R0 / DS-2CD2x32 BrickfixV2 brick recovery and full upgrade tool - enhanced.

in fact what is the original value of bootloader variable bootargs? :)
and how to try updating with a command in the bootloader?
with tftp camera update but returned to previous state in shell and is not found in the network
 
Last edited:
I bought the my DS-2CD2732F-IS from an authorized reseller in the Netherlands. I tried to upgrade yesterday (downloaded from the American website), but after the upgrade the camera doesn't come online anymore. I downloaded TFTP and the european SW version (are they different), and managed to upload the file to my camera. However, after the transmit completed, it doesn't do anything anymore. I don't get the System update completed message (not even after 10 minutes) ...

What should i do next ?
 
SADP didn't show anything. After flashing the CN version, it showed the update complete message.
Guess I will contact my reseller why he sold me a chinese version.
 
That is what I did. Thanks for the excellent tutorial.
However, I've bought 10+ cams from a reseller in the region, just to avoid this mess. I knew the problems with chinese hacked versions, and i wanted to avoid that. Otherwise I could have just sold em directly on ali or the like
 
rumenn said:
in fact what is the original value of bootloader variable bootargs? :)
and how to try updating with a command in the bootloader?
with tftp camera update but returned to previous state in shell and is not found in the network
Click to expand...
OK, let's re-visit the manual recovery process, if you wish.
Though I have a suspicion that the flash memory is failing.
For a complete flash refresh, attached is the partition that holds the kernel, to add to the others in the NFS Public share on the NAS.

The procedure and commands are as follows :
First, interrupt the bootloader and change the bootargs variable value and reset the system -

setenv bootargs console=ttyS0 initrd=0xc0a00000,0x400000 rw root=/dev/ram dbg=9 debug single
saveenv
reset

Then, when it boots up to an ash root shell, copy / paste the following commands, one line at a time, changing the NAS and camera IP address to match your network if needed.

Code: 
mount -t proc proc /proc
mount -t sysfs sysfs /sys
mount -t ramfs ramfs /home
/etc/S_udev

ifconfig eth0 192.168.2.154 up

mount -t nfs -o nolock 192.168.2.155:/Public /mnt/nfs00

ls -al /mnt/nfs00/mtdblock*

cat /mnt/nfs00/mtdblock8 > /dev/mtdblock8
cat /mnt/nfs00/mtdblock9 > /dev/mtdblock9
cat /mnt/nfs00/mtdblock9 > /dev/mtdblock10
cat /mnt/nfs00/mtdblock11 > /dev/mtdblock11
cat /mnt/nfs00/mtdblock11 > /dev/mtdblock12
cat /mnt/nfs00/mtdblock13 > /dev/mtdblock13
cat /mnt/nfs00/mtdblock13 > /dev/mtdblock14


If the flash is still working OK, there should be no errors above.

When done use 'reboot' and interrupt the bootloader, and put the bootargs value back to the original.

setenv bootargs console=ttyS0 initrd=0xc0a00000,0x400000 rw root=/dev/ram dbg=0
saveenv
reset

And check the result.

Below for reference is an example transcript I just made of the same process.

Code: 
Worked example of firmware re-flash without using the update facility.


HKVS #
HKVS #
HKVS #
HKVS #
HKVS #
HKVS #
HKVS #
HKVS # printenv
ipaddr=192.0.0.64
serverip=192.0.0.128
gatewayip=0.0.0.0
netmask=255.255.255.0
ethaddr=28:57:be:23:3c:ea
loadaddr=0xc2000000
bootfile=digicap.dav
bootcmd=null
bootargs=console=ttyS0 initrd=0xc0a00000,0x400000 rw root=/dev/ram dbg=9 debug single
bootdelay=2
HKVS #
HKVS #
HKVS #
HKVS #
ŠKVS # reset

U-Boot 1.3.4-121219 (Apr  8 2015 - 14:34:29)

ARM Clock: 480MHz
DDR Clock: 336MHz
Hit Ctrl+u to stop autoboot: 0
|BIND err|
Unknown command:null
booting from pri part...
load kernel...
load ramdisk...
[    0.000000] Linux version 2.6.38.8 (chenyuanming@Cpl-Frt-BSP) (gcc version 4.6.1 (Sourcery CodeBench Lite 2011.09-70) )
[    0.000000] #18 PREEMPT Thu Jan 21 17:27:08 CST 2016
[    0.000000] CPU: ARMv6-compatible processor [4117b365] revision 5 (ARMv6TEJ), cr=00c5387f
[    0.000000] CPU: VIPT nonaliasing data cache, VIPT nonaliasing instruction cache
[    0.000000] Machine: Coconut
[    0.000000] Memory policy: ECC disabled, Data cache writeback
[    0.000000] Ambarella: AHB   = 0x60000000[0xf0000000],0x01000000 0
[    0.000000] Ambarella: APB   = 0x70000000[0xf1000000],0x01000000 0
[    0.000000] Ambarella: PPM   = 0xc0000000[0xe0000000],0x00200000 9
[    0.000000] Ambarella: BSB   = 0xc8c00000[0xe8c00000],0x00400000 9
[    0.000000] Ambarella: DSP   = 0xc9000000[0xe9000000],0x07000000 9
[    0.000000] Ambarella: HAL   = 0xc00a0000[0xfee00000],0x0000e708 9
[    0.000000] On node 0 totalpages: 25344
[    0.000000] free_area_init_node: node 0, pgdat c0563180, node_mem_map c0589000
[    0.000000]   Normal zone: 198 pages used for memmap
[    0.000000]   Normal zone: 0 pages reserved
[    0.000000]   Normal zone: 25146 pages, LIFO batch:7
[    0.000000] bootmem_init: high_memory = 0xc8a00000
[    0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
[    0.000000] pcpu-alloc: [0] 0
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 25146
[    0.000000] Kernel command line: console=ttyS0 initrd=0xc0a00000,0x400000 rw root=/dev/ram dbg=9 debug single KRN_PRT=pri RMD_PRT=pri reserved=0xc6500000,0x100000,99 video=amb0fb:720x480,720x480,1,0
[    0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Memory: 99MB = 99MB total
[    0.000000] Memory: 90656k/90656k available, 10720k reserved, 0K highmem
[    0.000000] Virtual kernel memory layout:
[    0.000000]     vector  : 0xffff0000 - 0xffff1000   (   4 kB)
[    0.000000]     fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
[    0.000000]     DMA     : 0xfe600000 - 0xfee00000   (   8 MB)
[    0.000000]     vmalloc : 0xc9000000 - 0xe0000000   ( 368 MB)
[    0.000000]     lowmem  : 0xc0000000 - 0xc8a00000   ( 138 MB)
[    0.000000]     modules : 0xbf000000 - 0xc0000000   (  16 MB)
[    0.000000]       .init : 0xc0008000 - 0xc002d000   ( 148 kB)
[    0.000000]       .text : 0xc002d000 - 0xc052f000   (5128 kB)
[    0.000000]       .data : 0xc0530000 - 0xc0563820   ( 207 kB)
[    0.000000] Preemptable hierarchical RCU implementation.
[    0.000000]  RCU-based detection of stalled CPUs is disabled.
[    0.000000]  Verbose stalled-CPUs detection is disabled.
[    0.000000] NR_IRQS:224
[    0.000000] sched_clock: 32 bits at 72MHz, resolution 13ns, wraps every 59652ms
[    0.000000] sched_clock: wrong multiply/shift: 1864135111>>27 vs calculated 3728270222>>28
[    0.000000] sched_clock: fix multiply/shift to avoid scheduler hiccups
[    0.000000] Console: colour dummy device 80x30
[    0.000000] console [ttyS0] enabled
[    0.274238] Calibrating delay loop... 525.92 BogoMIPS (lpj=2629632)
[    0.532811] pid_max: default: 32768 minimum: 301
[    0.537820] Mount-cache hash table entries: 512
[    0.543130] CPU: Testing write buffer coherency: ok
[    0.554587] NET: Registered protocol family 16
[    0.569507] Ambarella Coconut:
[    0.572809]  chip id:                5100
[    0.575611]  board type:             3
[    0.578399]  board revision:         10
[    0.581771]  chip name:              a5m
[    0.584670]  HAL version:            176869
[    0.587989]  reference clock:        24000000
[    0.591819]  system configuration:   0x173804ea
[    0.596189]  boot type:              0x00000002
[    0.599679]  hif type:               0x00000000
[    0.628877] bio: create slab <bio-0> at 0
[    0.635560] ambarella-spi ambarella-spi.0: ambarella SPI Controller 0 created
[    0.653015] ambarella-i2c ambarella-i2c.0: Ambarella Media Processor I2C adapter[i2c-0] probed!
[    0.663399] ambarella-i2c ambarella-i2c.1: Ambarella Media Processor I2C adapter[i2c-1] probed!
[    0.673609] i2c i2c-0: Added multiplexed i2c bus 2
[    0.678427] ambarella-i2cmux ambarella-i2cmux.0: mux on ambarella-i2c adapter
[    0.688431] Advanced Linux Sound Architecture Driver Version 1.0.23.
[    0.698501] cfg80211: Calling CRDA to update world regulatory domain
[    0.706348] Switching to clocksource ambarella-cs-timer
[    0.720182] Switched to NOHz mode on CPU #0
[    0.776320] NET: Registered protocol family 2
[    0.781013] IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.789145] TCP established hash table entries: 4096 (order: 3, 32768 bytes)
[    0.796566] TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
[    0.803218] TCP: Hash tables configured (established 4096 bind 4096)
[    0.809581] TCP reno registered
[    0.812830] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.818701] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.825658] NET: Registered protocol family 1
[    0.830765] RPC: Registered udp transport module.
[    0.835637] RPC: Registered tcp transport module.
[    0.840364] RPC: Registered tcp NFSv4.1 backchannel transport module.
[    0.847336] Trying to unpack rootfs image as initramfs...
[    0.855127] rootfs image is not initramfs (no cpio magic); looks like an initrd
[    0.895522] Freeing initrd memory: 4096K
[    0.902354] [ kernel version:  svn-174544 ]
[    0.906618] mmc0 power register success!
[    0.910567] mmc1 power register success!
[    0.914868] reboot times :8
[    0.943344] msgmni has been set to 185
[    0.956013] alg: No test for stdrng (krng)
[    0.960254] io scheduler noop registered
[    0.964470] io scheduler deadline registered
[    0.968913] io scheduler cfq registered (default)
[    0.977256] ambarella-fb ambarella-fb.0: probe p[720x480] v[720x576] c[1] b[0] l[736] @ [0xc5980000:0x00068000]!
[    0.989319] ambarella-uart.0: ttyS0 at MMIO 0x70005000 (irq = 9) is a ambuart
[    1.035157] brd: module loaded
[    1.051884] loop: module loaded
[    1.058350] NAND device: Manufacturer ID: 0x01, Chip ID: 0xf1 (AMD NAND 128MiB 3,3V 8-bit)
[    1.066976] ambarella_nand_config_flash: 0x02e00140, 0x02c00140
[    1.073422] Bad block table found at page 65472, version 0x01
[    1.079635] Bad block table found at page 65408, version 0x01
[    1.090875] ambarella-nand ambarella-nand: ambarella_nand_probe: Partition infomation found!
[    1.099452] Creating 18 MTD partitions on "ambnand":
[    1.104518] 0x000000000000-0x000000020000 : "bst"
[    1.113093] 0x000000020000-0x000000120000 : "ptb"
[    1.121357] 0x000000120000-0x000000220000 : "bld"
[    1.129917] 0x000000220000-0x000000320000 : "hal"
[    1.138485] 0x000000320000-0x000000420000 : "ano_ptb"
[    1.147426] 0x000000420000-0x0000004a0000 : "env"
[    1.156122] 0x0000004a0000-0x000000520000 : "param"
[    1.164983] 0x000000520000-0x000000620000 : "dpt"
[    1.173696] 0x000000620000-0x000001020000 : "rcvy"
[    1.182600] 0x000001020000-0x000001820000 : "krn_pri"
[    1.191340] 0x000001820000-0x000002020000 : "krn_sec"
[    1.200380] 0x000002020000-0x000002420000 : "rmd_pri"
[    1.209395] 0x000002420000-0x000002820000 : "rmd_sec"
[    1.218495] 0x000002820000-0x000004020000 : "app_pri"
[    1.227642] 0x000004020000-0x000005820000 : "app_sec"
[    1.236877] 0x000005820000-0x000005c20000 : "cfg_pri"
[    1.246070] 0x000005c20000-0x000006020000 : "cfg_sec"
[    1.255369] 0x000006020000-0x000007020000 : "dbg"
[    1.270684] PPP generic driver version 2.4.2
[    1.276481] PPP Deflate Compression module registered
[    1.281557] PPP BSD Compression module registered
[    1.478596] Ambarella MII Bus: probed
[    1.483937] ambarella-eth ambarella-eth.0: MAC Address[28:57:be:23:3c:ea].
[    1.491546] console [netcon0] enabled
[    1.495388] netconsole: network logging started
[    1.501438] mousedev: PS/2 mouse device common for all mice
[    1.508172] input: AmbInput as /devices/virtual/input/input0
[    1.514952] ambarella_gpio_irq_set_wake: irq[75] = girq[11] = 1
[    1.520898] ambarella-input ambarella-input: AmbInput probed!
[    1.527755] ambarella-adc ambarella-adc: ADC Host Controller [polling mode] probed!
[    1.537144] ambarella-rtc ambarella-rtc: rtc core: registered ambarella-rtc as rtc0
[    1.545512] i2c /dev entries driver
[    1.553743] ambarella-wdt ambarella-wdt: Ambarella Media Processor Watch Dog Timer[ambarella-wdt].
[    1.569139] ALSA device list:
[    1.572372]   No soundcards found.
[    1.575950] Netfilter messages via NETLINK v0.30.
[    1.580817] nf_conntrack version 0.5.0 (1480 buckets, 5920 max)
[    1.587596] ip_tables: (C) 2000-2006 Netfilter Core Team
[    1.593205] TCP cubic registered
[    1.596833] NET: Registered protocol family 10
[    1.603847] Mobile IPv6
[    1.606415] ip6_tables: (C) 2000-2006 Netfilter Core Team
[    1.612051] IPv6 over IPv4 tunneling driver
[    1.619933] NET: Registered protocol family 17
[    1.625297] sctp: Hash tables configured (established 4096 bind 8192)
[    1.632208] sctp: sctp_init_sock(sk: c58d5b20)
[    1.636768] lib80211: common routines for IEEE802.11 drivers
[    1.642544] lib80211_crypt: registered algorithm 'NULL'
[    1.651631] ambarella-rtc ambarella-rtc: setting system clock to 2020-06-13 10:24:35 UTC (1592043875)
[    1.661838] RAMDISK: gzip image found at block 0
[    2.529267] VFS: Mounted root (ext2 filesystem) on device 1:0.
[    2.535423] Freeing init memory: 148K
init started: BusyBox v1.19.3 (2016-05-23 16:23:55 CST)
starting pid 378, tty '': '-/bin/sh'


BusyBox v1.19.3 (2016-05-23 16:23:55 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

#
#
# mount -t proc proc /proc
#
# mount -t sysfs sysfs /sys
#
# mount -t ramfs ramfs /home
#
# /etc/S_udev
Starting udev:      [ OK ]
#
# ifconfig eth0 192.168.1.64 up
[   78.635544] net eth0: Could not find default PHY in 9.
[   78.640714] net eth0: Try PHY[3] whose id is 0x001cc816!
[   78.649664] ADDRCONF(NETDEV_UP): eth0: link is not ready
# [   80.642447] PHY: 0:03 - Link is Up - 100/Full
[   80.646996] ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready

#
# [   91.552117] eth0: no IPv6 routers present

# mount -t nfs -o nolock 192.168.1.201:/cctv1 /mnt/nfs00
#
# ls -al /mnt/nfs00/mtdblock*
-rw-r--r--    1 root     root       4194304 Jun 13 10:09 /mnt/nfs00/mtdblock11
-rw-r--r--    1 root     root      25165824 Jun 13 10:09 /mnt/nfs00/mtdblock13
-rw-r--r--    1 root     root      10485760 Jun 13 10:09 /mnt/nfs00/mtdblock8
-rw-r--r--    1 root     root       8388608 Jun 13 10:08 /mnt/nfs00/mtdblock9
#
# cat /mnt/nfs00/mtdblock8 > /dev/mtdblock8
#
# cat /mnt/nfs00/mtdblock9 > /dev/mtdblock9
#
# cat /mnt/nfs00/mtdblock9 > /dev/mtdblock10
#
# cat /mnt/nfs00/mtdblock11 > /dev/mtdblock11
#
# cat /mnt/nfs00/mtdblock11 > /dev/mtdblock12
#
# cat /mnt/nfs00/mtdblock13 > /dev/mtdblock13
#
# cat /mnt/nfs00/mtdblock13 > /dev/mtdblock14
#
#
#
# reboot
The system is going down NOW!
Sent SIGTERM to all processes
Terminated
Sent SIGKILL to all processes
[  261.383964] Restarting system.


U-Boot 1.3.4-121219 (Apr  8 2015 - 14:34:29)

ARM Clock: 480MHz
DDR Clock: 336MHz
Hit Ctrl+u to stop autoboot: 2
HKVS #
HKVS #
HKVS # setenv bootargs console=ttyS0 initrd=0xc0a00000,0x400000 rw root=/dev/ram dbg=0
HKVS # saveenv
Writing env to Nand... done
HKVS #
HKVS # printenv
ipaddr=192.0.0.64
serverip=192.0.0.128
gatewayip=0.0.0.0
netmask=255.255.255.0
ethaddr=28:57:be:23:3c:ea
loadaddr=0xc2000000
bootfile=digicap.dav
bootcmd=null
bootargs=console=ttyS0 initrd=0xc0a00000,0x400000 rw root=/dev/ram dbg=0
bootdelay=2
HKVS #

Good luck!
 

Attachments

Thanks :)
After this last procedure, there were a lot of errors again, in fact only / dev / mtdblock10 / dev / mtdblock11, went without error.
However, the camera seems to come to life completely, even the web interface works, but in Chinese :)
Now it remains to find a way to turn it into international upgradable version ... if possible?
putty back to life with errors log..

hic_cam_2.jpg
 
rumenn said:
After this last procedure, there were a lot of errors again, in fact only / dev / mtdblock10 / dev / mtdblock11, went without error.
Click to expand...
Yes, the flash has a large number of errors, it's failing badly in multiple segments.

rumenn said:
However, the camera seems to come to life completely, even the web interface works, but in Chinese
Click to expand...
A pity it was not an EN device, then you'd be finished.

rumenn said:
Now it remains to find a way to turn it into international upgradable version ... if possible?
Click to expand...
That's what the BrickfixV2 method does - but it's not directly usable as the needed mtdblock8 partition is very much broken.
A manual process could be followed, in theory -
Re-run the manual refresh but with the 5.2.5 firmware partitions instead. The ones I supplied were from 5.4.0 - the version that BrickfixV2 is based on.
Extract mtdblock6 and do the 'mtd hack' to change it to EN.
Re-apply mtdblock6

But it seems a lot of work for a camera that is very likely to fail, with such a widely-failing flash.
 
I tried to directly install the 5.30 Downgrader from the Chinese web interface everything went OK, now I have a 5.2.5 international version with several languages...
I'm wondering now what to do..or to leave it like that, for me the biggest problem was the back door, because my camera settings were constantly changing and that's why I didn't use it ..
I think it is possible that this camera was defective at birth (perhaps discarded due to a defective flash memory) and is only set to work without major changes.
hic_cam_3.jpg
 
Last edited:
rumenn said:
I tried to directly install the 5.30 Downgrader from the Chinese web interface everything went OK, now I have a 5.2.5 international version with several languages...
Click to expand...
Well, that's quite a good state to get to.

rumenn said:
I'm wondering now what to do..or to leave it like that,
Click to expand...
In theory you could still do the 'enhanced MTD hack' and attempt to update the firmware through the various versions.
The web GUI update process does not require the (broken) min-system recovery environment, like the tftp updater does.
And UBIFS will be mapping out the bad blocks, and the web GUI updater operates file-by-file so will take advantage of that.
The risk would be if the free space in the partitions gets totally consumed by the bad blocks such that an update fails.
And even if updating does work - there is a chance that more bad blocks get grown and the camera just fails over time.

If you wanted to try updating, this is what you could do :
First there is a need to grab a copy of mtdblock6
You will be able to enable telnet or SSH in the web GUI.
I think the telnet root password was 12345 or hiklinux, I don't recall.
You'd need to mount your NFS share as before, then at the root shell prompt -

cat /dev/mtd6ro > /mnt/nfs00/mtd6ro_orig

Then either zip up the mtd6ro_orig and attach here and I'll fix it up for you, or mod it yourself.
Then to put the modded version back -

cat /mnt/nfs00/mtd6ro_mod > /dev/mtdblock6
Warning - only do this when the 5.2.5 firmware is running, not with any newer versions.

And reboot.
You may then be able to use the web GUI Maintenance menus to progress though the updates.

R0 (2xx2)

2xx2
ipcamtalk.com ipcamtalk.com

But it could very well fail along the way if the bad blocks get in the way.
 
Great, I will try,
here is the archive

mtd6ro_orig

which of these versions will be the most suitable for me :)

R0 series DS-2CD2x32x-Ixx IP camera firmware IPC_R0_EN_STD_5.4.5_170401
DS-2CD2332-I V5.2.0 build 140721
DS-2CD2132F-I 5.4.0_160530
DS-2CD2012WD-I 5.4.5_170123
 
Done..everything went smoothly and I already have a new update camera :)
Thank you very much for help..
In the next days I will look for 1 more similar camera and if it is convenient to send its file for modification?
hic_cam_4.jpg
 
  • Like
Reactions: alastairstevenson
as I have already begun .. I also found my other camera, it is brand new and has been stored for 2 years..
It is a slightly newer model but it is again a Chinese version with international menu and the Chinese seller had explicitly told me to not try any updates. The firmware is 5.3.8.
Can it be made upgradeable with the latest firmware or is it good to stay that way?
hic_cam_5.jpg
 
That's an R6 series camera that would be running hacked firmware.
Any updates would also need hacked firmware as the camera personality is held in a security chip, not in the flash.
 
I understand, maybe it's best to stay that way ... it works well and has a multilingual menu.
I was worried that it would have back doors, but with hacker firmware it is even more risky.
 
You must log in or register to reply here.
Top Bottom