New RCA HSDB2A 3MP Doorbell IP Camera
- Thread starter fleece
- Start date
TLDR: Unbricking via TTL Serial was successful!
I was able to get connected with the TTL Serial adapter, and found that the Config file of the camera is what is causing it not to load. The magic bullet was to interrupt the boot and issue a format command to erase everything but the bootloader, then issue an update command (with sdcard inserted, having RCA firmware renamed to digicap.dav as the only file present). This loaded successfully and the doorbell booted to a blue flashing ring and voice prompt to configure via phone app.
Full details:
The USB TTL Serial adapter arrived this afternoon and I tinkered with it after work. For reference, I purchased this one which uses a Prolific chipset. Win10 picked it up and automatically installed functional drivers.
I'm already familiar with using Putty (years of IT work) but for anyone who's not, there are detailed instructions for setting up the connection on the thread I was referencing earlier about resetting Hikvision devices via TTL Serial.
Because of the packaging of the doorbell, Hik didn't put a JST-ZH connector on the 4-pin TTL Serial header. It does use the 1.5mm pin spacing of the JST-ZH connector, though. Lacking a connector and wanting a reliable connection, I temporarily soldered some 22AWG wires onto the pin pads, with a 3-pin PC fan header on the other end of the wires so I could slide the TTL adapter leads on. Not a clean soldering job at all, just going for quick, functional, and easy to desolder afterward, since I'll need to remove this in order to close up the camera case.
Not to worry, a little heat shrink to keep those wires separated.
I connected ground, TX and RX from the USB TTL adapter to the leads coming from the board.
JST Pin 1 (my black wire) -> TTL Ground (black)
JST Pin 2 (my red wire) -> TTL RX (white)
JST Pin 3 (my orange wire) -> TTL TX (green)
JST Pin 4 -> NO CONNECTION (do not connect the TTL red wire to JST pin 4. The TTL adapter outputs 5V and the camera runs at 3.3V.)
I powered it up, and my Putty window sprang to life with output from the camera. After pressing CTRL+U at the prompt to interrupt the bootloader, I found there is an update command which tries to read digicap.dav from the sdcard. I ran this, and it completed successfully and rebooted. BUT - the camera was still stuck in a boot loop, so I examined closer and found two errors:
[09 22:34:30][CONFIG][ERROR]config_file_to_json error
[09 22:34:30][CONFIG][ERROR]recover_config_file
I looked at the available commands (typing ? or help lists them) and found format - format flash except bootloader area. Sounded promising, so I executed format, followed by another update command to load the firmware from digicap.dav on the sdcard. Success! The doorbell booted to a blue ring and voice prompt.
I am going to further configure it on the RCA firmware I just loaded, flash it over to EzViz firmware, remove the EzViz logo from the video output (via Batch Config), then flash over to my final intended LaView firmware. That will get it to the same state as my other two RCA units. Once everything's done, I'll desolder my wires from the TTL header and close it up.
@davidew98 I am not really an expert on Linux and other embedded OS, but if there are any specific commands you'd like me to try to probe it with before I remove the TTL wires and close it up, let me know. In the Code block below is a listing of the commands available when the bootloader is interrupted (CTRL+U at the prompt).
I've attached the full text output from my Putty session to this post as a PDF file. For science!
I hope this helps someone who has a bricked doorbell kicking around and doesn't mind doing a little soldering and buying a $7 USB-TTL adapter to get it running again.
Code:U-Boot 2010.06-svn-43155 (Oct 30 2018 - 10:01:33) Find sd card. DM9051-MAC Hit Ctrl+u to stop autoboot: 0 HKVS # ? ? - alias for 'help' arc_go - start application at address 'addr' base - print or set address offset bdinfo - print Board Info structure boot - boot default, i.e., run 'bootcmd' bootd - boot default, i.e., run 'bootcmd' bootm - boot application image from memory bootp - boot image via network using BOOTP/TFTP protocol cmp - memory compare coninfo - print console devices and information cp - memory copy crc32 - checksum calculation dhcp - boot image via network using DHCP/TFTP protocol echo - echo args to console editenv - edit environment variable fatinfo - print information about filesystem fatload - load binary file from a dos filesystem fatls - list files in a directory (default /) format - format flash except bootloader area go - go xxx.bin thru network go_orig - start application at address 'addr' gos - go xxx.bin thru serial help - print command description/usage iminfo - print header information for application image imxtract- extract a part of a multi-image loadb - load binary file over serial line (kermit mode) loadk - load kernel to DRAM loadm - load mini to DRAM loads - load S-Record file over serial line loadss - load safe system loady - load binary file over serial line (ymodem mode) loop - infinite loop on address range md - memory display mm - memory modify (auto-incrementing address) mmc - MMC sub system mmcinfo - mmcinfo <dev num>-- display MMC info mtest - simple RAM read/write test mw - memory write (fill) nfs - boot image via network using NFS protocol nm - memory modify (constant address) pinctrl - Pin Ctrl ping - send ICMP ECHO_REQUEST to network host printenv- print environment variables rarpboot- boot image via network using RARP/TFTP protocol reset - Perform RESET of the CPU run - run commands in an environment variable saveenv - save environment variables to persistent storage setenv - set environment variables sf - SPI flash sub-system sleep - delay execution for some time source - run script from memory sspi - SPI utility commands tftpboot- boot image via network using TFTP protocol upa - update app image uparc - update arc update - update digicap.dav updateb - update ramboot and uboot updateu - update uboot updevinfo- update devinfo upf - update firmware, format and update (factory use) upk - update uImage upmcu - update mcu upmini - update minisys upram - update ramboot upres - update res version - print monitor version wdt - WDT utility commands
My bricked RCA DB is not powering up off the USB TTL adapter. So have no idea how yours powered up. I'll just throw it in a garbage lol Still have a battery coming for my working Hikvision DB, maybe that will work..
Last edited:
James92TSi
n3wb
You still have to power it via the usual power terminals on the back. It will not power up from the TTL terminals. In fact I specifically said not to connect the +5VDC USB TTL wire to the +3.3VDC pad on the camera due to the voltage difference. You only want to hook up ground and the two signal wires so you can communicate with the camera.
To power the doorbell on the healing bench, I used a 24V AC plug-in transformer that used to go to my sprinkler system. Alarm panels also commonly use 16-24V AC plug-in transformers.
From my post that you quoted:
James92TSi
n3wb
Cool. Any luck getting connected over TTL?
Funny, I'm back on here looking to see what's new in doorbell-land since one of my RCAs died. I had the unbricked one as a spare, which seems to be working except it keeps roasting SD cards. Seems people are all about some Reolink doorbells lately but IDK about that.
Yea, it was restored just fine with TTL. But shortly after I accidently touched the still exposed board with one of the terminals of ac adapter and it killed it lol No, reolink is cheap garage made garbage. Nobody can convince me otherwise here. I even returned one from Amazon and re-ordered it with cheaper price. Same issue of rebooting. Especially if you're in the app and trying to play video off SD card. It will hang and reboot. And then for a few hours you can browse and play all the videos you want with no issues. Pure trash.
What size transformer are you using? This is the first I have heard of the ReoLink having a rebooting problem...
Replaced the 10vac with 30vac back when I had issues with hikvision doorbell ring not working, thaught something was up with a transformer (it was not) It's like a trashed windows that runs for 300 days without reboot. Once it reboots you can't make it to reboot afterwards even if you try. It has to run for awhile.. I tried to drop bitrate from max 6144 to default, no changes. Maybe it can't handle 90f outside, who knows.. Hikvision never rebooted once within 2 years, that much I know.
Sorry for the dumb question, I figured you did from reading your post. Upgrading transformers for these Smart CAMs fixes the majority of their issues we have found over these last 4 years. I am only a year into this ReoLink and we got to 107 last year, hopefully it will hold up since these CAMs run hot. My LaView (Hik) DB is still running fine to this day after 4 years in many 100+ summers. It is at our old house...
Sadly, the main reason I went ReoLink is because of the POE, but just found out recently at our new house I can't get an Ethernet cable down to the DB without ripping out sheetrock, the wife said No Way, haha, we had the house painted before we moved in so I am not allowed to mess anything up yet, lol
Last edited:
EZVIZ does not support ONVIF
You could try the latest Hikvision Firmware which does support ONVIF
Hikvision (DS-HD1):
Always be aware of the possibly of bricking your unit when changing firmware...
Our 101 has instructions on Updating firmware is you need it...keep in mind the firmware listed is a bit out dated...
Anyone can view snapshot with Hikvision (DS-HD1) 211101 firmware? Ii has Onvif support but I could not access http://DOORBELL_IP_ADDRESS/onvif/snapshot.jpg.
I can access the snapshot link with 200321 FW. It is safe to downgrade from 211101 to 200321?
I can access the snapshot link with 200321 FW. It is safe to downgrade from 211101 to 200321?
My chime does not work anymore, when press the ring button it, it change to read and the device reboot. But when I reset the DB1, and select no chime it work fine.
So your problem same with mine, and it solve by replace the battery?
Yes. By the way the battery connector was not the same, so I had to cut the connector off the original battery and connect it to this one.
Thank you, I will try to replace the battery, Today after change from EZVIZ to the HIK Onvif firmware, suddenly chime not working anymore, I have try multiple reset but no luck.
This is the link for the DS-HD1, maybe try a FTP Client and see if they have a link for the DS-HD2
Mine never worked quite right, and eventually died completely after about a year and a half.
I ended up getting the reolink
[Official] Reolink Doorbell WiFi - Smart Video Doorbell Camera
Smart 2K+ 5MP Wi-Fi doorbell camera with clear night vision, person & package detection, easy installation, two-way audio, 24/7 recording, and waterproof rating.
m.reolink.com
Even though that one says wifi, it also has an Ethernet port you can use. It uses your chime power, but not the actual chime. Instead it comes with a plug in chime. Has worked flawlessly for me since last summer.
Got this really cool lightning strike on it!
View attachment 1000004242.mp4