R0 / DS-2CD2x32 BrickfixV2 brick recovery and full upgrade tool - enhanced.

Discussion in 'Hikvision' started by alastairstevenson, Dec 2, 2017.

Share This Page

  1. alastairstevenson

    alastairstevenson Staff Member

    Joined:
    Oct 28, 2014
    Messages:
    9,744
    Likes Received:
    2,865
    Location:
    Scotland
    The original 'brick-fix tool' and 'enhanced mtd hack' has proven pretty useful for those with R0 cameras that had been bricked by doing a firmware update.
    It's been even more useful to deal with the fallout from the 'Hikvision backdoor' disclosure where so many people are finding their cameras are being messed with from the internet, mischievously or maliciously, and need to update to safer firmware.
    However - the rather techy original method to make the changes, and probably my not-very-clear instructions have been a challenge for some people.
    * And I only just noticed this - my original .txt attachments were in Linux format, not Windows format, making them hard to read without proper line breaks. And no-one let me know! Dohh! *

    So here is 'Brick-fix tool V2' aimed at making the process less complex, a bit automated and easier to use, with the following changes:
    - After Brick-fix toolV2 has been installed using the Hikvision tftp updater, following the power cycle to activate and drop the payload, the camera will boot directly into 'min-system' mode with telnet and tftp access and a 'fixup' script ready and primed for use.
    - No web GUI access or Windows shares are needed to move files in and out of the camera.
    - The fixup script handles all the basics of extracting the original mtdblock6, importing and applying the user-modified mtdblock6 that has had the 'enhanced mtd hack', and initiating a firmware update.
    - The Brick-fix toolV2 automatically writes a valid template into mtdblock1 that stops cameras that originally had firmware 5.2.0 or 5.2.8 from otherwise going into a bricked state when newer firmware is applied.
    Attached to this post are the resources required to convert your R0 / DS-2CD2x32 cameras into full English upgradeable devices.
    - The brick-fix tool V2 in both EN and CN header language versions.
    - A required resource list and step-by-step guide to the fixup script.
    - A description of how to do the 'enhanced mtd hack' with screenshot with a list of devType codes for those cameras that have the masqueraded values.
    - A sample transcript of the fixup script going through all 3 stages - extract mtdblocks, import modded mtdblock6, apply firmware update.

    *edit* 15Dec17 By popular request, a video worked example using a DS-2CD3332-I camera donated by a generous forum member.


    *edit* 28Jan18 devType codes updated - thanks @hikcamuser
    And check out this useful post from @Bradmph with attached resources (but use tftp32 not tftp64) : R0 / DS-2CD2x32 BrickfixV2 brick recovery and full upgrade tool - enhanced.
     

    Attached Files:

    Last edited: Jan 28, 2018
    Mike, camsepp, fritzycat1 and 35 others like this.
  2. Tolting Colt Acres

    Tolting Colt Acres Pulling my weight

    Joined:
    Jun 7, 2016
    Messages:
    314
    Likes Received:
    120
    Thanks Alastair for your dedication and hard work on this.

    Where shall I send the gallon of Marmite as a token of my appreciation? :p
     
  3. alastairstevenson

    alastairstevenson Staff Member

    Joined:
    Oct 28, 2014
    Messages:
    9,744
    Likes Received:
    2,865
    Location:
    Scotland
    A virtual one will do nicely, thank you.
    Do you have Vegemite in your part of the globe? As far as I know it's an Oz invention.
    The same origin for the ingredients, but a bit behind in the taste stakes.
    And many thanks to the generous forum member who donated some cameras to become the experimental patients on the operating table - you know who you are! And they survived and grew stronger.
     
    catseyenu and marku2 like this.
  4. Tolting Colt Acres

    Tolting Colt Acres Pulling my weight

    Joined:
    Jun 7, 2016
    Messages:
    314
    Likes Received:
    120
    We have Vegemite too. Wife doesn’t care for the flavor though, says it is no substitute for the “real thing”. Both are readily available at our local Sainsbury’s-equivalent, along with Digestables and Heinz Beanz (the ‘regular’ variety, we still have to import the Curry and Chili versions periodically), other staples in our pantry. When I started dating my wife I had to locate a website dedicated to serving the nutritional needs of British ex-pats, of which there are many (sites, that is). Only thing I haven’t been able to import are actual Jersey Royals, we have to settle for the Waitrose variety. Our shipment of bon-bons for Christmas Eve are expected any day now, courtesy of Royal Post. (At least the English eat normal food us yanks can tolerate here in the colonies — my pre-wife girlfriend was a Swede from Vastervik... I do not want to re-live all the nasty crap I had to import and eat from that relationship — like pickled herring (blech!) — but the ginger cookies were good at least :D )

    [​IMG]
     
    alastairstevenson and marku2 like this.
  5. marku2

    marku2 Known around here

    Joined:
    Dec 23, 2016
    Messages:
    914
    Likes Received:
    253
    Location:
    Australia
    Lol the wife loves this stuff :puke: I prefer a bottle of iron brew if I have a hangover we get that in the uk section at the local super market :)
     

    Attached Files:

    sylvie likes this.
  6. Vollstein

    Vollstein n3wb

    Joined:
    Nov 27, 2017
    Messages:
    6
    Likes Received:
    1
    I can confirm devType 1298 for DS-2CD2432F-IW cams. Thanks!
     
    alastairstevenson likes this.
  7. Securame

    Securame Pulling my weight

    Joined:
    Mar 25, 2014
    Messages:
    465
    Likes Received:
    119
    Location:
    Barcelona, Spain
    You do an awesome job on the forum Alastair, thank you!
     
  8. alastairstevenson

    alastairstevenson Staff Member

    Joined:
    Oct 28, 2014
    Messages:
    9,744
    Likes Received:
    2,865
    Location:
    Scotland
    Thank you, that's useful.
    And well done for following the steps and fully updating your cameras.
     
  9. Stefan017

    Stefan017 n3wb

    Joined:
    Nov 9, 2017
    Messages:
    1
    Likes Received:
    2
    wooooohoooo!
    This tool and the description ist great - it saved my bricked DS2-CD3332-I and i am able to update it to 5.4.5
    I have upgraded it directly with the 5.4.5 firmware and it run perfectly.
    THANK YOU!
     
    alastairstevenson and marku2 like this.
  10. alastairstevenson

    alastairstevenson Staff Member

    Joined:
    Oct 28, 2014
    Messages:
    9,744
    Likes Received:
    2,865
    Location:
    Scotland
    Great! Another good result.
    And well done for trying the upgraded version of the tool - it's new, and not as much tested as the original.
     
    Last edited: Dec 4, 2017
  11. CelticWebs

    CelticWebs n3wb

    Joined:
    Dec 5, 2017
    Messages:
    6
    Likes Received:
    1
    Hi all,

    I've given this tool a whirl on my camera, it wasn't bricked but was running an old firmware that I assume had been hacked to English on a Chinese camera. I'm getting stuck at the putty part. Initially I tried the EN.dav but that didn't work at all, it would find the camera, start transferring, complete transferring then just stop with no further notifications. I then tried the cn.dav and that one went further with the following log.


    2017-12-06 10:15:38] TFTP server[192.0.0.128] initialized

    [2017-12-06 10:15:43] Device[192.0.0.64] test tftpserver

    [2017-12-06 10:15:53] Connect client[192.0.0.64] success

    [2017-12-06 10:15:53] Start file[C:\hikvision\hack\tftp\digicap.dav] transmitting

    [2017-12-06 10:16:12] Completed file[C:\hikvision\hack\tftp\digicap.dav] transmit

    [2017-12-06 10:16:31] Device[192.0.0.64] system update completed!
    I gave it a moment then powered down the camera. Connected the power back up and opened Putty, selected Telnet, entered the address 192.168.0.64 and this is where I'm stopped, putty will not connect to the camera, it just says Network error: network unreachable. Any tips on how to move forward here?



    ***EDIT***


    Sorry! I just realised my own mistake! it should have been 192.0.0.64 muppet moment!
     
  12. CelticWebs

    CelticWebs n3wb

    Joined:
    Dec 5, 2017
    Messages:
    6
    Likes Received:
    1
    OK so I've got the file out and I've opened HXD to edit it, I made the edits and this is where I am, the 0x04 and 0x05 bit is where eI got a little confused.

    Here's a screen shot, can you let me know if I've edited this correctly for a DS-2CD3132-I please before I attempt to put it back in to the camera. I'm assuming if I got it wrong I could really mess it up at this point?

    [​IMG]

    I added O inter first line at the first digit of 05 and I added F in the first line in the first digit of 04 is this correct please?
     
  13. alastairstevenson

    alastairstevenson Staff Member

    Joined:
    Oct 28, 2014
    Messages:
    9,744
    Likes Received:
    2,865
    Location:
    Scotland
    If the Checksum-16 value that's showing in the blue bar of the Checksums tab of your screenshot has been calculated from highlighting the area starting at location 09 until there is a length of F4 bytes shown in the HxD status bar, then :
    The value 0BF9 should be used as follows - 0B (the most significant byte) applied to location 05, and F9 (the least significant byte) to location 04.
    If that's not the proper calculated checksum, re-select the bytes from 09 downwards until the Length : xx value shows as F4, then use the Analysis | Checksums | Checksum-16 to calculate the required value, and apply as described above.
     
  14. CelticWebs

    CelticWebs n3wb

    Joined:
    Dec 5, 2017
    Messages:
    6
    Likes Received:
    1
    I flashed the file I'd modified and was able to upgrade to stock English Firmware. I'm now on Firmware V5.4.5 build 170123

    Thanks for all your help!
     
    alastairstevenson likes this.
  15. alastairstevenson

    alastairstevenson Staff Member

    Joined:
    Oct 28, 2014
    Messages:
    9,744
    Likes Received:
    2,865
    Location:
    Scotland
    Brilliant! Yet another good result.
    Well done, and thanks for sharing.
     
  16. yu130960

    yu130960 n3wb

    Joined:
    Jan 5, 2017
    Messages:
    1
    Likes Received:
    1
    Did two cameras last night that were 5.1.2 and 5.1.6 (grey market english hacked), and the upgrade direct to 5.4.5 took fine. Just monitoring them before I do the remaining 2.
    Thanks a lot for your work. Why is this not a sticky?
     
  17. alastairstevenson

    alastairstevenson Staff Member

    Joined:
    Oct 28, 2014
    Messages:
    9,744
    Likes Received:
    2,865
    Location:
    Scotland
    Excellent! This is looking pretty good.
    I kinduv wondered about that myself, as some of the existing stickies on the same topic are obsolete.
    Maybe @fenderman will comment.
     
    fenderman likes this.
  18. fenderman

    fenderman Staff Member

    Joined:
    Mar 9, 2014
    Messages:
    27,897
    Likes Received:
    7,727
  19. marku2

    marku2 Known around here

    Joined:
    Dec 23, 2016
    Messages:
    914
    Likes Received:
    253
    Location:
    Australia
    It should be a hiki sticky wiki :ipct:
     
    alastairstevenson likes this.
  20. alastairstevenson

    alastairstevenson Staff Member

    Joined:
    Oct 28, 2014
    Messages:
    9,744
    Likes Received:
    2,865
    Location:
    Scotland
    Lol!
    It's looking useful so far.
    The cricket was big news over here.

    The patient is wondering what trial to be part of next.