Need Firmware for DS-2CD3132F-IW

MrBurritoMan

MrBurritoMan

n3wb
Oct 29, 2017
20
3
Hey everyone,
I messed up and uploaded the wrong firmware to my cameras (DS-2CD3132F-IW) and now can't locate any firmware on HikVision's webpage. I also can't get into their FTP site.

Any ideas?
 
The only link I could find was the Chinese version, will that mess up my English version camera?

Sent from my Pixel XL using Tapatalk
 
Since I have 4 bricked cameras I tried this firmware on one of them:
"07, DS-2CD3XX2 V5.4.41build170707"
http://download.hikvision.com/UploadFile/Soft/IPC/IPC_R0_CN_STD_5.4.41_170707.zip
I get this in the HikVision TFTP server:
upload_2017-10-29_21-53-49.png
The camera reboots, then it remains offline, waiting for ~30 minutes or so.
In order to get any response from it I pull the plug, and when reapplying power it will connect to the TFTP server and redownload its firmware again and repeat the cycle.
 
Just received a response from HikVision USA, they are washing their hands of my problem.

Does anyone have any ideas on what I can try?
 
MrBurritoMan said:
Since I have 4 bricked cameras I tried this firmware on one of them:
"07, DS-2CD3XX2 V5.4.41build170707"
Click to expand...
When firmware of 5.4.0 or higher has been tried, there is a downgrade block which prevents recovery, a Catch-22 scenarion.
"Can't run the updated firmware, can't downgrade to fix the problem."

MrBurritoMan said:
Does anyone have any ideas on what I can try?
Click to expand...
Check out @ex-r-wagon post here, using the brick-fix tool and the enhanced mtd hack on the same camera model : Hikvision DS-2CD2x32-I (R0) brick-fix tool / full upgrade method / fixup roundup.

See if you can digest the attachments here : Hikvision DS-2CD2x32-I (R0) brick-fix tool / full upgrade method / fixup roundup.
My only uncertainty is if the 3132 behave in the same way as a 2132 - it's not a model I have direct experience of.
 
I started the un-brick process and uploaded the first set of firmware to my camera (brickfix540), and now my camera is completely unresponsive. This is the last thing it did and no amount of power cycling has brought it back. NOTE: I waited 30 minutes before pulling the power, the instructions suggested waiting 10 minutes... if I understood that correctly.
upload_2017-10-31_23-47-25.png
 
That's normal - the brick-fix tool simply prepares the camera for the downgrader firmware by removing the downgrade block. It does not provide any services itself.
 
Ah, I just figured out that the camera changed from the old default IP that I was connecting to (192.0.0.64) to a new one (192.168.1.64).

Now to get into the camera....
 
Waited for ~30 minutes, no SSH or Telnet on the camera. Rebooted the camera, another ~30 minute wait, still no SSH (TCP22), or Telnet (TCP23).

Any ideas?
 
MrBurritoMan said:
Any ideas?
Click to expand...
Let's just recap.

You have 4 CN cameras that are bricked, with at least one by upgrading to the 5.4.41 firmware.
That triggers the 'downgrade block' Catch-22 scenario.

So, to recover and do the proper upgrade, the steps are as follows:
Use the Brick-fix tool via the Hikvision tftp updater. This only needs to be done once. It does its work on the first reboot after install, all this does is make the camera able to be downgraded. No services are active, so the camera will not (for the first 10 mins anyway) appear in SADP, no web access, no SSH, no telnet. It appears to be inert.

The camera is now ready to take the '5.3.0 to 5.2.5 downgrader' via the tftp updater. There is a CN and an EN version depending on what language the camera presents as.
The camera will now have a normal web GUI, probably in Chinese.
At this point either the 'classic mtd hack' can be done, to convert to English, or the 'enhanced mtd hack' to convert to English and be fully upgradeable.
 
alastairstevenson said:
[...]
No services are active, so the camera will not (for the first 10 mins anyway) appear in SADP, no web access, no SSH, no telnet. It appears to be inert.

The camera is now ready to take the '5.3.0 to 5.2.5 downgrader' via the tftp updater.
[...]
Click to expand...
With regard to the first sentence above, that is what my camera is currently doing. It has been like this for over 24 hours now. I have tried rebooting it and nothing changes.
How do I get the camera on to the last sentence where I can use the TFTP updater? Are you referring to this software?
upload_2017-11-3_0-8-4.png
 
MrBurritoMan said:
With regard to the first sentence above, that is what my camera is currently doing. It has been like this for over 24 hours now. I have tried rebooting it and nothing changes.
Click to expand...
Yes, as stated, the 'brick-fix tool' simply removed the downgrade block and prepares the camera for being downgraded with firmware that will get it working again. Until you load more firmware, the camera will appear unresponsive as no services are running.
alastairstevenson said:
The camera is now ready to take the '5.3.0 to 5.2.5 downgrader' via the tftp updater. There is a CN and an EN version depending on what language the camera presents as.
Click to expand...
Download the EN and CN versions of the '5.3.0 to 5.2.5 downgrader' firmware from the second link here : Custom Firmware Downgrader 5.3.0 Chinese to 5.2.5 English
Make a copy of the CN version and rename it as digicap.dav and place it in the same folder as the tftp updater program tftpserve.exe
With the PC IP address at 192.0.0.128 start the tftp updater, and power on the camera and check the status.
Hopefully get 'System update completed'.
Reboot the camera and check the status in SADP.
The web GUI should be accessible.
If that does not work - use the EN version of the downgrader firmware, in case your camera has had the classic mtd hack.
 
I performed a packet capture on my switch for one of my cameras while trying your steps above and on reboot (after waiting 3-4 minutes) the camera does not assign itself 192.0.0.64, it instead assigns itself 192.168.1.64. After doing this it will respond to ping and nothing else. I show no attempt from the camera to reach out to 192.168.1.128, or any other address for that matter, on any port.

It looks like I may need to figure out the TTL interface unless there are any other ideas?
 
MrBurritoMan said:
I show no attempt from the camera to reach out to 192.168.1.128, or any other address for that matter, on any port.
Click to expand...
With apologies for the dumb question -
How was this done exactly? Does the switch have that facility?
The first activity of the camera on power up when probing for the tftp updater is a UDP packet directed to (usually) 192.0.0.128, port 9978 if I remember correctly. So it will have required an ARP response for the address it's looking for, usually 192.0.0.128, so an end-point needs to be on that address.
 
alastairstevenson said:
With apologies for the dumb question -
How was this done exactly? Does the switch have that facility?
The first activity of the camera on power up when probing for the tftp updater is a UDP packet directed to (usually) 192.0.0.128, port 9978 if I remember correctly. So it will have required an ARP response for the address it's looking for, usually 192.0.0.128, so an end-point needs to be on that address.
Click to expand...
I have a Cisco Meraki switch that performed a packet capture on the port that the access point was plugged into. With that I was able to see that the access point just shows up as 192.168.1.64, I see no ARP requests, broadcasts, or the UDP traffic you mentioned take place.

Sent from my Pixel XL using Tapatalk
 
You said access point.
Does that mean these are WiFi cameras connected over WiFi?
If so, they need to be wired. WiFi can't be used to do the recovery and updates.
 
alastairstevenson said:
You said access point.
Does that mean these are WiFi cameras connected over WiFi?
If so, they need to be wired. WiFi can't be used to do the recovery and updates.
Click to expand...
Sorry I was at the t-ball game with my kids, my phone heard access point, all of these cameras are wired. The port that I was running the packet capture on only has one camera plugged into it.

Sent from my Pixel XL using Tapatalk
 
I finally had some time to take another run at this today and I can get one of the cameras (that I am testing a recovery process with) to show up in the Batch Configuration tool. I can sign into the camera with the default password but that is about it. I cannot get the camera to take any of the 5.3.0 to 5.2.5 downgrader images.

I receive the error: Upgrading error (when upgrading).

The camera is not reaching out to a TFTP server as all of the articles and how-to articles state it should.
[EDIT]
I just found a 5th camera that was never deployed. It is running the original (hacked) firmware that these ones used to have (on the box: v5.3.0_150513).
Is there any way to extract this firmware so it can be deployed to my other cameras?
[/EDIT]
 
Last edited:
You must log in or register to reply here.
Top Bottom