11 UTC
Image Type: ARM Linux Standalone Program (uncompressed)
Data Size: 5802168 Bytes = 5.5 MiB
Load Address: 01600000
Entry Point: 01e00000
Verifying Checksum ... OK
Programing start at: 0x01600000
write : 100%
done
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
fail to load bootargsParametersV22.txt
fail to load bootargsParametersV21.txt
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'partition-x.cramfs.img'.
Download to address: 0x2000000
Downloading: #################################################
done
Bytes transferred = 6392 (18f8 hex)
do not find BOOT_IMG_NAME!
Erasing update flag partition.
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8

## Checking Image at 02000000 ...
Legacy image found
Image Name: partition
Created: 2019-11-05 9:03:05 UTC
Image Type: ARM Linux Standalone Program (uncompressed)
Data Size: 6328 Bytes = 6.2 KiB
Load Address: 00500000
Entry Point: 00600000
Verifying Checksum ... OK
Programing start at: 0x00500000
write : 100%
done
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
fail to load bootargsParametersV22.txt
fail to load bootargsParametersV21.txt
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'custom-x.squashfs.img'.
Download to address: 0x2000000
Downloading: #################################################
done
Bytes transferred = 1251576 (1318f8 hex)
do not find BOOT_IMG_NAME!
Erasing update flag partition.
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8

## Checking Image at 02000000 ...
Legacy image found
Image Name: custom
Created: 2019-11-05 9:03:45 UTC
Image Type: ARM Linux Standalone Program (uncompressed)
Data Size: 1251512 Bytes = 1.2 MiB
Load Address: 00600000
Entry Point: 00940000
Verifying Checksum ... OK
Programing start at: 0x00600000
write : 100%
done
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
fail to load bootargsParametersV22.txt
fail to load bootargsParametersV21.txt
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'pd-x.squashfs.img'.
Download to address: 0x2000000
Downloading: #################################################
done
Bytes transferred = 67832 (108f8 hex)
do not find BOOT_IMG_NAME!
Erasing update flag partition.
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8

## Checking Image at 02000000 ...
Legacy image found
Image Name: pd
Created: 2019-11-05 9:03:43 UTC
Image Type: ARM Linux Standalone Program (uncompressed)
Data Size: 67768 Bytes = 66.2 KiB
Load Address: 00940000
Entry Point: 00c80000
Verifying Checksum ... OK
Programing start at: 0x00940000
write : 100%
done
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
fail to load bootargsParametersV22.txt
fail to load bootargsParametersV21.txt
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename '.FLASHING_DONE_STOP_TFTP_NOW'.
Download to address: 0x2000000
Downloading: #
done
do not find BOOT_IMG_NAME!
Erasing update flag partition.
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8

## Checking Image at 02000000 ...
Legacy image found
Image Name: pd
Created: 2019-11-05 9:03:43 UTC
Image Type: ARM Linux Standalone Program (uncompressed)
Data Size: 67768 Bytes = 66.2 KiB
Load Address: 00940000
Entry Point: 00c80000
Verifying Checksum ... OK
Programing start at: 0x00940000
write : 100%
done
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
fail to load bootargsParametersV22.txt
fail to load bootargsParametersV21.txt
partition file version 2
rootfstype squashfs root /dev/mtdblock8
fail to load bootargsParameters.txt
fail to load bootargsParameters.txt file
get bootargs info failed
cmdLine console=ttyS0,115200 mem=198M root=/dev/mtdblock8 rootfstype=squashfs init=/linuxrc
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'success.txt'.
Download to address: 0x2000000
Downloading: *
TFTP error: (0)Erasing Nand...
Erasing at 0x360000 -- 100% complete.
Writing to Nand... unknown core,use back
done
Support backupVer:255
state:5a,err_count:01
can't find uImage
resetting ...
▒

U-Boot 2010.06-svn5213 (Sep 13 2018 - 14:55:04)
I2C: ready
DRAM: 198 MiB
gBootLogPtr:00b80008.
NAND: 128 MiB
amb_nand_read_oob read page:49152 err
Erasing Nand...
Erasing at 0x380000 -- 100% complete.
Writing to Nand...
partition file version 2
rootfstype squashfs root /dev/mtdblock8
fail to load bootargsParametersV22.txt
fail to load bootargsParametersV21.txt
fail to init bootargsParametersV2
TEXT_BASE:01000000
Net: Detected MACID:00:12:34:56:78:9a
PHY:0x001cc816,addr:0x00
s3l phy RTL8201 init

 

[anthonys650]

I have serial connection to it and I ran the two

nana d read 0x2000000 0x300000 0x100000

NAND read: device 0 offset 0x300000, size 0x00100000
ERR: parameter error in nand_read_pages()NAND read from offset 300000 failed -1
nand read error address: 0x300000.
0 bytes read: ERROR

This continuously going.

md 0x2000000 0x1000000

02000000: ea000013 e59ff014 e59ff014 e59ff014 ................
02000010: e59ff014 e59ff014 e59ff014 e59ff014 ................
02000020: 010000e0 01000140 010001a0 01000200 ....@...........

 

[anthonys650]

I completely brick it now

uboot magic is not match.
uboot magic is not match.
Fail to find vaild uboot.

 

[Corellon]

It shouldn't be completely bricked unless you overwrote the bootloader, if you can still get a serial console you can TFTP back the latest firmware, uboot magic might indicate that you flashed an older version that the bootloader doesn't support. But the boot loader itself should still boot.

The syntex of the Nand read might be off since my camera's use the SPI bus, but if you can get it to read 1000000 bytes from 0x3000000 then that would give information on the hardware

 

[anthonys650]

it's not getting a prompt or trying to TFTP, I think it's done.

Before I rebooted it wouldn't let me TFTP.

 

[Corellon]

When you connect it to serial are you getting any input? I find that I have to mash * the moment I connect power to the camera to get it to jump into the boot loader.

Do you get a network link when it's plugged in? do you see any activity over the link?

 

[anthonys650]

Once I plug in the serial outputs
▒uboot magic is not match.
uboot magic is not match.
Fail to find vaild uboot.
I have it connected to my POE Switch and no sign. Also on the board it no longer blinks for activity.

 

[Corellon]

Did you flash the boot loader? That would indicate that the bootloader kernel does not match the required version, the good news is the serial works so likely u-boot-min is still intact to do an initial load, the bad news is that I'm not sure what and how to work with it, perhaps someone more experienced can weight in.

If you have serial then in theory there should be a way to get to at least a very basic shell that would allow you to load the rest of the boot loader into memory or reflash it, I'm just not sure how.

 

[anthonys650]

Thanks for all the advise. I was looking around on how to reflash no luck. Or even if I can boot from sd. At this point I can’t even get a command prompt.
This was one of my last Dahua cameras. I’ve been moving away from Dahua because of the number of cameras failing, plug in for browser, warranty and can’t find the firmware. I’ve been using Reolink and Ubiquiti.

 

[iTuneDVR]

Thanks for all the advise. I was looking around on how to reflash no luck. Or even if I can boot from sd. At this point I can’t even get a command prompt.
This was one of my last Dahua cameras. I’ve been moving away from Dahua because of the number of cameras failing, plug in for browser, warranty and can’t find the firmware. I’ve been using Reolink and Ubiquiti.

You dropped your hands too early.
images exist and on the programmer you can restore the original version.
Of course, you had to first make an existing dump before such experiments, but for some reason you ran forward headlong.

P.S.
Reolink, are you serious?
Ubi - forewer!

 

[anthonys650]

I don't have the bandwidth to spend on it. I prefer hardware that has easy to find firmware, warranty coverage and online support.

 

[iTuneDVR]

I prefer hardware that has easy to find firmware, warranty coverage and online support.

Agree!
But ...

 

[Corellon]

Ubiquiti i would recommend.... Reolink..... eh not really

Dahau did remove the need for plugins for the browser, and I personally find the firmware easy to find and the new versions have a build in update checker on the camera's interface (it's still a little hit or miss but does work)

Sorry to hear about the Camera, if you ever decide to get back into trying it or as ITune said get a re programmer drop a line here.

 

[anthonys650]

Thanks! I’ve look to see if I can use y modem and send the dh-mini-boot.img via serial. No luck.
I might of accidentally wipe out the NAND or the bad sector causing it.

 

[Corellon]

If you can let us know what commands you tried it might help in letting us troubleshoot if your still interested, the whole NAND doesn't seem wiped since the minboot is there, but the uboot partition seems to be.

What did you try between the last time you rebooted the camera and when it stopped working on the next reboot?

 

[anthonys650]

I might of ran nand scrub and nand bad but I didn't have a log of what I've done.

Now if someone can help me with the

uboot magic is not match.
Fail to find vaild uboot.

 

[Corellon]

The only suggestion I can think of at this point would be to see if you can get kermit or another file server running on the host computer and see if when the camera boots it tries to initiate a binary transfer over serial.

There is a slight chance it will either pull or accept a boot image over serial if the main bootloader has failed, but I'm not sure of how to initiate it.

If I had to try something that's where I would start (aside from programming the flash chip with an external tool)

 

[iTuneDVR]

I might of ran nand scrub and nand bad but I didn't have a log of what I've done.

Now if someone can help me with the

uboot magic is not match.
Fail to find vaild uboot.

Nand scrub often leads to sad consequences
Here full original dump for DH-SD1A203T-GN-S2 & boot image files.

DH-SD1A203T-GN-S2_.zip

View and download from Yandex.Disk

yadi.sk