Dahua IPC EASY unbricking / recovery over TFTP

[XrayZ]

How stupid was I when deiced to give another try to update my NVR4104 to the newer version 4. I had issues every time with it, but was able to downgrade NVR back to v3.216. This time even after reading your post I did the same try and got the exact issue you have - it boots up with Dahua logo, then opens 4 squares for 2 seconds and then disconnects the monitor. Ping is OK. But the refuses to connect with Config Utility or any other standard means.
Dear forum gurus - is there any way to recover the NVR from this issue?

I see that problem is with latest 4x
DH_NVR4XXX-4KS2_MultiLang_V4.001.0000000.0.R.200221.bin
(this ROM still bugzy as all 4x Dahua firmware but with additional surprise) when downgrade to last working
DH_NVR4XXX-4KS2_MultiLang_V3.216.0000003.0.R.1905211
because all firmwares that i flash before DH_NVR4XXX-4KS2_MultiLang_V4.001.0000000.0.R.200221.bin back to DH_NVR4XXX-4KS2_MultiLang_V3.216.0000003.0.R.1905211 was SUCCESSFULL.

We have not soldered RS232 connector on our board. NVR is answer on ping. Hope that possible recover it through network.
I had a many troubles with Hikvision earlier, so decide work with Dahua. But now i see that this is also same low level china shit, not for my own use.
Of course i understand that some Dahua products works perfect in simple customer installations.

 

[katcha]

I see that problem is with latest 4x
DH_NVR4XXX-4KS2_MultiLang_V4.001.0000000.0.R.200221.bin
(this ROM still bugzy as all 4x Dahua firmware but with additional surprise) when downgrade to last working
DH_NVR4XXX-4KS2_MultiLang_V3.216.0000003.0.R.1905211
because all firmwares that i flash before DH_NVR4XXX-4KS2_MultiLang_V4.001.0000000.0.R.200221.bin back to DH_NVR4XXX-4KS2_MultiLang_V3.216.0000003.0.R.1905211 was SUCCESSFULL.

We have not soldered RS232 connector on our board. NVR is answer on ping. Hope that possible recover it through network.
I had a many troubles with Hikvision earlier, so decide work with Dahua. But now i see that this is also same low level china shit, not for my own use.
Of course i understand that some Dahua products works perfect in simple customer installations.

Good luck. Please let me know if you were able to recover the NVR. I will try to do some research on my side.

 

[Oleglevsha]

I have flashed DH_IPC-HX5X3X-Rhea_MultiLang_NP_Stream3_Market_V2.800.0000013.0.R.191202 to my IPC-HDBW4631R-ZS and it has bricked my camera! I attempted to use: DH_IPC-HX5X3X-Rhea_Eng_P_Stream3_V2.460.0000.14.R.20170720 provided here on the forums with no luck.. I ALSO run into the "HEADER be changed!" error
[/ QUOTE]
Congratulations, you got the original Chinese IP camera
Now it can only be restored with the Chinese version of the firmware

 

[katcha]

I see that problem is with latest 4x
DH_NVR4XXX-4KS2_MultiLang_V4.001.0000000.0.R.200221.bin
(this ROM still bugzy as all 4x Dahua firmware but with additional surprise) when downgrade to last working
DH_NVR4XXX-4KS2_MultiLang_V3.216.0000003.0.R.1905211
because all firmwares that i flash before DH_NVR4XXX-4KS2_MultiLang_V4.001.0000000.0.R.200221.bin back to DH_NVR4XXX-4KS2_MultiLang_V3.216.0000003.0.R.1905211 was SUCCESSFULL.

We have not soldered RS232 connector on our board. NVR is answer on ping. Hope that possible recover it through network.
I had a many troubles with Hikvision earlier, so decide work with Dahua. But now i see that this is also same low level china shit, not for my own use.
Of course i understand that some Dahua products works perfect in simple customer installations.

I've recovered my NVR via serial connection. It was pain in the butt though. F..king Dahua made with this v4.001 impossible to go back and if you do you screw-up the device.

 

[mythosmc]

Is there a way to read the firmware from a working camera of the same model? I wanted to try and revert it back to English - I think i lose the ability to rotate the picture in the Chinese version!

 

[XrayZ]

I've recovered my NVR via serial connection. It was pain in the butt though.

Which manual you use ? You solder uart connector on plate ?

F..king Dahua made with this v4.001 impossible to go back and if you do you screw-up the device.

Understand now whats a problem. In Ukraine techsupport from Vidimost/Viatek is very stupid

 

[katcha]

Which manual you use ? You solder uart connector on plate ?
Understand now whats a problem. In Ukraine techsupport from Vidimost/Viatek is very stupid

I just found in this forum the pinout of the Dahua camera serial cable here: Dahua IPC unbricking / recovery over serial UART and TFTP
It is the same cable as the NVR. It uses the JST ZH connector. I ordered it on Amazon. In 2 days the NVR was recovered. Thanks to the contributors on this forum. I just used the method to recover a camera to recover my NVR. It worked. Moreover, I when down to version 3.215 instead of v3.216. So now my Chinese HWD4433A-C also works with the NVR.
Good luck.

 

[Bob1v]

Excuse me if I am in the wrong section but my knowledge is limited. Recently I bought a VTO2000 and it came with a 2017 firmware. In my try to set it up I think I flashed a wrong firmware via VDP config and now I don’t even see it in my routers page. Is there a way to fix this mesh without losing another week of my life or should I throw a brand new VTO from the window?

 

[housi001]

Hi!

Hopefully you can help me. My cam is VTH1550CH
When I want to do the update, following goes wrong:


The web-x.cramfs.img is missing - but in every image I found, there is not such a file...
Thank you for your help.

 

[housi001]

Edit:
I have changed the commands.txt from run dw to run dg, now I have this picture...

 

[Relik]

SOLUTION to "Client 192.168.1.xxx:xxxx root\pd-x.squashfs.img, Timeout" (TFTP firmware recovery)

I bought a camera lot on eBay that included an IPC-HDBW1120E-W (960p from 2017), amongst other 1080p & 4K cameras. It was locked to a particular cloud provider and unusable as a standalone camera. Factory defaults would just set it to an admin password that was unknown.

I successfully used the tools on page 1 along with the firmware for the camera (DH_IPC-Consumer-Zi-Themis_EngSpn_N_V2.400.0000000.16.R.20170831.bin) to restore it to a Dahua brand camera. This did not come without difficulty however.

The most important change I would make to the instructions on page 1 is to watch a TFTP update with Console.bat and see the address the camera is loading the files at. In my case it was not 0x82000000, but instead 0x02000000. [Remove everything except the "run" lines from commands.txt to do a successful but non-functional update]

Spoiler: Console log

## Checking Image at 02000000 ...
Legacy image found
Image Name: kernel

...

## Checking Image at 02000000 ...
Legacy image found
Image Name: user

The pd-x.squashfs.img image would always fail to load and the camera would continually load the files in a loop. My solution was to change the loading address and then everything finally took off. Here is the commands.txt that worked for me. I also hex edited the firmware bin so the first two characters were PK instead of DH so extraction worked perfectly (extract in "root" subdirectory). I also had to reset to factory defaults using the reset button after the proper firmware was flashed and booted.

Spoiler: commands.txt

run dr
run dk
run du
run dw
run dp
run dc
tftp 0x02000000 pd-x.squashfs.img
flwrite
tftp 0x02000000 .FLASHING_DONE_STOP_TFTP_NOW
sleep 5

I know, it's a measly 1280x960 camera in 2020, but it's now saved from the trash. Besides, I get so mad at vendors locking hardware this way that I took the time to see how this was done so I can do it on future cameras if necessary.

 

[Relik]

Edit:
I have changed the commands.txt from run dw to run dg, now I have this picture...

Post a directory listing of the root subdirectory that has all extracted firmware files in it, along with your current commands.txt

You should also run Console.bat before plugging in the camera and post the log output it shows here in a spoiler. I'm no expert, but after messing with this for 4 hours last night I have a decent idea how this process works.

 

[Gabe]

Hello IPCam fanatics,

I'm here because I want to convert my Amcrest PTZ camera (IP2M-853EW) to a Dahua. I've tried upgrading to the latest Amcrest firmware and then afterwards upgrading to the latest Dahua firmware through the web gui but that didn't work.

I've also already read this thread and now I'm so close to hitting pay dirt I can taste it!!!

Here is where I'm stuck...as you can see from my tftp server results below I have successfully used the tftp server to interface with the Amcrest camera (All blocks served). When finished executing the commands I get the error message "success.txt, File not found or No Access". Afterwards it begins this process all over again in a loop.

accepting requests..
Open TFTP Server MultiThreaded Version 1.64 Windows Built 2001

starting TFTP...
alias / is mapped to root\
permitted clients: all
server port range: all
max blksize: 65464
default blksize: 512
default timeout: 60
file read allowed: Yes
file create allowed: Yes
file overwrite allowed: Yes
thread pool size: 1
Listening On: 192.168.254.254:69
Client 192.168.1.108:3109 root\upgrade_info_7db780a713a4.txt, 1 Blocks Served
Client 192.168.1.108:3284 root\romfs-x.squashfs.img, 973 Blocks Served
Client 192.168.1.108:1500 root\kernel.img, 1178 Blocks Served
Client 192.168.1.108:3657 root\user-x.squashfs.img, 13308 Blocks Served
Client 192.168.1.108:1345 root\web-x.squashfs.img, 3953 Blocks Served
Client 192.168.1.108:1411 root\partition-x.cramfs.img, 5 Blocks Served
Client 192.168.1.108:2312 root\custom-x.squashfs.img, 853 Blocks Served
Client 192.168.1.108:3187 root\pd-x.squashfs.img, 47 Blocks Served
Client 192.168.1.108:1135 root\.FLASHING_DONE_STOP_TFTP_NOW, 1 Blocks Served
Client 192.168.1.108:3496 root\success.txt, File not found or No Access
Client 192.168.1.108:3106 root\upgrade_info_7db780a713a4.txt, 1 Blocks Served
Client 192.168.1.108:3281 root\romfs-x.squashfs.img, 973 Blocks Served
Client 192.168.1.108:1475 root\kernel.img, 1178 Blocks Served
Client 192.168.1.108:3567 root\user-x.squashfs.img, 13308 Blocks Served

As for the console.bat results below, as far as I can tell the error that I think is relevant is the "failed to load bootTargsParametersV22.txt".

Ncat: Version 7.40 ( https://nmap.org/ncat )
Ncat: Listening on 192.168.254.254:5002
tition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
fail to load bootargsParametersV22.txt
fail to load bootargsParametersV21.txt
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename '.FLASHING_DONE_STOP_TFTP_NOW'.Download to address: 0x2000000
Downloading: #
done
partition file version 2
rootfstype squashfs root /dev/mtdblock8
fail to load bootargsParameters.txt
fail to load bootargsParameters.txt file
get bootargs info failed
cmdLine console=ttyS0,115200 mem=150M root=/dev/mtdblock8 rootfstype=squashfs init=/linuxrc
arella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'romfs-x.squashfs.img'.Download to address: 0x2000000
Downloading: *
done
Bytes transferred = 1427704 (15c8f8 hex)
do not find BOOT_IMG_NAME!
Erasing update flag partition.
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8

## Checking Image at 02000000 ...
   Legacy image found
   Image Name:   romfs
   Created:      2019-11-05   9:00:05 UTC
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    1427640 Bytes = 1.4 MiB
   Load Address: 01200000
   Entry Point:  01600000
   Verifying Checksum ... OK
Programing start at: 0x01200000
write : 100%
done
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
fail to load bootargsParametersV22.txt
fail to load bootargsParametersV21.txt
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'kernel.img'.Download to address: 0x2000000
Downloading: *
done
Bytes transferred = 1728248 (1a5ef8 hex)
do not find BOOT_IMG_NAME!
Erasing update flag partition.
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8

## Checking Image at 02000000 ...
   Legacy image found
   Image Name:   kernel
   Created:      2019-11-05   9:00:03 UTC
   Image Type:   ARM Linux Firmware (uncompressed)
   Data Size:    1728184 Bytes = 1.6 MiB
   Load Address: 00c80000
   Entry Point:  01200000
   Verifying Checksum ... OK
Programing start at: 0x00c80000
write : 100%
done
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
fail to load bootargsParametersV22.txt
fail to load bootargsParametersV21.txt
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'user-x.squashfs.img'.Download to address: 0x2000000
Downloading: *
done
Bytes transferred = 19536120 (12a18f8 hex)
do not find BOOT_IMG_NAME!
Erasing update flag partition.
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8

## Checking Image at 02000000 ...
   Legacy image found
   Image Name:   user
   Created:      2019-11-05   9:00:31 UTC
   Image Type:   ARM Linux Standalone Program (uncompressed)
   Data Size:    19536056 Bytes = 18.6 MiB
   Load Address: 01e00000
   Entry Point:  03a80000
   Verifying Checksum ... OK
Programing start at: 0x01e00000
write : 100%
done
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
fail to load bootargsParametersV22.txt
fail to load bootargsParametersV21.txt
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'web-x.squashfs.img'.Download to address: 0x2000000
Downloading: *
done
Bytes transferred = 5802232 (5888f8 hex)
do not find BOOT_IMG_NAME!
Erasing update flag partition.
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8

## Checking Image at 02000000 ...
   Legacy image found
   Image Name:   web
   Created:      2019-11-05   9:00:09 UTC
   Image Type:   ARM Linux Standalone Program (uncompressed)
   Data Size:    5802168 Bytes = 5.5 MiB
   Load Address: 01600000
   Entry Point:  01e00000
   Verifying Checksum ... OK
Programing start at: 0x01600000
write : 100%
done
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
fail to load bootargsParametersV22.txt
fail to load bootargsParametersV21.txt
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'partition-x.cramfs.img'.Download to address: 0x2000000
Downloading: *
done
Bytes transferred = 6392 (18f8 hex)
do not find BOOT_IMG_NAME!
Erasing update flag partition.
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8

## Checking Image at 02000000 ...
   Legacy image found
   Image Name:   partition
   Created:      2019-11-05   9:00:02 UTC
   Image Type:   ARM Linux Standalone Program (uncompressed)
   Data Size:    6328 Bytes = 6.2 KiB
   Load Address: 00500000
   Entry Point:  00600000
   Verifying Checksum ... OK
Programing start at: 0x00500000
write : 100%
done
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
fail to load bootargsParametersV22.txt
fail to load bootargsParametersV21.txt
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'custom-x.squashfs.img'.Download to address: 0x2000000
Downloading: *
done
Bytes transferred = 1251576 (1318f8 hex)
do not find BOOT_IMG_NAME!
Erasing update flag partition.
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8

## Checking Image at 02000000 ...
   Legacy image found
   Image Name:   custom
   Created:      2019-11-05   9:00:47 UTC
   Image Type:   ARM Linux Standalone Program (uncompressed)
   Data Size:    1251512 Bytes = 1.2 MiB
   Load Address: 00600000
   Entry Point:  00940000
   Verifying Checksum ... OK
Programing start at: 0x00600000
write : 100%
done
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
fail to load bootargsParametersV22.txt
fail to load bootargsParametersV21.txt
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'pd-x.squashfs.img'.Download to address: 0x2000000
Downloading: *
done
Bytes transferred = 67832 (108f8 hex)
do not find BOOT_IMG_NAME!
Erasing update flag partition.
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8

## Checking Image at 02000000 ...
   Legacy image found
   Image Name:   pd
   Created:      2019-11-05   9:00:45 UTC
   Image Type:   ARM Linux Standalone Program (uncompressed)
   Data Size:    67768 Bytes = 66.2 KiB
   Load Address: 00940000
   Entry Point:  00c80000
   Verifying Checksum ... OK
Programing start at: 0x00940000
write : 100%
done
partition file version 2
rootfstype squashfs root /dev/mtdblock8
par

I'm trying to upgrade to the DH_SD-Mao-Rhea_MultiLang_PN_Stream3_IVS_Market_V2.800.0000000.4.R.191105 firmware. I've read that several users have had success with this firmware with these types of PTZ's. When comparing this Dahua firmware to the latest Amcrest firmware, which is loaded on the camera, I noticed the Dahua firmware has three bin files compared to the Armcrest's one bin file. The Dahua's additional bin files are called "Partition.bin" and "Upall_SD-Mao-Rhea.20191105.bin". The "Partition.bin" file is 1KB and the "Upall_SD-Mao-Rhea.20191105.bin" is 135,168 KB's. The latter .bin contains 2 files named "partition.txt" and "partitionV2.txt".

If anyone has any ideas to get me through this last hurdle I would greatly appreciate any help. Thank you

 

[Corellon]

As far as I know "failed to load bootTargsParametersV22.txt" is expected behavior (at least with my lorex camera's) but if you dig around in the BIN files (Maybe not every version) there is a bootargsparametersV22.txt file in them, not 100% how to upload but you can use the relevant section for your camera as additional commands in the commands.txt file to set the variables.

It is also expected behavior that the TFTP would repeat after seeing success.txt... once you see success.txt you should shutdown the TFTP server so it doesn't try to reflash and boots (Hopefully) with the new firmware (Leave the console running).

The line that does stand out to me as odd behavior is "do not find BOOT_IMG_NAME!" I'm not sure that is related to the bootloader in the camera, updating that can be very risky as it would potentially brick the camera without physical intervention, if you intent to do it I would highly suggest not using the run command but updating the uboot only and not the min-boot partition. (Run command updates both)

I would also ask to add the following to the command.txt file (and rerun the .bat) and post the console log as it can give better information

Spoiler: Code

echo help
help
echo printenv
printenv
echo "fatls"
fatls
echo "partition"
partition
echo "bdinfo"
bdinfo
echo "fsinfo"
fsinfo

I would first suggest running it and stopping the TFTP as soon as you see the success.txt line, if it still doesn't boot with the updated firmware then put the above commands in the txt file and post the output. Possibly there are other commands that may need to be run or partitions flashed in order to get it to work.

 

[Gabe]

So I attempted to reflash again and this time I closed tftp before it could begin it's command sequence all over again. Afterwards I waited for the camera to boot up and the GUI was still showing the Amcrest firmware at 192.168.1.108. I'm also getting "success.txt, File not found or No Access". I'm not sure if the "file not found" part of that line means that it was not a "success".

I did run the commands you recommended and here is what was displayed in the console.bat window -

Spoiler: console.bat results

Ncat: Version 7.40 ( Ncat - Netcat for the 21st Century )
Ncat: Listening on 192.168.254.254:5002
gBootLogPtr:00b80008.
NAND: 128 MiB
amb_nand_read_oob read page:49152 err
partition file version 2
rootfstype squashfs root /dev/mtdblock8
fail to load bootargsParametersV22.txt
fail to load bootargsParametersV21.txt
fail to init bootargsParametersV2
TEXT_BASE:01000000
Net: Detected MACID:9c:8e:cd:1c:78:3b
PHY:0x001cc816,addr:0x00
s3l phy RTL8201 init
partition file version 2
rootfstype squashfs root /dev/mtdblock8
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'upgrade_info_7db780a713a4.txt'.Download to address: 0x5000000
Downloading: *
done
Bytes transferred = 191 (bf hex)
? - alias for 'help'
backup - backup - manual backup program.

base - print or set address offset
bdinfo - print Board Info structure
boot - boot default, i.e., run 'bootcmd'
bootd - boot default, i.e., run 'bootcmd'
bootf - boot from flash
bootm - boot application image from memory
bootp - boot image via network using BOOTP/TFTP protocol
cfgRestore- erase config and backup partition.

cmp - memory compare
coninfo - print console devices and information
cp - memory copy
crc32 - checksum calculation
dcache - enable or disable data cache
dhcp - boot image via network using DHCP/TFTP protocol
echo - echo args to console
editenv - edit environment variable
erasepart- erasepart

exit - exit script
false - do nothing, unsuccessfully
flwrite - flwrite - write data into FLASH memory

fsinfo - print information about filesystems
fsload - load binary file from a filesystem image
go - start application at address 'addr'
gpio - gpio test
help - print command description/usage
hwid - hwid - set hardware id and save to flash

i2c - I2C sub-system
icache - enable or disable instruction cache
iminfo - print header information for application image
itest - return true/false on integer compare
kload - kload - load uImage file from parttion

lip - lip - set local ip address but not save to flash

loadb - load binary file over serial line (kermit mode)
loads - load S-Record file over serial line
loady - load binary file over serial line (ymodem mode)
logsend - get log buf
loop - infinite loop on address range
ls - list files in a directory (default /)
mac - mac - set mac address and save to flash

md - memory display
memsize - memsize - set mem size

mii - MII utility commands
mm - memory modify (auto-incrementing address)
mtest - simple RAM read/write test
mw - memory write (fill)
nand - NAND sub-system
nboot - boot from NAND device
nfs - boot image via network using NFS protocol
nm - memory modify (constant address)
partition- print partition information
ping - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
rarpboot- boot image via network using RARP/TFTP protocol
rdefault- rdefault -recover default env

reset - Perform RESET of the CPU
run - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv - set environment variables
showvar - print local hushshell variables
sip - sip - set server ip address but not save to flash

sleep - delay execution for some time
source - run script from memory
sync_uboot- sync_uboot - sync uboot to uboot-bak

test - minimal test like /bin/sh
tftpboot- tftpboot- boot image via network using TFTP protocol
true - do nothing, successfully
uartUp - uartUp- update image via uart using uart4

upmh - mcu heat upgraded
usleep - delay execution for some time
version - print monitor version
bootdelay=3baudrate=115200ipaddr=192.168.1.108serverip=192.168.1.1autoload=yesgatewayip=192.168.1.1netmask=255.255.255.0dh_keyboard=1sysbackup=1logserver=127.0.0.1loglevel=4 autosip=192.168.254.254autolip=192.168.1.108autogw=192.168.1.1autonm=255.255.255.0pd=tftp 0x02000000 pd-x.squashfs.img; flwriteethact=ambarella macda=tftp 0x2000000 dhboot.bin.img; flwrite; tftp dhboot-min.bin.img;nand protect off;flwrite;nand protect ondr=tftp 0x2000000 romfs-x.squashfs.img; flwritedk=tftp 0x2000000 kernel.img; flwritedu=tftp 0x2000000 user-x.squashfs.img; flwritedw=tftp 0x2000000 web-x.squashfs.img; flwriteds=tftp 0x2000000 dsp-x.squashfs.img; flwritedc=tftp 0x2000000 custom-x.squashfs.img; flwritedt=tftp 0x2000000 data-x.squashfs.img; flwritedf=tftp 0x2000000 fpga.img; flwriteup=tftp 0x2000000 update.img; flwritetk=tftp 0x200100 hawthorn.dts.dtb;tftp 0x2000000 uImage;bootm 0x2000000bootcmd=nand read 0x200100 0x60000 0x10000;kload 0x2000000; bootm 0x2000000bootargs=console=ttyS0,115200 mem=150M root=/dev/mtdblock8 rootfstype=squashfs init=/linuxrcHWID=CA-HZ2012T-S2:01:03:04:4A:21:00:01:0E:01:01:04:330:00:00:00:04:00:00:00:00:200:00peripheral=1:140:0:0:0:1:0:00:1:21:0:1ID=AMC0448C9C4E7301C2devalias=IP2M-853Eethaddr=9C:8E:CD:1C:78:3Bappauto=1stdin=serialstdout=serialstderr=serialfilesize=BFfileaddr=5000000
Environment size: 1355/131068 bytes
Unknown command 'fatls' - try 'help'
cmd Failed fatls!
partition file version 2
rootfstype squashfs root /dev/mtdblock8
fail to load bootargsParameters.txt
fail to load bootargsParameters.txt file
get bootargs info failed
cmdLine console=ttyS0,115200 mem=150M root=/dev/mtdblock8 rootfstype=squashfs init=/linuxrc

Thanks for offering you help, I greatly appreciate it!

 

[Corellon]

Did you try relik's solution and replace "run pd" with "tftp 0x02000000 pd-x.squashfs.img"?

Looking at the output I am inclined to think your partition map is corrupted, partition only shows dev/mtdblock8 when it should look something like this:

Spoiler: Partition

MinBoot, 0, 0x0000000000000000, 0x0000000000100000, RW, , , , 0xffffffffffffffff
U-Boot, 0, 0x0000000000200000, 0x0000000000100000, RW, , , , 0x0000000000100000
hwid, 0, 0x0000000000300000, 0x0000000000100000, RW, , , , 0xffffffffffffffff
updateflag, 0, 0x0000000000400000, 0x0000000000100000, RW, , , , 0xffffffffffffffff
partition, 0, 0x0000000000500000, 0x0000000000100000, RW, R, cramfs, , 0x0000000003b80000
custom, 0, 0x0000000000600000, 0x0000000000340000, RW, R, squashfs, "mount /dev/mtdblock5 /mnt/custom/", 0x0000000003c80000
product, 0, 0x0000000000940000, 0x0000000000340000, RW, R, squashfs, "mount /dev/mtdblock6 /mnt/pd/", 0x0000000003fc0000
Kernel, 0, 0x0000000000c80000, 0x0000000000580000, RW, , , , 0x0000000004300000
romfs, 0, 0x0000000001200000, 0x0000000000400000, RW, R, squashfs, , 0x0000000004880000
web, 0, 0x0000000001600000, 0x0000000000800000, RW, R, squashfs, "mount /dev/mtdblock9 /mnt/web/", 0x0000000004c80000
user, 0, 0x0000000001e00000, 0x0000000001c80000, RW, R, squashfs, "mount /dev/mtdblock10 /usr/", 0x0000000005480000
syslog, 0, 0x0000000007200000, 0x0000000000400000, RW, RW, ubi, "/sbin/ubiattach /dev/ubi_ctrl -m 11 \n /sbin/ubimkvol /dev/ubi0 -s 2500000 -N syslog \n mount -t ubifs ubi0_0 /mnt/syslog \n if [ $? -ne 0 ];then \n flash_eraseall /dev/mtd/11 \n /sbin/ubiattach /dev/ubi_ctrl -m 11 \n /sbin/ubimkvol /dev/ubi0 -s 2500000 -N syslog \n mount -t ubifs ubi0_0 /mnt/syslog \n fi ", 0xffffffffffffffff
config, 0, 0x0000000007600000, 0x0000000000400000, RW, RW, ubi, "/sbin/ubiattach /dev/ubi_ctrl -m 12 \n /sbin/ubimkvol /dev/ubi1 -s 2500000 -N config \n mount -t ubifs ubi1_0 /mnt/mtd \n if [ $? -ne 0 ];then \n echo /mnt/config mount fail! >> /mnt/syslog/ubifsLog \n sync \n flash_eraseall /dev/mtd/12 \n /sbin/ubiattach /dev/ubi_ctrl -m 12 \n /sbin/ubimkvol /dev/ubi1 -s 2500000 -N config \n mount -t ubifs ubi1_0 /mnt/mtd \n fi ", 0xffffffffffffffff
backup, 0, 0x0000000007a00000, 0x0000000000400000, RW, RW, ubi, "/sbin/ubiattach /dev/ubi_ctrl -m 13 \n /sbin/ubimkvol /dev/ubi2 -s 2500000 -N backup \n mount -t ubifs ubi2_0 /mnt/backup \n if [ $? -ne 0 ];then \n echo /mnt/backup mount fail! >> /mnt/syslog/ubifsLog \n sync \n flash_eraseall /dev/mtd/13 \n /sbin/ubiattach /dev/ubi_ctrl -m 13 \n /sbin/ubimkvol /dev/ubi2 -s 2500000 -N backup \n mount -t ubifs ubi2_0 /mnt/backup \n fi ", 0xffffffffffffffff
lens, 0, 0x0000000007100000, 0x0000000000100000, RW, , , , 0xffffffffffffffff

I'm not sure if it's a copy/paste error, console error or actual error in the firmware but your bootenvs show pd=tftp 0x02000000 pd-x.squashfs.img; flwriteethact=ambarella macda=tftp 0x2000000 ......
there is a stray ethact=ambarella mac thrown in in the middle of the pd definition, if that is in the firmware I suspect it could cause run pd to fail as the flwrite command is set as flwriteethact=ambarella mac which is invalid (Replacing run pd with relik's solution would fix this too), I also noticed there is no dp= definition but run dp seems to work, again it's partition related.

You could try putting run dp at as the first run in the command.txt, or replace it with "tftp 0x02000000partition-x.cramfs.img; flwrite"

Do you only have the single camera or is there another camera that you didn't flash that you could run just the information commands on to do a comparison?

 

[Gabe]

I did use relik's solution because I was having issues with the camera taking some commands at first. So instead of using run commands for any of the files I did each command beginning with "tftp...". Here's are my command file contents -

Spoiler: command.txt

tftp 0x02000000 romfs-x.squashfs.img
flwrite
tftp 0x02000000 kernel.img
flwrite
tftp 0x02000000 user-x.squashfs.img
flwrite
tftp 0x02000000 web-x.squashfs.img
flwrite
tftp 0x02000000 partition-x.cramfs.img
flwrite
tftp 0x02000000 custom-x.squashfs.img
flwrite
tftp 0x02000000 pd-x.squashfs.img
flwrite
tftp 0x02000000 .FLASHING_DONE_STOP_TFTP_NOW
sleep 5

 

[Corellon]

The other post where it says no access is normal, it's attempting to write success.txt back to the tftp server, one person did say they had a similar issue and had to make a blank success.txt file for it to work, maybe give that a try? (I've never needed it myself). The commands look right, but the partition being spit back still seems off, it should show way more then 1 partition. Could try rearranging the write commands, I like to have the commands in one line so if the tftp fails the flwrite doesn't go wrong: "tftp 0x2000000 dsp-x.squashfs.img; flwrite" the ; separates the commands.

I would also suggest maybe trying a later armcrest firmware first or an earlier Dahau firmware, I'm doing a comparison of the output from your console and the partitionV2.txt file from the firmware package, it might not be related but there are discrepancies which indicate to me that the partition structure was likely changed between patches (this might need a new bootloader but I'm not sure)

Spoiler: Partition Compare

Partition Firmware Start Address TFTP Write Address
MinBoot, 0x0000000000000000, Not Updated
U-Boot, 0x0000000000200000, Not Updated
hwid, 0x0000000000300000, Not Updated
updateflag, 0x0000000000400000, Not Updated (But cleared?)
partition, 0x0000000000500000, 00500000 (SAME)
custom, 0x0000000000600000, 00600000 (SAME)
product, 0x0000000000940000, 00940000 (SAME)
Kernel, 0x0000000000c80000, 00c80000 (SAME)
romfs, 0x0000000001200000, 01200000 (SAME)
web, 0x0000000001a00000, 01600000 (Different)
user, 0x0000000002200000, 01e00000 (Different)
syslog, 0x0000000007200000, Not Updated
config, 0x0000000007600000, Not Updated
backup, 0x0000000007a00000, Not Updated

The file offset between Web and User is identical (80000) in both versions, so I suspect at some point in the firmware the ROMFS partition ran out of space and they enlarged it pushing all the other partitions back, I suspect that is why things work but don't work.... You update the ROM as the first partition, it overwrites some of the WEB partition but then when you update the web partition it sets it back to normal (since it writes to the old address) I'm surprised the camera still functions if that's the case, there is some buffer but some part of the ROM must be being corrupted.

I'm afraid I don't have much I can think of at this time, everything else I can think of is risky and has a chance of bricking the camera. I will list suggestions in the order I feel is least risky but can offer no promises that it will not brick the camera
Flash just the partition image, let it complete then power down, then start flashing the other partitions and see if it gives the new start addresses (I would start by flashing in the order listed by address (Partition, Custom, Product (pd) Kernal, ROMFS, Web and then user) (This should be safe, but worst case scenario might break the web interface and some functionality, rendering the camera "dead" until a good flash is done, but not "bricked" with a bad bootloader)
or
You can try updating the bootloader but there's no going back after that point
or
You can try the all in one update "run up", you might need to rename the "Upall_SD-Mao-Rhea.20191105.bin" file that was in the zip file to match what it is looking for (This will likely update the bootloader as well)

 

[Gabe]

Okay I changed the command file to include the semicolon before the flwrite command to make sure there wasn't going to be an issue with that. I also did your first and least risky solution which was flashing the partition bin only and then reflashing the rest of the commands after a camera reboot. This appears to have had no effect on the camera, same as before. The camera's GUI and other functions are still working as far as I can tell. Below are the console results after each flashing attempt. I don't want to risk going any further as far as updating the bootloader or the "run up" command. If this camera was a cheap $60 Amcrest I would try those things but this cam is a little on the expensive side. Thanks for helping out, I don't want to quit now but it looks like I'll be forced to with this stingy Amcrest V2.623.00AC004.0.R firmware.

Spoiler: partition only results

Ncat: Version 7.40 ( Ncat - Netcat for the 21st Century )
Ncat: Listening on 192.168.254.254:5002
gBootLogPtr:00b80008.
NAND: 128 MiB
amb_nand_read_oob read page:49152 err
partition file version 2
rootfstype squashfs root /dev/mtdblock8
fail to load bootargsParametersV22.txt
fail to load bootargsParametersV21.txt
fail to init bootargsParametersV2
TEXT_BASE:01000000
Net: Detected MACID:9c:8e:cd:1c:78:3b
PHY:0x001cc816,addr:0x00
s3l phy RTL8201 init
partition file version 2
rootfstype squashfs root /dev/mtdblock8
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'upgrade_info_7db780a713a4.txt'.Download to address: 0x5000000
Downloading: *
done
Bytes transferred = 164 (a4 hex)
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'partition-x.cramfs.img'.Download to address: 0x2000000
Downloading: *
done
Bytes transferred = 6392 (18f8 hex)
do not find BOOT_IMG_NAME!
Erasing update flag partition.
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8

## Checking Image at 02000000 ...
Legacy image found
Image Name: partition
Created: 2019-11-05 9:00:02 UTC
Image Type: ARM Linux Standalone Program (uncompressed)
Data Size: 6328 Bytes = 6.2 KiB
Load Address: 00500000
Entry Point: 00600000
Verifying Checksum ... OK
Programing start at: 0x00500000
write : 100%
done
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
fail to load bootargsParametersV22.txt
fail to load bootargsParametersV21.txt
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename '.FLASHING_DONE_STOP_TFTP_NOW'.Download to address: 0x2000000
Downloading: #
done
partition file version 2
rootfstype squashfs root /dev/mtdblock8
fail to load bootargsParameters.txt
fail to load bootargsParameters.txt file
get bootargs info failed
cmdLine console=ttyS0,115200 mem=150M root=/dev/mtdblock8 rootfstype=squashfs init=/linuxrc

Spoiler: remaining flashes

Ncat: Version 7.40 ( Ncat - Netcat for the 21st Century )
Ncat: Listening on 192.168.254.254:5002
gBootLogPtr:00b80008.
NAND: 128 MiB
amb_nand_read_oob read page:49152 err
Erasing Nand...
Erasing at 0x380000 -- 100% complete.
Writing to Nand...
partition file version 2
rootfstype squashfs root /dev/mtdblock8
fail to load bootargsParametersV22.txt
fail to load bootargsParametersV21.txt
fail to init bootargsParametersV2
TEXT_BASE:01000000
Net: Detected MACID:9c:8e:cd:1c:78:3b
PHY:0x001cc816,addr:0x00
s3l phy RTL8201 init
partition file version 2
rootfstype squashfs root /dev/mtdblock8
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'upgrade_info_7db780a713a4.txt'.Download to address: 0x5000000
Downloading: *
done
Bytes transferred = 378 (17a hex)
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'custom-x.squashfs.img'.Download to address: 0x2000000
Downloading: *
done
Bytes transferred = 1251576 (1318f8 hex)
do not find BOOT_IMG_NAME!
Erasing update flag partition.
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8

## Checking Image at 02000000 ...
Legacy image found
Image Name: custom
Created: 2019-11-05 9:00:47 UTC
Image Type: ARM Linux Standalone Program (uncompressed)
Data Size: 1251512 Bytes = 1.2 MiB
Load Address: 00600000
Entry Point: 00940000
Verifying Checksum ... OK
Programing start at: 0x00600000
write : 100%
done
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
fail to load bootargsParametersV22.txt
fail to load bootargsParametersV21.txt
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'pd-x.squashfs.img'.Download to address: 0x2000000
Downloading: *
done
Bytes transferred = 67832 (108f8 hex)
do not find BOOT_IMG_NAME!
Erasing update flag partition.
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8

## Checking Image at 02000000 ...
Legacy image found
Image Name: pd
Created: 2019-11-05 9:00:45 UTC
Image Type: ARM Linux Standalone Program (uncompressed)
Data Size: 67768 Bytes = 66.2 KiB
Load Address: 00940000
Entry Point: 00c80000
Verifying Checksum ... OK
Programing start at: 0x00940000
write : 100%
done
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
fail to load bootargsParametersV22.txt
fail to load bootargsParametersV21.txt
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'kernel.img'.Download to address: 0x2000000
Downloading: *
done
Bytes transferred = 1728248 (1a5ef8 hex)
do not find BOOT_IMG_NAME!
Erasing update flag partition.
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8

## Checking Image at 02000000 ...
Legacy image found
Image Name: kernel
Created: 2019-11-05 9:00:03 UTC
Image Type: ARM Linux Firmware (uncompressed)
Data Size: 1728184 Bytes = 1.6 MiB
Load Address: 00c80000
Entry Point: 01200000
Verifying Checksum ... OK
Programing start at: 0x00c80000
write : 100%
done
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
fail to load bootargsParametersV22.txt
fail to load bootargsParametersV21.txt
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'romfs-x.squashfs.img'.Download to address: 0x2000000
Downloading: *
done
Bytes transferred = 1427704 (15c8f8 hex)
do not find BOOT_IMG_NAME!
Erasing update flag partition.
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8

## Checking Image at 02000000 ...
Legacy image found
Image Name: romfs
Created: 2019-11-05 9:00:05 UTC
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 1427640 Bytes = 1.4 MiB
Load Address: 01200000
Entry Point: 01600000
Verifying Checksum ... OK
Programing start at: 0x01200000
write : 100%
done
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
fail to load bootargsParametersV22.txt
fail to load bootargsParametersV21.txt
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'web-x.squashfs.img'.Download to address: 0x2000000
Downloading: *
done
Bytes transferred = 5802232 (5888f8 hex)
do not find BOOT_IMG_NAME!
Erasing update flag partition.
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8

## Checking Image at 02000000 ...
Legacy image found
Image Name: web
Created: 2019-11-05 9:00:09 UTC
Image Type: ARM Linux Standalone Program (uncompressed)
Data Size: 5802168 Bytes = 5.5 MiB
Load Address: 01600000
Entry Point: 01e00000
Verifying Checksum ... OK
Programing start at: 0x01600000
write : 100%
done
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
fail to load bootargsParametersV22.txt
fail to load bootargsParametersV21.txt
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'user-x.squashfs.img'.Download to address: 0x2000000
Downloading: *
done
Bytes transferred = 19536120 (12a18f8 hex)
do not find BOOT_IMG_NAME!
Erasing update flag partition.
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8

## Checking Image at 02000000 ...
Legacy image found
Image Name: user
Created: 2019-11-05 9:00:31 UTC
Image Type: ARM Linux Standalone Program (uncompressed)
Data Size: 19536056 Bytes = 18.6 MiB
Load Address: 01e00000
Entry Point: 03a80000
Verifying Checksum ... OK
Programing start at: 0x01e00000
write : 100%
done
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
partition file version 2
rootfstype squashfs root /dev/mtdblock8
fail to load bootargsParametersV22.txt
fail to load bootargsParametersV21.txt
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename '.FLASHING_DONE_STOP_TFTP_NOW'.Download to address: 0x2000000
Downloading: #
done
partition file version 2
rootfstype squashfs root /dev/mtdblock8
fail to load bootargsParameters.txt
fail to load bootargsParameters.txt file
get bootargs info failed
cmdLine console=ttyS0,115200 mem=150M root=/dev/mtdblock8 rootfstype=squashfs init=/linuxrc

 

[Corellon]

Ok last thing I can think of, I found on Dahua's site: DH_SD-Mao-Rhea_MultiLang_NP_Stream3_IVS_V2.623.0000000.7.R.181124 and the partition structure exactly matches yours. As I suspected between 2.623 and 2.800 there was a partition resizing.

As a baby step, try converting to that firmware as it should be near 1:1 with what you have, if it works then you can progress using the dahua chain (I can't find versions in between but they likely exist, otherwise you can do a inplace upgrade from the dahua web interface (but this will update the bootloader too, but should be safe(ish) if it took the dahau 2.263 firmware.