DS 2CD3345-I HELP!! Will pay $50 US recovery bounty

Str8rippin

Str8rippin

n3wb
Mar 17, 2023
9
5
Australia
Hi, I picked up 3 DS 2CD3345-I Hikvision branded older IP cameras from marketplace (possibly Chinese fakes)
I do not have the password for them.
They assign an IP on my local network and I can get to the login page.
How can I reset the password? I have tried
Using the Hikvision password reset tool and punching in the correct address, I get the error 401 unauthorised error.
I’ve tried sadp tool, it gives me the start time as 1970-01-01 and the serial number, put them into the website but still getting errors
Tried sending the xml file to hikvision email but didn’t get a reply,
I have a $50 USD PayPal bounty to anyone who can provide unlock code or help me get this cameras going again.
thanks
 

Attachments

  • 2CD8F849-0F64-48FC-B979-1817C524671B.jpeg
    2CD8F849-0F64-48FC-B979-1817C524671B.jpeg
    1.2 MB · Views: 31
  • 5B61074F-AA60-4175-9503-F0270D72388A.jpeg
    5B61074F-AA60-4175-9503-F0270D72388A.jpeg
    1.2 MB · Views: 32
  • CDD1334F-C906-4C4C-ACFF-9E4C0611408D.jpeg
    CDD1334F-C906-4C4C-ACFF-9E4C0611408D.jpeg
    1.3 MB · Views: 30
Str8rippin said:
Hi, I picked up 3 DS 2CD3345-I Hikvision branded older IP cameras from marketplace (possibly Chinese fakes)
I do not have the password for them.
They assign an IP on my local network and I can get to the login page.
How can I reset the password? I have tried
Using the Hikvision password reset tool and punching in the correct address, I get the error 401 unauthorised error.
I’ve tried sadp tool, it gives me the start time as 1970-01-01 and the serial number, put them into the website but still getting errors
Tried sending the xml file to hikvision email but didn’t get a reply,
I have a $50 USD PayPal bounty to anyone who can provide unlock code or help me get this cameras going again.
thanks
Click to expand...
These old cameras are not worth 50 bux for 3 so dont throw good money after bad.
You can try this tool

Hikvision Password Reset Tool

Generate a reset code to change the pw of any Hikvision device w/ the serial number and date.
ipcamtalk.com ipcamtalk.com

Perhaps @alastairstevenson can help you out.
 
  • Like
Reactions: JDreaming
Str8rippin said:
They assign an IP on my local network and I can get to the login page.
Click to expand...
That's a good start.

SADP shows that the firmware version on the camera(s) is in the range where it may have the Hikvision 'backdoor vulnerability'.
If so, the configuration file can be dumped without needing authentication, and decrypting and decoding it will reveal the admin password.

Assuming the PC IPv4 address is in the same range as that of the camera address as shown by SADP, use this URL in the browser:
If you are lucky and that extracts the configuration file, zip it up and attach here and it can be decrypted and decoded to reveal the password.
Repeat for each camera.
 
  • Like
Reactions: EMPIRETECANDY, fenderman and Str8rippin
alastairstevenson said:
That's a good start.

SADP shows that the firmware version on the camera(s) is in the range where it may have the Hikvision 'backdoor vulnerability'.
If so, the configuration file can be dumped without needing authentication, and decrypting and decoding it will reveal the admin password.

Assuming the PC IPv4 address is in the same range as that of the camera address as shown by SADP, use this URL in the browser:
If you are lucky and that extracts the configuration file, zip it up and attach here and it can be decrypted and decoded to reveal the password.
Repeat for each camera.
Click to expand...

dont think it worked :(
 

Attachments

  • Untitled.png
    Untitled.png
    112.7 KB · Views: 17
Str8rippin said:
dont think it worked
Click to expand...
No, it didn't.
That's a pity, it would have been an easy fix.

The next method (apart from doing things via the serial console connector) would be applying ideally the same firmware version using the Hikvision tftp updater.

TFTPServ

Hikvision IP Camera Emergency Firmware Recovery TFTP. Check this thread for info on how to use this tool to un-brick your Hikvision camera.
www.ipcamtalk.com www.ipcamtalk.com

But the uncertainty is -
  • Determining the model series of the camera to get suitable firmware. SADP doesn't suggest it's a G0 series, might be R6 series. I have a vague recollection G0 series didn't have the 'backdoor'.
  • Wondering if these are the Chinese versions of the camera with hacked-to-English firmware that were quite common a few years back.

Quite a big thread on the same issue and fix attempts here :

DS-2CD3345-I Cannot Change Firmware/PW

Hi all, after 3 year of working with DS-2CD3345-I i forgot password to camera :-) HDD with NVR software formatted and PW is lost. So now problem to recover/reet password. Camera Firmware is : 5.4.24 build 170303 SN is: SADP 2.0: DS-2CD3345-I20170214AACH713157881 initial wirmware was english...
ipcamtalk.com ipcamtalk.com

G0 and R6 firmware here :
 
  • Like
Reactions: fenderman
alastairstevenson said:
No, it didn't.
That's a pity, it would have been an easy fix.

The next method (apart from doing things via the serial console connector) would be applying ideally the same firmware version using the Hikvision tftp updater.

TFTPServ

Hikvision IP Camera Emergency Firmware Recovery TFTP. Check this thread for info on how to use this tool to un-brick your Hikvision camera.
www.ipcamtalk.com www.ipcamtalk.com

But the uncertainty is -
  • Determining the model series of the camera to get suitable firmware. SADP doesn't suggest it's a G0 series, might be R6 series. I have a vague recollection G0 series didn't have the 'backdoor'.
  • Wondering if these are the Chinese versions of the camera with hacked-to-English firmware that were quite common a few years back.

Quite a big thread on the same issue and fix attempts here :

DS-2CD3345-I Cannot Change Firmware/PW

Hi all, after 3 year of working with DS-2CD3345-I i forgot password to camera :-) HDD with NVR software formatted and PW is lost. So now problem to recover/reet password. Camera Firmware is : 5.4.24 build 170303 SN is: SADP 2.0: DS-2CD3345-I20170214AACH713157881 initial wirmware was english...
ipcamtalk.com ipcamtalk.com

G0 and R6 firmware here :
Click to expand...
Thanks getting Resend required error after 10 seconds :(
 
so this is how to fix it apparently from another page.
"Got it working putting the orignial digicap.dav with tftpd32.exe
booted into u-boot by ctrl+U
then issued command upf (update not working, it just uploads the original locked firmware)
with upf command new firmware loaded ok and settings resetted.
so i was able to set new password, but camera remains chinesed. "

can anyone make this a little simpler for me to understand?
can i do this without making a TTL adapter?
thanks
 
Str8rippin said:
does this mean its completed or wrong firmware? i think its missing last step
Click to expand...
That means the file transmitted, but was not accepted as valid firmware for the camera.
Try some other firmware, you may get lucky.
Maybe another user of the same model could give some pointers to a valid firmware source.

Str8rippin said:
so this is how to fix it apparently from another page.
"Got it working putting the orignial digicap.dav with tftpd32.exe
booted into u-boot by ctrl+U
then issued command upf (update not working, it just uploads the original locked firmware)
with upf command new firmware loaded ok and settings resetted.
so i was able to set new password, but camera remains chinesed. "

can anyone make this a little simpler for me to understand?
can i do this without making a TTL adapter?
Click to expand...
This method involves connecting to the serial console interface on the main board, and interacting at a command prompt.
It's a lot more fiddly than the other methods, but not that bad.
Needed :
A wired 4-pin 1.5mm ZH JST connector, usually sold in 10-packs
A serial TTL to USB convertor, such as a PL2303TA based device.
And some patience and help ...
 
alastairstevenson said:
That means the file transmitted, but was not accepted as valid firmware for the camera.
Try some other firmware, you may get lucky.
Maybe another user of the same model could give some pointers to a valid firmware source.


This method involves connecting to the serial console interface on the main board, and interacting at a command prompt.
It's a lot more fiddly than the other methods, but not that bad.
Needed :
A wired 4-pin 1.5mm ZH JST connector, usually sold in 10-packs
A serial TTL to USB convertor, such as a PL2303TA based device.
And some patience and help ...
Click to expand...

ok i made the cable and can send commands and upload files using putty, ive tried abour 4 firmware's nothing be accepted by the camera, how can i pull the original firmware?
 
Str8rippin said:
send commands and upload files using putty
Click to expand...
Depending on the version of the bootloader there may be a command to erase the configuration and therefore reset the camera to default settings.

Suggestion :
Interrupt the bootloader (usually Control-U at power-on) and issue the following commands -
printenv
help

In PuTTY it's convenient to use the 'copy all to clipboard' at the top left menu of the terminal window to copy/paste the screen rollback to something such as Notepad for editing / posting here.

Also worth doing - let the camera fully boot, where eventually there will be a 'psh' command prompt.
At that prompt, use the 'help' command to list available commands.
There is sometimes a configuration-related command there.
 
I’ve sorted it, I found out what firmware he used googled it and found a link on these forums, I then proceeded to downloaded It. It still wouldn’t accept through tftp but it did accept through putty using upf command. My camera has been reset and is now Chinese (I’m ok with this), thanks to alistair & town.
 
  • Like
Reactions: JDreaming and alastairstevenson
Ok here’s how to fix DS 2CD-3345I cameras if you have lost the password and the easy ways don’t work.
1. Download Chinese firmware (link below)
2. Make usb to serial cable
3. Login to camera with putty and upload that firmware with the UPF command

The original Chinese firmware (THE ONLY ONE THAT WORKS) with these cheap Chinese hacked cams was found through a few searches on this forum

[MCR] Hikvision packer/unpacker for 5.3.x and newer firmware

Yes, G0 platform. The new version of hikpack supports it. Attachment updated in the OP. You can step by step to write the "hikpack" command?
ipcamtalk.com ipcamtalk.com
post #120
 
  • Like
Reactions: The Automation Guy, JDreaming and alastairstevenson
You must log in or register to reply here.
Top Bottom