DS-2CD2532F-IS Bricked - Help Please

swaledale

n3wb
Joined
Sep 1, 2016
Messages
9
Reaction score
0
Hi,

I've read hundreds of posts on here and elsewhere about fixing these Hikvision cameras and can't seem to get anywhere...

I've got a DS-2CD2532F-IS camera that was bought from an Amazon seller, in his message it said it was a Multilanguage product, but it does have Chinese writing all over the label etc. He said it was flashed with 5.2.5 firmware yet the label underneath states is was built 10/2015 and the version is V5.3.0_150513. This leads me to believe it was downgraded using the widely suggested 5.3.0 to 5.2.5 TFTP method. The camera is bricked it seems, after it screwed up following an attempt to get it to 5.4.0 via the webgui.

So far, I've tried the TFTP method to get the downgrade firmware 5.2.5 onto the camera, both language version 1 and 2, and neither works. Also tried a Chinese and an EU version of the 5.3.0_150513 firmware to no avail. On all occasions I can see the camera downloading the software via TFTP, but do not get the magical 'upgrade complete' message after it completes the file download. After the file download it is not appearing in SADP and is pingable on 192.168.1.64 with no web access.

Anyone got any suggestions as to other firmware I can try etc?

Thanks...
 

Del Boy

Getting comfortable
Joined
Mar 19, 2015
Messages
2,727
Reaction score
294
Location
UK - England
I don't think the camera screwed up.

Did you try the 4-line or the 1-line downgrader? The 4-line is less reliable.

Where did you get the Chinese firmware from?

Have you asked your seller for help?
 

swaledale

n3wb
Joined
Sep 1, 2016
Messages
9
Reaction score
0
I don't think the camera screwed up.

Did you try the 4-line or the 1-line downgrader? The 4-line is less reliable.

Where did you get the Chinese firmware from?

Have you asked your seller for help?
Tried both 1 and 4 line versions.
Got the Chinese firmware from the Chinese Hikvision website (Chrome translate helped out). Was No. 6 on this page: http://www1.hikvision.com/cn/download_more_714.html

Asked the seller but no reply yet. Was someone called Aipai Direct on Amazon. He said in his message when I bought it in December that it was a multilanguage version, I'm assuming that's an export version produced for rest of the world, but this appears to be covered in chinese writing so pretty sure its a chinese model.
 

Del Boy

Getting comfortable
Joined
Mar 19, 2015
Messages
2,727
Reaction score
294
Location
UK - England
It's the Chinese model, you need to keep trying different firmwares and then the downgrader. It's not as effective as it used to be.
 

swaledale

n3wb
Joined
Sep 1, 2016
Messages
9
Reaction score
0
I cant seem to find any previous versions of Chinese firmware for this camera. In fact can't find any other versions only this one.
 

swaledale

n3wb
Joined
Sep 1, 2016
Messages
9
Reaction score
0
So a bit of progress, only slight...

I *think* (would like somebody to confirm the theory) that since I tried putting 5.4.0 on it, now the lowest firmware version it will accept is 5.4.0 - it clearly warns you this in the firmware release notes and says you cant downgrade, is this because it sets a minimum version flag in itself somewhere? I've tried all kinds of other firmware versions now and none seem to get accepted.
I've basically only managed to get a 'update complete' message out of TFTP if I upload the 5.4.0 firmware file again set to language2 Chinese with hiktools.
But now, it's stuck in in a reboot loop and doesn't appear in SADP. So I'm wondering if there is a Chinese version of the 5.4.0 firmware anywhere? I've tried looking and so far no joy.
Any ideas?
 

riri7707

Getting the hang of it
Joined
Feb 6, 2015
Messages
93
Reaction score
26
For this kind of issues, discussing with Hik, the only solution to reverse FW and unbreak the cam, is to use the internal 4 pin port of the cam and a small interface connected to RS232 laptop.
All cams have this connector and allow to force FW, downgrade, etc. I saw this small device but I don't know much more about how to use it.
I will try to get one of them and tell you more.
 

Brad_C

Banned
Joined
Jul 11, 2016
Messages
167
Reaction score
54
For this kind of issues, discussing with Hik, the only solution to reverse FW and unbreak the cam, is to use the internal 4 pin port of the cam and a small interface connected to RS232 laptop.
All cams have this connector and allow to force FW, downgrade, etc. I saw this small device but I don't know much more about how to use it.
I will try to get one of them and tell you more.
Its a serial console. Plenty of info around if you look hard enough.
 

swaledale

n3wb
Joined
Sep 1, 2016
Messages
9
Reaction score
0
I saw the notes on connecting the serial console, which I'll do when I order the parts, but not seen a definitive guide on how to downgrade or force an upgrade etc.
 

Brad_C

Banned
Joined
Jul 11, 2016
Messages
167
Reaction score
54
How familiar are you with linux system architecture?
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,930
Reaction score
6,778
Location
Scotland
How familiar are you with linux system architecture?
You are going to tell him about how to use a custom command line via the bootloader to bypass some of the obstacles.
Hikvision have sneakily removed some of the more useful variants such as NFS boot where you can pull down a different kernel, from what I can see the stock kernel quietly ignores it.
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,930
Reaction score
6,778
Location
Scotland
I saw the notes on connecting the serial console, which I'll do when I order the parts, but not seen a definitive guide on how to downgrade or force an upgrade etc.
The very least that will give you is the reason why the camera isn't fully working.
And it's easy enough to do, there are some helpful threads here.
 

Brad_C

Banned
Joined
Jul 11, 2016
Messages
167
Reaction score
54
You are going to tell him about how to use a custom command line via the bootloader to bypass some of the obstacles.
I got spanked for documenting that and I lent out my spare cameras so I can't refresh my memory at the moment.
 

swaledale

n3wb
Joined
Sep 1, 2016
Messages
9
Reaction score
0
I've got a Prolific chip coming tomorrow so will have a look at the serial and see what it's complaining about. I can do that much at least. I'm writing it off almost, so willing to try anything after that if there's no more ideas. Alastair, Linux aint my thing really, but can have a bash, excuse the pun.
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,930
Reaction score
6,778
Location
Scotland
I've got a Prolific chip coming tomorrow so will have a look at the serial and see what it's complaining about.
That's one part of the 2-part puzzle.
You will also need the cabled connector to plug in to the board, do a search for a local source of one of these on your favourite on-line electronics store: http://www.ebay.co.uk/itm/40-SETS-Mini-Micro-ZH-1-5-4-Pin-JST-Connector-with-Wires-Cables-/231967561605?hash=item3602581785:g:0bsAAOSw8aNXG0nK
1.5mm 4-pin Micro JST connector
 
As an eBay Associate IPCamTalk earns from qualifying purchases.

Brad_C

Banned
Joined
Jul 11, 2016
Messages
167
Reaction score
54
Or do what I did and solder tiny wires onto the tails on the connector where it is soldered to the board. I like the connector way better, but when you need to get a console *right now* you work with what you have.
 

swaledale

n3wb
Joined
Sep 1, 2016
Messages
9
Reaction score
0
So I managed to connect using the PL2303HXD and a few jumper wires. If you take off the plastic shield from the 2.5mm female connectors you get something roughly the same size as the pins, with a few bits of shielding (paper) between the pins to avoid shorting. Anyway... what did I discover?

I confirmed my suspicion about upgrading to 5.4.0 - when I did this the first time it must have set the minimum installable firmware (iDevsVers) to 5.4.0 which reinforces the Hikvision statement of 'you can't downgrade'. I have no idea whether this is simply the same mechanism they've used before and can easily be corrected back to the original 5.3.0? The below is what was reported over serial after attempting to TFTP 5.3.0 onto it:

[UPG][DEBUG_NOTICE][ext/sys_firm_version.c][firm_version_check][435]:i=1,szFileName=_cfgUpgClass,iFirmOffset=0xd78
[UPG][DEBUG_NOTICE][ext/sys_firm_version.c][firm_version_check][479]:####### iFirmVers=0x5030000, sys firm version check ok #######
[UPG][DEBUG_NOTICE][ext/sys_firm_version.c][firm_version_upgrade][626]:####### iFirmVers=0x5030000,iDevsVers=0x5040000,iBase=0x0,iMask=0xffff0000 #######

When updating to 5.4.0, after setting its language to 2 to match the camera, I get a success, and it reboots:

[UPG][DEBUG_NOTICE][ext/sys_firm_version.c][firm_version_check][435]:i=1,szFileName=_cfgUpgClass,iFirmOffset=0xf14
[UPG][DEBUG_NOTICE][ext/sys_firm_version.c][firm_version_check][479]:####### iFirmVers=0x5040000, sys firm version check ok #######
[UPG][DEBUG_NOTICE][ext/sys_firm_version.c][firm_version_upgrade][626]:####### iFirmVers=0x5040000,iDevsVers=0x5040000,iBase=0x0,iMask=0xffff0000 #######
[ INFO][MIN]BURN: Writing Flash
[ INFO][MIN]BURN: ..........................................................
[ INFO][MIN]BURN: Write Flash [OK]
***** UPDATE COMPLETE *****

Then after a reset it gets stuck in a boot loop and the full boot log is here:
http://pastebin.com/h95dwyPz



Anyone got any pearls of wisdom or observations?
 

swaledale

n3wb
Joined
Sep 1, 2016
Messages
9
Reaction score
0
In case anyone wants to look, the dmesg is here: http://pastebin.com/HtyiiWwp

I wonder if there is a backup bootloader partition and a command that will tell it to boot from that, like a built in backup? Just wondering if it has the ability to truly reset itself and expect a lower (original) firmware.
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,930
Reaction score
6,778
Location
Scotland
I don't recall the fine detail - but there is a byte set to 0x04 in one of the flash partitions (it may have been mtdblock5 or mtdblock6 which hold the hardware descriptor block) which when cleared removes the rollback block.
To get at it you need to alter the bootparams in u-boot to not do the normal init but drop to a shell (/bin/sh instead of /bin/linuxrc)
A certain member on this thread may still have that detail for you.
 
Top