Hello,

I ran your scripts successfully on my VTO2000A. Could you also add the VTH1550CH? I am getting this output when I extract the software with the VTO2000A switch.

/home/bavilo/Dahua-Firmware-Mod-Kit-master# ./extract.py firmware.bin -c VTO2000A
WARNING	Found config: VTO2000A
INFO	Extracting 9 files to: 'firmware.bin.extracted'
INFO	Processing 'Install'.
INFO	Processing 'dm365_ubl_boot_16M.bin.img'.
INFO	Processing 'kernel-x.cramfs.img'.
INFO	Processing 'romfs-x.cramfs.img'.
INFO	Processing 'user-x.cramfs.img'.
WARNING	Unrecognized file: 'gui-x.cramfs.img'.
INFO	Processing 'data-x.cramfs.img'.
INFO	Processing 'pd-x.cramfs.img'.
INFO	Processing 'custom-x.cramfs.img'.

I doubt that this will compile successfully.

Thanks!

Dec 30 '17 17:12 Bavilo

Since there is no partition img in the firmware I'm going to need you to telnet to your device, run cat /proc/mtd and paste the output here.

Dec 31 '17 21:12 BotoX

Sadly I can not access the panel via telnet. All attempts in activating telnet have failed.

Jan 01 '18 14:01 Bavilo

Hello, I run cat /proc/mtd

cat /proc/mtd

product:VTH1510:0:4:2:0:5:4:1:2:3:3:1:1B0:0:0:0:6:0:0:1 dev: size erasesize name mtd0: 00040000 00010000 "bootloader" mtd1: 00020000 00010000 "HWID" mtd2: 00020000 00010000 "custom" mtd3: 00200000 00010000 "kernel" mtd4: 00300000 00010000 "rootfs" mtd5: 00200000 00010000 "web" mtd6: 000a0000 00010000 "backup" mtd7: 000a0000 00010000 "config" mtd8: 00020000 00010000 "product" mtd9: 00600000 00010000 "user" mtd10: 00120000 00010000 "data"

Jan 17 '18 12:01 dimetta

Could you also print the output of the mount command?

There is a "web" partition in the mtd list but no web.img in the firmware. However the firmware has a "gui" partition but that doesn't exist in the mtd list...

Currently I came up with this: VTH1510.py

from .config import *

DAHUA_FILES = OrderedDict([
	("Install", {
		"required": True,
		"type": DAHUA_TYPE.Plain
	}),
	("dm365_ubl_boot_16M.bin.img", {
		"required": True,
		"type": DAHUA_TYPE.Plain,
		"size": 0x00040000
	}),
	("kernel-x.cramfs.img", {
		"required": True,
		"type": DAHUA_TYPE.Plain,
		"size": 0x00200000
	}),
	("romfs-x.cramfs.img", {
		"required": True,
		"type": DAHUA_TYPE.uImage | DAHUA_TYPE.CramFS,
		"size": 0x00300000
	}),
	("user-x.cramfs.img", {
		"required": True,
		"type": DAHUA_TYPE.uImage | DAHUA_TYPE.SquashFS,
		"size": 0x00600000
	}),
	("gui-x.cramfs.img", {
		"required": True,
		"type": DAHUA_TYPE.uImage | DAHUA_TYPE.CramFS,
		"size": 0x00200000
	}),
	("web-x.cramfs.img", {
		"required": True,
		"type": DAHUA_TYPE.uImage | DAHUA_TYPE.CramFS,
		"size": 0x00200000
	}),
	("data-x.cramfs.img", {
		"required": True,
		"type": DAHUA_TYPE.uImage | DAHUA_TYPE.CramFS,
		"size": 0x00120000
	}),
	("pd-x.cramfs.img", {
		"required": True,
		"type": DAHUA_TYPE.uImage | DAHUA_TYPE.CramFS,
		"size": 0x00020000
	}),
	("custom-x.cramfs.img", {
		"required": True,
		"type": DAHUA_TYPE.uImage | DAHUA_TYPE.CramFS,
		"size": 0x00020000
	})
])

Jan 19 '18 15:01 BotoX

Tomorrow I'll take off the mount. We fixed the config. Extracted and built firmware. Downloaded on VTH1510. After reboot, it does not turn on. How do we reset it? Through the serial port?

Jan 21 '18 15:01 dimetta

You're going to have to flash it with working firmware through the serial port using TFTP. See: https://ipcamtalk.com/threads/dahua-ipc-unbricking-recovery-over-serial-uart-and-tftp.16474/

Jan 21 '18 18:01 BotoX

mount

rootfs on / type rootfs (rw) /dev/root on / type cramfs (ro) proc on /proc type proc (rw) sysfs on /sys type sysfs (rw) tmpfs on /dev type tmpfs (rw) none on /proc/bus/usb type usbfs (rw) devpts on /dev/pts type devpts (rw) /dev/ram0 on /var type ramfs (rw) /dev/ram2 on /utils type ramfs (rw) /dev/mtdblock6 on /mnt/backup type jffs2 (rw) /dev/mtdblock7 on /mnt/mtd type jffs2 (rw) /dev/mtdblock9 on /usr type squashfs (ro) /dev/mtdblock2 on /mnt/custom type cramfs (ro) /dev/mtdblock5 on /mnt/web type cramfs (ro) /dev/mtdblock8 on /mnt/pd type cramfs (ro) /dev/mtdblock10 on /mnt/data type cramfs (ro) /dev/mmc0p1 on /mnt/sd type vfat (rw,fmask=0022,dmask=0022,codepage=cp437,iocharset=iso8859-1)

Jan 22 '18 06:01 dimetta

We found a serial port image 2018-01-24 12 20 21

Jan 24 '18 09:01 dimetta

I'm looking forward for a solution, too. I bought a VTH1510CH from aliexpress and want to change the language into german. Is there a way to download the original firmware from my device as a backup?

Feb 16 '18 16:02 stonemuc

I'm trying to build a new image, but the following ERROR message is shown after starting the build script: root@sebi-VirtualBox:/home/sebi/Downloads/Dahua-Firmware-Mod-Kit-master# sudo python3 ./build.py -c VTH1510 NEU WARNING Found config: VTH1510 INFO Checking required files/directories. ERROR Could not find required '.uImage' file for file: 'web-x.cramfs.img' Traceback (most recent call last): File "./build.py", line 311, in builder.Build(args.source) File "./build.py", line 69, in Build raise Exception("Missing requirement!") Exception: Missing requirement! root@sebi-VirtualBox:/home/sebi/Downloads/Dahua-Firmware-Mod-Kit-master#

Feb 18 '18 15:02 stonemuc

I have the same problem like stonemuc. Does anybody have a solution for it?

Apr 07 '18 12:04 OrisCoding

Hi, I am also fiddeling around with the FW for VTH. Unfortunately I bricked my VTH too. When trying to unbrick via serial I used by mistake 48V POE adapter instead of 24V POE. This resulted in a completely killed VTO. After researching I found that I killed a capacitor (which had a short). After replacing it with the one from the direct 12V source it was working fine again, puhhh.
I just wanted to let you know that (for me at least) with following step you will brick your VTH: Attention, with following steps you will brick the VTH and need to recover via serial: What I did try is simply replace web in the config.py with gui. I still do no understand why it bricked? Then everything was going well without error and I had a img file. But it did not work. This is just FYI.

PS: The reason why I started to upgrade the FW was the reason initially that the VTO (which I also upgraded) was not working anymore with the IOS app. So any1 same issue and any solution? as workaround: I wrote a small c program which now listen on my RPi and then send out via telegram screenshots. Very unhappy that Dahua is not providing any API for developers,...

Apr 17 '18 18:04 denimjeans

after digging bit more I found a workaround, maybe also the solution. you can upload only data-img etc. only when you update the INSTALL script.

Not sure if someone still read this thread... anyone know why when telnetd is enabled on the VTH it immediately close the connection on FW 3.1 or higher?

here is my VTH config which should work now, please test and reply back :

from .config import *

DAHUA_FILES = OrderedDict([
    ("Install", {
        "required": True,
        "type": DAHUA_TYPE.Plain
    }),
    ("dm365_ubl_boot_16M.bin.img", {
        "required": True,
        "type": DAHUA_TYPE.Plain,
        "size": 0x00040000
    }),
    ("kernel-x.cramfs.img", {
        "required": True,
        "type": DAHUA_TYPE.Plain,
        "size": 0x00200000
    }),
    ("romfs-x.cramfs.img", {
        "required": True,
        "type": DAHUA_TYPE.uImage | DAHUA_TYPE.CramFS,
        "size": 0x00300000
    }),
    ("user-x.cramfs.img", {
        "required": True,
        "type": DAHUA_TYPE.uImage | DAHUA_TYPE.SquashFS,
        "size": 0x00600000
    }),
    ("gui-x.cramfs.img", {
        "required": True,
        "type": DAHUA_TYPE.uImage | DAHUA_TYPE.CramFS,
        "size": 0x00200000
    }),
    ("data-x.cramfs.img", {
        "required": True,
        "type": DAHUA_TYPE.uImage | DAHUA_TYPE.CramFS,
        "size": 0x00120000
    }),
    ("pd-x.cramfs.img", {
        "required": True,
        "type": DAHUA_TYPE.uImage | DAHUA_TYPE.CramFS,
        "size": 0x00020000
    }),
    ("custom-x.cramfs.img", {
        "required": True,
        "type": DAHUA_TYPE.uImage | DAHUA_TYPE.CramFS,
        "size": 0x00020000
    })
])

if you want to update data only then change the INSTALL script like this:

{
   "Commands" : [
      "burn data-x.cramfs.img data"
   ],
   "Devices" : [
      [ "VTH1510", "1.10" ],
      [ "VTH1510", "1.20" ],
      [ "VTH1510CH", "1.10" ],
      [ "VTH1510CH", "1.20" ],
      [ "VTH1510CH", "1.50" ],
      [ "VTH1510CH", "1.60" ],
      [ "VTH1510CH", "1.90" ],
      [ "VTH1660CH", "1.10" ],
      [ "VTH1660CH", "1.20" ],
      [ "VTH1550CHW-2", "1.10" ],
      [ "VTH1550CHW-2", "1.20" ],
      [ "VTH52X1D", "1.10" ],
      [ "VTH52X1D", "1.20" ],
      [ "VTH5221D", "1.10" ],
      [ "VTH5221D", "1.20" ],
      [ "VTH1560B-W", "1.10" ],
      [ "VTH1560B-W", "1.20" ],
      [ "VTH5241D", "1.10" ],
      [ "VTH5241D", "1.20" ],
      [ "VTH5222CH", "1.10" ]
   ],
   "Vendor" : "General_Multi3"
}

please note that you need to change the HEADER of the IMG file -> replace the DH with PK. Then do the changes, then revert back to DH and upload.

Apr 30 '18 14:04 denimjeans

Yes! we need it! pls, Does anyone know hot to have root access to VTH1550CH ?, I saw one post , he already get SSH root access for VTO2111D-WP

Jun 06 '19 20:06 tjunussov

Maybe for someone would interesting, I managed out how to get SSH acces to VTH1550

Enable SSH toggler in GUI ( By pressing for 8 sec Settings and go to Network config )
Connect ssh: root:7ujMko0{GUI PASSWORD}@{VTH IP ADDRESS} it will get to DSH (D**ua protected ssh )
Type "shell", and enter Domain Account "888888" you will get QR code
Here i stacked :(

Jun 16 '19 12:06 tjunussov

Anyone to update the software and change logo please

Aug 27 '19 17:08 Rokit12

Does anyone know how to change the default Dahua boot up logo on their new NVR Recorders running 4.0+ GUI Firmware? I am wanting to add a custom boot logo and also change the default Dahua channel logo for unconnected cameras to my own logo. I used to be able to do this with their older firmware v3+ using the 1.1RECUpgrade Tool (DVR Upgrade Tool Ver1.16) If anyone can help that would be awesome :)

Oct 28 '22 05:10 mark-dep

Please support the Dahua VTH1550CH

cat /proc/mtd

mount