R0 / DS-2CD2x32 BrickfixV2 brick recovery and full upgrade tool - enhanced.

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,952
Reaction score
6,786
Location
Scotland
Do you know if the camera was an English / upgradeable model? Did the serial number provide any language information?

Have you see the firmware from here, for EN language cameras - DS-2DE2202I-DE3/W-Hangzhou Hikvision Digital Technology Co. Ltd.
If not - it may be worth trying the hikvision tftp updater with that firmware.
 

Raimis

n3wb
Joined
Jan 17, 2018
Messages
18
Reaction score
1
just update in normal proceses on boot ? or folow instructions ? :)
 

Attachments

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,952
Reaction score
6,786
Location
Scotland
It`s not rebooting long time, whait or reboot ?
If successful it would only take a couple of minutes to show.
That suggests the firmware is not compatible with the camera - most likely a language mismatch, as the firmware type is for that model.
Do you remember when you bought it if it was sold as 'updateable'?
 

Raimis

n3wb
Joined
Jan 17, 2018
Messages
18
Reaction score
1
If successful it would only take a couple of minutes to show.
That suggests the firmware is not compatible with the camera - most likely a language mismatch, as the firmware type is for that model.
Do you remember when you bought it if it was sold as 'updateable'?
i bought it avout two years ago, from ebay. I dont remember :(
 

hikcamuser

n3wb
Joined
May 1, 2015
Messages
15
Reaction score
0
I figured I'd help make this a bit easier... So here is a linux python script which will do all the necessary editing of the mtd6_ro file. Not the best code (I literally just learned python to do this).

You basically pass in the name of the target file (it will be overwritten) and the device code (e.g. 0x0598 for DS-2CD2032-I), as follows:

fixmtd.py TARGET_FILE HEXCODE

Actual sample run:

$ fixmtd.py mtd6_ro.bak 0x0598

Someone feel free to adapt to python for windows... (I think you just need to change the first line of the script below, but don't know what is should be).

Code:
#!/usr/bin/python
import sys
mtdfilename = sys.argv[1]
device_code = int(sys.argv[2][2:],16)
device_code_lower = (device_code & 0xFF)
device_code_upper = (device_code >> 8)

# Open file for writing
mtdfile = open(mtdfilename, "r+b")

try:
# Write the language hex value 0x01 at position 0x10
   mtdfile.seek(0x10,0)
   byte_to_be_written=[0x01]
   bytearrayObj=bytearray(byte_to_be_written)
   mtdfile.write(bytearrayObj)

# Write the device code at 0x64 and 0x65
   mtdfile.seek(0x64,0)
   byte_to_be_written=[device_code_upper]
   bytearrayObj=bytearray(byte_to_be_written)
   mtdfile.write(bytearrayObj)
   byte_to_be_written=[device_code_lower]
   bytearrayObj=bytearray(byte_to_be_written)
   mtdfile.write(bytearrayObj)

# Calculate the simple checksum-16
   mtdfile.seek(0x09,0)
   counter=0;
   for bytecounter in range (0,244):
      counter = int(ord(mtdfile.read(1))) + counter
   counter_lower = (counter & 0xFF)
   counter_upper = (counter >> 8) & 0xFF

# Write the checksum to 0x04 and 0x05
   mtdfile.seek(0x04,0)
   byte_to_be_written=[counter_lower]
   bytearrayObj=bytearray(byte_to_be_written)
   mtdfile.write(bytearrayObj)
   byte_to_be_written=[counter_upper]
   bytearrayObj=bytearray(byte_to_be_written)
   mtdfile.write(bytearrayObj)

finally:
   mtdfile.close()
 

Raimis

n3wb
Joined
Jan 17, 2018
Messages
18
Reaction score
1
If successful it would only take a couple of minutes to show.
That suggests the firmware is not compatible with the camera - most likely a language mismatch, as the firmware type is for that model.
Do you remember when you bought it if it was sold as 'updateable'?
well so no any way to get right fw ;( ?
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,952
Reaction score
6,786
Location
Scotland
well so no any way to get right fw ;( ?
It's still not clear why the EN stock firmware does not work.
The way to get more info would be to connect up to the serial console on the main board, assuming that the camera has one, as do other Hikvision devices.
 

Raimis

n3wb
Joined
Jan 17, 2018
Messages
18
Reaction score
1
It's still not clear why the EN stock firmware does not work.
The way to get more info would be to connect up to the serial console on the main board, assuming that the camera has one, as do other Hikvision devices.
well, is any docs where to connect and pinout of the cabble :) ?
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,952
Reaction score
6,786
Location
Scotland
well, is any docs where to connect and pinout of the cabble
Quite a few posts on the topic of a UART connection.
On the assumption that the camera has the same serial console facility as the NVRs and non-PTZ cameras, you need a couple of items:

A PL2303HX-based serial TTL to USB convertor, or equivalent.
A wired 4-pin 1.5mm JST ZH connector, usually sold in 10-packs.
 

scarface

n3wb
Joined
Jan 22, 2017
Messages
4
Reaction score
2
Oh yes! No problem at all to upgrade my DS-2CD2432F-IW to 5.4.5! Nice! AND THE FREKKIN IR WORKS NOW!! :) Now I will continue with all of my 2032 cams..! Thank you so much!!
 

scarface

n3wb
Joined
Jan 22, 2017
Messages
4
Reaction score
2
I am! Have you had any luck with updating the Hikvision DS-7108N-SN/P NVR? Must be the same principle?

Oh, and are my cams true EN versions now with the ability to use non Chinese FW over gui/http?

Thanks!
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,952
Reaction score
6,786
Location
Scotland
Have you had any luck with updating the Hikvision DS-7108N-SN/P NVR? Must be the same principle?
If that NVR firmware operates similarly to the 76xxNI-E series, the 'hardware signature block' is still in the flash, but is hidden by the kernel, which also blocks any attempts by external programs to modify it.
So the way to get a -N NVR to operate as an -NI NVR is to hack the firmware itself to masquerade the language.
Oh, and are my cams true EN versions now with the ability to use non Chinese FW over gui/http?
Yes, until Hikvision introduce a version beyond the current 5.4.5 that specifically looks for another signature indicating that the camera is a grey-market device.
It wouldn't be hard to do this, and I wouldn't be surprised if it happened.
It looks like 5.4.5 may be the last version for R0 cameras, unless they start feeling like punishing some of their customer base.
In previous firmware updates there have been attempts to break cameras that have had 'improvements'.
 

Bizentech

Getting the hang of it
Joined
Nov 17, 2015
Messages
105
Reaction score
9
In previous firmware updates there have been attempts to break cameras that have had 'improvements'.
So moral of the story is, if this was or may be the case, don’t update the firmware unless it’s absolutely necessary?
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,952
Reaction score
6,786
Location
Scotland
So moral of the story is, if this was or may be the case, don’t update the firmware unless it’s absolutely necessary?
Unfortunately true, for many Hikvision firmware updates. The normal expectation, for 'normal' firmware updates, those aimed at doing bug-fixes, security fixes, and adding functionality, isn't always met.
Hikvision are unusual in the way that some of their firmware updates are fraught with uncertainty - language mismatch, bricking, etc - deliberate abuse of their customers.
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,952
Reaction score
6,786
Location
Scotland
Will this file Brickfix match the cameras of other series R1, R2, R3 and R4?
Sorry, no, the 'hardware signature block' is not stored in the same way on those different camera series.
And the brickfixV2 payload firmware is specific to the R0 series.
 
Joined
May 17, 2016
Messages
10
Reaction score
1
Hello my friend
Tree years ago i bougth from Ali-Express the DS-2CD2132F-IWF V5.2.5
A few months later i had the problem with the email and when i made the update to V5.3.0 i lost the camera but with instructions from <Downgrader 5.3.0 Chinese to 5.2.5 English> the camera worked again.
Tree days ago again my camera stopped to sent me email.
From US portal DS-2CD2132F-IWS-Hangzhou Hikvision Digital Technology Co. Ltd. i made download Firmware: IPC - DS-2xx2_5.4.5_170123(with V5.4.41_170312 and 5.4.5_170312)
When i made the first update to V5.4.41 again i lost the camera.
Now i want to follow your instractions, please can you tell me:
1.At the enhanced_mtd_hack.txt i don't see my model, the nearest is the DS-2CD2132F-IS is it OK if i use the value 1E98 ?
2.At your video at time 7.56 i see you change the value 02 to 01, also for my camera i must make this change?
3.The two version that i made download is it OK for my camera or i must download this from EN Hangzhou Hikvision Digital Technology Co. Ltd. Baseline Firmware_IPC_ML_V5.4.5 170123 (2XX2)?
Thanks George
 
Last edited:
Top