Custom Firmware Downgrader 5.3.0 Chinese to 5.2.5 English

[alastairstevenson]

Just a dumb question, for which apologies.
You are using the Hikvision version of the tftp server, not a generic one? This shows in the window title.
The camera or NVR probes for the Hikvision-specific version by issuing a UDP packet holding the usual Hikvision magic number. The tftp server responds with the same and the dialogue starts.

 

[2delarosa]

No worries, I appreciate the support. Yes, I'm using the Hikvision version of the tftp server. I have a packet capture trace. What UDP port would the magic number be advertised?

 

[whoslooking]

How are you connected to the camera,
The best way is both camera and PC though a switch or router.
Directly to each other has timing issues.

 

[2delarosa]

CAM ---- (Port 8) <Catalyst 3560C Switch>(Port 6) -- (Port 10) <SG300-10P Switch> (Port 4) -- PC hosting tftp server. One flat network.

 

[whoslooking]

If you have another pc to hand I would give that a try.

 

[alastairstevenson]

I'm away from home at the moment - but a fragment from another post has this for the UDP packet from the camera:

No. Time Source Destination Protocol Length Info
97 40.996606000 192.0.0.64 192.0.0.128 UDP 62 Source port: 9979 Destination port: 9978

Frame 97: 62 bytes on wire (496 bits), 62 bytes captured (496 bits) on interface 0
Ethernet II, Src: Hangzhou_2b:6c:02 (c4:2f:90:2b:6c:02), Dst: Dell_6d:54:22 (5c:26:0a:6d:54:22)
Internet Protocol Version 4, Src: 192.0.0.64 (192.0.0.64), Dst: 192.0.0.128 (192.0.0.128)
User Datagram Protocol, Src Port: 9979 (9979), Dst Port: 9978 (9978)
Data (20 bytes)

0000 53 57 4b 48 00 00 00 00 00 00 00 00 00 00 00 00 SWKH............
0010 00 00 00 00 ....

That was after an ARP request for 192.0.0.128 where the tftp server must exist.
SWKH is the magic number.
This was from a camera using the traditional 192.0.0.64 default address.

Worth checking also to see if the camera is still 'alive' is a ping -t to the default address of 192.0.0.64
Normal would be 2 or 3 replies after power on.

 

[2delarosa]

I tried a different laptop connected directly to the same switch as the camera. Nothing. The packet captures shows no packets from 192.0.0.64.

 

[2delarosa]

I search the packet captures and I see no packet with SWKH and no packet with a source IP 192.0.0.64.

 

[alastairstevenson]

On the newest cameras the default IP address, that which is used after the config is cleared following a tftp update or factory reset, is changed to 192.168.1.64 from the classical 192.0.0.64
Now I don't know if the IP address used by the bootloader when probing for a tftp server is also changed - but that may be worth checking via a network capture.
Others may be able to confirm.

 

[whoslooking]

The tftp boot area has remained unchanged, it's only post boot ip that has changed with the release of 5.30

 

[2delarosa]

Understood, but I'm have not captured any packets from the IP camera with a source IP 192.0.0.64 or 192.168.1.64? So must I manually reset the camera?

 

[whoslooking]

No all the camera needs is to be power cycled to start the tftp,
Your looking to hard at a simple thing.
Are you powering the camera with a 12v or poe?

 

[2delarosa]

POE. I have rebooted the camera many times. I unplugged the cable and plugged it in. I have logged into the switch and shut the switch down to turn it off as well.

 

[whoslooking]

I would recommend using the 12v psu. either it's a totally dead camera or your setup, this is strange is your firewall all off and you have checked all rules to make sure nothing is blocking the tftp?
Also make sure your wifi is off on the pc and you are not use crossover cables.

 

[dieterdewyn]

Hi,
I have 4 cameras (DS-2CD2632F-IS) on the sticker there was already FW ver 5.3.0

When i checked the webgui, i saw ver. 5.2.5. Then i went to download the 5.3.0.... bad idea! :/

I read the thread about downgrading. i did everything, the TFTP hikvision tool.. also the MTD hack.
but still, that camera stays in chinese....

As i still have 3 other ones, in Multilanguage, isnt it possible to take copy/snapshot from one of those?

If you like me to put this question to some thread, or create one, please let me know
Thank you very much for the support!

 

[whoslooking]

After doing the tftp downgrader, check to see if the installed firmware is now 5.25
If the camera is still Chinese you must now do the mtd hack that is in the sticky section, this will now make your camera multi-language.

 

[dieterdewyn]

After doing the tftp downgrader, check to see if the installed firmware is now 5.25
If the camera is still Chinese you must now do the mtd hack that is in the sticky section, this will now make your camera multi-language.

Did everything, also the MTD hack.... but still CN. The current FW is V5.2.5 build 141201

 

[whoslooking]

Clear the browser memory, if you change the bit from 02 to 01 in both mtd5 and mtd6 as well as balanced the change you made, then the camera should show multi-languages if you made a mistake
Then it might not work.
Recheck your mtd files for the correct checksum-16.

 

[dxpl007]

Hi guys, I have the DS-2CD2032F-IW preloaded with 5.3.0 Chinese. I tried to downgrade to 5.2.5, the data transfer completed, camera rebooted with 192.168.1.64 however i can't web or telnet in. Did I use the wrong firmware file for this camera ?

 

[whoslooking]

If you downgraded, your IP on the camera has changed to 192.0.0.64
Use SADP to change your IP range, you can then enable telnet on the camera.