How to hack 5.1.2 firmware on China region cameras to English

Discussion in 'Hikvision' started by networkcameracritic, Mar 25, 2014.

Share This Page

  1. networkcameracritic

    networkcameracritic Getting the hang of it

    Joined:
    Mar 10, 2014
    Messages:
    719
    Likes Received:
    200
    This is not for the faint of heart, so you have been warned.

    The latest firmware, even if you install the English firmware on China region cameras will be all in Chinese with no option to change to English. If you follow the instructions, you can use 5.1.2 all in English including the day of week and all the menus.

    HARD WAY

    1. First, if you are doing this from Windows, pickup a few free tools (putty, 7-zip & HxD)
    2. Login to the camera via the browser
    3. Go to Advanced Configuration -> first category (System) -> last tab -> check Telnet [​IMG]
    4. Use Putty (or your favorite telnet program) to login. Use the browser password (admin/12345)
    5. FTP the Davinci file to your FTP server (you can get free software for this, but I used my NAS at 192.168.0.3) - /bin/ftpput -u username -p password 192.168.0.3 davinci.tar.gz /dav/davinci.tar.gz
    6. Grab the davinci.tar.gz file from your FTP server
    7. Use 7-Zip on Windows (or whatever tool you want to use to unzip, un-tar the file) and first unzip the file, then tar the file to extract the davinci file, almost 10MB.
    8. Open the file with the hex editor (I use HxD)
    9. Search for 8a 30 dd e5 38 a0 9d e5 53 90 c4 e5 14 90 9d e5 [​IMG]
    10. Change string from 38 a0 9d e5 to 01 a0 a0 e3 [​IMG][​IMG]
    11. Save
    12. Tar the file, gzip the tar file (I used 7-Zip) [​IMG][​IMG]
    13. Copy the file to your FTP server
    14. Put the file back in the camera - /bin/ftpget -u username -p password 192.168.0.3 /dav/davinci.tar.gz davinci.tar.gz
    15. reboot (just type reboot in telnet)
    16. Login to the camera and all is in English -

    [​IMG]

    [​IMG]
     

    Attached Files:

    Last edited: Mar 25, 2014
    SJshah, JohnnyBeGood, monty68 and 5 others like this.
  2. bombo

    bombo Young grasshopper

    Joined:
    Mar 11, 2014
    Messages:
    53
    Likes Received:
    2
    Thanks for posting. I am sure this will help many.
     
  3. networkcameracritic

    networkcameracritic Getting the hang of it

    Joined:
    Mar 10, 2014
    Messages:
    719
    Likes Received:
    200
    monty68, n4gry and Mike like this.
  4. Mike

    Mike Staff Member

    Joined:
    Mar 9, 2014
    Messages:
    1,455
    Likes Received:
    559
    Location:
    New York
    Very useful and informative write up. This is going to help a lot of people (including me). Thanks for sharing.
     
  5. dvb

    dvb n3wb

    Joined:
    Mar 28, 2014
    Messages:
    9
    Likes Received:
    1
    Hi,
    Thanks for the tips ! I think that "NFS workaround" isn't fixed in this firmware.
    Do you think the workaround (*) for 5.1 is working on this 5.1.2 ?

    Cheers !


    (*)
    5.1 Version
    search for the following hex string:
    5001DCC09DE54900001A0B005CE14700001A
    and change it to
    5001DCC09DE5000000000B005CE100000000
     
  6. networkcameracritic

    networkcameracritic Getting the hang of it

    Joined:
    Mar 10, 2014
    Messages:
    719
    Likes Received:
    200
    I don't know, did not try it with NFS. I tried it with CIFS, formatted the drive, but then went uninitialized as it did in 5.1.
     
  7. dvb

    dvb n3wb

    Joined:
    Mar 28, 2014
    Messages:
    9
    Likes Received:
    1
    mmm ! Bad news... Hikvision support told me that 5.1 is working in CIFS mode :-(
     
  8. dalepa

    dalepa Administrator

    Joined:
    Mar 9, 2014
    Messages:
    766
    Likes Received:
    175
    Location:
    Houston, Texas
    Has anyone tested this firmware on the DS-2CD2432F-I(W) ? I'm still having some nighttime resets on my 5.1.0


     
  9. madrian

    madrian n3wb

    Joined:
    Mar 11, 2014
    Messages:
    8
    Likes Received:
    9
    Thanks, it is worked on my 2CD3332 2.8mm camera -got back all languages Hungarian/English etc. :)
     
  10. silverbullet

    silverbullet n3wb

    Joined:
    Apr 10, 2014
    Messages:
    8
    Likes Received:
    0
    Work fine on my chinese ds-2cd2032 with 5.1.2 european firmware . Thanks.
     
  11. truviewcameras

    truviewcameras n3wb

    Joined:
    Apr 29, 2014
    Messages:
    1
    Likes Received:
    0
    Has anyone thought about trying something like this on Dahua NVR's? Seems like there has to be something like this that is preventing users from upgrading them with English Firmware.
     
  12. hmjgriffon

    hmjgriffon Known around here

    Joined:
    Mar 30, 2014
    Messages:
    3,324
    Likes Received:
    925
    Location:
    North Florida
    Not to beat a dead horse but my Chinese cam is in town and should be delivered tomorrow, if it for some reason has 5.1.0. on it can I TFTP the 5.1.2. version from the us ftp site ftp://ftp.hikvisionusa.com/ ? From what I understand they are all the same, I just want to make sure.
     
  13. networkcameracritic

    networkcameracritic Getting the hang of it

    Joined:
    Mar 10, 2014
    Messages:
    719
    Likes Received:
    200
  14. hmjgriffon

    hmjgriffon Known around here

    Joined:
    Mar 30, 2014
    Messages:
    3,324
    Likes Received:
    925
    Location:
    North Florida
    Sweet, got my camera, haven't unboxed it yet. :D IMG_20140512_134800.jpg
     
  15. networkcameracritic

    networkcameracritic Getting the hang of it

    Joined:
    Mar 10, 2014
    Messages:
    719
    Likes Received:
    200
  16. hmjgriffon

    hmjgriffon Known around here

    Joined:
    Mar 30, 2014
    Messages:
    3,324
    Likes Received:
    925
    Location:
    North Florida
    The box says 5.1.2._140116, I got it all out and got a piece of cat6 and then started to have a hypoglycemic episode (blood sugar was 66) so right now I'm recovering on the couch while I wait to test myself again, then I'll hook it up. I was just looking at the audio connectors and stuff hanging off the back and I was thinking I bet the stuff for it is on the circuit board and it's just missing the wires to hook it up but who knows. I'll give some more info in a bit.

    So I got it up and it has 5.1.0, what the heck.
    [TABLE="class: deviceinfotable, width: 690"]

    [TD="class: rowheader deviceinfotd, bgcolor: #F8F8F8"]Firmware Version[/TD]
    [TD="class: deviceinfotd"]V5.1.0 build 131202[/TD]

    [TD="class: rowheader deviceinfotd, bgcolor: #F8F8F8"]Encoding Version[/TD]
    [TD="class: deviceinfotd"]V5.0 build 131128[/TD]
    [/TABLE]

    So I used the TFTP server software and successfully uploaded 5.1.2._140116, and now it's sitting there with the IR lights lit up still, I can ping it but no web interface yet, does it take a while? I don't wanna power it off if it's still doing something.

    k nm, I killed the power and it came up in chinese, considered leaving it since chrome translates it fine but went ahead and put the haxed davinci file on it and now it acts like the european firmware with the language dropdown, win.
     
  17. pcmcg

    pcmcg Young grasshopper

    Joined:
    Mar 13, 2014
    Messages:
    67
    Likes Received:
    8
    Did you upload the firmware version from hikvisionusa ftp site, or did you get it from somewhere else?
     
  18. hmjgriffon

    hmjgriffon Known around here

    Joined:
    Mar 30, 2014
    Messages:
    3,324
    Likes Received:
    925
    Location:
    North Florida

    USA site, the way I understand it, which makes sense to me, is to make their lives easier they have one version of the firmware, with all of the different languages in it, that way they only have to maintain one file. On each camera there is 3 bytes of hex in the ROM to identify the camera as Chinese, European and American. When you load the firmware it checks the ROM and presents you the web interface in the correct language for the region, Chinese only gives you Chinese, European gives you a bunch of stuff, I think the US and European is the same. So after you upload the firmware it gives you Chinese, then you upload the davinici file with 3 bytes changed to fake it out and make it think it's American. Network Camera critic has a good walkthrough of how to do it, I used his already modded file but it's easy to do yourself. I shall be getting all of my cams from cctv china unless I find a better deal somewhere else. :D
     
  19. pcmcg

    pcmcg Young grasshopper

    Joined:
    Mar 13, 2014
    Messages:
    67
    Likes Received:
    8
    Ok, great. That makes sense. I only ask cause the other post assumes your camera already had the 5.1.2 firmware, so I wasn't sure if you could upload the hikvisionusa files to a Chinese cam and get it to work. I'll try upgrading one of my 5.1.0 cameras soon.
     
  20. hmjgriffon

    hmjgriffon Known around here

    Joined:
    Mar 30, 2014
    Messages:
    3,324
    Likes Received:
    925
    Location:
    North Florida
    Yeah if it has 5.1.0, just go on the ftp site and grab their TFTP server program, set your comp to 192.0.0.128, put the firmware file in the TFTP program folder and start it, then just boot up the cam. The tool comes with a nice PDF that walks you through it and has pictures and everything. If your cam does like mine the IR light will stay on and instead of rebooting, I waited about 15 minutes to be safe and yanked the power, it booted up and I pulled up the web interface and it was all in Chinese and was version 5.1.2.
     
  21. bellusvita

    bellusvita n3wb

    Joined:
    May 14, 2014
    Messages:
    5
    Likes Received:
    0
    Hello, i cound't found that string"8a 30 dd e5 38 a0 9d e5 53 90 c4 e5 14 90 9d e5" in the file of the latest version(5.1.6)
    it has change to "8a 30 dd e5 38 a0 9d e5",
    Can i
    Change "8a 30 dd e5 38 a0 9d e5" to "8a 30 dd e5 01 a0 9d e5"?
    Please help me, Thanks.
    question.png
     
    Last edited by a moderator: May 14, 2014
  22. hmjgriffon

    hmjgriffon Known around here

    Joined:
    Mar 30, 2014
    Messages:
    3,324
    Likes Received:
    925
    Location:
    North Florida

    Care to share your source for 5.1.6?
     
  23. bellusvita

    bellusvita n3wb

    Joined:
    May 14, 2014
    Messages:
    5
    Likes Received:
    0
    can you hack it? Give me your email, is too slow to upload to the website.
     
  24. hmjgriffon

    hmjgriffon Known around here

    Joined:
    Mar 30, 2014
    Messages:
    3,324
    Likes Received:
    925
    Location:
    North Florida

    Maybe, I'd have to look at it, but I really kind of wanted the source since who knows if the one you got was tampered with lol.
     
  25. bellusvita

    bellusvita n3wb

    Joined:
    May 14, 2014
    Messages:
    5
    Likes Received:
    0
    Here is the link url:http://pan.baidu.com/s/1c0tf7Ra
    U can download it.
    Just try to hack, Please
     
  26. Jacklin

    Jacklin n3wb

    Joined:
    May 21, 2014
    Messages:
    10
    Likes Received:
    0
  27. JeremyFr

    JeremyFr n3wb

    Joined:
    May 22, 2014
    Messages:
    8
    Likes Received:
    2
    I made the change to the string that bellusvita posted and it worked fine on both my cameras, figured what the hell I know how to bring em back from the dead if it didn't work lol. So yes the string bellusvita posted for 5.1.6 does work. Lastly if you want 5.1.6 its up on the European website and works on american cameras as well. I applied to 2 chinese cameras and 4 american with no issues, obviously you'll need to tftp to the chinese cameras.
     
  28. pcmcg

    pcmcg Young grasshopper

    Joined:
    Mar 13, 2014
    Messages:
    67
    Likes Received:
    8
    why can't you use the web interface to upload the new firmware?
     
  29. camillo777

    camillo777 Young grasshopper

    Joined:
    Apr 24, 2014
    Messages:
    31
    Likes Received:
    0
    The camera GUI will not allow an EU firmware on a Chinese camera.
     
  30. digger11

    digger11 Pulling my weight

    Joined:
    Mar 26, 2014
    Messages:
    264
    Likes Received:
    180
    When a new version of the firmware is loaded via TFTP, does it reset the camera to factory defaults? In particular, does the camera come up with the default network settings and admin password?