Hikvision Permanent Region Change

whoslooking

whoslooking

IPCT Contributor
Oct 3, 2014
1,524
548
London
I have made this a little bit easier to follow, as some people seemed to struggle with original.

This will allow you to use the English and Multi Language firmware without any hacks and it's Permanent!


First you need MTDUTILS, free open source Linux utilities to read/write to MTD. So easy enough. NetworkCameraCritic cross-compiled them for ARM
and put them here - http://www.wrightwoodsurveillance.com/stuff/mtd.zip

1[SUP]st[/SUP] Make a network shared folder on your PC.
2[SUP]nd[/SUP] Copy the folder (mtdutils-1.5.0-arm-linux-gnueabi) you downloaded into the folder you are sharing on your PC.
3[SUP]rd[/SUP] On your Camera setup NAS Storage to the folder you have shared on your PC (don’t format it)!
4[SUP]th[/SUP] Enable Telnet on your Camera.

Now using Telnet login to your Camera using

Hikvision Logon = Root
Password = 12345

While logon to the Camera we need to mount it.

cd /mnt/nfs00/ mtdutils-1.5.0-arm-linux-gnueabi/sbin

Start with these commands to read flash,
You will find them inside mtdutils-1.5.0-arm-linux-gnueabi/ sbIn folder.

./nanddump -nof mtd5_temp /dev/mtd5
./nanddump -nof mtd6_temp /dev/mtd6

Now Edit Using HxD Hex Editor.
Edit the mtd5 mtd5_temp & mtd6 mtd6_temp files.
Changing the 02 to 01 as in the circles
attachment.php
attachment.php


Then you can't just write MTD, you have to erase it.

./flash_eraseall /dev/mtd5
./flash_eraseall /dev/mtd6

Then you'll need to use nandwrite to write the image you edited back to flash;

./nandwrite -o /dev/mtd5 mtd5_temp
./nandwrite -o /dev/mtd6 mtd6_temp

And finally type
reboot

All done, now the is Camera is Region 1 US/Euro/ML


Thanks to NetworkCameraCritic RIP

For 2cd2xxx Camera's with Versions upto 5.2.3

Caution use at your own risk, always save a copy of your MTD5 & MTD6 files,
Using on a camera with a manufacturer date of 01/2015 or after, may brick your camera.

Make sure your camera has a firmware of or below 5.2.3 and you can see the camera in SADP before even trying.

ENJOY.
 

Attachments

  • MTD6.jpg
    MTD6.jpg
    181.4 KB · Views: 1,872
  • MTD5.jpg
    MTD5.jpg
    181.3 KB · Views: 1,808
Last edited by a moderator:
  • Like
Reactions: vasycara, metricus, heathloder and 9 others
That's pretty clear, many thanks.

We should probably add the caveat that caution must be used for cameras that have been manufactured after about January / February 2015. The manufacturing date can be seen associated with the serial number above. That's a better indication than the apparent firmware version.
For newer cameras, Hikvision have modified the detail of the checksum that protects this hardware descriptor segment of mtdblock5 & 6.
It's still a simple 2-byte sum of a byte range - but you may find that the HxD Checksum-16 calculated block of F4 bytes as highlighted above may no longer match the value stored circled above.
In this case do not simply apply HxD's calculation back with a modified language byte. Unless you are willing to risk your camera by just changing the value of the existing checksum by the same amount you changed the language or other byte.
 
  • Like
Reactions: vasycara, heathloder, manhbk2 and 4 others
No they don't, some are being shipped out with 5.2.0 or 5.2.5 and newer with 5.3.0 the supplier may have downgraded the firmware, but we are still not totally sure how they manage to do this.
 
Yes, Alexander, care is still needed with any changed values including the checksum.
Using 'cat' instead of the mtdutils components is just a simpler way of reading and writing the flash memory. The block device driver handles the nand flash erase / write process.
 
  • Like
Reactions: whoslooking
I have to 2 pieces of hikvision ds-2cd2532f-is bought from the aliexpress,it is labeled with 5.2.8,but run 5.2.0 firmware. I will share the mtd5 and mtd6 files on dropbox
 
  • Like
Reactions: whoslooking
Thank you my friend, after brick 2 cameras, i think i would rather not to do it by myself. Just share the files, and let smart and professional people do it.
alastairstevenson said:
Yes, Alexander, care is still needed with any changed values including the checksum.
Using 'cat' instead of the mtdutils components is just a simpler way of reading and writing the flash memory. The block device driver handles the nand flash erase / write process.
Click to expand...
 
I can confirm that after the mtd hack is done, you can safely upgrade to 5.3.0 and will be again a multi-lingual firmware release. unlike the firmware release notes, you can still downgrade via tftp if you were on a low firmware to start with.
After playing I found no reason to be on 5.3.0 unless you need greater levels of security at camera level.
 
  • Like
Reactions: vasycara, andyk1, alastairstevenson and 1 other person
I can confirm that after the mtd hack is done, you can safely upgrade to 5.3.0 and will be again a multi-lingual firmware release. unlike the firmware release notes, you can still downgrade via tftp if you were on a low firmware to start with.
After playing I found no reason to be on 5.3.0 unless you need greater levels of security at camera level.
Click to expand...

Useful to know - thanks for sharing!
 
  • Like
Reactions: whoslooking
phillip da said:
Does 5.3.0 include the extra detection options, such as face detection etc?
Click to expand...
No there is nothing extra in there, just items removed for greater levels of security or to stop us changing the region that is lol.
 
Last edited by a moderator:
Newer cams go brick to ds-2cd-minsystem... serial if you upgrade from 525 or 528 to 530 even without hacking the mtds as well.

You are saying upgrade from 523 or lower to 530 is fine?

Anybody else tried 525 528 to 530?
 
Yes, no problem at all with no bricking, installed from 5.1.6 to 5.3.0 all ok,
installed from 5.2.0 again all ok.
Changing region flag cause a brick on region mismatch but using correct region flag caused no issues tftp upgrading or downgrading.

Note: there are 2 version of 5.3.0 2xx0 & 2xx2 make sure you use the correct one 2xx2.

DO NOT USE 5.3.0 ON A Chinese camera with a sticker with a manufacturer date of 01/2015 or newer
 
Last edited by a moderator:
And have you tried 5.2.5 or 5.2.8 to 5.3.0? hacked or not hacked?

whoslooking said:
Yes, no problem at all with no bricking, installed from 5.1.6 to 5.3.0 all ok,
installed from 5.2.0 again all ok.
Changing region flag cause a brick on region mismatch but using correct region flag caused no issues tftp upgrading or downgrading.

Note: there are 2 version of 5.3.0 2xx0 & 2xx2 make sure you use the correct one 2xx2.
Click to expand...
 
gpower07 said:
all new cameras came with 5.2.8
Click to expand...

Ok Here is 5.28 camera downgraded and working on 5.2.0. it arrived today the manufacture date as you can see is 03/2015.
attachment.php
 

Attachments

  • 5.20 03-2015.jpg
    5.20 03-2015.jpg
    107.3 KB · Views: 717
  • Like
Reactions: catseyenu
Tested ok 5.2.8 camera Bricked! Will not tftp to recover back but shows in SADP.
More work needed to recover the camera.
 
You must log in or register to reply here.
Top Bottom