Custom Firmware Downgrader 5.3.0 Chinese to 5.2.5 English

[whoslooking]

no portforward is wise. but damage can be reduced by walls and rules with mac address control.

 

[jesd03]

hi

how can you tell is a camera is chinese or english and if safe to upgrade?

i purchased my cameras from china so i assume it must be chinese, came with version 5.25 preinstalled.

how do i go about upgrading this to latest version DS-2CD2732F-IS and stay with English menus

Thanks

 

[alastairstevenson]

With the 5.2.5 you can enable telnet and use the prtHardInfo command to see the language that the camera is presenting. Then you can compare that with the value in location 0x10 of mtdblock6
If mtdblock6 shows 2 and prtHardInfo shows 1 the camera is Chinese with hacked to English firmware.
Another clue is if there are the letters CCCH in the serial number.
Either way, all should be safe to update using the 'enhanced mtd hack'

 

[afernando]

I bricked my 2CD-2132 I while upgrading the firmware. I can't ping the camera. And the TFTP transfer stops at 'transmit' step every single time. Any ideas?
Thanks in advance.

 

[alastairstevenson]

I bricked my 2CD-2132 I while upgrading the firmware.

What firmware? If it's 5.4.0 or above, you will need to use the 'brick-fix tool'.
If 5.3.0, use the '@whoslooking 5.3.0 to 5.2.5 downgrader'.
Then when recovered, consider doing the 'enhanced mtd hack' to allow full upgrading to EN/ML firmware.
Hikvision DS-2CD2x32-I (R0) brick-fix tool / full upgrade method / fixup roundup.

 

[gpower07]

after I done the hack....my camea became DS-2CD- Min System. I try TFTP...but no response.

 

[gpower07]

The tftp not detecting the camera when I plus that in.


Sent from my iPhone using Tapatalk

 

[gpower07]

after I tftp a hacked 5.20 ir 5.3.0 firmware into the camera. SADP will not see it after reboot.i have a 2432 cube. with 5.2.8 sticker. thx

 

[alastairstevenson]

Suggestion:
Try with tftp the 'brick-fix tool' from here : Hikvision DS-2CD2x32-I (R0) brick-fix tool / full upgrade method / fixup roundup.
After the update, wait about 10 minutes until the watchdog reboots the camera into 'min-system' recovery mode, as seen by SADP.
At that point you should be able to telnet to the shell prompt and tftp files in and out.

after I done the hack....my camea became DS-2CD- Min System

Is it possible there is an error in the mtdblock6 that you put back into the camera?
If so, that could cause problems booting.
Maybe share the mtdblock6 for checking.
Also - did you check mtdblock1 contents at locations 0x0C and 0x8000C ? With 5.2.8 you will probably find they have 0 in them, which needs to be changed to 2.

 

[Hasslehogg]

Hi guys

newbie here and was wondering if you could help please?

I checked my camera today and it had the word "hacked" on the screen, I panicked, didnt know anything about the vulnerabilities and before i found this site i downloaded the USA firmware 5.4.41 and updated 1 of my camera's via ivms, it was running . v5.2.5 build 141201.

now i can ping it but cant get into the GUI, after checking the serial its starts DS-2332 but also has CCCH further down the serial, is this an actual chinese device and its now bricked and unrecoverable?

i cannot browse to it via a browser, but i can telnet to it

any help would be really appreciated, i feel like an idiot just updating assuming it was a USA device

P.S. its showing as min-system in ivms but i cannot manage it

 

[alastairstevenson]

Check out the brick-fix tool and upgrade instructions in the link in the previous post and in the signature at the bottom of my posts.
The camera is recoverable and can be fully updated.

 

[Hasslehogg]

Check out the brick-fix tool and upgrade instructions in the link in the previous post and in the signature at the bottom of my posts.
The camera is recoverable and can be fully updated.

Thanks Alastair I am reading them now, just wasnt sure if i could downgrade since it was higher than 5.3 i applied, but will give it a shot

thanks again

 

[Hasslehogg]

Hi Alastair, the tftp started transmitting, but i am just getting "resend required" in the tool.

Do i need to enter anything in the subnet mask/ default gateway when changing IP please

 

[Hasslehogg]

Hi Alastair, the tftp started transmitting, but i am just getting "resend required" in the tool.

Do i need to enter anything in the subnet mask/ default gateway when changing IP please

Ok i tried it on a different pc and it went ahead. applied update (in only about 2 minutes) ishut down tftp and restarted the cam, but now it wont even ping.

So i tried the fix tool again and it done exactly the same, i rebooted and then ran the 5.30 downgrader and again it was successful but i cannot ping it or see it via gui or ivms. before i ran the breakfix tool i could ping and see in the ivms tool.

Any idea where i am going wrong please?

 

[alastairstevenson]

Hi Alastair, the tftp started transmitting, but i am just getting "resend required" in the tool.

That's an indication of an unreliable network. Presumably it's wired, not WiFi?

Do i need to enter anything in the subnet mask/ default gateway when changing IP please

Default gateway does not matter, subnet mask should be 255.255.255.0

So i tried the fix tool again and it done exactly the same,

Was this after applying the brick-fix tool? It's normal that the camera appears unresponsive after that.
The brick-fix tool is just a one-off change that prepares the camera with the ability to be downgraded with earlier firmware.
I think in the notes it mentions that the camera will have no services running after it has been used, until next firmware update (the 5.3.0 to 5.2.5 downgrader') is applied.
If the camera is showing as a CN version (likely) then the CN version of the downgrader needs to be used.
The result after reboot will be web GUI access with CN menus.

Any idea where i am going wrong please?

In all cases, it's best to use SADP to observe the status of the camera, and to change the IP address away from the default that it reverts to on a tftp update.
If you don't have it - download from here : Hangzhou Hikvision Digital Technology Co. Ltd.

 

[Hasslehogg]

I have SADP installed but it doesnt detect any Camera's and i have 5 in total, 2 of them i patched before realizing and both of them are not showing, they have both had the brick fix ran, restarted then the downgrader and again both restarted but now i cannot ping or telnet.

inside the SADP tool it says initialization failed and shows no devices, maybe i need a restart or an updated version?

Another worrying thing is on my router as connected devices, only the 3 untouched cameras show as connected, the problem 2 dont

going to restart and see

thanks i appreciate the help

Was this after applying the brick-fix tool? It's normal that the camera appears unresponsive after that.
The brick-fix tool is just a one-off change that prepares the camera with the ability to be downgraded with earlier firmware.
I think in the notes it mentions that the camera will have no services running after it has been used, until next firmware update (the 5.3.0 to 5.2.5 downgrader') is applied.
If the camera is showing as a CN version (likely) then the CN version of the downgrader needs to be used.
The result after reboot will be web GUI access with CN menus.

In all cases, it's best to use SADP to observe the status of the camera, and to change the IP address away from the default that it reverts to on a tftp update.
If you don't have it - download from here : Hangzhou Hikvision Digital Technology Co. Ltd.

 

[alastairstevenson]

inside the SADP tool it says initialization failed and shows no devices, maybe i need a restart or an updated version?

That suggests SADP is not working.
But why?
It needs admin rights, usually prompted for when you start it. Did you see the prompt?
Do you have any strict antivirus in place?
The downloaded version should be 3.x

 

[Hasslehogg]

That suggests SADP is not working.
But why?
It needs admin rights, usually prompted for when you start it. Did you see the prompt?
Do you have any strict antivirus in place?
The downloaded version should be 3.x

Hi

it was SADP 3.0.9, so i have downloaded the latest .10 version, will let you know how it goes. AV is built in defender only and i ran as Admin.

Just restarted again so will let you know once its back online. in the meantime i have perm unplugged 1 of the 2 cams that arent working just in case of a duplicate ip or something

thanks

 

[Hasslehogg]

Hi

it was SADP 3.0.9, so i have downloaded the latest .10 version, will let you know how it goes. AV is built in defender only and i ran as Admin.

Just restarted again so will let you know once its back online. in the meantime i have perm unplugged 1 of the 2 cams that arent working just in case of a duplicate ip or something

thanks

Weird, I uninstalled 3.0.0.9 and restarted, reinstalled 3.0.0.10 the latest and its doing the same thing. I initially set these camera's up with this tool so i dont understand whats happened.

On opening it says "hint" initilization failed and then opens up into the SADP tool and no camera's present and no options to choose or change.

Going to uninstall again and make sure all program files and appdata info is deleted

 

[Hasslehogg]

Weird, I uninstalled 3.0.0.9 and restarted, reinstalled 3.0.0.10 the latest and its doing the same thing. I initially set these camera's up with this tool so i dont understand whats happened.

On opening it says "hint" initilization failed and then opens up into the SADP tool and no camera's present and no options to choose or change.

Going to uninstall again and make sure all program files and appdata info is deleted

ok it was the installation that was the issue. was fine after cleared out everything and reinstalled.

ok hopefully almost there, i have took a temp copy of mtkblock6 and have changed the language to 01, i have my devtype (38920) which is 9808 in hex, i have looked at the 2322 modded pic and can see changes in sections 04 & 05 on the 1st row, and 04 on the 7th row with the instructions stating:-

"0x64 and 0x65 devType bytes set to the value from your prtHardInfo command, for example 0x9807 (ie 0798 for the correct byte order) for the DS-2CD2232-I5"
I assume i put my 07 in row 7 column 4 and column 5 is already 98

"0x04 and 0x05 Checksum-16 bytes Set to the Checksum-16 value as calculated by HxD for the 0xF4 bytes starting from location 0x09 remembering the correct byte order, 0x04 is the least significant byte."

This is a little confusing, do i need to put my Checksum-16 value (0E28) backwards as well putting in 28 in row 0 column 4 and column 5 having 0E. but it mentions location 09?

thanks again Alastair