Custom Firmware Downgrader 5.3.0 Chinese to 5.2.5 English

[Roch Plourde]

You are right, tftp updater doesn't show anything in term of transfer but if I look at the wireshark ethernet trace it does show that 192.168.0.128 is sending data packet and 192.0.0.64 is acknowledging the reception of packets. 15872 packets were sent and received with an indication that they were all sent (with the LAST indicator). See the attached wireshark extract. Also Tftpserv doesn't give me indication that data transfer was started, was completed etc... I am confused.

 

[alastairstevenson]

Also Tftpserv doesn't give me indication that data transfer was started, was completed etc... I am confused.

And so am I.
You did show a similar wireshark shot earlier, but I assumed it didn't match the tftp updater screenshot in the same post so ignored it.
There will presumably be a logical explanation - but right now it makes no sense.

So if you shut down the Hikvision tftp updater, and power cycle the camera, does wireshark still show tftp traffic?

 

[Roch Plourde]

Alastair,
Thanks very much. Everything is working fine.
I restarted the process from a different PC running windows 10. I didn't have to change the language stuff... I just extracted the oneline downgrader code, installed it in a directory, started the FTPSERV process and finally got all the messages in the FTPSERV window. What was the problem? Different Windows environment? Probably some different security settings (however both run the same Norton code)?, ... I don't know. But at the end everything work fine. I am back in business with my cam. Thanks again.

 

[Roch Plourde]

One more question.
Is there an upgrade path from the current 5.2.5 version I just installed in order to get additional functions#features?
Thanks.

 

[alastairstevenson]

Thanks very much. Everything is working fine.
I restarted the process from a different PC running windows 10.

It's good that you got there. But a bit of a puzzle as to what was going on.
But add Norton into the mix, and who knows?

Is there an upgrade path from the current 5.2.5 version I just installed in order to get additional functions#features

I think it's generally agreed that although there are some bugfixes and recent security vulnerability fixes, and an improved user interface, there isn't a compelling functionality reason to update to later firmware than 5.2.5
Plus there is some uncertainty as to whether the older cameras will take the newer firmware.

 

[Aspiring Geek]

Gentlemen/Ladies,
I have a "Hikvision" DS-2CD3132f-IWS, purchased in the grey market before I even knew there was such a thing. Firmware 5.2.5 build 141201 (English). No issues with functionality (at a high level), but I became frustrated with inability to view the Cam in Chrome because support for the NPAPI plugin was discontinued. I used Firefox until the same happened. Ditto for edge. Have not used IE for years. Use with my Synology NAS (Surveillance Station) was also an issue - the camera worked and recorded, but I couldn't look at the recorded files (they needed to be opened via the Synology's web browser - and here we go again! Have since discovered IE Tab functionality in Chrome - too late, she cried.

Searched the web and found firmware upgrades that purported to fix the plug-in issue. Needless to say, the updates bricked the camera. All this happened before I moved to Blue Iris with another cam - and discovered that Blue Iris obviated the browser plug-in BS I had been trying to overcome.

Nevertheless, I resolved to try to unbrick my Hikvision. Patrolled the web, found this site and now know a lot more about what I should not have done, thanks to whoslooking and alastairstevenson in particular, and others. Unfortunately, I am less clear on what I should now do (read on).

The bricked camera was not visible on the SADP Tool, but my router picked up the address as 192.0.0.64 - but I could not ping this address.
Found and used whoslooking's downgrader (not the "four lines" version) by following instructions (including changing my PC IP address and turning off wifi) to impart the digicap.dav file to the camera via tftp. Everything worked fine (it seemed), with connection made, file transfer initiated and completed according to the log, but the cam did not acknowledge "update completed". After 15 minutes or more, I closed the TFTP server and rebooted the cam.

After rebooting the camera I now have:
Visibility in SADP Tool (short-lived ecstasy!)
Supposedly "Active"
Firmware V4.0.8 build 150401 (Que? where did that come from?)
IP address of 192.168.1.64
A corrupted Serial number with a couple of alpha numeric alterations.

I cannot change the IP address or the incorrect gateway address through the SADP tool UI because the UI no longer recognises either the original password for the camera or the default password, and use of the password reset tool from another site (which I have used successfully before) does not work - presumably because the serial number is corrupted??

While a reasonably experienced PC user, I have not delved into hex file editing - but I have no fear of PC's and am willing to learn. The cost of the camera is immaterial - I am irritated that manufacturers do this.

While I have read a lot of posts on this site, I haven't gone through all 21 pages assiduously, so forgive me if my issue is dealt with or is mirrored previously.

Any help greatly appreciated.

 

[alastairstevenson]

After rebooting the camera I now have:
Visibility in SADP Tool (short-lived ecstasy!)
Supposedly "Active"
Firmware V4.0.8 build 150401 (Que? where did that come from?)
IP address of 192.168.1.64

That's the 'min-system' recovery mode that is entered when invalid firmware has been loaded. A basic system, no web services.
But telnet and ftp will be active.

If this is due to the camera being a CN camera that was running seller-installed 'hacked to English' firmware, there will be an internal 'language mismatch' between the installed firmware and the camera language that causes the boot into min-system mode.

The standard fix that generally works, is to get it back booting normally with the stock firmware, then try the '5.3.0 to 5.2.5' downgrader.
CN stock firmware, to be installed via the Hikvision tftp updater, seems to be at section 11 here : http://www1.hikvision.com/cn/download_more_714.html
The 'downgrader' at tftp tool you already know about.

Good luck!

 

[Aspiring Geek]

Thanks Alastair.
I have:
Downloaded what I think is the correct CN firmware from:

11、DS-2CD3XX2系列网络摄像机升级程序包​

（下载）
软件描述
程序包适用于以下型号：

DS-2CD3112(D)-I、DS-2CD3132(D)-I、DS-2CD3212(D)-I3(5)、DS-2CD3232(D)-I3(5)、DS-2CD3312(D)-I、DS-2CD3412FD-IW、DS-2CD3T12(D)-I3(5)(8)、DS-2CD3112F(D)-I(W)(S)、DS-2CD3132F(D)-I(W)(S)、DS-2CD3332(D)-I、DS-2CD3T32(D)-I3/I5/I8

Have placed the downloaded digicap.dav file in the the same folder as the tftp server exe file
Have changed my PC IP to 192.168.1.128 to be on same network as cam 192.168.1.64
Turned off WiFi
Loaded tftp.exe
Result is:

[2017-04-17 18:45:11] TFTP server[192.168.1.128] initialized​

and nothing else!
Suggestions welcome, thanks.

 

[alastairstevenson]

The PC IP address needs to be set to 192.0.0.128

 

[Aspiring Geek]

Ok, but the camera IP had flipped from what it originally was to 192.168.1.64. I thought the camera had to be on the same sub-net as the PC running the tftp server? Ergo, I went for 192.168.1.128 for the PC

 

[Aspiring Geek]

Nevertheless tried PC on 192.0.0.128 with cam on 192.168.1.64, to no avail.
Log:
[2017-04-17 23:11:16] TFTP server[192.0.0.128] initialized

I must have to get the cam's IP address back to 192.0.0.64 somehow - without the SADP Tool which doesn't work, as outlined in previous post?

 

[alastairstevenson]

On startup, the camera uses 192.0.0.64 to probe for the tftp server, and changes to another address after it doesn't find it.

 

[Aspiring Geek]

Alastair,
Thank you for you patience - to me and others over an extended period!
I now understand the IP "flipping" process. I have attempted installation of the CN firmware V5.3.0 obtained from the Hikvision site you provided the link for.
The process kicked off in tftp server, as expected:
[2017-04-18 11:13:13] TFTP server[192.0.0.128] initialized
[2017-04-18 11:13:22] Device[192.0.0.64] test tftpserver
[2017-04-18 11:13:31] Connect client[192.0.0.64] success
[2017-04-18 11:13:31] Start file[C:\Users\XXXX\Downloads\Hikvision Camera\IPC_R0_CN_STD_5.3.0_150513\digicap.dav] transmitting
[2017-04-18 11:13:53] Completed file[C:\Users\XXXX\Downloads\Hikvision Camera\IPC_R0_CN_STD_5.3.0_150513\digicap.dav] transmit

However, after waiting more than 10 minutes, I still did not get the msg that:
"Device [192.0.0.64] system update completed!"

So I closed the tftp server, rebooted the camera, waited a few minutes and then opened SADP Tool.

Unfortunately it appears that the firmware did not install correctly. I still have Firmware V4.0.8 build 150401

The serial number is now different to the original serial number I had, but no longer "corrupted".

Original:
DS-2CD3132F-IWS20150818CCCHxxxxxxxxx

Now:
DS-2CD3132F-IWS012015081CCRRxxxxxxxxx

Not sure what this means but maybe the camera now thinks it is Russian?

I will repeat process and leave tftp server running a bit longer after file transmit, although it seems to me that once file transfer is completed, it would require the camera to be rebooted for install - so any amount of time after digicap file transmission is complete is immaterial - unless the camera is doing something else in that time?

 

[Aspiring Geek]

Tried again - still no joy. Camera reboots with Firmware V4.0.8 build 150401 and same "Russian?" serial number.

[2017-04-18 12:14:18] TFTP server[192.0.0.128] initialized
[2017-04-18 12:14:24] Device[192.0.0.64] test tftpserver
[2017-04-18 12:14:34] Connect client[192.0.0.64] success
[2017-04-18 12:14:34] Start file[C:\Users\Drew\Downloads\Hikvision Camera\IPC_R0_CN_STD_5.3.0_150513\digicap.dav] transmitting
[2017-04-18 12:14:57] Completed file[C:\Users\Drew\Downloads\Hikvision Camera\IPC_R0_CN_STD_5.3.0_150513\digicap.dav] transmit

Digicap file appears to be transmitting, but is not being loaded by the camera on reboot.

 

[Aspiring Geek]

OK folks.
With reference to my bricked DS-2CD3132F-IWS
I now understand that the RR in my "new" serial number is a region code meaning "Other/unspecified". I don't understand how my original serial code (indicating a Chinese cam - see above) became a different one). I now also understand the cam reverted to basic functionality (V4.0.8 build 150401) when firmware installation failed.

One blogger referred to being able to unbrick RR cameras using European firmware. I went searching in the following site:
DOWNLOAD PORTAL

Found and tried V5.3.0_150513 and managed to tftp this to the camera:

[2017-04-18 18:06:58] TFTP server[192.0.0.128] initialized
[2017-04-18 18:07:05] Device[192.0.0.64] test tftpserver
[2017-04-18 18:07:13] Connect client[192.0.0.64] success
[2017-04-18 18:07:13] Start file[C:\Users\XXXX\Downloads\Hikvision Camera\IPC_R0_EN_STD_5.3.0_150513\digicap.dav] transmitting
[2017-04-18 18:07:37] Completed file[C:\Users\XXXX\Downloads\Hikvision Camera\IPC_R0_EN_STD_5.3.0_150513\digicap.dav] transmit
[2017-04-18 18:08:01] Device[192.0.0.64] system update completed!

The file transmitted and I got the system update completed message (for the first time).

The "only" issue now is:
I can see the cam on the network via the router (always could), but address is now permanently back at 192.0.0.64
SADP Tool can't see it, so I can't change the IP address or other network params
I can't ping it, so also can't open the browser for the location to check whether it is in in Chinese, English or Swahili.

I nevertheless tried whoslooking's 5.30 Downgrader but that did not complete - never got the message "Device[192.0.0.64] system update completed!"

Summary:
I had a bricked camera for which the serial number indicated it was Chinese
I downloaded and tftp'd the V5.3. 0 firmware for my model from the Chinese site, hoping to then use wholooking's downgrader to get back to V5.2.5 (Eng)
Installation of the Chinese firmware was unsuccessful - the cam reverted to basic functionality (V4.0.8 build 150401), and serial number was corrupted - and included the letters RR in place of CH
Repeated several times with same result (definition of stupidity), although the hieroglyphic in the serial number ultimately disappeared
Found and apparently successfully installed European firmware V5.3.0 build 150513
Camera is still a brick.

Comments welcome. I do not often give up/retire on technology issues but this has me beat.

 

[alastairstevenson]

[2017-04-18 18:08:01] Device[192.0.0.64] system update completed!

Well, that is encouraging.
The camera is functional, it may just need the right firmware.
A clearer picture of what the problem is would be shown by creating a serial console connection, but that can consume even more time.
From what you've described, the camera may not be of the usual CN hacked to English variety where the 'downgrader' has worked pretty well. Though sometimes requiring the firmware language header change with the 'lang' option of Hiktools : Hikvision FIRMWARE TOOLS - change language, extract files and create own firmware

 

[Aspiring Geek]

Alastair,
Firstly, I really do appreciate your attention to my issue - and my learning process, albeit via baby steps.
I now have a camera with (apparently) successfully installed European firmware V5.3.0 build 150513. I now have no idea what the serial number is given corruption of the original number and then inexplicable assumption of a new number prior to successful installation of the European firmware. I do know the IP address is 192.0.0.64 by looking through my router, but I can't pick up the camera through the SADP Tool, ping it or bring up the Camera GUI, so I can't check what the serial number now is.
From looking at blogs for using Hiktools, it seems that this may be used for modifying digicap files before installation, principally to change menu language. I can't get a Chinese menu, let alone English. If European FW successfully installed (as indicated by the TFTP Log), I presumably have English language FW installed? But something else is preventing the camera showing up.
How can I look at what's in the camera now to determine possible next steps? Is that through the serial console or some other way?
----
Or are you suggesting an edit to the successfully installed version of European FW and try TFTP'ing again?

 

[alastairstevenson]

Hiktools, it seems that this may be used for modifying digicap files before installation, principally to change menu language.

Hiktools doesn't change the menu language, but it can change the language of the header of a firmware file (digicap.dav) to in some cases avoid the firmware being rejected by a language mismatch.

 

[Aspiring Geek]

Apologies - I understood that from your previous posts. My language was regrettably imprecise.
So even if the FW apparently "updates" successfully, as in my case, I could have an as yet unnotified language mismatch? European FW to a camera that thinks it is "Other/unspecified" region, but is actually Chinese as the original serial number indicated?
So one tack could be to edit the header language in the successfully installed and updated European FW to Chinese language and then try the downgrader? Sounds convoluted, but in this particular matter, trial and error seems part and parcel...
There were three V5.3.0 FW's on the European site. Maybe I should try the other two first? I haven't so far because I have been thinking that whatever the issue is, it would be the same, or similar.

 

[squishio]

Hi Guys,

I have a DS-2CD3410FD-IW
Serial - 20151010AACH547246860
Firmware - V5.3.0 build 150513

I'm trying to do the downgrade so I can connect it to my european NVR, but everytime I do so, it just shows...

This direct via a switch, no WiFi etc. Tried from a couple different PCs but same result.

Can anyone point me in the right direction?