Search results

  1. M

    02KH firmware header

    Yep, I second that. Oh, the memories... Some of those old games' floppy/tape loaders were absolutely fascinating. There was a website with commented disassemblies, can't find it now.
  2. M

    02KH firmware header

    I'll start reading my PMs more regularly, thanks everybody. RSA signing would need a new bootloader. New bootloader would need to be located in external flash. The flash can be patched to bypass signature verification... HIK should really stop spending R&D cycles on pathetic "security" attempts...
  3. M

    02KH firmware header

    Does anybody know how to decrypt a firmware blob for DS-2x22FWD,2x42FWD_5.3.6_151105 Here is the header, de-XORed as usual. The last 3 DWORDs are offset, length, and CRC of the firmware blob that immediately follows he header. The blob appears encrypted. How do I decrypt it? The camera is still...
  4. M

    Hi3535 SDK

    For those interested, SDK for Hi3535 (which is what 76xx, 77xx, 86xx are based on) appears to be available here: https://soc.systems/projects/hisilicon-hi3535-sdk
  5. M

    NVR firmware V3.4.6 build160405 released.

    +hidden command to enter debug mode: zhimakaimen. It needs a response for the challenge and you only have 5 attempts. It is easier to disable psh altogether though.
  6. M

    Hardware comparison within camera lines

    Don't know about 78xx, but on a 76xx the two SMD chips on top of the PCB are RAM. The flash is mounted on the bottom of the PCB. MX25L12835F. Your log suggests the same chip. http://www.macronix.com/Lists/DataSheet/Attachments/3253/MX25L12835F,%203V,%20128Mb,%20v1.5.pdf
  7. M

    Hardware comparison within camera lines

    Yes, I am trying to make sense of all those combinations. There are just a few popular SOC/sensor choices (Hi3516/3518, IMX178/222, OV9712), but there are dozens of HIK models within each line and there isn't an easy way to tell the difference (eg: 2cd2t42 vs 2cd2t45). Also, regarding the...
  8. M

    Hardware comparison within camera lines

    I would like to understand how core hik camera hardware compares between different models within the same Hikvision lines. I do NOT need to know that a "Z" suffix stands for "Zoom" or that some cameras come with POE and some don't have the POE module. I need to understand hardware...
  9. M

    New hikvision tool in the works

    OK, since the hiktool.rar and everything else I was able to find did not work with current digicap.dav images, I created this: jpi@dvdev:~$ hikpack hikpack 1.0b -- Hikvision digicap.dav firmware packer/unpacker Usage: hikpack -i <davfile> print dav file information...
  10. M

    Hikvision custom Firmware

    See my pm. They will kill their business if they continue doing it this way.
  11. M

    Hikvision custom Firmware

    Splendid! I hope they read this then: HIKVision -- please stop bloating the kernel with unnecessary crypto IOCTLs. Your firmware is becoming hackier and less stable with each new release. A much wiser use for your resources would be fixing real security issues (such as buffer overflows), fixing...
  12. M

    NVR firmware V3.4.6 build160405 released.

    Chinese 3.4.6 firmware for DS-76xx/77xx/86xx is here: http://download.hikvision.com/UploadFile/Soft/NVR/NVR_EXX_76%2077%2086_V3.4.6_160405.zip
  13. M

    Hikvision custom Firmware

    hikvision started encrypting files To decrypt the files do this on the NVR where you have shell access: /bin/ded <encrypted_file> <decrypted_file> -d If you modify any files, you will need to update new_10.bin as it contains MD5 checksums.
  14. M

    Encoding scheme for digcap.dav

    That is totally incorrect. Only digicap.dav header is XOR'd in newer firmware. Files inside the dav are encrypted using 3DES-ECB. The keys are in the uImage. Newer kernels provide /dev/hikded device and IOCTL interfaces used by /bin/ded to encrypt/decrypt files. Still, this does not protect...
View older results
Top Bottom