Hikvision DS-2CD2x32-I (R0) brick-fix tool / full upgrade method / fixup roundup.

korgua

n3wb
Joined
Aug 13, 2015
Messages
2
Reaction score
1
Location
The Shires
Fantastic post - really useful.

I have performed all the steps to amend MTBLOCK6 and MTDBLOCK1. I reboot the camera and it is still working on 5.2.5, so I proceed with a 5.3.0 FW upgrade. After a reboot the camera appears as DS-2CD-Min-System in SADP. I follow the downgrader steps to get the camera working on 5.2.5 once more.

I repeat the very same steps, and double check the modified MTBLOCK files by downloading them from the camera and confirm they contain the correct info.

Each time I try a 5.2.5 to 5.3.0 upgrade ( I have tried several 5.3.0 files ) the camera always boots into recovery mode.

Puzzling and frustrating as it feels I am 99% there....

UPDATE: completely my fault, I had incorrectly changed the mtdblock1 values from 00 to 02 and not 00 to 01. I thought I had read that they could be 02. Not sure if this caught anyone else out but if it did, make sure you change 00 to 01 in MTDBLOCK1 file
 

Attachments

Last edited:

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
13,281
Reaction score
4,569
Location
Scotland
I thought I had read that they could be 02.
Interesting.
Yes, that's what I suggested they should be set to.
Not sure if this caught anyone else out but if it did, make sure you change 00 to 01 in MTDBLOCK1 file
There is another user that is seeing the same symptoms as you have described, I'll point him to this post.
Thanks for sharing!
 

Uku

n3wb
Joined
Oct 5, 2017
Messages
3
Reaction score
1
I have one camera 2cd3132F_IWS012015082"CCRR536"""" v 5.3.0 150513

I tried with the downgrader 5.3 -> 5.2.5 but it failed. TFTP says transmit

Now the camera is in v4.0.8 mode i tried different CN firmware digicaps but its the same

EN firmware worked. Now the camera is CCCH
 
Last edited:

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
13,281
Reaction score
4,569
Location
Scotland
I tried with the downgrader 5.3 -> 5.2.5 but it failed. TFTP says transmit
There is an EN version and a CN version of the downgrader. Which did you try?
Have you tried to load any firmware above 5.3.0 ? If so, you will need the 'brick-fix tool' to remove the downgrade block.

*edit* This assumes the 3132 is the same hardware as a 2132 - which I can't confirm.
 

Uku

n3wb
Joined
Oct 5, 2017
Messages
3
Reaction score
1
Yes i found en downgrader digicap and tftp.
I had some minor problems with windows firewall.(tftp didnt work)
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
13,281
Reaction score
4,569
Location
Scotland
You have use downgrade firmware 5.2.5 En (on other thread) with tftp ?
It is possible to modify mtdblock6 hardware signature block on newer firmware - but it looks like Hikvision have created a trap for that activity, possibly to catch those that have done the 'mtd hack' to convert to English.
I only tried that once, didn't feel inclined to re-visit to figure which exact version of firmware had the trap in it.
Check this out : A new Hikvision tripwire.
 

ressue

n3wb
Joined
Jul 3, 2015
Messages
13
Reaction score
3
Thanks for the effort guys, worked fine with modding the mtd6 and mtd1 blocks with 2732F. Has anyone tried to upgrade later than 5.4.5 with the mtd mods?
 

ressue

n3wb
Joined
Jul 3, 2015
Messages
13
Reaction score
3
My DS-2CD2532F-IWS has the mtdblock1 empty (full FF). Should I change something in the mtdblock5 with that model or is changing mtd6 enough?
Edit. Actually I found the same part from mtdblock5 than in the mtdblock6 so I made the same changes to mtd5.

Regarding the newer firmware than 5.4.5, I mixed up the R6 with the newer firmwares with the R0 ones. So it seems that the 5.4.5 might be the last fw for the R0 models.
 
Last edited:

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
13,281
Reaction score
4,569
Location
Scotland
My DS-2CD2532F-IWS has the mtdblock1 empty (full FF).
That sounds like 5.2.0 or older firmware was on it. I don't think that will be a problem - if the new firmware finds this block erased like that, it creates a new template and keeps goiing.
Should I change something in the mtdblock5 with that model or is changing mtd6 enough?
So far, with loads of devices, I've seen none that also need mtdblock5 changed.
But we've got to give Hikvision something to check and hook on to when they try to brick those cameras that have had the 'enhanced mtd hack' with the next firmware release.
So it seems that the 5.4.5 might be the last fw for the R0 models.
I would not be surprised - unless they want to break a few things for spite.
 

The_Tim

n3wb
Joined
Aug 17, 2015
Messages
1
Reaction score
1
I was not going to post these details in public, to reduce the chance of Hikvision blocking them in future firmware - though no such inhibitions in private, quite busy on the topic!
I just wanted to say thanks for posting all this! I have some DS-2CD2532F-IS cameras that had been getting randomly (or so I thought) factory reset. I found a thread on that topic which led me here, and with the instructions in your files I was able to get all my (Chinese hacked) cameras updated cleanly from 5.2.5 to 5.4.5 without any issues (plus fixing my router security settings, changed all the passwords, etc.).

Thanks for your public service!
 

mvaldes

n3wb
Joined
Oct 27, 2017
Messages
3
Reaction score
1
Just updated the first one of my two 2CD-2132F with 5.2.5 firmware that showed random factory reset.
I've found that the mtdblock1 was filled with FF, so I was a bit scared to go ahead, but everything's went fine.
Updated to 5.4.5 without any issue.

Also set up a VPN server with Raspberry Pi... no more open ports...

alastairstevenson, thank you so much for posting this.
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
13,281
Reaction score
4,569
Location
Scotland
Just updated the first one of my two 2CD-2132F with 5.2.5 firmware that showed random factory reset.
Well done, yet another good result!
I've found that the mtdblock1 was filled with FF, so I was a bit scared to go ahead, but everything's went fine.
That's the case if the camera originally had very early firmware, such as 5.2.0 as far as I recall.
Also set up a VPN server with Raspberry Pi... no more open ports...
Even better - excellent!

5.2.5 firmware that showed random factory reset.
There must be so much of this going on around the world.
And think of all those people who maybe don't realise that 'port forwarding' is active, due to default enables on their router and cameras, that are maybe thinking 'These Hikvision cameras are cr$p as they are just not stable', without knowing what's really going on.
It's quite a thought.
 

miror

n3wb
Joined
Mar 23, 2017
Messages
5
Reaction score
0
Hello, it is possible to update the firmware for the camera DS2CD2145F-IWS ser.DS-CD2145F-IWS20160526AACH......
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
13,281
Reaction score
4,569
Location
Scotland
That's a different series of camera, different types of protection.
I believe that due to that and its presumed China region status it would need some customised firmware.
 
Top