EZVIZ Does it not work ?

[thedoc46]

Was hoping for a quick easy way around port for port forwarding. (yes I know that uPnP is a potential security vulnerability.) But I like the convenience.

Anyway, was hoping this EZVIZ and uPnP being active on my router would have been my way to enable remote viewing.

However even though I've registered on the EZVIZ site, it would not allow me to enter my cam serial numbers? and the register status stays offline, no matter what i seem to do. Perhaps its because of my firmware ? Learning here. Bought my DS-2CD2132F-IS's directly from China via Amazon fulfillment services, and my understanding is that they're chinese camera's with a English lang firmware, and that if i try to update the firmware, i risk bricking them.

 

[nottooloud]

I got mine online via the ivms-4500 iOS app. Notifications work. Haven't got remote viewing working yet, though.

 

[LittleBrother]

Very little online documentation about ezviz. I couldn't get it to work with a english or china region cam--however, then I read that it only works with their internal cube camera (or similar). The ones I tried were firmware 5.2.0 turrets. I went into the menu on each and did the ezviz stuff but it just never showed. I've not fiddled with it with my cube yet.

I just use the ivms-4500 on my iphone with port forwarding. I know it's not perfect.

 

[anon]

I just got my DS-2CD2132F-IS online by using EZVIZ. First I made account to ezviz7.com. Then I add camera by using serial number and authentication code from QR-code.
Guide: http://www.ezviz7.com/help/guanli.html

 

[nottooloud]

Can you view it from outside your local network?

 

[thedoc46]

My problem is that its as if my serial numbers are not valid. Try and add them, either via QR or manually entering the number and it comes back with device not active.

I've got them working using iVMS-4500, just using port forwarding and pretending my leased ISP is static, as my ddns registration at us.hik-vision.com didn't like my serial numbers either...

Little disappointed atm with my hikvisions. Software or iOS app is not very intuitive, no documentation, the HiDNS service or EZVIZ service seem to neither want to work. Reading that people with the Chinese camera's turn them into bricks if they update the firmware.

All in all, I'm learning it all the hard way, and i do have them working, but i wouldn't recommend them to anyone. Perhaps i should have spent a little extra and purchased from the US market. I'd feel a little more comfortable and have some documentation and support.

 

[nottooloud]

It took me a while to figure out that that serial number is just the 9 digits at the end, and that the verification code is case sensitive.

 

[thedoc46]

It took me a while to figure out that that serial number is just the 9 digits at the end, and that the verification code is case sensitive.

Yeah tried the last 9 digits, only to be left disappointed..

 

[waltr]

It seems that some cameras, including mine shipped without authentication codes on the box. Seems to be a dead end when you have that. The QR code only lists the home page of the site. The Android app states "invalid code" when the QR code is scanned. It appears to be the US and not China version. The site accepts the Serial number, but not the ABCDEF for those without a auth code. Most annoying.

Their DDNS service is equally difficult and non-intuitive to set up.

Excellent camera other than the oddly buggy poorly documented systems. Great image quality and features with and without IR. I expect that it would be cake when used professionally with an NVR as intended. Their Mac and PC software seems solid for local use. The Hikvision software for iOS and Android is a bit of work to set up. The EZVIZ solution looked like a great way to have a shared web cam using this hardware.

 

[duilio obici neto]

Hi Guys!

Waking up this thread...
I have bought one Chinese Ezviz camera and I'm trying to use Ezviz American app. I had no problem updating its firmware using language change on hiktools.
Problem is that when I try to add this camera to my account, it returns that the device is not compatible.

I have another American camera and used UART port to compare, it turns our that Serial No and Region are different from Chinese camera to American camera. Do anybody knows how to change Serial No and region using UART port? It's valid to remember that my chinese camera and american camera are the same model, I want to copy American's SN to Chinese camera only keeping camera's ID.

/ # prtHardInfo ~~~~~~chinese camera
Start at 2018-05-04 20:10:21
Serial NO :CS-C2C-XXXXXXXXXXXX (censored)
V5.2.1 build 180417
hardwareVersion = 0x0
hardWareExtVersion = 0x0
encodeChans = 1
decodeChans = 1
alarmInNums = 0
alarmOutNums = 0
ataCtrlNums = 0
flashChipNums = 0
ramSize = 0x4000000
networksNums = 1
language = 2
devType = 0x222d7
zone = 1
wifiSupport = 1
videoStandard = 0

Start at 2018-05-03 17:27:43
Serial NO :CS-C2C-YYYYYYYYYYYY (censored)
V5.2.1 build 180417
hardwareVersion = 0x0
hardWareExtVersion = 0x0
encodeChans = 1
decodeChans = 1
alarmInNums = 0
alarmOutNums = 0
ataCtrlNums = 0
flashChipNums = 0
ramSize = 0x4000000
networksNums = 1
language = 1
devType = 0x222d7
zone = 15
wifiSupport = 1
videoStandard = 0

 

[alastairstevenson]

Do anybody knows how to change Serial No and region using UART port?

It all depends on where the (unspecified) camera holds its 'hardware signature block' - in flash memory, that could potentially be edited, or in a specially secured store, which would be difficult to alter. The method varies amongst models - the newer ones are more secure.
As a clue, what does
cat /proc/mtd
show?

 

[duilio obici neto]

It all depends on where the (unspecified) camera holds its 'hardware signature block' - in flash memory, that could potentially be edited, or in a specially secured store, which would be difficult to alter. The method varies amongst models - the newer ones are more secure.
As a clue, what does
cat /proc/mtd
show?

Hello there!

By running this command it shows:
/proc/mtd
dev: size erasesize name
mtd0: 00040000 00010000 "bld"
mtd1: 00010000 00010000 "env"
mtd2: 00010000 00010000 "enc"
mtd3: 00010000 00010000 "dp_info"
mtd4: 00310000 00010000 "sys"
mtd5: 00600000 00010000 "app"
mtd6: 00080000 00010000 "cfg"
mtd7: 00600000 00010000 "backup"

 

[alastairstevenson]

OK, so it doesn't have the same 'param' partition that an R0 series camera has to hold its signature.

 

[duilio obici neto]

OK, so it doesn't have the same 'param' partition that an R0 series camera has to hold its signature.

So, bad news

I'm trying to figure out a way to do it, but had no success till now.

 

[alastairstevenson]

So, bad news

Well, if you feel like exploring, you could maybe try this:

Assuming you have an NFS or SMB/CIFS share that you can connect to the camera as a NetHDD destination - not necessary to 'format' it.
Inspect the mount point and extract a couple of the flash partitions like so:

alastair@PC-I5 ~ $ ssh admin@192.168.1.101
admin@192.168.1.101's password:


BusyBox v1.19.3 (2017-01-18 20:54:04 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

# mount
rootfs on / type rootfs (rw)
proc on /proc type proc (rw,relatime)
none on /sys type sysfs (rw,relatime)
ramfs on /home type ramfs (rw,relatime)
udev on /dev type tmpfs (rw,relatime)
devpts on /dev/pts type devpts (rw,relatime,mode=600)
/dev/mtdblock7 on /dav type yaffs2 (rw,relatime)
/dev/mtdblock9 on /devinfo type yaffs2 (rw,relatime)
192.168.1.201:/cctv1 on /mnt/nfs00 type nfs (rw,sync,relatime,vers=3,rsize=4096,wsize=4096,namlen=255,acregmin=0,acregmax=0,acdirmin=0,acdirmax=0,soft,noac,nolock,proto=tcp,port=2049,timeo=70,retrans=3,sec=sys,local_lock=all,addr=192.168.1.201)
#
# cd /mnt/nfs00
#
# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00100000 00020000 "bld"
mtd1: 00080000 00020000 "env"
mtd2: 00080000 00020000 "enc"
mtd3: 00080000 00020000 "sysflg"
mtd4: 00100000 00020000 "dpt"
mtd5: 00800000 00020000 "sys0"
mtd6: 00800000 00020000 "sys1"
mtd7: 02600000 00020000 "app0"
mtd8: 02600000 00020000 "app1"
mtd9: 00400000 00020000 "cfg0"
mtd10: 00400000 00020000 "cfg1"
mtd11: 01000000 00020000 "syslog"
mtd12: 00880000 00020000 "resv"
#
# cat /dev/mtd1ro > mtd1ro
# cat /dev/mtd2ro > mtd2ro
#
# ls -al mtd*
-rw-r--r--    1 admin    root        524288 May  4 19:02 mtd1ro
-rw-r--r--    1 admin    root        524288 May  4 19:02 mtd2ro
# Connection to 192.168.1.101 closed.
alastair@PC-I5 ~ $

And then inspect the contents of those candidates to determine if they hold the 'hardware signature block' that defines the individual camera.
Not very likely - but easy enough to try, and you never know.

The above was a DS-2CD3335D where the camera signature is held in a security chip separate from the flash memory.

alastair@PC-I5 ~ $ ssh admin@192.168.1.101
admin@192.168.1.101's password:


BusyBox v1.19.3 (2017-01-18 20:54:04 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

# prtHardInfo
Start at 2018-03-09 12:39:50
Serial NO :DS-2CD3335D-I20150619AACH524222564
V5.4.41 build 170710
NetProcess Version: 1.7.1.179932 [14:53:09-Dec 10 2016]
Db Encrypt Version: 65537
Db Major Version: 1176
Db svn info:
Path: /Camera/Platform/Branches/branches_frontend_software_platform/db_process_for_5.4.20
Last Changed Rev: 233659
Last Changed Date: 2016-11-08 11:13:39 +0800 (Tue, 08 Nov 2016)
hardwareVersion    = 0x0
hardWareExtVersion    = 0x0
encodeChans        = 1
decodeChans        = 1
alarmInNums        = 0
alarmOutNums        = 0
ataCtrlNums        = 0
flashChipNums        = 0
ramSize            = 0x100
networksNums        = 1
language            = 1
devType            = 0x22501
net reboot count    = 0
vi_type            = 32
Path: /Camera/Platform/Branches/branches_frontend_software_platform/comm_bug_fix/cgi_fix/ipc_repair/ipc_5.4.24_g0
Last Changed Rev: 297913
Last Changed Date: 2017-07-10 21:23:14 +0800 (Mon, 10 Jul 2017)


#