Dahua IPC EASY unbricking / recovery over TFTP

[riogrande75]

U gotta use a external power supply (12-24V) and connect it to your VTO. Then you can hook it up a "normal" ethernet switch.
Of course you can use a USB-TTL converter an connect it to the VTO's UART port to see whats going on - but you do not need it necessarily.

 

[fa355115]

Thank you Riodrande ... so I can not use a PoE switch to connect the VTO to ? You confirm with such material the VTO will not be powered on ?
What kind of power supply may I use ? A kind of transfo where I can select the voltage usually goes to 9v ...
? Do you have something in lind I can use to power that on please ?

 

[riogrande75]

No std. PoE, as mentioned in many posts.
If you do not have a lot experience with dc power, UART, embedded devices, etc. I strongly recommend to leave this work to a specialist! You can destroy the device in no time.

 

[fa355115]

ok ... I found this DC power, 12V and 1.8amp.
Is it sufficient and where do I need to connect it to the VTO (I will have to remove the plug and pay attention to the plus / minus) ?

 

[riogrande75]

On the back there are 2 connector blocks of 6 pen's. On the left, there ist "+12V/+24V" and "GND". Just connect it there. Your PS should be sufficient for this.
But as already mentioned, I have the feeling you are not very experienced with this. I recommend once again not to "play arround" with this, as this easily can let go up your device in smoke...

 

[fa355115]

At the point I am, I am ready to buy a new device to replace it ...
Yes, I see :

I need to "cut" the plug, see which wire is plus and which is minus, and put the
- "plus" on the +12V/+24V and
- "minus" on the GND, correct ?

The 2 wires have 1 black and 1 "white" ... I guess the black is the "minus" and white is the "plus".
In any case I will measure with a device and I should have +12V and not -12V

If I remember well my school 30 years ago ?

 

[riogrande75]

Correct!

 

[fa355115]

ok, that will be the first step I will do tomorrow, and connect it as well as my computer to an unmanaged switch.
The VTO has IP 192.168.1.110, I expect the computer to get an IP like 192.168.1.x

Next I need to download the package from 1st post I guess ?

 

[riogrande75]

Just follow the description from 1st post. IP's from pc must be set manually due the fact it acts as a server.

Gesendet von meinem SM-T819 mit Tapatalk

 

[fa355115]

yep but I do not get that IP 192.168.254.254 ... in that case they say that adress is the TFTP server, but that will run on the computer ??

 

[riogrande75]

Follow it step by step! There you learn how to add a 2nd ip to one network interface.

 

[fa355115]

ok, understood, I will start tomorrow. Will you be online in case I have a question please ?
Appreciate !

 

[holiday]

Hi

I bricked one of my cameras and the last known working firmware is "2.460.0000000.16.R. 2017-09-04"
Anyone has a copy of this firmware for me to try?


I tried TFPT it with the latest firmware, although "success.txt" with the TFTP method, it still goes into a loop and with the following error. HELP!! thanks.

Screen dump:
Ncat: Version 7.40 ( Ncat - Netcat for the 21st Century )
Ncat: Listening on 192.168.254.254:5002
gBootLogPtr:00b80008.
spinor flash ID is 0x1940ef
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=118M root=/dev/m
tdblock5 rootfstype=squashfs init=/linuxrc.
TEXT_BASE:01000000
Net: Detected MACID:XX:XX:XX:XX:XX:XX
PHY:0x001cc816,addr:0x00
s3l phy RTL8201 init
partition file version 2
rootfstype squashfs root /dev/mtdblock5
MMC: sdmmc init
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending throu
gh gateway 192.168.1.1Download Filename 'upgrade_info_7db780a713a4.txt'.Download
to address: 0x5000000
Downloading: *
done
Bytes transferred = 201 (c9 hex)
string value is 0
The end of file
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending throu
gh gateway 192.168.1.1Download Filename 'romfs-x.squashfs.img'.Download to addre
ss: 0x2000000
Downloading: *
done
Bytes transferred = 1335360 (146040 hex)

## Checking Image at 02000000 ...
Legacy image found
Image Name: romfs
Created: 2017-11-10 9:05:29 UTC
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 1335296 Bytes = 1.3 MiB
Load Address: 00270000
Entry Point: 003c0000
Verifying Checksum ... OK
Programing start at: 0x00270000
SPI probe: 32768 KiB W25Q256FV at 0:0 is now current device
write : 100%
done
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=118M root=/dev/m
tdblock5 rootfstype=squashfs init=/linuxrc.
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending throu
gh gateway 192.168.1.1Download Filename 'kernel.img'.Download to address: 0x2000
000
Downloading: *
done
Bytes transferred = 1569716 (17f3b4 hex)

## Checking Image at 02000000 ...
Legacy image found
Image Name: kernel
Created: 2017-11-10 9:05:24 UTC
Image Type: ARM Linux Firmware (uncompressed)
Data Size: 1569652 Bytes = 1.5 MiB
Load Address: 000f0000
Entry Point: 00270000
Verifying Checksum ... OK
Programing start at: 0x000f0000
write : 100%
done
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=118M root=/dev/m
tdblock5 rootfstype=squashfs init=/linuxrc.
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending throu
gh gateway 192.168.1.1Download Filename 'user-x.squashfs.img'.Download to addres
s: 0x2000000
Downloading: T
done
Bytes transferred = 15523904 (ece040 hex)

## Checking Image at 02000000 ...
Legacy image found
Image Name: user
Created: 2017-11-10 9:05:42 UTC
Image Type: ARM Linux Standalone Program (uncompressed)
Data Size: 15523840 Bytes = 14.8 MiB
Load Address: 00a40000
Entry Point: 01a70000
Verifying Checksum ... OK
Programing start at: 0x00a40000
write : 100%
done
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=118M root=/dev/m
tdblock5 rootfstype=squashfs init=/linuxrc.
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending throu
gh gateway 192.168.1.1Download Filename 'web-x.squashfs.img'.Download to address
: 0x2000000
Downloading: *
done
Bytes transferred = 6529088 (63a040 hex)

## Checking Image at 02000000 ...
Legacy image found
Image Name: web
Created: 2017-11-10 9:05:31 UTC
Image Type: ARM Linux Standalone Program (uncompressed)
Data Size: 6529024 Bytes = 6.2 MiB
Load Address: 003c0000
Entry Point: 00a40000
Verifying Checksum ... OK
Programing start at: 0x003c0000
write : 100%
done
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=118M root=/dev/m
tdblock5 rootfstype=squashfs init=/linuxrc.
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending throu
gh gateway 192.168.1.1Download Filename 'partition-x.cramfs.img'.Download to add
ress: 0x2000000
Downloading: *
done
Bytes transferred = 8256 (2040 hex)

## Checking Image at 02000000 ...
Legacy image found
Image Name: partition
Created: 2017-11-10 9:05:24 UTC
Image Type: ARM Linux Standalone Program (uncompressed)
Data Size: 8192 Bytes = 8 KiB
Load Address: 000e0000
Entry Point: 000f0000
Verifying Checksum ... OK
Programing start at: 0x000e0000
write : 100%
done
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=118M root=/dev/m
tdblock5 rootfstype=squashfs init=/linuxrc.
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending throu
gh gateway 192.168.1.1Download Filename 'custom-x.squashfs.img'.Download to addr
ess: 0x2000000
Downloading: *
done
Bytes transferred = 102464 (19040 hex)

## Checking Image at 02000000 ...
Legacy image found
Image Name: custom
Created: 2017-11-10 9:05:44 UTC
Image Type: ARM Linux Standalone Program (uncompressed)
Data Size: 102400 Bytes = 100 KiB
Load Address: 01b20000
Entry Point: 01b40000
Verifying Checksum ... OK
Programing start at: 0x01b20000
SPI probe: 32768 KiB W25Q256FV at 0:1 is now current device
write : 100%
done
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=118M root=/dev/m
tdblock5 rootfstype=squashfs init=/linuxrc.
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending throu
gh gateway 192.168.1.1Download Filename 'pd-x.squashfs.img'.Download to address:
0x2000000
Downloading: *
done
Bytes transferred = 45120 (b040 hex)

## Checking Image at 02000000 ...
Legacy image found
Image Name: pd
Created: 2017-11-10 9:05:43 UTC
Image Type: ARM Linux Standalone Program (uncompressed)
Data Size: 45056 Bytes = 44 KiB
Load Address: 01b10000
Entry Point: 01b20000
Verifying Checksum ... OK
Programing start at: 0x01b10000
SPI probe: 32768 KiB W25Q256FV at 0:1 is now current device
write : 100%
done
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=118M root=/dev/m
tdblock5 rootfstype=squashfs init=/linuxrc.
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending throu
gh gateway 192.168.1.1Download Filename '.FLASHING_DONE_STOP_TFTP_NOW'.Download
to address: 0x2000000
Downloading: #
done
partition file version 2
rootfstype squashfs root /dev/mtdblock5
fail to load bootargsParameters.txt
fail to load bootargsParameters.txt file
cmdLine console=ttyS0,115200 mem=118M root=/dev/mtdblock5 rootfstype=squashfs in
it=/linuxrc



Serial:

U-Boot 2010.06-svn573&B
՝▒1▒▒▒▒▒j▒▒Қ▒Ғ▒▒j▒>.▒▒▒▒▒▒▒▒5
DRAM: 118 MiB
gBootLogPtr:00b▒▒▒.▒5▒pX▒▒役▒fylg▒W▒ͥ▒▒▒2
▒▒▒▒▒▒͡▒́▒▒▒▒ٽ[▒▒▒
>▒▒▒▒bootargs,▒Ʌ▒▒▒▒▒▒k▒▒▒▒ttyS0,115200 mem=118M root=/dev/mtdblock5 rootfstype= ▒Յ͡▒́init=/linuxrc.▒▒e|>▒▒Detected MACID:14:a7:8b:5d:7b:f5
PHY:0x001cc816,addr:0▒0
s3l phy RT▒8▒▒ι▒▒▒▒pa.W▒▒▒▒▒V▒▒▒W▒▒役▒>C▒▒▒▒́▒닁/dev/m|▒~lock5ø▒~▒ sdmmc init
\▒TP ▒▒▒▒server 192.168.254.254; our IP address is 192.168.1.▒▒▒▒▒▒▒▒▒▒▒through gateway ▒N&9▒▒r▒r▒j
Downloa|▒|▒▒▒▒▒▒▒^▒Ʌ▒▒}▒▒▒▒}▒db780a713a4.txt'.
ȗ▒▒▒▒▒▒▒▒Y▒▒▒▒▒▒▒ starting again
Try again use ▒▒▒▒▒}͕▒ٕ▒▒▒5
.▒ qy▒~>▒͕▒ٕɥ▒ not set
Failed to get info.txt
Fai▒Using ambarella mac device
TFTP from server 192.168.254.▒M▒z▒ɁIP address is 192.168.1.1>8▒sen|ing▒|h~ough g ateway 192.168.1.1
Download Filename 'fail▒n▒ownl+▒▒▒▒▒^~
Retry count exceeded; starting again
support backupVer:255
state:ff,err_count:05
s3lm nor flash doesn't support safe mode
sP▒▒|~o~g:▒▒▒▒▒Z▒ ▒W25Q256FV at 0:0 is now current device
## ▒▒▒▒▒rrrj
▒ ▒mqge▒>▒▒▒.▒▒▒3.10.73
Created: 2017-11-09 22:03:10 UTC
Image Type: ARM ▒Z▒▒Kernel Image (uncomp~gss▒d9▒▒"▒х▒Size: 1569588 Bytes = 1.5 MiB
Load ▒▒▒▒▒▒▒~▒▒▒▒▒▒▒繝▒▒leckswm▒... ▒▒K
OK
~artition file>ve~sion▒nrootfstype squashfs root /dev/m||~▒k▒▒C▒fail to load boo tavgsParame|ers.txt
fail to load bo▒▒ɝ▒A▒Ʌ▒▒ѕ▒͹▒▒V▒▒5▒▒͹▒▒5fayl |o~▒▒▒▒▒▒▒▒▒A▒Ʌ▒▒ѕ▒͹txt file
pa~t^役▒file version 2
~ootfstype uashཽ|▒▒▒߽mtdblock5
fail to get half-boot partition in

 

[fa355115]

ok, so once I have connected my VTO and computer to the switch, and established the network configutation on the computer, and powered on the VTO using the 12V DC, what is next ?
I have extracted the tools (tftp server, commands.bat, etc ...), but what do I need to execute now ?

 

[catcamstar]

ok, so once I have connected my VTO and computer to the switch, and established the network configutation on the computer, and powered on the VTO using the 12V DC, what is next ?
I have extracted the tools (tftp server, commands.bat, etc ...), but what do I need to execute now ?

Read the first post again:

If you looked at the thread I linked at the start of this post you should know what to do now:

• Find working firmware for your camera.
• Extract firmware using 7zip/WinRAR.
• Confirm it is actually compatible using the HWID.
• Place the extracted .img files into the root directory.
• Write appropriate commands.txt to flash the img files onto the camera
  • Your camera should have some predefined ones in printenv, like:
  • dr=tftp 0x82000000 romfs-x.squashfs.img; flwrite
  • In this case you can run above by putting run dr into the commands.txt
  • Check the thread linked at the start for a description of all commands.
  • cfgRestore might be useful if you want to reset your camera.

HOWEVER: NEVER FLASH THE BOOTLOADER, THERE IS NEVER A REASON TO!!! (unless it's gone, but then this tutorial won't help you ^^)

But if you didn't read all the instructions correctly to this point, I'm pretty sure you will blow up your VTO right away.

 

[fa355115]

That is ok catamstar ... I am ready to buy a new one ... I already consider mine as for the trash.
- I have the correct firmware of the VTO
- Extracted the .bin file under the root directory (it is not an img file but a bin right ?)
- commands .txt I will use the one already used by a precedent user :

run dc
run dr
run du
run dd
run dw
run dk
run up
tftp 0x82000000 pd-x.cramfs.img; flwrite
tftp 0x82000000 .FLASHING_DONE_STOP_TFTP_NOW
sleep 5

- confirm the FW is compatible is not clear to me ... on the console I need to type the printenv but what should I expect ?
- Run TFTPServer.bat and Console.bat ... that means I can only power my VTO using the 12V DC at that moment and not before ?!?

 

[riogrande75]

Yes. As soon as it is powered on it should download all the files from the tftp server and flash it. If all went ok, it should boot up.
If not (failed.txt) you have to do this a couple of times.

 

[fa355115]

ok ... there is something first about checking that the FW is "compatible" ? how does it work, is it typing the printenv in the console to return some output ans see if FW is ok or not ?

Many Thanks !

 

[riogrande75]

If you have a VTO2000A then you shoud know your device. I guess you do not have to check the HWID.

 

[fa355115]

ok ;-)