R0 / DS-2CD2x32 BrickfixV2 brick recovery and full upgrade tool - enhanced.

mwoo68 said:
I have six Hik cameras and successfully updated 5 of them.
Click to expand...
That's good.
mwoo68 said:
my PC set a 192.0.0.128 cannot ping it, IP Scanner software can see it at 192.0.0.64.
Click to expand...
That's a bit of a contradiction, I'd expect them to give the same result. have you tried a 'ping -t 192.0.0.64' in case it's coming and going?
mwoo68 said:
SADP cannot see it,
Click to expand...
One thing worth trying is to wait 10 minutes to see if the watchdog timer will reboot into min-system mode (visible to SADP) in case the main firmware is partly running.
mwoo68 said:
The FTPserve.exe program will display Device [192.0.0.64] test tftpserver everytime I unplug and plug it back in.
Click to expand...
So not totally dead. But not completing the tftp updater handshake.
mwoo68 said:
I do recall that it did allow me to proceed past this stage and it did complete the upgrade,
Click to expand...
By this do you mean the 'System upgrade successful' message in the telnet session while running the /dav/fixup.sh script?
Or do you mean the successful installation if the brickfixv2EN firmware?

mwoo68 said:
it goes through a 8 port POE power injector before going into the switch.
Click to expand...
Suggestion :
The tftp updater timing can be marginal when using POE to power the camera.
If you can - try powering it with a 12v power supply to see if the tftp updater works better.
 
Thanks a lot for your great work !
My chinese 2032 was bricked, I followed the procedure and successfully flashed the firmware English V5.4.5_Build170123.
 
alastairstevenson said:
That's good.

That's a bit of a contradiction, I'd expect them to give the same result. have you tried a 'ping -t 192.0.0.64' in case it's coming and going?
With PC at 192,0,0,128, ping -t 192.0.0.64 just says "request timed out". Yes it is odd that IPscan can see it but not SADP. I did take the time to take down the camera from the home and tried holding reset and rebooting,but that didn't help either (didn't think it would)

One thing worth trying is to wait 10 minutes to see if the watchdog timer will reboot into min-system mode (visible to SADP) in case the main firmware is partly running. Wait for an hour, same thing.

So not totally dead. But not completing the tftp updater handshake. Yes it seems that way. There is power and etherlight lights are blinking away....

By this do you mean the 'System upgrade successful' message in the telnet session while running the /dav/fixup.sh script?
Or do you mean the successful installation if the brickfixv2EN firmware?
Click to expand...
I think I got to brickfixvEN and then I must of unplugged it. All I can remember was when I was performing the steps, this camera did get past the "test" on the TFTPserver, but now it just gets stuck at the "test" and like you said, does not complete the handshake.


Suggestion :
The tftp updater timing can be marginal when using POE to power the camera.
If you can - try powering it with a 12v power supply to see if the tftp updater works better.[/QUOTE]
Yup, took camera down from home and just tried it with a 12V supply and same result.

As you should know, I am definitely novice, but, I have read something about a serial connection method? If so, would this be worth a try?
 
mwoo68 said:
I have read something about a serial connection method? If so, would this be worth a try?
Click to expand...
Certainly, if you feel inclined to spend the time on it.
You need a couple of items, widely available on eBay -
A serial TTL to USB convertor, usually a PL2303HX-based one.
A 4-pin 1.5mm JST ZH wired connector, usually sold in 10-packs.

But before you start down that path - try another PC, use the 12v power supply, see if anything changes.
You still have a digicap.dav file in the same folder as tftpserve.exe ?
 
alastairstevenson said:
Certainly, if you feel inclined to spend the time on it.
You need a couple of items, widely available on eBay -
A serial TTL to USB convertor, usually a PL2303HX-based one.
A 4-pin 1.5mm JST ZH wired connector, usually sold in 10-packs.

But before you start down that path - try another PC, use the 12v power supply, see if anything changes.
You still have a digicap.dav file in the same folder as tftpserve.exe ?
Click to expand...

Yes I have tried a notebook on battery power and a desktop computer. And yes I have the digicap.dav in the same directory as tftpserve.exe.
This one camera is stumping me.

I'll begin looking for those items you mention above. Don't know what else to try... Thanks for all your help.
 
Just wanted to say thanks for writing this post. I have a DS-2CD2432F-IW that I got from AliExpress and I attempted to update the firmware a few months ago and it bricked. I had no idea there was a difference between the CN/EN models. I followed the instructions provided and used the EN digicap and everything worked great. Camera is back up and running now with v5.4.5 in English.

Would have been in the garbage without the help of this community.
 
alastairstevenson said:
The original 'brick-fix tool' and 'enhanced mtd hack' has proven pretty useful for those with R0 cameras that had been bricked by doing a firmware update.
It's been even more useful to deal with the fallout from the 'Hikvision backdoor' disclosure where so many people are finding their cameras are being messed with from the internet, mischievously or maliciously, and need to update to safer firmware.
However - the rather techy original method to make the changes, and probably my not-very-clear instructions have been a challenge for some people.
* And I only just noticed this - my original .txt attachments were in Linux format, not Windows format, making them hard to read without proper line breaks. And no-one let me know! Dohh! *

So here is 'Brick-fix tool V2' aimed at making the process less complex, a bit automated and easier to use, with the following changes:
- After Brick-fix toolV2 has been installed using the Hikvision tftp updater, following the power cycle to activate and drop the payload, the camera will boot directly into 'min-system' mode with telnet and tftp access and a 'fixup' script ready and primed for use.
- No web GUI access or Windows shares are needed to move files in and out of the camera.
- The fixup script handles all the basics of extracting the original mtdblock6, importing and applying the user-modified mtdblock6 that has had the 'enhanced mtd hack', and initiating a firmware update.
- The Brick-fix toolV2 automatically writes a valid template into mtdblock1 that stops cameras that originally had firmware 5.2.0 or 5.2.8 from otherwise going into a bricked state when newer firmware is applied.
Attached to this post are the resources required to convert your R0 / DS-2CD2x32 cameras into full English upgradeable devices.
- The brick-fix tool V2 in both EN and CN header language versions.
- A required resource list and step-by-step guide to the fixup script.
- A description of how to do the 'enhanced mtd hack' with screenshot with a list of devType codes for those cameras that have the masqueraded values.
- A sample transcript of the fixup script going through all 3 stages - extract mtdblocks, import modded mtdblock6, apply firmware update.

*edit* 15Dec17 By popular request, a video worked example using a DS-2CD3332-I camera donated by a generous forum member.


*edit* 28Jan18 devType codes updated - thanks @hikcamuser
And check out this useful post from @Bradmph with attached resources (but use tftp32 not tftp64) : R0 / DS-2CD2x32 BrickfixV2 brick recovery and full upgrade tool - enhanced.
Click to expand...


Firstly, i want to thank you all, to you and all the people involved on this "efford" of "bring to life chinese graymarket bricked cameras"

Secondly, the only reason to register to this forum was to thanks this thread resolution, the efford, the work and all the time invested/messed resolving this trouble.

Sorry for the bad english, im from Paraguay, and im very happy for recovering an inversion of 130 U$S (Recovered Hikvision DS-2CD2132IF-S camera)

I folloewed straighforward the instruccions listed, used the tftp 32 bit version software, used EN Digicap firmware FIXER, an "US ORIGINAL HIKVISION FIRMWARE version 5.4.5" instead of an older 5.3.0 and works like a charm.

In the future im gonna check and re check to buy a white/legal market Hikvision cameras, instead bottering people like you.

Thanks for everything you do with technnology messed by people like me.

Thumbs and kudos for you!!

Aldo.
 
Huxley said:
I folloewed straighforward the instruccions listed, used the tftp 32 bit version software, an "US FIRMWARE version 5.4.5" instead of an older 5.3.0 and works like a charm.
Click to expand...
Excellent!
Well done for getting the good result and sharing, glad it was useful for you.

Huxley said:
Thanks for everything you do with technnology messed by people like me.
Click to expand...
It's Hikvision who are putting these traps and pitfalls in people's way. Not nice - when firmware / software updates are usually a good thing to do.
 
  • Like
Reactions: Huxley
Thank you so much! I was doubtful this work work, I was a little confused with the HEX editor part but I was able to successfully "unbrick" model 2cd2632f-is and flash it with 5.4.0.
 
nic12937 said:
Thank you so much! I was doubtful this work work, I was a little confused with the HEX editor part but I was able to successfully "unbrick" model 2cd2632f-is and flash it with 5.4.0.
Click to expand...
Well done! Nice when a 'dead' camera is brought back to life.

But be aware - 5.4.0 is still vulnerable to the 'Hikvision backdoor'.
To have that fixed requires 5.4.5
 
I'm afraid to flash firmware again, I dont really understand why it was bricked in the first place when I first flashed the firmware. HIKVISION says my camera is gray market so I assume thats why the firmware breaks it. Now that it's operational on version 5.4.0, i'm hesitant to do anything to it since the camera mounted 40 feet up on the side of an airport hangar.
 
nic12937 said:
Now that it's operational on version 5.4.0, i'm hesitant to do anything to it since the camera mounted 40 feet up on the side of an airport hangar.
Click to expand...
If you used the brickfixv2 tool - to revive the camera and do the 'enhanced MTD hack' - the camera is now fully upgradeable, via the web GUI, to the latest 5.4.5 firmware.
 
yes that's exactly what I did but I dont see 5.4.5 available for download on the Hikvision US website. I'm looking here Firmware and the latest version says Archived Firmware: IPC -DS-2xx2_5.4.0_160530. Do you know anywhere else I would get that 5.4.5 version? thanks so much for the help
 
How would I go about confirming my camera is R0 series before flashing? I know it's gray market DS-2CD2632F-IS, running V5.4.0 build 160530
 
nic12937 said:
How would I go about confirming my camera is R0 series before flashing?
Click to expand...
The model number confirms it.
However, if it wasn't, the web GUI would reject the attempted firmware update.
But see attached - from the Hikvision EU portal (since removed when they revamped it).
 

Attachments

  • Like
Reactions: Pilaf and nic12937
You must log in or register to reply here.
Top Bottom