HIKVISION mtd Brick Recovery Guide

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,929
Reaction score
6,777
Location
Scotland
i can telnet to 192.0.0.64 - min-system. but tftp not.
In the 'min-system' mode, with the telnet shell (assuming it's not 'psh'), you should be able to use the tftp client in the camera to transfer either the original mtdblock6 or a fixed-up version back in so that you can replace what's in the camera.
You need a 'normal' tftp server, not the Hikvision-specific tftp update tool.
One that works OK is this one : TFTPD32 : an opensource IPv6 ready TFTP server/service for windows : TFTP server
With the required mtdblock6 in the same folder as tftpd32.exe try these commands at the camera telnet shell :

tftp -g -r my_mtdblock6 tftp_server_IP_address
cat my_mtdblock6 > /dev/mtdblock6
reboot

now my camera is on 192.0.0.64 - 2CD-Min-System - from brick-fix tool.
If you leave the camera for about 10 minutes after applying the brick-fix tool, the camera watchdog will reboot into 'min-system' mode (that's normal) and at that point telnet access should be possible.
 

almemento

n3wb
Joined
May 15, 2015
Messages
17
Reaction score
6
In the 'min-system' mode, with the telnet shell (assuming it's not 'psh'), you should be able to use the tftp client in the camera to transfer either the original mtdblock6 or a fixed-up version back in so that you can replace what's in the camera.
You need a 'normal' tftp server, not the Hikvision-specific tftp update tool.
One that works OK is this one : TFTPD32 : an opensource IPv6 ready TFTP server/service for windows : TFTP server
With the required mtdblock6 in the same folder as tftpd32.exe try these commands at the camera telnet shell :

tftp -g -r my_mtdblock6 tftp_server_IP_address
cat my_mtdblock6 > /dev/mtdblock6
reboot


If you leave the camera for about 10 minutes after applying the brick-fix tool, the camera watchdog will reboot into 'min-system' mode (that's normal) and at that point telnet access should be possible.
Ok, i understand. but i dont have original mtdblock5 / mtdblock6 files. i deleted it by mistake. is not possible to do that without this files? or i need them?
i dont have 2nd this type camera 2532f-is ;/
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,929
Reaction score
6,777
Location
Scotland

almemento

n3wb
Joined
May 15, 2015
Messages
17
Reaction score
6
yes. copy that I extracted from camera - i deleted it. in camera is now modified mtd5&mtd6

i can modify whatever incorrect but i dont remember what and where to correct ... i need sample mtd5&mtd6 from someone probably. if its not possible to do that without this files.

have someone i can attach there mtd5 & mtd6 from 2532f-is? please
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,929
Reaction score
6,777
Location
Scotland
OK, attached are your files with the values in the bytes associated with the 'enhanced mtd hack' corrected.
I have assumed the devType is 0x9814 which would show as a decimal value of 38932 in the result of your prtHardInfo telnet command, which you need to check.
Good luck!
 

Attachments

almemento

n3wb
Joined
May 15, 2015
Messages
17
Reaction score
6
OK, attached are your files with the values in the bytes associated with the 'enhanced mtd hack' corrected.
I have assumed the devType is 0x9814 which would show as a decimal value of 38932 in the result of your prtHardInfo telnet command, which you need to check.
Good luck!
Hi,
i do this without check devType, i can not prtHardInfo so ... i try. and it worked! English worked! You are the best!
So:
1. do brick_tool
2. cuteftp and tftp32 do mtdblock5 and mtdblock6 from your package upload to /dev/ on camera
3. telnet ... cat files, etc.
4. reboot
5. wait on sadptool for camera in 2CD-Min-System
6. ping camera, telnet to tftp - use tftp hikvision and 5.30 downgrader pack - digicap.dav
7. wait for upload
8. reboot
9. worked!

so now: can I upload newest version? ...
 

almemento

n3wb
Joined
May 15, 2015
Messages
17
Reaction score
6
Yes, I believe so. But do it in stages, don't skip intermediate versions.
This was the 'enhanced mtd hack'.
Very good! Im now 5.4.5 EN version. i have also my Polish language! that awesome!

So can i do the same with my 2032F?
and what about 2035 ? model
 

cruing

n3wb
Joined
Oct 4, 2017
Messages
19
Reaction score
1
Hi all,

my camera DS-2CD2432F-IW is in "Min-System" mode after I tried to update the firmware.
I can see it with SADP (192.168.1.64) but I can't change the parameters (IP, tec.), I can't access with telnet and TFTP doesn't recognize the camera.
I haven't got a copy of the mtd files.
What can I do to unbrick the camera?
What is a "power cycle", just power off and than power on the device?

Thank you very much
 

Attachments

Last edited:

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,929
Reaction score
6,777
Location
Scotland
my camera DS-2CD2432F-IW is in "Min-System" mode after I tried to update the firmware.
If the firmware you tried to update it with was 5.4.0 or higher, and it didn't work, there is a 'downgrade block' in place that leaves you with a 'Catch-22' situation.
If so, the 'brick-fix tool' will deal with that, and allow the use of the '5.3.0 to 5.2.5'downgrader' (try the CN version first) to recover the camera.
But you will need to set the PC IP address to 192.0.0.128, not the 192.168.1.128 as per your screenshot.

After recovering the camera, you'll likely have CN menus.
Consider doing the 'enhanced mtd hack' to convert to EN/ML and make the camera upgradeable.
Hikvision DS-2CD2x32-I (R0) brick-fix tool / full upgrade method / fixup roundup.
 

cruing

n3wb
Joined
Oct 4, 2017
Messages
19
Reaction score
1
But you will need to set the PC IP address to 192.0.0.128, not the 192.168.1.128 as per your screenshot.
Thank you very much for your reply, but the current address of the camera (in the "Min-System" mode) is 192.168.1.64 and even if the PC IP address is 192.0.0.128 I haven't got Telnet or RFTP access...
Thanks in advance for any suggestion
 

Attachments

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,929
Reaction score
6,777
Location
Scotland
The tftp updater is tested for by the bootloader when the IP address is set for the purpose. It is almost invariably 192.0.0.64 but can be set differently in the bootloader environment variables.
When min-system mode is entered, the IP address is set to a different unrelated value.

The tftp updater is not seeing any probes from the camera.
Common causes:
Windows firewall inbound rules not allowing the probes to reach the tftp updater. Did you get a popup when it was first run?
A wired connection, not WiFi, and via a switch not direct.
Also, the tftp updater can be troublesome with Windows 10.
 

cruing

n3wb
Joined
Oct 4, 2017
Messages
19
Reaction score
1
The tftp updater is not seeing any probes from the camera.
Common causes:
Windows firewall inbound rules not allowing the probes to reach the tftp updater. Did you get a popup when it was first run?
A wired connection, not WiFi, and via a switch not direct.
Also, the tftp updater can be troublesome with Windows 10.
I connected the camera to a PC with Windows XP and now the TFTP recognize the camera! Thanks for the advice!
Now I have to find the correct Firmware for my Model (DS-2CD2432F-IW) because TFTP doesn't complete the upgrade with the firmware that I tried...
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,929
Reaction score
6,777
Location
Scotland
What exact firmware did you try?
Is this a Chinese camera? Does it have CCCH in the serial number?
If the firmware you tried to update it with was 5.4.0 or higher, and it didn't work, there is a 'downgrade block' in place that leaves you with a 'Catch-22' situation.
If so, the 'brick-fix tool' will deal with that, and allow the use of the '5.3.0 to 5.2.5'downgrader' (try the CN version first) to recover the camera.
If not a Chinese camera, plenty of firmware here : DOWNLOAD PORTAL
 
Top