R0 / DS-2CD2x32 BrickfixV2 brick recovery and full upgrade tool - enhanced.

Magic_V said:
Is there anything I can do at this point?
Click to expand...
I'm pretty sure the camera will be recoverable - unless the firmware you installed has messed with the bootloader to shut down the ability to use the Hikvision tftp updater.
Do you have a link to the firmware download site that you first updated the camera with?
Magic_V said:
I accidentally flashed the wrong digicap.dav using the tftpserv application, it showed that the firmware was successfully installed.
Click to expand...
Was this the firmware you downloaded from the Hikvision site?

Worth checking is whether the camera shows in SADP, and what version of firmware it lists, and what IP address and serial number shows.
Get SADP here : SADP Tool
 
Thanks for your reply!
I initially flashed the firmware using the Web GUI, using the firmware from the Hikvision site: https://us.hikvision.com/sites/default/files/firmware/ipc_2xx2_en_std_5.4.5_170123.zip.
Then I tried to follow this guide.
The firmware I flashed first was the "brickfixv2EN.dav".
Then I flashed the firmware from this link: R0 series DS-2CD2x32x-Ixx IP camera firmware
Then I flashed the "brickfixv2EN.dav" again.
Tried to Telnet in, not working.
Power cycled a few times.
Tried to flash "brickfixv2CN.dav". This is when it started just freezing on the connection attempt with tftpserv.
As soon as I turn on the camera it will try to establish a connection, however it just never succeeds.

SADP Tool does not recognize anything.
 
Last edited:
Magic_V said:
I initially flashed the firmware using the Web GUI, using the firmware from the Hikvision site: https://us.hikvision.com/sites/default/files/firmware/ipc_2xx2_en_std_5.4.5_170123.zip.
Click to expand...
That will certainly 'brick' a China language camera, with the 'language mismatch' error.

Magic_V said:
The firmware I flashed first was the "brickfixv2EN.dav".
Click to expand...
This will revoke the 'downgrade block' that attempting the 5.4.5 will have applied, and set up the /dav/fixup.sh scripting to handle the export of mtd6ro and the import of mtd6ro_mod and the final firmware update.
But I'd have expected the camera to need the brickfixv2CN.dav version.

Magic_V said:
Then I flashed the firmware from this link: R0 series DS-2CD2x32x-Ixx IP camera firmware
Click to expand...
Was this after you had followed the brickfixV2 process to do the 'enhanced MTD hack' or did you just apply it straight after the brickfix2EN.dav?

Magic_V said:
This is when it started just freezing on the connection attempt with tftpserv.
Click to expand...
I'm not really sure what you mean by this.
Magic_V said:
As soon as I turn on the camera it will try to establish a connection, however it just never succeeds.
Click to expand...
'Device test tftp server' or similar?

Magic_V said:
SADP Tool does not recognize anything.
Click to expand...
Leave the camera powered on for 10 minutes, see if the watchdog kicks it into the min-system recovery mode, shown as firmware 4.0.8
SADP V3.x ?
 
I tried to do the procedure on my chinese dc-2cd2032-i I can only find ds-2cd2032-i FW (English) I assume this is the one.

I used brickfixV2 but on step one 1 got this error an error

my cam ip is now 192.0.0.64 my pc ip is set correctly but my logs show.

Code: 
*** error transferring mtd6ro_mod via tftp from the PC. ****
End of script - ready for the next run.
.
Checking that tftp works OK ...
[stage start] fixup_log.txt successfully transferrred to the PC via tftp
*** error transferring mtd6ro_mod via tftp from the PC. ****
End of script - ready for the next run.
.
Checking that tftp works OK ...
[stage start] fixup_log.txt successfully transferrred to the PC via tftp
*** error transferring mtd6ro_mod via tftp from the PC. ****
End of script - ready for the next run.
.
Checking that tftp works OK ...
[stage start] fixup_log.txt successfully transferrred to the PC via tftp
*** error transferring mtd6ro_mod via tftp from the PC. ****
End of script - ready for the next run.
.
[Brick-fix tool] Initiating reboot into min-system
Checking that tftp works OK ...
[stage start] fixup_log.txt successfully transferrred to the PC via tftp
*** error transferring mtd6ro_mod via tftp from the PC. ****
End of script - ready for the next run.
.
[Brick-fix tool] Initiating reboot into min-system
Checking that tftp works OK ...
*** error transferring mtd6ro_mod via tftp from the PC. ****
End of script - ready for the next run.
.
Checking that tftp works OK ...
*** error transferring mtd6ro_mod via tftp from the PC. ****
End of script - ready for the next run.
.
Checking that tftp works OK ...
*** error transferring mtd6ro_mod via tftp from the PC. ****
End of script - ready for the next run.
.
Checking that tftp works OK ...
[stage start] fixup_log.txt successfully transferrred to the PC via tftp
*** error transferring mtd6ro_mod via tftp from the PC. ****
End of script - ready for the next run.
.
Checking that tftp works OK ...
[stage start] fixup_log.txt successfully transfer

*** error transferring mtd6ro_mod via tftp from the PC. ****

I then ran

rm /dav/fixup_stage*

then

/dav/fixup.sh now I got things moving but another error

Code: 
[Brick-fix tool] Initialising fixup_log.txt
Payload dropped, rollback re-enabled
Initialising fixup current status to stage1
[Brick-fix tool] Initiating reboot into min-system
[Brick-fix tool] Initiating reboot into min-system
Checking that tftp works OK ...
[stage start] fixup_log.txt successfully transferrred to the PC via tftp
Extracting the original mtdblocks ...
Extracted the original mtdblock6 as mtd6ro_orig
Extracted the original mtdblock1 as mtd1ro_orig
Transferring out mtd6ro_orig via tftp ...
Successfully transferred out mtd6ro_orig via tftp
Transferring out mtd1ro_orig via tftp ...
Successfully transferred out mtd1ro_orig via tftp
Fixup Stage1 is completed - Extracted the original mtdblocks
End of script - ready for the next run.
.
Checking that tftp works OK ...
[stage start] fixup_log.txt successfully transferrred to the PC via tftp
*** error transferring mtd6ro_mod via tftp from the PC. ****
End of script - ready for the next run.
.
[Brick-fix tool] Initiating reboot into min-system
[Brick-fix tool] Initiating reboot into min-system
Checking that tftp works OK ...
[stage start] fixup_log.txt successfully transferrred to the PC via tftp
*** error transferring mtd6ro_mod via tftp from the PC. ****
End of script - ready for the next run.
.
Checking that tftp works OK ...
[stage start] fixup_log.txt successfully transferrred to the PC via tftp
*** error transferring mtd6ro_mod via tftp from the PC. ****
End of script - ready for the next run.
.
Checking that tftp works OK ...
[stage start] fixup_log.txt successfully transferrred to the PC via tftp
*** error transferring mtd6ro_mod via tftp from the PC. ****
End of script - ready for the next run.
.
Checking that tftp works OK ...
[stage start] fixup_log.txt successfully transferrred to the PC via tftp
*** error transferring mtd6ro_mod via tftp from the PC. ****
End of script - ready for the next run.
.
Checking that tftp works OK ...
[stage start] fixup_log.txt successfully transferrred to the PC via tftp
*** error transferring mtd6ro_mod via tftp from the PC. ****
End of script - ready for the next run.
.
Checking that tftp works OK ...
[stage start] fixup_log.txt successfully transferrred to the PC via tftp
*** error transferring mtd6ro_mod via tftp from the PC. ****
End of script - ready for the next run.
.
Checking that tftp works OK ...
[stage start] fixup_log.txt successfully transferrred to the PC via tftp
*** error transferring mtd6ro_mod via tftp from the PC. ****
End of script - ready for the next run.
.
[Brick-fix tool] Initiating reboot into min-system
Checking that tftp works OK ...
[stage start] fixup_log.txt successfully transferrred to the PC via tftp
*** error transferring mtd6ro_mod via tftp from the PC. ****
End of script - ready for the next run.
.
[Brick-fix tool] Initiating reboot into min-system
Checking that tftp works OK ...
*** error transferring mtd6ro_mod via tftp from the PC. ****
End of script - ready for the next run.
.
Checking that tftp works OK ...
*** error transferring mtd6ro_mod via tftp from the PC. ****
End of script - ready for the next run.
.
Checking that tftp works OK ...
*** error transferring mtd6ro_mod via tftp from the PC. ****
End of script - ready for the next run.
.
Checking that tftp works OK ...
[stage start] fixup_log.txt successfully transferrred to the PC via tftp
*** error transferring mtd6ro_mod via tftp from the PC. ****
End of script - ready for the next run.
.
Checking that tftp works OK ...
[stage start] fixup_log.txt successfully transferrred to the PC via tftp
*** error transferring mtd6ro_mod via tftp from the PC. ****
End of script - ready for the next run.


also maindigicap.dav was created in my tftp folder but that's the only file made. any tips?
 
Last edited:
The log shows that tftp is unable to find or read / transfer the mtd6_mod file from the PC.

Check that the file mtd6_mod is in the same folder as tftpd32.exe and that it is readable.
 
alastairstevenson said:
The log shows that tftp is unable to find or read / transfer the mtd6_mod file from the PC.

Check that the file mtd6_mod is in the same folder as tftpd32.exe and that it is readable.
Click to expand...
Thanks sorry for the messy post above I was about to clean it up before I saw this reply.

Where do I get this mtd6 file? I didnt' get one in the downloaded files and nothing was extracted out of the camera when I ran the script.
 
That file is the modded version of the mtd6_orig that the script extracted from the camera so that you can do the 'enhanced MTD hack' on it.
Code: 
Transferring out mtd6ro_orig via tftp ...
Successfully transferred out mtd6ro_orig via tftp
Transferring out mtd1ro_orig via tftp ...
Successfully transferred out

As per the step by step guide.
 
And this is where my problem lies I can't get this file it doesn't extract. I can still communicate to 192.0.0.64 the /dav/fixup.sh always give me errors and now when I run rm /dav/fixup_stage* i get no such file or directory

Will there be a point where I messed this beyond repair?


I think running the rm /dav/fixup_stage* I screwed up because in the log now I see it's looking for files there that are missing.

Code: 
[Brick-fix tool] Initialising fixup_log.txt
Payload dropped, rollback re-enabled
Initialising fixup current status to stage1
[Brick-fix tool] Initiating reboot into min-system
[Brick-fix tool] Initiating reboot into min-system
Checking that tftp works OK ...
[stage start] fixup_log.txt successfully transferrred to the PC via tftp
Extracting the original mtdblocks ...
Extracted the original mtdblock6 as mtd6ro_orig
Extracted the original mtdblock1 as mtd1ro_orig
Transferring out mtd6ro_orig via tftp ...
Successfully transferred out mtd6ro_orig via tftp
Transferring out mtd1ro_orig via tftp ...
Successfully transferred out mtd1ro_orig via tftp
Fixup Stage1 is completed - Extracted the original mtdblocks
End of script - ready for the next run.
.
Checking that tftp works OK ...
[stage start] fixup_log.txt successfully transferrred to the PC via tftp
*** error transferring mtd6ro_mod via tftp from the PC. ****
End of script - ready for the next run.
.
[Brick-fix tool] Initiating reboot into min-system
[Brick-fix tool] Initiating reboot into min-system
Checking that tftp works OK ...
[stage start] fixup_log.txt successfully transferrred to the PC via tftp
*** error transferring mtd6ro_mod via tftp from the PC. ****
End of script - ready for the next run.
.
Checking that tftp works OK ...
[stage start] fixup_log.txt successfully transferrred to the PC via tftp
*** error transferring mtd6ro_mod via tftp from the PC. ****
End of script - ready for the next run.
.
Checking that tftp works OK ...
[stage start] fixup_log.txt successfully transferrred to the PC via tftp
*** error transferring mtd6ro_mod via tftp from the PC. ****
End of script - ready for the next run.
.
Checking that tftp works OK ...
[stage start] fixup_log.txt successfully transferrred to the PC via tftp
*** error transferring mtd6ro_mod via tftp from the PC. ****
End of script - ready for the next run.
.
Checking that tftp works OK ...
[stage start] fixup_log.txt successfully transferrred to the PC via tftp
*** error transferring mtd6ro_mod via tftp from the PC. ****
End of script - ready for the next run.
.
Checking that tftp works OK ...
[stage start] fixup_log.txt successfully transferrred to the PC via tftp
*** error transferring mtd6ro_mod via tftp from the PC. ****
End of script - ready for the next run.
.
Checking that tftp works OK ...
[stage start] fixup_log.txt successfully transferrred to the PC via tftp
*** error transferring mtd6ro_mod via tftp from the PC. ****
End of script - ready for the next run.
.
[Brick-fix tool] Initiating reboot into min-system
Checking that tftp works OK ...
[stage start] fixup_log.txt successfully transferrred to the PC via tftp
*** error transferring mtd6ro_mod via tftp from the PC. ****
End of script - ready for the next run.
.
[Brick-fix tool] Initiating reboot into min-system
Checking that tftp works OK ...
*** error transferring mtd6ro_mod via tftp from the PC. ****
End of script - ready for the next run.
.
Checking that tftp works OK ...
*** error transferring mtd6ro_mod via tftp from the PC. ****
End of script - ready for the next run.
.
Checking that tftp works OK ...
*** error transferring mtd6ro_mod via tftp from the PC. ****
End of script - ready for the next run.
.
Checking that tftp works OK ...
[stage start] fixup_log.txt successfully transferrred to the PC via tftp
*** error transferring mtd6ro_mod via tftp from the PC. ****
End of script - ready for the next run.
.
Checking that tftp works OK ...
[stage start] fixup_log.txt successfully transferrred to the PC via tftp
*** error transferring mtd6ro_mod via tftp from the PC. ****
End of script - ready for the next run.
.
Checking that tftp works OK ...
[stage start] fixup_log.txt successfully transferrred to the PC via tftp
End of script - ready for the next run.
.
Checking that tftp works OK ...
End of script - ready for the next run.
.
Checking that tftp works OK ...
End of script - ready for the next run.
.
[Brick-fix tool] Initiating reboot into min-system
[Brick-fix tool] Initiating reboot into min-system
Checking that tftp works OK ...
End of script - ready for the next run.
.
Checking that tftp works OK ...
[stage start] fixup_log.txt successfully transferrred to the PC via tftp
End of script - ready for the next run.
.
[Brick-fix tool] Initiating reboot into min-system
Checking that tftp works OK ...
End of script - ready for the next run.
.
Checking that tftp works OK ...
End of script - ready for the next run.
.
[Brick-fix tool] Initiating reboot into min-system
[Brick-fix tool] Initiating reboot into min-system
Checking that tftp works OK ...
[stage start] fixup_log.txt successfully transferrred to the PC via tftp
End of script - ready for the next run.
.
Checking that tftp works OK ...
[stage start] fixup_log.txt successfully transferrred to the PC via tftp
End of script - ready for the next run.
.
Checking that tftp works OK ...
[stage start] fixup_log.txt successfully transferrred to the PC via tftp
End of script - ready for the next run.
.
Checking that tftp works OK ...
[stage start] fixup_log.txt successfully transferrred to the PC via tftp
End of script - ready for the next run.
.
Checking that tftp works OK ...
[stage start] fixup_log.txt successfully transferrred to the PC via tftp
End of script - ready for the next run.
.
 
nambi said:
Will there be a point where I messed this beyond repair?
Click to expand...
No, there isn't anything that's not recoverable being done here.
You are separated from the very important component - the bootloader - and you are not manually writing over the flash partitions.

nambi said:
I think running the rm /dav/fixup_stage* I screwed up because in the log now I see it's looking for files there that are missing.
Click to expand...
Deleting the file indicating the current stage won't cause any problems.

nambi said:
I can't get this file it doesn't extract.
Click to expand...
The telnet transcript does show that the mtd6ro_orig file is extracted, and transferred out.
Your task after Stage1 is to make a copy of that file, named as mtd6ro_mod and use the hex editor to modify the language value, possibly the dev_type value, and update the checksum.
From the step-by-step guide:
On success with Stage 1, check the PC folder that the tftp server is running in for the presence of the file 'mtd6ro_orig'. You may have to hit F5 to refresh. Make a copy of mtd6ro_orig rename to mtd6ro_mod. Do the 'enhanced mtd hack' on it, using the instructions in the spoiler below.
Click to expand...
In Stage2, the /dav/fixup.sh script transfers in the mtd6ro_mod file and applies it to the flash partition.

You need to find where your tftp server is placing the files that get transferred to it.
That will be the key to success.

**edit** You are actually using a standard tftp server, not the Hikvision tftp updater?
It will only download files - not upload them.
 
Last edited:
alastairstevenson said:
The telnet transcript does show that the mtd6ro_orig file is extracted, and transferred out.
Your task after Stage1 is to make a copy of that file, named as mtd6ro_mod and use the hex editor to modify the language value, possibly the dev_type value, and update the checksum.
From the step-by-step guide:

I'm sorry for so much confusion over this, I did read through the post but issue is the mtd6ro_orig file is not appearing in my directory. from my understanding when running the fixup.sh it should suck it out of the camera for me to modify it.


I ran both TFTP programs while having putty open to try, which one should I use? I left the cams at the office so I can't try anything new until tomorrow but I'm wondering if I need to run these tools out of a specific directory, maybe my write permissions are preventing these from being created. Is there a manual way I can log into the cam and download this outside the script?

I wish I could start this from scratch.

Is the fixup.sh file built into the camera from hikvision? or was this injected into the camera from the TFTP program 1st run?
Click to expand...
 
The brickfixV2 method can be started again from scratch.
Just follow the process again from the beginning.
At the start use the Hikvision tftp updater and the same brickfixV2CN firmware file, renamed as digicap.dav
Then after that is done - shut down the Hikvision tftp updater and use the standard tftp server for Stage 2 and 3.

The /dav/fixup.sh script is one that I created, to simplify what was quite a technical process, hide some of the detail that can be confusing.
It is incorporated into the brickfixV2CN and EN firmware.
 
Thanks for all the advice and hard work you did helping the community out.

I've read through the instructions I'm not trying to skip steps and be lazy.

I'm just stuck as the mtd6ro_orig isn't being transferred into the PC, I'll try again tomorrow.

If the mtd6ro_orig isn't being populated in the folder anyway to manually extract this out of the camera?
 
I'm back at it, I tried running the programs in different directories on the PC with full permissions the mtd6ro_orig does transfer over.

What flags me the most is the 1st error. i see on the screen (not in the log file)

the next stage is :
la /dav/fixup_stage:No such file or directory.

When I was having issues I ran
I think running the rm /dav/fixup_stage*

Which I assume is why I can't proceed.

This is the message I get on the screem
Code: 
This is the brick-fix and update script which will help you to extract,
modify and replace mtdblock6 to fix the downgrade block and convert this camera to English updateable.

** It is no longer necessary to make any changes to mtdblock1 - these have been processed already **
.
The whole process takes 3 stages.
Stage 1 - mtdblock6 is extracted and sent via tftp to your PC for you to modify.
Stage 2 - the modified mtdblock6 is retrieved by tftp from your PC and applied to the camera.
Stage 3 - the '5.3.0 to 5.2.5 downgrader' firmware is retrieved by tftp from your PC and used to update the camera.
At this point the web GUI in English will be available and allow
you to do progressive updates from 5.2.5 to 5.3.0 to 5.4.0 to 5.4.5
.
In each stage, check the content of the logfile fixup_log.txt for the actions taken and the status.
Good luck!
.
Checking that tftp works OK ...
tftp: timeout
.
Each stage of the process is carried out by a run of the /dav/fixup.sh script ...
The next stage is :
ls: /dav/fixup_stage*: No such file or directory
.
.

tftp: timeout

*** An error has occurred. Check the on-screen messages and the contents of the logfile   ***
*** fixup_log.txt that was transferred to your PC and after correcting the cause of the   ***
*** error re-run the script /dav/fixup.sh to resume.                                      ***
#

Also when examining fixup.sh

I see all paths are under /dav/ yet there is a /dev/mtd6ro to be copied, is this correct.
 
Last edited:
nambi said:
I think running the rm /dav/fixup_stage*
Which I assume is why I can't proceed.
Click to expand...
Yes, the initial version of that 'flag file' is created when the brickfixV2 firmware executes and drops its payload after being installed.
The contents do not matter. To save re-running the brickfixV2 firmware, you could simply re-create the initial version of the file like so, taken from the payload dump script :
Code: 
echo "Fixup stage1 completed - rollback payload dropped" > /dav/fixup_stage1.txt

nambi said:
I tried running the programs in different directories on the PC with full permissions the mtd6ro_orig does transfer over.
Click to expand...
Well, that's good.
So the problem was that the tftp server didn't have write access to the destination folder?
That makes sense.

nambi said:
I see all paths are under /dav/ yet there is a /dev/mtd6ro to be copied, is this correct.
Click to expand...
Yes, that is correct, it's the path to the 'device' that holds the flash partition inside which is the 'hardware descriptor block' which defines the individual camera options and detail such as serial number, model, language etc.

It looks like you on the finishing straight of this learning process. It will be fine.
 
SUCCESS!!! Thank you so much for the help it was the write permissions on the PC, this computer is part of a domain and it wouldn't allow the mtdblock6 file to be transferred, then when I finally changed permissions and used tftp32 (not hikvisions) the file came through, HUGE THANKS!!
 
Excellent!
I'm glad you got there, and maybe learned a few odd things along the way.
Done lots of that myself.
And thanks for sharing your experience. Good and less good, it's all helpful to the community here.
 
One more question I have many of these to update, I have a brand new cam Chinese with 5.2 on it, I updated it all went well. (at least I thought that it did)

I rebooted and tried to log in and I have the Language Mismatch Error, I figured I did something wrong in the Hex editing tried to log int via tftp and I not get connection refused. The cam has been updated to 5.45.

Any way to get this going again? I basically made it unusable on the new FW which prevents TFTP so I don't know what my options are on restoring this.
 
What is the model of camera?
When you say you updated it, do you mean that you used the brickfixv2 method on it but not successfully as you are getting the language mismatch error?
I'm not sure what you mean about the new firmware and tftp - can you explain?

If you zip up the mtd6ro orig and mod files and attach here I'll check them for you.
 
You must log in or register to reply here.
Top Bottom