Dahua Firmware Mod Kit + Modded Dahua Firmware

C

cor35vet

IPCT Contributor
Jun 23, 2016
337
247
Hi,

I've been hacking around with my Dahua camera and made a script to unpack and rebuild the firmware upgrade images.
Check out the Github for more info: GitHub - BotoX/Dahua-Firmware-Mod-Kit: Unpack and repack Dahua IP camera firmware upgrade images.

Give me firmware for my camera!
You can download the firmware image that fits your camera below and flash it to your camera or unpack and modify it more.
It will work on both Chinese and international models.
International cameras can flash back to official English firmware after using my modded firmware.
Chinese cameras will never work with official English firmware - they need to be patched.

For IPC-HX4XXX-Eos ("Eco-savvy 2.0" 3rd gen) cameras:
Software Version: 2.420.0000.22.R, Build Date: 2016-12-09
MD5Sum: 1332430392def5d9becd4e883d26f7d8
SHASum: 1bc476b78fd706b225243c12a334631971ea6a7c

Compatible cameras according to Dahua:
DH-IPC-HDBW4231R,DH-IPC-HDBW4236R
DH-IPC-HDBW4431R,DH-IPC-HDBW4436R
DH-IPC-HDW4231C-A,DH-IPC-HDW4236C-A
DH-IPC-HDW4233C-A,DH-IPC-HDW4238C-A
DH-IPC-HDW4431C-A,DH-IPC-HDW4436C-A
DH-IPC-HDBW4431R-S,DH-IPC-HDBW4436R-S
DH-IPC-HDBW4233R-AS,DH-IPC-HDBW4238R-S
DH-IPC-HDBW4231R-AS,DH-IPC-HDBW4236R-AS
DH-IPC-HDBW4431R-AS,DH-IPC-HDBW4436R-AS
DH-IPC-HDBW4231R-VF,DH-IPC-HDBW4431R-VF
DH-IPC-HFW4231F,DH-IPC-HFW4236F,DH-IPC-HFW4431F,DH-IPC-HFW4436F
DH-IPC-HFW4231B,DH-IPC-HFW4236B,DH-IPC-HFW4431B,DH-IPC-HFW4436B
DH-IPC-HFW4231D,DH-IPC-HFW4236D,DH-IPC-HFW4431D,DH-IPC-HFW4436D
DH-IPC-HFW4231R-Z,DH-IPC-HFW4431R-Z,DH-IPC-HFW4231R-VF,DH-IPC-HFW4431R-VF
DH-IPC-HFW4231F-AS,DH-IPC-HFW4236F-AS,DH-IPC-HFW4431F-AS,DH-IPC-HFW4436F-AS
DH-IPC-HFW4231B-AS,DH-IPC-HFW4236B-AS,DH-IPC-HFW4431B-AS,DH-IPC-HFW4436B-AS
DH-IPC-HFW4231D-AS,DH-IPC-HFW4236D-AS,DH-IPC-HFW4431D-AS,DH-IPC-HFW4436D-AS
DH-IPC-HFW4231K-I4,DH-IPC-HFW4236K-I4,DH-IPC-HFW4431K-I4,DH-IPC-HFW4436K-I4
DH-IPC-HFW4231K-I6,DH-IPC-HFW4236K-I6,DH-IPC-HFW4431K-I6,DH-IPC-HFW4436K-I6
DH-IPC-HFW4233K-I4,DH-IPC-HFW4238K-I4,DH-IPC-HFW4233K-I6,DH-IPC-HFW4238K-I6
DH-IPC-HFW4231M-I1,DH-IPC-HFW4236M-I1,DH-IPC-HFW4431M-I1,DH-IPC-HFW4436M-I1
DH-IPC-HFW4231M-I2,DH-IPC-HFW4236M-I2,DH-IPC-HFW4431M-I2,DH-IPC-HFW4436M-I2
DH-IPC-HFW4233M-I1,DH-IPC-HFW4238M-I1,DH-IPC-HFW4233M-I2,DH-IPC-HFW4238M-I2
DH-IPC-HFW4233K-AS-I4,DH-IPC-HFW4238K-AS-I4,DH-IPC-HFW4233K-AS-I6,DH-IPC-HFW4238K-AS-I6
DH-IPC-HFW4431K-AS-I4,DH-IPC-HFW4436K-AS-I4,DH-IPC-HFW4431K-AS-I6,DH-IPC-HFW4436K-AS-I6
DH-IPC-HFW4233M-AS-I1,DH-IPC-HFW4238M-AS-I1,DH-IPC-HFW4233M-AS-I2,DH-IPC-HFW4238M-AS-I2
DH-IPC-HFW4431M-AS-I1,DH-IPC-HFW4436M-AS-I1,DH-IPC-HFW4431M-AS-I2,DH-IPC-HFW4436M-AS-I2

Based on official English firmware with following noteworthy changes:
  • English, French, Spanish and Russian language.
  • PAL/NTSC
  • Unlocked additional web GUI features/options.
    • Disable P2P: Network -> TCP/IP -> Easy4ip
  • Hacked Playback to also work with NAS/NFS.
    • Playback tab will be enabled when you have an SD card (default) or enabled NAS/NFS feature. (F5 after you added a NAS)
    • Added option to select NAS instead of SD, obviously...
    • I barely tested it but it seemed to play fine... feedback welcome.
    • FTP can not be supported, stop using it, it's awful.
  • Unlocked all IVS modes.
  • Disabled "CloudUpgradeServer".
  • Telnet enabled permanently on port 2300.

For IPC-HX4XXX-NAND-Eos (-ZS models) cameras:
Software Version: 2.420.0000.21.R, Build Date: 2016-07-24
MD5Sum: c9ce325783ef99f8c476e861ebd4f82a
SHASum: 119f03c9a35509fb81393aa6653ace884873e57d

Compatible cameras (guessed):
IPC-HDBW4231R-ZS
IPC-HDBW4431R-ZS

Based on Chinese firmware with following noteworthy changes:
  • English, Chinese, French, Spanish and Russian language.
  • PAL/NTSC
  • Unlocked additional web GUI features/options.
    • Disable P2P: Network -> TCP/IP -> Easy4ip
  • Unlocked all IVS modes.
  • Disabled "CloudUpgradeServer".

For IPC-HX4X2X-Themis ("Eco-savvy 2.0" 2nd gen) cameras:
Software Version: 2.400.0000.34.R, Build Date: 2016-08-01
MD5Sum: 3a6d937e453c91202ab64542d83f1a38
SHASum: c5bfae26ff027d5c3a2c03e73dcbb9cf3e978759

Compatible cameras according to Dahua:
DH-IPC-HDW4120C-A,DH-IPC-HDW4125C-A
DH-IPC-HDW4221C-A,DH-IPC-HDW4226C-A
DH-IPC-HDW4421C-A,DH-IPC-HDW4426C-A
DH-IPC-HDW4120C-A-V2,DH-IPC-HDW4125C-A-V2
DH-IPC-HDW4120S,DH-IPC-HDW4125S,DH-IPC-HDW4221S,DH-IPC-HDW4226S
DH-IPC-HDW4320S,DH-IPC-HDW4325S,DH-IPC-HDW4421S,DH-IPC-HDW4426S
DH-IPC-HDW4120C,DH-IPC-HDW4125C,DH-IPC-HDW4221C,DH-IPC-HDW4226C
DH-IPC-HDW4320C,DH-IPC-HDW4325C,DH-IPC-HDW4421C,DH-IPC-HDW4426C
DH-IPC-HDBW4120R,DH-IPC-HDBW4125R,DH-IPC-HDBW4120R-AS,DH-IPC-HDBW4125R-AS
DH-IPC-HDBW4221R,DH-IPC-HDBW4226R,DH-IPC-HDBW4221R-AS,DH-IPC-HDBW4226R-AS
DH-IPC-HDBW4421R,DH-IPC-HDBW4426R,DH-IPC-HDBW4421R-AS,DH-IPC-HDBW4426R-AS
DH-IPC-HFW4120B,DH-IPC-HFW4125B,DH-IPC-HFW4120D,DH-IPC-HFW4125D
DH-IPC-HFW4221B,DH-IPC-HFW4226B,DH-IPC-HFW4221D,DH-IPC-HFW4226D
DH-IPC-HFW4320B,DH-IPC-HFW4325B,DH-IPC-HFW4320D,DH-IPC-HFW4325D
DH-IPC-HFW4421B,DH-IPC-HFW4426B,DH-IPC-HFW4421D,DH-IPC-HFW4426D
DH-IPC-HFW4120F,DH-IPC-HFW4125F,DH-IPC-HFW4120F-AS,DH-IPC-HFW4125F-AS
DH-IPC-HFW4120B-AS,DH-IPC-HFW4125B-AS,DH-IPC-HFW4120D-AS,DH-IPC-HFW4125D-AS
DH-IPC-HFW4221B-AS,DH-IPC-HFW4226B-AS,DH-IPC-HFW4221D-AS,DH-IPC-HFW4226D-AS
DH-IPC-HFW4421B-AS,DH-IPC-HFW4426B-AS,DH-IPC-HFW4421D-AS,DH-IPC-HFW4426D-AS

For IPC-HX8XXX-Demeter (Pinhole) cameras:
MD5Sum: 21a05c0520a5e511cb476f1608505df1
SHASum: cdb1e0b219d4586c50e74ba80019b34e958f06cb

Compatible cameras according to HWID:
IPC-HDBW8281-PC
IPC-HDBW8281-Z
IPC-HF8101
IPC-HF8201
IPC-HF8281
IPC-HF8291E-4GT
IPC-HF8301
IPC-HF8351E-4GT
IPC-HFW8101
IPC-HFW8106
IPC-HFW8201
IPC-HFW8206
IPC-HFW8281
IPC-HFW8281E-IRA
IPC-HFW8286
IPC-HFW8301
IPC-HFW8306
IPC-HUM8101
IPC-HUM8101-0280B

NVRs:
NVR7xxx:


TIP: Reset your camera to default config before updating, seems like Dahua messed something up so sonia will crash on certain configs...

PLEASE POST HERE IF YOU HAVE MORE LANGUAGES [OR A CAMERA WITH ANOTHER LANGUAGE]

These cameras have checks in place (HWID) so you can't flash the wrong firmware, hopefully this should prevent you from bricking your camera.

Experts can also use (from mtd-utils compiled with Hi3516a SDK) to flash .raw images to partitions on the camera from it's busybox shell.
This is useful while messing around, testing changes so you don't have to flash the full upgrade image every time.

WARNING: DO NOT FLASH THE OFFICIAL ENGLISH FIRMWARE ON CHINESE HARDWARE!
It won't start and you'll have to flash your camera back to the chinese one manually (over telnet or TFTP recovery)
And if you really want to try then at least do "appauto 0" to stop sonia from autostarting before flashing.
I personally always add permanent telnet to the image I am flashing with Dahua-Firmware-Mod-Kit, like so: Add utelnetd server · BotoX/DH_IPC-HX4XXX-Eos@2ddf0f5 · GitHub

Also, thanks to @nayr for chatting with me on IRC :v
(If this helped you and you have some spare for a student: paypal.me/BotoXbz)
(If shit hit the fan and you bricked your camera: Dahua IPC unbricking / recovery over serial UART and TFTP)
 
Last edited:
  • Like
Reactions: juliand, ipcamuser11, undecimo and 35 others
Awesome stuff. I have a 4421c so i can't use this, but I have to say it's very awesome that you succeeded in customizing your own Dahua firmware!
 
Is there any way you can mod the email SMTP part of the firmware so it will work properly? I'm finding that SMTP authentication can't be turned off on the HDW4431C. My SMTP server is set up for no authentication, no ssl or tls, and I can't get this camera to work properly with my mail server.
 
sumguy said:
Is there any way you can mod the email SMTP part of the firmware so it will work properly? I'm finding that SMTP authentication can't be turned off on the HDW4431C. My SMTP server is set up for no authentication, no ssl or tls, and I can't get this camera to work properly with my mail server.
Click to expand...
That's probably in sonia as there is no sendmail binary on the camera.

Warwick said:
I tested the firmware ,but without Smart Function and IVS function.
Click to expand...
idk man, works for me™
Screenshot_2016-09-10_19-12-18.png
Which camera do you have?
 
Thanks a lot for the great firmware. It works pretty well so far. However, if I turn on "Smart codec", the IVS functions become disabled and inaccessible. Is this by design? Thanks.
 
keithshlo said:
Thanks a lot for the great firmware. It works pretty well so far. However, if I turn on "Smart codec", the IVS functions become disabled and inaccessible. Is this by design? Thanks.
Click to expand...
Well, I didn't make the software, I just added english language to it and patched the checks so I guess it is!
 
cor35vet said:
Hi,


EDIT: DO NOT USE SMART CODEC WITH H265, THE CAMERA WILL BOOTLOOP (Dahua bug)
Click to expand...

THanks for this! I just ordered these cams, and definitely want to upgrade the firmware. This is my first system and install. I will be using H265 for the compression, can you explain what smart codec is and If i need to sorry about it at all?

Thanks!
 
wiz1der said:
THanks for this! I just ordered these cams, and definitely want to upgrade the firmware. This is my first system and install. I will be using H265 for the compression, can you explain what smart codec is and If i need to sorry about it at all?

Thanks!
Click to expand...
I have no clue what smart codec does, but some user said that it improves compression with h264.
You shouldn't have to worry about it, they've added this feature recently (2 months ago?).
H265 compression is already insane, doubt you could improve that without pouring lots more of processing power at it...
 
smartCodec disables all IVS features and the 3rd substream on my camera.. and then I didnt notice much improvement, oah and smartpss had no idea what the bitrate was so it said 0bps..

i dont think its anything you'll really miss and I could not find much documentation on it..

upgrading the firmware, just because you can is not advised.. unless you know something is fixed that your having issues with its best to leave it on what you got it with.. if you brick this you'll have to patch into the serial bus and force a tftp recovery, presuming you have a good image to restore.
 
thanks to @cor35vet Ive managed to flash my NVR 4216-4k to a Chinese firmware, and then converted it back to english successfully.. now to hack all the features enabled if we can figure out how.

This is a great little tool, should be doable to change languages or rebrand devices without too much trouble.. if your determined and savvy enough.

attached proof, firmware was applied from: and was entirely Chinese before modification.
 

Attachments

  • Screen Shot 2016-09-16 at 11.30.29 PM.png
    Screen Shot 2016-09-16 at 11.30.29 PM.png
    93.3 KB · Views: 698
Last edited by a moderator:
  • Like
Reactions: tahoavietnam
Seems like we could maybe extract English language files from some firmware while in operation to stick back after a factory reset maybe?
 
looks like might be possible to build a firmware package that just lays down the english modifications.. I think its how the grey market vendors are dong it.
 
If they were doing that why do we lose the language with a factory reset? Firmware shouldn't lose anything. It seems like they must make a non-persistent change? Agree that simply making a persistant language change would be best.
 
because the modifications are stored on a custom partition for branding and tweaking camera config out of the box; hard reset is likely formatting that and getting factory defaults..

Ive found firmware with only the update script and the custom partition image, indicating you can partially flash the firmware without changing everything.. depending on the partition u flash.. so in theory you can add the language files and over-ride to that custom branding image and just update that, leaving everything else intact.

for example on my NVR there is a custom.lua file in this partition that has the variables:
SupportedLanguage = "English",
SupportedLanguageDefault = "English",
Click to expand...

that when I flashed those into my Chinese firmware, it became english.. that was all I had to do.
 
  • Like
Reactions: spoonek
I was testing this with the SD-Zi-Themis_Chn_PN_Stream3_IVS_V2.400.0000.17 version but cant handle the tables in config.py
Anyone here who knows them .
maybe like this
dhboot.bin.img", {
"required": False,
"type": DAHUA_TYPE.Plain,
"size": 0x00030000

I had several errors because of th size,but i think its working with the Themis
 
dobiwan said:
I was testing this with the SD-Zi-Themis_Chn_PN_Stream3_IVS_V2.400.0000.17 version but cant handle the tables in config.py
Anyone here who knows them .
maybe like this
dhboot.bin.img", {
"required": False,
"type": DAHUA_TYPE.Plain,
"size": 0x00030000

I had several errors because of th size,but i think its working with the Themis
Click to expand...
You should've contacted me :v
This is the config for Themis: https://p.botox.bz/view/26279f91 (DH_IPC-HX4X2X-Themis not SD-Zi-Themis :v)
You should check the partition-x.cramfs.img image in the firmware upgrade image for the right sizes. Also Install for which files are actually flashed.

I am currently building a firmware image for Themis with the same modifications as for Eos.
This is completely untested DH_IPC-HX4X2X-Themis firmware http://i.botox.bz/DH_IPC-HX4X2X-Themis.bin if anyone wants to try it out.
I can't test it because I don't own such a device, compatibility list:
DH-IPC-HDW4120C-A,DH-IPC-HDW4125C-A
DH-IPC-HDW4221C-A,DH-IPC-HDW4226C-A
DH-IPC-HDW4421C-A,DH-IPC-HDW4426C-A
DH-IPC-HDW4120C-A-V2,DH-IPC-HDW4125C-A-V2
DH-IPC-HDW4120S,DH-IPC-HDW4125S,DH-IPC-HDW4221S,DH-IPC-HDW4226S
DH-IPC-HDW4320S,DH-IPC-HDW4325S,DH-IPC-HDW4421S,DH-IPC-HDW4426S
DH-IPC-HDW4120C,DH-IPC-HDW4125C,DH-IPC-HDW4221C,DH-IPC-HDW4226C
DH-IPC-HDW4320C,DH-IPC-HDW4325C,DH-IPC-HDW4421C,DH-IPC-HDW4426C
DH-IPC-HDBW4120R,DH-IPC-HDBW4125R,DH-IPC-HDBW4120R-AS,DH-IPC-HDBW4125R-AS
DH-IPC-HDBW4221R,DH-IPC-HDBW4226R,DH-IPC-HDBW4221R-AS,DH-IPC-HDBW4226R-AS
DH-IPC-HDBW4421R,DH-IPC-HDBW4426R,DH-IPC-HDBW4421R-AS,DH-IPC-HDBW4426R-AS
 
Last edited by a moderator:
  • Like
Reactions: xbmcnut, ilrider78, randyth and 3 others
I soldered a micro-SD socket to the board inside one of my HDW4431C-A cameras and installed a 32 gb card. Once the camera powered up, I browsed through the setup options, including STORAGE, but found nothing new. In other words, the camera is not seeing or recognizing the SD card.

So, if at all possible, if someone can create a modded firmware that might initialize or activate the SD card, I would volunteer to try it out.

If this means turning the camera from a HDW4431C-A into a HDW4431C-AS, then that's fine. Doesn't such a camera model already exist? Maybe this is as simple as dropping the -AS firmware into the -A camera?

Edit: Does this help?

http://download.dahuatech.com/kitDo..._Chn_PN_Stream3_V2.420.0000.21.R.20160724.bin

I got that from here: http://download.dahuatech.com/kit_det.php?cid=3877
 
Last edited by a moderator:
  • Like
Reactions: Purduephotog
You must log in or register to reply here.
Top Bottom