R0 / DS-2CD2x32 BrickfixV2 brick recovery and full upgrade tool - enhanced.

[alastairstevenson]

Its like they all have the same SN and MAC addresses and conflicts are every where..

That does sound like you used the mtd6ro_mod from one camera and applied it to all cameras, rather than keeping the file specific to each camera.
The MAC address and serial numbers are held in mtd6ro
A duplicate MAC address on the network will disrupt and break LAN access for the cameras.

Did you keep the mtd6ro_orig separately stored for each camera?
Do you still have copies of the per-camera original files?

There are a couple of things to do :
The original bootpara data also exists in mtd5
If extracted, this could be used to edit mtd6ro_mod to get back to the original values.

Easier, but would not get the original values back, would be to edit the mtd6ro_mod for 2 of the cameras and make a minor change to the MAC address and the serial number, and the checksum, so the data isn't duplicated.

 

[medsy]

That does sound like you used the mtd6ro_mod from one camera and applied it to all cameras, rather than keeping the file specific to each camera.
The MAC address and serial numbers are held in mtd6ro
A duplicate MAC address on the network will disrupt and break LAN access for the cameras.

Did you keep the mtd6ro_orig separately stored for each camera?
Do you still have copies of the per-camera original files?

There are a couple of things to do :
The original bootpara data also exists in mtd5
If extracted, this could be used to edit mtd6ro_mod to get back to the original values.

Easier, but would not get the original values back, would be to edit the mtd6ro_mod for 2 of the cameras and make a minor change to the MAC address and the serial number, and the checksum, so the data isn't duplicated.

pretty sure I used the same file for 2 or more cameras..... also pretty sure I didn’t keep,the original files.... bugga
can u explain where I would find the MAC address, and how exactly to checksum it..?

 

[medsy]

If the changing of the MAC address cant be explained to easily, does anyone have 2x copies of a modded mtd6 that works with their SN/MAC addresses I can slip into my cameras....??? Im not sure if anyone would be comfortable or even if that is a security thing, but im sure as hell not smart enough to do anything with it, I just wanna flash em in and get my cameras going otherwise ive killed em for good.... I confirmed I used the same file for all 3x cams, they all have the same SN. So I can save one, and 2x to fix.....

Or, how the hell would I change and check the mac addresses....

 

[alastairstevenson]

Zip up your mtd6ro_mod file and attach here and I'll create a couple of modded clones for you to apply.

 

[medsy]

Many thankx kind sir..... hopefully this works

 

[alastairstevenson]

hopefully this works

It will be fine.
Attached are 2 files, one for each camera, with the minimum of changes to the MAC address and the serial number, and a re-calculated checksum.
It's probably easiest to go through the brickfixV2 process again, and this time just discard the mtd6ro_orig that comes out, and use one of the mtd6ro_mod files for each camera in stage 2.
Making sure not to apply the same file to both cameras ...

 

[medsy]

It will be fine.
Attached are 2 files, one for each camera, with the minimum of changes to the MAC address and the serial number, and a re-calculated checksum.
It's probably easiest to go through the brickfixV2 process again, and this time just discard the mtd6ro_orig that comes out, and use one of the mtd6ro_mod files for each camera in stage 2.
Making sure not to apply the same file to both cameras ...

Thankx again for your time/help buddy.... Happy to report all 3x cameras back in action and working fine.
Im pretty thorough, but clearly I rushed into updating this firmware for no real advanatages...oh well, learned something new....

Lesson to the punters, dont cheat and use the same mod file for each camera, each cam needs its own file with individusl Mac addresses..... lol

Thanks again matey....

 

[alastairstevenson]

That's a good result, finally ....
Well done for getting there.

 

[duyckie]

Hello

I have a Hikvision DS-2CD2132-I camera, On stage 3 i get "error doing the firmware update". I use

https://ipcamtalk.com/downloads/r0-series-ds-2cd2x32x-ixx-ip-camera-firmware.57/download

. fixup_log.txt in attachment. What can I do to make this work? Thanks in advance.

 

[alastairstevenson]

get "error doing the firmware update". I use

https://ipcamtalk.com/downloads/r0-series-ds-2cd2x32x-ixx-ip-camera-firmware.57/download

Yes, that's the 5.4.41 firmware. It can't be used as a straight jump from the min-system version that's running the brickfixV2.
Repeat Stage 3 with the 5.4.5 firmware, that usually works OK.
Strictly, firmware should be applied incrementally, but most people seem to get away with the big update to 5.4.5.

Your mtd6ro_mod looks OK.

 

[duyckie]

Yes, that's the 5.4.41 firmware. It can't be used as a straight jump from the min-system version that's running the brickfixV2.
Repeat Stage 3 with the 5.4.5 firmware, that usually works OK.
Strictly, firmware should be applied incrementally, but most people seem to get away with the big update to 5.4.5.

Your mtd6ro_mod looks OK.

Yes, it worked with this firmware (5.4.5). Thank you so much! After 5 years, the camera works again! Do you work at Hikvision maybe?

 

[alastairstevenson]

Thank you so much! After 5 years, the camera works again!

Excellent! And well done.
It's always good to hear of a successful de-bricking.
By the way - 5.4.41 is a little newer than 5.4.5, and is the 'official' and last, firmware for that camera, with the backdoor fix.
But 5.4.5 does not have the backdoor as far as I could tell.

Do you work at Hikvision maybe?

Lol!
Nope - definitely not.

 

[duyckie]

By the way - 5.4.41 is a little newer than 5.4.5, and is the 'official' and last, firmware for that camera, with the backdoor fix.

And is it safe to do this via the web interface? From 5.4.5 > 5.4.41?

But 5.4.5 does not have the backdoor as far as I could tell.

What do you mean exactly with "Does not have the backdoor"?

 

[alastairstevenson]

And is it safe to do this via the web interface? From 5.4.5 > 5.4.41?

Yes, you have converted your camera from CN to EN.

What do you mean exactly with "Does not have the backdoor"?

Backdoor found in Hikvision cameras

There have been rumours... I would like to confirm that there is a backdoor in many popular Hikvision products that makes it possible to gain full admin access to the device. Hikvision gets two weeks to come forward, acknowledge, and explain why the backdoor is there and when it is going to be...

ipcamtalk.com

 

[lukel]

Hello, thank you for all your hard work on this. I've spent today trying to unbrick a camera without success.

I have a DS-2CD2032F-I and have gone through the brickfix process (with both the CN and EN brickfix firmwares). I successfully flash with the brickfixv2 dav firmware, connect with telnet and extract and modify the mt6ro files (file attached), I get to step 3 and always successfully flash the updated English firmware (I tried with 5.4.5, 5.4, 5.3)--I always get the message the English firmware was successful and to power cycle the camera, but when I power cycle it seems that the camera is still bricked and I can't access it via web interface.

Any suggestions on where I could be going wrong or what else to try?

 

[lukel]

Would anyone have the 5.2.5, 5.2.8 or any earlier firmware for these cameras?? I can't seem to find a reliable source online, it would like to at least try those before calling this camera a loss

 

[alastairstevenson]

I always get the message the English firmware was successful and to power cycle the camera, but when I power cycle it seems that the camera is still bricked and I can't access it via web interface.

That's not good.
What does SADP show for the status and the firmware version?
The attached mtd6ro_mod looks OK, I don't see any problems with it.

If the camera is reverting to the min-system recovery mode on bootup, and you were interested to see why this is happening, you could connect to the serial console and follow the bootup messages.
This would need a couple of widely-available on eBay low-cost items :
A 4-pin 1.5mm ZH JST wired connector, usually sold in 10-packs.
A USB to TTL serial convertor, such as a PL2303HX-based device.

Would anyone have the 5.2.5, 5.2.8 or any earlier firmware for these cameras??

Not really available on-line any more.
But maybe try the attached old versions:

 

[alastairstevenson]

And a follow-on question :
What was the original cause of the camera 'bricking'?
I'm wondering if there may be an underlying hard ware issue.
Sometimes on these older cameras the flash memory can start to give errors.
There is no in-built correction in that hardware.

 

[alastairstevenson]

I just got it working, I wasn't using the proper firmware in the last step

Well, that's a good result, and a sigh of relief all round.
Thanks for the update.
It's easily done when all the firmware files are digicap.dav

 

[lukel]

And a follow-on question :
What was the original cause of the camera 'bricking'?
I'm wondering if there may be an underlying hard ware issue.
Sometimes on these older cameras the flash memory can start to give errors.
There is no in-built correction in that hardware.

The original cause was, in a moment of stupidity, I decided to upgrade an NOS grey market camera with the latest 5.4.5 EN firmware...
Flash memory wearing out is good to know and to keep in mind for the future as I use the camera