How to reset password on DS-2CD2123FWD-I IP camera?
- Thread starter protocold
- Start date
alastairstevenson
Staff member
The 'update' command in the bootloader is not the Hikvision tftp updater tool.
This is that tool:
TFTPServ
Hikvision IP Camera Emergency Firmware Recovery TFTP. Check this thread for info on how to use this tool to un-brick your Hikvision camera.
Normally the camera probes for it on startup, it responds with a handshake and downloads the digicap.dav and the update process runs.
Your serial console logs do suggest it's probing for it - but not getting a response.
When you run it for the first time, there should be a Windows firewall popup asking if you want to allow inbound access. Click OK.
yeah i got all that.... so yes I ran that tool already.
In fact, I used that tool to update the version to 5.5.80 for SADP to see.
In fact, I used that tool to update the version to 5.5.80 for SADP to see.
alastairstevenson
Staff member
Hmm... well that's surprising and disappointing.
That normally clears the configuration.
alastairstevenson
Staff member
i have now unsoldered the chip to do a proper dump of it for further analysis.
I wonder if i hex edit and wipe cfg0 (the last section of the flash).. what would happen.
I wonder if i hex edit and wipe cfg0 (the last section of the flash).. what would happen.
HKVS # help
erase - erase flash except bootloader area
go - start application at address 'addr'
gpio - set the gpio
help - print command description/usage
loadk - load kernel to DRAM
update - update digicap.dav
updateb - update bootloader
upf - update firmware, format and update (factory use)
bootm - boot application image from memory
mii - MII utility commands
ping - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
reset - Perform RESET of the CPU
saveenv - save environment variables to persistent storage
setenv - set environment variables
alastairstevenson
Staff member
alastairstevenson
Staff member
No useful flash commands there.
I wonder if the update program is in the bootloader - or in a separate recovery partition.
It's usually the latter.
If in the bootloader - then an erase then update would be interesting ...
alastairstevenson
Staff member
No obvious recovery partition in that list.
And it's quite a big bootloader partition.
I was about to say I will be trying this next.
I now have the full dump. let me see what I come with after some binwalk. Do you want to have a look too?
alastairstevenson
Staff member
I'm impressed with how you've just taken off the flash chip and read it.
This camera is a pain - the usual methods not yielding results.
This camera is a pain - the usual methods not yielding results.
alastairstevenson
Staff member
I figured that.
Did you try an in-situ read? Crude though it may be, that can work with SPI chips.
Did you try an in-situ read? Crude though it may be, that can work with SPI chips.
Yup. I did that before i took it off... the read was unreliable as reading 3 times show different dump.
The only reliable way to dump this is to remove it.
alastairstevenson
Staff member
I'm not sure what you mean.
The tftp updater is just part of the firmware update process.
The problem in hand is how to reset to defaults. The camera is working OK if it looks normal in SADP.
alastairstevenson
Staff member
I'll be back later - I'm trying to fix up a Compaq laptop.
Already replaced the CPU - no effect.
Just swapped the motherboard - no effect.
Doesn't leave much apart from the display.
Already replaced the CPU - no effect.
Just swapped the motherboard - no effect.
Doesn't leave much apart from the display.
ok. the cfg0 section is a jffs2 image. when I mounted that i saw ipc_db and ipc_db_backup similar to what you show earlier.