so my question is would the mtd hack work?
I believe it would, via the 'min-system' environment in the absence of the Hikvision
tftp updater working normally. Though that might be due to the use of a direct connection as opposed to camera and PC being wired to switch/router ports.
As you've loaded an EN 5.3.0 firmware, which (presumably deliberately by Hikvision) objects to the contents of the hardware signature block in the flash partition mtdblock6 if you're up for a little experiment you could probably skip some of the usual 'enhanced mtd hack' steps.
But this will depend on the contents of your mtdblock6. If the 'devType' value is masqueraded (ie is 0xFF98) you don't have access to the output of the shell command 'prtHardInfo' to find the true, needed value.
But easy enough to check.
And if it is - then it's still possible to do the firmware downgrade from the 'min-system' environment.
they are stored in a dir on the camera?
Just for info - mtdblock6 is one of the 18 flash partitions in the camera, and holds amongst other things the camera-specific items such as MAC address, serial number, language, devType and all the optional features.
Here is a worked example of how you can extract a copy of mtdblock6 to inspect and modify and write back.
To do this you need a couple of things -
A normal tftp server. With the Hikvision-specific tftp updater you can 'get' files but not 'put' them.
One I've used that works well is this :
TFTPD32 : an opensource IPv6 ready TFTP server/service for windows : TFTP server
You also need a good hex editor. HxD is usually the one of choice :
HxD - Freeware Hex Editor and Disk Editor | mh-nexus
Suggestion:
Extract mtdblock6 as per this method below. Note that the IP addresses won't match what you have used - I just have them set that way for convenience.
Check out the detail and change the language and checksum as per this post :
V5.2.5 build 141201 should I upgrade
If the devType in locations 0x64, 0x65 is 0xFF98 then instead of guessing what the true devType is, it will be necessary to install the 5.2.5 firmware to run prtHardInfo
But you can cross that bridge when you come to it.
Check mtd1ro_orig locations 0x0C and 0x8000C and if they are 0, change them to 1 and also write back mtd1ro_mod in the same way as mtd6ro_mod, but to /dev/mtdblock1
If in mtd6ro_orig the devType is not 0xFF98 then write mtdblock6 back and reboot, hopefully into EN language 5.3.0 firmware.
Code:
alastair@PC-I5 ~ $ telnet 192.168.1.64
Trying 192.168.1.64...
Connected to 192.168.1.64.
Escape character is '^]'.
(none) login: root
Password:
login: can't chdir to home directory '/root/'
# cd /
# ls -al
drwxrwxrwx 2 0 Mar 28 2014 lib
drwxrwxrwx 2 0 Mar 28 2014 sbin
drwxr-xr-x 2 448 Nov 19 15:54 davinci
drwxrwxrwx 3 0 Mar 28 2014 usr
drwxr-xr-x 2 0 Nov 19 15:54 home
drwxr-xr-x 2 352 Nov 19 15:54 config
drwxrwxrwx 2 0 Mar 28 2014 bin
drwxr-xr-x 2 2792 Nov 10 12:34 dav
drwxr-xr-x 2 2288 Jul 5 21:45 dav_sec
drwxrwxrwx 3 0 Mar 28 2014 etc
drwxr-xr-x 11 0 Nov 19 15:54 sys
-rwxrwxrwx 1 6 Mar 28 2014 VERSION
drwxrwxrwx 2 0 Mar 28 2014 tmp
drwxrwxrwt 3 3120 Nov 19 15:54 dev
dr-xr-xr-x 59 0 Jan 1 1970 proc
lrwxrwxrwx 1 9 Mar 28 2014 init -> sbin/init
drwxrwxrwx 16 0 Nov 19 15:58 ..
drwxrwxrwx 16 0 Nov 19 15:58 .
#
# cat /dev/mtd6ro > mtd6ro_orig
# cat /dev/mtd1ro > mtd1ro_orig
# tftp -p -l mtd6ro_orig 192.168.1.99
[ INFO][MIN]TFTP: #####################
# tftp -p -l mtd1ro_orig 192.168.1.99
[ INFO][MIN]TFTP: ##########################################
#
# # Inspect and modify the extracted mtd6ro_orig, saving as mtd6ro_mod
#
# tftp -g -r mtd6ro_mod 192.168.1.99
[ INFO][MIN]TFTP: #####################
#
# ls -al
drwxrwxrwx 2 0 Mar 28 2014 lib
drwxrwxrwx 2 0 Mar 28 2014 sbin
drwxr-xr-x 2 448 Nov 19 15:54 davinci
drwxrwxrwx 3 0 Mar 28 2014 usr
drwxr-xr-x 2 0 Nov 19 15:54 home
drwxr-xr-x 2 352 Nov 19 15:54 config
drwxrwxrwx 2 0 Mar 28 2014 bin
drwxr-xr-x 2 2792 Nov 10 12:34 dav
drwxr-xr-x 2 2288 Jul 5 21:45 dav_sec
drwxrwxrwx 3 0 Mar 28 2014 etc
drwxr-xr-x 11 0 Nov 19 15:54 sys
-rwxrwxrwx 1 6 Mar 28 2014 VERSION
drwxrwxrwx 2 0 Mar 28 2014 tmp
drwxrwxrwt 3 3120 Nov 19 15:54 dev
dr-xr-xr-x 59 0 Jan 1 1970 proc
lrwxrwxrwx 1 9 Mar 28 2014 init -> sbin/init
-rw-r--r-- 1 524288 Nov 19 16:32 mtd6ro_orig
-rw-r--r-- 1 1048576 Nov 19 16:32 mtd1ro_orig
-rw-r--r-- 1 524288 Nov 19 16:33 mtd6ro_mod
drwxrwxrwx 16 0 Nov 19 16:33 ..
drwxrwxrwx 16 0 Nov 19 16:33 .
# cat mtd6ro_mod > /dev/mtdblock6
#
#
# reboot
Connection closed by foreign host.
alastair@PC-I5 ~ $