R0 / DS-2CD2x32 BrickfixV2 brick recovery and full upgrade tool - enhanced.

[allsys]

No, this model of camera has a completely different architecture from the R0 series.
The 'hardware signature block' is held in a security chip, not the main flash memory, so a conversion to EN from CN requires 'hacked firmware'.

Try connecting as an ONVIF device, that may not give a language mismatch, depending on the version of NVR firmware.
If it works - motion detection would be possible, but not any 'smart events'.

Crap.... I am not finding the firmware to download, will try the onvif and pray.

 

[mitrich161616]

Sorry, I've not seen that device, so have no idea what would be possible with it's firmware.

Yesterday I connected the intercom to the TTL adapter. And flashing through the U-boot only after changing the region to 2, but the language is broken, and it does not matter English or Russian.
How do I understand I need to get backup MTDblock6 via TFTP. How can I do that.....help please

Spoiler: Log Pussy

HKVS # help
? - alias for 'help'
base - print or set address offset
bootm - boot application image from memory
bootp - boot image via network using BOOTP/TFTP protocol
bubt - Burn an boot image on the Boot Flash.

cmp - memory compare
cp - memory copy
cpld - write cpld info to encrypt media

cramfsload- cramfsload - load binary file from a filesystem image
cramfsls- cramfsls - list files in a directory (default /)
crc32 - checksum calculation
erase_env- erase envirement info on flash

getinfo - print hardware information
go - start application at address 'addr'
help - print command description/usage
loadb - load binary file over serial line (kermit mode)
loady - load binary file over serial line (ymodem mode)
loop - infinite loop on address range
md - memory display
mii - MII utility commands
mm - memory modify (auto-incrementing address)
mtest - simple RAM read/write test
mw - memory write (fill)
nm - memory modify (constant address)
ping - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
rarpboot- boot image via network using RARP/TFTP protocol
reset - Perform RESET of the CPU
run - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv - set environment variables
sf - SPI flash sub-system
tftp - tftp - download or upload image via network using TFTP protocol
update - Update the digicap of the device.

version - print monitor version
HKVS # update
MAC: 58-03-FB-B3-85-8A
TFTP from server 192.0.0.128; our IP address is 192.0.0.64
Download Filename 'digicap.dav'.
Download to address: 0x80800000
Downloading: *# [ Connected ]
################################ [ 1.000 MB]
################################ [ 2.000 MB]
################################ [ 3.000 MB]
################################ [ 4.000 MB]
################################ [ 5.000 MB]
################################ [ 6.000 MB]
################################ [ 7.000 MB]
################################ [ 8.000 MB]
################################ [ 9.000 MB]
################################ [10.000 MB]
################################ [11.000 MB]
################################ [12.000 MB]
################################ [13.000 MB]
################################ [14.000 MB]
#
done
Bytes transferred = 14737532 (e0e07c hex)
cramfs.img checkSum ok !
Erasing SPI flash...done
Writing SPI flash...done
Upgrade check ......done
Erasing devcfg...done
HKVS # reset
resetting ...
u-Boot 2010.06 (May 13 2015 - 14:30:10)

Hit any key to stop autoboot: 1 0
### CRAMFS load complete: 2161840 bytes loaded to 0x80400000
### CRAMFS load complete: 1185719 bytes loaded to 0x80800000
timeout for link [5000]!
MAC: 58-03-FB-B3-85-8A
|RCV UDP pack timeout| TFTP server not found
## Booting kernel from Legacy Image at 80400000 ...
## Loading init Ramdisk from Legacy Image at 80800000 ...
Loading Kernel Image ... OK
OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.

init started: BusyBox v1.16.1 (2015-05-13 17:16:51 CST)
Mon Apr 4 17:36:36 UTC 2011
Starting udev: [ OK ]
show logo Mon Apr 4 17:36:36 UTC 2011
VGA LineBytes is 4096 ImgWidth is 1024 ImgHeight is 600
funcret1 = 3
CVBS LineBytes is 2880 ImgWidth is 717 ImgHeight is 576
start decompress Mon Apr 4 17:36:37 UTC 2011
end decompress Mon Apr 4 17:36:54 UTC 2011
scriptCmd: ./load3520A -i TW2964.
insmod: can't insert 'extdrv/ssp.ko': invalid module format


BusyBox v1.16.1 (2015-05-13 17:16:51 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

pdev_hard_info->alarmInNums=8
pdev_hard_info->alarmOutNums=2
pdev_hard_info->dspNums=1
pdev_hard_info->encodeChans=1
pdev_hard_info->decodeChans=1
pdev_hard_info->ipcChans=0
pdev_hard_info->ivsChans=0
pdev_hard_info->flashSize=0x10
pdev_hard_info->ramSize=0x100
pdev_hard_info->networkNums=2
pdev_hard_info->ataCtrlNums=0
pdev_hard_info->panelVersion=0
audio_input_nun=1
board=62976(0xf600)
cpldіМРт°ж±ѕ: 21Дк5ФВ18ИХ
PCBS-17011
УІјю°ж±ѕєЕ:f600
**************************************************
Working Copy Path: /usr/local/jenkins/workspace/Alarm-VIS-Branch-Package/PJ01C20161114136_дї„зЅ—ж–ЇZAO可视对讲1.4.7дї„иЇж— 楼层定制


BusyBox v1.16.1 (2015-05-13 17:16:51 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

[32m[guest[0m@[31mdvrdvs[0m [32m/] [35m$ [0mURL: https://192.0.0.183/IBP/VIS/branches/Custom/PJ01C20161114136_俄罗斯ZAO可视对讲1.4.7俄语无楼层定制/APPS
Last Change Rev: 44470
Last Change Date: 2016-12-21 16:33:08 +0800 (дё‰, 2016-12-21)
Program Provide: ci
Program Build Time: 2016-12-21 16:52:29
**************************************************
>>>open /dev/msb1 error: errno = 2(No such file or directory)
>>>open /dev/msb error: errno = 2(No such file or directory)
>>>open /dev/msa1 error: errno = 2(No such file or directory)
>>>open /dev/msa error: errno = 123(No medium found)
[ERR][../../../net/netUtil/net_util.c #980]: eth0 mac address is: 58:03:fb:b3:85:8a
normal panel found.
[ERR][../../../system/param/paramLib.c #3127]: Can't open parameter file on flash, errno=0x2.
[ERR][storage/hdCtrl/stor_adaptation_layer.c #2471]: stor_update_quota_param chan(-6) error.
[ERR][storage/hdCtrl/stor_adaptation_layer.c #2471]: stor_update_quota_param chan(-5) error.
[ERR][storage/hdCtrl/stor_adaptation_layer.c #2471]: stor_update_quota_param chan(-4) error.
[ERR][storage/hdCtrl/stor_adaptation_layer.c #2471]: stor_update_quota_param chan(-3) error.
[ERR][storage/hdCtrl/stor_adaptation_layer.c #2471]: stor_update_quota_param chan(-2) error.
[ERR][storage/hdCtrl/stor_adaptation_layer.c #2471]: stor_update_quota_param chan(-1) error.
[ERR][storage/hdCtrl/stor_adaptation_layer.c #2471]: stor_update_quota_param chan(0) error.
[ERR][../../../dataManagement/database/db.c #102]: sqlite3_exec fail: 1(no such table: ring_info)!

======>sql: [delete from ring_info ;]

read decNoSignle file n=101376
read calling image file n=460800
getMaxIPCCount 0

[0;35m*****************************************************
[0;35m** **
[0;35m** MODULE : DSP snv_37017
[0;35m** BUILD TIME : Sep 27 2016 15:46:27
[0;35m** INITPRM SIZE : 1316960 Bytes
[0;35m** **
[0;35m*****************************************************

[0;32m[DSP] >>>> DSP_SetParam(pDspInitPara,pFunc) ...
[m[0;32m[DSP] <<<< DSP_SetParam(pDspInitPara,pFunc) Done! ret 0x0
[m[0;32m[DSP] >>>> DSP_SetStatus() ...
[m[0;32m[DSP] <<<< DSP_SetStatus() Done! ret 0x0
[m[0;32m[DSP] >>>> DSP_Secret() ...
[m[0;32m[DSP] <<<< DSP_Secret() Done! ret 0x0
[m[0;32m[DSP] >>>> InitDateTime() ...
[m[0;32m[DSP] <<<< InitDateTime() Done! ret 0x0
[m[0;32m[DSP] >>>> InitSys() ...
[m[0;35m[DSP] HI_VERSION=Hi3520A_MPP_V1.0.8.1
[m[0;32m[DSP] POOL ID:0, u32BlkSize=460800, u32BlkCnt=8
[m[0;32m[DSP] POOL ID:1, u32BlkSize=152064, u32BlkCnt=8
[m[0;32m[DSP] POOL ID:2, u32BlkSize=784, u32BlkCnt=8
[m[0;32m[DSP] POOL ID:3, u32BlkSize=1382400, u32BlkCnt=2
[m[0;32m[DSP] POOL ID:4, u32BlkSize=0, u32BlkCnt=0
[m[0;32m[DSP] <<<< InitSys() Done! ret 0x0
[m[0;32m[DSP] >>>> InitModuleChanManger() ...
[m[0;32m[DSP] <<<< InitModuleChanManger() Done! ret 0x0
[m[0;32m[DSP] >>>> InitCmd() ...
[m[0;32m[DSP] <<<< InitCmd() Done! ret 0x0
[m[0;32m[DSP] >>>> InitStaticImg() ...
[m[0;32m[DSP] callpic set OK!
[m[0;32m[DSP] <<<< InitStaticImg() Done! ret 0x0
[m[0;32m[DSP] >>>> InitStreamPack() ...
[m[0;32m[DSP] <<<< InitStreamPack() Done! ret 0x0
[m[0;32m[DSP] >>>> InitStreamPool() ...
[m[0;32m[DSP] <<<< InitStreamPool() Done! ret 0x0
[m[0;32m[DSP] >>>> InitVi() ...
[m[0;32m[DSP] <<<< InitVi() Done! ret 0x0
[m[0;32m[DSP] >>>> InitVo() ...
[m[1;33m[DSP] vo.c|VoLayerBind|443: Layer 0, return
[m[1;33m[DSP] vo.c|VoLayerBind|443: Layer 2, return
[m[0;32m[DSP] <<<< InitVo() Done! ret 0x0
[m[0;32m[DSP] >>>> InitAudio() ...
[m[0;32m[DSP] himpi_CreateAi AudioDevId 2
[m[0;32m[DSP] AI_ATTR_S enSamplerate 8000, enBitwidth 1, enWorkmode 1, enSoundmode 0,u32EXFlag 1, u32FrmNum 30, u32PtNumPerFrm 320, u32ChnCnt 2, u32ClkSel 1
[m[0;32m[DSP] himpi_CreateAo AudioDevId 2
[m[0;32m[DSP] AO_ATTR_S enSamplerate 8000, enBitwidth 1, enWorkmode 1, enSoundmode 0,u32EXFlag 1, u32FrmNum 9, u32PtNumPerFrm 320, u32ChnCnt 2, u32ClkSel 1
[m[1;33m[DSP] WARN: HDMI disable
[mpageaddr:4013f000,dgbaddr:4013f000,size:0
[0;32m[DSP] <<<< InitAudio() Done! ret 0x0
[m[0;32m[DSP] >>>> InitDecoder() ...
[m[1;33m[DSP] WARN: InitDecoder chan 0, malloc memory form arm orgBufLen 0x100000
[m[0;32m[DSP] <<<< InitDecoder() Done! ret 0x0
[m[0;32m[DSP] >>>> InitGrahpics() ...
[m[0;32m[DSP] <<<< InitGrahpics() Done! ret 0x0
[m[0;32m[DSP] >>>> InitEncode() ...
[m[0;35m[DSP] AinDev 2, AinChn 0, AencChn 0
[mpageaddr:40141000,dgbaddr:40141000,size:0
[0;32m[DSP] <<<< InitEncode() Done! ret 0x0
[m[0;32m[DSP] >>>> InitOsd() ...
[m[0;32m[DSP] <<<< InitOsd() Done! ret 0x0
[m[0;32m[DSP] >>>> InitVProc() ...
[m[0;32m[DSP] <<<< InitVProc() Done! ret 0x0
[m[0;32m[DSP] >>>> InitJpegSoft() ...
[m[0;32m[DSP] <<<< InitJpegSoft() Done! ret 0x0
[m[0;32m[DSP] >>>> InitAes() ...
[m[0;32m[DSP] <<<< InitAes() Done! ret 0x0
[m[0;32m[DSP] >>>> InitLowPower() ...
[m[0;32m[DSP] <<<< InitLowPower() Done! ret 0x0
[m[0;32m[DSP] total alloc 6768976
[m[1;33m[DSP] dec.c|TskDecDownloadStream|590: LOAD = 0, tid=803, pid=784
[m[0;35m[DSP] TskAudioDisplay LOAD, tid=799, pid=784
[m[1;33m[DSP] WARN: TskAudTalkBack LOAD = 0, tid=802, pid=784
[m[0;32m[DSP] InitDsp OK!!!
[m[0;32m[DSP] DSP (SvnVersion:37017) Build Time: Sep 27 2016:15:46:25
[m[0;32m[DSP] Size 1316960
[m[0;32m[DSP] viResolution =0
[m[0;32m[DSP] bHaveVo =0
[m[0;32m[DSP] viType =7
[m[0;32m[DSP] aiType =8
[m[0;32m[DSP] cpuFreq =0
[m[0;32m[DSP] encChanCnt =1
[m[0;32m[DSP] decChanCnt =1
[m[0;32m[DSP] IpcChanCnt =1
[m[0;32m[DSP] dispChanCnt =3
[m[0;32m[DSP] bHaveMenu =0
[m[0;32m[DSP] menuDispChan =0
[m[0;32m[DSP] bHaveVga =0
[m[0;32m[DSP] dispMode =4
[m[0;32m[DSP] boardType =15
[m[0;32m[DSP] sn =0
[m[0;32m[DSP] machineType =57351
[m[0;32m[DSP] bDetectViSignal =0
[m[0;32m[DSP] voStandard =2
[m[0;32m[DSP] voType =0
[m[0;32m[DSP] device_type =7
[m[0;32m[DSP] device_info =0
[m[0;32m[DSP] bDspStarted =1
[m[0;32m[DSP] bViInited =0
[m[0;32m[DSP] bVoInited =0
[m[0;32m[DSP] logBuf.bufLen =0
[m[0;32m[DSP] streamParam:
[m[0;32m[DSP] videoEncType =5
[m[0;32m[DSP] videoSubEncType =5
[m[0;32m[DSP] strPacketType =5
[m[0;32m[DSP] strSubPacketType =4
[m[0;32m[DSP] bWaterMark =0
[m[0;32m[DSP] streamParam.audioParam:
[m[0;32m[DSP] encType =0
[m[0;32m[DSP] samplesPerSecond =0
[m[0;32m[DSP] samplesPerFrame =0
[m[0;32m[DSP] boardSamplesPerSecond =0
[m[0;32m[DSP] encChans =0
[m[0;32m[DSP] bitRate =0
[m[0;32m[DSP] talkBackType =0
[m[0;32m[DSP] talkBackSamplesPerSecond =0
[m[0;32m[DSP] talkBackSamplesPerFrame =0
[m[0;32m[DSP] boardOutSamplesPerSecond =0
[m[0;32m[DSP] talkBackBitRate =0
[m[0;32m[DSP] talkBackChans =0
[m[0;32m[DSP] boardOutChans =0
[m[0;32m[DSP] audOutVolume =0
[m[0;32m[DSP] mouseParam.X =0
[m[0;32m[DSP] mouseParam.Y =0
[m[0;32m[DSP] mouseParam.I =0
[m[0;32m[DSP] bVgaDisp =1
[m[0;32m[DSP] bVoExchangeOk =0
[m[0;32m[DSP] bResetFpga =0
[m[0;32m[DSP] viSigState =0
[m[0;32m[DSP] bChanUnmatch =0
[m[0;32m[DSP] kyNum =0
[m[0;32m[DSP] device_memsize =0
[m[0;32m[DSP] bOnechnDec =0
[m[0;32m[DSP] maxD1EncChns =0
[m[0;32m[DSP] armNeedBufLen =0
[m[0;32m[DSP] pArmNeedBuf =(null)
[m[0;32m[DSP] NetOsdType =0
[m[0;32m[DSP] dspIdx =0
[m[0;32m[DSP] bSupportZeroEncode=0
[m[0;32m[DSP] chipId =-868586728
[m[0;32m[DSP] malloc Encode Buf:
[m[0;32m[DSP] NetPoolMain[0].totalLen = 512 K
[m[0;32m[DSP] NetPoolMain[0].vAddr = 0x40eca008
[m[0;32m[DSP] NetPoolSub[0].totalLen = 128 K
[m[0;32m[DSP] NetPoolSub[0].vAddr = 0x2f486f0
[m[0;35m[DSP] Total malloc len user 6768976(7) dsp 7481856(8)
[mg_pDspInitPara->viType = 7
[ERR][src/interface/comSubDefine.c #2891]: Read bmp error!! logoPath:/home/app/logo/logo.bmp
iMainIdx 2,iAuxIdx 1
[ERR][event/interactCtrl/osdCtrl.c #520]: seems not init!
[PSWD][0061]ublic_base64_len 188 len 140
init_stor_system maxEnChanNo = 1 maxIPCount 0
encParam fps = 0
[1;33m[DSP] encHostCmd.c|HostSetEncoderParam|172: chan 0 videoType 2 resolution 1010
[mencParam fps = 0
[1;33m[DSP] encHostCmd.c|HostSetEncoderParam|172: chan 0 videoType 2 resolution 1010
[m[1;33m[DSP] encHostCmd.c|HostSetSubEncoderParam|242: subChan 32 videoType 2
[m[1;33m[DSP] encHostCmd.c|HostStartEncode|109: chan 0
[m######## w = 1024, h = 600, depth=16
--------end of InitGAL--------
[ERR][../../../net/netUtil/net_config.c #905]: wlan0 get_netmask ioctl error and errno=99
[ERR][../../../net/netUtil/net_config.c #905]: wlan0 get_netmask ioctl error and errno=99
[ERR][../../../net/netUtil/net_config.c #905]: wlan0 get_netmask ioctl error and errno=99
[ERR][transProtocol/transParse.cpp #1812]: getDoorInfoFromDb err
[ERR][protocol/control.cpp #955]: AppKey:bd9731ed82d6413daeecd9841c54a1cc
[CRIT][misc/misc.c #705]: ###### error Ctrl yPos, Ctrl : auto_accept, yPos_desc : auto_acceptt_y######
[1;33m[DSP] encHostCmd.c|HostStopEncode|126: chan 0
[mIAL Native Engine: mouse device has been connected.
=======Init GUI [ [5mOK[0m ]=======
IME: Loading Input Method 0: pinyin
keyboard index error!!, current_board_idx:2,index:2.
keyboard index error!!, current_board_idx:2,index:2.
<dataManagement/storManagement/storManage.c, 156>Param error!
iYoffset[0] = 0
====== del line feed character 1 ======
====== del line feed character 1 ======
====== del line feed character 1 ======
====== del line feed character 1 ======
====== del line feed character 1 ======
keyboard index error!!, current_board_idx:2,index:2.
[ERR][src/gui_localConfigurationApi.c #898]: roomNum is 0
[ERR][../../../net/netUtil/net_config.c #905]: wlan0 get_netmask ioctl error and errno=99
[ERR][../../../net/netUtil/net_config.c #905]: wlan0 get_netmask ioctl error and errno=99

 

[Matt_d]

Hi, I'm unsure how to tell if my new Chinese Hikvision camera is R0 and therefore where this brick recovery will work. I can't activate on my NVR and it is a brand new DS-2CD3346WD-I. Will this process work? thanks Matt

SADP shows:
Status: Inactive
Software version V5.5.3
S/N DS-2CD3346WD-I20180921AACHC47032...

 

[alastairstevenson]

I'm unsure how to tell if my new Chinese Hikvision camera is R0 and therefore where this brick recovery will work.

No, that's not an R0 camera, so the brickfixv2 method is not applicable.
As SADP shows the camera as Inactive, you can use SADP to Activate it.
Follow the prompts to activate it by creating a strong password of your own choice.

 

[alastairstevenson]

How do I understand I need to get backup MTDblock6 via TFTP. How can I do that.....help please

The device may not use a flash partition to hold the hardware signature - the more recent devices hold the device-specific information in a special security chip.
Find out about the flash partitions with this command :
cat /proc/mtd
See if this command is available, for device info :
prtHardInfo
See if tftp is available using :
tftp

 

[mitrich161616]

The device may not use a flash partition to hold the hardware signature - the more recent devices hold the device-specific information in a special security chip.
Find out about the flash partitions with this command :
cat /proc/mtd
See if this command is available, for device info :
prtHardInfo
See if tftp is available using :
tftp

Thanks alastairstevenson
Тoday I will try at home, I will write about the results!

 

[Chunk72]

So I have 3 x DS-2CD2132F-IS camera's originally with the 5.2.5 chinese/english firmware. I was able to upgrade 1 no problem using alastairstevenson fabulous process. My next one failed miserably, either I pushed on through the script after an error message or made a booboo in the process - it now does the boot loop, doesn't show in sadp, won't respond to standard tftp recovery.

So I availed myself of a serial adaptor and with some faffing got the following text

Spoiler: Boot Text

HKVS # boot
Unknown command:null
booting from pri part...
load kernel...
load ramdisk...
init started: BusyBox v1.19.3 (2016-05-23 16:23:55 CST)
starting pid 377, tty '': '/etc/init.d/rcS'
Starting udev: [ OK ]
UBI device number 1, total 192 LEBs (24772608 bytes, 23.6 MiB), available 0 LEBs (0 bytes), LEB size 129024 bytes (126.0 KiB)
waiting for /dev/ubi1_0.
pri_iUpgSuccCnt:0x1, sec_iUpgSuccCnt:0x1
UBI device number 3, total 32 LEBs (4128768 bytes, 3.9 MiB), available 0 LEBs (0 bytes), LEB size 129024 bytes (126.0 KiB)
waiting for /dev/ubi3_0.
Check dir /davinci ok! (0)
UBI device number 4, total 32 LEBs (4128768 bytes, 3.9 MiB), available 0 LEBs (0 bytes), LEB size 129024 bytes (126.0 KiB)
waiting for /dev/ubi4_0.
Check dir /config ok! (0)
diagnose_way = 15, repair_way = 1, interval = 30
route: ioctl 0x890c failed: No such process
mount: mounting none on /proc/bus/usb failed: No such file or directory
/dav
map_size = 0x300000
nr_item = 3
addr_offset = 0x0 filename = orccode.bin
addr_offset = 0x200000 filename = orcme.bin
addr_offset = 0x2a0000 filename = default_binary.bin
mmap returns 0x40243000
loading ./orccode.bin...addr = 0x40243000, size = 0x1a0a91
loading ./orcme.bin...addr = 0x40443000, size = 0x3a4fc
loading ./default_binary.bin...addr = 0x404e3000, size = 0x40000
===============================
u_code version = 2016/4/6 3.0
===============================
The system is going down NOW!
Sent SIGTERM to all processes
Sent SIGKILL to all processes
Requesting system reboot

Current situation is I have this camera on my desk awaiting repair, the successfully upgraded one working fine and the other running 5.2.5 untouched.

Any idea if this one is recoverable and if so how one goes about it? Any help appreciated, I hate to chuck stuff in the bin while there's still a glimmer of hope.

 

[alastairstevenson]

That's an abrupt reset with no obvious cause or comment about it.

so how one goes about it?

I'd be surprised if it's not recoverable - but knowing a bit more about what went wrong would be good.

either I pushed on through the script after an error message or made a booboo in the process

Is it possible that the mtd6ro_mod contents are wrong?
Maybe attach a zipped copy here to look at.
*edit* And the original.

Worth trying if you interrupt the bootloader is the update command - with a choice of digicap.dav
Maybe at first try the @whoslooking Downgrader from the second dropbox link here : Custom Firmware Downgrader 5.3.0 Chinese to 5.2.5 English
You could also upgrade with the brickfixV2 to restart the process.

 

[Chunk72]

When I ctrl-u out of the bootloader, and type update it connects to the tftp looking for an mImage file, if I type sftpboot it will copy a digicap.dav file successfully but I've not managed to get one to actually install like it did when it works properly.

I've attached the mtd6 files but I suspect they are off the camera that upgraded without issue.

Is there a way to extract files from the bricked cam? In the meantime I will start from scratch and try what you've suggested - thank you

edit - had a poke around and found what may be the cause, if you read the log it looks like I pressed ahead when it hadn't extracted the files correctly, attached in the actualmtdfixuplog.zip

 

[alastairstevenson]

type update it connects to the tftp looking for an mImage file

That's unusual - that would normally follow the 'upm' command, or be part of the 'upf' command.

read the log it looks like I pressed ahead when it hadn't extracted the files correctly

The fact that the extracted file wasn't initially transferred correctly does not matter - the script stays in Stage1 until it has worked OK.

I've attached the mtd6 files but I suspect they are off the camera that upgraded without issue.

The attached 2 files are identical - and seems valid.
Are you not sure if you have the one from the problem camera?

Suggestion:
Drop the mImage file from here into the tftp updater folder, alongside the '5.3.0 to 5.2.5 downgrader' and use the 'update' command in the bootloader.
That should get the camera back to a working state with 5.2.5 firmware.
R0 / DS-2CD2x32 BrickfixV2 brick recovery and full upgrade tool - enhanced.

 

[blackmilk]

THANK YOU!!!

Another two grey market Chinese eBay cams updated via this method. They are both baby monitors so wanted them to be secure.

Cheers

 

[alastairstevenson]

Excellent! Well done, and thanks for sharing.

 

[khx73]

Does anyone have any more information on the difference between 5.4.5 and 5.4.41 for R0 cams? Haven't seen it talked about for a couple months. No release notes on the EU portal unfortunately.

 

[soulavatar7]

The original 'brick-fix tool' and 'enhanced mtd hack' has proven pretty useful for those with R0 cameras that had been bricked by doing a firmware update.
It's been even more useful to deal with the fallout from the 'Hikvision backdoor' disclosure where so many people are finding their cameras are being messed with from the internet, mischievously or maliciously, and need to update to safer firmware.
However - the rather techy original method to make the changes, and probably my not-very-clear instructions have been a challenge for some people.
* And I only just noticed this - my original .txt attachments were in Linux format, not Windows format, making them hard to read without proper line breaks. And no-one let me know! Dohh! *

So here is 'Brick-fix tool V2' aimed at making the process less complex, a bit automated and easier to use, with the following changes:
- After Brick-fix toolV2 has been installed using the Hikvision tftp updater, following the power cycle to activate and drop the payload, the camera will boot directly into 'min-system' mode with telnet and tftp access and a 'fixup' script ready and primed for use.
- No web GUI access or Windows shares are needed to move files in and out of the camera.
- The fixup script handles all the basics of extracting the original mtdblock6, importing and applying the user-modified mtdblock6 that has had the 'enhanced mtd hack', and initiating a firmware update.
- The Brick-fix toolV2 automatically writes a valid template into mtdblock1 that stops cameras that originally had firmware 5.2.0 or 5.2.8 from otherwise going into a bricked state when newer firmware is applied.
Attached to this post are the resources required to convert your R0 / DS-2CD2x32 cameras into full English upgradeable devices.
- The brick-fix tool V2 in both EN and CN header language versions.
- A required resource list and step-by-step guide to the fixup script.
- A description of how to do the 'enhanced mtd hack' with screenshot with a list of devType codes for those cameras that have the masqueraded values.
- A sample transcript of the fixup script going through all 3 stages - extract mtdblocks, import modded mtdblock6, apply firmware update.

*edit* 15Dec17 By popular request, a video worked example using a DS-2CD3332-I camera donated by a generous forum member.


*edit* 28Jan18 devType codes updated - thanks @hikcamuser
And check out this useful post from @Bradmph with attached resources (but use tftp32 not tftp64) : R0 / DS-2CD2x32 BrickfixV2 brick recovery and full upgrade tool - enhanced.

Hi, I got ds-2cd3t56wd-i8 hikvision camera whose firmware ver is 5.5.12. Can i solve language mismatch problem through this method??
Thanks in advance.

 

[alastairstevenson]

No, that is not an R0 series camera. The language / region settings are not defined in the flash memory.

 

[camsepp]

Thanks Alastair for your hard work on this.
With your tutorial I was able to unbrick my 2CD2032-I.

 

[alastairstevenson]

With your tutorial I was able to unbrick my 2CD2032-I.

Well done! Another useful revival.

 

[mitrich161616]

Thanks alastairstevenson
Тoday I will try at home, I will write about the results!

Good day! I found in my device mtd6 zone.
Is it possible to edit the area (fix), so that it is possible to install a multilanguage firmware, not a Chinese?

 

[Smithson15]

After a little trial and error in getting my PC appropriately set up to 192.0.0.128, I was able to successfully upgrade my DS-2CD2432F-IW from 5.2.5 directly to 5.4.5.

Thank you alastairstevenson!

 

[alastairstevenson]

I was able to successfully upgrade my DS-2CD2432F-IW from 5.2.5 directly to 5.4.5.

Excellent! Well done, nice result.