Hikvision DS-2CD2x32-I (R0) brick-fix tool / full upgrade method / fixup roundup.

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,929
Reaction score
6,777
Location
Scotland
The serial console will provide much more information about the cause of the problem, and some chances to get round it.
However, I still don't know what is the issue or the fix when I am in the console
A transcript of what shows from power-on should help to understand what the underlying problem is.

Then in terms of possible useful commands - interrupt the bootloader and show the output of the 'help' command.
 

hinzinho

n3wb
Joined
Jan 14, 2017
Messages
12
Reaction score
1
Then in terms of possible useful commands - interrupt the bootloader and show the output of the 'help' command.
Below are outputs from the terminal. I ran as much commands that I think was useful. There is one command, "upf", that similar to update, but I don't know what this mImage file it is looking for.

Thanks again!

Code:
HKVS # help
The following commands are supported:
boot    help    bios    diag
mtest   dump    erase   go
exec    ping    r8      r16
r32     reset   saveenv printenv
setenv  show    usbdl   w8
w16     w32     tftpboot        bootm
readoob killb   crc     format
update  upf     updateb ubi
bapi
Use 'help' to get help on a specific command
HKVS #


HKVS # printenv
ipaddr=192.0.0.64
serverip=192.0.0.128
gatewayip=0.0.0.0
netmask=255.255.255.0
ethaddr=c4:2f:90:18:a4:c3
loadaddr=0xc2000000
bootfile=digicap.dav
bootcmd=
bootargs=console=ttyS0 initrd=0xc0a00000,0x400000 rw root=/dev/ram dbg=0
bootdelay=2
HKVS #



HKVS # show flash
RCT configured to NAND mode
main size: 2048
pages per block: 64
bst partition blocks: 0 - 1
ptb partition blocks: 1 - 9
bld partition blocks: 9 - 17
hal partition blocks: 17 - 25
ano_ptb partition blocks: 25 - 33
env partition blocks: 33 - 37
param partition blocks: 37 - 41
dpt partition blocks: 41 - 49
rcvy partition blocks: 49 - 129
krn_pri partition blocks: 129 - 193
krn_sec partition blocks: 193 - 257
rmd_pri partition blocks: 257 - 289
rmd_sec partition blocks: 289 - 321
app_pri partition blocks: 321 - 513
app_sec partition blocks: 513 - 705
cfg_pri partition blocks: 705 - 737
cfg_sec partition blocks: 737 - 769
dbg partition blocks: 769 - 897
HKVS #


HKVS # show ptb
bst: 0x4076e165 1.3     (2014/10/9)     0x00000000 0x00000001 (2048)
bld: 0x20fb27ea 1.3     (2015/3/20)     0xc0000000 0x00000000 (228716)
hal: 0x3407bf3c 5.1     (2015/3/20)     0xc00a0000 0x00000000 (59144)
S/N:
usbdl_mode: 0
auto_boot: 1
cmdline: "console=ttyS0 initrd=0xc0a00000,0x400000 rw root=/dev/ram dbg=0"
HKVS #


HKVS # show bb

----- Late developed bad blocks -----
150     253     439     487     496
559     649     676     901     933
Total bad blocks: 10
HKVS #


HKVS # show meta
bst      sblk: 0         nblk: 1         on: NAND
ptb      sblk: 1         nblk: 8         on: NAND
bld      sblk: 9         nblk: 8         on: NAND
hal      sblk: 17        nblk: 8         on: NAND
ano_ptb  sblk: 25        nblk: 8         on: NAND
env      sblk: 33        nblk: 4         on: NAND
param    sblk: 37        nblk: 4         on: NAND
dpt      sblk: 41        nblk: 8         on: NAND
rcvy     sblk: 49        nblk: 80        on: NAND
krn_pri  sblk: 129       nblk: 64        on: NAND
krn_sec  sblk: 193       nblk: 64        on: NAND
rmd_pri  sblk: 257       nblk: 32        on: NAND
rmd_sec  sblk: 289       nblk: 32        on: NAND
app_pri  sblk: 321       nblk: 192       on: NAND
app_sec  sblk: 513       nblk: 192       on: NAND
cfg_pri  sblk: 705       nblk: 32        on: NAND
cfg_sec  sblk: 737       nblk: 32        on: NAND
dbg      sblk: 769       nblk: 128       on: NAND
         sblk: 0         nblk: 0         on: DEFAULT
         sblk: 0         nblk: 0         on: DEFAULT

sm_stg[0]        sblk: 0         nblk: 0
sm_stg[1]        sblk: 0         nblk: 0

model name:
crc32:          0x9d57e812
HKVS #


HKVS # show netboot
eth0_mac: 00:00:00:00:00:00
eth0_ip: 0.0.0.0
eth0_mask: 0.0.0.0
eth0_gw: 0.0.0.0
auto_dl: 0
tftpd: 0.0.0.0
pri_addr: 0x00000000
pri_file:
pri_comp: 0
rmd_addr: 0x00000000
rmd_file:
rmd_comp: 0
dsp_addr: 0x00000000
dsp_file:
dsp_comp: 0


HKVS # upf
***** UPDATE START *****
[ INFO][BLD]TFTP: MAC: c4:2f:90:18:a4:c3
[ INFO][BLD]TFTP: TFTP from server 192.0.0.128; our IP address is 192.0.0.64
[ INFO][BLD]TFTP: Filename: 'mImage'
[ERROR][BLD]TFTP: do_tftp_load:bld_udp_recv RRQ failed!rval=-110
[ERROR][BLD]TFTP: do_tftp_load:bld_udp_recv RRQ failed!rval=-110
[ERROR][BLD]TFTP: do_tftp_load:transfer error
[ERROR][BLD]BURN: Download File [FAIL]! error: tftp.
[ERROR][BLD]BURN: update mini system [FAIL]!error: upf.
!!!!! UPDATE FAIL !!!!!
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,929
Reaction score
6,777
Location
Scotland
Below are outputs from the terminal.
OK, so no flash read/write commands in that bootloader.

I ran as much commands that I think was useful. There is one command, "upf", that similar to update, but I don't know what this mImage file it is looking for.
That can be risky - and is best avoided if you are unsure of the purpose of the commands.
upf is the 'factory update' command. It installs the min-system recovery image and the main firmware.

A transcript of what shows from power-on should help to understand what the underlying problem is.
But it would probably be useful to know what the current problem is.
Can you do a transcript of a normal power-on, with no interruptions?
 

hinzinho

n3wb
Joined
Jan 14, 2017
Messages
12
Reaction score
1
But it would probably be useful to know what the current problem is.
Can you do a transcript of a normal power-on, with no interruptions?
I have provided 2 different scenarios. One with the network cable plugged in and another without. I checked with WireShark and SADP Tool and don't see any activities from the camera beside the initial tftp check from WireShark.

With the network cable plugged in. I left it on for about 20 minutes and no extra output from the terminal
Code:
U-Boot 1.3.4-113988 (Mar 20 2015 - 17:36:32)

ARM Clock: 480MHz
DDR Clock: 336MHz
Hit Ctrl+u to stop autoboot: 0
Without the network cable. I also waited for a while and still nothing on the terminal
Code:
U-Boot 1.3.4-113988 (Mar 20 2015 - 17:36:32)

ARM Clock: 480MHz
DDR Clock: 336MHz
Hit Ctrl+u to stop autoboot: 0
|NUL eth|
booting from pri part...
load kernel...
load ramdisk...
init started: BusyBox v1.19.3 (2016-05-23 16:23:55 CST)
starting pid 378, tty '': '/etc/init.d/rcS'
Starting udev:      [ OK ]
UBI device number 1, total 189 LEBs (24385536 bytes, 23.3 MiB), available 0 LEBs                                                                                                                                                              (0 bytes), LEB size 129024 bytes (126.0 KiB)
waiting for /dev/ubi1_0.
pri_iUpgSuccCnt:0x1, sec_iUpgSuccCnt:0x1
UBI device number 3, total 32 LEBs (4128768 bytes, 3.9 MiB), available 0 LEBs (0                                                                                                                                                              bytes), LEB size 129024 bytes (126.0 KiB)
waiting for /dev/ubi3_0.
waiting for /dev/ubi3_0.
Check dir /davinci ok! (0)
UBI device number 4, total 32 LEBs (4128768 bytes, 3.9 MiB), available 0 LEBs (0                                                                                                                                                              bytes), LEB size 129024 bytes (126.0 KiB)
waiting for /dev/ubi4_0.
Check dir /config ok! (0)
diagnose_way = 15, repair_way = 1, interval = 30
route: ioctl 0x890c failed: No such process
mount: mounting none on /proc/bus/usb failed: No such file or directory
/dav
map_size = 0x300000
nr_item = 3
addr_offset = 0x0 filename = orccode.bin
addr_offset = 0x200000 filename = orcme.bin
addr_offset = 0x2a0000 filename = default_binary.bin
mmap returns 0x40331000
loading ./orccode.bin...addr = 0x40331000, size = 0x1a0a91
loading ./orcme.bin...addr = 0x40531000, size = 0x3a4fc
loading ./default_binary.bin...addr = 0x405d1000, size = 0x40000
===============================
u_code version = 2016/4/6 3.0
===============================
The system is going down NOW!
Sent SIGTERM to all processes
Sent SIGKILL to all processes
Requesting system reboot


U-Boot 1.3.4-113988 (Mar 20 2015 - 17:36:32)

ARM Clock: 480MHz
DDR Clock: 336MHz
Hit Ctrl+u to stop autoboot: 0
begin to enter mini system
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,929
Reaction score
6,777
Location
Scotland
I have provided 2 different scenarios. One with the network cable plugged in and another without.
Your transcript suggests the camera is attempting to boot firmware version 5.4.5 Build 170123 and I'd speculate that it had been applied over a very early firmware version such as 5.1.6 that had not created valid data in mtdblock1. This partition holds info on number of reboot times, and whether the previous update was successful or not.
If the counts indicate the last update did not succeed, a reboot is triggered.
But it does not reboot properly into the min-system recovery environment.
That's a 'Catch-22 situation' as the min-system holds the system update code.

A suggestion to try :
With the tftp server running, and a digicap.dav file from an early firmware version such as the 5.2.0 from here :

power on, interrupt the bootloader and try the 'update' command.
Post the full transcript here and we'll see what it says.
 

hinzinho

n3wb
Joined
Jan 14, 2017
Messages
12
Reaction score
1
power on, interrupt the bootloader and try the 'update' command.
Post the full transcript here and we'll see what it says.
I have downloaded 5.2.0 firmware as suggested to my tfpt directory. When I issue the 'update' command, it just stay stuck in that mode. I don't see any activities in the tfpt log or in wireshark. I waited for at least 20 minutes before giving up. .
Code:
HKVS # update
I figured maybe it doesn't have a good image, so I typed 'tftpboot' and see see the camera grabbing the digicap.dav file from my tftp. I waited for about 10-15 minutes to see if it would do anything afterward. It did not, so I typed 'update'. Again this just hang at the terminal and does nothing that I can see.
Code:
HKVS # tftpboot
[ INFO][BLD]TFTP: MAC: c4:2f:90:18:a4:c3
[ INFO][BLD]TFTP: TFTP from server 192.0.0.128; our IP address is 192.0.0.64
[ INFO][BLD]TFTP: Filename: 'digicap.dav'
[ INFO][BLD]TFTP: ##############################################################                                                 ##################
[ INFO][BLD]TFTP: ##############################################################                                                 ##################
[ INFO][BLD]TFTP: ##############################################################                                                 ##################
[ INFO][BLD]TFTP: ##############################################################                                                 ##################
[ INFO][BLD]TFTP: ##############################################################                                                 ##################
[ INFO][BLD]TFTP: ##############################################################                                                 ##################
[ INFO][BLD]TFTP: ##############################################################                                                 ##################
[ INFO][BLD]TFTP: ##############################################################                                                 ##################
[ INFO][BLD]TFTP: ##############################################################                                                 ##################
[ INFO][BLD]TFTP: ##############################################################                                                 ##################
[ INFO][BLD]TFTP: ##########################
[ INFO][BLD]TFTP: File size is 21160827 bytes (20664 KB)
HKVS # update
BTW, I tried a few different firmwares (5.2.0 and 5.4.41) to see if it would work, but no luck. That is my the file size in my output might be match to what you are expecting. Thanks again.
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,929
Reaction score
6,777
Location
Scotland
You've confirmed that the min-system recovery environment, that does the firmware update process, is not working.
It can be possible to work around this and recover the camera, but the process can be a bit messy if you are not used to working at a low level.

Here are a couple of pointers to how this has been done before, should you wish to try them :


 

hinzinho

n3wb
Joined
Jan 14, 2017
Messages
12
Reaction score
1
Here are a couple of pointers to how this has been done before, should you wish to try them :
I have followed the commands from the 2 posts. I spent most of my time trying to get the mount working. I ended up using this command 'mount -t cifs /192.0.0.128/temp /mnt/nfs00 -o username=myuser,password=mypassword'.

Toward the end, when flashing the mtdblocks, I got a lot of errors. Only one that worked without any errors are on mtdblock11 and mtdblock12.

lot of errors when running cat /mnt/nfs00/mtdblock8 > /dev/mtdblock8
some errors on cat /mnt/nfs00/mtdblock9 > /dev/mtdblock9
errors on cat /mnt/nfs00/mtdblock9 > /dev/mtdblock10
no error on cat /mnt/nfs00/mtdblock11 > /dev/mtdblock11
no error cat /mnt/nfs00/mtdblock11 > /dev/mtdblock12
errors on cat /mnt/nfs00/mtdblock13 > /dev/mtdblock13


I think this device is dead and it's time to get a new one. In the future, it something is working, don't do any firmware update. :)

Outputs of the log, just in case you see something.

Thanks for all your help!

Code:
U-Boot 1.3.4-113988 (Mar 20 2015 - 17:36:32)

ARM Clock: 480MHz
DDR Clock: 336MHz
Hit Ctrl+u to stop autoboot: 2
HKVS # printenv
ipaddr=192.0.0.64
serverip=192.0.0.128
gatewayip=0.0.0.0
netmask=255.255.255.0
ethaddr=c4:2f:90:18:a4:c3
loadaddr=0xc2000000
bootfile=digicap.dav
bootcmd=
bootargs=console=ttyS0 initrd=0xc0a00000,0x400000 rw root=/dev/ram dbg=0
bootdelay=2
HKVS # setenv bootargs console=ttyS0 initrd=0xc0a00000,0x400000 rw root=/dev/ram dbg=9 debug single
HKVS # saveenv
Writing env to Nand... done
▒KVS # reset

U-Boot 1.3.4-113988 (Mar 20 2015 - 17:36:32)

ARM Clock: 480MHz
DDR Clock: 336MHz
Hit Ctrl+u to stop autoboot: 0


U-Boot 1.3.4-113988 (Mar 20 2015 - 17:36:32)

ARM Clock: 480MHz
DDR Clock: 336MHz
Hit Ctrl+u to stop autoboot: 0
|RCV UDP pack timeout|
booting from sec part...
load kernel...
load ramdisk...
[    0.000000] Linux version 2.6.38.8 (chenyuanming@Cpl-Frt-BSP) (gcc version 4.6.1 (Sourcery CodeBench Lite 2011.09-70) )
[    0.000000] #18 PREEMPT Thu Jan 21 17:27:08 CST 2016
[    0.000000] CPU: ARMv6-compatible processor [4117b365] revision 5 (ARMv6TEJ), cr=00c5387f
[    0.000000] CPU: VIPT nonaliasing data cache, VIPT nonaliasing instruction cache
[    0.000000] Machine: Coconut
[    0.000000] Memory policy: ECC disabled, Data cache writeback
[    0.000000] Ambarella: AHB   = 0x60000000[0xf0000000],0x01000000 0
[    0.000000] Ambarella: APB   = 0x70000000[0xf1000000],0x01000000 0
[    0.000000] Ambarella: PPM   = 0xc0000000[0xe0000000],0x00200000 9
[    0.000000] Ambarella: BSB   = 0xc8c00000[0xe8c00000],0x00400000 9
[    0.000000] Ambarella: DSP   = 0xc9000000[0xe9000000],0x07000000 9
[    0.000000] Ambarella: HAL   = 0xc00a0000[0xfee00000],0x0000e708 9
[    0.000000] On node 0 totalpages: 25344
[    0.000000] free_area_init_node: node 0, pgdat c0563180, node_mem_map c0589000
[    0.000000]   Normal zone: 198 pages used for memmap
[    0.000000]   Normal zone: 0 pages reserved
[    0.000000]   Normal zone: 25146 pages, LIFO batch:7
[    0.000000] bootmem_init: high_memory = 0xc8a00000
[    0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
[    0.000000] pcpu-alloc: [0] 0
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 25146
[    0.000000] Kernel command line: console=ttyS0 initrd=0xc0a00000,0x400000 rw root=/dev/ram dbg=9 debug single KRN_PRT=sec RMD_PRT=sec reserved=0xc6500000,0x100000,99 video=amb0fb:720x480,720x480,1,0
[    0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Memory: 99MB = 99MB total
[    0.000000] Memory: 90656k/90656k available, 10720k reserved, 0K highmem
[    0.000000] Virtual kernel memory layout:
[    0.000000]     vector  : 0xffff0000 - 0xffff1000   (   4 kB)
[    0.000000]     fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
[    0.000000]     DMA     : 0xfe600000 - 0xfee00000   (   8 MB)
[    0.000000]     vmalloc : 0xc9000000 - 0xe0000000   ( 368 MB)
[    0.000000]     lowmem  : 0xc0000000 - 0xc8a00000   ( 138 MB)
[    0.000000]     modules : 0xbf000000 - 0xc0000000   (  16 MB)
[    0.000000]       .init : 0xc0008000 - 0xc002d000   ( 148 kB)
[    0.000000]       .text : 0xc002d000 - 0xc052f000   (5128 kB)
[    0.000000]       .data : 0xc0530000 - 0xc0563820   ( 207 kB)
[    0.000000] Preemptable hierarchical RCU implementation.
[    0.000000]  RCU-based detection of stalled CPUs is disabled.
[    0.000000]  Verbose stalled-CPUs detection is disabled.
[    0.000000] NR_IRQS:224
[    0.000000] sched_clock: 32 bits at 72MHz, resolution 13ns, wraps every 59652ms
[    0.000000] sched_clock: wrong multiply/shift: 1864135111>>27 vs calculated 3728270222>>28
[    0.000000] sched_clock: fix multiply/shift to avoid scheduler hiccups
[    0.000000] Console: colour dummy device 80x30
[    0.000000] console [ttyS0] enabled
[    0.274238] Calibrating delay loop... 527.56 BogoMIPS (lpj=2637824)
[    0.522862] pid_max: default: 32768 minimum: 301
[    0.527858] Mount-cache hash table entries: 512
[    0.533173] CPU: Testing write buffer coherency: ok
[    0.544612] NET: Registered protocol family 16
[    0.559530] Ambarella Coconut:
[    0.562829]  chip id:                5100
[    0.565637]  board type:             3
[    0.568433]  board revision:         10
[    0.571808]  chip name:              a5m
[    0.574704]  HAL version:            176869
[    0.578023]  reference clock:        24000000
[    0.581853]  system configuration:   0x177804ea
[    0.586223]  boot type:              0x00000002
[    0.589712]  hif type:               0x00000000
[    0.618937] bio: create slab <bio-0> at 0
[    0.625617] ambarella-spi ambarella-spi.0: ambarella SPI Controller 0 created
[    0.643077] ambarella-i2c ambarella-i2c.0: Ambarella Media Processor I2C adapter[i2c-0] probed!
[    0.653447] ambarella-i2c ambarella-i2c.1: Ambarella Media Processor I2C adapter[i2c-1] probed!
[    0.663654] i2c i2c-0: Added multiplexed i2c bus 2
[    0.668470] ambarella-i2cmux ambarella-i2cmux.0: mux on ambarella-i2c adapter
[    0.678478] Advanced Linux Sound Architecture Driver Version 1.0.23.
[    0.688525] cfg80211: Calling CRDA to update world regulatory domain
[    0.696369] Switching to clocksource ambarella-cs-timer
[    0.710181] Switched to NOHz mode on CPU #0
[    0.766313] NET: Registered protocol family 2
[    0.771003] IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.779132] TCP established hash table entries: 4096 (order: 3, 32768 bytes)
[    0.786556] TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
[    0.793210] TCP: Hash tables configured (established 4096 bind 4096)
[    0.799581] TCP reno registered
[    0.802825] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.808699] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.815656] NET: Registered protocol family 1
[    0.820772] RPC: Registered udp transport module.
[    0.825650] RPC: Registered tcp transport module.
[    0.830371] RPC: Registered tcp NFSv4.1 backchannel transport module.
[    0.837344] Trying to unpack rootfs image as initramfs...
[    0.845172] rootfs image is not initramfs (no cpio magic); looks like an initrd
[    0.885583] Freeing initrd memory: 4096K
[    0.892423] [ kernel version:  svn-174544 ]
[    0.896690] mmc0 power register success!
[    0.900634] mmc1 power register success!
[    0.904935] reboot times :1
[    0.933381] msgmni has been set to 185
[    0.946026] alg: No test for stdrng (krng)
[    0.950272] io scheduler noop registered
[    0.954486] io scheduler deadline registered
[    0.958929] io scheduler cfq registered (default)
[    0.967297] ambarella-fb ambarella-fb.0: probe p[720x480] v[720x576] c[1] b[0] l[736] @ [0xc5980000:0x00068000]!
[    0.979372] ambarella-uart.0: ttyS0 at MMIO 0x70005000 (irq = 9) is a ambuart
[    1.025191] brd: module loaded
[    1.041893] loop: module loaded
[    1.048365] NAND device: Manufacturer ID: 0xc2, Chip ID: 0xf1 (MXIC NAND 128MiB 3,3V 8-bit)
[    1.057085] ambarella_nand_config_flash: 0x02e00140, 0x02c00140
[    1.063547] Bad block table found at page 65472, version 0x01
[    1.069767] Bad block table found at page 65408, version 0x01
[    1.075914] nand_read_bbt: Bad block at 0x0000009c0000
[    1.081076] nand_read_bbt: Bad block at 0x0000012c0000
[    1.086312] nand_read_bbt: Bad block at 0x000001fa0000
[    1.091470] nand_read_bbt: Bad block at 0x0000036e0000
[    1.096676] nand_read_bbt: Bad block at 0x000003ce0000
[    1.101818] nand_read_bbt: Bad block at 0x000003e00000
[    1.107015] nand_read_bbt: Bad block at 0x0000045e0000
[    1.112210] nand_read_bbt: Bad block at 0x000005120000
[    1.117359] nand_read_bbt: Bad block at 0x000005480000
[    1.122552] nand_read_bbt: Bad block at 0x0000070a0000
[    1.127698] nand_read_bbt: Bad block at 0x0000074a0000
[    1.139191] ambarella-nand ambarella-nand: ambarella_nand_probe: Partition infomation found!
[    1.147770] Creating 18 MTD partitions on "ambnand":
[    1.152830] 0x000000000000-0x000000020000 : "bst"
[    1.161342] 0x000000020000-0x000000120000 : "ptb"
[    1.169763] 0x000000120000-0x000000220000 : "bld"
[    1.178298] 0x000000220000-0x000000320000 : "hal"
[    1.186865] 0x000000320000-0x000000420000 : "ano_ptb"
[    1.195835] 0x000000420000-0x0000004a0000 : "env"
[    1.204492] 0x0000004a0000-0x000000520000 : "param"
[    1.213380] 0x000000520000-0x000000620000 : "dpt"
[    1.221893] 0x000000620000-0x000001020000 : "rcvy"
[    1.230849] 0x000001020000-0x000001820000 : "krn_pri"
[    1.239812] 0x000001820000-0x000002020000 : "krn_sec"
[    1.248829] 0x000002020000-0x000002420000 : "rmd_pri"
[    1.257851] 0x000002420000-0x000002820000 : "rmd_sec"
[    1.266941] 0x000002820000-0x000004020000 : "app_pri"
[    1.276096] 0x000004020000-0x000005820000 : "app_sec"
[    1.285285] 0x000005820000-0x000005c20000 : "cfg_pri"
[    1.294439] 0x000005c20000-0x000006020000 : "cfg_sec"
[    1.303760] 0x000006020000-0x000007020000 : "dbg"
[    1.319075] PPP generic driver version 2.4.2
[    1.324872] PPP Deflate Compression module registered
[    1.329944] PPP BSD Compression module registered
[    1.528652] Ambarella MII Bus: probed
[    1.534003] ambarella-eth ambarella-eth.0: MAC Address[c4:2f:90:18:a4:c3].
[    1.541611] console [netcon0] enabled
[    1.545455] netconsole: network logging started
[    1.551505] mousedev: PS/2 mouse device common for all mice
[    1.558237] input: AmbInput as /devices/virtual/input/input0
[    1.565026] ambarella_gpio_irq_set_wake: irq[75] = girq[11] = 1
[    1.570975] ambarella-input ambarella-input: AmbInput probed!
[    1.577836] ambarella-adc ambarella-adc: ADC Host Controller [polling mode] probed!
[    1.587230] ambarella-rtc ambarella-rtc: rtc core: registered ambarella-rtc as rtc0
[    1.595594] i2c /dev entries driver
[    1.603834] ambarella-wdt ambarella-wdt: Ambarella Media Processor Watch Dog Timer[ambarella-wdt].
[    1.619220] ALSA device list:
[    1.622446]   No soundcards found.
[    1.626025] Netfilter messages via NETLINK v0.30.
[    1.630895] nf_conntrack version 0.5.0 (1480 buckets, 5920 max)
[    1.637678] ip_tables: (C) 2000-2006 Netfilter Core Team
[    1.643283] TCP cubic registered
[    1.646917] NET: Registered protocol family 10
[    1.653922] Mobile IPv6
[    1.656494] ip6_tables: (C) 2000-2006 Netfilter Core Team
[    1.662246] IPv6 over IPv4 tunneling driver
[    1.670043] NET: Registered protocol family 17
[    1.675398] sctp: Hash tables configured (established 4096 bind 8192)
[    1.682313] sctp: sctp_init_sock(sk: c58d5b20)
[    1.686875] lib80211: common routines for IEEE802.11 drivers
[    1.692661] lib80211_crypt: registered algorithm 'NULL'
[    1.701751] ambarella-rtc ambarella-rtc: setting system clock to 2020-09-16 21:17:00 UTC (1600291020)
[    1.711956] RAMDISK: gzip image found at block 0
[    2.540527] EXT2-fs (ram0): warning: maximal mount count reached, running e2fsck is recommended
[    2.549506] VFS: Mounted root (ext2 filesystem) on device 1:0.
[    2.555670] Freeing init memory: 148K
init started: BusyBox v1.19.3 (2014-07-11 11:25:54 CST)
starting pid 378, tty '': '-/bin/sh'


BusyBox v1.19.3 (2014-07-11 11:25:54 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

awk: /proc/mounts: No such file or directory
==================== INITRAM_FS ====================
# mount -t proc proc /proc
# mount -t sysfs sysfs /sys
# mount -t ramfs ramfs /home
# /etc/S_udev
Starting udev:      [ OK ]
# ifconfig eth0 192.0.0.64 up
[   99.536242] net eth0: Could not find default PHY in 9.
[   99.541411] net eth0: Try PHY[3] whose id is 0x001cc816!
[   99.550368] ADDRCONF(NETDEV_UP): eth0: link is not ready
# [  101.542466] PHY: 0:03 - Link is Up - 100/Full
[  101.547016] ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready

#
# [  111.872142] eth0: no IPv6 routers present

# mount -t cifs /192.0.0.128/temp /mnt/nfs00 -o username=myuser,password=mypassword
# ls -al /mnt/nfs00/mtdblock*
-rwxr-xr-x    0 root     root       4194304 Sep 17  2020 /mnt/nfs00/mtdblock11
-rwxr-xr-x    0 root     root      25165824 Sep 17  2020 /mnt/nfs00/mtdblock13
-rwxr-xr-x    0 root     root      10485760 Sep 17  2020 /mnt/nfs00/mtdblock8
-rwxr-xr-x    0 root     root       8388608 Sep 17  2020 /mnt/nfs00/mtdblock9
#


After the reboot, sometimes it goes into mini system and hang there. If I power cycle the camera, it would into busybox but without an ip. If I set the ip, I can ping it but doesn't see anything with SADP or the web interface.
Code:
U-Boot 1.3.4-113988 (Mar 20 2015 - 17:36:32)

ARM Clock: 480MHz
DDR Clock: 336MHz
Hit Ctrl+u to stop autoboot: 0
begin to enter mini system


U-Boot 1.3.4-113988 (Mar 20 2015 - 17:36:32)

ARM Clock: 480MHz
DDR Clock: 336MHz
Hit Ctrl+u to stop autoboot: 0
|RCV UDP pack timeout|
booting from sec part...
load kernel...
load ramdisk...
init started: BusyBox v1.19.3 (2014-07-11 11:25:54 CST)
starting pid 378, tty '': '/etc/init.d/rcS'
Starting udev:      [ OK ]
starting pid 609, tty '': '/sbin/iptables -A INPUT -p tcp --dport 23 -j DROP'
starting pid 610, tty '': '/sbin/iptables -A INPUT -p tcp --dport 22 -j DROP'
starting pid 611, tty '': '/sbin/iptables -A INPUT -p tcp --dport 21 -j DROP'
starting pid 612, tty '': '/sbin/inetd -f -e /etc/inetd.conf'
starting pid 613, tty '': '-/bin/sh'
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,929
Reaction score
6,777
Location
Scotland
I have followed the commands from the 2 posts. I spent most of my time trying to get the mount working. I ended up using this command 'mount -t cifs /192.0.0.128/temp /mnt/nfs00 -o username=myuser,password=mypassword'.
Yes, that's a good alternate to using NFS when a handy NAS isn't available.

lot of errors when running cat /mnt/nfs00/mtdblock8 > /dev/mtdblock8
That's the partition that holds the min-system recovery environment.

I think this device is dead and it's time to get a new one.
I think you're right.
It seems to be riddled with flash failures, lots of bad blocks.
These would only get worse, and exceed the reserve in the file system to deal with them.
You've had a pretty good go at exploring the problem, and try to deal with it.
But sometimes a fix just isn't possible.

If I set the ip, I can ping it but doesn't see anything with SADP or the web interface.
Yes, those responses would come from the davinci main app if it was running, but the boot-up has been limited to just get to a shell prompt.
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,929
Reaction score
6,777
Location
Scotland
Outputs of the log, just in case you see something.
Despite the errors in re-flashing the critical partitions - did you check what happened when the bootargs variable in the bootloader was put back to its original value as opposed to the one that drops the boot-up into a shell prompt?
 

hinzinho

n3wb
Joined
Jan 14, 2017
Messages
12
Reaction score
1
Despite the errors in re-flashing the critical partitions - did you check what happened when the bootargs variable in the bootloader was put back to its original value as opposed to the one that drops the boot-up into a shell prompt?
Alastairstevenson, I got my hikvision cam up and running today!

Today, I have some spare time and thought I would give it another "good old college try". I ran your commands again but it was still giving me a lot of bad block errors. With nothing else to lose, since this camera is a goner, I took a bit more risk and cleared the bad blocks table (don't remember the exact command, but it was under diag). I then went and follow your postings for reflashing the /dev/mtdblocks. To my surprise, I was able to flash mtdblock8 without any errors. The other mtdblocks that gave me errors still doing the same. Upon reboot, I noticed I was no longer stuck at the mini system. From there, I followed the debrick process and got the cam flashed with firmware 5.2.0. It is up and running now, but not with the latest firmware. I can live with 5.2.0 firmware, as I don't want to go thought this mess again.

Let me know how I can buy you some beers for all your help. :thumb: Thank you for all your help again!
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,929
Reaction score
6,777
Location
Scotland

beatmag0

n3wb
Joined
Nov 13, 2021
Messages
2
Reaction score
0
Location
Australia
Thank you so much alastairstevenson!!!!

Just upgraded my DS-2CD2432F-IW
With your enhanced mtd hack.

Working fine.
Was on v5.2.5 English Hack FW with Chinese Cameras.

All I did, was hack mtd6 according to instructions once per camera. Then just use ivms4200 remote config to perform upgrade.
Works fine.
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,929
Reaction score
6,777
Location
Scotland
Thank you so much alastairstevenson!!!!

Just upgraded my DS-2CD2432F-IW
With your enhanced mtd hack.

Working fine.
Was on v5.2.5 English Hack FW with Chinese Cameras.

All I did, was hack mtd6 according to instructions once per camera. Then just use ivms4200 remote config to perform upgrade.
Works fine.
Great!
Well done, thanks for sharing.
 

Rene72

n3wb
Joined
Apr 20, 2023
Messages
2
Reaction score
0
Location
Netherlands
Hi,

I still have to fully read this thread so many messages.

I got two cams for china menu's in English so I suspect hacked firmware because serial has CN

Model: DS-2CD2145F-IWS
sn: DS-2CD2145F-IWS20160701AACH6192xxxxxx
fw version: V5.4.0 build 160401

Model: DS-2CD2145F-IS
sn:DS-2CD2145F-IS20161111BBCH6737xxxxxx
fw version:V5.4.23 build 161020

Can those be upgraded ? I think they're G1 cams but on the hikvision site in EU I dont find the 2145 ipcam.
If anyone here has succesfully upgraded these cams let me know I can use some help.
 
Joined
Dec 5, 2022
Messages
15
Reaction score
0
Location
GAZA
That is looking good - provided that the Checksum that is showing in the HxD status bar at the bottom is the result of doing the Checksum-16 calculation on the highlighted bytes.
If it is - you then change location 0x04 to the value 0x08 (the least significant byte) and location 0x05 to the value 0x0C (the most significant byte).
Then save the file, say as 'mtdblock6_mod' in the shared folder that is mounted in the camera.
At the camera root shell prompt, while running firmware 5.2.5, the command to replace the mtdblock6 with the modified one is :
cat /mnt/nfs00/mtdblock6_mod > /dev/mtdblock6
And reboot the camera.

The firmware will consider that there is bad data in the hardware information and will not run.
The value of the checksum looks about right - but with just the screenshot and not the file itself I can't confirm.

I do think you have got the method figured out now.
Good luck!
Hi.
I have this camera in picture..i flash the bios from another same camera,so there are two mac address appear
i need to log on the shell of camera to get the dev.type value but the ssh or telnet is not connected

this camera R0 or R6 series ??
any idea ??
 

Attachments

Top