Can't access DS-2CD2442FWD-IW (R6 platform) anymore. Uploading firmware via TFPT doesn't solve it

bugmenot

bugmenot

Young grasshopper
Jun 30, 2014
27
7
So I had a problem with my Zyxel POE Switch when I did some firmware changes on it. Two of my Hikvision camera's then stopped working a DS-2CD2432F-IW and a DS-2CD2442FWD-IW.
After I fixed the issue on the Zyxel switch (factory reset) one Hikvision camera started working again but the DS-2CD2442FWD-IW did not.
All the indicator lights (alarm, status, link) and the IR Led seem to be permanently on.
I tried to use the reset button on the camera to factory reset it. I got no visual feedback (the indicators keep being turned on permanently), but I do see in my router the camera has IP 192.0.0.64 which is the default one.
However the SADP tool doesn't see it.
I connect my laptop directly to the camera with an ethernet cable (and power the camera with 12V as obviously my laptop does not supply POE) and manually configure the IP of my laptop to 192.0.0.128.
When I ping 192.0.0.64 the camera responds about 66% of the time.
Using my browser to go to 192.0.0.64 does not work.
I can successfully use TFTP to flash firmware to the camera . I flashed both the latest firmware for this camera, as well as some older firmware from this post. But in both cases SADP does not see the camera (it does see my other camera's) and navigating to 192.0.0.64 using the browser does not work either.

I'm out of idea's (I tried all the above on what I found in various threads in this forum and posts from @alastairstevenson), so I was hoping someone could provide me some guidance on what else I could try.
Thanks!
 
Hi!
The most effective way is to connect the camera to PC using uart-converter and see, what happenning during the camera boots and even make a controled firmware upgrading.
Also you can try to use something like wireshark to see, what camera 'says' to other network devces, maybe yo can find something useful in this messages.
Is your camera a non-chinese camera? Because some cameras, that have worldwide firmware, become a brick after upgrading to a wrong firmware. But in this case usualy tftp upgrading helps.
 
try to flash 5.2.5 version universal firmware. If i understand correctly, this helps to unbrick your model of camera.
But if your firmware upgrading was succesfull, maybe the problem is out here.
The simplest way to understand it is using wireshark. It should show if your camera can't boot properly and reboots and reboots.
 
Thansk a lot for your advice @v-milenin,

I installed wireshark and looked at the traffic when flashing firmware using TFTP, then rebooting the camera and then doing some ping requests.
The output is here:
I can't deduct from that whether it is in a bootloop. Is there something I should do to get that info?
It being in some sort of boot-loop could explain why pinging the device fails very often.

I tried to search for this universal 5.2.5 firmware you were referring to but couldn't find it. 5.2.5 seems very old (Hikvision europe only goes back to 5.4.1). Where did you find this special edition to unbrick the R6 series of camera's?

I did buy this hikvision camera (and all my other hikvision camera's) from Aliexpress, but specifically chose one that was sold as an original English version updatable camera and have in the past always been able to upgrade the firmware without problem (same for my other Aliexpress Hikvision cameras).
 
bugmenot said:
I installed wireshark and looked at the traffic when flashing firmware using TFTP,
Click to expand...
If that's the 5.5.82 R6 firmware, and the Hikvision tftp updater, then the digicap.dav is just a little larger than the 32MB filesize limit of that updater.
The Scott Lamb tftp updater Python2 clone doesn't have that filesize limitation.
github.com

GitHub - scottlamb/hikvision-tftpd: Unbrick a Hikvision device (NVR or camera) via TFTP

Unbrick a Hikvision device (NVR or camera) via TFTP - scottlamb/hikvision-tftpd
github.com github.com

Also - despite the header version being tweaked, it might be that the older 5.4.5 firmware falls foul of the R6 'downgrade block' that Hikvision implemented.

Something quick to try would be the other 5.5.x R6 versions here, they should just creep under the 32MB filesize limit of the Hikvision tftp updater :

R6 series firmware - see models list - History

www.ipcamtalk.com www.ipcamtalk.com
 
I suppose, that:

1) output after line # 9 says that the cam has found the tftp server and started to transfer the firmware;
2) and i think, that after line 75 we can see, tht the boot went wrong and the cam started to look after tftp server to load the firmware.

Also it's a good idea about the filesize. I had the same problem with G5 cam. I've TFTPed earlier only R6 cams with old small size firmware, so when i tried to upload a firmware for G5 i've got a problem because of it's size.
I've used such way: running TFTP64 (that can transfer bigger files), than run usual hikvision tftp program (it send something like special signal), than turn it off. After that camera started to upload the firmware from TFTP64.
 
bugmenot said:
I tried to search for this universal 5.2.5 firmware you were referring to but couldn't find it. 5.2.5 seems very old (Hikvision europe only goes back to 5.4.1). Where did you find this special edition to unbrick the R6 series of camera's?
Click to expand...

I'm sorry,- i've mixed up R0 and R6 platform.

I have old R0 camera, i'll try to get the wireshark output with normal boot later, maybe it will help.
 
Thanks a lot @alastairstevenson and @v-milenin,
Based on your advice I used tftp to flash the firmware IPC_R6_EN_STD_5.5.53_1807 which indeed is under 32MB in size.
Just like with the other firmware TFPT tells me that everything went fine.
However SADP still can't find the camera and I can't reach it from the browser (both when I connect the camera and laptop directly using an ethernet cable and manually setting the laptop IP to 168.0.0.128 and when the camera is connected to my switch and my laptop has a normal IP).
Here's the output from wireshark (I added some comments on what I was doing at various stages).

Anything you think I could try further based on the output in those logs?
 
bugmenot said:
Anything you think I could try further based on the output in those logs?
Click to expand...
I don't think it's close enough to the action to get a better idea of what's going on.
If you want to spend more time on the topic - the serial console should give a much clearer picture of the problem.
 
Do you mean this type of stuff?
I'm afraid that's over my skill level (wireshark is already stretching it, I'm more experienced in HR policy than IT :)).
Does this basically mean that except if I want to break open the device and do these type of serial connections, my camera is now an expensive paperweight?
 
It's no so difficult as it looks like. About two weeks ago i used such device to connect the camera. I hadn't any big troubles with itm but it helped me to reanimate the camera.
The difficulties, that i faced during connection were the wires. Usual wires (like on the picture) are big black square tips, but my camera has a small connector for serial connection. I've removed this tips and used paper tape to isolate it. it's enough to connect only txd, rxd and gnd wires to the camera.
 
bugmenot said:
Do you mean this type of stuff?
Click to expand...
Yes, that looks like a serial TTL to USB convertor.
You'd also need a 4-pin 1.5mm JST ZH wired connector.

bugmenot said:
wireshark is already stretching it
Click to expand...
Well, you did OK with that!

bugmenot said:
Does this basically mean that except if I want to break open the device and do these type of serial connections, my camera is now an expensive paperweight?
Click to expand...
Basically, yes.

Just one more thing to try - though you've already done this :
Don't be running the tftp updater, just run SADP.
Power the camera off, keep the reset button pressed, power the camera on, keep the button pressed for about 40 seconds.
Release the reset button and click the refresh button in SADP over the next couple of minutes, see if it appears.
 
You must log in or register to reply here.
Top Bottom