HIKVISION mtd Brick Recovery Guide

I just found this thread today trying to fix a new Annke camera that failed a firmware upgrade. The camera never connected to 192.0.0.128 on TFTP but a packet capture on the network showed some life from the camera on IP 192.168.1.83 looking for 192.168.1.128 so i changed the IP of the PC to 192.168.1.128 and the camera connected to the TFTP-server. Not home free yet, but maybe this info could help someone else, the camera seems to have been manufactured in April 2021 judging by the serial number, maybe the default IP addressing has changed in newer equipment. It would make sense to change it, as 192.0.0.x is in the public ip space.
 
  • Like
Reactions: hung_1301
Hi you
I have 1 bricked IP camera that cannot be found using SADP. How can I re-flash it. The situation happened when I was flashing it and the power went out, after the power came back I couldn't find its ip address
 
I just found this thread today trying to fix a new Annke camera that failed a firmware upgrade. The camera never connected to 192.0.0.128 on TFTP but a packet capture on the network showed some life from the camera on IP 192.168.1.83 looking for 192.168.1.128 so i changed the IP of the PC to 192.168.1.128 and the camera connected to the TFTP-server. Not home free yet, but maybe this info could help someone else, the camera seems to have been manufactured in April 2021 judging by the serial number, maybe the default IP addressing has changed in newer equipment. It would make sense to change it, as 192.0.0.x is in the public ip space.
Hello
I have the same case, my camera is Annke C800 , i had trying to send new firmware and exactly IP server have to be 192.168.1.128 and client appeared IP 192.168.1.69 but i still can't finish upgrade. Camera connecting and tftp shown sending, but never done.
 
Hello
I have the same case, my camera is Annke C800 , i had trying to send new firmware and exactly IP server have to be 192.168.1.128 and client appeared IP 192.168.1.69 but i still can't finish upgrade. Camera connecting and tftp shown sending, but never done.
Apparently the the hikvision tftp tool only supports 32mb most of new firmware is greater than that.
There is a guy on gethub called Scott lamb and he made another tool. I have been try to work how to use it no luck yet
 
Hello guys,

I have DS-2CD1121-I and I would like to install new firmware cause I don't remember the password and the HIK support doesn't want to help as we know.. Problem is that I can't handle with the TFTP.. Could you help me in some matters?

1. Should I connect the camera directly to the computer or can the camera be connected to the wifi router?
2. Should I change the computer IP address in settings of Ethernet or WiFi?
3. Should the computer IP address be changed always to 192.0.0.128 or does it depends on camera settings? Camera IP address in SADP is 192.168.5.XXX, so the main IP is 192.168.5.1

Thanks in advance.
 
What version of firmware does SADP show?
If it's between 5.3.0 and 5.4.4 inclusive it may have a backdoor vulnerability that would allow a password extraction.
 
What version of firmware does SADP show?
If it's between 5.3.0 and 5.4.4 inclusive it may have a backdoor vulnerability that would allow a password extraction.

I figured TFPT out, but I have problem that it shows "resend required" than "completed file... transmit" and it stays like that.. after closing that and checking in SADP, it shows newer firmware version, but it still has previous ip, password, etc. settings.. what to do?

I have just realized that in hikvision download site there are DS-2CD1121-I ver. D and E and there are other firmaweres for them. How to check which version is mine?
 
What version of firmware was on it, and what version did you apply?
You may have closed the backdoor that might have allowed password extraction.

I have still 1 untouched, so you can still help with it if it is possible cause all of 3 were V5.4.5_17114 from the beginning.. is there any possibility to put by tfpt clean firmware which will cause the need of fresh activation of the camera?
 
Last edited:
What is the exact model number, including the (x) suffix, on the camera label?

DS-2CD1121-I there is nothing more..

I have already found out that this model has reset button, but it was hidden under the cover.. the one untouched is okay, these two where I was trying to put new firmware went ok during the reset, but now they are not visible in SADP.. god damn..

It seems that cameras work.. I see the video.. I am just wondering.. what can cause that not ended firmware update?
 
Last edited:
Hey guys tftp program are you using.
I am trying to recover a NVR and it fails with the tftp from the downloads.
Apparently the newer firmware is greater than 32mb payload limit which stops the tftp from finishing.
 
I had trouble setting up Scott's setup.
Was hoping there was something else on the market or Internet that would do the job with a simple setup.
 
In what way?
Maybe the wrong version of Python?
It was a while ago, but for memory i had to setup a linux machine to add the packages, dhcp server, and run script.
Im mainly a windows guy so anything in the linux world is a lot harder for the trial and error approach.

Unless i got the setup wrong and it can be run in windows? it was a while ago.