Hikvision DS-2CD2x32-I (R0) brick-fix tool / full upgrade method / fixup roundup.

Anyone know if V5.5.53 is safe to upgrade to cameras patched with this method?
I noticed the china website has 5.5.53 on it www1.hikvision.com/cn/download_more_714.html#prettyPhoto
Im not sure if it will work . Im also not sure if that firmware will still be in english
 
I have buy a Chinese DS-2CD3335F-I. V5.5.80_180911. Very good quality camera but i must all translate. Thanks Good it is a web translate...
It is possible to make this English ? :)
 
Good day. I would like to ask for help. The topic has been discussed many times, but I still have a problem. I have a DS-2CD2232-I5 camera. I'm accidentally updating the software in the camera. The camera is dead now. Camera no longer clicks - relay. I don't see the camera in SADP. I tried the BRICK_FIXV2 process, the data transfer was successful, but the camera is still deaf, SADP sees nothing. SADP saw only MINI from Brick_fixV2 in the camera. I looked into the DAVINCI directory and it's empty. Could this be a problem? Missing file in DAVINCI directory? Can there be an error in MDTBLOCK5, MTDBLOCK1? What command would I copy the MDTBLOCK5 file from camera to computer and then back? Thank you for your reply, advice. Sincerely
 
I tried the BRICK_FIXV2 process, the data transfer was successful,
What data transfer process?
Do you mean the firmware update in Stage 3?
If so, what firmware version did you use? The newest that works at that point is 5.4.5
Version 5.4.41 will not, that needs a web GUI update after Stage 3 completion.

What mtdblocks did you change?
I'm wondering why you mentioned mtdblock5. That doesn't need any changes.
The brickfixV2 method automatically handles mtdblock1
Maybe zip up and attach your mtd6ro_mod here so it can be checked.

SADP saw only MINI from Brick_fixV2 in the camera.
That is normal - the brickfixV2 method uses a customised recovery min-system.
 
Good day. All three transfer steps were successful. I used the final firmware from this forum R0_5.4.5. I just edited mtdblock6. The camera never clicks after the voltage is applied - the relay. I want to ask the DAVINCI directory why it is empty ?, not missing the file davinci. *? On the net I read about mtdblock1,5,6 - that's why I ask all the blocks. Thank you for your response.
 
Please refer to your DAVINCI directory. Do you have davinci.tar in it? Here are the zip files:
 

Attachments

  • Screenshot_20200415_180836.jpg
    Screenshot_20200415_180836.jpg
    136.7 KB · Views: 16
  • mtd6_1.zip
    mtd6_1.zip
    6.3 KB · Views: 7
Good evening. There is a "davinci" file in the / DAV directory but without an extension. I don't know why the / DAVINCI directory is created. Do you know why the relay doesn't click in the camera? Is it for a bad firmware - dead camera? // I don't know what to do next. // Thanks for your time.
 
I'm not a programmer, but I have to find out how to establish a connection between a camera and a PC - directory on a PC. Then I could transfer files between directories in the camera and directories in PC. But my field - employment is different, it will probably be a problem for me.?! MS DOS and something from PASCAL and a few from ASSEMBLER I remember from school, but that's been decades back.
 
There is a "davinci" file in the / DAV directory but without an extension.
Yes, that's the main application. Extensions are less meaningful in Linux than Windows, most executables don't have one.

Do you know why the relay doesn't click in the camera?
It's not so much a relay as the 'IR Cut filter' that is controlled by the davinci app based on whether the camera is transitioning between colour and blank/white modes depending on light level and device configuration. If davinci doesn't fully initiallise on a normal startup, the filter will not be operated.

I have to find out how to establish a connection between a camera and a PC - directory on a PC. Then I could transfer files between directories in the camera and directories in PC.
What is it that you want to do?
In the fixup.sh script below are some examples of how files can be transferred in and out at a shell level.
Code:
#brick-fixV2 - a helping hand to do the enhanced mtd hack
SERVER=192.0.0.128
#
# This value will decide if a stage is considered to be complete.
STAGE_STATUS=0
echo "This is the brick-fix and update script which will help you to extract,"
echo "modify and replace mtdblock6 to fix the downgrade block and convert this camera to English updateable."
echo -e "\n** It is no longer necessary to make any changes to mtdblock1 - these have been processed already **"
echo "."
echo "The whole process takes 3 stages."
echo "Stage 1 - mtdblock6 is extracted and sent via tftp to your PC for you to modify."
echo "Stage 2 - the modified mtdblock6 is retrieved by tftp from your PC and applied to the camera."
echo "Stage 3 - the '5.3.0 to 5.2.5 downgrader' firmware is retrieved by tftp from your PC and used to update the camera."
echo "At this point the web GUI in English will be available and allow"
echo "you to do progressive updates from 5.2.5 to 5.3.0 to 5.4.0 to 5.4.5"
echo "."
echo "In each stage, check the content of the logfile fixup_log.txt for the actions taken and the status."
echo "Good luck!"
echo "."
echo "Checking that tftp works OK ..."
echo "Checking that tftp works OK ..." >> /dav/fixup_log.txt
cd /dav
tftp -p -l fixup_log.txt -b 1400 $SERVER
if [ "$?" = "0" ] ; then
    echo -e "\ntftp test transfer worked OK."
    echo "[stage start] fixup_log.txt successfully transferrred to the PC via tftp" >> /dav/fixup_log.txt
    echo "."
fi
#
#
#
#stage3 retrieve and apply the downgrader firmware
if [ -e /dav/fixup_stage3.txt ]; then
    cd /
    echo "."
    tftp -g -r digicap.dav -b 1400 $SERVER
    if [ "$?" = "0" ] ; then
        echo -e "\nSuccessfully transferred in digicap.dav via tftp"
        echo "Successfully transferred in digicap.dav via tftp" >> /dav/fixup_log.txt
        echo "."
        echo "Attempting a firmware update ..."
        echo "Attempting a firmware update ..." >> /dav/fixup_log.txt
        echo "."
        # The upgrade program gives a return value=0 even on failure, so need to assess the result differently.
        /bin/upgrade /digicap.dav > /dav/fixup_upg_ok.txt
        UPG=`cat /dav/fixup_upg_ok.txt | awk '/ERROR/ {print $3}'`
        if [ "$UPG" = "" ] ; then
            echo -e "\nFirmware update appears to be successful.\n"
            echo -e "\nFirmware update appears to be successful.\n" >> /dav/fixup_log.txt
            cat /dav/fixup_upg_ok.txt
            cat /dav/fixup_upg_ok.txt >> /dav/fixup_log.txt
            echo -e "\n\nChanging fixup current status to completed ..."
            echo -e "\n\nChanging fixup current status to completed ..." >> /dav/fixup_log.txt
            echo "Stage3 is completed - the camera should now be full English and updateable."
            STAGE_STATUS=2
            echo "Fixup stage3 completed - the camera should now be full English and updateable." > /dav/fixup_stages_completed.txt
            rm /dav/fixup_stage3.txt
        else
            echo -e "\n*** error doing the firmware update. ****"
            echo "*** error doing the firmware update. ****" >> /dav/fixup_log.txt
        fi
    else
        echo -e "\n*** error transferring digicap.dav via tftp from the PC. ****"
        echo "*** error transferring digicap.dav via tftp from the PC. ****" >> /dav/fixup_log.txt
    fi
    echo "."
fi
#
#
#
#stage2 retrieve and apply the modified mtdblocks
if [ -e /dav/fixup_stage2.txt ]; then
    cd /
    echo "."
    tftp -g -r mtd6ro_mod -b 1400 $SERVER
    if [ "$?" = "0" ] ; then
        echo -e "\nSuccessfully transferred in mtd6ro_mod via tftp"
        echo "Successfully transferred in mtd6ro_mod via tftp" >> /dav/fixup_log.txt
        cat mtd6ro_mod > /dev/mtdblock6
        echo "Written mtd6ro_mod to mtdblock6 ..."
        echo "Written mtd6ro_mod to mtdblock6 ..." >> /dav/fixup_log.txt
#        echo -e "\nChecking if there is an mtd1ro_mod to apply ..."
#        echo "Checking if there is an mtd1ro_mod to apply ..." >> /dav/fixup_log.txt
#        tftp -g -r mtd1ro_mod -b 1400 $SERVER
#        if [ "$?" = "0" ] ; then
#            echo -e "\nSuccessfully transferred in mtd1ro_mod via tftp"
#            echo "Successfully transferred in mtd1ro_mod via tftp" >> /dav/fixup_log.txt
#            cat mtd1ro_mod > /dev/mtdblock1
#            echo "Written mtd1ro_mod to mtdblock1 ..."
#            echo "Written mtd1ro_mod to mtdblock1 ..." >> /dav/fixup_log.txt
#        else
#            echo -e "\n**** mtd1ro_mod not available via tftp from the PC. ****"
#            echo "**** mtd1ro_mod not found via tftp from the PC. ****" >> /dav/fixup_log.txt
#        fi
        echo "Fixup stage2 is completed - Applied the modified mtdblock"
        echo "Fixup stage2 is completed - Applied the modified mtdblock" > /dav/fixup_stage3.txt
        echo "Initialising fixup next status to stage3 ..." >> /dav/fixup_log.txt
        echo "Initialising fixup next status to stage3 ..."
        echo -e "\nPlease ensure that your required firmware update is named digicap.dav and is available for transfer\n"
        STAGE_STATUS=1
        rm /dav/fixup_stage2.txt
    else
        echo -e "\n*** error transferring mtd6ro_mod via tftp from the PC. ****"
        echo "*** error transferring mtd6ro_mod via tftp from the PC. ****" >> /dav/fixup_log.txt
    fi
    echo "."
fi
#
#
#
# Stage1 extract the original mtdblocks
if [ -e /dav/fixup_stage1.txt ]; then
    echo "Extracting the original mtdblocks ..." >> /dav/fixup_log.txt
    cat /dev/mtd6ro > /mtd6ro_orig
    echo "Extracted the original mtdblock6 as mtd6ro_orig"
    echo "Extracted the original mtdblock6 as mtd6ro_orig" >> /dav/fixup_log.txt
    cat /dev/mtd1ro > /mtd1ro_orig
    echo "Extracted the original mtdblock1 as mtd1ro_orig"
    echo "Extracted the original mtdblock1 as mtd1ro_orig" >> /dav/fixup_log.txt
    echo "Transferring out mtd6ro_orig via tftp ..."
    echo "Transferring out mtd6ro_orig via tftp ..." >> /dav/fixup_log.txt
    cd /
    echo "."
    tftp -p -l mtd6ro_orig -b 1400 $SERVER
    if [ "$?" = "0" ] ; then
        echo "Successfully transferred out mtd6ro_orig via tftp" >> /dav/fixup_log.txt
        echo -e "\nSuccessfully transferred out mtd6ro_orig via tftp"
        rm mtd6ro_orig
        echo "Transferring out mtd1ro_orig via tftp ..." >> /dav/fixup_log.txt
        tftp -p -l mtd1ro_orig -b 1400 $SERVER
        echo -e "\nSuccessfully transferred out mtd1ro_orig via tftp"
        echo "Successfully transferred out mtd1ro_orig via tftp" >> /dav/fixup_log.txt
        rm mtd1ro_orig
        STAGE_STATUS=1
        rm /dav/fixup_stage1.txt
        echo "Fixup Stage1 is completed - Extracted the original mtdblocks"
        echo "Fixup Stage1 is completed - Extracted the original mtdblocks" >> /dav/fixup_log.txt
        echo "Fixup Stage1 completed - Extracted the original mtdblocks" > /dav/fixup_stage2.txt
        echo "."
        echo "Transferring out fixup_log.txt via tftp for you to check ..."
        echo "."
        echo "Your Stage2 task now is to make a copy of mtd6ro_orig named as mtd6ro_mod"
        echo "and to carry out the 'enhanced mtd hack' on it."
        echo "This means setting the language byte at 0x10 to 1, checking/changing as needed the devType"
        echo "bytes at 0x64,0x65 and recalculating and applying the checksum-16 value at 0x04,0x05"
#        echo "Also required is to check mtd1ro_orig for the values at locations 0x0C and 0x8000C"
#        echo "If these are 0, make a copy named as mtd1ro_mod, and change those values to 01"
        echo "When that has been done, run this /dav/fixup.sh script again for Stage2"
        echo "which will transfer the file in and apply it to the camera."
    else
        echo -e "\n*** error transferring mtd6ro_orig via tftp to the PC. ****"
        echo "*** error transferring mtd6ro_orig via tftp to the PC. ****" >> /dav/fixup_log.txt
    fi
    echo "."
fi
#
#     
echo "."
echo "Each stage of the process is carried out by a run of the /dav/fixup.sh script ..."
echo "The next stage is :"
ls -al /dav/fixup_stage*
echo -e ".\n.\n"
echo -e "End of script - ready for the next run.\n." >> /dav/fixup_log.txt
cd /dav
tftp -p -l fixup_log.txt -b 1400 $SERVER
if [ "$STAGE_STATUS" = "0" ] ; then
    echo -e "\n*** An error has occurred. Check the on-screen messages and the contents of the logfile   ***"
    echo "*** fixup_log.txt that was transferred to your PC and after correcting the cause of the   ***"
    echo "*** error re-run the script /dav/fixup.sh to resume.                                      ***"
    /usr/sbin/set_sysflag -m 1
else
    if [ "$STAGE_STATUS" = "1" ] ; then
    echo -e "\nEnd of script - ready for the next run."
    /usr/sbin/set_sysflag -m 1
    fi
fi
#
if [ "$STAGE_STATUS" = "2" ] ; then
    echo -e "\nmtdblock and firmware updates are completed. Now power cycle the camera and log in to the web GUI for full firmware upgrades."
    /usr/sbin/set_sysflag -m 0
fi
#Ends
 
Thank you for the info. I think I may have a problem in the / DAV / davinci file and therefore the camera does not initialize = "IR Cut filter". That's why she doesn't click. I've found the davinci.tar file on the HDD, which is packed with davinci. I bi could try to overwrite the file in the camera, but I don't know how - commands.
 
Hi, I have a DS-2CD2532F-IS camera that is bricked. I loaded the brickfix with tftp and it completed the process and I got the "System update completed" message (step 5 of your instruction). After I did a power cycle on the camera, I can't ping or telnet into 192.0.0.64.

My computer is at 192.0.0.128 and I am connected via a switch. Using wireshark, I do see the initial "request for tftp" traffic from 192.0.0.64, but nothing afterward. I am a bit lost here.
 
Normally at this stage the camera should still show in SADP as 'Active' at 192.0.0.64 with firmware 4.0.8 (ie in recovery mode) and with telnet access available.

Maybe try the tftp updater again.

Thank you for the replies. I tried redoing the tftp process multiple times and each time I can see the message "Device[192.0.0.64] test tftpserver" but never get to the "Connect client[192.0.0.64] success" step.

If I have to use the serial connection to restore the firmware, are there any good instructions? I found this but this is referring to NVR. Would it be the same process for IP Cam?: Hikvision - Clearing Passwords and/or Loading Firmware via TTL Serial

Thanks again.
 
If I have to use the serial connection to restore the firmware, are there any good instructions?
The serial console will provide much more information about the cause of the problem, and some chances to get round it.

You will need -
A 4-pin 1.5mm ZH JST wired connector, usually sold in 10-packs.
A USB to serial TTL convertor, such as a PL2303TA-based device.
 
The serial console will provide much more information about the cause of the problem, and some chances to get round it.

Took a while to get the parts but I finally got it! I have terminal access to the camera. However, I still don't know what is the issue or the fix when I am in the console. I ran tftpboot and it is able to grab the digicap.dav file from my tftp server but I never get the "Device [192.0.0.64] system update completed!" step. If I run the "update" command, the terminal just freezes.

If you can help, I would really appreciate it. Otherwise, I am at a lost and about to throw in the white towel. Thank you!

Output of the terminal below:

Code:
HKVS # printenv
ipaddr=192.0.0.64
serverip=192.0.0.128
gatewayip=0.0.0.0
netmask=255.255.255.0
ethaddr=c4:2f:90:18:a4:c3
loadaddr=0xc2000000
bootfile=digicap.dav
bootcmd=';update'
bootargs=console=ttyS0 initrd=0xc0a00000,0x400000 rw root=/dev/ram dbg=0
bootdelay=2
HKVS # tftpboot
Unknown command:tftpboot
HKVS # tftpboot
[ INFO][BLD]TFTP: MAC: c4:2f:90:18:a4:c3
[ INFO][BLD]TFTP: TFTP from server 192.0.0.128; our IP address is 192.0.0.64
[ INFO][BLD]TFTP: Filename: 'digicap.dav'
[ INFO][BLD]TFTP: ################################################################################
[ INFO][BLD]TFTP: ################################################################################
[ INFO][BLD]TFTP: ################################################################################
[ INFO][BLD]TFTP: ################################################################################
[ INFO][BLD]TFTP: ################################################################################
[ INFO][BLD]TFTP: ################################################################################
[ INFO][BLD]TFTP: ################################################################################
[ INFO][BLD]TFTP: ################################################################################
[ INFO][BLD]TFTP: ################################################################################
[ INFO][BLD]TFTP: ################################################################################
[ INFO][BLD]TFTP: ################################################################################
[ INFO][BLD]TFTP: ####################################
[ INFO][BLD]TFTP: File size is 23458645 bytes (22908 KB)
HKVS # reset
Unknown command:reset
▒KVS # reset

U-Boot 1.3.4-113988 (Mar 20 2015 - 17:36:32)

ARM Clock: 480MHz
DDR Clock: 336MHz
Hit Ctrl+u to stop autoboot: 0