UART connection to recover Hik cameras

Flow Control is deaktivated, USB Cable is 1m an Cable Connectioncable is 10cm.
The problem occurred until now only on this one on camera.
All other Devices no Problem.
 
Here's a pic from inside a 2CD2032F-I.
Unfortunately there's no connector but there are 4 holes at the bottom.
I'll see if i can get a serial connection and will report back.

Seems to be a chinese 5.3.0 model which got sold to germany with some hacked firmware on it.
Tried to upgrade to 5.4.0 (EU) via webinterface. Worked so far, no errors, but cam never came back online.
So i decided to restore to 5.3.0 (EU) via tftp. Also worked without errors but now cam says "V4.0.8build 150401", IP "192.168.1.64" and Serial "DS-2CD2032F-I012015111CCRRXXXXXXXXXX".
Serial matches sticker on the camera. So it's not a fake one.
Cam doesn't try to load a firmware via TFTP anymore and SADP always says "Time out" when trying to change IP.
 

Attachments

  • IMG_20161128_095613.jpg
    IMG_20161128_095613.jpg
    405.1 KB · Views: 175
Hello alastairstevenson, where can I find a 1.25mm molex picoblade cable as posted above? I looked around but could not find the right one.
Thanks in advance
Martin
 
Is there any chance someone's done a writeup that has all the serial and firmware update knowledge in one place? Or is that an unreasonable thing to think given the way Hikvision hates their customers?

I too am going through the results of a bad firmware update and am left with a boot-looping camera. Now thinking I'm going to have to go through the serial interface to see what's going on. Not how I wanted to spend my weekend. :)
 
michaelh99 said:
Is there any chance someone's done a writeup that has all the serial and firmware update knowledge in one place? Or is that an unreasonable thing to think given the way Hikvision hates their customers?
Click to expand...
This forum does seem to be the best collection of what's out there in public for Hikvision.
But it does seem to be the case that Hikvision pick up on disclosed technical details and counter them in later firmware updates, so folks are a bit cautious about announcing these to the world at large.
A game of leapfrog.

But what model of camera, what firmware was on it, and what did you do to it?
There is a fair chance you may have just mismatched the firmware, and a tftp updater install of the right file might fix it.
 
I've got a DS-2CD2632F-IS that I tried to install the latest US firmware on. It's got a chinese sticker (which I now understand is a warning sign). 5.3.0 if I remember correctly, though the original order said it would have 5.2.5
I've tried several different fw versions and locales using the tftp updater and none of them reboot after the firmware has been updated. Several never report back that the update was completed.
For the ones that do report back, waiting even an hour (I went to dinner) didn't result in the camera rebooting. After a power cycle the camera just boot loops.
 
michaelh99 said:
none of them reboot after the firmware has been updated.
Click to expand...
Depending on the version of the updater program that the tftp update process kicks off, the camera can just sit there at the default 192.0.0.64 address with telnet and ftpd active waiting to be power cycled.
But for a CN region 2632, you should be able to use the tftp updater with this firmware : Custom Firmware Downgrader 5.3.0 Chinese to 5.2.5 English
but you may need to change the language in the firmware header for the camera to accept it as an upgrade.
If so, Hiktools can do this, the 'lang' option. Hikvision FIRMWARE TOOLS - change language, extract files and create own firmware eg
- At this point it is possible to simply change the ‘Language flag’ by executing the following command, using ‘1’ for English or Multi, and ‘2’ for Chinese device. If you want flash english firmware to chinese IPC or NVR you need set language to 2:
hiktools lang digicap.dav 2
Click to expand...
 
  • Like
Reactions: vasycara
Well, I've tried half a dozen different fw versions and most don't give me the "Device[192.0.0.64] system update completed!" when applied. No matter if I'm flashing English or Chinese. They just stall at "Completed file[D:\util\hikvision\downgrader\digicap.dav] transmit"
Only one version shows completed at the end, only in English and it still boot loops.

So far, I haven't been able to connect using telnet. The connection is either refused or times out.
 
michaelh99 said:
They just stall at "Completed file[D:\util\hikvision\downgrader\digicap.dav] transmit"
Click to expand...
With apologies for the dumb question - but presumably you've waited 5 mins (the firmware flash process is quietly taking place after file transmit and can take 3-4 mins) then power-cycled the camera, watching if it appears on SADP?
 
Questions can't be dumb. Only people can be dumb. ;-)
But no, that's not a dumb question.
Yeah, I did wait up to 10 minutes.
Interesting to me is the one Eng firmware that sent back the completed message only when set to english. In Chinese it also stalled.
I'm going to try a few other versions tonight.
I've also got a serial adapter coming so I can try that method of getting in sometime this week or next.
 
am pulling up a chair as I'll be joining this fun as soon as the parts for my serial connection arrive :-)
 
Hint - (easier for you, and easier for the readers) - with PuTTY you can use the 'Copy scrollback to clipboard' in the menu at the top left of the window to grab the text, paste into a text editor, adjust as needed, then post using the 'CODE' tags in the '+' dropdown of the edit menu.

Looking at the image, you have the same problem as I was recently investigating where the camera firmware 'upgrade' program has erased the flash partitions associated with the apps of the camera, then rejected the downloaded firmware, leaving just the hated 'psh' restricted shell.
Example that seems similar: HELP! Cant find DS-2CD2432F-IW after updating firmware to 5.4.41_170312
DS-2CD2432F-IW 3MP firmware issue after trying to upgrade to 5.4

What was the original firmware version of the camera?
Where are you located?
 
Does anyone know the size of molex connector on the 2CD2132 Dome cameras?

I ordered the TTL UART which came with fly leads, but they don't fit. And my local components store don't fancy pulling out all their molex connectors to find the right size :/
 
maxk said:
So, no worries, your camera is not fully bricked if it's not booting. It just needs a bit of effort to recover. I should say that my other 2CD2332 camera has a similar connector plug on it, so they probably put it on all IPCs in the 2 model line. Hope it's helpful for someone.
Click to expand...
Greetings from Finland and thanks a lot, you saved my DS-2CD3132F-IWS from a trash can! I was able to restore it back to life (with v5.2.5) it using your instructions!

Note to mention that also my cheapo USB-to-TTL adapter from Ebay seller seems to be a pirated version (of course). It became obvious when tried to install drivers for Win10 and getting nothing but a yellow exclamation mark in device manager. This URL might come handy to somebody else when facing similar problems: Family Software Drag Racing - Newsletter#37, Prolific PL-2303 Driver Solution for Code 10 Error
 
  • Like
Reactions: 7007
gb7777 said:
Does anyone know the size of molex connector on the 2CD2132 Dome cameras?

I ordered the TTL UART which came with fly leads, but they don't fit. And my local components store don't fancy pulling out all their molex connectors to find the right size :/
Click to expand...

If it's a 3-pin connector, this Micro JST connector MIGHT fit. Otherwise, search ebay for "n-pin Micro JST connector"
I see from @alastairstevenson post earlier, it's not the link above, which is a 1.25 spacing. :(
It's still a Micro JST connector, but with 1.5 spacing.
20 Sets X Mini Micro ZH 1.5 4-Pin JST Connector with Wires Cables | eBay
 
Last edited:
As an eBay Associate IPCamTalk earns from qualifying purchases.
  • Like
Reactions: catseyenu and alastairstevenson
Just to add to this thread.
For those who might have a raspberrypi 1 or greater sitting around being a kodi or media player, or general linux play thing.... i found it very helpful to know that it as built-in the same serial TTL 3.3v capabilities as mentioned/needed above.

http://www.savagehomeautomation.com....jpg?__SQUARESPACE_CACHEVERSION=1412775830151

Some important tricks - otherwise you will potentially fight with your distributions operating system for the serial port.

sudo cp /boot/cmdline.txt /boot/cmdline.bak
The file probably contains this default configuration line:

dwc_otg.lpm_enable=0 console=ttyAMA0,115200 kgdboc=ttyAMA0,115200
console=tty1 root=/dev/mmcblk0p2 rootfstype=ext4 elevator=deadline rootwait
After removing the two configuration parameters, it will look similar to this:

dwc_otg.lpm_enable=0 console=tty1 root=/dev/mmcblk0p2 rootfstype=ext4
elevator=deadline rootwait

depending on your operating system distribution you may also need to remove it from inittab.


$ minicom -b 115200 -o -D /dev/ttyAMA0

and then away you go :)


Code: 
Some Reference material incase you need to deep dive the solution.
http://www.savagehomeautomation.com/projects/raspberry-pi-rs232-serial-interface-options-revisit.html
 
  • Like
Reactions: alastairstevenson
I just used the TTL connection on my 2CD3132F-IW camera to help recover it.

For posterity, the TTL header pinout is:
1. GND (The one with the arrow)
2. Tx
3. Rx
4. 3v (Optional, I didn't use it)
 
You must log in or register to reply here.
Top Bottom