Hikvision DS-2CD2x32-I (R0) brick-fix tool / full upgrade method / fixup roundup.

Fantastic post - really useful.

I have performed all the steps to amend MTBLOCK6 and MTDBLOCK1. I reboot the camera and it is still working on 5.2.5, so I proceed with a 5.3.0 FW upgrade. After a reboot the camera appears as DS-2CD-Min-System in SADP. I follow the downgrader steps to get the camera working on 5.2.5 once more.

I repeat the very same steps, and double check the modified MTBLOCK files by downloading them from the camera and confirm they contain the correct info.

Each time I try a 5.2.5 to 5.3.0 upgrade ( I have tried several 5.3.0 files ) the camera always boots into recovery mode.

Puzzling and frustrating as it feels I am 99% there....

UPDATE: completely my fault, I had incorrectly changed the mtdblock1 values from 00 to 02 and not 00 to 01. I thought I had read that they could be 02. Not sure if this caught anyone else out but if it did, make sure you change 00 to 01 in MTDBLOCK1 file
 

Attachments

Last edited:
  • Like
Reactions: alastairstevenson
I have one camera 2cd3132F_IWS012015082"CCRR536"""" v 5.3.0 150513

I tried with the downgrader 5.3 -> 5.2.5 but it failed. TFTP says transmit

Now the camera is in v4.0.8 mode i tried different CN firmware digicaps but its the same

EN firmware worked. Now the camera is CCCH
 
Last edited:
Uku said:
I tried with the downgrader 5.3 -> 5.2.5 but it failed. TFTP says transmit
Click to expand...
There is an EN version and a CN version of the downgrader. Which did you try?
Have you tried to load any firmware above 5.3.0 ? If so, you will need the 'brick-fix tool' to remove the downgrade block.

*edit* This assumes the 3132 is the same hardware as a 2132 - which I can't confirm.
 
Yes i found en downgrader digicap and tftp.
I had some minor problems with windows firewall.(tftp didnt work)
 
Todely said:
You have use downgrade firmware 5.2.5 En (on other thread) with tftp ?
Click to expand...
It is possible to modify mtdblock6 hardware signature block on newer firmware - but it looks like Hikvision have created a trap for that activity, possibly to catch those that have done the 'mtd hack' to convert to English.
I only tried that once, didn't feel inclined to re-visit to figure which exact version of firmware had the trap in it.
Check this out : A new Hikvision tripwire.
 
Thanks for the effort guys, worked fine with modding the mtd6 and mtd1 blocks with 2732F. Has anyone tried to upgrade later than 5.4.5 with the mtd mods?
 
My DS-2CD2532F-IWS has the mtdblock1 empty (full FF). Should I change something in the mtdblock5 with that model or is changing mtd6 enough?
Edit. Actually I found the same part from mtdblock5 than in the mtdblock6 so I made the same changes to mtd5.

Regarding the newer firmware than 5.4.5, I mixed up the R6 with the newer firmwares with the R0 ones. So it seems that the 5.4.5 might be the last fw for the R0 models.
 
Last edited:
ressue said:
My DS-2CD2532F-IWS has the mtdblock1 empty (full FF).
Click to expand...
That sounds like 5.2.0 or older firmware was on it. I don't think that will be a problem - if the new firmware finds this block erased like that, it creates a new template and keeps goiing.
ressue said:
Should I change something in the mtdblock5 with that model or is changing mtd6 enough?
Click to expand...
So far, with loads of devices, I've seen none that also need mtdblock5 changed.
But we've got to give Hikvision something to check and hook on to when they try to brick those cameras that have had the 'enhanced mtd hack' with the next firmware release.
ressue said:
So it seems that the 5.4.5 might be the last fw for the R0 models.
Click to expand...
I would not be surprised - unless they want to break a few things for spite.
 
alastairstevenson said:
I was not going to post these details in public, to reduce the chance of Hikvision blocking them in future firmware - though no such inhibitions in private, quite busy on the topic!
Click to expand...
I just wanted to say thanks for posting all this! I have some DS-2CD2532F-IS cameras that had been getting randomly (or so I thought) factory reset. I found a thread on that topic which led me here, and with the instructions in your files I was able to get all my (Chinese hacked) cameras updated cleanly from 5.2.5 to 5.4.5 without any issues (plus fixing my router security settings, changed all the passwords, etc.).

Thanks for your public service!
 
  • Like
Reactions: alastairstevenson
Just updated the first one of my two 2CD-2132F with 5.2.5 firmware that showed random factory reset.
I've found that the mtdblock1 was filled with FF, so I was a bit scared to go ahead, but everything's went fine.
Updated to 5.4.5 without any issue.

Also set up a VPN server with Raspberry Pi... no more open ports...

alastairstevenson, thank you so much for posting this.
 
  • Like
Reactions: alastairstevenson
mvaldes said:
Just updated the first one of my two 2CD-2132F with 5.2.5 firmware that showed random factory reset.
Click to expand...
Well done, yet another good result!
mvaldes said:
I've found that the mtdblock1 was filled with FF, so I was a bit scared to go ahead, but everything's went fine.
Click to expand...
That's the case if the camera originally had very early firmware, such as 5.2.0 as far as I recall.
mvaldes said:
Also set up a VPN server with Raspberry Pi... no more open ports...
Click to expand...
Even better - excellent!

mvaldes said:
5.2.5 firmware that showed random factory reset.
Click to expand...
There must be so much of this going on around the world.
And think of all those people who maybe don't realise that 'port forwarding' is active, due to default enables on their router and cameras, that are maybe thinking 'These Hikvision cameras are cr$p as they are just not stable', without knowing what's really going on.
It's quite a thought.
 
Hello, it is possible to update the firmware for the camera DS2CD2145F-IWS ser.DS-CD2145F-IWS20160526AACH......
 
That's a different series of camera, different types of protection.
I believe that due to that and its presumed China region status it would need some customised firmware.
 
You must log in or register to reply here.
Top Bottom