Hikvision DS-2032-I Console Recovery

[alastairstevenson]

Is it possible to copy mtd5 and mtd6 blocks from a working camera to solve this ?

If you have telnet access to the working camera, it will be possible to copy mtdblock5 & 6 from it.
As an experiment, this could be copied on to the problem camera to see if it brings it back to normal operation.
To test this, it would be best to have the working camera disconnected, as there will be a duplicate MAC address on the network.
Some ways to transfer the files are covered here:
https://www.ipcamtalk.com/showthread.php/3408-HIKVISION-mtd-Brick-Recovery-Guide
and more info here:
https://www.ipcamtalk.com/showthread.php/3474-Hikvision-5-2-5-amp-5-2-8-Full-English-(INC-DAYS-OF-WEEK)-mtd-Hack
If that does work - it should be possible to change the MAC address in the same way as is done for the region code.

 

[msxer]

I've managed to get the camera back up and running by copying the mtdblock5 and mtdblock6 files from a working camera.

Stil have to figure out how to change the mac adress, but it's bedtime now...

Thanks Alastairstevenson for the great help sofar !

Will come back tomorrow with an update on the mac adres issue (and probably will need some extra help )

 

[alastairstevenson]

I've managed to get the camera back up and running by copying the mtdblock5 and mtdblock6 files from a working camera.

Brilliant! Well done.

The MAC address is held in bytes 0x679-0x67E of mtdbock5, 0x35-0x3A and 0x20035-0x2003A of mtdbock6
I'm not sure which one is the active one - I've always changed all 3 instances of the hardware descriptor block equally.
You should be able to avoid checksum problems by doing something like adding 1 to the last byte and subtracting 1 from the second last byte of the MAC address, to balance the sum to 0.
To check that the changes take place, you can try the following:
Before changing anything, power up the camera and ping it at its known IP address.
At the Windows command prompt, use 'arp -a' to list the ARP table, inspect for the IP address and note down the current MAC address.
Update the camera mtdblock5 & 6 and repeat.

 

[whoslooking]

Well done, it's great when it all goes well.

 

[msxer]

@alastairstevenson : thanks again for the explanation, couldn't have done it without your help !
@whoslooking : you've also been a great help, I wouldn't have got even started without your guides and firmware solutions !


Will try to alter the mac adres tonight and let you know how it worked out

 

[msxer]

Been able to give the cam a new IP adress and as a bonus even managed to get the serial number of the sticker back in the mtd blocks

I just love it when a plan comes together !


Just curious about the region code adjustment in mtdblock6 : it seems that changing the regioncode in the first adressblock (0x35-0x3A) only is enough to fix the language mismatch.
To be sure, I've also altered the region code in the second adressblock (0x20035-0x2003A) but doesn't seem to make any difference.

 

[alastairstevenson]

Been able to give the cam a new IP adress and as a bonus even managed to get the serial number of the sticker back in the mtd blocks

Hey, well done, above and beyond as they say.

To be sure, I've also altered the region code in the second adressblock (0x20035-0x2003A) but doesn't seem to make any difference.

Yes, that's what I've done as well, just in case there is some obscure program that makes use of the other locations.

*edit*

I've bought the camera from someone who bricked it using the wrong firmware, assuming I could solve the problem like I did with my other 2332.

I didn't do the upgrade myself, so I don't have a backup off the mtd files.

A friend of yours / maybe another forum member?
I occasionally look on eBay to see if there are any cheap bricked Hikvision devices, but never seen any, which is a pity.

 

[msxer]

Sorry for the late reply, been away.

I look around on different internet marketplaces and sometimes get lucky.

Also helped out some friends who got there chinese camera's messed up.

 

[pimps]

The contents of mtd0,1,2,3,4,7 and 17 do not change between v5.0 and 5.3 upgrades. MD5SUMS are all the same across multiple tftp and web firmware upgrades. Cheers, Doug

Doug has written the mtd didn't change with different versions.
Is anybody aware of a location to download a copy/dump of mtd2 boot loader with nandwrite and nandread command from a 2cd2032 series 1?

Any help is welcome.
Thank you.

 

[alastairstevenson]

Here is a copy of an mtdblock2 from a DS-2CD2032 that originally had 5.2.0 firmware, manufactured 11/2014
View attachment mtdblock2.zip

 

[pimps]

Thank you very much.