R0 / DS-2CD2x32 BrickfixV2 brick recovery and full upgrade tool - enhanced.

[idunbar]

Successfully upgraded 3 RO model DS-2CD2032F-I cameras! Thanks for all the posts and comments. I have one remaining camera - DS-2DE3204W-DE which is the 2MP Network Mini PTZ Dome Camera. Has anyone been successful in upgrading one of these? Current F/W is V5.4.20 and the serial number has the CCH in it so I'm afraid to try the upgrade to V5.5.0_170724 Thanks for any feedback,

 

[alastairstevenson]

Successfully upgraded 3 RO model DS-2CD2032F-I cameras!

Well done!

have one remaining camera - DS-2DE3204W-DE which is the 2MP Network Mini PTZ Dome Camera. Has anyone been successful in upgrading one of these?

I for one don't know, sorry. It's not a model I'm familiar with.

 

[Bradmph]

I Intioally updated the firmware on the web in maintenance and it gave a completed message but did not restart properly and I decided to try the server fix install.
Well, I thought I would get away with updating one at a time of the 5 hick2032 cameras and when I ran the first brickfixEN update it ended up grabbing 4 cameras and involuntary updating and batched the brew. So I just pulled all the cameras from the POE/Switch and I am doing the further updates one camera at a time now.
I included my tftpserv.log file below to show the damages, which I hope I haven't broken anything. I removed several resend lines to shorten the log file. It went so fast I couldn't stop it and had to let it run. After, I powered the cameras and watched the SADP program load them, which took a long time. Looks to of changed 3 cameras to 192.0.0.64 and one it changed to 192.168.1.64 which I will wait for last to correct it.
I have the single camera shown in the SADP.gif file I attached to this post and I have made a copy of the firmware 5.4.5 firmware so it is ready, but I am confused how t extract my MTD files from the camera to modify it. I am unfamiliar with Putty and what settings should be made with the program to drop the hex code file properly to update it and put it back in. Then run the 5.4.5 firmware update. I haven't made my hex code changes because I am stuck at extracting it. Since when did firmware become such a pain in the ass to install. I can remember when it was just a couple clicks and making sure the power didn't go out. This Hikvision upgrade fix has me confused with so many steps. Couldn't I insert the fix digi file, then the 5.4.5 digi file to get it squared away, then pull the code file out, upgrade the hex code and re-insert it back and be done with this. I am wondering if I am doing steps that are not required for dedicated system security PC. Well, if you can tell me how to drop the hex code MTD file, I should get that done and then run the firmware version update and have one camera done. The rest should be familiar enough to complete after that.
I'm taking a break from this for a few and do some easy car work to relax. I be back later to check on reply. Thank you again for your patience. :.)

 

[alastairstevenson]

I haven't made my hex code changes because I am stuck at extracting it.

The brickfixv2 /dav/fixup.sh script extracts it for you, then you modify the contents ready for it to put the modded version back for you.

Well, if you can tell me how to drop the hex code MTD file, I should get that done and then run the firmware version update and have one camera done.

When you have modified the extracted mtd6 file - the /dav/fixup.sh script will apply it for you.

Suggestion:
Re-read the step-by-step guide.
Watch the YouTube video.

 

[chylld]

Successfully unbricked my 2432!! Thanks @alastairstevenson Went and used the same procedure on my other working 2432, hex editor showed everything OK so just upgraded straight to the same 5.4.5.

 

[DigitalPackrat]

Used it to upgrade 8x DS-2CD3132F-IW 0698 and one DS-2CD2032F-I 0598.

First one was a challenge trying to get the camera to connect to the tftp server. Ended up using the web firmware upgrade on the other 8. Using the web upgrade, one camera took about an hour to boot then 2 hours to update the firmware at 2800Bps but worked normal after.

Two things I noticed coming from 5.2.5 to 5.4.5.

The WIFI doesn't work, the DS-2CD3132F-IW shows the tab but it doesn't see the AP's and inputting a setting says its not supported. I see that as a plus, one less potential security hole.

HDD Management doesn't see a SD card. Not a big deal but would have been nice to use for a backup.

 

[alastairstevenson]

Using the web upgrade, one camera took about an hour to boot then 2 hours to update the firmware at 2800Bps but worked normal after.

That's a weirdly slow throughput. Was the PC connected over WiFi? Hopefully not - a risky way to do firmware updates.

The WIFI doesn't work, the DS-2CD3132F-IW shows the tab but it doesn't see the AP's and inputting a setting says its not supported.

That should still work OK under the 5.4.5 firmware.
Did the mtd6 have the 'masqueraded' devtype of FF98 and if so, did you get a value from the prtHardInfo command to replace it? DS-2CD3132F-IW isn't in the provided devType list.

HDD Management doesn't see a SD card. Not a big deal but would have been nice to use for a backup.

Again - the same question regarding devType. That should still work OK.

Thanks for sharing your experience.

 

[alastairstevenson]

Successfully unbricked my 2432!!

Excellent!
That's what I like to hear - another camera risen from the 'dead'.

 

[Victor Strahov]

Great!
Used it to unbrick DS-2CD2432F-IW camera with latest firmware V5.4.5 build 170123.
Thanks!

P.S.
WiFi is working fine on this version

 

[alastairstevenson]

Used it to unbrick DS-2CD2432F-IW camera with latest firmware V5.4.5 build 170123.

Very good!
Well done, and thanks for sharing.

 

[Bradmph]

The brickfixv2 /dav/fixup.sh script extracts it for you, then you modify the contents ready for it to put the modded version back for you.

When you have modified the extracted mtd6 file - the /dav/fixup.sh script will apply it for you.

Suggestion:
Re-read the step-by-step guide.
Watch the YouTube video.

I finally got a grip on this firmware updating, lol. I watched and read and watched over and over and on the other system, I did the update on one camera and picked up the idea. I dropped the mtd6ro file, renamed it with mtd6ro_mod and brought it into the HEX editor and all the fixes, according to the specifications were already done on this camera. I still went through the motions to get the idea down. I then /dav/fixup.sh to install it. Ran the /dav/fixup.sh the last time to update the firmware to 5.4.5 build170123. Power down camera and Checked SADP and included a snap shot of the info below. Everything worked like your video with no problems, finally. :.)
I tried to ping the camera by the IP caught by SADP 192.168.1.64 and no luck. Then tried to change IP, gateway, to my cable gateway connection which failed because the password wasn't accepted.
I then tried to reset the password using ipcamtalk page password reset tool using the right date and it failed again with the code given to me.
As I checked the Serial on the camera after this update, it has a CCWR. Should I update the firmware to the EA or NA version. I can't access the web GUI on the camera so, I will have to grab the English version or Europe version and run over the installed CCWR version to correct it.
Appreciate the help.

The firmware I used was IPC_R0_EN_STD_5.4.5_170123.dav and renamed to digicap.dav

 

[alastairstevenson]

Power down camera and Checked SADP and included a snap shot of the info below.

I don't understand your SADP screenshot.
It should show the camera as 'Inactive' and require you to create a strong password of your own choice in order to 'Activate' it.

renamed it with mtd6ro_mod and brought it into the HEX editor and all the fixes, according to the specifications were already done on this camera.

If that is the case - this was not a China region camera and could simply be updated as normal via the web GUI.

As I checked the Serial on the camera after this update, it has a CCWR.

Did you believe this was a China market camera? That serial number suggests not.

I then tried to reset the password using ipcamtalk page password reset tool using the right date and it failed again with the code given to me.

That will not work as you are running the 5.4.5 version of firmware, where neither the old version of the reset tool works, nor the newer version as the 'Hikvision backdoor' it relies on is fixed in that version.

Suggestion:
You haven't specified what the PC IP address is when you ran SADP.
I'm speculating that it may be in a different address range than the 192.168.1.64 that SADP shows for the camera.
Set the PC IP address to, say, 192.168.1.128
Run SADP - check that it's at least version 3.0.x and see what it says for 'Status' for the camera.
It should be 'Inactive'.

Point your IE browser at the IP address shown in SADP, 192.168.1.64
You should get a page asking you to create a strong password in order to 'Activate' the camera.

 

[Bradmph]

I don't understand your SADP screenshot.
It should show the camera as 'Inactive' and require you to create a strong password of your own choice in order to 'Activate' it.

If that is the case - this was not a China region camera and could simply be updated as normal via the web GUI.

Did you believe this was a China market camera? That serial number suggests not.

That will not work as you are running the 5.4.5 version of firmware, where neither the old version of the reset tool works, nor the newer version as the 'Hikvision backdoor' it relies on is fixed in that version.

Suggestion:
You haven't specified what the PC IP address is when you ran SADP.
I'm speculating that it may be in a different address range than the 192.168.1.64 that SADP shows for the camera.
Set the PC IP address to, say, 192.168.1.128
Run SADP - check that it's at least version 3.0.x and see what it says for 'Status' for the camera.
It should be 'Inactive'.

Point your IE browser at the IP address shown in SADP, 192.168.1.64
You should get a page asking you to create a strong password in order to 'Activate' the camera.

I got the one camera going, Yeeehaaa, lol. Going through setting now. My Xfinity gateway is changed from 10.0.0.1 to 192.168.1.1. I also have a list of other compatible IP numbers to use. What a huge relief to get this figured out. One of my cameras was not Chinese and this is the one. You are correct that it was not. All the others are Chinese so it will just be a loading process now and I have the details figured out with the programs used to update the cameras. I should have them all done tonight ifg all goes well.
I also had to reset the cable modem to flush out all the old saved IP numbers. It was putting the number in on the xfinity gateway level and I couldn't change it manually and just happen to read about that on another forum with the same issue.
Sure like the upgraded firmware also. I was getting someone out there hacking in and changing settings on one of my cameras. I would watch them connect in and default the settings and soon as they finished I would shut the system down and wait till they moved on. SO, this update will fix all that BS too.
Well, going to take a break and then get started tonight finishing all the others. Should go fine.
I again appreciate your patience alastairstevenson

 

[lo111]

Awesome tool and description, thanks a lot for it.

I just managed to make it happen to a DS-2CD3332-I, which was not bricked, but holding FW 5.2.5.
The direct upgrade to 5.4.5 worked exact as you describe it.

May I ask a question, as I am about to buy some more cams:
Would it be possible to do the same to a DS-2CD2385FWD-I with this tool?

 

[alastairstevenson]

I just managed to make it happen to a DS-2CD3332-I, which was not bricked, but holding FW 5.2.5.

Well done on that!

Would it be possible to do the same to a DS-2CD2385FWD-I with this tool?

No, the tool is specific to the R0 series, that's a different series of camera, and the hardware signature is not held in a flash partition.
You need to check carefully if the camera is 'Full English, upgradeable' or maybe a China region, 'hacked to English' model.

 

[alastairstevenson]

What a huge relief to get this figured out. One of my cameras was not Chinese and this is the one.

Well, that's good, and that also explains what you described.

 

[alexf40]

Hi Alastair, awesome work with this tool, it's extremely appreciated.

My first camera went fine with no issues, the second camera I accidently used the new digicap file rather than the CH file. I re-did that step when I realised with the CH file and there were no errors appearing. And I believe all went well, but I got to the stage of pulling the mtd6ro file, however on opening the orig file, it is almost blank. (attached). The camera wasn't bricked and was running fine with 5.2.0


I tried using another mtd6ro file from the other camera which allowed me to get all the way to installing 5.4.5 firmware. However I'm not able to activate the camera. I think it's getting mixed up with the original camera I too the mtd6ro file from as intermittently shows in the batch tool and swaps out with the other camera.

Any ideas on what I should do next? Thanks for your help in advance.

 

[alastairstevenson]

the second camera I accidently used the new digicap file rather than the CH file.

Sorry, I'm not sure what you mean by that.

And I believe all went well, but I got to the stage of pulling the mtd6ro file, however on opening the orig file, it is almost blank. (attached).

That's the mtd1ro file attached - and it's perfectly normal.
Are you saying that you accidentally copied and renamed the mtd1ro_orig file as mtd6ro_mod and used that?
That would certainly have unknown and bad effects.
For the second camera - is the extracted mtd6ro_orig file still available?

I tried using another mtd6ro file from the other camera which allowed me to get all the way to installing 5.4.5 firmware

That will cause a duplicate MAC address on the network, such that the 2 cameras will fight each other for network packets.

The best solution is to retrieve the mtd6ro_orig that the tool extracted from the second camera, make a copy named as mtd6ro_mod, do the edits and start the brickfix process again.
If you have lost the original mtd6ro_orig from the second camera, then you could use a mtd6ro_orig from another camera of exactly the same model - but you would have to make a change to the MAC address. Change one of the bytes in hex locations 35 to 3A by 1 for example, and then adjust the checksum.
You will end up with the same serial number on 2 cameras.

 

[alexf40]

Hi, sorry what I meant was that for the second camera when I started I forgot to that the last digicap file I used was the one for the 5.4.5 firmware and not the brickfixv2CN.dav file. I used the same files to start the second camera as what I finished with on the first.

The extracted mtd6ro_orig file was the one attached, that's the one which is nearly all blank. Let me do this all over again, otherwise I'll try changing the MAC address. Thank you

 

[alastairstevenson]

The extracted mtd6ro_orig file was the one attached, that's the one which is nearly all blank.

No, the attached file is definitely mtd1ro_orig.

Let me do this all over again, otherwise I'll try changing the MAC address. Thank you

If you simply do it again - the mtd6ro_orig that gets extracted will be the same as the one that was put in - the copy from the other camera.
You will need to change the MAC address - that will fix it, given that the donor camera is the exact same model and you also fix up the checksum accordingly.