DS-2CD 6332 fwd (fisheye) -How to upgrade (CN to EN)

In short - the camera works - The modified mtd WAS SUCCESSFUL.
Wow! Indeed, who would have thought it?
I'm amazed - and pretty impressed that you found that and figured out what it was, well done! You must be wearing your lucky charm.
I'm really not sure how obvious that would have been - not at all is my guess.
Attached is a modded mtd6ro_mod with a different MAC address.

The modified mtd created a mac address which is exactly same to another of my 6332 on the network!!!
A potential implication of that is the seller applied the same modded copy of mtdblock6 to at least these 2 camera - as well as the 'hacked to English' firmware. I wonder if that was a way to get round the 'per-camera' licence for the CBX (or similar) mods? I don't know if they are linked to MAC address or serial number - or both.

When you get a chance, it may be worth checking out the serial numbers on your cameras, see if they match.
 

Attachments

Please excuse the dumb question - the modified mtd6 that you applied was taken from the camera that you extracted it from?
Yes - You caught my dumb moment. I checked it BEFORE I read your comment - effectively - i was cursing myself when this thought came into my head. This thought was triggered when I applied the mod_1, and still the cam came up with the same MAC.

Yes - The camera from which I picked up the mtd6ro is different (and bit not accessible). I in my brainy moment missed the important fact that MAC is stored in these mtds and messed up.

Summary- Yes - The mtd came from a different camera. Will apply this to the donor camera and report.(on upgrade possibilty with newer firmware).

PS - I did the following check -
a) prtHardInfo comes up with the language flag1
b) Var.. script shows the camera is chinese.
 
Hmm - after my snafu - I have a potential trouble now.
Since I dont have the original mtd6 of this camera, I cannot put this cam on network now.

I have two more of these - and file compare of the mtd6 of these give 24 difference. Basically they are 8, but repeat 3 times. Of these 8, 3 are serial number changes. so, that leaves me with 5 changes- and their mac differs by 3 changes.
How to reconstruct the mtd6 from this? I am uploading the mtd6s for comparing.

The MAC of the effected camera is C0:56:E3:BE:DE:4A and serial number is 492873934 (last digits)

PS -

alastairstevenson - I am thankful for helping me out. I am giving above MACs and serial numbers not that I want everything laid out to me - But just nudging me to the right direction. I am quite sure that putting back the above serials and MAC is possible.
 

Attachments

Last edited:
Since I dont have the original mtd6 of this camera, I cannot put this cam on network now.
Yes you can - assuming the NetHDD is a share on the PC (and the PC IP address matches what's set in the camera for the NetHDD) and the camera and PC are be on the same switch and the camera the MAC etc was cloned from is not - in other words sidestep the duplicate MAC address error.
Your original serial number is in the prtHardInfo (assuming that's the camera you have applied the modded mtdblock6 to?) and is
Serial NO DS-2CD6332FWD-xxxxxxCCCH492873934
And you don't really need the original MAC address - but if you did, are you using DHCP reservations to set the IP address? In which case it's configured in the router.
So - attached is the original mtd6ro that you posted here, with a modified MAC address, and with the serial number from your prtHardInfo posted here, and a fixed-up checksum.
Presumably that will work OK.
 

Attachments

Thank you - The camera came up with different MAC. Though a little bit surprised, you change e3 to e4 in the 3rd byte - Wouldnt it change the manufacturer?
edit - e3 is still hikvision.
Serial was not changed (in all 3 places?). I think I have a side effect(and for you to study)

Fisheye Camera1 in mode 2- It doesnot come up. IVMS says not supported. This is the main fisheye 360 camera.
I tested mode 1, mode 2(other 4 cams), mode3 and mode 4. All come up.

Language is 1 in prtHardInfo.
But VAR=`dd if=/dev/mtd5ro skip=1620 bs=1 count=1 2>/dev/null` ; if [ $VAR == $'\002' ]; then echo Chinese ; elif [ $VAR == $'\001' ]; then echo English ; else echo Unknown; fi
understandbly gives out Chinese.


The next firmware on hikvision europe is 5.3.5. I guess I will going one way forward (encrypted firmware etc) with that version. Should I try something to get the camera1 in mode2 before I loose the ability to modify mtds? Or just try to jump in and check if the next firmware works?

Edit again - I reset the camera using batch tool. Strangely - It didnot loose the network settings but all channels started working. So, the camera is back at the state what it was- working fully (But now with modified mtd6 and language flag=1 in prtHardInfo)
 

Attachments

  • cam3.png
    cam3.png
    91.9 KB · Views: 11
Last edited:
Ok - As the camera is now fully operational, the procedure to update is -
If you need to update from 5.0.9 to 5.3.5, you need to update "digicap_eng_std.dav" first, then update the firmware 5.3.5.


So, any gotchas before?
 

Attachments

I reset the camera using batch tool. Strangely - It didnot loose the network settings but all channels started working. So, the camera is back at the state what it was- working fully (But now with modified mtd6 and language flag=1 in prtHardInfo)
Well, that's good. A few steps forward ...
 
If you need to update from 5.0.9 to 5.3.5, you need to update "digicap_eng_std.dav" first, then update the firmware 5.3.5.
Sorry, but for that camera I have no familiarity with the update path or required steps.
It does look like you've made good progress.

One thing I do need to mention though - assuming the same trap exists as in R0 firmware - do not write mtdblok6 or 5 while running firmware 5.3.0 or higher. There may be a deliberate trap that is hard to get out of.
 
Success- Upgraded to 5.41 (via 5.3 interim)

I didnot gain H265 :(

But overall compression/quality has improved.

Thank you alastairstevenson

Will try to upgrade the balance camera(can you tell me which block crc is to be maintained in mtd5).


Now off to the second project 2CD-3942F which is chinese fisheye..
 
Curiosity got the cat!!
i upgraded to 5.4.5, to language mismatch error!!

ivms work though.

The language flag is 2 now in prtHardInfo
 
Last edited:
One thing I do need to mention though - assuming the same trap exists as in R0 firmware - do not write mtdblok6 or 5 while running firmware 5.3.0 or higher. There may be a deliberate trap that is hard to get out of.
What exactly is this trap?

And I think Hikvision is now checking the other copies(balance 2 copies of mtd6) in 5.4.5 onwards?

And, I did gain H264+ in another mode - Fisheye only. Worth the compression (tradeoff on quality)
 
Last edited:
I didnot gain H265
That's a function of the capability of the DSP (Digital Signal processor) in the SoC (System on a Chip), in other words the hardware as well as the firmware.
Success- Upgraded to 5.41 (via 5.3 interim)
Well, that's good.
Curiosity got the cat!!
i upgraded to 5.4.5, to language mismatch error!!

ivms work though.

The language flag is 2 now in prtHardInfo
And that's not so good.
Maybe a difference between the R0 5.4.5 and the Fisheye 5.4.5
You should be able to downgrade to the 5.4.41 version - it's backdoor-fixed as well.
What exactly is this trap?
I found that when you write mtdblock6 back on 5.3.0 firmware (or maybe also higher) that the kernel puts a 0 in the language byte, and the camera bricks, and also complains in the bootloader also. Do not write a modified mtdblock6 (and perhaps mtdblock5) back under the newer firmware.
Presumably to trap those camera that had the 'classic mtd hack' under the 5.3.0 to 5.2.5 downgrader.
And I think Hikvision is now checking the other copies(balance 2 copies of mtd6) in 5.4.5 onwards?
That's feasible - some study of that firmware would be needed to confirm that.
I'd speculated that if ever an R0 firmware above 5.4.5 was released, that might be done to trap the 'enhanced mtd hack'. But not so far.
 
You should be able to downgrade to the 5.4.41 version - it's backdoor-fixed as well.
Tried to downgrade using IVMS - says language mismatch.

Hikvision as usual is putting in more effort in making sure we dont upgrade and Chinese Govt access to our homes remain intact. Well, 5.41 is what I would like to have. I havent lost any functionality though - other than web access (use it via IVMS)
 
Tried to downgrade using IVMS - says language mismatch.
OK - maybe what's required is a 5.4.41 version of the firmware with a CN header - I'll look at doing that later.
I'm at last in the process of some camera re-wiring to move to h.265 and a new NVR.
So far so good.
 
hmm - another bad news on this camera - IVMS now refusing to connect saying language mismatch.
So, this camera is a brick now.

Any pointers on how to recover?
Read your detailed guide on brickfixv2. You have put some magic sauce in digicap which is brickfixv2.
So, any chance you can make brickfix_version_for_6332?
 
OK, so stock EN/ML firmware 5.4.41 worked OK, the camera was updated OK and presented as EN, language=1 in prtHardInfo.
But 5.4.5 complains of a language mismatch, so we speculate that it has some additional checks for modifications to the 'hardware signature block'.

So, this camera is a brick now.
Presumably the web browser is saying the same?
If you haven't tried already - install the Batch Configuration Tool and see if it connects OK. Hangzhou Hikvision Digital Technology Co. Ltd.
I'd be surprised if it didn't.
Have you used the Hikvision tftp updater tool?
Worth checking is if the camera would accept the stock 5.4.41 firmware via this method.
If it's only the full booted-up system that has the additional checks, the tftp update to downgrade may fix it.