R0 / DS-2CD2x32 BrickfixV2 brick recovery and full upgrade tool - enhanced.

Joined
Mar 27, 2018
Messages
19
Reaction score
0
It can be that the use of PoE adversely affects the timing of the tftp updater. 12v works best.
Hi Alastair,
I tried the 12V adapter method. I see that the camera gets the IP address 192.0.0.64 (i can ping it from the pc running the tftp tool), but the camera never attempts to connect to the tftp server.

The camera gets the IP address of 192.0.0.64 for exactly 14 seconds

Thanks !
 
Joined
Mar 27, 2018
Messages
19
Reaction score
0
@
Maybe temporarily disable the Windows firewall, see if that changes anything.
The first time the tftp updater runs, it should trigger a Windows firewall alert to confirm it's OK to allow inbound access.
The Windows firewall is disabled.
To see if it makes any difference, i also enabled the firewall and restarted the tftp uploader, and got the windows firewall prompt you describe.

However, both the times, I get the exact same issue of the camera not wanting to talk to the tftp uploader
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,930
Reaction score
6,778
Location
Scotland
However, both the times, I get the exact same issue of the camera not wanting to talk to the tftp uploader
It sounds like the camera isn't probing for the tftp updater.
You have the optimum setup - both PC and camera wired to a switch, camera powered by 12v.

It is possible to alter the way the camera probes for the tftp updater by modifying the bootloader variables - though that's not very likely.
If you feel it's worth the effort - maybe see what wireshark captures after the tftp updater is running, and the camera gets powered on.


The default settings in wireshark should work OK.
Just close down any traffic sources on the PC such as browsers, start the tftp updater, start capturing on wireshark, power on the camera.
Wait a couple of minutes, stop and save the capture.
You can post the capture file here.
 

Oleglevsha

Getting the hang of it
Joined
Jan 25, 2015
Messages
299
Reaction score
77
Location
Россия г.Волгоград
Using the materials of publications on this forum thread, a service version of the firmware was prepared for changing the Chinese interface of the R0 series ip cameras
you can get acquainted with the firmware by visiting the link to my blog
this post I posted earlier on another thread, but here is a more appropriate topic.
The data change is permanent, just as suggested in the BrickfixV2 method
 

rst

n3wb
Joined
Aug 12, 2015
Messages
6
Reaction score
1
cess and a 'fixu
us forum member.
unzipped 'brick-fixV2' fi
refresh. Make a copy of mtd6ro_orig
firm devType 1298 f
he 5.4.5 firmware and it run perfectly
was running an old firmware that I assume had been hacked to English on a Chinese camera. I'm getting stuck at the putty
 

rst

n3wb
Joined
Aug 12, 2015
Messages
6
Reaction score
1
Hi
Hope someone can help me. I loaded a new firmware on my DS-2CD2432F-1W camera and it bricked, It had firmware version 5.2.5 and I tried installing 5.4.5. I tried the brick recovery steps and managed to get brick fix toolv2 installed. When using putty and starting a telnet session an error comes up saying Network error: Connection refused. Tried both EN and CN versions.

Thanks
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,930
Reaction score
6,778
Location
Scotland
When using putty and starting a telnet session an error comes up saying Network error: Connection refused. Tried both EN and CN versions.
What was the IP address of the PC when you tried telnet?

Suggestion :

With the PC IP address set to 192.0.0.128 try to ping 192.0.0.64 and telnet to that address.

With the PC IP address set to 192.168.1.128 try to ping 192.168.1.64 and telnet to that address.
 

rst

n3wb
Joined
Aug 12, 2015
Messages
6
Reaction score
1
IP address of pc was 192.0.0.128.

I pinged 192.0.0.64 and got a reply.

SADP finds the cam as mini system and the ip address is 192.0.0.64.


Thanks
 

rst

n3wb
Joined
Aug 12, 2015
Messages
6
Reaction score
1
Thanks Alastair. Yeah not sure whats going on. Wil try again. Just to check, Telnet port is 22 right.

Thanks
 

rst

n3wb
Joined
Aug 12, 2015
Messages
6
Reaction score
1
Got it working . Changed connection type to other in putty and it worked. Upgraded to 5.4.5 firmware.

Thanks Alastair
 
Joined
Jun 23, 2021
Messages
1
Reaction score
1
Location
US
Just wanted to say thank you @alastairstevenson - I was able to un-brick three DS-2CD2032-I cameras using this method. Didn't realize til now that flashing the CH versions would lead to disaster. Fortunately only 3 of 18 were CH versions. Anyway, thanks for saving my bacon!
 

Mancho4

n3wb
Joined
Jun 25, 2021
Messages
13
Reaction score
0
Location
costa rica
The original 'brick-fix tool' and 'enhanced mtd hack' has proven pretty useful for those with R0 cameras that had been bricked by doing a firmware update.
It's been even more useful to deal with the fallout from the 'Hikvision backdoor' disclosure where so many people are finding their cameras are being messed with from the internet, mischievously or maliciously, and need to update to safer firmware.
However - the rather techy original method to make the changes, and probably my not-very-clear instructions have been a challenge for some people.
* And I only just noticed this - my original .txt attachments were in Linux format, not Windows format, making them hard to read without proper line breaks. And no-one let me know! Dohh! *

So here is 'Brick-fix tool V2' aimed at making the process less complex, a bit automated and easier to use, with the following changes:
  • After Brick-fix toolV2 has been installed using the Hikvision tftp updater, following the power cycle to activate and drop the payload, the camera will boot directly into 'min-system' mode with telnet and tftp access and a 'fixup' script ready and primed for use.
  • No web GUI access or Windows shares are needed to move files in and out of the camera.
  • The fixup script handles all the basics of extracting the original mtdblock6, importing and applying the user-modified mtdblock6 that has had the 'enhanced mtd hack', and initiating a firmware update.
  • The Brick-fix toolV2 automatically writes a valid template into mtdblock1 that stops cameras that originally had firmware 5.2.0 or 5.2.8 from otherwise going into a bricked state when newer firmware is applied.
  • Attached to this post are the resources required to convert your R0 / DS-2CD2x32 cameras into full English upgradeable devices.
  • The brick-fix tool V2 in both EN and CN header language versions (brick_fixv2.zip).
  • A required resource list and step-by-step guide to the fixup script.
  • A description of how to do the 'enhanced mtd hack' with screenshot with a list of devType codes for those cameras that have the masqueraded values.
  • A sample transcript of the fixup script going through all 3 stages - extract mtdblocks, import modded mtdblock6, apply firmware update.

edit 15Dec17 By popular request, a video worked example using a DS-2CD3332-I camera donated by a generous forum member.

edit 28Jan18 devType codes updated - thanks @hikcamuser

Resource List
Step By Step Guide:
Here are the steps to take when using the brick-fixV2 tool to recover a bricked camera, and running the fixup script to change the camera to English / upgradeable. The camera doesn't have to be bricked to run the brick-fix tool if all that's required is a helping hand doing the 'enhanced mtd hack'.
  1. Create a folder on the local drive of your Windows PC to hold the Hikvision tftp updater, the chosen tftp server program (e.g. jouinin.net version), the unzipped 'brick-fixV2' files, and the Hikvision firmware to use for updating. The HxD hex editor should be installed on the PC.
  2. With the PC and the camera each on a wired connection (not WiFi) set the PC IP address to 192.0.0.128, subnet mask to 255.255.255.0 The default gateway does not matter.
  3. Make a copy of brickfixV2EN and name it as digicap.dav If the EN version does not work, e.g. "System update completed" is not displayed in step 5 or you don't get the login prompt when trying to telnet in step 8, try the CN version.
  4. Start the Hikvision tftp updater tftpserve.exe and if a Windows firewall popup appears, click OK to accept what the program needs.
  5. Power on the camera and observe the status messages in the tftp updater. Hopefully you will see 'System update completed' after 2 or 3 minutes.
  6. Close the Hikvision tftp updater, delete the digicap.dev file from step 3 and make a copy of the Hikvision firmware to use for updating and name it digicap.dav.
  7. Power down the camera. At this point the brickfixV2 tool has been installed but not yet activated. Power on the camera to activate the tool, it will then drop the payload, fix up mtdblock1 and reboot into min-system mode for telnet access.
  8. Using PuTTY, start a telnet session to 192.0.0.64 and make sure the telnet radio button is selected. At the login prompt username=root password=12345. You should see a # prompt. The message "can't chdir to home directory '/root/'" isn't an error and can be ignored.
  9. Start the normal tftp server (not the Hikvision tftp updater). If it's the jouinin.net version, the program is tftpd32.exe

    At this point, Stage 1 of 3 is ready to be executed.
    At the telnet command prompt, type:
    /dav/fixup.sh
    and watch the on-screen messages.​

    • On success with Stage 1, check the PC folder that the tftp server is running in for the presence of the file 'mtd6ro_orig'. You may have to hit F5 to refresh. Make a copy of mtd6ro_orig rename to mtd6ro_mod. Do the 'enhanced mtd hack' on it, using the instructions in the spoiler below.
  10. These are the steps that are used to do the 'enhanced mtd hack' to mtdblock6 in an R0 IP camera.
    • Extract a copy of mtdblock6 from the camera. The 'Brick-fixV2 tool / fixup script' will conveniently do this for you, or it could be done manually by other methods.
    • Make a copy of the mtdblock6 file and name it mtd6ro_mod
    • Open it with the HxD hex editor.
    • Referring to this image
      View attachment 24161
    • Check / change as needed the language byte at location 0x10 to ensure it is 01
    • Check the devType value in locations 0x64 and 0x65
    [*]
    If the value shown is FF98 - then the FF value needs to be replaced with the true numeric value. Ideally the true value is determined from the 'devType' line from the prtHardInfo shell command, but as that is going to be unavailable on a bricked camera use this (partial) cross-reference list, paying careful attention to the exact model number.

    There is some slight uncertainty here - it would be good if any forum members could confirm / supplement the content.

    devType - Model
    2698 - DS-2CD2032F-I
    2698 - DS-2CD2032F-IW
    0598 - DS-2CD2032-I
    0698 - DS-2CD2132-I
    1E98 - DS-2CD2132F-IS
    1E98 - DS-2CD2132F-IWS
    0798 - DS-2CD2232-I5
    0898 - DS-2CD2332-I
    1298 - DS-2CD2432F-IW
    1498 - DS-2CD2532F-IS
    1098 - DS-2CD2632F-IS
    0E98 - DS-2CD2732F-IS
    0698 - DS-2CD3132-I
    1C23 - DS-2DE2103-DE3/W
    2198 - DS-2CD2T32-I8​



    • Replace the FF in location 0x64 with the first 2 digits of the numeric devType value.
    • If location 0x64 already has a 2-digit numeric value, no change is needed.
    • Starting at location 0x09, drag to select and highlight a length of F4 bytes, as shown he the HxD bottom status bar.
    [*]
    Using the Analysis / Checksum menu, double-click Checksum-16 to calculate the new checksum. This will show as a 2 byte value in the Checksums tab at the bottom of the screen. These need to be applied using the correct 'endian-ness', which is the reverse of how the values are presented on the screen.

    The left hand byte (0x0C in the screenshot) is the most significant byte and should be used in location 0x05

    The right hand byte (0x5F in the screenshot) is the least significant byte and should be used in location 0x04

    Use your own just-calculated values - not those from the screenshot.

    Click File | Save and the mtd6ro_mod file has had the 'enhanced mtd hack' and is ready to be applied to the camera.

    Esto se hace durante la Etapa 2 del script de reparación en la herramienta brick-fixV2.​


    ¡Buena suerte!​

    [/revelación]​
    [SPOILER = "Instrucciones mejoradas de pirateo de MTD"]
    [/ SPOILER]


    En este punto, la Etapa 2 de 3 está lista para ejecutarse.
    En el símbolo del sistema de telnet, escriba:
    /dav/fixup.sh
    y observe los mensajes en pantalla.

    Esto traerá el mtd6ro_mod modificado y lo aplicará a la cámara para convertirlo a inglés / actualizable.

    En este punto, la Etapa 3 de 3 está lista para ejecutarse.
    En el símbolo del sistema de telnet, escriba:
    /dav/fixup.sh
    y observe los mensajes en pantalla.

    Esto intentará una actualización de firmware utilizando el archivo de firmware de Hikvision digicap.dav que colocó en la misma carpeta que el servidor tftp.​
    [*]Suponiendo un resultado exitoso, apague el servidor tftp y apague y encienda la cámara. Curiosamente, en las pruebas encontré que un salto directo a la versión de firmware 5.4.5 funcionó bien. YMMV. Pero vale la pena intentarlo.
    [*]Inicie SADP y verifique la presencia de la cámara ejecutando la versión de firmware utilizada para la actualización.
    [*]Si usó el firmware 5.4.5, la cámara requerirá 'activación' con su elección de contraseña segura.
    Si ya está activo, si se usó firmware anterior para la actualización, inicie sesión con la contraseña de administrador = 12345
    Cambie la dirección IP a la que desea que use la cámara.
Cómo actualizar
  1. Cambie el nombre del firmware a digicap.dav
  2. Coloque el firmware en la misma carpeta de este TFTP
  3. Configure la IP de la computadora como 192.0.0.128
  4. La IP de la cámara puede ser cualquiera.
  5. Ejecute tftpserv.exe
  6. Apague y encienda el DVR / DVS / IPC. El dispositivo buscará el nuevo firmware y lo actualizará automáticamente.
  7. Espere hasta que TFTP muestre "¡Actualización del sistema del dispositivo [192.0.0.64] completada!" Tarda unos 5 minutos.
  8. Cierre el TFTP antes de que la cámara se reinicie.
  9. DVR / DVS / IPC se reiniciará automáticamente después de la actualización.
[/CITA]


Buenos días,
querido, ¿podrías ayudarme? Soy nuevo aquí y tengo un problema con mi cámara DS-2CD3145F-IS
V5.3.8 build 160108.
Me estaba funcionando bien en mi grabadora y de repente no se conecta y dice que hay un problema con la coincidencia de idiomas, me metí en la cámara y solo aparece en chino. Alguien que me ayude y tal vez tenga un firmware en inglés, por favor

Ícono de validado por la comunidad
Estos pasos pueden funcionar para esta cámara DS-2CD3145F-IS.
V5.3.8 build 160108. con el firmware con el que trabajaste
 

Mancho4

n3wb
Joined
Jun 25, 2021
Messages
13
Reaction score
0
Location
costa rica
bueno querida

Estos pasos pueden funcionar para esta cámara DS-2CD3145F-IS.
V5.3.8 build 160108. con el firmware con el que trabajaste
 

Mancho4

n3wb
Joined
Jun 25, 2021
Messages
13
Reaction score
0
Location
costa rica
good dear

These steps may work for this DS-2CD3145F-IS camera.
V5.3.8 build 160108. with the firmware you worked with
 

Mancho4

n3wb
Joined
Jun 25, 2021
Messages
13
Reaction score
0
Location
costa rica
Dear, according to your experience what I can do to put it in English.
He asks the firmware that I attach works, the camera does not let me update from the web

DS-2CD3145F-IS
V5.3.8 build 160108

Please help me, I'll be grateful
 

Attachments

Top