Hikvision 5.2.5 & 5.2.8 Full English (INC DAYS OF WEEK) mtd Hack

whoslooking

IPCT Contributor
Joined
Oct 3, 2014
Messages
1,524
Reaction score
548
Location
London
No you must do the mtd hack first, then upgrade with English 5.30
 

alexf40

n3wb
Joined
Nov 3, 2016
Messages
23
Reaction score
3
Ah wish I saw this yesterday, I had paid CBX for his hack last year which I thought was the MTD hack, I did the upgrade and now have the language mismatch error. Will have to try and go back through the forums to see how to unbrick it.
 
Joined
Dec 3, 2016
Messages
4
Reaction score
0
Location
Curitiba - PR - Brazil
I'm almost there, just missing to find where to make the change to the hex file.

Hopefully I'll get my DS-2CD1103-I running V5.2.3 build 141024 into english so it can work along with my DS-7104N-SN/P that's already working fine with another DS-2CD2020F-I.

Thanks for sharing the solutions found. :D

Full English Including days of the week for Version 5.2.5 & 5.2.8.

This Again is the mtd5 & mt6 Hack, but requires you to maintain the checksum -16 to the original value.
So if you change the region flag from Chinese to EN / US you need to find the other correct value to also change allowing the checksum to remain the same.

This solves the day of week in Chinese and also the Issues with IVMS and NVR with region mismatch.

Yes the Language is now region 1

No you can’t upgrade to 5.3.0 this is done via another check which I’m still looking for.

All the normal things use at your own risk, but fully tested on my own cameras.
One thing to remember that, If you update the camera you have to use Chinese firmware, with the region changed on the firmware with hiktools
to region 1.

This is also a fix for the cameras brought from AliExpress with hacked firmwares (from that Russian) that don't work correctly.

1st setup your NAS storage on your Camera

With Putty as Telnet Port 23

IP = 192.0.0.64

user = root
password = 12345

cd /mnt/nfs00

To copy the mtd files

cat /dev/mtdblock5 > temp5
cat /dev/mtdblock6 > temp6

Change the flag bytes using HxD editior,
Then putting them back with the changed block:

cat temp5 > /dev/mtdblock5
cat temp6 > /dev/mtdblock6
Reboot






NOTE: Always backup you mtd files before you play with them.

Don't forget the Thanks Button!



As Always Enjoy and Enjoy it for Free!

And the video linked below.

MTD HACK made easy on Video









 
Joined
Dec 3, 2016
Messages
4
Reaction score
0
Location
Curitiba - PR - Brazil
This technique is only for the DS-2CD2x32 cameras, the R0 series.
Your camera, I believe, is an R2 series, so the method does not apply.
In others words, there's nothing else I can do about that then.
The only way to keep using that camera will be by streaming the videos with the RTSP protocol. I didn't want to miss the feature of "controlling" the camera setup such as data right on the NVR.

Tks!
 

Defender666

Getting the hang of it
Joined
Dec 19, 2015
Messages
193
Reaction score
25
The basic technic apply to all series even nvr but need to be older then Mid 2015 to accept latest firmwares without issue. Newer cameras have additional protection
 

Coffeemann

n3wb
Joined
Mar 30, 2017
Messages
2
Reaction score
0
Hi, I'm really sorry, I'm new here.
I'm actually going to purchase CN version of DS-2CD45C5F cameras due to 3 times price difference.
Could someone kindly advise if I will be able to apply MTD hack to this model?

Thanks a lot in advance
 

gb7777

Young grasshopper
Joined
Apr 11, 2017
Messages
43
Reaction score
2
Can anyone tell me where to get Chinese FW 5.1.6 with or without modification for language?
 

gb7777

Young grasshopper
Joined
Apr 11, 2017
Messages
43
Reaction score
2
Couldn't find 5.1.6 anywhere but managed to use the 5.2.5 from the downgraded. Unfortunately the smart events which is the reason I want to upgrade still aren't there :(

Have I missed something here. Do I need to do the MTD hack and use EU FW to get the smart events on my 2132's?
 

copex

Getting the hang of it
Joined
Feb 15, 2015
Messages
225
Reaction score
79
Location
Cumbria,England
editing the region and the mac or date was to keep the checksum correct, i believe the new checksum calculation is known any one care to share?? so i can edit the region with out altering the date or mac addr???
 

gb7777

Young grasshopper
Joined
Apr 11, 2017
Messages
43
Reaction score
2
Tried messing around with normal motion detection and kept failing to save via IVMS4200 (Camera Settings page). Then tried via remote configuration through IVMS and got the following error when saving motion settings:

"Error code HCNetSDK.dll[11].(Data transmission failed, incorrect data to or from the device.)"​

Plugin doesnt work on safari OS X so can't use web interface.

So I tried rolling back to 5.0 (provided by seller) and got failed to update error. Then thought i'd try to update to 5.2.5 again incase something went wrong the first time. Now no longer get English option like I did the first time I updated, but to do get smart events showing up on web interface (they don't show up on IVMS, but that is the same for my UK camera so presume its an IVMS issue).

Effectively 1 step forward 1 step back. Guess I need to do the MTD hack on this camera now. But still not sure why motion settings aren't saving.

Any pointers/help please :)
 

gb7777

Young grasshopper
Joined
Apr 11, 2017
Messages
43
Reaction score
2
Well thought I'd try the MTD hack on this Cam. Decided to backup all the MTD blocks and came across first problem:

# cat /dev/mtdblock8 > temp8

cat: read error: Input/output error
All the other blocks, including 5 & 6 seemed to work so I moved on. Downloaded iHex (on MAC) and found temp5 = all FF's.

Corrupt block? Something to do with the vendors own hack?

Is there a way to recover it?
 

gb7777

Young grasshopper
Joined
Apr 11, 2017
Messages
43
Reaction score
2
Bit the bullet and updated another camera to 5.2.5 (needed to update to enable Telnet access) and again MTD5 is all FF :/

Any help would be greatly appreciated as can't seem to find any other threads mention this issue.
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,930
Reaction score
6,779
Location
Scotland
Mtdblock8 is open by the system, it holds the recovery files, a basic kernel and the update programs.
Use mtd8ro instead.

There should be a few hundred bytes of data at the beginning of mtdblock5, the rest is all in the erased (0xFF) state.
 

gb7777

Young grasshopper
Joined
Apr 11, 2017
Messages
43
Reaction score
2
Mtdblock8 is open by the system, it holds the recovery files, a basic kernel and the update programs.
Use mtd8ro instead.

There should be a few hundred bytes of data at the beginning of mtdblock5, the rest is all in the erased (0xFF) state.
Ahh thanks for the pointer on Mtdblock8, that worked.

Unfortunately mtdblock5 is definitely FF on both cameras. Checked and double checked and then once again out of shear desperation :/

I'm not sure if I caused this by using the 5.2.5 FW from the 5.3.0 -> 5.2.5 downgraded.
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,930
Reaction score
6,779
Location
Scotland
Unfortunately mtdblock5 is definitely FF on both cameras. Checked and double checked and then once again out of shear desperation :/
It's most likely something to do with when the camera was manufactured.
It doesn't really matter.
A firmware update doesn't change it.
 

gb7777

Young grasshopper
Joined
Apr 11, 2017
Messages
43
Reaction score
2
It's most likely something to do with when the camera was manufactured.
It doesn't really matter.
A firmware update doesn't change it.
This is on both cameras Iv'e updated to 5.2.5. The others I can't check as 5.0 doesnt have option to enable telnet and I can't seem to find any other version between the two.

Ok I guess I edit block 6 and proceed then? I'm currently stuck anyway so keep digging to get out of the hole :)
 
Last edited:
Top