Hikvision Firmware 5.1.2 Chinese to English Fix

[Douglaster 0]

Thank you so much.

 

i did the easy way but with my newest camera´s firmware.

 

Worked flawlessly.

[lewislitt 0]

First, thanks a lot for the write up, it is really informative. I tried to follow it but was stuck on the ftp part. It seems that ftpput is not available in /bin, neither is ftpget. Is there any other way to ftp the davinci file off the ipc?

 

The IPC I currently have is on Fw 5.2.1 and it is in Chinese only. It would really help if I can bring up the English interface on it.

 

Also I have an NVR on 3.0.8 that only has chinese as well, is there a similar way to add english to it? Currently no matter what fw I try on the NVR, it always gives the prompt "can't upgrade, firmware mismatch".

 

Thanks!!

 

-LL

[catseyenu 0]

FTP was removed in 5.20, you would need to down grade to a prior version using TFTP.

Your best bet may be to contact CBX.

[buellwinkle 0]

Instead of FTP, you can use a NAS or even a Windows share (which is what I do). Then define that under Storage in Advanced Configuration, but don't format it. It will show up as /mnt/nfs00 directory and you can copy files to and from that mount point, in my case a directory on my PC. Careful with 5.2 and newer, you just can't change the davinci file, you have to update the checksum in the file or it will brick your camera. In case you do, you can recover using the TFTP method and I know from experience. The easy way out is to put in 5.1 via TFTP, its English & Chinese and you can apply the NAS patch to that.

[Defender666 0]

Does this patch also work to switch to german??

 

Does someone have the 5.2.0 Patched Version so i can upgrade older cameras.

 

I know if I flash european Firmware my camera will be in chinese so I need the correct file.

[avarty 0]

Does this patch also work to switch to german??

 

Does someone have the 5.2.0 Patched Version so i can upgrade older cameras.

 

I know if I flash european Firmware my camera will be in chinese so I need the correct file.

 

You can find a multilanguage / german 5.2.0 version for "Raptor 2XXX" cameras here:

https://knx-user-forum.de/gebaeudetechnik-ohne-knx-eib/31704-hikvision-ds-2cd2032-i-gute-outdoor-uberwachungskamera-76.html#post424306

 

Otherwise, you have these options to switch manually to german:

https://knx-user-forum.de/gebaeudetechnik-ohne-knx-eib/31704-hikvision-ds-2cd2032-i-gute-outdoor-uberwachungskamera-76.html#post421213

[Defender666 0]

I have a Fisheye DS-2CD6332FWD-IVS does someone have a patched firmware.

 

I get "Language missmatched" if I try to flash oversea version firmware.

 

I just want to put german language. Telnet works fine and I can modify files.

[iTuneDVR 2]

I have a Fisheye DS-2CD6332FWD-IVS does someone have a patched firmware.

I get "Language missmatched" if I try to flash oversea version firmware.

I just want to put german language. Telnet works fine and I can modify files.

 

This is not a problem and never the problem was not, and was the task.

All these tasks have been solved long ago. You're probably sick at this time or slept?

[Defender666 0]

Okay. But the davinchi.tar.gz is different so cannot apply the HEX trick to get the EU firmware to flash through the web.

[Spark 0]

Use TFTP "recovery" as that does not do a "language check".

[Defender666 0]

Use TFTP "recovery" as that does not do a "language check".

 

thanks this worked.

[ArmoredDragon 0]

I don't see any reason why we need to do even half of this stuff as the cameras seem to have all of the binaries required to do an in-place patching. For example:

 

WARNING: Example only, don't use.

Edit: 5.2.0 uses LZMA compression for the oddly named .gz file, but earlier versions seem to use regular gzip. For earlier versions it would be tar -xzvf rather than -xavf as seen below.

 

mkdir /dev/davtar
cd /dev/davtar
tar -C /dev/davtar -xavf /dav/davinci.tar.gz
echo -ne "\x01\xA0\xA0\xE3" | dd conv=notrunc of=/dev/davtar/davinci bs=1 seek=1536408
mv /dav/davinci.tar.gz /dav/davinci.tar.gz.old
#next step takes a while due to slow Armv6 CPU
tar -cf - davinci | gzip -9 > /dav/davinci.tar.gz 
rm -rf /dev/davtar

 

That untars/unlzma's the davinci binary, patches the bytes 01A0A0E3 at the decimal offset 1536408, creates a backup, tar/gz's the patched binary and puts it in place. You can just paste that into a telnet/ssh console and it *should* work but I haven't fully tested (see below for why.)

 

Also, I've been able to transfer files just fine without using FTP. I haven't tried with telnet (it may or may not work due to how telnet sometimes handles strings differently) but with SSH, I do this:

 

herpderp@files:/my/local/files$ ssh -l admin 192.168.1.212 'cat /dev/davtar/davinci' > ./davinci

 

That effectively downloads the specified file, in this case admin being the username, 192.168.1.212 is my camera IP, /dev/davtar/davinci being the remote file I wanted to download, and ./davinci being the local one. Just type in the password when prompted and it works.

 

You can upload in a similar manner, e.g.

 

herpderp@files:/my/local/files$ cat davinci | ssh -l admin 192.168.1.212 'cat > /dev/davtar/davinci'

 

Anyways I applied firmware 5.2.0 without realizing that I now ended up with a chinese language camera, and for whatever reason the TFTP method isn't working (my TFTP server doesn't even see it try to log in.) I'm presently trying to patch the davinci ELF binary but I've never been any good at disassembly. Anywho I've dumped it (using the above described method) if anybody wants to take a crack at it:

 

https://dl.dropboxusercontent.com/u/38947259/davinci

MD5: 968860b8101b39ad40dd000e185dba8e

 

Presently the javascript method is doing ok as a workaround, but I'd rather have something more permanent.

[gbix 0]

I don't see any reason why we need to do even half of this stuff as the cameras seem to have all of the binaries required to do an in-place patching. For example:

 

That untars/unlzma's the davinci binary, patches the bytes 01A0A0E3 at the decimal offset 1536408, creates a backup, tar/gz's the patched binary and puts it in place. You can just paste that into a telnet/ssh console and it *should* work but I haven't fully tested (see below for why.)

 

https://dl.dropboxusercontent.com/u/38947259/davinci

MD5: 968860b8101b39ad40dd000e185dba8e

 

Its original 5.2.0 davinci

 

5.1.6

before is

8a 30 dd e5 LDRB R3, [sP,#0x150+var_C6]

38 a0 9d e5 LDR R10, [sP,#0x150+var_118]

 

after is

8a 30 dd e5 LDRB R3, [sP,#0x150+var_C6]

01 a0 a0 e3 MOV R10, #1

 

for 5.2.0 also similarly

[Maniaxx 0]

In v5.3.0 its similar (just tested the CN version so far). Don't know if its working as the integrity checks are still in place that reboot the camera.

.text:00225040 54 90 C4 E5 STRB R9, [R4,#0x54]

.text:00225044 82 30 DD E5 LDRB R3, [sP,#0x148+var_C6]

.text:00225048 30 90 9D E5 LDR R9, [sP,#0x148+var_118]

.text:00225048 01 90 A0 E3 MOV R9, #1

[sidisdim 0]

hello,

 

i try directions for my 2432fw camera but i cant complete it.

i get sh: /bin/ftpget: not found

 

could anyone help me? i need also the files because i m not sure if i get the correct files.

[Cam-it 0]

In v5.3.0 its similar (just tested the CN version so far). Don't know if its working as the integrity checks are still in place that reboot the camera.

.text:00225040 54 90 C4 E5 STRB R9, [R4,#0x54]

.text:00225044 82 30 DD E5 LDRB R3, [sP,#0x148+var_C6]

.text:00225048 30 90 9D E5 LDR R9, [sP,#0x148+var_118]

.text:00225048 01 90 A0 E3 MOV R9, #1

How did you uncompress the davinci.tar.gz file?

[imforipcctv 0]

good stuff! thank you!

[izboril 0]

I have a camera Hikvision DS-2CD3232-I5 and unfortunately I upgraded the firmware to version 5.2.0 build 140721 in Chinese and English version to version V5.3.0 build 150,513, which I downloaded from the website of the Chinese Hikvision, but it is, unfortunately, only Chinese. I can not do downgrade, because I have the original file digicap.dav.

Nowhere in the English version I can get for my camera, Hikvision company he refused because I did not buy a camera with them, but with the company www.wi8.com.

Will you help me, please, anyone?

[pidgey 0]

Hello, i have a couple Hikvision bullet cams from China, model DS-2CD2032-I, and a dome model DS-2CD2732F-IS, both with firmware 5.0.2 130805, the original one i had factory installed when i bought the cams, in English. Never upgraded it myself.

 

I guess it's about time for an update now, lucky me i checked this forum before downloading and installing, because if i understand correctly, the cams would have turned into chinese language and now way to go back unless doing the tricks explained in the original post.

 

Now i was wondering... it's there any suggested way for me to go from 5.0.2 to the new firmware (i think last one is 5.3.0) and keep english language?

[gb77 0]

You can permanently convert a Chinese cam to an English cam with this code fix:

http://www.cctvforum.com/viewtopic.php?f=19&t=41225

 

I haven't used it myself (no Chinese cams) and am not sure of the cost, but reports have been good.

 

Can't seem to access this thread, get:

 

You are not authorised to read this forum.

 

Do you need a minimum number of posts?

 

Alternatively does the firmware mode work on the 5.4 firmware as I need this so I can use gmail TLS :/ I've got some newer UK cameras which are fine, but the ones I bought a few years ago (before I realised there was a region lock on firmware) need updating.

 

Thanks

[almj 0]

Hi there,

 

I'm also very interested in getting the latest firmware on a cineese hikvision to get the TLS to work.

Please give the direction to go?

[DazNick 0]

Hello,

 

I too would like to convert/Fix to the later firmware,

The above link wont open, It just says: You are not authorised to read this forum

even though I am a registered user

 

I currently have the following cameras

 

PTZ 1080p 20x zoom (Suppose to be Hikvision internals)

CMR-HD200-20-K20141008CCCH483322481

Software: V5.1.6 Build 140802

DSP: V5.7 Build 140701

 

1 x Hikvision Bullet Style

DS-2CD2632F-IS20150320CCCH508529096

Software: V5.2.5 Build 141201

DSP: V5.0 Build 14714

 

1 x Hikvision Bullet Style

DS-2CD2632F-IS20141218CCCH495794165

Software: V5.2.5 Build 141201

DSP: V5.0 Build 14714

 

1 x Hikvision Bullet Style

DS-2CD2632F-IS20150320CCCH508529124

Software: V5.2.5 Build 141201

DSP: V5.0 Build 14714

 

1 x Hikvision Bullet Style

DS-2CD2732F-IS20150102CCCH497278229

Software: V5.2.5 Build 141201

DSP: V5.0 Build 14714

 

1 x Hikvsion Bullet Style

DS-2CD2132F-IS20150210CCCH503066975

Software: V5.2.5 Build 141201

DSP: V5.0 Build 14714

 

Any help would be greatly appreciated.

Darren

[slbeh81 0]

Hi brother Dahua firmware chinese version can change to english version or not! where can get the english version. My ip cam is DH-IPC-HDBW4631R-VFAS. Thank! please advise.