Hikvision FIRMWARE TOOLS - change language, extract files and create own firmware

Discussion in 'Hikvision' started by wzhick, Feb 25, 2015.

Share This Page

  1. Mike A.

    Mike A. Pulling my weight

    Joined:
    May 6, 2017
    Messages:
    315
    Likes Received:
    145
    Enabled SSH under Configuration-Security-Security Service and I now have the login prompt. But then I locked myself out for a while after trying various default logins/passwords that I found searching around that apparently aren't right. Tried root/regular admin password, root/12345.
     
  2. HobbeS

    HobbeS n3wb

    Joined:
    Sep 2, 2017
    Messages:
    8
    Likes Received:
    1
    Thank you for the great help Alastair!
    After removing the power and powering up the camera, the camera was accessible again via 192.0.0.64.

    Then I've read a couple of times how to do the enhanced mtd hack. For one camera I've modified the mtdblock1 and for both camera's mtdblock6. I'm really happy I've both camera's running firmware 5.4.5 now!
    Thank you for the great support & quick response!

    Is it now also possible to use the hik-connect functionality and get notifications on my iPhone when there is motion detection on a camera?
     
  3. alastairstevenson

    alastairstevenson Staff Member

    Joined:
    Oct 28, 2014
    Messages:
    9,446
    Likes Received:
    2,745
    Location:
    Scotland
    That's good to hear, I'm glad to be able to help, as are many others on this really useful forum.

    Not a question I can answer, sorry, I know nothing about hik-connect. I'm blind to any such external connections, it's too easy to imagine how it could be messed with. And iPhones excellent though they may be, are not a feature for me.
     
    HobbeS likes this.
  4. HobbeS

    HobbeS n3wb

    Joined:
    Sep 2, 2017
    Messages:
    8
    Likes Received:
    1
    Yes, with some other topics on this forum I've managed to get the notifications also working. After more than a year not happy anymore with my camera's I'm now really happy with them again.
     
    alastairstevenson likes this.
  5. afddwfadwfadwf

    afddwfadwfadwf Young grasshopper

    Joined:
    Mar 28, 2016
    Messages:
    58
    Likes Received:
    6
    So for Chinese DS-2CD3T45-I5 (V5.4.20 build 160726) and DS-2CD3345-I (V5.3.8 build 160108) hacked to English/non-upgradeable, what method is out there to upgrade?

    I don't mind Chinese UI. Tried Chinese firmware IPC_G0_CN_STD_5.4.41_170710.zip, hikpack -L 1/2 and original dav all returned HTTP 401 on web update.
     
  6. xuvisku

    xuvisku n3wb

    Joined:
    Mar 30, 2015
    Messages:
    5
    Likes Received:
    1
    My camera is the model DS-2CD2032-I with firmware 5.2.5 141201.
    The camera was losing its settings once a day and I decided to upgrade to the latest firmware 5.4.5 170123 downloaded directly from hikvision's website.
    After the update I can no longer log in the camera and the error occurs
    firmware language mismatch: /home/webLib/doc/page/login.asp

    Can I downgrade from 5.4.5 to 5.2.5? What do you suggest?

    Thank you.
     
  7. alastairstevenson

    alastairstevenson Staff Member

    Joined:
    Oct 28, 2014
    Messages:
    9,446
    Likes Received:
    2,745
    Location:
    Scotland
    vasycara likes this.
  8. netpirat

    netpirat n3wb

    Joined:
    Oct 3, 2017
    Messages:
    1
    Likes Received:
    4
    Hello Guys,
    i would like to update my NVR from 3.3.2 Firmware to the actually one. But I have a chinese version.

    Model: DS-7732N-E4 / 16P

    It is possible to make the update when a change the languarge code from 1 (EN/ML) to 2 chinese (digicap.dav). But it will not start. Beeping Beeping Beepin and only the picture NVR Embedded.

    I read a lot the last two days about MTD Hack. Is it possible for that NVR, too? I have not Telnet available. I checked it today. It is frustrating. Nobody look on N or NI when he buys an NVR.

    Can i get access to the root files?

    I hope someone can help me.

    BR

    Netpirat
     
    Last edited: Oct 3, 2017
  9. alastairstevenson

    alastairstevenson Staff Member

    Joined:
    Oct 28, 2014
    Messages:
    9,446
    Likes Received:
    2,745
    Location:
    Scotland
    As your NVR is a CN model and EN firmware has been applied, behind the scenes on the console the firmware will be saying (sic) "!!!You NVR is illegal, you bought in China!!! !!!You need to contact the factory!!!" while beeping 15 times then rebooting.

    To answer your questions:
    That only changes the language of the header in the firmware file, it does not change the internal region version of the firmware or the NVR. It's just bypassing one of the initial checks done when the update process starts.
    Not easily - the kernel has been coded to both hide and to prohibit changes to the 'hardware signature block' of the NVR.
    The easiest fix would be some 'hacked to English' firmware, which is probably what was installed by the seller when you bought the NVR.
    Check your 'Conversations' for a potential solution.
     
  10. omid

    omid n3wb

    Joined:
    Jan 2, 2017
    Messages:
    4
    Likes Received:
    0
  11. omid

    omid n3wb

    Joined:
    Jan 2, 2017
    Messages:
    4
    Likes Received:
    0
    Did any one knows how can I change the model number of hikvision camera?
     
  12. alastairstevenson

    alastairstevenson Staff Member

    Joined:
    Oct 28, 2014
    Messages:
    9,446
    Likes Received:
    2,745
    Location:
    Scotland
    It all depends on which series of camera.
    On some, that data is held in the flash memory, on others that data is held in a security chip, but in all cases there is tamper protection.
    What do you aim to do?
     
  13. alastairstevenson

    alastairstevenson Staff Member

    Joined:
    Oct 28, 2014
    Messages:
    9,446
    Likes Received:
    2,745
    Location:
    Scotland
    On the regular Hikvision R0 series, the telnet/SSH shell password for root is the web GUI admin password, except for firmware 5.4.5 where the root password is hard-coded to hiklinux for some odd reason.
     
  14. omid

    omid n3wb

    Joined:
    Jan 2, 2017
    Messages:
    4
    Likes Received:
    0
    Hi
    Thanks for your attention.
    because I have some OEM Camera and there is no any model number.
     
  15. omid

    omid n3wb

    Joined:
    Jan 2, 2017
    Messages:
    4
    Likes Received:
    0
    you mean i can change it with telnet?
    if yes how can i do it?
    thanks
     
  16. alastairstevenson

    alastairstevenson Staff Member

    Joined:
    Oct 28, 2014
    Messages:
    9,446
    Likes Received:
    2,745
    Location:
    Scotland
    It's complicated.
     
  17. tripnotics

    tripnotics n3wb

    Joined:
    Dec 11, 2015
    Messages:
    12
    Likes Received:
    0
    Noob question,

    What is the appropriate source to download Firmware upgrades?

    I have two cameras, and I have never updated the Firmware.

    XC-2342WDI - V5.3.3 build 150630
    DS-2CD2332-I - V5.3.0 build 150513

    I assume both are horribly dated in regards to firmware. Also to the best of knowledge, both are English (multi language) versions of the cameras. The 2332 was purchased from Nelly's and 2342 was purchased from Power Supply Center (via Amazon).

    Thanks,
     
  18. alastairstevenson

    alastairstevenson Staff Member

    Joined:
    Oct 28, 2014
    Messages:
    9,446
    Likes Received:
    2,745
    Location:
    Scotland
    If these are truly English / upgradeable cameras, then a good firmware source is :
    This is an R0 series camera - DOWNLOAD PORTAL
    The DS-2CD2342WD-I is an R6 series camera. I'm not 100% sure if your slightly different model number is in that series - if it is - DOWNLOAD PORTAL

    If the 2342 is a CN camera, it may brick or revert to Chinese using the EN/ML firmware.
     
  19. tripnotics

    tripnotics n3wb

    Joined:
    Dec 11, 2015
    Messages:
    12
    Likes Received:
    0
    Thanks for your response alastairstevenson. Is there anyway to determine, for sure, that the camera is truly an English camera?

    Thanks
     
  20. Igor0k

    Igor0k n3wb

    Joined:
    Oct 12, 2017
    Messages:
    4
    Likes Received:
    0
    Hi, I would appriciate for the help on following issue:
    I have model ds-2cd2335-i (CN) (running 5.3.3 english fw) bought on aliexpress so assuming it is hacked firmware.
    Is it possible to get newer english fw version 5.4+ for it?
    camera started often drop activation and issue with setup email notification.

    Thanks for any help.
     
  21. alastairstevenson

    alastairstevenson Staff Member

    Joined:
    Oct 28, 2014
    Messages:
    9,446
    Likes Received:
    2,745
    Location:
    Scotland
    A good clue used to be the serial number - but I don't think it's as clear now.
    What does it show?
     
  22. alastairstevenson

    alastairstevenson Staff Member

    Joined:
    Oct 28, 2014
    Messages:
    9,446
    Likes Received:
    2,745
    Location:
    Scotland
    If this is definitely a CN camera, the EN firmware will not run on it, and will be rejected.
    This series of camera has extra protection for the 'hardware info' and does not have the easy ability to change it that exists in the R0 series of cameras.
     
  23. Igor0k

    Igor0k n3wb

    Joined:
    Oct 12, 2017
    Messages:
    4
    Likes Received:
    0
    Thanks alastairstevenson!
    So adding chinese fw most likely would brick it as well or I would be able to use it with google translate?
    would like to know if there is any other solution rather then blok any outside traffic to it and making it just local.
    Constant resets make it even locally unusable now ( wierd that it also shows iVMS kamera name as HACKED). and change of admin pass not helps with resets.
     
  24. alastairstevenson

    alastairstevenson Staff Member

    Joined:
    Oct 28, 2014
    Messages:
    9,446
    Likes Received:
    2,745
    Location:
    Scotland
    If you're comfortable with Chinese menus, and the CN language isn't going to alienate any NVR the camera is connected to, you can administer in English all the detailed configuration with the Batch Configuration Tool : Hangzhou Hikvision Digital Technology Co. Ltd.
    It works pretty well, and avoids the need for Google translate.
    That's a pretty good clue that it's been messed with by an external entity.
    No, the Hikvision backdoor does not require knowledge of any passwords, it's a really open backdoor.
     
  25. Igor0k

    Igor0k n3wb

    Joined:
    Oct 12, 2017
    Messages:
    4
    Likes Received:
    0
    Yes, that's what is my suspicion as well. Do you think applying IPC_G0_CN_STD_5.4.41_170710 firmware should work (on CN website that fw was listed for 2335 camera) and i can manage it after via Batch Configuration Tool? I like to use iVMS but i guess it would be not an option after that.

    All i want is just fix that backdoor issue.
     
  26. alastairstevenson

    alastairstevenson Staff Member

    Joined:
    Oct 28, 2014
    Messages:
    9,446
    Likes Received:
    2,745
    Location:
    Scotland
    I would guess that firmware will work - but you will need to be sure you are not going to get any 'language mismatch' errors with whatever you connect it to.
    I have never used iVMS so I don't know if it will work like an NVR and object to the new language.

    It sounds like there is a need for a G0/G1 equivalent of the R0 'enhanced mtd hack' that will allow these series of cameras to be fully updated without a brick-risk to protect against security threats.
     
  27. Igor0k

    Igor0k n3wb

    Joined:
    Oct 12, 2017
    Messages:
    4
    Likes Received:
    0
    Yes, having that mtd hack would be nice. This series looks like kind of popular, but now I regret with not getting just normal R0.
    If i was able to test that "language mismatch" issue, but if there is no other option apart from loading that "CN FW", i might risk it to try.
     
  28. Jablan

    Jablan n3wb

    Joined:
    Mar 31, 2016
    Messages:
    5
    Likes Received:
    0
    If you do the update can you please report if iVMS still works ok. I just may live with chinese menu if I can configure camera with other tools. And can you say if there is chinese language on overlay of camera image(date, time, etc)?
     
  29. Defender666

    Defender666 Getting the hang of it

    Joined:
    Dec 19, 2015
    Messages:
    179
    Likes Received:
    22
    Question about Camera with 5.3.6 Firmware. I cannot enable SSH in Webinterface the option is not there. I tried the trick with the SDK Tools to enable it but it still does not work. How can I solve this?
     
  30. alastairstevenson

    alastairstevenson Staff Member

    Joined:
    Oct 28, 2014
    Messages:
    9,446
    Likes Received:
    2,745
    Location:
    Scotland
    Depending on the camera model, it may not actually be running an SSH service, even behind the IP filter that the SDK tool can disable.
    And even if it was - you'd only get access to the 'psh' restricted shell, which is even less useful than a chocolate teapot. In my view.