[Solved] DS-2CD2185FWD-I Firmware dump

Maki_mitz

Maki_mitz

n3wb
Nov 4, 2020
6
2
/dev/shm
Hello everyone,

Actually I'm trying to dump the DS -2CD2125FWD-I firmware. I tried those different method:
  • Building an ARMv7 kernel from scratch and boot via TFTP, but I don't have Device Tree Blob for the Amarella board... So, addresses etc.. Seems not good ;
  • Decrypt the digicap.dav with tools found on this forum (hikpack for example), but the actuel firmware seems to be too recent, so tools can't decrypt it ;
  • Chip off the flash and dig into memory blocks, but I probably broke something will doing it.
So, if someone know a way to dump the firmware, I'll really appreciate the help. Or if someone has the secret key for "digicap.dav", it would be perfect too.
Thanks in advance.
Best regards.
 
The hikpack (see in attached picture) i'm using doesn't support G1 firmware... Is the version 2.5 the latest ? If no, you didn't manage to find a newer version.

For the SDK, I see... So my kernel can't be a right one lol. Thanks for the help !
 

Attachments

  • 2020-11-04_13-56.png
    2020-11-04_13-56.png
    52 KB · Views: 43
Maki_mitz said:
Chip off the flash and dig into memory blocks, but I probably broke something will doing it.
Click to expand...
Given the availability of a suitable test clip that works for whatever type of flash chip that camera uses - usually an 'in-situ' read works OK.

Alternatively - check what useful flash commands if any remain in the bootloader.
You may be able to dump the flash directly and transfer out over tftp.

Also - and this is optimistic as Hikvision started disabling this method a while back - if you can add
init=/bin/sh single debug
to the bootargs environment variable, you might be able to boot it to a root shell, in which case the flash partitions can be extracted.
 
alastairstevenson said:
Given the availability of a suitable test clip that works for whatever type of flash chip that camera uses - usually an 'in-situ' read works OK.

Alternatively - check what useful flash commands if any remain in the bootloader.
You may be able to dump the flash directly and transfer out over tftp.

Also - and this is optimistic as Hikvision started disabling this method a while back - if you can add
init=/bin/sh single debug
to the bootargs environment variable, you might be able to boot it to a root shell, in which case the flash partitions can be extracted.
Click to expand...

Yes, I wanted to do this, but I only have few commands. Mainly for update actions :/
Do you see something helpful in the available commands ?
 

Attachments

  • 2020-11-04_17-51.png
    2020-11-04_17-51.png
    11.5 KB · Views: 40
You must log in or register to reply here.
Top Bottom