New RCA HSDB2A 3MP Doorbell IP Camera

[David L]

So were you able to or is it possible to put hikvision firmware on RCA doorbells? What's the procedure to make sure no bricking?

Check out our 101

 

[IdleWild]

TLDR: Unbricking via TTL Serial was successful!

I was able to get connected with the TTL Serial adapter, and found that the Config file of the camera is what is causing it not to load. The magic bullet was to interrupt the boot and issue a format command to erase everything but the bootloader, then issue an update command (with sdcard inserted, having RCA firmware renamed to digicap.dav as the only file present). This loaded successfully and the doorbell booted to a blue flashing ring and voice prompt to configure via phone app.

Full details:

The USB TTL Serial adapter arrived this afternoon and I tinkered with it after work. For reference, I purchased this one which uses a Prolific chipset. Win10 picked it up and automatically installed functional drivers.

I'm already familiar with using Putty (years of IT work) but for anyone who's not, there are detailed instructions for setting up the connection on the thread I was referencing earlier about resetting Hikvision devices via TTL Serial.

Because of the packaging of the doorbell, Hik didn't put a JST-ZH connector on the 4-pin TTL Serial header. It does use the 1.5mm pin spacing of the JST-ZH connector, though. Lacking a connector and wanting a reliable connection, I temporarily soldered some 22AWG wires onto the pin pads, with a 3-pin PC fan header on the other end of the wires so I could slide the TTL adapter leads on. Not a clean soldering job at all, just going for quick, functional, and easy to desolder afterward, since I'll need to remove this in order to close up the camera case.

Not to worry, a little heat shrink to keep those wires separated.

I connected ground, TX and RX from the USB TTL adapter to the leads coming from the board.
JST Pin 1 (my black wire) -> TTL Ground (black)
JST Pin 2 (my red wire) -> TTL RX (white)
JST Pin 3 (my orange wire) -> TTL TX (green)
JST Pin 4 -> NO CONNECTION (do not connect the TTL red wire to JST pin 4. The TTL adapter outputs 5V and the camera runs at 3.3V.)

I powered it up, and my Putty window sprang to life with output from the camera. After pressing CTRL+U at the prompt to interrupt the bootloader, I found there is an update command which tries to read digicap.dav from the sdcard. I ran this, and it completed successfully and rebooted. BUT - the camera was still stuck in a boot loop, so I examined closer and found two errors:

[09 22:34:30][CONFIG][ERROR]config_file_to_json error
[09 22:34:30][CONFIG][ERROR]recover_config_file

I looked at the available commands (typing ? or help lists them) and found format - format flash except bootloader area. Sounded promising, so I executed format, followed by another update command to load the firmware from digicap.dav on the sdcard. Success! The doorbell booted to a blue ring and voice prompt.

I am going to further configure it on the RCA firmware I just loaded, flash it over to EzViz firmware, remove the EzViz logo from the video output (via Batch Config), then flash over to my final intended LaView firmware. That will get it to the same state as my other two RCA units. Once everything's done, I'll desolder my wires from the TTL header and close it up.

@davidew98 I am not really an expert on Linux and other embedded OS, but if there are any specific commands you'd like me to try to probe it with before I remove the TTL wires and close it up, let me know. In the Code block below is a listing of the commands available when the bootloader is interrupted (CTRL+U at the prompt).

I've attached the full text output from my Putty session to this post as a PDF file. For science!

I hope this helps someone who has a bricked doorbell kicking around and doesn't mind doing a little soldering and buying a $7 USB-TTL adapter to get it running again.

U-Boot 2010.06-svn-43155 (Oct 30 2018 - 10:01:33)
Find sd card.
DM9051-MAC
Hit Ctrl+u to stop autoboot:  0
HKVS # ?
?       - alias for 'help'
arc_go  - start application at address 'addr'
base    - print or set address offset
bdinfo  - print Board Info structure
boot    - boot default, i.e., run 'bootcmd'
bootd   - boot default, i.e., run 'bootcmd'
bootm   - boot application image from memory
bootp   - boot image via network using BOOTP/TFTP protocol
cmp     - memory compare
coninfo - print console devices and information
cp      - memory copy
crc32   - checksum calculation
dhcp    - boot image via network using DHCP/TFTP protocol
echo    - echo args to console
editenv - edit environment variable
fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls   - list files in a directory (default /)
format  - format flash except bootloader area
go      - go xxx.bin thru network
go_orig - start application at address 'addr'
gos     - go xxx.bin thru serial
help    - print command description/usage
iminfo  - print header information for application image
imxtract- extract a part of a multi-image
loadb   - load binary file over serial line (kermit mode)
loadk   - load kernel to DRAM
loadm   - load mini to DRAM
loads   - load S-Record file over serial line
loadss  - load safe system
loady   - load binary file over serial line (ymodem mode)
loop    - infinite loop on address range
md      - memory display
mm      - memory modify (auto-incrementing address)
mmc     - MMC sub system
mmcinfo - mmcinfo <dev num>-- display MMC info
mtest   - simple RAM read/write test
mw      - memory write (fill)
nfs     - boot image via network using NFS protocol
nm      - memory modify (constant address)
pinctrl - Pin Ctrl
ping    - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
rarpboot- boot image via network using RARP/TFTP protocol
reset   - Perform RESET of the CPU
run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv  - set environment variables
sf      - SPI flash sub-system
sleep   - delay execution for some time
source  - run script from memory
sspi    - SPI utility commands
tftpboot- boot image via network using TFTP protocol
upa     - update app image
uparc   - update arc
update  - update digicap.dav
updateb - update ramboot and uboot
updateu - update uboot
updevinfo- update devinfo
upf     - update firmware, format and update (factory use)
upk     - update uImage
upmcu   - update mcu
upmini  - update minisys
upram   - update ramboot
upres   - update res
version - print monitor version
wdt     - WDT utility commands

With the wires sticking like that how did you close up the camera to give it power?
ps. Nevermind I missed the bit that camera is gonna get powered from the USB cable.