One Firmware, Many Logos: How the Dahua Firmware Finder Works

Say you own an Amcrest IP4M-1041, a little pan-and-tilt camera, and you want to know if there’s newer firmware for it. You go to Amcrest’s site and find a file. Then you go to Dahua’s site, and EmpireTech’s, and a Polish distributor’s FTP server, and you find more files with completely different names. Which ones will actually install on your camera?

That question is why I built the Dahua Firmware Finder. It tracks about 9,500 firmware files from 51 sources, works out which devices each one is built for, and keeps a permanent copy of every file on the Internet Archive. This post covers how it does that, and the thing I learned along the way: a huge number of “different” cameras are the same hardware with a different sticker on it.

One Factory, Many Logos

Dahua is one of the largest security camera makers in the world, but a lot of their cameras never say “Dahua” anywhere on the box. They’re sold as white-label products: Dahua builds the hardware and software, and another company puts its own brand on it. Amcrest, Lorex, EmpireTech, IC Realtime, Intelbras in Brazil, RVI in Russia, and dozens of smaller brands all sell Dahua hardware under their own names.

This is extremely common in embedded devices, the small computers built into things like cameras, routers, TVs and smart plugs. Designing a circuit board, writing the software for it, and getting it certified is expensive. It’s much cheaper for a brand to buy a finished product and change the logo, the default settings, and maybe the app it connects to. Underneath, the hardware is the same.

That’s good news if you’re looking for firmware. If Amcrest stops releasing updates for your camera, Dahua, or another rebrand of the same camera, might still be releasing them. The catch is figuring out which of their products is “the same camera,” because nobody publishes that list.

One Firmware, a Whole Family of Devices

The second thing that makes this work is how manufacturers handle variations. A company might sell a 2-megapixel camera and a 4-megapixel camera, a dome and a bullet, a version with a microphone and one without. Those look like different products, but they’re usually built around the same platform: the same main chip (the SoC, or “system on a chip,” which is the processor, video encoder and more in one package), the same basic board design, and the same software. The differences are small parts like the image sensor, the lens, or whether a WiFi chip is installed.

Maintaining separate software for every variant would be a nightmare, so the manufacturer writes one firmware for the whole platform. When it boots, it checks which variant it’s running on and adjusts. Dahua even gives its platforms code names, and you’ll see them in firmware file names: Rhea, Volt, Kant, Themis, Taylor, Mao-Molec.

Here’s a real example. Amcrest’s firmware Amcrest_IPC-Consumer-Web-Mao-Molec_Eng_N_AMCREST_V2.800.1ENN001.0.R.241029.bin is listed by Amcrest for three products:

• IP2M-841B-V3 (a 2MP camera)
• IP4M-1041
• IP4M-1041B (4MP cameras)

Inside the file, the firmware says it installs on two Dahua boards: IPC-AW26WN-S2 and IPC-AW46WN-S2. Both are built on the same SigmaStar SSC325 chip. The “2” and “4” are the megapixels, and the “W” means WiFi. Three Amcrest products, two Dahua boards, one firmware file.

Some platforms are much bigger. One Rhea-platform camera firmware in the collection lists 326 different device models it will install on.

Step 1: Finding the Firmware

The tool behind the site is amcrest-compatible-finder, a Python program with one module per source. (It started as a way to find firmware for Amcrest cameras, hence the name.) Every source publishes its files differently, so each module knows how to read one of them:

• Official sites: Dahua’s download center across its regional sites, Dahua China’s support portal, Dahua France’s document center.
• Rebrands: Amcrest, Lorex, EmpireTech, IC Realtime, Intelbras, Montavue, RVI and others. Some of these are web pages, some are public cloud folders (Google Drive, Dropbox, MEGA, SharePoint), and one is a public Amazon S3 bucket.
• Distributors’ file servers: old FTP servers in the Czech Republic, Poland, Ukraine, Hong Kong and elsewhere, some of which have been quietly hosting files since 2012.
• Forum posts: files people shared on forums like IPCamTalk.
• The Wayback Machine: for files a company used to host but deleted. If the Internet Archive captured the download link years ago, the tool can still get the file.

Not every brand that sells cameras sells Dahua cameras, and some brands switch suppliers. One line from GSS turns out to be Hikvision, a competitor, and some old DVRs are something else entirely. So every download gets its file header checked, and anything that isn’t Dahua is set aside rather than mixed in.

Downloads also get checked for damage. Most Dahua firmware is a variation of a zip file, and zip files end with a directory listing everything inside. If that directory is missing, the download got cut off. A cut-off firmware can’t be installed, so the site warns about those, and the tool keeps looking for a complete copy somewhere else.

Finally, every file gets a SHA-256 hash, a fingerprint of its exact contents. Vendors constantly rename the same file, so the fingerprint is how the tool knows that a file on Amcrest’s site and a differently named file on a Polish FTP server are byte-for-byte identical.

Step 2: Reading What the Firmware Says About Itself

This is the interesting part. Vendors’ websites tell you which models they sell a firmware for, which is usually a short and incomplete list. The firmware itself knows better, because it has to protect itself from being installed on the wrong hardware. Flash a camera with firmware meant for a different board and you can turn it into a paperweight, so before installing, the camera checks a list inside the update. The tool reads that same list.

The tool never runs anything from the firmware. It opens the package the same way an unzip program would, and reads a few small text files inside it:

• hwid and check.img: the list of exact hardware IDs the camera checks before it accepts the update. These are the most reliable.
• Install or Install.lua: the installer script, which often names the board family, like IPC-HX3XXX.
• Headers on the boot loader and kernel images, as a last resort.

Here’s what the hwid list looks like in the Amcrest firmware from earlier:

IPC-AW26WN-S2:01:02:08:77:3B:00:01:10:01:01:04:320:00:02:00:00:01:00:00:00:80
IPC-AW46WN-S2:01:02:08:89:3C:00:01:10:01:01:04:320:03:02:00:00:00:00:00:00:80

The part before the first colon is the device ID. Everything after it describes details of that board’s hardware revision. Two lines, two boards, so this firmware is compatible with both.

One rule keeps this from going wrong. The same firmware’s Install file says IPC-HX3XXX, an entire family of cameras. If the tool counted that, this firmware would look compatible with hundreds of cameras it would never install on. So when a firmware has both, only the most specific list counts. The family name is kept, but only as a hint.

Some firmware can’t be read this way. About 400 newer files are encrypted, so nothing inside them can be read without Dahua’s keys. About 400 more are for tiny microcontrollers, like the motor controller in a pan-tilt-zoom camera, which have no list to read. For those, the site falls back to what the vendors say.

Step 3: Learning Everything Else

Once a package is open, there’s a lot more to learn from it:

• The chip. The boot loader and the device tree (a file that describes the hardware to Linux) name the SoC. Across the collection, most firmware is for HiSilicon chips, followed by Ambarella, SigmaStar, Novatek and Rockchip.
• The flash layout. A partition table lists where each piece goes on the camera’s flash memory: boot loader, kernel, filesystem, settings. This shows which parts an update replaces and which it leaves alone.
• Security settings. Whether the update is signed, and its “security baseline” version. A camera with a higher baseline may refuse to go back to older firmware, which matters if you’re thinking about downgrading.
• Region and language. The video standard (NTSC for North America, PAL for most other places) and the languages the menus support.

Even the file name carries information once you know how to read it. Take DH_IPC-HX1X3X-Kant_EngSpnRus_PN_V2.860.0000000.40.R.260515.zip:

DH	Who it was built for. DH is Dahua; General is Dahua’s unbranded build; Amcrest, Customer and others are OEM builds.
IPC-HX1X3X-Kant	The product line and platform. X is a wildcard, so this covers a range of IP cameras on the Kant platform.
EngSpnRus	Menu languages: English, Spanish and Russian.
PN	Video standards: PAL and NTSC.
V2.860.0000000.40.R	The version. The middle section identifies the build’s customer or branch, and R means a release build.
260515	The build date: May 15, 2026.

Step 4: Flipping the List Around

At this point the tool has, for every firmware, the list of devices it installs on. That’s backwards from what people need, since you start with a device and want firmware. So the site flips it around: for each of the 6,000+ device IDs, it collects every firmware that lists it and sorts them newest first. It also adds retail model names from every vendor, so searching “IP4M-1041” leads to the Dahua board inside it, and from there to firmware from any brand for that board.

Doing this also shows the platforms. When dozens of devices have exactly the same list of compatible firmware, they’re almost certainly the same platform with minor changes. The site groups those into platform pages: about 240 groups, covering roughly 2,500 devices, each with one firmware list shared by every device in it.

Step 5: Saving Everything

Firmware disappears all the time. Companies redesign their websites, stop supporting old products, go out of business, or switch to other suppliers and delete everything. Several of the sources this tool reads are already gone except for old Wayback Machine captures.

So every firmware gets uploaded to the Internet Archive, about 0.9 TB so far. Each file gets its own archive item with its checksums, the vendors and models it was listed for, the hardware IDs inside it, and the original download link. Identical copies under different names are uploaded once and listed as aliases. The site links to the archived copy first, so a download keeps working even after the vendor’s link dies.

There’s also a list of firmware that’s been mentioned in release notes, forums or other vendors’ listings but hasn’t been found yet. If someone has one of those files, it can be added to the collection.

A Word of Caution

Matching hardware IDs means a firmware should install, not that it’s a good idea. The firmware’s own checks are a strong signal, but they aren’t perfect, and installing another brand’s firmware (called cross-flashing) has real risks:

• The camera may reject it as the wrong brand.
• If it installs, you can lose brand-specific features, like that company’s app or cloud service.
• If something goes wrong partway through, recovering the device can take a serial cable and some patience.

Back up your settings, check your exact hardware ID in the device’s web interface, and never cut power during an update.

The Bigger Picture

None of this is specific to security cameras. The same pattern shows up in routers, smart TVs, dashcams and DJ gear: a few manufacturers build platforms, many brands sell them, and one firmware covers a whole family of devices. Once you know to look for it, the label on the box tells you much less than the list inside the firmware.

If you have a Dahua or rebranded device, you can search for it on the Firmware Finder. The code for both the firmware tool and the site is on GitHub.