New RCA HSDB2A 3MP Doorbell IP Camera

IdleWild

n3wb
Joined
May 3, 2024
Messages
11
Reaction score
5
Location
Usa
TLDR: Unbricking via TTL Serial was successful!

I was able to get connected with the TTL Serial adapter, and found that the Config file of the camera is what is causing it not to load. The magic bullet was to interrupt the boot and issue a format command to erase everything but the bootloader, then issue an update command (with sdcard inserted, having RCA firmware renamed to digicap.dav as the only file present). This loaded successfully and the doorbell booted to a blue flashing ring and voice prompt to configure via phone app.

Full details:

The USB TTL Serial adapter arrived this afternoon and I tinkered with it after work. For reference, I purchased this one which uses a Prolific chipset. Win10 picked it up and automatically installed functional drivers.

I'm already familiar with using Putty (years of IT work) but for anyone who's not, there are detailed instructions for setting up the connection on the thread I was referencing earlier about resetting Hikvision devices via TTL Serial.

Because of the packaging of the doorbell, Hik didn't put a JST-ZH connector on the 4-pin TTL Serial header. It does use the 1.5mm pin spacing of the JST-ZH connector, though. Lacking a connector and wanting a reliable connection, I temporarily soldered some 22AWG wires onto the pin pads, with a 3-pin PC fan header on the other end of the wires so I could slide the TTL adapter leads on. Not a clean soldering job at all, just going for quick, functional, and easy to desolder afterward, since I'll need to remove this in order to close up the camera case.



Not to worry, a little heat shrink to keep those wires separated.



I connected ground, TX and RX from the USB TTL adapter to the leads coming from the board.
JST Pin 1 (my black wire) -> TTL Ground (black)
JST Pin 2 (my red wire) -> TTL RX (white)
JST Pin 3 (my orange wire) -> TTL TX (green)
JST Pin 4 -> NO CONNECTION (do not connect the TTL red wire to JST pin 4. The TTL adapter outputs 5V and the camera runs at 3.3V.)



I powered it up, and my Putty window sprang to life with output from the camera. After pressing CTRL+U at the prompt to interrupt the bootloader, I found there is an update command which tries to read digicap.dav from the sdcard. I ran this, and it completed successfully and rebooted. BUT - the camera was still stuck in a boot loop, so I examined closer and found two errors:

[09 22:34:30][CONFIG][ERROR]config_file_to_json error
[09 22:34:30][CONFIG][ERROR]recover_config_file


I looked at the available commands (typing ? or help lists them) and found format - format flash except bootloader area. Sounded promising, so I executed format, followed by another update command to load the firmware from digicap.dav on the sdcard. Success! The doorbell booted to a blue ring and voice prompt.

I am going to further configure it on the RCA firmware I just loaded, flash it over to EzViz firmware, remove the EzViz logo from the video output (via Batch Config), then flash over to my final intended LaView firmware. That will get it to the same state as my other two RCA units. Once everything's done, I'll desolder my wires from the TTL header and close it up.

@davidew98 I am not really an expert on Linux and other embedded OS, but if there are any specific commands you'd like me to try to probe it with before I remove the TTL wires and close it up, let me know. In the Code block below is a listing of the commands available when the bootloader is interrupted (CTRL+U at the prompt).

I've attached the full text output from my Putty session to this post as a PDF file. For science! :)

I hope this helps someone who has a bricked doorbell kicking around and doesn't mind doing a little soldering and buying a $7 USB-TTL adapter to get it running again.

Code:
U-Boot 2010.06-svn-43155 (Oct 30 2018 - 10:01:33)
Find sd card.
DM9051-MAC
Hit Ctrl+u to stop autoboot:  0
HKVS # ?
?       - alias for 'help'
arc_go  - start application at address 'addr'
base    - print or set address offset
bdinfo  - print Board Info structure
boot    - boot default, i.e., run 'bootcmd'
bootd   - boot default, i.e., run 'bootcmd'
bootm   - boot application image from memory
bootp   - boot image via network using BOOTP/TFTP protocol
cmp     - memory compare
coninfo - print console devices and information
cp      - memory copy
crc32   - checksum calculation
dhcp    - boot image via network using DHCP/TFTP protocol
echo    - echo args to console
editenv - edit environment variable
fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls   - list files in a directory (default /)
format  - format flash except bootloader area
go      - go xxx.bin thru network
go_orig - start application at address 'addr'
gos     - go xxx.bin thru serial
help    - print command description/usage
iminfo  - print header information for application image
imxtract- extract a part of a multi-image
loadb   - load binary file over serial line (kermit mode)
loadk   - load kernel to DRAM
loadm   - load mini to DRAM
loads   - load S-Record file over serial line
loadss  - load safe system
loady   - load binary file over serial line (ymodem mode)
loop    - infinite loop on address range
md      - memory display
mm      - memory modify (auto-incrementing address)
mmc     - MMC sub system
mmcinfo - mmcinfo <dev num>-- display MMC info
mtest   - simple RAM read/write test
mw      - memory write (fill)
nfs     - boot image via network using NFS protocol
nm      - memory modify (constant address)
pinctrl - Pin Ctrl
ping    - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
rarpboot- boot image via network using RARP/TFTP protocol
reset   - Perform RESET of the CPU
run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv  - set environment variables
sf      - SPI flash sub-system
sleep   - delay execution for some time
source  - run script from memory
sspi    - SPI utility commands
tftpboot- boot image via network using TFTP protocol
upa     - update app image
uparc   - update arc
update  - update digicap.dav
updateb - update ramboot and uboot
updateu - update uboot
updevinfo- update devinfo
upf     - update firmware, format and update (factory use)
upk     - update uImage
upmcu   - update mcu
upmini  - update minisys
upram   - update ramboot
upres   - update res
version - print monitor version
wdt     - WDT utility commands

My bricked RCA DB is not powering up off the USB TTL adapter. So have no idea how yours powered up. I'll just throw it in a garbage lol Still have a battery coming for my working Hikvision DB, maybe that will work..
 
Last edited:

James92TSi

n3wb
Joined
Apr 20, 2019
Messages
18
Reaction score
19
Location
Houston, TX
My bricked RCA DB is not powering up off the USB TTL adapter. So have no idea how yours powered up. I'll just throw it in a garbage lol Still have a battery coming for my working Hikvision DB, maybe that will work..
You still have to power it via the usual power terminals on the back. It will not power up from the TTL terminals. In fact I specifically said not to connect the +5VDC USB TTL wire to the +3.3VDC pad on the camera due to the voltage difference. You only want to hook up ground and the two signal wires so you can communicate with the camera.

To power the doorbell on the healing bench, I used a 24V AC plug-in transformer that used to go to my sprinkler system. Alarm panels also commonly use 16-24V AC plug-in transformers.

From my post that you quoted:

I connected ground, TX and RX from the USB TTL adapter to the leads coming from the board.
JST Pin 1 (my black wire) -> TTL Ground (black)
JST Pin 2 (my red wire) -> TTL RX (white)
JST Pin 3 (my orange wire) -> TTL TX (green)
JST Pin 4 -> NO CONNECTION (do not connect the TTL red wire to JST pin 4. The TTL adapter outputs 5V and the camera runs at 3.3V.)
 

IdleWild

n3wb
Joined
May 3, 2024
Messages
11
Reaction score
5
Location
Usa
You still have to power it via the usual power terminals on the back. It will not power up from the TTL terminals. In fact I specifically said not to connect the +5VDC USB TTL wire to the +3.3VDC pad on the camera due to the voltage difference. You only want to hook up ground and the two signal wires so you can communicate with the camera.

To power the doorbell on the healing bench, I used a 24V AC plug-in transformer that used to go to my sprinkler system. Alarm panels also commonly use 16-24V AC plug-in transformers.

From my post that you quoted:
Yea, I figured it afterwards. My POS reolink doorbell adapter worked.
 

James92TSi

n3wb
Joined
Apr 20, 2019
Messages
18
Reaction score
19
Location
Houston, TX
Yea, I figured it afterwards. My POS reolink doorbell adapter worked.
Cool. Any luck getting connected over TTL?

Funny, I'm back on here looking to see what's new in doorbell-land since one of my RCAs died. I had the unbricked one as a spare, which seems to be working except it keeps roasting SD cards. Seems people are all about some Reolink doorbells lately but IDK about that.
 

IdleWild

n3wb
Joined
May 3, 2024
Messages
11
Reaction score
5
Location
Usa
Cool. Any luck getting connected over TTL?

Funny, I'm back on here looking to see what's new in doorbell-land since one of my RCAs died. I had the unbricked one as a spare, which seems to be working except it keeps roasting SD cards. Seems people are all about some Reolink doorbells lately but IDK about that.
Yea, it was restored just fine with TTL. But shortly after I accidently touched the still exposed board with one of the terminals of ac adapter and it killed it lol No, reolink is cheap garage made garbage. Nobody can convince me otherwise here. I even returned one from Amazon and re-ordered it with cheaper price. Same issue of rebooting. Especially if you're in the app and trying to play video off SD card. It will hang and reboot. And then for a few hours you can browse and play all the videos you want with no issues. Pure trash.
 

David L

IPCT Contributor
Joined
Aug 2, 2019
Messages
8,397
Reaction score
22,030
Location
USA
Yea, it was restored just fine with TTL. But shortly after I accidently touched the still exposed board with one of the terminals of ac adapter and it killed it lol No, reolink is cheap garage made garbage. Nobody can convince me otherwise here. I even returned one from Amazon and re-ordered it with cheaper price. Same issue of rebooting. Especially if you're in the app and trying to play video off SD card. It will hang and reboot. And then for a few hours you can browse and play all the videos you want with no issues. Pure trash.
What size transformer are you using? This is the first I have heard of the ReoLink having a rebooting problem...
 

IdleWild

n3wb
Joined
May 3, 2024
Messages
11
Reaction score
5
Location
Usa
What size transformer are you using? This is the first I have heard of the ReoLink having a rebooting problem...
Replaced the 10vac with 30vac back when I had issues with hikvision doorbell ring not working, thaught something was up with a transformer (it was not) It's like a trashed windows that runs for 300 days without reboot. Once it reboots you can't make it to reboot afterwards even if you try. It has to run for awhile.. I tried to drop bitrate from max 6144 to default, no changes. Maybe it can't handle 90f outside, who knows.. Hikvision never rebooted once within 2 years, that much I know.
 

David L

IPCT Contributor
Joined
Aug 2, 2019
Messages
8,397
Reaction score
22,030
Location
USA
Replaced the 10vac with 30vac back when I had issues with hikvision doorbell ring not working, thaught something was up with a transformer (it was not) It's like a trashed windows that runs for 300 days without reboot. Once it reboots you can't make it to reboot afterwards even if you try. It has to run for awhile.. I tried to drop bitrate from max 6144 to default, no changes. Maybe it can't handle 90f outside, who knows.. Hikvision never rebooted once within 2 years, that much I know.
Sorry for the dumb question, I figured you did from reading your post. Upgrading transformers for these Smart CAMs fixes the majority of their issues we have found over these last 4 years. I am only a year into this ReoLink and we got to 107 last year, hopefully it will hold up since these CAMs run hot. My LaView (Hik) DB is still running fine to this day after 4 years in many 100+ summers. It is at our old house...

Sadly, the main reason I went ReoLink is because of the POE, but just found out recently at our new house I can't get an Ethernet cable down to the DB without ripping out sheetrock, the wife said No Way, haha, we had the house painted before we moved in so I am not allowed to mess anything up yet, lol
 
Last edited:

EricLEE

n3wb
Joined
Aug 16, 2018
Messages
28
Reaction score
12
Location
ny
My EZVIZ shows an update available to build 230404 anyway of getting the onvif version of this?
 

David L

IPCT Contributor
Joined
Aug 2, 2019
Messages
8,397
Reaction score
22,030
Location
USA
My EZVIZ shows an update available to build 230404 anyway of getting the onvif version of this?
EZVIZ does not support ONVIF

You could try the latest Hikvision Firmware which does support ONVIF

Hikvision (DS-HD1):

Always be aware of the possibly of bricking your unit when changing firmware...

Our 101 has instructions on Updating firmware is you need it...keep in mind the firmware listed is a bit out dated...
 

Viet Dzung

n3wb
Joined
Aug 29, 2019
Messages
14
Reaction score
7
Location
Vietnam

IdleWild

n3wb
Joined
May 3, 2024
Messages
11
Reaction score
5
Location
Usa
My chime does not work anymore, when press the ring button it, it change to read and the device reboot. But when I reset the DB1, and select no chime it work fine.
So your problem same with mine, and it solve by replace the battery?
Yes. By the way the battery connector was not the same, so I had to cut the connector off the original battery and connect it to this one.
 

Viet Dzung

n3wb
Joined
Aug 29, 2019
Messages
14
Reaction score
7
Location
Vietnam
Yes. By the way the battery connector was not the same, so I had to cut the connector off the original battery and connect it to this one.
Thank you, I will try to replace the battery, Today after change from EZVIZ to the HIK Onvif firmware, suddenly chime not working anymore, I have try multiple reset but no luck.
 
Top