Long-shot help request - Hikvision DS-2CD3335D - G0 series IPC.

[alastairstevenson]

Is this using the regular mtd hack? How do I apply it to the unpacked firmware?

It's not quite so simple - it's a hack to davinci itself, after decrypting it, uncompressing it, doing the hexedit, then compressing and encrypting back again.

Which specific commands do I use to do this?

This is more straightforward, assuming there is something handy such as an NFS share that can be mounted to transfer the files in to the camera.
Then it's a matter of mounting the relevant primary mtdblock and populating the mount points with the files, umounting and then doing the secondary mtdblock using this type of command:
/bin/mount -t yaffs2 /dev/mtdblock8 /dav
/bin/mount -t yaffs2 /dev/mtdblock7 /dav

 

[soulja]

I have 8 cameras 3145f-i here. If i can help with doing something tell me. I would also like to update the firmware.

 

[alastairstevenson]

I have 8 cameras 3145f-i here.

I have to say I'm a bit confused as to exactly which models are G0 and which are G1.
What is the 3145F-I ?
If you have SSH enabled (if not in the web GUI, try the Batch Configuration Tool - Hangzhou Hikvision Digital Technology Co. Ltd.) the commands
prtHardInfo
should provide some info in the development folder path at the bottom
and
dmesg
should have a 'machine XX' reference near the beginning.

 

[soulja]

I have to say I'm a bit confused as to exactly which models are G0 and which are G1.
What is the 3145F-I ?
If you have SSH enabled (if not in the web GUI, try the Batch Configuration Tool - Hangzhou Hikvision Digital Technology Co. Ltd.) the commands
prtHardInfo
should provide some info in the development folder path at the bottom
and
dmesg
should have a 'machine XX' reference near the beginning.

Thank you for the quick reply. I will check this now

 

[soulja]

prtHardInfo:

Working Copy Root Path: /usr/local/jenkins/workspace/Frontend_BaseLine_Publish_B uild/2015-06-13_17-52-49
URL: https://192.0.0.140/Camera/Platform/Branches/branches_frontend_software_pla tform/IPC_develop_branch/ipc_G0_4M
Repository Root: https://192.0.0.140/Camera
Repository UUID: dont know if i should publish this id
Revision: 132940
Node Kind: directory
Schedule: normal
Last Changed Author: liwenwei
Last Changed Rev: 132940
Last Changed Date: 2015-06-13 17:51:13 +0800 (Sat, 13 Jun 2015)


dmesg:
[ 0.000000] Machine: g0

 

[mitnickhun]

Hello guys!

I've a DS-2CD2135 chinese camera with (probably hacked) english fw. This camera is also a G0 series camera like 3335?
Or maybe can I use alastairstevenson's cool debrick tool to have a full English upgradeable device?
Did you find any solution to upgrade these devices?
Thanks for your answer!

 

[alastairstevenson]

The brickfixv2 tool is only for R0 series cameras.
The 'hacked to English' firmware on the DS-2CD3335 camera I had blocked all attempts to change the firmware, so I had to resort to a serial console connection to deal with it.

 

[mitnickhun]

I see, so 2135 is not G0 series. Thanks!
I'll keep my eyes on this topic if you figure out something

 

[alastairstevenson]

I see, so 2135 is not G0 series.

That's not what I said.
There is some confusing fine detail about which series, G0 or G1, a DS-2CDxxx5-yyy camera is.

 

[afddwfadwfadwf]

How did you get G0 to use tftp? I used hikvision tftp server and set the static IP, but when I reboot the camera it doesn't try tftp at all. It just gets address from DHCP and continues on booting

 

[alastairstevenson]

I didn't use tftp - using the serial console I mounted an NFS share to copy files in and out.
The hacked firmware that was on it had no update capabilities.

 

[Jansen Yong]

So now I need to see if the 'hacked to English' tweak to Davinci works on this G0 firmware, and find out if Hikvision have layered a bit more protection on than exists in the R0 5.4.5 firmware.

Hi alastairstevenson,

Can you please elaborate more on how you do the davinci tweak? I have two DS-2CD2035-i (G0) from China running 5.4.0 (hacked-to-English). Successfully upgraded one of them to 5.4.41 (IPC_G0_CN_STD_5.4.41_170710.zip) with everything working and full ssh shell but it is now in Chinese with the famous language mismatch error. I have searched high and low but unable to find any guide or reference on patching davinci. Do you mind elaborate on how you get the cam to "talk in English" by "changing 3 bytes of of 9MB" of the davinci file?
FYI, here are the camera info:

U-Boot 2010.06-151624 (Sep 24 2015 - 00:18:01)

NAND:  128 MiB
Hit Ctrl+u to stop autoboot:  0
HKVS # help
?       - alias for 'help'
base    - print or set address offset
bootss  - boot from snapshot image
cmp     - memory compare
cp      - memory copy
crc32   - checksum calculation
ddr     - ddr training function
format  - format flash except bootloader area
go      - start application at address 'addr'
help    - print command description/usage
loadk   - load kernel to DRAM
loop    - infinite loop on address range
md      - memory display
mii     - MII utility commands
mm      - memory modify (auto-incrementing address)
mtest   - simple RAM read/write test
mw      - memory write (fill)
nm      - memory modify (constant address)
ping    - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
reset   - Perform RESET of the CPU
saveenv - save environment variables to persistent storage
setenv  - set environment variables
update  - update digicap.dav
updateb - update bootloader
upf     - update firmware, format and update (factory use)
version - print monitor version
HKVS #

# prtHardInfo
Start at 2019-05-24 15:59:58
Serial NO :DS-2CD2035-I20160526AACH603632498
V5.4.41 build 170710
NetProcess Version: 1.7.1.179932 [14:53:09-Dec 10 2016]
Db Encrypt Version: 65537
Db Major Version: 1176
Db svn info:
Path: /Camera/Platform/Branches/branches_frontend_software_platform/db_process_for_5.4.20
Last Changed Rev: 233659
Last Changed Date: 2016-11-08 11:13:39 +0800 (Tue, 08 Nov 2016)
hardwareVersion = 0x0
hardWareExtVersion      = 0x0
encodeChans             = 1
decodeChans             = 1
alarmInNums             = 0
alarmOutNums            = 0
ataCtrlNums             = 0
flashChipNums           = 0
ramSize                 = 0x100
networksNums            = 1
language                        = 2
devType                 = 0x2250a
net reboot count        = 0
vi_type                 = 32
Path: /Camera/Platform/Branches/branches_frontend_software_platform/comm_bug_fix/cgi_fix/ipc_repair/ipc_5.4.24_g0
Last Changed Rev: 297913
Last Changed Date: 2017-07-10 21:23:14 +0800 (Mon, 10 Jul 2017)

Thanks in advance,
JY

 

[hieppo]

Actually, looking more closely, the 3345 is listed in section 08 here, alongside the 3335 : 海康威视是全球领先的以视频为核心的物联网解决方案提供商
My usual reflex reaction that what appears to be a 4MP camera (ie the xx4x) is usually not the same series as the 3MP camera (ie xx3x) may not be correct n this case. Maybe others can confirm.
Do you feel inclined to get hold of a serial TTL to USB converter and connector and experiment?
Where are you based?

I have I believe a China camera with firmware marked as WR instead of CN. The camera is a DS-2CD3345-I with FW V5.4.52 build 170527. I am having issue with NAS feature.

The camera firmware upgrade feature has been locked out. I was wondering if I can use the TTL to flash over it to another version that may fix the NAS issue. Is there an English firmware version that will work?

Another side note, I was not able to detect this camera using SADP. Is there some sort of setting needs to be set? Both camera and the PC that is running SADP is on the same network.

 

[alastairstevenson]

I have I believe a China camera with firmware marked as WR instead of CN.

I do believe it would be unusual for 'hacked firmware' to also masquerade the region as well as the language.
Was the camera purchased with a 'do not upgrade' caveat?

I am having issue with NAS feature.

What is the detail of this problem?
It could be something like an SMB/CIFS version incompatibility for example.
Does the NAS support NFS?

I was wondering if I can use the TTL to flash over it to another version that may fix the NAS issue. Is there an English firmware version that will work?

I think that would be a complete shot in the dark. I've not seen recent release notes specifically mention NAS problem fixes.

Another side note, I was not able to detect this camera using SADP. Is there some sort of setting needs to be set? Both camera and the PC that is running SADP is on the same network.

That is a bit odd.
There are no specific settings to allow SADP to operate.
Is the PC running any unusually strict network access protection?

 

[hieppo]

Thanks Alastair. Very quick reply.

I do believe it would be unusual for 'hacked firmware' to also masquerade the region as well as the language.
Was the camera purchased with a 'do not upgrade' caveat?

Unfortunately, I bought this camera used and do not know if there was a caveat. But I do know all the firmware I downloaded from the EU site will not allow to be upgraded. Always return the "The type of upgrade file mismatch" Henc, I think it is locked from upgrading the easy way.

What is the detail of this problem?
It could be something like an SMB/CIFS version incompatibility for example.
Does the NAS support NFS?

I think that would be a complete shot in the dark. I've not seen recent release notes specifically mention NAS problem fixes.

I search this forum and it seems there were 2 or 3 other users with the same model and fimrware having the exact same NAS issue. I tried both NAS with NFS and SMB/CIFS supposedly be supported by Hikvision. Both type is detected and I was able to initialize it ("FORMAT" - what it does is create the folders datadir).
Everything seems to be mounted and the status is "Normal". However, whether I am Continously or Motion Detected video or snap shot will not work. It starts to do something as soon as I click on apply (like create the file hiv00000.mp4 268.4MB then a little later the file is 0MB then recycle back to the 268.4MB file). The file does not get detected in playback or can I play the mp4 from my Linux VLC.
Similar this happens with jpg snap shot too.

That is a bit odd.
There are no specific settings to allow SADP to operate.
Is the PC running any unusually strict network access protection?

Doh! Palm to the face. Just as I posted the original question, I realized my VM was set to NAT and I was on a different SUBNET. Even though the VM had a route to the camera network (I can browse to the web configuration), SADP was only looking at the current network. I can see the camera now.

 

[alastairstevenson]

Yes, I should have thought of that. A VM with a NAT mode network interface does block SADP.

 

[hieppo]

Can someone with DS-2CD3345 version do a quick NAS test and let me know if it works? If so, please let me know the firmware you used/have? I will TTL into the camera and try to flash it.

 

[Mancho4]

I have a DS-2CD3145F-IS camera.
V5.3.8 build 160108

I try to update it and it won't let me The update file type does not match the camera I suppose it is from the G1 family
Will someone help me, the menu is in Chinese, but the big problem is that I try to connect it to the nvr and it tells me language incompatibility

 

[watchful_ip]

I have a DS-2CD3145F-IS camera.
V5.3.8 build 160108

I try to update it and it won't let me The update file type does not match the camera I suppose it is from the G1 family
Will someone help me, the menu is in Chinese, but the big problem is that I try to connect it to the nvr and it tells me language incompatibility

That looks like an IPC_G0 camera. You can download the firmware on the China Hikvision website.

I can't help you with the language problem though.