UART connection to recover Hik cameras

maxk

Getting the hang of it
Joined
Sep 8, 2014
Messages
11
Reaction score
25
I was recently looking around the web for some instructions on how to get a serial connection to Hikvision IPC in order to bring back to life my constantly rebooting 2432 camera. And I couldn't find a clear indication on how to do this other than some suggestions that it should be possible. Well, it's quite simple:

All you need is a +3V compatible TTL UART (e.g PL2303HX) and a small 4-pin Molex connector. Check your components store or ebay. It should cost you around ~$1-2 each.





Open camera, plug in molex connector, connect Ground, TX, and RX leads to UART as per the labels on the picture. White cable is likely +3V power and should not be connected. Use your terminal program (e.g. putty) to open a serial connection using default settings 115200, 8N1. You should see U-Boot and all the console log messages from IPC and can, if required, stop the normal boot process via Ctrl-u to get into the rom bootloader. There you can specify tftp server address and do a forced firmware update (type help; help setenv; help update).

So, no worries, your camera is not fully bricked if it's not booting. It just needs a bit of effort to recover. I should say that my other 2CD2332 camera has a similar connector plug on it, so they probably put it on all IPCs in the 2 model line. Hope it's helpful for someone.
 

Attachments

Last edited by a moderator:
As an eBay Associate IPCamTalk earns from qualifying purchases.

klasipca

Banned
Joined
Mar 27, 2014
Messages
3,146
Reaction score
750
Excellent! Thank you for sharing this info (and not charging for it ;)) Is the white cable not being used? Also, could you link to PL2303HX that you bought?
 

Peter

Young grasshopper
Joined
Nov 12, 2014
Messages
33
Reaction score
3
This is an excellent effort :)
Connector looks like a 1.25mm molex picoblade found on ebay.
Now people can experiment more which is nice.
Ok so as long the bootloader is intact, we can always recover-boot like this?.
 

Sakuji

Young grasshopper
Joined
Dec 2, 2014
Messages
48
Reaction score
1
Thanks for this, man.

How did you connect the rx and tx leads to the UART? Is it rx-to-rx, tx-to-tx OR rx-to-tx, tx-to-rx?

Thanks.
 

riri7707

Getting the hang of it
Joined
Feb 6, 2015
Messages
93
Reaction score
26
Logically will be RX to TX, then TX to RX (cross signals)
 

Sakuji

Young grasshopper
Joined
Dec 2, 2014
Messages
48
Reaction score
1
Logically will be RX to TX, then TX to RX (cross signals)
Thanks for this.
It's not that I have a bricked cam or something. It's just that I have this pigtail and uart lying around (arduino and rasp pi projects) somewhere and curiosity-the-cat bit me. I wonder what will I see inside and maybe learn the ropes of unbricking Hiks once I get bored enough to firmware upgrade my china versions.

Thanks again.
 

maxk

Getting the hang of it
Joined
Sep 8, 2014
Messages
11
Reaction score
25
I labeled the wires on the picture with the UART lead labels (e.g. black would go to RX on UART). But if you see no output on a first try just swap RX and TX, no harm done.

And yes, if you have the bootloader then you can (almost) always recover the unit back. Almost because of situations like bad flash, etc.
 
Last edited by a moderator:

maxk

Getting the hang of it
Joined
Sep 8, 2014
Messages
11
Reaction score
25
It's not that I have a bricked cam or something. It's just that I have this pigtail and uart lying around (arduino and rasp pi projects) somewhere and curiosity-the-cat bit me. I wonder what will I see inside and maybe learn the ropes of unbricking Hiks once I get bored enough to firmware upgrade my china versions.
Yes, exactly my point when posting this. First, it's *significantly* easier to recover than almost betting on the built-in TFTP process during a camera reboot. E.g. I saw suggestions to wait 5 or 30min after TFTP upgrade. Well, you don't need any of this, just issue a reboot command. But second, more people we get looking at things more closely, better results could be achieved. Camera is also logging *tons* more stuff to the serial port console versus telnet/ssh.
 

Sakuji

Young grasshopper
Joined
Dec 2, 2014
Messages
48
Reaction score
1
I labeled the wires on the picture with the UART lead labels (e.g. black would go to TX on UART). But if you see no output on a first try just swap RX and TX, no harm done.

And yes, if you have the bootloader then you can (almost) always recover the unit back. Almost because of situations like bad flash, etc.
Thanks for the clarification.
 

davo22

n3wb
Joined
Mar 24, 2015
Messages
17
Reaction score
5
This looks normal to me when trying to flash an incorrectly packed digicap.dav file with the old version of hiktools.

Try using the whoslooking 5.25 downgrade from 5.30 digicap.dav file located on this forum
 

2delarosa

n3wb
Joined
Jul 26, 2015
Messages
23
Reaction score
1
I constructed the console cable for the 2432 but I'm getting unreadable txt. I figured it was a bad connection but I redone it several times and I get the same result. It is only three wires. I'm using USB to serial adapter and there is a LED that lits when it establish communications. I'm using 115.2K, 8N1. I ohmed from the db9 plug to the back of the connector on the camera and verified connectivity. What am I doing wrong?
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,929
Reaction score
6,776
Location
Scotland
I'm using USB to serial adapter
There are different types of USB to serial adaptor - what type are you using?
I'd speculate when you mention "the db9 plug" that you are using a classic RS232 interface that uses bipolar signal levels +-3-15v
The camera needs a 'TTL level' serial adaptor which uses unipolar signal levels 0-3v
You need a 'USB to TTL serial adaptor'.
In eBay or Amazon they are available in large numbers very cheaply.
 

2delarosa

n3wb
Joined
Jul 26, 2015
Messages
23
Reaction score
1
Yes. You're correct. I picked up a TTL level serial adapter and it worked. Now, I'm trying to figure how to update the firmware using the console. Most of the threads out there talk about using tftp server. Do you have any commands I can use?
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,929
Reaction score
6,776
Location
Scotland
Do you have any commands I can use?
These vary with the version of the bootloader in the camera.
If you interrupt the startup, the 'help' command will list the available commands.
You will need a standard tftp server - this one is old but works well: http://www.jounin.net/tftpd32.html
What is the problem with the camera that has made you resort to a console connection?
Have you used the console connection to check out the specifics of the problem you're experiencing?
 

2delarosa

n3wb
Joined
Jul 26, 2015
Messages
23
Reaction score
1
I have nine cameras and I upgraded a 2432 and 2032 to 5.3 build 150513. Turns out the cameras are Chinese region so I lost access to them. I tried following the sticky post from Whoslooking to downgrade but the cameras did not issue a tftp command. I tried various configurations. Going through a switch using POE or a external power supply. I attached directly to a server with an external power supply. The IP address of the camera was a 169.x.x.x; not the 192.0.0.64 that I was expecting. So I consoled in to force the tftp download. I have a tftp server on my NAS. I figure I need to set the IP address on the camera and the IP address of the tftp server, issue the command to download the digicap.dav, write it to flash, and then reboot. with setenv, I believe I can stumble through the configuration but I hope someone else has already went through this, documented the steps, and listed some best practices.

P.S. I've added the console log of the 2432 when it boots up. Any insights on davinci errors would be helpful.
 

Attachments

Last edited by a moderator:
Top