Thank you. Do I go to 5.2.5 first or proceed with 5.3.0 after the’enhanced mtd hack’?
alastairstevenson
Staff member
Hi alastairstevenson,
I am too wanting to upgrade my cameras after getting them up and running. my 2 cameras are as follows.
Model: DS-2CD2332-I
Serial No.: DS-2CD2332-I20150422CCCH514342868
Firmware Version: V5.2.5 build 141201
Encoding Version: V5.0 build 140714
I have edited my mtdblock6_orig in the attachment. All the links in this thread to the new firmwares seem to be dead, any idea where to get 5.3.0 and 5.4.0?
Now I have my edited mtdblock6_orig (provided it is correct) Where do i go from here in terms of upgrading the cameras?
Thanks.
I am too wanting to upgrade my cameras after getting them up and running. my 2 cameras are as follows.
Model: DS-2CD2332-I
Serial No.: DS-2CD2332-I20150422CCCH514342868
Firmware Version: V5.2.5 build 141201
Encoding Version: V5.0 build 140714
I have edited my mtdblock6_orig in the attachment. All the links in this thread to the new firmwares seem to be dead, any idea where to get 5.3.0 and 5.4.0?
Now I have my edited mtdblock6_orig (provided it is correct) Where do i go from here in terms of upgrading the cameras?
Thanks.
Attachments
alastairstevenson
Staff member
Despite it being an image and not a file (so I could verify the checksum), that looks OK to me.
Just be sure to keep a copy of the original, and only update a copy.
Out of interest - how did you extract mtdblock6 ?
I'd guess not by using the 'brickfixv2' method, as that handles the export and import via a script to make it easy, and allows going direct to version 5.4.5
What you should be able to do is :
Apply the modified mtdblock6 using the existing 5.2.5 telnet/SSH that you've presumably been using.
Reboot and check the web GUI still works OK.
Using this method it's safest tp progress through the 5.3.0 -> 5.4.0 - 5.4.5 versions, using the web GUI maintenance menu.
You can still download them here : Value Series
I used the method here with the windows share - Hikvision DS-2CD2x32-I (R0) brick-fix tool / full upgrade method / fixup roundup.
I just realised there is now a V2 method as you mentioned so I will take a look at that!
I will head down the V2 path and should be able to go direct from 5.2.5 to 5.4.5.
I just realised there is now a V2 method as you mentioned so I will take a look at that!
I will head down the V2 path and should be able to go direct from 5.2.5 to 5.4.5.
Last edited:
Urmil Patel
n3wb
- Oct 5, 2017
- 13
- 1
thank you for the guide and I gave this a try but got stuck so I'm holding fast before proceeding. I think the road blocks I have may been down to tools as you suggest to use HxD and I am using iHex (Mac equivalent) tool for this. I don't think that should matter but it may be the reason why.
I have exported the mtdblock6 successfully. (the original process said to export file 5 & 6 but your instruction says to just get 6. Is my understanding correct?)
I have my dev type: 38932 - which I have calculated to be '9814' in hex. so the correct order would be 14 98???
I have uploaded mtdbblock6 to my iHex editor.
I can change '0X10' to '0x01'. all good and feeling goof so far.
Then the devtype and hex catches me out.
at position 0x64 and 0x65 i have FF 98.
Do i replace FF with 14 and 98 stays the same? I think i have it right but just want to check.
Lastly the check sum at position 0x04 and 0x05.
Do I start the checksum from location 0X09 but how far down do i go? is it all the way to the end before all the FF FF FF FF starts? Or do i start at the first data point and highlight up to the last entry before all the FF FF FF start??
just an update i downloaded Had for windows on a windows machine. got the checksum results all good now but not sure when i select the data in the hex editor how much of it do i select to do the checksum on? is it from the first data point to the last before all the FFFF?
If my checksum is F808 does that mean in point 0x04 i would put 08 and in point 0x05 i would put F8??
I think thats it. If i can get these steps confirmed I'm all set to go and try make these changes
Hiya, I have three same camera models which were purchased from AliExpress with the same Chinese firmware (V5.2.5 build 141201), my cameras are connected to a HikVision NVR, and I can ssh/scp to the private camera IPs (192.168.254.x) via my Windows laptop. I can never get the CIFS share to work to pull the mtdblock6 file off, how did you manage this?
I appreciate any assistance!
alastairstevenson
Staff member
This method works OK, using a tftp server :
Unbrick and fully upgrade your R0 / DS-2CD2x32 IP cameras -
R0 / DS-2CD2x32 BrickfixV2 brick recovery and full upgrade tool - enhanced.
Unbrick and fully upgrade your R0 / DS-2CD2x32 IP cameras -
R0 / DS-2CD2x32 BrickfixV2 brick recovery and full upgrade tool - enhanced.
Urmil Patel
n3wb
- Oct 5, 2017
- 13
- 1
Thanks for the reply, finally got to try this method! I tried both the v2 CN and EN files which copied across perfectly via the Hikvision TFTP program, but after powering off/on the camera would reply on 192.0.0.64 for about 10 secs but I could never get to the telnet prompt via putty and pings would stop.
In the end I applied the 'brickfixv2' again but then did not reboot the camera, I closed the Hikvision TFTP program and opened the normal TFTP program to pull off the 'mtdblock6' file by typing in the following command:
SERVER=192.0.0.128
tftp -p -l mtdblock6 -b 1400 $SERVER
Then made the changes as per your instructions (renamed to 'mtd6ro_mod' in HEX editor) and copied the file back by typing these commands:
tftp -g -r mtdblock6_mod -b 1400 $SERVER
cat mtd6ro_mod > /dev/mtdblock6
Now I launched the Hikvision TFTP program again after copying in the 'digicap.dav' file (IPC_DS-2xx2_EN_STD_5.4.5_170123) in the 'tftp' directory. I then typed in 'reboot' at the telnet prompt and the camera rebooted.
I checked my camera firmware via the NVR to connect to it, the firmware has been upgraded to correct version! ;-)
One final question, can I copy the same modified 'mtdblock6' to my remaining Chinese cameras, same models to update them?
Thanks!
alastairstevenson
Staff member
Good workaround! Well done doing the alternate route.
Don't use the same mtd6ro_mod file for other cameras even the same model, as it holds the MAC address and serial number.
Duplicate MAC addresses will break the networking. But you could mod the file to make it different.
Don't use the same mtd6ro_mod file for other cameras even the same model, as it holds the MAC address and serial number.
Duplicate MAC addresses will break the networking. But you could mod the file to make it different.
Urmil Patel
n3wb
- Oct 5, 2017
- 13
- 1
Thanks for the information, I complete my other similar cameras, but when I did my final camera (DS-2CD2432F-I(W)) with the same method and firmware the camera never shows on my NVR or gets an IP.
I can still connect via putty if I use a tftp server, appreciate any help on recovering this one and if you have the firmware to use?
Regards,
Tich.
alastairstevenson
Staff member
Does it show in SADP, if so, what's the firmware version?
Maybe worth trying a recovery with the classic '5.3.0 to 5.2.5 downgrader' - see attached.
Urmil Patel
n3wb
- Oct 5, 2017
- 13
- 1
I went back to my previous 'mtdblock6' and then did the downgrader, camera is back online and back on 5.2.5..
I've attached my files (Porch.zip), appreciate if you can check if I did anything wrong, hopefully give it another go during week.
Appreciate all your help.
Attachments
alastairstevenson
Staff member
The modded mtdblock6 looks fine.
One possibility might be the contents of mtdblock1 if the brickfixv2 firmware doesn't execute.
Some cameras have contents that cause a reboot into min-system mode as it's interpreted as having failed an update attempt.
The brickfixV2 firmware when it runs forces a valid mtdblock1 template to be written to cover those cameras.
Urmil Patel
n3wb
- Oct 5, 2017
- 13
- 1
Thanks for the reply, can I do a manual 'mtdblock1' template copy? I can connect to the camera via tftp and putty.
alastairstevenson
Staff member
Yes, that should be feasible.
It might be interesting to first export the original, for inspection.
Attached are a couple of variants to try.
One is a plain template, one has the 'previous firmware version' in locations 0x16
The important values are held in 0x0a and 0x 0c - these are 'the success count for the last firmware update attempt'.
If zero, it implies a problem and it triggers a reboot into the min-system mode.
If mtdblock1 is all erased, that's not a problem, the firmware treats that as a reason to apply an initial valid template.
It would be good if this fixes the problem, but not guaranteed.
You'd have to connect to the serial console to get more detailed info as to what's going on.
Urmil Patel
n3wb
- Oct 5, 2017
- 13
- 1
Thanks for the reply, I managed to get it working by using your 'donor' version, I've attached my 'mtdblock1' which did not work.
Appreciate all the support you have given me!
alastairstevenson
Staff member
Great! That's good to hear.
Yes - it has zeros in the locations where the success counts for the last firmware update is held, so it's interpreted as a failed update.
That's why I arranged for the brickfixV2 process flow to include the writing of a valid template into mtdblock1, to cover some cameras that were manufactured with invalid data in it.