Hikvision DS-2032-I Console Recovery

[dknabe]

The reason I joined this forum was that my HIKVision DS-2032-I that I purchased on Amazon got bricked when I tried to update the firmware to V5.2.3 build141024 via the web interface.

TFTP via the network port does not seem to work properly. I used Wireshark to discover that it never goes out to port 69, but is expecting some kind of response on port 9978. Setting TFTP server to port 9978 did not help. So, the only option to recover appeared to be via the RS-232 interface. So now I have console access and can stop at either u-boot or the initial kernel/BusyBox terminal. From u-boot I can tftp load the latest firmware (named digicap.dav) from my tftpd-hpa server.

As I researched where to load the file in memory and save to flash, I discovered that there seems to be a war going on between IP camera distributors/HIVision on one side and users on the other side. Firmware seems to be region locked, and firmware updates seem to be prohibited across regions. The poor consumer knows nothing of this which can lead to the kind of problems I'm experiencing.

So it appears there are region codes embedded somewhere in flash that need to be changed to allow me to update and recover my camera. Any advise on where to gain information on region codes and u-boot tftp recovery is much appreciated.

Thanks!
Doug

 

[alastairstevenson]

You do need to use the Hikvision-specific TFTP server to be able to use the TFTP recovery method. There are links to the download in multiple posts, should still be possible to Google for it. I don't have a link to hand.
The access to port 9978 that you saw is the camera emitting a UDP packet with the Hikvision 'Magic number' SWKH to look for a Hikvision-specific response from the TFTP server. If the TFPT server provides the response (a UDP packet on 9979 with the Magic number in the payload), the camera will connect to it and attempt a download and install of digicap.dav for the firmware update.
The serial console is valuable, but not necessary, for the normal TFTP recovery. The firmware update does not write over the bootstrap or bootloader.

As for the 'hardware descriptor' segment, its embedded in the flash area named mtdblock5 & 6, as you can imagine it's a hot topic on this forum with lots of posts.
Start here if you have not already seen it:
http://www.ipcamtalk.com/showthread.php/3474-Hikvision-5-2-5-amp-5-2-8-Full-English-(INC-DAYS-OF-WEEK)-mtd-Hack
The firmware load on the 2-series cameras is spread across multiple flash segments, of which there are 18 in total!

*edit* I think this is the Hikvision-specific TFTP tool + instructions: http://www.hikvision.com/europe/download_more.asp?id=1336

 

[dknabe]

Thanks for the confirmation that network tftp from HIKvision still works. I tried it earlier, but Windows 7 has some peculiarites on ethernet ports and maybe firewalls that tripped me up. I'll try that again. Thanks for the authoritative response and the link into the hot topics on hardware descriptors. When I get tftp to work on Windows 7, I'll post some tips for others to follow.

 

[alastairstevenson]

What's important for the normal TFTP update / recovery is that the PC on which tftpserv.exe runs has an IP address of 192.0.0.128 and that the digicap.dav firmware update file is in the same folder as the executable.
In the Hikvision download archive at that URL are the instructions to be followed.
Oh, and a good tip - don't connect the 2 with a crossover LAN cable, use a switch or router. The interface up / downs embarrass the timing of the interaction.
If the camera doesn't properly connect on the first attempt, the 2 will chase each other round with a repeating but finite timeout which will restart and should be OK after maybe 2-3 mins. Some patience is needed.

 

[dknabe]

I haven't had a chance to retry all of this, but thanks for the specifics. When I tried Windows 7 TFTP network update previously, my IP addresses were setup correctly. My guess is that I was stuck in the reboot loop because the IR led's kept turning on periodically. When I use TFTP on other systems, it works immediately or something went wrong. Guess I need more patience for HIKvision stuff. Will try it in the morning. So I guess HIKvision is attempting to put some level of tftp security into the process by requiring the interaction on port 9978. Ugh.

 

[dknabe]

TFTP server from Win7 works, but the camera is still not recovered. I tried a couple of European digicap.dav versions - 5.2.3_141024 and v5.2.0_140721. The TFTP server logs show the transfer sequence concluding with "system update completed". However, nothing happens after that. The console shows a u-boot tftp connection process that looks normal (see below). The process essentially stops at the bash prompt #. The ps command results that I entered are also below. The camera then seems to wait forever, and nothing happens. Pings to 192.0.0.64 work fine in this state, but the camera webserver is not running. If I reboot without the tftp server on the network, the camera continually reboots with this console message (among many others). [01-10 14:27:19][pid:835][SYSINIT][ERROR]hwif_dsp_init error force sys reboot,ret=-12!!!!. It appears to not be able to talk to the dsp. Any ideas are appreciated!

DS-2032-I rs232 console log:
U-Boot 1.3.4-100728 (Nov 11 2014 - 13:58:34)
ARM Clock: 480MHz
DDR Clock: 336MHz
Hit Ctrl+u to stop autoboot: 2 Hit Ctrl+u to stop autoboot: 1 Hit Ctrl+u to stop autoboot: 0
[ INFO][MIN]FORMAT: Formatting Flash
[ INFO][MIN]FORMAT: ....................................
[ INFO][MIN]FORMAT: Format Flash [OK]
[ INFO][MIN]TFTP: TFTP from server 192.0.0.128
[ INFO][MIN]TFTP: Filename: 'digicap.dav'
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: #######################################################################
[ INFO][MIN]TFTP: Download File [OK]
[ INFO][MIN]BURN: File size is 20260112 bytes (19785 KB)
[ INFO][MIN]BURN: Writing Flash
[ INFO][MIN]BURN: ....................................................
[ INFO][MIN]BURN: Write Flash [OK]
***** UPDATE COMPLETE *****
#
# ps %(note - I entered the ps command manually from putty)
PID USER VSZ STAT COMMAND
1 root 2896 S init
2 root 0 SW [kthreadd]
3 root 0 SW [ksoftirqd/0]
4 root 0 SW [kworker/0:0]
5 root 0 SW [kworker/u:0]
6 root 0 SW< [khelper]
7 root 0 SW [kworker/u:1]
52 root 0 SW [sync_supers]
54 root 0 SW [bdi-default]
56 root 0 SW< [kblockd]
173 root 0 SW [kswapd0]
174 root 0 SW< [aio]
186 root 0 SW [mtdblock0]
191 root 0 SW [mtdblock1]
196 root 0 SW [mtdblock2]
201 root 0 SW [mtdblock3]
206 root 0 SW [mtdblock4]
211 root 0 SW [mtdblock5]
216 root 0 SW [mtdblock6]
221 root 0 SW [mtdblock7]
226 root 0 SW [mtdblock8]
231 root 0 SW [mtdblock9]
236 root 0 SW [mtdblock10]
241 root 0 SW [mtdblock11]
246 root 0 SW [mtdblock12]
251 root 0 SW [mtdblock13]
256 root 0 SW [mtdblock14]
261 root 0 SW [mtdblock15]
266 root 0 SW [mtdblock16]
271 root 0 SW [mtdblock17]
280 root 0 DW [rxdma_check]
309 root 0 SW [kworker/0:1]
310 root 2896 S /sbin/inetd -f -e /etc/inetd.conf
311 root 2900 S -/bin/sh
312 root 2896 S init
320 root 0 SW [ubi_bgt1d]
327 root 0 SW [ubifs_bgt1_0]
333 root 0 SW [ubi_bgt2d]
344 root 0 SW [ubifs_bgt2_0]
350 root 0 SW [ubi_bgt3d]
359 root 0 SW [ubifs_bgt3_0]
365 root 0 SW [ubi_bgt4d]
374 root 0 SW [ubifs_bgt4_0]
381 root 0 SW [flush-ubifs_2_0]
382 root 0 SW [flush-ubifs_1_0]
383 root 0 SW [flush-ubifs_3_0]
384 root 0 SW [flush-ubifs_4_0]
391 root 2900 R ps
#

 

[alastairstevenson]

That does not look very promising.
It's a pity u-boot doesn't give any detail about the flash write. The firmware is spread round various segments:

dev: size erasesize name
mtd0: 00020000 00020000 "bst"
mtd1: 00100000 00020000 "ptb"
mtd2: 00100000 00020000 "bld"
mtd3: 00100000 00020000 "hal"
mtd4: 00100000 00020000 "ano_ptb"
mtd5: 00080000 00020000 "env"
mtd6: 00080000 00020000 "param"
mtd7: 00100000 00020000 "dpt"
mtd8: 00a00000 00020000 "rcvy"
mtd9: 00800000 00020000 "krn_pri"
mtd10: 00800000 00020000 "krn_sec"
mtd11: 00400000 00020000 "rmd_pri"
mtd12: 00400000 00020000 "rmd_sec"
mtd13: 01800000 00020000 "app_pri"
mtd14: 01800000 00020000 "app_sec"
mtd15: 00400000 00020000 "cfg_pri"
mtd16: 00400000 00020000 "cfg_sec"
mtd17: 01000000 00020000 "dbg"

It sounds like this may be something you are familiar with - mtdblock11 holds an initrd, with a 64-byte header. If you were to copy mtdblock11 off the camera, strip the 64-byte header, you should be able to check out the contents, even mount it under Linux. The next important segment is mtblock9 with the Linux kernel.

 

[dknabe]

Thanks for the flash map. I'll work on analyzing my specific flash content this afternoon/evening Dallas time. I do have a working camera from the same Amazon vendor, so I'll compare contents between the two. Cheers!

 

[alastairstevenson]

Here is the actual map from a 5.2.3 2CD3332 camera:

<6>[ 0.534818] NAND device: Manufacturer ID: 0x01, Chip ID: 0xf1 (AMD NAND 128MiB 3,3V 8-bit)
<4>[ 0.534866] ambarella_nand_config_flash: 0x02e00140, 0x02c00140
<7>[ 0.535293] Bad block table found at page 65472, version 0x01
<7>[ 0.535826] Bad block table found at page 65408, version 0x01
<7>[ 0.536125] nand_read_bbt: Bad block at 0x000000ba0000
<6>[ 0.541737] ambarella-nand ambarella-nand: ambarella_nand_probe: Partition infomation found!
<5>[ 0.541803] Creating 18 MTD partitions on "ambnand":
<5>[ 0.541840] 0x000000000000-0x000000020000 : "bst"
<5>[ 0.546059] 0x000000020000-0x000000120000 : "ptb"
<5>[ 0.549882] 0x000000120000-0x000000220000 : "bld"
<5>[ 0.553969] 0x000000220000-0x000000320000 : "hal"
<5>[ 0.557861] 0x000000320000-0x000000420000 : "ano_ptb"
<5>[ 0.561788] 0x000000420000-0x0000004a0000 : "env"
<5>[ 0.566082] 0x0000004a0000-0x000000520000 : "param"
<5>[ 0.570107] 0x000000520000-0x000000620000 : "dpt"
<5>[ 0.574465] 0x000000620000-0x000001020000 : "rcvy"
<5>[ 0.578683] 0x000001020000-0x000001820000 : "krn_pri"
<5>[ 0.582597] 0x000001820000-0x000002020000 : "krn_sec"
<5>[ 0.586838] 0x000002020000-0x000002420000 : "rmd_pri"
<5>[ 0.590821] 0x000002420000-0x000002820000 : "rmd_sec"
<5>[ 0.595142] 0x000002820000-0x000004020000 : "app_pri"
<5>[ 0.599287] 0x000004020000-0x000005820000 : "app_sec"
<5>[ 0.603783] 0x000005820000-0x000005c20000 : "cfg_pri"
<5>[ 0.607958] 0x000005c20000-0x000006020000 : "cfg_sec"
<5>[ 0.612269] 0x000006020000-0x000007020000 : "dbg"

 

[whoslooking]

Mite me worth checking to see if a chinese firmware works if the camera came from amazon it maybe a hacked one.

 

[dknabe]

After reading a lot of posts, it seems that there are a large number of hardware and software variables all changing at the same time - and some big incompatibilities between firmware versions. Apparently all DS-2032-I cameras are not the same under the hood. My camera came with a label DS-2CD2032-I v5.2.8_141231. The first mistake was trying to do a firmware update to v5.3.0_150513. That seemed to fail making the camera not accessible via the web browser. In attempting to recover via TFTP, I tried several firmware versions, including v5.2.0_140721, v5.2.3_141024, v5.2.8_141231 and v5.3.0_150513. Somewhere along the line, I suspect a firmware version that was not compatible with the underlying architecture corrupted at least one of the partitions, and it only boots into the Linux minisystem without ethernet support. Luckily I have a serial console connected, so I still have a chance at recovery. Here's the latest console printout. Another very complicating factor is that HIKvision seems to put security/ license checks in the system, so I may not be able to recover by making a bit copy another of my working cameras to load on the bad camera.

U-Boot 1.3.4-100728 (Nov 11 2014 - 13:58:34)
ARM Clock: 480MHz
DDR Clock: 336MHz
Hit Ctrl+u to stop autoboot: 2
Hit Ctrl+u to stop autoboot: 1
Hit Ctrl+u to stop autoboot: 0
|NUL eth|
Unknown command:null 
nand booting ...
load kernel...
load ramdisk...
init started: BusyBox v1.19.3 (2015-03-20 17:37:48 CST)
starting pid 375, tty '': '/etc/init.d/rcS'
Starting udev:      [ OK ]
UBI device number 1, total 191 LEBs (24643584 bytes, 23.5 MiB), available 0 LEBs (0 bytes), LEB size 129024 bytes (126.0 KiB)
waiting for /dev/ubi1_0.
pri_iUpgSuccCnt:0x0, sec_iUpgSuccCnt:0x0
pri_part and sec_part data error.
cat: read error: Invalid argument
The system is going down NOW!
Sent SIGTERM to all processes
Sent SIGKILL to all processes
Requesting system reboot
#[4l

U-Boot 1.3.4-100728 (Nov 11 2014 - 13:58:34)
ARM Clock: 480MHz
DDR Clock: 336MHz
Hit Ctrl+u to stop autoboot: 2
Hit Ctrl+u to stop autoboot: 1
Hit Ctrl+u to stop autoboot: 0
begin to enter mini system
# ##[4l

 

[ak_camguy]

Do you have another amazon camera in good working condition with the factory firmware? If so, I would copy that firmware to your local PC and then try and upload that firmware version to the bricked camera. If all else fails... I purchased 2 of these cameras from amazon as well, it will be about a month before I receive mine. If you are still having issues I can copy the firmware that came with my camera's and email the firmware to you or host it somewhere so you can try and re-flash with the stock firmware. This is why they always teach you to get a good known backup before making any changes...

 

[alastairstevenson]

I think this stored flag indicates that there has been an unsuccessful firmware upgrade

pri_iUpgSuccCnt:0x0, sec_iUpgSuccCnt:0x0

and that the system should just boot into a minimal system.

On the 'mini System' we've seen a few posts here of recent manufacture cameras caught in this state when older firmware has been applied.
I suspect - though have not proven it out as I don't (yet) have a sample of these newer cameras - that the newer cameras have an updated bootstrap and bootloader that is not compatible with the older firmware.
An indication is if the camera is still discoverable by SADP and shows the 'mini System' as part of the serial number.
It might be worth checking some of the posts here to see how forum members have recovered from this condition.

 

[dknabe]

I do have an identical camera (bought at the same time) that is working, so theoretically I can clone all of the mtd partitions. Haven't figured out how yet. Still researcing best method.

 

[alastairstevenson]

Certainly from a working camera you can simply use 'cat mtdblockN > mtdblockN_save' except for mtdblock8 & 16 where you need to use the 'ro' view, mtd8ro if I remember correctly.
Then you'll be finding out how functional the u-boot bootloader is. I've not explored that (yet) on a camera, might do soon as I've got a camera to play with just being delivered.
But I think people have recovered from this just by a firmware install, if it's the same 'minSystem' situation.

*edit* Ooops just spotted that "'cat mtdblockN > mtdblockN_save'" should be "'cat /dev/mtdblockN > mtdblockN_save'"

 

[dknabe]

What is the best method to transfer a file from the camera? I have ssh enabled, but scp, rsync, ftp and nc don't seem to be installed on the camera busybox.

 

[dknabe]

rz is installed. Haven't used that before, but I bet that will work.

 

[alastairstevenson]

TFTP should be active. And I'd expect the camera interface to be on 192.0.0.64
But then I haven't knowingly had a camera stop at that point as your has so far, except a 2CD3332I maybe when I was messing with the 'Zone' flag in the hardware descriptor block and it would no longer boot fully.
*edit* Someone else's possibly similar experience:
http://www.ipcamtalk.com/showthread.php/3366-ds-2cd2032-i-bricked-from-v5-2-5-to-v5-3-0-can-anyone-help?highlight=min-system

 

[dknabe]

My working camera (v5.2.8_141231) has the following functions in /bin. tftp does not seem to be available.

        [TABLE]
[TR]
[TD="align: left"]IPZOOMDebug -> /bin/da_info[/TD]
[/TR]
[TR]
[TD="align: left"][ -> busybox[/TD]
[/TR]
[TR]
[TD="align: left"][[ -> busybox[/TD]
[/TR]
[TR]
[TD="align: left"]agingTest -> /bin/da_info[/TD]
[/TR]
[TR]
[TD="align: left"]ambarella_eth_debug.ko[/TD]
[/TR]
[TR]
[TD="align: left"]ash -> busybox[/TD]
[/TR]
[TR]
[TD="align: left"]awk -> busybox[/TD]
[/TR]
[TR]
[TD="align: left"]bash -> busybox[/TD]
[/TR]
[TR]
[TD="align: left"]busybox[/TD]
[/TR]
[TR]
[TD="align: left"]camCmd -> /bin/da_info[/TD]
[/TR]
[TR]
[TD="align: left"]cat -> busybox[/TD]
[/TR]
[TR]
[TD="align: left"]check_config[/TD]
[/TR]
[TR]
[TD="align: left"]check_rs232 -> /bin/da_info[/TD]
[/TR]
[TR]
[TD="align: left"]chmod -> busybox[/TD]
[/TR]
[TR]
[TD="align: left"]cloudService -> /bin/da_info[/TD]
[/TR]
[TR]
[TD="align: left"]clrSelfcheckOsd -> /dav/da_info[/TD]
[/TR]
[TR]
[TD="align: left"]cp -> busybox[/TD]
[/TR]
[TR]
[TD="align: left"]da_info[/TD]
[/TR]
[TR]
[TD="align: left"]date -> busybox[/TD]
[/TR]
[TR]
[TD="align: left"]dd -> busybox[/TD]
[/TR]
[TR]
[TD="align: left"]debugLog -> /bin/da_info[/TD]
[/TR]
[TR]
[TD="align: left"]df -> busybox[/TD]
[/TR]
[TR]
[TD="align: left"]dm365 -> /bin/da_info[/TD]
[/TR]
[TR]
[TD="align: left"]dmesg -> busybox[/TD]
[/TR]
[TR]
[TD="align: left"]dspStatus -> /bin/da_info[/TD]
[/TR]
[TR]
[TD="align: left"]du -> busybox[/TD]
[/TR]
[TR]
[TD="align: left"]echo -> busybox[/TD]
[/TR]
[TR]
[TD="align: left"]env -> busybox[/TD]
[/TR]
[TR]
[TD="align: left"]execSystemCmd[/TD]
[/TR]
[TR]
[TD="align: left"]false -> busybox[/TD]
[/TR]
[TR]
[TD="align: left"]free -> busybox[/TD]
[/TR]
[TR]
[TD="align: left"]fsync -> busybox[/TD]
[/TR]
[TR]
[TD="align: left"]gdbcfg -> /bin/da_info[/TD]
[/TR]
[TR]
[TD="align: left"]getAgingMode -> /bin/da_info[/TD]
[/TR]
[TR]
[TD="align: left"]getAgingTime -> /bin/da_info[/TD]
[/TR]
[TR]
[TD="align: left"]getAlarmStatus -> /bin/da_info[/TD]
[/TR]
[TR]
[TD="align: left"]getDebug -> /bin/da_info[/TD]
[/TR]
[TR]
[TD="align: left"]getFanMode -> /bin/da_info[/TD]
[/TR]
[TR]
[TD="align: left"]getIp -> /bin/da_info[/TD]
[/TR]
[TR]
[TD="align: left"]getIrstate -> /bin/da_info[/TD]
[/TR]
[TR]
[TD="align: left"]getLowDelayMode -> /bin/da_info[/TD]
[/TR]
[TR]
[TD="align: left"]getMcuInfo -> /bin/da_info[/TD]
[/TR]
[TR]
[TD="align: left"]getMcuStateInfo -> /bin/da_info[/TD]
[/TR]
[TR]
[TD="align: left"]getModuleVer -> /bin/da_info[/TD]
[/TR]
[TR]
[TD="align: left"]getMtu -> /bin/da_info[/TD]
[/TR]
[TR]
[TD="align: left"]getNetConnInfo -> /bin/da_info[/TD]
[/TR]
[TR]
[TD="align: left"]getPacketType -> /bin/da_info[/TD]
[/TR]
[TR]
[TD="align: left"]getPreviewStatus -> /bin/da_info[/TD]
[/TR]
[TR]
[TD="align: left"]getQP -> /bin/da_info[/TD]
[/TR]
[TR]
[TD="align: left"]getRtcpStatus -> /bin/da_info[/TD]
[/TR]
[TR]
[TD="align: left"]getTempCtrlMode -> /bin/da_info[/TD]
[/TR]
[TR]
[TD="align: left"]getZoomMinLimit -> /bin/da_info[/TD]
[/TR]
[TR]
[TD="align: left"]gunzip -> busybox[/TD]
[/TR]
[TR]
[TD="align: left"]gzip -> busybox[/TD]
[/TR]
[TR]
[TD="align: left"]iostat -> busybox[/TD]
[/TR]
[TR]
[TD="align: left"]irisputClose -> /bin/da_info[/TD]
[/TR]
[TR]
[TD="align: left"]irisputOpen -> /bin/da_info[/TD]
[/TR]
[TR]
[TD="align: left"]kill -> busybox[/TD]
[/TR]
[TR]
[TD="align: left"]ln -> busybox[/TD]
[/TR]
[TR]
[TD="align: left"]login -> busybox[/TD]
[/TR]
[TR]
[TD="align: left"]ls -> busybox[/TD]
[/TR]
[TR]
[TD="align: left"]lzcat -> busybox[/TD]
[/TR]
[TR]
[TD="align: left"]lzma -> busybox[/TD]
[/TR]
[TR]
[TD="align: left"]mkdir -> busybox[/TD]
[/TR]
[TR]
[TD="align: left"]mknod -> busybox[/TD]
[/TR]
[TR]
[TD="align: left"]motionTest -> /bin/da_info[/TD]
[/TR]
[TR]
[TD="align: left"]mount -> busybox[/TD]
[/TR]
[TR]
[TD="align: left"]mpstat -> busybox[/TD]
[/TR]
[TR]
[TD="align: left"]mv -> busybox[/TD]
[/TR]
[TR]
[TD="align: left"]netstat -> busybox[/TD]
[/TR]
[TR]
[TD="align: left"]outputClose -> /bin/da_info[/TD]
[/TR]
[TR]
[TD="align: left"]outputOpen -> /bin/da_info[/TD]
[/TR]
[TR]
[TD="align: left"]ping -> busybox[/TD]
[/TR]
[TR]
[TD="align: left"]ping6 -> busybox[/TD]
[/TR]
[TR]
[TD="align: left"]pppd[/TD]
[/TR]
[TR]
[TD="align: left"]pppoe[/TD]
[/TR]
[TR]
[TD="align: left"]pppoed[/TD]
[/TR]
[TR]
[TD="align: left"]printPart -> /bin/da_info[/TD]
[/TR]
[TR]
[TD="align: left"]prtHardInfo -> /bin/da_info[/TD]
[/TR]
[TR]
[TD="align: left"]ps -> busybox[/TD]
[/TR]
[TR]
[TD="align: left"]pwd -> busybox[/TD]
[/TR]
[TR]
[TD="align: left"]resetParam -> /bin/da_info[/TD]
[/TR]
[TR]
[TD="align: left"]resetPasswd -> /bin/da_info[/TD]
[/TR]
[TR]
[TD="align: left"]rm -> busybox[/TD]
[/TR]
[TR]
[TD="align: left"]rz[/TD]
[/TR]
[TR]
[TD="align: left"]sdDataCheck -> /bin/da_info[/TD]
[/TR]
[TR]
[TD="align: left"]sed -> busybox[/TD]
[/TR]
[TR]
[TD="align: left"]setAgingMode -> /bin/da_info[/TD]
[/TR]
[TR]
[TD="align: left"]setAgingTime -> /bin/da_info[/TD]
[/TR]
[TR]
[TD="align: left"]setAlarm -> /bin/da_info[/TD]
[/TR]
[TR]
[TD="align: left"]setDebug -> /bin/da_info[/TD]
[/TR]
[TR]
[TD="align: left"]setFanMode -> /bin/da_info[/TD]
[/TR]
[TR]
[TD="align: left"]setFtpService -> /bin/da_info[/TD]
[/TR]
[TR]
[TD="align: left"]setGateway -> /bin/da_info[/TD]
[/TR]
[TR]
[TD="align: left"]setIp -> /bin/da_info[/TD]
[/TR]
[TR]
[TD="align: left"]setIrcmd -> /bin/da_info[/TD]
[/TR]
[TR]
[TD="align: left"]setLBS -> /bin/da_info[/TD]
[/TR]
[TR]
[TD="align: left"]setLowDelayMode -> /bin/da_info[/TD]
[/TR]
[TR]
[TD="align: left"]setMtu -> /bin/da_info[/TD]
[/TR]
[TR]
[TD="align: left"]setPacketType -> /bin/da_info[/TD]
[/TR]
[TR]
[TD="align: left"]setQP -> /bin/da_info[/TD]
[/TR]
[TR]
[TD="align: left"]setRetrievalRuleShow -> /bin/da_info[/TD]
[/TR]
[TR]
[TD="align: left"]setRtcpStatus -> /bin/da_info[/TD]
[/TR]
[TR]
[TD="align: left"]setSerial485Status -> /bin/da_info[/TD]
[/TR]
[TR]
[TD="align: left"]setTempCtrlMode -> /bin/da_info[/TD]
[/TR]
[TR]
[TD="align: left"]setUpgradeTime -> /bin/da_info[/TD]
[/TR]
[TR]
[TD="align: left"]setV6ip -> /bin/da_info[/TD]
[/TR]
[TR]
[TD="align: left"]setWlan -> /bin/da_info[/TD]
[/TR]
[TR]
[TD="align: left"]setZoomMinLimit -> /bin/da_info[/TD]
[/TR]
[TR]
[TD="align: left"]sh -> busybox[/TD]
[/TR]
[TR]
[TD="align: left"]showDefence -> /bin/da_info[/TD]
[/TR]
[TR]
[TD="align: left"]showKey -> /bin/da_info[/TD]
[/TR]
[TR]
[TD="align: left"]showServer -> /bin/da_info[/TD]
[/TR]
[TR]
[TD="align: left"]showStatus -> /bin/da_info[/TD]
[/TR]
[TR]
[TD="align: left"]showUpnp -> /bin/da_info[/TD]
[/TR]
[TR]
[TD="align: left"]sleep -> busybox[/TD]
[/TR]
[TR]
[TD="align: left"]sync -> busybox[/TD]
[/TR]
[TR]
[TD="align: left"]t1[/TD]
[/TR]
[TR]
[TD="align: left"]tail -> busybox[/TD]
[/TR]
[TR]
[TD="align: left"]tar -> busybox[/TD]
[/TR]
[TR]
[TD="align: left"]taskShow -> /bin/da_info[/TD]
[/TR]
[TR]
[TD="align: left"]test -> busybox[/TD]
[/TR]
[TR]
[TD="align: left"]top -> busybox[/TD]
[/TR]
[TR]
[TD="align: left"]touch -> busybox[/TD]
[/TR]
[TR]
[TD="align: left"]true -> busybox[/TD]
[/TR]
[TR]
[TD="align: left"]umount -> busybox[/TD]
[/TR]
[TR]
[TD="align: left"]unlzma -> busybox[/TD]
[/TR]
[TR]
[TD="align: left"]unxz -> busybox[/TD]
[/TR]
[TR]
[TD="align: left"]upgcfg -> /bin/da_info[/TD]
[/TR]
[TR]
[TD="align: left"]xz -> busybox[/TD]
[/TR]
[TR]
[TD="align: left"]xzcat -> busybox[/TD]
[/TR]
[TR]
[TD="align: left"]zcat -> busybox[/TD]
[/TR]
[/TABLE]

 

[dknabe]

My working camera (and bricked one as well) has a white label that says it's version v5.2.8_141231. However, the web interface system page reports only 5.2.0.

Firmware Version	V5.2.0 build 140721
Encoding Version	V5.0 build 140714