Dahua locked out Uboot from bad Firmware install.DH-SD8A840-HNF-PA

[Revo2Maxx]

So have a camera that came with CEEN firmware and when trying to add in USA Firmware the camera is now bricked.. I have looked at the SoC in the camera housing. It has a few and they were not related to the camera it self so I removed the camera module, wanted to see if it was setup like some of the other cameras that I have repaired in the past. This PCB don't have any clear USB or Reset pads, Connecting a USB to Serial I get very little data and shows that it is FW dead.. I can't stop UBoot I have even tried a script that has some expected key strokes and this also fails.. At first I thought the SoC was sanded off but it don't seem to be, Rather they put black tape over the chip, So Found it is a CV22 A1 RH from 2020.. Anyone know of a way to get it so I can put the CEEN firmware back in? Thought I would ask before I take the next step of removing chips lol. I don't want to have to get that deep into it if I can figure out another easier method?

Thank you

[Revo2Maxx]

Here is what happens with Putty from Camera module. I have tried to stop it but it just gets to the successfully part and then fails after so long restarts to try again. I can ping the default IP address but no open ports and nothing acting like it is trying to do a pull off port 69,

[Diah]

you are talking on SoC. firmware will written either on SPI or ePROM ! could you show here the Boards from up and downside

this is part of the SoC Sepc
Memory Interfaces
• LPDDR4x / LPDDR4 up to 1.8 GHz clock rate,
32-bit data bus, up to 2 GB capacity
• Two SD controllers
• Boot from SPI / parallel SLC NAND with BCH /
SPI NOR / USB / eMMC
• Single- / dual- / quad-SPI NOR and SPI NAND

[Revo2Maxx]

Thank you for the reply.


So here is 3 pictures, The 2 of the board I didn't take the tape off at that time because I already had a picture of the chip.

[Diah]

so the firmware are saved on this custom NAND chips

[lotas]

THGBMJG6C1LBAIL - eMMC (8GB)

[Diah]

its look as eMMC but its as i wrote custom NAND it process FG NAND, any way.. he need to find the rights pins on SoC to switch it in download mode