Is it allowed to buy firmware on here? Specifically I'm interested in full filesystems of Hikvision cameras, if possible newer models. Thanks in advance!
alastairstevenson
Staff member
That's a strange question.
Have you checked Hikvision's public websites for their CCTV products?
Most new product listings have a firmware download on the product page.
And firmware is publicly available to download from many of their sites, such as here -
As far as I can see that's just the digicap.dav, without the actual files on the system. I'm interested in modding the firmware, i.e. changing functionality like for example the front page's html.
Last edited:
You can't, it's encrypted and RSA signed, even if you are able to decrypt it, camera still won't accept unsigned modified firmware
shelestoff
Young grasshopper
What should I do if the camera becomes inactive after rebooting? This is a common issue with G5 series cameras (2xx3G2, 2xx7G2).
Judging by previous cases with other camera series, the mimage and minisys files helped. Where can I get these files for this series, or what are the solutions?
Judging by previous cases with other camera series, the mimage and minisys files helped. Where can I get these files for this series, or what are the solutions?
watchful_ip
Getting comfortable
Inactive on SADP just means you need to activate it.
If you mean it becomes unresponsive, and doesn't show on SADP, then TFTP recovery would be the first thing to try (after checking cables, switch, POE etc)
shelestoff
Young grasshopper
Of course, this means the device isn't activated. The issue is that after activation and reboot, the camera reverts to inactive status. Attempts to flash the firmware via TFTP are just as ineffective as flashing it via the web interface. The problem can be solved by manipulating the partitions from the working device, but this requires desoldering the memory chip, performing the necessary manipulations, writing a modified dump to the chip, and re-soldering the chip back into the device. Having the aforementioned files on hand makes solving the problem easier.
watchful_ip
Getting comfortable
If it's not saving to the correct partition properly (even after a config reset) then as you've likely surmised there's likely a flash issue.
Of course, this means the device isn't activated. The issue is that after activation and reboot, the camera reverts to inactive status. Attempts to flash the firmware via TFTP are just as ineffective as flashing it via the web interface. The problem can be solved by manipulating the partitions from the working device, but this requires desoldering the memory chip, performing the necessary manipulations, writing a modified dump to the chip, and re-soldering the chip back into the device. Having the aforementioned files on hand makes solving the problem easier.
I'd login via SSH and view logging to see if there's any errors generated (or UART if you are already doing that anyway) when changing config.
Having the filesystem won't help.
But I checked one of my G5s anyway just for reference:
Code:
# prtHardInfo | grep G5
Path: /Camera/Platform/Branches/branches_frontend_software_platform/IPC_develop_branch/ipc_baseline/baseline_V5.7.17_G5_IPC_qudao
# ls /config/ipc_db /davinci/ipc_db
/config/ipc_db /davinci/ipc_db
# mount | grep -e config -e davinci
/dev/ubi3_0 on /davinci type ubifs (rw,sync,relatime,chk_data_crc,assert=read-only,ubi=3,vol=0)
/dev/ubi3_0 on /config type ubifs (rw,sync,relatime,chk_data_crc,assert=read-only,ubi=3,vol=0)
# cat /proc/mtd | grep cfg
mtd12: 00600000 00020000 "cfg0"
mtd13: 00000000 00020000 "cfg1"i.e. config is saved to mtd12 and my G5 at least doesn't have a backup config partition.
If you have the ability to change the filesystem then you could of course mount /config and /davinci to another partition assuming it's writable and has space.
watchful_ip
Getting comfortable
Just in case helpful for anyone else, my G5 doesn't really have a good alternative dedicated partition to store config on, unless you want to repurpose the syslog partition (which wasn't mounted/used for me - just be aware could cause issues if a related debug option gets used).
Alternatively, you could mount nfs to /config and /davinci on startup or just symlink to a directory on SD card (you may have to bring it up earlier than normal so it's seen at the right time).
I thought I'd check out one of the new H13's (unhelpfully using model name DS-2CD2387G3-LI2UY) - and mine don't have a backup config partition either, but they do have an unused resv partition.
Personally I think given the runtime read/write on cfg0 (i.e. higher likelihood to fail) it would have been better to make the unused resv partition cfg1 for a proper alternative way to store the config if the partition fails.
Note higher end versions, or PTZ versions are much more likely to have backup partitions for all primaries.
Alternatively, you could mount nfs to /config and /davinci on startup or just symlink to a directory on SD card (you may have to bring it up earlier than normal so it's seen at the right time).
I thought I'd check out one of the new H13's (unhelpfully using model name DS-2CD2387G3-LI2UY) - and mine don't have a backup config partition either, but they do have an unused resv partition.
Code:
# prtHardInfo | grep Path
Path: /Camera/Platform/Branches/branches_frontend_software_platform/IPC_develop_branch/ipc_baseline/baseline_V5.8.10_H13_heop_qudao_ipc
# cat /proc/mtd | grep -v ': 00000000'
dev: size erasesize name
mtd0: 00100000 00020000 "bld"
mtd1: 00080000 00020000 "env"
mtd2: 00080000 00020000 "enc"
mtd3: 00080000 00020000 "sysflg"
mtd4: 00100000 00020000 "dpt"
mtd5: 00a00000 00020000 "rcvy"
mtd6: 00a00000 00020000 "sys0"
mtd8: 0d600000 00020000 "app0"
mtd10: 00600000 00020000 "cfg0"
mtd12: 00600000 00020000 "syslog"
mtd14: 00600000 00020000 "resv"Personally I think given the runtime read/write on cfg0 (i.e. higher likelihood to fail) it would have been better to make the unused resv partition cfg1 for a proper alternative way to store the config if the partition fails.
Note higher end versions, or PTZ versions are much more likely to have backup partitions for all primaries.
Last edited:
I was told by some guy that you can't use the format command in uboot on H3 platform, it will damage the config partition and resulting in the same situation as yours, camera is always inactive after rebooting.
There's old firmware for G5 before Oct 2021, which is vulnerable to CVE-2021-36260 found by @watchful_ip . Get shell access and manually format the config partition, save db files
There's old firmware for G5 before Oct 2021, which is vulnerable to CVE-2021-36260 found by @watchful_ip . Get shell access and manually format the config partition, save db files
So you managed to find new method to get shell access to the newest H13 platform?
watchful_ip
Getting comfortable
But obviously you didn't get them from theYou could get any of the info I posted from the diag command
diag command, you already have root accessDo you know how I could get a shell on my "DS-2CD2386G2-I"? Should I try to downgrade the firmware?You could get any of the info I posted from the diag command