Hikvision camera admin password reset tool

Discussion in 'Hikvision' started by bp2008, Mar 11, 2015.

Share This Page

  1. bp2008

    bp2008 Staff Member

    Joined:
    Mar 10, 2014
    Messages:
    4,673
    Likes Received:
    1,717
    If you have ever locked yourself out of a Hikvision camera or NVR by forgetting the admin password, and had to beg Hikvision or anyone else for an unlock code, you will appreciate this. I present a small tool that lets you generate your own unlock codes which can be entered into SADP to reset the admin password on any of your Hikvision cameras. This tool is written in HTML/CSS/JavaScript so it runs in any modern web browser and you can view the complete source code easily.

    Disclaimer: This tool may or may not work for your camera or NVR. Please follow the instructions very carefully and be precise in all your inputs into the tool. Some devices on newer firmware require a more secure password reset procedure which I can not help with. I think this tool will only work with cameras running firmware older than 5.3.0. I do not know what version is the cutoff for NVRs.

    Update:
    Some Hikvision devices (perhaps only NVRs) show their model number appended to the beginning of their serial numbers. You must remove this from the serial number that you enter into the tool. For example, if the serial number shows as DS-7208HVI-ST0123456789AAWR987654321WCVU and the device's model number is DS-7208HVI-ST, then the true serial number is 0123456789AAWR987654321WCVU

    Without further ado, here is a link so you can use it without downloading anything: Hikvision Password Reset Tool

    [​IMG]

    Inside this spoiler block is the complete source code which you can write to a .html file on your computer, allowing you to use it offline.
    HTML:
    <html>
    <head>
        <title>Hikvision Password Reset</title>
        <script type="text/javascript">
            function padLeft(str, l, c) { str = str + ""; return Array(l - str.length + 1).join(c || " ") + str }
            function initialize()
            {
                document.getElementById("year").value = new Date().getYear() + 1900;
                document.getElementById("month").value = padLeft(new Date().getMonth() + 1, 2, '0');
                document.getElementById("day").value = padLeft(new Date().getDate(), 2, '0');
    
                document.getElementById("serialNumber").onchange = GenerateSerialCode;
                document.getElementById("year").onchange = GenerateSerialCode;
                document.getElementById("month").onchange = GenerateSerialCode;
                document.getElementById("day").onchange = GenerateSerialCode;
            }
            function GenerateSerialCode()
            {
                var serialNumber = document.getElementById("serialNumber").value;
                var year = document.getElementById("year").value;
                var month = document.getElementById("month").value;
                var day = document.getElementById("day").value;
                var plainText = serialNumber + year + month + day;
    
                var magicNumber = 0;
                for (var i = 0; i < plainText.length; i++)
                    magicNumber += (plainText.charCodeAt(i) * (i + 1)) ^ (i + 1);
    
                magicNumber *= 1751873395;
                magicNumber = magicNumber >>> 0; // convert to 32 bit integer
    
                var magicWord = magicNumber + "";
                var serialCode = "";
                for (var i = 0; i < magicWord.length; i++)
                {
                    var c = magicWord.charCodeAt(i);
                    if (c < 51)
                        serialCode += String.fromCharCode(c + 33);
                    else if (c < 53)
                        serialCode += String.fromCharCode(c + 62);
                    else if (c < 55)
                        serialCode += String.fromCharCode(c + 47);
                    else if (c < 57)
                        serialCode += String.fromCharCode(c + 66);
                    else
                        serialCode += String.fromCharCode(c);
                }
    
                document.getElementById("output").innerHTML = serialCode;
            }
            window.onload = initialize;
        </script>
        <style type="text/css">
            body
            {
                width: 450px;
            }
            .description
            {
                margin: 20px 0px;
            }
            .label
            {
                margin: 10px 0px;
            }
            .input
            {
                margin-bottom: 10px;
            }
            #output
            {
                font-weight: bold;
                border: 1px solid black;
                padding: 10px;
                font-size: 2em;
                max-width: 100%;
            }
        </style>
    </head>
    <body>
        <div><h2>Hikvision Camera Password Reset Utility</h2></div>
        <div class="description">This tool will generate a <b>password reset code</b> which you may use to reset a forgotten admin password for a Hikvision camera.</div>
        <div class="label">Enter your camera's complete CASE SENSITIVE serial number, as seen in the <a href="http://www.google.com/search?q=Hikvision%20SADP">Hikvision SADP</a> tool:</div>
        <div class="input"><input type="text" id="serialNumber" style="width: 100%" placeholder="Hikvision Camera Serial Number" /></div>
        <div class="label"><b>Important:</b> The date you enter below much match with the camera's clock. <b>Most likely it is not today's date!</b> To find out what date your camera thinks it is, power cycle your camera, give it time to boot up, and then refresh your camera list in SADP and check the Start Time column.</div>
        <div class="label">Enter the <b>4 digit</b> year the camera thinks it is:</div>
        <div class="input"><input type="text" id="year" style="width: 20%" /></div>
        <div class="label">Enter the <b>2 digit</b> month the camera thinks it is:</div>
        <div class="input"><input type="text" id="month" style="width: 20%" /></div>
        <div class="label">Enter the <b>2 digit</b> day the camera thinks it is:</div>
        <div class="input"><input type="text" id="day" style="width: 20%" /></div>
        <div class="label">Your <b>password reset code</b> will appear below.</div>
        <div id="output"></div>
        <div class="label">The code must be entered into the <a href="http://www.google.com/search?q=Hikvision%20SADP">Hikvision SADP</a> tool in the <b>Serial code</b> box (called <b>Security Code</b> in later SADP versions). The camera will compare its internal date and time with the date and time you have entered above. The Serial Number and date much match perfectly or else the code will not work.</div>
    </body>
    </html>
    
    Some will say it is irresponsible to publish this. I disagree. Evidently a number of people outside of Hikvision have possessed the ability to generate these codes for a while now. I found this (similar) functionality freely available for download elsewhere, so I really don't feel bad about releasing this and making it a bit easier to recover your cameras.
     
    Last edited: Feb 5, 2016
    GoNz0, gth, Arnaldo Murillo and 70 others like this.
  2. fenderman

    fenderman Staff Member

    Joined:
    Mar 9, 2014
    Messages:
    17,869
    Likes Received:
    3,559
    Very cool! awesome!
     
    insteek likes this.
  3. DaveP

    DaveP Getting the hang of it

    Joined:
    Nov 18, 2014
    Messages:
    273
    Likes Received:
    55
    Location:
    Dumfriesshire
    Well done bp2008

    I could of done with this a couple of hours ago, lol
     
  4. bp2008

    bp2008 Staff Member

    Joined:
    Mar 10, 2014
    Messages:
    4,673
    Likes Received:
    1,717
    heh heh, I wasn't done with this a couple hours ago.
     
  5. DaveP

    DaveP Getting the hang of it

    Joined:
    Nov 18, 2014
    Messages:
    273
    Likes Received:
    55
    Location:
    Dumfriesshire
    Just tested on my NVR (for no good reason, other than seeing if it worked on NVRs as well as cameras)

    In the serial number from SADP, take out the beginning part of the serial which is the model number
     
  6. bp2008

    bp2008 Staff Member

    Joined:
    Mar 10, 2014
    Messages:
    4,673
    Likes Received:
    1,717
    Cool, I tried it with a Swann branded Hikvision cam and didn't have to remove anything from the serial. So that must just be a quirk of the NVR.
     
    DaveP likes this.
  7. Mike

    Mike Staff Member

    Joined:
    Mar 9, 2014
    Messages:
    1,442
    Likes Received:
    536
    Location:
    New York
    This is awesome, many thanks for sharing! This will definitely come in handy for many.

    Thread made sticky.
     
  8. networkcameracritic

    networkcameracritic Getting the hang of it

    Joined:
    Mar 10, 2014
    Messages:
    719
    Likes Received:
    200
  9. iTuneDVR

    iTuneDVR Getting the hang of it

    Joined:
    Aug 23, 2014
    Messages:
    235
    Likes Received:
    26
    Location:
    www.iTuneDVR.ru
  10. Sakuji

    Sakuji Young grasshopper

    Joined:
    Dec 2, 2014
    Messages:
    48
    Likes Received:
    1
    Really awesome, man!
    More power to you!
     
  11. karmadhi

    karmadhi Young grasshopper

    Joined:
    Mar 11, 2015
    Messages:
    36
    Likes Received:
    9
    doesn't work on Chinese cameras
     
  12. bp2008

    bp2008 Staff Member

    Joined:
    Mar 10, 2014
    Messages:
    4,673
    Likes Received:
    1,717
    Are you sure about that? There need to be no errors at all in the serial number, and the year has to be 4 digits ("2015"), month 2 digits ("03"), day 2 digits ("12"), and the camera's internal clock needs to match the date you entered on the form. I do admit though I did not try it with a Chinese camera, only one from USA.
     
  13. karmadhi

    karmadhi Young grasshopper

    Joined:
    Mar 11, 2015
    Messages:
    36
    Likes Received:
    9
    yeah i tried a couple of times, the cameras clock matched the one on the form. tied two different cameras but still nothing. both of them Chinese.
     
  14. bp2008

    bp2008 Staff Member

    Joined:
    Mar 10, 2014
    Messages:
    4,673
    Likes Received:
    1,717
    I will try one of my chinese cams when I get home. Maybe something needs to be taken out of the serial number like with an NVR...
     
  15. bp2008

    bp2008 Staff Member

    Joined:
    Mar 10, 2014
    Messages:
    4,673
    Likes Received:
    1,717
    Tested on a chinese 2332 and it worked fine. Full serial number, today's date, no trouble at all.

    [​IMG]
     
    catseyenu likes this.
  16. RyanODan

    RyanODan IPCT Vendor

    Joined:
    Mar 10, 2014
    Messages:
    401
    Likes Received:
    155
    Location:
    Tulsa
    Simply amazing. The time and trouble you've saved everyone is priceless. Thank you for sharing!
     
  17. karmadhi

    karmadhi Young grasshopper

    Joined:
    Mar 11, 2015
    Messages:
    36
    Likes Received:
    9
    thank you. it worked. apparently i was doing something wrong.
     
  18. whoslooking

    whoslooking Known around here

    Joined:
    Oct 3, 2014
    Messages:
    1,452
    Likes Received:
    507
    Location:
    London
    Thanks for sharing, this can make life a lot easier for a lot of Engineers.
     
  19. siknit

    siknit n3wb

    Joined:
    Mar 29, 2015
    Messages:
    1
    Likes Received:
    1
    vasycara likes this.
  20. Arrowhawk

    Arrowhawk n3wb

    Joined:
    Apr 27, 2015
    Messages:
    5
    Likes Received:
    0
    Hi, I have just bought a new DS-7608NI-E2/8P from a Chinese seller, and when trying to log in for the first time it is telling me the password 12345 is wrong. I have emailed the seller for the reset code however have not had any reply yet.

    I have tried resetting the password using this tool however keep getting the message password recovery failed. I have tried the full serial number and by deleting the model number from the start.

    Has anyone else successfully used this reset tool with this model NVR?

    Thanks.
     
  21. bp2008

    bp2008 Staff Member

    Joined:
    Mar 10, 2014
    Messages:
    4,673
    Likes Received:
    1,717
    Unfortunately I don't have a Hikvision NVR to test with so I can't suggest anything you haven't already tried. Every single character (including capitalization) matters, so even if you have an extra space at the start or end, that could be a problem.
     
    Arrowhawk likes this.
  22. iTuneDVR

    iTuneDVR Getting the hang of it

    Joined:
    Aug 23, 2014
    Messages:
    235
    Likes Received:
    26
    Location:
    www.iTuneDVR.ru
    TFTP and password will 12345 or correct use original algorithm ;)
    All is work.
    There are just differences in the use of the algorithm for the IPC and DVR, NVR!
     
  23. iTuneDVR

    iTuneDVR Getting the hang of it

    Joined:
    Aug 23, 2014
    Messages:
    235
    Likes Received:
    26
    Location:
    www.iTuneDVR.ru
    All work fine before you publication and after!
    Algorithm is the same ;)
     
  24. Arrowhawk

    Arrowhawk n3wb

    Joined:
    Apr 27, 2015
    Messages:
    5
    Likes Received:
    0
    I have just tried a firmware update with the Hikvision TFTP tool, however get the error
    [2015-05-11 18:53:11] Open file failure[C:\Auto Update\econt_Vision-AV2000]

    The firmware file in the directory is digicap.dav, so I am unsure where this filename is coming from. A quick Google search lists others with the same issue but no immediate solution.

    I may be best to wait for the reset code from the seller.
     
  25. iTuneDVR

    iTuneDVR Getting the hang of it

    Joined:
    Aug 23, 2014
    Messages:
    235
    Likes Received:
    26
    Location:
    www.iTuneDVR.ru
    Nevermind about it. It's after correct boot your NVR.
    This mean that your NVR doesn't catch TFTP Server sowtware via 69 UDP port!!!
    Make sure that you have one LAN adapter with correct IP and of couse check firewall and etc.
     
    Last edited by a moderator: May 11, 2015
    Arrowhawk likes this.
  26. alastairstevenson

    alastairstevenson Known around here

    Joined:
    Oct 28, 2014
    Messages:
    5,482
    Likes Received:
    1,216
    Location:
    Scotland
    That's not an error - it's just a loose end lying around in the firmware that appears after it's fully booted.
    Did you follow the Hik instruction pages on the use of their TFTP tool?
    You should see a log entry in TFTP when you start the NVR showing the NVR 'testing' the TFTP tool. If that doesn't show, something in your setup is not correct.
    It's important that both the PC, with its IP address of 192.0.0.128, and the NVR, are both connected to live ports on a switch or router for the whole process.
     
    Arrowhawk likes this.
  27. Oleglevsha

    Oleglevsha Getting the hang of it

    Joined:
    Jan 25, 2015
    Messages:
    107
    Likes Received:
    18
    iTuneDVR, привет, я не пойму, он не может обновиться с помощью Tftp или что?
     
  28. iTuneDVR

    iTuneDVR Getting the hang of it

    Joined:
    Aug 23, 2014
    Messages:
    235
    Likes Received:
    26
    Location:
    www.iTuneDVR.ru
    Олег!
    Да. Почему-то не срабатывает у него через tftp и его смущает ареконовская надпись и сбросить пароль не может через опубликованный алгоритм.
    Вообщем всё как обычно ;)
    Как сам?
     
    Last edited by a moderator: May 11, 2015
  29. Oleglevsha

    Oleglevsha Getting the hang of it

    Joined:
    Jan 25, 2015
    Messages:
    107
    Likes Received:
    18
    Нормально, спасибо, в прошивке v3.3.0 изменили адрес tftp сервера.
     
    Last edited by a moderator: May 11, 2015
  30. iTuneDVR

    iTuneDVR Getting the hang of it

    Joined:
    Aug 23, 2014
    Messages:
    235
    Likes Received:
    26
    Location:
    www.iTuneDVR.ru
    Да, это я в курсе, но тут как всегда вопрос задают без каких либо подробностей о деле. Вот я про что! ;)
    Потому и написал, что нужно указать корректный ip адрес на ПК.
    Пусть трахают мозг техподдержке и продаванам чинайским, может что-то дойдёт до них и до тех и до других ;)