HIKVision DS-2CD2032F Bricked

[Jeff2016]

Hi all,

I was having problems with SMB on my 2032 and thought it would be a good idea to upgrade it, not realising it was a Chinglish version. I now realise the error of my ways as despite following the help offered on this forum, I still do not have a camera that works. A couple of things I did find out that might be of benefit to others :

• Using any other TFTP server software than the Hikvision TFTP tool did not work for me. The camera I have uses UDP 9978 when booting up and not UDP 69, which would account for it.
• Only a direct cable connection worked, having a switch in middle didn't, maybe something to do with my switch but worth noting.

Where I am now is that the TFTP transfer completes successfully but the SADP tool does not see the camera and when running a packet capture, I see no comms from the camera.
I have tried a few different images : v2.5 downloaded from this forum, IPC_R0_EN_STD_5.3.0_150513-downloaded from HIkvision Europe and the same file with a modified region code and custom firmware downgrader 5.3.0.
Originally the camera had v5.2.5 build 141201 but I cannot find a copy of this image and I am not sure why none of the others work at all. The box it came in says it should have been chinese v5.3.0_150513.

From what I understand, I need to get it working in chinese before using the downgrader, where would I get a working chinese image from ?

I would be very grateful of any assistance as I have exhausted every option I know so far.

Thanks.

 

[alastairstevenson]

The camera I have uses UDP 9978 when booting up and not UDP 69, which would account for it.

That's the bootloader looking to do a handshake with the Hikvision-specific tftp updater tool.

Only a direct cable connection worked, having a switch in middle didn't, maybe something to do with my switch but worth noting.

Usually that doesn't work so well, as the camera ups/downs/ups the interface on startup, leaving the PC to try to keep up. Sometimes does, sometimes doesn't. Not a problem with a switch.
The @whoslooking 5.3.0 to 5.2.5 downgrader usually works pretty well.
Did you use the 1-line version?
Did you change the language of the firmware file with Hiktools, to match what your camera would accept?
https://www.ipcamtalk.com/showthread.php/2733-Hikvision-FIRMWARE-TOOLS-change-language-extract-files-and-create-own-firmware

 

[Jeff2016]

Hi & thanks for the reply

At the moment I cannot get the camera to respond to anything following the successful upload of the firmware. I gather that I need to get it working in chinese before using the downgrader, is that correct ? The chinese image I have found elsewhere is IPC_R0_CN_STD_5.3.0_150327 but SADP,http,ping,telnet etc doesnt work and Wireshark shows no comms, which leads me to think that the image I have, is still not the right one. I did have a go with Hiktool on a euro image but had no luck, should I use this on the chinese image ? Is there anywhere I can download a known working chinese image ? Sorry for all the questions

 

[Jeff2016]

I noted when I used the image included in the downgrader tool, the camera on one or two occasions is detected by SADP but with a 192.168.1.64 address. I was however unable to connect to it via telnet/http:8000 although it did respond to ping. The firmware shows as v4.0.8. build 150401. I have scanned the open ports and indeed 8000 is there but will not show a web page although it will give a connection if I telnet on that port. I have no idea where the image version is coming from as I used the one included and it should be 5.25.

 

[alastairstevenson]

The firmware shows as v4.0.8. build 150401

This is the 'Min-system mode' - it's a recovery mode that's entered when incompatible firmware has been loaded. There are no web services, just a basic system.
Plenty of EN versions here : http://www.hikvisioneurope.com/portal/index.php?dir=Product Firmware/Front-ends/01--IPC/R0 platform(2xx2)/
If the tftp updater handshakes are no longer being issued at power-on, you could try using the 'Batch config tool' here:
http://www.hikvisioneurope.com/portal/index.php?dir=Software/00 Software Tool Package/

Your variable results (eg SADP sometimes see it sometimes not) are unusual - despite what you've seen, it is better to have both the PC and camera wired to a switch or router.

 

[Jeff2016]

Thanks for explaining that, I couldn't understand the 4.0.8 firmware version.
I have now tried the update through a different switch and it transferred ok but still no further forward. All the images I try load but all give the same result i.e no connectivity. I have also tried a couple of the EN versions you kindly provided the link for but again no change. What I suppose I am not clear on is which image I should load and why the original matching chinese version also doesn't work. Can I load any version using the HIK tool or prior to using the downgrader ? Sorry but I feel I am missing the obvious and I have ready so many articles on this I am probably just very confused.
Thanks very much for the help so far, its very much appreciated.

 

[Jeff2016]

I am not sure if this helps but the TFTP instructions say that the update takes approx 5 mins and then reports system update completed. I never see this and my transfer takes 30 secs and only reports completed file etc. The camera appears to reboot after this as the pings drop but it never ever attempts to TFTP again if I leave TFTp running and pings don't restablish. I have attached a screen shot which shows what I see. No matter how long I leave it the result is the same. Is this correct for a 2032 ?

 

[alastairstevenson]

The camera appears to reboot after this as the pings drop but it never ever attempts to TFTP again if I leave TFTp running and pings don't restablish.

That's good in the sense that if they were to re-appear periodically, every few 10s of seconds, the camera would be in a bootloop.

The 1-line 5.3.0 to 5.2.5 downgrader is your best bet, tried in both it's original form and with the language changed using Hiktools.

If that does not yield success (and it does sound like you've tried that more than once), and telnet access does not work while the tftp updater is still running, the way to determine what is wrong would be to connect to the serial console inside the camera to see the kernel log.
If you think that's worth doing - some info here:
There are some links to the needed connectors in this post:
https://www.ipcamtalk.com/showthread...ht=uart+manual
here is another usful post
https://www.ipcamtalk.com/showthread...highlight=uart

And as a long shot - worth trying is a full reset.
Hold the reset button (at the back of the camera body) down while powered off, power on, keep it down for at least 10seconds, release it.
See what SADP makes of the camera.

 

[CodeGreen]

Two things that cross my mind. You extracted the zip to get the firmware file? If yes, than you may want to try another firmware version.

i was having similar issue while trying to tftp. You have to wait for the last responce from tftp ~5-8mins

 

[Jeff2016]

Thanks Codegreen, I have extracted the files and they seem to transfer ok although I am not sure I am rebooting it when I should. Should I leave TFTP running for 5-8 mins after the completed transfer messag ? Should I see another message ? When should I reboot it ? I have tried many images and the HIKtool but still convinced I have something basically wrong and most people seem to get it working with the downgrader image. Appreciate the help.

 

[Jeff2016]

I have now tried the following after removing camera from its installation position :

Connected to a local PSU and different switch rather than the POE switch I was using.
Pressed the reset for 20 secs whilst powering on and then tried downgrader image again using Hikvision TFTP.
Observed that IR lights remain on and ping stopped responding after transfer completed
Waited 15 mins after seeing completed file message in TFTP (about 30 secs after transfer started) then disconnected power to reboot. (No further completion messages seen in TFTP)
Camera pinged 3 times before going to not responding
Camera eventually shows up in SADP as 192.168.1.64 (recovery image)

If I get bored one day then I might try connecting a serial cable but for now I have probably spent enough time on this so will have to bin the camera and buy a new one. I only post this as a warning to those who buy cheap chinglish camera and stupidly try to upgrade it. The next one I buy will certainly be a UK version with support and I would advise anyone else to do the same.

Big thanks to those that tried to help me out with this.

 

[IMF]

I have now tried the following after removing camera from its installation position :

Connected to a local PSU and different switch rather than the POE switch I was using.
Pressed the reset for 20 secs whilst powering on and then tried downgrader image again using Hikvision TFTP.
Observed that IR lights remain on and ping stopped responding after transfer completed
Waited 15 mins after seeing completed file message in TFTP (about 30 secs after transfer started) then disconnected power to reboot. (No further completion messages seen in TFTP)
Camera pinged 3 times before going to not responding
Camera eventually shows up in SADP as 192.168.1.64 (recovery image)

If I get bored one day then I might try connecting a serial cable but for now I have probably spent enough time on this so will have to bin the camera and buy a new one. I only post this as a warning to those who buy cheap chinglish camera and stupidly try to upgrade it. The next one I buy will certainly be a UK version with support and I would advise anyone else to do the same.

Big thanks to those that tried to help me out with this.

Sorry for reviving an old thread - did you ever manage to get this to work? I'm experiencing exactly the issue that you're having. TFTP only ever gets to completed but never success. I leave it for hours and nothing. I can't telnet to the camera while TFTP is still up either.

I reboot the camera and eventually shows up in SADP in the min system mode. I've tried so many different firmwares (including trying hiktools lang change) that I've lost count. They all give me the same result.

 

[alastairstevenson]

If you can supply some details of how the camera got to the bricked state, we should be able to revive it.
Also the camera model, and the as-installed firmware version, off the label for example.

There are quite a few different forms and reasons for bricking, the solution for which varies with the way it happened.
Common is a CN camera with 'hacked to EN' firmware being updated with new firmware and failing - then suffering a Catch-22 state - can't run new firmware - can't roll back to working version.
I have a brick-fix tool for that.
And ways to enable updates to work OK.

Where are you based?

 

[IMF]

If you can supply some details of how the camera got to the bricked state, we should be able to revive it.
Also the camera model, and the as-installed firmware version, off the label for example.

There are quite a few different forms and reasons for bricking, the solution for which varies with the way it happened.
Common is a CN camera with 'hacked to EN' firmware being updated with new firmware and failing - then suffering a Catch-22 state - can't run new firmware - can't roll back to working version.
I have a brick-fix tool for that.
And ways to enable updates to work OK.

Where are you based?

Based just around half a thousand miles south of you!

I know not to upgrade these, I totally messed up. I've got 3 hikvisions and one of them is UK and I thought this was the UK one but I should have double checked... I applied a 5.4.0 firmware found here: Hikvision firmware update for DS-2CD2xx2 IP cameras and instantly realised my mistake when the camera wasn't coming back up.

It was plugged into my NVR and that wasn't picking it up, I plugged it into my laptop via a POE adaptor and still nothing.

Now no matter which firmware I try and flash, I can't get past "completed" in TFTP and it eventually shows up as v4.0.8 in SADP when I reboot the camera.

I've tried the 5.3.0 chinese firmware and all variations of the 5.2.5 found on this site.

The camera came with 5.2.5 on it (I think) but the label on it says 5.3.0 150513 (had to get the binoculars out to see that earlier today!).

Any help would be appreciated! Going on holiday soon so got to either sort this out or spend money and buy another one!!

EDIT. Camera model is DS-2CD2232-i5

 

[alastairstevenson]

the label on it says 5.3.0 150513

OK, so it's got the newer min-system code (that what the 4.0.8 firmware version signifies) with psh, no telnet and anti-rollback. And was running seller-installed 5.2.5 'hacked to EN' firmware.
Lots of folk have been caught out by these nasty tricks Hikvision pull to stop people getting best use out of their products.
But this can be fixed.
How long before you go away?

 

[IMF]

OK, so it's got the newer min-system code (that what the 4.0.8 firmware version signifies) with psh, no telnet and anti-rollback. And was running seller-installed 5.2.5 'hacked to EN' firmware.
Lots of folk have been caught out by these nasty tricks Hikvision pull to stop people getting best use out of their products.
But this can be fixed.
How long before you go away?

All resolved thanks to you!

I got it to Chinese firmware, then followed the steps to change language to English. When everything finally works, it's so easy!

I'm off on holiday next week, kids birthday this weekend and then we're off for 2 weeks so got my peace of mind that I can keep an eye on my car when I'm gone

 

[alastairstevenson]

Excellent! Always good to get a successful outcome.
When you are back from holiday, if you wish we could tweak the camera to make it fully upgradeable, it's easy to do, and will apply the bug fixes and security fixes of the newer firmware.

 

[IMF]

Excellent! Always good to get a successful outcome.
When you are back from holiday, if you wish we could tweak the camera to make it fully upgradeable, it's easy to do, and will apply the bug fixes and security fixes of the newer firmware.

That sounds great thanks! Also can you reply to my conversation? You've saved me cost of camera and cost of getting someone down to swap it over (I have an involuntary fear of heights).

 

[alastairstevenson]

I'm glad to have been able to help.
"Virtue is its own reward".
Sounds a bit pompous though.