R0 / DS-2CD2x32 BrickfixV2 brick recovery and full upgrade tool - enhanced.

[alastairstevenson]

I also made 1 NFS shared folder on my QNAP ..
my shared NFS folder should look like this:
nfs 192.168.2.155:/Public

That's good.
Unzip the attachment from here into the root of the NFS share.
Power on the camera, and at the root shell # prompt, copy / paste these commands one at a time -
(change the IP address 192.168.2.154 if already in use)

/bin/mount -t proc proc /proc
/bin/mount -t sysfs sysfs /sys
/bin/mount -t ramfs ramfs /home
/etc/S_udev
ifconfig eth0 192.168.2.154 up
mount -t nfs -o nolock 192.168.2.155:/Public /mnt/nfs00
cat /mnt/nfs00/mtdblock11 > /dev/mtdblock11
cat /mnt/nfs00/mtdblock13 > /dev/mtdblock13
cat /mnt/nfs00/mtdblock8 > /dev/mtdblock8
reboot

When the device reboots, use the command -
/etc/init.d/rcS

And see if SADP finds the camera.
If so - put the bootloader variable bootargs back to the original value and reboot.
Hopefully at that point, the camera will be working with the 5.2.5 firmware version.

 

[rumenn]

I tried it, but unfortunately mtdblock13 and mtdblock8 end up with a lot of errors that I don't know what they mean ..
only mtdblock11 shows no errors ..

mount -t nfs -o nolock 192.168.2.155:/Public /mnt/nfs00
# cat /mnt/nfs00/mtdblock11 > /dev/mtdblock11
# cat /mnt/nfs00/mtdblock13 > /dev/mtdblock13
[ 251.566012] fio_dma_parse_error: fio dma read error 0x5000800.
[ 251.571890] ambarella-nand ambarella-nand: nand_amb_request: cmd=0xe, addr_hi=0x0, addr=0x2cc0000, dst=0x0, buf=0xc595c000, len=0x800, area=0x2, ecc=0x2, block addr=0x2cc0000!
[ 251.592509] fio_dma_parse_error: fio dma read error 0x5000800.
[ 251.598395] ambarella-nand ambarella-nand: nand_amb_request: cmd=0xe, addr_hi=0x0, addr=0x2cc0800, dst=0x0, buf=0xc595c000, len=0x800, area=0x2, ecc=0x2, block addr=0x2cc0000!
[ 251.642505] fio_dma_parse_error: fio dma read error 0x5000800.
[ 251.648384] ambarella-nand ambarella-nand: nand_amb_request: cmd=0xe, addr_hi=0x0, addr=0x2cc1000, dst=0x0, buf=0xc595c000, len=0x800, area=0x2, ecc=0x2, block addr=0x2cc0000!
[ 251.692524] fio_dma_parse_error: fio dma read error 0x5000800.
[ 251.698406] ambarella-nand ambarella-nand: nand_amb_request: cmd=0xe, addr_hi=0x0, addr=0x2cc1800, dst=0x0, buf=0xc595c000, len=0x800, area=0x2, ecc=0x2, block addr=0x2cc0000!
[ 251.756391] end_request: I/O error, dev mtdblock13, sector 9472
[ 251.762338] Buffer I/O error on device mtdblock13, logical block 1184
[ 251.768777] lost page write due to I/O error on mtdblock13
[ 251.778209] fio_dma_parse_error: fio dma read error 0x5000800.

.
.
.etc...to the end

# cat /mnt/nfs00/mtdblock8 > /dev/mtdblock8
[ 275.988155] nand_erase_nand: attempt to erase a bad block at page 0x00000dc0
[ 275.995336] mtdblock: erase of region [0xc0000, 0x20000] on "rcvy" failed
[ 276.002226] end_request: I/O error, dev mtdblock8, sector 1792
[ 276.008079] quiet_error: 22 callbacks suppressed
[ 276.012707] Buffer I/O error on device mtdblock8, logical block 224
[ 276.018976] lost page write due to I/O error on mtdblock8
[ 276.024606] nand_erase_nand: attempt to erase a bad block at page 0x00000dc0
[ 276.031678] mtdblock: erase of region [0xc0000, 0x20000] on "rcvy" failed
[ 276.038562] end_request: I/O error, dev mtdblock8, sector 1800
[ 276.044423] Buffer I/O error on device mtdblock8, logical block 225
[ 276.050688] lost page write due to I/O error on mtdblock8
[ 276.056374] nand_erase_nand: attempt to erase a bad block at page 0x00000dc0
[ 276.063544] mtdblock: erase of region [0xc0000, 0x20000] on "rcvy" failed
[ 276.070354] end_request: I/O error, dev mtdblock8, sector 1808
.
.
.
etc...to the end

in fact the camera appeared on the network, now I will try to update to 5.2.5 with tftp

 

[alastairstevenson]

It seems the flash is not very healthy.
That's probably the underlying cause of the problems.
But at least the min-system seems to be operating, so the update command in the bootloader should work.

 

[rumenn]

in fact what is the original value of bootloader variable bootargs?
and how to try updating with a command in the bootloader?
with tftp camera update but returned to previous state in shell and is not found in the network

 

[devastator]

I bought the my DS-2CD2732F-IS from an authorized reseller in the Netherlands. I tried to upgrade yesterday (downloaded from the American website), but after the upgrade the camera doesn't come online anymore. I downloaded TFTP and the european SW version (are they different), and managed to upload the file to my camera. However, after the transmit completed, it doesn't do anything anymore. I don't get the System update completed message (not even after 10 minutes) ...

What should i do next ?

 

[alastairstevenson]

What should i do next ?

What does SADP show if anything for the camera status and firmware version?

 

[devastator]

SADP didn't show anything. After flashing the CN version, it showed the update complete message.
Guess I will contact my reseller why he sold me a chinese version.

 

[alastairstevenson]

Guess I will contact my reseller why he sold me a chinese version.

Alternatively - you could attempt a brickfix and conversion to EN and update :
Unbrick and fully upgrade your R0 / DS-2CD2x32 IP cameras -
R0 / DS-2CD2x32 BrickfixV2 brick recovery and full upgrade tool - enhanced.

 

[devastator]

That is what I did. Thanks for the excellent tutorial.
However, I've bought 10+ cams from a reseller in the region, just to avoid this mess. I knew the problems with chinese hacked versions, and i wanted to avoid that. Otherwise I could have just sold em directly on ali or the like

 

[alastairstevenson]

in fact what is the original value of bootloader variable bootargs?
and how to try updating with a command in the bootloader?
with tftp camera update but returned to previous state in shell and is not found in the network

OK, let's re-visit the manual recovery process, if you wish.
Though I have a suspicion that the flash memory is failing.
For a complete flash refresh, attached is the partition that holds the kernel, to add to the others in the NFS Public share on the NAS.

The procedure and commands are as follows :
First, interrupt the bootloader and change the bootargs variable value and reset the system -

setenv bootargs console=ttyS0 initrd=0xc0a00000,0x400000 rw root=/dev/ram dbg=9 debug single
saveenv
reset

Then, when it boots up to an ash root shell, copy / paste the following commands, one line at a time, changing the NAS and camera IP address to match your network if needed.

mount -t proc proc /proc
mount -t sysfs sysfs /sys
mount -t ramfs ramfs /home
/etc/S_udev

ifconfig eth0 192.168.2.154 up

mount -t nfs -o nolock 192.168.2.155:/Public /mnt/nfs00

ls -al /mnt/nfs00/mtdblock*

cat /mnt/nfs00/mtdblock8 > /dev/mtdblock8
cat /mnt/nfs00/mtdblock9 > /dev/mtdblock9
cat /mnt/nfs00/mtdblock9 > /dev/mtdblock10
cat /mnt/nfs00/mtdblock11 > /dev/mtdblock11
cat /mnt/nfs00/mtdblock11 > /dev/mtdblock12
cat /mnt/nfs00/mtdblock13 > /dev/mtdblock13
cat /mnt/nfs00/mtdblock13 > /dev/mtdblock14

If the flash is still working OK, there should be no errors above.

When done use 'reboot' and interrupt the bootloader, and put the bootargs value back to the original.

setenv bootargs console=ttyS0 initrd=0xc0a00000,0x400000 rw root=/dev/ram dbg=0
saveenv
reset

And check the result.

Below for reference is an example transcript I just made of the same process.

Spoiler: Example transcript

Worked example of firmware re-flash without using the update facility.


HKVS #
HKVS #
HKVS #
HKVS #
HKVS #
HKVS #
HKVS #
HKVS # printenv
ipaddr=192.0.0.64
serverip=192.0.0.128
gatewayip=0.0.0.0
netmask=255.255.255.0
ethaddr=28:57:be:23:3c:ea
loadaddr=0xc2000000
bootfile=digicap.dav
bootcmd=null
bootargs=console=ttyS0 initrd=0xc0a00000,0x400000 rw root=/dev/ram dbg=9 debug single
bootdelay=2
HKVS #
HKVS #
HKVS #
HKVS #
ŠKVS # reset

U-Boot 1.3.4-121219 (Apr  8 2015 - 14:34:29)

ARM Clock: 480MHz
DDR Clock: 336MHz
Hit Ctrl+u to stop autoboot: 0
|BIND err|
Unknown command:null
booting from pri part...
load kernel...
load ramdisk...
[    0.000000] Linux version 2.6.38.8 (chenyuanming@Cpl-Frt-BSP) (gcc version 4.6.1 (Sourcery CodeBench Lite 2011.09-70) )
[    0.000000] #18 PREEMPT Thu Jan 21 17:27:08 CST 2016
[    0.000000] CPU: ARMv6-compatible processor [4117b365] revision 5 (ARMv6TEJ), cr=00c5387f
[    0.000000] CPU: VIPT nonaliasing data cache, VIPT nonaliasing instruction cache
[    0.000000] Machine: Coconut
[    0.000000] Memory policy: ECC disabled, Data cache writeback
[    0.000000] Ambarella: AHB   = 0x60000000[0xf0000000],0x01000000 0
[    0.000000] Ambarella: APB   = 0x70000000[0xf1000000],0x01000000 0
[    0.000000] Ambarella: PPM   = 0xc0000000[0xe0000000],0x00200000 9
[    0.000000] Ambarella: BSB   = 0xc8c00000[0xe8c00000],0x00400000 9
[    0.000000] Ambarella: DSP   = 0xc9000000[0xe9000000],0x07000000 9
[    0.000000] Ambarella: HAL   = 0xc00a0000[0xfee00000],0x0000e708 9
[    0.000000] On node 0 totalpages: 25344
[    0.000000] free_area_init_node: node 0, pgdat c0563180, node_mem_map c0589000
[    0.000000]   Normal zone: 198 pages used for memmap
[    0.000000]   Normal zone: 0 pages reserved
[    0.000000]   Normal zone: 25146 pages, LIFO batch:7
[    0.000000] bootmem_init: high_memory = 0xc8a00000
[    0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
[    0.000000] pcpu-alloc: [0] 0
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 25146
[    0.000000] Kernel command line: console=ttyS0 initrd=0xc0a00000,0x400000 rw root=/dev/ram dbg=9 debug single KRN_PRT=pri RMD_PRT=pri reserved=0xc6500000,0x100000,99 video=amb0fb:720x480,720x480,1,0
[    0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Memory: 99MB = 99MB total
[    0.000000] Memory: 90656k/90656k available, 10720k reserved, 0K highmem
[    0.000000] Virtual kernel memory layout:
[    0.000000]     vector  : 0xffff0000 - 0xffff1000   (   4 kB)
[    0.000000]     fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
[    0.000000]     DMA     : 0xfe600000 - 0xfee00000   (   8 MB)
[    0.000000]     vmalloc : 0xc9000000 - 0xe0000000   ( 368 MB)
[    0.000000]     lowmem  : 0xc0000000 - 0xc8a00000   ( 138 MB)
[    0.000000]     modules : 0xbf000000 - 0xc0000000   (  16 MB)
[    0.000000]       .init : 0xc0008000 - 0xc002d000   ( 148 kB)
[    0.000000]       .text : 0xc002d000 - 0xc052f000   (5128 kB)
[    0.000000]       .data : 0xc0530000 - 0xc0563820   ( 207 kB)
[    0.000000] Preemptable hierarchical RCU implementation.
[    0.000000]  RCU-based detection of stalled CPUs is disabled.
[    0.000000]  Verbose stalled-CPUs detection is disabled.
[    0.000000] NR_IRQS:224
[    0.000000] sched_clock: 32 bits at 72MHz, resolution 13ns, wraps every 59652ms
[    0.000000] sched_clock: wrong multiply/shift: 1864135111>>27 vs calculated 3728270222>>28
[    0.000000] sched_clock: fix multiply/shift to avoid scheduler hiccups
[    0.000000] Console: colour dummy device 80x30
[    0.000000] console [ttyS0] enabled
[    0.274238] Calibrating delay loop... 525.92 BogoMIPS (lpj=2629632)
[    0.532811] pid_max: default: 32768 minimum: 301
[    0.537820] Mount-cache hash table entries: 512
[    0.543130] CPU: Testing write buffer coherency: ok
[    0.554587] NET: Registered protocol family 16
[    0.569507] Ambarella Coconut:
[    0.572809]  chip id:                5100
[    0.575611]  board type:             3
[    0.578399]  board revision:         10
[    0.581771]  chip name:              a5m
[    0.584670]  HAL version:            176869
[    0.587989]  reference clock:        24000000
[    0.591819]  system configuration:   0x173804ea
[    0.596189]  boot type:              0x00000002
[    0.599679]  hif type:               0x00000000
[    0.628877] bio: create slab <bio-0> at 0
[    0.635560] ambarella-spi ambarella-spi.0: ambarella SPI Controller 0 created
[    0.653015] ambarella-i2c ambarella-i2c.0: Ambarella Media Processor I2C adapter[i2c-0] probed!
[    0.663399] ambarella-i2c ambarella-i2c.1: Ambarella Media Processor I2C adapter[i2c-1] probed!
[    0.673609] i2c i2c-0: Added multiplexed i2c bus 2
[    0.678427] ambarella-i2cmux ambarella-i2cmux.0: mux on ambarella-i2c adapter
[    0.688431] Advanced Linux Sound Architecture Driver Version 1.0.23.
[    0.698501] cfg80211: Calling CRDA to update world regulatory domain
[    0.706348] Switching to clocksource ambarella-cs-timer
[    0.720182] Switched to NOHz mode on CPU #0
[    0.776320] NET: Registered protocol family 2
[    0.781013] IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.789145] TCP established hash table entries: 4096 (order: 3, 32768 bytes)
[    0.796566] TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
[    0.803218] TCP: Hash tables configured (established 4096 bind 4096)
[    0.809581] TCP reno registered
[    0.812830] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.818701] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.825658] NET: Registered protocol family 1
[    0.830765] RPC: Registered udp transport module.
[    0.835637] RPC: Registered tcp transport module.
[    0.840364] RPC: Registered tcp NFSv4.1 backchannel transport module.
[    0.847336] Trying to unpack rootfs image as initramfs...
[    0.855127] rootfs image is not initramfs (no cpio magic); looks like an initrd
[    0.895522] Freeing initrd memory: 4096K
[    0.902354] [ kernel version:  svn-174544 ]
[    0.906618] mmc0 power register success!
[    0.910567] mmc1 power register success!
[    0.914868] reboot times :8
[    0.943344] msgmni has been set to 185
[    0.956013] alg: No test for stdrng (krng)
[    0.960254] io scheduler noop registered
[    0.964470] io scheduler deadline registered
[    0.968913] io scheduler cfq registered (default)
[    0.977256] ambarella-fb ambarella-fb.0: probe p[720x480] v[720x576] c[1] b[0] l[736] @ [0xc5980000:0x00068000]!
[    0.989319] ambarella-uart.0: ttyS0 at MMIO 0x70005000 (irq = 9) is a ambuart
[    1.035157] brd: module loaded
[    1.051884] loop: module loaded
[    1.058350] NAND device: Manufacturer ID: 0x01, Chip ID: 0xf1 (AMD NAND 128MiB 3,3V 8-bit)
[    1.066976] ambarella_nand_config_flash: 0x02e00140, 0x02c00140
[    1.073422] Bad block table found at page 65472, version 0x01
[    1.079635] Bad block table found at page 65408, version 0x01
[    1.090875] ambarella-nand ambarella-nand: ambarella_nand_probe: Partition infomation found!
[    1.099452] Creating 18 MTD partitions on "ambnand":
[    1.104518] 0x000000000000-0x000000020000 : "bst"
[    1.113093] 0x000000020000-0x000000120000 : "ptb"
[    1.121357] 0x000000120000-0x000000220000 : "bld"
[    1.129917] 0x000000220000-0x000000320000 : "hal"
[    1.138485] 0x000000320000-0x000000420000 : "ano_ptb"
[    1.147426] 0x000000420000-0x0000004a0000 : "env"
[    1.156122] 0x0000004a0000-0x000000520000 : "param"
[    1.164983] 0x000000520000-0x000000620000 : "dpt"
[    1.173696] 0x000000620000-0x000001020000 : "rcvy"
[    1.182600] 0x000001020000-0x000001820000 : "krn_pri"
[    1.191340] 0x000001820000-0x000002020000 : "krn_sec"
[    1.200380] 0x000002020000-0x000002420000 : "rmd_pri"
[    1.209395] 0x000002420000-0x000002820000 : "rmd_sec"
[    1.218495] 0x000002820000-0x000004020000 : "app_pri"
[    1.227642] 0x000004020000-0x000005820000 : "app_sec"
[    1.236877] 0x000005820000-0x000005c20000 : "cfg_pri"
[    1.246070] 0x000005c20000-0x000006020000 : "cfg_sec"
[    1.255369] 0x000006020000-0x000007020000 : "dbg"
[    1.270684] PPP generic driver version 2.4.2
[    1.276481] PPP Deflate Compression module registered
[    1.281557] PPP BSD Compression module registered
[    1.478596] Ambarella MII Bus: probed
[    1.483937] ambarella-eth ambarella-eth.0: MAC Address[28:57:be:23:3c:ea].
[    1.491546] console [netcon0] enabled
[    1.495388] netconsole: network logging started
[    1.501438] mousedev: PS/2 mouse device common for all mice
[    1.508172] input: AmbInput as /devices/virtual/input/input0
[    1.514952] ambarella_gpio_irq_set_wake: irq[75] = girq[11] = 1
[    1.520898] ambarella-input ambarella-input: AmbInput probed!
[    1.527755] ambarella-adc ambarella-adc: ADC Host Controller [polling mode] probed!
[    1.537144] ambarella-rtc ambarella-rtc: rtc core: registered ambarella-rtc as rtc0
[    1.545512] i2c /dev entries driver
[    1.553743] ambarella-wdt ambarella-wdt: Ambarella Media Processor Watch Dog Timer[ambarella-wdt].
[    1.569139] ALSA device list:
[    1.572372]   No soundcards found.
[    1.575950] Netfilter messages via NETLINK v0.30.
[    1.580817] nf_conntrack version 0.5.0 (1480 buckets, 5920 max)
[    1.587596] ip_tables: (C) 2000-2006 Netfilter Core Team
[    1.593205] TCP cubic registered
[    1.596833] NET: Registered protocol family 10
[    1.603847] Mobile IPv6
[    1.606415] ip6_tables: (C) 2000-2006 Netfilter Core Team
[    1.612051] IPv6 over IPv4 tunneling driver
[    1.619933] NET: Registered protocol family 17
[    1.625297] sctp: Hash tables configured (established 4096 bind 8192)
[    1.632208] sctp: sctp_init_sock(sk: c58d5b20)
[    1.636768] lib80211: common routines for IEEE802.11 drivers
[    1.642544] lib80211_crypt: registered algorithm 'NULL'
[    1.651631] ambarella-rtc ambarella-rtc: setting system clock to 2020-06-13 10:24:35 UTC (1592043875)
[    1.661838] RAMDISK: gzip image found at block 0
[    2.529267] VFS: Mounted root (ext2 filesystem) on device 1:0.
[    2.535423] Freeing init memory: 148K
init started: BusyBox v1.19.3 (2016-05-23 16:23:55 CST)
starting pid 378, tty '': '-/bin/sh'


BusyBox v1.19.3 (2016-05-23 16:23:55 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

#
#
# mount -t proc proc /proc
#
# mount -t sysfs sysfs /sys
#
# mount -t ramfs ramfs /home
#
# /etc/S_udev
Starting udev:      [ OK ]
#
# ifconfig eth0 192.168.1.64 up
[   78.635544] net eth0: Could not find default PHY in 9.
[   78.640714] net eth0: Try PHY[3] whose id is 0x001cc816!
[   78.649664] ADDRCONF(NETDEV_UP): eth0: link is not ready
# [   80.642447] PHY: 0:03 - Link is Up - 100/Full
[   80.646996] ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready

#
# [   91.552117] eth0: no IPv6 routers present

# mount -t nfs -o nolock 192.168.1.201:/cctv1 /mnt/nfs00
#
# ls -al /mnt/nfs00/mtdblock*
-rw-r--r--    1 root     root       4194304 Jun 13 10:09 /mnt/nfs00/mtdblock11
-rw-r--r--    1 root     root      25165824 Jun 13 10:09 /mnt/nfs00/mtdblock13
-rw-r--r--    1 root     root      10485760 Jun 13 10:09 /mnt/nfs00/mtdblock8
-rw-r--r--    1 root     root       8388608 Jun 13 10:08 /mnt/nfs00/mtdblock9
#
# cat /mnt/nfs00/mtdblock8 > /dev/mtdblock8
#
# cat /mnt/nfs00/mtdblock9 > /dev/mtdblock9
#
# cat /mnt/nfs00/mtdblock9 > /dev/mtdblock10
#
# cat /mnt/nfs00/mtdblock11 > /dev/mtdblock11
#
# cat /mnt/nfs00/mtdblock11 > /dev/mtdblock12
#
# cat /mnt/nfs00/mtdblock13 > /dev/mtdblock13
#
# cat /mnt/nfs00/mtdblock13 > /dev/mtdblock14
#
#
#
# reboot
The system is going down NOW!
Sent SIGTERM to all processes
Terminated
Sent SIGKILL to all processes
[  261.383964] Restarting system.


U-Boot 1.3.4-121219 (Apr  8 2015 - 14:34:29)

ARM Clock: 480MHz
DDR Clock: 336MHz
Hit Ctrl+u to stop autoboot: 2
HKVS #
HKVS #
HKVS # setenv bootargs console=ttyS0 initrd=0xc0a00000,0x400000 rw root=/dev/ram dbg=0
HKVS # saveenv
Writing env to Nand... done
HKVS #
HKVS # printenv
ipaddr=192.0.0.64
serverip=192.0.0.128
gatewayip=0.0.0.0
netmask=255.255.255.0
ethaddr=28:57:be:23:3c:ea
loadaddr=0xc2000000
bootfile=digicap.dav
bootcmd=null
bootargs=console=ttyS0 initrd=0xc0a00000,0x400000 rw root=/dev/ram dbg=0
bootdelay=2
HKVS #

Good luck!

 

[rumenn]

Thanks
After this last procedure, there were a lot of errors again, in fact only / dev / mtdblock10 / dev / mtdblock11, went without error.
However, the camera seems to come to life completely, even the web interface works, but in Chinese
Now it remains to find a way to turn it into international upgradable version ... if possible?
putty back to life with errors log..

 

[alastairstevenson]

After this last procedure, there were a lot of errors again, in fact only / dev / mtdblock10 / dev / mtdblock11, went without error.

Yes, the flash has a large number of errors, it's failing badly in multiple segments.

However, the camera seems to come to life completely, even the web interface works, but in Chinese

A pity it was not an EN device, then you'd be finished.

Now it remains to find a way to turn it into international upgradable version ... if possible?

That's what the BrickfixV2 method does - but it's not directly usable as the needed mtdblock8 partition is very much broken.
A manual process could be followed, in theory -
Re-run the manual refresh but with the 5.2.5 firmware partitions instead. The ones I supplied were from 5.4.0 - the version that BrickfixV2 is based on.
Extract mtdblock6 and do the 'mtd hack' to change it to EN.
Re-apply mtdblock6

But it seems a lot of work for a camera that is very likely to fail, with such a widely-failing flash.

 

[rumenn]

I tried to directly install the 5.30 Downgrader from the Chinese web interface everything went OK, now I have a 5.2.5 international version with several languages...
I'm wondering now what to do..or to leave it like that, for me the biggest problem was the back door, because my camera settings were constantly changing and that's why I didn't use it ..
I think it is possible that this camera was defective at birth (perhaps discarded due to a defective flash memory) and is only set to work without major changes.

 

[alastairstevenson]

I tried to directly install the 5.30 Downgrader from the Chinese web interface everything went OK, now I have a 5.2.5 international version with several languages...

Well, that's quite a good state to get to.

I'm wondering now what to do..or to leave it like that,

In theory you could still do the 'enhanced MTD hack' and attempt to update the firmware through the various versions.
The web GUI update process does not require the (broken) min-system recovery environment, like the tftp updater does.
And UBIFS will be mapping out the bad blocks, and the web GUI updater operates file-by-file so will take advantage of that.
The risk would be if the free space in the partitions gets totally consumed by the bad blocks such that an update fails.
And even if updating does work - there is a chance that more bad blocks get grown and the camera just fails over time.

If you wanted to try updating, this is what you could do :
First there is a need to grab a copy of mtdblock6
You will be able to enable telnet or SSH in the web GUI.
I think the telnet root password was 12345 or hiklinux, I don't recall.
You'd need to mount your NFS share as before, then at the root shell prompt -

cat /dev/mtd6ro > /mnt/nfs00/mtd6ro_orig

Then either zip up the mtd6ro_orig and attach here and I'll fix it up for you, or mod it yourself.
Then to put the modded version back -

cat /mnt/nfs00/mtd6ro_mod > /dev/mtdblock6
Warning - only do this when the 5.2.5 firmware is running, not with any newer versions.

And reboot.
You may then be able to use the web GUI Maintenance menus to progress though the updates.

R0 (2xx2)

2xx2

ipcamtalk.com

But it could very well fail along the way if the bad blocks get in the way.

 

[rumenn]

Great, I will try,
here is the archive

mtd6ro_orig

which of these versions will be the most suitable for me

R0 series DS-2CD2x32x-Ixx IP camera firmware IPC_R0_EN_STD_5.4.5_170401
DS-2CD2332-I V5.2.0 build 140721
DS-2CD2132F-I 5.4.0_160530
DS-2CD2012WD-I 5.4.5_170123

 

[alastairstevenson]

here is the archive

And attached is the modded version.

which of these versions will be the most suitable for me

I'd suggest going from the 5.2.5 to 5.3.0 to 5.4.0 to 5.4.5 from here :

R0 series DS-2CD2x32x-Ixx IP camera firmware - Updates

ipcamtalk.com

 

[rumenn]

Done..everything went smoothly and I already have a new update camera
Thank you very much for help..
In the next days I will look for 1 more similar camera and if it is convenient to send its file for modification?

 

[alastairstevenson]

Hey, well done!
That's such a good result.
I just hope it stays ok.

 

[rumenn]

as I have already begun .. I also found my other camera, it is brand new and has been stored for 2 years..
It is a slightly newer model but it is again a Chinese version with international menu and the Chinese seller had explicitly told me to not try any updates. The firmware is 5.3.8.
Can it be made upgradeable with the latest firmware or is it good to stay that way?

 

[alastairstevenson]

That's an R6 series camera that would be running hacked firmware.
Any updates would also need hacked firmware as the camera personality is held in a security chip, not in the flash.