Hikvision Permanent Region Change

[whoslooking]

I have made this a little bit easier to follow, as some people seemed to struggle with original.

This will allow you to use the English and Multi Language firmware without any hacks and it's Permanent!


First you need MTDUTILS, free open source Linux utilities to read/write to MTD. So easy enough. NetworkCameraCritic cross-compiled them for ARM
and put them here - http://www.wrightwoodsurveillance.com/stuff/mtd.zip

1[SUP]st[/SUP] Make a network shared folder on your PC.
2[SUP]nd[/SUP] Copy the folder (mtdutils-1.5.0-arm-linux-gnueabi) you downloaded into the folder you are sharing on your PC.
3[SUP]rd[/SUP] On your Camera setup NAS Storage to the folder you have shared on your PC (don’t format it)!
4[SUP]th[/SUP] Enable Telnet on your Camera.

Now using Telnet login to your Camera using

Hikvision Logon = Root
Password = 12345

While logon to the Camera we need to mount it.

cd /mnt/nfs00/ mtdutils-1.5.0-arm-linux-gnueabi/sbin

Start with these commands to read flash,
You will find them inside mtdutils-1.5.0-arm-linux-gnueabi/ sbIn folder.

./nanddump -nof mtd5_temp /dev/mtd5
./nanddump -nof mtd6_temp /dev/mtd6

Now Edit Using HxD Hex Editor.
Edit the mtd5 mtd5_temp & mtd6 mtd6_temp files.
Changing the 02 to 01 as in the circles

Then you can't just write MTD, you have to erase it.

./flash_eraseall /dev/mtd5
./flash_eraseall /dev/mtd6

Then you'll need to use nandwrite to write the image you edited back to flash;

./nandwrite -o /dev/mtd5 mtd5_temp
./nandwrite -o /dev/mtd6 mtd6_temp

And finally type
reboot

All done, now the is Camera is Region 1 US/Euro/ML


Thanks to NetworkCameraCritic RIP

For 2cd2xxx Camera's with Versions upto 5.2.3

Caution use at your own risk, always save a copy of your MTD5 & MTD6 files,
Using on a camera with a manufacturer date of 01/2015 or after, may brick your camera.

Make sure your camera has a firmware of or below 5.2.3 and you can see the camera in SADP before even trying.

ENJOY.

 

[alastairstevenson]

That's pretty clear, many thanks.

We should probably add the caveat that caution must be used for cameras that have been manufactured after about January / February 2015. The manufacturing date can be seen associated with the serial number above. That's a better indication than the apparent firmware version.
For newer cameras, Hikvision have modified the detail of the checksum that protects this hardware descriptor segment of mtdblock5 & 6.
It's still a simple 2-byte sum of a byte range - but you may find that the HxD Checksum-16 calculated block of F4 bytes as highlighted above may no longer match the value stored circled above.
In this case do not simply apply HxD's calculation back with a modified language byte. Unless you are willing to risk your camera by just changing the value of the existing checksum by the same amount you changed the language or other byte.

 

[gpower07]

all new cameras came with 5.2.8

 

[yuaa2]

no need to use MTDUTILS, u can just edit /dev/mtdblock5 and /dev/mtdblock6

 

[alastairstevenson]

And getting a copy of the original:
cat /dev/mtdblock5 > temp5
Change whatever bytes you want, then putting back the changed block:
cat temp5 > /dev/mtdblock5
works perfectly well without needing to use mtdutils.

 

[alexander.omiz]

Hi Alastair
In this way, also need to be careful with checksum?

 

[whoslooking]

No they don't, some are being shipped out with 5.2.0 or 5.2.5 and newer with 5.3.0 the supplier may have downgraded the firmware, but we are still not totally sure how they manage to do this.

 

[alastairstevenson]

Yes, Alexander, care is still needed with any changed values including the checksum.
Using 'cat' instead of the mtdutils components is just a simpler way of reading and writing the flash memory. The block device driver handles the nand flash erase / write process.

 

[alexander.omiz]

I have to 2 pieces of hikvision ds-2cd2532f-is bought from the aliexpress,it is labeled with 5.2.8,but run 5.2.0 firmware. I will share the mtd5 and mtd6 files on dropbox

 

[alexander.omiz]

Thank you my friend, after brick 2 cameras, i think i would rather not to do it by myself. Just share the files, and let smart and professional people do it.

Yes, Alexander, care is still needed with any changed values including the checksum.
Using 'cat' instead of the mtdutils components is just a simpler way of reading and writing the flash memory. The block device driver handles the nand flash erase / write process.

 

[whoslooking]

I can confirm that after the mtd hack is done, you can safely upgrade to 5.3.0 and will be again a multi-lingual firmware release. unlike the firmware release notes, you can still downgrade via tftp if you were on a low firmware to start with.
After playing I found no reason to be on 5.3.0 unless you need greater levels of security at camera level.

 

[phillip da]

Does 5.3.0 include the extra detection options, such as face detection etc?

 

[alastairstevenson]

I can confirm that after the mtd hack is done, you can safely upgrade to 5.3.0 and will be again a multi-lingual firmware release. unlike the firmware release notes, you can still downgrade via tftp if you were on a low firmware to start with.
After playing I found no reason to be on 5.3.0 unless you need greater levels of security at camera level.

Useful to know - thanks for sharing!

 

[whoslooking]

Does 5.3.0 include the extra detection options, such as face detection etc?

No there is nothing extra in there, just items removed for greater levels of security or to stop us changing the region that is lol.

 

[AKalm]

Newer cams go brick to ds-2cd-minsystem... serial if you upgrade from 525 or 528 to 530 even without hacking the mtds as well.

You are saying upgrade from 523 or lower to 530 is fine?

Anybody else tried 525 528 to 530?

 

[whoslooking]

Yes, no problem at all with no bricking, installed from 5.1.6 to 5.3.0 all ok,
installed from 5.2.0 again all ok.
Changing region flag cause a brick on region mismatch but using correct region flag caused no issues tftp upgrading or downgrading.

Note: there are 2 version of 5.3.0 2xx0 & 2xx2 make sure you use the correct one 2xx2.

DO NOT USE 5.3.0 ON A Chinese camera with a sticker with a manufacturer date of 01/2015 or newer

 

[AKalm]

And have you tried 5.2.5 or 5.2.8 to 5.3.0? hacked or not hacked?

Yes, no problem at all with no bricking, installed from 5.1.6 to 5.3.0 all ok,
installed from 5.2.0 again all ok.
Changing region flag cause a brick on region mismatch but using correct region flag caused no issues tftp upgrading or downgrading.

Note: there are 2 version of 5.3.0 2xx0 & 2xx2 make sure you use the correct one 2xx2.

 

[whoslooking]

And have you tried 5.2.5 or 5.2.8 to 5.3.0? hacked or not hacked?

No not yet tested above 5.2.3.

 

[whoslooking]

all new cameras came with 5.2.8

Ok Here is 5.28 camera downgraded and working on 5.2.0. it arrived today the manufacture date as you can see is 03/2015.

 

[whoslooking]

Tested ok 5.2.8 camera Bricked! Will not tftp to recover back but shows in SADP.
More work needed to recover the camera.