mroek

Curiosity got the better of me (and killed the cat..), so I decided to crack open one of my brand new Hiks to see what it was like inside. Being a nice guy, I thought I'd share my findings with you guys. The housing itself is held together by three philips head screws, but to get at the screws you have to remove some rubber inserts from the screw holes. They're embedded quite deep, so not very easy to get out. This is what you will see when you remove the front part of the housing (need to disconnect the ribbon cable and one more cable): The connector with the multiple colored wires goes to the pigtail on the outside of the camera, so it contains the network and power wires. The board you can see, is therefore the power supply board, and it also has the physical ethernet transformer on it, as you can see. Here's a closeup of the same board, but fully removed from the housing: The other side of the same board: Note the black board-to-board connector. This is where it connects to the mainboard with the CPU, which you can see here, while it is still sitting in the housing. The ethernet PHY and the flash is also here, but unfortunately I forgot to lift off the label on the flash, so I don't have the part number: Here's the other side of the main CPU board, removed from the housing. Note the reset button and the 256MB DDR3 SDRAM: If we lift off that orange sticky foam from the CPU, we can see (not easy to see from the image, I admit) that it is a Ambarella A5s SoC. The connector at the upper left is not connected to anything, and I'd be willing to bet that it has the RS232 pins to get access to the bootloader. I didn't test it, though: Here's the rear housing with all the electronics removed. As you can see, the cables are embedded in some kind of rubbery sealant where they enter the housing, so they can't be easily removed. Keeps everything pretty waterproof, though: The front part of the housing has the lens and IR-boards, and looks like this while still attached to the housing: The assembly removed from the housing. Note the small silica gel bag that has been zip-tied to the cable to keep moisture low: Here's how it looks from the side: And finally, here's the front of this assembly. The lens is glued, as others have said, but it is not easily visible in the image. If you look closely, you can see a shiny little speck at around 1 o'clock, but there is quite a bit more glue there: And finally, the empty front part of the housing: I think the build quality seems to be excellent, and they have done a very nice job with the weatherproofing. The two housing halves has a nice, molded gasket between them (can be seen in the first image), and everything is kept very tidy inside. Good job, Hikvision!

I've tested the Dahua Smart Player software, but it has one major flaw, as far as I can tell: You have to navigate to each folder that contains video (.dav) files to add them to the view list. This is a major PITA, if you are trying to access the folder structure that the Dahua cameras create when they store events. The structure has many levels, here's an example from my camera (stored to my NAS via FTP from the camera): \\NAS\ftpserver\TZC2LV0xxxxxxx\2013-02-24\001\dav\22 In this folder the events that occured between 22:00 and 22:59 on the 24th of Feb is stored. Fine, and it makes it easy to actually find a specific recording if you know when it happened. However, that's not what I typically want, what I want is to point the player application to a folder and have it traverse all the subfolders to add all the videos it can find, so that I can quickly play them (sequentially) to look for events. The Dahua Smart Player actually looks like a fine piece of software, but it is still useless for what I want. Is there some way of making it do what I want? I think not, but I have been wrong before. I've also looked at PSS, but that software doesn't even seem to have an interface for loading files from folders, it problably only works with files that it has written itself, and in my case that defeats the purpose, since the cameras store directly to my NAS.

What's up with the user account system on the Dahua cameras? I have some HFW-2100 (got them a few days ago), and I have naturally changed the passwords on the accounts (admin/888888/666666). Today I tried installing PSS just to see how it works, and even though I can add cameras, PSS cannot login to them, and the accounts subsequently gets locked (for 30 minutes, apparently). I am of course 100% certain that I have entered the correct password (which works on the web interface), but PSS (which tries to connect at port 37777) obviously manages to lock the account. Afterwards this account is also locked for login from the web interface (which it should be, as long as it is the same account). Anyone have any insight here?

I don't know which sensor it is, but I'm sure the chip was marked A5S.

Hi, Today I received three of these bullets from China (Aliexpress). They are obviously Chinese versions, with a Chinese leaflet, Chinese label, and ... Chinese firmware. Now, before anyone gets scared, there is actually only one minor item that shows the firmware is Chinese, and that is the weekday text overlay. It is impossible to get that to be in English, other than that, absolutely everything is in English. The cameras are fully usable as-is, you just have to live without weekday display (or learn Chinese). The cameras I received are manufactured in July, so they're coming almost directly from the production lines. The connector pigtail is the new and improved style, a wise move from Hikvision. One word of caution though, you have to re-crimp the connector on the ethernet cable if you are going to use it, because you need to thread some parts onto the cable itself before assembling it. I have only installed one of the cameras yet, but I am very impressed with it. It replaces a bricked Dahua HFW2100, and it is way, way better in almost every regard. I'm not going to make this a review, because others have written good reviews, but this is a little gem of a camera. Not flawless, but very good. Now, to get to the point of this thread, since I am a tinkerer, I really want to find out if it is possible to cross-flash the camera to the European version of the firmware. Two reasons for this, one is the minor issue with the weekdays, the other is future updates. When new versions are released on the European (or US) site, it would be nice to be able to use those, and I guess to do that the camera must think it is already a US or European version. I'm saying US or European, because I did a binary compare of the v5 firmware that is available from Hikvision US and Hikvision Europe, and they are actually identical. May not be relevant, but nevertheless it probably means Hikvision doesn't have PAL or NTSC versions (which is rather pointless these days anyway) like Dahua has. As others have also discovered, just trying to flash the European firmware to these Chinese cameras gives you an error message stating "Language mismatch". Nothing is broken or corrupted by trying this, it's just the camera that refuses to flash the firmware. I have asked the Aliexpress supplier if they can offer some advice, but I'm not sure if they will have any to offer. I've been thinking if it would be possible to use the TFTP brick recovery method to trick the camera into taking the other firmware, but I am not sure I'd like to risk it. I have verified that these cameras always tries to contact the TFTP-server at 192.0.0.128 during boot, no matter if the cameras are fully working or not. I am quite convinced that the TFTP functionality is part of the bootloader (99% sure it is U-boot), and in theory it is possible, maybe even likely, that this method could bypass the language check (if that's actually what it is). After all, this method is meant to recover a bricked camera, so there might not be a previous firmware to check against. It is of course also possible that there is some regional indicator stored elsewhere, in which case all of this might be a moot point. At this point I am going to wait for a reply from the supplier, but I am a bit tempted to try this, even though I run the risk of bricking the camera. If anyone else has any info to chip in with, please do.

Most likely the supplier has patched them manually, but they are still Chinese region cameras.

You can only use one of these at a time? You can use line traversal and intrusion detection simultaneously, but not face detection.

Maybe I'm not configuring it correctly. You have to leave motion detection still enabled still - correct? Or do you turn motion detection off completely and enable one of the new methods instead? You can use the other features without having motion detection enabled, but as mentioned, it will not work with Surveillance Station.

Ok, that means it doesn't work in the newer versions of SS either. That's a pity, because it looks like line traversal and intrusion detection might be better than general motion detection. At least in theory.

That's been my experience too. Nothing I do gets Synology Surveillance Station capturing Traversal, Face Detection or Intrusion Detection. Just for reference, which version of DSM and Surveillance Station are you running? I'm still on DSM 4.3 and SS 6.1-2976. DSM 5 has the awful new UI and seemingly a lot of bugs, so I haven't updated. I think the newer versions (6.3-xxxx) of Surveillance Station has better native support for these cameras, have you tried that? I'm using the PSIA mode in Surveillance Station for mine (with ONVIF I can't have motion detection by the cameras, and the native mode works no better than PSIA).

Two additional observations: If I set up a shared folder on the NAS, and then connect to this folder using SMB/CIFS (not NFS!) in the camera, the camera will actually respect the quota for the user I set up. In other words, I can set up one unique user per camera, and set a quota for each of those users. This means the camera will only "see" the quota size for any folder, and it will only "format" this amount of space in the folder. And another interesting observation is that when using the camera playback function, you can have it overlay the detection features (like line traversal and intrusion detection) and show which one was tripped. This could be helpful when trying to fine-tune the settings. To play back the video without these overlays, just disable "Rules" under the camera local configuration tab.

Ok, I've done some more testing, and I've concluded that there is no way to have anything other than regular (normal or expert) motion detection to get Surveillance Station to trigger. Line traversal, face detection and intrusion detection will not trigger under any circumstances. I then experiented a bit with setting up NFS on the NAS, and the cameras can connect just fine, but after initializing/"formatting" the NFS drive, it goes back to uninitialized, and it doesn't work. I've since discovered that this is a known bug, and that you have to patch the davinci file to fix it (or have a completely empty volume for the camera). I haven't done so, at least not yet. Then I did as you suggested, and shared a USB stick on a Windows computer, and set that up for storage on one of the cameras. With this setup I can get both line traversal and intrusion detection to work, and what is more, now it is possible to search the log. My assumption that the log needed external storage to work was therefore correct. I'm a bit annoyed by this, because it just seems easier to have all this centralized in Surveillance Station, instead of having to scrub each camera for events. I guess the real solution is to move everything to a dedicated computer or NVR, running some other software (like Milestone or something).

On mine the log is empty, even if motion events have been triggered. I suspect this is because I don't use NFS/FTP, it just alerts Surveillance Station to make a recording.

I'm on the latest/new 5.1.6 build, and I have tried resetting the config (except user and ip info). To use intrusion detection and line traversal, should the normal/regular motion detection be enabled or disabled? Does the "Dynamic analysis for motion" work, so that you can see when the above mentioned features are triggered? It could be that those features does not want to send the events to Surveillance Station (even though regular motion detection does), and that I'd have to do a NFS setup to get it working, but that would be a bit annoying.

I've updated my cameras to the new 5.1.6, and I tried getting some of the new features to work, but to no avail. I am using Surveillance Station on a NAS as the recording device, and I can set up motion detection (using expert mode) in the cameras. When the cameras detect motion, they'll signal SS to start recording, which does work. However, it looks to me like the new intrusion detection and line traversal options (but according to the release notes, these are mutually exclusive) could be a better fit for my needs, but I was unable to get any of those to work. Are there any special tricks needed to get this working? I think I've tried most combinations of options, but no dice.

I saw him around here somewhere. He looks a bit tired from lack of sleep though This 5.1.6 is different than the old 5.1.6. I'm not sure how though. Some release notes /change logs would be nice On the US FTP there is now a pdf document containing the release notes for the "new" 5.1.6.

ftp://ftp.hikvisionusa.com/ User: hikfirmware Pass: Hikvision123

I have also updated my three Chinese cameras (region-changed by CBX) from the web-interface, no problems. I haven't tried any of the new features though, so all I can vouch for is that the actual update was flawless.

I haven't tried 5.1.6, but I am using my cameras (older firmware) with Surveillance Station, and motion detection by the cameras, which is working (but it is difficult to avoid a lot of false detections if you also want to catch real action). I think you need to verify if regular motion detection works first, and if it does, the more advanced detection features *should* also work, since then you know that the cameras are able to signal to Surveillance Station that a recording should be made.

That looks like the output from some third-party patching software, and it is definitely not something Hikvision has put in there. I'd wager a guess that it has been put on there by some Chinese supplier to convert/patch the camera to appear English. Whether uploading the patched davinci file to this camera will work or not, I can't say.

You'll not brick your camera if you try to update it from the web interface. If you use the English 5.1.6 version, and the camera is Chinese, you'll get a message saying something like "language mismatch". You could also try to turn on the day of week in the OSD settings. If the camera is Chinese, you'll get the name of the day in Chinese letters in the text overlay.

The higher average load might be the reason, but at the same time it would be expected due to the added functionality. In other words, if that's why they pulled it, I'd say they didn't do their homework properly in the first place. However, if it has no other negative impact, then it should be OK to use this version. What is the forum consensus on this?

Hasn't this version been pulled? It doesn't seem to be available on any of the official Hikvision sites?

Very nice writeup, buellwinkle! While not being too difficult, it would have been even better if we could change the actual embedded camera region from Chinese to English. I'm fairly certain that CBX, given his extensive digging into these things, could figure out how to do that, but there is of course a risk of permanent bricking. Perhaps we could do a small crowdfunding to get him a camera to experiment with? I'd be willing to throw in some money for this, provided that he'd be willing to try, of course.

I wouldn't say that the writeup was wasted, but I guess that actually performing all these operations is too involved and difficult for most people. Personally, I haven't bothered, at least not yet. One of the reasons is that the procedure will have to be repeated for each new version of the firmware, and it might (probably) also be different for a new version. That means someone will have to figure out how to patch each new version, and you haven't really documented what you did to find out how to do the patch. In other words, if people apply the current patch, they will depend on you (or someone else with enough time and knowledge) to publish a new patch in order to keep the functionality. That's why it would be vastly better if it was possible to patch the relevant locations in the flash instead, since you'd (at least in theory) have to apply the patch only once.