DS-2CD2335-I accidentally bricked after repair

[cstout]

Hello all, I just replaced a blown capacitor on an old DS-2CD2335-I and it powered right up and I re-activated it and successfully got to the admin page. In a complete lapse of judgement I flashed the wrong firmware onto it and now it sits repaired, yet bricked on my repair bench. I've attempted the brickfix procedure, but both the CN and EN files result in the same error in the Hikvision TFTP Server which is simply "Resend required." It never retries and never progresses past this point. I've tried multiple versions of the TFTP Server, but all provide the same error. The Python script option gave me the same error on Mac and PC so I'm not sure what's going on there.

Does anyone have a good recommendation on what I should try next? Before the bricking it was running V5.3.6 build 151221

Update: It appears it didn't brick. The camera is resetting to factory defaults when the power is unplugged so the IP went back to default and cam needed to activate again. Even with whatever is causing that issue (there is no reset button to be stuck in my case) I cannot TFTP any firmware to the camera. Really at a loss here.

Thank you!

 

[cstout]

I came across the python3 branch of the script and was able to host and send the file to the camera but both the EN and CN versions of the brickfix digicap unfortunately never booted up with telnet access.

Wed Aug 23 16:02:44 2023: 12642 / 12642 [#####################################################]
Wed Aug 23 16:02:44 2023: done!
Setting block size to 512
Serving 18558206-byte digicap.dav (block size 512, 36247 blocks)

 

[cstout]

Interesting turn of events here...I'm now able to reconnect to the web UI. Nothing I throw at it from brickfix appears to be "taking" unfortunately. Web UI is showing the following specifications

Equipment model
DS-2CD2335-I
Equipment serial number
DS-2CD2335-I20151117AACH553703705
Main control version
V5.3.6 build 151221
Code version
V7.2 build 151029
Web version
V4.0.1 build 151009
Plugin version
V3.0.5.42

Is this particular model incompatible with the brickfix workflow? I'm just not sure why every attempt at sending a file through the TFTP server won't advance further than "Resend required." I've tried Mac and PC and multiple cables.
I would love any help I can get in changing the firmware on this one. I'm not sure if whoever had it before me got hacked or not, but this model factory resets each time it's unplugged as well. There is no reset button on the turret or pigtail on this particular camera so it doesn't look to be a stuck reset button in this case. I'm curious if the firmware has been tampered with and needs to be restored...but I'm having no such luck doing so. Thank you!

 

[Starglow]

My first question would be what caused the capacitor to blow and what particular circuit was it in, because other electronic components could have been damaged internally as well without your knowledge even if the camera still powers up somewhat normally.

 

[cstout]

My first question would be what caused the capacitor to blow and what particular circuit was it in, because other electronic components could have been damaged internally as well without your knowledge even if the camera still powers up somewhat normally.

Yeah, a totally reasonable question to ask. I'm doing a little more probing today on the board to look for any other visible signs of damage - I'm no expert though. The replacement blown capacitor allowed it to boot normally and last night I was able to load a newer Chinese firmware on it through the web UI, so at least I've got some confirmation that writing new firmware to it works.

There's no reset button on this model, but there is a little watch battery that may be used to hold the configurations in memory. I plan on checking that as well.

 

[cstout]

Battery voltage is 2.58 which technically is within the "stable operating voltage" for this battery (FDK ML614R) but it is also technically a 3V battery and it's possible that the circuit requires a higher battery voltage to maintain the settings. I'm going to look for a replacement and see if this is the source of my lost config data after removing the camera from power.

 

[cstout]

Replaced battery and went through activation again, unplugged power, and booted back up only to be greeted with activation. Sadness.

 

[alastairstevenson]

Is this particular model incompatible with the brickfix workflow?

Yes. The brickfix recovery / upgrade method is specific to R0 series IP cameras.
The DS-2CD3335-I is a G0 series camera, likely to be a CN model running hacked-to-english firmware, maybe the interesting 'Dieter & Fiona' instance.
That firmware resists attempts to replace it, attempts to change it can trigger a self destruct and leave the camera with Chinese menus.

I'm just not sure why every attempt at sending a file through the TFTP server won't advance further than "Resend required."

That's the normal behaviour if the firmware downloaded doesn't match the camera model, no 'upgrade successful' message.
'Resend required' just means that a block of data failed an integrity check and will be sent again. A networking issue.

there is a little watch battery that may be used to hold the configurations in memory.

The battery keeps the RTC (real time clock) active when the camera is powered off.
Configuration data is held in flash memory.

If you want to see more of what's going on internally, and maybe why the configuration is reset on power on, you could connect to the serial console.
To do that you'd need, to connect to the on-board 4-pin plug :
A USB to serial TTL adaptor.
A wired 4-pin 1.5mm JST ZH connector, usually sold in 10-packs.
Connections as follows :

Hikvision NVR DS-7804N-E1/4P Bricked

Hello, i have NVR DS-7804N-E1/4P bricked when i flash wrong firmware DS-7604NI for it. So now it only boot to Logo then bip bip and auto restart. I tried flash TFTP very many time by set IP of my PC to 192.0.0.128 / subnet 255.255.255.0 and turn firewall is off. But no thing flashable although i...

ipcamtalk.com

 

[cstout]

maybe the interesting 'Dieter & Fiona' instance

I found your old discussion on this topic and I'm intrigued. Especially since you experimented with this same model of camera. Is there anything you'd recommend I try for getting a different firmware on there before calling it quits. I just hate that the camera works great once activated, but if it loses power it needs physical intervention and reactivation making it useless for any real installation.

I did try the serial connection, but got no output. On significantly closer inspection I found the TX lead had lifted from the board. There's nowhere I can see to scrape a new contact point either.

 

[Starglow]

I found your old discussion on this topic and I'm intrigued. Especially since you experimented with this same model of camera. Is there anything you'd recommend I try for getting a different firmware on there before calling it quits. I just hate that the camera works great once activated, but if it loses power it needs physical intervention and reactivation making it useless for any real installation.

I did try the serial connection, but got no output. On significantly closer inspection I found the TX lead had lifted from the board. There's nowhere I can see to scrape a new contact point either.

I wonder how that happened...sounds like someone was in there before. See if you can trace and find whatever PCB component connects to the lifted TX lead and attach it there.