[PATCH] Hikvision Chinese day of week

[CBX 0]

Hi All

 

You may be aware that imported Hikvision cameras show the day of the week in a non English language that I am going to refer to as Chinese (though I know that is not it's proper name).

 

For some this doesn't matter, just ignore the sqiggles, or turn off day of the week. For me and some others, we would prefer everything in English.

 

There is a language flag set at least once in the flash which is not changed by firmware updates.

 

You can see which yours is set to with this command:

 

VAR=`dd if=/dev/mtd5ro skip=1620 bs=1 count=1 2>/dev/null` ; if [ $VAR == $'\002' ]; then echo Chinese ; elif [ $VAR == $'\001' ]; then echo English ; else echo Unknown; fi

 

Changing the flash is optimal, but dangerous. Therefore, I've made a patch to the 5.1 davinci program that does all the cameras functions, and doesn't present this risk.

 

This might work on < 5.1 firmware, but I've not tested this.

 

I ACCEPT NO RESPONSIBILITY FOR THE CONSEQUENCES OF YOU APPLYING THIS CHANGE WHICH YOU DO AT YOUR OWN RISK. IF YOU BREAK YOUR CAMERA, YOUR CROPS FAIL TO GROW OR YOUR CAMERA ROBOTICALLY TRANSFORMS INTO A DECEPTICON AND TAKES OVER THE WORLD DO NOT BLAME ME.

 

Right, firstly you need to get your davinci binary off your camera. You can do this via FTP, CIFS, NFS, SD card etc. I'll use NFS.

 

Telnet into your camera (enable first if needed).

 

# cp /dav/davinci.tar.gz /mnt/nfs00

 

I would recommend keep this original just in case. Open the file and extract davinci (on Windows winrar would work).

 

root@rl70:~# mv davinci.tar.gz davinci.tar.gz.original
root@rl70:~# tar zvfx davinci.tar.gz.original
davinci
root@rl70:~# md5sum davinci
22ebe5d2eb30af43d030122138ee2f5f  davinci

 

Use a hex editor (e.g. HxD) to search for the following bytes in davinci.

 

8a 30 dd e5 38 a0 9d e5 53 90 c4 e5 14 90 9d e5

 

There should only be one match at 0x001738b0.

 

Change 38 a0 9d e5 to 01 a0 a0 e3

 

8a 30 dd e5 01 a0 a0 e3 53 90 c4 e5 14 90 9d e5

 

Save. You can verify the md5sum matches the below if you want to be sure you made the change correctly.

 

root@rl70:# md5sum davinci
e3b54d9de5ce40edfcf47f998935e541  davinci

 

Create new davinci.tar.gz (keep the original)

 

root@rl70:/# tar -c davinci | gzip > davinci.tar.gz 

 

You should get a file around 4.4Mb bytes in size. It's worth checking this, and that it contains a 9.9Mb davinci file because if you've messed up you will stop your camera booting and will need to recover using TFTP.

 

Once you are sure all is well, overwrite /dav/davinci.tar.gz on your camera with this new davinci.tar.gz.

 

Reboot !

 

Please post how you get on, and if all well an OK or similar even if others have already done this. Be interesting to see how many people actually use this patch.

 

NOTE

 

Hikvision could if they wanted block this in future firmware updates, or even detect this change (though you could replace the original davinci.tar.gz before upgrading). I doubt they will care but what do I know.

[Heuer 0]

Am I correct in thinking this is a 'cosmetic' change and will not overcome the issue of upgrading the Chinese camera with EU/US firmware via the browser?

[CBX 0]

Am I correct in thinking this is a 'cosmetic' change and will not overcome the issue of upgrading the Chinese camera with EU/US firmware via the browser?

 

Haven't tested that as it wasn'y my goal - doubt it. But it's worth noting that the EU, US and Chinese firmware are all identical so there's no compelling reason to flash with a different version.

[mroek 0]

Am I correct in thinking this is a 'cosmetic' change and will not overcome the issue of upgrading the Chinese camera with EU/US firmware via the browser?

 

Haven't tested that as it wasn'y my goal - doubt it. But it's worth noting that the EU, US and Chinese firmware are all identical so there's no compelling reason to flash with a different version.

No, they aren't identical, per se. There is a language indicator also in the firmware file, which will prevent flashing a different version through the web interface. TFTP-flashing still works, although slightly more cumbersome.

 

That's why it would be even better if the language indicator location(s) in the flash could be changed permanently. I'm quite sure this is fully possible, but experimenting with it is obviously risky.

[CBX 0]

Sorry for not being clear before. Yes the filename, time stamp and language flag in the firmware files are different, and they are hosted in different places. But the content of the firmware (filesystems etc) are identical, and offer no advantage over another.

 

Thus there is no reason to flash different versions because the are not different in any meaningful way - at least not unless Hikvision start to release different software for the different language zones.

[CBX 0]

Has this patch actually been used by anyone? If not I wasted a load of time writing all that up!

[mroek 0]

I wouldn't say that the writeup was wasted, but I guess that actually performing all these operations is too involved and difficult for most people. Personally, I haven't bothered, at least not yet. One of the reasons is that the procedure will have to be repeated for each new version of the firmware, and it might (probably) also be different for a new version. That means someone will have to figure out how to patch each new version, and you haven't really documented what you did to find out how to do the patch. In other words, if people apply the current patch, they will depend on you (or someone else with enough time and knowledge) to publish a new patch in order to keep the functionality.

 

That's why it would be vastly better if it was possible to patch the relevant locations in the flash instead, since you'd (at least in theory) have to apply the patch only once.

[MaxIcon 0]

I'll add that there's a relatively small group here interested in the low-level technical details like this, and the write-up definitely was not a waste for those who want to understand this better.

 

Most people may not want or need it, but having it documented is a good thing.

[CBX 0]

Due to the mounting number of patches I've applied to the davinci binary (to make it NAS server for other cameras, SD card improvements, NFS enhancements etc), I've changed to a patch in memory solution for each patch which might be easier for people.

 

# Day of week patch
for HEX in 01 a0 a0 e3; do
 echo -n -e \\x$HEX
done | dd of=/home/davinci seek=1521844 bs=1 conv=notrunc

 

This needs to be added in a script called from /dav/initrun.sh, or in /dav/initrun.sh itself near the bottom.

 

When I make changes, I like to add in a safety window where the change won't take effect if the code is being run at 50 -59 secs past the minute. That way if you stop the camera booting you just have to power it on at the right time to get back in, rather than resorting to TFTP recovery.

 

Direct example using safety window (excerpt bottom of /dav/initrun.sh):

 

# Day of week patch
[ `date +%S` -lt 50 ] && {
for HEX in 01 a0 a0 e3; do
 echo -n -e \\x$HEX
done | dd of=/home/davinci seek=1521844 bs=1 conv=notrunc
}
# End of patch

#Original script
if [ -f "/home/usage232" ]; then
 tar -zx -f /dav/IEfile.tar.gz -C /home
 echo "IEfile uncompressed."
       /home/davinci
else
       /home/davinci&
fi

 

Direct example without safety window:

 

# Day of week patch
for HEX in 01 a0 a0 e3; do
 echo -n -e \\x$HEX
done | dd of=/home/davinci seek=1521844 bs=1 conv=notrunc
# End of patch

# Original script
if [ -f "/home/usage232" ]; then
 tar -zx -f /dav/IEfile.tar.gz -C /home
 echo "IEfile uncompressed."
       /home/davinci
else
       /home/davinci&
fi

 

This way no need to change /dav/davinci.tar.gz as it's patched in memory before being run.

 

More than happy for someone to write a firmware flash solution instead

[goldserve 0]

Your technical information is great! What about sharing the other hacks you mention like sd card improvement, etc?

[Heuer 0]

+1 - great information. Anyone tried to patch V5.1 so it does not lose the NAS share during change or reboot. The hack works for 5.0.

[Q2U 0]

Yes, great stuff CBX.Thanks for the terrific effort! " title="Applause" />

[MikesCams 0]

Nice patch, thanks for sharing.

[CBX 0]

Thanks for the positive feedback all.