Wow! You got there eventually, that's good to see.
Full marks for persistence.
Looking at the logs - the missing piece is that after the brickfix540 tool has been applied via the
tftp updater - it needs to execute once to do it's thing and drop the payload that reverses the 'downgrade block' that Hikvision introduced.
If you don't reboot the camera at that point, and just leave the tftp updater running with the next firmware attempt, it's as if the brickfix tool was never applied.
From the instructions (for the benefit of others) :
See attached files for brickfix540.zip
Of the 2 language variants supplied, it's probably best to try the CN version first.
This should be applied as a normal Hikvision tftp update, and hopefully should show 'upgrade successful'.
It needs to be power-cycled to boot once to make the changes, and then it deactivates, so more than one boot should not be a problem.
There will be no web services, or SADP status, but SSH access should be available.
Left alone after booting, it will reboot into 'min-system' mode (hopefully, it's the newly-installed one that will be running) in about 10 minutes when the watchdog gives up waiting for davinci to initiallise and feed it.
At this point, telnet access to a root shell (pwd=12345) that has tftp is also available if access to existing files or flash is needed
it displayed some things I haven't seen.
Yes, I did wave a small flag, and flush the SSH filter in case SSH access would be useful :
Code:
u_code version = 2016/4/6 3.0
===============================
Hello Hikvision! Enabling rollback ...
Enabled.
ln: /dev/rtc: File exists
=====check_config start=====
Before and after flush :
Code:
Chain INPUT (policy ACCEPT)
target prot opt source destination
DROP tcp -- anywhere anywhere tcp dpt:ssh
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
flushed:
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
What posts would you recommend I read over to fix things up and possibly upgrade the firmware on this camera to newer versions?
Now that you have the web GUI of the 5.2.5 firmware available, I'd recommend that you do the 'enhanced mtd hack'. This will convert the camera to full English and allow full updating to the current 5.4.5 backdoor-fixed firmware.
Check out the instructions in the attachment here :
Hikvision DS-2CD2x32-I (R0) brick-fix tool / full upgrade method / fixup roundup.
It's not that hard to extract a copy of mtdblock6, change the language byte, check/change as needed the devType, recalculate and apply the checksum, and write back.
The only extra is to extract mtdblock1 and look at the values held in locations 0x0C and 0x8000C. If they are 0, change them to 1 and re-write.
Then update firmware via the major versions, 5.2.5 to 5.3.0 to 5.4.0 to 5.4.5
Good luck!
S-2CD3132F-IW20160227CCCH575927658