Hikvision DS-2CD2386G2-IU post_app_hook No Driver Found

S

s1977

n3wb
Mar 17, 2025
10
1
UK
Hi All

Wonder if anyone has seen this and can assist in recovery of my camera. I think in error I have ended up formatting one of the boot partitions trying to reset and boot alternative firmware onto the camera. The camera now u-boots but drops out of the boot sequence and exits at the Protect Shell console. It is unable to find the initrun.sh script and that's why I think it is unable to load the ethernet driver so cannot update via the T-FTP option. Is there anything I can do to get address this?

On boot, I get the following log messages:

Code: 
NDI>XSRCTETH trim = 00001BF0
dma1 zq_trim[f], ldo_trim[8]
DDR3_2133ver 2.00
ini_ver: 0x60210205
CPU1000 DONE
>dma1 ssc 1
dma ok
2 DR
dma2 zq_trim[f], ldo_trim[a]
dma1 ssc 1
dma2 ok

UNZOK!
Loader Start ...
LD_VER 03.01.07

528_DRAM1_1066_4096Mb_DRAM2_1066_4096Mb 06/18/2021 16:27:02

NAND,BS= 0x00000002
gpio ID2   0x00000000
gpio ID3   0x00000000
SPI NAND MID=000000EF DEV=000000AA
ld.LdCtrl2 0x00000000
LdCtrl2 0x00000000
teeos_addr 0x02000000
uboot_addr 0x0E000000
uboot_size 0x02000000
smp(tee2)
core2_jump_program 0xF07C0500
code2JumpCodelen 0x00000010
core2_entry2_addr 0x01FC0000
core2_entry_checksum 0x0000C40F
core2_entry_program 0xF07C0510
code2EntryCodelen 0x000001BC
0xF07F8000= 0x02000180
core2_reset
2ajcor1awaitump 0x02000180
abceRS2WK2


U-Boot 2019.04-svn1300746 (Jun 18 2021 - 16:27:08 +0800), Build: jenkins-Frontend.BSP.CCI.devCloud-3862

CPU:   999 MHz
DRAM:  256 MiB
l2cache:0
l2cache:1
bootmode = 0 addr=00007e00!
NAND:  id =  0xef 0xaa 0x21 0x00
nvt spinand 4-bit mode @ 12000000 Hz
128 MiB
MMC:   0
 misc_init_r: boot time: 1351128(us)
 misc_init_r: boot time: 1355131(us)
Net:   INTER MII

[Uboot] In release mode!
Hit Ctrl+u to stop autoboot:  0
|RCV UDP pack timeout| error: auto upgrade.(error!!)
TFTP server auto connect disabled
Unknown command 'crc' - try 'help'

booting from sys part...
Load kernel to 0xc700000 ...
<sbal_wb_aes_update>...decrypt
<sbal_wb_aes_update>...decrypt
<sbal_seboot>body_total_len=7342880
<sbal_seboot>verify success ##successful to load enc_uImage##
gzip_image_size  700b08  image_size   e72b3c
nvt_ker_img_ungzip_linux: gz_uncompress linux
nvt_ker_img_ungzip_linux: generating uImage header for linux
CHIP_1.
Succeed!
## Booting kernel from Legacy Image at 0c720000 ...
   Image Name:
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    15149884 Bytes = 14.4 MiB
   Load Address: 00008000
   Entry Point:  00008000
## Flattened Device Tree blob at 0c700000
   Booting using the fdt blob at 0xc700000
   Loading Kernel Image
   Loading Device Tree to 087dd000, end 087fffff ... OK

Starting kernel ...

l2cache:0
Disable MMU
Clear MMU
Uboot L2 cache aux val: 0x72420000
Uboot L2 cache prefetch ctrl val: 0x70000000
Uboot L2 cache ctrl val: 0x00000000
Done
SW2
starting pid 159, tty '': '/etc/init.d/rcS'
Starting udev:      [ OK ]
create static device nodes under /dev dir
>>>run pre_app_hook
done
waiting for /dev/ubi1_0.
waiting for /dev/ubi3_0.
waiting for /dev/ubi3_0.
>>>run post_app_hook
Error: not found driver
Run tee-supplicant ...
device open: No such file or directory
Not find initrun.sh!
starting pid 505, tty '': '-/bin/psh'
BusyBox v3.0.0-2726094 Protect Shell (psh)
Enter 'help' for a list of davinci system commands.

#

Any help will be appreciated.
 
s1977 said:
It is unable to find the initrun.sh script and that's why I think it is unable to load the ethernet driver so cannot update via the T-FTP option.
Click to expand...
I think, but I'm not certain, that the bootloader manages the ethernet connection itself, as opposed to the kernel after its loaded and running.

A bit of a long shot, but a suggestion to try :

Keep Control-U pressed till it autorepeats, power on the camera, so that the bootloader is interrupted.
At the bootloader HKVS # prompt, use the command
printenv
to see the target IP address (serverip) the bootloader expects to find the tftp server at.
This is likely to be 192.168.1.128
Also check the camera IP address (ipaddr) is in the same address range, in case someone has messed with it.
Start a normal tftp server set to that address (not the Hikvision tftp updater, that's limited to 32GB filesize) and have the digicap.dav firmware in it's folder.
Ensure the PC firewall will allow inbound tftp access.

The command
help
will show available commands.
With luck, the command
update
will connect to the tftp server, download the firmware and re-write the missing data in the ubi3_0 app0 partition.
The command
upf
may also be worth trying though it does a lot more and may be risky
 
Thanks @alastairstevenson. Both camera and laptop are on the same network and laptop is set to a fixed 128 address as expected. Running arp or ping from the camera doesn't yield anything. I tried a similar approach to what you outlined and have loaded firmware using the update method previously too.

Let me try with your approach again and get back to you. :)
 
  • Like
Reactions: alastairstevenson
@alastairstevenson Tried to go down the usual u-boot route running the update command, which worked fine this time around. It was previously exiting the boot routine not able to find initrun.sh, but update worked today somehow. :)

Maybe you can help me with another query - some of these cameras do a random reboot, whereas others don't even though they are the same model. Assuming that the error logs reset themselves on reboot, where could I find the reason for reboot? Issue is that I have patched the same firmware as Hikvision suggests, but yet some cameras still reboot randomly.
 
s1977 said:
where could I find the reason for reboot?
Click to expand...
Presumably in an inside test environment - leave a connection to the serial console running, and inspect any entries preceding a random reboot, there might be a reason shown.
I'm guessing these were bought as 'spares and repairs' on eBay. There have been a few on sale with the same faults described.
 
  • Like
Reactions: s1977
Yep, makes sense to do that. I will try. The last time I did that, I could see some block corruption, for e.g.:

Code: 
Mar 17 16:56:53 bsp.warn kernel: [  410.599615] ERR:nvtmpp_vb_chk_blk_valid() blk corruption => blk_head_va=0x4090afc0 != blk=0xa190afc0^M
Mar 17 16:56:53 bsp.warn kernel: [  410.599623] ERR:nvtmpp_vb_get_free_block_from_pool() Invalid blk = 0xa190afc0^M
Mar 17 16:56:53 bsp.warn kernel: [  410.623966] ERR:ife_isr() IFE frame error!^M
Mar 17 16:56:53 bsp.warn kernel: [  410.624208] ERR:ife_isr() IFE Buffer overflow!^M
Mar 17 16:56:53 bsp.warn kernel: [  410.639556] ERR:nvtmpp_vb_chk_blk_valid() blk corruption => blk_head_va=0x4090afc0 != blk=0xa190afc0^M
Mar 17 16:56:53 bsp.warn kernel: [  410.639565] ERR:nvtmpp_vb_get_free_block_from_pool() Invalid blk = 0xa190afc0^M
Mar 17 16:56:53 bsp.warn kernel: [  410.663912] ERR:ife_isr() IFE frame error!^M
Mar 17 16:56:53 bsp.warn kernel: [  410.664151] ERR:ife_isr() IFE Buffer overflow!^M
Mar 17 16:56:53 bsp.warn kernel: [  410.679501] ERR:nvtmpp_vb_chk_blk_valid() blk corruption => blk_head_va=0x4090afc0 != blk=0xa190afc0^M
Mar 17 16:56:53 bsp.warn kernel: [  410.679510] ERR:nvtmpp_vb_get_free_block_from_pool() Invalid blk = 0xa190afc0^M
Mar 17 16:56:53 bsp.warn kernel: [  410.703844] ERR:ife_isr() IFE frame error!^M
Mar 17 16:56:53 bsp.warn kernel: [  410.704094] ERR:ife_isr() IFE Buffer overflow!^M
Mar 17 16:56:53 bsp.warn kernel: [  410.719446] ERR:nvtmpp_vb_chk_blk_valid() blk corruption => blk_head_va=0x

On this camera, I could see ONVIF errors, METADATA errors and database errors, but I assume some of those may be legit too. Unfortunately that's where my capability to fix anything diminishes. ;)
 
You must log in or register to reply here.
Top Bottom