Hikvision DS-2CD2x32-I (R0) brick-fix tool / full upgrade method / fixup roundup.

markb said:
Looks good to me so far, i would just double check the checksum value as all my 3 cameras required i change both 04 and 05.
Click to expand...
Great.
Just to be sure; I did double check the checksum value again and it turned out to be 0DB6 again (as expected).
Flip those numbers and location 04 becomes "B6" and location 05 "0D".
Since location 05 is already "0D"; I don't have to change that number.
0x8000C is way down in that file, if you scroll you will see the numbers on the left rising. When you get to 00080000 move your cursor over to the 0C column and you should see the offset at the bottom change to 8000c to verify.

I changed the first number to 2, so changed "00" to "20". I'm not sure if thats correct but it worked on all 3 of my cameras.
Click to expand...
Yep, you're right. I've found it and changed it to "02".
Should be good to go, looks okay to me but you might want to wait for Alastair to verify.
Click to expand...
Just to be sure I did.
alastairstevenson said:
mtdblock6 is looking good, well done!
And as you have determined, mtdblock1 does need the tweak as well, in the location 0x0C and also in 0x8000C which as @markb has usefully advised is way down the file.
After you've done that and written tdblock6 and mtdblock1 back - you're good to go!
Click to expand...
Awesome. From not understanding a single bit about this to (about to) doing this hack.
But I'll wait for tomorrow; it's 23:17 now and I want to do well rested.:rolleyes:
 
Last edited:
  • Like
Reactions: alastairstevenson
Thanks to the OP and the quick and dirty poster of the instructions. Worked perfectly to go from 5.2.5 to 5.4.5. My camera was mysteriously reset so hopefully the upgrade does the trick.

markb said:
Another 2032 camera updated.

This one only took me 30 minutes, its easy once you know what to do.

These are the steps i personally took:
Click to expand...
 
  • Like
Reactions: alastairstevenson
@markb and @alastairstevenson; you guys rock!

I succesfully did the hack and now I'm running firmware V5.4.5 instead of the old 5.2.5.
Went from 5.2.5 to 5.3.0, 5.4.0 and finally 5.4.5.

Many, many thanks!

Now, lets' see what has been added/changed in these firmwares...
 
  • Like
Reactions: Klippy
cctvukuser said:
Managed to update 3 x 2CD3332's (CH serial / 2014) up to 5.4.
Click to expand...
Great, well done!
cctvukuser said:
Unable to downgrade 2 x 2CD3335 (5.3.6 & 5.3.8) to 5.2.5
Click to expand...
I have what was a Chinese menu DS-2CD3335D G0 series camera that refused any firmware, down or up, by any method.
That was, until I accidentally wiped it. Long-shot help request - Hikvision DS-2CD3335D - G0 series IPC.

But - just for the avoidance of doubt, for other readers, the 'brick-fix tool' and downgrader referenced in this thread is specific to 2x32 (R0 series) cameras.
 
  • Like
Reactions: vasycara and cctvukuser
alastairstevenson said:
I have what was a Chinese menu DS-2CD3335D G0 series camera that refused any firmware, down or up, by any method.
That was, until I accidentally wiped it. Long-shot help request - Hikvision DS-2CD3335D - G0 series IPC.

But - just for the avoidance of doubt, for other readers, the 'brick-fix tool' and downgrader referenced in this thread is specific to 2x32 (R0 series) cameras.
Click to expand...
Yeah sorry i should have been clearer, my downgrade attempts i've tried various solutions and just couldn't get it to work.

I've gone back to the original Aliexpress seller and asked if they can offer a possible firmware upgrade route retaining the English menus.

Once again though many thanks for sharing :)
 
  • Like
Reactions: alastairstevenson
Have anyone tried at ds-2cd2032f-i ? It is at 5.3.0 and dont know where to start. At the ssh prompt cannot even run cd command. Any help appreciated.
 
chubros said:
Have anyone tried at ds-2cd2032f-i
Click to expand...
That's been one of the more common models, works OK.
Is this a Chinese camera that would be problematic updating directly?
chubros said:
At the ssh prompt cannot even run cd command.
Click to expand...
The 5.3.0 firmware has the Hikvision 'psh' restricted shell, it does not allow any useful changes to be done.
chubros said:
It is at 5.3.0 and dont know where to start.
Click to expand...
Use the '@whoslooking 5.3.0 to 5.2.5 downgrader' to get to a firmware version where you can safely make changes to pave the way for a full upgrade.
 
@alastairstevenson, thanks for the help!

Yesterday I updated the camera DS-2CD2432F-IW.
In the camera was installed firmware V5.2.5 build 141201 (in the firmware were made changes "hiktools05r1 lang digicap.dav 1").
I opened the original mtdblock6 and saw that 00000010 x 00 = 01

I made changes in the following places:
00000000 x 04 = 52 I changed to 7C,
00000000 x 05 = 0С I changed to 0D,
00000060 with 04 = FF I changed to 07.

I changed the mtdblock6 into the camera, restarted the camera, then updated it to 530, 540, 545.

Firmware 525 recognized the built-in pir sensor, and firmware 545 camera would stop seeing the built-in pir sensor.

Write, please, what does mtdblock6 affect?
I could break something in mtdblock 6, so that the camera would stop seeing the built-in pir sensor?

p.s. I noticed an interesting feature, after the hack and upgrade in the Ivms4200 program, it became possible to enable SSH, there is no SSH point via the Web. On official other cameras with the same firmware, you can not enable it through Ivms4200.

original.jpg modified.jpg

# prtHardInfo
Start at 2017-10-10 17:29:27
Serial NO :DS-2CD2432F-IW20150730CCCH***
V5.2.5 build 141201
hardwareVersion = 0x0
hardWareExtVersion = 0x0
encodeChans = 1
decodeChans = 1
alarmInNums = 1
alarmOutNums = 1
ataCtrlNums = 0
flashChipNums = 0
ramSize = 0x4000000
networksNums = 1
language = 1
devType = 38930
net reboot count = 0
SD status = 1 (1:noraml;0:none)

I returned to 525, after replacing the mtdblock6, a built-in pir sensor appeared in the menu.
 
Last edited:
Tsarsky said:
devType = 38930
Click to expand...
In the prtHardInfo, the camera devType=38930 which in hex is 0x9812
Therefore the correct value for your location 0x64 is 0x12, not 0x07
Tsarsky said:
00000060 with 04 = FF I changed to 07.
Click to expand...
In effect, you are telling the firmware that it is a different camera, one that does not have a PIR sensor.
Where did you get the value 0x07 from? In the instructions, it says thatthe true value must come from the info shown in prtHardInfo.

So you need to change the value in 0x64 to 0x12 and re-calculate the checksum.

Good luck!
I'm sure it will be fine.
 
alastairstevenson said:
That's been one of the more common models, works OK.
Is this a Chinese camera that would be problematic updating directly?

The 5.3.0 firmware has the Hikvision 'psh' restricted shell, it does not allow any useful changes to be done.

Use the '@whoslooking 5.3.0 to 5.2.5 downgrader' to get to a firmware version where you can safely make changes to pave the way for a full upgrade.
Click to expand...

I have tried the 530 to 525 downgrade but it fails. (device was not return to 5.2.5). So i upload the brick fix en version and after that i tried the 530 to 525 downgrade. Then do the mtd hack and everything runs smoothly.. Another success.. So how many thanks is enough??? :) :) :)
 
  • Like
Reactions: alastairstevenson
chubros said:
I have tried the 530 to 525 downgrade but it fails. (device was not return to 5.2.5
Click to expand...
If the camera has had an upgrade attempt using 5.4.0 or higher, a 'downgrade block' will stop 5.2.5 being installed.
Why do Hikvision do this when the newer firmware does not run? Because they want the camera to go into a 'Catch-22 can't update / new firmware won't run / can't downgrade, we've added code to stop that' state where it's 'bricked'.
chubros said:
So i upload the brick fix en version and after that i tried the 530 to 525 downgrade.
Click to expand...
This removes the 'downgrade block' and allows recovery of the camera.
chubros said:
then do the mtd hack and everything runs smoothly.. Another success..
Click to expand...
Which is actually what should usually happen on a normal firmware update, as it does with other manufacturers.

Well done for getting there!
 
  • Like
Reactions: chubros
Just a question on mtdblock1 "0x0C and 0x8000C" i have two cameras i was looking to upgrade, one camera the 0x0C and 0x8000C value is 00 and on the other the value is 01 should i change the value to 02 on both of the mtdblock1 or just the file where the value is 00?

possible IPC version one was 5.2.5 and the other one was 5.2.8
 
copex said:
just the file where the value is 00?
Click to expand...
Just where it's 0 is what I believe is the only one needing to be changed.
I think 01 works OK as well as 02 - 0 definitely doesn't.
There would be no harm updating both.

These are the 'upgrade success counts' for pri and sec app partitions from the last attempted firmware update.
For a new camera these should be pre-defined correctly - and it looks like on those manufactured with 5.2.8 firmware installed they were not.
Presumably the camera with 0 is the one that had firmware 5.2.8 on the label.
 
  • Like
Reactions: izzner, catseyenu and copex
Thanks a lot.

I have finally upgraded my Chinese DS-2CD2632F-IS to 5.3(I know its still old firmware but its a start)

upload_2017-10-15_20-12-18.jpeg
 
OK finally managed to upgrade to 5.4 and then to 5.4.5.
Its not possible to use browser(FF54/Chrome/IE) to update.
IVMS 4200 did the trick. The update from 5.3 to 5.4 is awefully slow for some reason.

upload_2017-10-16_0-10-42.png
 
You must log in or register to reply here.
Top Bottom