Hikvision Chinese day of week fix question

[CBX 0]

Hi all

 

Got a 2732 from China last week, and of course the day of the week OSD is in chinese (or similar).

 

I know you can just turn off day of the week, but then it doesn't match my other non imported camera, and I am awkward

 

So I did some inestigation and figured out why this was, were it was set and how to correct matters so my imported cam now shows days in English

 

Is there any interest in this? It does involve changing a few bytes of a file on the camera.

Edited February 13, 2014 by Guest

[Lapheus 0]

Is there any interest in this? It does involve changing a few bytes of a file on the camera.

 

Hello CBX,

 

Yes, I'm intersted in other languages.

Perhaps it is possible to set up German, but if you change some bytes it will not be possible.

 

Thank you.

[buellwinkle 0]

Please share, we would be forever grateful. Also, does this fix allow you install English firmware via the web browser interface?

[steuk 0]

If hikvision cameras are based on Linux/Unix and accessible through Telnet or SSH, then I guess it's only a small text file on the system in which are written all days.

 

Therefore I don't think it's related to the possibility to install English firmware, but maybe there is an other file that contains options like enabling (or not) english firmware.

 

If my cameras were already shipped I would have checked by myself

[buellwinkle 0]

Just telnet into the camera, standard telnet port, use your admin/12345 default password, just Linux.

 

BTW, it's the same firmware, just does a language flag comparison when you use the browser interface to do a firmware update. You can use TFTP to load English firmware on China cameras but date is still in Chinese.

[steuk 0]

Ok, so it means that changing from chinese to english firmware doesn't modify the "day file".

 

We now only need to know the "day file" name

[CBX 0]

Ok, so it means that changing from chinese to english firmware doesn't modify the "day file".

 

We now only need to know the "day file" name

 

It's not that simple. Everything is contained in a large binary file which has both English and Chinese day names contained within it along with everything else needed to control the camera.

 

Also, you don't need to wait to look at the filesystem or the davinci binary (in the /dav folder). You can download the firmware and extract it if you want to play before your cams arrive (I did).

 

buellwinkle: No, this is unlikely to permit flashing different zone firmware, but there is no point in doing this anyway as they are all the same.

 

Lapheus: As far as I know German is not in the davinci binary, but you could overwrite the English day of week array string with a hex editor. There are a few strings - you'll have to do a bit of testing to find out which one you need to change.

 

 

Doing other camera dev at the moment - will post day of week changes once done a bit more testing.

[pcmcg 0]

I don't know how the firmware and/or memory hardware on these cameras are setup, but it is entirely possible that there are values in the memory programmed that cannot be changed. There are places in some flash memory called OTP bits, which stand for "one time programmable". If Hikvisionis using these areas to set the language, then there is no possibility to change the value.

 

The only option would be to modify the firmware binary before uploading it to avoid these checks.

[CBX 0]

I don't know how the firmware and/or memory hardware on these cameras are setup, but it is entirely possible that there are values in the memory programmed that cannot be changed. There are places in some flash memory called OTP bits, which stand for "one time programmable". If Hikvisionis using these areas to set the language, then there is no possibility to change the value.

 

The only option would be to modify the firmware binary before uploading it to avoid these checks.

 

I've not seen any evidance that OTP flash areas would be present, particularly as there is no real device security to speak of. You don't need to change the firmware before flashing, just the davinci binary on the file system.

 

I could change the language values in the flash, but for all I know there are checksums which need to be changed and I would prefer to simply change a binary than risk bricking the camera.

[drocer 0]

If hikvision cameras are based on Linux/Unix and accessible through Telnet or SSH, then I guess it's only a small text file on the system in which are written all days.

 

Therefore I don't think it's related to the possibility to install English firmware, but maybe there is an other file that contains options like enabling (or not) english firmware.

 

If my cameras were already shipped I would have checked by myself

 

Why don't you all attempt to enforce GPL licensing on hikvision USA? I can't find any mention of of GPL at hikvision. I refuse to believe that there aren't any violations from their cameras, dvrs, and nvrs. You will have to get the original author to submit the request (http://gpl-violations.org/).

 

Look at what happened for the home router market once GPL was enforced on Cisco for the Linksys WRT54G. DDWRT came from it and now firmware can be custom made. Took a few years for other models though...

[CBX 0]

I've already made a request:

 

Date: Tue, 14 Jan 2014 16:31:49 +0000

From:

To: @hikvision.com>

Subject: GPL request

 

 

Oh one other thing

 

I understand that under the terms of the GPL license for the linux

kernel you use on the 2032 (5.1 raptor), Hikvision is legally obliged to

provide the kernel source to an owner of the product. (see

http://gpl-violations.org/gpl.html for the license).

 

How do I make a GPL request for the kernel source?

 

Thanks!

 

 

Date: Thu, 16 Jan 2014 10:52:48 +0000

From:

To: @hikvision.com>

Subject: Re: GPL request

 

 

Hi

 

Sorry you were sick - I hope you are feeling better now.

 

Please allow me to explain.

 

Hikvision uses linux software on it's camera products as the operating

system. In the case of the Raptor cameras like mine (2032), the

following Linux version is used:

 

Linux version 2.6.38.8 (wangqian@ipcteam2) (gcc version 4.6.1 (Sourcery

CodeBench Lite 2011.09-70) )

 

Linux is licnesed under GNU GPL version 2 - the text of which is here

https://www.kernel.org/pub/linux/kernel/COPYING

Hikvision agreed to the terms of that license when it used linux on it's

products.

 

This means any company in the world which uses linux on it's products is

legally obliged to provide the source code used to build the linux

kernel when requested by a customer. For example, I have a Samsung

Television which runs linux, and Samsung have to provide the kernel

source code when asked. People can download it from here

http://opensource.samsung.com (click on TV then model number).

 

A good FAQ on the subject is here:

http://www.gnu.org/licenses/gpl-faq.html#GPLRequireSourcePostedPublic

 

Does the GPL require that source code of modified versions be posted to

the public? (#GPLRequireSourcePostedPublic

<http://www.gnu.org/licenses/gpl-faq.html#GPLRequireSourcePostedPublic>)

 

The GPL does not require you to release your modified version, or

any part of it. You are free to make modifications and use them

privately, without ever releasing them. This applies to

organizations (including companies), too; an organization can make a

modified version and use it internally without ever releasing it

outside the organization.

 

_*But *__*/if/*__*you release the modified version to the public in

some way, the GPL requires you to make the modified source code

available to the program's users, under the GPL.*_

 

Thus, the GPL gives permission to release the modified program in

certain ways, and not in other ways; but the decision of whether to

release it is up to you.

 

 

 

Please note that I am talking about the opensource Linux kernel source

code. I am *not *requesting source code owned by Hikvision, such as the

source code for /home/davinci - that code is the property of Hikvision

and Hikvision would likely refuse to release that.

 

Having the source used to build the Linux kernel allows customers to

create programs for the that product.

 

If Hikvision doesn't make the Linux source code available, then it is

not permitted to use Linux on it's products.

 

I hope this makes sense - please come back to me if it doesn't.

 

Thanks again for all your help.

 

 

On 16/01/2014 02:39, wrote:

>

> Hi ,

>

> Sorry for the late reply as I was sick yesterday.

>

> Sorry for my poor knowledge, but to be honest with you, I haven't

> known this as far as you mentioned, however, would you mind to let me

> know more details about what exactly you want to do with this "GPL"

> and how I can help, so that I can try my best to investigate if it

> will be possible?

>

> Best regards,

>

> **

>

> **

>

> * / *UK&Ireland Technical Consultant

>

> */HIK/**/VISION/**//**/Europe B.V./*

 

Had some email exchanges but not got anywhere yet. By all means others make a GPL request (mine was via Hikvision EU)

 

Though a GPL request won't provide the source to the main camera binary davinci anyway.

 

But I have a solution I'll post soon - I reversed the binary to fix the days of the week language issue.

[buellwinkle 0]

Do you think that China will enforce a GPL license violation? Also, you don't know if they are paying royalties or not. I worked for a software company that used the GPL license and basically you have two options, make you code GPL or pay a royalty. Again, we are talking China, not Cisco in San jose.

[tomcctv 190]

Seems like a lot of work for nothing.

 

Also ..... How would the camera stand up to electronic signature or watermark.

 

No point if they show up as tamper.

[CBX 0]

Seems like a lot of work for nothing.

 

Also ..... How would the camera stand up to electronic signature or watermark.

 

No point if they show up as tamper.

 

Not sure what you mean about a lot of work - do you mean me sending 2 emails to them or the day of the week issue? If the latter I've already resolved that without the kernel source. I posted the emails I sent as someone suggested a GPL request which I'd already done.

 

I was primiarily interested in the kernel source as I wanted to turn my 2732 into a NAS server for my 2032 so they can record to the same SD card (the 2032 doesn't have an SD card slot), and I don't need to have a power hungry NAS/PC server with hard disk on all the time. Just to 2 cameras and the switch is all that is needed. That means I needed to compile kernel modules etc. As it turned out I managed to do by getting another Ambarella 2.6.8 linux kernel source released by a company of a different product who actually do abide by GPL V2 conditions. The point is they should release the linux kernel sources upon request.

 

Whether in China or no they accepted the license conditions by putting linux on their products. They should abide by that license irrespective of any enforcement issues. It should be noted that they have companies in other legal jurisdictions such as EU and US.

 

They haven't refused as of yet, but not yet provided them so we'll see.

[Securame 0]

This is geting interesting...

[Q2U 0]

[steuk 0]

Days are stored in a binary file...so bad, that's definitely not the way Linux is meant to be.

[CBX 0]

Days are stored in a binary file...so bad, that's definitely not the way Linux is meant to be.

 

It's the way Linux is anyway - on my Ubuntu server:

 

root@rl70:~# uname -v
#41-Ubuntu SMP Thu Jun 14 16:45:14 UTC 2012
root@rl70:~# strings `which date` | grep DAY
SUNDAY
MONDAY
TUESDAY
WEDNESDAY
THURSDAY
FRIDAY
SATURDAY
YESTERDAY
TODAY

 

Though of course a proper Linux installation will have options to change languages/codepages etc.

 

And on embedded systems things tend to get compiled together into as fewer files as possible to improve performance.

[steuk 0]

I was thinking of the day as a web parameter not as the output of "date" binary.

In linux parameters (web or not) are usually stored in text files, not in binaries.

 

But you're right about "date"

 

And on embedded systems things tend to get compiled together into as fewer files as possible to improve performance.

 

Yes (often) and no (sometimes), some langages (script langages - no compilation) are really performants and are used a lot (Python for example).

[CBX 0]

For reference it looks like the language flag is set in mtd5 (though it may be other locations also).

 

Could a few people run this on their cameras and confirm the output matches their camera language please?

 

VAR=`dd if=/dev/mtd5ro skip=1620 bs=1 count=1 2>/dev/null` ; if [ $VAR == $'\002' ]; then echo Chinese ; elif [ $VAR == $'\001' ]; then echo English ; else echo Unknown; fi

 

Assuming all is as expected I'll post the needed change to the davinci binary.

[mroek 0]

For reference it looks like the language flag is set as below.

 

Could a few people run this on there cameras and confirm the output is accurate?

 

VAR=`dd if=/dev/mtd5ro skip=1620 bs=1 count=1 2>/dev/null` ; if [ $VAR == $'\002' ]; then echo Chinese ; elif [ $VAR == $'\001' ]; then echo English ; else echo Unknown; fi

Appears to be accurate on my Chinese cameras, at least.

 

I also did some digging into this at some point:

 

viewtopic.php?f=19&t=37430&p=229583&hilit=chinese#p229583

 

As you can see, the command prtHardInfo outputs the same language value that you found on mtd5ro, and I'd be surprised if prtHardInfo doesn't actually just present the info from this partition in a human-readable format. In other words, it probably takes the language value from the exact same location that you found.

[CBX 0]

Interesting - never read that thread Good to hear this patch is actually wanted by people (though I did it for my own amusement more than anything).

 

prtHardInfo actually only connects to the davinci binary on port 7001 and runs a command. This is like what setDebug does also and is indicative of how davinci does everything.

 

connect(3, {sa_family=AF_INET, sin_port=htons(7001), sin_addr=inet_addr("127.0.0.1")}, 16) = 0
write(3, "\0\0\0\f\0\0\0\0\0\0\0\0", 12) = 12
recv(3, "Start at 2014-02-12 12:38:55\nSer"..., 4096, 0) = 363

 

On my Chinese 2732 camera, reading mtd5 gives:

 

# VAR=`dd if=/dev/mtd5ro skip=1620 bs=1 count=1 2>/dev/null` ; if [ $VAR == $'\002' ]; then echo Chinese ; elif [ $VAR == $'\001' ]; then echo English ; else echo Unknown; fi
Chinese

 

i.e. language code 2

 

Whereas my patched davinci binary responds with a language code of 1 when queried by prtHardInfo:

 

# prtHardInfo
Start at 2014-02-12 20:15:41
Serial NO :<removed>
V5.1.0 build 131202
hardwareVersion = 0x0
hardWareExtVersion      = 0x0
encodeChans             = 1
decodeChans             = 1
alarmInNums             = 1
alarmOutNums            = 1
ataCtrlNums             = 0
flashChipNums           = 0
ramSize                 = 0x4000000
networksNums            = 1
language                        = 1
devType                 = 38926
SD status                       = -1 (0:noraml;none-0:timeout)

 

Funny how they've spelt normal

 

Anyway, that's a posivitive sign that the code change I made in davinci is correct, if it's responding to Hikvision's own tools that the language code is English rather than the actual Chinese flag in the flash.

[mroek 0]

I'm curious, have you actually disassembled any of the binaries, given that you present what looks like C source code for the calls performed by prtHardInfo?

 

While patching the davinci binary is probably a fully useable solution, it would be even more interesting to modify the actual language code in the flash, if that would permanently transform a Chinese camera to a European/US counterpart. That would then also allow for using the firmware updates posted to the US/European sites directly from the web interface.

 

Their spelling isn't the best, but trust me, they're far better than many other Chinese manufacturers.

[CBX 0]

I've debugged the binary while it is running on the camera. Unfortunately that mostly means dealing with raw ASM rather than nice C

 

The output I posted is from strace. I'm currently playing with sending the camera different commands to see whats possible.

 

root@rl70:/tmp#  echo -n -e '\x00\x00\x00\x0c\x00\x00\x00\x00\x00\x00\x00\x00'  | nc 192.168.0.202 7001

Start at 2014-02-12 21:08:08
Serial NO :<removed>
V5.1.0 build 131202
hardwareVersion = 0x0
hardWareExtVersion      = 0x0
..snip

root@rl70:/tmp# echo -n -e '\x00\x00\x00\x0c\x00\x00\x00\x0c\x00\x00\x00\x00'  | nc 192.168.0.202 7001
Interface  : eth0
IP address : 192.168.0.202
Subnet mask: 255.255.255.0
IPv6 address: <removed>
IPv6 Subnet mask: ffff:ffff:ffff:ffff::

 

Just to see what is possible outside of the commands already in the /bin partition. I'm curious

 

Yes, it would be better to change the language flag in the flash, and the commands for doing so are already on the camera. Then no need to change davinci.

 

But I won't be doing that as I don't know what the ramifications are. To anyone that wants to try I would advise you nanddump all mtds to a server first and have access to the bootloader via UART just in case.

 

As you can see from the command I posted the language flag looks to be at 0x0654 in /dev/mtd5. Overwriting it with 0x01 may work, not work or brick your camera.

 

I'll stick with my davinci change as that won't kill that camera

[drocer 0]

Do you think that China will enforce a GPL license violation? Also, you don't know if they are paying royalties or not. I worked for a software company that used the GPL license and basically you have two options, make you code GPL or pay a royalty. Again, we are talking China, not Cisco in San jose.

 

Hikvision USA and Hikvision EU would be the targets. Yes, Hikvision China makes them but they have to get approved to be imported for the USA/EU companies to sell them. That would include the unbranded no-names too.

 

AFAIK, they can ignore the GPL requests until the author of the code requests it or someone on acting on their behalf.