@alastairstevenson
Yes I do and Putty as all my cameras are ex Ebay or Alibaba I put it together as a back up plan before I pushed the firmware upgrade button the first time.
Have only used it to view the boot up of two NVR’s and one camera.
I heading to a remote location tomorrow and will need to test it on a NVR there as I now have win 10 and had to down grade the driver to day to remove device error. (Pl2303 HXA clone)
I am a windows guy only and at present don’t have a working Linux set up.
If need I will set it up again as a dual boot on my laptop.
That should be OK.
The Hikvision tftp updater is a Windows program, and PuTTY works best in Windows.
Given that the firmware is a match for the camera, and that the camera isn't a Chinese model (serial number does not suggest that), if the updater isn't being probed for by the bootloader, the 'update' command in the serial console should do the job.
But it would be interesting first to see what (remaining) commands the bootloader has.
With luck there may be some flash commands that would allow a flash dump, with the potential for a password extract ...
But it would be interesting first to see what (remaining) commands the bootloader has.
With luck there may be some flash commands that would allow a flash dump, with the potential for a password extract ...
Yes indeed.
The first action would be to interrupt the bootloader.
Then 'printenv' to see the environment variables, and 'help' to list the apparently available commands.
Saved to Notepad or similar as a text file from the PuTTY 'copy all to clipboard' menu for the as-is status.
Then maybe a transcript of the full bootup, which is likely to end at a 'psh' Hikvision protected shell prompt.
Hi Alistair and dgwasw. First thanks dg, and yes that is my camera in every respect, right down to the firmware. So where to from here?
I note you are going to a remote location tomorrow -and possibly "off grid"?
I shall contact my Tech here in Brisbane and let him know I am putting everything on hold pending an outcome from your investigations
Then we need to commence some private message just so the world does not obtain our personal contact details - does such a facility exist on this forum?
For myself, I have always been prepared to pay someone to "fix" the cameras and that has not changed, I was just feeling it was no longer possible
So - I can send you a single camera to try, or the whole eight if that works, just let me know what works for you?
I can see between Alistair and yourself, you seem to already have the problems just about solved?
Then we need to commence some private message just so the world does not obtain our personal contact details - does such a facility exist on this forum?
I suggest only one as we don’t know what the outcome will be yet. Also Alastair may be able to decode the password. If you send the one that the second tech had them I suggest two as we don’t know what he may have done.
Had a test run with Tftp on my spare camera today, it only took a few minutes to update the camera back to defaults and plug and play to the NVR. Have attached status report of the update.
That's great guys, private message sent to dg. I have just spoken to my local tech who is pleased I may have some help to make the cameras work, said it was very easy to make "bricks"
He is going to pick up the camera I loaned him from storage and return same over the next few days.
And clearly he is still happy to assist with purchase of new cameras should that be the outcome (I hope not)
It works! All seven cameras in my possession now running again thanks to the patience and perseverance of Alistair and "my new best friend in Aussie"- dgwasw
He took me through all the steps, one by one, never doubting we could make this happen - and we did, so thanks very much guys, you saved me around $1500 for replacement cameras.
I now have one camera still to go - the one my local "tech" took away to try and work on a fix, but never got there - he has indicated it will be returned this week so no harm done
Clearly I am not the right person to advise anyone how to repeat this process but my understanding is that the process is not unknown, just that it is critical to get the correct firmware before you start - model and build specific seems to have been the key. Alistair may want to comment on this? Thanks again to all who helped with this issue
Hmmmm……… well, I got the 8th camera back yesterday from my tech - not a happy man, said he "did not like my attitude" since I had put the hard word on him to return the camera after two failed delivery dates passed, I even offered to come to him and pick it up, all politely. I suspect he was upset at 1/ not getting a sale for 8 new cameras, or 2/ being shown up by some dumb end user who fixed, with outside help, what he seemed incapable of doing - even with expert backup!
I adopted the same "re-install" procedure to make this last camera go and quickly had it running the same as the others, so a great outcome!
Now with the same help I hope to recover the password said "tech" installed in the NVR as he was un-willing to give it to me, saying he did not install any password when he re-booted the NVR? This would appear very unlikely but with help I understand there is a work around to obtain the password, which dgwasw has very kindly offered to work through with me. I believe Alistair will need to help us with the de-coding of a file once it is extracted?
Congratulations to both Alistair and dgwasw for a job well done! My heartfelt thanks go out to these two gents and anyone else who has contributed to the knowledge base which now sees my "post security upgrade" by HIK Vision CCTV system back on track, fully functional, nothing bricked and a now a known password once more. No help whatever from HIK Vision who abandoned me and many like me because we purchased our system from a "non approved" distributor. When Alistair posted back the password from coded files I had sent, I was almost afraid to test it - I need not have been, worked like a charm! That is not to mention the hours behind the scene with dgwasw gently guiding me through, step by little step - over the internet and by phone. I am 72 y/o and with no experience in this field at all, indeed felt I was wasting my time trying but dgwasw kept with me all the way. These are cameras and NVR that are built to be very secure and by my thinking they are but the genius pool on this forum have cracked the system and we may now use the product we purchased once more, even after we loose the password! Thanks heaps people!
If you have ever locked yourself out of a Hikvision camera or NVR by forgetting the admin password, and had to beg Hikvision or anyone else for an unlock code, you will appreciate this. I present a small tool that lets you generate your own unlock codes which can be entered into SADP to reset the admin password on any of your Hikvision cameras. This tool is written in HTML/CSS/JavaScript so it runs in any modern web browser and you can view the complete source code easily.
Disclaimer: This tool may or may not work for your camera or NVR. Please follow the instructions very carefully and be precise in all your inputs into the tool. Devices on newer firmware require a more secure password reset procedure which I can not help with. I think this tool will only work with cameras running firmware older than 5.3.0. I do not know what version is the cutoff for NVRs.
Some Hikvision devices (perhaps only NVRs) show their model number appended to the beginning of their serial numbers. You may need to remove this from the serial number that you enter into the tool. For example, if the serial number shows as DS-7208HVI-ST0123456789AAWR987654321WCVU and the device's model number is DS-7208HVI-ST, then the true serial number is 0123456789AAWR987654321WCVU
Inside this spoiler block is the complete source code which you can write to a .html file on your computer, allowing you to use it offline.
HTML:
<html>
<head>
<title>Hikvision Password Reset</title>
<script type="text/javascript">
function padLeft(str, l, c) { str = str + ""; return Array(l - str.length + 1).join(c || " ") + str }
function initialize()
{
document.getElementById("year").value = new Date().getYear() + 1900;
document.getElementById("month").value = padLeft(new Date().getMonth() + 1, 2, '0');
document.getElementById("day").value = padLeft(new Date().getDate(), 2, '0');
document.getElementById("serialNumber").onchange = GenerateSerialCode;
document.getElementById("year").onchange = GenerateSerialCode;
document.getElementById("month").onchange = GenerateSerialCode;
document.getElementById("day").onchange = GenerateSerialCode;
}
function GenerateSerialCode()
{
var serialNumber = document.getElementById("serialNumber").value;
var year = document.getElementById("year").value;
var month = document.getElementById("month").value;
var day = document.getElementById("day").value;
var plainText = serialNumber + year + month + day;
var magicNumber = 0;
for (var i = 0; i < plainText.length; i++)
magicNumber += (plainText.charCodeAt(i) * (i + 1)) ^ (i + 1);
magicNumber *= 1751873395;
magicNumber = magicNumber >>> 0; // convert to 32 bit integer
var magicWord = magicNumber + "";
var serialCode = "";
for (var i = 0; i < magicWord.length; i++)
{
var c = magicWord.charCodeAt(i);
if (c < 51)
serialCode += String.fromCharCode(c + 33);
else if (c < 53)
serialCode += String.fromCharCode(c + 62);
else if (c < 55)
serialCode += String.fromCharCode(c + 47);
else if (c < 57)
serialCode += String.fromCharCode(c + 66);
else
serialCode += String.fromCharCode(c);
}
document.getElementById("output").innerHTML = serialCode;
}
window.onload = initialize;
</script>
<style type="text/css">
body
{
width: 450px;
}
.description
{
margin: 20px 0px;
}
.label
{
margin: 10px 0px;
}
.input
{
margin-bottom: 10px;
}
#output
{
font-weight: bold;
border: 1px solid black;
padding: 10px;
font-size: 2em;
max-width: 100%;
}
</style>
</head>
<body>
<div><h2>Hikvision Camera Password Reset Utility</h2></div>
<div class="description">This tool will generate a <b>password reset code</b> which you may use to reset a forgotten admin password for a Hikvision camera.</div>
<div class="label">Enter your camera's complete CASE SENSITIVE serial number, as seen in the <a href="http://www.google.com/search?q=Hikvision%20SADP">Hikvision SADP</a> tool:</div>
<div class="input"><input type="text" id="serialNumber" style="width: 100%" placeholder="Hikvision Camera Serial Number" /></div>
<div class="label"><b>Important:</b> The date you enter below much match with the camera's clock. <b>Most likely it is not today's date!</b> To find out what date your camera thinks it is, power cycle your camera, give it time to boot up, and then refresh your camera list in SADP and check the Start Time column.</div>
<div class="label">Enter the <b>4 digit</b> year the camera thinks it is:</div>
<div class="input"><input type="text" id="year" style="width: 20%" /></div>
<div class="label">Enter the <b>2 digit</b> month the camera thinks it is:</div>
<div class="input"><input type="text" id="month" style="width: 20%" /></div>
<div class="label">Enter the <b>2 digit</b> day the camera thinks it is:</div>
<div class="input"><input type="text" id="day" style="width: 20%" /></div>
<div class="label">Your <b>password reset code</b> will appear below.</div>
<div id="output"></div>
<div class="label">The code must be entered into the <a href="http://www.google.com/search?q=Hikvision%20SADP">Hikvision SADP</a> tool in the <b>Serial code</b> box (called <b>Security Code</b> in later SADP versions). The camera will compare its internal date and time with the date and time you have entered above. The Serial Number and date much match perfectly or else the code will not work.</div>
</body>
</html>
Some will say it is irresponsible to publish this. I disagree. Evidently a number of people outside of Hikvision have possessed the ability to generate these codes for a while now. I found this (similar) functionality freely available for download elsewhere, so I really don't feel bad about releasing this and making it a bit easier to recover your cameras.
I believe you are looking at an entirely different approach to recovery of the password than that described above, so cannot comment
However Alistair or gdwasw will be able to put you straight. Good luck and may you soon be running again
Disclaimer: This tool may or may not work for your camera or NVR. Please follow the instructions very carefully and be precise in all your inputs into the tool. Devices on newer firmware require a more secure password reset procedure which I can not help with. I think this tool will only work with cameras running firmware older than 5.3.0. I do not know what version is the cutoff for NVRs.
That is correct. I used the application tool which is the http vulnerability to get the cameras password changed.
I then tried it with the NVR but it refused it.
I then tried the web paged based one linked in the first post of this thread, but I got errors 2022 and 2015 when using the serial number from the Hikvision app. Tried several combinations of the serial number. Just the digits at the end seemed to work to get those errors above. The rest were just invalid errors.
And yes that is the correct NVR model. No POE ports as I already had a POE swtich for some wireless gear.
