CBX

Hi all Edit: try this tool - https://www.cctvforum.com/hikvision-password-reset/ I've been playing with the mechanism by which you can reset your password to the default if you get locked out. Apparently Hikvision provide a free service by which you can email them with your serial number, and they will respond with a secure code you can use with a tool to reset remotely. I've figured out a way to send this code remotely using the command line. Or you can use a tool on the camera via telnet, though of course if you have access to telnet you probably don't need the password resetting: # resetPasswd Device Serial No.:DS-2CD2732F-IS20121226CCCH546641810 Current Date :20140223 # resetPasswd xxxxxxxxxx Invalid secure code. # resetPasswd Re9rSR9rzd Default password of 'admin' restored. This code is date dependant and the camera will accept the code for today or yesterday. I've written my own secure code generator just for fun though I can only test with my 2 cameras. Example generating codes for next 4 days, and sending todays remotely using the command line: root@rl70:~# for DATE in 20140222 20140223 20140224 20140225; do ./gen_hik_secure_code.php --serial=DS-2CD2732F-IS20121226CCCH546641810"$DATE" done Serial is: DS-2CD2732F-IS20121226CCCH54664181020140222 Secure Code = Re9rSR9rzd Serial is: DS-2CD2732F-IS20121226CCCH54664181020140223 Secure Code = qee9zdzdRe Serial is: DS-2CD2732F-IS20121226CCCH54664181020140224 Secure Code = SrzqzqRzqd Serial is: DS-2CD2732F-IS20121226CCCH54664181020140225 Secure Code = zrqzrRSdz root@rl70:~# echo -n -e '\x00\x00\x00\x1a\x00\x00\x00\x13\x00\x00\x00\x02\x00\x00\x00\x0e'qee9zdzdRe | nc 192.168.0.201 7001 Default password of 'admin' restored. As far as I know, you can't do this with access to port 80 only so this shouldn't be a risk of people gaining access remotely unless they have access to port 7001 and others of your camera which I wouldn't advise. I won't be publishing my secure code generator as this would be irresponsible, but I thought it would be interesting to explore to understand the security aspects of the camera better.

Hi all I've been playing with my Hikvisions cameras to get them to do what I need, but found it more fun than I expected so I have continued to look into different aspects. Up till now I've been making a different thread for each investigation, but it might make more sense to just have one and not deluge everyone with threads they likely have no interest it This is primarily for my reference as it's helpful to remember what I've done. Chinese day of week patch: viewtopic.php?f=19&t=39693 How to put camera in debug mode & How to enable FTP: viewtopic.php?f=19&t=39417 Hikvision secure code: viewtopic.php?f=19&t=39846 I know people want a permemant fix for the chinese day of week issue. I modify my cameras anyway so I've no need for this, but if you are interested the locations I think the language flag is set are detailed in this thread: viewtopic.php?f=19&t=39646 If no one minds, I'll just post new things here rather than new thread each time, unless it seems particularly called for. As far as I know you can't edit posts after a certain time, so I can't update this post with new info, so will just be added to the end

Hi All Been doing some work on creating custom firmware for my Hikvision cameras, and have to say though hard it was pretty interesting and rewarding. But then I like that sort of thing cos I'm a geek with no life (or job) I'm sure Hikvision don't want me spreading around the tech details of this and I will respect their point of view, and would likely not be acceptable on here anyway. But suffice to say cameras now running custom firmware rather than manually copying file patches which is fine for a few cameras, probably not if you got 100! lol Anyway, just to let you know it is possible and if anyone wants to discuss custom digicap.dav with me, feel free to PM me. Languages, custom logos/contact info on web interface, network monitoring agents, ssh on cam etc etc etc. That's the great thing about linux embedded systems - can pretty much do what you want if you try! Sorry technical notes been quiet recently - been reverse engineering firmware on my AVR for custom firmware on that too but now done so maybe do a bit more Hik stuff soon. Cheers all

Hi All Looks like 5.2.0 has hit the FTP site. ftp://ftp.hikvisionusa.com/ Obvious changes include: - Multi languages are back (if the camera is EN region)! - Platform access support (EZVIZ Cloud P2P) - SSH daemon - No face detection - "Dual-VCA which can be used cooperatively with NVR to implement dual-VCA retrieval during playback" There's probably others - these are what I noticed. Also I would like to confirm tested with my region change solution and no problems observed, either for people who changed before 5.2.0 or whilst 5.2.0 is loaded.

Yes.

I would not recommend putting any version less than 5.2.5 on a camera that has a label stating it left the factory with 5.2.5. This is the case even if the camera is supplied with a version less than 5.2.5 I'm not able to provide further information regarding this so feel free to ignore my advice if you wish.

Hi there As I've already previously indicated, my region change solution is fully compatible with 5.2.5. Any issue feel free to PM or email me. Edit: I've never bricked anyone's camera nor heard of a problem after an upgrade. I'm not sure if you were implying that that was the case but I can confirm that has not happened.

Maybe I'm just a retard but search doesn't show up much with keywords like hikivision nas 5.2 uninitialized. I'm not really sure wether the cbx fix is for people with chinese region cameras or if it's supposed to fix the nas issue. And downloading the file with no ftp access on the 5.2 firmware is that possible. Anyhow any nudge in the right direction would be awesome! Josh Hi there No it's permanent device region change I provide - NAS patches for various firmware versions are a completely different issue which I don't provide (the support I'd have to give would be a total nightmare ). Though in my experience if the NAS share is on it's own hard disk partition on the server (and there's nothing else on the partition) then everything is fine.

Salut friends. Raptor 2xxx 5.2.3 on our favourite Hikvision FTP site. ftp://ftp.hikvisionusa.com/Hikvision_IP_Camera_Firmware/Raptor_2xxx_Series/DS-2CD24x2&25x2_WiFi_Camera_Firmware_v5.2.3_141024.zip Labelled for Wifi only it works fine on my 2032 and 2732 OK. Obvious changes are: - prompted to change default password at login - Moved some functions to "Smart Event" menu - No extra languages There's probably others and I would invite anyone to post them if discovered. Seems minor update, but of course no change log (except the file that is contained in the .zip file which refers to 5.2.0 anyway) so who knows. For people who have used my region change solution I can verify all tested OK on my cameras for 5.2.3. Any issues of course let me know.

Yes I didn't include that because it doesn't refer to 5.2.3 (though of course they may have just typo'd).

By all means PM me and we can take it from there.

I am unemployed I just help people with IPC/DVR/NVR now Thanks for your kind words.

Having reviewed the firmware binary code of this model, and extensive code analysis in order to implement PTZ, I can confirm MindTwist is correct. Earthquakes may produce some movement, though of course it is hard to predict. If you wish to purchase my Earthquake prediction product please get in touch.

iTuneDVR!

My region change program would resolve this, and change the camera region from Chinese to International (which includes the day of the week issue on the OSD). PM me if you wish to discuss purchasing it.

Hola folks New firmware for DS-2CD24x2&25x2 WiFi Cameras on the FTP site. Don't have one of these cameras, but having looked in the code I can't see any reason why this would have any issues with my Chinese to International region change program.

If the bootloader is working then yes. But I wouldn't worry about that part yet. 1) Try network options 2) See what you get from the UART if 1 fails Then go from there.

You could listen to the network with Wireshark just to see if there's anything at all from it when it starts. Or if you have a managed swtich you could have a look at the port info. I've only ever connected to a 2732's UART - can't remember the pinout but a multimeter is handy Good luck!

I don't think Hikvision or Dahua products are vulnerable, as they use busybox. That's only what I've read, I've not done any code analysis.

Hi all Got a 2732 from China last week, and of course the day of the week OSD is in chinese (or similar). I know you can just turn off day of the week, but then it doesn't match my other non imported camera, and I am awkward So I did some inestigation and figured out why this was, were it was set and how to correct matters so my imported cam now shows days in English Is there any interest in this? It does involve changing a few bytes of a file on the camera.

Hi there Yes an executable that runs on the camera - so shouldn't matter what OS you have on your computer.

Haha my friend - you know there are too many cameras to sit still for too long

Hi there I don't know if permanent region change is something you are interested in or the solution that best fits your needs - but your class of camera is in the list below - and I am able to provide a solution to change it from a Chinese region camera to a EU/US camera if you decide that's what you want: DS-2CD7133-E DS-2CD7153-E DS-2CD7164-E DS-2CD7233F-E DS-2CD7253F-E DS-2CD7254F-E DS-2CD7254FWD-E DS-2CD7255F-E DS-2CD7263NF-E DS-2CD7263PF-E DS-2CD7264F-E DS-2CD7264FWD-E DS-2CD7283F-E DS-2CD7293NF-E DS-2CD7293NFWD-E DS-2CD7293PF-E DS-2CD7293PFWD-E DS-2CD733F-E DS-2CD7353F-E DS-2CD7393NF-E DS-2CD7393NFWD-E DS-2CD7393PF-E DS-2CD7393PFWD-E DS-2CD753F-E DS-2CD754F-E DS-2CD754FWD-E DS-2CD755F-E DS-2CD763NF-E DS-2CD763PF-E DS-2CD764F-E DS-2CD764FWD-E DS-2CD783F-E DS-2CD793NF-E DS-2CD793NFWD-E DS-2CD793PF-E DS-2CD793PFWD-E DS-2CD8133F-E DS-2CD8133F-EW DS-2CD8153F-E DS-2CD8153F-EW DS-2CD8233F-E DS-2CD8253F-E DS-2CD8254F-E DS-2CD8254FWD-E DS-2CD8255F-E DS-2CD8264F-E DS-2CD8264FWD-E DS-2CD8283F-E DS-2CD833-EI3 DS-2CD833F-E DS-2CD833F-EW DS-2CD8433F-E DS-2CD8453F-E DS-2CD8464F-E DS-2CD853F-E DS-2CD853F-EW DS-2CD854F-E DS-2CD854FWD-E DS-2CD855-EI3 DS-2CD855F-E DS-2CD863NF-E DS-2CD863NF-EW DS-2CD863PF-E DS-2CD863PF-EW DS-2CD864-EI3 DS-2CD864F-E DS-2CD864FWD-E DS-2CD883F-E DS-2CD893NF-E DS-2CD893NF-EW DS-2CD893NFWD-E DS-2CD893NFWD-EW DS-2CD893PF-E DS-2CD893PF-EW DS-2CD893PFWD-E DS-2CD893PFWD-EW

Hello everyone Understandably there's some dissatisfaction due to the manufacturer removing or downgrading some features of 5.2.0 - and not even documenting them. Worse, you can't even go back to an earlier version if you want to (though TFTP works for now). This is for Raptor Series 2 only (e.g. 2032, 2112, 2632, 2712, 2732 etc etc). Given that I've helped some people change the region of their cameras from Chinese to EU/US I felt I should do something about this. For this reason I have developed a patch to: - Increase Traversal Lines from 1 back to 4 - Increase Intrusion Detection zones from 1 back to 4 - Reinstatement of FTP server I have decided not to reinstate face detection as you can't use it at the same time with the generally more useful Traversal Lines & Intrusion Detection. To say thank you to those who have bought my region changer, I have decided not to put a mandatory charge on this. However, as an unemployed person (just think of me in a cardboard box with a hat asking for spare change) any donations won't be turned down GBP are better for me than USD due to PayPal fees. Here's an FAQ: What about feature X,Y,Z? Sorry - these are the main ones causing most concern so I do not expect to resolve others unless there is a real general need. Can't you provide 8 instead of 4 detection lines/zones? Yes but I'm not going to. To play fair by the manufacturer, I will only consider reinstating functionality they themselves provided in previous firmware. People have bought cameras based upon what was provided so it is justifiable to put this back - enabling other features would be crossing the line in my view. Nothing in what I provide contains manufacturer code, nor breaks any license agreements nor laws that exist in my country to the best of my knowledge. So we get FTP server back? Yes. You still need to enable with setFtpService start I haven't bought your region changer - I already had a EU/US region camera You can PM me if you wish to discuss me providing this to you. What is the difference between this and your region changer? A lot of difference. The region changer is a permanent region change and has nothing to do with what firmware is loaded or put on in future. I provide full support for this, and try to do so quickly. The 5.2.0 solution is a patch. That means if you change your firmware, or even reflash with original 5.2.0 it will not be preserved. That's not a problem - just something to be aware of. Also, support for this is much lower priority for me - I might not respond instantly like I try to for the region change program. If there's much demand, I might generate the needed files (everyone is different) in batches and send out every few days or so. I and an early adopter (thanks!) have done some testing and it all looks good. But the real test is people using it. Any problems just go back to the original 5.2.0 How do I put this patch on? I've come up with a way to provide you patched firmware that you can just upload via the web interface. I do not provide the original firmware due to copyright issues (the manufacturer owns it not me) - you download that yourself from them first. But I can provide a small file that contains my code and a batch file that uses the original firmware + my changes to create your own custom firmware. It isn't hard. Great - how do I get it? Please email me your serial numbers, preferably replying to the email I already sent you with the region change program. As always you agree not to share this, and keep our communications confidential. Cheers CBX

Hi Don Yep - totally fair enough and completely sensible points. I would like to make it clear that I have always indicated the manufacturer could take action if they wanted to. Here's an excerpt from the FAQ