Dahua IPC EASY unbricking / recovery over TFTP

tibimakai · Feb 22, 2021

I have used Unpacker from the Microsoft Store to unpack it and I have the Install with 1kb of data, so it is all good.
I have used this Command instead:

tftp 0x02000000 kernel.img; flwrite
tftp 0x02000000 partition-x.cramfs.img; flwrite
tftp 0x02000000 romfs-x.squashfs.img; flwrite
tftp 0x02000000 pd-x.squashfs.img; flwrite
tftp 0x02000000 user-x.squashfs.img; flwrite
tftp 0x02000000 custom-x.squashfs.img; flwrite
tftp 0x02000000 web-x.squashfs.img; flwrite
tftp 0x02000000 user1-x.squashfs.img; flwrite
tftp 0x02000000 .FLASHING_DONE_STOP_TFTP_NOW
sleep 5

I have removed:
tftp 0x82000000 dhboot-min.bin.img; flwrite
tftp 0x82000000 dhboot.bin.img; flwrite
since I'm not reloading the bootloader.
I have replaced:
tftp 0x82000000 with tftp 0x02000000 on all lines and it worked!!!

Thank you very much!!!

myk3le · Feb 23, 2021

@tibimakai can i update my guideline with your experience?

tibimakai · Feb 23, 2021

You can, but it seems like there no one way of doing this. Different cameras and firmware requires tweaking Commands file.

myk3le · Feb 23, 2021

yes it depends on physical RAM architecture I think. 0x82000000 or 0x02000000 refers to linux kernel address in system RAM. When you put the 0x82000000 or 0x02000000 you are going to tell to tftp server in witch address of ram has to load the kernel and the base software. I understand this.

snowidun · Feb 23, 2021

@tibimakai or anyone can lend me a helping hand please?

Im trying for my nvr4216 but to no avail ..it just keeps showing failed.txt

my list of files from firmware
install.lua
u-boot.bin.img
uImage.img
romfs-x.squashfs.img
web-x.squashfs.img
custom-x.squashfs.img
logo-x.squashfs.img
sign.img

my commands
tftp 0x82000000 u-boot.bin.img; flwrite
tftp 0x82000000 uImage.img; flwrite
tftp 0x82000000 romfs-x.squashfs.img; flwrite
tftp 0x82000000 web-x.squashfs.img; flwrite
tftp 0x82000000 custom-x.squashfs.img; flwrite
tftp 0x82000000 logo-x.squashfs.img; flwrite
tftp 0x82000000 .FLASHING_DONE_STOP_TFTP_NOW
sleep 5

generated file ID_3K05B9EPAZ26155.txt (file requested by nvr)
CRC:907200979
MagicString:c016dcd6-cdeb-45df-9fd0-e821bf0e1e62
tftp 0x82000000 u-boot.bin.img; flwrite
tftp 0x82000000 uImage.img; flwrite
tftp 0x82000000 romfs-x.squashfs.img; flwrite
tftp 0x82000000 web-x.squashfs.img; flwrite
tftp 0x82000000 custom-x.squashfs.img; flwrite
tftp 0x82000000 logo-x.squashfs.img; flwrite
tftp 0x82000000 .FLASHING_DONE_STOP_TFTP_NOW
sleep 5

I've tried both tftp 0x82000000 0x02000000

....any help anyone?

install.lua content
--
-- Copyright (C) 2005 dahua Technologies, All Rights Reserved.
-- 2006-4-25 15:54 Z:\wjj\ven\152\DAHUA\Install.lua
-- 2006-9-21 modified by zhongjl for new partition
--

-- Flash ¿éµÄ´óÐ¡Îª128K
local flashSectorSize = 0x20000;

local Installer = {};
Installer.TotalSize = 0; -- ×ÜµÄÒªÐ´µ½FlashÖÐµÄÊý¾Ý´óÐ¡
Installer.InProgressSize = 0; -- ÓÃÀ´ÔÚÉý¼¶¹ý³ÌÖÐ¿ØÖÆ½ø¶È
Installer.UpgradeSecurityVersion = "2.20"; --Éý¼¶°üÖÐ°æ±¾ÐÅÏ¢ÐèÒªÊÖ¶¯¸üÐÂ£¬ºÍuser/data/hardware.luaÖÐµÄversion±£³ÖÒ»ÖÂ

-- Í¨ÖªÉÏ²ãÓ¦ÓÃ³ÌÐòÉý¼¶µÄ½ø¶ÈÐÅÏ¢
-- params:
-- ÎÞ
-- return:
-- ÎÞ
function Installer:notify()
self.InProgressSize = self.InProgressSize + flashSectorSize;

local progress = self.InProgressSize / self.TotalSize * 100;
if(progress > 100) then
progress = 100;
end;
progress = tonumber(string.format("%d", progress));

-- ×¢Òâµ÷ÓÃ·½Ê½,²»ÊÇself::callback,·ñÔò»áµ¼ÖÂ»Øµ÷³ö´í
self.callback(0x01, progress);
end

-- »ñÈ¡Éý¼¶ÎÄ¼þµÄ°æ±¾ÐÅÏ¢
-- params :
-- filename : Éý¼¶ÎÄ¼þÃû
-- return : ³É¹¦true/Ê§°Üfalse£¬°æ±¾ÐÅÏ¢
function Installer:getHardwareVersion(filename)
local myfile = self.ZipArchive

pen(filename);

-- Ã»ÓÐÎÄ¼þ·µ»ØÊ§°Ü
if(not myfile) then
print(string.format("%s not exist", filename));
return false, "no file";
end

-- imgÍ·½á¹¹
--typedef struct image_header {
-- uint32_t ih_magic; /* Image Header Magic Number */
-- uint32_t ih_hcrc; /* Image Header CRC Checksum */
-- uint32_t ih_time; /* Image Creation Timestamp */
-- uint32_t ih_size; /* Image Data Size */
-- uint32_t ih_load; /* Data Load Address */
-- uint32_t ih_ep; /* Entry Point Address */
-- uint32_t ih_dcrc; /* Image Data CRC Checksum */
-- uint8_t ih_os; /* Operating System */
-- uint8_t ih_arch; /* CPU architecture */
-- uint8_t ih_type; /* Image Type */
-- uint8_t ih_comp; /* Compression Type */
-- uint8_t ih_name[IH_NMLEN]; /* Image Name */
-- uint8_t ih_version[IH_VERLEN]; /* Version Name */----Õâ¸öVersionÊÇ´ò°üµÄÊ±ºò´ò½øÈ¥µÄ£¬¶ÔÓ¦user/data/hardware.luaÖÐµÄversion
--} image_header_t;
--#define IH_NMLEN 26 /* Image Name Length */
--#define IH_VERLEN 6 /* Image Version Length */

-- ¶ÁÈ¡version
myfile:seek("set", 58);
data = myfile:read(6);
myfile:close();
if(data) then
return true, data;
else
return false, "read error";
end
end

-- °²È«»ùÏß°æ±¾Ð£Ñé
-- ¸Ãº¯ÊýÎªÀúÊ·ÒÅÁô£¬²»ÄÜÔÚ´Ëº¯Êý»ù´¡ÉÏÐÞ¸Ä
-- params:
-- ÎÞ
-- return:
-- ³É¹¦·µ»ØTrue, Ê§°Ü·µ»ØFalseÒÔ¼°Ê§°ÜµÄÔÒò
function Installer:checkSecurityBaselineVersion()
local defVersion = "V1.4";
local curVersion = Global.Vendor.SecurityBaselineVersion;
--Éý¼¶°üÖÐ°æ±¾ÐÅÏ¢ÐèÒªÊÖ¶¯¸üÐÂ£¬ºÍÉý¼¶°üconfig.luaÖÐµÄSecurityBaselineVersionÏî±£³ÖÒ»ÖÂ
local newVersion = "V1.4";

if (type(curVersion) ~= "nil") then
--½«×Ö·û´®µÄ°²È«»ùÏß°æ±¾ÐÅÏ¢×ª»»Îª¶ÔÓ¦Êý×Ö
--Ä¿Ç°½öÖ§³Ö°²È«»ùÏß°æ±¾ÐÅÏ¢¸ñÊ½£ºVx.x
--Èç¹ûºóÃæ°²È«»ùÏß°æ±¾ÐÅÏ¢¸ñÊ½±ä¸ü£¬ÏÂÃæµÄ×ª»»Âß¼ÐèÒªÏàÓ¦¸üÐÂ

local sPos;
local ePos;

local defMainVerStr;
local defSubVerStr;
sPos, ePos, defMainVerStr, defSubVerStr = string.find(defVersion, "V(%d+)%.(%d+)");
local defMainVerNum = tonumber(defMainVerStr);
local defSubVerNum = tonumber(defSubVerStr);

local curMainVerStr;
local curSubVerStr;
sPos, ePos, curMainVerStr, curSubVerStr = string.find(curVersion, "V(%d+)%.(%d+)");
local curMainVerNum = tonumber(curMainVerStr);
local curSubVerNum = tonumber(curSubVerStr);

local newMainVerStr;
local newSubVerStr;
sPos, ePos, newMainVerStr, newSubVerStr = string.find(newVersion, "V(%d+)%.(%d+)");
local newMainVerNum = tonumber(newMainVerStr);
local newSubVerNum = tonumber(newSubVerStr);

if (type(defMainVerNum) == "nil" or type(defSubVerNum) == "nil" or type(curMainVerNum) == "nil" or type(curSubVerNum) == "nil" or type(newMainVerNum) == "nil" or type(newSubVerNum) == "nil") then
print(string.format("Error defVersion:%s, curVersion:%s, newVersion:%s", defVersion, curVersion, newVersion));
return false, "Invalid version";
end

print(string.format("Checking SecurityBaselineVersion defVersion:%s(%d %d), curVersion:%s(%d %d), newVersion:%s(%d %d)", defVersion, defMainVerNum, defSubVerNum, curVersion, curMainVerNum, curSubVerNum, newVersion, newMainVerNum, newSubVerNum));

if(((newMainVerNum < defMainVerNum) or (newMainVerNum == defMainVerNum and newSubVerNum < defSubVerNum)) and ((curMainVerNum > defMainVerNum) or (curMainVerNum == defMainVerNum and curSubVerNum >= defSubVerNum))) then
return false, "Invalid version";
end
else
print("curVersion nil");
end

return true;
end

-- ·À»ØÉý£¬¹Ì¼þ°æ±¾¼æÈÝÐÔ¼ì²â£¨·½°¸1:£©
-- params:
-- ÎÞ
-- return:
-- True-¹Ì¼þ°æ±¾¼æÈÝ¿ÉÒÔÉý¼¶, False-¹Ì¼þ°æ±¾²»¼æÈÝ£¬»òÕßÆäËûÔÒò£¬²»ÄÜÉý¼¶£¬·µ»ØÊ§°ÜÔÒò
function Installer:checkFirmwareVersionSheme1()
-- return true;
local fileList = {"u-boot.bin.img",
"uImage.img",
"romfs-x.squashfs.img",
"u-boot_slave.bin.img",
"uImage_slave.img",
"romfs_slave-x.squashfs.img",
"web-x.squashfs.img",
"custom-x.squashfs.img",
"logo-x.squashfs.img",
"user-x.squashfs.img",
"575S_PMX.bin.img",
"romfs2-x.squashfs.img"}

--Éè±¸³ÌÐòµÄhardware°æ±¾ºÅÎª¿Õ£¬¿Ï¶¨ÊÇÀÏ³ÌÐò£¬ÔÊÐíÉý¼¶
local hardwareVersion = Global.Hardware.board.version; --Éè±¸ÉÏ³ÌÐò°æ±¾ºÅ,user/data/hardware.luaÖÐµÄversion
print(string.format("Hardware.board.version:%s", hardwareVersion));
if (type(hardwareVersion) == "nil" or hardwareVersion == "x.xx") then
return true;
end

--°Ñhardware°æ±¾×Ö·û´®ÎÄ¼þ×ª»»Êý×Ö
local sPos;
local ePos;
local hardwareMainVerStr;
local hardwareSubVerStr;
sPos, ePos, hardwareMainVerStr, hardwareSubVerStr = string.find(hardwareVersion, "(%d+)%.(%d+)");
local hardwareMainVerNum = tonumber(hardwareMainVerStr);
local hardwareSubVerNum = tonumber(hardwareSubVerStr);
print("hardwareMainVerStr:%s hardwareSubVerStr:%s hardwareMainVerNum:%d hardwareSubVerNum:%d", hardwareMainVerStr, hardwareSubVerStr, hardwareMainVerNum, hardwareSubVerNum);
--È¡³öÉý¼¶°üÖÐµÄimgÎÄ¼þ£¬È¡³öimgÍ·ÖÐµÄ°æ±¾ºÅ£¬ÓëÉè±¸³ÌÐòµÄhardware°æ±¾ºÅ±È¶Ô
for i, file in fileList do
local ret, version = Installer:getHardwareVersion(fileList);
print(string.format("filename:%s filelist[%d]:%s, version:%s", file, i, fileList, version));
if(ret) then
--Éý¼¶ÎÄ¼þµÄ°æ±¾ºÅ
local mainVerStr;
local subVerStr;
sPos, ePos, mainVerStr, subVerStr = string.find(version, "(%d+)%.(%d+)");
local mainVerNum = tonumber(mainVerStr);
local subVerNum = tonumber(subVerStr);
print("mainVerStr:%s subVerStr:%s mainVerStr:%d subVerStr:%d", mainVerStr, subVerStr, mainVerNum, subVerNum);

--Éý¼¶ÎÄ¼þµÄ°æ±¾ºÅ±ØÐë>=Éè±¸³ÌÐòµÄhardware°æ±¾ºÅ
if ((mainVerNum > hardwareMainVerNum) or (mainVerNum == hardwareMainVerNum and subVerNum >= hardwareSubVerNum)) then
return true;
else
return false, "Invalid version";
end
end
end

return false, "Invalid version";
end

-- ·À»ØÉý£¬¹Ì¼þ°æ±¾¼æÈÝÐÔ¼ì²â£¨·½°¸2:£©
-- params:
-- ÎÞ
-- return:
-- True-¹Ì¼þ°æ±¾¼æÈÝ¿ÉÒÔÉý¼¶, False-¹Ì¼þ°æ±¾²»¼æÈÝ£¬»òÕßÆäËûÔÒò£¬²»ÄÜÉý¼¶£¬·µ»ØÊ§°ÜÔÒò
function Installer:checkFirmwareVersion()

--Éè±¸ÉÏ³ÌÐò°æ±¾ºÅ,user/data/hardware.luaÖÐµÄversion
local hardwareVersion = Global.Hardware.board.version;

--ÔçÆÚ°æ±¾ºÅÊÇ"x.xx"£¬ÔÊÐíÉý¼¶
if (hardwareVersion == "x.xx") then
return true;
end

--»ñÈ¡Éè±¸ÉÏ³ÌÐòµÄ°æ±¾ºÅ£¬²¢×ª»¯³ÉÊý×Ö
local sPos;
local ePos;
local hardwareMainVerStr;
local hardwareSubVerStr;
sPos, ePos, hardwareMainVerStr, hardwareSubVerStr = string.find(hardwareVersion, "(%d+)%.(%d+)");
local hardwareMainVerNum = tonumber(hardwareMainVerStr);
local hardwareSubVerNum = tonumber(hardwareSubVerStr);
print("hardwareMainVerStr:%s hardwareSubVerStr:%s hardwareMainVerNum:%d hardwareSubVerNum:%d", hardwareMainVerStr, hardwareMainVerNum, hardwareMainVerNum, hardwareSubVerNum);

--»ñÈ¡Éý¼¶°üµÄ°æ±¾ºÅ£¬²¢×ª»¯³ÉÊý×Ö
local version = Installer.UpgradeSecurityVersion;
local mainVerStr;
local subVerStr;
sPos, ePos, mainVerStr, subVerStr = string.find(version, "(%d+)%.(%d+)");
local mainVerNum = tonumber(mainVerStr);
local subVerNum = tonumber(subVerStr);
print("mainVerStr:%s subVerStr:%s mainVerNum:%d subVerNum:%d", mainVerStr, subVerStr, mainVerNum, subVerNum);

--Éý¼¶°üµÄ°æ±¾ºÅ±ØÐë>=Éè±¸³ÌÐòµÄhardware°æ±¾ºÅ
if ((mainVerNum > hardwareMainVerNum) or (mainVerNum == hardwareMainVerNum and subVerNum >= hardwareSubVerNum)) then
return true;
else
return false, "Invalid version";
end
return true;
end

-- ¸ù¾ÝÓ¦ÓÃ³ÌÐòÌá¹©µÄÐÅÏ¢ÅÐ¶ÏÊÇ·ñ¿ÉÒÔÉý¼¶
-- params:
-- ÎÞ
-- return:
-- ³É¹¦·µ»ØTrue, Ê§°Ü·µ»ØFalseÒÔ¼°Ê§°ÜµÄÔÒò
function InstallerreInstall()
-- ÕâÀïÎÒÃÇÐèÒª¿¼ÂÇÄÇÐ©ÒòÊý£¿
-- Ó²¼þ°æ±¾ºÅ £¿
-- ÔÓÐÈí¼þµÄ°æ±¾ºÅ£¿
--
local board = Global.Hardware.board;
local hwproduct;
local hwchannel;
local hwversion;
local hwfunction;

print(string.format("Checking hardware information,board name:%s version:%s",
board.name, board.version));
if(board.name ~= "NVR4X-4KS2") then
return false, "Invalid board";
end

--Éý¼¶³ÌÐòÖ±½Ó´ÓÓ²¼þÖÐÈ¡Öµ¡£ÒâÒåÈçÏÂ
--hwproductÈ¡ÖµÈçÏÂ: 2 -- LB; 3 -- LBN; 4 -- LB_ATM; 5 -- GBE; 6 -- LK; 7 -- LS
--hwproductÈ¡ÖµÈçÏÂ: 2 -- IPC4X5; 3 -- A6; 4 -- A8; 5 -- IPVM;
--hwchannelÈ¡ÖµÈçÏÂ: x -- x chans
--hwfunctionÈ¡ÖµÈçÏÂ: 0 -- AUDIO; 1 -- MATRIX; 3 -- LOOP

if(mtd.getinfo)then
hwproduct,hwchannel,hwversion,hwfunction = mtd.getinfo();
print(string.format("Checking hardware id info: product = %x; channel = %x; version = %x; function = %x",
hwproduct,hwchannel,hwversion,hwfunction));
if((hwproduct ~= 3) and (hwproduct ~= 4)) then
print(string.format("product not match"));
return false, "Invalid board";
end
end

-- ÕâÀïÎÒÃÇÐèÒªÐ£Ñé²»Í¬°å±¾µÄ°å×Ó³ÌÐòÊÇ·ñ¿ÉÒÔÍ¨ÓÃ,
-- ÈçÄ¿Ç°LB 1.22µÄÓë LB 2.00µÄ°å×Ó¾Í²»ÄÜÍ¨ÓÃ
-- if(board.version ~= "1.22") then
-- print(string.format("XXXXXXXXXXXX"));
-- return false, "Invalid board version";
-- end

local vendor = Global.Vendor;

print(string.format("Checking vendor information,vendor name:%s", vendor.Name));
if(vendor.Name ~= 'NVR4X-4KS2' and vendor.Name ~= 'DAHUA') then
return false, "Invalid vendor";
end

local curRegion = Global.VersionAreaInformation;

--¹úÄÚ"Inland"; º£Íâ"Abroad"
local newRegion = "Inland";

if(type(curRegion) == "nil") then
print(string.format("Checking VersionAreaInformation, curRegion:nil, newRegion:%s", newRegion));
else
print(string.format("Checking VersionAreaInformation, curRegion:%s, newRegion:%s", curRegion, newRegion));
end

--Èç¹ûcurRegionÎª¿Õ£¬±íÊ¾ÀÏ³ÌÐòÉý¼¶µ½°²È«»ùÏßV1.4¼°ÒÔÉÏ£¬±£³ÖÔÓÐÉý¼¶²ßÂÔ£¬¿ÉÒÔÉý¼¶£»
--Èç¹ûcurRegion²»Îª¿Õ£¬±íÊ¾°²È«»ùÏßV1.4¼°ÒÔÉÏµÄ³ÌÐòÉý¼¶£¬²ÉÓÃÐÂ²ßÂÔ£¬ÏÞÖÆ¹úÄÚº£Íâ»¥ÏàÉý¼¶¡£
if(type(curRegion) ~= "nil" and curRegion ~= newRegion) then
return false, "Regional conflict";
end

return true;
end

-- Éý¼¶Íê³ÉºóµÄ´¦Àí,Èç¿ØÖÆÏµÍ³ÖØÆô
-- params:
-- ÎÞ
-- return:
-- ÎÞ
function InstallerostInstall()
end

-- Éý¼¶Flash·ÖÇø,¶ÔÓÚ²»Í¬µÄÓ¦ÓÃ,Éý¼¶µÄ´¦Àí¿ÉÄÜ²»Ò»Ñù
-- params :
-- part : ±í¸ñ,°üº¬·ÖÇøµÄÆðÊ¼Î»ÖÃÒÔ¼°½áÊøÎ»ÖÃ
-- filename : ÔÚÉý¼¶°üÖÐµÄÎÄ¼þÃû
-- return : ÎÞ
function Installer:updatePart(part, filename)
local myfile = self.ZipArchivepen(filename);
local write_times = 0;
-- Èç¹û¸ÃÎÄ¼þ´ò²»¿ª,Ôò²»ÐèÒª¶Ô´Ë²¿·Ö½øÐÐÉý¼¶
if(not myfile) then
print(string.format("%s not exist", filename));
return ;
end

local addr = part.baseAddr;
local endAddr= part.endAddr;
local data;
local fldata;
local write_times1 = 0;
print(string.format("Start Update : %s ", filename));
-- Ìø¹ýÇ°Ãæ64×Ö½ÚµÄÍ·,ÔÚÐÂµÄÉý¼¶³ÌÐò°æ±¾ÖÐ²»ÐèÒª¶Ô´Ë½øÐÐÐ£Ñé
myfile:seek("set", 64);
while(addr < endAddr) do
fldata = mtd.read(addr,flashSectorSize);
data = myfile:read(flashSectorSize); -- ¶ÁÈëÒ»¿éFlashÉÈÇø´óÐ¡µÄÊý¾Ý
-- if (fldata and data and (fldata ~= data)) then
-- µ±fldataÎª¿ÕµÄÊ±ºòÎªÀÏµÄ³ÌÐò£¬Ö±½Ó²Á³ý

if(data) then
if((not fldata) or (data and (fldata ~= data))) then
print(string.format("Update : %s Addr %x", filename, addr));
mtd.erase(addr);
mtd.write(addr, data);
write_times = write_times+1;
fldata = mtd.read(addr,flashSectorSize);
-- myfile:read¶ÁÈ¡²»×ãÒ»¸öÎïÀí¿éÊý¾ÝÊ±£¬Ö»·µ»ØÊµ¼Ê¶ÁÈ¡³¤¶È
-- ×îºóÒ»¸öÎïÀí¿é±È½ÏÊ±£¬ÏÂÃæµÄÅÐ¶Ï»á³ÉÁ¢
-- Hi3798Æ½Ì¨ÒªÇóuboot¾µÏñ³¤¶È±ØÐë¿é´óÐ¡¶ÔÆë£¬ËùÒÔ
-- ½«×îºóÒ»¸öblockµÄÊý¾ÝÔÙ´ÎÐ´ÈëÊµÏÖblock´óÐ¡¶ÔÆëÐ´
-- Ð´²Ù×÷µÄÕýÈ·ÐÔÓÉmtd.write½Ó¿Ú±£Ö¤
if((not fldata) or (data and (fldata ~= data))) then
mtd.erase(addr);
if (filename ~= "u-boot.bin.img") then
mtd.write(addr, data);
else
mtd.write(addr, fldata);
end
write_times1 = write_times1 + 1;
end
end
self:notify();
addr = addr + flashSectorSize;
else
addr = endAddr;
end
end

print(string.format("==========> Write Times : %s write_times1 : %s<==========", write_times, write_times1));
myfile:close();
end

function Installer:InstallPlayer(filename)
local myfile = self.ZipArchivepen(filename);

-- Èç¹û¸ÃÎÄ¼þ´ò²»¿ª,Ôò²»ÐèÒª¶Ô´Ë²¿·Ö½øÐÐÉý¼¶
if(not myfile) then
return ;
end

--
-- TODO:
-- ¶ÁÈë×Ô¶¯²¥·ÅÆ÷µÄÄÚÈÝ£¬Í¨¹ýIDE½Ó¿ÚÐ´Èëµ½Ó²ÅÌ
--
end

--¶ÔÑ¹Ëõ°üÀïµÄimgÎÄ¼þ½øÐÐÐ£Ñé£¬Ð£ÑéÕýÈ··µ»Ø1£¬´íÎó·µ»Ø0
function Installer:crc32check( filename)
local myfile = self.ZipArchivepen(filename);

-- Èç¹û¸ÃÎÄ¼þ´ò²»¿ª(¼´ÎÞ´ËÎÄ¼þ),Ôò²»ÐèÒª¶Ô´Ë²¿·Ö½øÐÐÉý¼¶
if(not myfile) then
print(string.format("==>Installer:crc32check not myfile %s , no need to check", filename));
return 1;
end

-- Èç¹ûÓ¦ÓÃ³ÌÐòÎÞÐ£Ñé½Ó¿Ú,Ôò²»ÐèÐ£Ñé£¬Ö±½Ó·µ»Ø³É¹¦£¬ÒÔ¼æÈÝÒÔÇ°µÄÓ¦ÓÃ³ÌÐò
if(not mtd.check_init) then
print(string.format("==>Installer:crc32check not mtd.check_init, no need to check") );
return 1
end
if(not mtd.crc32)then
print(string.format("==>Installer:crc32check not mtd.crc32, no need to check"));
return 1
end

local head = myfile:read(64);--¶Á64¸ö×Ö½ÚµÄÍ·

local filesize = 0;
local filecrc32 = 0;
print(string.format("==>Installermtd.check_init"));
filesize, filecrc32 = mtd.check_init(head);-- ³õÊ¼»¯
print(string.format("==>Installer mtd.check_init over, filesize:%d filecrc:%x!", filesize, filecrc32));
local checksum = 0;
local readlen =0;
local data;
-- ¶ÔÊý¾Ý²¿·Ö¼ÆËãÐ£ÑéºÍ
while (readlen < filesize) do
data = myfile:read(flashSectorSize);
--print(string.format("Installer check crc32:%x ------%x!", checksum, readlen) );
if (filesize - readlen < flashSectorSize) then
checksum = mtd.crc32(checksum, data, filesize - readlen)
else
checksum = mtd.crc32(checksum, data, flashSectorSize)
end
readlen = readlen + flashSectorSize;
end

if (checksum ~= filecrc32) then
print(string.format("==>error: Installer check (%s)crc32 error:%x ------%x!", filename, checksum, filecrc32));
return 0;
end
print(string.format("==>correct: Installer check(%s) crc32 correct:%x ------%x!", filename, checksum, filecrc32));
return 1;
end

function Installer:do_cmd(cmd)
local ret;
if (mtd.run_cmd) then
ret = mtd.run_cmd(cmd);
print(string.format("Installer:do_cmd mtd.run_cmd cmd=%s ret=%d \n", cmd, ret));
else
ret = os.execute(cmd);
print(string.format("Installer:do_cmd os.execute cmd=%s ret=%d \n", cmd, ret));
end
return ret == 0;
end
-- ÔÚÕâÀï¿ØÖÆÕû¸öÉý¼¶¹ý³Ì
-- params:
-- ÎÞ
-- return:
-- ³É¹¦·µ»ØTrue,Ê§°Ü·µ»ØFlaseÒÔ¼°´íÎóÔÒò
function Installer:execute()
--[[
·ÖÇøÅäÖÃÐÅÏ¢±í,À´×ÔÖªÊ¶¿â "Flash ·ÖÇø¹æ»®"
0xa0000000 £ 0xa0040000 256K armboot u-boot
0xa0060000 £ 0xa0460000 4096K kernel + root romfs
0xa0460000 £ 0xa0a60000 6144K application + modules user
0xa0a60000 £ 0xa0c60000 1536K web web
0xa0c60000 £ 0xa0e60000 2560K slave:romfs + kernel + pcidriver slave
0xa0e60000 £ 0xa0e80000 128K custom custom
0xa0e80000 £ 0xa0ec0000 256K logo logo
0xa0ec0000 £ 0xa0f40000 1024K config
0xa0f40000 £ 0xa1000000 1024K config1
]]

local flashPartions =
{
boot = { baseAddr = 0x00000000 , endAddr = 0x00300000 }, --/ 3M boot
env = { baseAddr = 0x00300000 , endAddr = 0x00500000 }, --/ 2M env
uImage = { baseAddr = 0x00500000 , endAddr = 0x00f00000 }, --/ 10M kernel
rootfs = { baseAddr = 0x00f00000 , endAddr = 0x04500000 }, --/ 54M rootfs
web = { baseAddr = 0x04500000 , endAddr = 0x04f00000 }, --/ 10M web
custom = { baseAddr = 0x04f00000 , endAddr = 0x05100000 }, --/ 2M custom
logo = { baseAddr = 0x05100000 , endAddr = 0x05400000 }, --/ 3M logo
config = { baseAddr = 0x05400000 , endAddr = 0x05a00000 }, --/ 6M logs
logs = { baseAddr = 0x05a00000 , endAddr = 0x06400000 }, --/ 10M config
extend1 = { baseAddr = 0x06400000 , endAddr = 0x06c00000 }, --/ 8M extend1
backup = { baseAddr = 0x06c00000 , endAddr = 0x07800000 }, --/ 12M backup
extend2 = { baseAddr = 0x07800000 , endAddr = 0x08000000 }, --/ 8M extend2
}

-- self.ZipArchive Õâ¸ö±äÁ¿ÓÉÍâ²¿³ÌÐòÉèÖÃ,Èç¹ûÃ»ÓÐÉèÖÃ³ÌÐò²»Ó¦¸ÃÔËÐÐµ½ÕâÀï
assert(self.ZipArchive);
local zfile = self.ZipArchive;

local ret, info = selfreInstall();
if(not ret) then
return false, info;
end

-- ¼ÆËãÒªÉý¼¶µÄÎÄ¼þ´óÐ¡ÒÔ¼°´òÓ¡Éý¼¶ÎÄ¼þÇåµ¥
local TotalSize = 0;
print("==>Files in archive");
for file in zfile:files() do
print(file.filename);
TotalSize = TotalSize + file.uncompressed_size;
end
self.TotalSize = TotalSize; -- ×ÜµÄÎÄ¼þ´óÐ¡

mtd.init();

if ( 1 ~= (self:crc32check("u-boot.bin.img"))
or 1 ~= (self:crc32check("uImage.img"))
or 1 ~= (self:crc32check("romfs-x.squashfs.img"))
or 1 ~= (self:crc32check("web-x.squashfs.img"))
or 1 ~= (self:crc32check("custom-x.squashfs.img"))
or 1 ~= (self:crc32check("logo-x.squashfs.img"))) then
--or 1 ~= (self:crc32check("user-x.squashfs.img"))
print("==>Upgrade: crc32check error!");
return false;
end

self:updatePart(flashPartions["boot"], "u-boot.bin.img");
--mtd.saveenv();
self:updatePart(flashPartions["uImage"], "uImage.img");
self:updatePart(flashPartions["rootfs"], "romfs-x.squashfs.img");
--self:updatePart(flashPartions["user"], "user-x.squashfs.img");
self:updatePart(flashPartions["web"], "web-x.squashfs.img");
self:updatePart(flashPartions["custom"], "custom-x.squashfs.img");
-- Éè±¸logo·ÖÇøÄ¬ÈÏ²Á³ý£¬²Á³ýÓë·ñÐèÓ¦ÓÃ³ÌÐòÅäÖÃ£¬EraseLogoÎªÍâ²¿³ÌÐòÅäÖÃ
-- if (self.EraseLogo) then
-- print(string.format("==>correct: Installer EraseLogo executed!"));
-- self:updatePart(flashPartions["logo"], "logo-x.squashfs.img");
-- end
-- Éè±¸logo·ÖÇøÄ¬ÈÏ²Á³ý£¬²Á³ýÓë·ñÐèÓ¦ÓÃ³ÌÐòÅäÖÃ£¬EraseLogoÎªÍâ²¿³ÌÐòÅäÖÃ
-- ÈçÎ´ÅäÖÃ´Ë±êÖ¾£¬logo·ÖÇø½«±»²ÁÐ´
if ((type(self.EraseLogo) == 'nil') or self.EraseLogo) then
print(string.format("==>correct: Installer EraseLogo executed!"));
self:updatePart(flashPartions["logo"], "logo-x.squashfs.img");
end
print(string.format("==>correct: Installer EraseLogo£º%s!", tostring(self.EraseLogo)));
selfostInstall();
print("==>Upgrade finished.");
return true;
end

return Installer;

myk3le · Feb 23, 2021

open install file with WordPad and post it here please

snowidun · Feb 24, 2021

I really have no idea what is not right...many thx

This is the install.lua opened in wordpad..i believe is the same as above

or can download the firmware directly from below ... my model is DH-NVR4216-HDS2 as listed compatible

support

www.dahuatech.com

====================================================
--
-- Copyright (C) 2005 dahua Technologies, All Rights Reserved.
-- 2006-4-25 15:54 Z:\wjj\ven\152\DAHUA\Install.lua
-- 2006-9-21 modified by zhongjl for new partition
--

-- Flash ¿éµÄ´óÐ¡Îª128K
local flashSectorSize = 0x20000;

local Installer = {};
Installer.TotalSize = 0; -- ×ÜµÄÒªÐ´µ½FlashÖÐµÄÊý¾Ý´óÐ¡
Installer.InProgressSize = 0; -- ÓÃÀ´ÔÚÉý¼¶¹ý³ÌÖÐ¿ØÖÆ½ø¶È
Installer.UpgradeSecurityVersion = "2.20"; --Éý¼¶°üÖÐ°æ±¾ÐÅÏ¢ÐèÒªÊÖ¶¯¸üÐÂ£¬ºÍuser/data/hardware.luaÖÐµÄversion±£³ÖÒ»ÖÂ

-- Í¨ÖªÉÏ²ãÓ¦ÓÃ³ÌÐòÉý¼¶µÄ½ø¶ÈÐÅÏ¢
-- params:
-- ÎÞ
-- return:
-- ÎÞ
function Installer:notify()
self.InProgressSize = self.InProgressSize + flashSectorSize;

local progress = self.InProgressSize / self.TotalSize * 100;
if(progress > 100) then
progress = 100;
end;
progress = tonumber(string.format("%d", progress));

-- ×¢Òâµ÷ÓÃ·½Ê½,²»ÊÇself::callback,·ñÔò»áµ¼ÖÂ»Øµ÷³ö´í
self.callback(0x01, progress);
end

-- »ñÈ¡Éý¼¶ÎÄ¼þµÄ°æ±¾ÐÅÏ¢
-- params :
-- filename : Éý¼¶ÎÄ¼þÃû
-- return : ³É¹¦true/Ê§°Üfalse£¬°æ±¾ÐÅÏ¢
function Installer:getHardwareVersion(filename)
local myfile = self.ZipArchive

pen(filename);

-- Ã»ÓÐÎÄ¼þ·µ»ØÊ§°Ü
if(not myfile) then
print(string.format("%s not exist", filename));
return false, "no file";
end

-- imgÍ·½á¹¹
--typedef struct image_header {
-- uint32_t ih_magic; /* Image Header Magic Number */
-- uint32_t ih_hcrc; /* Image Header CRC Checksum */
-- uint32_t ih_time; /* Image Creation Timestamp */
-- uint32_t ih_size; /* Image Data Size */
-- uint32_t ih_load; /* Data Load Address */
-- uint32_t ih_ep; /* Entry Point Address */
-- uint32_t ih_dcrc; /* Image Data CRC Checksum */
-- uint8_t ih_os; /* Operating System */
-- uint8_t ih_arch; /* CPU architecture */
-- uint8_t ih_type; /* Image Type */
-- uint8_t ih_comp; /* Compression Type */
-- uint8_t ih_name[IH_NMLEN]; /* Image Name */
-- uint8_t ih_version[IH_VERLEN]; /* Version Name */----Õâ¸öVersionÊÇ´ò°üµÄÊ±ºò´ò½øÈ¥µÄ£¬¶ÔÓ¦user/data/hardware.luaÖÐµÄversion
--} image_header_t;
--#define IH_NMLEN 26 /* Image Name Length */
--#define IH_VERLEN 6 /* Image Version Length */

-- ¶ÁÈ¡version
myfile:seek("set", 58);
data = myfile:read(6);
myfile:close();
if(data) then
return true, data;
else
return false, "read error";
end
end

-- °²È«»ùÏß°æ±¾Ð£Ñé
-- ¸Ãº¯ÊýÎªÀúÊ·ÒÅÁô£¬²»ÄÜÔÚ´Ëº¯Êý»ù´¡ÉÏÐÞ¸Ä
-- params:
-- ÎÞ
-- return:
-- ³É¹¦·µ»ØTrue, Ê§°Ü·µ»ØFalseÒÔ¼°Ê§°ÜµÄÔÒò
function Installer:checkSecurityBaselineVersion()
local defVersion = "V1.4";
local curVersion = Global.Vendor.SecurityBaselineVersion;
--Éý¼¶°üÖÐ°æ±¾ÐÅÏ¢ÐèÒªÊÖ¶¯¸üÐÂ£¬ºÍÉý¼¶°üconfig.luaÖÐµÄSecurityBaselineVersionÏî±£³ÖÒ»ÖÂ
local newVersion = "V1.4";

if (type(curVersion) ~= "nil") then
--½«×Ö·û´®µÄ°²È«»ùÏß°æ±¾ÐÅÏ¢×ª»»Îª¶ÔÓ¦Êý×Ö
--Ä¿Ç°½öÖ§³Ö°²È«»ùÏß°æ±¾ÐÅÏ¢¸ñÊ½£ºVx.x
--Èç¹ûºóÃæ°²È«»ùÏß°æ±¾ÐÅÏ¢¸ñÊ½±ä¸ü£¬ÏÂÃæµÄ×ª»»Âß¼ÐèÒªÏàÓ¦¸üÐÂ

local sPos;
local ePos;

local defMainVerStr;
local defSubVerStr;
sPos, ePos, defMainVerStr, defSubVerStr = string.find(defVersion, "V(%d+)%.(%d+)");
local defMainVerNum = tonumber(defMainVerStr);
local defSubVerNum = tonumber(defSubVerStr);

local curMainVerStr;
local curSubVerStr;
sPos, ePos, curMainVerStr, curSubVerStr = string.find(curVersion, "V(%d+)%.(%d+)");
local curMainVerNum = tonumber(curMainVerStr);
local curSubVerNum = tonumber(curSubVerStr);

local newMainVerStr;
local newSubVerStr;
sPos, ePos, newMainVerStr, newSubVerStr = string.find(newVersion, "V(%d+)%.(%d+)");
local newMainVerNum = tonumber(newMainVerStr);
local newSubVerNum = tonumber(newSubVerStr);

if (type(defMainVerNum) == "nil" or type(defSubVerNum) == "nil" or type(curMainVerNum) == "nil" or type(curSubVerNum) == "nil" or type(newMainVerNum) == "nil" or type(newSubVerNum) == "nil") then
print(string.format("Error defVersion:%s, curVersion:%s, newVersion:%s", defVersion, curVersion, newVersion));
return false, "Invalid version";
end

print(string.format("Checking SecurityBaselineVersion defVersion:%s(%d %d), curVersion:%s(%d %d), newVersion:%s(%d %d)", defVersion, defMainVerNum, defSubVerNum, curVersion, curMainVerNum, curSubVerNum, newVersion, newMainVerNum, newSubVerNum));

if(((newMainVerNum < defMainVerNum) or (newMainVerNum == defMainVerNum and newSubVerNum < defSubVerNum)) and ((curMainVerNum > defMainVerNum) or (curMainVerNum == defMainVerNum and curSubVerNum >= defSubVerNum))) then
return false, "Invalid version";
end
else
print("curVersion nil");
end

return true;
end

-- ·À»ØÉý£¬¹Ì¼þ°æ±¾¼æÈÝÐÔ¼ì²â£¨·½°¸1:£©
-- params:
-- ÎÞ
-- return:
-- True-¹Ì¼þ°æ±¾¼æÈÝ¿ÉÒÔÉý¼¶, False-¹Ì¼þ°æ±¾²»¼æÈÝ£¬»òÕßÆäËûÔÒò£¬²»ÄÜÉý¼¶£¬·µ»ØÊ§°ÜÔÒò
function Installer:checkFirmwareVersionSheme1()
-- return true;
local fileList = {"u-boot.bin.img",
"uImage.img",
"romfs-x.squashfs.img",
"u-boot_slave.bin.img",
"uImage_slave.img",
"romfs_slave-x.squashfs.img",
"web-x.squashfs.img",
"custom-x.squashfs.img",
"logo-x.squashfs.img",
"user-x.squashfs.img",
"575S_PMX.bin.img",
"romfs2-x.squashfs.img"}

--Éè±¸³ÌÐòµÄhardware°æ±¾ºÅÎª¿Õ£¬¿Ï¶¨ÊÇÀÏ³ÌÐò£¬ÔÊÐíÉý¼¶
local hardwareVersion = Global.Hardware.board.version; --Éè±¸ÉÏ³ÌÐò°æ±¾ºÅ,user/data/hardware.luaÖÐµÄversion
print(string.format("Hardware.board.version:%s", hardwareVersion));
if (type(hardwareVersion) == "nil" or hardwareVersion == "x.xx") then
return true;
end

--°Ñhardware°æ±¾×Ö·û´®ÎÄ¼þ×ª»»Êý×Ö
local sPos;
local ePos;
local hardwareMainVerStr;
local hardwareSubVerStr;
sPos, ePos, hardwareMainVerStr, hardwareSubVerStr = string.find(hardwareVersion, "(%d+)%.(%d+)");
local hardwareMainVerNum = tonumber(hardwareMainVerStr);
local hardwareSubVerNum = tonumber(hardwareSubVerStr);
print("hardwareMainVerStr:%s hardwareSubVerStr:%s hardwareMainVerNum:%d hardwareSubVerNum:%d", hardwareMainVerStr, hardwareSubVerStr, hardwareMainVerNum, hardwareSubVerNum);
--È¡³öÉý¼¶°üÖÐµÄimgÎÄ¼þ£¬È¡³öimgÍ·ÖÐµÄ°æ±¾ºÅ£¬ÓëÉè±¸³ÌÐòµÄhardware°æ±¾ºÅ±È¶Ô
for i, file in fileList do
local ret, version = Installer:getHardwareVersion(fileList);
print(string.format("filename:%s filelist[%d]:%s, version:%s", file, i, fileList, version));
if(ret) then
--Éý¼¶ÎÄ¼þµÄ°æ±¾ºÅ
local mainVerStr;
local subVerStr;
sPos, ePos, mainVerStr, subVerStr = string.find(version, "(%d+)%.(%d+)");
local mainVerNum = tonumber(mainVerStr);
local subVerNum = tonumber(subVerStr);
print("mainVerStr:%s subVerStr:%s mainVerStr:%d subVerStr:%d", mainVerStr, subVerStr, mainVerNum, subVerNum);

--Éý¼¶ÎÄ¼þµÄ°æ±¾ºÅ±ØÐë>=Éè±¸³ÌÐòµÄhardware°æ±¾ºÅ
if ((mainVerNum > hardwareMainVerNum) or (mainVerNum == hardwareMainVerNum and subVerNum >= hardwareSubVerNum)) then
return true;
else
return false, "Invalid version";
end
end
end

return false, "Invalid version";
end

-- ·À»ØÉý£¬¹Ì¼þ°æ±¾¼æÈÝÐÔ¼ì²â£¨·½°¸2:£©
-- params:
-- ÎÞ
-- return:
-- True-¹Ì¼þ°æ±¾¼æÈÝ¿ÉÒÔÉý¼¶, False-¹Ì¼þ°æ±¾²»¼æÈÝ£¬»òÕßÆäËûÔÒò£¬²»ÄÜÉý¼¶£¬·µ»ØÊ§°ÜÔÒò
function Installer:checkFirmwareVersion()

--Éè±¸ÉÏ³ÌÐò°æ±¾ºÅ,user/data/hardware.luaÖÐµÄversion
local hardwareVersion = Global.Hardware.board.version;

--ÔçÆÚ°æ±¾ºÅÊÇ"x.xx"£¬ÔÊÐíÉý¼¶
if (hardwareVersion == "x.xx") then
return true;
end

--»ñÈ¡Éè±¸ÉÏ³ÌÐòµÄ°æ±¾ºÅ£¬²¢×ª»¯³ÉÊý×Ö
local sPos;
local ePos;
local hardwareMainVerStr;
local hardwareSubVerStr;
sPos, ePos, hardwareMainVerStr, hardwareSubVerStr = string.find(hardwareVersion, "(%d+)%.(%d+)");
local hardwareMainVerNum = tonumber(hardwareMainVerStr);
local hardwareSubVerNum = tonumber(hardwareSubVerStr);
print("hardwareMainVerStr:%s hardwareSubVerStr:%s hardwareMainVerNum:%d hardwareSubVerNum:%d", hardwareMainVerStr, hardwareMainVerNum, hardwareMainVerNum, hardwareSubVerNum);

--»ñÈ¡Éý¼¶°üµÄ°æ±¾ºÅ£¬²¢×ª»¯³ÉÊý×Ö
local version = Installer.UpgradeSecurityVersion;
local mainVerStr;
local subVerStr;
sPos, ePos, mainVerStr, subVerStr = string.find(version, "(%d+)%.(%d+)");
local mainVerNum = tonumber(mainVerStr);
local subVerNum = tonumber(subVerStr);
print("mainVerStr:%s subVerStr:%s mainVerNum:%d subVerNum:%d", mainVerStr, subVerStr, mainVerNum, subVerNum);

--Éý¼¶°üµÄ°æ±¾ºÅ±ØÐë>=Éè±¸³ÌÐòµÄhardware°æ±¾ºÅ
if ((mainVerNum > hardwareMainVerNum) or (mainVerNum == hardwareMainVerNum and subVerNum >= hardwareSubVerNum)) then
return true;
else
return false, "Invalid version";
end
return true;
end

-- ¸ù¾ÝÓ¦ÓÃ³ÌÐòÌá¹©µÄÐÅÏ¢ÅÐ¶ÏÊÇ·ñ¿ÉÒÔÉý¼¶
-- params:
-- ÎÞ
-- return:
-- ³É¹¦·µ»ØTrue, Ê§°Ü·µ»ØFalseÒÔ¼°Ê§°ÜµÄÔÒò
function InstallerreInstall()
-- ÕâÀïÎÒÃÇÐèÒª¿¼ÂÇÄÇÐ©ÒòÊý£¿
-- Ó²¼þ°æ±¾ºÅ £¿
-- ÔÓÐÈí¼þµÄ°æ±¾ºÅ£¿
--
local board = Global.Hardware.board;
local hwproduct;
local hwchannel;
local hwversion;
local hwfunction;

print(string.format("Checking hardware information,board name:%s version:%s",
board.name, board.version));
if(board.name ~= "NVR4X-4KS2") then
return false, "Invalid board";
end

--Éý¼¶³ÌÐòÖ±½Ó´ÓÓ²¼þÖÐÈ¡Öµ¡£ÒâÒåÈçÏÂ
--hwproductÈ¡ÖµÈçÏÂ: 2 -- LB; 3 -- LBN; 4 -- LB_ATM; 5 -- GBE; 6 -- LK; 7 -- LS
--hwproductÈ¡ÖµÈçÏÂ: 2 -- IPC4X5; 3 -- A6; 4 -- A8; 5 -- IPVM;
--hwchannelÈ¡ÖµÈçÏÂ: x -- x chans
--hwfunctionÈ¡ÖµÈçÏÂ: 0 -- AUDIO; 1 -- MATRIX; 3 -- LOOP

if(mtd.getinfo)then
hwproduct,hwchannel,hwversion,hwfunction = mtd.getinfo();
print(string.format("Checking hardware id info: product = %x; channel = %x; version = %x; function = %x",
hwproduct,hwchannel,hwversion,hwfunction));
if((hwproduct ~= 3) and (hwproduct ~= 4)) then
print(string.format("product not match"));
return false, "Invalid board";
end
end

-- ÕâÀïÎÒÃÇÐèÒªÐ£Ñé²»Í¬°å±¾µÄ°å×Ó³ÌÐòÊÇ·ñ¿ÉÒÔÍ¨ÓÃ,
-- ÈçÄ¿Ç°LB 1.22µÄÓë LB 2.00µÄ°å×Ó¾Í²»ÄÜÍ¨ÓÃ
-- if(board.version ~= "1.22") then
-- print(string.format("XXXXXXXXXXXX"));
-- return false, "Invalid board version";
-- end

local vendor = Global.Vendor;

print(string.format("Checking vendor information,vendor name:%s", vendor.Name));
if(vendor.Name ~= 'NVR4X-4KS2' and vendor.Name ~= 'DAHUA') then
return false, "Invalid vendor";
end

local curRegion = Global.VersionAreaInformation;

--¹úÄÚ"Inland"; º£Íâ"Abroad"
local newRegion = "Inland";

if(type(curRegion) == "nil") then
print(string.format("Checking VersionAreaInformation, curRegion:nil, newRegion:%s", newRegion));
else
print(string.format("Checking VersionAreaInformation, curRegion:%s, newRegion:%s", curRegion, newRegion));
end

--Èç¹ûcurRegionÎª¿Õ£¬±íÊ¾ÀÏ³ÌÐòÉý¼¶µ½°²È«»ùÏßV1.4¼°ÒÔÉÏ£¬±£³ÖÔÓÐÉý¼¶²ßÂÔ£¬¿ÉÒÔÉý¼¶£»
--Èç¹ûcurRegion²»Îª¿Õ£¬±íÊ¾°²È«»ùÏßV1.4¼°ÒÔÉÏµÄ³ÌÐòÉý¼¶£¬²ÉÓÃÐÂ²ßÂÔ£¬ÏÞÖÆ¹úÄÚº£Íâ»¥ÏàÉý¼¶¡£
if(type(curRegion) ~= "nil" and curRegion ~= newRegion) then
return false, "Regional conflict";
end

return true;
end

-- Éý¼¶Íê³ÉºóµÄ´¦Àí,Èç¿ØÖÆÏµÍ³ÖØÆô
-- params:
-- ÎÞ
-- return:
-- ÎÞ
function InstallerostInstall()
end

-- Éý¼¶Flash·ÖÇø,¶ÔÓÚ²»Í¬µÄÓ¦ÓÃ,Éý¼¶µÄ´¦Àí¿ÉÄÜ²»Ò»Ñù
-- params :
-- part : ±í¸ñ,°üº¬·ÖÇøµÄÆðÊ¼Î»ÖÃÒÔ¼°½áÊøÎ»ÖÃ
-- filename : ÔÚÉý¼¶°üÖÐµÄÎÄ¼þÃû
-- return : ÎÞ
function Installer:updatePart(part, filename)
local myfile = self.ZipArchivepen(filename);
local write_times = 0;
-- Èç¹û¸ÃÎÄ¼þ´ò²»¿ª,Ôò²»ÐèÒª¶Ô´Ë²¿·Ö½øÐÐÉý¼¶
if(not myfile) then
print(string.format("%s not exist", filename));
return ;
end

local addr = part.baseAddr;
local endAddr= part.endAddr;
local data;
local fldata;
local write_times1 = 0;
print(string.format("Start Update : %s ", filename));
-- Ìø¹ýÇ°Ãæ64×Ö½ÚµÄÍ·,ÔÚÐÂµÄÉý¼¶³ÌÐò°æ±¾ÖÐ²»ÐèÒª¶Ô´Ë½øÐÐÐ£Ñé
myfile:seek("set", 64);
while(addr < endAddr) do
fldata = mtd.read(addr,flashSectorSize);
data = myfile:read(flashSectorSize); -- ¶ÁÈëÒ»¿éFlashÉÈÇø´óÐ¡µÄÊý¾Ý
-- if (fldata and data and (fldata ~= data)) then
-- µ±fldataÎª¿ÕµÄÊ±ºòÎªÀÏµÄ³ÌÐò£¬Ö±½Ó²Á³ý

if(data) then
if((not fldata) or (data and (fldata ~= data))) then
print(string.format("Update : %s Addr %x", filename, addr));
mtd.erase(addr);
mtd.write(addr, data);
write_times = write_times+1;
fldata = mtd.read(addr,flashSectorSize);
-- myfile:read¶ÁÈ¡²»×ãÒ»¸öÎïÀí¿éÊý¾ÝÊ±£¬Ö»·µ»ØÊµ¼Ê¶ÁÈ¡³¤¶È
-- ×îºóÒ»¸öÎïÀí¿é±È½ÏÊ±£¬ÏÂÃæµÄÅÐ¶Ï»á³ÉÁ¢
-- Hi3798Æ½Ì¨ÒªÇóuboot¾µÏñ³¤¶È±ØÐë¿é´óÐ¡¶ÔÆë£¬ËùÒÔ
-- ½«×îºóÒ»¸öblockµÄÊý¾ÝÔÙ´ÎÐ´ÈëÊµÏÖblock´óÐ¡¶ÔÆëÐ´
-- Ð´²Ù×÷µÄÕýÈ·ÐÔÓÉmtd.write½Ó¿Ú±£Ö¤
if((not fldata) or (data and (fldata ~= data))) then
mtd.erase(addr);
if (filename ~= "u-boot.bin.img") then
mtd.write(addr, data);
else
mtd.write(addr, fldata);
end
write_times1 = write_times1 + 1;
end
end
self:notify();
addr = addr + flashSectorSize;
else
addr = endAddr;
end
end

print(string.format("==========> Write Times : %s write_times1 : %s<==========", write_times, write_times1));
myfile:close();
end

function Installer:InstallPlayer(filename)
local myfile = self.ZipArchivepen(filename);

-- Èç¹û¸ÃÎÄ¼þ´ò²»¿ª,Ôò²»ÐèÒª¶Ô´Ë²¿·Ö½øÐÐÉý¼¶
if(not myfile) then
return ;
end

--
-- TODO:
-- ¶ÁÈë×Ô¶¯²¥·ÅÆ÷µÄÄÚÈÝ£¬Í¨¹ýIDE½Ó¿ÚÐ´Èëµ½Ó²ÅÌ
--
end

--¶ÔÑ¹Ëõ°üÀïµÄimgÎÄ¼þ½øÐÐÐ£Ñé£¬Ð£ÑéÕýÈ··µ»Ø1£¬´íÎó·µ»Ø0
function Installer:crc32check( filename)
local myfile = self.ZipArchivepen(filename);

-- Èç¹û¸ÃÎÄ¼þ´ò²»¿ª(¼´ÎÞ´ËÎÄ¼þ),Ôò²»ÐèÒª¶Ô´Ë²¿·Ö½øÐÐÉý¼¶
if(not myfile) then
print(string.format("==>Installer:crc32check not myfile %s , no need to check", filename));
return 1;
end

-- Èç¹ûÓ¦ÓÃ³ÌÐòÎÞÐ£Ñé½Ó¿Ú,Ôò²»ÐèÐ£Ñé£¬Ö±½Ó·µ»Ø³É¹¦£¬ÒÔ¼æÈÝÒÔÇ°µÄÓ¦ÓÃ³ÌÐò
if(not mtd.check_init) then
print(string.format("==>Installer:crc32check not mtd.check_init, no need to check") );
return 1
end
if(not mtd.crc32)then
print(string.format("==>Installer:crc32check not mtd.crc32, no need to check"));
return 1
end

local head = myfile:read(64);--¶Á64¸ö×Ö½ÚµÄÍ·

local filesize = 0;
local filecrc32 = 0;
print(string.format("==>Installermtd.check_init"));
filesize, filecrc32 = mtd.check_init(head);-- ³õÊ¼»¯
print(string.format("==>Installer mtd.check_init over, filesize:%d filecrc:%x!", filesize, filecrc32));
local checksum = 0;
local readlen =0;
local data;
-- ¶ÔÊý¾Ý²¿·Ö¼ÆËãÐ£ÑéºÍ
while (readlen < filesize) do
data = myfile:read(flashSectorSize);
--print(string.format("Installer check crc32:%x ------%x!", checksum, readlen) );
if (filesize - readlen < flashSectorSize) then
checksum = mtd.crc32(checksum, data, filesize - readlen)
else
checksum = mtd.crc32(checksum, data, flashSectorSize)
end
readlen = readlen + flashSectorSize;
end

if (checksum ~= filecrc32) then
print(string.format("==>error: Installer check (%s)crc32 error:%x ------%x!", filename, checksum, filecrc32));
return 0;
end
print(string.format("==>correct: Installer check(%s) crc32 correct:%x ------%x!", filename, checksum, filecrc32));
return 1;
end

function Installer:do_cmd(cmd)
local ret;
if (mtd.run_cmd) then
ret = mtd.run_cmd(cmd);
print(string.format("Installer:do_cmd mtd.run_cmd cmd=%s ret=%d \n", cmd, ret));
else
ret = os.execute(cmd);
print(string.format("Installer:do_cmd os.execute cmd=%s ret=%d \n", cmd, ret));
end
return ret == 0;
end
-- ÔÚÕâÀï¿ØÖÆÕû¸öÉý¼¶¹ý³Ì
-- params:
-- ÎÞ
-- return:
-- ³É¹¦·µ»ØTrue,Ê§°Ü·µ»ØFlaseÒÔ¼°´íÎóÔÒò
function Installer:execute()
--[[
·ÖÇøÅäÖÃÐÅÏ¢±í,À´×ÔÖªÊ¶¿â "Flash ·ÖÇø¹æ»®"
0xa0000000 £ 0xa0040000 256K armboot u-boot
0xa0060000 £ 0xa0460000 4096K kernel + root romfs
0xa0460000 £ 0xa0a60000 6144K application + modules user
0xa0a60000 £ 0xa0c60000 1536K web web
0xa0c60000 £ 0xa0e60000 2560K slave:romfs + kernel + pcidriver slave
0xa0e60000 £ 0xa0e80000 128K custom custom
0xa0e80000 £ 0xa0ec0000 256K logo logo
0xa0ec0000 £ 0xa0f40000 1024K config
0xa0f40000 £ 0xa1000000 1024K config1
]]

local flashPartions =
{
boot = { baseAddr = 0x00000000 , endAddr = 0x00300000 }, --/ 3M boot
env = { baseAddr = 0x00300000 , endAddr = 0x00500000 }, --/ 2M env
uImage = { baseAddr = 0x00500000 , endAddr = 0x00f00000 }, --/ 10M kernel
rootfs = { baseAddr = 0x00f00000 , endAddr = 0x04500000 }, --/ 54M rootfs
web = { baseAddr = 0x04500000 , endAddr = 0x04f00000 }, --/ 10M web
custom = { baseAddr = 0x04f00000 , endAddr = 0x05100000 }, --/ 2M custom
logo = { baseAddr = 0x05100000 , endAddr = 0x05400000 }, --/ 3M logo
config = { baseAddr = 0x05400000 , endAddr = 0x05a00000 }, --/ 6M logs
logs = { baseAddr = 0x05a00000 , endAddr = 0x06400000 }, --/ 10M config
extend1 = { baseAddr = 0x06400000 , endAddr = 0x06c00000 }, --/ 8M extend1
backup = { baseAddr = 0x06c00000 , endAddr = 0x07800000 }, --/ 12M backup
extend2 = { baseAddr = 0x07800000 , endAddr = 0x08000000 }, --/ 8M extend2
}

-- self.ZipArchive Õâ¸ö±äÁ¿ÓÉÍâ²¿³ÌÐòÉèÖÃ,Èç¹ûÃ»ÓÐÉèÖÃ³ÌÐò²»Ó¦¸ÃÔËÐÐµ½ÕâÀï
assert(self.ZipArchive);
local zfile = self.ZipArchive;

local ret, info = selfreInstall();
if(not ret) then
return false, info;
end

-- ¼ÆËãÒªÉý¼¶µÄÎÄ¼þ´óÐ¡ÒÔ¼°´òÓ¡Éý¼¶ÎÄ¼þÇåµ¥
local TotalSize = 0;
print("==>Files in archive");
for file in zfile:files() do
print(file.filename);
TotalSize = TotalSize + file.uncompressed_size;
end
self.TotalSize = TotalSize; -- ×ÜµÄÎÄ¼þ´óÐ¡

mtd.init();

if ( 1 ~= (self:crc32check("u-boot.bin.img"))
or 1 ~= (self:crc32check("uImage.img"))
or 1 ~= (self:crc32check("romfs-x.squashfs.img"))
or 1 ~= (self:crc32check("web-x.squashfs.img"))
or 1 ~= (self:crc32check("custom-x.squashfs.img"))
or 1 ~= (self:crc32check("logo-x.squashfs.img"))) then
--or 1 ~= (self:crc32check("user-x.squashfs.img"))
print("==>Upgrade: crc32check error!");
return false;
end

self:updatePart(flashPartions["boot"], "u-boot.bin.img");
--mtd.saveenv();
self:updatePart(flashPartions["uImage"], "uImage.img");
self:updatePart(flashPartions["rootfs"], "romfs-x.squashfs.img");
--self:updatePart(flashPartions["user"], "user-x.squashfs.img");
self:updatePart(flashPartions["web"], "web-x.squashfs.img");
self:updatePart(flashPartions["custom"], "custom-x.squashfs.img");
-- Éè±¸logo·ÖÇøÄ¬ÈÏ²Á³ý£¬²Á³ýÓë·ñÐèÓ¦ÓÃ³ÌÐòÅäÖÃ£¬EraseLogoÎªÍâ²¿³ÌÐòÅäÖÃ
-- if (self.EraseLogo) then
-- print(string.format("==>correct: Installer EraseLogo executed!"));
-- self:updatePart(flashPartions["logo"], "logo-x.squashfs.img");
-- end
-- Éè±¸logo·ÖÇøÄ¬ÈÏ²Á³ý£¬²Á³ýÓë·ñÐèÓ¦ÓÃ³ÌÐòÅäÖÃ£¬EraseLogoÎªÍâ²¿³ÌÐòÅäÖÃ
-- ÈçÎ´ÅäÖÃ´Ë±êÖ¾£¬logo·ÖÇø½«±»²ÁÐ´
if ((type(self.EraseLogo) == 'nil') or self.EraseLogo) then
print(string.format("==>correct: Installer EraseLogo executed!"));
self:updatePart(flashPartions["logo"], "logo-x.squashfs.img");
end
print(string.format("==>correct: Installer EraseLogo£º%s!", tostring(self.EraseLogo)));
selfostInstall();
print("==>Upgrade finished.");
return true;
end

return Installer;

myk3le · Feb 24, 2021

open install.lua with Visual Studio Code and post code here...the procedure is exposed in install file but something could be different from IPC and VTO

myk3le · Feb 24, 2021

try these commands

run dx
run tk
run dr
run dw
run dc
run dl
tftp 0x82000000 .FLASHING_DONE_STOP_TFTP_NOW
sleep 5

post tftp screenshot

snowidun · Feb 25, 2021

myk3le said:
try these commands

run dx
run tk
run dr
run dw
run dc
run dl
tftp 0x82000000 .FLASHING_DONE_STOP_TFTP_NOW
sleep 5

post tftp screenshot

thx for helping ...for some reason it doesnt work and I don't know why...

no choice so I just ordered a rs232 usb cable ..gonna wait for it to arrive to try next week

mtriggiano · Mar 3, 2021

Hi !, I have a VTO2000A and a VTH1510CH blocked, could someone provide me with the firmware to try this method?

cd36 · Mar 4, 2021

I probably should have made this post in here, but I made a new thread. I wanted to cross post here in case anyone that can help missed it though. Thanks,

SD49225T-HN Rebooting

Hey, I have an SD49225T-HN that one morning suddenly got stuck rebooting it seems. It won't completely reboot, as it doesn't go through the initial movement of the camera that it does when powering up, but you can hear it click at regular intervals, see the lens zoom in/out, and if I ping it...

www.ipcamtalk.com

Mc2472 · Mar 14, 2021

mcx said:
Thanks @cor35vet !

It took few minutes to get my HDW5231R-Z live again. I deleted 3 last lines from commands.txt then few clicks and wait for a while.

The camera came with fw dated 2016 07 05 and has time sync failure. So I decided to upgrade but because I'm half blind idiot I chose wrong fw...result - boot loop.

I made a lil donation trough Paypal.

Mc2472 · Mar 14, 2021

I’m able to get option 2 to work but I don’t understand one part. When I unzip the firmware I get a Bin file - where does the .img file come from?

alastairstevenson · Mar 14, 2021

The .bin file is another (slightly modified) zip file.

Mc2472 · Mar 15, 2021

Im working on a HDW5231-ZE that died during a firmware update. Everytime I try this method I get (success.txt file not found). Does anybody know what it means?

Mc2472 · Mar 15, 2021

I spent days trying to restore a 5231 - then i realized all I had to do was put the command line in front of the command and it worked like a charm. Seems like cake once you figure it out. Tibimakai’s post turned on the light for me - Thanks

tftp 0x82000000

tibimakai · Mar 15, 2021

I also had to change the 0x82000000 to 0x02000000. Mine it is the 2mp wedge camera, which I believe it uses the same firmware, if I remember correctly.

Arsach · Mar 26, 2021

myk3le said:
ok i have done success!!!
I write this guideline for help you. Thanks to all especially to @cor35vet
View attachment 83047 View attachment 83048 View attachment 83049 View attachment 83050
View attachment 83305

Hello myk3le,
I also have a VTO3211D (Gen 1 version) and I am currently trying to unbrick it.
I am following your tutorial step by step and facing an issue.
Commands file looks fine :

Code:

tftp 0x82000000 kernel.img; flwrite
tftp 0x82000000 partition-x.cramfs.img; flwrite
tftp 0x82000000 romfs-x.squashfs.img; flwrite
tftp 0x82000000 pd-x.squashfs.img; flwrite
tftp 0x82000000 user-x.squashfs.img; flwrite
tftp 0x82000000 custom-x.squashfs.img; flwrite
tftp 0x82000000 web-x.squashfs.img; flwrite
tftp 0x82000000 data-x.squashfs.img; flwrite
tftp 0x82000000 .FLASHING_DONE_STOP_TFTP_NOW
sleep 5

File is correctly generated in root folder.
However when turning on the VTO here is what I get on WIreshark :
681 243.998038 192.168.1.108 192.168.254.254 TFTP 111 Read Request, File: upgrade_info_7db780a713a4.txt, Transfer type: octet, timeout=1, tsize=0, blksize=1468
690 245.171387 192.168.1.108 192.168.254.254 TFTP 92 Read Request, File: failed.txt, Transfer type: octet, timeout=1, tsize=0, blksize=1468

So it seems there is an issue but I cannot figure out why.
Any idea, it seems you made it work on your side.

Thanks.

alastairstevenson · Mar 27, 2021

Arsach said:
So it seems there is an issue but I cannot figure out why.

What does the netcat output show?
What does the tftp server show?
These are the key items.

I'm guessing that there isn't a gateway on 192.168.1.1 with a route for 192.168.254.254
How have you arranged the network?
On an isolated switch with dual IP addresses on the PC?
Or on the LAN as normal with a route added to the 192.168.1.1 gateway?

Dahua IPC EASY unbricking / recovery over TFTP

Known around here

n3wb

Known around here

n3wb

n3wb

n3wb

n3wb

n3wb

n3wb

n3wb

Attachments

n3wb

Pulling my weight

n3wb

n3wb

n3wb

n3wb

Known around here

n3wb