Recent content by protocold

The cost of these things are negligible compare to the time cost. It is always doing it for fun I guess. People now know what to do when the TFTP doesnt work.

guess what... deleting the 2 db didnt work. However... when I do 'erase' in bootloader, it prompt me to select which partition to erase. i selected cfg0 and boom! things got reset and SADP now said inactive. I am in business. So much messing around...

This is the newly created jffs2 image and its content: root@osboxes:/home/osboxes/hikvision# jffs2reader new_cfg0 --w---x--T 1 0 0 4096 /DS-2CD2123FWD-I20181113AAWRC67720447.log -rwxr--r-- 1 0 0 652 /db_op_info.log -rw-r--r-- 1 0 0...

FYI. This is the content of the cfg0 partiton: root@osboxes:/home/osboxes/hikvision# jffs2reader cfg0 -rwxr--r-- 1 0 0 652 /db_op_info.log -rw-r--r-- 1 0 0 4096 /netOsd.bin -rw-r--r-- 1 0 0 1054 /servkey.pem -rw-r--r-- 1 0...

yes, I cut out cfg0 partition and under linux I can mount it and delete the 2 files. However I would have to re-create the jffs2 images as I cant just "edit" it. This is a time waster and pain. I am about to try putting the new jffs2 back onto the image and write it back.

ok. the cfg0 section is a jffs2 image. when I mounted that i saw ipc_db and ipc_db_backup similar to what you show earlier.

hey... this tftp thing is supposed to fix corruption right? if the thing is corrupted then it will work harder????

Yup. I did that before i took it off... the read was unreliable as reading 3 times show different dump. The only reliable way to dump this is to remove it.

i have a hotgun station here and also a spi chip programmer.

I was about to say I will be trying this next. I now have the full dump. let me see what I come with after some binwalk. Do you want to have a look too?

HKVS # help erase - erase flash except bootloader area go - start application at address 'addr' gpio - set the gpio help - print command description/usage loadk - load kernel to DRAM update - update digicap.dav updateb - update bootloader upf - update firmware, format and...

i have now unsoldered the chip to do a proper dump of it for further analysis. I wonder if i hex edit and wipe cfg0 (the last section of the flash).. what would happen.

The logs shown was what I saw before I used the tools..

yeah i got all that.... so yes I ran that tool already. In fact, I used that tool to update the version to 5.5.80 for SADP to see.

Hikvision tftp updater tool ?? I thought I ran it? there is this tftpserv.exe thing that ran and when the camera boot up it auto fetch firmware from it and update. Is this the tool that you are talking about?