Hikvision DS-2CD2432F-IW Bricked?

[dlauth]

So I bought the Hikvision DS-2CD2432F-IW from Amazon seller Scanti, which I believe is a Chinese version.

I tried using the tftp software for the camera to use the firmware from here:
American Version:

ftp://ftp.hikvisionusa.com/
Username: hikfirmware
Password: Hikvision123

DS-2CD24x2&25x2_WiFi_Camera_Firmware_v5.2.3_141024.zip

It started the transfer and completed the transfer but it never said update complete.

The only way to access the camera now is through the tftp software as nothing else works. The only thing lit up on the front is the alarm LED and a blinking status light.

Any thoughts?

 

[alastairstevenson]

So - a couple of things:
See what SADP makes of the camera if it finds it - maybe 'Min-system 4.0.8' showing in the serial number.
At the PC command line, with the TFTP server NOT running set a continuous ping going with 'ping -t 192.0.0.64' and power on the camera, and see if it appears periodically for a second or 2, indicating a boot loop.

If you then leave the TFTP server running, and at the PC command line set a continuous ping going with 'ping -t 192.0.0.64' and power on the camera, you will be able to see if it's still responding after the next update.
Then, if it is, you should be able to access the camera via telnet on the 192.0.0.64 IP address. If you don't have a favourite telnet client, PuTTY is good and very popular.
Then, at the camera telnet command prompt, if you grab a copy of the kernel log there will likely be a clue there as to the cause of the problem. If you paste the result back here, or attach a text file copy, maybe some interpretation can be made.
At the telnet command prompt,
cat /proc/kmsg
Then Control-C to exit, and copy / paste to Notepad or equivalent.

 

[dlauth]

SADP cannot see any device even though the camera is connected directly via ethernet to the PC.

I am using a static IP of 192.0.0.128 on the PC.

When I try to ping the device, I get "Reply from 192.0.0.128: Destination host unreachable." When I unplug and replug the device back in with the continuous ping, I do get 2 successful pings before I get the same unreachable message.

Putty is nogo.

It seems like I am needing a different firmware before I can troubleshoot further since I cannot get a connection.

Thoughts?

 

[alastairstevenson]

SADP cannot see any device even though the camera is connected directly via ethernet to the PC

Don't connect the camera directly to the PC, that can stop the TFTP recovery process working reliably.
During startup, the camera firmware enables and disables the Ethernet interface more than once, fairly quickly, and that also drops the connection at the PC end of the cable, so the PC needs time to recover from that.
Keep the PC wired in to the normal switch or router port, and connect the camera to a spare port on the same switch or router. You don't need to isolate the switch or router from your normal network.

The fact that you see a couple of ping responses after powering on the camera shows it is checking for the TFTP server, and the fact that it does not repeat that later suggests it's not in a boot loop, but just failing to fully boot.
It's important that you run the Hikvision-specific TFTP server, check that it has 'Hikvision TFTP Server' on the windows title bar.

If you run the TFTP server with the digicap.dav file in the same folder as the TFTP executable, and power on the camera, it should run a firmware install / upgrade. It could take several minutes to do so, with some progress messages on the TFTP server window.
After the 'update complete' message, if the ping is still responding, you should be able to use PuTTY to establish a telnet connection to 192.0.0.64 and grab a copy of the kernel log for clues about the problem.

At the telnet command prompt,
cat /proc/kmsg
Then Control-C to exit, and copy / paste to Notepad or equivalent.

Trying other firmware would be a good idea.
Here are some potential alternatives:
http://www.hikvisioneurope.com/portal/index.php?dir=Product Firmware/Cameras/DS-2CD2xx2/
http://overseas.hikvision.com/en/download_89_p3.html
http://www1.hikvision.com/cn/download_more_714.html

 

[dlauth]

OK, so I plugged it straight into my switch, along with the PC.

I changed to PC's IP to 192.0.0.128 and ran the Hikvision TFTP software.

After plugging the power into the camera, it booted up and then started the transfer. It is still not getting past file transfer complete, even after 30 minutes.

I tried the Euro firmware without success also.

 

[alastairstevenson]

Well that's a pity it didn't just burst into life.

It is still not getting past file transfer complete

When getting to the point where it's transferred the firmware but not saying 'Upgrade completed' you should be able to connect a telnet session to 192.0.0.64 with PuTTY if you leave the TFTP server running.
If you can connect, grab a copy of the kernel log so far to see what clue it may provide as to why it's not completing the bootup.

cat /proc/kmsg
then use Control-C to get back to the prompt.
Copy the PuTTY scrollback to something like Notepad and save for review.

 

[dlauth]

When I try that technique, I get connection refused.

 

[Tahir Zia]

Well that's a pity it didn't just burst into life.
It is still not getting past file transfer complete


When getting to the point where it's transferred the firmware but not saying 'Upgrade completed' you should be able to connect a telnet session to 192.0.0.64 with PuTTY if you leave the TFTP server running.
If you can connect, grab a copy of the kernel log so far to see what clue it may provide as to why it's not completing the bootup.

cat /proc/kmsg
then use Control-C to get back to the prompt.
Copy the PuTTY scrollback to something like Notepad and save for review.

Dear alastairstevenson
I had same problem and I followed the points you mentioned and able to get error log. I am posting mine here. Can you tell what further should i be doing in order to access my camera again?

------------------ log here------------------------
<5>[ 0.000000] fixmap : 0xfff00000 - 0xfffe0000 ( 896 kB)
<5>[ 0.000000] DMA : 0xfe600000 - 0xfee00000 ( 8 MB)
<5>[ 0.000000] vmalloc : 0xc9000000 - 0xe0000000 ( 368 MB)
<5>[ 0.000000] lowmem : 0xc0000000 - 0xc8a00000 ( 138 MB)
<5>[ 0.000000] modules : 0xbf000000 - 0xc0000000 ( 16 MB)
<5>[ 0.000000] .init : 0xc0008000 - 0xc02d2000 (2856 kB)
<5>[ 0.000000] .text : 0xc02d2000 - 0xc05d7000 (3092 kB)
<5>[ 0.000000] .data : 0xc05d8000 - 0xc05f6640 ( 122 kB)
<6>[ 0.000000] Preemptable hierarchical RCU implementation.
<6>[ 0.000000] RCU-based detection of stalled CPUs is disabled.
<6>[ 0.000000] Verbose stalled-CPUs detection is disabled.
<6>[ 0.000000] NR_IRQS:224
<6>[ 0.000000] ambarella-cs-timer: mult = 2236962133, shift = 27
<6>[ 0.000000] ambarella_ce_timer_set_mode:1
<6>[ 0.000000] ambarella_ce_timer_set_mode:2
<4>[ 0.000000] Console: colour dummy device 80x30
<6>[ 0.000000] console [ttyS0] enabled
<6>[ 0.000000] Calibrating delay loop... 319.48 BogoMIPS (lpj=1597440)
<6>[ 0.230000] pid_max: default: 32768 minimum: 301
<4>[ 0.230000] Mount-cache hash table entries: 512
<6>[ 0.230000] CPU: Testing write buffer coherency: ok
<6>[ 0.230000] NET: Registered protocol family 16
<6>[ 0.240000] Ambarella Coconut:
<6>[ 0.240000] chip id: 5100
<6>[ 0.240000] board type: 3
<6>[ 0.240000] board revision: 10
<6>[ 0.240000] chip name: a5m
<6>[ 0.240000] HAL version: 176869
<6>[ 0.240000] reference clock: 24000000
<6>[ 0.240000] system configuration: 0x177804ea
<6>[ 0.240000] boot type: 0x00000002
<6>[ 0.240000] hif type: 0x00000000
<4>[ 0.260000] bio: create slab <bio-0> at 0
<6>[ 0.260000] ambarella-spi ambarella-spi.0: ambarella SPI Controller 0 crea
ted
<6>[ 0.260000] ambarella-spi ambarella-spi.1: ambarella SPI Controller 1 crea
ted
<5>[ 0.270000] ambarella-i2c ambarella-i2c.0: Ambarella Media Processor I2C a
dapter[i2c-0] probed!
<5>[ 0.270000] ambarella-i2c ambarella-i2c.1: Ambarella Media Processor I2C a
dapter[i2c-1] probed!
<6>[ 0.270000] i2c i2c-0: Added multiplexed i2c bus 2
<6>[ 0.270000] ambarella-i2cmux ambarella-i2cmux.0: mux on ambarella-i2c adap
ter
<6>[ 0.280000] Switching to clocksource ambarella-cs-timer
<6>[ 0.330000] NET: Registered protocol family 2
<6>[ 0.330000] IP route cache hash table entries: 2048 (order: 1, 8192 bytes)
<6>[ 0.330000] TCP established hash table entries: 8192 (order: 4, 65536 byte
s)
<6>[ 0.330000] TCP bind hash table entries: 8192 (order: 3, 32768 bytes)
<6>[ 0.330000] TCP: Hash tables configured (established 8192 bind 8192)
<6>[ 0.330000] TCP reno registered
<6>[ 0.330000] UDP hash table entries: 256 (order: 0, 4096 bytes)
<6>[ 0.330000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
<6>[ 0.330000] NET: Registered protocol family 1
<6>[ 0.370000] Trying to unpack rootfs image as initramfs...
<6>[ 0.420000] rootfs image is not initramfs (junk in compressed archive); lo
oks like an initrd
<6>[ 0.460000] Freeing initrd memory: 4096K
<0>[ 0.460000] [ kernel version: svn-22068 ]
<6>[ 0.470000] msgmni has been set to 261
<6>[ 0.470000] io scheduler noop registered
<6>[ 0.470000] io scheduler deadline registered (default)
<6>[ 0.470000] ambarella-uart.0: ttyS0 at MMIO 0x70005000 (irq = 9) is a ambu
art
<6>[ 0.470000] ambarella-uart.1: ttyS1 at MMIO 0x7001f000 (irq = 25) is a amb
uart
<6>[ 0.480000] brd: module loaded
<6>[ 0.480000] NAND device: Manufacturer ID: 0xec, Chip ID: 0xf1 (Samsung NAN
D 128MiB 3,3V 8-bit)
<4>[ 0.480000] ambarella_nand_config_flash: 0x02e00140, 0x02c00140
<7>[ 0.480000] Bad block table found at page 65472, version 0x01
<7>[ 0.480000] Bad block table found at page 65408, version 0x01
<6>[ 0.490000] ambarella-nand ambarella-nand: ambarella_nand_probe: Partition
infomation found!
<5>[ 0.490000] Creating 18 MTD partitions on "ambnand":
<5>[ 0.490000] 0x000000000000-0x000000020000 : "bst"
<5>[ 0.490000] 0x000000020000-0x000000120000 : "ptb"
<5>[ 0.500000] 0x000000120000-0x000000220000 : "bld"
<5>[ 0.500000] 0x000000220000-0x000000320000 : "hal"
<5>[ 0.500000] 0x000000320000-0x000000420000 : "ano_ptb"
<5>[ 0.510000] 0x000000420000-0x0000004a0000 : "env"
<5>[ 0.510000] 0x0000004a0000-0x000000520000 : "param"
<5>[ 0.510000] 0x000000520000-0x000000620000 : "dpt"
<5>[ 0.520000] 0x000000620000-0x000001020000 : "rcvy"
<5>[ 0.520000] 0x000001020000-0x000001820000 : "krn_pri"
<5>[ 0.520000] 0x000001820000-0x000002020000 : "krn_sec"
<5>[ 0.530000] 0x000002020000-0x000002420000 : "rmd_pri"
<5>[ 0.530000] 0x000002420000-0x000002820000 : "rmd_sec"
<5>[ 0.540000] 0x000002820000-0x000004020000 : "app_pri"
<5>[ 0.540000] 0x000004020000-0x000005820000 : "app_sec"
<5>[ 0.540000] 0x000005820000-0x000005c20000 : "cfg_pri"
<5>[ 0.550000] 0x000005c20000-0x000006020000 : "cfg_sec"
<5>[ 0.550000] 0x000006020000-0x000007020000 : "dbg"
<6>[ 0.560000] Ambarella MII Bus: probed
<5>[ 0.570000] ambarella-eth ambarella-eth.0: MAC Address[8c:e7:48:bf:d9:8a].
<6>[ 0.570000] mousedev: PS/2 mouse device common for all mice
<6>[ 0.570000] ambarella-rtc ambarella-rtc: rtc core: registered ambarella-rt
c as rtc0
<6>[ 0.570000] i2c /dev entries driver
<5>[ 0.570000] ambarella-wdt ambarella-wdt: Ambarella Media Processor Watch D
og Timer[ambarella-wdt].
<5>[ 0.570000] ambarella-crypto ambarella-crypto: Ambarella Media Processor C
ryptography Engine probed(interrupt mode).
<6>[ 0.570000] TCP cubic registered
<6>[ 0.570000] NET: Registered protocol family 17
<6>[ 0.580000] ambarella-rtc ambarella-rtc: setting system clock to 2015-06-1
4 19:18:35 UTC (1434309515)
<6>[ 0.580000] Freeing init memory: 2856K
<5>[ 1.730000] UBI: attaching mtd13 to ubi1
<5>[ 1.730000] UBI: physical eraseblock size: 131072 bytes (128 KiB)
<5>[ 1.730000] UBI: logical eraseblock size: 129024 bytes
<5>[ 1.730000] UBI: smallest flash I/O unit: 2048
<5>[ 1.730000] UBI: sub-page size: 512
<5>[ 1.730000] UBI: VID header offset: 512 (aligned 512)
<5>[ 1.730000] UBI: data offset: 2048
<5>[ 1.780000] UBI: max. sequence number: 136
<5>[ 1.790000] UBI: attached mtd13 to ubi1
<5>[ 1.790000] UBI: MTD device name: "app_pri"
<5>[ 1.790000] UBI: MTD device size: 24 MiB
<5>[ 1.790000] UBI: number of good PEBs: 192
<5>[ 1.790000] UBI: number of bad PEBs: 0
<5>[ 1.790000] UBI: number of corrupted PEBs: 0
<5>[ 1.790000] UBI: max. allowed volumes: 128
<5>[ 1.790000] UBI: wear-leveling threshold: 4096
<5>[ 1.820000] UBI: number of internal volumes: 1
<5>[ 1.820000] UBI: number of user volumes: 1
<5>[ 1.820000] UBI: available PEBs: 0
<5>[ 1.820000] UBI: total number of reserved PEBs: 192
<5>[ 1.820000] UBI: number of PEBs reserved for bad PEB handling: 2
<5>[ 1.820000] UBI: max/mean erase counter: 21/15
<5>[ 1.820000] UBI: image sequence number: 166467862
<5>[ 1.820000] UBI: background thread "ubi_bgt1d" started, PID 329
<5>[ 1.900000] UBIFS: recovery needed
<5>[ 1.940000] UBIFS: recovery completed
<5>[ 1.940000] UBIFS: mounted UBI device 1, volume 0, name "app_pri"
<5>[ 1.940000] UBIFS: file system size: 22837248 bytes (22302 KiB, 21 MiB,
177 LEBs)
<5>[ 1.940000] UBIFS: journal size: 1161216 bytes (1134 KiB, 1 MiB, 9 L
EBs)
<5>[ 1.940000] UBIFS: media format: w4/r0 (latest is w4/r0)
<5>[ 1.940000] UBIFS: default compressor: lzo
<5>[ 1.940000] UBIFS: reserved for root: 1078659 bytes (1053 KiB)
<5>[ 1.950000] UBI: attaching mtd14 to ubi2
<5>[ 1.950000] UBI: physical eraseblock size: 131072 bytes (128 KiB)
<5>[ 1.950000] UBI: logical eraseblock size: 129024 bytes
<5>[ 1.950000] UBI: smallest flash I/O unit: 2048
<5>[ 1.950000] UBI: sub-page size: 512
<5>[ 1.950000] UBI: VID header offset: 512 (aligned 512)
<5>[ 1.950000] UBI: data offset: 2048
<5>[ 2.010000] UBI: max. sequence number: 136
<5>[ 2.040000] UBI: attached mtd14 to ubi2
<5>[ 2.040000] UBI: MTD device name: "app_sec"
<5>[ 2.040000] UBI: MTD device size: 24 MiB
<5>[ 2.040000] UBI: number of good PEBs: 192
<5>[ 2.040000] UBI: number of bad PEBs: 0
<5>[ 2.040000] UBI: number of corrupted PEBs: 0
<5>[ 2.040000] UBI: max. allowed volumes: 128
<5>[ 2.040000] UBI: wear-leveling threshold: 4096
<5>[ 2.040000] UBI: number of internal volumes: 1
<5>[ 2.040000] UBI: number of user volumes: 1
<5>[ 2.040000] UBI: available PEBs: 0
<5>[ 2.040000] UBI: total number of reserved PEBs: 192
<5>[ 2.040000] UBI: number of PEBs reserved for bad PEB handling: 2
<5>[ 2.040000] UBI: max/mean erase counter: 19/10
<5>[ 2.040000] UBI: image sequence number: 1140176502
<5>[ 2.050000] UBI: background thread "ubi_bgt2d" started, PID 338
<5>[ 2.120000] UBIFS: recovery needed
<5>[ 2.190000] UBIFS: recovery completed
<5>[ 2.190000] UBIFS: mounted UBI device 2, volume 0, name "app_sec"
<5>[ 2.190000] UBIFS: file system size: 22837248 bytes (22302 KiB, 21 MiB,
177 LEBs)
<5>[ 2.190000] UBIFS: journal size: 1161216 bytes (1134 KiB, 1 MiB, 9 L
EBs)
<5>[ 2.190000] UBIFS: media format: w4/r0 (latest is w4/r0)
<5>[ 2.190000] UBIFS: default compressor: lzo
<5>[ 2.190000] UBIFS: reserved for root: 1078659 bytes (1053 KiB)
<5>[ 2.230000] UBIFS: un-mount UBI device 1, volume 0
<5>[ 2.280000] UBI: mtd13 is detached from ubi1
<5>[ 2.720000] UBI: attaching mtd13 to ubi1
<5>[ 2.720000] UBI: physical eraseblock size: 131072 bytes (128 KiB)
<5>[ 2.720000] UBI: logical eraseblock size: 129024 bytes
<5>[ 2.720000] UBI: smallest flash I/O unit: 2048
<5>[ 2.720000] UBI: sub-page size: 512
<5>[ 2.720000] UBI: VID header offset: 512 (aligned 512)
<5>[ 2.720000] UBI: data offset: 2048
<5>[ 2.770000] UBI: max. sequence number: 0
<5>[ 2.770000] UBI: attached mtd13 to ubi1
<5>[ 2.770000] UBI: MTD device name: "app_pri"
<5>[ 2.770000] UBI: MTD device size: 24 MiB
<5>[ 2.770000] UBI: number of good PEBs: 192
<5>[ 2.770000] UBI: number of bad PEBs: 0
<5>[ 2.770000] UBI: number of corrupted PEBs: 0
<5>[ 2.770000] UBI: max. allowed volumes: 128
<5>[ 2.770000] UBI: wear-leveling threshold: 4096
<5>[ 2.770000] UBI: number of internal volumes: 1
<5>[ 2.770000] UBI: number of user volumes: 0
<5>[ 2.770000] UBI: available PEBs: 186
<5>[ 2.770000] UBI: total number of reserved PEBs: 6
<5>[ 2.770000] UBI: number of PEBs reserved for bad PEB handling: 2
<5>[ 2.770000] UBI: max/mean erase counter: 22/16
<5>[ 2.770000] UBI: image sequence number: 1965464430
<5>[ 2.780000] UBI: background thread "ubi_bgt1d" started, PID 353
<5>[ 2.900000] UBIFS: default file-system created
<5>[ 2.960000] UBIFS: mounted UBI device 1, volume 0, name "app_pri"
<5>[ 2.960000] UBIFS: file system size: 22837248 bytes (22302 KiB, 21 MiB,
177 LEBs)
<5>[ 2.960000] UBIFS: journal size: 1161216 bytes (1134 KiB, 1 MiB, 9 L
EBs)
<5>[ 2.960000] UBIFS: media format: w4/r0 (latest is w4/r0)
<5>[ 2.960000] UBIFS: default compressor: lzo
<5>[ 2.960000] UBIFS: reserved for root: 1078659 bytes (1053 KiB)
<5>[ 2.980000] UBIFS: un-mount UBI device 2, volume 0
<5>[ 3.030000] UBI: mtd14 is detached from ubi2
<5>[ 3.470000] UBI: attaching mtd14 to ubi2
<5>[ 3.470000] UBI: physical eraseblock size: 131072 bytes (128 KiB)
<5>[ 3.470000] UBI: logical eraseblock size: 129024 bytes
<5>[ 3.470000] UBI: smallest flash I/O unit: 2048
<5>[ 3.470000] UBI: sub-page size: 512
<5>[ 3.470000] UBI: VID header offset: 512 (aligned 512)
<5>[ 3.470000] UBI: data offset: 2048
<5>[ 3.520000] UBI: max. sequence number: 0
<5>[ 3.520000] UBI: attached mtd14 to ubi2
<5>[ 3.520000] UBI: MTD device name: "app_sec"
<5>[ 3.520000] UBI: MTD device size: 24 MiB
<5>[ 3.520000] UBI: number of good PEBs: 192
<5>[ 3.520000] UBI: number of bad PEBs: 0
<5>[ 3.520000] UBI: number of corrupted PEBs: 0
<5>[ 3.520000] UBI: max. allowed volumes: 128
<5>[ 3.520000] UBI: wear-leveling threshold: 4096
<5>[ 3.520000] UBI: number of internal volumes: 1
<5>[ 3.520000] UBI: number of user volumes: 0
<5>[ 3.520000] UBI: available PEBs: 186
<5>[ 3.520000] UBI: total number of reserved PEBs: 6
<5>[ 3.520000] UBI: number of PEBs reserved for bad PEB handling: 2
<5>[ 3.520000] UBI: max/mean erase counter: 20/11
<5>[ 3.520000] UBI: image sequence number: 215132996
<5>[ 3.530000] UBI: background thread "ubi_bgt2d" started, PID 370
<5>[ 3.650000] UBIFS: default file-system created
<5>[ 3.700000] UBIFS: mounted UBI device 2, volume 0, name "app_sec"
<5>[ 3.700000] UBIFS: file system size: 22837248 bytes (22302 KiB, 21 MiB,
177 LEBs)
<5>[ 3.700000] UBIFS: journal size: 1161216 bytes (1134 KiB, 1 MiB, 9 L
EBs)
<5>[ 3.700000] UBIFS: media format: w4/r0 (latest is w4/r0)
<5>[ 3.700000] UBIFS: default compressor: lzo
<5>[ 3.700000] UBIFS: reserved for root: 1078659 bytes (1053 KiB)
<5>[ 3.860000] UBI: attaching mtd15 to ubi3
<5>[ 3.860000] UBI: physical eraseblock size: 131072 bytes (128 KiB)
<5>[ 3.860000] UBI: logical eraseblock size: 129024 bytes
<5>[ 3.860000] UBI: smallest flash I/O unit: 2048
<5>[ 3.860000] UBI: sub-page size: 512
<5>[ 3.860000] UBI: VID header offset: 512 (aligned 512)
<5>[ 3.860000] UBI: data offset: 2048
<5>[ 3.870000] UBI: max. sequence number: 0
<5>[ 3.890000] UBI: attached mtd15 to ubi3
<5>[ 3.890000] UBI: MTD device name: "cfg_pri"
<5>[ 3.890000] UBI: MTD device size: 4 MiB
<5>[ 3.890000] UBI: number of good PEBs: 32
<5>[ 3.890000] UBI: number of bad PEBs: 0
<5>[ 3.890000] UBI: number of corrupted PEBs: 0
<5>[ 3.890000] UBI: max. allowed volumes: 128
<5>[ 3.890000] UBI: wear-leveling threshold: 4096
<5>[ 3.890000] UBI: number of internal volumes: 1
<5>[ 3.890000] UBI: number of user volumes: 0
<5>[ 3.890000] UBI: available PEBs: 26
<5>[ 3.890000] UBI: total number of reserved PEBs: 6
<5>[ 3.890000] UBI: number of PEBs reserved for bad PEB handling: 2
<5>[ 3.890000] UBI: max/mean erase counter: 66/50
<5>[ 3.890000] UBI: image sequence number: 1495003498
<5>[ 3.890000] UBI: background thread "ubi_bgt3d" started, PID 382
<5>[ 4.110000] UBI: attaching mtd16 to ubi4
<5>[ 4.110000] UBI: physical eraseblock size: 131072 bytes (128 KiB)
<5>[ 4.110000] UBI: logical eraseblock size: 129024 bytes
<5>[ 4.110000] UBI: smallest flash I/O unit: 2048
<5>[ 4.110000] UBI: sub-page size: 512
<5>[ 4.110000] UBI: VID header offset: 512 (aligned 512)
<5>[ 4.110000] UBI: data offset: 2048
<5>[ 4.120000] UBI: max. sequence number: 0
<5>[ 4.130000] UBI: attached mtd16 to ubi4
<5>[ 4.130000] UBI: MTD device name: "cfg_sec"
<5>[ 4.130000] UBI: MTD device size: 4 MiB
<5>[ 4.130000] UBI: number of good PEBs: 32
<5>[ 4.130000] UBI: number of bad PEBs: 0
<5>[ 4.130000] UBI: number of corrupted PEBs: 0
<5>[ 4.130000] UBI: max. allowed volumes: 128
<5>[ 4.130000] UBI: wear-leveling threshold: 4096
<5>[ 4.130000] UBI: number of internal volumes: 1
<5>[ 4.130000] UBI: number of user volumes: 0
<5>[ 4.130000] UBI: available PEBs: 26
<5>[ 4.130000] UBI: total number of reserved PEBs: 6
<5>[ 4.130000] UBI: number of PEBs reserved for bad PEB handling: 2
<5>[ 4.130000] UBI: max/mean erase counter: 55/47
<5>[ 4.130000] UBI: image sequence number: 895740281
<5>[ 4.140000] UBI: background thread "ubi_bgt4d" started, PID 390
<5>[ 4.250000] net eth0: Could not find default PHY in 9.
<5>[ 4.250000] net eth0: Try PHY[9] whose id is 0x00008201!
<6>[ 6.250000] PHY: 0:09 - Link is Up - 100/Full
<6>[ 78.230000] device eth0 entered promiscuous mode

 

[Dony Viana]

Dear alastairstevenson,


I have same problem, bellow log to you help me:


# cat /proc/kmsg
<5>Linux version 2.6.38.8 (wangqian@ipcteam2) (gcc version 4.6.1 (Sourcery CodeBench Lite 2011.09-70) )
<5>#75 PREEMPT Mon Jul 14 20:15:03 CST 2014
<4>CPU: ARMv6-compatible processor [4117b365] revision 5 (ARMv6TEJ), cr=00c5387f
<4>CPU: VIPT nonaliasing data cache, VIPT nonaliasing instruction cache
<4>Machine: Coconut
<4>Ignoring unrecognised tag 0x44000426
<4>Memory policy: ECC disabled, Data cache writeback
<6>Ambarella: AHB = 0x60000000[0xf0000000],0x01000000 0
<6>Ambarella: APB = 0x70000000[0xf1000000],0x01000000 0
<6>Ambarella: PPM = 0xc0000000[0xe0000000],0x00200000 9
<6>Ambarella: BSB = 0xc8c00000[0xe8c00000],0x00400000 9
<6>Ambarella: DSP = 0xc9000000[0xe9000000],0x07000000 9
<6>Ambarella: HAL = 0xc00a0000[0xfee00000],0x0000e708 9
<7>On node 0 totalpages: 25344
<7>free_area_init_node: node 0, pgdat c04e5c80, node_mem_map c0506000
<7> Normal zone: 198 pages used for memmap
<7> Normal zone: 0 pages reserved
<7> Normal zone: 25146 pages, LIFO batch:7
<4>bootmem_init: high_memory = 0xc8a00000
<7>pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
<7>pcpu-alloc: [0] 0
<4>Built 1 zonelists in Zone order, mobility grouping on. Total pages: 25146
<5>Kernel command line: console=ttyS0 dbg=0 IP=192.0.0.64 MASK=255.255.255.0 GW=0.0.0.0 SERVER=192.0.0.128 video=amb0fb:720x480,720x480,1,0
<6>PID hash table entries: 512 (order: -1, 2048 bytes)
<6>Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
<6>Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
<6>Memory: 99MB = 99MB total
<5>Memory: 91180k/91180k available, 10196k reserved, 0K highmem
<5>Virtual kernel memory layout:
<5> vector : 0xffff0000 - 0xffff1000 ( 4 kB)
<5> fixmap : 0xfff00000 - 0xfffe0000 ( 896 kB)
<5> DMA : 0xfe600000 - 0xfee00000 ( 8 MB)
<5> vmalloc : 0xc9000000 - 0xe0000000 ( 368 MB)
<5> lowmem : 0xc0000000 - 0xc8a00000 ( 138 MB)
<5> modules : 0xbf000000 - 0xc0000000 ( 16 MB)
<5> .init : 0xc0008000 - 0xc027d000 (2516 kB)
<5> .text : 0xc027d000 - 0xc04c7000 (2344 kB)
<5> .data : 0xc04c8000 - 0xc04e6320 ( 121 kB)
<6>Preemptable hierarchical RCU implementation.
<6> RCU-based detection of stalled CPUs is disabled.
<6> Verbose stalled-CPUs detection is disabled.
<6>NR_IRQS:224
<6>sched_clock: 32 bits at 72MHz, resolution 13ns, wraps every 59652ms
<2>sched_clock: wrong multiply/shift: 1864135111>>27 vs calculated 3728270222>>28
<2>sched_clock: fix multiply/shift to avoid scheduler hiccups
<4>Console: colour dummy device 80x30
<6>console [ttyS0] enabled
<6>Calibrating delay loop... 351.43 BogoMIPS (lpj=1757184)
<6>pid_max: default: 32768 minimum: 301
<4>Mount-cache hash table entries: 512
<6>CPU: Testing write buffer coherency: ok
<6>NET: Registered protocol family 16
<6>Ambarella Coconut:
<6> chip id: 5100
<6> board type: 3
<6> board revision: 10
<6> chip name: a5m
<6> HAL version: 176869
<6> reference clock: 24000000
<6> system configuration: 0x050004ea
<6> boot type: 0x00000002
<6> hif type: 0x00000000
<4>bio: create slab <bio-0> at 0
<6>ambarella-spi ambarella-spi.0: ambarella SPI Controller 0 created
<5>ambarella-i2c ambarella-i2c.0: Ambarella Media Processor I2C adapter[i2c-0] probed!
<5>ambarella-i2c ambarella-i2c.1: Ambarella Media Processor I2C adapter[i2c-1] probed!
<6>i2c i2c-0: Added multiplexed i2c bus 2
<6>ambarella-i2cmux ambarella-i2cmux.0: mux on ambarella-i2c adapter
<6>Switching to clocksource ambarella-cs-timer
<6>NET: Registered protocol family 2
<6>IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
<6>TCP established hash table entries: 4096 (order: 3, 32768 bytes)
<6>TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
<6>TCP: Hash tables configured (established 4096 bind 4096)
<6>TCP reno registered
<6>UDP hash table entries: 256 (order: 0, 4096 bytes)
<6>UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
<6>NET: Registered protocol family 1
<6>Unpacking initramfs...
<0>Initramfs unpacking failed: junk in compressed archive
<6>Freeing initrd memory: 4096K
<0>[ kernel version: svn-83192 ]
<4>mmc0 power register success!
<4>mmc1 power register success!
<1>use default reserved area information!
<6>reboot times :2
<6>msgmni has been set to 186
<6>io scheduler noop registered
<6>io scheduler deadline registered (default)
<6>ambarella-uart.0: ttyS0 at MMIO 0x70005000 (irq = 9) is a ambuart
<6>NAND device: Manufacturer ID: 0x01, Chip ID: 0xf1 (AMD NAND 128MiB 3,3V 8-bit)
<4>ambarella_nand_config_flash: 0x02e00140, 0x02c00140
<7>Bad block table found at page 65472, version 0x01
<7>Bad block table found at page 65408, version 0x01
<6>ambarella-nand ambarella-nand: ambarella_nand_probe: Partition infomation found!
<5>Creating 18 MTD partitions on "ambnand":
<5>0x000000000000-0x000000020000 : "bst"
<5>0x000000020000-0x000000120000 : "ptb"
<5>0x000000120000-0x000000220000 : "bld"
<5>0x000000220000-0x000000320000 : "hal"
<5>0x000000320000-0x000000420000 : "ano_ptb"
<5>0x000000420000-0x0000004a0000 : "env"
<5>0x0000004a0000-0x000000520000 : "param"
<5>0x000000520000-0x000000620000 : "dpt"
<5>0x000000620000-0x000001020000 : "rcvy"
<5>0x000001020000-0x000001820000 : "krn_pri"
<5>0x000001820000-0x000002020000 : "krn_sec"
<5>0x000002020000-0x000002420000 : "rmd_pri"
<5>0x000002420000-0x000002820000 : "rmd_sec"
<5>0x000002820000-0x000004020000 : "app_pri"
<5>0x000004020000-0x000005820000 : "app_sec"
<5>0x000005820000-0x000005c20000 : "cfg_pri"
<5>0x000005c20000-0x000006020000 : "cfg_sec"
<5>0x000006020000-0x000007020000 : "dbg"
<6>Ambarella MII Bus: probed
<5>ambarella-eth ambarella-eth.0: MAC Address[c0:56:e3:f9:12:3c].
<6>mousedev: PS/2 mouse device common for all mice
<6>ambarella-rtc ambarella-rtc: rtc core: registered ambarella-rtc as rtc0
<6>i2c /dev entries driver
<5>ambarella-wdt ambarella-wdt: Ambarella Media Processor Watch Dog Timer[ambarella-wdt].
<6>TCP cubic registered
<6>NET: Registered protocol family 17
<6>ambarella-rtc ambarella-rtc: setting system clock to 2015-06-14 15:24:22 UTC (1434295462)
<6>Freeing init memory: 2516K
<5>net eth0: Could not find default PHY in 9.
<5>net eth0: Try PHY[3] whose id is 0x001cc816!
<5>UBI: attaching mtd13 to ubi1
<5>UBI: physical eraseblock size: 131072 bytes (128 KiB)
<5>UBI: logical eraseblock size: 129024 bytes
<5>UBI: smallest flash I/O unit: 2048
<5>UBI: sub-page size: 512
<5>UBI: VID header offset: 512 (aligned 512)
<5>UBI: data offset: 2048
<5>UBI: max. sequence number: 852
<5>UBI: attached mtd13 to ubi1
<5>UBI: MTD device name: "app_pri"
<5>UBI: MTD device size: 24 MiB
<5>UBI: number of good PEBs: 192
<5>UBI: number of bad PEBs: 0
<5>UBI: number of corrupted PEBs: 0
<5>UBI: max. allowed volumes: 128
<5>UBI: wear-leveling threshold: 4096
<5>UBI: number of internal volumes: 1
<5>UBI: number of user volumes: 1
<5>UBI: available PEBs: 0
<5>UBI: total number of reserved PEBs: 192
<5>UBI: number of PEBs reserved for bad PEB handling: 2
<5>UBI: max/mean erase counter: 11/6
<5>UBI: image sequence number: 1791277343
<5>UBI: background thread "ubi_bgt1d" started, PID 322
<5>UBIFS: recovery needed
<5>UBIFS: recovery completed
<5>UBIFS: mounted UBI device 1, volume 0, name "app_pri"
<5>UBIFS: file system size: 22837248 bytes (22302 KiB, 21 MiB, 177 LEBs)
<5>UBIFS: journal size: 1161216 bytes (1134 KiB, 1 MiB, 9 LEBs)
<5>UBIFS: media format: w4/r0 (latest is w4/r0)
<5>UBIFS: default compressor: lzo
<5>UBIFS: reserved for root: 1078659 bytes (1053 KiB)
<5>UBI: attaching mtd14 to ubi2
<5>UBI: physical eraseblock size: 131072 bytes (128 KiB)
<5>UBI: logical eraseblock size: 129024 bytes
<5>UBI: smallest flash I/O unit: 2048
<5>UBI: sub-page size: 512
<5>UBI: VID header offset: 512 (aligned 512)
<5>UBI: data offset: 2048
<5>UBI: max. sequence number: 284
<5>UBI: attached mtd14 to ubi2
<5>UBI: MTD device name: "app_sec"
<5>UBI: MTD device size: 24 MiB
<5>UBI: number of good PEBs: 192
<5>UBI: number of bad PEBs: 0
<5>UBI: number of corrupted PEBs: 0
<5>UBI: max. allowed volumes: 128
<5>UBI: wear-leveling threshold: 4096
<5>UBI: number of internal volumes: 1
<5>UBI: number of user volumes: 1
<5>UBI: available PEBs: 0
<5>UBI: total number of reserved PEBs: 192
<5>UBI: number of PEBs reserved for bad PEB handling: 2
<5>UBI: max/mean erase counter: 3/2
<5>UBI: image sequence number: 1899091096
<5>UBI: background thread "ubi_bgt2d" started, PID 333
<6>PHY: 0:03 - Link is Up - 100/Full
<5>UBIFS: recovery needed
<5>UBIFS: recovery completed
<5>UBIFS: mounted UBI device 2, volume 0, name "app_sec"
<5>UBIFS: file system size: 22837248 bytes (22302 KiB, 21 MiB, 177 LEBs)
<5>UBIFS: journal size: 1161216 bytes (1134 KiB, 1 MiB, 9 LEBs)
<5>UBIFS: media format: w4/r0 (latest is w4/r0)
<5>UBIFS: default compressor: lzo
<5>UBIFS: reserved for root: 1078659 bytes (1053 KiB)
<5>UBI: attaching mtd15 to ubi3
<5>UBI: physical eraseblock size: 131072 bytes (128 KiB)
<5>UBI: logical eraseblock size: 129024 bytes
<5>UBI: smallest flash I/O unit: 2048
<5>UBI: sub-page size: 512
<5>UBI: VID header offset: 512 (aligned 512)
<5>UBI: data offset: 2048
<5>UBI: max. sequence number: 639
<5>UBI: attached mtd15 to ubi3
<5>UBI: MTD device name: "cfg_pri"
<5>UBI: MTD device size: 4 MiB
<5>UBI: number of good PEBs: 32
<5>UBI: number of bad PEBs: 0
<5>UBI: number of corrupted PEBs: 0
<5>UBI: max. allowed volumes: 128
<5>UBI: wear-leveling threshold: 4096
<5>UBI: number of internal volumes: 1
<5>UBI: number of user volumes: 1
<5>UBI: available PEBs: 0
<5>UBI: total number of reserved PEBs: 32
<5>UBI: number of PEBs reserved for bad PEB handling: 2
<5>UBI: max/mean erase counter: 35/26
<5>UBI: image sequence number: 1722070252
<5>UBI: background thread "ubi_bgt3d" started, PID 344
<5>UBIFS: recovery needed
<5>UBIFS: recovery completed
<5>UBIFS: mounted UBI device 3, volume 0, name "cfg_pri"
<5>UBIFS: file system size: 2193408 bytes (2142 KiB, 2 MiB, 17 LEBs)
<5>UBIFS: journal size: 1032193 bytes (1008 KiB, 0 MiB, 6 LEBs)
<5>UBIFS: media format: w4/r0 (latest is w4/r0)
<5>UBIFS: default compressor: lzo
<5>UBIFS: reserved for root: 103599 bytes (101 KiB)
<5>UBI: attaching mtd16 to ubi4
<5>UBI: physical eraseblock size: 131072 bytes (128 KiB)
<5>UBI: logical eraseblock size: 129024 bytes
<5>UBI: smallest flash I/O unit: 2048
<5>UBI: sub-page size: 512
<5>UBI: VID header offset: 512 (aligned 512)
<5>UBI: data offset: 2048
<5>UBI: max. sequence number: 673
<5>UBI: attached mtd16 to ubi4
<5>UBI: MTD device name: "cfg_sec"
<5>UBI: MTD device size: 4 MiB
<5>UBI: number of good PEBs: 32
<5>UBI: number of bad PEBs: 0
<5>UBI: number of corrupted PEBs: 0
<5>UBI: max. allowed volumes: 128
<5>UBI: wear-leveling threshold: 4096
<5>UBI: number of internal volumes: 1
<5>UBI: number of user volumes: 1
<5>UBI: available PEBs: 0
<5>UBI: total number of reserved PEBs: 32
<5>UBI: number of PEBs reserved for bad PEB handling: 2
<5>UBI: max/mean erase counter: 32/28
<5>UBI: image sequence number: 290347506
<5>UBI: background thread "ubi_bgt4d" started, PID 355
<5>UBIFS: recovery needed
<5>UBIFS: recovery completed
<5>UBIFS: mounted UBI device 4, volume 0, name "cfg_sec"
<5>UBIFS: file system size: 2193408 bytes (2142 KiB, 2 MiB, 17 LEBs)
<5>UBIFS: journal size: 1032193 bytes (1008 KiB, 0 MiB, 6 LEBs)
<5>UBIFS: media format: w4/r0 (latest is w4/r0)
<5>UBIFS: default compressor: lzo
<5>UBIFS: reserved for root: 103599 bytes (101 KiB)

 

[whoslooking]

Silly question here, after reading through the post you have a camera with 5.2.3 on the sticker and it's a Chinese camera but for the looks of things your trying to put US/Euro firmware on it, It will only work if you have done the mtd hack in the past or changed the us/euro firmware to flag 2 (Chinese Region), or you could use this firmware.

https://www.dropbox.com/sh/qqgksfzdu899ha1/AAD3Zp0_tg-dofxme9dq3onTa?dl=0

note: this will work on a Chinese or English camera but the last firmware sticker version the it will work correctly with is 5.2.3

 

[alastairstevenson]

@Tahir Zia

<6>[ 0.370000] Trying to unpack rootfs image as initramfs...
<6>[ 0.420000] rootfs image is not initramfs (junk in compressed archive); lo
oks like an initrd
<6>[ 0.460000] Freeing initrd memory: 4096K

The camera firmware is refusing to load the ramdisk files, possibly because the data in the 'hardware descriptor block in mtdblock5 & 6 has incorrect values for the firmware.
Try the suggestion above from @whoslooking
@Dony Viana

<6>Unpacking initramfs...
<0>Initramfs unpacking failed: junk in compressed archive
<6>Freeing initrd memory: 4096K

The same problem, and the same suggestion.

 

[Dony Viana]

@Tahir Zia

The camera firmware is refusing to load the ramdisk files, possibly because the data in the 'hardware descriptor block in mtdblock5 & 6 has incorrect values for the firmware.
Try the suggestion above from @whoslooking
@Dony Viana

The same problem, and the same suggestion.

Thanks alastairstevenson/whoslooking

I tried update via TFTP with versions 5.2.5 / 5.2.0 but the status remained 'Initialized...'




I'll try to update when I get home with the version above (Dropbox), but what changes the other versions?


- Why this theory TFTP accepted the version available (Dropbox)?


- If successful, the menu had stayed Chines?




*** Remembering that I can now realize the PING command at 192.0.0.64 and my note is configured with fixed IP 192.0.0.128.

 

[alastairstevenson]

Remembering also that you have to use the Hikvision-specific Windows TFTP server, and its best not to connect the camera and PC directly, connect them to a port each on your router or switch.

 

[dlauth]

Any thought to what I can do to get my camera working?

 

[Joshua Parker Ruehlig]

@alastairstevenson
I am having similar symptoms as dlauth after trying to upgrade my camera to 5.3.0 from 5.2.5. After running the TFTP tool and recieving the "Complete file" line, pings to the camera stop working. I cannot ping/telnet/ftp the device after that and it doesn't show on SDAP. And I do have the camera and my computer connected to a switch, not directly each other.


My camera is DS-2CD2432F-IW, the sticker on it say "V5.3.0_150513" but it had firmware 5.2.5 on it when I got it from eBay.
I tried upgrading because PIR events were not showing on '/Event/notification/alertStream', but now I have a bricked camera =/

I'm wondering if there are any other images I could flash over TFTP to get my camera working again? I'm fine with using a Chinese firmware, v5.3.0 is someone has that. Thanks

 

[Joshua Parker Ruehlig]

So I was able to upload the digicap.dav for v5.3.0 Chinese version, and now the camera seems to somewhat work, but I still can't do anything with it.
I see it on SDAP, HTTP Port shows as N/A and DSP Version is blank. Any idea where I can go from here?

 

[alastairstevenson]

Was the 5.2.5 firmware the 'downgrader' version from here (1-line version) ? https://www.ipcamtalk.com/showthread.php/4036-Custom-Firmware-Downgrader-5-3-0-Chinese-to-5-2-5-English
That's been pretty successful in bringing cameras back to English.

If the tftp updater is still being contacted by the camera on startup, there is a good choice of firmware versions on the Hikvision Europe site, here : http://www.hikvisioneurope.com/portal/index.php?dir=Product Firmware/Front-ends/01--IPC/R0 platform(2xx2)/
And if you really want to try the original Chinese version, here at section 6 : http://www1.hikvision.com/cn/download_more_714.html

 

[Joshua Parker Ruehlig]

thanks I was actually able to get a working version of 2.3.5

 

[Joshua Parker Ruehlig]

thanks, I was actually able to get it working by using the procedure @net78 explained here.
https://www.ipcamtalk.com/showthread.php/3408-HIKVISION-mtd-Brick-Recovery-Guide?p=113233&viewfull=1#post113233

now my unit is working like it did before I messed with it. but I'm back to my original issue... my PIR is not working to my liking. do you happen to know if PIR events show on the alertStream for V5.2.5?
https://github.com/waynieack/HikvisionZM/issues/2