[MCR] Hikvision packer/unpacker for 5.3.x and newer firmware

Good idea, but fundamentally I can recrypt and upgrade to a start.sh encrypted by hiktools and it'll accept it?

I was expecting it to require encryption with a private key that we dont have, otherwise the kernel will detect its non-authentic.
 
The only code signing used as anti-tamper tripwires are md5 digests of the files held within the 'manifest' file new_10.bin and the cramfs.img in new_20.bin
No private keys, just normal encryption keys.
 
Thanks. So made a minor change to my start.sh (echo "Hello" and /bin/busybox (to list commands)) and repackaged it all. It installed ok, but then is stuck in a bootloop. The error it is giving (over serial) is /home/app/cfg/devCfg.bin failed to open. It retries after 2 seconds then reboots. I can fix it by reinstalling the original upgrade file.

Am I missing a step/file in my upgrade repacking? After flashing the upgrade, it always logs "Erasing devCfg..... done". So why is this not being restored when my modded image reboots?
 
eadrain said:
The error it is giving (over serial) is /home/app/cfg/devCfg.bin failed to open.
Click to expand...
That's odd. It's not something I've seen.
As you say, it should be re-created with default values.
I'm just heading off out - I'll try to look for clues later.
eadrain said:
Am I missing a step/file in my upgrade repacking?
Click to expand...
Is there an updated 'new_20.bin' on the end of digicap.dav ?
 
Yes, and if you decrypt the new_20.bin it contains the corrected md5sum of my repacked cramfs.img. The 69 byte firmware ID is also on the end of the digicap.dav.
Basically seems to match the format of the original.

My steps were:
Modify start.sh (I see in the serial output my mods are working)
Reencrypt start.sh
Modify new_10.bin with the new md5 of the encrypted start.sh
Reencrypt new_10.bin
Recramfs
Modify new_20.bin with the new md5sum of cramfs.img
Reencrypt new_20.bin
hikpack back into a digicap.dav

I see hikpack has options to do with configuration files; have I missed something there.

Thank you for your help :)
 
eadrain said:
I see hikpack has options to do with configuration files; have I missed something there.
Click to expand...
No, that's for decrypting an exported configuration file.
What you've described sounds OK.

Just a dumb thought (I'm away just now, so can't do a search for the origin of the error you quoted) - did you ensure your new start.sh was executable before you encrypted and re-packed ? chmod +x start.sh
Though I don't see a connection with the error, but it would cause a problem.

*edit* And you say the mods are working, so scratch that thought.
 
eadrain said:
So made a minor change to my start.sh (echo "Hello" and /bin/busybox (to list commands)) and repackaged it all. It installed ok, but then is stuck in a bootloop. The error it is giving (over serial) is /home/app/cfg/devCfg.bin failed to open. It retries after 2 seconds then reboots. I can fix it by reinstalling the original upgrade file.
Click to expand...
I'm wondering if this is busybox related - as you mentioned changing busybox in some way.

The device configuration is stored in part of mtdblock1, the relevant section of which is extracted by dd (part of busybox), like so :
dd if=/dev/mtdblock1 of=/home/app/cfg.tgz count=1 bs=64k skip=1
This is then uncompressed to give the 4MB configuration file.
Maybe a problem in that area.
 
Hi Guys

i want to change the logo shown in the DVR. i extracted the digicap.dav and cramfs.
Now i have a lot of .tar.lzma files.
can some one explain how i can use the hikpack tool? Because i am totally new in linux.

Thanks.
 
Can i modify a DVR firmware? or is it just for IPC and NVR?
because i don't know the firmware type. I tried k41
and got this:

test@test-VirtualBox:~$ ./hikpack -t k41 -i 1.dav -o contents
Magic : 484b5753
hdr_crc : 00001d1a (OK)
lang_id : 00000001
date_hex: 20150315
devclass: 00000043
File: cramfs.img, CRC OK
WARN: missing new_20.bin trailer file
Extra tail at the end of dav, 29082624 bytes, maybe firmware id?
 
Last edited:
Gul-Dukat said:
There might be hope.....
Click to expand...
The free and very good Oracle VM VirtualBox Manager works well under both Windows and Linux.
I've used it for ages and found it solid and reliable.
You get a lot of flexibility to run whatever environments you need, if you have a well enough configured PC.
I run Linux as the primary environment, but start up a Windows VM for those things where you have no choice such as SADP etc.
If it comes out of cache, Windows is up in a matter of seconds.
 
Yeah... the crazy thing about the content of my post... is that its not a Virtual Machine.
Windows10 now supports a genuine linux kernel interface to the NT kernel. Watch the video... the developers do a good job explaining it.
 
Hi guys!
Some noob question:

I have DS-2CD2432F-IW and wanna decrypt the configuration file.

hikpack -t r0 -g configurationFile -o zzzzz
Command not supported

What I'm doing wrong?
 
ChrisKelmiBe said:
What I'm doing wrong?
Click to expand...
Nothing. You're using a combination that's not implemented.
It's fair to say that the 'decrypt configuration file' facility in @montecrypto 's hikpack is a work in progress.
When you consider the variety of encoding/encryption schemes used across the various model series and firmware versions, plus the way that the file is keyed to the individual camera, it's a lot of work, and probably more tedious than interesting.
 
  • Like
Reactions: ChrisKelmiBe
Gul-Dukat said:
Can you tell us a little more about it?
Where is it from? What makes you think its encrypted? etc.
Click to expand...
OK, I've got it from my cam. It's DS-2CD2022WD-I. How can I decrypt it. I can't find what type of firmware it is. Could you help me?
 
Last edited:
You must log in or register to reply here.
Top Bottom