HIKVISION mtd Brick Recovery Guide

mamuli said:
Update: after coming out of boot loop, I was stuck with 5.3.0 version, but Chinese UI. I tried to put many other firmware but failed. Tried to do mtb hack, but never could connect to the camera via telnet.

At this stage I reached out to my eBay seller and he provided me a firmware, which magically worked. It brought the camera to 5.2.5 version, and English UI. And this 'upgrade' just worked using web UI upgrade.

As part of the upgrade instructions, seller asked me to change my PC's mac address to a specific mac address. I did that before upgrading to that firmware, which obviously worked. However, I could not resist doing the same with my default mac address (yes, I did put Chinese 5.3.0 firmware first) and that worked too. This makes me to believe that the whole magic of being able to downgrade from 5.3.0 to 5.2.5, with English UI is confined in the firmware given by the seller.

Any bright minds want to investigate this magical firmware?
Click to expand...

Hi
Could you give me instruction, how do it with mac address?
 
Thanks - will try this evening and report back.


-UPDATE-
In my situation, no luck - tried with suggested mac as well. YRMV.
 
Last edited by a moderator:
You have 2, Choices with this model the downgrader or 5.30 CN.
If the tftp does not shows successful, then the try using another pc as this is tried and tested with this model.
 
is it possible to see this instruction on a format apart from a dav file?
I don't want to download a programme just to read some instructions which I may or may not use.
 
whoslooking said:
You have 2, Choices with this model the downgrader or 5.30 CN.
Click to expand...
@whoslooking - I retried these two firmware files

Unit - DS-2CD2632F-IS
5.3.0_150513 CN - downloaded from http://www1.hikvision.com/cn/download_more_714.html (file)
5.3.0 - 5.2.5 downgrader - downloaded from https://www.dropbox.com/s/3hy72q4osstun72/5.30 Downgrader.rar?dl=0

Both comes up min-system on SADP (no http port, software version 4.0.8build 150401)

whoslooking said:
If the tftp does not shows successful, then the try using another pc as this is tried and tested with this model.
Click to expand...

Tried on another PC - results are the same on both computers.

By "shows successful", are you referring to the "system update completed!" Log entry?

The two above TFTP Logs display the following:
[2016-03-04 19:30:16] TFTP server[192.0.0.128] initialized
[2016-03-04 19:30:27] Device[192.0.0.64] test tftpserver
[2016-03-04 19:30:35] Connect client[192.0.0.64] success
[2016-03-04 19:30:35] Start file[C:\tftp\digicap.dav] transmitting
[2016-03-04 19:31:07] Completed file[C:\tftp\digicap.dav] transmit
Click to expand...


When I use 5.3.0_150513 EN - (Or CN changed to EN via hiktools) TFTP Logs display the following:
[2016-03-04 19:52:08] TFTP server[192.0.0.128] initialized
[2016-03-04 19:52:20] Device[192.0.0.64] test tftpserver
[2016-03-04 19:52:28] Connect client[192.0.0.64] success
[2016-03-04 19:52:28] Start file[C:\tftp\digicap.dav] transmitting
[2016-03-04 19:53:02] Completed file[C:\tftp\digicap.dav] transmit
[2016-03-04 19:53:26] Device[192.0.0.64] system update completed!
Click to expand...

And unit will reappear in SADP / require activation / but display "firmware language mismatch /home/WebLib" when accessing port 80.
 
Last edited by a moderator:
@torvil
To read this, I have had to put Dropbox on my laptop.
Click to expand...
No - you don't need to sign up to Dropbox to download the file at the link. Look carefully at the screen after you click the link.
When I extract it, it extracts as a dav file which Windows cannot open without downloading a further programme to encrypt the file........I think.
Click to expand...
The digicap.dav is not a Windows file - it is a firmware image for a Hikvision camera.

What are you actually looking for?
 
Last edited by a moderator:
Hi, I have also messed up my camera. I tried all variants I could find in the web to de-brick it but no success so far. I bought a DS-2CD2532F-IS at Aliexpress. It was delivered with a hacked firmware 5.2.5 so that UI was in English. As I don't care much about that UI, but had trouble with max resolution video streams in my setup, I wanted to flash it to 5.3.0. The sticker states it was originally delivered with V5.3.0_150513 and it is a Chinese model. The short version: It runs only min-system now, showing V4.0.8 and only after waiting really long, at 192.168.1.64 address. I am able to upload firmware via TFTP. The first one which showed the final "success" message was the EU 5.3.0 version. The Chinese one did not complete. But The camera does not boot up at all. The 5.3.0 to 5.2.5 downgrade version could not be flashed (did not show the last "completed" statement in TFTP). Any ideas on what else I could try except throwing the camera out?
 
Always worth trying is to ask the reseller if they would supply you a copy of the firmware that was on the camera when they sold you it.
The first one which showed the final "success" message was the EU 5.3.0 version.
Click to expand...
Following the power cycle after this - what did SADP show?
 
I ended up in a boot loop again, SADP could not find it after that, but TFTP worked. Using another downgrade firmware I found did not complete again. I wrote the dealer, hoping that he replies. Otherwise I have a fake camera at least ;)
Update: Dealer gets camera patched already, so no firmware to get from them :(
 
Last edited by a moderator:
alastairstevenson said:
@torvil

No - you don't need to sign up to Dropbox to download the file at the link. Look carefully at the screen after you click the link.

The digicap.dav is not a Windows file - it is a firmware image for a Hikvision camera.


I was thinking of downgrading the firmware as I have two dome cameras, 1 had euro firmware, the other a version three camera (3145) with Chinese firmware. I have never been able to remote view the 3145 unlike the 2132, however I have since lost this function on the 2132 now. I don't know why tho. I want to be able to mirror the settings on the camera, and thought if I changed the firmware to V2.5, it would be home and dry.
I fell at he first hurdle, and am nervous about doing it for fearing of bricking the 3145, especially as I am a novice.
Thanks
Click to expand...
 
after upgrade my DS-2CD2032F-I to version 5.3 i downgrade it again to 5.2.5 and it was ok till language was chinese,reading manual of mtd hack i tried with hxd to modify mtd5 and 6 but camera bricked , i have tried many times to downgrade with tftp update but no luck ,also have used hiktool,it downgrade sucessfully but when i restart the camera still bricked,i can't telnet during tftp update.i notice now that my camera ip is not 192.0.0.64 as before was but is 192.168.1.64 .any one to help how to put back the original mtd5 and 6 files inside with console commands or any other recovery mode? thnx br
 
digicamp.dav is set with hiktools to english ,it update complete but when turn the camera on irda stays always turned on,so not normal boot
tftp logs:
016-03-08 16:48:01] TFTP server[192.168.1.128] initialized
[2016-03-08 16:48:08] Device[192.168.1.64] test tftpserver
[2016-03-08 16:48:15] Connect client[192.168.1.64] success
[2016-03-08 16:48:15] Start file[D:\tftp Downgrader\digicap.dav] transmitting
[2016-03-08 16:48:49] Completed file[D:\tftp Downgrader\digicap.dav] transmit
[2016-03-08 16:49:12] Device[192.168.1.64] system update completed!
 
after upgrade my DS-2CD2032F-I to version 5.3
Click to expand...
What was the original version of firmware?
You need to try earlier versions of firmware to try to get a telnet connection so you can replace mtdblock5&6 with the originals.
If not, you may need to use the serial console to be able to do that.
What changes did you make to mtdblock5&6?
 
camera is chinese and was in english with version 5.2.5,i have tried to telnet but no results,i may need serial console,i have follow the guide for the language change but haven't been carefully on checksum so i think that was the problem of the failure,also i have formated the pc and when recovered the original mdf files on pc they might be corrupted after when i see them with HXD the content is not convenient.so if i take mtdblock 5 & 6 from another camera can i replace them to this one?and how can i transfer them with console after i get connected to camera,im not familiar with commands i sholud use in this case
 
Last edited by a moderator:
so if i take mtdblock 5 & 6 from another camera can i replace them to this one?
Click to expand...
Another forum member has done this successfully.
The serial console requires a USB to TTL serial convertor and a connection inside the camera.
Not easy if you are unfamiliar with this - but there are some posts on the topic.
 
  • Like
Reactions: arveni
ok thank you,ill try to connect with serial first and after will try to find the commands to bring me there,i will ask ask if i will have any difficulty .thank you
 
You must log in or register to reply here.
Top Bottom