Hikvision DS-2CD2612F-I bricked

[garyjduk]

Hi,

Anyone got a suggestion what is wrong with this camera? It has 5.3.0-150327 on the sticker and the camera appears to have the UL sticker on it so I don't think it's a Chinese version.
I've tried TFTP various firmwares and the 5.3.0.150327 but the camera doesn't appear in SADP/No webGUI but pings on 192.168.1.64.
I've connected via serial to the camera and this is the log

U-Boot 1.3.4-113988 (Mar 20 2015 - 17:36:32)

ARM Clock: 480MHz
DDR Clock: 336MHz
Hit Ctrl+u to stop autoboot: 0
[ INFO][MIN]FORMAT: Formatting Flash
[ INFO][MIN]FORMAT: ................................
[ INFO][MIN]FORMAT: Format Flash [OK]
[ INFO][MIN]TFTP: TFTP from server 192.0.0.128
[ INFO][MIN]TFTP: Filename: 'digicap.dav'
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ############################################
[ INFO][MIN]TFTP: Download File [OK]
[ INFO][MIN]BURN: File size is 21615145 bytes (21108 KB)
[ INFO][MIN]BURN: Writing Flash
[ INFO][MIN]BURN: ..........................................................
[ INFO][MIN]BURN: Write Flash [OK]
***** UPDATE COMPLETE *****

BusyBox v1.2.1 Protect Shell (psh)
Enter 'help' for a list of davinci system commands.

# ▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒

U-Boot 1.3.4-113988 (Mar 20 2015 - 17:36:32)

ARM Clock: 480MHz
DDR Clock: 336MHz
Hit Ctrl+u to stop autoboot: 0
|BIND err|
Unknown command:null
booting from pri part...
load kernel...
load ramdisk...
init started: BusyBox v1.19.3 (2015-03-20 17:37:48 CST)
starting pid 375, tty '': '/etc/init.d/rcS'
Starting udev: [ OK ]
UBI device number 1, total 192 LEBs (24772608 bytes, 23.6 MiB), available 0 LEBs (0 bytes), LEB size 129024 bytes (126.0 KiB)
waiting for /dev/ubi1_0.
pri_iUpgSuccCnt:0x1, sec_iUpgSuccCnt:0x1
UBI device number 3, total 32 LEBs (4128768 bytes, 3.9 MiB), available 0 LEBs (0 bytes), LEB size 129024 bytes (126.0 KiB)
waiting for /dev/ubi3_0.
Check dir /davinci ok! (0)
UBI device number 4, total 32 LEBs (4128768 bytes, 3.9 MiB), available 0 LEBs (0 bytes), LEB size 129024 bytes (126.0 KiB)
waiting for /dev/ubi4_0.
Check dir /config ok! (0)
route: ioctl 0x890c failed: No such process
mount: mounting none on /proc/bus/usb failed: No such file or directory
/dav
map_size = 0x300000
nr_item = 3
addr_offset = 0x0 filename = orccode.bin
addr_offset = 0x200000 filename = orcme.bin
addr_offset = 0x2a0000 filename = default_binary.bin
mmap returns 0x4036a000
loading ./orccode.bin...addr = 0x4036a000, size = 0x19f02d
loading ./orcme.bin...addr = 0x4056a000, size = 0x36374
loading ./default_binary.bin...addr = 0x4060a000, size = 0x40000
===============================
u_code version = 2013/10/24 3.0
===============================
ln: /dev/rtc: File exists
=====check_config start=====
===db file doesn't exist===
===db file doesn't exist===
==== both config files are broken====
pppoed==>pppoed ret -1.
netprocess version: 1.4.0 [20:10:19-Mar 10 2015].
No need to recover kernel pri partition.
No need to recover ramdisk pri partition.
[01-18 23:48:53][pid:832][IPC][ERROR] from daemon ack, dst not work len 0 , load_type is [10012]
[01-18 23:48:53][pid:832][UNI_IF][ERROR]65554:ipc_unix_call_service failed, ret = -3.
[01-18 23:48:53][pid:832][UNI_IF][ERROR]communicaite_to_davinci failed!!!
[01-18 23:48:53][pid:828][IPC][ERROR]daemon can not find Dst process.load_type 0x10012 is_need_ack 1
[01-18 23:48:54][pid:828][IPC][ERROR]daemon can not find Dst process.load_type 0x10012 is_need_ack 1
[01-18 23:48:54][pid:832][IPC][ERROR] from daemon ack, dst not work len 0 , load_type is [10012]
[01-18 23:48:54][pid:832][UNI_IF][ERROR]65554:ipc_unix_call_service failed, ret = -3.
[01-18 23:48:54][pid:832][UNI_IF][ERROR]communicaite_to_davinci failed!!!
infd read End
Unix bus 0 .
[01-18 23:48:55][pid:828][IPC][ERROR]daemon can not find Dst process.load_type 0x10012 is_need_ack 1
[01-18 23:48:55][pid:832][IPC][ERROR] from daemon ack, dst not work len 0 , load_type is [10012]
[01-18 23:48:55][pid:832][UNI_IF][ERROR]65554:ipc_unix_call_service failed, ret = -3.
[01-18 23:48:55][pid:832][UNI_IF][ERROR]communicaite_to_davinci failed!!!
[01-18 23:48:56][pid:828][IPC][ERROR]daemon can not find Dst process.load_type 0x10012 is_need_ack 1
[01-18 23:48:56][pid:832][IPC][ERROR] from daemon ack, dst not work len 0 , load_type is [10012]
[01-18 23:48:56][pid:832][UNI_IF][ERROR]65554:ipc_unix_call_service failed, ret = -3.
[01-18 23:48:56][pid:832][UNI_IF][ERROR]communicaite_to_davinci failed!!!
IEfile uncompressed.
[01-18 23:48:57][pid:828][IPC][ERROR]daemon can not find Dst process.load_type 0x10012 is_need_ack 1
[01-18 23:48:57][pid:832][IPC][ERROR] from daemon ack, dst not work len 0 , load_type is [10012]
[01-18 23:48:57][pid:832][UNI_IF][ERROR]65554:ipc_unix_call_service failed, ret = -3.
[01-18 23:48:57][pid:832][UNI_IF][ERROR]communicaite_to_davinci failed!!!
[01-18 23:48:58][pid:828][IPC][ERROR]daemon can not find Dst process.load_type 0x10012 is_need_ack 1
[01-18 23:48:58][pid:832][IPC][ERROR] from daemon ack, dst not work len 0 , load_type is [10012]
[01-18 23:48:58][pid:832][UNI_IF][ERROR]65554:ipc_unix_call_service failed, ret = -3.
[01-18 23:48:58][pid:832][UNI_IF][ERROR]communicaite_to_davinci failed!!!
[01-18 23:48:59][pid:828][IPC][ERROR]daemon can not find Dst process.load_type 0x10012 is_need_ack 1
[01-18 23:48:59][pid:832][IPC][ERROR] from daemon ack, dst not work len 0 , load_type is [10012]
[01-18 23:48:59][pid:832][UNI_IF][ERROR]65554:ipc_unix_call_service failed, ret = -3.
[01-18 23:48:59][pid:832][UNI_IF][ERROR]communicaite_to_davinci failed!!!
[01-18 23:49:00][pid:828][IPC][ERROR]daemon can not find Dst process.load_type 0x10012 is_need_ack 1
[01-18 23:49:00][pid:832][IPC][ERROR] from daemon ack, dst not work len 0 , load_type is [10012]
[01-18 23:49:00][pid:832][UNI_IF][ERROR]65554:ipc_unix_call_service failed, ret = -3.
[01-18 23:49:00][pid:832][UNI_IF][ERROR]communicaite_to_davinci failed!!!
[01-18 23:49:01][pid:828][IPC][ERROR]daemon can not find Dst process.load_type 0x10012 is_need_ack 1
[01-18 23:49:01][pid:832][IPC][ERROR] from daemon ack, dst not work len 0 , load_type is [10012]
[01-18 23:49:01][pid:832][UNI_IF][ERROR]65554:ipc_unix_call_service failed, ret = -3.
[01-18 23:49:01][pid:832][UNI_IF][ERROR]communicaite_to_davinci failed!!!
[01-18 23:49:02][pid:828][IPC][ERROR]daemon can not find Dst process.load_type 0x10012 is_need_ack 1
[01-18 23:49:02][pid:832][IPC][ERROR] from daemon ack, dst not work len 0 , load_type is [10012]
[01-18 23:49:02][pid:832][UNI_IF][ERROR]65554:ipc_unix_call_service failed, ret = -3.
[01-18 23:49:02][pid:832][UNI_IF][ERROR]communicaite_to_davinci failed!!!
[01-18 23:49:03][pid:832][IPC][ERROR] from daemon ack, dst not work len 0 , load_type is [10012]
[01-18 23:49:03][pid:832][UNI_IF][ERROR]65554:ipc_unix_call_service failed, ret = -3.
[01-18 23:49:03][pid:832][UNI_IF][ERROR]communicaite_to_davinci failed!!!
[01-18 23:49:03][pid:828][IPC][ERROR]daemon can not find Dst process.load_type 0x10012 is_need_ack 1
[01-18 23:49:04][pid:832][IPC][ERROR] from daemon ack, dst not work len 0 , load_type is [10012]
[01-18 23:49:04][pid:832][UNI_IF][ERROR]65554:ipc_unix_call_service failed, ret = -3.
[01-18 23:49:04][pid:832][UNI_IF][ERROR]communicaite_to_davinci failed!!!
[01-18 23:49:04][pid:828][IPC][ERROR]daemon can not find Dst process.load_type 0x10012 is_need_ack 1
Unix bus End
[01-18 23:49:04][pid:849][CAPA][ERROR]resolution_num_temp = 4
OK
[01-18 23:49:04][pid:849][CAPA][ERROR]resolution_num_temp = 4
OK
[01-18 23:49:04][pid:849][CAPA][ERROR]resolution_num_temp = 4
OK
[01-18 23:49:04][pid:849][CAPA][ERROR]resolution_num_temp = 4
OK
insmod: can't insert 'uart232.ko': File exists
[01-18 23:49:04][pid:849][OTHER][ERROR]db /davinci/ipc_db does not exist
[01-18 23:49:04][pid:849][OTHER][ERROR]db /config/ipc_db_backup does not exist
powerLineFrequencyMode = 0
[01-18 23:49:04][pid:849][UNI_IF][ERROR]unsupport command = 66
[01-18 23:49:04][pid:849][UNI_IF][ERROR]unsupport command = 66
[01-18 23:49:04][pid:849][UNI_IF][ERROR]unsupport command = 66
[01-18 23:49:04][pid:849][UNI_IF][ERROR]unsupport command = 66
@@@motion PAL!!!!!!!!!!!!!!!!!
[01-18 23:49:04][pid:849][UNI_IF][ERROR]stream request out range 3(2)
sqlite3_get_table:1, no such table: db_version
sqlite3_get_table:1, no such table: sec_lock_auth_db_info
[01-18 23:49:04][pid:849][OTHER][ERROR]db_query_open_v2 error: 1
sqlite3_get_table:1, no such table: netconfig_table
sqlite3_get_table:1, no such table: wep_encrypt_info
[01-18 23:49:04][pid:849][OTHER][ERROR] db_query_open_v2 err
sqlite3_get_table:1, no such table: wep_key_list
[01-18 23:49:04][pid:849][OTHER][ERROR] db_query_open_v2 err
sqlite3_get_table:1, no such table: ipaddr_list
[01-18 23:49:04][pid:849][OTHER][ERROR] db_query_open_v2 err
sqlite3_get_table:1, no such table: local_port_list
[01-18 23:49:04][pid:849][OTHER][ERROR] db_query_open_v2 err
sqlite3_get_table:1, no such table: pppoe_config_info
davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

starting pid 864, tty '': '-/bin/sh'


BusyBox v1.19.3 (2015-03-20 17:37:48 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

BusyBox v1.2.1 Protect Shell (psh)
Enter 'help' for a list of davinci system commands.

# davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

===maxEnchan: 1
davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

[01-18 23:49:09][pid:849][OTHER][ERROR]can not open file /config/ipc_db_backup
[01-18 23:49:09][pid:849][OTHER][ERROR]ipc_db_backup need backup.
<init_run>3367_devcfg->ccdPara[1].capture_mode [5]
<MEGA_DSP>Platform Value:
<MEGA_DSP>Main mux type [0x4].
<MEGA_DSP>Sub mux type [0x4].
<MEGA_DSP>Thi mux type [0x2].
<MEGA_DSP>audio enc type[0x2].
<MEGA_DSP>voicetalk type[0x2].
<MEGA_DSP>Need PS SysHdr[0].
[01-18 23:49:09][pid:849][SYSINIT][ERROR]device not support RS485
[01-18 23:49:09][pid:849][HW_IF][ERROR]transfer_485_config_options error [options:57]
davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

<DSP> DBG:init_dsp_lib() begin
<DSP> DBG:init_dsp_lib() end
[01-18 23:49:15][pid:849][DSP][ERROR][2]g_pdsp->audioTBShare.frameLen=80, g_pdsp->audioTBShare.totalFrame=128..
mknod: /dev/snd/controlC0: File exists
mknod: /dev/snd/pcmC0D0c: File exists
mknod: /dev/snd/pcmC0D0p: File exists
[01-18 23:49:15][pid:849][HW_IF][ERROR]<read_fixed_noise_info_from_flash> (CFG_MAGIC != read.magicNumber(ffffffff)
davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

<DSP> DBG:setup_dsp() begin
<DSP> DBG:init_cmem_module:cached_size=33030144(31M),noncached_size=6815744(6M)
init_cmem_module:CMEM_cmdline=insmod /dav/cmemk.ko phys_start=0xc6600000 phys_end=0xc8c00000 pools=1x33030144,1x6815744

davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

gdma Init Successful
b_fd=0,b_smd=1,b_scd=0,device_type=15,enableswaec=0
channel 1 is not 1 or 2<DSP> DBGSP start with Vout:Enabled,Audioisabled,VTisabled,MD:Enabled, vsync_guard:Enabled,vout_osd: Disabled, oversampling:Enabled, roi: Enabled, primacy: Disabled . hdr mode Disabled qr Disabled
<DSP> DBG:dsp_object.device_mode 0
<DSP> DBG:enc channel cnt 2, delay mode 0
Use CMEM buffer!
goto_idle done
pDspInitPara->VideoInitParam.capture_mode 83978265(width = 1280, height = 720, fps = 25, interlace = 0)
device_type: 15, vitype: 14, fps: 25.000000
find_video_mode sucusss!! mode 83978265 p_mode_table.vin_mode 65524 vin_object.vin_fps 25.000000 vin w 1280 h 720
set mode 65524 type 14
vin_mode 1280*720 vin_mode_temp 1280*720 vin_mode_temp2 1280*720enc_chan_cnt=2
vin_object.vi_param chan = 1, fps/resolution/width/height = 25/4115/1280/720
vin_object.vi_param chan = 2, fps/resolution/width/height = 25/4097/352/288
#######pDspInitPara vout enable 1
<VidThrd> DBG:update_encode_fps_ctrl: Begin chan=0,maxRate(maxFps)=25.000000,fps=0x1
<VidThrd> DBG:update_encode_fps_ctrl: f_frame_rate=1.000000,clockStep=45000
<VidThrd> DBG:update_encode_fps_ctrl:Finally chan=0,fps=0x1,fpsFlg=0x1,frmPerSec=1,fpsCounter=0,fpsCycle=25,g_md_interval 5 ms
<VidThrd> DBG:update_encode_fps_ctrl: Begin chan=1,maxRate(maxFps)=25.000000,fps=0x19
<VidThrd> DBG:update_encode_fps_ctrl: f_frame_rate=25.000000,clockStep=1800
<VidThrd> DBG:update_encode_fps_ctrl:f_frame_rate=25.000000,[25].clockStep=1800,[25]
<VidThrd> DBG:update_encode_fps_ctrl:Finally chan=1,fps=0x19,fpsFlg=0x1ffffff,frmPerSec=25,fpsCounter=0,fpsCycle=25,g_md_interval 5 ms
<VidThrd> DBG:update_video_config_param: chan=1,encode_type=1, (1280x720), mirror type0, I inerval 50, bps 2007,quality 60 i_quant 29, complexity 1 rate_type 0,p_encode_param->f_frame_rate 25.000000,svc mode 0 qp 6
<chan 1> in None MotionJPEG, skip!
<VidThrd> DBG:update_encode_fps_ctrl: Begin chan=2,maxRate(maxFps)=25.000000,fps=0x19
<VidThrd> DBG:update_encode_fps_ctrl: f_frame_rate=25.000000,clockStep=1800
<VidThrd> DBG:update_encode_fps_ctrl:f_frame_rate=25.000000,[25].clockStep=1800,[25]
<VidThrd> DBG:update_encode_fps_ctrl:Finally chan=2,fps=0x19,fpsFlg=0x1ffffff,frmPerSec=25,fpsCounter=0,fpsCycle=25,g_md_interval 5 ms
<VidThrd> DBG:update_video_config_param: chan=2,encode_type=1, (352x288), mirror type0, I inerval 50, bps 501,quality 60 i_quant 29, complexity 1 rate_type 0,p_encode_param->f_frame_rate 25.000000,svc mode 0 qp 6
<chan 2> in None MotionJPEG, skip!

overlay: start = 0x43e23000, total size = 0x100000 ( bytes)
b_rotate 0 overlay_level48 width 1280 height 720
osd_width 864 osd_scale_first 48 total 41472
b_rotate 0 overlay_level16 width 352 height 288
osd_width 256 osd_scale_first 16 sub total 4096
init osd area success
init osd memory ok
<OSD> DBG:Left=0 pChar->pos=4000000
<SetOsd()> line=0 y=64 line_char_count=16, valid char count 24,osd_lines 0
<SetOsd()> line=1 y=0 line_char_count=0, valid char count 0,osd_lines 0
<SetOsd()> line=2 y=0 line_char_count=0, valid char count 0,osd_lines 0
<SetOsd()> line=3 y=0 line_char_count=0, valid char count 0,osd_lines 0
<SetOsd()> line=4 y=0 line_char_count=0, valid char count 0,osd_lines 0
<SetOsd()> line=5 y=0 line_char_count=0, valid char count 0,osd_lines 0
<SetOsd()> line=6 y=0 line_char_count=0, valid char count 0,osd_lines 0
<SetOsd()> line=7 y=0 line_char_count=0, valid char count 0,osd_lines 0
chan 1, osd size 0 osd_size_changed 1
chan 2, osd size 0 osd_size_changed 1
b_rotate 0 overlay_level16 width 1280 height 720
osd_width 864 osd_scale_first 16 total 13824
b_rotate 0 overlay_level16 width 352 height 288
osd_width 256 osd_scale_first 16 sub total 4096
init osd area success
<OSD> DBG:setosd ok
<OSD> DBG:setosd:END. chan=0,flgOsd=0x1, bStart=1
<OSD> DBG:Left=0 pChar->pos=4000000
<SetOsd()> line=0 y=64 line_char_count=16, valid char count 24,osd_lines 0
<SetOsd()> line=1 y=0 line_char_count=0, valid char count 0,osd_lines 0
<SetOsd()> line=2 y=0 line_char_count=0, valid char count 0,osd_lines 0
<SetOsd()> line=3 y=0 line_char_count=0, valid char count 0,osd_lines 0
<SetOsd()> line=4 y=0 line_char_count=0, valid char count 0,osd_lines 0
<SetOsd()> line=5 y=0 line_char_count=0, valid char count 0,osd_lines 0
<SetOsd()> line=6 y=0 line_char_count=0, valid char count 0,osd_lines 0
<SetOsd()> line=7 y=0 line_char_count=0, valid char count 0,osd_lines 0
chan 1, osd size 0 osd_size_changed 0
chan 2, osd size 0 osd_size_changed 0
<OSD> DBG:setosd ok
<OSD> DBG:setosd:END. chan=1,flgOsd=0x3, bStart=1
<OSD> DBG:Left=0 pChar->pos=4000000
<SetOsd()> line=0 y=64 line_char_count=16, valid char count 24,osd_lines 0
<SetOsd()> line=1 y=0 line_char_count=0, valid char count 0,osd_lines 0
<SetOsd()> line=2 y=0 line_char_count=0, valid char count 0,osd_lines 0
<SetOsd()> line=3 y=0 line_char_count=0, valid char count 0,osd_lines 0
<SetOsd()> line=4 y=0 line_char_count=0, valid char count 0,osd_lines 0
<SetOsd()> line=5 y=0 line_char_count=0, valid char count 0,osd_lines 0
<SetOsd()> line=6 y=0 line_char_count=0, valid char count 0,osd_lines 0
<SetOsd()> line=7 y=0 line_char_count=0, valid char count 0,osd_lines 0
chan 1, osd size 0 osd_size_changed 0
chan 2, osd size 0 osd_size_changed 0
<OSD> DBG:setosd ok
<OSD> DBG:setosd:END. chan=2,flgOsd=0x7, bStart=1
init osd success
davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

<VidThrd> DBG:setup_video_input begin
<VidThrd> ERRlease load source driver!
<VidThrd> ERR:set video source failed!
<DSP> ERR:setup_dsp:setup_video_input
[01-18 23:49:29][pid:849][DSP][ERROR]DSP ▒▒ʼ▒▒ʧ▒▒...
[01-18 23:49:29][pid:849][SYSINIT][ERROR]hwif_dsp_init error force sys reboot,ret=-12!!!!
davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

 

[alastairstevenson]

pDspInitPara->VideoInitParam.capture_mode 83978265(width = 1280, height = 720, fps = 25, interlace = 0)
device_type: 15, vitype: 14, fps: 25.000000
find_video_mode sucusss!! mode 83978265 p_mode_table.vin_mode 65524 vin_object.vin_fps 25.000000 vin w 1280 h 720
set mode 65524 type 14

It looks like the firmware does not have the right driver for the sensor, vitype=14
I'm unfamiliar with that specific model, I'm not sure what sensor it's fitted with. Later I'll see what a type 14 is.
Have you tried a tftp downgrade to the '5.3.0 to 5.2.5 downgrader' here : Custom Firmware Downgrader 5.3.0 Chinese to 5.2.5 English
I'd have expected that to work OK.
And the firmware should be here : DOWNLOAD PORTAL

*edit*
vitype=14 is for "insmod /home/imx122.ko"
The 3MP R0 cameras use vitype=15 which is "insmod /home/ar0330.ko"
however they start as mt9t002

cd /etc/idsp/sensors
mv mt9t002_01_3D.bin ar0330_01_3D.bin
mv mt9t002_02_3D.bin ar0330_02_3D.bin
mv mt9t002_03_3D.bin ar0330_03_3D.bin
mv mt9t002_04_3D.bin ar0330_04_3D.bin

 

[garyjduk]

When I try the '5.3.0 to 5.2.5 downgrader' here : Custom Firmware Downgrader 5.3.0 Chinese to 5.2.5 English
(Attached is the sticker on the cam)

This is what I get:-

BusyBox v1.2.1 Protect Shell (psh)
Enter 'help' for a list of davinci system commands.

# ▒▒▒▒

U-Boot 1.3.4-113988 (Mar 20 2015 - 17:36:32)

ARM Clock: 480MHz
DDR Clock: 336MHz
Hit Ctrl+u to stop autoboot: 2.....▒▒▒[ INFO][MIN]FORMAT: Formatting Flash
[ INFO][MIN]FORMAT: ...................................
[ INFO][MIN]FORMAT: Format Flash [OK]
[ INFO][MIN]TFTP: TFTP from server 192.0.0.128
[ INFO][MIN]TFTP: Filename: 'digicap.dav'
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ######################################################
[ INFO][MIN]TFTP: Download File [OK]
[ INFO][MIN]BURN: File size is 19819598 bytes (19355 KB)
[ INFO][MIN]BURN: Writing Flash
[ INFO][MIN]BURN: [ERROR][MIN]BURN: upgrade_from_digicap: error: language mismatch.

[ INFO][MIN]BURN: Write Flash [OK]
***** UPDATE COMPLETE *****

 

[alastairstevenson]

There are both. CN and EN versions for download at that post - you need to try the other one.

 

[garyjduk]

So the CN version log gives

BusyBox v1.2.1 Protect Shell (psh)
Enter 'help' for a list of davinci system commands.

# ▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒

U-Boot 1.3.4-113988 (Mar 20 2015 - 17:36:32)

ARM Clock: 480MHz
DDR Clock: 336MHz
Hit Ctrl+u to stop autoboot: 0
[ INFO][MIN]FORMAT: Formatting Flash
[ INFO][MIN]FORMAT: ....................................
[ INFO][MIN]FORMAT: Format Flash [OK]
[ INFO][MIN]TFTP: TFTP from server 192.0.0.128
[ INFO][MIN]TFTP: Filename: 'digicap.dav'
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: #############################
[ INFO][MIN]TFTP: Download File [OK]
[ INFO][MIN]BURN: File size is 13042245 bytes (12736 KB)
[ INFO][MIN]BURN: digicap package error!!!

[ INFO][MIN]BURN: Write Flash [FAIL] error: write flash.
!!!!! UPDATE FAIL !!!!!

And the EN version log gives

▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒

U-Boot 1.3.4-113988 (Mar 20 2015 - 17:36:32)

ARM Clock: 480MHz
DDR Clock: 336MHz
Hit Ctrl+u to stop autoboot: 0
[ INFO][MIN]FORMAT: Formatting Flash
[ INFO][MIN]FORMAT: ................................
[ INFO][MIN]FORMAT: Format Flash [OK]
[ INFO][MIN]TFTP: TFTP from server 192.0.0.128
[ INFO][MIN]TFTP: Filename: 'digicap.dav'
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ######################################################
[ INFO][MIN]TFTP: Download File [OK]
[ INFO][MIN]BURN: File size is 19819598 bytes (19355 KB)
[ INFO][MIN]BURN: Writing Flash
[ INFO][MIN]BURN: [ERROR][MIN]BURN: upgrade_from_digicap: error: language mismatch.

[ INFO][MIN]BURN: Write Flash [OK]
***** UPDATE COMPLETE *****

I'm just wondering if going by the sticker that this a different country maybe US/Canada but even the DS-2xx2_5.4.5_170123 from North USA doesn't seem to work?

 

[alastairstevenson]

@garyjduk Did you resolve the bricked camera?

 

[garyjduk]

No still got it sitting on my desk.

 

[Kish]

Hello,

I've had this bricked cam for quite a while, and one day I decided to tinker with it (then wanted to order these cables, and it took forever to come, then forgot, then moved, then got tucked away, then got bored one day and tried to tinker again... but I guess no need for my background on my life).

I got this bricked camera from a buddy who works surveillance, so I I would assume it's coming from a legit source.
It's a
HIK DS-2CD2712F-I
SV: V5.1.2_140116
He also gave me the same model of the camera above (but working), so if you need me to pull any files from that for this, I can do so (may need a bit detailed 'How To' on that... just a heads up)

It's stuck in a boot loop, but I've tried to search multiple forums to see solutions, but none seem to work.
I've tried the custom downgrader, tried loading different flash files, and once I figured out how to connect the UART cable to it, tried the BrickFixV2 way.

@alastairstevenson
I hear you're a hero when it comes to getting these things back to life.
Are you willing to accept my challenge in helping one more? (He asks as Mariah Carey - Hero plays in the background)

The BrickFixV2 is quite an impressive find (at least to me... I'm not all savvy with the way these fixes are being done with these cameras), however, everything seemed to be correct with my camera in that sense.
The closest I see, is Gary's issue above, but without the failed flashes - every version I tried, it ends in success.
Please see attached file for my version of the boot log.

My Vitype is also 14, but it being a different model, I don't know if that's correct or not.
I'm seeing a bunch of errors - same/similar as above, but I wouldn't know where to start to even try to troubleshooting it.

To Add, my setup is currently the camera to a PoE injector to my desktop - there's no delay when I power cycle the camera, and that's confirmed by succesful flashing everytime.
I also have the UART USB thing connected as well (as you probably already know from the logs).

SADP doesn't see anything.

Thanks in advance for anyone who has any suggestions/help!

 

[alastairstevenson]

I'm seeing a bunch of errors - same/similar as above, but I wouldn't know where to start to even try to troubleshooting it.

Your serial console log looks like the classic 'updated the firmware to 5.3.0 or later and the devType in mtdblock6 is masqueraded (ie FF98) and I don't like it so I'll reboot'.
The standard fix for that is the 'enhanced mtd hack' that fixes up mtdblock6 language byte, devType value and the checksum bytes, or the whole brickfixv2 scripted process which incorporates the enhanced mtd hack.
But you can only safely write back a modified mtdblock6 if the camera is running 5.2.5 firmware, or the min-system recovery environment that the brickfixv2 method uses.

Also - as the DS-2CD2712F-I model isn't listed in the brickfixv2 'devtype list' (required to replace the masqueraded devtype value in mtdblock6) it's necessary to be able to run the prtHardInfo shell command to find the devType value. This needs telnet or SSH access to the command shell.

So, suggestions to try:
I don't recall if the 5.1.2 firmware on the working camera yet has telnet access - I suspect not.
If it does, enable it, access telnet, and run prtHardInfo, note down the value shown for devType.

On the bricked one - as the history is muddy - worth trying initially, to get back to 5.2.5, is the @whoslooking '5.3.0 to 5.2.5 downgrader' - Custom Firmware Downgrader 5.3.0 Chinese to 5.2.5 English
But if the camera has ever had firmware 5.4.0 or higher attempted - the Catch-22 downgrade block is in effect, and the only solution is to use the brickfixv2 method.
Which begs the question - how to get the devType value - without breaking the working camera by updating the firmware to get telnet active ...

every version I tried, it ends in success.

Is this with the Hikvision tftp updater tool?
And what firmware have you attempted - eg stock firmware 5.4.0 or higher, the 'downgrader' etc?

 

[Kish]

Thanks for replying so quickly!

Is this with the Hikvision tftp updater tool?
And what firmware have you attempted

Yes, the Hikvision updater - I started on the lowest I could, then slowly kept moving up versions till it worked (but obviously didn't)
After I did all the 'official' ones I could get my hands on (the FTP site doesn't seem to work - at least with me, so I resulted on whatever I could find on these forums), I tried whatever modified fixes I could (ie. downgrader).
The Downgrader was the last one I applied, so to my knowledge, it should have the '5.30 to 5.25' version.
However, I did try your BrickFixV2 method, and during Stage 3, I applied the 5.4.5 version to it... so... yeah, I got caught with the catch.

devType in mtdblock6 is masqueraded (ie FF98)

So when I was doing that fix, and opened up the Hex editor, I was having a hard time wondering where the issue was, as everything was correct per your instructions on to change if it doesn't look like it should (the language was 01, the analysis and checksum were already correct).
Unless I'm talking about something different.

If it does, enable it, access telnet, and run prtHardInfo

Ok, so I slightly lied about having the working one.
After I moved, I took it down at the old place and took it with me, but I'm in a basement now, and have no use for it, so I 'donated' it to my parents house, and my brother already has it up and running.
So, it's not completely out of reach. I plan on going there soon, so I can see if I can access it.
However, what do you mean by 'enable it' - if, let's say I don't have to flash it, shouldn't I just try to log on and that's it, or am I missing something here... or we talking about flashing it to BrickFixV2 one?
I would also have to confirm the working camera's version - as I may of had updated it way back (when it was setup in my possession... last year)

So in a perfect scenario, we can get what we need from the working one and apply it to the broken one?

 

[alastairstevenson]

However, I did try your BrickFixV2 method, and during Stage 3, I applied the 5.4.5 version to it... so... yeah, I got caught with the catch.

That does suggest that mtdblock6 is not correct for that firmware - I'd speculate that it's the 'devType' value in hex locations 64/65
If it show FF98 you will get a bricked camera.

I was having a hard time wondering where the issue was, as everything was correct per your instructions on to change if it doesn't look like it should (the language was 01, the analysis and checksum were already correct).

If you'd like to zip up mtdblock6 and attach I'll check it out for you.

So, it's not completely out of reach. I plan on going there soon, so I can see if I can access it.
However, what do you mean by 'enable it' - if, let's say I don't have to flash it, shouldn't I just try to log on and that's it,

In the web GUI (certainly in the 5.2.5 and 5.3.0 firmware) there are tickboxes to enable telnet and SSH - under a Security tab.
If that's available, use the command prtHardInfo and note down the value against devType
That's required to be correct in mtdblock6
It's a pity I don't have a value for that specific model.

Suggestion to go forward:
As you have serial console access, you can trigger firmware updates via that route.
If the brickfixv2 has been applied - and you indicate that it has - make a copy of the '5.3.0 to 5.2.5 downgrader' named as digicap.dav and place in the same folder as the tftpd32 tftp server.
With the PC IP address set to 192.0.0.128 (the 'serverip' value in the bootloader environment variables) and the tftpd32.exe running :
Power on the camera, interrupt the bootloader, press return a couple of times, and use the command 'update'.
It should download the digicap.dav and validate and apply it.
If that gets the 5.2.5 version running you can check the devType value using prtHardInfo and get mtdblock6 properly fixed up so it will take the newer firmware versions.

 

[Kish]

If you'd like to zip up mtdblock6 and attach I'll check it out for you.

Please see attached - I'm seeing OD 98

I also ran the whole BrickFix process again, and attached the log. It's the usual, but just in case you see something I don't.
Before power cycle when it's flashed, the prtHardInfo doesn't return any results - after power cycle, I have no telnet access.

As for the working one, I'll reply back as soon as I have the info.

It's a pity I don't have a value for that specific model

With any luck, I can add to your list ^_^

 

[alastairstevenson]

I also ran the whole BrickFix process again, and attached the log. It's the usual, but just in case you see something I don't.

That transcript looks perfectly normal - no problems with it.
The final firmware update was accepted as successful.

And your mtdblock6 looks OK too, language=1, checksum is correct, and devType is not FF98

Before power cycle when it's flashed, the prtHardInfo doesn't return any results

That's normal, as the normal davinci program, the main app that would provide that data, isn't running in the min-system environment.

after power cycle, I have no telnet access.

Are you referring to the state after the power cycle following the brickfixv2 install, in other words the state when the /dav/fixup.sh can be run?
Telnet should certainly be available at that point. Not that you actually need it, with the serial console access.

Going back to your original serial console log of the bootloop state we have this fatal error triggering the restart -

<DSP> ERR:setup_dsp:setup_video_input
[06-01 10:45:43][pid:849][DSP][ERROR]DSP ▒▒ʼ▒▒ʧ▒▒...
[06-01 10:45:43][pid:849][SYSINIT][ERROR]hwif_dsp_init error force sys reboot,ret=-12!!!!

This is the same error that occurs when the devType is incorrect. But your was not FF98 and did not need to be fixed up.

However, preceding that fatal error you have this as the likely underlying cause :

<VidThrd> DBG:setup_video_input begin
<VidThrd> ERR:Please load source driver!
<VidThrd> ERR:set video source failed!

This follows a davinci IOCTL request to the kernel, possibly a driver communications status query. I'm guessing a bit here.

So what could cause it not to be able to set up the video input?
Could it be a hardware fault - the kernel not able to communicate with the sensor? Can you check that the ribbon cable to the sensor is properly seated?
It's unlikely to be the devType value incorrect, asking for a type that does not exist, this would have to have been deliberately changed.
Without knowing the history, why it stopped working, I suspect the only way to find out would be swapping a component such as the sensor with another of the same model.

I'm coming to the thought, certainly after all that you've tried, and the data provided, that the cause of the problem isn't firmware-related.

 

[Kish]

Not that you actually need it, with the serial console access.

Are you saying serial connection can give me the prtHardInfo?

But your was not FF98 and did not need to be fixed up.

I feel a little joy in confusing you a bit there... then followed by slight sadness that you found the probable cause

Can you check that the ribbon cable to the sensor is properly seated?

Are we talking an actual ribbon cable, or the wire connections as shown in the picture?
I guess last resort, I can [carefully] take it apart and see if anything looks funny (though my knowledge won't be that savvy in what goes where; just if something isn't plugged in) - If you don't recommend that, do say so, I'm fine with it since you said it could be hardware related, not software... I tried looking up parts for this model and kept getting random results.

I didn't forget about the working one, I completely forgot I have VPN access to my parents house (cause if something goes wrong, I don't wanna drive all the way over there to fix it if it could be done remotely).
I got into the WebGUI of the working camera:

Model DS-2CD2712F-I
Firmware Version V5.3.0 build 150513
Encoding Version V5.0 build 150327

In the Security Settings, I only see:
Enable SSH
Enable Illegal Login Lock

I turned on SSH and attempted Telnet, but it timed out, then I tried SSH, and that too timed out - not sure if it's cause I'm VPN'd in, but I'll still try when I'm physically there.
Scratch that - I had to reboot the device.
Got in (via SSH) - ran the prtHardInfo - Hope the below helps you add to your list.

login as: root
root@192.168.1.150's password:


BusyBox v1.19.3 (2015-03-20 17:37:48 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

BusyBox v1.2.1 Protect Shell (psh)
Enter 'help' for a list of davinci system commands.

# prtHardInfo
Start at 2018-03-02 22:22:06
Serial NO :DS-2CD2712F-I20150327CCWR508823073
V5.3.0 build 150513
NetProcess Version: 1.4.0 [20:10:19-Mar 10 2015]
Db Encrypt Version: 65537
hardwareVersion = 0x0
hardWareExtVersion      = 0x0
encodeChans             = 1
decodeChans             = 1
alarmInNums             = 0
alarmOutNums            = 0
ataCtrlNums             = 0
flashChipNums           = 0
ramSize                 = 0x4000000
networksNums            = 1
language                        = 1
devType                 = 0x980d
net reboot count        = 0
Path: .
Working Copy Root Path: /usr/local/jenkins/workspace/Frontend_BaseLine_Publish_Build/2015-05-13_19-56-39
URL: https://192.0.0.140/Camera/Platform/Branches/branches_frontend_software_platform/IPC_develop_branch/ipc_plateform_5.3.0
Repository Root: https://192.0.0.140/Camera
Repository UUID: df2d70c3-7593-7941-af1e-571b313c0946
Revision: 127831
Node Kind: directory
Schedule: normal
Last Changed Author: tanghui
Last Changed Rev: 127827
Last Changed Date: 2015-05-13 19:50:30 +0800 (Wed, 13 May 2015)

I'm coming to the thought, certainly after all that you've tried, and the data provided, that the cause of the problem isn't firmware-related.

I'm super grateful for the time you took for my issue, which leaves me to this:
If there's nothing else you want to pull from the working one (info wise), or things to attempt for the broken one, then if you want, I would gladly ship this device to your direction - maybe you can have fun tinkering with it - like I said earlier; I'm in a basement (of my in-laws) right now, so I don't have much use for it... let's hope in the future I'll be more well off to just purchase a camera just willy nilly whenever I need it.

Thanks again for all your help, and contribution to this entire forum!

 

[alastairstevenson]

Got in (via SSH) - ran the prtHardInfo - Hope the below helps you add to your list.

Well done - exactly what was needed.
So the prtHardInfo shows that the camera is a DS-2CD2712F-I and that "devType = 0x980d"
Which is a match to what is in your mtdblock6.
So a problem with that value can be eliminated as a cause of the boot failure.

If there's nothing else you want to pull from the working one (info wise), or things to attempt for the broken one,

Nothing comes to mind - you've covered all the usual relevant things.

then if you want, I would gladly ship this device to your direction - maybe you can have fun tinkering with it

I do quite like trying to solve problems with these type of devices, and am always checking eBay for 'Spare and repairs' Hikvision and Dahua devices.
Over the last few weeks I've bought and re-sold 4 or 5. The common problem has been bricked due to firmware updates (easily fixed, but not that interesting), though I'm just about to post a DS-2CD2612F which was not working due to an internal ribbon cable being disconnected, and several IR LED sections out due to open-circuit LEDs, replaced OK.
This was a 1.3MP device, like yours, with surprisingly good low-light capability. A couple of images attached - there are stars showing, with scene illumination from a quarter-full-moon.

So, yes, I'd be pleased to accept your offer - though I do suspect the problem may be hardware-related.
Where are you based?

 

[Kish]

Where are you based?

Toronto, Ontario, Canada... Eh?
No clue what shipping would be, but I can definitely check

surprisingly good low-light capability

Dam... that is surprisingly good

My brother decided to set it up in our backyard, which I think it would be more useful in the front - it's better than the current ones he has there, so I'd think better for security, but in the summer time, he wants to turn this deck into a little club, so I'm guessing it's more for his personal gain over security.
Though I wonder if when party lights go off constantly at night, if that'll trigger the auto Night/Day sensor, which would probably confuse the shit out of the camera.

always checking eBay for 'Spare and repairs' Hikvision and Dahua devices.

Funny enough... I said that if I were to get this camera up and running again, I'd do the same.
Not for reselling, but to save a buck for myself - buy a few bricked devices at a fraction of the cost, then fix em up as per your (or other super helpful people's) instructions - and I'll have a complete surveillance system that won't hurt the bank.
Though I don't know what keywords you look for, but I'm having a helluva hard time finding just bricked devices.

I'd be pleased to accept your offer

Do PM me with a P.O box or something so I can get a quote

 

[CodeGreen]

First sorry for digging up an old thread- but this is some great info. I was having the exact same problem when I was trying to put new firmware on via serial.
I would never had thought it was a hardware issue. My ribbon cable was put on backwards during one of the removals. My camera was an 2cd2232-i5, so apparently this happens to all the 2xx2 models. Thank you for telling us what the errors meant! I had done just about all the things the guy with the issue had done (plus some extra software deletion) and was about to give up for the night but bingo! found this thread read thru it and bam. fixed. thanks! - ribbon cable.