Unbricking DS-2CD2432F-IW help, no luck with 5.30 downgrader

[Rex]

Can anyone help me with unbricking my DS-2CD2432F-IW from aliexpress? Camera date is 03/2016

I updated it to 5.4 via the web interface but it never succeeded. Could not see camera in SADP so I looked here and tried a bunch of firmwares:
5.30 downgrader
5.30 downgrader with hiktools lang digicap.dav 1 mod
5.30 Downgrader 4lines
5.30 Downgrader 4lines with hiktools lang digicap.dav 1 mod
5.30 from hikvision china here 海康威视——以视频为核心的物联网解决方案和数据运营服务提供商
IPC_R0_EN_STD_5.2.3_141024
I even asked the seller and they sent over a digicap.dav file and that didn't work either

I could not get the Device [192.0.0.64] system update completed! message no matter what I tried, waited up to 20mins too. I noticed that ping stopped responding after the completed file transmit message. After power cycle, the camera shows in SADP in mini-recovery mode. In mini-recovery, telnet shows access denied message

Also tried with a different cisco switch and different patch leads. I'm totally out of ideas. The only thing I saved from the original firmware are the config files

 

[alastairstevenson]

I updated it to 5.4 via the web interface but it never succeeded.

What 5.4.0 version did you use? Do you have any idea what the region of the cameras is?
I'm wondering if the 5.4.0 'unrollback (sic)' feature is getting in the way of your downgrade attempts.
The only way to find out would be to open it up and use the serial console to see some detail about what's going on.
In the meantime, some other firmware sources to try out here : HIKVISION EUROPE
By the way - it's not necessarily the tftp updater 'completion' message that indicates success, but the state of the camera after a power cycle that determines it.

 

[Rex]

thanks for the quick reply. the 5.4 firmware i used is http://oversea-download.hikvision.com/uploadfile/USA/Firmware/Value Series/DS-2xx2_5.4.0_160530.zip
I fear the unrollback feature may really be getting in the way too.
how would I go about and check the region? SADP currently shows CCRR in the serial but that's after I flashed it with v5.3 firmware from hikvision china.
I'll go and try out more firmwares in the mean time. The only one i tried from Hik europe is IPC_R0_EN_STD_5.2.3_141024
how would I use the serial console? is it a USB to RS232 like this one? I'm getting one to enable RTSP on my cheap xiaoyi/xiaomi home camera. This might be easier in terms of time saving since flashing the firmware is time intensive!
I read some users only had success after seeing completion message and ping responded until that message shows up. I might redo some of the firmwares again just to rule this out.

 

[alastairstevenson]

That USB to TTL serial convertor is OK - but you would also need the wired connector to attach to the camera serial console connector.
Something like this : 4-pin 1.5mm jst micro zh connector | eBay
4-pin 1.5mm jst micro zh connector
Make sure it's 4 pin and 1.5mm

 

[whoslooking]

post a copy of the camera sticker this will show what is the original firmware, and whether it's World Region or Chinese.

From this we can work out what firmware you need.

 

[Rex]

4-pin 1.5mm jst micro zh connector

thanks, I'll order one as well then. saves me the trouble of soldering then.

here is a photo of the sticker on the back of the camera.

 

[Enabler]

You might want to have another look at the thread I posted about 5.4.0 downgrader for 2xx2

2xx2 5.4.0 to 5.3.0 downgrader

I uploaded a China tagged version that should be accepted by your camera, and it should wipe the part of the camera that thinks it should only accept 5.4.0 +

The camera won't start fully after but after but now you can TFTP 5.3.0 China firmware to it. filename IPC_R0_CN_STD_5.3.0_150513.zip

It's untested, but should work.

 

[Rex]

Just tried the 5.4 to 5.3 downgrader. This in less than a minute, the downgrader showed the 'update completed' message so it definitely did something. I waited for about 10min and then TFTPed the IPC_R0_CN_STD_5.3.0_150513.zip file. However no luck with it at all, still mini-recovery. I also tried the 5.3 downloader again but still nothing. in the end I tried the firmware the aliexpress seller sent and still no luck.

Interestingly while the 5.4 downgrader is running, after the completed message I get ping response for about a minute after still.

 

[whoslooking]

Strange as the camera will downgrade, but you may have to use him tool on the digicap.DAV file just to change the region to Chinese.

That should do the trick, after that an mtd hack is needed

 

[Enabler]

Just tried the 5.4 to 5.3 downgrader. This in less than a minute, the downgrader showed the 'update completed' message so it definitely did something. I waited for about 10min and then TFTPed the IPC_R0_CN_STD_5.3.0_150513.zip file. However no luck with it at all, still mini-recovery. I also tried the 5.3 downloader again but still nothing. in the end I tried the firmware the aliexpress seller sent and still no luck.

Interestingly while the 5.4 downgrader is running, after the completed message I get ping response for about a minute after still.

OK when it says update completed, reboot the camera. It should respond on 192.0.0.99 to a ping once it's started and wiped the part of the camera that records what firmware was installed (max a minute or so).

It won't go further than that into SADP, web etc and just sit there on 192.0.0.99

At that point TFTP the original 5.3.0 China firmware.

 

[Rex]

but you may have to use him tool on the digicap.DAV file just to change the region to Chinese.

I didn't try hiktools since I thought the original firmware as well as the other ones such as the 5.3 downgrader are all set to 2 CN already.

I'll give pinging 192.0.0.99 a go to see what happens.
I could never get the original firmware to work though, it was still booting into mini-recovery

 

[Enabler]

The English 5.4.0 downgrader I posted is set to 1 , whereas the Chinese one I recently put up is set to 2 so there should be no need to alter them.

Ping 192.0.0.99 is not required - but it is a handy indicator the firmware was accepted, has booted, wiped the version store and now is ready to TFTP a version less than 5.4.0

 

[Rex]

Just tried those steps. After update is completed, I rebooted and started pinging. I never got any response from 192.0.0.99 at all.

 

[Enabler]

Sometimes people make the mistake of rebooting the camera when it says file transfer complete (or similar) rather than waiting for device upgrade complete (or similar).

But if you didn't, and you tried the correct version of the files I posted for the region of your camera, then I don't know what the problem is.

 

[Rex]

I've got good news and bad news. I tried the 5.4 downgrader again but this time left the camera on for about 5min after the completed message. After power cycle, I began seeing a response from 192.0.0.99! I left it there for another 5minutes and then opened up TFTP and power cycled the camera. However TFTP never started and the test message never appeared. I left it for about 10min but still nothing. I then power cycled it again but still no luck.

Normally when I power cycle the alarm light is on and the link flashing. Now the alarm light is off and the link light is on and every second it will flash off for ~ 100milliseconds.

Its the first time I cant TFTP. Not sure if there is anything I can do now.

 

[Enabler]

I've no idea why that is - the Chinese file is just the English file tagged as Chinese so it will be accepted by Chinese cameras. It just has a pause because the files are English so it doesn't try to load on a Chinese camera.

Also you seem to get results before that are inconsistant, implying something else going on, so I'm reluctant to draw any conclusions.

 

[Rex]

The only real inconsistancy is the 5.4 downgrader not working before. That would appear to due to the fact that I power cycle the camera ~10sec after the completed message. I'm getting it still haven't had enough time to install properly. On the last occasion, leaving it for 5minutes ensured that it was installed.

What can I do now apart from try the RS232 interface since TFTP doesn't see the camera at all. when I ping 192.0.0.64 at power on, I don't see the two quick ping replies anymore either.

 

[Enabler]

If power and network are OK (and there's no reason to suppose they are not) - that doesn't sound good

You can try the TTL UART (not RS232) after all what have you got to lose at this stage.

The Chinese file I posted was the same as the English one, except told to come up on 192.0.0.99 and wait. Tested ok on my camera but given your experience I've taken it down just in case.

 

[Rex]

yes, power and network ok. also tested with my backup cisco switch. True, have to try TTL UART now, nothing to lose I suppose.

also managed to recover the complete S/N of the device from an email of when it was working. Interestingly, it has CCCH where as after i tried to recover, all of them came up with CCRR in SADP (mini-recovery) and it was missing the '4' from the date and was showing a '.' instead

DS-2CD2432F-IW20160324CCCH584751792

 

[Rex]

ok. i think it's completely dead. connected the serial interface per UART connection to recover Hik cameras

Nothing at all in putty. tried setting different speed and turning flow control off. wires tested fine with my multi-meter. the serial cable works fine with my yi camera that i'm trying to hack so I know the cable is fine.

the only thing I can think of is that maybe I should've left the camera on for longer before power cycle it.

At least now that I have the serial cable, if I ever get into a sticky situation at least I can see what's going on first before flashing.