How to reset password on DS-2CD2123FWD-I IP camera?

[protocold]

Hikvision tftp updater tool ?? I thought I ran it? there is this tftpserv.exe thing that ran and when the camera boot up it auto fetch firmware from it and update. Is this the tool that you are talking about?

 

[alastairstevenson]

Hikvision tftp updater tool ?? I thought I ran it?

The 'update' command in the bootloader is not the Hikvision tftp updater tool.
This is that tool:

TFTPServ

Hikvision IP Camera Emergency Firmware Recovery TFTP. Check this thread for info on how to use this tool to un-brick your Hikvision camera.

ipcamtalk.com

Normally the camera probes for it on startup, it responds with a handshake and downloads the digicap.dav and the update process runs.
Your serial console logs do suggest it's probing for it - but not getting a response.
When you run it for the first time, there should be a Windows firewall popup asking if you want to allow inbound access. Click OK.

 

[protocold]

yeah i got all that.... so yes I ran that tool already.

In fact, I used that tool to update the version to 5.5.80 for SADP to see.

 

[protocold]

Your serial console logs do suggest it's probing for it - but not getting a response.

The logs shown was what I saw before I used the tools..

 

[alastairstevenson]

yeah i got all that.... so yes I ran that tool already.

In fact, I used that tool to update the version to 5.5.80 for SADP to see.

Hmm... well that's surprising and disappointing.
That normally clears the configuration.

 

[alastairstevenson]

I wonder if there are any useful commands in the bootloader.
'help' should list them.

 

[protocold]

i have now unsoldered the chip to do a proper dump of it for further analysis.

I wonder if i hex edit and wipe cfg0 (the last section of the flash).. what would happen.

 

[protocold]

I wonder if there are any useful commands in the bootloader.
'help' should list them.

HKVS # help
erase - erase flash except bootloader area
go - start application at address 'addr'
gpio - set the gpio
help - print command description/usage
loadk - load kernel to DRAM
update - update digicap.dav
updateb - update bootloader
upf - update firmware, format and update (factory use)
bootm - boot application image from memory
mii - MII utility commands
ping - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
reset - Perform RESET of the CPU
saveenv - save environment variables to persistent storage
setenv - set environment variables

 

[alastairstevenson]

I wonder if i hex edit and wipe cfg0 (the last section of the flash).. what would happen.

Maybe extract it and post the contents here, it may be in plaintext.

 

[alastairstevenson]

HKVS # help

No useful flash commands there.

erase - erase flash except bootloader area

I wonder if the update program is in the bootloader - or in a separate recovery partition.
It's usually the latter.
If in the bootloader - then an erase then update would be interesting ...

 

[alastairstevenson]

[ 2.795798] Creating 8 MTD partitions on "hi_sfc":
[ 2.800622] 0x000000000000-0x000000060000 : "bld"
[ 2.806941] 0x000000060000-0x000000070000 : "env"
[ 2.812966] 0x000000070000-0x000000080000 : "enc"
[ 2.819196] 0x000000080000-0x000000090000 : "sysflg"
[ 2.825695] 0x000000090000-0x0000000a0000 : "dpt"
[ 2.831783] 0x0000000a0000-0x0000003f0000 : "sys0"
[ 2.838054] 0x0000003f0000-0x000000ed0000 : "app0"
[ 2.844260] 0x000000ed0000-0x000001000000 : "cfg0"

No obvious recovery partition in that list.
And it's quite a big bootloader partition.

 

[protocold]

If in the bootloader - then an erase then update would be interesting ...

I was about to say I will be trying this next.

I now have the full dump. let me see what I come with after some binwalk. Do you want to have a look too?

 

[alastairstevenson]

I'm impressed with how you've just taken off the flash chip and read it.

This camera is a pain - the usual methods not yielding results.

 

[protocold]

i have a hotgun station here and also a spi chip programmer.

 

[alastairstevenson]

I figured that.
Did you try an in-situ read? Crude though it may be, that can work with SPI chips.

 

[protocold]

I figured that.
Did you try an in-situ read? Crude though it may be, that can work with SPI chips.

Yup. I did that before i took it off... the read was unreliable as reading 3 times show different dump.

The only reliable way to dump this is to remove it.

 

[protocold]

hey... this tftp thing is supposed to fix corruption right? if the thing is corrupted then it will work harder????

 

[alastairstevenson]

this tftp thing is supposed to fix corruption right?

I'm not sure what you mean.
The tftp updater is just part of the firmware update process.

The problem in hand is how to reset to defaults. The camera is working OK if it looks normal in SADP.

 

[alastairstevenson]

I'll be back later - I'm trying to fix up a Compaq laptop.
Already replaced the CPU - no effect.
Just swapped the motherboard - no effect.
Doesn't leave much apart from the display.

 

[protocold]

ok. the cfg0 section is a jffs2 image. when I mounted that i saw ipc_db and ipc_db_backup similar to what you show earlier.