Overwrote u-boot mtd0 partition on DS-2CD3145F-IS. Any hope?

[alaford]

Hi friends.

Long time reader, first time poster.

I was experimenting with my Hikvision DS-2CD3145F-IS (Which I think roughly equivalent to the more popular DS-2CD2142) .

I managed to corrupt the mtd0 partition on the NVRAM that contains the u-boot program which runs at boot.

Now when the modem is powered up there's no response on the serial port and no activity on the Ethernet port.

I've tried holding down the reset button for 10 seconds after powering up, but I suspect that only helps in cases when uboot is intact.

Any ideas?

If not then can someone with experience get me started on how one goes about manually rewriting a NAND chip? Is that an avenue worth pursuing or should I just make this camera into a door stop.

Thanks very much everyone.

P.S. I can't thank everyone on these forums enough for all I've learned about reverse engineering, linux, u-boot and all sorts of cool things.

 

[alastairstevenson]

If not then can someone with experience get me started on how one goes about manually rewriting a NAND chip? Is that an avenue worth pursuing or should I just make this camera into a door stop.

Oddly enough I did something similar this week.
I had a DS-2CD3332 that I'd bought a few years back to experiment with, and managed to fully erase the flash memory, ending up a bit like your camera.
I never had any success with the ambarella low-level fastboot equivalent, so it sat on the shelf for a couple of years.
A few weeks ago I bought a 'spares or repairs' DS-2CD2132 from eBay, hoping it was just a firmware or corroded RJ45 problem, but it had a hardware fault, a short-circuit on the SoC.
With nothing to lose, I thought I'd see if I could remove the flash chip (an SOIC-48 TC58NVG0S3ETA00) to see if I could transplant it into the erased camera.
And I did, it was easier than I thought it would be.
So the Chinese 3332 suddenly became a English 2132, until I replaced the hardware signature partition with the one I'd saved from the 3332 before I started messing with it.

It's possible to buy the flash memory, and possible to buy a programmer that would handle them, but they are not that cheap. It would cost less to buy a new camera.
Unless a broken one can be obtained that would offer a transplant.

 

[iTuneDVR]

It's not a problem at all!
What firmware version at you IPC label?
Get dump from you NAND flash and then it possible rebuild you mtd0 if it realy mtd0

 

[alastairstevenson]

Get dump from you NAND flash and then it possible rebuild you mtd0 if it realy mtd0

Fix by what method?
Flash programmer?
Or a low-level fastboot?

 

[iTuneDVR]

Fix by what method?
Flash programmer?
Or a low-level fastboot?

I have original dump for this ipc model for test of course and nothing more

Many way to solve his problem!
Copy-paste pure nand data with spare or.....

 

[alastairstevenson]

Copy-paste pure nand data with spare or.....

Yes, but please explain by what method :

- By removing the NAND flash and replacing with a programmed one?
- By programming in-place with a NAND programmer and SOIC-48 test clip?
- By access to low-level recovery bootstrap code?

 

[iTuneDVR]

Yes, but please explain by what method :

- By removing the NAND flash and replacing with a programmed one?
- By programming in-place with a NAND programmer and SOIC-48 test clip?
- By access to low-level recovery bootstrap code?

1st need get dump from broken device all other according to the situation.

If he kill bootloader and nothing at TTL console so reflash by rebuilded image.

 

[alastairstevenson]

1st need get dump from broken device all other according to the situation.

Yes, of course, that's assumed.

reflash by rebuilded image.

Using an eprom programmer? With the chip removed?

 

[iTuneDVR]

Using an eprom programmer? With the chip removed?

Yes, it's simple way, because our hero burn a bridge
But it's only 1st step.

 

[alaford]

Thanks Alastair and iTuneDVR for replying.

I do have a copy of the original mtd0 / u-boot partition but I'm afraid I don't have the equipment or know how to manually burn that onto the Toshiba TC58BVG0S3HTA00 NVRAM chip. Any tips for appropriate equipment iTuneDVR?

I came across another thread on this forum that gave me some hope .. . Guide unbricking G0 cam nand ... where it describes being able to set the H19 / VO_DAT1 / BOOROM_SEL pin of the hi3516a processor to high to direct the system to boot from a bootrom on the board rather than the NAND, then using the "Fastboot" tool from the hi3516a SDK to recover.

The problem I have though is that I wouldn't have the faintest idea which part of the board of my DS-2CD3145F-IS is the right place to put the pullup resistor. I've attached a picture of the board below.

If anyone has an idea then it would be great to hear from you.

Thanks again everyone!