Search results

The cost of these things are negligible compare to the time cost. It is always doing it for fun I guess. People now know what to do when the TFTP doesnt work.

guess what... deleting the 2 db didnt work. However... when I do 'erase' in bootloader, it prompt me to select which partition to erase. i selected cfg0 and boom! things got reset and SADP now said inactive. I am in business. So much messing around...

This is the newly created jffs2 image and its content: root@osboxes:/home/osboxes/hikvision# jffs2reader new_cfg0 --w---x--T 1 0 0 4096 /DS-2CD2123FWD-I20181113AAWRC67720447.log -rwxr--r-- 1 0 0 652 /db_op_info.log -rw-r--r-- 1 0 0...

FYI. This is the content of the cfg0 partiton: root@osboxes:/home/osboxes/hikvision# jffs2reader cfg0 -rwxr--r-- 1 0 0 652 /db_op_info.log -rw-r--r-- 1 0 0 4096 /netOsd.bin -rw-r--r-- 1 0 0 1054 /servkey.pem -rw-r--r-- 1 0...

yes, I cut out cfg0 partition and under linux I can mount it and delete the 2 files. However I would have to re-create the jffs2 images as I cant just "edit" it. This is a time waster and pain. I am about to try putting the new jffs2 back onto the image and write it back.

ok. the cfg0 section is a jffs2 image. when I mounted that i saw ipc_db and ipc_db_backup similar to what you show earlier.

hey... this tftp thing is supposed to fix corruption right? if the thing is corrupted then it will work harder????

Yup. I did that before i took it off... the read was unreliable as reading 3 times show different dump. The only reliable way to dump this is to remove it.

i have a hotgun station here and also a spi chip programmer.

I was about to say I will be trying this next. I now have the full dump. let me see what I come with after some binwalk. Do you want to have a look too?

HKVS # help erase - erase flash except bootloader area go - start application at address 'addr' gpio - set the gpio help - print command description/usage loadk - load kernel to DRAM update - update digicap.dav updateb - update bootloader upf - update firmware, format and...

i have now unsoldered the chip to do a proper dump of it for further analysis. I wonder if i hex edit and wipe cfg0 (the last section of the flash).. what would happen.

The logs shown was what I saw before I used the tools..

yeah i got all that.... so yes I ran that tool already. In fact, I used that tool to update the version to 5.5.80 for SADP to see.

Hikvision tftp updater tool ?? I thought I ran it? there is this tftpserv.exe thing that ran and when the camera boot up it auto fetch firmware from it and update. Is this the tool that you are talking about?

Ok. I tried to use the 13mb firmware instead of the 21mb as my flash size is only 16mb. Update took it and wrote it. But SADP still show it is active? I tried both the same version as well as newer version, SADP recognize new version updated as well, but then the database still remain intact.

last question before i try.. i saw there are different languages for the firmware. what if mine is a chinese version? will it take the firmware and create a brick? or will it reject it?

perhaps mine is not G1? google shows nothing..

HKVS # reset resetting ... System startup Uncompress.............Ok System startup U-Boot 2010.06-403449 (Jun 27 2018 - 14:29:28) spi_solve_flash_lock_qe_enable(379): Error: Disable Quad failed! reg: 0x2 SPI Nor: 16MB DDR: 128MB [Uboot] In release mode! Hit Ctrl+u to stop autoboot: 0...

# prtHardInfo Start at 2020-01-18 17:54:26 Serial NO :DS-2CD2123FWD-I<I removed this> V5.5.53 build 180713 NetProcess Version: 6.11.2 [12:03:06-Jun 7 2018] Path: /Camera/Platform/Branches/branches_FSP_network_protocol/FSP_network_protocol_for_e3_suit_wpa_update_V6 Last Changed Rev: 398792 Last...

this is what was shown in printenv in bootloader: HKVS # printenv bootargs=console=ttyAMA0,115200 bootcmd=loadk;bootm bootdelay=3 baudrate=115200 netmask=255.255.255.0 bootfile="uImage" ipaddr=192.168.1.64 serverip=192.168.1.128 stdin=serial stdout=serial stderr=serial verify=n mdio_intf=rmii...

just tried... but update is looking for digicap.dav... but the file I download was mImage_g1 ? HKVS # update MAC: <I removed this> eth0 : phy status change : LINK=UP : DUPLEX=FULL : SPEED=100M TFTP from server 192.168.1.128; our IP address is 192.168.1.64 Download Filename 'digicap.dav'...

sorry to be a noob, but when you type 'update' in the bootloader, does it fetch some stuff over tftp? Is that mImage_g1 ??? Do i need to rename mImage_g1 to anything? Is there a more detailed instruction?

thanks. I got serial to work and saw the output. Let me read the link you sent earlier in detail to make sure i dont mess up. Will be in touch with updates.

ok i was just working with the soldering iron actually so I managed to just solder the 4 serial wires as well. About to test it. Now can you also tell me what do i do with that? How can I use the serial to do the reset?

Let me try the TFTP. I am very comfortable in soldering the serial and also de-soldering the flash chip to do a dump etc. If I get serial console to work, how do I perform the reset? If I get a flash dump, is there a way I can wipe some section of the flash to perform such reset? I can...

Hi, I bought 2 used Hikvision DS-2CD2123FWD-I camera and want to reset the admin password. I took it apart to look for the reset button but it doesnt have one, I took some internal pictures of it (as attached). [EDIT] I have now resolved the problem, as described later in the thread...

I have programmer and so I can do full dump and restore if needed. My question is, is it possible to somehow use old bootloader with new firmware? (i.e. possible to use the cor35vet scripts to fix up the new chinese firmware and then package it with old bootloader? Is bootloader part of the...