Soft bricked DS-2CD2732F-IS - Advice needed...

Hunk · Oct 22, 2018

Hi,

Been lurking around for quite some time now getting wiser quietly - now the time has come for an advice

I have 6 DS-2CD2732F-IS - all CN models - happily running the firmware they came with
Now the time came to fix what was not really broken and I successfully upgraded 4 of them without problems following the great "R0/DS-2CD2x32 BrickfixV2 brick recovery and full upgrade tool - enhanced" guide at R0 / DS-2CD2x32 BrickfixV2 brick recovery and full upgrade tool - enhanced.

But the 5th... did not work out so well and I would love some guidende to get it back to a better state
I'm not really sure where I messed up, but I think at some point I get my "digicap.dav" files mixed up and flashed IPC_R0_EN_STD_5.4.5_170123 from the Hikvision tftp updater
Either way, I'm stuck now and can't flash any firmware without boot failure
Currently it's running the mini system from the 'Brick-fix tool V2' with an mtd6ro modified according to the guide
I've attached serial to it and can see roughly the same symptoms whatever I flash it with - A boot loop!

This repeats over and over again

Code:

U-Boot 1.3.4-113988 (Mar 20 2015 - 17:36:32)

ARM Clock: 480MHz
DDR Clock: 336MHz
Hit Ctrl+u to stop autoboot: 0
|RCV UDP pack timeout|
Unknown command:null
booting from pri part...
load kernel...
load ramdisk...
init started: BusyBox v1.19.3 (2017-01-13 20:51:32 CST)
starting pid 373, tty '': '/etc/init.d/rcS'
Starting udev:      [ OK ]
UBI device number 1, total 192 LEBs (24772608 bytes, 23.6 MiB), available 0 LEBs (0 bytes), LEB size 129024 bytes (126.0 KiB)
waiting for /dev/ubi1_0.
pri_iUpgSuccCnt:0x1, sec_iUpgSuccCnt:0x1
UBI device number 3, total 32 LEBs (4128768 bytes, 3.9 MiB), available 0 LEBs (0 bytes), LEB size 129024 bytes (126.0 KiB)
waiting for /dev/ubi3_0.
Check dir /davinci ok! (0)
UBI device number 4, total 32 LEBs (4128768 bytes, 3.9 MiB), available 0 LEBs (0 bytes), LEB size 129024 bytes (126.0 KiB)
waiting for /dev/ubi4_0.
Check dir /config ok! (0)
diagnose_way = 10, repair_way = 1, interval = 60
route: ioctl 0x890c failed: No such process
mount: mounting none on /proc/bus/usb failed: No such file or directory
/dav
map_size = 0x300000
nr_item = 3
addr_offset = 0x0 filename = orccode.bin
addr_offset = 0x200000 filename = orcme.bin
addr_offset = 0x2a0000 filename = default_binary.bin
mmap returns 0x40260000
loading ./orccode.bin...addr = 0x40260000, size = 0x1a0a91
loading ./orcme.bin...addr = 0x40460000, size = 0x3a4fc
loading ./default_binary.bin...addr = 0x40500000, size = 0x40000
===============================
u_code version = 2016/4/6 3.0
===============================
ln: /dev/rtc: File exists
=====check_config start=====
===main db is ok===
FSP_network_protocol_5.3.5_net_1.6.1 netprocess version: 1.6.1 [17:24:18-Jan 13 2017].
No need to recover kernel pri partition.
No need to recover ramdisk pri partition.
[10-21 22:59:45][pid:843][STRM_ANLS][ERROR] from daemon ack, dst not work  len 0 , load_type is [10012]
[10-21 22:59:45][pid:843][UNI_IF][ERROR]65554:ipc_unix_call_service failed, ret = -3.
[10-21 22:59:45][pid:843][UNI_IF][ERROR]communicaite_to_davinci failed!!!
[10-21 22:59:45][pid:839][STRM_ANLS][ERROR]daemon can not find Dst process.load_type 0x10012 is_need_ack 1
infd read End
Unix bus   0 .
[10-21 22:59:46][pid:839][STRM_ANLS][ERROR]daemon can not find Dst process.load_type 0x10012 is_need_ack 1
[10-21 22:59:46][pid:843][STRM_ANLS][ERROR] from daemon ack, dst not work  len 0 , load_type is [10012]
[10-21 22:59:46][pid:843][UNI_IF][ERROR]65554:ipc_unix_call_service failed, ret = -3.
[10-21 22:59:46][pid:843][UNI_IF][ERROR]communicaite_to_davinci failed!!!
[10-21 22:59:47][pid:839][STRM_ANLS][ERROR]daemon can not find Dst process.load_type 0x10012 is_need_ack 1
[10-21 22:59:47][pid:843][STRM_ANLS][ERROR] from daemon ack, dst not work  len 0 , load_type is [10012]
[10-21 22:59:47][pid:843][UNI_IF][ERROR]65554:ipc_unix_call_service failed, ret = -3.
[10-21 22:59:47][pid:843][UNI_IF][ERROR]communicaite_to_davinci failed!!!
[10-21 22:59:48][pid:839][STRM_ANLS][ERROR]daemon can not find Dst process.load_type 0x10012 is_need_ack 1
[10-21 22:59:48][pid:843][STRM_ANLS][ERROR] from daemon ack, dst not work  len 0 , load_type is [10012]
[10-21 22:59:48][pid:843][UNI_IF][ERROR]65554:ipc_unix_call_service failed, ret = -3.
[10-21 22:59:48][pid:843][UNI_IF][ERROR]communicaite_to_davinci failed!!!
IEfile uncompressed.
[10-21 22:59:49][pid:839][STRM_ANLS][ERROR]daemon can not find Dst process.load_type 0x10012 is_need_ack 1
[10-21 22:59:49][pid:843][STRM_ANLS][ERROR] from daemon ack, dst not work  len 0 , load_type is [10012]
[10-21 22:59:49][pid:843][UNI_IF][ERROR]65554:ipc_unix_call_service failed, ret = -3.
[10-21 22:59:49][pid:843][UNI_IF][ERROR]communicaite_to_davinci failed!!!
[10-21 22:59:50][pid:839][STRM_ANLS][ERROR]daemon can not find Dst process.load_type 0x10012 is_need_ack 1
[10-21 22:59:50][pid:843][STRM_ANLS][ERROR] from daemon ack, dst not work  len 0 , load_type is [10012]
[10-21 22:59:50][pid:843][UNI_IF][ERROR]65554:ipc_unix_call_service failed, ret = -3.
[10-21 22:59:50][pid:843][UNI_IF][ERROR]communicaite_to_davinci failed!!!
[10-21 22:59:51][pid:839][STRM_ANLS][ERROR]daemon can not find Dst process.load_type 0x10012 is_need_ack 1
[10-21 22:59:51][pid:843][STRM_ANLS][ERROR] from daemon ack, dst not work  len 0 , load_type is [10012]
[10-21 22:59:51][pid:843][UNI_IF][ERROR]65554:ipc_unix_call_service failed, ret = -3.
[10-21 22:59:51][pid:843][UNI_IF][ERROR]communicaite_to_davinci failed!!!
[10-21 22:59:52][pid:839][STRM_ANLS][ERROR]daemon can not find Dst process.load_type 0x10012 is_need_ack 1
[10-21 22:59:52][pid:843][STRM_ANLS][ERROR] from daemon ack, dst not work  len 0 , load_type is [10012]
[10-21 22:59:52][pid:843][UNI_IF][ERROR]65554:ipc_unix_call_service failed, ret = -3.
[10-21 22:59:52][pid:843][UNI_IF][ERROR]communicaite_to_davinci failed!!!
[10-21 22:59:53][pid:839][STRM_ANLS][ERROR]daemon can not find Dst process.load_type 0x10012 is_need_ack 1
[10-21 22:59:53][pid:843][STRM_ANLS][ERROR] from daemon ack, dst not work  len 0 , load_type is [10012]
[10-21 22:59:53][pid:843][UNI_IF][ERROR]65554:ipc_unix_call_service failed, ret = -3.
[10-21 22:59:53][pid:843][UNI_IF][ERROR]communicaite_to_davinci failed!!!
[10-21 22:59:54][pid:843][STRM_ANLS][ERROR] from daemon ack, dst not work  len 0 , load_type is [10012]
[10-21 22:59:54][pid:843][UNI_IF][ERROR]65554:ipc_unix_call_service failed, ret = -3.
[10-21 22:59:54][pid:843][UNI_IF][ERROR]communicaite_to_davinci failed!!!
[10-21 22:59:54][pid:839][STRM_ANLS][ERROR]daemon can not find Dst process.load_type 0x10012 is_need_ack 1
[10-21 22:59:55][pid:843][STRM_ANLS][ERROR] from daemon ack, dst not work  len 0 , load_type is [10012]
[10-21 22:59:55][pid:843][UNI_IF][ERROR]65554:ipc_unix_call_service failed, ret = -3.
[10-21 22:59:55][pid:843][UNI_IF][ERROR]communicaite_to_davinci failed!!!
[10-21 22:59:55][pid:839][STRM_ANLS][ERROR]daemon can not find Dst process.load_type 0x10012 is_need_ack 1
Unix bus  End
insmod: can't insert 'uart232.ko': File exists
davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

powerLineFrequencyMode = 0
@@@motion PAL!!!!!!!!!!!!!!!!!
[10-21 22:59:57][pid:859][UNI_IF][ERROR]stream request out range 3(2)
davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param
version = 16777472
get 0-0-0-0.000000-0-0-0
version = 16777472
davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

[10-21 22:59:59][pid:859][OTHER][ERROR]ipc_db_backup need backup.
<init_run>3902:p_devcfg->ccdPara[1].capture_mode [0]
<MEGA_DSP>Platform Value:
<MEGA_DSP>Main mux type [0x4].
<MEGA_DSP>Sub   mux type [0x4].
<MEGA_DSP>Thi  mux type [0x2].
<MEGA_DSP>audio enc type[0x2].
<MEGA_DSP>voicetalk type[0x2].
<MEGA_DSP>Need PS SysHdr[0].
[10-21 22:59:59][pid:859][HW_IF][ERROR]<INIT485>:x=9,maxBaudIdx=15,/dev/uart1
[10-21 22:59:59][pid:859][HW_IF][ERROR]<INIT485>set...baudrate=9600,data=3,stop=0,parity=0,flowcontrol=0
starting pid 877, tty '': '-/bin/psh'
BusyBox v1.2.1-171136 Protect Shell (psh)
Enter 'help' for a list of davinci system commands.

# davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

<DSP> DBG:init_dsp_lib() begin
<DSP> DBG:init_dsp_lib() end
[10-21 23:00:05][pid:859][DSP][ERROR][0]g_pdsp->audioTBShare.frameLen=160, g_pdsp->audioTBShare.totalFrame=64..
[10-21 23:00:05][pid:859][SYSINIT][ERROR]max_fps=0...
[10-21 23:00:05][pid:859][SYSINIT][ERROR]max_fps=0...
[10-21 23:00:05][pid:859][SYSINIT][ERROR]max_fps=0...
davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

mknod: /dev/snd/controlC0: File exists
mknod: /dev/snd/pcmC0D0c: File exists
mknod: /dev/snd/pcmC0D0p: File exists
dsp_init: Unsupported viType=0
davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

[10-21 23:00:16][pid:859][SYSINIT][ERROR]hwif_dsp_init error force sys reboot,ret=-12!!!!
davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

I'm thinking some other mtd got damaged in the process and that I can dump it from a donor camera
I do have a backup of the original mtd 1 and 6 from all cam's so I can get mtd6 back to it's old state - which does not seem to help here

Thanks in advance! I've been reading a lot on this forum both before and after this problem and I'm sure someone has a good advice

alastairstevenson · Oct 23, 2018

Hunk said:
dsp_init: Unsupported viType=0

For some reason the sensor type is missing. That's a fatal error.

Hunk said:
Currently it's running the mini system from the 'Brick-fix tool V2' with an mtd6ro modified according to the guide

Did you have to change the devType from a masqueraded value, FF98 ? If so, what value did you use? 0E98 seems to be the one for the DS-2CD2732F-IS

Just in case it's a problem with the modified mtd6ro, attached is a donor one that should be OK.
When running a telnet session in the min-system environment, you can use these commands to apply it :

Code:

    tftp -g -r mtd6ro_mod -b 1400 192.0.0.128
    cat mtd6ro_mod > /dev/mtdblock6

Warning - don't write mtdblock6 when running other than the min-system environment, especially firmware above 5.2.5 or a Hikvision trap can be triggered.

Hunk · Oct 23, 2018

Thank you for your reply! - You Sir, are a legend!

Yes, the devType was FF98 to begin with and I changed it to 0E98 and corrected the checksum-16
The only thing different (and not in my original post - sorry), is that the language was 1 and not 2 like on my other cam's

I flashed the provided mtd6 and did see a lot of errors on the serial connection, but in the end - IT WORKED!
I'm not really sure if there was an error in the original mtd6 dump (it was made over a 20m long ethernet cable, crossing some high voltage cables along the way) but your donor mtd6 did the trick!
I guess I could have taken the mtd6 from another one of my cam's but I was unsure if the MAC address, serial number, or other part needed to match the rest of the flash - seeing your mtd6 was successful I guess I could have been more adventures

You saved my cam!

Thanks a million

And thank you for all your great posts

I guess there are more like me out there that's been a member for years and quietly getting their hand dirty thanks to the great amount of great resources on this board

alastairstevenson · Oct 23, 2018

Hunk said:
I flashed the provided mtd6 and did see a lot of errors on the serial connection, but in the end - IT WORKED!

Hey, a good result!
When you first see the serial console it can be quite worrying the quantity of errors that are reported.
But for the most part, it's how the firmware works.
The same firmware is used for many different models within the same series, and with a few different options.
So some of the errors are the firmware interacting with the hardware to determine what it's running in.
And many are informational, but marked as ERROR.

Hunk said:
I could have taken the mtd6 from another one of my cam's but I was unsure if the MAC address,

That would have given a duplicate MAC address - bad news for a network, neither camera would work properly when both were powered on.

Hunk said:
quietly getting their hand dirty thanks to the great amount of great resources on this board

You are right - there is a terrific set of resources provided by this board - covering the whole spectrum from mechanical to electrical to hacking and absolutely loads of advice and guidance for different choices and use cases.
I think the members get much satisfaction from contributing info that helps others.

davej · Nov 11, 2018

Okay, so please allow me to hijack this thread, since I may have a nearly identical situation with the same camera. What are the steps for evaluating a non-functional camera with an unknown history? Some years ago I bought a slightly-used DS-2CD2732F-IS before I understood that this was a bad idea. Now I have finally taken a look at it and can see it suffers from some sort of firmware screw-up. I have no idea if it is a Chinese version or what it is. Is there any way to tell? The label says: V5.2.8_141231 and SADP says: V4.0.8build 140610 and reports it as a DS-2CD-Min-System.

Hunk · Nov 11, 2018

DS-2CD-Min-System... Can you telnet to it?

alastairstevenson · Nov 11, 2018

Hunk said:
DS-2CD-Min-System... Can you telnet to it?

Yes, at the IP address of 192.0.0.64 and with admin/12345 as the credentials, and the PC on the same IP address range, such as 192.0.0.128
But depending on the version of the min-system recovery mode you may be hit with the 'psh' restricted shell.
You might be as well going through the brickfixV2 method to convert the camera to upgradeable and update it to the 5.4.5 or 5.4.41 newest firmware :

Unbrick and fully upgrade your R0 / DS-2CD2x32 IP cameras -
R0 / DS-2CD2x32 BrickfixV2 brick recovery and full upgrade tool - enhanced.

davej · Nov 11, 2018

Telnet responds with the login prompt but admin 12345 doesn't get me logged in.

alastairstevenson · Nov 11, 2018

davej said:
Telnet responds with the login prompt but admin 12345 doesn't get me logged in.

Sorry, my mistake. Too many varieties to remember correctly.
Should be root/12345

davej · Nov 11, 2018

Okay, root/12345 worked. It says...

login: can't change chdir to home directory '/root/'
# _

alastairstevenson · Nov 11, 2018

davej said:
login: can't change chdir to home directory '/root/'

More of a comment than an error.
An inconsistency - as there is no /root to change to.
But do you get a full shell - or is it psh

Use 'help' to find out.

davej · Nov 11, 2018

Well, it looks sorta like linux. Help gives me...
Built-in commands:
----------------------
.: [ [[ bg break cd chdir command continue echo eval exec exit
export false fg getopts hash help jobs kill let local pwd read
readonly return set shift source test times trap true type ulimit
umask unset wait

davej · Nov 11, 2018

linux commands such as ifconfig work.

alastairstevenson · Nov 12, 2018

OK, so that's not psh, it's a regular shell. That's good.
It's likely also that this older version of the min-system doesn't have the anti-rollback blocking facility that's in the newer versions.

What do you want to do next?
With the 'upgrade' command you should be able to install older firmware such as the '5.3.0 to 5.2.5 downgrader' from here (2nd dropbox link) - Custom Firmware Downgrader 5.3.0 Chinese to 5.2.5 English

You should be able to do the classic 'MTD hack' to convert to English - Hikvision 5.2.5 & 5.2.8 Full English (INC DAYS OF WEEK) mtd Hack

And you should be able to do the 'enhanced MTD hack' to convert to English / upgradeable - R0 / DS-2CD2x32 BrickfixV2 brick recovery and full upgrade tool - enhanced.

davej · Nov 12, 2018

Hmmm... I don't know what to do. I've never read up on how to perform the firmware upgrade process -- since I figured I'd be buying the cheap eBay Hikvision's that are not safe to upgrade. Maybe I need to go read about this process and download the necessary tools? Thank you for your assistance!

alastairstevenson · Nov 12, 2018

davej said:
I've never read up on how to perform the firmware upgrade proc

It's all in here - lots of folk have done this :
Unbrick and fully upgrade your R0 / DS-2CD2x32 IP cameras -
R0 / DS-2CD2x32 BrickfixV2 brick recovery and full upgrade tool - enhanced.

Search

Soft bricked DS-2CD2732F-IS - Advice needed...

Hunk

n3wb

alastairstevenson

Attachments

Hunk

n3wb

alastairstevenson

davej

Getting the hang of it

Hunk

n3wb

alastairstevenson

davej

Getting the hang of it

alastairstevenson

davej

Getting the hang of it

alastairstevenson

davej

Getting the hang of it

davej

Getting the hang of it

alastairstevenson

davej

Getting the hang of it

alastairstevenson