Hikvision TFTP server tool.

[alastairstevenson]

For the cameras it's as much a matter of having the original firmware available as a fallback.

digicap.dav data thats' on there?

Well, that's been spread around the various flash destinations, after being unwrapped from it's encoded wrapper, split and unencrypted into its components, chopped up a bit and dropped into various places.
And you could imagine that doing the reverse to get it out would be quite hard going.

 

[remy9]

doing the reverse to get it out would be quite hard going

Yeah it's complicated for sure, It's not like the ol xcopy days of bit by bit copying of each sector I suppose.

Speaking of bits, now I'm having a time tryin to get webcomponents to work with firefox 64 bit. Just doesn't as far as I can see..

more pain..

 

[remy9]

One thing I wanted to ask also was, say I put the Chinese firmware on, does that change the language in IVMS4200? Or will it not work in that after?

 

[remy9]

a matter of having the original firmware

Well, I tried the 5.3.1_150424 and 5.3.5_150925 and they didn't change much, except in SADP, it now reports the firmware is 5.3.5_150925, but still no access to web server. All it did when I tried 5.3.5_150925 was it went into a loop of - Resend required - So perhaps this is where the region lock on the device needs to be changed to Chinese?

 

[Enabler]

Can you ping the camera?

If SADP sees it then a port must be open even if nmap said it isn't.

 

[alastairstevenson]

it now reports the firmware is 5.3.5_150925, but still no access to web server.

Just out of interest, and only if the IP address as shown by SADP is on the same segment as the PC it is running on, it would be interesting to see what the very good Windows open-source tool 'ONVIF Device Manager' from sourceforge.net makes of the current state of the camera. Though the ONVIF protocols do need HTTP services.
If ODM sees the camera, there should be lots of useful info.
You need to give ODM valid logon credentials, top left of the window.

 

[remy9]

Can you ping the camera?

Yeah but only when I use the -Pn option in nmap. I think what's happening is, it's opening ports 68 and 5353 to get an address on the network but then closes them again.

 

[remy9]

'ONVIF Device Manager

Ok, I'll have a look..

 

[remy9]

ODM

It says "there was no endpoint listening" also "see inner exception if present" but I don't see any?

 

[remy9]

I see it's trying to get an ipv6 address, now I've pretty much disabled ipv6 everywhere, but I'm wondering if I gave it one, would the web sever be accessible then? or does that not have anything to do with it?

 

[alastairstevenson]

It says "there was no endpoint listening" also "see inner exception if present" but I don't see any?

OK, so it's unresponsive to the ONVIF SOAP broadcasts. Figures I suppose if no web services.

So, just to check something else, you are using SADP V3.x, and the camera is visible and normal looking, for firmware version, model, ports, IP address etc?
Screenshot?

 

[remy9]

SADP V3.x, and the camera is visible and normal looking, for firmware version, model, ports, IP address etc

Yes, all looks normal. I tried everything else with the working cam and it checks out, like I said, the only thing different now after that unsuccessful firmware update, is that, it has some how managed to change what firmware it's reporting, and what DSP it's reporting..

So like you've been saying, if they've hacked the boot loader for multi lang, does this not have to change to Chinese in order to take Chinese lang firmware - what lang was 5.3.5_150925 supposed to be anyways I wonder? I can't find it on any of the Hikvision sites..

 

[alastairstevenson]

if they've hacked the boot loader for multi lang

It's the firmware that gets tweaked to masquerade the camera region to be different from that burned into the 'hardware descriptor' part of the flash during manufacture.
The camera stays the same with it's internal region value. Not for your camera, or the newer designs in manufacturing now, this was the way to make a permanent, non-firmware dependant change: https://www.ipcamtalk.com/showthread.php/3474-Hikvision-5-2-5-amp-5-2-8-Full-English-(INC-DAYS-OF-WEEK)-mtd-Hack
The language flag in the header of the (older) firmware can be altered with tis tool so an upgrade isn't rejected - at that initial level. Subsequent checks may make the upgrade fail: https://www.ipcamtalk.com/showthread.php/2733-Hikvision-FIRMWARE-TOOLS-change-language-extract-files-and-create-own-firmware

 

[remy9]

Not for your camera

Ok, I understand that now. So maybe there's a new TFTP update tool? I tried 5.3.3_150610 too, but no change. Seems like ARP is the only thing it understands.. I can save changes to enable or disable DHCP but that's it about it.

 

[alastairstevenson]

No, this is one of the new versions of camera firmware from 5.3.1 and above for which the really useful (previously for cameras and still for NVRs) Hiktools no longer works.
There are new 'magic numbers' to identify them, this one is HIK20, and a modified encoding for the digicap.dav header and encryption of the contents.

 

[remy9]

'magic numbers'

Yeah I see the mismatch in that number. I opened 5.3.3_150610 and ‘magic number’ is ‘0x484B5753’ Just out of curiosity, it shows it's ML what is the command to change language? tried pressing '2' but say not such command?

it's ok got it!

 

[remy9]

Hiktools no longer works

So that's it then until there's a new Hiktool or I get the firmware that's on the camera?

 

[Enabler]

At the end of the day if you've flashed the camera with 5.3.5 and it's accepted it (which it sounds like it did given the SADP reported fw version changed), and it still doesn't work then I think it is return it to seller time.

 

[remy9]

Well thanks anyway guys, really appreciate the support, I'll keep on looking for updates and will post back.
@alastairstevenson @Enabler

Cheers!

 

[alastairstevenson]

You are welcome - it's always good to share learned experiences, that's what this community is all about.