DS-2cd2t52-i5 bricked, but can't find a working solution...

[kispista]

Hi,

i have a DS-2cd2t52-i5 camera, I got it from a friend, becouse it was set aside after a firmware upgrade, for a year... It was bricked. I tried all firmwares what i got from several places, for the R6 platform..

V5.5.82_Build190909,
V5.5.53_Build180730(1.3MP, 2MP, 4MP, 5MP,1X31,1X41,67X5)
V5.5.5_Build180111(1.3MP, 2MP, 4MP, 5MP,1X31,1X41,67X5)
IPC_R6_EN-STD_5.5.5_180111
IPC_R6_EN_STD_5.5.0_170725
IPC_R6_EN_STD_5.4.5_170124
IPC_R6_EN_STD_5.4.4_161125
IPC_R6_EN_STD_5.4.3_160902
IPC_R6_EN_STD_5.4.1_160525
IPC_R6_EN_STD_5.3.8_151224
IPC_R6_EN_STD_5.3.6_151105
IPC_R6_EN_STD_5.3.3_150630
IPC_R6_EN_STD_5.3.2_150603

they did not work. After using the tftp tool, 2 results are possible with this firmwares..
a., The upload works great, but did not get the "upgrade successful" message, but the camera answers to the 192.168.1.64 address, no web interface, just ping works. After power cycle, it does not boot up.
b., The upgrade works, i got the "upgrade successful" message in the tool, but takes just 20-25 sec. After the "upload complete" and it does not work.

the serial number is: 6660143**
it was made on 10/2016
CAN ICES-3 (A)/NMB-M(A)

I hope, it's an EU camera It has the CE mark on it, and no CN marking. Was installed by a local company...

Is it an R6 platform camera?

What kind of firmware should is use? It is taken apart, so i can use rs232 interface too... soldering is not a problem.

thanks!

 

[alastairstevenson]

Is it an R6 platform camera?

Judging by this firmware link, it seems to be :

5MP EXIR Bullet Camera

Hikvision DS-2CD2T52-I5 EXIR Bullet Network Camera is an affordable solution for all of yoursecurity needs. It features a powerful 5 MPsensor that captures images with a resolution of2560 × 1920 at up to 30 fps.

us.hikvision.com

I tried all firmwares what i got from several places, for the R6 platform..

I'm guessing a couple of possibilities here, depending on which versions gave you which result :
Firmware older than that which is installed will be rejected by the 'downgrade block'.
Firmware from about 5.5.x onward looks to be above the 32MB filesize limit of the Hikvision tftp updater, but this would show by the download status continually re-starting after appearing to be almost complete.
This larger firmware can be handled by the Scott Lamb tftp updater clone, example :

Can't access DS-2CD2442FWD-IW (R6 platform) anymore. Uploading firmware via TFPT doesn't solve it

So I had a problem with my Zyxel POE Switch when I did some firmware changes on it. Two of my Hikvision camera's then stopped working a DS-2CD2432F-IW and a DS-2CD2442FWD-IW. After I fixed the issue on the Zyxel switch (factory reset) one Hikvision camera started working again but the...

www.ipcamtalk.com

i can use rs232 interface too... soldering is not a problem.

That's easy enough to use, and see in more detail what the problems are.
But it's TTL serial, not RS232, and no soldering needed, there will be a connector on the board.
Needed, readily available on eBay :
USB to serial TTL adaptor, such as a PL2303TA-based device.
A wired 4-pin 1.5mm ZH JST connector, usually sold in 10-packs.

 

[kispista]

Hi,

thank you!

I spent the last 6 hours on this but no success..

I tried the python version uf the tftp updater. On Ubuntu-miint, it did not worked for me. the .py script did not start, I tried to install a python enviroment, but it didn't help. After 2 hours, with google i found this solution:

Darkfighter DS-2DE2A404IW-DE3

End of the road for me, I fear. SADP can now see the camera via both the POE switch or the 12V PSU. But TFTP won't negotiate with it. I've tried fresh copies of the files in the TFTP folder and also renaming the folder. I've tried setting the server IP to the Hikvision recommended 192.0.0.128...

www.use-ip.co.uk

With win10, and python, it seems to work, but i have the same problem.. Update is OK, camera answers to 192.168.1.64, but after power cycle, it does not reply anymore, and the SADP tool can't find it.. (and the web interface is down too..)

I used Your firmware link, but tried all of the r6 EU firmwares available..

i had this during the upgrades as resoult:


Setting block size to 512
Serving 33291341-byte digicap.dav (block size 512, 65023 blocks)
10/11/22 12:09:30: Replied to magic handshake request.
read request options: {}
10/11/22 12:09:34: starting transfer
10/11/22 12:09:34: 1 / 65023 [ ]
.
.
.
10/11/22 12:09:55: 65021 / 65023 [#################################################### ]
10/11/22 12:09:55: 65022 / 65023 [#################################################### ]
10/11/22 12:09:55: 65023 / 65023 [#####################################################]
10/11/22 12:09:55: done!
10/11/22 12:10:19: received unexpected handshake bytes '53574b4807000000000000000000000000000000' from 192.0.0.64:59806

I think, Scot Lamb's tool works fine for me.. Right?

 

[kispista]

good news? Bad news? I don't know.

I tried to use an old R0 firmware.. Same situation. Upgrade OK, but no ping or http answer after reboot. I had to eat something, I left the camera turned on, ping was running. I came back, there is a PING asnwer.. ok. SADP tool? There is my camera.. Hmmm. great. but i can't reach it over http.. The sadp tool says: http port: n/a... Ok. reboot. It takes 10-15 minutes to boot up. After booting, same.. No http, but ping OK. And according to the SADP tool, password is needed.. (not known..) The hikvision password recovery tool was unable to reach the camera...


What to do next?

 

[alastairstevenson]

I think, Scot Lamb's tool works fine for me.. Right?

Yes, the handshake completes, and the file is transferred OK.
And the response "SWKH" 0x07 is Hikvision's very common 'magic number' and is the normal tftp updater response to the firmware download.

As to why that firmware download is not accepted - you'd need to connect up to the device serial console to see why.

 

[alastairstevenson]

SADP tool? There is my camera..

The 4.0.8 firmware version shown in SADP is an indication that the camera is running in 'recovery mode' due to an invalid firmware install.

 

[kispista]

Ok. I made a serial cable, and.. it seems you are right..

=~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2022.10.11 14:56:11 =~=~=~=~=~=~=~=~=~=~=~=
[4l


U-Boot 3.1.6-195297 (May 25 2016-11:39:03)
boards:195277
Boot From: NAND 2048 RC

SYS_CONFIG: 0x30064059 POC: 100

Cortex freq: 600000000

ENET freq: 50000000

iDSP freq: 216000000

Dram freq: 564000000

Core freq: 216000000

AHB freq: 108000000

APB freq: 54000000

UART freq: 24000000

SD freq: 50000000

SDIO freq: 50000000

SDXC freq: 60000000

dev_modelS-2CD2T52-I5
Hit Ctrl+u to stop autoboot: 2
Hit Ctrl+u to stop autoboot: 1
Hit Ctrl+u to stop autoboot: 0

|NUL eth|

cmd 'null' is not supported.

nand booting ...

booting from pri part...
load kernel...

[ 1.518556] Card authentication succeeded

init started: BusyBox v1.19.3 (2019-01-10 15:07:37 CST)

starting pid 46, tty '': '/etc/init.d/rcS'
Starting udev: [ OK ]
UBI device number 1, total 272 LEBs (34537472 bytes, 32.9 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
waiting for /dev/ubi1_0.
waiting for /dev/ubi1_0.
pri_iUpgSuccCnt:1, sec_iUpgSuccCnt:1
UBI device number 3, total 48 LEBs (6094848 bytes, 5.8 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
waiting for /dev/ubi3_0.
waiting for /dev/ubi3_0.
Check dir /davinci ok! (0)
UBI device number 4, total 48 LEBs (6094848 bytes, 5.8 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
waiting for /dev/ubi4_0.
waiting for /dev/ubi4_0.
Check dir /config ok! (0)

starting pid 324, tty '': '-/bin/psh'
BusyBox v1.2.1-390993 Protect Shell (psh)
Enter 'help' for a list of davinci system commands.

# davinci not found and watchdog not initialized! auto reboot system!
begin to enter minisys~~

The system is going down NOW!

S
Sent SIGKILL to all processes

Requesting system reboot
[ 320.162754] Restarting system.
[4l


U-Boot 3.1.6-195297 (May 25 2016-11:39:03)
boards:195277
Boot From: NAND 2048 RC

SYS_CONFIG: 0x30064059 POC: 100

Cortex freq: 600000000

ENET freq: 50000000

iDSP freq: 216000000

Dram freq: 564000000

Core freq: 216000000

AHB freq: 108000000

APB freq: 54000000

UART freq: 24000000

SD freq: 50000000

SDIO freq: 50000000

SDXC freq: 60000000

dev_modelS-2CD2T52-I5
Hit Ctrl+u to stop autoboot: 2
Hit Ctrl+u to stop autoboot: 1
Hit Ctrl+u to stop autoboot: 0

|NUL eth|

cmd 'null' is not supported.

nand booting ...


BusyBox v1.2.1 Protect Shell (psh)
Enter 'help' for a list of davinci system commands.



---------------------------------------------------------------------------------------

Ok, it seems you are right. The device is in a boot loop, and can't start. the main problem is, that i tried all of the EU versions of the available firmwares. And some US versions too... Did not worked.


This boot loop condition was my last attempt to use an old r0 firmware for it..

 

[alastairstevenson]

Yes, minisys is the recovery environment.

If you interrupt the bootloader you should find the 'update' command which can be used with a normal tftp server and apply the R6 firmware.

 

[kispista]

Hi!



Hit Ctrl+u to stop autoboot: 2


HKVS # u
'u' is a ambiguous command! Exec the shortest command
* UPDATE START *
MAC: a4:14:37:c1:***
TFTP from server 192.0.0.128; our IP address is 192.0.0.64
Filename: 'mImage_r6'
Load address: 0x02000000
tftp transfer block size is set to 512 bytes
################################################################################
################################################################################
################################################################################
################################################################################
################################################################################
################################################################################
################################################################################
################################################################################
################################################################################
################################################################################
################################################################################
################################################################################
################################################################################
################################################################################
################################################################################
################################################################################
#################### got 33291341 bytes (32511 KB)
[ INFO][BLD]TFTP: Download File [OK]
error: broken header. Wrong magic! (0x40545c46)
hdr->crc32=0xb6f7ff8a
hdr->img_len=-1095382081
hdr->mem_addr=0xd7054080
hdr->magic=0x40545c46
build_time:▒▒▒㊌▒▒▒▒▒▒▒▒▒#E▒▒ي,▒▒{▒Ӻ▒BPD▒!,▒0▒▒▒Az▒z▒▒▒▒˵▒@D▒(v▒~è▒i.T▒▒2▒▒▒C▒▒▒▒▒L▒s▒▒▒L▒4▒x▒▒êP▒mw▒K▒▒▒`4▒▒6▒▒~▒▒O▒▒▒کq▒#▒$#$H▒-▒▒'▒p{=m▒h▒▒}▒=▒5▒.B▒▒▒▒E▒
hT▒▒
▒J▒▒▒Ps4▒▒▒Ρ˾▒▒i▒▒▒.▒I}
▒(YM▒▒T▒▒▒!▒q^F^▒<ռ▒▒ae▒.1J▒▒▒<username: ▒▒{▒Ӻ▒BPD▒!,▒0▒▒▒Az▒z▒▒▒▒˵▒@D▒(v▒~è▒i.T▒▒2▒▒▒C▒▒▒▒▒L▒s▒▒▒L▒4▒x▒▒êP▒mw▒K▒▒▒`4▒▒6▒▒~▒▒O▒▒▒کq▒#▒$#$H▒-▒▒'▒p{=m▒h▒▒}▒=▒5▒.B▒▒▒▒E▒
hT▒▒
▒J▒▒▒Ps4▒▒▒Ρ˾▒▒i▒▒▒.▒I}
▒(YM▒▒T▒▒▒!▒q^F^▒<ռ▒▒ae▒.1J▒▒▒<[,▒▒▒Uz▒+▒
hostname: ▒▒▒Az▒z▒▒▒▒˵▒@D▒(v▒~è▒i.T▒▒2▒▒▒C▒▒▒▒▒L▒s▒▒▒L▒4▒x▒▒êP▒mw▒K▒▒▒`4▒▒6▒▒~▒▒O▒▒▒کq▒#▒$#$H▒-▒▒'▒p{=m▒h▒▒}▒=▒5▒.B▒▒▒▒E▒
hT▒▒
▒J▒▒▒Ps4▒▒▒Ρ˾▒▒i▒▒▒.▒I}
▒(YM▒▒T▒▒▒!▒q^F^▒<ռ▒▒ae▒.1J▒▒▒<[,▒▒▒Uz▒+▒
verify data failed! error: upm.
update mini system [FAIL]!error: upf.
!!!!! UPDATE FAIL !!!!!
HKVS # PuTTYPuTTYPuTTYPuTTYPuTTYPuTTYverify data failed! error: upm.
cmd 'PuTTYPuTTYPuTTYPuTTYPuTTYPuTTYverify' is not supported.
HKVS #
HKVS #

---------------------------------------------------------------------------------------------------------------------------

The camera searched for a "mImage_r6" file.. Not the digicap.dav file.. i renamed the digicap.dav to mImage_r6 but the update failed. what is an mImage_r6?

I simple stoped the boot with ctrl+u, the u and enter...

 

[alastairstevenson]

mImage_r6 is the minisys image.
It sounds like the upm command has been used instead of the update command.
This might be upf
Check available commands using the help command.

Alternatively you could watch the progress of the tftp updater process via the serial console.

 

[kispista]

Hi,

done. 3 times but no luck. The camera gets the new firmware, updates, fine.. But after rebbot, it does not start, does not answer to 192.168.1.64.

i made a try with the original fw version, according to the label on the camera.. then the latest r6 fw, and last i tried one of the r0 version.. but no luck.

the boot process ends wint this, in a loop:

davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

Please, find the 3 logs in the attachment.

Thanks!

 

[watchful_ip]

Looks like under IPC_R6, camera boots OK.

After booting, try:

prtHardInfo
ps
ifconfig

If the IP/subnet is OK, try ping an IP on your network.
If IP not OK, use SADP to change it or the ifconfig command directly.

 

[kispista]

Hi,

i had to flash back the r6 version. (last was the r0..) The prtHardInfo does not work...

ps, and ifconfig attached, but does not use the 192.168.1.64 address.. sadp cant find it..

is there a method, to rebuild the file system, delete the config, and the darabases, and start the whole camera from zero?

 

[watchful_ip]

If the camera had been booted for a few minutes, and then prtHardInfo results in:

connect failre errno=2

suggests it is not running properly despite the presence of /home/davinci in the process listing.

I would try the format command from the bootloader to reset configuration. It should list the partitions available to format and the bootloader likely won't be one of those (or the camera would brick).

It should let you wipe the config partition containing the database.

 

[kispista]

do You know how to use the format command? there is no help for it. After executing: format +enter, resoult is: formatting...................... After o made a tftp upgrade, the camera boots, but does not run properly, but seems better.. longer boot log, less error messages but ip address is still 192.0.0.64..

 

[watchful_ip]

do You know how to use the format command? there is no help for it. After executing: format +enter, resoult is: formatting...................... After o made a tftp upgrade, the camera boots, but does not run properly, but seems better.. longer boot log, less error messages but ip address is still 192.0.0.64..

[10-13 18:39:55][pid:523][DATABASE][ERROR][main/dbutil.c 1180][db_isok]db /davinci/ipc_db does not exist--errno = 2
Davinci wait for init dababase
[10-13 18:39:55][pid:523][DATABASE][DEBUG][main/dbutil.c 1558][db_checkandrecovery]db_main check num=-1
[10-13 18:39:55][pid:523][DATABASE][DEBUG][main/dbutil.c 1568][db_checkandrecovery]try to restore main db from backup db
[10-13 18:39:55][pid:523][DATABASE][ERROR][main/dbutil.c 1180][db_isok]db /config/ipc_db_backup does not exist--errno = 2
[10-13 18:39:55][pid:523][DATABASE][DEBUG][main/dbutil.c 1530][db_restore]the backup database is bad, errno = -1.

Configuration wipe was a success - so at least it cannot be previous configuration from incompatible firmware version that is the issue.

 

[kispista]

Ok but what is the next step

 

[watchful_ip]

I'd make sure the fw version was at least that of what is stated on the label.

After that, assuming still does not boot - further investigation would be needed but unfortunately that involves territory where I cannot go with you.

 

[kispista]

I used the same fw version, what was on the label, but i tried the latest one. Same result..

 

[alastairstevenson]

the boot process ends wint this, in a loop:

davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

It's not obvious to me why it's in a bootloop - usually there are some console comments that explain why before it does so.

The 'update' command isn't clearing the configuration.
It may just be possible there is a combination of values it doesn't properly handle, as suggested by @watchful_ip
I think the 'erase' command at the bootloader should be able to clear the configuration.
I'd expect 'erase' with no arguments should list the available parameters, and probably
erase cfg
would probably be the one to use.