Bricked SV3C IP 1080P Firmware help

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,950
Reaction score
6,786
Location
Scotland
In all honesty, I could have just purchased another $40 camera instead of all these flashing equipment and thrown the camera in the trash. But I am enjoying this, great learning experience. Also, I'll be able to help friends if they ever have the need to flash a chip.
I can certainly relate to those sentiments.
The learning and research and problem solving and testing and sharing are all interesting and keep the mind active.
If we looked at these activities from an accountant's perspective we just would not do any of it.
 

RubberDinero

Young grasshopper
Joined
Aug 13, 2018
Messages
54
Reaction score
1
Location
phoenix, az
Well, I tried and tried again and this programmer is not reading the chip. It won't detect it, it won't read it. Maybe i need better instructions. I tried hooking everything up before inserting the USB and many, many other things and that chip won't read.
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,950
Reaction score
6,786
Location
Scotland
Well, I tried and tried again and this programmer is not reading the chip. It won't detect it, it won't read it. Maybe i need better instructions. I tried hooking everything up before inserting the USB and many, many other things and that chip won't read.
That's disappointing.
Arguably it's a bit optimistic putting a programmer in parallel with the normal circuitry that the chip is connected to, but it can work. However, it's not guaranteed, it depends on how the other circuitry affects the programmer signals.
Presumably the camera was powered off?
 

RubberDinero

Young grasshopper
Joined
Aug 13, 2018
Messages
54
Reaction score
1
Location
phoenix, az
That's disappointing.
Arguably it's a bit optimistic putting a programmer in parallel with the normal circuitry that the chip is connected to, but it can work. However, it's not guaranteed, it depends on how the other circuitry affects the programmer signals.
Presumably the camera was powered off?
Yeah, powered off and disconnected from everything. My next idea will be to take the chip off completely and see if it will read.
Another issue is that the programmer I'm using doesn't list an MX25L6436, only matches up to MX25L64... the rest don't come close.
I'll take the chip off and see if it'll read.
 

RubberDinero

Young grasshopper
Joined
Aug 13, 2018
Messages
54
Reaction score
1
Location
phoenix, az
That's disappointing.
Arguably it's a bit optimistic putting a programmer in parallel with the normal circuitry that the chip is connected to, but it can work. However, it's not guaranteed, it depends on how the other circuitry affects the programmer signals.
Presumably the camera was powered off?
I read in another place that the reason some chips can't be read in parallel is because when you input the VCC voltage, it sends that to the board and tries to boot. There are some solutions, you could put a 1000ohm resister before the nearest power source to the VCC to prevent the voltage from spewing. Or remove the chip from the board. I'm going to try number 2. been youtubing soldering tips. Flux is the key.
 

RubberDinero

Young grasshopper
Joined
Aug 13, 2018
Messages
54
Reaction score
1
Location
phoenix, az
Well, after desoldering and connecting it to my chip reader. Nothing, nada. same as if it were still plugged in. Maybe this reader is just not compatible. Don't know. I've officially given up. No way to program this chip.
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,950
Reaction score
6,786
Location
Scotland
Well, after desoldering and connecting it to my chip reader. Nothing, nada. same as if it were still plugged in. Maybe this reader is just not compatible.
Oh dear, not good.
A google search suggests that the MX25L6436F can be programmed via the CH341A. There is a lot of commonality amongst serial flash memory chips.
But it depends on the program, and the drivers.
What program and version are you using?
 

RubberDinero

Young grasshopper
Joined
Aug 13, 2018
Messages
54
Reaction score
1
Location
phoenix, az
Oh dear, not good.
A google search suggests that the MX25L6436F can be programmed via the CH341A. There is a lot of commonality amongst serial flash memory chips.
But it depends on the program, and the drivers.
What program and version are you using?
at first I was using 1.18 and then i found 1.29. do you have a more recent version?
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,950
Reaction score
6,786
Location
Scotland
No, it sounds like you are up to date.
But I have a recollection from a while back that an earlier version worked more reliably for the eeprom I was messing with at the time.
 

Bert Jones

n3wb
Joined
May 19, 2017
Messages
23
Reaction score
11
Hopefully this information has not come too late and will be helpful.

Today I successfully unbricked one of these cameras by using the C341A Flash programmer and program v1.29 to read the MX25L6436F ic removed from a working camera and flashing it to the ic from the bricked camera. The bricked camera kept it's original serial number and MAC address after flashing. I'm not sure if the password and fixed IP address were kept or not as both passwords were originally the same and I didn't keep a note of the original IP address.

I had tried to read the flash rom while it was on the pcb but was unable to. But even after removing the ic the programmer would not read the ic. After a lot of testing, as I initially suspected a fault on the USB programmer pcb after reading some information on the internet, I found that the ic clip was not connecting to the pins of the ic! I had to put the ic further down in the clip before it would connect, which bent the pins. Once I did that it was able to read and write to the ic. Use the Detect option in the program to confirm it is fully connected.

I used Program v1.29 on Windows 7 x64, while Sandboxed, to read and write to the ic. V1.30 read the ic but gave occasional error messages, which may only be because it was Sandboxed. I never tried it un-sandboxed. I only read and flashed the Main memory area of the ic.

I set the program to use the MX25L6436E ic, as the F version was not listed. The E version is identical to the F version but has a smaller Secured memory area. The Secured memory did not appear to have anything in it when I read it but that may be because it is Secured, because it is actually empty or because the program cannot read it as the wrong version, type E instead of F, was selected. Both programs V1.29 and v1.3 don't have the F version listed.

As the bricked camera kept it's original serial number and MAC address I assume they are either stored in the Secured rom area, which I didn't copy or flash, or in the 16Kb flash rom ic, which I didn't try to copy.

I purchased both of these cameras at the end of last year, they are dated 28/8/2017. Both came with firmware version V2.3.4.2103-S50-NTD-B20170508B. I was using them with a HikVision NVR DS-7732NI-SP NVR with firmware v3.4.4, which I believe is the latest firmware. When I first connected the cameras the NVR found them automatically and listed them as Hikvision type. SADP also found the cameras. I found that a later version of firmware was available for the cameras, V2.3.4.2103-S50-NTD-B20170823B, so I updated both cameras using the camera web interface. Both updated correctly but I then found that the NVR and SADAP would no longer find them! But the NVR would find them if set to ONVIF instead of Hikvision.

So I tried re-flashing the previous version of the firmware to one of the cameras, using the camera web interface. About halfway through the flashing the browser said it had lost connection and nothing I did would reconnect to it. I tried using the Product Tool and the Search tool from the SV3C website but neither would find the camera. I found that the Product Tool and the IPSearch programs do not work on Windows 7 x64 when Sandboxed. I didn't try them non Sandboxed. But they do work on XP when Sandboxed. Both found the non bricked camera.

So I opened the camera and soldered wires to the Serial connections and using Putty I got exactly the same boot log as the original poster.

After un-bricking the camera, by flashing the rom with the C341A, I tried using the Product Tool, instead of the web interface, to flash the earlier version of the firmware to see if that would work. While flashing the network led went out for a while but eventually came back on and after a long pause the Product Tool eventually said the flash had been successful. BUT the camera was bricked again and I had to remove the flash rom and reprogram it again!

Before I reflashed the rom again, I used Putty connected to the serial connections and confirmed that the camera had exactly the same boot problems, shown from the Putty log, as when I originally tried to flash it from the web interface.

With the later firmware and with the camera connected to the NVR it now only works in ONVIF mode. It will also not work on the POE ports if the camera is set to DHCP mode. I had to set a fixed IP before the NVR would find it. Although this may be because the NVR still had the settings from when the camera had been connected previously and was getting confused. I have found that moving a camera to a different port can confuse the NVR.
If the camera is connected directly to the LAN the NVR will find it when the camera is set to DHCP mode.


I would like to go back to the earlier firmware V2.3.4.2103-S50-NTD-B20170508B as it worked much better when connected to the NVR and gave far more options. You could set all of the camera settings from the NVR interface, with the later firmware it only works in ONVIF mode and almost no camera settings came be set from the NVR. The earlier firmware version has been removed from the SV3C website but I downloaded a copy before it was removed if you want a copy to look at.

Note that the current SV3C-B01POE-1080 cameras use completely different hardware and firmware. The hardware versions of my cameras are 8700-sc2035 and 8700-sc2135 but both use the same firmware.
 

RubberDinero

Young grasshopper
Joined
Aug 13, 2018
Messages
54
Reaction score
1
Location
phoenix, az
I used Program v1.29 on Windows 7 x64, while Sandboxed, to read and write to the ic. V1.30 read the ic but gave occasional error messages, which may only be because it was Sandboxed. I never tried it un-sandboxed. I only read and flashed the Main memory area of the ic.
.
Can you upload the version of the program you have. I've tried a 1.29 version but it would never read
 
Joined
Jan 3, 2018
Messages
4
Reaction score
0
Hopefully this information has not come too late and will be helpful.

Today I successfully unbricked one of these cameras by using the C341A Flash programmer and program v1.29 to read the MX25L6436F ic removed from a working camera and flashing it to the ic from the bricked camera. The bricked camera kept it's original serial number and MAC address after flashing. I'm not sure if the password and fixed IP address were kept or not as both passwords were originally the same and I didn't keep a note of the original IP address.

I had tried to read the flash rom while it was on the pcb but was unable to. But even after removing the ic the programmer would not read the ic. After a lot of testing, as I initially suspected a fault on the USB programmer pcb after reading some information on the internet, I found that the ic clip was not connecting to the pins of the ic! I had to put the ic further down in the clip before it would connect, which bent the pins. Once I did that it was able to read and write to the ic. Use the Detect option in the program to confirm it is fully connected.

I used Program v1.29 on Windows 7 x64, while Sandboxed, to read and write to the ic. V1.30 read the ic but gave occasional error messages, which may only be because it was Sandboxed. I never tried it un-sandboxed. I only read and flashed the Main memory area of the ic.

I set the program to use the MX25L6436E ic, as the F version was not listed. The E version is identical to the F version but has a smaller Secured memory area. The Secured memory did not appear to have anything in it when I read it but that may be because it is Secured, because it is actually empty or because the program cannot read it as the wrong version, type E instead of F, was selected. Both programs V1.29 and v1.3 don't have the F version listed.

As the bricked camera kept it's original serial number and MAC address I assume they are either stored in the Secured rom area, which I didn't copy or flash, or in the 16Kb flash rom ic, which I didn't try to copy.

I purchased both of these cameras at the end of last year, they are dated 28/8/2017. Both came with firmware version V2.3.4.2103-S50-NTD-B20170508B. I was using them with a HikVision NVR DS-7732NI-SP NVR with firmware v3.4.4, which I believe is the latest firmware. When I first connected the cameras the NVR found them automatically and listed them as Hikvision type. SADP also found the cameras. I found that a later version of firmware was available for the cameras, V2.3.4.2103-S50-NTD-B20170823B, so I updated both cameras using the camera web interface. Both updated correctly but I then found that the NVR and SADAP would no longer find them! But the NVR would find them if set to ONVIF instead of Hikvision.

So I tried re-flashing the previous version of the firmware to one of the cameras, using the camera web interface. About halfway through the flashing the browser said it had lost connection and nothing I did would reconnect to it. I tried using the Product Tool and the Search tool from the SV3C website but neither would find the camera. I found that the Product Tool and the IPSearch programs do not work on Windows 7 x64 when Sandboxed. I didn't try them non Sandboxed. But they do work on XP when Sandboxed. Both found the non bricked camera.

So I opened the camera and soldered wires to the Serial connections and using Putty I got exactly the same boot log as the original poster.

After un-bricking the camera, by flashing the rom with the C341A, I tried using the Product Tool, instead of the web interface, to flash the earlier version of the firmware to see if that would work. While flashing the network led went out for a while but eventually came back on and after a long pause the Product Tool eventually said the flash had been successful. BUT the camera was bricked again and I had to remove the flash rom and reprogram it again!

Before I reflashed the rom again, I used Putty connected to the serial connections and confirmed that the camera had exactly the same boot problems, shown from the Putty log, as when I originally tried to flash it from the web interface.

With the later firmware and with the camera connected to the NVR it now only works in ONVIF mode. It will also not work on the POE ports if the camera is set to DHCP mode. I had to set a fixed IP before the NVR would find it. Although this may be because the NVR still had the settings from when the camera had been connected previously and was getting confused. I have found that moving a camera to a different port can confuse the NVR.
If the camera is connected directly to the LAN the NVR will find it when the camera is set to DHCP mode.


I would like to go back to the earlier firmware V2.3.4.2103-S50-NTD-B20170508B as it worked much better when connected to the NVR and gave far more options. You could set all of the camera settings from the NVR interface, with the later firmware it only works in ONVIF mode and almost no camera settings came be set from the NVR. The earlier firmware version has been removed from the SV3C website but I downloaded a copy before it was removed if you want a copy to look at.

Note that the current SV3C-B01POE-1080 cameras use completely different hardware and firmware. The hardware versions of my cameras are 8700-sc2035 and 8700-sc2135 but both use the same firmware.

can you post the files and any more info please thanks
 

Bert Jones

n3wb
Joined
May 19, 2017
Messages
23
Reaction score
11
Can you upload the version of the program you have. I've tried a 1.29 version but it would never read
Attached is the v1.29 I used. I only used it Sandboxed as AVG thought it had a virus, but AVG often has false positives. Use it at your own risk.

These websites have more information and links to versions of the software :-
CH341A Mini Programmer Schematic and Drivers · One Transistor
CH341A USB Mini Programmer Software Free Download - Kazmi Elecom

This Youtube video tutorial is very good :-

What I found useful was the comment that some versions of the programmer tell you to put the ic in the wrong way round. My programmer is the "Black" version and that has a print of the ic's on the bopard next to hte zif socket. They show the ic the correct way round.

I have a copy of my working flash rom if anyone needs a copy to use to unbrick their camera. But it would only be useful if you are able to read your flash rom using your programmer. If you cannot read your flash rom it's unlikely that you will be able to write to it. You also need to erase it before writing to it. My copy of the flash only contains the Main memory, it doesn't include the Secured memory area, and as far as I can tell it doesn't contain any of my personal information.
 

Attachments

Bert Jones

n3wb
Joined
May 19, 2017
Messages
23
Reaction score
11
can i have a link for the flash file thanks for your help
Attached is the copy of my flash rom. It may set the camera to a fixed IP address of 192.168.254.5 but if you use the Search tool you should be able to find the camera and change it without having to mess around with your network and computer IP addresses.
 

Attachments

Bert Jones

n3wb
Joined
May 19, 2017
Messages
23
Reaction score
11
As well as keeping a copy of the working flash rom with firmware V2.3.4.2103-S50-NTD-B20170823B I also kept a copy of the bricked flash rom after I used the Product tool to flash it with the earlier firmware V2.3.4.2103-S50-NTD-B20170508B.

Doing a file compare I found that the first area of memory of both files is identical, the rest of the memory is different. This makes me think that the first area of memory contains boot code, or similar, that the early version of the firmware does not over write when being flashed with the Product tool (because the tool recognises that it is later code?) and as the code is different, it's the later code, that is why the camera will not boot after being flashed with the earlier firmware.

If I am correct then if this code could be extracted from the earlier firmware file, UPG_ipc8700_f8-M20-snx660_f8-20170508_100042.ov, and flashed to the ic using the C341A programmer then the camera would boot correctly and have the earlier firmware, which is recognised by SADP and my Hikvision NVR and works much better. If anyone, cue Alastair Stevenson, has any ideas on how to do this it would be appreciated. As I have sucessfully managed to unbrick the camera twice I am feeling confident, probably over confident, that I can again unbrick the camera by flashing my working flash copy to the ic if I brick the camera again while trying to get this first area of memory flashed with the earlier code.

I realise that it's not really cost effective playing with the camera to get it unbricked, or to try to get it to work with the earlier firmware version, but I hate to throw things away that can be repaired and also to know that it can work better with the earlier firmware. I've attached a copy of the earlier firmware that I downloaded from the SV3C website before they removed it.
 

Attachments

vman101

n3wb
Joined
Dec 26, 2018
Messages
1
Reaction score
0
Location
USA
I'm not even sure if this is the same issue but I also bricked my SV3C camera it was a POE-1080P camera.. I used the AJ Device Tool to find it and the status stated Login Failed - I eventualy found that if I clicked the IP Batch Setting button and selected DHCP it was able to finally login successfully and work. Maybe this will help.
 

Bert Jones

n3wb
Joined
May 19, 2017
Messages
23
Reaction score
11
I'm not even sure if this is the same issue but I also bricked my SV3C camera it was a POE-1080P camera.. I used the AJ Device Tool to find it and the status stated Login Failed - I eventualy found that if I clicked the IP Batch Setting button and selected DHCP it was able to finally login successfully and work. Maybe this will help.
I'm pretty sure yours was a different issue. It sounds like your password, or IP address, had been changed.

I had tried the software that was available on the SV3C website "Product Tool for POE IP Camera", which should be the equivalent of the "A J Device Tool" you used, and that was unable to detect the camera. I also tried the Onvif Device Manager tool and that was also unable to see the camera.
 

AveryFreeman

Getting the hang of it
Joined
Jan 24, 2019
Messages
122
Reaction score
50
Location
Near Seattle
I tried to upgrade the firmware via the provided OV file from their website and it bricked.

I am able to get info off the Serial UART connection on Putty and it says that it's looking for "uImage".
I am not sure if it'll work, but did you try SV3C's AjDevTools? I just flashed a SV-B06-4MP-A w/ it last night. PC Software A Series Download | SV3C

Thread is old, did you get your TFTP to work? I thought I'd have to do it myself, but AjDevTools worked for me.
 
Top