Bricked 2CD2032-I no sadp

[nambi]

When upgrading my cam I bricked it, bricked it hard no mini system (even with the brick fix tool) can't upload FW with the hikvision tool. Nothing in SADP

when I connect it I can ping 192.0.0.64 Two times then stops, it won't take the upgrade.

it this trash or can I jtag it? I have 3 cams that never cam back after upgrading one I may be able to get back online but 2 are not responsive, wondering if I should replace or repair.


If repair is an option.

Any advice on how to handle a this would be appreciated.

 

[alastairstevenson]

Zip up and attach here the mtd6ro_mod files and I'll check them out.

You are very likely to be able to understand the problem and fix them up by connecting to the serial console.

 

[nambi]

I included the files from the one cam I can at least get into and write the minisystem to . Here si the files I extract from it. If during the testing with this i wrote other cam's mtd files to it, if I wrote the mini system then extract the mtd files again would the mtd files extracted be that of the bad camera? and therefore the good mtd files lost for good if I didn't' have backups on the PC? (which I know I don't)

Thank You for the help, regarding the serial connection fix for the hard bricked ones, do you sell this cable? and once I get / make a cable does one just putty into the cam then run the brick fix? have you ever fixed a cam like this?

 

[alastairstevenson]

I included the files from the one cam I can at least get into and write the minisystem to .

Zip up and attach here the mtd6ro_mod files and I'll check them out.

In your attachment is the mtd6ro_orig (not the mtd6ro_mod as requested) from a Chinese DS-DS2132F-IS camera with a masqueraded devType.
This camera would 'brick' when EN/ML firmware was applied to it.

Don't you have any of the mtd6ro_mod files that you used to apply to the cameras that are not seen by SADP?
It may well be that the problem is in the modified contents of those files.
Can you still start a telnet session to those cameras where SADP does not see them?
If so, the mtd6ro data can easily be extracted and checked.

regarding the serial connection fix

What you need for this is readily available on eBay :
A 4-pin 1.5mm JST ZH wired connector, usually sold in 10-packs.
A serial TTL to USB convertor, common is a PL2303HX-based device, often sold as 'For Arduino'.

if I wrote the mini system then extract the mtd files again would the mtd files extracted be that of the bad camera? and therefore the good mtd files lost for good if I didn't' have backups on the PC? (which I know I don't)

I'm sorry but I do not understand what you are asking here.
What you must not do is to use the mtd6ro_mod file from one camera for another camera.
If you do - you will have 2 identical cameras on the network, with duplicate IP MAC addresses.
If they are powered on at the same time, the networking will fail, only one camera will be accessible.

 

[nambi]

thank you here is the mod i did on the file, I sent you the original yesterday/ for cam my cam dev type I have1E98 (i put in 1E)

I'm going to order tho tools from Ebay would hate to toss our working cams over s fw issue.

"if I wrote the mini system then extract the mtd files again would the mtd files extracted be that of the bad camera? and therefore the good mtd files lost for good if I didn't' have backups on the PC? (which I know I don't) "

what I was trying to get at is, if I FUBR the mtd file and I no longer have any original backup etc. is this cam a lost cause? I understand the using an mtd file from another cam would clone it and cause conflicts but I was out of options and trying different things just to get it going, yet no luck.

 

[alastairstevenson]

what I was trying to get at is, if I FUBR the mtd file and I no longer have any original backup etc. is this cam a lost cause?

No, it's still able to be recovered.
The 'bootpara data' that's held in mtd6ro and is modified to convert the camera also has another copy in mtd5ro.
I'd guess that your problem camera still has telnet access - is that correct?
With either telnet access, or the serial console access, mtd5ro can be extracted and used to recover any data that was in mtd6ro which can then be fixed up and applied to the camera.

Looking at the files that you supplied, from the problem camera :
The checksum value in 0x05 is not correct.
The value in the file is 0x0C03 when it should be 0x0D03
On the newer firmware, that will cause a 'bricked' camera.
But easily fixed.

 

[nambi]

Thanks for looking into this,

Not sure how I made these mistakes I did over 15 of them, maybe files got mixed up.

I ran the brick fix again, got the mini system into the cam. Then I extracted the cam data using putty, moved all these files extracted to a new backup folder,

I took the mod files I posted here and put them in the cam upload folder ready to upload into the cam, I then loaded the hex editor opened up the mt6_mod and
made the edit on 0x05 and changed this value to 0D (this is what I interpreted) it was 0c before.

uploaded the mod file into the cam (the exact same files i posted here with 0x05 changed to 0D) into the cam, uploaded the new FW into the cam reboot it hoping to see in sadp 192.168.1.64 but no detection.

I then decided to do everything from scratch.

back to mini system, extract files mod the needed areas including 0x05 save and upload I took a screen shot of the mod I did before I saved it so you can see what I changed in red.

Still nothing,

Is there anything evident that I did incorrectly?

After all this, I dont' see it in sadp I cant' login in via 192.168.1.64, I can't batch config it,

I CAN PING IT.








ordered the parts they were cheap! thanks under 3$ for everything

No, it's still able to be recovered.
The 'bootpara data' that's held in mtd6ro and is modified to convert the camera also has another copy in mtd5ro.
I'd guess that your problem camera still has telnet access - is that correct?
With either telnet access, or the serial console access, mtd5ro can be extracted and used to recover any data that was in mtd6ro which can then be fixed up and applied to the camera.

Looking at the files that you supplied, from the problem camera :
The checksum value in 0x05 is not correct.
The value in the file is 0x0C03 when it should be 0x0D03
On the newer firmware, that will cause a 'bricked' camera.
But easily fixed.

 

[alastairstevenson]

I took a screen shot of the mod I did before I saved it so you can see what I changed in red.

Those mods look OK.

But I'm puzzled -

uploaded the mod file into the cam (the exact same files i posted here with 0x05 changed to 0D) into the cam

back to mini system, extract files mod the needed areas including 0x05 save

The extracted file should have been the same as the file you'd already modded and applied to the camera - and so should not have needed any changes.

 

[nambi]

yes thats what I expected too I've modded this cam so many times, yet everytime i try and I extract the mtd6 files, I need to change the language to 01I wonder if I use Chinese FW I can get this going?

if I could find it I would try, I wonder if I use batch config on a chinese menu camera if It would read and be in English.

If I upload the mod file then I run fixup.sh I then upload the FW

Is there a command I can upoad the mod file, then run stage 1 again to downlaod what I just uploaded to see it in the hex editor and see what happened, I have a feeling I may need to putty into the cam and possibly change permission settings then it may accept the uploaded filed.

 

[alastairstevenson]

yes thats what I expected too I've modded this cam so many times, yet everytime i try and I extract the mtd6 files, I need to change the language to 01I wonder if I use Chinese FW I can get this going?

That does seem to be the root cause of not being able to fix up this camera.

Is there a command I can upoad the mod file, then run stage 1 again to downlaod what I just uploaded to see it in the hex editor and see what happened, I have a feeling I may need to putty into the cam and possibly change permission settings then it may accept the uploaded filed.

You might find it interesting to experiment with manually extracting and uploading the files at the telnet root shell using the tftp commands.
It's easy enough to do, and you can inspect how it's done in the tftp command lines of the fixup.sh script as shown below.
For the tftp commands, you'd need to replace the $SERVER word with 192.0.0.128 as the address of the tftp server.
Don't be daunted by it - it's nothing like as hard as it looks.

#brick-fixV2 - a helping hand to do the enhanced mtd hack
SERVER=192.0.0.128
#
# This value will decide if a stage is considered to be complete.
STAGE_STATUS=0
echo "This is the brick-fix and update script which will help you to extract,"
echo "modify and replace mtdblock6 to fix the downgrade block and convert this camera to English updateable."
echo -e "\n** It is no longer necessary to make any changes to mtdblock1 - these have been processed already **"
echo "."
echo "The whole process takes 3 stages."
echo "Stage 1 - mtdblock6 is extracted and sent via tftp to your PC for you to modify."
echo "Stage 2 - the modified mtdblock6 is retrieved by tftp from your PC and applied to the camera."
echo "Stage 3 - the '5.3.0 to 5.2.5 downgrader' firmware is retrieved by tftp from your PC and used to update the camera."
echo "At this point the web GUI in English will be available and allow"
echo "you to do progressive updates from 5.2.5 to 5.3.0 to 5.4.0 to 5.4.5"
echo "."
echo "In each stage, check the content of the logfile fixup_log.txt for the actions taken and the status."
echo "Good luck!"
echo "."
echo "Checking that tftp works OK ..."
echo "Checking that tftp works OK ..." >> /dav/fixup_log.txt
cd /dav
tftp -p -l fixup_log.txt -b 1400 $SERVER
if [ "$?" = "0" ] ; then
    echo -e "\ntftp test transfer worked OK."
    echo "[stage start] fixup_log.txt successfully transferrred to the PC via tftp" >> /dav/fixup_log.txt
    echo "."
fi
#
#
#
#stage3 retrieve and apply the downgrader firmware
if [ -e /dav/fixup_stage3.txt ]; then
    cd /
    echo "."
    tftp -g -r digicap.dav -b 1400 $SERVER
    if [ "$?" = "0" ] ; then
        echo -e "\nSuccessfully transferred in digicap.dav via tftp"
        echo "Successfully transferred in digicap.dav via tftp" >> /dav/fixup_log.txt
        echo "."
        echo "Attempting a firmware update ..."
        echo "Attempting a firmware update ..." >> /dav/fixup_log.txt
        echo "."
        # The upgrade program gives a return value=0 even on failure, so need to assess the result differently.
        /bin/upgrade /digicap.dav > /dav/fixup_upg_ok.txt
        UPG=`cat /dav/fixup_upg_ok.txt | awk '/ERROR/ {print $3}'`
        if [ "$UPG" = "" ] ; then
            echo -e "\nFirmware update appears to be successful.\n"
            echo -e "\nFirmware update appears to be successful.\n" >> /dav/fixup_log.txt
            cat /dav/fixup_upg_ok.txt
            cat /dav/fixup_upg_ok.txt >> /dav/fixup_log.txt
            echo -e "\n\nChanging fixup current status to completed ..."
            echo -e "\n\nChanging fixup current status to completed ..." >> /dav/fixup_log.txt
            echo "Stage3 is completed - the camera should now be full English and updateable."
            STAGE_STATUS=2
            echo "Fixup stage3 completed - the camera should now be full English and updateable." > /dav/fixup_stages_completed.txt
            rm /dav/fixup_stage3.txt
        else
            echo -e "\n*** error doing the firmware update. ****"
            echo "*** error doing the firmware update. ****" >> /dav/fixup_log.txt
        fi
    else
        echo -e "\n*** error transferring digicap.dav via tftp from the PC. ****"
        echo "*** error transferring digicap.dav via tftp from the PC. ****" >> /dav/fixup_log.txt
    fi
    echo "."
fi
#
#
#
#stage2 retrieve and apply the modified mtdblocks
if [ -e /dav/fixup_stage2.txt ]; then
    cd /
    echo "."
    tftp -g -r mtd6ro_mod -b 1400 $SERVER
    if [ "$?" = "0" ] ; then
        echo -e "\nSuccessfully transferred in mtd6ro_mod via tftp"
        echo "Successfully transferred in mtd6ro_mod via tftp" >> /dav/fixup_log.txt
        cat mtd6ro_mod > /dev/mtdblock6
        echo "Written mtd6ro_mod to mtdblock6 ..."
        echo "Written mtd6ro_mod to mtdblock6 ..." >> /dav/fixup_log.txt
#        echo -e "\nChecking if there is an mtd1ro_mod to apply ..."
#        echo "Checking if there is an mtd1ro_mod to apply ..." >> /dav/fixup_log.txt
#        tftp -g -r mtd1ro_mod -b 1400 $SERVER
#        if [ "$?" = "0" ] ; then
#            echo -e "\nSuccessfully transferred in mtd1ro_mod via tftp"
#            echo "Successfully transferred in mtd1ro_mod via tftp" >> /dav/fixup_log.txt
#            cat mtd1ro_mod > /dev/mtdblock1
#            echo "Written mtd1ro_mod to mtdblock1 ..."
#            echo "Written mtd1ro_mod to mtdblock1 ..." >> /dav/fixup_log.txt
#        else
#            echo -e "\n**** mtd1ro_mod not available via tftp from the PC. ****"
#            echo "**** mtd1ro_mod not found via tftp from the PC. ****" >> /dav/fixup_log.txt
#        fi
        echo "Fixup stage2 is completed - Applied the modified mtdblock"
        echo "Fixup stage2 is completed - Applied the modified mtdblock" > /dav/fixup_stage3.txt
        echo "Initialising fixup next status to stage3 ..." >> /dav/fixup_log.txt
        echo "Initialising fixup next status to stage3 ..."
        echo -e "\nPlease ensure that your required firmware update is named digicap.dav and is available for transfer\n"
        STAGE_STATUS=1
        rm /dav/fixup_stage2.txt
    else
        echo -e "\n*** error transferring mtd6ro_mod via tftp from the PC. ****"
        echo "*** error transferring mtd6ro_mod via tftp from the PC. ****" >> /dav/fixup_log.txt
    fi
    echo "."
fi
#
#
#
# Stage1 extract the original mtdblocks
if [ -e /dav/fixup_stage1.txt ]; then
    echo "Extracting the original mtdblocks ..." >> /dav/fixup_log.txt
    cat /dev/mtd6ro > /mtd6ro_orig
    echo "Extracted the original mtdblock6 as mtd6ro_orig"
    echo "Extracted the original mtdblock6 as mtd6ro_orig" >> /dav/fixup_log.txt
    cat /dev/mtd1ro > /mtd1ro_orig
    echo "Extracted the original mtdblock1 as mtd1ro_orig"
    echo "Extracted the original mtdblock1 as mtd1ro_orig" >> /dav/fixup_log.txt
    echo "Transferring out mtd6ro_orig via tftp ..."
    echo "Transferring out mtd6ro_orig via tftp ..." >> /dav/fixup_log.txt
    cd /
    echo "."
    tftp -p -l mtd6ro_orig -b 1400 $SERVER
    if [ "$?" = "0" ] ; then
        echo "Successfully transferred out mtd6ro_orig via tftp" >> /dav/fixup_log.txt
        echo -e "\nSuccessfully transferred out mtd6ro_orig via tftp"
        rm mtd6ro_orig
        echo "Transferring out mtd1ro_orig via tftp ..." >> /dav/fixup_log.txt
        tftp -p -l mtd1ro_orig -b 1400 $SERVER
        echo -e "\nSuccessfully transferred out mtd1ro_orig via tftp"
        echo "Successfully transferred out mtd1ro_orig via tftp" >> /dav/fixup_log.txt
        rm mtd1ro_orig
        STAGE_STATUS=1
        rm /dav/fixup_stage1.txt
        echo "Fixup Stage1 is completed - Extracted the original mtdblocks"
        echo "Fixup Stage1 is completed - Extracted the original mtdblocks" >> /dav/fixup_log.txt
        echo "Fixup Stage1 completed - Extracted the original mtdblocks" > /dav/fixup_stage2.txt
        echo "."
        echo "Transferring out fixup_log.txt via tftp for you to check ..."
        echo "."
        echo "Your Stage2 task now is to make a copy of mtd6ro_orig named as mtd6ro_mod"
        echo "and to carry out the 'enhanced mtd hack' on it."
        echo "This means setting the language byte at 0x10 to 1, checking/changing as needed the devType"
        echo "bytes at 0x64,0x65 and recalculating and applying the checksum-16 value at 0x04,0x05"
#        echo "Also required is to check mtd1ro_orig for the values at locations 0x0C and 0x8000C"
#        echo "If these are 0, make a copy named as mtd1ro_mod, and change those values to 01"
        echo "When that has been done, run this /dav/fixup.sh script again for Stage2"
        echo "which will transfer the file in and apply it to the camera."
    else
        echo -e "\n*** error transferring mtd6ro_orig via tftp to the PC. ****"
        echo "*** error transferring mtd6ro_orig via tftp to the PC. ****" >> /dav/fixup_log.txt
    fi
    echo "."
fi
#
#     
echo "."
echo "Each stage of the process is carried out by a run of the /dav/fixup.sh script ..."
echo "The next stage is :"
ls -al /dav/fixup_stage*
echo -e ".\n.\n"
echo -e "End of script - ready for the next run.\n." >> /dav/fixup_log.txt
cd /dav
tftp -p -l fixup_log.txt -b 1400 $SERVER
if [ "$STAGE_STATUS" = "0" ] ; then
    echo -e "\n*** An error has occurred. Check the on-screen messages and the contents of the logfile   ***"
    echo "*** fixup_log.txt that was transferred to your PC and after correcting the cause of the   ***"
    echo "*** error re-run the script /dav/fixup.sh to resume.                                      ***"
    /usr/sbin/set_sysflag -m 1
else
    if [ "$STAGE_STATUS" = "1" ] ; then
    echo -e "\nEnd of script - ready for the next run."
    /usr/sbin/set_sysflag -m 1
    fi
fi
#
if [ "$STAGE_STATUS" = "2" ] ; then
    echo -e "\nmtdblock and firmware updates are completed. Now power cycle the camera and log in to the web GUI for full firmware upgrades."
    /usr/sbin/set_sysflag -m 0
fi
#Ends

 

[nambi]

interesting, I'll give it a try, what I really should do is check the permission of the system make sure the cam is accepting the write, if it doesn't then I'll change it try to write it again, then I'll try to download the mod, Verify it is modded in the cam then up the Firmware.

I'll play with this next week .

Thanks for all this info, I'll post my results, I'm stubbron this darn cam will haunt me unti li figure it out, but I will figure it out.

 

[alastairstevenson]

I will figure it out

I do believe that you will!

 

[nambi]

i got all my parts to Jtag the cams, but I'm I can't locate any guides or instruction how to do so, would you have any links that you can share to get me started?

Thanks

 

[alastairstevenson]

would you have any links that you can share to get me started?

There are a fair number on the forum - maybe the second image on this one would help :

UART connection to recover Hik cameras

I was recently looking around the web for some instructions on how to get a serial connection to Hikvision IPC in order to bring back to life my constantly rebooting 2432 camera. And I couldn't find a clear indication on how to do this other than some suggestions that it should be possible...

ipcamtalk.com

Hikvision are consistent with how the 4-pin serial console connectors are wired.
Connect the Tx from the camera to Rx on the serial TTL to USB convertor.
Connect the Rx from the camera to Tx on the serial TTL to USB convertor.
Connect GND to GND.
Do not connect the VCC or 3.3v or 5v wire on the serial TTL to USB convertor.

Use PuTTY with baud=115200 8 bits no parity.

 

[nambi]

Thank you!!! I'll try this week, Hopefully I can resurrect 2-3 of these.