DS-2CD2032F-I - firmware

[eXtremer]

Hi all,

Can someone share a working firmware for DS-2CD2032F-I. At the moment it has V5.2.5 build 141201 but I'm having problems with it, I set up static IP, but sometimes after restart it looses IP and it comes back to 192.0.0.64 so every time using SADP I have to change the IP of my subnet. I need any firmware starting with 5.3.0, don't need multi language just english/chinese and to be able to upgrade it using Browser because I will do it remotely so TFTP is no a choice here. Any file tested before is more than welcome, thank you.

 

[alastairstevenson]

A good range of versions is available here : DOWNLOAD PORTAL

 

[eXtremer]

A good range of versions is available here : DOWNLOAD PORTAL

DS-2CD2032F-I is a chinese hacked camera, so the link you posted is not relevant. I need special firmware for it to work.

 

[alastairstevenson]

You could apply the 'enhanced mtd hack' and use any of that firmware.

 

[eXtremer]

You could apply the 'enhanced mtd hack' and use any of that firmware.

Can I extract mtdblock6 from another camera but with exactly same firmware?

 

[alastairstevenson]

Can I extract mtdblock6 from another camera but with exactly same firmware?

Yes, you can transplant mtdblock6 from exactly the same model, if you are OK with ending up with the same serial number and MAC address.
But if you are going to consider that, it would be easy just to correct the original mtdblock6 so the camera is changed to English and upgradable with EN/ML firmware.

 

[eXtremer]

Yes, you can transplant mtdblock6 from exactly the same model, if you are OK with ending up with the same serial number and MAC address.
But if you are going to consider that, it would be easy just to correct the original mtdblock6 so the camera is changed to English and upgradable with EN/ML firmware.

Thanks a lot for your hard work explaining the steps. So, I've managed to extract the mtdblock6 and prtHardInfo, but can't seem to understand what values I have to change using the hex editor, I would really appreciate any help.

 

[eXtremer]

I've extracted the mtdblock1 and mtdblock5.

Smb said that in the /dev/mtdblock1 we need to check address 0x0000C and 0x8000C and make sure it is 0x02
I have to modify the mtdblock5 file too ?

 

[eXtremer]

"0x10 language byte set to 0x01 for EN instead of the 0x02 for CN" - I need to do the following in the mtdblock6, but I can't see no 0x10 in the file, I'm not used to work with hex files, what I'm doing wrong ?

This one is the mtdblock1:

 

[alastairstevenson]

but can't seem to understand what values I have to change using the hex editor

Well, you are doing OK so far!
In your mtdblock6 :
The language byte at location 10 is already at 01 so no change required there.
The devType in locations 64,65 is FF,98 so that needs fixed up.
Your prtHardInfo shows the real devType in decimal as 38950 which is 9826 in hexadecimal (usually written as 0x9826).
So you need to fix up location 64 by changing it to 26. The 98 is already in location 65 so no change required there.
And finally, calculate the new checksum and apply it.
Using the mouse, drag to select starting from location 09 until the HxD status bar at the bottom shows that you have highlighted a total of F4 bytes.
Then with the Analysis menu, Checksums, select Checksum-16 and see what the value is.
The result is a 2 byte hex number.
Place the least significant byte (the one on the right) in location 04, and the most significant byte (the one on the left) in location 05
Save the file and apply it to your camera, and all should be good!
Your mtdblock1 is OK as it does not have 00 in location 0x0C

I have to modify the mtdblock5 file too ?

On current firmware versions, that does not seem to be needed.
Maybe Hikvision will change that in the future to try to brick cameras with the 'enhanced mtd hack'.

*Note to the knowledgeable*
As was pointed out in the forum recently by an observant member (you know who you are ..), strictly speaking the checksum is a Checksum-32 and the scope is held in the 4 bytes starting at 0x08 and the data therefore starts at location 0x0C
In practice though, due to the low value of the Checksum, and the trailing zeroes at the end of the scope, both types of checksum give the same result.
I had just followed the very ground-breaking original 'mtd hack' Checksum-16 method without looking at the detail.

 

[eXtremer]

I think the post above is wrong, this one is good ? 0x09 to 0xFC range has to be checksum calculated, yes ?

 

[eXtremer]

Checksum, correct ?

 

[eXtremer]

In first place it seems difficult, but in the end when you understand how it works you realize how easy the procedure is. Alastair you are a life saver, thank you.
I've managed to upgrade to 5.3.0 > 5.4 > all up till 5.4.5

 

[alastairstevenson]

Excellent, very well done!
You've managed well, and climbed a learning curve.

 

[Wyzard]

Hello guys,

I have a DS-2CD2032F-I camera. It's some kind of 'chinese hacked camera', like eXtremer wrote, but I didn't know that.
It's version number was 5.3.0, when I purchased it from Aliexpress.
Recently I wanted to upgrade the firmware to 5.4.0. I downloaded a firmware from Hikvision site.
Needless to say it was a very bad idea, I (soft?) bricked the camera, can't reach the web interface now.
Can I 'save' the camera somehow, or I ruined it completely ?
I've tried at least 10 different firmware so far (found on forums, Google, etc.) with TFTP, but no luck.
If I can save the camera is there any tutorial how to do it ? Maybe the mentioned 'enhanced mtd hack' ... (I don't know what is that)?

Thank you.

 

[alastairstevenson]

This can be recovered and fully updated.
The downgrade block needs to be removed with the 'brick-fix tool'.
Then the 5.3.0 to 5.2.5 downgrader.
Then the 'enhanced mtd hack'.
Check the link at the bottom of my posts for instructions.

 

[Wyzard]

Thank you for sharing this instruction.
I take the first brick-fix-tool step successfully (get the appropriate 'successful' message using TFTP), but the second step I don't get the 'Upgrade success..." message at TFTP:
"
Then the 5.3.0 to 5.2.5 downgrader.
"
What am I doing wrong?

Thank you for your help.

Edit: CN version didn't work, but EN version did. But I still can't reach the web interface.
Edit2: I've restarted the device manually, now it's working, as the instruction said ("If all has gone well, the camera should boot 5.2.5 with CN menus."). I'm going to try to do the next step.

 

[alastairstevenson]

I'm going to try to do the next step.

So far, so good!
Just something extra to check that's needed on some cameras, typically those with firmware version 5.2.8 on the label :
Extract mtdblock1 and check the values in locations 0x0C and 0x8000C If they are 0 - change them to 2, and re-apply the mtdblock1.

 

[Wyzard]

So far, so good!
Just something extra to check that's needed on some cameras, typically those with firmware version 5.2.8 on the label :
Extract mtdblock1 and check the values in locations 0x0C and 0x8000C If they are 0 - change them to 2, and re-apply the mtdblock1.

Thank you. I have '1' in locations 0x0C and 0x8000C, not 0, but I changed them to '2'.

 

[Wyzard]

So far, so good!
Just something extra to check that's needed on some cameras, typically those with firmware version 5.2.8 on the label :
Extract mtdblock1 and check the values in locations 0x0C and 0x8000C If they are 0 - change them to 2, and re-apply the mtdblock1.

Finally I've successfully updated the device to 5.4.5. You are a life saver, my camera is working again.
Thank you very much for your help and instructions!