Bricked IPC-HDW3849H-AS-PV-S3

D

damiannet

n3wb
Oct 19, 2022
8
2
Warrington
Hi everyone!


I’m dealing with a bricked camera issue.
The camera is an IPC-HDW3849H-AS-PV-S3. It had been working flawlessly for many years. Three days ago, I disconnected it because I needed to move a switch to a different location. Unfortunately, after reconnecting it, the camera stopped working.

On the NVR and in the web interface, I get the message:
“Fail to start camera. Fix it by ConfigTool.”

I can still see the camera on the network, and ConfigTool is able to detect it as well, but the firmware version has changed to 0.000.0. I tried uploading new firmware to the camera via ConfigTool, but nothing changed.

The issue occurs regardless of whether the camera is powered via PoE or 12V

Has anyone encountered something like this?


Have a nice day!
 

Attachments

  • Zrzut ekranu 2026-03-20 153220.png
    Zrzut ekranu 2026-03-20 153220.png
    15.5 KB · Views: 16
  • Zrzut ekranu 2026-03-20 155541.png
    Zrzut ekranu 2026-03-20 155541.png
    49.9 KB · Views: 16
  • Zrzut ekranu 2026-03-22 091324.png
    Zrzut ekranu 2026-03-22 091324.png
    73.2 KB · Views: 16
damiannet said:
Hi everyone!


I’m dealing with a bricked camera issue.
The camera is an IPC-HDW3849H-AS-PV-S3. It had been working flawlessly for many years. Three days ago, I disconnected it because I needed to move a switch to a different location. Unfortunately, after reconnecting it, the camera stopped working.

On the NVR and in the web interface, I get the message:
“Fail to start camera. Fix it by ConfigTool.”

I can still see the camera on the network, and ConfigTool is able to detect it as well, but the firmware version has changed to 0.000.0. I tried uploading new firmware to the camera via ConfigTool, but nothing changed.

The issue occurs regardless of whether the camera is powered via PoE or 12V

Has anyone encountered something like this?


Have a nice day!
Click to expand...
“Fail to start camera. Fix it by ConfigTool." error can be caused by different issues in the firmware or boot loader or TPM.
You will need to get this serviced by Dahua Technology in your region.

The config tool used to fix this is not available to the public for security reasons regarding TPM signing.

www.dahuasecurity.com

Contact Us

Contact Us
www.dahuasecurity.com www.dahuasecurity.com
 
  • Like
  • Love
Reactions: bigredfish and Flintstone61
DahuaTechnicalMan said:
“Fail to start camera. Fix it by ConfigTool." error can be caused by different issues in the firmware or boot loader or TPM.
You will need to get this serviced by Dahua Technology in your region.

The config tool used to fix this is not available to the public for security reasons regarding TPM signing.

www.dahuasecurity.com

Contact Us

Contact Us
www.dahuasecurity.com www.dahuasecurity.com
Click to expand...
Hello Did you ever get this sorted?
 
manish121 said:
Hello Did you ever get this sorted?
Click to expand...
Hi. I tried to upload new firmware through TFTP. Unfortunately, it always stopped at the same point and asked for the file boot-mini.img. I couldn’t find that file anywhere, and after a while I uploaded a file from a different camera version instead… and now the camera doesn’t even respond to ping anymore.
UART is the only option left, but I’ve never done it before. I bought an adapter and promised myself that one day I’d learn how to do it properly, at least for my own experience. The problem is that I still can’t find the correct firmware file. This camera is already a few years old, so working on it is really just a way for me to improve my skills.

Have a good day
 
manish121 said:
Hello Did you ever get this sorted?
Click to expand...
I've done it multiple times - but that's because I work for Dahua and can access the software tools/files.
This is not a task you can do on your own. The software is internal use only.

damiannet said:
his camera is already a few years old, so working on it is really just a way for me to improve my skills.
Click to expand...
Contact your regional Dahua office If it's still under warranty and bought through your authorised regional channels.

support

support.dahuasecurity.com support.dahuasecurity.com
 
  • Like
Reactions: bigredfish
I am stuck as the camera was already in the house when we bought it,

I have finally got a UART cable could you at least help with the pin layout to confirm I am connecting to the right pads, I have one square pad and three round pads.

Also I cannot interrupt the boot with key combo to interrupt the boot process I have tried *, ctrl b, ctrl c, esq, enter. here is my output so far, concerned about the garbage characters after UBOOT

I have not been able to interrupt quick enough.

I have the latest and previous firmware this is the one that i am attempting to flash, I did try TFTP server and this can upload most file but still i am in a boot loop when the camera fires up. Any help or guidance would be appreciated even if that means sending back to Dahua but dont know as did not buy it.


1) DH_IPC-HX3XXX-Taurus_MultiLang_PN_Stream3_V3.120.0000000.34.R.230715.zip

dahua.jpg
Code: 
System startup
SPI Nand ID Table Version 2.7
SPI Nand(cs 0) ID: 0xc2 0x14 0x3 Name:"MX35LF1G24AD"
allowed version 00000000, major=0, minor=0
device support otp.
Otp version is 0x00000000, Flash version is 0x00000000
Otp version is 0x00000000, Flash version is 0x00000000
UBOOT_commonSwRsaVerify run successfully!
������/�|���





System startup
SPI Nand ID Table Version 2.7
SPI Nand(cs 0) ID: 0xc2 0x14 0x3 Name:"MX35LF1G24AD"
allowed version 00000000, major=0, minor=0
device support otp.
Otp version is 0x00000000, Flash version is 0x00000000
Otp version is 0x00000000, Flash version is 0x00000000
UBOOT_commonSwRsaVerify run successfully!
������/�|���





System startup
SPI Nand ID Table Version 2.7
SPI Nand(cs 0) ID: 0xc2 0x14 0x3 Name:"MX35LF1G24AD"
allowed version 00000000, major=0, minor=0
device support otp.
Otp version is 0x00000000, Flash version is 0x00000000
Otp version is 0x00000000, Flash version is 0x00000000
UBOOT_commonSwRsaVerify run successfully!
������/�|���





System startup
SPI Nand ID Table Version 2.7
SPI Nand(cs 0) ID: 0xc2 0x14 0x3 Name:"MX35LF1G24AD"
allowed version 00000000, major=0, minor=0
device support otp.
Otp version is 0x00000000, Flash version is 0x00000000
Otp version is 0x00000000, Flash version is 0x00000000
UBOOT_commonSwRsaVerify run successfully!
������/�|���





System startup
SPI Nand ID Table Version 2.7
SPI Nand(cs 0) ID: 0xc2 0x14 0x3 Name:"MX35LF1G24AD"
allowed version 00000000, major=0, minor=0
device support otp.
Otp version is 0x00000000, Flash version is 0x00000000
Otp version is 0x00000000, Flash version is 0x00000000
UBOOT_commonSwRsaVerify run successfully!
������/�|���





System startup
SPI Nand ID Table Version 2.7
SPI Nand(cs 0) ID: 0xc2 0x14 0x3 Name:"MX35LF1G24AD"
allowed version 00000000, major=0, minor=0
device support otp.
Otp version is 0x00000000, Flash version is 0x00000000
Otp version is 0x00000000, Flash version is 0x00000000
UBOOT_commonSwRsaVerify run successfully!
������/�|���



Booting Linux on physical CPU 0x0
Linux version 4.9.37 (jenkins@b52cb075c3e2) (gcc version 6.3.0 (HC&C V100R002C00B021_20180917) ) #2 SMP Thu Apr 14 16:03:41 CST 2022
CPU: ARMv7 Processor [410fc075] revision 5 (ARMv7), cr=10c5387d
CPU: div instructions available: patching division code
CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
OF: fdt:Machine model: Hisilicon HI3516CV500 DEMO Board
cma zone is not set!
Memory policy: Data cache writealloc
percpu: Embedded 12 pages/cpu @ced30000 s17740 r8192 d23220 u49152
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 60900
Kernel command line: mem=240M console=ttyS0,115200 root=/dev/mtdblock14 rootfstype=squashfs
PID hash table entries: 1024 (order: 0, 4096 bytes)
Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
Memory: 238420K/245760K available (2891K kernel code, 112K rwdata, 720K rodata, 192K init, 193K bss, 7340K reserved, 0K cma-reserved, 0K highmem)
Virtual kernel memory layout:
    vector  : 0xffff0000 - 0xffff1000   (   4 kB)
    fixmap  : 0xffc00000 - 0xfff00000   (3072 kB)
    vmalloc : 0xcf800000 - 0xff800000   ( 768 MB)
    lowmem  : 0xc0000000 - 0xcf000000   ( 240 MB)
    pkmap   : 0xbfe00000 - 0xc0000000   (   2 MB)
    modules : 0xbe800000 - 0xbfe00000   (  22 MB)
      .text : 0xc0008000 - 0xc02db214   (2893 kB)
      .init : 0xc03aa000 - 0xc03da000   ( 192 kB)
      .data : 0xc03da000 - 0xc03f6300   ( 113 kB)
       .bss : 0xc03f8000 - 0xc0428700   ( 194 kB)
SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
Hierarchical RCU implementation.
        Build-time adjustment of leaf fanout to 32.
NR_IRQS:16 nr_irqs:16 16
Gic dist init...
arm_arch_timer: Architected cp15 timer(s) running at 50.00MHz (phys).
clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0xb8812736b, max_idle_ns: 440795202655 ns
sched_clock: 56 bits at 50MHz, resolution 20ns, wraps every 4398046511100ns
Switching to timer-based delay loop, resolution 20ns
clocksource: hisp804: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 637086815595 ns
Calibrating delay loop (skipped), value calculated using timer frequency.. 100.00 BogoMIPS (lpj=500000)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
CPU: Testing write buffer coherency: ok
OMAP_PLATFORM_SUPPORT driver
CPU0: thread -1, cpu 0, socket 0, mpidr 80000000
Setting up static identity map for 0x80008280 - 0x800082d8
CPU1: thread -1, cpu 1, socket 0, mpidr 80000001
Brought up 2 CPUs
SMP: Total of 2 processors activated (200.00 BogoMIPS).
CPU: All CPU(s) started in SVC mode.
devtmpfs: initialized
VFP support v0.3: implementor 41 architecture 2 part 30 variant 7 rev 5
clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
futex hash table entries: 512 (order: 3, 32768 bytes)
pinctrl core: initialized pinctrl subsystem
NET: Registered protocol family 16
DMA: preallocated 256 KiB pool for atomic coherent allocations
Serial: AMBA PL011 UART driver
120a0000.uart: ttyS0 at MMIO 0x120a0000 (irq = 24, base_baud = 0) is a PL011 rev2
console [ttyS0] enabled
120a1000.uart: ttyS1 at MMIO 0x120a1000 (irq = 25, base_baud = 0) is a PL011 rev2
120a2000.uart: ttyS2 at MMIO 0x120a2000 (irq = 26, base_baud = 0) is a PL011 rev2
120a3000.uart: ttyS3 at MMIO 0x120a3000 (irq = 27, base_baud = 0) is a PL011 rev2
120a4000.uart: ttyS4 at MMIO 0x120a4000 (irq = 28, base_baud = 0) is a PL011 rev2
clocksource: Switched to clocksource hisp804
NET: Registered protocol family 2
TCP established hash table entries: 2048 (order: 1, 8192 bytes)
TCP bind hash table entries: 2048 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
UDP hash table entries: 256 (order: 1, 8192 bytes)
UDP-Lite hash table entries: 256 (order: 1, 8192 bytes)
NET: Registered protocol family 1
workingset: timestamp_bits=14 max_order=16 bucket_order=2
squashfs: version 4.0 (2009/01/31) Phillip Lougher
safe_abn_init : Failed to open /proc/net/sockstat
safe_abn_init : Failed to open /proc/net/sockstat6
Block layer SCSI generic (bsg) driver version 0.4 loaded (major 253)
io scheduler noop registered
io scheduler deadline registered (default)
io scheduler cfq registered
dgs mem addr: 0x8ef7c000,mem len :0x2000
Dahua read-only mtdblock
SPI Nand ID Table Version 2.7
SPI Nand(cs 0) ID: 0xc2 0x14 0x3
nand: device found, Manufacturer ID: 0xc2, Chip ID: 0x14
nand: Macronix MX35LF1G24AD
nand: 128MiB, SLC, page size: 2048
Nand(Auto): OOB:64B
ECC:8bit/512 nand:  ECC provided by Flash Memory Controller
CONFIG_MTD_CMDLINE_PARTS
Creating 16 MTD partitions on "hinand":
0x000000000000-0x000000100000 : "mini-Boot"
0x000000200000-0x000000300000 : "U-Boot"
0x000000300000-0x000000400000 : "updateflag"
0x000000400000-0x000000480000 : "hwid"
0x000000480000-0x000000a80000 : "config"
0x000000a80000-0x000001080000 : "backup"
0x000001080000-0x000001680000 : "syslog"
0x000001680000-0x000001700000 : "partition"
0x000001700000-0x000001800000 : "dgs"
0x000001800000-0x000001a00000 : "kernel_min"
0x000001f00000-0x000002500000 : "appdata"
0x000002500000-0x000002900000 : "Kernel"
0x000002900000-0x000005200000 : "romfs"
0x000005200000-0x000008000000 : "firmware"
0x000001a00000-0x000001e80000 : "romfs_min"
0x000001e80000-0x000001f00000 : "bakpart"
hisi_femac_get_phy_addr: No valid PHY device node!
mdio@:0x0 get phy, id:0x1cc816
mdio@:0x1 get phy, id:0x1cc816
multi mode smi is busy
ret = 0x0, phy_addr = 0x1d, read_data1 = 0xffff, read_data2 = 0xffff
libphy: hisimii: probed
multi mode smi is busy
multi mode smi is busy
multi mode smi is busy
ret = 0x0, phy_addr = 0x1d, read_data1 = 0xffff, read_data2 = 0xffff
libphy: Fixed MDIO Bus: probed
init 8306
find phydev = hisimii:01!
Generic PHY hisimii:01: attached PHY driver [Generic PHY] (mii_bus:phy_addr=hisimii:01, irq=-1)
phy_id=0x001cc816, phy_mode=rmii
hisi-femac 10010000.ethernet: using random MAC address 2e:f1:64:93:fe:39
i2c /dev entries driver
hibvt-i2c 120b0000.i2c: hibvt-i2c0@100000hz registered
hibvt-i2c 120b1000.i2c: hibvt-i2c1@100000hz registered
hibvt-i2c 120b2000.i2c: hibvt-i2c2@100000hz registered
hibvt-i2c 120b3000.i2c: hibvt-i2c3@100000hz registered
hibvt-i2c 120b5000.i2c: hibvt-i2c5@100000hz registered
hibvt-i2c 120b6000.i2c: hibvt-i2c6@100000hz registered
hibvt-i2c 120b7000.i2c: hibvt-i2c7@100000hz registered
NET: Registered protocol family 17
8021q: 802.1Q VLAN Support v1.8
Registering SWP/SWPB emulation handler
[DGSK]:Dgs_DrvCreate start7
List of all partitions:
1f00            1024 mtdblock0  (driver?)
1f01            1024 mtdblock1  (driver?)
1f02            1024 mtdblock2  (driver?)
1f03             512 mtdblock3  (driver?)
1f04            6144 mtdblock4  (driver?)
1f05            6144 mtdblock5  (driver?)
1f06            6144 mtdblock6  (driver?)
1f07             512 mtdblock7  (driver?)
1f08            1024 mtdblock8  (driver?)
1f09            2048 mtdblock9  (driver?)
1f0a            6144 mtdblock10  (driver?)
1f0b            4096 mtdblock11  (driver?)
1f0c           41984 mtdblock12  (driver?)
1f0d           47104 mtdblock13  (driver?)
1f0e            4608 mtdblock14  (driver?)
1f0f             512 mtdblock15  (driver?)
No filesystem could mount root, tried:  squashfs

Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(31,14)
CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.9.37 #2
Hardware name: Generic DT based system
[<c0015204>] (unwind_backtrace) from [<c0011b88>] (show_stack+0x10/0x14)
[<c0011b88>] (show_stack) from [<c01a39f8>] (dump_stack+0x7c/0x98)
[<c01a39f8>] (dump_stack) from [<c008ae30>] (panic+0xd0/0x24c)
[<c008ae30>] (panic) from [<c03ab224>] (mount_block_root+0x27c/0x370)
[<c03ab224>] (mount_block_root) from [<c03ab4dc>] (prepare_namespace+0x154/0x194)
[<c03ab4dc>] (prepare_namespace) from [<c03aadb4>] (kernel_init_freeable+0x16c/0x1d4)
[<c03aadb4>] (kernel_init_freeable) from [<c02d5570>] (kernel_init+0x8/0xf0)
[<c02d5570>] (kernel_init) from [<c000ed48>] (ret_from_fork+0x14/0x2c)
CPU1: stopping
CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.9.37 #2
Hardware name: Generic DT based system
[<c0015204>] (unwind_backtrace) from [<c0011b88>] (show_stack+0x10/0x14)
[<c0011b88>] (show_stack) from [<c01a39f8>] (dump_stack+0x7c/0x98)
[<c01a39f8>] (dump_stack) from [<c00144e4>] (handle_IPI+0xdc/0x184)
[<c00144e4>] (handle_IPI) from [<c000943c>] (gic_handle_irq+0x78/0x94)
[<c000943c>] (gic_handle_irq) from [<c0012f78>] (__irq_svc+0x58/0x74)
Exception stack(0xce86df98 to 0xce86dfe0)
df80:                                                       00000000 00000562
dfa0: ced3e31c c001a380 ce86c000 c03dcfe4 00000002 c03dd038 8000406a 410fc075
dfc0: 00000000 00000000 00000000 ce86dfe8 c000f744 c000f734 60000013 ffffffff
[<c0012f78>] (__irq_svc) from [<c000f734>] (arch_cpu_idle+0x1c/0x38)
[<c000f734>] (arch_cpu_idle) from [<c0052c80>] (cpu_startup_entry+0xc4/0x110)
[<c0052c80>] (cpu_startup_entry) from [<800094ec>] (0x800094ec)
---[ end Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(31,14)
 
Last edited:
You must log in or register to reply here.
Top Bottom