Hikvision IPC firmware update... my eyes are bleeding... need some help/clarification

[gabemcg]

I did all of the below before spending the last 24 hours parsing through all of these forums and trying different things:

I have a DS-7608NI-E2/8P that was running v3.0.1 I think. The NVR's SMTP function didn't really seem to conform to RFCs and was not working properly, so I updated firmware to 3.3.4. No issues there (other than some functionality lost).

I have (6) DS-2CD2232-I5 cameras that were purchased from AliExpress. They came with v5.2.5build 141201. I tried updating to a US firmware 5.3.0. The camera rebooted and I got the language mismatch error. I tried restoring firmware via TFTP using 4-5 different versions I found online. None of them worked. I accidentally left the TFTP server running when I rebooted the NVR so I bricked 5 out of the 6 cameras. I still have one working camera up and running.

I've tried 5.30 Downgrader, 525.zip, and ftp583v525. I eventually found one that would load but it is Chinese, so I modified it using the hiktools.exe and loaded it, but it is still Chinese (even though the hiktools.exe shows it as being Language version 1).

I've emailed the two sellers I purchased the cameras from requesting the original firmware they used, but I don't forsee getting a timely response.

I've got some cameras that show up in SADP with Min-System, some with a 4.0.x firmware.

I'm at a loss here now...

The process I've been using is to power cycle the camera, TFTP download succeeds, then I wait 10 minutes before power cycling the camera again. I've tried loading the modified firmware via the Chinese web interface and via TFTP with no luck either method.

Can someone help me out?

 

[gabemcg]

Re: Hikvision IPC firmware update... my eyes are bleeding... need some help/clarifica

If I knew how to simply export the firmware from the working camera, that would solve all my problems... can't seem to find any definitive info on that.

 

[alastairstevenson]

Re: Hikvision IPC firmware update... my eyes are bleeding... need some help/clarifica

What firmware version and manufacturing date shows on the label or box of the cameras?

I eventually found one that would load but it is Chinese, so I modified it using the hiktools.exe and loaded it, but it is still Chinese (even though the hiktools.exe shows it as being Language version 1).

Be aware that Hiktools LANG option changes the language of the firmware header so the firmware is not rejected as an update by the camera - not the region setting of the camera.
From what you've described, I'd have expected "I've tried 5.30 Downgrader," to work OK.
Did it show 'upgrade completed' or similar on the tftp server?

 

[gabemcg]

Re: Hikvision IPC firmware update... my eyes are bleeding... need some help/clarifica

Just grabbed 5.30 Downgrader 4lines.rar. Ran the tftpserver... I get connect, start file, completed file, and system update complete. I then power cycle the camera and it never shows up in SADP or on the NVR.

Will grab the info off the bottom of the camera when I have some time, they are all mounted in hard to reach places. I believe they say 5.2.5 on them.

 

[gabemcg]

Re: Hikvision IPC firmware update... my eyes are bleeding... need some help/clarifica

5 of them were bought at the same time from the same reseller... the 6th one was bought more recently from a different reseller and is labeled 9/2015 5.3.0. I believe it only had 5.1.6 on it when I plugged it in.

 

[Korgoth]

Re: Hikvision IPC firmware update... my eyes are bleeding... need some help/clarifica

Just have to ask, why you ppl buy them on Ali? Why not from local distributor? Never had any problem with support, updating cameras or NVRs etc. Is it rly worth it to risk and loose functionality?

 

[Enabler]

Re: Hikvision IPC firmware update... my eyes are bleeding... need some help/clarifica

Just have to ask, why you ppl buy them on Ali? Why not from local distributor? Never had any problem with support, updating cameras or NVRs etc. Is it rly worth it to risk and loose functionality?

Because it's usually ALOT cheaper - maybe not 2032s but many other models are less than 50% what I'd pay in the UK.

But that said you need to consider issues like support, returning it if there's a problem etc. And my advice unless you know what you are doing leave the multi language firmware it comes with alone.

 

[Speed666]

Re: Hikvision IPC firmware update... my eyes are bleeding... need some help/clarifica

Enabler - tell me on PW the diffs on few cams you buy. I have prices almost same as ALI and are EU region. Legal channel.

 

[epcjay]

Re: Hikvision IPC firmware update... my eyes are bleeding... need some help/clarifica

Enabler - tell me on PW the diffs on few cams you buy. I have prices almost same as ALI and are EU region. Legal channel.

Anything in Canada? They are 220$ + hst CAD for a 2032 or a 2132.

My one question is, why update the firmware when it's all working to begin with.

 

[gabemcg]

Re: Hikvision IPC firmware update... my eyes are bleeding... need some help/clarifica

I bought them there because they were half the cost of anywhere else I could find in the states... I didn't know any better... I had no idea they were Chinese region cameras with modified firmware.

I updated the NVR firmware to try and resolve some SMTP issues. I did have some motion detection sensitivity issues and figured why not upgrade firmware on the cameras? I assume Hikvision is fine tuning code for things like this.

Again, I had not found these forums before I attempted the firmware updates.

I did receive firmware directly from the reseller, but I still can't get my cameras working.

Firmware loads via TFTP, but the cameras come back up with Min-System. Ugh. I now have 5/6 non-functioning cameras.

Any other ideas??

 

[Speed666]

Re: Hikvision IPC firmware update... my eyes are bleeding... need some help/clarifica

None. You can't do antthing right now. There is a way but needs desoldering Flash.

 

[alastairstevenson]

Re: Hikvision IPC firmware update... my eyes are bleeding... need some help/clarifica

A suggestion that may help figure the cause - though maybe not a solution:
In min-system mode, you should still be able to telnet into the camera and get a command prompt.
Grab a copy of the kernel log with cat /proc/kmsg
and see what clues if any show in the bootup messages.

None. You can't do antthing right now. There is a way but needs desoldering Flash.

Not something the average person would succeed in doing ...
Are you saying that using the bootloader commands via the serial console would not allow a successful recovery?
What would be the cause of that?

 

[gabemcg]

Re: Hikvision IPC firmware update... my eyes are bleeding... need some help/clarifica

(none) login: root
Password:
login: can't chdir to home directory '/root/'
# cat /proc/kmsg
<5>Linux version 2.6.38.8 (wangqian@ipcteam2) (gcc version 4.6.1 (Sourcery CodeBench Lite 2011.09-70) )
<5>#75 PREEMPT Mon Jul 14 20:15:03 CST 2014
<4>CPU: ARMv6-compatible processor [4117b365] revision 5 (ARMv6TEJ), cr=00c5387f
<4>CPU: VIPT nonaliasing data cache, VIPT nonaliasing instruction cache
<4>Machine: Coconut
<4>Ignoring unrecognised tag 0x44000426
<4>Memory policy: ECC disabled, Data cache writeback
<6>Ambarella: AHB = 0x60000000[0xf0000000],0x01000000 0
<6>Ambarella: APB = 0x70000000[0xf1000000],0x01000000 0
<6>Ambarella: PPM = 0xc0000000[0xe0000000],0x00200000 9
<6>Ambarella: BSB = 0xc8c00000[0xe8c00000],0x00400000 9
<6>Ambarella: DSP = 0xc9000000[0xe9000000],0x07000000 9
<6>Ambarella: HAL = 0xc00a0000[0xfee00000],0x0000e708 9
<7>On node 0 totalpages: 25344
<7>free_area_init_node: node 0, pgdat c04e5c80, node_mem_map c0506000
<7> Normal zone: 198 pages used for memmap
<7> Normal zone: 0 pages reserved
<7> Normal zone: 25146 pages, LIFO batch:7
<4>bootmem_init: high_memory = 0xc8a00000
<7>pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
<7>pcpu-alloc: [0] 0
<4>Built 1 zonelists in Zone order, mobility grouping on. Total pages: 25146
<5>Kernel command line: console=ttyS0 dbg=0 IP=192.0.0.64 MASK=255.255.255.0 GW=0.0.0.0 SERVER=192.0.0.128 video=amb0fb:720x480,720x480,1,0
<6>PID hash table entries: 512 (order: -1, 2048 bytes)
<6>Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
<6>Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
<6>Memory: 99MB = 99MB total
<5>Memory: 91180k/91180k available, 10196k reserved, 0K highmem
<5>Virtual kernel memory layout:
<5> vector : 0xffff0000 - 0xffff1000 ( 4 kB)
<5> fixmap : 0xfff00000 - 0xfffe0000 ( 896 kB)
<5> DMA : 0xfe600000 - 0xfee00000 ( 8 MB)
<5> vmalloc : 0xc9000000 - 0xe0000000 ( 368 MB)
<5> lowmem : 0xc0000000 - 0xc8a00000 ( 138 MB)
<5> modules : 0xbf000000 - 0xc0000000 ( 16 MB)
<5> .init : 0xc0008000 - 0xc027d000 (2516 kB)
<5> .text : 0xc027d000 - 0xc04c7000 (2344 kB)
<5> .data : 0xc04c8000 - 0xc04e6320 ( 121 kB)
<6>Preemptable hierarchical RCU implementation.
<6> RCU-based detection of stalled CPUs is disabled.
<6> Verbose stalled-CPUs detection is disabled.
<6>NR_IRQS:224
<6>sched_clock: 32 bits at 72MHz, resolution 13ns, wraps every 59652ms
<2>sched_clock: wrong multiply/shift: 1864135111>>27 vs calculated 3728270222>>28
<2>sched_clock: fix multiply/shift to avoid scheduler hiccups
<4>Console: colour dummy device 80x30
<6>console [ttyS0] enabled
<6>Calibrating delay loop... 351.43 BogoMIPS (lpj=1757184)
<6>pid_max: default: 32768 minimum: 301
<4>Mount-cache hash table entries: 512
<6>CPU: Testing write buffer coherency: ok
<6>NET: Registered protocol family 16
<6>Ambarella Coconut:
<6> chip id: 5100
<6> board type: 3
<6> board revision: 10
<6> chip name: a5m
<6> HAL version: 176869
<6> reference clock: 24000000
<6> system configuration: 0x140004ea
<6> boot type: 0x00000002
<6> hif type: 0x00000000
<4>bio: create slab <bio-0> at 0
<6>ambarella-spi ambarella-spi.0: ambarella SPI Controller 0 created
<5>ambarella-i2c ambarella-i2c.0: Ambarella Media Processor I2C adapter[i2c-0] probed!
<5>ambarella-i2c ambarella-i2c.1: Ambarella Media Processor I2C adapter[i2c-1] probed!
<6>i2c i2c-0: Added multiplexed i2c bus 2
<6>ambarella-i2cmux ambarella-i2cmux.0: mux on ambarella-i2c adapter
<6>Switching to clocksource ambarella-cs-timer
<6>NET: Registered protocol family 2
<6>IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
<6>TCP established hash table entries: 4096 (order: 3, 32768 bytes)
<6>TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
<6>TCP: Hash tables configured (established 4096 bind 4096)
<6>TCP reno registered
<6>UDP hash table entries: 256 (order: 0, 4096 bytes)
<6>UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
<6>NET: Registered protocol family 1
<6>Unpacking initramfs...
<0>Initramfs unpacking failed: junk in compressed archive
<6>Freeing initrd memory: 4096K
<0>[ kernel version: svn-83192 ]
<4>mmc0 power register success!
<4>mmc1 power register success!
<1>use default reserved area information!
<6>reboot times :2
<6>msgmni has been set to 186
<6>io scheduler noop registered
<6>io scheduler deadline registered (default)
<6>ambarella-uart.0: ttyS0 at MMIO 0x70005000 (irq = 9) is a ambuart
<6>NAND device: Manufacturer ID: 0x01, Chip ID: 0xf1 (AMD NAND 128MiB 3,3V 8-bit)
<4>ambarella_nand_config_flash: 0x02e00140, 0x02c00140
<7>Bad block table found at page 65472, version 0x01
<7>Bad block table found at page 65408, version 0x01
<6>ambarella-nand ambarella-nand: ambarella_nand_probe: Partition infomation found!
<5>Creating 18 MTD partitions on "ambnand":
<5>0x000000000000-0x000000020000 : "bst"
<5>0x000000020000-0x000000120000 : "ptb"
<5>0x000000120000-0x000000220000 : "bld"
<5>0x000000220000-0x000000320000 : "hal"
<5>0x000000320000-0x000000420000 : "ano_ptb"
<5>0x000000420000-0x0000004a0000 : "env"
<5>0x0000004a0000-0x000000520000 : "param"
<5>0x000000520000-0x000000620000 : "dpt"
<5>0x000000620000-0x000001020000 : "rcvy"
<5>0x000001020000-0x000001820000 : "krn_pri"
<5>0x000001820000-0x000002020000 : "krn_sec"
<5>0x000002020000-0x000002420000 : "rmd_pri"
<5>0x000002420000-0x000002820000 : "rmd_sec"
<5>0x000002820000-0x000004020000 : "app_pri"
<5>0x000004020000-0x000005820000 : "app_sec"
<5>0x000005820000-0x000005c20000 : "cfg_pri"
<5>0x000005c20000-0x000006020000 : "cfg_sec"
<5>0x000006020000-0x000007020000 : "dbg"
<6>Ambarella MII Bus: probed
<5>ambarella-eth ambarella-eth.0: MAC Address[c0:56:e3:fc:a9:2d].
<6>mousedev: PS/2 mouse device common for all mice
<6>ambarella-rtc ambarella-rtc: rtc core: registered ambarella-rtc as rtc0
<6>i2c /dev entries driver
<5>ambarella-wdt ambarella-wdt: Ambarella Media Processor Watch Dog Timer[ambarella-wdt].
<6>TCP cubic registered
<6>NET: Registered protocol family 17
<6>ambarella-rtc ambarella-rtc: setting system clock to 2015-12-04 09:21:47 UTC (1449220907)
<6>Freeing init memory: 2516K
<5>net eth0: Could not find default PHY in 9.
<5>net eth0: Try PHY[9] whose id is 0x00008201!
<5>UBI: attaching mtd13 to ubi1
<5>UBI: physical eraseblock size: 131072 bytes (128 KiB)
<5>UBI: logical eraseblock size: 129024 bytes
<5>UBI: smallest flash I/O unit: 2048
<5>UBI: sub-page size: 512
<5>UBI: VID header offset: 512 (aligned 512)
<5>UBI: data offset: 2048
<5>UBI: max. sequence number: 154
<5>UBI: attached mtd13 to ubi1
<5>UBI: MTD device name: "app_pri"
<5>UBI: MTD device size: 24 MiB
<5>UBI: number of good PEBs: 192
<5>UBI: number of bad PEBs: 0
<5>UBI: number of corrupted PEBs: 0
<5>UBI: max. allowed volumes: 128
<5>UBI: wear-leveling threshold: 4096
<5>UBI: number of internal volumes: 1
<5>UBI: number of user volumes: 1
<5>UBI: available PEBs: 0
<5>UBI: total number of reserved PEBs: 192
<5>UBI: number of PEBs reserved for bad PEB handling: 2
<5>UBI: max/mean erase counter: 15/8
<5>UBI: image sequence number: 1206679201
<5>UBI: background thread "ubi_bgt1d" started, PID 321
<5>UBIFS: recovery needed
<5>UBIFS: recovery completed
<5>UBIFS: mounted UBI device 1, volume 0, name "app_pri"
<5>UBIFS: file system size: 22837248 bytes (22302 KiB, 21 MiB, 177 LEBs)
<5>UBIFS: journal size: 1161216 bytes (1134 KiB, 1 MiB, 9 LEBs)
<5>UBIFS: media format: w4/r0 (latest is w4/r0)
<5>UBIFS: default compressor: lzo
<5>UBIFS: reserved for root: 1078659 bytes (1053 KiB)
<5>UBI: attaching mtd14 to ubi2
<5>UBI: physical eraseblock size: 131072 bytes (128 KiB)
<5>UBI: logical eraseblock size: 129024 bytes
<5>UBI: smallest flash I/O unit: 2048
<5>UBI: sub-page size: 512
<5>UBI: VID header offset: 512 (aligned 512)
<5>UBI: data offset: 2048
<5>UBI: max. sequence number: 162
<5>UBI: attached mtd14 to ubi2
<5>UBI: MTD device name: "app_sec"
<5>UBI: MTD device size: 24 MiB
<5>UBI: number of good PEBs: 192
<5>UBI: number of bad PEBs: 0
<5>UBI: number of corrupted PEBs: 0
<5>UBI: max. allowed volumes: 128
<5>UBI: wear-leveling threshold: 4096
<5>UBI: number of internal volumes: 1
<5>UBI: number of user volumes: 1
<5>UBI: available PEBs: 0
<5>UBI: total number of reserved PEBs: 192
<5>UBI: number of PEBs reserved for bad PEB handling: 2
<5>UBI: max/mean erase counter: 15/8
<5>UBI: image sequence number: 2142784015
<5>UBI: background thread "ubi_bgt2d" started, PID 332
<6>PHY: 0:09 - Link is Up - 100/Full
<5>UBIFS: recovery needed
<5>UBIFS: recovery completed
<5>UBIFS: mounted UBI device 2, volume 0, name "app_sec"
<5>UBIFS: file system size: 22837248 bytes (22302 KiB, 21 MiB, 177 LEBs)
<5>UBIFS: journal size: 1161216 bytes (1134 KiB, 1 MiB, 9 LEBs)
<5>UBIFS: media format: w4/r0 (latest is w4/r0)
<5>UBIFS: default compressor: lzo
<5>UBIFS: reserved for root: 1078659 bytes (1053 KiB)
<5>UBI: attaching mtd15 to ubi3
<5>UBI: physical eraseblock size: 131072 bytes (128 KiB)
<5>UBI: logical eraseblock size: 129024 bytes
<5>UBI: smallest flash I/O unit: 2048
<5>UBI: sub-page size: 512
<5>UBI: VID header offset: 512 (aligned 512)
<5>UBI: data offset: 2048
<5>UBI: max. sequence number: 58
<5>UBI: attached mtd15 to ubi3
<5>UBI: MTD device name: "cfg_pri"
<5>UBI: MTD device size: 4 MiB
<5>UBI: number of good PEBs: 32
<5>UBI: number of bad PEBs: 0
<5>UBI: number of corrupted PEBs: 0
<5>UBI: max. allowed volumes: 128
<5>UBI: wear-leveling threshold: 4096
<5>UBI: number of internal volumes: 1
<5>UBI: number of user volumes: 1
<5>UBI: available PEBs: 0
<5>UBI: total number of reserved PEBs: 32
<5>UBI: number of PEBs reserved for bad PEB handling: 2
<5>UBI: max/mean erase counter: 20/16
<5>UBI: image sequence number: 1827778893
<5>UBI: background thread "ubi_bgt3d" started, PID 343
<5>UBIFS: recovery needed
<5>UBIFS: recovery completed
<5>UBIFS: mounted UBI device 3, volume 0, name "cfg_pri"
<5>UBIFS: file system size: 2193408 bytes (2142 KiB, 2 MiB, 17 LEBs)
<5>UBIFS: journal size: 1032193 bytes (1008 KiB, 0 MiB, 6 LEBs)
<5>UBIFS: media format: w4/r0 (latest is w4/r0)
<5>UBIFS: default compressor: lzo
<5>UBIFS: reserved for root: 103599 bytes (101 KiB)
<5>UBI: attaching mtd16 to ubi4
<5>UBI: physical eraseblock size: 131072 bytes (128 KiB)
<5>UBI: logical eraseblock size: 129024 bytes
<5>UBI: smallest flash I/O unit: 2048
<5>UBI: sub-page size: 512
<5>UBI: VID header offset: 512 (aligned 512)
<5>UBI: data offset: 2048
<5>UBI: max. sequence number: 62
<5>UBI: attached mtd16 to ubi4
<5>UBI: MTD device name: "cfg_sec"
<5>UBI: MTD device size: 4 MiB
<5>UBI: number of good PEBs: 32
<5>UBI: number of bad PEBs: 0
<5>UBI: number of corrupted PEBs: 0
<5>UBI: max. allowed volumes: 128
<5>UBI: wear-leveling threshold: 4096
<5>UBI: number of internal volumes: 1
<5>UBI: number of user volumes: 1
<5>UBI: available PEBs: 0
<5>UBI: total number of reserved PEBs: 32
<5>UBI: number of PEBs reserved for bad PEB handling: 2
<5>UBI: max/mean erase counter: 20/16
<5>UBI: image sequence number: 892566401
<5>UBI: background thread "ubi_bgt4d" started, PID 352
<5>UBIFS: recovery needed
<5>UBIFS: recovery completed
<5>UBIFS: mounted UBI device 4, volume 0, name "cfg_sec"
<5>UBIFS: file system size: 2193408 bytes (2142 KiB, 2 MiB, 17 LEBs)
<5>UBIFS: journal size: 1032193 bytes (1008 KiB, 0 MiB, 6 LEBs)
<5>UBIFS: media format: w4/r0 (latest is w4/r0)
<5>UBIFS: default compressor: lzo
<5>UBIFS: reserved for root: 103599 bytes (101 KiB)

 

[Speed666]

Re: Hikvision IPC firmware update... my eyes are bleeding... need some help/clarifica

Recovery is possible. But all is blocked. Only update and upf commands can be used to recover BUT only to same firmware that was installed in cam.

 

[alastairstevenson]

Re: Hikvision IPC firmware update... my eyes are bleeding... need some help/clarifica

<6>Unpacking initramfs...
<0>Initramfs unpacking failed: junk in compressed archive
<6>Freeing initrd memory: 4096K
<0>[ kernel version: svn-83192 ]

The camera is failing to create the initrd (Initial RAM file system) - probably due to an inconsistency between the hardware information and the running firmware.
Without that there is no normal running environment and the camera reverts to the 'min-system' recovery mode.

I eventually found one that would load but it is Chinese, so I modified it using the hiktools.exe and loaded it, but it is still Chinese (even though the hiktools.exe shows it as being Language version 1).

What was the exact version of this firmware that you found would run, but give Chinese menus?
It may be possible to do the MTD hack to get the camera back to English.

Recovery is possible. But all is blocked. Only update and upf commands can be used to recover BUT only to same firmware that was installed in cam.

@Speed666 here is referring to the update commands available within the bootloader, which would need access to the serial console in order to be executed.
To do this requires a cable connection to the camera main board from an RS232/TTL serial adaptor. @Speed666 - what do you think about MTD hack to region=1 while in min-system mode, then load 5.2.5 ML firmware? @gabemcg - what firmware version shows on the label of the cameras?

 

[whoslooking]

Re: Hikvision IPC firmware update... my eyes are bleeding... need some help/clarifica

Use this firmware to recover your camera's

https://www.dropbox.com/s/i88eaoge0mx0t29/525.zip?dl=0

 

[gabemcg]

Re: Hikvision IPC firmware update... my eyes are bleeding... need some help/clarifica

Recovery is possible. But all is blocked. Only update and upf commands can be used to recover BUT only to same firmware that was installed in cam.

What do you mean by 'only update and upf commands can be used'?

I have been provided the original firmware by the reseller, but it is not booting after a TFTP load.

 

[gabemcg]

Re: Hikvision IPC firmware update... my eyes are bleeding... need some help/clarifica

Use this firmware to recover your camera's

https://www.dropbox.com/s/i88eaoge0mx0t29/525.zip?dl=0

Ok, so I'm one step further! Thank you!!!

This firmware loaded on 4 of the cameras... they boot up now with 5.2.5, one if them is in English, the rest are in Chinese. What is the next step for converting from Chinese to English? I'm guessing whatever I was doing to try and get these back on line previously is why one of them is already in English?

On the newest camera I bought (from the same reseller as the ones above), the TFTP completes, but I never see a 'update successful' message. For some reason I think this one was running 5.1.6 when I got it, and all the others were running 5.2.5. Would that be causing the issue with this specific camera? Do I need to load the original version that it came with?

 

[gabemcg]

Re: Hikvision IPC firmware update... my eyes are bleeding... need some help/clarifica

I tried using the hiktools.exe on the 5.2.5 code and change it to English, but when I load it and reboot the camera, it comes back up as Chinese. Is there a different method I should be using?

 

[whoslooking]

Re: Hikvision IPC firmware update... my eyes are bleeding... need some help/clarifica

Next step is the mtd hack, I made a video to show you how.

https://www.ipcamtalk.com/showthread.php/5988-MTD-HACK-made-easy-on-Video

The firmware was edited for a manufacture date that's why you have one camera in English, what was the date 04/2015 or 07/2015?