Search results

  1. M

    [MCR] Hikvision packer/unpacker for 5.3.x and newer firmware

    The attached app unpacks and repacks Hikvision firmware for K41/K51 NVRs and R0/R1/R6/G0 cameras. I plan to add support for more hardware, but in many cases I need to buy cameras to extract keys from them. Your donations can help, contribute here if you feel like it: The binary runs on x64...
  2. M

    (www.hik-online.com) is determined to discontinue

    .. also a stool sample, a copy of your birth certificate, and a notarized list of your sex partners for the last 3 years.
  3. M

    Hikvision 4MP Firmware 5.40.20 doesn't exist formally yet LOL

    How the heck did you get it? It does not exist on the web. The only two possible options I can think of are: beat it out of the seller with a rubber hose and use the recent hik ddns website hack to get an unpublished version off their website.
  4. M

    Hikvision 4MP Firmware 5.40.20 doesn't exist formally yet LOL

    I have that 5.4.20_160726 firmware, it is for G0 series of cameras(2345/3345), and might not work for R6 series (2042). The seller did not want to provide digicap.dav no matter what, so I just dumped nand flash from the camera. I'Il repackage and share digicap.dav later -- that needs G0/CN...
  5. M

    [MCR] R6 EN camera firmware 5.4.3 repack +SSH -PSH

    This is a repack of R6 English firmware IPC_R6_EN_STD_5.4.3_160902 with the following changes: * PSH disabled * SSH enabled IPC_R6_EN_STD_5.4.3_160902_mcr.zip — RGhost — файлообменник Enjoy!
  6. M

    any turret or bullet with built in mic?

    I have just received DS-2CD2345F-IS. Not only it has a built-in mic, it comes with sd card slot, audio out, alarm input, ALL smart event features (face detection, etc). And the serial connector is conveniently accessible under the SD-card slot cover, so no need to disassemble the camera for...
  7. M

    Hikvision Permanent Region Change

    It is possible to permanently change region code, default country (CH, WR), most parameters, serial number, and everything else stored in bootparams. I have done this to NVRs. I have not tried to play with cameras, because I do not have any CH cameras. I should probably buy one.
  8. M

    Accessing individual cameras connected to a built-in PoE HikVision NVR switch

    Just tested. I stand corrected. "Virtual host" does control ip_forward. Also, static route syntax for windows is: route add 192.168.254.0 mask 255.255.255.0 <NVR-IP-ADDRESS>
  9. M

    Accessing individual cameras connected to a built-in PoE HikVision NVR switch

    "Activate virtual host" should not be needed. NVR by default routes traffic between the subnet it is connected to and the camera/poe subnet. Step1: for each camera set NVR POE IP (192.168.254.1) as a default gateway Step2: on your desktop add a static route for the POE subnet, using this...
  10. M

    [MCR] NVR_K51_BL_ML_STD_V3.4.80_160718 DS-78xxNI-I2 firmware +BUSYBOX +BPREAD -PSH

    K51 DS-78xxNI-I2 firmware repack for NVR_K51_BL_ML_STD_V3.4.80_160718 http://rgho.st/7xHv2ZRzs Changes: PSH removed Added bp_read app that dumps bootparams (just run bp_read at console prompt). Yes, I also have bp_set that changes bootparams but I won't share it at this time. Full featured...
  11. M

    Hikvision NVR English firmware 3.4.80

    Update: The amount of memory seemed too small, so I opened the NVR. It actually has 1GB of DDR3 DRAM. Here is what I think the issue is: 8P hardware comes with 1GB of DRAM. Of the 1Gb, 640MB (80MB per channel) is allocated for video buffers, which leaves 384MB for system RAM. I bet that 16P...
  12. M

    Hikvision NVR English firmware 3.4.80

    That is a good question. Somebody with a 7616 I2/16P, check your memory size. DS-7608NI-I2/8P has 384Mb of system RAM DS-7608NI-E2/16P has 512Mb of system RAM This confirms my suspicion that all Hikvision hardware is designed by pandas in the Hangzhou zoo.
  13. M

    Hikvision NVR English firmware 3.4.80

    I did not notice it, but I have not looked much because 76xx I2 with this firmware reboots all the time. I did research the reboots, they are OOM killings of hikvision's main process by the kernel, so HikVision's message about insufficient RAM on 76xx I2 devices is unfortunately correct. fsck...
  14. M

    Hikvision NVR English firmware 3.4.80

    Yeah... This new firmware really does suck. Tried it for 15 minutes... Some configuration screen show empty data over https, but work fine over http. 3.4.62 did not have this problem, but had a tendency to reboot if you click too fast in the IVMS playback menu. I guess Hikvision's engineers are...
  15. M

    *** You go Hang Zhou! *** [R6 camera (DS-2CD2x42) firmware encoding method]

    Sector number is 0x2e000, not 0x2e010. Offset in the sector is 0x10. That only changes the language, not the region code. Region code is stored at a different offset. Also, you can write unencrypted bootparams into that sector even if the existing sector was encrypted. Firmware accepts it...
  16. M

    [MCR] Advanced Hikvision K51 (DS-76xxNI-I2) firmware 3.4.62 -PSH +SSH +BUSYBOX

    This is a repack of NVR_K51_BL_ML_STD_V3.4.62_160503 PSH disabled SSH available Hikvision's bastardized busybox replaced with a full-featured busybox app. This turns the DVR into a capable Linux server. You can do syslog, etc. http://rgho.st/68mln2sdk Enjoy.
  17. M

    *** You go Hang Zhou! *** [R6 camera (DS-2CD2x42) firmware encoding method]

    I stand corrected. Hardware write-protection in dvr serial flash is actually not used because Hikvision's production processes need to modify bootparams multiple times to set configuration values, such as memory sizes, model name, and yes, region and language codes. What this means for us is...
  18. M

    Here's how to read Hikvision serial numbers

    There is confusion in forums regarding serial numbers and region codes. Here is now you read HIK serial numbers: Example for a DVR: DS-7608NI-E2/8P0820160211AAWR123456789WCVU (IP camera serials are similar) DS-7608NI-E2/8P <- model name 08 <- input channels 20160211 <-...
  19. M

    Hikvision FIRMWARE TOOLS - change language, extract files and create own firmware

    Cannot be sure, and it may actually be Chinese. I had a Chinese DVR with RR region code and Chinese language code (which was permanently changed to US/English and it now happily takes US firmware). Technically,they are all Chinese, regardless of he region code and language code. :) I'll post a...
  20. M

    5.4.0 firmware for EN/US R6 (2x42) cameras. SSH re-enabled. PSH disabled

    The ftpd contains a hardcoded crypt() hash "ToCOv8qxP13qs" which corresponds to the password "hiklinux". I tried it with the username "root", it did not seem to work. Why would you need ftp? You can transfer everything you need through nfs or cifs mounts.
  21. M

    Main Stream Lagging and Choppy with 4MP Cams

    The Hi3535 codec in your NVR can simultaneously decode five 1080p streams at 30fps. Hik's specs for the NVR say "four 1080p streams". You are loading it with six 4mp streams.
  22. M

    *** You go Hang Zhou! *** [R6 camera (DS-2CD2x42) firmware encoding method]

    It also appears to be write-protected using security features of the flash chip (MX25L12835F in my NVR). You can buy a new chip for $3 and program it to your taste. Cameras use generic NAND memory that cannot be write-protected and it is easier to permanently change region in them. Encryption...
  23. M

    5.4.0 firmware for EN/US R6 (2x42) cameras. SSH re-enabled. PSH disabled

    http://rgho.st/79FhPqRZr
  24. M

    5.3.8 psh-less firmware for EN R6 cameras (2x42 ).

    Shared externally, see link in the OP.
  25. M

    5.3.8 psh-less firmware for EN R6 cameras (2x42 ).

    Repacked IPC_R6_EN_STD_5.3.8_160126 firmware with psh disabled. English cameras only. I could repack the same EN firmware to work with CN hardware, but I don't have any CN cameras for testing and they use different crypto keys. Yes, I can do 5.4.0 and R0 cameras (2x32) too. Be patient...
  26. M

    *** You go Hang Zhou! *** [R6 camera (DS-2CD2x42) firmware encoding method]

    R6 camera (DS-2CD2x42) may support face detection I have not explored it yet, but 2042 firmware includes face classification library.... Stay tuned.
  27. M

    *** You go Hang Zhou! *** [R6 camera (DS-2CD2x42) firmware encoding method]

    Xuefeng Qian, Hikvision's head of R&D is on the mission to use as many crypto, hashing, and CRC algorithms as his team can possibly fit in firmware. So far we have: md5 sha1 dumb add crc XOR with rotating key XOR with computed key crc32 3des aes256 All this obfuscation mess has no...
  28. M

    NVR firmware V3.4.6 build160405 released.

    They use RSA, but psh generates a rather short challenge and it might be possible to write an app to bruteforce the response, but again, it is easier to get rid of psh altogether.
  29. M

    HangZhouHikVisionOpenssl

    Could somebody PM me 14 bytes that ioctl("/dev/hikio", 0x8004480f) returns? (2032 hardware)
  30. M

    02KH firmware header

    I wish they only copied good/useful features... What is the deal with Chinese obsession with ActiveX? Why cannot they use a full-featured HTML5 instead? ActiveX is 20+ years old and should die painful death. What product architect genius decided to use it in 2016? Hik should cut that person...
Top Bottom