UART connection to recover Hik cameras

M

maxk

Getting the hang of it
Sep 8, 2014
11
25
I was recently looking around the web for some instructions on how to get a serial connection to Hikvision IPC in order to bring back to life my constantly rebooting 2432 camera. And I couldn't find a clear indication on how to do this other than some suggestions that it should be possible. Well, it's quite simple:

All you need is a +3V compatible TTL UART (e.g PL2303HX) and a small 4-pin Molex connector. Check your components store or ebay. It should cost you around ~$1-2 each.

attachment.php


attachment.php


Open camera, plug in molex connector, connect Ground, TX, and RX leads to UART as per the labels on the picture. White cable is likely +3V power and should not be connected. Use your terminal program (e.g. putty) to open a serial connection using default settings 115200, 8N1. You should see U-Boot and all the console log messages from IPC and can, if required, stop the normal boot process via Ctrl-u to get into the rom bootloader. There you can specify tftp server address and do a forced firmware update (type help; help setenv; help update).

So, no worries, your camera is not fully bricked if it's not booting. It just needs a bit of effort to recover. I should say that my other 2CD2332 camera has a similar connector plug on it, so they probably put it on all IPCs in the 2 model line. Hope it's helpful for someone.
 

Attachments

  • IMG_20150220_112156.jpg
    IMG_20150220_112156.jpg
    126.9 KB · Views: 3,160
  • IMG_20150219_235823.jpg
    IMG_20150219_235823.jpg
    208.3 KB · Views: 3,356
Last edited by a moderator:
As an eBay Associate IPCamTalk earns from qualifying purchases.
  • Like
Reactions: LO-CO, mikätöhö, aristobrat and 19 others
Excellent! Thank you for sharing this info (and not charging for it ;)) Is the white cable not being used? Also, could you link to PL2303HX that you bought?
 
This is an excellent effort :)
Connector looks like a 1.25mm molex picoblade found on ebay.
Now people can experiment more which is nice.
Ok so as long the bootloader is intact, we can always recover-boot like this?.
 
Thanks for this, man.

How did you connect the rx and tx leads to the UART? Is it rx-to-rx, tx-to-tx OR rx-to-tx, tx-to-rx?

Thanks.
 
riri7707 said:
Logically will be RX to TX, then TX to RX (cross signals)
Click to expand...

Thanks for this.
It's not that I have a bricked cam or something. It's just that I have this pigtail and uart lying around (arduino and rasp pi projects) somewhere and curiosity-the-cat bit me. I wonder what will I see inside and maybe learn the ropes of unbricking Hiks once I get bored enough to firmware upgrade my china versions.

Thanks again.
 
I labeled the wires on the picture with the UART lead labels (e.g. black would go to RX on UART). But if you see no output on a first try just swap RX and TX, no harm done.

And yes, if you have the bootloader then you can (almost) always recover the unit back. Almost because of situations like bad flash, etc.
 
Last edited by a moderator:
Sakuji said:
It's not that I have a bricked cam or something. It's just that I have this pigtail and uart lying around (arduino and rasp pi projects) somewhere and curiosity-the-cat bit me. I wonder what will I see inside and maybe learn the ropes of unbricking Hiks once I get bored enough to firmware upgrade my china versions.
Click to expand...

Yes, exactly my point when posting this. First, it's *significantly* easier to recover than almost betting on the built-in TFTP process during a camera reboot. E.g. I saw suggestions to wait 5 or 30min after TFTP upgrade. Well, you don't need any of this, just issue a reboot command. But second, more people we get looking at things more closely, better results could be achieved. Camera is also logging *tons* more stuff to the serial port console versus telnet/ssh.
 
maxk said:
I labeled the wires on the picture with the UART lead labels (e.g. black would go to TX on UART). But if you see no output on a first try just swap RX and TX, no harm done.

And yes, if you have the bootloader then you can (almost) always recover the unit back. Almost because of situations like bad flash, etc.
Click to expand...

Thanks for the clarification.
 
This looks normal to me when trying to flash an incorrectly packed digicap.dav file with the old version of hiktools.

Try using the whoslooking 5.25 downgrade from 5.30 digicap.dav file located on this forum
 
I constructed the console cable for the 2432 but I'm getting unreadable txt. I figured it was a bad connection but I redone it several times and I get the same result. It is only three wires. I'm using USB to serial adapter and there is a LED that lits when it establish communications. I'm using 115.2K, 8N1. I ohmed from the db9 plug to the back of the connector on the camera and verified connectivity. What am I doing wrong?
 
I'm using USB to serial adapter
Click to expand...
There are different types of USB to serial adaptor - what type are you using?
I'd speculate when you mention "the db9 plug" that you are using a classic RS232 interface that uses bipolar signal levels +-3-15v
The camera needs a 'TTL level' serial adaptor which uses unipolar signal levels 0-3v
You need a 'USB to TTL serial adaptor'.
In eBay or Amazon they are available in large numbers very cheaply.
 
  • Like
Reactions: 2delarosa
Yes. You're correct. I picked up a TTL level serial adapter and it worked. Now, I'm trying to figure how to update the firmware using the console. Most of the threads out there talk about using tftp server. Do you have any commands I can use?
 
Do you have any commands I can use?
Click to expand...
These vary with the version of the bootloader in the camera.
If you interrupt the startup, the 'help' command will list the available commands.
You will need a standard tftp server - this one is old but works well: http://www.jounin.net/tftpd32.html
What is the problem with the camera that has made you resort to a console connection?
Have you used the console connection to check out the specifics of the problem you're experiencing?
 
I have nine cameras and I upgraded a 2432 and 2032 to 5.3 build 150513. Turns out the cameras are Chinese region so I lost access to them. I tried following the sticky post from Whoslooking to downgrade but the cameras did not issue a tftp command. I tried various configurations. Going through a switch using POE or a external power supply. I attached directly to a server with an external power supply. The IP address of the camera was a 169.x.x.x; not the 192.0.0.64 that I was expecting. So I consoled in to force the tftp download. I have a tftp server on my NAS. I figure I need to set the IP address on the camera and the IP address of the tftp server, issue the command to download the digicap.dav, write it to flash, and then reboot. with setenv, I believe I can stumble through the configuration but I hope someone else has already went through this, documented the steps, and listed some best practices.

P.S. I've added the console log of the 2432 when it boots up. Any insights on davinci errors would be helpful.
 

Attachments

Last edited by a moderator:
  • Like
Reactions: alaarehil
You must log in or register to reply here.
Top Bottom