[MCR] Hikvision packer/unpacker for 5.3.x and newer firmware

[kayl669]

Somebody tried to modify the NVR firmware 76,77 series using this tool? Or HDTVI DVR 78,79 series?

 

[montecrypto]

hikpack updated -- see OP. Version 2.2 fixes a few bugs including R0 packer issue reported by @alastairstevenson

 

[alastairstevenson]

Checked it out, looking good - many thanks for sharing this.

 

[Sg86]

@alastairstevenson Thanks for pointing me here. I have a DS-2CD2442FWD-IW camera and would like to try and enable SSH. Having read your post a few up on this page i see i can unpack 5.4, edit and repack. Though i saw on the first page something about camera specific keys, am i out of luck with my model?

Thanks

----

EDIT: I've repacked 5.4.5 with your idea of flushing iptables, however i can't upgrade firmware via UI i guess without their damn plugin!

Is there a solution to get their plugin for browser working on linux, or an alternative way to flash firmware?

 

[Sg86]

Pay Pal always says like this

Welcome to 2017, @montecrypto 's bitcoin address is in the binary help text

 

[alastairstevenson]

Welcome to 2017, @montecrypto 's bitcoin address is in the binary help text

Yes, he doesn't have the crypto moniker for nothing!

 

[montecrypto]

@alastairstevensonIs there a solution to get their plugin for browser working on linux, or an alternative way to flash firmware?

curl -T digicap.dav http://admin:password@camera.ip/ISAPI/System/updateFirmware
curl -X PUT http://admin:password@camera.ip/ISAPI/System/reboot

 

[Sg86]

@alastairstevenson I added "/sbin/iptables -F" to the end of the initrun.sh with no joy. Did I do it correct as you suggested or miss something?

PORT STATE SERVICE
22/tcp filtered ssh

 

[alastairstevenson]

I added "/sbin/iptables -F" to the end of the initrun.sh with no joy.

I'd have expected that would work OK, it does for me on the R0 5.4.5 firmware.
I did notice that Hikvision have replaced the original iptables with the extended xtables-multi but my understanding is that this is a multi-call binary that should still work with the original iptables command set.
I wonder if they have used something different on the R6 firmware for the DS-2CD2442FWD-IW cameras.
I haven't unpacked that firmware to look, I don't have any of that series of cameras.
But didn't @montecrypto post a modified R6 firmware with SSH enabled and no psh?
Yes, here it is, version 5.4.4 [MCR] R6 EN camera firmware 5.4.4 repack +SSH -PSH
You could check it out and see what he's done!

 

[Sg86]

@alastairstevenson Thanks, tried it and no change though for me. Port 22 is still filtered

@montecrypto To save me some time, is it possible to get these LEDs turned off or is that going to be deep in the drivers? I can donate a little bitcoin if that sways you PM me

 

[montecrypto]

iptables -F will not always help. Newer firmware starts/stops dropbear, not just filters the port. Also, you may need a delay when you try to flush iptables rules from init.sh, because the process that sets those rules may not be completely initialized and you flush the rules before they are set.

To save me some time, is it possible to get these LEDs turned off or is that going to be deep in the drivers?

Which LEDs are you concerned about? IR? There should be an option in the UI. Or just open the camera an unplug them.

 

[Sg86]

Which LEDs are you concerned about? IR? There should be an option in the UI. Or just open the camera an unplug them.

All 3 on my cube I would like off, status, alarm, link I think they are called.

I would have preferred to do it via the firmware before opening up the unit, and I didn't think they would be "plugged" either. I will open it up if you think it's a non starter to do it via code.

Also about the SSH, I used your enabled one for 5.4.4, so shouldn't it work?

 

[montecrypto]

New hikpack 2.3 in the OP. The update adds R1 support and ability to decrypt / encrypt saved configuration backup files. You can enable SSH for some cameras by manually editing config backup.

 

[Tobias Lawiarso]

@montecrypto I have
Model: DS-2CD2325F-IS 4mm C
Firmware: V5.4.23-161020

And it's Chinese, do you know how to connect this to HikVision NVR (problem is language mismatch).

Thanks.

 

[charlesmaldo]

Hi there eveybody been reading for days Hope you can give me some light in this path to conect my amazing camera

I just bought a

Model: DS-2DC2204IW-DE3/W
Firmware: V5.4.20 build 160811

But I havent figured a way to get the language problem fix, please help! Much apreciated

 

[brk]

We published a report covering the hikpack tool on IPVM today. Here is a link for ipcamtalk readers to view it for free if you'd like : Hikvision Firmware Decrypted

 

[alastairstevenson]

@brk In your report, the root hash can be decoded as follows:
ToCOv8qxP13qs:hiklinux

 

[kayl669]

Hello everybody. @montecrypto, thanks for continue developing the tool. I tried to repack the K41 firmware, but the device did not accept it. The tool after repacking adds two files after the cramfs image, and in the original firmware only one new_20.bin. Can you check it?
P.S. Ready to donate more bitcoins

 

[montecrypto]

hikpack 2.5 released

 

[scn101]

Does hikpack allow you to load newer FW in a Chinese 2xx2 (r0) camera that ran 5.2.8 originally from the factory and run 5.4.0 in English (with no NVR language mismatches?) I have a bunch of 5.2.8 cameras that I've hacked the mtd5/6 language flags to English and run 5.2.5 in full English without NVR mismatches. I know if I load 5.3.0 or higher the cameras will revert to Chinese and I'll have HV NVR language mismatches. Does hikpack solve this?

If one wants to repack with modifications (e.g., changing language from Chinese), specify "-L 1" to tell it to convert the image to an English version: