Menu
What's new

[Solved] DS-2CD2185FWD-I Firmware dump

Maki_mitz

Maki_mitz

n3wb
Joined
Nov 4, 2020
Messages
6
Reaction score
2
Location
/dev/shm
Hello everyone,

Actually I'm trying to dump the DS -2CD2125FWD-I firmware. I tried those different method:
  • Building an ARMv7 kernel from scratch and boot via TFTP, but I don't have Device Tree Blob for the Amarella board... So, addresses etc.. Seems not good ;
  • Decrypt the digicap.dav with tools found on this forum (hikpack for example), but the actuel firmware seems to be too recent, so tools can't decrypt it ;
  • Chip off the flash and dig into memory blocks, but I probably broke something will doing it.
So, if someone know a way to dump the firmware, I'll really appreciate the help. Or if someone has the secret key for "digicap.dav", it would be perfect too.
Thanks in advance.
Best regards.
 
Maki_mitz

Maki_mitz

n3wb
Joined
Nov 4, 2020
Messages
6
Reaction score
2
Location
/dev/shm
The hikpack (see in attached picture) i'm using doesn't support G1 firmware... Is the version 2.5 the latest ? If no, you didn't manage to find a newer version.

For the SDK, I see... So my kernel can't be a right one lol. Thanks for the help !
 

Attachments

alastairstevenson

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,975
Reaction score
6,799
Location
Scotland
Maki_mitz said:
Chip off the flash and dig into memory blocks, but I probably broke something will doing it.
Click to expand...
Given the availability of a suitable test clip that works for whatever type of flash chip that camera uses - usually an 'in-situ' read works OK.

Alternatively - check what useful flash commands if any remain in the bootloader.
You may be able to dump the flash directly and transfer out over tftp.

Also - and this is optimistic as Hikvision started disabling this method a while back - if you can add
init=/bin/sh single debug
to the bootargs environment variable, you might be able to boot it to a root shell, in which case the flash partitions can be extracted.
 
Maki_mitz

Maki_mitz

n3wb
Joined
Nov 4, 2020
Messages
6
Reaction score
2
Location
/dev/shm
alastairstevenson said:
Given the availability of a suitable test clip that works for whatever type of flash chip that camera uses - usually an 'in-situ' read works OK.

Alternatively - check what useful flash commands if any remain in the bootloader.
You may be able to dump the flash directly and transfer out over tftp.

Also - and this is optimistic as Hikvision started disabling this method a while back - if you can add
init=/bin/sh single debug
to the bootargs environment variable, you might be able to boot it to a root shell, in which case the flash partitions can be extracted.
Click to expand...
Yes, I wanted to do this, but I only have few commands. Mainly for update actions :/
Do you see something helpful in the available commands ?
 

Attachments

You must log in or register to reply here.
Top