I have an old Lorex system bought from Costco many years ago. The model number is LNR6108 which is a Dahua OEM. I have been looking for ways to load a Dahua firmware to it. After digging around, I finally found a way to do this and upgraded the firmware to Dahua v4 firmware which seems to be much nicer than the Lorex stock version. I learned a lot from this forum during the process, so I thought I would share this here to benefit others. This method involves using tftp and connection to the serial port inside the NVR.
1. Hardware connection
The NVR has a serial port on the board. The connection is labeled in the attached image. (The original picture was found on this forum for a Dahua DVR, which is identical to the board in the Lorex.) I believe the connector is 1.5mm JST type. I don't have a plug available, so I managed to crimp some rectangular connectors and inserted into the pins. I also inserted small pieces of paper in between the connectors to avoid shorting them. Then the wires can be connected to a USB-serial adapter. The 3.3V connection is not needed. The TX pin on the board should be connected to RX on the adapter, and vice versa. I might have mislabeled the RX/TX pins, but if you don't see any output, simply swap them. You also need an ethernet cable to connect your computer to any of the camera ports on the back of the NVR.
2. Software preparation
On the computer, you will need a serial monitor (I used Tera Term VT). Baud rate: 115200, 8 bit, none parity, stop bit 1, flow control none. When the NVR is powered up, you should see the output message.
You need to interrupt the auto boot process and enter the boot environment. I learned most of this from the following post. Please read it though carefully. The remaining steps are very similar to the procedures described in that post.
Note: make sure to back up your environment variables (copy the output from printenv).
TFTP server on your computer: I used Tftpd64 which is very simple and straightforward.
3. Firmware preparation
Download the v3 version of the Dahua firmware that matches your NVR type. For LNR6108, it corresponds to NVR4X-4KS2. I downloaded DH_NVR4XXX-4KS2_Eng_V3.216.0000000.0.R.180605.bin from Index of /Firmware/Rejestratory/NVR/NVR4xxx-4KS2/Stare
Rename the .bin file to .zip. You can then open it and see the contents inside which are a bunch of img files. Copy the romfs-x.squashfs.img file to the TFTP working folder. This file contains the main application software for the NVR.
4. Flashing the firmware
The post linked above discussed using "run up" to download update.img file from TFTP server and flash it to the NVR. The update.img file is a single file that contains everything from the .bin file. However, most of the downloaded firmware .bin files do not contain this update.img. But what we really need is only to flash romfs-x.squashfs.img. To do this, instead of "run up", execute the following
run dr
This will download the romfs-x.squashfs.img from TFTP and flash it to the NVR. After it completes flashing, the NVR will reboot and load the Dahua software. If the system successfully boots up, congratulations, your NVR now runs the Dahua firmware. Afterwards, to upgrade to Dahua V4 firmware, simply use the regular USB method.
I actually learned this command from the printout of the environmental variables. There are a few lines that define a series of download actions
da=tftp u-boot.bin.img; flwrite
dr=tftp romfs-x.squashfs.img; flwrite
du=tftp user-x.squashfs.img; flwrite
dw=tftp web-x.squashfs.img; flwrite
dl=tftp logo-x.squashfs.img; flwrite
dc=tftp custom-x.squashfs.img; flwrite
up=tftp update.img; flwrite
tk=tftp uImage; bootm
dk=tftp uImage.img; flwrite
If you execute "run" + any of these commands, it basically download the corresponding file from the TFTP server, for example, "run up" downloads the update.img, which is not available in most of the firmware files.
That being said, if you ever brick your NVR, you can simply flash each of these files from a Lorex stock firmware to unbrick it.
Enjoy your refreshed "Dahua" NVR!
1. Hardware connection
The NVR has a serial port on the board. The connection is labeled in the attached image. (The original picture was found on this forum for a Dahua DVR, which is identical to the board in the Lorex.) I believe the connector is 1.5mm JST type. I don't have a plug available, so I managed to crimp some rectangular connectors and inserted into the pins. I also inserted small pieces of paper in between the connectors to avoid shorting them. Then the wires can be connected to a USB-serial adapter. The 3.3V connection is not needed. The TX pin on the board should be connected to RX on the adapter, and vice versa. I might have mislabeled the RX/TX pins, but if you don't see any output, simply swap them. You also need an ethernet cable to connect your computer to any of the camera ports on the back of the NVR.
2. Software preparation
On the computer, you will need a serial monitor (I used Tera Term VT). Baud rate: 115200, 8 bit, none parity, stop bit 1, flow control none. When the NVR is powered up, you should see the output message.
You need to interrupt the auto boot process and enter the boot environment. I learned most of this from the following post. Please read it though carefully. The remaining steps are very similar to the procedures described in that post.
Note: make sure to back up your environment variables (copy the output from printenv).
TFTP server on your computer: I used Tftpd64 which is very simple and straightforward.
3. Firmware preparation
Download the v3 version of the Dahua firmware that matches your NVR type. For LNR6108, it corresponds to NVR4X-4KS2. I downloaded DH_NVR4XXX-4KS2_Eng_V3.216.0000000.0.R.180605.bin from Index of /Firmware/Rejestratory/NVR/NVR4xxx-4KS2/Stare
Rename the .bin file to .zip. You can then open it and see the contents inside which are a bunch of img files. Copy the romfs-x.squashfs.img file to the TFTP working folder. This file contains the main application software for the NVR.
4. Flashing the firmware
The post linked above discussed using "run up" to download update.img file from TFTP server and flash it to the NVR. The update.img file is a single file that contains everything from the .bin file. However, most of the downloaded firmware .bin files do not contain this update.img. But what we really need is only to flash romfs-x.squashfs.img. To do this, instead of "run up", execute the following
run dr
This will download the romfs-x.squashfs.img from TFTP and flash it to the NVR. After it completes flashing, the NVR will reboot and load the Dahua software. If the system successfully boots up, congratulations, your NVR now runs the Dahua firmware. Afterwards, to upgrade to Dahua V4 firmware, simply use the regular USB method.
I actually learned this command from the printout of the environmental variables. There are a few lines that define a series of download actions
da=tftp u-boot.bin.img; flwrite
dr=tftp romfs-x.squashfs.img; flwrite
du=tftp user-x.squashfs.img; flwrite
dw=tftp web-x.squashfs.img; flwrite
dl=tftp logo-x.squashfs.img; flwrite
dc=tftp custom-x.squashfs.img; flwrite
up=tftp update.img; flwrite
tk=tftp uImage; bootm
dk=tftp uImage.img; flwrite
If you execute "run" + any of these commands, it basically download the corresponding file from the TFTP server, for example, "run up" downloads the update.img, which is not available in most of the firmware files.
That being said, if you ever brick your NVR, you can simply flash each of these files from a Lorex stock firmware to unbrick it.
Enjoy your refreshed "Dahua" NVR!
