New RCA HSDB2A 3MP Doorbell IP Camera

[David L]

Exactly, this happens also on Android sometimes. I disable, reboot, enable. Usually it fixes it.

Hahaha, yeah seems common on Android. Funny, Windows programs normally warn you to reboot

 

[TechBill]

Look like the last IPhone app update broke the the motion notification. It is no longer triggering for me.

** sigh **

It still record and log the motion detect in the app itself but it doesn't display banner notification on top of the iPhone anymore after the app update.

The notification setting is set at "allow" .

Reboot your phone, or maybe turn off/disallow then reboot, then turn on/allow.

Exactly, this happens also on Android sometimes. I disable, reboot, enable. Usually it fixes it.

I deleted the EZVIZ app off iPhone and reinstalled it.

The banner notification is working again.

 

[TechBill]

Ignore my last post .. the address made it seem it's in Canada but it in California on "Canada Street" lol .. very confusing ....

 

[alexdelprete]

True, what also is interesting is James has a RCA DB and it is looking for ezviz.dav file.

So looking back on all the firmware's, Nelly's seem to be the only one who has their firmware upgrade/update as digicap.dav in their file. I would assume renaming a firmware to digicap.dav should work, but it is only an assumption.
Also I just noticed Nelly's latest firmware has a March 12, 2020 build date (Under Downloads). Also what is strange is the filename is digicap (2).dav and has a Nov. 10, 2020 date like they just threw in a change (No Chime???) just guessing...
Does anyone know of the latest build number for Nelly's

3MP Wi-Fi Video Doorbell ONVIF Compliant IP Camera with 2 Way Audio, PIR Motion Sensor, Night Vision, 16GB SD Card Pre-Installed, and 3 Face Plates (NSC-DB2)

Video Doorbell Camera delivering 3MP of crisp clear video Dual Band Wifi (2.4Ghz / 5GHz) to reach all types of routers and wireless access points PIR Motion Detection to detect true human movement. Much less false motion events than standard pixel based motion. Clear Night Vision up to 16' -...

www.nellyssecurity.com

The Putty Log File James provided is pretty kewl.

Probably both filenames would work.

 

[alexdelprete]

Hahaha, yeah seems common on Android. Funny, Windows programs normally warn you to reboot

I never reboot on windows. But you have to know how it works.

Rebooting is the solution when you don't know or you don't have a way to fix things: it doesn't depend on the OS, but mainly it's about the level of knowledge of the platform.

In the case of Android on a phone: reboot is the fastest way.

 

[alexdelprete]

Ignore my last post .. the address made it seem it's in Canada but it in California on "Canada Street" lol .. very confusing ....

which post?

did you fix the chime issue in the end? they replaced the VDB?

 

[TechBill]

which post?

did you fix the chime issue in the end? they replaced the VDB?

I deleted that post ... I have not fixed chime issue - they are shipping me. replacement DB1 as soon I ship my DB1 back to them.

 

[alexdelprete]

I deleted that post ... I have not fixed chime issue - they are shipping me. replacement DB1 as soon I ship my DB1 back to them.

Yes. When they replaced mine, they sent UPS to collect it and after 5 days UPS delivered the replacement. Everything free of charge.

 

[TechBill]

Yes. When they replaced mine, they sent UPS to collect it and after 5 days UPS delivered the replacement. Everything free of charge.

They said I have to pay to have it shipped back because it been over 30 days since I purchased it.

 

[alexdelprete]

They said I have to pay to have it shipped back because it been over 30 days since I purchased it.

In europe we have 2y of FULL warranty.

 

[davidew98]

Do we know if the VDB has a CRC for the firmware that would stop us from uploading a modified file?
Anyone know if the code is just disabled (set to 0 in the firmware) or if the code for missing options was left out?

Apparently you missed the fact that it’s running Linux or something of the sort hence why it has uboot. If this is the case then it’s simpler then modifying firmware and is as simple as logging into the device and turning options on by hand.

 

[davidew98]

We have not got that far, it would require changing the firmware.

Dont think so, it might be simpler. I won’t be home for a while so can’t jump into it like he did but great stuff has been found.

 

[davidew98]

Because we can flash diff firmware to the door bells this would sujest it does not have encrypt or have a check going on with the DAV file right? Would this perhaps open the door up to some one (much smarter then me) doing an edit to the file like changing a 0 to a 1 to turn on a disabled option like I have done with some of the video cards I have had to over clock and over volt them?

Yes changing a 1 to 0 or 0 to 1 but not the firmware. I seriously think it’s this config file he’s talking about

 

[davidew98]

Are the diff firmware options just turned off by setting them to 0 is like the RCA firmware and turned on by setting to 1 in say the EzViz firmware you think? Or is the code left out / added? Just wandering if you think we have a chance of some one who know how to edit the file can make changes and turn on options or not.

I know in the past way smarter people then me have done this with video card firmware to boost clock speeds or boost voltage. Wandering if you think we have any chance of some thing like that now that we know we can fix it if we brick it big time messing around with the files code a bit.

If its just a 1/0 On/Off setup it would be fun to see what we may be able to turn on and play with.

I highly doubt the code is missing. It most likely is just options set in the nvram or config file

 

[davidew98]

No, quite the opposite - it's talkative. I'll have to do some captures on it through various activities.... pressing the doorbell, remote live feed, 2-way convo, Batch Config tool, etc.

I already have captures from firmware updates and running Batch Config (DST adjustments and hiding the EzViz logo) last night and some various testing, but it'd probably be easier for me to capture those events in isolation than try to go back and identify them in last night's logfile.

Tap a button on your coomputee after the camera boots and see if you get a Linux prompt or a password prompt

 

[davidew98]

So this is interesting from your Putty Log File, wonder what is in the ezviz.dav file it is trying to find?:

View attachment 74642

Is this the config file you were referring to?

This camera could be a ezviz camera which means it has a ezviz bootblock it’s looking for ezviz.dav firmware file to recover the bad firmware would be nice to know if other brands are looking for ezviz or a different file. They all might in fact look for the same file.

 

[davidew98]

Just curious what ezviz.dav is since we know digicap.dav is the upgrade/update.

Digitap is the unbranded uboot update file but the unattended recovery tools will want to make sure it’s branded

 

[davidew98]

Probably both filenames would work.

Seriously I think if someone has a dead vdb I would suggest taking a blank se card and putting 2 copies of firmware on it ezviz and digital that sdcatd will most likely recover 90% of dead vdb

 

[James92TSi]

This camera could be a ezviz camera which means it has a ezviz bootblock it’s looking for ezviz.dav firmware file to recover the bad firmware would be nice to know if other brands are looking for ezviz or a different file. They all might in fact look for the same file.

This is definitely an RCA camera - received in full RCA packaging, and it's an RCA faceplate (oval camera lens rather than circular like ezviz). The auto-recovery routine is checking for ezviz.dav though. When bootloader is interrupted via CTRL+U, the update command looks for digicap.dav.

It may have been possible to recover this doorbell by placing a firmware file named ezviz.dav on the sdcard and possibly doing some press of the reset button that causes it to wipe the config (if there is a reset button sequence that can make it wipe the config - I don't think we really know that).

Do note that I first flashed the firmware using update, and the doorbell was still bricked at that point, because writing firmware doesn't dump the config (see screenshot below). The info I had from previous owner is that he was changing wireless network config when it bricked. Something was definitely messed up in the config. But hey that's how I got it for 50 bucks shipped and started on this science project....

Only once I issued the format command (which erases everything but bootloader) followed by the update command did it unbrick.

It makes sense that updating firmware doesn't drop the config - this is how the DB stays setup for your network, phone app account, etc. through firmware changes.

This is from page 23 of the Putty log file on my previous post - when I did format followed by update. Notice the format command wipes the config area, while the firmware update doesn't touch it.

 

[David L]

This is definitely an RCA camera - received in full RCA packaging, and it's an RCA faceplate (oval camera lens rather than circular like ezviz). The auto-recovery routine is checking for ezviz.dav though. When bootloader is interrupted via CTRL+U, the update command looks for digicap.dav.

It may have been possible to recover this doorbell by placing a firmware file named ezviz.dav on the sdcard and possibly doing some press of the reset button that causes it to wipe the config (if there is a reset button sequence that can make it wipe the config - I don't think we really know that).

Do note that I first flashed the firmware using update, and the doorbell was still bricked at that point, because writing firmware doesn't dump the config (see screenshot below). The info I had from previous owner is that he was changing wireless network config when it bricked. Something was definitely messed up in the config. But hey that's how I got it for 50 bucks shipped and started on this science project....

Only once I issued the format command (which erases everything but bootloader) followed by the update command did it unbrick.

It makes sense that updating firmware doesn't drop the config - this is how the DB stays setup for your network, phone app account, etc. through firmware changes.

This is from page 23 of the Putty log file on my previous post - when I did format followed by update. Notice the format command wipes the config area, while the firmware update doesn't touch it. View attachment 74705

Makes sense. So I wonder if the cfg also holds the Chime info (Mech./Digital/No Chime)? Maybe those who are experiencing Chime lost needs to wipe this cfg

Question, I know you have your RCA working, do you plan on connecting it to a Chime?

Oh, BTW, these Doorbells are Hikvision cameras, you can see they are Rebrands by RCA, Nelly's, LaView. EZVIZ is a division/company of Hikvision.

You can check out the FCC filings showing the same hardware (Look at Internal Photos):

From the 101:
⦁ FCC Registrations: Search FCC ID Database
FCC ID 2ADTD-DSHD1 3MP Wi-Fi Doorbell Camera by Hangzhou Hikvision Digital Technology Co., Ltd. (Info on Hikvision Doorbell)
FCC ID VIXHSDB2 Video Doorbell by Voxx Accessories Corp. (Info on RCA Doorbell)
FCC ID 2APV2-CSDB1 Wi-Fi Doorbell Camera by Hangzhou Ezviz Software Co., Ltd. (Info on EZVIZ Doorbell)
FCC ID 2APYR-PDB1630 Wi-Fi Doorbell Camera by LaView Eagle-Eye Technology Inc. (Info on LaView Doorbell)
FCC ID 2ADTD-DOORBELL 3MP Wi-Fi Doorbell Camera by Hangzhou Hikvision Digital Technology Co., Ltd. (Info on Nelly's Doorbell)