Hikivision - IP Cam - How to Force a firmware into an IP CAM

[tazman]

Hello,

I have Hikvision cameras bought from Aliexpress: DS-2CD3145F
One of them is no more working since I decided to try to flash the firmware with a new. Actually, using the RS232 and U-Boot I used a command which clear all the partitions (what I saw) and try to download a new firmware. The trouble is none firmware coming from Hikvision website (europe, asia and US) was uploaded into the cam and I had have to abort the upload into the cam. Conclusion, the IP cam has no more OS, just only the U-boot section working.
So, does someone can give me the firmware for this cam, and explain how to force the upload of it into the cam ?
Other solution, I have another one which works fine, so does someone managed to extract the firmware and managed to import it to a bricked IP cam ?

Thank you very much
Sebastien

 

[ipcamuser11]

Either you downloaded the wrong platform firmware or it’s a Chinese model, you can only install Chinese firmware. What’s the platform of this camera? I can find the correct firmware for you

 

[tazman]

To be honest I don't know. I tried to check on the xls sheets coming from hikvision but this model is not present. May be on the PCB ? Do you know where ?

I tried to upload several G0, G1 and so on firmwares as well, without success.
Sometime i've go a missmatch message and sometime a message which told me there's no acknolodgement return (timeout)

 

[tazman]

When I power on the ip cam I have the following:

U-Boot 2010.06-209953 (Jul 29 2016 - 10:09:34)␍␊
␍␊
NAND: 128 MB␍␊
*** Warning - bad CRC or NAND, using default environment␍␊
␍␊
Hit Ctrl+u to stop autoboot: 3 <0x08><0x08><0x08> 2 <0x08><0x08><0x08> 1 <0x08><0x08><0x08> 0 ␍␊
ETH0: PHY(phyaddr=3, mii) link UP: DUPLEX=FULL : SPEED=100M␍␊
MAC: 4C-BD-8F-DC-74-95␍␊
NUL ethaddr| TFTP server not found␍␊
main and bakup partition are broken, please upgrade after reboot!␍␊
booting from pri partition...␍␊
Load kernel to 0x80007fc0 ... ␍␊
do_load_kernel: uImage data size(0xffffffff byte) err!␍␊
Fail!␍␊
set_upg_fail_flag: upg flags has been set fail!␍␊
booting from sec partition...␍␊
Load kernel to 0x80007fc0 ... ␍␊
do_load_kernel: uImage data size(0xffffffff byte) err!␍␊
Fail!␍␊
set_upg_fail_flag: upg flags has been set fail!␍␊
main and bakup partition are broken, please upgrade after reboot!␍␊
resetting ...␍␊


So I assume I can download using TFTP, from another ip cam which is the same model, the kernel starting from 0x80007fc0 with a size of 0x8000000 (128 MB) and then reload it into this cam ?

 

[tazman]

About features supported by the booloader, here are the commands:
? - alias for 'help'␍␊
base - print or set address offset␍␊
bootss - boot from snapshot image␍␊
cmp - memory compare␍␊
cp - memory copy␍␊
crc32 - checksum calculation␍␊
ddr - ddr training function␍␊
format - format flash except bootloader area␍␊
go - start application at address 'addr'␍␊
help - print command description/usage␍␊
loadk - load kernel to DRAM␍␊
loop - infinite loop on address range␍␊
md - memory display␍␊
mii - MII utility commands␍␊
mm - memory modify (auto-incrementing address)␍␊
mtest - simple RAM read/write test␍␊
mw - memory write (fill)␍␊
nm - memory modify (constant address)␍␊
ping - send ICMP ECHO_REQUEST to network host␍␊
printenv- print environment variables␍␊
reset - Perform RESET of the CPU␍␊
saveenv - save environment variables to persistent storage␍␊
setenv - set environment variables␍␊
update - update digicap.dav␍␊
updateb - update bootloader␍␊
upf - update firmware, format and update (factory use)␍␊
version - print monitor version␍␊
HKVS #

about TFPT update command:
TFTP from server 192.168.1.128; our IP address is 192.168.1.64␍␊
Download Filename 'digicap.dav'.␍␊
Download to address: 0x82000000␍␊
Downloading:

But for any firmware found on global and china hikvision site It goes into timeout

 

[watchful_ip]

I think you are looking for IPC_G0_CN_STD_5.5.82_190130.zip or similar.

Have a look on hikvision.com/cn or web search.

 

[ipcamuser11]

I think you are looking for IPC_G0_CN_STD_5.5.82_190130.zip or similar.

If it's really G0 platform, try this firmware

 

[tazman]

Hi, thank you. This firmware is uploaded and accepted by the cam but...
The linux kernel does not work fine, ioctl et db are not working and you have a lot of error
Using a browser and trying to access to the webserver into the cam I have :

http://192.168.1.64/notSupported.asp

==>
Access Error: 404 -- Not Found

Can't locate document: /notSupported.asp

So I guess the platform is G0 but this version of firmware does not support this hardware. If you have an older one (can't find it on CN portal)

 

[ipcamuser11]

Can you share the serial number and current firmware version?

 

[tazman]

HKVS # upf
Erasing [env] .
Erasing at 0x160000 -- 100% complete.
done

Erasing [sys0] .
Erasing at 0xb60000 -- 100% complete.
done

Erasing [sys1] .
rasing at 0x1360000 -- 100% complete.
done

Erasing [app0] .
Erasing at 0x3960000 -- 100% complete.
done

Erasing [app1] .
Erasing at 0x5f60000 -- 100% complete.
done

Erasing [cfg0] .
Erasing at 0x6360000 -- 100% complete.
done

Erasing [cfg1] .
Erasing at 0x6760000 -- 100% complete.
done

Erasing [syslog] .
Erasing at 0x7760000 -- 100% complete.
done

ETH0: PHY(phyaddr=3, mii) link UP: DUPLEX=FULL : SPEED=100M
MAC: XXXXX
TFTP from server 192.168.1.128; our IP address is 192.168.1.64
Download Filename 'digicap.dav'.
Download to address: 0x82000000
Downloading: *# [ Connected ]
################################ [20.000 MB]
##############################
done
Bytes transferred = 21970268 (14f3d5c hex)
Found 1 packets.

Erasing at 0x200000 -- 100% complete.
data length:0x800, include bad block length: 0x20000

Erasing at 0x220000 -- 100% complete.
data length:0x800, include bad block length: 0x20000
Erasing [sys0] .
Erasing at 0xb60000 -- 100% complete.
done
Erasing [sys1] .
Erasing at 0x1360000 -- 100% complete.
done
Erasing [app0] .

Erasing at 0x3960000 -- 100% complete.
done
Erasing [app1]

Erasing at 0x5f60000 -- 100% complete.
done

start to write files to partition app0...
yaffs: Mounting /nand/
[0]16-1. write /nand/_cfgUpgClass len: 996
data length:0x444000, include bad block length: 0x460000
[0]16-2. write /nand/uImage len: 4471464
[0]16-3. write /nand/initrun.sh len: 10654
[0]16-4. write /nand/IEfile.tar.gz len: 3396392
[0]16-5. write /nand/r7_app.tar.gz len: 2298
[0]16-6. write /nand/g0_app.tar.gz len: 7891748
[0]16-7. write /nand/help.tar.gz len: 238830
[0]16-8. write /nand/SoftwareLicense.txt len: 98846
[0]16-9. write /nand/cap.json len: 587
[0]16-10. write /nand/g0_modules.tgz len: 3232792
[0]16-11. write /nand/mpp_modules.tgz len: 1103294
[0]16-12. write /nand/libr7_isp_ipc.so.tar.gz len: 335670
[0]16-13. write /nand/libcrypto.so.tar.gz len: 366297
[0]16-14. write /nand/libsqlite3.so.tar.gz len: 186468
[0]16-15. write /nand/libzoomcam_ipc.so.tar.gz len: 593312
[0]16-16. write /nand/libmcu.so len: 35392
update partition 0 success!
save exit: isCheckpointed 1

start to write files to partition app1...
yaffs: Mounting /nand/
[0]16-1. write /nand/_cfgUpgClass len: 996
data length:0x444000, include bad block length: 0x460000
[0]16-2. write /nand/uImage len: 4471464
[0]16-3. write /nand/initrun.sh len: 10654
[0]16-4. write /nand/IEfile.tar.gz len: 3396392
[0]16-5. write /nand/r7_app.tar.gz len: 2298
[0]16-6. write /nand/g0_app.tar.gz len: 7891748
[0]16-7. write /nand/help.tar.gz len: 238830
[0]16-8. write /nand/SoftwareLicense.txt len: 98846
[0]16-9. write /nand/cap.json len: 587
[0]16-10. write /nand/g0_modules.tgz len: 3232792
[0]16-11. write /nand/mpp_modules.tgz len: 1103294
[0]16-12. write /nand/libr7_isp_ipc.so.tar.gz len: 335670
[0]16-13. write /nand/libcrypto.so.tar.gz len: 366297
[0]16-14. write /nand/libsqlite3.so.tar.gz len: 186468
[0]16-15. write /nand/libzoomcam_ipc.so.tar.gz len: 593312
[0]16-16. write /nand/libmcu.so len: 35392
update partition 1 success!
save exit: isCheckpointed 1

Upgrade success!
auto reboot now
resetting ...

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
Starting udev: [ OK ]
diagnose_way = 32, repair_way = 0, interval = 60 ping_timeout = 1, ping_count = 1
route: ioctl 0x890c failed: No such process
libdadsp.so
hikdsp.lzma
sound.tar.gz
....
[PACK][DBG_INFO][src/firm_unpack_lib.c][firm_pack_decode][183]:iPackIdx=0,iPackFlg=0x00650100,iPlatform=101,iDevMajor=111,iDevMinor=111,iLanguage=2
BusyBox v2.0.0-621376 Protect Shell (psh)

wait davinci set default...
[01-01 03:19:21][pid:0][OTHER][ERROR]daemon can not find Dst process.load_type 0x10012 is_need_ack 1
[01-01 03:19:21][pid:1191][OTHER][ERROR] from daemon ack, dst not work len 0 , load_type is [0x10012]
[01-01 03:19:21][pid:1191][UNI_IF][ERROR]65554:ipc_unix_call_service failed, ret = -3.
[01-01 03:19:21][pid:1191][UNI_IF][ERROR]communicaite_to_davinci failed!!!
[01-01 03:19:22][pid:0][OTHER][ERROR]daemon can not find Dst process.load_type 0x10012 is_need_ack 1
[01-01 03:19:22][pid:1191][OTHER][ERROR] from daemon ack, dst not work len 0 , load_type is [0x10012]
[01-01 03:19:22][pid:1191][UNI_IF][ERROR]65554:ipc_unix_call_service failed, ret = -3.
[01-01 03:19:22][pid:1191][UNI_IF][ERROR]communicaite_to_davinci failed!!!

 

[tazman]

Can you share the serial number and current firmware version?

For serial that's DS2CD3145F-IWS 832701229 and the previous firmware (because there's no more fimware in it) was 5.5.0_170728

 

[ipcamuser11]

From serial number I can confirm that it’s a Chinese domestic model, newest firmware attached

 

[wittaj]

I hope you know Chinese lol

 

[tazman]

same result, it goes into the cam, the update has been done, uncompressing kernel is ok but during the boot you have a lot of errors
It's like hardware is compliant with firmware ?

 

[ipcamuser11]

Guess the seller made some modifications to the system info mtdblock, to allow a modified English firmware on a Chinese model, so you can’t install the original firmware on it, either English or Chinese. Try searching for the mtd hack thread on this forum

 

[wittaj]

For future people that find this thread, this thread serves as a lesson that is preached here....You really need to be asking yourself why are you updating? If it is just for grins and giggles or OCD behavior to be running the latest firmware, think twice.

A common theme around here is don't fix what ain't broke. If the unit is working and meets your needs, in many instances an update breaks what you had working and provides you with something you didn't need or bricks the camera. In most instances, updates are simply security vulnerability patches (usually years after the breach was found), but since we do not give our cameras internet access, the update is useless to us.

Unless the release notes specifically mention it fixing a problem you are experiencing, more than likely it won't fix an issue and may make the camera worse by removing functionality or worse brick it.

Further, it is best to obtain any firmware updates from the vendor you purchased it from so that you do not run into issues. Any firmware you find here or elsewhere is obviously proceed at your own risk. We have many threads here where someone tried an update with a firmware they found on the internet and bricked their unit.

Many units being sold are Chinese hacked units into English that will either brick or go into Chinese upon updating. Some vendors will be upfront and tell consumers that as part of their posting on AliExpress or elsewhere, but many do not or the consumer forgets...here is one such example....

 

[watchful_ip]

How about if you access the camera with Internet Explorer?

I also assume it shows up on SADP OK.

None of the message errors on boot appear to be abnormal to me for this older platform.

 

[tazman]

How about if you access the camera with Internet Explorer?

I also assume it shows up on SADP OK.

None of the message errors on boot appear to be abnormal to me for this older platform.

using IE, I have a 404 and the cam try to publish the notSupported.asp page (which should tell me this device is not supported, i guess)
Nothing on SADP

 

[watchful_ip]

Both of these firmware files are on hikvision.com/cn

IPC_G0_CN_STD_5.5.88_200602.zip
IPC_G0_CN_STD_5.5.88_200610.zip

Make sure both were tried. I suspect it may not help though as one of them is in the 2XXX firmware package.

 

[alastairstevenson]

(which should tell me this device is not supported, i guess)

No - it's saying the browser is not supported. Not the firmware.
You definitely using IE11? Not reverted automatically to Edge?
Try Edge in IE11 mode.