How to reset password on DS-2CD2123FWD-I IP camera?

[protocold]

Hi, I bought 2 used Hikvision DS-2CD2123FWD-I camera and want to reset the admin password.

I took it apart to look for the reset button but it doesnt have one, I took some internal pictures of it (as attached).

[EDIT] I have now resolved the problem, as described later in the thread:

How to reset password on DS-2CD2123FWD-I IP camera?

ok. the cfg0 section is a jffs2 image. when I mounted that i saw ipc_db and ipc_db_backup similar to what you show earlier. Did you just cut out the cfg0 partition as defined in the mtd list? is it mounted ro or rw ? If rw I wonder if it would be possible to delete those 2 files and still have...

ipcamtalk.com

 

[alastairstevenson]

Does anyone know how I can reset this thing?

That's an unusual model - I'm not sure what series it belongs to.
No obvious reset button on your comprehensive set of images.
And an absence of the usual 4-pin serial console connector.
But I'd guess the 4 through-hole pads at the top right of the 3rd picture provide the serial console.

One way to reset to defaults is to re-flash about the same version of firmware using either the Hikvision tftp updater or via the serial console / bootloader interface.
I'm guessing that the correct firmware for the camera is here - but not with 100% certainty :

DOWNLOAD EU PORTAL

www.hikvisioneurope.com

If so, it's just below the 32MB file size limit of the tftp updater (though there is a workaround for that), which is here :

TFTPServ

Hikvision IP Camera Emergency Firmware Recovery TFTP. Check this thread for info on how to use this tool to un-brick your Hikvision camera.

ipcamtalk.com

Easy enough to try.

Then if you want to try the serial console you'll need a serial TTL to USB convertor, something like a PL2303-TA based device or similar.

 

[protocold]

Let me try the TFTP.

I am very comfortable in soldering the serial and also de-soldering the flash chip to do a dump etc.

If I get serial console to work, how do I perform the reset?

If I get a flash dump, is there a way I can wipe some section of the flash to perform such reset? I can always make changes and then write back to the chip directly.

I would need some pointers for further research.

 

[alastairstevenson]

Let me try the TFTP.

That's the simplest method.
The Hikvision tftp updater is limited to a 32MB filesize.
Scott Lamb created a clone which does not have that limitation :

GitHub - scottlamb/hikvision-tftpd: Unbrick a Hikvision device (NVR or camera) via TFTP

Unbrick a Hikvision device (NVR or camera) via TFTP - scottlamb/hikvision-tftpd

github.com

also de-soldering the flash chip to do a dump etc.

You don't need to do that.
There is a modded 'min-system recovery image' that gives full root access, via which the flash memory can be accessed.
Check out this thread :

Hikvision G1 5.5+ firmware Exploring the Cam & attempting unlock

The G1 runs on ambarella S3L (also used in dahua cams) minishell below will work with U-Boot 3.1.6-279309 (May 11 2017-13:36:13) or earlier https://ipcamtalk.com/threads/unrestricted-root-shell-on-g1-cameras.23213/#post-221134 However will not work with U-Boot 3.1.6-297597 (Aug 30...

ipcamtalk.com

If I get a flash dump, is there a way I can wipe some section of the flash to perform such reset?

The admin password is held in hashed form in a Sqlite database along with all the other configuration elements.
I've not (yet) tried deleting the database and the backup - but I'd expect the firmware to recreate the database with default values if it can't be found.

 

[protocold]

ok i was just working with the soldering iron actually so I managed to just solder the 4 serial wires as well. About to test it.

Now can you also tell me what do i do with that? How can I use the serial to do the reset?

 

[alastairstevenson]

Now can you also tell me what do i do with that? How can I use the serial to do the reset?

OK, so I dug out a DS-2CD2135FWD that I'd bought cheaply on eBay (spares and repairs) that's running the 5.5.51 G1 firmware, so should be similar to yours.

I used the 'update' command in the bootloader to install the modded mImage_g1 recovery system, as in the @rearanger thread I linked to above.
Then mounted the configuration partitions, primary and backup, and renamed the configuration databases.
On restart, the firmware dealt with the missing configuration by recreating the databases and populating them with default values.
And the camera restarted in an 'Inactive' state.

Here is a transcript of the activity.
You should hopefully be able to follow the commands.
Good luck!

How to do a reset to defaults by removing the configuration database and backup.

-----------------------------------------------------------------

U-Boot 3.1.6-371476 (May 11 2018-21:35:18)
boards:378780
Boot From: NAND 2048 RC BCH 6bit
SYS_CONFIG: 0x20070053 POC: 001
Cortex freq: 816000000
ENET freq: 50000000
iDSP freq: 348000000
Dram freq: 840000000
Core freq: 360000000
AHB freq: 180000000
APB freq: 90000000
UART freq: 24000000
SD freq: 50000000
SDXC freq: 50000000
dev_model:DS-2CD2135FWD-I
[Uboot] In release mode!
Hit Ctrl+u to stop autoboot: 2
HKVS #
HKVS #
HKVS #
HKVS #
HKVS #
HKVS #
HKVS #
HKVS #
HKVS #
HKVS #
HKVS #
HKVS #
HKVS #
HKVS #
HKVS #
HKVS #
HKVS #
HKVS #
HKVS #
HKVS # update
'update' is a ambiguous command! Exec the shortest command
init started: BusyBox v1.23.2 (2017-03-17 22:46:40 PDT)
starting pid 26, tty '': '/etc/init.d/rcS'
Starting udev:      [ OK ]
create static device nodes under /dev dir
modprobe: can't change directory to '3.10.104': No such file or directory
iptables v1.4.18: can't initialize iptables table `filter': Table does not exist (do you need to insmod?)
Perhaps iptables or your kernel needs to be upgraded.
------------------------------------------------------------------
[montecrypto] minisystem action suppressed, entering shell instead
[montecrypto] run /etc/app.continue to resume minisystem action
[montecrypto] To mount UBI volumes:
[montecrypto]    ubiattach -m <MTDNUM> -d <DEVNUM> /dev/ubi_ctrl
[montecrypto]    mount -t ubifs /dev/ubi<DEVNUM>_0 /mnt
[montecrypto] APP: ubiattach -m 10 -d 1 /dev/ubi_ctrl; sleep 1; mount -t ubifs /dev/ubi1_0 /mnt
[montecrypto] *** Enjoy! ***
------------------------------------------------------------------
starting pid 254, tty '': '-/bin/sh'
/ #
/ #
/ # mount
rootfs on / type rootfs (rw)
devtmpfs on /dev type devtmpfs (rw,relatime,size=51592k,nr_inodes=12898,mode=755)
proc on /proc type proc (rw,relatime)
sysfs on /sys type sysfs (rw,relatime)
ramfs on /home type ramfs (rw,relatime)
udev on /dev type tmpfs (rw,relatime)
devpts on /dev/pts type devpts (rw,relatime,mode=600)
/ # ls -al /mnt
drwxrwxr-x   19 root     root             0 Oct 21  2017 .
drwxr-xr-x   21 root     root             0 Oct 21  2017 ..
drwxrwxr-x    2 root     root             0 Oct 21  2017 mmc01
drwxrwxr-x    2 root     root             0 Oct 21  2017 mmc02
drwxrwxr-x    2 root     root             0 Oct 21  2017 mmc03
drwxrwxr-x    2 root     root             0 Oct 21  2017 mmc04
drwxrwxr-x    2 root     root             0 Oct 21  2017 mmc05
drwxrwxr-x    2 root     root             0 Oct 21  2017 mmc06
drwxrwxr-x    2 root     root             0 Oct 21  2017 mmc07
drwxrwxr-x    2 root     root             0 Oct 21  2017 mmc08
drwxrwxr-x    2 root     root             0 Oct 21  2017 nfs0
drwxrwxr-x    2 root     root             0 Oct 21  2017 nfs00
drwxrwxr-x    2 root     root             0 Oct 21  2017 nfs01
drwxrwxr-x    2 root     root             0 Oct 21  2017 nfs02
drwxrwxr-x    2 root     root             0 Oct 21  2017 nfs03
drwxrwxr-x    2 root     root             0 Oct 21  2017 nfs04
drwxrwxr-x    2 root     root             0 Oct 21  2017 nfs05
drwxrwxr-x    2 root     root             0 Oct 21  2017 nfs06
drwxrwxr-x    2 root     root             0 Oct 21  2017 nfs07
/ # mkdir /mnt/cfgpri
/ # mkdir /mnt/cfgsec
/ #
/ #
/ #
/ # cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00020000 00020000 "bst"
mtd1: 00100000 00020000 "bld"
mtd2: 000e0000 00020000 "ptb"
mtd3: 00080000 00020000 "env"
mtd4: 00100000 00020000 "sysflg"
mtd5: 00080000 00020000 "param"
mtd6: 00100000 00020000 "dpt"
mtd7: 00a00000 00020000 "rcvy"
mtd8: 00800000 00020000 "krn_pri"
mtd9: 00800000 00020000 "krn_sec"
mtd10: 02200000 00020000 "app_pri"
mtd11: 02200000 00020000 "app_sec"
mtd12: 00600000 00020000 "cfg_pri"
mtd13: 00600000 00020000 "cfg_sec"
mtd14: 00800000 00020000 "dbg"
mtd15: 00800000 00020000 "syslog"
/ #
/ # ubiattach -m 12 -d 3 /dev/ubi_ctrl
UBI device number 3, total 48 LEBs (6094848 bytes, 5.8 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
/ # ubiattach -m 13 -d 4 /dev/ubi_ctrl
UBI device number 4, total 48 LEBs (6094848 bytes, 5.8 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
/ #
/ # mount -t ubifs /dev/ubi3_0 /mnt/cfgpri
/ # mount -t ubifs /dev/ubi4_0 /mnt/cfgsec
/ #
/ #
/ # mount
rootfs on / type rootfs (rw)
devtmpfs on /dev type devtmpfs (rw,relatime,size=51592k,nr_inodes=12898,mode=755)
proc on /proc type proc (rw,relatime)
sysfs on /sys type sysfs (rw,relatime)
ramfs on /home type ramfs (rw,relatime)
udev on /dev type tmpfs (rw,relatime)
devpts on /dev/pts type devpts (rw,relatime,mode=600)
/dev/ubi3_0 on /mnt/cfgpri type ubifs (rw,relatime)
/dev/ubi4_0 on /mnt/cfgsec type ubifs (rw,relatime)
/ #
/ # ls -al /mnt/cfgpri
drwxr-xr-x    2 root     root           360 Mar 27 15:28 .
drwxrwxr-x   21 root     root             0 Mar 27 17:43 ..
-rw-r--r--    1 root     root          4120 Jan  1  1970 ...\
-rw-r--r--    1 root     root        576512 Mar 27 15:28 ipc_db
-rw-r--r--    1 root     root          6656 Dec 11 21:57 netOsd.bin
/ # mv /mnt/cfgpri/ipc_db /mnt/cfgpri/ipc_db_orig
/ #
/ # ls -al /mnt/cfgsec
drwxr-xr-x    2 root     root           408 Mar 27 15:28 .
drwxrwxr-x   21 root     root             0 Mar 27 17:43 ..
--w---x--T    1 root     root           410 Jan  1  1970 DS-2CD2135FWD-I20180706AAWRC33586588.log
-rwxr--r--    1 root     root          1786 Jan  1  1970 db_op_info.log
-rw-r--r--    1 root     root        576512 Mar 27 15:28 ipc_db_backup
/ #
/ # mv /mnt/cfgsec/ipc_db_backup /mnt/cfgpri/ipc_db_backup_orig
/ #
/ #
/ #
/ # reset
The system is going down NOW!
Sent SIGTERM to all processes
Terminated
Requesting system reboot


[etc etc]

 

[protocold]

thanks. I got serial to work and saw the output. Let me read the link you sent earlier in detail to make sure i dont mess up.

Will be in touch with updates.

 

[protocold]

sorry to be a noob, but when you type 'update' in the bootloader, does it fetch some stuff over tftp? Is that mImage_g1 ???

Do i need to rename mImage_g1 to anything? Is there a more detailed instruction?

 

[alastairstevenson]

Yes, you need a tftp server.
And you need to either use the IP addresses defined in the bootloader environment variables or change them to suit.
printenv
to see them.
saveenv
to store any changes.
No need to change the filename, it's hardcoded.

 

[protocold]

just tried... but update is looking for digicap.dav... but the file I download was mImage_g1 ?

HKVS # update
MAC: <I removed this>
eth0 : phy status change : LINK=UP : DUPLEX=FULL : SPEED=100M
TFTP from server 192.168.1.128; our IP address is 192.168.1.64
Download Filename 'digicap.dav'.
Download to address: 0x82000000
Downloading: T
TFTP error: 'File not found' (1)
Not retrying...
error: tftp.
error: update.
HKVS # upf
MAC: <I removed this>
eth0 : phy status change : LINK=UP : DUPLEX=FULL : SPEED=100M
TFTP from server 192.168.1.128; our IP address is 192.168.1.64
Download Filename 'digicap.dav'.
Download to address: 0x82000000
Downloading: T
TFTP error: 'File not found' (1)
Not retrying...
error: tftp.
error: upf.

 

[protocold]

this is what was shown in printenv in bootloader:

HKVS # printenv
bootargs=console=ttyAMA0,115200
bootcmd=loadk;bootm
bootdelay=3
baudrate=115200
netmask=255.255.255.0
bootfile="uImage"
ipaddr=192.168.1.64
serverip=192.168.1.128
stdin=serial
stdout=serial
stderr=serial
verify=n
mdio_intf=rmii
phy_addr=3
ethaddr=<I removed this>
ver=U-Boot 2010.06-403449 (Jun 27 2018 - 14:29:28)

Environment size: 316/65532 bytes
HKVS #

 

[protocold]

# prtHardInfo
Start at 2020-01-18 17:54:26
Serial NO S-2CD2123FWD-I<I removed this>
V5.5.53 build 180713
NetProcess Version: 6.11.2 [12:03:06-Jun 7 2018]
Path: /Camera/Platform/Branches/branches_FSP_network_protocol/FSP_network_protocol_for_e3_suit_wpa_update_V6
Last Changed Rev: 398792
Last Changed Date: 2018-06-06 10:50:54 +0800 (Wed, 06 Jun 2018)

Db Encrypt Version: 131072
Db Major Version: 1184
Db svn info:
Path: /Camera/Platform/Branches/branches_frontend_software_platform/IPC_develop_branch/ipc_baseline/baseline_E3
Last Changed Rev: 411946
Last Changed Date: 2018-07-13 12:15:28 +0800 (Fri, 13 Jul 2018)
hardwareVersion = 0x0
hardWareExtVersion = 0x0
encodeChans = 1
decodeChans = 1
alarmInNums = 0
alarmOutNums = 0
ataCtrlNums = 0
flashChipNums = 0
rms = 0x80
networksNums = 1
language = 1
devType = 0x22c1c
net reboot count = 0
vi_type = 52
hardware type = 0
firmwareCode = 0000000200000100000000010821bc70000000010000000100000002ffffffff050500350012070d00022c1c
Path: /Camera/Platform/Branches/branches_frontend_software_platform/IPC_develop_branch/ipc_baseline/baseline_E3
Last Changed Rev: 411946
Last Changed Date: 2018-07-13 12:15:28 +0800 (Fri, 13 Jul 2018)

 

[protocold]

HKVS # reset
resetting ...


System startup

Uncompress.............Ok


System startup


U-Boot 2010.06-403449 (Jun 27 2018 - 14:29:28)

spi_solve_flash_lock_qe_enable(379): Error: Disable Quad failed! reg: 0x2
SPI Nor: 16MB
DDR: 128MB
[Uboot] In release mode!
Hit Ctrl+u to stop autoboot: 0
MAC: <I removed this>
eth0 : phy status change : LINK=UP : DUPLEX=FULL : SPEED=100M
|RCV UDP pack timeout| TFTP server not found

booting from sys part...
Load kernel to 0x80007fc0 ...
Done!
Succeed!
## Booting kernel from Legacy Image at 80007fc0 ...
Image Name: Linux-3.18.20-e3
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 2893367 Bytes = 2.8 MiB
Load Address: 80008000
Entry Point: 80008000
XIP Kernel Image ... OK
OK

Starting kernel ...

[ 0.000000] Booting Linux on physical CPU 0x0
[ 0.000000] Initializing cgroup subsys cpu
[ 0.000000] Linux version 3.18.20 (root@HIK-RD-CI-Frontend) (gcc version 4.9.4 20150629 (prerelease) (Hisilicon_v500_20150831) ) #2 Wed Jun 27 14:54:46 CST 2018
[ 0.000000] CPU: ARM926EJ-S [41069265] revision 5 (ARMv5TEJ), cr=0005317f
[ 0.000000] CPU: VIVT data cache, VIVT instruction cache
[ 0.000000] Machine model: E3 Board
[ 0.000000] Memory policy: Data cache writeback
[ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 16764
[ 0.000000] Kernel command line: console=ttyAMA0,115200 KRN_PRT=pri mdio_intf=rmii phy_addr=3 mac=<removed> rst_flag=0 bld_rev=403449 trspt_mode=0x0 flash_type=spinor flash_size=16777216 devtype=0x22c1c
[ 0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[ 0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[ 0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[ 0.000000] Memory: 61072K/67584K available (3034K kernel code, 145K rwdata, 872K rodata, 1412K init, 242K bss, 6512K reserved)
[ 0.000000] Virtual kernel memory layout:
[ 0.000000] vector : 0xffff0000 - 0xffff1000 ( 4 kB)
[ 0.000000] fixmap : 0xffc00000 - 0xffe00000 (2048 kB)
[ 0.000000] vmalloc : 0xc4800000 - 0xff000000 ( 936 MB)
[ 0.000000] lowmem : 0xc0000000 - 0xc4300000 ( 67 MB)
[ 0.000000] modules : 0xbf000000 - 0xc0000000 ( 16 MB)
[ 0.000000] .text : 0xc0008000 - 0xc03d8e94 (3908 kB)
[ 0.000000] .init : 0xc03d9000 - 0xc053a000 (1412 kB)
[ 0.000000] .data : 0xc053a000 - 0xc055e760 ( 146 kB)
[ 0.000000] .bss : 0xc055e760 - 0xc059b070 ( 243 kB)
[ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[ 0.000000] NR_IRQS:16 nr_irqs:16 16
[ 0.000000] VIC @fe040000: id 0x00641190, vendor 0x41
[ 0.000028] sched_clock: 32 bits at 3000kHz, resolution 333ns, wraps every 1431655765682ns
[ 0.000691] Console: colour dummy device 80x30
[ 0.000746] Calibrating delay loop... 398.13 BogoMIPS (lpj=1990656)
[ 0.050025] pid_max: default: 32768 minimum: 301
[ 0.050203] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.050229] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.051515] CPU: Testing write buffer coherency: ok
[ 0.052294] Setting up static identity map for 0x802e4640 - 0x802e4698
[ 0.055667] VFP support v0.3: not present
[ 0.056321] pinctrl core: initialized pinctrl subsystem
[ 0.064882] NET: Registered protocol family 16
[ 0.066391] DMA: preallocated 256 KiB pool for atomic coherent allocations
[ 0.080472] Serial: AMBA PL011 UART driver
[ 0.080773] 12100000.uart: ttyAMA0 at MMIO 0x12100000 (irq = 21, base_baud = 0) is a PL011 rev2
[ 0.334041] console [ttyAMA0] enabled
[ 0.347416] ssp-pl022 12120000.spi: ARM PL022 driver, device ID: 0x00800022
[ 0.354517] ssp-pl022 12120000.spi: mapped registers from 0x12120000 to fea20000
[ 0.363475] ssp-pl022 12121000.spi: could not find pctldev for node /soc/pinmux@12040000/spi1_pmux, deferring probe
[ 0.374019] amba 12121000.spi: Driver ssp-pl022 requests probe deferral
[ 0.381440] usbcore: registered new interface driver usbfs
[ 0.387081] usbcore: registered new interface driver hub
[ 0.392579] usbcore: registered new device driver usb
[ 0.398383] himci: mmc host probe
[ 0.570134] himci: mmc host probe
[ 0.740141] himci: mmc host probe
[ 0.910437] eMMC netlink init ok.
[ 0.915439] Switched to clocksource arm,sp804
[ 0.931171] NET: Registered protocol family 2
[ 0.937472] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.944514] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.951001] TCP: Hash tables configured (established 1024 bind 1024)
[ 0.957565] TCP: reno registered
[ 0.960813] UDP hash table entries: 256 (order: 0, 4096 bytes)
[ 0.966749] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[ 0.973432] NET: Registered protocol family 1
[ 2.665423] mmc0 power register success!
[ 2.669525] mmc1 power register success!
[ 2.673449] mmc2 power register success!
[ 2.677414] usb0 power register success!
[ 2.682997] futex hash table entries: 256 (order: -1, 3072 bytes)
[ 2.708780] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 2.715388] jffs2: version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
[ 2.723198] msgmni has been set to 119
[ 2.729552] io scheduler noop registered (default)
[ 2.740857] pinctrl-single 12040000.pinmux: 66 pins at pa fe940000 size 264
[ 2.748468] pinctrl-single 12040800.pinconf: 76 pins at pa fe940800 size 304
[ 2.768258] brd: module loaded
[ 2.773911] hisi-sfc hisi_spi_nor.0: all blocks is unlocked.
[ 2.779708] hisi-sfc hisi_spi_nor.0: w25q128 (16384 Kbytes)
[ 2.795798] Creating 8 MTD partitions on "hi_sfc":
[ 2.800622] 0x000000000000-0x000000060000 : "bld"
[ 2.806941] 0x000000060000-0x000000070000 : "env"
[ 2.812966] 0x000000070000-0x000000080000 : "enc"
[ 2.819196] 0x000000080000-0x000000090000 : "sysflg"
[ 2.825695] 0x000000090000-0x0000000a0000 : "dpt"
[ 2.831783] 0x0000000a0000-0x0000003f0000 : "sys0"
[ 2.838054] 0x0000003f0000-0x000000ed0000 : "app0"
[ 2.844260] 0x000000ed0000-0x000001000000 : "cfg0"
[ 2.851492] libphy: hisi_femac_mii_bus: probed
[ 2.915490] hisi-femac 10050000.ethernet: phy_id=0x001cc816, phy_addr=3, phy_mode=rmii
[ 2.925329] PPP generic driver version 2.4.2
[ 2.930078] PPP BSD Compression module registered
[ 2.934807] PPP Deflate Compression module registered
[ 2.939945] PPP MPPE Compression module registered
[ 2.944766] NET: Registered protocol family 24
[ 2.949334] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[ 2.955917] ehci-platform: EHCI generic platform driver
[ 2.961438] ehci-platform 10120000.ehci: EHCI Host Controller
[ 2.967311] ehci-platform 10120000.ehci: new USB bus registered, assigned bus number 1
[ 2.975723] ehci-platform 10120000.ehci: irq 31, io mem 0x10120000
[ 2.996524] ehci-platform 10120000.ehci: USB 2.0 started, EHCI 1.00

etc etc etc

 

[protocold]

perhaps mine is not G1? google shows nothing..

 

[alastairstevenson]

Path: /Camera/Platform/Branches/branches_frontend_software_platform/IPC_develop_branch/ipc_baseline/baseline_E3

OK, so it's an E3 series camera, not the G1 that I'd supposed it to be.
With different firmware, it looks looks like the way update and upf works is different.

If it really is E3, the firmware is here.
If you try the digicap.dav from the E3 firmware here, the 'update' command should download it and hopefully validate it.

DOWNLOAD EU PORTAL

www.hikvisioneurope.com

But sometimes a manual update doesn't also wipe the configuration, so you'd need to try the Hikvision tftp updater method, which does.
You'd just watch it on the serial console, it does seem to probe for it :

|RCV UDP pack timeout| TFTP server not found

Though the usual IP address combo is 192.0.0.64 camera, 192.0.0.128 PC.
I'd try it with the existing settings first though.

By the way - just as well the upf command didn't do the 'format and update' like it used to a while back instead of the 'update and format' which is safer ...

 

[protocold]

last question before i try.. i saw there are different languages for the firmware.

what if mine is a chinese version? will it take the firmware and create a brick? or will it reject it?

 

[alastairstevenson]

Generally the update program would reject a firmware file that's not valid for the camera.
But there are fewer validation checks when using this lower-level update as opposed to that in the web GUI.
Usually a clue to it being Chinese would be the letters CCCH in the serial number.

 

[protocold]

Ok. I tried to use the 13mb firmware instead of the 21mb as my flash size is only 16mb.

Update took it and wrote it. But SADP still show it is active?

I tried both the same version as well as newer version, SADP recognize new version updated as well, but then the database still remain intact.

 

[alastairstevenson]

Update took it and wrote it. But SADP still show it is active?

OK, so the update program has not wiped the configuration database.
My experience is that whether it does varies with the model series.

SADP recognize new version updated as well

That's positive in that it validates the firmware source.

But I've never seen the Hikvision tftp updater tool not wipe the configuration and reset to defaults.
It sounds like you haven't yet tried that method. Yet.

 

[alastairstevenson]

Just out of interest - in the bootloader, check what commands are available using the 'help' command.