HIKVISION mtd Brick Recovery Guide

[alastairstevenson]

ping -t 192.0.0.64,

Excuse the dumb question, but definitely with the '-t' as above?

Some of the newer cameras have a default IP address of 192.168.1.64 instead of 192.0.0.64
It may be worth trying that as well, with your PC set to its usual 192.168.1.x address, just to see if there is any bootup activity by the camera.

 

[enir]

Excuse the dumb question, but definitely with the '-t' as above?

Yes

Some of the newer cameras have a default IP address of 192.168.1.64 instead of 192.0.0.64
It may be worth trying that as well, with your PC set to its usual 192.168.1.x address, just to see if there is any bootup activity by the camera.

In the beginning, IP was 192.0.0.64. I changed it to 192.168.1.64 in SADP.
These are my results with ping

 

[alastairstevenson]

That confirms there is still activity in the bootloader of the camera, 2 or 3 responses is normal.
But the repeat suggests the camera is in a 'boot loop', ie it's re-starting without fully booting.

Now - here is something I'm not sure of, maybe others may comment.
With this newer-manufacture camera, using the new default IP address of 192.168.1.64, does that mean that the tftp updater will be active at the 192.168.1.64 address instead of the original 192.0.0.64 address?
If so - what is the equivalent required IP address of the PC that runs the Hikvision-specific tftp server? Is it 192.168.1.128?
Or does it no longer have an over-the-network (as opposed to the serial console physical connection) tftp updater capability?
Is that why Hikvision have removed the tftp updater program from their websites?
All these questions ...

If you are familiar with network traffic monitoring - you'd be able to see if the camera is 'probing' the PC for the tftp server, it used to be a UDP packet with a Hikvision-specific magic number payload.

 

[enir]

I have some results! I had to wait a little longer in TFTP (IP address of the PC 192.168.1.128). But i see only "Completed file[C:\TFTP\digicap.dav] transmit". It most be "Device[192.168.1.64] system update completed", i think.
P.S. I used 5.2.5 firmware from the firsth post.

 

[jimg]

Hi - have a DS-2CD2632-IS - attempted a US firmware update and bricked it.

I haven't done any MT Hacks - but prior to US firmware update the screens were english.

bricked SN: DS-2CD2632F-IS02015101(blockchar)CCRR548xxxxxx
change 1: DS-2CD2632F-IS012015.101CCRR548xxxxxx (changed block to period)

Ver: V5.3.0_150513 (on sticker, but not on camera - was 5.2xxx)

Downloaded 5.2.5 from this forum & placed in directory with tftp - rebooted camera & camera downloaded firmware.

Didn't get the "device system update completed!" message - waited 10 minutes and manually rebooted camera.

In a few minutes Camera is visible in SADP @ 192.168.1.64 - but software version is reported as V4.0.8build 150401 and HTTP port is N/A. From other posts, I am guessing this is Min-Mode.

Tried 5.30 Downgrader.rar firmware as well. And a china version of 5.3 shared in this post. All bring me back to Min-mode.


-----------------------------------
* I was concerned over the "block character" in the serial number. I unscrewed the lens cover and pressed reset - now the serial number has changed. Noticed that a different character appears in the same location in the SN block on each reboot.

 

[mauros]

Hello,
sorry for my english ... thanks for who will help me,
I have a 2032f-iw V5.3.0_150513 I'm trying to restore the firmware with tftp but the operation ends with "Completed file [C: \ TFTP \ digicap.DAV] transmit" and NEVER with "Device [192.168.1.64] system update completed ".
I tried many firmware posted on the forum also 5.3.0 to 5.2.5 Downgrader for CH that has given me my ebay seller without any results.
From what I've read you may need to stop the tftp immediately after "Completed file [C: \ TFTP \ digicap.DAV] transmit" is not it?
Or you could just be wrong even firmware?
Do you have any idea?
thanks

 

[jimg]

@alastairstevenson any suggestions? Or should I simply box up and return?

 

[alastairstevenson]

In a few minutes Camera is visible in SADP @ 192.168.1.64 - but software version is reported as V4.0.8build 150401 and HTTP port is N/A. From other posts, I am guessing this is Min-Mode.

Yes, that's the 'min-system mode'.
I don't know for sure if that camera shares the same firmware as its fixed-focal variants - but it looks like it should, based on the firmware listings.
What would help is to know why it's going into that mode - probably incompatible firmware, which gets more thoroughly checked on bootup that during a tftp update.
I think you should be able to establish a telnet session while in that state, in which case the command
cat /proc/kmsg
or dmesg
if possible might provide a clue as to cause.
It may be worth trying the CN firmware in section 02 here: http://www1.hikvision.com/cn/download_more_714.html
though I suppose CN menus may be the result.
And there is a good selection of versions listed for that camera here, maybe try one that's not the most recent:
http://www.hikvisioneurope.com/portal/index.php?dir=Product Firmware/Cameras/DS-2CD2xx2/

 

[jimg]

I think you should be able to establish a telnet session while in that state, in which case the command
cat /proc/kmsg if possible might provide a clue as to cause.

No Joy - can ping device but can't telnet (or ssh) - system refused, never get the prompt to enter user /pass.

Will try the CN firmware & report back.

RE: Europe files - given that the camera is a CC.. variant, would those actually work?

 

[alastairstevenson]

No Joy - can ping device but can't telnet (or ssh) - system refused, never get the prompt to enter user /pass.

From what I recall - and it's ages since I did this - the telnet access is only available after the tftp update, and before any subsequent reboot.

 

[jimg]

From what I recall - and it's ages since I did this - the telnet access is only available after the tftp update, and before any subsequent reboot.

No luck - telnet didn't work post TFTP / pre-reboot. putty to 192.168.1.64 would report connection refused.

Interesting enough, the only firmware that would give the TFTP response "Device[192.0.0.64] system update completed! was IPC_R0_EN_STD_5.3.0_150513 - but once I reboot the camera, it disappears - no IP pingable, no SADP (even min-system mode). Tried IPC_R0_CN_STD_5.3.0_150513 - no "completed!" response & results in min-system mode.

 

[alastairstevenson]

No luck - telnet didn't work post TFTP / pre-reboot. putty to 192.168.1.64 would report connection refused.

That's a pity.
As it's the bootloader that's running for the tftp updater - the behaviour will depend on whether Hikvision have changed it over time.
Maybe the telnet facility in the bootloader was too useful and got removed.
Have you tried the @whoslooking 'downgrader' here: https://www.ipcamtalk.com/showthread.php/4036-Custom-Firmware-Downgrader-5-3-0-Chinese-to-5-2-5-English
It may need the language changed with Hiktools 'lang' command: https://www.ipcamtalk.com/showthread.php/2733-Hikvision-FIRMWARE-TOOLS-change-language-extract-files-and-create-own-firmware

 

[jimg]

Have you tried the @whoslooking 'downgrader' here: https://www.ipcamtalk.com/showthread...-5-2-5-English

Yes, tried that one (and retried over IPC_R0_EN_STD_5.3.0_150513) no luck.

Using the EN and CN firmware version 5.3.0_150513 & hiktools, I tried the following combinations (where -> refers to changing language with hiktools):

EN = nothing (no SAPD, no ping)
CN = min system mode
EN -> CN = min system mode
CN -> EN = appears in SADP & accepts new password - but port 80 displays firmware language mismatch: /home/webLib
CN -> EN -> CN = min system mode

The CN -> EN & EN firmware reports "system update completed!" to TFTP - others are blank.

If this is of any help, this is the CN -> EN digicap.dav

Magic number : 0x484B5753
iHeaderCheckSum : 0x0000DE6F [56943]
iHeadTotalLen : 0x0000053C [1340]
iFileNum : 0x0000001D [29]
iLanguage : 0x00000001 [1] EN/ML
iDeviceClass : 0x00000002
iOEMCode : 0x00000001
iFirmwareVer : 0xFFFFFFFF
iFeature: 0x0136ACC7
Calculated CheckSum : 0x0000DE6F [56943]

Not sure what to try next... suggestions welcome.

 

[alastairstevenson]

Frustrating, and presumably time-consuming!
Hard to know what to suggest next when the reason for going into 'min-system mode' isn't clear, with no access to the system log.
It does sound like the camera is CN region internally.

CN -> EN = appears in SADP & accepts new password - but port 80 displays firmware language mismatch: /home/webLib

Other posts with those same symptoms from 5.3.0 have needed to revert to older versions of firmware.
As 5.2.0 was on the label - maybe this is worth a go: Baseline Firmware_IPC_En_V5.2.0 140721 (2XX2) on here http://overseas.hikvision.com/en/download_89_p3.html

 

[jimg]

Yeah - getting frustrating.

As 5.2.0 was on the label..

Actually, label on the camera reads V5.3.0_150513 - which is why I focused on that version.

Tried 5.20, 5.23 & 5.16 - no changes.

Unless anyone has a better idea, I'm packing this one up to go back.

 

[whoslooking]

If the camera is a brown boxed, 5.20 the above firmware is correct just wrong region, use Hiktools to change the region of the firmware from 2 to 1.

- - - Updated - - -

Or use the 5.16 in my signature below will also work.

 

[jimg]

Thanks @whoslooking

I believe this was a brown box unit.

Was unable to locate Baseline Firmware_IPC_En_V5.2.0 140721 (2XX2) - damn Hik site requires password to download and their registration system doesn't seem to be working. Assuming that I need a CN Lang version. I did find on the Europe site Baseline Firmware_IPC_R0 series_En_V5.2.0 140721 but that was already EN & didn't work (min system).

Tried your 5.1.6 untouched (min-system) and CN->EN (also min-system). Do you happen to have a link to the 5.2.0 baseline you suggest?

-------- update -------
got a PM with a link to the baseline 5.2.0 - thanks. Testing now.

 

[jimg]

@whoslooking

5.20 the above firmware [Firmware_IPC_En_V5.2.0 140721 (2XX2)] is correct just wrong region, use Hiktools to change the region of the firmware from 2 to 1.

Sorry for the possibly stupid question, but isn't it already set to 1? hiktools reports it as [1] EN/ML

 

[whoslooking]

Yes if the camera is a brown boxed version IE Chinese change the firmware region to 2.

So the camera will take the en firmware and think it's Chinese.

 

[jimg]

No Joy - Using Firmware_IPC_En_V5.2.0 140721 I set Lang to 2 (CH) - min-system mode.