Camera bricked after region changer hack

[bp2008]

@klasipca ./ = run

I wouldn't say that is entirely accurate. Of course only a real nerd will care about and understand the difference LOL: http://stackoverflow.com/questions/6331075/why-do-you-need-dot-slash-before-script-name-to-run-it-in-bash

 

[klasipca]

Thank you for all support! I was able to recover it! Will try again to apply the hack.


Can you confirm the selected places are the only ones that I need to update? I see other 02 in there, but no sure if they need to be updated:

 

[bp2008]

Looks right. I looked at some mtd5 and mtd6 files of my own and that is what I saw. In fact since one of those files (mtd6 I think) is nothing but FF values on an english cam I wonder if both files even matter, or if just one of them matters.

I also dont think the first 4 bytes of either file is a checksum as Networkcameracritic suspected, because they were an exact match between a swann branded 2032 and a chinese 2032 from aliexpress (they did have a lot of differences, including the expected region code bytes, but the first bytes matched between cams).

 

[alastairstevenson]

The SWKH bytes are the 'magic number' by which the block start is confirmed. Hikvision use this all over the place, even in the NVR configuration blocks. The checksum is after that. Along with the bytecount for it.

 

[Murtaza Kheraluwala]

Dear Admin,
i am facing a very big problem by mistake i have set my resolution wrong in my HIKVISION DVR because of which i am not able to view anything on the attached monitor kindly help me!!1

 

[harrijs]

Yes, do not cat it, it may mess up your telnet session. These are programs that are part of the open source MTDUtils.

Thanks, I didn't realize it was a binary. It seemed based on the output klasipca shared that it was a script and was expecting some parameters to be passed along. Can someone point me to the cheapest location for one of these cameras and I will pick one up to start messing with. I figured that the grey market devices are going to be cheaper than the $110 I am seeing on Amazon.

 

[bp2008]

Dear Admin,
i am facing a very big problem by mistake i have set my resolution wrong in my HIKVISION DVR because of which i am not able to view anything on the attached monitor kindly help me!!1

You should post a new thread about this. But I would suggest power cycling the DVR (did you mean NVR?) and if that fails look up a reset procedure (involving a physical reset button on the DVR, if it has one).

Thanks, I didn't realize it was a binary. It seemed based on the output klasipca shared that it was a script and was expecting some parameters to be passed along. Can someone point me to the cheapest location for one of these cameras and I will pick one up to start messing with. I figured that the grey market devices are going to be cheaper than the $110 I am seeing on Amazon.

Search aliexpress for them. You'll find them around $84 from a bunch of sellers, though the popular CCTV CAMERA CHINA seller is on vacation for Chinese new year, there are still a handful of well rated sellers with it for sale.

 

[klasipca]

So, I re applied the hack on 5.2.0 camera, worked fine this time (obviously) and then I upgraded to 5.2.3 easily via web interface. The only language now shows English which is fine. If anyone knows where to get 5.2.8 or perhaps 5.2.5 I would give this a try as well.

EDIT: Successfully upgraded to 5.2.5

 

[S474N]

Upgraded to 5.2.5 with LANGUAGE=1 and Eng day of week on OSD?

 

[klasipca]

Upgraded to 5.2.5 with LANGUAGE=1 and Eng day of week on OSD?

Yes

 

[networkcameracritic]

Good to know, have not tried that yet. Working with help on the direct hack for 5.2.5 cameras.

 

[iTuneDVR]

Good to know, have not tried that yet. Working with help on the direct hack for 5.2.5 cameras.

Boring :sleeping:

 

[klasipca]

Boring :sleeping:

Were you looking for some excitement here? Perhaps try a strip club. I hear it cures a boredom for some

 

[iTuneDVR]

Were you looking for some excitement here? Perhaps try a strip club. I hear it cures a boredom for some

Really?
Helping you?

When the whole year around and around it starts to get boring.
All because under your's nose.

 

[copex]

Ok i managed to write the wrong file to mtd5 and then rebooted the camera so using the info in this thread i managed to recover it, hoping it maybe usefull to some one else i am posing my findings here, ( share the info )

1. one thing i found when uploading the file this has to be done in binarymode i was using filezilla and in default it was set to auto this caused the flash_eraseall to error
2. you have to upload flash_erase & flash_eraseall ( i didnt find this clear )
3. you have to have the mtd5_temp & mtd6_temp from the nandump

below is a log of the working process, hope it helps someone

telnet 192.0.0.64
Trying 192.0.0.64...
Connected to 192.0.0.64.
Escape character is '^]'.

(none) login: root
Password: 
login: can't chdir to home directory '/root/'
# mkdir test
# ls
lib      davinci  home     bin      dav_sec  sys      tmp      proc     test
sbin     usr      config   dav      etc      VERSION  dev      init
# cd test
# ls
# ls
flash_eraseall  flash_erase     nandwrite       mtd5_temp       mtd6_temp
# chmod 777 flash_erase
# chmod 777 flash_eraseall
# chmod 777 nandwrite
# ./flash_eraseall /dev/mtd5
flash_eraseall has been replaced by `flash_erase <mtddev> 0 0`; please use it
Erasing 128 Kibyte @ 60000 -- 100 % complete 
# ./flash_eraseall /dev/mtd6
flash_eraseall has been replaced by `flash_erase <mtddev> 0 0`; please use it
Erasing 128 Kibyte @ 60000 -- 100 % complete 
# ./nandwrite -o /dev/mtd5 mtd5_temp
Writing data to block 0 at offset 0x0
Writing data to block 1 at offset 0x20000
Writing data to block 2 at offset 0x40000
Writing data to block 3 at offset 0x60000
# ./nandwrite -o /dev/mtd6 mtd6_temp
Writing data to block 0 at offset 0x0
Writing data to block 1 at offset 0x20000
Writing data to block 2 at offset 0x40000
Writing data to block 3 at offset 0x60000
# reboot
Connection closed by foreign host.

 

[aztihg]

I'm new to linux and computers and need some help. When I try to telnet the Windows share into the camera using "mount -t cifs //192.168.1.100/mtdutils /mnt/nfs07 -o user,password" command it fails and I'm getting "failed: Invalid argument" What am I doing wrong? Thanks.

 

[klasipca]

I'm new to linux and computers and need some help. When I try to telnet the Windows share into the camera using "mount -t cifs //192.168.1.100/mtdutils /mnt/nfs07 -o user,password" command it fails and I'm getting "failed: Invalid argument" What am I doing wrong? Thanks.

Username=pcuser,password=pcpass

 

[aztihg]

Thanks klasipca. I used the same info that I input into the camera under NAS tab.

 

[harrijs]

I'm new to linux and computers and need some help. When I try to telnet the Windows share into the camera using "mount -t cifs //192.168.1.100/mtdutils /mnt/nfs07 -o user,password" command it fails and I'm getting "failed: Invalid argument" What am I doing wrong? Thanks.

Try changing your command to the following syntax:

mount -t nfs 192.168.1.100:/mtdutils /mnt/nfs07

 

[alastairstevenson]

Just in case that didn't work ...
You would have to be running NFS on the target host.
Fine for a Linux box (incl NAS). Less fine for Windows.