Hikvision DS-2CD2x32-I (R0) brick-fix tool / full upgrade method / fixup roundup.

[Iemand91]

Looks good to me so far, i would just double check the checksum value as all my 3 cameras required i change both 04 and 05.

Great.
Just to be sure; I did double check the checksum value again and it turned out to be 0DB6 again (as expected).
Flip those numbers and location 04 becomes "B6" and location 05 "0D".
Since location 05 is already "0D"; I don't have to change that number.

0x8000C is way down in that file, if you scroll you will see the numbers on the left rising. When you get to 00080000 move your cursor over to the 0C column and you should see the offset at the bottom change to 8000c to verify.

I changed the first number to 2, so changed "00" to "20". I'm not sure if thats correct but it worked on all 3 of my cameras.

Yep, you're right. I've found it and changed it to "02".

Should be good to go, looks okay to me but you might want to wait for Alastair to verify.

Just to be sure I did.

mtdblock6 is looking good, well done!
And as you have determined, mtdblock1 does need the tweak as well, in the location 0x0C and also in 0x8000C which as @markb has usefully advised is way down the file.
After you've done that and written tdblock6 and mtdblock1 back - you're good to go!

Awesome. From not understanding a single bit about this to (about to) doing this hack.
But I'll wait for tomorrow; it's 23:17 now and I want to do well rested.

 

[idex]

Thanks to the OP and the quick and dirty poster of the instructions. Worked perfectly to go from 5.2.5 to 5.4.5. My camera was mysteriously reset so hopefully the upgrade does the trick.

Another 2032 camera updated.

This one only took me 30 minutes, its easy once you know what to do.

These are the steps i personally took:

 

[Iemand91]

@markb and @alastairstevenson; you guys rock!

I succesfully did the hack and now I'm running firmware V5.4.5 instead of the old 5.2.5.
Went from 5.2.5 to 5.3.0, 5.4.0 and finally 5.4.5.

Many, many thanks!

Now, lets' see what has been added/changed in these firmwares...

 

[alastairstevenson]

I succesfully did the hack and now I'm running firmware V5.4.5 instead of the old 5.2.5.

Wow!
Well done indeed, another good result.

 

[cctvukuser]

My thanks to @alastairstevenson, much appreciated!

Managed to update 3 x 2CD3332's (CH serial / 2014) up to 5.4.5. Unable to downgrade 2 x 2CD3335 (5.3.6 & 5.3.8) to 5.2.5 but i've tested using @bp2008 password tool and they don't appear to be vulnerable.

 

[alastairstevenson]

Managed to update 3 x 2CD3332's (CH serial / 2014) up to 5.4.

Great, well done!

Unable to downgrade 2 x 2CD3335 (5.3.6 & 5.3.8) to 5.2.5

I have what was a Chinese menu DS-2CD3335D G0 series camera that refused any firmware, down or up, by any method.
That was, until I accidentally wiped it. Long-shot help request - Hikvision DS-2CD3335D - G0 series IPC.

But - just for the avoidance of doubt, for other readers, the 'brick-fix tool' and downgrader referenced in this thread is specific to 2x32 (R0 series) cameras.

 

[cctvukuser]

I have what was a Chinese menu DS-2CD3335D G0 series camera that refused any firmware, down or up, by any method.
That was, until I accidentally wiped it. Long-shot help request - Hikvision DS-2CD3335D - G0 series IPC.

But - just for the avoidance of doubt, for other readers, the 'brick-fix tool' and downgrader referenced in this thread is specific to 2x32 (R0 series) cameras.

Yeah sorry i should have been clearer, my downgrade attempts i've tried various solutions and just couldn't get it to work.

I've gone back to the original Aliexpress seller and asked if they can offer a possible firmware upgrade route retaining the English menus.

Once again though many thanks for sharing

 

[chubros]

Have anyone tried at ds-2cd2032f-i ? It is at 5.3.0 and dont know where to start. At the ssh prompt cannot even run cd command. Any help appreciated.

 

[alastairstevenson]

Have anyone tried at ds-2cd2032f-i

That's been one of the more common models, works OK.
Is this a Chinese camera that would be problematic updating directly?

At the ssh prompt cannot even run cd command.

The 5.3.0 firmware has the Hikvision 'psh' restricted shell, it does not allow any useful changes to be done.

It is at 5.3.0 and dont know where to start.

Use the '@whoslooking 5.3.0 to 5.2.5 downgrader' to get to a firmware version where you can safely make changes to pave the way for a full upgrade.

 

[Tsarsky]

@alastairstevenson, thanks for the help!

Yesterday I updated the camera DS-2CD2432F-IW.
In the camera was installed firmware V5.2.5 build 141201 (in the firmware were made changes "hiktools05r1 lang digicap.dav 1").
I opened the original mtdblock6 and saw that 00000010 x 00 = 01

I made changes in the following places:
00000000 x 04 = 52 I changed to 7C,
00000000 x 05 = 0С I changed to 0D,
00000060 with 04 = FF I changed to 07.

I changed the mtdblock6 into the camera, restarted the camera, then updated it to 530, 540, 545.

Firmware 525 recognized the built-in pir sensor, and firmware 545 camera would stop seeing the built-in pir sensor.

Write, please, what does mtdblock6 affect?
I could break something in mtdblock 6, so that the camera would stop seeing the built-in pir sensor?

p.s. I noticed an interesting feature, after the hack and upgrade in the Ivms4200 program, it became possible to enable SSH, there is no SSH point via the Web. On official other cameras with the same firmware, you can not enable it through Ivms4200.



# prtHardInfo
Start at 2017-10-10 17:29:27
Serial NO S-2CD2432F-IW20150730CCCH***
V5.2.5 build 141201
hardwareVersion = 0x0
hardWareExtVersion = 0x0
encodeChans = 1
decodeChans = 1
alarmInNums = 1
alarmOutNums = 1
ataCtrlNums = 0
flashChipNums = 0
ramSize = 0x4000000
networksNums = 1
language = 1
devType = 38930
net reboot count = 0
SD status = 1 (1:noraml;0:none)

I returned to 525, after replacing the mtdblock6, a built-in pir sensor appeared in the menu.

 

[alastairstevenson]

devType = 38930

In the prtHardInfo, the camera devType=38930 which in hex is 0x9812
Therefore the correct value for your location 0x64 is 0x12, not 0x07

00000060 with 04 = FF I changed to 07.

In effect, you are telling the firmware that it is a different camera, one that does not have a PIR sensor.
Where did you get the value 0x07 from? In the instructions, it says thatthe true value must come from the info shown in prtHardInfo.

So you need to change the value in 0x64 to 0x12 and re-calculate the checksum.

Good luck!
I'm sure it will be fine.

 

[chubros]

That's been one of the more common models, works OK.
Is this a Chinese camera that would be problematic updating directly?

The 5.3.0 firmware has the Hikvision 'psh' restricted shell, it does not allow any useful changes to be done.

Use the '@whoslooking 5.3.0 to 5.2.5 downgrader' to get to a firmware version where you can safely make changes to pave the way for a full upgrade.

I have tried the 530 to 525 downgrade but it fails. (device was not return to 5.2.5). So i upload the brick fix en version and after that i tried the 530 to 525 downgrade. Then do the mtd hack and everything runs smoothly.. Another success.. So how many thanks is enough???

 

[alastairstevenson]

I have tried the 530 to 525 downgrade but it fails. (device was not return to 5.2.5

If the camera has had an upgrade attempt using 5.4.0 or higher, a 'downgrade block' will stop 5.2.5 being installed.
Why do Hikvision do this when the newer firmware does not run? Because they want the camera to go into a 'Catch-22 can't update / new firmware won't run / can't downgrade, we've added code to stop that' state where it's 'bricked'.

So i upload the brick fix en version and after that i tried the 530 to 525 downgrade.

This removes the 'downgrade block' and allows recovery of the camera.

then do the mtd hack and everything runs smoothly.. Another success..

Which is actually what should usually happen on a normal firmware update, as it does with other manufacturers.

Well done for getting there!

 

[copex]

Just a question on mtdblock1 "0x0C and 0x8000C" i have two cameras i was looking to upgrade, one camera the 0x0C and 0x8000C value is 00 and on the other the value is 01 should i change the value to 02 on both of the mtdblock1 or just the file where the value is 00?

possible IPC version one was 5.2.5 and the other one was 5.2.8

 

[alastairstevenson]

just the file where the value is 00?

Just where it's 0 is what I believe is the only one needing to be changed.
I think 01 works OK as well as 02 - 0 definitely doesn't.
There would be no harm updating both.

These are the 'upgrade success counts' for pri and sec app partitions from the last attempted firmware update.
For a new camera these should be pre-defined correctly - and it looks like on those manufactured with 5.2.8 firmware installed they were not.
Presumably the camera with 0 is the one that had firmware 5.2.8 on the label.

 

[izzner]

Thanks a lot.

I have finally upgraded my Chinese DS-2CD2632F-IS to 5.3(I know its still old firmware but its a start)

 

[izzner]

Now to go to 5.4 >>5.4.5 >> 5.5.0

Fingers crossed

 

[alastairstevenson]

I've not seen it yet for the R0 series.
Maybe skip going to 5.5.0
It seems to have a few issues judging from user experience so far on other camera series.

 

[izzner]

OK finally managed to upgrade to 5.4 and then to 5.4.5.
Its not possible to use browser(FF54/Chrome/IE) to update.
IVMS 4200 did the trick. The update from 5.3 to 5.4 is awefully slow for some reason.

 

[alastairstevenson]

Well done.
Yet another good result, loads behind the scenes too, totally lost count.