HIKVISION mtd Brick Recovery Guide

chris85

n3wb
Joined
Feb 28, 2016
Messages
7
Reaction score
2
Update: after coming out of boot loop, I was stuck with 5.3.0 version, but Chinese UI. I tried to put many other firmware but failed. Tried to do mtb hack, but never could connect to the camera via telnet.

At this stage I reached out to my eBay seller and he provided me a firmware, which magically worked. It brought the camera to 5.2.5 version, and English UI. And this 'upgrade' just worked using web UI upgrade.

As part of the upgrade instructions, seller asked me to change my PC's mac address to a specific mac address. I did that before upgrading to that firmware, which obviously worked. However, I could not resist doing the same with my default mac address (yes, I did put Chinese 5.3.0 firmware first) and that worked too. This makes me to believe that the whole magic of being able to downgrade from 5.3.0 to 5.2.5, with English UI is confined in the firmware given by the seller.

Any bright minds want to investigate this magical firmware?
Hi
Could you give me instruction, how do it with mac address?
 

jimg

Young grasshopper
Joined
Feb 12, 2016
Messages
33
Reaction score
1
Care to share the firmware / model of your camera?
 

jimg

Young grasshopper
Joined
Feb 12, 2016
Messages
33
Reaction score
1
Thanks - will try this evening and report back.


-UPDATE-
In my situation, no luck - tried with suggested mac as well. YRMV.
 
Last edited by a moderator:

whoslooking

IPCT Contributor
Joined
Oct 3, 2014
Messages
1,524
Reaction score
548
Location
London
You have 2, Choices with this model the downgrader or 5.30 CN.
If the tftp does not shows successful, then the try using another pc as this is tried and tested with this model.
 

torvil

Young grasshopper
Joined
May 26, 2015
Messages
31
Reaction score
0
Location
Staffordshire UK
is it possible to see this instruction on a format apart from a dav file?
I don't want to download a programme just to read some instructions which I may or may not use.
 

jimg

Young grasshopper
Joined
Feb 12, 2016
Messages
33
Reaction score
1
You have 2, Choices with this model the downgrader or 5.30 CN.
@whoslooking - I retried these two firmware files

Unit - DS-2CD2632F-IS
5.3.0_150513 CN - downloaded from http://www1.hikvision.com/cn/download_more_714.html (file)
5.3.0 - 5.2.5 downgrader - downloaded from https://www.dropbox.com/s/3hy72q4osstun72/5.30 Downgrader.rar?dl=0

Both comes up min-system on SADP (no http port, software version 4.0.8build 150401)

If the tftp does not shows successful, then the try using another pc as this is tried and tested with this model.
Tried on another PC - results are the same on both computers.

By "shows successful", are you referring to the "system update completed!" Log entry?

The two above TFTP Logs display the following:
[2016-03-04 19:30:16] TFTP server[192.0.0.128] initialized
[2016-03-04 19:30:27] Device[192.0.0.64] test tftpserver
[2016-03-04 19:30:35] Connect client[192.0.0.64] success
[2016-03-04 19:30:35] Start file[C:\tftp\digicap.dav] transmitting
[2016-03-04 19:31:07] Completed file[C:\tftp\digicap.dav] transmit

When I use 5.3.0_150513 EN - (Or CN changed to EN via hiktools) TFTP Logs display the following:
[2016-03-04 19:52:08] TFTP server[192.0.0.128] initialized
[2016-03-04 19:52:20] Device[192.0.0.64] test tftpserver
[2016-03-04 19:52:28] Connect client[192.0.0.64] success
[2016-03-04 19:52:28] Start file[C:\tftp\digicap.dav] transmitting
[2016-03-04 19:53:02] Completed file[C:\tftp\digicap.dav] transmit
[2016-03-04 19:53:26] Device[192.0.0.64] system update completed!
And unit will reappear in SADP / require activation / but display "firmware language mismatch /home/WebLib" when accessing port 80.
 
Last edited by a moderator:

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,930
Reaction score
6,779
Location
Scotland
@torvil
To read this, I have had to put Dropbox on my laptop.
No - you don't need to sign up to Dropbox to download the file at the link. Look carefully at the screen after you click the link.
When I extract it, it extracts as a dav file which Windows cannot open without downloading a further programme to encrypt the file........I think.
The digicap.dav is not a Windows file - it is a firmware image for a Hikvision camera.

What are you actually looking for?
 
Last edited by a moderator:
Joined
Mar 6, 2016
Messages
2
Reaction score
0
Hi, I have also messed up my camera. I tried all variants I could find in the web to de-brick it but no success so far. I bought a DS-2CD2532F-IS at Aliexpress. It was delivered with a hacked firmware 5.2.5 so that UI was in English. As I don't care much about that UI, but had trouble with max resolution video streams in my setup, I wanted to flash it to 5.3.0. The sticker states it was originally delivered with V5.3.0_150513 and it is a Chinese model. The short version: It runs only min-system now, showing V4.0.8 and only after waiting really long, at 192.168.1.64 address. I am able to upload firmware via TFTP. The first one which showed the final "success" message was the EU 5.3.0 version. The Chinese one did not complete. But The camera does not boot up at all. The 5.3.0 to 5.2.5 downgrade version could not be flashed (did not show the last "completed" statement in TFTP). Any ideas on what else I could try except throwing the camera out?
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,930
Reaction score
6,779
Location
Scotland
Always worth trying is to ask the reseller if they would supply you a copy of the firmware that was on the camera when they sold you it.
The first one which showed the final "success" message was the EU 5.3.0 version.
Following the power cycle after this - what did SADP show?
 
Joined
Mar 6, 2016
Messages
2
Reaction score
0
I ended up in a boot loop again, SADP could not find it after that, but TFTP worked. Using another downgrade firmware I found did not complete again. I wrote the dealer, hoping that he replies. Otherwise I have a fake camera at least ;)
Update: Dealer gets camera patched already, so no firmware to get from them :(
 
Last edited by a moderator:

torvil

Young grasshopper
Joined
May 26, 2015
Messages
31
Reaction score
0
Location
Staffordshire UK
@torvil

No - you don't need to sign up to Dropbox to download the file at the link. Look carefully at the screen after you click the link.

The digicap.dav is not a Windows file - it is a firmware image for a Hikvision camera.


I was thinking of downgrading the firmware as I have two dome cameras, 1 had euro firmware, the other a version three camera (3145) with Chinese firmware. I have never been able to remote view the 3145 unlike the 2132, however I have since lost this function on the 2132 now. I don't know why tho. I want to be able to mirror the settings on the camera, and thought if I changed the firmware to V2.5, it would be home and dry.
I fell at he first hurdle, and am nervous about doing it for fearing of bricking the 3145, especially as I am a novice.
Thanks
 

arveni

n3wb
Joined
Feb 19, 2016
Messages
5
Reaction score
0
after upgrade my DS-2CD2032F-I to version 5.3 i downgrade it again to 5.2.5 and it was ok till language was chinese,reading manual of mtd hack i tried with hxd to modify mtd5 and 6 but camera bricked , i have tried many times to downgrade with tftp update but no luck ,also have used hiktool,it downgrade sucessfully but when i restart the camera still bricked,i can't telnet during tftp update.i notice now that my camera ip is not 192.0.0.64 as before was but is 192.168.1.64 .any one to help how to put back the original mtd5 and 6 files inside with console commands or any other recovery mode? thnx br
 

arveni

n3wb
Joined
Feb 19, 2016
Messages
5
Reaction score
0
digicamp.dav is set with hiktools to english ,it update complete but when turn the camera on irda stays always turned on,so not normal boot
tftp logs:
016-03-08 16:48:01] TFTP server[192.168.1.128] initialized
[2016-03-08 16:48:08] Device[192.168.1.64] test tftpserver
[2016-03-08 16:48:15] Connect client[192.168.1.64] success
[2016-03-08 16:48:15] Start file[D:\tftp Downgrader\digicap.dav] transmitting
[2016-03-08 16:48:49] Completed file[D:\tftp Downgrader\digicap.dav] transmit
[2016-03-08 16:49:12] Device[192.168.1.64] system update completed!
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,930
Reaction score
6,779
Location
Scotland
after upgrade my DS-2CD2032F-I to version 5.3
What was the original version of firmware?
You need to try earlier versions of firmware to try to get a telnet connection so you can replace mtdblock5&6 with the originals.
If not, you may need to use the serial console to be able to do that.
What changes did you make to mtdblock5&6?
 

arveni

n3wb
Joined
Feb 19, 2016
Messages
5
Reaction score
0
camera is chinese and was in english with version 5.2.5,i have tried to telnet but no results,i may need serial console,i have follow the guide for the language change but haven't been carefully on checksum so i think that was the problem of the failure,also i have formated the pc and when recovered the original mdf files on pc they might be corrupted after when i see them with HXD the content is not convenient.so if i take mtdblock 5 & 6 from another camera can i replace them to this one?and how can i transfer them with console after i get connected to camera,im not familiar with commands i sholud use in this case
 
Last edited by a moderator:

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,930
Reaction score
6,779
Location
Scotland
so if i take mtdblock 5 & 6 from another camera can i replace them to this one?
Another forum member has done this successfully.
The serial console requires a USB to TTL serial convertor and a connection inside the camera.
Not easy if you are unfamiliar with this - but there are some posts on the topic.
 

arveni

n3wb
Joined
Feb 19, 2016
Messages
5
Reaction score
0
ok thank you,ill try to connect with serial first and after will try to find the commands to bring me there,i will ask ask if i will have any difficulty .thank you
 
Top