DS 2CD3345-I HELP!! Will pay $50 US recovery bounty

[Str8rippin]

Hi, I picked up 3 DS 2CD3345-I Hikvision branded older IP cameras from marketplace (possibly Chinese fakes)
I do not have the password for them.
They assign an IP on my local network and I can get to the login page.
How can I reset the password? I have tried
Using the Hikvision password reset tool and punching in the correct address, I get the error 401 unauthorised error.
I’ve tried sadp tool, it gives me the start time as 1970-01-01 and the serial number, put them into the website but still getting errors
Tried sending the xml file to hikvision email but didn’t get a reply,
I have a $50 USD PayPal bounty to anyone who can provide unlock code or help me get this cameras going again.
thanks

 

[fenderman]

Hi, I picked up 3 DS 2CD3345-I Hikvision branded older IP cameras from marketplace (possibly Chinese fakes)
I do not have the password for them.
They assign an IP on my local network and I can get to the login page.
How can I reset the password? I have tried
Using the Hikvision password reset tool and punching in the correct address, I get the error 401 unauthorised error.
I’ve tried sadp tool, it gives me the start time as 1970-01-01 and the serial number, put them into the website but still getting errors
Tried sending the xml file to hikvision email but didn’t get a reply,
I have a $50 USD PayPal bounty to anyone who can provide unlock code or help me get this cameras going again.
thanks

These old cameras are not worth 50 bux for 3 so dont throw good money after bad.
You can try this tool

Hikvision Password Reset Tool

Generate a reset code to change the pw of any Hikvision device w/ the serial number and date.

ipcamtalk.com

Perhaps @alastairstevenson can help you out.

 

[alastairstevenson]

They assign an IP on my local network and I can get to the login page.

That's a good start.

SADP shows that the firmware version on the camera(s) is in the range where it may have the Hikvision 'backdoor vulnerability'.
If so, the configuration file can be dumped without needing authentication, and decrypting and decoding it will reveal the admin password.

Assuming the PC IPv4 address is in the same range as that of the camera address as shown by SADP, use this URL in the browser:

http://192.168.4.231/System/configurationFile?auth=YWRtaW46MTEK

If you are lucky and that extracts the configuration file, zip it up and attach here and it can be decrypted and decoded to reveal the password.
Repeat for each camera.

 

[Str8rippin]

That's a good start.

SADP shows that the firmware version on the camera(s) is in the range where it may have the Hikvision 'backdoor vulnerability'.
If so, the configuration file can be dumped without needing authentication, and decrypting and decoding it will reveal the admin password.

Assuming the PC IPv4 address is in the same range as that of the camera address as shown by SADP, use this URL in the browser:

http://192.168.4.231/System/configurationFile?auth=YWRtaW46MTEK

If you are lucky and that extracts the configuration file, zip it up and attach here and it can be decrypted and decoded to reveal the password.
Repeat for each camera.

dont think it worked

 

[alastairstevenson]

dont think it worked

No, it didn't.
That's a pity, it would have been an easy fix.

The next method (apart from doing things via the serial console connector) would be applying ideally the same firmware version using the Hikvision tftp updater.

TFTPServ

Hikvision IP Camera Emergency Firmware Recovery TFTP. Check this thread for info on how to use this tool to un-brick your Hikvision camera.

www.ipcamtalk.com

But the uncertainty is -

• Determining the model series of the camera to get suitable firmware. SADP doesn't suggest it's a G0 series, might be R6 series. I have a vague recollection G0 series didn't have the 'backdoor'.
• Wondering if these are the Chinese versions of the camera with hacked-to-English firmware that were quite common a few years back.

Quite a big thread on the same issue and fix attempts here :

DS-2CD3345-I Cannot Change Firmware/PW

Hi all, after 3 year of working with DS-2CD3345-I i forgot password to camera :-) HDD with NVR software formatted and PW is lost. So now problem to recover/reet password. Camera Firmware is : 5.4.24 build 170303 SN is: SADP 2.0: DS-2CD3345-I20170214AACH713157881 initial wirmware was english...

ipcamtalk.com

G0 and R6 firmware here :

https://www.hikvisioneurope.com/eu/portal/?dir=portal/Technical%20Materials/00%20%20Network%20Camera/00%20%20Product%20Firmware

 

[Str8rippin]

No, it didn't.
That's a pity, it would have been an easy fix.

The next method (apart from doing things via the serial console connector) would be applying ideally the same firmware version using the Hikvision tftp updater.

TFTPServ

Hikvision IP Camera Emergency Firmware Recovery TFTP. Check this thread for info on how to use this tool to un-brick your Hikvision camera.

www.ipcamtalk.com

But the uncertainty is -

• Determining the model series of the camera to get suitable firmware. SADP doesn't suggest it's a G0 series, might be R6 series. I have a vague recollection G0 series didn't have the 'backdoor'.
• Wondering if these are the Chinese versions of the camera with hacked-to-English firmware that were quite common a few years back.

Quite a big thread on the same issue and fix attempts here :

DS-2CD3345-I Cannot Change Firmware/PW

Hi all, after 3 year of working with DS-2CD3345-I i forgot password to camera :-) HDD with NVR software formatted and PW is lost. So now problem to recover/reet password. Camera Firmware is : 5.4.24 build 170303 SN is: SADP 2.0: DS-2CD3345-I20170214AACH713157881 initial wirmware was english...

ipcamtalk.com

G0 and R6 firmware here :

https://www.hikvisioneurope.com/eu/portal/?dir=portal/Technical%20Materials/00%20%20Network%20Camera/00%20%20Product%20Firmware

Thanks getting Resend required error after 10 seconds

 

[alastairstevenson]

Resend required error after 10 seconds

That's not fatal, it just means a block failed an integrity check and was re-transmitted.
A network error.

 

[Str8rippin]

That's not fatal, it just means a block failed an integrity check and was re-transmitted.
A network error.

Any easy fix? Tried 2 PCs

 

[Str8rippin]

does this mean its completed or wrong firmware? i think its missing last step

 

[Str8rippin]

so this is how to fix it apparently from another page.
"Got it working putting the orignial digicap.dav with tftpd32.exe
booted into u-boot by ctrl+U
then issued command upf (update not working, it just uploads the original locked firmware)
with upf command new firmware loaded ok and settings resetted.
so i was able to set new password, but camera remains chinesed. "

can anyone make this a little simpler for me to understand?
can i do this without making a TTL adapter?
thanks

 

[alastairstevenson]

does this mean its completed or wrong firmware? i think its missing last step

That means the file transmitted, but was not accepted as valid firmware for the camera.
Try some other firmware, you may get lucky.
Maybe another user of the same model could give some pointers to a valid firmware source.

so this is how to fix it apparently from another page.
"Got it working putting the orignial digicap.dav with tftpd32.exe
booted into u-boot by ctrl+U
then issued command upf (update not working, it just uploads the original locked firmware)
with upf command new firmware loaded ok and settings resetted.
so i was able to set new password, but camera remains chinesed. "

can anyone make this a little simpler for me to understand?
can i do this without making a TTL adapter?

This method involves connecting to the serial console interface on the main board, and interacting at a command prompt.
It's a lot more fiddly than the other methods, but not that bad.
Needed :
A wired 4-pin 1.5mm ZH JST connector, usually sold in 10-packs
A serial TTL to USB convertor, such as a PL2303TA based device.
And some patience and help ...

 

[Str8rippin]

That means the file transmitted, but was not accepted as valid firmware for the camera.
Try some other firmware, you may get lucky.
Maybe another user of the same model could give some pointers to a valid firmware source.


This method involves connecting to the serial console interface on the main board, and interacting at a command prompt.
It's a lot more fiddly than the other methods, but not that bad.
Needed :
A wired 4-pin 1.5mm ZH JST connector, usually sold in 10-packs
A serial TTL to USB convertor, such as a PL2303TA based device.
And some patience and help ...

ok i made the cable and can send commands and upload files using putty, ive tried abour 4 firmware's nothing be accepted by the camera, how can i pull the original firmware?

 

[alastairstevenson]

send commands and upload files using putty

Depending on the version of the bootloader there may be a command to erase the configuration and therefore reset the camera to default settings.

Suggestion :
Interrupt the bootloader (usually Control-U at power-on) and issue the following commands -
printenv
help

In PuTTY it's convenient to use the 'copy all to clipboard' at the top left menu of the terminal window to copy/paste the screen rollback to something such as Notepad for editing / posting here.

Also worth doing - let the camera fully boot, where eventually there will be a 'psh' command prompt.
At that prompt, use the 'help' command to list available commands.
There is sometimes a configuration-related command there.

 

[alastairstevenson]

ive tried abour 4 firmware's nothing be accepted by the camera

What was the command to apply the firmware, and what were the errors that resulted?

 

[Str8rippin]

I’ve sorted it, I found out what firmware he used googled it and found a link on these forums, I then proceeded to downloaded It. It still wouldn’t accept through tftp but it did accept through putty using upf command. My camera has been reset and is now Chinese (I’m ok with this), thanks to alistair & town.

 

[alastairstevenson]

I found out what firmware he used googled it and found a link on these forums

Can you post the link to that - there have been quite a few posts about this camera model, it may help others.

 

[Str8rippin]

Ok here’s how to fix DS 2CD-3345I cameras if you have lost the password and the easy ways don’t work.
1. Download Chinese firmware (link below)
2. Make usb to serial cable
3. Login to camera with putty and upload that firmware with the UPF command

The original Chinese firmware (THE ONLY ONE THAT WORKS) with these cheap Chinese hacked cams was found through a few searches on this forum

[MCR] Hikvision packer/unpacker for 5.3.x and newer firmware

Yes, G0 platform. The new version of hikpack supports it. Attachment updated in the OP. You can step by step to write the "hikpack" command?

ipcamtalk.com

post #120

 

[alastairstevenson]

Wow! From 6 years ago. And still useful!