HIKVISION mtd Brick Recovery Guide

Discussion in 'Hikvision' started by whoslooking, Apr 27, 2015.

Share This Page

  1. alastairstevenson

    alastairstevenson Staff Member

    Joined:
    Oct 28, 2014
    Messages:
    10,884
    Likes Received:
    3,413
    Location:
    Scotland
    In the 'min-system' mode, with the telnet shell (assuming it's not 'psh'), you should be able to use the tftp client in the camera to transfer either the original mtdblock6 or a fixed-up version back in so that you can replace what's in the camera.
    You need a 'normal' tftp server, not the Hikvision-specific tftp update tool.
    One that works OK is this one : TFTPD32 : an opensource IPv6 ready TFTP server/service for windows : TFTP server
    With the required mtdblock6 in the same folder as tftpd32.exe try these commands at the camera telnet shell :

    tftp -g -r my_mtdblock6 tftp_server_IP_address
    cat my_mtdblock6 > /dev/mtdblock6
    reboot

    If you leave the camera for about 10 minutes after applying the brick-fix tool, the camera watchdog will reboot into 'min-system' mode (that's normal) and at that point telnet access should be possible.
     
  2. almemento

    almemento n3wb

    Joined:
    May 15, 2015
    Messages:
    17
    Likes Received:
    6
    Ok, i understand. but i dont have original mtdblock5 / mtdblock6 files. i deleted it by mistake. is not possible to do that without this files? or i need them?
    i dont have 2nd this type camera 2532f-is ;/
     
  3. alastairstevenson

    alastairstevenson Staff Member

    Joined:
    Oct 28, 2014
    Messages:
    10,884
    Likes Received:
    3,413
    Location:
    Scotland
    I don't have any sample mtd5&6 of a 2532, sorry.
    Do you mean the copy that you extracted from the camera? Or do you mean within the camera?
    Can you extract from the camera, fix up whatever incorrect changes that were made, and replace?
     
  4. almemento

    almemento n3wb

    Joined:
    May 15, 2015
    Messages:
    17
    Likes Received:
    6
    yes. copy that I extracted from camera - i deleted it. in camera is now modified mtd5&mtd6

    i can modify whatever incorrect but i dont remember what and where to correct ... i need sample mtd5&mtd6 from someone probably. if its not possible to do that without this files.

    have someone i can attach there mtd5 & mtd6 from 2532f-is? please
     
  5. alastairstevenson

    alastairstevenson Staff Member

    Joined:
    Oct 28, 2014
    Messages:
    10,884
    Likes Received:
    3,413
    Location:
    Scotland
    Attach the files here and I will check them out, tomorrow.
     
  6. almemento

    almemento n3wb

    Joined:
    May 15, 2015
    Messages:
    17
    Likes Received:
    6
  7. alastairstevenson

    alastairstevenson Staff Member

    Joined:
    Oct 28, 2014
    Messages:
    10,884
    Likes Received:
    3,413
    Location:
    Scotland
    OK, attached are your files with the values in the bytes associated with the 'enhanced mtd hack' corrected.
    I have assumed the devType is 0x9814 which would show as a decimal value of 38932 in the result of your prtHardInfo telnet command, which you need to check.
    Good luck!
     

    Attached Files:

  8. almemento

    almemento n3wb

    Joined:
    May 15, 2015
    Messages:
    17
    Likes Received:
    6
    Hi,
    i do this without check devType, i can not prtHardInfo so ... i try. and it worked! English worked! You are the best!
    So:
    1. do brick_tool
    2. cuteftp and tftp32 do mtdblock5 and mtdblock6 from your package upload to /dev/ on camera
    3. telnet ... cat files, etc.
    4. reboot
    5. wait on sadptool for camera in 2CD-Min-System
    6. ping camera, telnet to tftp - use tftp hikvision and 5.30 downgrader pack - digicap.dav
    7. wait for upload
    8. reboot
    9. worked!

    so now: can I upload newest version? ...
     
  9. alastairstevenson

    alastairstevenson Staff Member

    Joined:
    Oct 28, 2014
    Messages:
    10,884
    Likes Received:
    3,413
    Location:
    Scotland
    Yes, I believe so. But do it in stages, don't skip intermediate versions.
    This was the 'enhanced mtd hack'.
     
  10. almemento

    almemento n3wb

    Joined:
    May 15, 2015
    Messages:
    17
    Likes Received:
    6
    Very good! Im now 5.4.5 EN version. i have also my Polish language! that awesome!

    So can i do the same with my 2032F?
    and what about 2035 ? model
     
  11. alastairstevenson

    alastairstevenson Staff Member

    Joined:
    Oct 28, 2014
    Messages:
    10,884
    Likes Received:
    3,413
    Location:
    Scotland
    Excellent!
    You certainly can.
    A different series - different methods ...
     
  12. almemento

    almemento n3wb

    Joined:
    May 15, 2015
    Messages:
    17
    Likes Received:
    6
    can you tell me how to do 2035?
     
  13. alastairstevenson

    alastairstevenson Staff Member

    Joined:
    Oct 28, 2014
    Messages:
    10,884
    Likes Received:
    3,413
    Location:
    Scotland
    Sorry, that's not a model I've had any experience with.
     
  14. cruing

    cruing n3wb

    Joined:
    Oct 4, 2017
    Messages:
    19
    Likes Received:
    1
    Hi all,

    my camera DS-2CD2432F-IW is in "Min-System" mode after I tried to update the firmware.
    I can see it with SADP (192.168.1.64) but I can't change the parameters (IP, tec.), I can't access with telnet and TFTP doesn't recognize the camera.
    I haven't got a copy of the mtd files.
    What can I do to unbrick the camera?
    What is a "power cycle", just power off and than power on the device?

    Thank you very much
     

    Attached Files:

    Last edited: Oct 17, 2017
  15. alastairstevenson

    alastairstevenson Staff Member

    Joined:
    Oct 28, 2014
    Messages:
    10,884
    Likes Received:
    3,413
    Location:
    Scotland
    If the firmware you tried to update it with was 5.4.0 or higher, and it didn't work, there is a 'downgrade block' in place that leaves you with a 'Catch-22' situation.
    If so, the 'brick-fix tool' will deal with that, and allow the use of the '5.3.0 to 5.2.5'downgrader' (try the CN version first) to recover the camera.
    But you will need to set the PC IP address to 192.0.0.128, not the 192.168.1.128 as per your screenshot.

    After recovering the camera, you'll likely have CN menus.
    Consider doing the 'enhanced mtd hack' to convert to EN/ML and make the camera upgradeable.
    Hikvision DS-2CD2x32-I (R0) brick-fix tool / full upgrade method / fixup roundup.
     
    cruing and vasycara like this.
  16. cruing

    cruing n3wb

    Joined:
    Oct 4, 2017
    Messages:
    19
    Likes Received:
    1
    Thank you very much for your reply, but the current address of the camera (in the "Min-System" mode) is 192.168.1.64 and even if the PC IP address is 192.0.0.128 I haven't got Telnet or RFTP access...
    Thanks in advance for any suggestion
     

    Attached Files:

  17. alastairstevenson

    alastairstevenson Staff Member

    Joined:
    Oct 28, 2014
    Messages:
    10,884
    Likes Received:
    3,413
    Location:
    Scotland
    The tftp updater is tested for by the bootloader when the IP address is set for the purpose. It is almost invariably 192.0.0.64 but can be set differently in the bootloader environment variables.
    When min-system mode is entered, the IP address is set to a different unrelated value.

    The tftp updater is not seeing any probes from the camera.
    Common causes:
    Windows firewall inbound rules not allowing the probes to reach the tftp updater. Did you get a popup when it was first run?
    A wired connection, not WiFi, and via a switch not direct.
    Also, the tftp updater can be troublesome with Windows 10.
     
    cruing likes this.
  18. cruing

    cruing n3wb

    Joined:
    Oct 4, 2017
    Messages:
    19
    Likes Received:
    1
    I connected the camera to a PC with Windows XP and now the TFTP recognize the camera! Thanks for the advice!
    Now I have to find the correct Firmware for my Model (DS-2CD2432F-IW) because TFTP doesn't complete the upgrade with the firmware that I tried...
     
  19. alastairstevenson

    alastairstevenson Staff Member

    Joined:
    Oct 28, 2014
    Messages:
    10,884
    Likes Received:
    3,413
    Location:
    Scotland
    What exact firmware did you try?
    Is this a Chinese camera? Does it have CCCH in the serial number?
    If not a Chinese camera, plenty of firmware here : DOWNLOAD PORTAL
     
    cruing likes this.
  20. cruing

    cruing n3wb

    Joined:
    Oct 4, 2017
    Messages:
    19
    Likes Received:
    1
    Yes, it's a CCCH. I tried the 5.30 Downgrader and now it works.... thanks a lot!
     
    Last edited: Oct 19, 2017
    whoslooking likes this.