How to hack 5.1.2 firmware on China region cameras to English

N

networkcameracritic

Getting the hang of it
Mar 10, 2014
717
203
This is not for the faint of heart, so you have been warned.

The latest firmware, even if you install the English firmware on China region cameras will be all in Chinese with no option to change to English. If you follow the instructions, you can use 5.1.2 all in English including the day of week and all the menus.

HARD WAY

  1. First, if you are doing this from Windows, pickup a few free tools (putty, 7-zip & HxD)
  2. Login to the camera via the browser
  3. Go to Advanced Configuration -> first category (System) -> last tab -> check Telnet
    hack1.jpg
  4. Use Putty (or your favorite telnet program) to login. Use the browser password (admin/12345)
  5. FTP the Davinci file to your FTP server (you can get free software for this, but I used my NAS at 192.168.0.3) - /bin/ftpput -u username -p password 192.168.0.3 davinci.tar.gz /dav/davinci.tar.gz
  6. Grab the davinci.tar.gz file from your FTP server
  7. Use 7-Zip on Windows (or whatever tool you want to use to unzip, un-tar the file) and first unzip the file, then tar the file to extract the davinci file, almost 10MB.
  8. Open the file with the hex editor (I use HxD)
  9. Search for 8a 30 dd e5 38 a0 9d e5 53 90 c4 e5 14 90 9d e5
    hack2.jpg
  10. Change string from 38 a0 9d e5 to 01 a0 a0 e3
    hack3.jpg
    hack4.jpg
  11. Save
  12. Tar the file, gzip the tar file (I used 7-Zip)
    hack5.jpg
    hack6.jpg
  13. Copy the file to your FTP server
  14. Put the file back in the camera - /bin/ftpget -u username -p password 192.168.0.3 /dav/davinci.tar.gz davinci.tar.gz
  15. reboot (just type reboot in telnet)
  16. Login to the camera and all is in English -

hack8.jpg


hack7.jpg
 

Attachments

  • hack3.jpg
    hack3.jpg
    320.3 KB · Views: 110
  • hack5.jpg
    hack5.jpg
    61.7 KB · Views: 99
Last edited:
  • Like
Reactions: SJshah, JohnnyBeGood, monty68 and 5 others
Hi,
Thanks for the tips ! I think that "NFS workaround" isn't fixed in this firmware.
Do you think the workaround (*) for 5.1 is working on this 5.1.2 ?

Cheers !


(*)
5.1 Version
search for the following hex string:
5001DCC09DE54900001A0B005CE14700001A
and change it to
5001DCC09DE5000000000B005CE100000000
 
I don't know, did not try it with NFS. I tried it with CIFS, formatted the drive, but then went uninitialized as it did in 5.1.
 
Thanks, it is worked on my 2CD3332 2.8mm camera -got back all languages Hungarian/English etc. :)
 
Has anyone thought about trying something like this on Dahua NVR's? Seems like there has to be something like this that is preventing users from upgrading them with English Firmware.
 
networkcameracritic said:
So what firmware does it have?
Click to expand...

The box says 5.1.2._140116, I got it all out and got a piece of cat6 and then started to have a hypoglycemic episode (blood sugar was 66) so right now I'm recovering on the couch while I wait to test myself again, then I'll hook it up. I was just looking at the audio connectors and stuff hanging off the back and I was thinking I bet the stuff for it is on the circuit board and it's just missing the wires to hook it up but who knows. I'll give some more info in a bit.

So I got it up and it has 5.1.0, what the heck.
[TABLE="class: deviceinfotable, width: 690"]
[TR]
[TD="class: rowheader deviceinfotd, bgcolor: #F8F8F8"]Firmware Version[/TD]
[TD="class: deviceinfotd"]V5.1.0 build 131202[/TD]
[/TR]
[TR]
[TD="class: rowheader deviceinfotd, bgcolor: #F8F8F8"]Encoding Version[/TD]
[TD="class: deviceinfotd"]V5.0 build 131128[/TD]
[/TR]
[/TABLE]

So I used the TFTP server software and successfully uploaded 5.1.2._140116, and now it's sitting there with the IR lights lit up still, I can ping it but no web interface yet, does it take a while? I don't wanna power it off if it's still doing something.

k nm, I killed the power and it came up in chinese, considered leaving it since chrome translates it fine but went ahead and put the haxed davinci file on it and now it acts like the european firmware with the language dropdown, win.
 
Did you upload the firmware version from hikvisionusa ftp site, or did you get it from somewhere else?
 
pcmcg said:
Did you upload the firmware version from hikvisionusa ftp site, or did you get it from somewhere else?
Click to expand...


USA site, the way I understand it, which makes sense to me, is to make their lives easier they have one version of the firmware, with all of the different languages in it, that way they only have to maintain one file. On each camera there is 3 bytes of hex in the ROM to identify the camera as Chinese, European and American. When you load the firmware it checks the ROM and presents you the web interface in the correct language for the region, Chinese only gives you Chinese, European gives you a bunch of stuff, I think the US and European is the same. So after you upload the firmware it gives you Chinese, then you upload the davinici file with 3 bytes changed to fake it out and make it think it's American. Network Camera critic has a good walkthrough of how to do it, I used his already modded file but it's easy to do yourself. I shall be getting all of my cams from cctv china unless I find a better deal somewhere else. :D
 
Ok, great. That makes sense. I only ask cause the other post assumes your camera already had the 5.1.2 firmware, so I wasn't sure if you could upload the hikvisionusa files to a Chinese cam and get it to work. I'll try upgrading one of my 5.1.0 cameras soon.
 
pcmcg said:
Ok, great. That makes sense. I only ask cause the other post assumes your camera already had the 5.1.2 firmware, so I wasn't sure if you could upload the hikvisionusa files to a Chinese cam and get it to work. I'll try upgrading one of my 5.1.0 cameras soon.
Click to expand...

Yeah if it has 5.1.0, just go on the ftp site and grab their TFTP server program, set your comp to 192.0.0.128, put the firmware file in the TFTP program folder and start it, then just boot up the cam. The tool comes with a nice PDF that walks you through it and has pictures and everything. If your cam does like mine the IR light will stay on and instead of rebooting, I waited about 15 minutes to be safe and yanked the power, it booted up and I pulled up the web interface and it was all in Chinese and was version 5.1.2.
 
You must log in or register to reply here.
Top Bottom