R0 / DS-2CD2x32 BrickfixV2 brick recovery and full upgrade tool - enhanced.

[P100D]

On the face of it that appears to be an EN camera that should be able to be upgraded without any need to change its hardware signature.
Do you have any recollection of what was done to brick it on the update you tried a while back?

If you do try the updates, do then in stages, not skipping major versions.
You'll find a good selection of the R0 firmware in the downloads section of this forum.

I cannot unfortunately exactly remember what I did. Now I tempted to go straight to 5.3 then 540 then 545 from hikvsion web but afraid I will screw up again...Not sure what to do here...

I believe I went to 5.3.0 and it went dead. Had to go back to 5.2.5 to restore it, I think...

Please tell me what would you do in this case...

 

[alastairstevenson]

I believe I went to 5.3.0 and it went dead.

It's possible then, that despite the encouraging prtHardInfo data, and the serial number, the camera may be a Chinese model.
If so, the 'enhanced MTD hack' to mtd6 and maybe mtd1 would convert it to EN and allow full updates.

Do you have a 'NetHDD' (NAS or Windows share) configured in the camera?
If we could get a copy of mtd6ro some details could be checked out.

In the meantime, maybe try this to check the language flag directly :
Telnet in to the camera IP address.
Log in with username=root password=12345
and issue this command (copy/paste to avoid errors)

VAR=`dd if=/dev/mtd6ro skip=16 bs=1 count=1 2>/dev/null` ; if [ $VAR == $'\002' ]; then echo Chinese ; elif [ $VAR == $'\001' ]; then echo English ; else echo Unknown; fi

There are other parts of mtd6ro, and mtd1ro that can get in the way of updating, but it would be useful to check the language flag above.

 

[P100D]

I just ssh-ed into the camera :

# VAR=`dd if=/dev/mtd6ro skip=16 bs=1 count=1 2>/dev/null` ; if [ $VAR == $'\002' ]; then

echo Chinese ; elif [ $VAR == $'\001' ]; then echo English ; else echo Unknown; fi

English

#

Please let me know what else I can give you and how.
This is an overseas camera and have limited time with it.

Best to all of you!

PS Trying to cfg a NFS MAC share now in, running into issues...

While messing with this stupid camera an alarm started never did before and cannot stop it.....

 

[alastairstevenson]

While messing with this stupid camera an alarm started never did before and cannot stop it.....

Check under Events - Exceptions. It will be complaining about the NetHDD.

The language byte looks OK - English.

 

[P100D]

Check under Events - Exceptions. It will be complaining about the NetHDD.

The language byte looks OK - English.

Thanks. What can I do next?

Should I attempt 5.3.0 then 40 then 545 from hikvision web?
Or follow the thread here, which I'm confused about since mine it's not bricked and it's the english version...

 

[alastairstevenson]

If you have some confidence in being able to recover back to 5.2.5 ( the whoslooking downgrader?) then I'd try the web GUI update to the 5.3.0 firmware.

 

[P100D]

If you have some confidence in being able to recover back to 5.2.5 ( the whoslooking downgrader?) then I'd try the web GUI update to the 5.3.0 firmware.

Thanks for your support.
I upgraded step by step via web and all is good.
I decided to do it after checking the back of the camera (UL US). It is the US version.

However for some reason this camera stopped working in BI v5....

 

[alastairstevenson]

I upgraded step by step via web and all is good.

Hey, that's a good result! Nice to hear.

However for some reason this camera stopped working in BI v5....

I've a recollection of something similar after a firmware update, where the solution was to remove the camera and add it again.
But I'm guessing a bit.

 

[P100D]

Hey, that's a good result! Nice to hear.


I've a recollection of something similar after a firmware update, where the solution was to remove the camera and add it again.
But I'm guessing a bit.

Thanks tried that and abs no luck...

 

[alastairstevenson]

That should work just fine - it's a very common combination.

Maybe some screenshots and other configuration info and some of the BI experts on here will give some help. I'm not a BI user myself.

 

[Phily]

I followed all the steps, got a good flash at the end, set the password in the HIK tool but the web interfaces says language mismatch I checked the hex bit I needed to change and I have set it to 01. Will try again

 

[alastairstevenson]

Will try again

Long shot - try refreshing IE11 - or clearing the cache.

I checked the hex bit I needed to change and I have set it to 01

Presumably also adjusted the checksum bytes.

 

[Phily]

Yup, so I started a fresh and did it again and tihs time it worked!
Thank you to the OP! I just have another 4 cameras to update

 

[alastairstevenson]

Yup, so I started a fresh and did it again and tihs time it worked!

Great!

I just have another 4 cameras to update

It gets easier the more you do.
Just remember to keep the files separate and properly named to avoid any mixups, so easily done!

 

[alfa-62]

hi friend
my DS-2CD2132 cam has this firmware V5.2.0 ; can I upgrade directly to V5.4.X or is necessary to upgrade step by step : V5.2.0 to V5.3.X and after V5.3.X to V5.4.X
Where find V5.3.x ?
thanks

 

[alastairstevenson]

Is this an EN / upgradable camera or a Chinese camera? You can't upgrade a Chinese camera without first converting to EN.

If it's an EN camera, it's best to upgrade in stages.
For various R0 firmware versions, check out the Downloads section of this forum.

 

[alfa-62]

It's an Chinese cam ; I will convert it in EN version
thanks for your help

 

[alastairstevenson]

thanks for your help

You are welcome.
Good luck with the conversion and update.

 

[Purduephotog]

Alastair-

First, thank you for the great tutorial. I've been bumming around firmware for years, and this is very concise and well laid out.
Unfortunately I think my experience has come back to bite me.

I couldn't get the camera to reset- although I was able to log into it and force a factory reset. At that point it picked up the tftp server, did the EN-digicap download... and then it did nothing.

Manually rebooted after a long while, but was never able to get it to reset or connect again.

Wireshark shows some activity- I was able to capture a couple of ARP (broadcast packet below).

The odd thing was the IP came back as 192.168.1.64 - so I moved everything over to 1.128- still no bites though, and no activity on wireshark to indicate reachout to the tftp server.
I isolated completely from switches and direct plugged it into the PC... no go.

So now it's in 4 pieces on my desk, and I'm about to solder in a header connector. Saw a cute little plug though- wondering what it is.

I'm about to do a serial reprogramming on it- any last words to stop me? Or suggestions to try before I head down this path? I've not fired up binwalk in a looong time....

0000   ff ff ff ff ff ff c4 2f 90 00 35 4f 80 33 21 01   ......./..5O.3!.
0010   01 f6 00 00 00 02 06 04 01 02 3c 89 c4 2f 90 00   ..........<../..
0020   35 4f c0 a8 01 40 ff ff ff ff ff ff 00 00 00 00   5O...@..........
0030   ff ff ff 00 44 53 2d 32 43 44 32 30 33 32 46 2d   ....DS-2CD2032F-
0040   49 30 31 32 30 31 35 30 37 32 04 43 43 52 52 35   I012015072.CCRR5
0050   33 30 35 39 32 30 39 37 00 00 00 00 00 00 00 00   30592097........
0060   00 00 00 00 00 00 98 26 00 00 1f 40 00 00 00 00   .......&...@....
0070   00 00 00 00 56 34 2e 30 2e 38 62 75 69 6c 64 20   ....V4.0.8build
0080   31 35 30 34 30 31 00 00 00 00 00 00 00 00 00 00   150401..........
0090   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
00a0   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
00b0   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
00c0   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
00d0   00 00 00 00 32 30 31 39 2d 30 37 2d 31 36 20 30   ....2019-07-16 0
00e0   36 3a 31 38 3a 30 37 00 00 00 00 00 00 00 00 00   6:18:07.........
00f0   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0100   00 00 00 00 02 9c 60 52 c0 a8 01 01 00 00 00 00   ......`R........
0110   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0120   00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00   ............@...
0130   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0140   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0150   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0160   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0170   44 53 2d 32 43 44 32 30 33 32 46 2d 49 00 00 00   DS-2CD2032F-I...
0180   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0190   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................

Oh I saw this - hah- some of the info I need

Manual: Create console/serial access to Hikvision DS-2CD2032F-I

Sounds like the camera is stuck and the reset button isn't working. Hrmm...

 

[alastairstevenson]

SADP will show that the camera is running the min-system recovery environment, as shown on your wireshark data (4.0.8).
That should respond to a telnet access if its the brickfix version.

On a 2032, the serial console connector is on the underside of the system board.