Hikvision FIRMWARE TOOLS - change language, extract files and create own firmware

scn101 · Jul 31, 2016

normel said:
As mentioned before, i have the same as Gilnash. After installing FW, NVR boots, stucks at https://www.ipcamtalk.com/attachment.php?attachmentid=11768&d=1467798343 screen while beeping. After around 12 beeps ,it reboots.. same process repeats.
Bought the mini connector, in order to establish a serial connection, which i am very new withh:

Read the first post: https://www.ipcamtalk.com/showthread.php/9549-Upgrading-beyond-3-4-0-on-a-Chinese-(lang-2)-HV-NVR

Same thing happened to me. You should be able to restore 3.0.10 via a serial UART connection.

eldad007 · Aug 23, 2016

hello
i need a help with the language mismatch problem
i have 6 ipc DS-2CD3210-I3 camera's and a DS-7100 NVR
the ipc camera's are chinese and the nvr is english version
the nvr cannot connect the camera's and the mismatch language is the problem
i tried to use the TFTP with several "digicap.dav" files from this post but non of them fixed the problem, the TFTP tool could not finished the firmware update and it is looped in "Resend required" massage
is any of you can help me with this problem please?
i dont care if the camera's will be in english or the nvr will be in chinese - i just want it to work!!!
please!!!!

alastairstevenson · Aug 23, 2016

Try to connect the cameras as ONVIF instead of Hikvision. Use port=80
Depending on how new the NVR firmware is, language isn't checked under ONVIF.

eldad007 · Aug 23, 2016

ok
how to change to onvif?
when i want to edit something on the camera setting in the nvr the massge language mismatch apear
cant do nothing

alastairstevenson · Aug 23, 2016

how to change to onvif?

In the NVR web GUI, under Camera Management, select the camera, click the 'Modify' button, and in the Protocol drop-down which currently has Hikvision selected, select ONVIF instead.
Change the port from 8000 to 80, click Save.

At this point you will find out if your NVR firmware also checks camera language under ONVIF as well as under Hikvision. Some versions didn't.

pepeEL · Aug 26, 2016

Hi
I buy from aliexpress.com camera IP HikVision DS-2CD2035-I chinese version with FW multilanguage 5.3.6
I know that is available for this model version 5.4.0 but seller dont want share me FW. Tell me that only his computer he can update FW.
I found on this chinese page FW for my model:
http://www1.hikvision.com/cn/download_more_714.html

I want change language to english/multilanguage. I don as describe in post 1. But this is info about original FW before change flag lang:

Code:

 HIK firmware header converter 0.4R


Head raw data(108b) :
00000000 8A FF F7 B6 DF EE DD D3 D6 B9 A3 AB BF CB B5 BE    ................
00000010 65 89 F7 D7 CB DD D3 BA 46 5C 54 40 34 4A 41 45    e.......F\T@4JAE
00000020 43 01 29 35 22 2C 45 46 5C 54 40 34 84 8C 88 FD    C.)5",EF\T@4....
00000030 CE E0 FA ED E1 8B 88 92 9A 8E FA 85 8E 88 FC BC    ................
00000040 E7 F8 EF E3 8A 8F 93 9B 8D FA 84 8F 8B FC 8D CE    ................
00000050 FA EF E2 BA 7E C3 A9 52 97 DE 24 37 CE B3 E8 11    ....~..R..$7....
00000060 B1 D3 BA B9 9F 9E B6 CA 3A 51 B7 49


Head decoded data(108b) :
00000000 30 32 4B 48 09 24 00 00 6C 00 00 00 00 00 00 00    02KH.$..l.......
00000010 A8 35 09 01 01 00 00 00 FF FF FF FF FF FF FF FF    .5..............
00000020 FF FF FF FF FF FF FF FF FF FF FF FF 31 32 32 30    ............1220
00000030 30 36 30 30 32 31 31 31 31 31 31 30 30 32 31 00    060021111110021.
00000040 31 32 32 30 30 36 30 30 32 31 31 31 31 31 31 30    1220060021111110
00000050 30 32 31 00 C7 60 02 ED 5C 6B 9A 8D 03 0F 16 C7    021..`..\k.....
00000060 6C 00 00 00 3C 35 09 01 8F EF 0D 84


Magic number :    0x484B3230
iHeaderCheckSum : 0x00002409 [9225]
iHeadTotalLen :   0x0000006C [108]
iFileNum :        0x00000000 [0]
iLanguage :       0x010935A8 [17380776]
iDeviceClass :    0x00000001
iOEMCode :        0xFFFFFFFF
iFirmwareVer :    0xFFFFFFFF
iFeature:         0xFFFFFFFF
Calculated CheckSum :        0x00002409 [9225]


Full decoded data (with full files block):
00000000 30 32 4B 48 09 24 00 00 6C 00 00 00 00 00 00 00    02KH.$..l.......
00000010 A8 35 09 01 01 00 00 00 FF FF FF FF FF FF FF FF    .5..............
00000020 FF FF FF FF FF FF FF FF FF FF FF FF 31 32 32 30    ............1220
00000030 30 36 30 30 32 31 31 31 31 31 31 30 30 32 31 00    060021111110021.
00000040 31 32 32 30 30 36 30 30 32 31 31 31 31 31 31 30    1220060021111110
00000050 30 32 31 00 C7 60 02 ED 5C 6B 9A 8D 03 0F 16 C7    021..`..\k.....
00000060 6C 00 00 00 3C 35 09 01 8F EF 0D 84
C:\hiktools04r>

Magic code is other as describe and iLanguage is not set 2.

After change flag language it looks as:

Code:

 HIK firmware header converter 0.4R


Head raw data(108b) :
00000000 8A FF F7 B6 B4 E9 DD D3 D6 B9 A3 AB BF CB B5 BE    ................
00000010 CC 89 F7 D7 CB DD D3 BA 46 5C 54 40 34 4A 41 45    ........F\T@4JAE
00000020 43 01 29 35 22 2C 45 46 5C 54 40 34 84 8C 88 FD    C.)5",EF\T@4....
00000030 CE E0 FA ED E1 8B 88 92 9A 8E FA 85 8E 88 FC BC    ................
00000040 E7 F8 EF E3 8A 8F 93 9B 8D FA 84 8F 8B FC 8D CE    ................
00000050 FA EF E2 BA 7E C3 A9 52 97 DE 24 37 CE B3 E8 11    ....~..R..$7....
00000060 B1 D3 BA B9 9F 9E B6 CA 3A 51 B7 49


Head decoded data(108b) :
00000000 30 32 4B 48 62 23 00 00 6C 00 00 00 00 00 00 00    02KHb#..l.......
00000010 01 35 09 01 01 00 00 00 FF FF FF FF FF FF FF FF    .5..............
00000020 FF FF FF FF FF FF FF FF FF FF FF FF 31 32 32 30    ............1220
00000030 30 36 30 30 32 31 31 31 31 31 31 30 30 32 31 00    060021111110021.
00000040 31 32 32 30 30 36 30 30 32 31 31 31 31 31 31 30    1220060021111110
00000050 30 32 31 00 C7 60 02 ED 5C 6B 9A 8D 03 0F 16 C7    021..`..\k.....
00000060 6C 00 00 00 3C 35 09 01 8F EF 0D 84


Magic number :    0x484B3230
iHeaderCheckSum : 0x00002362 [9058]
iHeadTotalLen :   0x0000006C [108]
iFileNum :        0x00000000 [0]
iLanguage :       0x01093501 [17380609] EN/ML
iDeviceClass :    0x00000001
iOEMCode :        0xFFFFFFFF
iFirmwareVer :    0xFFFFFFFF
iFeature:         0xFFFFFFFF
Calculated CheckSum :        0x00002362 [9058]


Full decoded data (with full files block):
00000000 30 32 4B 48 62 23 00 00 6C 00 00 00 00 00 00 00    02KHb#..l.......
00000010 01 35 09 01 01 00 00 00 FF FF FF FF FF FF FF FF    .5..............
00000020 FF FF FF FF FF FF FF FF FF FF FF FF 31 32 32 30    ............1220
00000030 30 36 30 30 32 31 31 31 31 31 31 30 30 32 31 00    060021111110021.
00000040 31 32 32 30 30 36 30 30 32 31 31 31 31 31 31 30    1220060021111110
00000050 30 32 31 00 C7 60 02 ED 5C 6B 9A 8D 03 0F 16 C7    021..`..\k.....
00000060 6C 00 00 00 3C 35 09 01 8F EF 0D 84
C:\hiktools04r>

I dont know that i can update this FW ? Seller chinese tell me that firmware chineese is hacked to english firmware... What you mean ?

alastairstevenson · Aug 26, 2016

Hiktools does not work with with the HK20, HK30, HK53 type of firmware encapsulation - only the original HKWS.
And for info, changing the language of the firmware header does not change the language of the device that the firmware would be applied to - it's just another type of device compatibility check when you try a firmware update.

Speed666 · Aug 26, 2016

Also the Chineese firmwares are RSA Signed so repacker will just not be created. Too much effort. Of course there is some way that i found but as i dont use Chineese cams - i will not try to work on this. Sorry.

alastairstevenson · Aug 26, 2016

I have a Chinese DS-2CD3335 that I play with just for fun from time to time, it has Chinese menus.
The last thing I tried was booting it over the network with the kernel from a Longse/Cantonk S500, which also has the 3516A SoC.
What I haven't yet managed to do is provide the kernel with an initrd/initramfs over the network so I can explore the Hikvision internals via the intruder.

asbiugyybsad · Sep 3, 2016

Hello would anyone be able to tell me how to change the camera DS-2CD3320-I into english ?
it has the firmware 5.2.3_141024
the camera was brought from ebay on chinese firmware,
thank you and appreciate your time

reesion · Sep 8, 2016

Hi Guys,

I tried to update my DS-7116N-SN with http://www.hikvisioneurope.com/portal/index.php?dir=Product Firmware/Back-ends/Recorder/NVR/DS-7100NI-SN/v3.0.18_151231 English & Multi-lingual/English/&file=NVR_71_16_SN_BL_EN_STD_V3.0.18_151231.zip via the web access but upon completion the NVR is in a boot loop.

Note: I've modified the firmware using HikTool to enable the language hack.

Now I've rolled back the firmware to V3.0.13 build 150503 via TFTP and it is back to functioning again

Would appreciate any thought on this in upgrading the firmware. Thanks!

alastairstevenson · Sep 8, 2016

If it's the 15 beeps bootloop then it may be complaining about a CN region NVR being loaded with non-CN region firmware.
The older firmware may not have that 'feature' in it.

reesion · Sep 8, 2016

alastairstevenson said:
If it's the 15 beeps bootloop then it may be complaining about a CN region NVR being loaded with non-CN region firmware.
The older firmware may not have that 'feature' in it.

I don't recall there were 15 beeps. Maybe less than 10. The NVR boots up and shows the Hikvision splash screen then starts beeping. After a certain interval it reboots itself and does the same cycle again.

So, there is no way around this to get the firmware upgraded?

alastairstevenson · Sep 9, 2016

So, there is no way around this to get the firmware upgraded?

Given some compatible firmware - the Hikvision tftp updater tool would be the next easiest to try.
The tool and usage instructions are in the download linked to here : https://www.ipcamtalk.com/showthread.php/4036-Custom-Firmware-Downgrader-5-3-0-Chinese-to-5-2-5-English
But key to success will be getting the right firmware. The Hikvision CN website is currently inaccessible - so I can't check for any CN firmware just now, which is likely to be what it needs.
You could try this one, at least to prove out the tftp updater : http://overseas.hikvision.com/en/download_89.html

reesion · Sep 9, 2016

alastairstevenson said:
Given some compatible firmware - the Hikvision tftp updater tool would be the next easiest to try.
The tool and usage instructions are in the download linked to here : https://www.ipcamtalk.com/showthread.php/4036-Custom-Firmware-Downgrader-5-3-0-Chinese-to-5-2-5-English
But key to success will be getting the right firmware. The Hikvision CN website is currently inaccessible - so I can't check for any CN firmware just now, which is likely to be what it needs.
You could try this one, at least to prove out the tftp updater : http://overseas.hikvision.com/en/download_89.html

I've tried tftp update using the firmware downloaded from http://oversea-download.hikvision.com/uploadfile/Firmware/New/KY2013 NVR/DS-7116NI-SN_EN_STD_V3.0.16build150617.zip but it is giving me the same result. It is the same as before. I can confirm that it beeps 15 times and does the reboot cycle.

I've once again rolled back to the firmware to V3.0.13 build 150503. This firmware has English GUI.

How do i determine which is the 'right firmware' ?

alastairstevenson · Sep 10, 2016

How do i determine which is the 'right firmware' ?

It depends on the region of your NVR.
The beeps and bootloop is what the 76/78 NVR EU firmware does when loaded in a CN region NVR.
I'm assuming what you are seeing is the same situation.

What are the letters within the serial number?
Check if the web GUI responds to http://NVR_IP_address/SDK/language and if so, see what it says.

reesion · Sep 10, 2016

alastairstevenson said:
what are the letters within the serial number?
Check if the web gui responds to http://nvr_ip_address/sdk/language and if so, see what it says.

ds-7116n-sn0820160216aarr573861588wcvu

<language xmlns="http://www.isapi.org/ver20/xmlschema" version="1.0">
<type>english</type>

</language>

alastairstevenson · Sep 10, 2016

aarr

OK, I think that means 'Other' as opposed to CN or WR (World).
It's what my 7816N-E2 NVRs show - but they are Chinese region.
I would have expected the EU firmware to work OK.

reesion · Sep 10, 2016

alastairstevenson said:
OK, I think that means 'Other' as opposed to CN or WR (World).
It's what my 7816N-E2 NVRs show - but they are Chinese region.
I would have expected the EU firmware to work OK.

Technically we have a similar NVR and both are Chinese region

I tried loading the EU firmware without modifying the language flag but it wouldn't let me upgrade via web GUI.

hzx505 · Sep 19, 2016

DS-2CD3942F-I picture turns red, do not know the last upgrade file wrong, come and look. Thank you

Search

Hikvision FIRMWARE TOOLS - change language, extract files and create own firmware

scn101

Getting the hang of it

eldad007

n3wb

alastairstevenson

eldad007

n3wb

alastairstevenson

pepeEL

Getting the hang of it

alastairstevenson

Speed666

Getting the hang of it

alastairstevenson

asbiugyybsad

n3wb

reesion

n3wb

alastairstevenson

reesion

n3wb

alastairstevenson

reesion

n3wb

alastairstevenson

reesion

n3wb

alastairstevenson

reesion

n3wb

hzx505

n3wb