Firmware upgrade of DS-2CD2132F-IS left me in Min System Mode

[John Wolf]

I attempted a firmware update to see if it would resolve an issue with not being able to save settings on a couple of the settings pages. I didn't realize how careful you had to be in choosing firmware. I installed the US 5.4 firmware on top of 5.2.5 and it has apparently left me in MinSystem Mode from what I have been reading. I can telnet to it, but there is no web interface.

The user interface previously was entirely in english on the camera, but I am gathering that doesn't necessarily mean it was a US model and would accept the US firmware? Looking at the back the serial number sticker is all in Chinese.

Can someone point me in the right direction as to what firmware I should be trying to install, and how to install it since it isn't attempting TFTP on boot? The threads I have found so far dealing with MinSystem mode talk about 5.3 ->5.2.5 and others point toward a firmware that I don't believe is for my camera. I am just trying to avoid screwing this up worse.

I do have another identical unit if that helps to scavenge files.

 

[alastairstevenson]

it has apparently left me in MinSystem Mode from what I have been reading.

This is generally indicated by the firmware version '4.0.8' when seen in SADP, and the lack of web services at the IP address shown in SADP.

I can telnet to it

What IP address are you using for this?
To maybe get a hint of what is stopping it fully booting, you could check out the kernel log using:
cat /proc/kmsg

Looking at the back the serial number sticker is all in Chinese.

Does the serial number itself have the letters 'CCCH' or similar embedded?

The threads I have found so far dealing with MinSystem mode talk about 5.3 ->5.2.5 and others point toward a firmware that I don't believe is for my camera.

This : Custom Firmware Downgrader 5.3.0 Chinese to 5.2.5 English
should generally work - unless the 5.40 has managed to install the 'unrollback' (sic) feature and the xxxxF-IS excludes this model.
But as it is 'bricked' already - there would be no harm in checking it out.

how to install it since it isn't attempting TFTP on boot?

Excuse the question - you are definitely using the Hikvision-specific tftp updater, a copy of which and instructions, is in the 'downgrader' link?
And does the IP address of the camera differ from the usual 192.0.0.64 ?
What does the status screen of the tftp updater show when the camera is powered on?

 

[John Wolf]

I'll install SADP and verify that it truly is in MinSystem mode. So far, I've gone by symptoms. Wife was using her PC at the time so I haven't checked with SADP yet, my stuff is OSX.

I will check the kernel log and report back.

I am telnetting to the same IP address as I had set originally for the camera. 192.168.1.21. Telnet accepted the standard root/12345

I don't see CCCH anywhere on the sticker, is that also revealed by SADP?

Will check on the downgrader as well.

I was using OSX TFTP, with the IP address of the machine set to 192.0.0.128. I had logging turned on, and didn't see the camera hit the TFTP server at all. (I know, I am throwing way too many irons into the fire, I'll get all the PC tools on a win laptop as I continue to work on this.)

Thank you for your response!

 

[John Wolf]

Installed SADP, and in the serial number it has CCRR embedded in it, not CCCH.

SADP says it says DS-2CD-Min-System, but doesn't allow changing of IP parameters. This is with the computer on the original network: 192.168.1.X

Below is the kmsg log (Didn't see an upload file option here.)

Should I go ahead with trying the restore with the downgrader that was listed? (Putting the computer on 192.0.0.128)


(none) login: root
Password:
login: can't chdir to home directory '/root/'
# cat /proc/kmsg
<5>Linux version 2.6.38.8 (wangqian@ipcteam2) (gcc version 4.6.1 (Sourcery CodeBench Lite 2011.09-70) )
<5>#75 PREEMPT Mon Jul 14 20:15:03 CST 2014
<4>CPU: ARMv6-compatible processor [4117b365] revision 5 (ARMv6TEJ), cr=00c5387f
<4>CPU: VIPT nonaliasing data cache, VIPT nonaliasing instruction cache
<4>Machine: Coconut
<4>Ignoring unrecognised tag 0x44000426
<4>Memory policy: ECC disabled, Data cache writeback
<6>Ambarella: AHB = 0x60000000[0xf0000000],0x01000000 0
<6>Ambarella: APB = 0x70000000[0xf1000000],0x01000000 0
<6>Ambarella: PPM = 0xc0000000[0xe0000000],0x00200000 9
<6>Ambarella: BSB = 0xc8c00000[0xe8c00000],0x00400000 9
<6>Ambarella: DSP = 0xc9000000[0xe9000000],0x07000000 9
<6>Ambarella: HAL = 0xc00a0000[0xfee00000],0x0000e708 9
<7>On node 0 totalpages: 25344
<7>free_area_init_node: node 0, pgdat c04e5c80, node_mem_map c0506000
<7> Normal zone: 198 pages used for memmap
<7> Normal zone: 0 pages reserved
<7> Normal zone: 25146 pages, LIFO batch:7
<4>bootmem_init: high_memory = 0xc8a00000
<7>pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
<7>pcpu-alloc: [0] 0
<4>Built 1 zonelists in Zone order, mobility grouping on. Total pages: 25146
<5>Kernel command line: console=ttyS0 dbg=0 IP=192.0.0.64 MASK=255.255.255.0 GW=0.0.0.0 SERVER=192.0.0.128 video=amb0fb:720x480,720x480,1,0
<6>PID hash table entries: 512 (order: -1, 2048 bytes)
<6>Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
<6>Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
<6>Memory: 99MB = 99MB total
<5>Memory: 91180k/91180k available, 10196k reserved, 0K highmem
<5>Virtual kernel memory layout:
<5> vector : 0xffff0000 - 0xffff1000 ( 4 kB)
<5> fixmap : 0xfff00000 - 0xfffe0000 ( 896 kB)
<5> DMA : 0xfe600000 - 0xfee00000 ( 8 MB)
<5> vmalloc : 0xc9000000 - 0xe0000000 ( 368 MB)
<5> lowmem : 0xc0000000 - 0xc8a00000 ( 138 MB)
<5> modules : 0xbf000000 - 0xc0000000 ( 16 MB)
<5> .init : 0xc0008000 - 0xc027d000 (2516 kB)
<5> .text : 0xc027d000 - 0xc04c7000 (2344 kB)
<5> .data : 0xc04c8000 - 0xc04e6320 ( 121 kB)
<6>Preemptable hierarchical RCU implementation.
<6> RCU-based detection of stalled CPUs is disabled.
<6> Verbose stalled-CPUs detection is disabled.
<6>NR_IRQS:224
<6>sched_clock: 32 bits at 72MHz, resolution 13ns, wraps every 59652ms
<2>sched_clock: wrong multiply/shift: 1864135111>>27 vs calculated 3728270222>>28
<2>sched_clock: fix multiply/shift to avoid scheduler hiccups
<4>Console: colour dummy device 80x30
<6>console [ttyS0] enabled
<6>Calibrating delay loop... 351.43 BogoMIPS (lpj=1757184)
<6>pid_max: default: 32768 minimum: 301
<4>Mount-cache hash table entries: 512
<6>CPU: Testing write buffer coherency: ok
<6>NET: Registered protocol family 16
<6>Ambarella Coconut:
<6> chip id: 5100
<6> board type: 3
<6> board revision: 10
<6> chip name: a5m
<6> HAL version: 176869
<6> reference clock: 24000000
<6> system configuration: 0x040004ea
<6> boot type: 0x00000002
<6> hif type: 0x00000000
<4>bio: create slab <bio-0> at 0
<6>ambarella-spi ambarella-spi.0: ambarella SPI Controller 0 created
<5>ambarella-i2c ambarella-i2c.0: Ambarella Media Processor I2C adapter[i2c-0] probed!
<5>ambarella-i2c ambarella-i2c.1: Ambarella Media Processor I2C adapter[i2c-1] probed!
<6>i2c i2c-0: Added multiplexed i2c bus 2
<6>ambarella-i2cmux ambarella-i2cmux.0: mux on ambarella-i2c adapter
<6>Switching to clocksource ambarella-cs-timer
<6>NET: Registered protocol family 2
<6>IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
<6>TCP established hash table entries: 4096 (order: 3, 32768 bytes)
<6>TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
<6>TCP: Hash tables configured (established 4096 bind 4096)
<6>TCP reno registered
<6>UDP hash table entries: 256 (order: 0, 4096 bytes)
<6>UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
<6>NET: Registered protocol family 1
<6>Unpacking initramfs...
<0>Initramfs unpacking failed: junk in compressed archive
<6>Freeing initrd memory: 4096K
<0>[ kernel version: svn-83192 ]
<4>mmc0 power register success!
<4>mmc1 power register success!
<1>use default reserved area information!
<6>reboot times :2
<6>msgmni has been set to 186
<6>io scheduler noop registered
<6>io scheduler deadline registered (default)
<6>ambarella-uart.0: ttyS0 at MMIO 0x70005000 (irq = 9) is a ambuart
<6>NAND device: Manufacturer ID: 0x01, Chip ID: 0xf1 (AMD NAND 128MiB 3,3V 8-bit)
<4>ambarella_nand_config_flash: 0x02e00140, 0x02c00140
<7>Bad block table found at page 65472, version 0x01
<7>Bad block table found at page 65408, version 0x01
<7>nand_read_bbt: Bad block at 0x0000010c0000
<7>nand_read_bbt: Bad block at 0x000006400000
<6>ambarella-nand ambarella-nand: ambarella_nand_probe: Partition infomation found!
<5>Creating 18 MTD partitions on "ambnand":
<5>0x000000000000-0x000000020000 : "bst"
<5>0x000000020000-0x000000120000 : "ptb"
<5>0x000000120000-0x000000220000 : "bld"
<5>0x000000220000-0x000000320000 : "hal"
<5>0x000000320000-0x000000420000 : "ano_ptb"
<5>0x000000420000-0x0000004a0000 : "env"
<5>0x0000004a0000-0x000000520000 : "param"
<5>0x000000520000-0x000000620000 : "dpt"
<5>0x000000620000-0x000001020000 : "rcvy"
<5>0x000001020000-0x000001820000 : "krn_pri"
<5>0x000001820000-0x000002020000 : "krn_sec"
<5>0x000002020000-0x000002420000 : "rmd_pri"
<5>0x000002420000-0x000002820000 : "rmd_sec"
<5>0x000002820000-0x000004020000 : "app_pri"
<5>0x000004020000-0x000005820000 : "app_sec"
<5>0x000005820000-0x000005c20000 : "cfg_pri"
<5>0x000005c20000-0x000006020000 : "cfg_sec"
<5>0x000006020000-0x000007020000 : "dbg"
<6>Ambarella MII Bus: probed
<5>ambarella-eth ambarella-eth.0: MAC Address[c0:56:e3:7f:2c:4e].
<6>mousedev: PS/2 mouse device common for all mice
<6>ambarella-rtc ambarella-rtc: rtc core: registered ambarella-rtc as rtc0
<6>i2c /dev entries driver
<5>ambarella-wdt ambarella-wdt: Ambarella Media Processor Watch Dog Timer[ambarella-wdt].
<6>TCP cubic registered
<6>NET: Registered protocol family 17
<6>ambarella-rtc ambarella-rtc: setting system clock to 2016-12-12 10:58:32 UTC (1481540312)
<6>Freeing init memory: 2516K
<5>net eth0: Could not find default PHY in 9.
<5>net eth0: Try PHY[3] whose id is 0x001cc816!
<5>UBI: attaching mtd13 to ubi1
<5>UBI: physical eraseblock size: 131072 bytes (128 KiB)
<5>UBI: logical eraseblock size: 129024 bytes
<5>UBI: smallest flash I/O unit: 2048
<5>UBI: sub-page size: 512
<5>UBI: VID header offset: 512 (aligned 512)
<5>UBI: data offset: 2048
<5>UBI: max. sequence number: 381
<5>UBI: attached mtd13 to ubi1
<5>UBI: MTD device name: "app_pri"
<5>UBI: MTD device size: 24 MiB
<5>UBI: number of good PEBs: 192
<5>UBI: number of bad PEBs: 0
<5>UBI: number of corrupted PEBs: 0
<5>UBI: max. allowed volumes: 128
<5>UBI: wear-leveling threshold: 4096
<5>UBI: number of internal volumes: 1
<5>UBI: number of user volumes: 1
<5>UBI: available PEBs: 0
<5>UBI: total number of reserved PEBs: 192
<5>UBI: number of PEBs reserved for bad PEB handling: 2
<5>UBI: max/mean erase counter: 6/4
<5>UBI: image sequence number: 643585892
<5>UBI: background thread "ubi_bgt1d" started, PID 322
<5>UBIFS: recovery needed
<5>UBIFS: recovery completed
<5>UBIFS: mounted UBI device 1, volume 0, name "app_pri"
<5>UBIFS: file system size: 22837248 bytes (22302 KiB, 21 MiB, 177 LEBs)
<5>UBIFS: journal size: 1161216 bytes (1134 KiB, 1 MiB, 9 LEBs)
<5>UBIFS: media format: w4/r0 (latest is w4/r0)
<5>UBIFS: default compressor: lzo
<5>UBIFS: reserved for root: 1078659 bytes (1053 KiB)
<5>UBI: attaching mtd14 to ubi2
<5>UBI: physical eraseblock size: 131072 bytes (128 KiB)
<5>UBI: logical eraseblock size: 129024 bytes
<5>UBI: smallest flash I/O unit: 2048
<5>UBI: sub-page size: 512
<5>UBI: VID header offset: 512 (aligned 512)
<5>UBI: data offset: 2048
<5>UBI: max. sequence number: 281
<5>UBI: attached mtd14 to ubi2
<5>UBI: MTD device name: "app_sec"
<5>UBI: MTD device size: 24 MiB
<5>UBI: number of good PEBs: 192
<5>UBI: number of bad PEBs: 0
<5>UBI: number of corrupted PEBs: 0
<5>UBI: max. allowed volumes: 128
<5>UBI: wear-leveling threshold: 4096
<5>UBI: number of internal volumes: 1
<5>UBI: number of user volumes: 1
<5>UBI: available PEBs: 0
<5>UBI: total number of reserved PEBs: 192
<5>UBI: number of PEBs reserved for bad PEB handling: 2
<5>UBI: max/mean erase counter: 3/2
<5>UBI: image sequence number: 2012014713
<5>UBI: background thread "ubi_bgt2d" started, PID 333
<6>PHY: 0:03 - Link is Up - 100/Full
<5>UBIFS: recovery needed
<5>UBIFS: recovery completed
<5>UBIFS: mounted UBI device 2, volume 0, name "app_sec"
<5>UBIFS: file system size: 22837248 bytes (22302 KiB, 21 MiB, 177 LEBs)
<5>UBIFS: journal size: 1161216 bytes (1134 KiB, 1 MiB, 9 LEBs)
<5>UBIFS: media format: w4/r0 (latest is w4/r0)
<5>UBIFS: default compressor: lzo
<5>UBIFS: reserved for root: 1078659 bytes (1053 KiB)
<5>UBI: attaching mtd15 to ubi3
<5>UBI: physical eraseblock size: 131072 bytes (128 KiB)
<5>UBI: logical eraseblock size: 129024 bytes
<5>UBI: smallest flash I/O unit: 2048
<5>UBI: sub-page size: 512
<5>UBI: VID header offset: 512 (aligned 512)
<5>UBI: data offset: 2048
<5>UBI: max. sequence number: 147
<5>UBI: attached mtd15 to ubi3
<5>UBI: MTD device name: "cfg_pri"
<5>UBI: MTD device size: 4 MiB
<5>UBI: number of good PEBs: 32
<5>UBI: number of bad PEBs: 0
<5>UBI: number of corrupted PEBs: 0
<5>UBI: max. allowed volumes: 128
<5>UBI: wear-leveling threshold: 4096
<5>UBI: number of internal volumes: 1
<5>UBI: number of user volumes: 1
<5>UBI: available PEBs: 0
<5>UBI: total number of reserved PEBs: 32
<5>UBI: number of PEBs reserved for bad PEB handling: 2
<5>UBI: max/mean erase counter: 13/10
<5>UBI: image sequence number: 1484639837
<5>UBI: background thread "ubi_bgt3d" started, PID 344
<5>UBIFS: recovery needed
<5>UBIFS: recovery completed
<5>UBIFS: mounted UBI device 3, volume 0, name "cfg_pri"
<5>UBIFS: file system size: 2193408 bytes (2142 KiB, 2 MiB, 17 LEBs)
<5>UBIFS: journal size: 1032193 bytes (1008 KiB, 0 MiB, 6 LEBs)
<5>UBIFS: media format: w4/r0 (latest is w4/r0)
<5>UBIFS: default compressor: lzo
<5>UBIFS: reserved for root: 103599 bytes (101 KiB)
<5>UBI: attaching mtd16 to ubi4
<5>UBI: physical eraseblock size: 131072 bytes (128 KiB)
<5>UBI: logical eraseblock size: 129024 bytes
<5>UBI: smallest flash I/O unit: 2048
<5>UBI: sub-page size: 512
<5>UBI: VID header offset: 512 (aligned 512)
<5>UBI: data offset: 2048
<5>UBI: max. sequence number: 155
<5>UBI: attached mtd16 to ubi4
<5>UBI: MTD device name: "cfg_sec"
<5>UBI: MTD device size: 4 MiB
<5>UBI: number of good PEBs: 32
<5>UBI: number of bad PEBs: 0
<5>UBI: number of corrupted PEBs: 0
<5>UBI: max. allowed volumes: 128
<5>UBI: wear-leveling threshold: 4096
<5>UBI: number of internal volumes: 1
<5>UBI: number of user volumes: 1
<5>UBI: available PEBs: 0
<5>UBI: total number of reserved PEBs: 32
<5>UBI: number of PEBs reserved for bad PEB handling: 2
<5>UBI: max/mean erase counter: 13/11
<5>UBI: image sequence number: 2142699236
<5>UBI: background thread "ubi_bgt4d" started, PID 355
<5>UBIFS: recovery needed
<5>UBIFS: recovery completed
<5>UBIFS: mounted UBI device 4, volume 0, name "cfg_sec"
<5>UBIFS: file system size: 2193408 bytes (2142 KiB, 2 MiB, 17 LEBs)
<5>UBIFS: journal size: 1032193 bytes (1008 KiB, 0 MiB, 6 LEBs)
<5>UBIFS: media format: w4/r0 (latest is w4/r0)
<5>UBIFS: default compressor: lzo
<5>UBIFS: reserved for root: 103599 bytes (101 KiB)

 

[alastairstevenson]

Below is the kmsg log (Didn't see an upload file option here.)

Some lengthy transcripts can be conveniently enclosed in the CODE tags, accessed via the '+' dropdown.

<6>Unpacking initramfs...
<0>Initramfs unpacking failed: junk in compressed archive

That's a good indication that invalid firmware is loaded.
Without the root file system, no apps will be loaded and run.

I was using OSX TFTP

The Hikvision-specific tftp updater isn't a standard tftp server - it does a UDP magic handshake with the client device (so needs inbound access through the Windows firewall to operate).
I think there is a pretty good chance the 'downgrader' will work OK here.
Also worth noting is the fine selection of back firmware versions here, for older hardware : HIKVISION EUROPE

 

[John Wolf]

It successfully pulls the firmware over TFTP, but doesn't come back to life.

[2016-12-12 14:20:31] TFTP server[192.0.0.128] initialized
[2016-12-12 14:20:49] Device[192.0.0.64] test tftpserver
[2016-12-12 14:20:57] Connect client[192.0.0.64] success
[2016-12-12 14:20:57] Start file[C:\Users\LocalAdmin\Downloads\5.30 Downgrader 4lines\digicap.dav] transmitting
[2016-12-12 14:21:19] Completed file[C:\Users\LocalAdmin\Downloads\5.30 Downgrader 4lines\digicap.dav] transmit
[2016-12-12 14:21:38] Device[192.0.0.64] system update completed!

SADP doesn't find the camera any longer, but it does appear to have switched the IP back to 192.0.0.64. I can telnet to it still.

kmsg gives this:

(none) login: root
Password:
login: can't chdir to home directory '/root/'
# cat /proc/kmsg
<5>Linux version 2.6.38.8 (wangqian@ipcteam2) (gcc version 4.6.1 (Sourcery CodeBench Lite 2011.09-70) )
<5>#75 PREEMPT Mon Jul 14 20:15:03 CST 2014
<4>CPU: ARMv6-compatible processor [4117b365] revision 5 (ARMv6TEJ), cr=00c5387f
<4>CPU: VIPT nonaliasing data cache, VIPT nonaliasing instruction cache
<4>Machine: Coconut
<4>Ignoring unrecognised tag 0x44000426
<4>Memory policy: ECC disabled, Data cache writeback
<6>Ambarella: AHB       = 0x60000000[0xf0000000],0x01000000 0
<6>Ambarella: APB       = 0x70000000[0xf1000000],0x01000000 0
<6>Ambarella: PPM       = 0xc0000000[0xe0000000],0x00200000 9
<6>Ambarella: BSB       = 0xc8c00000[0xe8c00000],0x00400000 9
<6>Ambarella: DSP       = 0xc9000000[0xe9000000],0x07000000 9
<6>Ambarella: HAL       = 0xc00a0000[0xfee00000],0x0000e708 9
<7>On node 0 totalpages: 25344
<7>free_area_init_node: node 0, pgdat c04e5c80, node_mem_map c0506000
<7>  Normal zone: 198 pages used for memmap
<7>  Normal zone: 0 pages reserved
<7>  Normal zone: 25146 pages, LIFO batch:7
<4>bootmem_init: high_memory = 0xc8a00000
<7>pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
<7>pcpu-alloc: [0] 0
<4>Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 25146
<5>Kernel command line: console=ttyS0 dbg=0 IP=192.0.0.64 MASK=255.255.255.0 GW=0.0.0.0 SERVER=192.0.0.128 MS_ACTION=auto_update video=amb0fb:720x480,720x480,1,0
<6>PID hash table entries: 512 (order: -1, 2048 bytes)
<6>Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
<6>Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
<6>Memory: 99MB = 99MB total
<5>Memory: 91180k/91180k available, 10196k reserved, 0K highmem
<5>Virtual kernel memory layout:
<5>    vector  : 0xffff0000 - 0xffff1000   (   4 kB)
<5>    fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
<5>    DMA     : 0xfe600000 - 0xfee00000   (   8 MB)
<5>    vmalloc : 0xc9000000 - 0xe0000000   ( 368 MB)
<5>    lowmem  : 0xc0000000 - 0xc8a00000   ( 138 MB)
<5>    modules : 0xbf000000 - 0xc0000000   (  16 MB)
<5>      .init : 0xc0008000 - 0xc027d000   (2516 kB)
<5>      .text : 0xc027d000 - 0xc04c7000   (2344 kB)
<5>      .data : 0xc04c8000 - 0xc04e6320   ( 121 kB)
<6>Preemptable hierarchical RCU implementation.
<6>     RCU-based detection of stalled CPUs is disabled.
<6>     Verbose stalled-CPUs detection is disabled.
<6>NR_IRQS:224
<6>sched_clock: 32 bits at 72MHz, resolution 13ns, wraps every 59652ms
<2>sched_clock: wrong multiply/shift: 1864135111>>27 vs calculated 3728270222>>28
<2>sched_clock: fix multiply/shift to avoid scheduler hiccups
<4>Console: colour dummy device 80x30
<6>console [ttyS0] enabled
<6>Calibrating delay loop... 351.43 BogoMIPS (lpj=1757184)
<6>pid_max: default: 32768 minimum: 301
<4>Mount-cache hash table entries: 512
<6>CPU: Testing write buffer coherency: ok
<6>NET: Registered protocol family 16
<6>Ambarella Coconut:
<6>     chip id:                5100
<6>     board type:             3
<6>     board revision:         10
<6>     chip name:              a5m
<6>     HAL version:            176869
<6>     reference clock:        24000000
<6>     system configuration:   0x040004ea
<6>     boot type:              0x00000002
<6>     hif type:               0x00000000
<4>bio: create slab <bio-0> at 0
<6>ambarella-spi ambarella-spi.0: ambarella SPI Controller 0 created
<5>ambarella-i2c ambarella-i2c.0: Ambarella Media Processor I2C adapter[i2c-0] probed!
<5>ambarella-i2c ambarella-i2c.1: Ambarella Media Processor I2C adapter[i2c-1] probed!
<6>i2c i2c-0: Added multiplexed i2c bus 2
<6>ambarella-i2cmux ambarella-i2cmux.0: mux on ambarella-i2c adapter
<6>Switching to clocksource ambarella-cs-timer
<6>NET: Registered protocol family 2
<6>IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
<6>TCP established hash table entries: 4096 (order: 3, 32768 bytes)
<6>TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
<6>TCP: Hash tables configured (established 4096 bind 4096)
<6>TCP reno registered
<6>UDP hash table entries: 256 (order: 0, 4096 bytes)
<6>UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
<6>NET: Registered protocol family 1
<6>Unpacking initramfs...
<0>Initramfs unpacking failed: junk in compressed archive
<6>Freeing initrd memory: 4096K
<0>[ kernel version:  svn-83192 ]
<4>mmc0 power register success!
<4>mmc1 power register success!
<1>use default reserved area information!
<6>reboot times :1
<6>msgmni has been set to 186
<6>io scheduler noop registered
<6>io scheduler deadline registered (default)
<6>ambarella-uart.0: ttyS0 at MMIO 0x70005000 (irq = 9) is a ambuart
<6>NAND device: Manufacturer ID: 0x01, Chip ID: 0xf1 (AMD NAND 128MiB 3,3V 8-bit)
<4>ambarella_nand_config_flash: 0x02e00140, 0x02c00140
<7>Bad block table found at page 65472, version 0x01
<7>Bad block table found at page 65408, version 0x01
<7>nand_read_bbt: Bad block at 0x0000010c0000
<7>nand_read_bbt: Bad block at 0x000006400000
<6>ambarella-nand ambarella-nand: ambarella_nand_probe: Partition infomation found!
<5>Creating 18 MTD partitions on "ambnand":
<5>0x000000000000-0x000000020000 : "bst"
<5>0x000000020000-0x000000120000 : "ptb"
<5>0x000000120000-0x000000220000 : "bld"
<5>0x000000220000-0x000000320000 : "hal"
<5>0x000000320000-0x000000420000 : "ano_ptb"
<5>0x000000420000-0x0000004a0000 : "env"
<5>0x0000004a0000-0x000000520000 : "param"
<5>0x000000520000-0x000000620000 : "dpt"
<5>0x000000620000-0x000001020000 : "rcvy"
<5>0x000001020000-0x000001820000 : "krn_pri"
<5>0x000001820000-0x000002020000 : "krn_sec"
<5>0x000002020000-0x000002420000 : "rmd_pri"
<5>0x000002420000-0x000002820000 : "rmd_sec"
<5>0x000002820000-0x000004020000 : "app_pri"
<5>0x000004020000-0x000005820000 : "app_sec"
<5>0x000005820000-0x000005c20000 : "cfg_pri"
<5>0x000005c20000-0x000006020000 : "cfg_sec"
<5>0x000006020000-0x000007020000 : "dbg"
<6>Ambarella MII Bus: probed
<5>ambarella-eth ambarella-eth.0: MAC Address[c0:56:e3:7f:2c:4e].
<6>mousedev: PS/2 mouse device common for all mice
<6>ambarella-rtc ambarella-rtc: rtc core: registered ambarella-rtc as rtc0
<6>i2c /dev entries driver
<5>ambarella-wdt ambarella-wdt: Ambarella Media Processor Watch Dog Timer[ambarella-wdt].
<6>TCP cubic registered
<6>NET: Registered protocol family 17
<6>ambarella-rtc ambarella-rtc: setting system clock to 2016-12-12 14:11:37 UTC (1481551897)
<6>Freeing init memory: 2516K
<5>net eth0: Could not find default PHY in 9.
<5>net eth0: Try PHY[3] whose id is 0x001cc816!
<5>UBI: attaching mtd13 to ubi1
<5>UBI: physical eraseblock size:   131072 bytes (128 KiB)
<5>UBI: logical eraseblock size:    129024 bytes
<5>UBI: smallest flash I/O unit:    2048
<5>UBI: sub-page size:              512
<5>UBI: VID header offset:          512 (aligned 512)
<5>UBI: data offset:                2048
<5>UBI: max. sequence number:       0
<5>UBI: attached mtd13 to ubi1
<5>UBI: MTD device name:            "app_pri"
<5>UBI: MTD device size:            24 MiB
<5>UBI: number of good PEBs:        192
<5>UBI: number of bad PEBs:         0
<5>UBI: number of corrupted PEBs:   0
<5>UBI: max. allowed volumes:       128
<5>UBI: wear-leveling threshold:    4096
<5>UBI: number of internal volumes: 1
<5>UBI: number of user volumes:     0
<5>UBI: available PEBs:             186
<5>UBI: total number of reserved PEBs: 6
<5>UBI: number of PEBs reserved for bad PEB handling: 2
<5>UBI: max/mean erase counter: 9/6
<5>UBI: image sequence number:  1712893491
<5>UBI: background thread "ubi_bgt1d" started, PID 321
<5>UBIFS: default file-system created
<5>UBIFS: mounted UBI device 1, volume 0, name "app_pri"
<5>UBIFS: file system size:   22837248 bytes (22302 KiB, 21 MiB, 177 LEBs)
<5>UBIFS: journal size:       1161216 bytes (1134 KiB, 1 MiB, 9 LEBs)
<5>UBIFS: media format:       w4/r0 (latest is w4/r0)
<5>UBIFS: default compressor: lzo
<5>UBIFS: reserved for root:  1078659 bytes (1053 KiB)
<5>UBI: attaching mtd14 to ubi2
<5>UBI: physical eraseblock size:   131072 bytes (128 KiB)
<5>UBI: logical eraseblock size:    129024 bytes
<5>UBI: smallest flash I/O unit:    2048
<5>UBI: sub-page size:              512
<5>UBI: VID header offset:          512 (aligned 512)
<5>UBI: data offset:                2048
<5>UBI: max. sequence number:       0
<5>UBI: attached mtd14 to ubi2
<5>UBI: MTD device name:            "app_sec"
<5>UBI: MTD device size:            24 MiB
<5>UBI: number of good PEBs:        192
<5>UBI: number of bad PEBs:         0
<5>UBI: number of corrupted PEBs:   0
<5>UBI: max. allowed volumes:       128
<5>UBI: wear-leveling threshold:    4096
<5>UBI: number of internal volumes: 1
<5>UBI: number of user volumes:     0
<5>UBI: available PEBs:             186
<5>UBI: total number of reserved PEBs: 6
<5>UBI: number of PEBs reserved for bad PEB handling: 2
<5>UBI: max/mean erase counter: 6/4
<5>UBI: image sequence number:  1746962869
<5>UBI: background thread "ubi_bgt2d" started, PID 334
<6>PHY: 0:03 - Link is Up - 100/Full
<5>UBIFS: default file-system created
<5>UBIFS: mounted UBI device 2, volume 0, name "app_sec"
<5>UBIFS: file system size:   22837248 bytes (22302 KiB, 21 MiB, 177 LEBs)
<5>UBIFS: journal size:       1161216 bytes (1134 KiB, 1 MiB, 9 LEBs)
<5>UBIFS: media format:       w4/r0 (latest is w4/r0)
<5>UBIFS: default compressor: lzo
<5>UBIFS: reserved for root:  1078659 bytes (1053 KiB)
<5>UBI: attaching mtd15 to ubi3
<5>UBI: physical eraseblock size:   131072 bytes (128 KiB)
<5>UBI: logical eraseblock size:    129024 bytes
<5>UBI: smallest flash I/O unit:    2048
<5>UBI: sub-page size:              512
<5>UBI: VID header offset:          512 (aligned 512)
<5>UBI: data offset:                2048
<5>UBI: max. sequence number:       0
<5>UBI: attached mtd15 to ubi3
<5>UBI: MTD device name:            "cfg_pri"
<5>UBI: MTD device size:            4 MiB
<5>UBI: number of good PEBs:        32
<5>UBI: number of bad PEBs:         0
<5>UBI: number of corrupted PEBs:   0
<5>UBI: max. allowed volumes:       128
<5>UBI: wear-leveling threshold:    4096
<5>UBI: number of internal volumes: 1
<5>UBI: number of user volumes:     0
<5>UBI: available PEBs:             26
<5>UBI: total number of reserved PEBs: 6
<5>UBI: number of PEBs reserved for bad PEB handling: 2
<5>UBI: max/mean erase counter: 15/14
<5>UBI: image sequence number:  875141422
<5>UBI: background thread "ubi_bgt3d" started, PID 349
<5>UBIFS: default file-system created
<5>UBIFS: mounted UBI device 3, volume 0, name "cfg_pri"
<5>UBIFS: file system size:   2193408 bytes (2142 KiB, 2 MiB, 17 LEBs)
<5>UBIFS: journal size:       1032193 bytes (1008 KiB, 0 MiB, 6 LEBs)
<5>UBIFS: media format:       w4/r0 (latest is w4/r0)
<5>UBIFS: default compressor: lzo
<5>UBIFS: reserved for root:  103599 bytes (101 KiB)
<5>UBI: attaching mtd16 to ubi4
<5>UBI: physical eraseblock size:   131072 bytes (128 KiB)
<5>UBI: logical eraseblock size:    129024 bytes
<5>UBI: smallest flash I/O unit:    2048
<5>UBI: sub-page size:              512
<5>UBI: VID header offset:          512 (aligned 512)
<5>UBI: data offset:                2048
<5>UBI: max. sequence number:       0
<5>UBI: attached mtd16 to ubi4
<5>UBI: MTD device name:            "cfg_sec"
<5>UBI: MTD device size:            4 MiB
<5>UBI: number of good PEBs:        32
<5>UBI: number of bad PEBs:         0
<5>UBI: number of corrupted PEBs:   0
<5>UBI: max. allowed volumes:       128
<5>UBI: wear-leveling threshold:    4096
<5>UBI: number of internal volumes: 1
<5>UBI: number of user volumes:     0
<5>UBI: available PEBs:             26
<5>UBI: total number of reserved PEBs: 6
<5>UBI: number of PEBs reserved for bad PEB handling: 2
<5>UBI: max/mean erase counter: 16/14
<5>UBI: image sequence number:  1043577473
<5>UBI: background thread "ubi_bgt4d" started, PID 364
<5>UBIFS: default file-system created
<5>UBIFS: mounted UBI device 4, volume 0, name "cfg_sec"
<5>UBIFS: file system size:   2193408 bytes (2142 KiB, 2 MiB, 17 LEBs)
<5>UBIFS: journal size:       1032193 bytes (1008 KiB, 0 MiB, 6 LEBs)
<5>UBIFS: media format:       w4/r0 (latest is w4/r0)
<5>UBIFS: default compressor: lzo
<5>UBIFS: reserved for root:  103599 bytes (101 KiB)

 

[alastairstevenson]

<6>Unpacking initramfs... <0>Initramfs unpacking failed: junk in compressed archive

Hmmm.. the same error.
But try the 1-line 'downgrader', the 4-line has been known to be troublesome.

There are quite a few hits on the forum search for 'junk in compressed archive', which may be a deliberately misleading error message. in my view.
Here is just one Hikvision DS-2CD2132F-IS bricked, in search of help

 

[John Wolf]

OK, tomorrow I will try the 1-line as well as grabbing the mtdblock6 from my other camera and put it on the bricked one...and search some more for the "junk in compressed archive" error.

Thanks again for your replies. Sounds like you have dealt with this same issue before!

 

[John Wolf]

OK, PROGRESS! I checked out the other camera that I got at the same time and from the same reseller and it had a CCCH serial number. So, I grabbed the Chinese 5.2.5 firmware from a post by fenderman, and it flashed fine. After reboot, everything is in Chinese, but I think I can dig through the threads to find out how to get them back to english. If nothing else, I can leave it in Chinese and just use the other camera to help me figure out where everything is.

I am really hesitant in trying to save the mtd6 from the other camera on the off chance I run the camera out of space or cause it to brick for whatever reason.

 

[John Wolf]

Annnd with the Full English mtd hack, I am back to english menus as well. Thank you alastairstevenson

 

[alastairstevenson]

Excellent! Well done for persisting and getting there.
Transplanting the mtdblock5&6 would actually have involved the same steps as the 'MTD hack' as you'd need to modify the MAC address, and therefore the checksum, to remove a duplicate device on the LAN.

 

[John Wolf]

Ahh, very good point on the MAC address. Even after reading the mtd hack thread, I don't know that I would have realized that I would need to mod the MAC address on copied mtdblock files (keeping the checksum the same).

Lucked out!