HIKVISION mtd Brick Recovery Guide

[Joshua Parker Ruehlig]

So I'm back trying to fix my Hikvision 2432, got the parts finally...
Got serial access showing U-Boot 1.3.4-121219 > BusyBox v1.19.3 (ash).
I also can assign an IP using ifconfig.
Now I gotta find a way to push/pull files over. Could find a tftp/ftp client. and trying to mount using 'mount -t nfs' is causing the serial connection to hang, maybe I'm doing this wrong?

I see dropbear, and I'm able to try logging in if I flush the firewall with '/sbin/iptables -F'
Does anyone know the password for root? my /etc/passwd file has "root:tcC0v8qxP13qs:" I figure it's some type of default for this operating system. I figured if I have this I can use sftp

Thanks!

 

[alastairstevenson]

This tftp server works pretty well : http://www.jounin.net/tftpd32.html
The telnet or SSH (Dropbear) root password is the same as your web GUI admin password.
But if you have a shell prompt via the serial console presumably you have root access already, a '#' prompt?

 

[Brad_C]

Try mount -t nfs -o nolock and see how you go.i had a sod of a job with the mount hanging due to the Hik nfs being lower version than my server.

 

[alastairstevenson]

'nolock' seems to be a requirement also for NFS mounts on Huisun and Longse/Cantonk cameras.

 

[Joshua Parker Ruehlig]

This tftp server works pretty well : http://www.jounin.net/tftpd32.html
The telnet or SSH (Dropbear) root password is the same as your web GUI admin password.
But if you have a shell prompt via the serial console presumably you have root access already, a '#' prompt?

thanks, I'll try password I had set before.
but I think I'm not in the regular OS since I screwed up my mtd6 block.
see https://www.ipcamtalk.com/showthread.php/3408-HIKVISION-mtd-Brick-Recovery-Guide?p=113522&viewfull=1#post113522

I'm thinking of trying ssh so I can use sftp/scp to send a fixed mtd6 block over

 

[Joshua Parker Ruehlig]

sweet, I'll try nolock tonight. I got a lot of options for recovery so hopefully I can get this thing fixed. this unit even has an sdcard but I couldn't seem to find the block device to mount. I have a feeling the limited OS I'm in doesn't have everything the regular OS has.

 

[alastairstevenson]

this unit even has an sdcard but I couldn't seem to find the block device to mount.

Likely to be (from memory ... but I should really check.)
/dev/mmc01

*edit* Just checked - see here : https://www.ipcamtalk.com/showthread.php/2951-Full-access-to-2732-SD-Card-files?p=40072&viewfull=1#post40072

 

[Joshua Parker Ruehlig]

Likely to be (from memory ... but I should really check.)
/dev/mmc01

yeah I didn't see anything that stuck out like that in /dev and pulling/plugging in the card doesn't produce anything in dmesg. as I said I think I'm in some sort of preboot environment, not sure how the boot process goes for these units but I think me screwing up mtdblock6 stops it part way through.

 

[alastairstevenson]

If you are at a kernel shell (and from what you've described you are), tftp should be available to you, if so
tftp -g -r mtdblock6 tftp_server_IP_address
cat mtdblock6 > /dev/mtdblock6
But you probably knew that.

 

[Joshua Parker Ruehlig]

awesome thanks, gives me another option to try tonight if NFS doesn't work

 

[Joshua Parker Ruehlig]

The 'nolock' option is what I needed. I was able to hack the mtdblock5/6 back to Chinese. Put v5.3.0 Chinese on there.
Now PIR events show on the trigger feed, so camera works how I want it to!

Thanks for the help!

 

[Brad_C]

The 'nolock' option is what I needed.

That needs to be in flashing lights somewhere. Glad you had a win.

 

[ck42]

Got the bright idea I'd upgrade my 2CD2342-WD-I to 5.4.0. Was originally running 5.3.6.
Using the Web interface, I was getting a failed upgrade message. This is over a wireless link, so I decided to take a laptop (after finding out about the hik tftpserver tool) and get a wired connection.
Everything appeared to work correctly based on the tftpserver output. But, like many others that I find when I search, I'm never seeing the 'completed' indicator. No errors. It just never gives me the final completion message.
192.0.0.64 is not PING'able either.

I've tried both the 1-line and 4-line downgrader package. Same exact results. Tried multiple times. Help?

[EDIT] Not sure if this is an actual Chinese version, WR, or USA....(came in a Retail style box). If there's some way I check verify, I'd happily do it.

 

[alastairstevenson]

But, like many others that I find when I search, I'm never seeing the 'completed' indicator.

But the important test is if SADP can see the camera : http://www.hikvision.com/en/tools_82.html and if so what does it show.

192.0.0.64 is not PING'able either.

Not even for 2 or 3 responses a few seconds after power-on, from a PC on 192.0.0.128 ?

 

[ck42]

But the important test is if SADP can see the camera : http://www.hikvision.com/en/tools_82.html and if so what does it show.

interesting. So last night, the SADP tool didn't find anything. Checked it again this morning and the camera shows up.
I can PING it. But, I cannot access its web interface. It 's giving me a "refused to connect" "[FONT=&quot]ERR_CONNECTION_REFUSED" [/FONT]message. What is the reference to port 8000 vs. the HTTP port? (as it shows in the SADP tool).
Shows as version: 4.0.8 build 150325. So looks like it did get loaded with v4.0 then.
So what next? Tried telnet'ing. No-go.

Not even for 2 or 3 responses a few seconds after power-on, from a PC on 192.0.0.128 ?

Haven't tried this yet...but I'm guessing that if the camera is being found with the SADP tool, then this step isn't really required.

 

[alastairstevenson]

What is the reference to port 8000 vs. the HTTP port? (as it shows in the SADP tool).

That's the so-called media port, over which the camera handles it's command and control interface with devices such as an NVR.

Shows as version: 4.0.8 build 150325. So looks like it did get loaded with v4.0 then.

Not quite - this is how the 'recovery mode' shows. It's a basic system with no web or application services - just a bare kernel from a built-in recovery partition.
It's a mode the camera enters when incompatible firmware has been applied.

The 2CD2342-WD-I is based on different hardware than the R0 series that the 'downgrader' works for - it's not compatible.
You need to find compatible firmware - but you'll need to match the region of the camera.
Did the "Was originally running 5.3.6." match what was on the label?

 

[ck42]

Unsure which label you're referring to. Is this a label that it physically on the camera somewhere...or on the box it came in. I don't recall ever upgrading the firmware since I've had the camera...which is only for a couple of months now.
So if 5.3.6 is the firmware that it came with, what do I need to do? Find a copy of this same firmware and use the tftpserv tool to load it?

 

[alastairstevenson]

It was the label on the camera I was referring to.
Usually, when you buy a camera, a difference between the actual firmware version shown on the web GUI and that shown on the label the manufacturer stuck on the camera suggests that the seller has installed a hacked version of firmware, often to make a Chinese region camera masquerade as English with English menus.
In reality that's a good thing - you get a cheap camera that works like a more expensive EN region camera - but the downside is if you update the firmware it reverts to Chinese region and can be rejected by Hikvision NVRs.

 

[ck42]

Ok...so that's good info. But even if this were to be a Chinese camera, shouldn't I be able to pull up the camera's web page now? Or is there another step to recovering?

 

[alastairstevenson]

But even if this were to be a Chinese camera, shouldn't I be able to pull up the camera's web page now? Or is there another step to recovering?

Not when it's running in 'Recovery mode' where there are no web services.

The next step is to find compatible firmware.
Some possible sources for the 2CD2342-WD-I (Listed in the Hikvision model spreadsheet as an R6 model)
http://www.hikvisioneurope.com/portal/index.php?dir=Product Firmware/Front-ends/01--IPC/R6 platform (2X22FWD, 2X42FWD, 2X52)/
Actually - that's all I can find for the particular model. The CN site appears inaccessible just now - it does come and go a bit.