R0 / DS-2CD2x32 BrickfixV2 brick recovery and full upgrade tool - enhanced.

These series store the 'bootpara' data in a security chip, not in a flash partition, so not feasible to make a permanent change.
It would needed hacked firmware to alter on the fly the values read from the secured storage.
 
Alastair,

When I get to the step of sftp detecting the camera, it will not. The computer IP is set properly, SADP detects the camera and I even disabled other network adapters. I've followed your video exactly but the server never detects the camera. Running windows 7. Any ideas?
 
treetop82 said:
the server never detects the camera.
Click to expand...
On power-on, the camera probes for the Hikvision tftp updater (this is not a standard tftp server, it's specific to Hikvision) with a UDP network packet and it responds with a handshake.
It's best to have the camera and PC wired as normal to your switch/router.
Wiring directly between them, and powering over PoE, can give variable results, sometimes needs a few retries before they connect.

The Windows PC must allow the camera probe inbound through the Windows firewall.
Check inbound firewall rules for 'tftpserve.exe'.
Assuming you clicked 'OK' to the firewall popup when first running the Hikvision tftp updater, that rule should have been created automatically.

What messages show on the window of the tftp updater?
 
I have followed you fix tool to the letter. I have successfully unbricked an NVR and was able to get all are Hikvision cameras back up on 2 NVR's in 2 buildings thanks to your instructions . However, I have one camera I can't get to work. It is an DS-2CD2032F-I. I was able to get to the end of this fix, Putty said the firmware was successfully installed, but when I pull up the camera in SADP is looks off the serial says "DS-2CD-Min-System" which the others have their model number in that spot. the NVR says network unreachable. I know I'm using the correct IP on the camera like all the others I've added before it. We have a 2nd unused DS2CD2032F-I and I went through your steps to unbrick that one. same issue in the end. I did the 2nd one fresh in a different folder I notised the Hex editor checksum-16 was different values so I know it was not a copy of the first cam. I used your resources and downloaded older firmware from this site and stil nothing will let these 2 cameras work on the NVR. I've suxsessfully unbricker other cameras for our set up using your tools. I can't understand why I can't get these 2 to work?
 
The cameras are running the min-sys recovery firmware, usually due to something that stops the full system booting completely.
That might be due to the contents of mtd6ro_mod
If you attach a copy this can be checked.

What was the version of firmware that you used for the Stage 3 part of the process?
5.4.5 is the newest that would work at that point. 5.4.41 would cause a failure.
 
alastairstevenson said:
The cameras are running the min-sys recovery firmware, usually due to something that stops the full system booting completely.
That might be due to the contents of mtd6ro_mod
If you attach a copy this can be checked.

What was the version of firmware that you used for the Stage 3 part of the process?
5.4.5 is the newest that would work at that point. 5.4.41 would cause a failure.
Click to expand...
I attached the edited mtd6ro_mod file. the camera is a DS-2CD2032F-I. When I try step three in PuTTY to install 5.4.5 the process errors. I tried every older versions of the firmware, "5.3.3", "5.3.0", "5.2.3" and they completed successfully, but the camera would not populate in SADP. I double-triple checked the mtd6ro_mod file but maybe a second set of eyes could help, Thanks!
 

Attachments

Last edited:
Solider said:
maybe a second set of eyes could help
Click to expand...
I have looked at the mtd6ro_mod file that you attached, and it looks good to me, I do not see any errors.
The language is EN, devType is 2698 and the checksum is correct.
As a long shot - maybe try 0598 for the devtype.

Solider said:
I tried every older versions of the firmware, "5.3.3", "5.3.0", "5.2.3" and they completed successfully, but the camera would not populate in SADP
Click to expand...
That does seem odd.
Does a telnet access connect to the camera after one of those earlier versions has been applied?

A question : Did mtdblock6 ever get written to the camera when the running firmware was 5.3.0 or higher?
There is quite a nasty trap that is invoked under those circumstances.

I think the only way to trouble-shoot this would be to connect to the serial console, and observe the messages.
 
alastairstevenson said:
I have looked at the mtd6ro_mod file that you attached, and it looks good to me, I do not see any errors.
The language is EN, devType is 2698 and the checksum is correct.
As a long shot - maybe try 0598 for the devtype.


That does seem odd.
Does a telnet access connect to the camera after one of those earlier versions has been applied?

A question : Did mtdblock6 ever get written to the camera when the running firmware was 5.3.0 or higher?
There is quite a nasty trap that is invoked under those circumstances.

I think the only way to trouble-shoot this would be to connect to the serial console, and observe the messages.
Click to expand...
It had 5.3.0 when I used the brickfix2
 
Last edited:
Solider said:
It had 5.3.0 when I used the brickfix2
Click to expand...
That's OK unless that environment was used for manually copying mtd6ro on to the camera, before trying the brickfixV2 method, if that makes sense.
But does that mean it wasn't a Chinese camera? Did the mtd6ro_orig have 02 or 01 in location 0x10 ?

BrickfixV2 uses a recovery environment to copy the file on to the flash, so the original firmware version doesn't matter.
 
alastairstevenson said:
That's OK unless that environment was used for manually copying mtd6ro on to the camera, before trying the brickfixV2 method, if that makes sense.
But does that mean it wasn't a Chinese camera? Did the mtd6ro_orig have 02 or 01 in location 0x10 ?

BrickfixV2 uses a recovery environment to copy the file on to the flash, so the original firmware version doesn't matter.
Click to expand...
the first time I ran it, it had a 01 in location 0x10 I believe it was already an English camera. I did try the code 05 98 and recalculate the checksum to get the same outcome. Is there any way to bring the camera back to life?
 
Last edited:
alastairstevenson said:
That's OK unless that environment was used for manually copying mtd6ro on to the camera, before trying the brickfixV2 method, if that makes sense.
But does that mean it wasn't a Chinese camera? Did the mtd6ro_orig have 02 or 01 in location 0x10 ?

BrickfixV2 uses a recovery environment to copy the file on to the flash, so the original firmware version doesn't matter.
Click to expand...
I just got the 5.4.5 to finish successfully from PuTTY and the fix tool v2. Before I ran PuTTY to install the firmware the SADP tool was able to see the camera as mini-system, that is the fixv2 renamed digicap installed. But after I finish the steps to install the camera's 5.4.5 firmware through PuTTY, SADP can not see the camera. I'm at a loss here.
 
That is strange. I can't think of a normal reason for that, or any other suggestions to fix it.
The detail of the problem would be visible in the serial console.
There could be a hardware issue.
Where are you based?
 
If this was originally an English camera - what was the reason for using the briickfixV2 method?
Had the device stopped working?

As a long shot - check that the reset button on the back of the body isn't stuck in.
 
alastairstevenson said:
If this was originally an English camera - what was the reason for using the briickfixV2 method?
Had the device stopped working?

As a long shot - check that the reset button on the back of the body isn't stuck in.
Click to expand...
I have 2 same model cameras, both with the same issues. I only need 1 to be working. I tried the same steps for both, using 2 separate folders to not mix up the _mod files created and edited. Both cameras had slightly different checksum-16 values.

I was trying to get one back up and working, so I did the factory reset, hold down the reset button for 30 seconds are plugging into power. THey did not show up on the SAPD tool like other hikvision cameras I had recently reset successfully. So I tried to use the brickfix tools like I did successfully with one of our NVR's. Why I think the camera might work is that the SADP tool will show the camera after I load the brickfixv2 as digicap.dav. The SADP tool has the 192.0.0.64 IP address for the cam and I can ping the camera. This leads me to believe that it should hold the firmware and show up on the SADP tool after it is installed. The company I work for did not purchase their equipment from a Hikvision source but rather a 3rd party so I have no vender support to turn too. I read over how to access the serial console and would have to order the parts needed.
 
Solider said:
I read over how to access the serial console and would have to order the parts needed.
Click to expand...
These are very cheap, but can take a while to arrive if not locally sourced.
A serial TTL to USB convertor, usually a PL2303HX-based device, 'for Arduino' for example.
A 4-pin 1.5mm JST ZH wired connector, usually sold in 10-packs.

Where are you based?
 
So many people have thanked you and i wanted to take the time to also do the same. Years and years my cameras been flawless, recently got an upgraded NVR and thought i should also do some upgrades on software from 5.2.0 and of course, language mismatch, but being armed with this tool and some time without distractions, what would often have been a very stressful situation was *SO EASILY* resolved by this information and tool and i cannot begin to thank you and all those who have contributed to this process over time.

I don't think i'm going to risk touching my old NVR with 3.0.5 until i also have a plan if it all goes bad !
 
:( ...ive so spent 48hrs trying to get my 3x cameras back working.... I can get each individual one going, but when trying to use all 3x together the whole show crashes down. Its like they all have the same SN and MAC addresses and conflicts are every where..

What am I doing wrong....??? 3x 2CS2032-I models.... all 3x CN.
 
You must log in or register to reply here.
Top Bottom