HIKVISION mtd Brick Recovery Guide

[jeremiegboss]

Hello , how to perform the hack mtd without having access to the camera web page ? telnet?

 

[edmsecurity]

Hi

Does anyone know where I can get a copy of the Hikvision TFTP

Kind Regards

Robert

 

[whoslooking]

look in the downgrader

 

[GooseMan]

Hi all, I came here to solve my bricked DS-2CD2032-1, English but sent from Hong Kong according to Amazon.co.uk. I tried upgrading it to v5.3.0 151016(Released) and it claimed to be successful but went into a reboot cycle that never ended. Having read this and most other threads on the subject there a couple of things that need saying. Use the 5.2.5 Downgrader. It works... If you are in the reboot cycle you don't even need to power off the camera! Start the TFTP Server with your IP address set to 192.0.0.128 and as long as both the PC and camera are plugged into the same switch/hub/crossover cable it will work (Ok, a really intelligent switch might get in the way but it shouldn't). If you use a different firmware from the one in the downgrader archive you will see all sorts of strangeness. SADP reporting IP addresses of 192.168.1.64 with passwords that are not 12345. I since tried reapplying the 5.3 firmware and bricked my camera again and within 2 minutes I had debricked it using the Downgrader...

 

[IL-MAFIOSO]

Hello,

If someone can have a look at this topic :
https://www.ipcamtalk.com/showthread.php/12057-DS-2CD2632F-IS-not-more-working-after-update-v5-4-0-R0?p=108877&viewfull=1#post108877

I really need an help. Thanks in advance

 

[Varn]

gonna throw my hat in here too for a miracle. we have a new [FONT=&amp]ds-2cd2532f-is. sticker says that the firmware that goes with it is [/FONT][FONT=&amp]v5.3.0_150513. purchased from ebay. firmware was updated, and as many here know, it is now bricked. i tried all the firmware and i could find in this forum and from the hikvision website. none would successfully load with tftpserv except [/FONT]IPC_R0_EN_STD_5.3.0_150327. The IR lights would come on and off every 20 seconds, from what i read, this could possibly be a boot loop. cam does not show in sadptool. tried to telnet during and after tftpserv update, but failed. hikvision won't support it for they deemed it a grey market device. the seller does not have a copy of the original firmware.


hoping someone would be able to help with a solution:sad:

 

[whoslooking]

Check out the sticky on my downgrader this will sort you out.

 

[Varn]

Check out the sticky on my downgrader this will sort you out.

Already tried it. it was successful for our camera that is 1 year older. Thank you for that. but it won't work for the newer one. i tried the 1 line and 4 line, still won't work

 

[whoslooking]

You may need to use Hiktools to change the region flag.
It will work on all 5.30 models but may leave you in Chinese, thus needing an mtd hack also.

 

[Varn]

You may need to use Hiktools to change the region flag.
It will work on all 5.30 models but may leave you in Chinese, thus needing an mtd hack also.

yeah, unfortunately, i also tried changing the region flag using hiktools. strange thing is, if i change the region on IPC_R0_EN_STD_5.3.0_150327, tftpserv will not give a success status.

 

[whoslooking]

I would try on another PC, there nothing new in the 5.30 models still leaving the factory.

 

[net78]

Hi found my solution with a collection of some post on a DS-2CD2632F-IS buyed from Amazon and received Chinese version with label V5.3.0:150513 (01/2016):

Uploaded with TFTP digicap.dev v5.30, then the cam was visible on SADP with IP address 192.168.1.64 but in the browser I get the error like Chris85 "firmware mismatch: /home/webLib"
Then downloaded 5.30 downgrader from whoslooking:
https://www.dropbox.com/s/3hy72q4oss...rader.rar?dl=0

But stop, for me not worked directly! Before I have changed the language flag to 1 with the utility hiktools:

Execute "hiktools05r1 lang digicap.dav 1"

Then uploaded this new dicicap.dev file with TFTP, after some minutes with IR led ON the camera was available in the SADP but with IP address 192.0.0.64.
Logged in with the browser (user admin / password 12345) with the version 5.2.5build141201 multilanguage

Regards
Mattia

 

[Joshua Parker Ruehlig]

Hi found my solution with a collection of some post on a DS-2CD2632F-IS buyed from Amazon and received Chinese version with label V5.3.0:150513 (01/2016):

Uploaded with TFTP digicap.dev v5.30, then the cam was visible on SADP with IP address 192.168.1.64 but in the browser I get the error like Chris85 "firmware mismatch: /home/webLib"
Then downloaded 5.30 downgrader from whoslooking:
https://www.dropbox.com/s/3hy72q4oss...rader.rar?dl=0

But stop, for me not worked directly! Before I have changed the language flag to 1 with the utility hiktools:

Execute "hiktools05r1 lang digicap.dav 1"

Then uploaded this new dicicap.dev file with TFTP, after some minutes with IR led ON the camera was available in the SADP but with IP address 192.0.0.64.
Logged in with the browser (user admin / password 12345) with the version 5.2.5build141201 multilanguage

Regards
Mattia

Thank you, this helped me get my DS-2CD2432F-IW working after a failed update.

 

[Joshua Parker Ruehlig]

You may need to use Hiktools to change the region flag.
It will work on all 5.30 models but may leave you in Chinese, thus needing an mtd hack also.

Hi @whoslooking I was able to use hiktools to TFTP the Chinese V5.3.0 onto my DS-2CD2432F-IW, but now I am faced with the page
"firmware language mismatch: /home/webLib"
Is there a way for me to now access the webinterface. It doesn't seem like telnet/SSH/FTP are listening.
Thanks

See the actual issue I'm try to solve by updating to V5.3.0.
https://www.ipcamtalk.com/showthread.php/12573-DS-2CD2432F-IW-PIR-events-on-alertStream

 

[Joshua Parker Ruehlig]

Ok, so I tried the mtd hack, but made a mistake because I got confused watching a youtube video that didn't match exactly the thread on the subject =/.
- I only changed /dev/mtdblock6 from 01 to 02
- and didn't edit anything else to keep the checksum correct

Now I think I'm really screwed. The camera accepts the TFTP downgrade from here, https://www.ipcamtalk.com/showthread.php/4036-Custom-Firmware-Downgrader-5-3-0-Chinese-to-5-2-5-English, when before I needed to use Hiktool to get them to work.
But the camera obviously doesn't work now. And telnet doesn't seem to come up on my unit during boot up, just TFTP.

Is there any way I can repair the mtdblocks without telnet? Maybe a serial cable?
Thanks

 

[Joshua Parker Ruehlig]

Ok, so I've opened up my camera and see the serial connection. Before I buy the necessary USB-serial adapter, and molex cable. Can anyone confirm that I can overwrite /dev/mtdblock6 from a serial cable?
Thanks

 

[Q™]

Ok, so I've opened up my camera and see the serial connection. Before I buy the necessary USB-serial adapter, and molex cable. Can anyone confirm that I can overwrite /dev/mtdblock6 from a serial cable?
Thanks

This is the point where I would ask myself "is this worth the aggravation." Then I'd send the camera to WL or AS as a gift and call LTS or Nelly's purchase a Western Region Hikvision camera and be done with this nonsense.

 

[Joshua Parker Ruehlig]

This is the point where I would ask myself "is this worth the aggravation." Then I'd send the camera to WL or AS as a gift and call LTS or Nelly's purchase a Western Region Hikvision camera and be done with this nonsense.

Lol, I know you are right, but I'm pretty stubborn.
Now that I think I know what I'm doing with the Hex editor I at least wanted to try it =/

 

[Q™]

Lol, I know you are right, but I'm pretty stubborn.
Now that I think I know what I'm doing with the Hex editor I at least wanted to try it =/

When asked why he climbed Mount Everest, George Herbert Mallory replied "Because it's there."

 

[wifi75]

hello to all,
I've to try recovery my DS-2CD2232-I5 with the file on first post, but nothing...
after trasmission new firmware I don't foud my caper by SADP tool.
There is alternative way for revovery my camera?