Custom Firmware Downgrader 5.3.0 Chinese to 5.2.5 English

[high-5]

Thanks alot for this tool, worked great on a CH 2DS-DDS-2CD2632F-ISC!!

 

[vuhothang]

Dear whoslooking!

Can you tell me how to change region or language for 2xx0 (my camera is DS-2CD2110FD-IS) is chinese language but NVR DS7608NI-E2 is English version, my NVR can't connect CamIp (mismatch language).

I can u-boot console, ssh

but ssh from PC-Linux can't cat /dev/mtdblock5, mtdblock6 to mmc (i put sd to mmc slot) or nas (connect nas success) (on pc-linux ssh root@192.168.1.64 cat /dev/mtdblock5 /mnt/mmc01/temp5)
on pc-linux ssh root@192.168.1.64 ls /mnt/mmc01 or /mnt/nfs0 i can see current files!

Thanks!

 

[whoslooking]

This tool doesn't work on model XXX0 or XXX5.
If you using 2410 I would ask your seller for the firmware.

Also it would seem mtd2 is the key file on this model

I believe the chinese have a hacked version I don't if you do manage to get one remember to share it.

 

[gary_mcm]

I did something stupid trying to solve an issue and probably put the wrong firmware on a DS-2CD2032F-I.

Followed the TFTP instructions which never gave me the final message. Retried a bunch of times and now it won't get passed the first initialized message.

The camera does show up in SADP:



Any assistance would be appreciated.

 

[alastairstevenson]

The camera is in the so-called 'min-system' mode, a recovery mode with no web services, when incompatible firmware, or other problems occurs.
You will need to try loading some compatible firmware - though what exactly is compatible seems less certain (to me) on the newer cameras than it used to be.
Maybe other can comment on what worked for them.
What was the originally installed firmware, from the label and the web GUI?

As a start, if you haven't already done so, try the firmware on the first post of this thread.

 

[gary_mcm]

I don't have the boxes anymore so I can't tell you the firmware. On the Amazon page they are listed as 5.3.0 though.

Since the TFTP seems to do nothing after initialized, and doesn't even detect the camera, is that also due to the firmware I am trying to upload, or am I not leaving it long enough? I feel certain this camera can be recovered, if i just knew what was going on.

 

[alastairstevenson]

Followed the TFTP instructions which never gave me the final message.

So tftp has worked, but no longer works?
But SADP is still finding it.
Just check if telnet is available at the 192.168.1.64 address. It used to be in the older cameras, but I think no longer so.

One way to figure if the camera is still tftp aware / active is to change the PC IP address to 192.0.0.128 (wired, not WiFi), use 'ping -t 192.0.0.64' and power cycle the camera.
Normal would be 2 or 3 responses a couple of seconds after power on, with none thereafter.
If that doesn't work, repeat with 192.168.1.128 / 192.168.1.64

Since the TFTP seems to do nothing after initialized, and doesn't even detect the camera, is that also due to the firmware I am trying to upload, or am I not leaving it long enough?

The tftp probe is immediately after power on, a fraction of a second, from the bootloader.
A common cause of it not happening is Windows firewall blocking the inbound access from the camera, or the PC being on WiFi, or, less commonly use of a direct cable instead of both being plugged in to a switch or router.

 

[gary_mcm]

I actually had been plugging the camera into the laptop's ethernet port and that's how the TFTP sort of worked the first time. I tried it a few ways now with the device on the network and no success.

I tried the ping as you described, with a power cycle. Ping starts with "request timed out" 6 times, then dozens of "destination host unreachable" then after a few minutes it pings fine. Tried 192.168.1.128 / 192.168.1.64 TFTP with no success.

Seems like camera may be finished. Hard lesson to learn, but lesson nonetheless.

EDIT: there definitely is something listening on port 8000. No success with http or https. Telnet echos characters, but no login prompt. SSH no success.
EDIT 2: I was also able to confirm that 192.0.0.64 pings once a few seconds after power is restored.

 

[alastairstevenson]

EDIT: there definitely is something listening on port 8000.

That's what's called the 'media port' , it's the port over which the Hikvision 'command and control' dialogues are conducted.

EDIT 2: I was also able to confirm that 192.0.0.64 pings once a few seconds after power is restored.

That is normal, and good, it's the bootloader setting the network up to probe for the Hikvision tftp updater.

Seems like camera may be finished. Hard lesson to learn, but lesson nonetheless.

It does not sound like it. It's working as normal after a wrong firmware update.

The tftp updater can be a bit unreliable.
There have been posts where under Windows 10 it does not work at all - then bursts into life with Windows 7.
And a common problem is Windows firewall blocking the traffic - but that's usually when people have not had it working at all, unlike your experience.
I don't support you have a serial TTL to USB interface?

Ping starts with "request timed out" 6 times, then dozens of "destination host unreachable" then after a few minutes it pings fine.

That's actually a bit strange - not the initial timeout, as you presumably didn't have the IP addresses correct (implied from your edit), but the 'after a few minutes' result.
Normal or recovery bootup is just a few 10s of seconds.

 

[gary_mcm]

I don't have a TTL to USB, at least not one I can butcher. I think it's worth investing in one though. I have been trying Wireshark to capture any traffic and I get nothing. I believe TFTP is initiated by the device so I think I should have seen a packet(s) from the camera, but nothing.

Anyway, I am very grateful for all your assistance today. Not really sure what to do next. Start googling TTL?

 

[alastairstevenson]

You'll need to decide if it's worth spending your time fixing the thing ... it is a bit addictive, though, having a go.
There are a few posts on here about how to get access to the serial console. The Serial TTL to USB convertor is available widely on Ebay, for the specific cable you need to know the type, again widely available.
This post should provide the needed info: https://www.ipcamtalk.com/showthread.php/6356-Manual-Create-console-serial-access-to-Hikvision-DS-2CD2032F-I?highlight=serial+ttl

 

[gary_mcm]

I have already learned a lot. I bought two of these cameras at the same time and the working one has CCCH in the firmware string. I now know what that means and wish I had known it sooner. Anyway, I ordered all the bits to make the cable and will post to new thread in a few weeks if I have success. Again, many, many thanks, Alastair.

 

[Gaz]

Hi,

I hope someone can help me. I mistakenly upgraded one of my Chinese (english language) DS-2CD2332 to V5.3.0build 150513.

It is now obviously in Chinese and I get a language error on the NVR. I can still access the ip directly in the browser and view the camera, albeit in Chinese.

I have read whoslooking guide but I can't seem to get the camera to appear in the tftp server.

I have tried every conceivable method to get it to appear but to no avail. What am I doing wrong?

I have set my connection to 192.0.0.128 with the camera set to dhcp.
I have set my connection to 192.0.0.128 with the camera set to static 192.0.0.64
I have tried it with 10.0.0.128 (this is my internal ip range)
I have tried hard rebooting by pulling the poe power and by rebooting from the browser

I cannot get the camera to load in the tftp server. It gets an IP address that I can see in SADP.

I can access the camera via the browser.

How can I get this camera back to english and working on the nvr?

Please help.

Thanks

G

UPDATE:


I used the web browser to upload the .dav supplied with the downgrader and it worked. I then did the mtd hack.

Thanks

 

[whoslooking]

Your not the only person to make this mistake.

The easiest way to downgrade is via the Web browser, you don't have to tftp unless your camera is in recovery mode. I.E 4.08 min-system.

Glad to see worked it out.

 

[whoslooking]

I have already learned a lot. I bought two of these cameras at the same time and the working one has CCCH in the firmware string. I now know what that means and wish I had known it sooner. Anyway, I ordered all the bits to make the cable and will post to new thread in a few weeks if I have success. Again, many, many thanks, Alastair.

No cable should be necessary just a standard patch lead.

 

[leesburgjk]

whoslooking:
you solved my problem! (but now I can't send PMs for some reason)...

To recap (for anyone else's benefit):
I have about 40 hikvision cameras deployed at different sites (DS-2CD2632F-IS) and they've all been great for the price.
I always buy "cheap" and get chinese versions but thats never been a problem at all.
i had one camera that kept going dark on the screen after about 20 hours (but still responding) that i kept having to reboot in order to bring back online.
it was still feeding video (software showed frames, http responded properly, etc).

I quickly decided to update firmware without doing much reading and bricked the camera.
While starting my troubleshooting I put up the Hikvision TFTP service with a possible fix (not the fix...) to flash and asked a coworker to go restart that camera.
He restarted the whole PoE switch and restarted 3 cameras bricking all 3 of them turning my small problem into a bigger problem.

After tons of reading and testing and reading and testing I reached out to Whoslooking and he diagnosed that I needed to change the region/language flag from 2 to 1 using hiktools.
before changing the language, I would run TFTP and reboot my camera and it would pull the firmware successfully but I never saw the message that system update was complete.
after a manual reboot, the phone would show in SADP eventually but had no "encoding channels" and DSP version was blank.
this means it is running in "safe mode" or some sort of minimal recovery mode.

After changing the language flag, I do see the system update complete message (first clue everything was all better).
I've now saved all 3 of my bricked cameras and learned more about these cameras than i may have ever wanted to know!

thanks a ton whoslooking!
If you're ever in DC/northern VA, let me know: your beers are on me!

 

[eXtremer]

After changing the language flag, I do see the system update complete message (first clue everything was all better).
I've now saved all 3 of my bricked cameras and learned more about these cameras than i may have ever wanted to know!

I have the same issue with one DS-2CD2032F-I, upgraded to 5.3.0 then I wanted to downgrade and I'm always on minimal mode, tried several firmware versions without luck. What do you mean by changing language flag? How to change the language flag if the camera has no firmware on it (recovery mode) or there is something I don't know. Can you bear more clear on this I would really appreciate. Thank you.

 

[alastairstevenson]

It's the 'language flag' in the header of the firmware you're trying to load that is being referenced above - the 'lang' option in Hiktools here : https://www.ipcamtalk.com/showthread.php/2733-Hikvision-FIRMWARE-TOOLS-change-language-extract-files-and-create-own-firmware
When you try to tftp update firmware on a CN camera with EN firmware it will complain (internally) of a language mismatch and go into a recovery mode.

 

[eXtremer]

I understand that, but the firmware file in the "Firmware Downgrader 5.3.0 Chinese to 5.2.5 English" tool has already hacked "lang" option why then I don't get the "system update complete" message?

 

[leesburgjk]

It does not. That's what I used... that's where I started. Now download hiktools and use it to change the language flag to 1 and flash the new firmware. Instructions for using hiktools are easy to follow. It's like 3 steps. You're close!