R0 / DS-2CD2x32 BrickfixV2 brick recovery and full upgrade tool - enhanced.

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,952
Reaction score
6,787
Location
Scotland
I have six Hik cameras and successfully updated 5 of them.
That's good.
my PC set a 192.0.0.128 cannot ping it, IP Scanner software can see it at 192.0.0.64.
That's a bit of a contradiction, I'd expect them to give the same result. have you tried a 'ping -t 192.0.0.64' in case it's coming and going?
SADP cannot see it,
One thing worth trying is to wait 10 minutes to see if the watchdog timer will reboot into min-system mode (visible to SADP) in case the main firmware is partly running.
The FTPserve.exe program will display Device [192.0.0.64] test tftpserver everytime I unplug and plug it back in.
So not totally dead. But not completing the tftp updater handshake.
I do recall that it did allow me to proceed past this stage and it did complete the upgrade,
By this do you mean the 'System upgrade successful' message in the telnet session while running the /dav/fixup.sh script?
Or do you mean the successful installation if the brickfixv2EN firmware?

it goes through a 8 port POE power injector before going into the switch.
Suggestion :
The tftp updater timing can be marginal when using POE to power the camera.
If you can - try powering it with a 12v power supply to see if the tftp updater works better.
 

Titoine

n3wb
Joined
Jun 2, 2018
Messages
1
Reaction score
0
Location
canada
Thanks a lot for your great work !
My chinese 2032 was bricked, I followed the procedure and successfully flashed the firmware English V5.4.5_Build170123.
 

mwoo68

n3wb
Joined
Sep 16, 2014
Messages
27
Reaction score
2
That's good.

That's a bit of a contradiction, I'd expect them to give the same result. have you tried a 'ping -t 192.0.0.64' in case it's coming and going?
With PC at 192,0,0,128, ping -t 192.0.0.64 just says "request timed out". Yes it is odd that IPscan can see it but not SADP. I did take the time to take down the camera from the home and tried holding reset and rebooting,but that didn't help either (didn't think it would)

One thing worth trying is to wait 10 minutes to see if the watchdog timer will reboot into min-system mode (visible to SADP) in case the main firmware is partly running. Wait for an hour, same thing.

So not totally dead. But not completing the tftp updater handshake. Yes it seems that way. There is power and etherlight lights are blinking away....

By this do you mean the 'System upgrade successful' message in the telnet session while running the /dav/fixup.sh script?
Or do you mean the successful installation if the brickfixv2EN firmware?
I think I got to brickfixvEN and then I must of unplugged it. All I can remember was when I was performing the steps, this camera did get past the "test" on the TFTPserver, but now it just gets stuck at the "test" and like you said, does not complete the handshake.


Suggestion :
The tftp updater timing can be marginal when using POE to power the camera.
If you can - try powering it with a 12v power supply to see if the tftp updater works better.[/QUOTE]
Yup, took camera down from home and just tried it with a 12V supply and same result.

As you should know, I am definitely novice, but, I have read something about a serial connection method? If so, would this be worth a try?
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,952
Reaction score
6,787
Location
Scotland
I have read something about a serial connection method? If so, would this be worth a try?
Certainly, if you feel inclined to spend the time on it.
You need a couple of items, widely available on eBay -
A serial TTL to USB convertor, usually a PL2303HX-based one.
A 4-pin 1.5mm JST ZH wired connector, usually sold in 10-packs.

But before you start down that path - try another PC, use the 12v power supply, see if anything changes.
You still have a digicap.dav file in the same folder as tftpserve.exe ?
 

mwoo68

n3wb
Joined
Sep 16, 2014
Messages
27
Reaction score
2
Certainly, if you feel inclined to spend the time on it.
You need a couple of items, widely available on eBay -
A serial TTL to USB convertor, usually a PL2303HX-based one.
A 4-pin 1.5mm JST ZH wired connector, usually sold in 10-packs.

But before you start down that path - try another PC, use the 12v power supply, see if anything changes.
You still have a digicap.dav file in the same folder as tftpserve.exe ?
Yes I have tried a notebook on battery power and a desktop computer. And yes I have the digicap.dav in the same directory as tftpserve.exe.
This one camera is stumping me.

I'll begin looking for those items you mention above. Don't know what else to try... Thanks for all your help.
 

automaton

n3wb
Joined
Aug 1, 2017
Messages
28
Reaction score
8
Just wanted to say thanks for writing this post. I have a DS-2CD2432F-IW that I got from AliExpress and I attempted to update the firmware a few months ago and it bricked. I had no idea there was a difference between the CN/EN models. I followed the instructions provided and used the EN digicap and everything worked great. Camera is back up and running now with v5.4.5 in English.

Would have been in the garbage without the help of this community.
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,952
Reaction score
6,787
Location
Scotland
I followed the instructions provided and used the EN digicap and everything worked great.
Well done, and thanks for sharing!

I attempted to update the firmware a few months ago and it bricked.
This is quite deliberate by Hikvision and ranks high in the list of nasty tricks.
Shame on them.
 

Huxley

n3wb
Joined
Jun 3, 2018
Messages
1
Reaction score
0
Location
Paraguay
The original 'brick-fix tool' and 'enhanced mtd hack' has proven pretty useful for those with R0 cameras that had been bricked by doing a firmware update.
It's been even more useful to deal with the fallout from the 'Hikvision backdoor' disclosure where so many people are finding their cameras are being messed with from the internet, mischievously or maliciously, and need to update to safer firmware.
However - the rather techy original method to make the changes, and probably my not-very-clear instructions have been a challenge for some people.
* And I only just noticed this - my original .txt attachments were in Linux format, not Windows format, making them hard to read without proper line breaks. And no-one let me know! Dohh! *

So here is 'Brick-fix tool V2' aimed at making the process less complex, a bit automated and easier to use, with the following changes:
- After Brick-fix toolV2 has been installed using the Hikvision tftp updater, following the power cycle to activate and drop the payload, the camera will boot directly into 'min-system' mode with telnet and tftp access and a 'fixup' script ready and primed for use.
- No web GUI access or Windows shares are needed to move files in and out of the camera.
- The fixup script handles all the basics of extracting the original mtdblock6, importing and applying the user-modified mtdblock6 that has had the 'enhanced mtd hack', and initiating a firmware update.
- The Brick-fix toolV2 automatically writes a valid template into mtdblock1 that stops cameras that originally had firmware 5.2.0 or 5.2.8 from otherwise going into a bricked state when newer firmware is applied.
Attached to this post are the resources required to convert your R0 / DS-2CD2x32 cameras into full English upgradeable devices.
- The brick-fix tool V2 in both EN and CN header language versions.
- A required resource list and step-by-step guide to the fixup script.
- A description of how to do the 'enhanced mtd hack' with screenshot with a list of devType codes for those cameras that have the masqueraded values.
- A sample transcript of the fixup script going through all 3 stages - extract mtdblocks, import modded mtdblock6, apply firmware update.

*edit* 15Dec17 By popular request, a video worked example using a DS-2CD3332-I camera donated by a generous forum member.

*edit* 28Jan18 devType codes updated - thanks @hikcamuser
And check out this useful post from @Bradmph with attached resources (but use tftp32 not tftp64) : R0 / DS-2CD2x32 BrickfixV2 brick recovery and full upgrade tool - enhanced.
Firstly, i want to thank you all, to you and all the people involved on this "efford" of "bring to life chinese graymarket bricked cameras"

Secondly, the only reason to register to this forum was to thanks this thread resolution, the efford, the work and all the time invested/messed resolving this trouble.

Sorry for the bad english, im from Paraguay, and im very happy for recovering an inversion of 130 U$S (Recovered Hikvision DS-2CD2132IF-S camera)

I folloewed straighforward the instruccions listed, used the tftp 32 bit version software, used EN Digicap firmware FIXER, an "US ORIGINAL HIKVISION FIRMWARE version 5.4.5" instead of an older 5.3.0 and works like a charm.

In the future im gonna check and re check to buy a white/legal market Hikvision cameras, instead bottering people like you.

Thanks for everything you do with technnology messed by people like me.

Thumbs and kudos for you!!

Aldo.
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,952
Reaction score
6,787
Location
Scotland
I folloewed straighforward the instruccions listed, used the tftp 32 bit version software, an "US FIRMWARE version 5.4.5" instead of an older 5.3.0 and works like a charm.
Excellent!
Well done for getting the good result and sharing, glad it was useful for you.

Thanks for everything you do with technnology messed by people like me.
It's Hikvision who are putting these traps and pitfalls in people's way. Not nice - when firmware / software updates are usually a good thing to do.
 

nic12937

n3wb
Joined
Jun 27, 2018
Messages
4
Reaction score
0
Location
USA
Thank you so much! I was doubtful this work work, I was a little confused with the HEX editor part but I was able to successfully "unbrick" model 2cd2632f-is and flash it with 5.4.0.
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,952
Reaction score
6,787
Location
Scotland
Thank you so much! I was doubtful this work work, I was a little confused with the HEX editor part but I was able to successfully "unbrick" model 2cd2632f-is and flash it with 5.4.0.
Well done! Nice when a 'dead' camera is brought back to life.

But be aware - 5.4.0 is still vulnerable to the 'Hikvision backdoor'.
To have that fixed requires 5.4.5
 

nic12937

n3wb
Joined
Jun 27, 2018
Messages
4
Reaction score
0
Location
USA
I'm afraid to flash firmware again, I dont really understand why it was bricked in the first place when I first flashed the firmware. HIKVISION says my camera is gray market so I assume thats why the firmware breaks it. Now that it's operational on version 5.4.0, i'm hesitant to do anything to it since the camera mounted 40 feet up on the side of an airport hangar.
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,952
Reaction score
6,787
Location
Scotland
Now that it's operational on version 5.4.0, i'm hesitant to do anything to it since the camera mounted 40 feet up on the side of an airport hangar.
If you used the brickfixv2 tool - to revive the camera and do the 'enhanced MTD hack' - the camera is now fully upgradeable, via the web GUI, to the latest 5.4.5 firmware.
 

nic12937

n3wb
Joined
Jun 27, 2018
Messages
4
Reaction score
0
Location
USA
yes that's exactly what I did but I dont see 5.4.5 available for download on the Hikvision US website. I'm looking here Firmware and the latest version says Archived Firmware: IPC -DS-2xx2_5.4.0_160530. Do you know anywhere else I would get that 5.4.5 version? thanks so much for the help
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,952
Reaction score
6,787
Location
Scotland
Do you know anywhere else I would get that 5.4.5 version?
This is the newest version, and probably the last, firmware for an R0 series camera : DOWNLOAD PORTAL

*edit* here is another source, closer to home : Value Series

The very many Hikvision websites are all over the place with respect to content, not much consistency. Poor for such a large company.
 

nic12937

n3wb
Joined
Jun 27, 2018
Messages
4
Reaction score
0
Location
USA
How would I go about confirming my camera is R0 series before flashing? I know it's gray market DS-2CD2632F-IS, running V5.4.0 build 160530
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,952
Reaction score
6,787
Location
Scotland
How would I go about confirming my camera is R0 series before flashing?
The model number confirms it.
However, if it wasn't, the web GUI would reject the attempted firmware update.
But see attached - from the Hikvision EU portal (since removed when they revamped it).
 

Attachments

Top