Hikvision FIRMWARE TOOLS - change language, extract files and create own firmware

[alastairstevenson]

Still no clue about RSA key so new 2335 cams with 5.3.5 has only China lang and there is no way to switch it.

If you want to take the time to modify the firmware, you can make it do anything you wish.

 

[uralits]

The region code of the camera is held within the flash memory in the 'hardware descriptor block'.
Hiktools allows to change the language in the header of the firmware you'd like to load, it does not change the region of the camera. For that you must do the 'mtd hack' or equivalent.
Hiktools works well for unpacking and re-packing the older generation of firmware for cameras, and the current generation of firmware for NVRs.

i dont need change region, i need multilang for iVMS

 

[Enabler]

Yes but the camera only will accept firmware if signed by RSA key that only Hikvision have.

 

[Speed666]

It means you got RSA private key. Otherwise sorry, not possible.

 

[uralits]

seller answered me:

sorry,your 2132 (production date 2014) only fix V5.2.0, 2132 (production date 2015.1~2015.5) can fix V5.2.5,please kindly noted,thx

 

[Enabler]

speed666 is right and just to be clear we are talking about 2**5 cameras not 2**2

 

[wzhick]

It means you got RSA private key. Otherwise sorry, not possible.

The key can not be hacked, but it can be avoided.

 

[whoslooking]

It means you got RSA private key. Otherwise sorry, not possible.

how about replacing the nand with an earlier version from a 5.20? thats more possible than looking for the RSA key.

 

[Enabler]

The key can not be hacked, but it can be avoided.

Even if that is the case, I guess maybe best not to post publicly anyway (not saying you were going to) as Hikvision would just stop whatever works and there's no point in us telling them.

 

[psicobelico]

Hi
I received a DS-2CD2032F-I from AMAZON that was on 5.3.0_150513 (11/2015) multi language.
Upgrade to 5.3.0_150814 (big error), after that does not work any more, just MIN-SYSTEM.
Downgraded to 5.2.5 and tried the hiktools 'patch' to change the language flag, confirmed that the language flag was changed from 2 to 1 in the firmware file.
Tried tftpserv.exe using the modified digicap, system update completed successfully !!
But camera still stuck on Chinese
Any advice???

 

[alastairstevenson]

This may be your next step: https://www.ipcamtalk.com/showthread.php/3474-Hikvision-5-2-5-amp-5-2-8-Full-English-(INC-DAYS-OF-WEEK)-mtd-Hack

 

[Click4]

If 5.3 hasn't been cracked yet due to the RSA security.

How are some China sellers selling 5.3 brown box cameras with firmware that can't be upgraded?

 

[psicobelico]

""This may be your next step: https://www.ipcamtalk.com/showthread...WEEK)-mtd-Hack""

Like i read here: "This procedure is out of my comfort zone"
I spoke with the seller, he sent me by email a new firmware and now my camera is multi language again.

alastairstevenson: thank you very much for your time and support!!

 

[Defender666]

I ordered many cameras from china and all worked fine, however now I have one DS-2032F-IW it was shown in HikTools and can change ip adress but Webinterface does not work. Firefox show page / missing.

Now I trieded the hacked 5.2.5 with 4 Lines on this camera. TFTP does not finish loading. I wait for 30 Minutes, it sends the file but does not show the message it is ready. I unpluged and rebooted but nothing...not even in Hik SDAP Tool

I guess it needs different firmware or it has bigger defect.

Any other firmware I should try? It has sticker with 5.3.0 Firmware originaly.

EDIT: After some time now it shows up with 192.168.1.64 default ip but Software Version 4.0.8 build 150401. In browser no reaction.

 

[spammy99]

Hello Forum people.... Have just spent the last 2 days reading all these posts, but still have questions..

Situ:
Like many of you I ordered 2 Hikvision camera off Amazon thinking they were from a local supplier, but it
turned out they came from China. (1xDS-2CD2032F-I 1xDS-2CD2032F-IW). Now here's the Odd bit.
The firmware ver. on the box/camera sticker is V5.3.0 build 150513. I have also confirmed that the
software actually on the cameras is the same version.

Now here's the kicker.. The default language is English, and there is a menu avail. for other languages as well.
So even though these are Chinese camera (CCH in ser. Nr) they are running English/multilingual ver 5.3.0 Firmware.
Anybody seen this yet?

The Problem:
I tried flashing the DS-2CD2032F-I to the newer firmware 5.3.0_150814 and as expected the camera failed to upgrade
and went into mini mode... I was able to recover the camera by flashing to V5.3.0 build 150513 Chinese, then using the Downgrader
to get back to 5.2.5 English... So the camera is actually working again, just on an older firmware.

The Question:
Is it somehow possible to get this camera back on the V5.3.0 build 150513 Multi Lang firmware?
I still have an Untouched camera I can copy MDT or other files from if that helps..
I have actually tried around 8-10 other FW versions and Locals (US/EU/CH) but only the CH 5.3.0 150513
and downgrader version seem to work

 

[alastairstevenson]

Is it somehow possible to get this camera back on the V5.3.0 build 150513 Multi Lang firmware?

It sounds like the reseller had installed a modified multi-language firmware in the camera.
If you are lucky - a quick solution to get it back would be to ask the reseller to send you a copy of the firmware that had been installed.

 

[Speed666]

It cannot be avoided. The only way is to flash FW via NAND reader and i did that. Worked. No RSA means no upgrade package to DOWNGRADE offcial camera into something else. New firmware will check the signature of uploaded file and resign to flash it if it is not signed via proper RSA private key.

Also psh waits for RSA challenge-response code to exit psh into shell.

 

[alastairstevenson]

No RSA means no upgrade package to DOWNGRADE offcial camera into something else.

You mean avoiding running the 'upgrade' program to stop it re-writing the bootloader with an updated version? Or modifying it to do something different?

The only way is to flash FW via NAND reader and i did that. Worked.

I'm curious how you did this. With external hardware connected to the main board? Or did you manage to do it via software and the serial console?

 

[Speed666]

Desoldered NAND i read and programmed in NAND reader. Then i but it back. I tested on 2DE 5184 but this is insane to solder camera for few hundreds USD.....

About downgrade. Camera with FW > 5.3.5 checks on upgrade process if files are signed with proper RSA key (private key, only known to HIK), if yes - it will do upgrade whatever it contains. Otherwise it will refuse to flash.

As the bootloader also checks for this - it is impossible to create a digicap.dav which you will be able to use to downgrade/upgrade camera with unofficial package.

 

[alastairstevenson]

but this is insane to solder camera for few hundreds USD....

Agreed. Thanks for the clarification.