R0 / DS-2CD2x32 BrickfixV2 brick recovery and full upgrade tool - enhanced.
- Thread starter alastairstevenson
- Start date
bathuudamdin
n3wb
Camera and pc are both connected to router. Need to find the 12v adapter then. Any idea what to use?
Any 12v 1.5A centre-positive power supply, widely available on eBay or even Amazon.
It's likely to be a timing problem.
You might get lucky if you just keep retrying the power cycling, than can happen.
For reference - my old Chinese DS-2CD3332-I which arrived with hacked english on it was also happy with the devtype
0898 - DS-2CD2332-I
Mark
0898 - DS-2CD2332-I
Mark
Hello
first of all a big thank you to
alastairstevenson for the time he spends helping on this forum.
I try to unlock an intercom from hik DS-KV8102A from the Chinese market.
until the last firmware I arrived with hiktools05R1 to load the new DIGICAP.DAV.
since the last, it hangs, without briquing, with the message: language incompatible with the client.
so I will try the method "Brick-fix tool V2"
however, I stall on: "Ideally the true value is determined from the 'devType' line from the prtHardInfo shell command,"
question: how do we activate this command "prtHardInfo shell". Do you need a tool other than those described in the procedure?
thank you for responding to my request. I can attach the DIGICAP.DAV files from the device, but we can easily find them on the FTP hik europe.
first of all a big thank you to
alastairstevenson for the time he spends helping on this forum.
I try to unlock an intercom from hik DS-KV8102A from the Chinese market.
until the last firmware I arrived with hiktools05R1 to load the new DIGICAP.DAV.
since the last, it hangs, without briquing, with the message: language incompatible with the client.
so I will try the method "Brick-fix tool V2"
however, I stall on: "Ideally the true value is determined from the 'devType' line from the prtHardInfo shell command,"
question: how do we activate this command "prtHardInfo shell". Do you need a tool other than those described in the procedure?
thank you for responding to my request. I can attach the DIGICAP.DAV files from the device, but we can easily find them on the FTP hik europe.
Attachments
No - the brickfixV2 method is for R0 series cameras only - it is not for doorbells or door stations or for any other series.
These are EN/ML files that will not work on a Chinese door station device. As you have discovered.
thank you for these clarifications.
however I successfully use the an / ml versions with the "hiktools05R1.exe" tool
Who is it for R0 cameras?
I just want to try this method and for that I do not have the answer to the question I ask on the forum.
imagine that it works, i would be happy to share it with you.
imagine that it works, i would be happy to share it with you.
If the camera supports it - you need to be able to get to a command shell to issue the command.
Some of the newer firmware allows ssh access :
Code:
alastair@PC-I5 ~ $ ssh admin@192.168.1.102
admin@192.168.1.102's password:
BusyBox v2.0.0-548754 Protect Shell (psh)
Enter 'help' for a list of davinci system commands.
# prtHardInfo
Start at 2020-03-09 13:41:18
Serial NO :IPC-T2347G-LU20191006AAWRD68543108
V5.6.4 build 191224
NetProcess Version: 8.11.3 [09:37:40-Oct 31 2019]
Path: /Camera/Platform/Branches/branches_FSP_network_protocol/shizhi/FSP_network_protocol_chanpin_G1_V5.6.4
Last Changed Rev: 635684
Last Changed Date: 2019-10-30 15:51:14 +0800 (Wed, 30 Oct 2019)
Sec Version: 1.0.1 [16:47:42-Mar 20 2019]
Path: /Camera/Platform/Trunk/FSP_network_security
Last Changed Rev: 460994
Last Changed Date: 2018-11-09 14:26:28 +0800 (Fri, 09 Nov 2018)
Db Encrypt Version: 131072
hardwareVersion = 0x0
hardWareExtVersion = 0x0
encodeChans = 1
decodeChans = 1
alarmInNums = 0
alarmOutNums = 0
ataCtrlNums = 0
flashChipNums = 0
rms = 0x200
networksNums = 1
language = 1
devType = 0x26006
net reboot count = 0
vi_type = 62
hardwareType = 1
firmwareCode = 0000000200000100000000010c91bc6f000000010000000100000002ffffffff0506000400130c1800026006
Path: /Camera/Platform/Branches/branches_frontend_software_platform/IPC_develop_branch/ipc_baseline/baseline_V5.6.0_IPC
Last Changed Rev: 671597
Last Changed Date: 2019-12-23 16:58:14 +0800 (Mon, 23 Dec 2019)
#
thank you
I saw on a forum that one could use this command while passing by "PUTTY"
do you confirm ?
I will try the manipulation tomorrow and will keep you posted
I saw on a forum that one could use this command while passing by "PUTTY"
do you confirm ?
I will try the manipulation tomorrow and will keep you posted
Yes that's correct, the prtHardInfo command is also available via the serial console.
I want to ask the only question, why follow this long quest, if the old IP camera with the Chinese version of the firmware is in working condition, then it will be more convenient to make a service firmware that will make the necessary changes yourself.
First off - thank you Asastair for the whole brickfix! Its pretty amazing what you were able to do! I have used it on 7 cameras sucessfully, but on one, it got stuck just like Bidon (TFTP stuck on test) on a 2CD2432F-IW that came with a hacked english 5.1.2. ran the I read through all the info on the last set of pages - but I don't currently have serial access. I have tried TFTP probably 50 times under different circumstances - 12v power on a switch, direct to computer, PoE... nothing.
Here is the wireshark capture in case anyone can make sense of that.
So, my question - is it worth trying to get a serial adapter up? I don't have the linux skills of Bidon, but can follow directions fairly well!
is there any other way to unbrick?
Here is the wireshark capture in case anyone can make sense of that.
So, my question - is it worth trying to get a serial adapter up? I don't have the linux skills of Bidon, but can follow directions fairly well!
is there any other way to unbrick?
Very good!
There is a single valid instance of the probe / response handshake in packets 533/534 - but no follow-on seen.
Which is a bit odd.
Presumably the brickfixV2 digicap.dav is still in the tftpserve.exe folder.
A bit of a long shot, for no real reason - your PC is extremely chatty on IPv6 - maybe temporarily disable IPv6 and see if that changes anything.
Also - if the camera isn't currently bricked, you should be able to use the web GUI as normal to do a firmware update using the brickfixV2 firmware (probably the EN header version), via the maintenance menu with the PC IP address as normal.
Then after the update is complete, change the PC IP address to 192.0.0.128 and proceed to Stage 2.
Hello
I come back to you to declaw.
reminder: door phone DS KV 8102A.
brickfixV2EN loading without result;
brickfixV2CH loading: "Completed file [D: \ tftpserv \ tftpserv \ digicap.dav] transmit"
as when I load a firmware;
I never have the indication: "System update complete"
Unable to communicate with PuTTY.
at this point, on SADP the intercom address is 192.0.0.65 and not 64 with a gateway at 192.0.0.1
here is
I can no longer upgrade my device
thanks again for these great tips
are you doing well
bye
I come back to you to declaw.
reminder: door phone DS KV 8102A.
brickfixV2EN loading without result;
brickfixV2CH loading: "Completed file [D: \ tftpserv \ tftpserv \ digicap.dav] transmit"
as when I load a firmware;
I never have the indication: "System update complete"
Unable to communicate with PuTTY.
at this point, on SADP the intercom address is 192.0.0.65 and not 64 with a gateway at 192.0.0.1
here is
I can no longer upgrade my device
thanks again for these great tips
are you doing well
bye
The firmware is being downloaded then rejected as being invalid for the device.
I can't get to it via web, batch updater or any hiktools - even when I had no web interface on the old bricked cameras I could get rstp, but not this one.
turned off ipv6 - similar result - just the "test tftpservier"
yes, the brickfixv2 digicap is still in the tftp server - seems to be failing its tftpserver test...
That is odd.
The initial handshake is normal - the tftp updater responds, but then no follow-on from the camera.
There is the tftp updater clone, by Scott Lamb, but this has only been useful when the digicap.dav file exceeds 32MB, which is not the case here.
GitHub - scottlamb/hikvision-tftpd: Unbrick a Hikvision device (NVR or camera) via TFTP
Unbrick a Hikvision device (NVR or camera) via TFTP - scottlamb/hikvision-tftpd
github.com
I suspect if you want to spend the time to explore this further, it will have to be via the serial console.
Thanks - that is what I was worried about...That is odd.
The initial handshake is normal - the tftp updater responds, but then no follow-on from the camera.
There is the tftp updater clone, by Scott Lamb, but this has only been useful when the digicap.dav file exceeds 32MB, which is not the case here.
GitHub - scottlamb/hikvision-tftpd: Unbrick a Hikvision device (NVR or camera) via TFTP
Unbrick a Hikvision device (NVR or camera) via TFTP - scottlamb/hikvision-tftpd
I suspect if you want to spend the time to explore this further, it will have to be via the serial console.
same result with python version - "replied to magic handshake request." then nothing!
Let me crack this thing open!
thank you for the help!