Need Firmware for DS-2CD3132F-IW

[MrBurritoMan]

Hey everyone,
I messed up and uploaded the wrong firmware to my cameras (DS-2CD3132F-IW) and now can't locate any firmware on HikVision's webpage. I also can't get into their FTP site.

Any ideas?

 

[ex-r-wagon]

Hikvision ASIAN FTP server
Post #7

 

[MrBurritoMan]

The only link I could find was the Chinese version, will that mess up my English version camera?

Sent from my Pixel XL using Tapatalk

 

[MrBurritoMan]

Since I have 4 bricked cameras I tried this firmware on one of them:
"07, DS-2CD3XX2 V5.4.41build170707"
http://download.hikvision.com/UploadFile/Soft/IPC/IPC_R0_CN_STD_5.4.41_170707.zip
I get this in the HikVision TFTP server:

The camera reboots, then it remains offline, waiting for ~30 minutes or so.
In order to get any response from it I pull the plug, and when reapplying power it will connect to the TFTP server and redownload its firmware again and repeat the cycle.

 

[MrBurritoMan]

Just received a response from HikVision USA, they are washing their hands of my problem.

Does anyone have any ideas on what I can try?

 

[alastairstevenson]

Since I have 4 bricked cameras I tried this firmware on one of them:
"07, DS-2CD3XX2 V5.4.41build170707"

When firmware of 5.4.0 or higher has been tried, there is a downgrade block which prevents recovery, a Catch-22 scenarion.
"Can't run the updated firmware, can't downgrade to fix the problem."

Does anyone have any ideas on what I can try?

Check out @ex-r-wagon post here, using the brick-fix tool and the enhanced mtd hack on the same camera model : Hikvision DS-2CD2x32-I (R0) brick-fix tool / full upgrade method / fixup roundup.

See if you can digest the attachments here : Hikvision DS-2CD2x32-I (R0) brick-fix tool / full upgrade method / fixup roundup.
My only uncertainty is if the 3132 behave in the same way as a 2132 - it's not a model I have direct experience of.

 

[MrBurritoMan]

I started the un-brick process and uploaded the first set of firmware to my camera (brickfix540), and now my camera is completely unresponsive. This is the last thing it did and no amount of power cycling has brought it back. NOTE: I waited 30 minutes before pulling the power, the instructions suggested waiting 10 minutes... if I understood that correctly.

 

[alastairstevenson]

That's normal - the brick-fix tool simply prepares the camera for the downgrader firmware by removing the downgrade block. It does not provide any services itself.

 

[MrBurritoMan]

Ah, I just figured out that the camera changed from the old default IP that I was connecting to (192.0.0.64) to a new one (192.168.1.64).

Now to get into the camera....

 

[MrBurritoMan]

Waited for ~30 minutes, no SSH or Telnet on the camera. Rebooted the camera, another ~30 minute wait, still no SSH (TCP22), or Telnet (TCP23).

Any ideas?

 

[alastairstevenson]

Any ideas?

Let's just recap.

You have 4 CN cameras that are bricked, with at least one by upgrading to the 5.4.41 firmware.
That triggers the 'downgrade block' Catch-22 scenario.

So, to recover and do the proper upgrade, the steps are as follows:
Use the Brick-fix tool via the Hikvision tftp updater. This only needs to be done once. It does its work on the first reboot after install, all this does is make the camera able to be downgraded. No services are active, so the camera will not (for the first 10 mins anyway) appear in SADP, no web access, no SSH, no telnet. It appears to be inert.

The camera is now ready to take the '5.3.0 to 5.2.5 downgrader' via the tftp updater. There is a CN and an EN version depending on what language the camera presents as.
The camera will now have a normal web GUI, probably in Chinese.
At this point either the 'classic mtd hack' can be done, to convert to English, or the 'enhanced mtd hack' to convert to English and be fully upgradeable.

 

[MrBurritoMan]

[...]
No services are active, so the camera will not (for the first 10 mins anyway) appear in SADP, no web access, no SSH, no telnet. It appears to be inert.

The camera is now ready to take the '5.3.0 to 5.2.5 downgrader' via the tftp updater.
[...]

With regard to the first sentence above, that is what my camera is currently doing. It has been like this for over 24 hours now. I have tried rebooting it and nothing changes.
How do I get the camera on to the last sentence where I can use the TFTP updater? Are you referring to this software?

 

[alastairstevenson]

With regard to the first sentence above, that is what my camera is currently doing. It has been like this for over 24 hours now. I have tried rebooting it and nothing changes.

Yes, as stated, the 'brick-fix tool' simply removed the downgrade block and prepares the camera for being downgraded with firmware that will get it working again. Until you load more firmware, the camera will appear unresponsive as no services are running.

The camera is now ready to take the '5.3.0 to 5.2.5 downgrader' via the tftp updater. There is a CN and an EN version depending on what language the camera presents as.

Download the EN and CN versions of the '5.3.0 to 5.2.5 downgrader' firmware from the second link here : Custom Firmware Downgrader 5.3.0 Chinese to 5.2.5 English
Make a copy of the CN version and rename it as digicap.dav and place it in the same folder as the tftp updater program tftpserve.exe
With the PC IP address at 192.0.0.128 start the tftp updater, and power on the camera and check the status.
Hopefully get 'System update completed'.
Reboot the camera and check the status in SADP.
The web GUI should be accessible.
If that does not work - use the EN version of the downgrader firmware, in case your camera has had the classic mtd hack.

 

[MrBurritoMan]

I performed a packet capture on my switch for one of my cameras while trying your steps above and on reboot (after waiting 3-4 minutes) the camera does not assign itself 192.0.0.64, it instead assigns itself 192.168.1.64. After doing this it will respond to ping and nothing else. I show no attempt from the camera to reach out to 192.168.1.128, or any other address for that matter, on any port.

It looks like I may need to figure out the TTL interface unless there are any other ideas?

 

[alastairstevenson]

I show no attempt from the camera to reach out to 192.168.1.128, or any other address for that matter, on any port.

With apologies for the dumb question -
How was this done exactly? Does the switch have that facility?
The first activity of the camera on power up when probing for the tftp updater is a UDP packet directed to (usually) 192.0.0.128, port 9978 if I remember correctly. So it will have required an ARP response for the address it's looking for, usually 192.0.0.128, so an end-point needs to be on that address.

 

[MrBurritoMan]

With apologies for the dumb question -
How was this done exactly? Does the switch have that facility?
The first activity of the camera on power up when probing for the tftp updater is a UDP packet directed to (usually) 192.0.0.128, port 9978 if I remember correctly. So it will have required an ARP response for the address it's looking for, usually 192.0.0.128, so an end-point needs to be on that address.

I have a Cisco Meraki switch that performed a packet capture on the port that the access point was plugged into. With that I was able to see that the access point just shows up as 192.168.1.64, I see no ARP requests, broadcasts, or the UDP traffic you mentioned take place.

Sent from my Pixel XL using Tapatalk

 

[alastairstevenson]

You said access point.
Does that mean these are WiFi cameras connected over WiFi?
If so, they need to be wired. WiFi can't be used to do the recovery and updates.

 

[MrBurritoMan]

You said access point.
Does that mean these are WiFi cameras connected over WiFi?
If so, they need to be wired. WiFi can't be used to do the recovery and updates.

Sorry I was at the t-ball game with my kids, my phone heard access point, all of these cameras are wired. The port that I was running the packet capture on only has one camera plugged into it.

Sent from my Pixel XL using Tapatalk

 

[alastairstevenson]

Oh well, that would have been a pretty good explanation for the symptoms.

 

[MrBurritoMan]

I finally had some time to take another run at this today and I can get one of the cameras (that I am testing a recovery process with) to show up in the Batch Configuration tool. I can sign into the camera with the default password but that is about it. I cannot get the camera to take any of the 5.3.0 to 5.2.5 downgrader images.

I receive the error: Upgrading error (when upgrading).

The camera is not reaching out to a TFTP server as all of the articles and how-to articles state it should.
[EDIT]
I just found a 5th camera that was never deployed. It is running the original (hacked) firmware that these ones used to have (on the box: v5.3.0_150513).
Is there any way to extract this firmware so it can be deployed to my other cameras?
[/EDIT]