DS-2CD2020F-I lost Network Advanced settings access?

[NotEinstein]

I few weeks ago I bought a second-hand DS-2CD2020F-I and configured it to upload images via FTP to my local server, ready as a spare. I got it out again this morning as I wanted to connect to it via Windows in a VM (I've been a Linux user for the past 15 years) so that I could configure the motion trigger area map, which was the one thing I couldn't do before. For some reason, upon power up it had changed it's mac-address, static IP, and annoyingly, lost the menu item to access the Advanced settings for FTP etc. It seems to have gained access to WiFi settings, which I didn't see before.

A factory reset has made no difference.

I guess the firmware is old, but I don't want to update it and not be able to go back, if there is some hidden way of resolving this.

Thanks

 

[David]

@NotEinstein very strange....
MAC address is usually hard coded into the device, could you be seeing a MAC address from the VM virtual interface?

Clear cookies / browser cache for that cameras IP address.

Windows updates to the browser may have reduced functionality, I've seen this with my older cameras using IE and Edge. IVMS 4200 is a workaround, are there any linux browsers that emulate a windows browser?

When you last used the camera, could an update have been pre loaded to load at next boot?

David

 

[NotEinstein]

Thanks for your response.

When I saw the issue, I gave up with the Windows VM and went back to Linux, on the same Notebook, then my Raspberry Pi4 that is my main desktop.
So not a browser/cache thing. While Firefox and Chromium can operate in emulation mode, pretending to be a Microsoft browser, there is no ActiveX, it being proprietary Microsoft software, hence the need for a Windows box to interface through ActiveX when required.

I remember looking at the firmware update, and even downloaded the latest, but found I would require ActiveX for the cam to access the file, so no chance any update was uploaded to the cam.

I guess it could be a fault of some kind - maybe it was sold because it lost access to WiFi - and it now has a new variant (seems to be the way of the world these days).

 

[David]

Thanks for your response.

When I saw the issue, I gave up with the Windows VM and went back to Linux, on the same Notebook, then my Raspberry Pi4 that is my main desktop.
So not a browser/cache thing. While Firefox and Chromium can operate in emulation mode, pretending to be a Microsoft browser, there is no ActiveX, it being proprietary Microsoft software, hence the need for a Windows box to interface through ActiveX when required.

I remember looking at the firmware update, and even downloaded the latest, but found I would require ActiveX for the cam to access the file, so no chance any update was uploaded to the cam.

I guess it could be a fault of some kind - maybe it was sold because it lost access to WiFi - and it now has a new variant (seems to be the way of the world these days).

I'd forgotten about the ActiveX bit.

You could try a TFTP firmware reload, there's a chance you could brick the camera. This was possible with older Hikvision cameras. You don't need the Hik tftp software, any tftp server app will do. When the camera is in tftp mode you can use Wireshark to find the camera tftp mode IP address and the firmware filename the camera is looking for.

David

 

[NotEinstein]

I'd forgotten about the ActiveX bit.

You could try a TFTP firmware reload, there's a chance you could brick the camera. This was possible with older Hikvision cameras. You don't need the Hik tftp software, any tftp server app will do. When the camera is in tftp mode you can use Wireshark to find the camera tftp mode IP address and the firmware filename the camera is looking for.

David

How do I put it in TFTP mode? The only maintenance options are:

I probably have to go back to the VM to do it......

 

[NotEinstein]

I installed iVMS-4200 Lite on the Windows VM and that doesn't see the cam. Also, I can no longer view the rtsp stream with VLC, with the cam seemingly rejecting the request, which is the same with an FTP connect request.

 

[David]

How do I put it in TFTP mode?

from the internet it may already be in TFTP mode, see here. You could setup the laptop static IP address and try to ping the camera. There's a link to a tftp tool, I'd use my own tftp server.
There are several YouTube videos as well as the Hikvision forum here.

 

[David]

I installed iVMS-4200 Lite on the Windows VM and that doesn't see the cam. Also, I can no longer view the rtsp stream with VLC, with the cam seemingly rejecting the request, which is the same with an FTP connect request.

Check the VLC logs for more info.

 

[JB1970]

Off topic but looking at that screenshot, I think that is the oldest firmware I've ever seen on a Hikvision camera!

 

[NotEinstein]

Thanks for your input David.

This is becoming a quest!
As I now know that firmware is region specific, and I am in Thailand, and I only have what the dealer that sold the unit said as model number, I firstly need to correctly identify the region and actual product model from the serial number/firmware version - is that possible?
If it is a DS-2CD2020F-I, how to know which firmware to download, as that model doesn't appear in the list?
As I will be using a Linux host, what username and password does the unit use when attempting to TFTP update firmware?

When I received the cam, it's IP was 192.168.1.64, so the dealer had probably tried to update. Maybe he tried 192.0.0.64 first.

 

[NotEinstein]

Anybody know the telnet username (if not root) and password - it accepts a connection.

 

[JB1970]

It should be root and password 12345. Your camera is an R0 firmware platform model. There’s a lot of info over on IPCam Talk regarding flashing camera firmware via telnet TFTP. Check this page out:

Hikvision

ipcamtalk.com

The top few ‘sticky’ posts provide details

 

[NotEinstein]

It should be root and password 12345. Your camera is an R0 firmware platform model. There’s a lot of info over on IPCam Talk regarding flashing camera firmware via telnet TFTP. Check this page out:

Hikvision

ipcamtalk.com

The top few ‘sticky’ posts provide details

Thanks JB1970, I'll dive in there.....

 

[JB1970]

Thanks JB1970, I'll dive in there.....

I think Alistair is the expert on there

 

[David]

@NotEinstein I found this firmware on the forum Firmware - Firmware for the Hikvision DS-2CD2020F-I cameras?

eu region for R2 platform

 

[David]

I think Alistair is the expert on there

watching Alastair's video brought back memories of the mid to late 90's when I started cloning EEPROMs and tweaking firmware. No Windows just DOS and the rs232 interface with procomm plus as the terminal emulator.

 

[NotEinstein]

An update....

All attempts to 'factory reset' the cam result in it having an IP address of 192.168.1.203, even when it is connected (through a 5 port switch) only to my notebook with network set to 192.0.0.128, according to tcpdump. It has a button on a trailing cable that I assume is a reset button - it squwarks when held in. I tried holding that button until it squwarks, remove power for 30 seconds, then apply power and wait for the click, before releasing the button. 192.168.1.203 asking where is 192.168.1.1

The fact that it also changed the MAC address and removed the ability to apply firmware updates looks suspiciously like a malicious attack to me - is it soldering iron time, or is there another way to make it truly reset?

 

[David]

An update....

All attempts to 'factory reset' the cam result in it having an IP address of 192.168.1.203, even when it is connected (through a 5 port switch) only to my notebook with network set to 192.0.0.128, according to tcpdump. It has a button on a trailing cable that I assume is a reset button - it squwarks when held in. I tried holding that button until it squwarks, remove power for 30 seconds, then apply power and wait for the click, before releasing the button. 192.168.1.203 asking where is 192.168.1.1

The fact that it also changed the MAC address and removed the ability to apply firmware updates looks suspiciously like a malicious attack to me - is it soldering iron time, or is there another way to make it truly reset?

I don't think it is a malicious attack, 192.168.1.203 is a non routable IP address and would be dropped by a public internet router.

I don't know exactly how these cameras work but you may have to press the reset button (holds an input low at logic 0) before you switch the power on and wait more than 30 seconds before releasing the button. This will stop the camera loading the main operating system and it may default to ftp / tftp. you can ping the camera tftp IP address and see if it comes up. you could try macOS terminal command nc -vz 192.168.nnn.nnn 21 to check for ftp port 21 being open and what protocols are available.

did you read...
R0 / DS-2CD2x32 BrickfixV2 brick recovery and full upgrade tool - enhanced. I'm familiar with the process used by Alastair as I used to repair bricked Cisco devices.

 

[NotEinstein]

I tried again, holding the button in for 40 seconds, remove power still with the button pressed for 40 seconds, applied power, and despite me still holding the button in, it went through it's normal startup, saying 'welcome to vuze' (is that normal?) and then, as 192.168.1.203, asking where is 192.168.1.1. It doesn't respond to 192.0.0.64 or 192.168.1.64.

I did read the amazing info by Alistair, as well as some others, but it is academic if the cam doesn't look for the tftp server.

 

[David]

I tried again, holding the button in for 40 seconds, remove power still with the button pressed for 40 seconds, applied power, and despite me still holding the button in, it went through it's normal startup, saying 'welcome to vuze' (is that normal?) and then, as 192.168.1.203, asking where is 192.168.1.1. It doesn't respond to 192.0.0.64 or 192.168.1.64.

I did read the amazing info by Alistair, as well as some others, but it is academic if the cam doesn't look for the tftp server.

some devices need the "press and hold button down then switch on and continue to hold button down for 60 to 90 seconds". The initial boot has to time out and default to recovery mode. I'm second guessing here, maybe ask Alastair for his input.

Why not just create the subnet the camera wants and see what happens. give your laptop a static ip of 192.168.1.202 mask 255.255.255.0.