R0 / DS-2CD2x32 BrickfixV2 brick recovery and full upgrade tool - enhanced.

Has anyone seen this work on 5.5.12 or is it too far that it will not allow downgrade. I have quite a few CN 3145s that I would like to get operational rather than have to send back. I'm able to get them to download the EN & CN digicap.dav files but they seem to discard it after downloading as they reboot back with 5.5.12.

Anyone have any experience with these newer versions. I'm assuming that these cameras are going to be useless to me and I'll have to return them.
 
Raymond G said:
I have quite a few CN 3145s
Click to expand...
These are not R0 cameras, they are quite a different internal architecture.
The 'brickfixV2' full upgrade method is specific to the DS-2CD2x32-I series of cameras, for which the latest and likely last firmware is 5.4.5

Raymond G said:
I have quite a few CN 3145s that I would like to get operational
Click to expand...
What's the problem with them - CN menus?
Or that they won't allow updates? I've seen that on DS-2CD3335 models which had 'hacked to English' firmware which has an upgrade inhibit built in.
 
alastairstevenson said:
What's the problem with them - CN menus?
Or that they won't allow updates? I've seen that on DS-2CD3335 models which had 'hacked to English' firmware which has an upgrade inhibit built in.
Click to expand...

The were delivered with CN. The menus are a side issue. I've setup enough I know the interface well enough to navigate and I can change the OSD (I think) well enough that wouldn't be an issue. My problem is my NVR won't recognize them. It says language mismatch.

I've tried switching to ONVIF and it goes to UNKNOWN ERROR at that point. From what I've read and learned the 3145 is a type G1 (?) camera but I thought this procedure was worth a shot at least to a point where I might learn something that would help me.

When I do a reset on them with the button they will download from the TFTP but they must recognize the code is incompatible as they immediately reboot back to 5.5

So in short to answer your question at the moment they are totally unusable; even if the CN menu is as much of a non-issue as I think it might be later on.
 
Raymond G said:
My problem is my NVR won't recognize them. It says language mismatch.
Click to expand...
That's a pity. The only way round that would be some 'hacked to English' firmware. Which is sometimes what the sellers put on them, and mark them as 'not upgradeable'.
I had a couple of CN 3335s which I fixed up by messing with their internals so they'd work with the NVrs, but I wouldn't recommend doing that unless you're a linux tinkerer like me.
 
alastairstevenson said:
I wouldn't recommend doing that unless you're a linux tinkerer like me.
Click to expand...
Well that' s not me. I have a couple of Linux systems under my purview but they are one of the systems I have the least experience with. Sounds like I need to contact the company and see if I can return these units.

Thanks for the insight.
 
Yet another success story updating a pwned DS-2CD2132F-IS from something chinese and very old. The video was an invaluable companion.

Noticed that Bradmph's archive doesn't include the whoslooking tftp files.

Had to go to 5.4.0 before going to 5.4.41, but I got there.

Sadly and coincidentally(?), the SD card slot stopped working at the same time. Dunno what that's about.

Anyway, huge thanks.
 
nottooloud said:
Sadly and coincidentally(?), the SD card slot stopped working at the same time. Dunno what that's about.
Click to expand...
Probably not a coincidence. Some aspects of the hardware environment are coded in mtdblock6 to inform the firmware what to run.

Did you have to change the devType from 0xFF98? From the table it looks like it should be 0x1E98 for that model.

I have a vague recollection of another forum member having a similar symptom, that was fixed after updating to the latest firmware version, though I can't be sure.
5.4.5 is the latest, available here : DOWNLOAD PORTAL
 
nottooloud said:
updating a pwned DS-2CD2132F-IS
Click to expand...
nottooloud said:
I did 0698 per the chart in enhanced_mtd_hack.txt.
Click to expand...
devType Model
2698 DS-2CD2032F-I
2698 DS-2CD2032F-IW
0598 DS-2CD2032-I
0698 DS-2CD2132-I
1E98 DS-2CD2132F-IS
Click to expand...

I'm pretty sure the devType needs to be 0x1E98
That's quite likely to be why the SD card is no longer active.
If you choose to fix this by writing a modified version of mtdblock6, you'll need to go back to the 5.2.5 or earlier (eg min-system) firmware version to do so, for a couple of reasons -

The later firmware, I think it's 5.3.0 and onwards, has a deliberate trap for when mtdblock6 is written, which bricks the camera in a way that's quite hard to recover from.
Plus - you need telnet access to do the file transfer and writing.

Probably the quickest and easiest method would be to re-run the brickfixV2 process, this time starting with the EN version.
You should be able to go direct to 5.4.5 in Stage3.
Hopefully that will bring the SD card back.

Good luck!
 
alastairstevenson said:
Probably the quickest and easiest method would be to re-run the brickfixV2 process, this time starting with the EN version.
You should be able to go direct to 5.4.5 in Stage3.
Click to expand...

Boom. That worked. The SD card is back.

I did still have to go to 5.4.0 first. I also remembered to note that I needed to change the directory displayed in the Tftpd32 window to the current directory on desktop.

Are you sure 5.4.5 is the latest? 5.4.41 has a later build date.
 
nottooloud said:
Boom. That worked. The SD card is back.
Click to expand...
Excellent! That's a good result.

nottooloud said:
Are you sure 5.4.5 is the latest? 5.4.41 has a later build date.
Click to expand...
Now you've got me wondering ...
I've always thought that 5.4.5 was the latest version, as it was the 5.4.41 version that was the first fix for the 'backdoor', and I've posted as such.
And my recollection is that 5.4.5 came out after 5.4.41
But my recollection might be incorrect.
I'll need to try a backdoor test on a 5.4.5 version and see what happens.
 
  • Like
Reactions: nottooloud
jb_bak said:
The resource links shows website http://www.jounin.net/tftpd32.html but it is down.
Click to expand...
So it is - hopefully just temporary.
Copy of tftpd32.exe and the Hikvision tftp updater attached.

jb_bak said:
I tried using the hikvision tftp server but camera never sees the server.
Click to expand...
That's a prerequisite for the start point.
Requires - PC on 192.0.0.128, should show that value on the status window.
Best - 12v power vs POE, and both PC and camera connected to a switch/router as normal - not directly connected.

jb_bak said:
Restored camera to defaults. Nothing. This is a chinese firmware hacked 2432 cam by the way.
Click to expand...
If the camera web GUI is still active, you should be able to do a web GUI firmware update to the brickfixV2EN.dav firmware as the start point.
But make sure you know what the devType is - via the prtHardInfo shell command.
 

Attachments

Hello everyone,

I would like to ask if there is any newer firmware for my Hikvisions 2032 and 2232.
Last year I used the very helpful guide of Mr alastairstevenson and I thank him. And now I have the v5.4.5 Build 170123.
Unfortunately, I cannot watch the forum very often. Is this the latest firmware can I have?

Many thanks.
 
alastairstevenson amazing work! Just updated two DS-2CD3132-I cams to V5.4.41 build 170312. Had to use the CN firmware to get the tftp updater to work and for the last step it would not jump to 5.4.5 firmware I had to use the EN downgrande digicap.dav then update from the GUI. Thanks again!

Just went to V5.4.5 build 170123 :)
 
Last edited:
Hello friends
I have a few Chinese 2335(DS-2CD2335-I)
I try to change the language into English
As I tried, I could not upload the brickfixv2 file to the camera.
My camera is a new version:IPC default ip 192.168.1.66 and server add 192.168.1.128 and not work with Tftpd64-4.60-setup.exe

I am using a UART and RS232 port to upgrade22334455.jpg
 
You must log in or register to reply here.
Top Bottom