HIKVISION mtd Brick Recovery Guide

So I'm back trying to fix my Hikvision 2432, got the parts finally...
Got serial access showing U-Boot 1.3.4-121219 > BusyBox v1.19.3 (ash).
I also can assign an IP using ifconfig.
Now I gotta find a way to push/pull files over. Could find a tftp/ftp client. and trying to mount using 'mount -t nfs' is causing the serial connection to hang, maybe I'm doing this wrong?

I see dropbear, and I'm able to try logging in if I flush the firewall with '/sbin/iptables -F'
Does anyone know the password for root? my /etc/passwd file has "root:tcC0v8qxP13qs:" I figure it's some type of default for this operating system. I figured if I have this I can use sftp

Thanks!
 
alastairstevenson said:
This tftp server works pretty well : http://www.jounin.net/tftpd32.html
The telnet or SSH (Dropbear) root password is the same as your web GUI admin password.
But if you have a shell prompt via the serial console presumably you have root access already, a '#' prompt?
Click to expand...

thanks, I'll try password I had set before.
but I think I'm not in the regular OS since I screwed up my mtd6 block.
see https://www.ipcamtalk.com/showthrea...Recovery-Guide?p=113522&viewfull=1#post113522

I'm thinking of trying ssh so I can use sftp/scp to send a fixed mtd6 block over
 
sweet, I'll try nolock tonight. I got a lot of options for recovery so hopefully I can get this thing fixed. this unit even has an sdcard but I couldn't seem to find the block device to mount. I have a feeling the limited OS I'm in doesn't have everything the regular OS has.
 
alastairstevenson said:
Likely to be (from memory ... but I should really check.)
/dev/mmc01
Click to expand...

yeah I didn't see anything that stuck out like that in /dev and pulling/plugging in the card doesn't produce anything in dmesg. as I said I think I'm in some sort of preboot environment, not sure how the boot process goes for these units but I think me screwing up mtdblock6 stops it part way through.
 
If you are at a kernel shell (and from what you've described you are), tftp should be available to you, if so
tftp -g -r mtdblock6 tftp_server_IP_address
cat mtdblock6 > /dev/mtdblock6
But you probably knew that.
 
The 'nolock' option is what I needed. I was able to hack the mtdblock5/6 back to Chinese. Put v5.3.0 Chinese on there.
Now PIR events show on the trigger feed, so camera works how I want it to!

Thanks for the help!
 
Got the bright idea I'd upgrade my 2CD2342-WD-I to 5.4.0. Was originally running 5.3.6.
Using the Web interface, I was getting a failed upgrade message. This is over a wireless link, so I decided to take a laptop (after finding out about the hik tftpserver tool) and get a wired connection.
Everything appeared to work correctly based on the tftpserver output. But, like many others that I find when I search, I'm never seeing the 'completed' indicator. No errors. It just never gives me the final completion message.
192.0.0.64 is not PING'able either.

I've tried both the 1-line and 4-line downgrader package. Same exact results. Tried multiple times. Help?

[EDIT] Not sure if this is an actual Chinese version, WR, or USA....(came in a Retail style box). If there's some way I check verify, I'd happily do it.
 
Last edited by a moderator:
alastairstevenson said:
But the important test is if SADP can see the camera : http://www.hikvision.com/en/tools_82.html and if so what does it show.
Click to expand...

interesting. So last night, the SADP tool didn't find anything. Checked it again this morning and the camera shows up.
I can PING it. But, I cannot access its web interface. It 's giving me a "refused to connect" "[FONT=&quot]ERR_CONNECTION_REFUSED" [/FONT]message. What is the reference to port 8000 vs. the HTTP port? (as it shows in the SADP tool).
Shows as version: 4.0.8 build 150325. So looks like it did get loaded with v4.0 then.
So what next? Tried telnet'ing. No-go.

Not even for 2 or 3 responses a few seconds after power-on, from a PC on 192.0.0.128 ?
Click to expand...
Haven't tried this yet...but I'm guessing that if the camera is being found with the SADP tool, then this step isn't really required.SADP.jpg
 
Last edited by a moderator:
What is the reference to port 8000 vs. the HTTP port? (as it shows in the SADP tool).
Click to expand...
That's the so-called media port, over which the camera handles it's command and control interface with devices such as an NVR.
Shows as version: 4.0.8 build 150325. So looks like it did get loaded with v4.0 then.
Click to expand...
Not quite - this is how the 'recovery mode' shows. It's a basic system with no web or application services - just a bare kernel from a built-in recovery partition.
It's a mode the camera enters when incompatible firmware has been applied.

The 2CD2342-WD-I is based on different hardware than the R0 series that the 'downgrader' works for - it's not compatible.
You need to find compatible firmware - but you'll need to match the region of the camera.
Did the "Was originally running 5.3.6." match what was on the label?
 
Unsure which label you're referring to. Is this a label that it physically on the camera somewhere...or on the box it came in. I don't recall ever upgrading the firmware since I've had the camera...which is only for a couple of months now.
So if 5.3.6 is the firmware that it came with, what do I need to do? Find a copy of this same firmware and use the tftpserv tool to load it?
 
It was the label on the camera I was referring to.
Usually, when you buy a camera, a difference between the actual firmware version shown on the web GUI and that shown on the label the manufacturer stuck on the camera suggests that the seller has installed a hacked version of firmware, often to make a Chinese region camera masquerade as English with English menus.
In reality that's a good thing - you get a cheap camera that works like a more expensive EN region camera - but the downside is if you update the firmware it reverts to Chinese region and can be rejected by Hikvision NVRs.
 
Ok...so that's good info. But even if this were to be a Chinese camera, shouldn't I be able to pull up the camera's web page now? Or is there another step to recovering?
 
But even if this were to be a Chinese camera, shouldn't I be able to pull up the camera's web page now? Or is there another step to recovering?
Click to expand...
Not when it's running in 'Recovery mode' where there are no web services.

The next step is to find compatible firmware.
Some possible sources for the 2CD2342-WD-I (Listed in the Hikvision model spreadsheet as an R6 model)
http://www.hikvisioneurope.com/port...01--IPC/R6 platform (2X22FWD, 2X42FWD, 2X52)/
Actually - that's all I can find for the particular model. The CN site appears inaccessible just now - it does come and go a bit.
 
You must log in or register to reply here.
Top Bottom