Hikvision FIRMWARE TOOLS - change language, extract files and create own firmware

[devjatov.alex]

you open files _cfgUpgSecPls _cfgUpgClass?

 

[kraven]

I'm using your tool to upgrade my DS-7116N-SN/P from 3.0.10 (CN) to either 3.0.10 (EN) or 3.0.17 (EN) , however the unit will not accept the modified firmwares.


When I use the REMOTE UPGRADE from the web interface, I get a message UPGRADE FAILED when pressing UPGRADE. If I use TFTP the firmware is transferred but the unit does not reboot and does not apply the firmware.


When I try unmodified firmwares for 3.0.10 or 3.0.17, I have no problems and they apply cleanly. I can also downgrade from 3.0.17 to 3.0.10 without any issues (providing I apply 3.0.17, and then 3.0.10 without logging into the NVR whilst at 3.0.17). So I do know that I am applying the firmwares correctly.


Any ideas ?


K.

 

[alastairstevenson]

however the unit will not accept the modified firmwares.

Are you trying to modify the firmware language with the 'lang' option?
Or if not, what modifications have you made?

From where are you downloading the (EN) firmware and the 'unmodified' firmware?
Have you tried the firmware from here: http://www.hikvisioneurope.com/portal/index.php?dir=Product Firmware/Recorder/DS-7100NI-SN/V3.0.17 build 150804/16 channel/

 

[kraven]

I downloaded my firmware from http://www1.hikvision.com/cn/download_more_699.html and tried the firmware with the LANG 1 (EN-ML) option.

 

[kraven]

Are you trying to modify the firmware language with the 'lang' option?
Or if not, what modifications have you made?

From where are you downloading the (EN) firmware and the 'unmodified' firmware?
Have you tried the firmware from here: http://www.hikvisioneurope.com/portal/index.php?dir=Product Firmware/Recorder/DS-7100NI-SN/V3.0.17 build 150804/16 channel/

Out of interest, I tried the firmware from that location, with LANG 1 (default) for that firmware, got UPGRADE FAILED. Set it to LANG 2 (CN) and it would apply, but would give 6 or 7 beeps and then dead. So TFTP back to 3.0.10 CN and it came back to life.

 

[kraven]

Alastairstevenson,

You're a genius, flashed with the 3.0.10 EU version changed to LANG 2 and it's all working.

Thank you again.

 

[alastairstevenson]

Well done for persisting, you got there. Hiktools is such a simple, handy tool, credit to @wzhick
It's a pity what Hikvision have done with all this region-locking stuff - it's just creating uncertainty and frustration, especially when they put the various firmwares enticingly on public download.
Personally, I don't think it does their name and reputation any good at all.

 

[whoslooking]

I fully agree, why not embrace the grey market remove the regional encoding and watch profits really rise, for a Chinese company they seem to have limited views of making money, poor share holds will be kicking the if @wzhick comes up with more great tool's.

 

[perf2711]

Does anybody know how the header is encoded, and on what bytes is the checksum calculated?

 

[alastairstevenson]

on what bytes is the checksum calculated?

Plenty of threads covering that topic here under such as 'mtd hack'.
It depends on the version of the firmware, post 5.2.5 that range is no longer the 'F4 bytes of the hardware descriptor block after the checksum', other bytes are now included and additional calculations. So the pragmatic approach taken, as it's still a linear sum, is to make a net change of zero by adding and subtracting an equal value.

 

[Oleglevsha]

In the latest versions of firmware for Hikvision NVR uses an additional compliance test region.
If you change the title with the help of a program Hiktools firmwareis loaded but when you start NVR fails matching regionis sewn into the boot loader NVR.
You will hear a series of tonesand then the NVR will reboot.
To use the old versionof firmwareis not possible, and the resulting hardware version (ds7116).
Is a protective reactionof the manufacturer to change Chinese NVR.
But you can still use the previous version of the firmware to change in English.

 

[k0t4]

welcome
I use your patch but somehow nothing.
The camera came from China with firmware 5.3.0
Camera Model 2020F-i
The region of the camera 2
I use the firmware with the region 2 by changing your patch on the region 1 .
After flashing look through the properties of putty and still remains a region of the chamber 2 .
what could be the problem?
Thank you

Firmware Mod Tool for Hikvision NVR and IP camera devices.

What is this tool?
It’s a short piece of code that makes it easily possible to change the ‘Language’ flag on the firmware update files that Hikvision provides for their range of NVRs and IP cameras. The user does not need programming expertise to use this tool.
The tool also provides some advanced facilities to extract the contents from the main body of a firmware upgrade file for inspection or further development. The tool can also re-package the updated changed or added contents into a new firmware update file that can be applied to the IP camera or NVR as a normal upgrade.

Why would I need it?
It’s common that after purchasing Hikvision IP cameras and NVRs from low-cost sources such as Chinese internet-based sellers, users encounter some problems such as ‘Language mismatch’ when trying to integrate the devices or update the firmware. Hikvision applies ‘Region codes’ and ‘language flags’ to their IP cameras and NVRs and to the associated firmware updates, and tries to ensure their products are sold via their ‘Authorised Distributor Network’. Sellers can modify internal region and language settings in various ways to cheaply sell products from one region in another region, in a way that can cause later problems for the buyer when updates are attempted.
Advanced users can modify or add files to the firmware image, to customise the capabilities and behaviour of their IP camera or NVR.

How does the tool work?
The tool scans and decodes the NVR or IP camera firmware update file that the user would like to use to update the device, and allows the ‘Language flag’ to be changed, such that ‘Language mismatch’ errors that occur on an attempted update can be eliminated.
The tool extracts all the individual files from the main section of the firmware upgrade file, making them available for inspection or changing.

How do I use it?
The steps are straightforward, but do need some care to be taken, and require an understanding that although the tool is reliable and has been tested, it may not take account of future changes such as the firmware update file structure being re-engineered, or new checksums being incorporated.
Please proceed as follows:

- Have available a Windows PC, with the Hikvision Support Tools package available, which mainly consists of a TFTP server and the instructions on how this can be used to recover a failed firmware update on an NVR or IP camera. A good source of information on this are the many threads on Hikvision devices in the forum www.ipcamtalk.com

- Store in a folder on the PC the NVR or IP camera firmware upgrade file that you would like to use, along with the ‘hiktools.exe’ firmware mod tool program. This could be the same folder as used by the TFTP program.

- Ensure the NVR or IP camera is powered on and connected to the same local network as the PC, and ensure that you can log on to the web admin GUI with an administrator account (usually admin).

- On the Windows PC, start a command-line window, usually with ‘Start | CMD’. Change the drive and directory to that holding the hiktools.exe program.

- First check that the firmware file to be changed can be correctly decoded. Assuming that the firmware filename is ‘digicap.dav, execute the following command:
hiktools digicap.dav
and inspect the result on the screen.
The tool will show the header raw data, the header decoded data, a summary of key values in the header, and the full decoded data including a list of the embedded files and their checksums.
An important value to check in the summary of key values is that the ‘magic number’ is ‘0x484B5753’ and that the iLanguage value is 1 or 2 The iHeadTotalLen varies with the number of files in the main section of the firmware update file. The value is 64 bytes plus 44 bytes x (the number of files held in the main section). This can be 108 for NVR firmware that typically has a single CRAMFS image, and 1208 for camera firmware holding 26 files. This should give a reasonable confidence level that the file is in a format that can be decoded. If the results do not match these values – DO NOT PROCEED further.

- Make a backup copy of the original firmware file with the following command:
‘copy digicap.dav digicap.dav.backup’

- At this point it is possible to simply change the ‘Language flag’ by executing the following command, using ‘1’ for English or Multi, and ‘2’ for Chinese device. If you want flash english firmware to chinese IPC or NVR you need set language to 2:
hiktools lang digicap.dav 2

- The modified firmware file is now ready to be applied to the NVR or IP camera. Log in to the web admin GUI, and use the ‘Configuration | Maintenance | Remote Upgrade’ menu to select the new firmware file, and click the ‘Upgrade’ button. Observe the progress indicator, and the reboot progress. After reboot, check that the ‘Language mismatch’ problem has been eliminated.


Advanced use of the Firmware Mod Tool

In addition to the ability to modify the language flag in a firmware update file, the tool can be used to split the firmware file into its header section and all the component parts of the main or rootfs section, and also to create a new firmware file by joining a header section to a new main section that holds files from within a specified folder where the user may have modified the contents.
This clearly provides opportunities for customising the behaviour of your NVR or IP camera, however it is suggested that these facilities should only be used by those knowledgeable in the structure and practice of embedded Linux firmware files as implemented by Hikvision in their NVR and IP camera products.
For reference, the advanced commands of the firmware mod tool are as follows:

hiktools split digicap.dav destinationdir
The output on the screen lists the names of the files extracted from the main section of the firmware file. These files are created in the specified destination directory, and can be inspected and used when the extraction is complete.
In the version 03R and later of the hiktools program, there is a facility to recombine the extracted files, some of which the user may have since modified, or added to, into an original, valid firmware file that could be used by the firmware upgrade process in the IP camera or NVR. It is therefore possible for the user to modify and customise the IP camera or NVR behaviour should they wish to do so.

hiktools create header_from_digicap.dav sourcedir
The tool creates a new firmware file by combining the header extracted from the first argument with the contents of the directory from the second argument. Those contents could be files previously extracted, some of which were since modified, or with additional files to be included in the firmware image.


Special thanks alastairstevenson

UPDATE 19-06-15

version 05R1
1. Fixed minor bugs

 

[whoslooking]

HIKtools has no control over the 5.30 operation.
To make your camera another language read the post in the sticky section 5.30 downgrader.

 

[alastairstevenson]

After flashing look through the properties of putty and still remains a region of the chamber 2 .
what could be the problem?

Hiktools does not change the region of the camera - it changes the region of the header of the firmware, to avoid the camera or NVR rejecting the attempted firmware update due to a language mismatch between the firmware and camera or NVR.

 

[homejones]

I received a 2532 from Aliexpress that was on 5.3.0_150513 (07/2015). Downgraded to 5.2.5 and tried this Hiktools 'patch' to change the language flag. Confirmed that the language flag was changed in the firmware file, but after trying to upgrade the firmware on the camera a couple times, it's still stuck on Chinese. Cleared my web browser's cache to no avail.

Any guidance would be appreciated. Thank you!

 

[DemonicHawk]

Just curious, has anyone successfully flashed a 5.3 firmware with modifications made to it? I played around with it briefly, but I couldn't flash a custom 5.3 firmware made with this tool.

 

[cybergibbons]

Is the source of hiktools available? I'd like to work on some newer firmware images, and there is commonality but also differences.

 

[alastairstevenson]

Is the source of hiktools available?

The tool is the work of @wzhick, and has not been offered as open-source. He will read this and may comment.

I'd like to work on some newer firmware images

Are you referring to the newer camera firmware such as 5.3.x where the header and contents are differently encoded?

 

[cybergibbons]

This is a rebadged camera with subtle differences in the file format.

 

[azn-tuan86]

Hi,

Will it work with this version of hikvision camera DS-2CD3410FD-IW or DS-2CD1103-I?

Thanks