Hikvision DS-2CD2x32-I (R0) brick-fix tool / full upgrade method / fixup roundup.

[alastairstevenson]

My question was is there now a working 5.4.5 for Chinese cameras that has english menus?

Not a Chinese one that I am aware of - the Chinese firmware for Chinese R0 cameras is here : 海康威视是以视频为核心的物联网解决方案提供商 and is 5.4.41 and only has CN (zh) language files.
The method lots of people have used to get EN/ML menus with 5.4.5 firmware on Chinese cameras is to convert them to English/updateable.

 

[td0g]

Not a Chinese one that I am aware of - the Chinese firmware for Chinese R0 cameras is here : 海康威视是以视频为核心的物联网解决方案提供商 and is 5.4.41 and only has CN (zh) language files.
The method lots of people have used to get EN/ML menus with 5.4.5 firmware on Chinese cameras is to convert them to English/updateable.

Ok I'll have to do that to mine then, thanks.

 

[MrBurritoMan]

I just used this to recover one of my DS-2CD3132F-IW cameras.
Odd thing is the CN version wouldn't install but the EN worked just fine.

Overall steps followed:
1. Connected the camera to the same LAN as my workstation (ip: 192.0.0.128/24)
2. Started the TFTP software with the BrickFix540-CN .dav file, this didn't work (I was watching the firmware update process via the TTL header)
3. Closed the TFTP software and renamed the files to use the BrickFix540-EN .dav file, this loaded and my camera finished then rebooted. As soon as you see the camera say "Update Complete" pull the power cord on the camera.
4. Close TFTP server, re-apply power, the camera attempted to boot into normal mode, failed, sat around for a little while then rebooted into Min mode (4-5 minutes). You will know when it is in min mode as the Batch configuration tool by Hikvision will display that. Also, telnet was operational on the camera.
5. Set the custom firmware downgrader as the .dav file for the TFTP server (change it to digicap.dav) and started the TFTP server, rebooted the camera and it pulled down this file. Once complete it sat for 1-2 minutes then rebooted automatically. Once it did that it started up normally and is now running v5.2.5. Again, the English version worked for me, the Chinese version wouldn't take.

Hope that helps someone.
Here is the thread that covered the entire learning curve: Need Firmware for DS-2CD3132F-IW

Thanks!

 

[alastairstevenson]

Thanks for sharing - this will benefit others. And I'm glad you persisted and finally had success!

the camera attempted to boot into normal mode, failed, sat around for a little while then rebooted into Min mode (4-5 minutes).

Just for info - it didn't fail - it's 'by design'.
The payload in the brick-fix tool is pretty large, so no room in the firmware wrapper to include normal things such as the SADP responder and web services.
It does appear inert after dropping its payload. And after any subsequent reboots.
And when davinci isn't running to periodically reset it, the hardware watchdog timer will force a system reset after about 10 mins into min-system mode.

 

[DragonIPC]

Is there any chance I can fix my 2142 ipc using these methods?

Mine upgraded just fine to 5.5.0. Now apparently I cannot upgrade anything or downgrade anything. I can no longer enable ssh. And I cannot connect to my SMB shares as I could before. I keep getting "upgrade failed" or "file mismatch"

currently cam says this:

Model DS-2CD2142FWD-I
Serial No. ------BBWR------
Firmware Version V5.5.0 build 170725
Encoding Version V4.0.1 build 170711
Web Version V4.0.1 build 170711
Plugin Version V3.0.6.26

 

[alastairstevenson]

Is there any chance I can fix my 2142 ipc using these methods?

That camera is an R6 series camera, it's quite different internally from the R0 series that the brick-fix tool operates on.

I can no longer enable ssh.

By default, this is 'filtered'.
What version of firmware was on before the update? Even when SSH was available, did it drop you into the 'psh' shell where very few useful commands are available?

You could test if the Batch Configuration Tool would enable SSH on the camera : Hangzhou Hikvision Digital Technology Co. Ltd.

And I cannot connect to my SMB shares as I could before.

Guessing a bit as a long shot here - I'm wondering if that facility might depend on a service that's now disabled by default.
Check the Network > Advanced Settings > Integration Protocol tickboxes

 

[bromz]

Quick question, just to be sure:
Can I do the enhanced mtd hack on a camera with firmware 5.2.0?
If not, what's the best way to upgrade to 5.2.5 from 5.2.0?

Thx

 

[alastairstevenson]

Can I do the enhanced mtd hack on a camera with firmware 5.2.0?

Yes, you can, and here's the reason why:
The original 'classic mtd hack' and the 'enhanced mtd hack' were oriented around the 5.2.5 firmware because often the '@whoslooking 5.3.0 to 5.2.5 downgrader' had been used to recover from a bricked camera where 5.3.0 had been tried, and also because there is a Hikvision trap if you try to re-write mtdblock6 on the 5.3.0 firmware or higher.
So 5.2.5 was a convenient starting point.

However - the new 'brickfixV2' brick-fix and upgrade tool does all the work whilst running the 'min-system' recovery environment, so it doesn't matter what firmware version is on the camera.
The new tool is here : R0 / DS-2CD2x32 BrickfixV2 brick recovery and full upgrade tool - enhanced.

But there is something you should use the existing 5.2.0 firmware for, as the camera is presumably still working - find out the value of the 'devType' as this is required as part of the 'enhanced mtd hack'.
Do this by enabling telnet in the camera web GUI, login with your admin password, and at the root shell use the command prtHardInfo
Note down the value shown for devType
This is a decimal value, convert it to hex with the Windows calculator.

 

[bromz]

Allright, thx for the fast response @alastairstevenson .
Both of my camera's are DS-2CD3332-I.
One with the V5.2.0 build 140721 firmware, one with the V5.2.5 build 141201 firmware.

Both of them report the same devtype:
devType = 38920

So in hex: 0x9808

Gonna try them both

 

[alastairstevenson]

Gonna try them both

You, and the cameras, will be fine!

 

[Edward Murray]

Thanks I have my camera back! In Chinese... I have enabled ssh and access the camera but can't start ftpd when running the full firmware. Is there a method other than using the SD card reader to get the mtd files off for hex editing?

 

[Edward Murray]

Thanks I have my camera back! In Chinese... I have enabled ssh and access the camera but can't start ftpd when running the full firmware. Is there a method other than using the SD card reader to get the mtd files off for hex editing?

I found V2 thanks. All sorted. Thanks for execlent guides and hacks.

 

[alastairstevenson]

Is there a method other than using the SD card reader to get the mtd files off for hex editing?

You already found it! The tftp client in the min-system recovery environment, and the fixup script did it for you.
And well done for getting to the end-point.

Thanks for execlent guides and hacks.

Glad to have been able to help.
Now I need to get my hands on some other series of camera to open up.
6 weeks ago I thought I had 8xDS-2CD2345WD coming so I could explore them, but it was a rogue trader, I got scammed.

 

[bromz]

@alastairstevenson
I've tried to upgrade the first one, the one with the 5.2.5 firmware.
I didn't use the brickfix tools, just manually changed the mtdblock6 file.
Rebooted the camera and then upgraded to 5.4.5.

Upgrade was succesfull, however, I can't login.
I was using the default password before the upgrade.
It doesn't let me set an initial password and doesn't accept the old/default one.
"Incorrect user name or password. The device will be locked after 2 failed login attempts."

Removed the power to reboot again, but same result

 

[alastairstevenson]

I didn't use the brickfix tools, just manually changed the mtdblock6 file.

What all did you change in that file?
Did you also check the content of mtdblock1 to see if it needed changes?

You could try a couple of things:
A Hikvision tftp update with the same 5.4.5 firmware. This will clear the configuration and leave the camera in an 'Inactive' state so you can create your own strong password.
If that doesn't work the brickfixV2 tool and method should be OK, using the 5.4.5 firmware as the digicap.dav source for Stage 3.
Unbrick and fully upgrade your R0 / DS-2CD2x32 IP cameras -
R0 / DS-2CD2x32 BrickfixV2 brick recovery and full upgrade tool - enhanced.

 

[bromz]

I just did the changes as mentioned in your instructions.

0x10 language byte set to 0x01 for EN instead of the 0x02 for CN
0x64 and 0x65 devType bytes set to the value from your prtHardInfo command, for example 0x9807 (ie 0798 for the correct byte order) for the DS-2CD2232-I5
0x04 and 0x05 Checksum-16 bytes Set to the Checksum-16 value as calculated by HxD for the 0xF4 bytes starting from location 0x09 remembering the correct byte order, 0x04 is the least significant byte.

Since the device was working and not bricked, I thought I had no use in using the bricktool.
I just needed to switch to EN and enable upgrades.

I did not check mtdblock1 because I don't know a lot about mtdblocks how could I see if it needed changes?

 

[bromz]

A Hikvision tftp update with the same 5.4.5 firmware. This will clear the configuration and leave the camera in an 'Inactive' state so you can create your own strong password.

After some searching I found the needed instructions and the tftpserv.exe tool, followed the instructions and updated the same firmware again.
Configuration got cleared indeed and camera was in inactive state. So SADP offered to set a password.
Back working again.
So I've got 5.4.5 working in English!

Thanks for your assistance

 

[alastairstevenson]

So I've got 5.4.5 working in English!

Excellent!
Well done for managing the full 'enhanced mtd hack'.
(I'd assumed you'd already used the Hikvision tftp updater, so didn't give you any download links, apologies).

 

[bromz]

Another update:
Did my second camera, so the one with the 5.2.0 firmware.

Something I noticed: the 0x64 and 0x65 devType bytes were already set to 08 98 in this firmware, this was not the case in the other camera with 5.2.5 firmware.

So I did the enhanced mtd hack, rebooted and tried the update, but the update failed immediately. Tried it via ivms4200, via firefox, via IE.
Remembered the readme in the 5.4.5 firmware file:

Scenario 1- If the version falls into the range from V5.2.0 build 140721 to V5.4.0 Build 160530, you need a 2-step ugrade process. Note, if the step was skipped, your device may fail to operate normally.

1) update to V5.4.41 build 170310 FIRST, reboot
2) update to v5.4.5 Build 170123, reboot

So tried that, and initially set a strong password before upgrading, to avoid the 'incorrect password'.
Both upgrades went flawlessly, keeping my config intact.

 

[alastairstevenson]

Something I noticed: the 0x64 and 0x65 devType bytes were already set to 08 98 in this firmware, this was not the case in the other camera with 5.2.5 firmware

Yes, this varies amongst cameras. Those with the FF98 masqueraded devType fail an update, presumably a deliberate trap.

Did my second camera, so the one with the 5.2.0 firmware.

It's likely that with the 5.2.0 firmware, mtdblock1 has data that indicates a prior upgrade has failed.
This is also the case with cameras that originally had 5.2.8 firmware which used to fail any attempted update.
How this apparent prior failure is handled varies with the version of firmware used for the update attempt.

The newer brickfixV2 method automatically writes a valid template into mtdblock1, so removes the need to check / change this area.
And it allows a direct one-step update to the 5.4.5 EN/ML firmware.
Unbrick and fully upgrade your R0 / DS-2CD2x32 IP cameras -
R0 / DS-2CD2x32 BrickfixV2 brick recovery and full upgrade tool - enhanced.

Both upgrades went flawlessly, keeping my config intact.

Well done for getting there, and sharing the experience.