Not sure what I Missing

Mrweiser

n3wb
Joined
Nov 18, 2017
Messages
5
Reaction score
3
Location
St.louis Mo
I purchased my DS2CD2132-I s/n 425284955 about 3 years ago when I did my addition to my house ( i did most the work myself by adding 3 bedrooms and 2 baths) and left it mounted on the outside of my house till I got time to play with it and I decided this weekend I sit down and get cracking on it finally. I did all the firmware updating before I found this site (which I wish I of found BEFORE I started this process)

I figured out finally how to update the camera from 5.0.x to 5.2.5 using SADPTool as the web gui browsing function was not working. But when I tried to go from 5.2.5 to 5.3.0 is when I ran into a wall (Possibly a brick wall )

SADPTool sees the camera now with a firmware of V4.0.8 , where before I could tell SADP to enable DHCP now I cannot.

SADP allows me to changed the IP address but when i try to load the webpage to that address the page does not load correctly. So I thought I would roll the firmware back to 5.2.5 but the camera takes a loong time to come up and be seen by SADP (Like 10 min) and is not connecting with TFTP server. The pc is set 192.0.0.128

What am i missing because it just does not make sense....and can I get into the camera to fix this

I am very very much new to this but am very much wanting to lean.

Thanks in advance
 

NoloC

Getting comfortable
Joined
Nov 24, 2014
Messages
701
Reaction score
454
Are you sure your pc ip is "192.0.0.128"? Is that a typo?
 

Mrweiser

n3wb
Joined
Nov 18, 2017
Messages
5
Reaction score
3
Location
St.louis Mo
Hi NoloC thanks for replying

From everything I read and the other firmware updates i did when using the TFTP software the pc has to be set to 192.0.0.128 then you startup TFTP software, reboot camera and the camera will connect and upload the firmware.
 

NoloC

Getting comfortable
Joined
Nov 24, 2014
Messages
701
Reaction score
454
Could be. I am not familiar with this and @alastairstevenson is the resident genius on this subject. Hopefully he'll see this and guide you.
In the mean time I can tell you that is not a "private" or "non-routable" ip address and should not be used for you PC as a rule. I do have a vague recollection that some of my Hik cams started out with an ip of 192.168.0.x. I used the SADP tool to change the ip to the same subnet as my PC. In my case 192.168.1.xxx. You must have the pc and the cam on the same subnet in order to connect via browser. I'd try a factory reset and see what you get. I am not sure what you gain updating the firmware on the Hik as I am running 5.0 on an isolated vlan and all seems fine.

After the factory reset and restoring your PC ip to a proper address, try SADP again and get the cam on the same subnet. You mentioned dhcp so I assume you have a router acting as a dhcp server? Your pc should have a static address on the same subnet the router is serving but preferably not in the dhcp range.

If you did brick it, @alastairstevenson is your man!

EDIT: Just read the sticky and you are correct! Feeling dumb. Good luck.
 
Last edited:

Mrweiser

n3wb
Joined
Nov 18, 2017
Messages
5
Reaction score
3
Location
St.louis Mo
I tried to find the reset button on this camera and from what I can figure out there is not one..... As for a Non-routable Ip i know :) the camera reboots into 192.0.0.68 so that why the pc is set to .128 subnet which I did not clarify earlier. I believe in the later firmware the camera will start rebooting into 192.168.1.x range so then there is no reason to change ip.
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,930
Reaction score
6,778
Location
Scotland
SADPTool sees the camera now with a firmware of V4.0.8
The camera is 'bricked' as the 5.3.0 firmware is not compatible with the likely China region origin of the camera.
That firmware version of 4.0.8 indicates it's in the 'min-system recovery mode' due to incompatible firmware being applied.
This is a minimal system with no web services, no apps running apart from the SADP responder and probably telnet.

As you didn't try any firmware of 5.4.0 or higher and therefore didn't trigger the 'Catch-22 downgrade block' the easiest method on the road to recovery will be the @whoslooking '5.3.0 to 5.2.5 downgrader' found in the second link of the post here : Custom Firmware Downgrader 5.3.0 Chinese to 5.2.5 English
You probably want to try the CN version first.

This should bring back the camera to a working state, with a web GUI, probably with CN menus.
At this point you can consider doing the 'enhanced mtd hack' to make the camera English and fully upgradeable, it's not much different from the 'classic mtd hack' which will convert to English but probably not be upgradeable, depending on the original firmware version.
Classic mtd hack:
Hikvision 5.2.5 & 5.2.8 Full English (INC DAYS OF WEEK) mtd Hack

Enhanced mtd hack :
Hikvision DS-2CD2x32-I (R0) brick-fix tool / full upgrade method / fixup roundup.
 

Mrweiser

n3wb
Joined
Nov 18, 2017
Messages
5
Reaction score
3
Location
St.louis Mo
Thanks Alastair,
Thats what I thought but I was not 100% postive since I purchased it from who I thought would be safe..I tear into the documentation and see what happens.

Thank you all
 

Mrweiser

n3wb
Joined
Nov 18, 2017
Messages
5
Reaction score
3
Location
St.louis Mo
ok so I am unable to get the camera to attach to TFTP server, I tried multiple ways with laptops, desktop all direct connections and no joy. But being the stubborn person I am I tried to telnet to it and I can get in....so my question is would the mtd hack work? if I just replace the mtdblock5 & 6 via ftp and if so does anyone have some I could use since I did not even know to do this before finding this site so no backup of those files or did I miss understand other posts and they are stored in a dir on the camera? I just hate losing to a camera LOL
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,930
Reaction score
6,778
Location
Scotland
so my question is would the mtd hack work?
I believe it would, via the 'min-system' environment in the absence of the Hikvision tftp updater working normally. Though that might be due to the use of a direct connection as opposed to camera and PC being wired to switch/router ports.

As you've loaded an EN 5.3.0 firmware, which (presumably deliberately by Hikvision) objects to the contents of the hardware signature block in the flash partition mtdblock6 if you're up for a little experiment you could probably skip some of the usual 'enhanced mtd hack' steps.
But this will depend on the contents of your mtdblock6. If the 'devType' value is masqueraded (ie is 0xFF98) you don't have access to the output of the shell command 'prtHardInfo' to find the true, needed value.
But easy enough to check.
And if it is - then it's still possible to do the firmware downgrade from the 'min-system' environment.
they are stored in a dir on the camera?
Just for info - mtdblock6 is one of the 18 flash partitions in the camera, and holds amongst other things the camera-specific items such as MAC address, serial number, language, devType and all the optional features.

Here is a worked example of how you can extract a copy of mtdblock6 to inspect and modify and write back.
To do this you need a couple of things -
A normal tftp server. With the Hikvision-specific tftp updater you can 'get' files but not 'put' them.
One I've used that works well is this : TFTPD32 : an opensource IPv6 ready TFTP server/service for windows : TFTP server
You also need a good hex editor. HxD is usually the one of choice : HxD - Freeware Hex Editor and Disk Editor | mh-nexus

Suggestion:
Extract mtdblock6 as per this method below. Note that the IP addresses won't match what you have used - I just have them set that way for convenience.
Check out the detail and change the language and checksum as per this post : V5.2.5 build 141201 should I upgrade
If the devType in locations 0x64, 0x65 is 0xFF98 then instead of guessing what the true devType is, it will be necessary to install the 5.2.5 firmware to run prtHardInfo
But you can cross that bridge when you come to it.
Check mtd1ro_orig locations 0x0C and 0x8000C and if they are 0, change them to 1 and also write back mtd1ro_mod in the same way as mtd6ro_mod, but to /dev/mtdblock1
If in mtd6ro_orig the devType is not 0xFF98 then write mtdblock6 back and reboot, hopefully into EN language 5.3.0 firmware.

Code:
alastair@PC-I5 ~ $ telnet 192.168.1.64
Trying 192.168.1.64...
Connected to 192.168.1.64.
Escape character is '^]'.

(none) login: root
Password:
login: can't chdir to home directory '/root/'
# cd /
# ls -al
drwxrwxrwx    2         0 Mar 28  2014 lib
drwxrwxrwx    2         0 Mar 28  2014 sbin
drwxr-xr-x    2       448 Nov 19 15:54 davinci
drwxrwxrwx    3         0 Mar 28  2014 usr
drwxr-xr-x    2         0 Nov 19 15:54 home
drwxr-xr-x    2       352 Nov 19 15:54 config
drwxrwxrwx    2         0 Mar 28  2014 bin
drwxr-xr-x    2      2792 Nov 10 12:34 dav
drwxr-xr-x    2      2288 Jul  5 21:45 dav_sec
drwxrwxrwx    3         0 Mar 28  2014 etc
drwxr-xr-x   11         0 Nov 19 15:54 sys
-rwxrwxrwx    1         6 Mar 28  2014 VERSION
drwxrwxrwx    2         0 Mar 28  2014 tmp
drwxrwxrwt    3      3120 Nov 19 15:54 dev
dr-xr-xr-x   59         0 Jan  1  1970 proc
lrwxrwxrwx    1         9 Mar 28  2014 init -> sbin/init
drwxrwxrwx   16         0 Nov 19 15:58 ..
drwxrwxrwx   16         0 Nov 19 15:58 .
#
# cat /dev/mtd6ro > mtd6ro_orig
# cat /dev/mtd1ro > mtd1ro_orig
# tftp -p -l mtd6ro_orig 192.168.1.99
[ INFO][MIN]TFTP: #####################
# tftp -p -l mtd1ro_orig 192.168.1.99
[ INFO][MIN]TFTP: ##########################################
#
# # Inspect and modify the extracted mtd6ro_orig, saving as mtd6ro_mod
#
# tftp -g -r mtd6ro_mod 192.168.1.99
[ INFO][MIN]TFTP: #####################
#
# ls -al
drwxrwxrwx    2         0 Mar 28  2014 lib
drwxrwxrwx    2         0 Mar 28  2014 sbin
drwxr-xr-x    2       448 Nov 19 15:54 davinci
drwxrwxrwx    3         0 Mar 28  2014 usr
drwxr-xr-x    2         0 Nov 19 15:54 home
drwxr-xr-x    2       352 Nov 19 15:54 config
drwxrwxrwx    2         0 Mar 28  2014 bin
drwxr-xr-x    2      2792 Nov 10 12:34 dav
drwxr-xr-x    2      2288 Jul  5 21:45 dav_sec
drwxrwxrwx    3         0 Mar 28  2014 etc
drwxr-xr-x   11         0 Nov 19 15:54 sys
-rwxrwxrwx    1         6 Mar 28  2014 VERSION
drwxrwxrwx    2         0 Mar 28  2014 tmp
drwxrwxrwt    3      3120 Nov 19 15:54 dev
dr-xr-xr-x   59         0 Jan  1  1970 proc
lrwxrwxrwx    1         9 Mar 28  2014 init -> sbin/init
-rw-r--r--    1    524288 Nov 19 16:32 mtd6ro_orig
-rw-r--r--    1   1048576 Nov 19 16:32 mtd1ro_orig
-rw-r--r--    1    524288 Nov 19 16:33 mtd6ro_mod
drwxrwxrwx   16         0 Nov 19 16:33 ..
drwxrwxrwx   16         0 Nov 19 16:33 .
# cat mtd6ro_mod > /dev/mtdblock6
#
#
# reboot
Connection closed by foreign host.
alastair@PC-I5 ~ $
 
Top