HikVision DS-7208huhi-k1 bricked after firmware upg

[StewartM]

Additionally, please post a screen capture of the response to:
Open a cmd prompt.
Type c:\>python.exe
Type (at the >>):
>> import socket

 

[StewartM]

It's possible the path isn't correctly setup in your environment variables. Any chance you have multiple versions of Python loaded?
I'm on Win10 so attachments may look a bit different. Instructions below are for Win7:
Select “Computer” from the Start menu
Choose “System Properties” from the menu
Click “Advanced system settings” then click the “Advanced” tab
Click on “Environment Variables”, under “System Variables”, find “Path”, and click on it.
Click “Edit…”, and add the text on the following line to the end of the Path in the box “Variable value”.
Note that there should be no spaces anywhere at all:
;C:\Python27

 

[JamieG]

So on another laptop I've fully setup again, this one is a Dell so different from the first one, running TFTPSERV.EXE has no joy but running from python the script I do get further, I've installed v2.7 and I've managed to run the script which does indeed go further but it stops at "Serving xxxx-byte digicap.dav" and goes no further, this is even after I've rebooted the DVR.

 

[StewartM]

Few long shots to try:
1. Configure the laptop adapter to IP 4 only, nothing else ticked.

2. Don't open the cmd prompt as admin, it works for me without elevated privileges.
Try the script again.
If it fails again, download this version firmware.
Copy the digicap.dav to the Python folder and overwrite.
Try again.

 

[JamieG]

Cheers for your time again Stewart it's appreciated.

So I've completed no 1 and no 2 and still no handshake from the DVR

 

[StewartM]

Just to clarify, you haven't received the magic handshake part? Stuck at the line above?

 

[StewartM]

Are you power cycling the DVR when the script waits on 'Serving xxxxx-byte digicap.dav ...'? It won't proceed unless you do.
Failing that:
I can't say when, but Hikvision changed the default IPs in the firmware. I had to set my TFTPServ IP to 192.168.1.128 for this reason.
Please try this only if you still haven't received the 'magic handshake' reply:
Edit the hikvision_tftpd.py script and set the server IP (line 171) to default='192.168.1.128'.
Change your laptop IP to static to 192.168.1.128, 255.255.255.0 (Don't worry about the DVR's IP).
Put the digicap.dav you first tried back in your Python folder.
Run the process again.
Remember, at 'Serving xxxxx-byte digicap.dav ...' line you have to power cycle the DVR before the script will proceed.

 

[JamieG]

I am for sure powering off and on when the script states "serving xxxx"

Spun the IP address over to 192.168.1.128 and changed line 171 and still nothing.

Put the first digi file back in again and nothing.

Just not getting the handshake from the DVR endpoint

 

[StewartM]

Set the IP to 192.168.0.128 on your laptop adapter and amend script line 171 to the same. I see a few reports of success with that IP. Keep me posted.

 

[JamieG]

no joy on that one.

Wireshark is doing an ARP from 192.0.0.64 - the DVR - so nothing else is going to work and must be in the same VLAN segment.

 

[StewartM]

Please send a Wireshark capture. Expand the initial ARP broadcast from the DVR.

 

[JamieG]

I will send the wireshark in a bit


I've also hooked up to a screen and found today that I can see a display, no cameras but a display with menu's when I try to go into "Menu" i get prompted for a username and password, I can type a password but can't type in the user name box, it has a drop down menu to select a username, there is no list appearing.

 

[JamieG]

 

[StewartM]

“I've also hooked up to a screen and found today that I can see a display, no cameras but a display with menu's when I try to go into "Menu" i get prompted for a username and password, I can type a password but can't type in the user name box, it has a drop down menu to select a username, there is no list appearing.”

I’ve seen a rare few posts of database corruption of the users table after a firmware update. The user should default to admin in your case. If you enter a password, 12345 or your last known working password, does it fail because the user field is empty?

The only way to correct the database corruption was to perform a factory reset or use the wizard (if available) to recreate the admin password. When the DVR is on the menu screen, are you to able to ping it on 192.0.0.64 from the laptop? If so, this opens up some other options to reset it. Let me know.

Regarding your Wireshark capture. It’s interesting the DVR's ARP broadcast is looking for the TFTP server on 192.0.0.64.

When the DVR is in recovery mode, the IP for the TFTP server is already hard-coded by Hikvision. This might explain why your laptop is not responding to the ARP broadcast.

The DVR’s IP aside for now, please try the following. Let’s see if you can get a response from the laptop's NIC to the ARP broadcast. Set the laptop’s NIC to 192.0.0.64 and edit the script line 171 to reflect the same. With Wireshark in capture mode, run the python script and power-cycle the DVR at the ‘Serving…. ‘ line of the script. Please post the screen capture from Wireshark as you did before.

 

[JamieG]

Ive already tried to enter 12345 and my password in the box but the "ok" button is greyed, Im assuming until I select a user ID.

Ive lost patience now and its on its way back to the supplier/Hikvision.

Thanks for you help.

 

[aglamadrid19]

Just wanted to say thank you. Im currently trying to reset to factory defaults a DS-7208HQHI-F1/N. No luck so far but thanks to this i have learned a lot.

 

[marchinho91]

Good evening, I was wondering if anyone found the solution to this.

I am trying to flash the firmware of my Hikvision DS7204HGHI, and I was reading all the useful information mentioned in these 2 pages in this thread.

I have the feeling that my DVR is completely gone. It had an issue with the HDD, for which it started intermittently beeping. I have disabled the alert for the sounds. I was then playing with the DDNS configuration to watch cameras remotely, and rebooted the DVR multiple times.
After a couple of days I noticed that it was not singable anymore.
Last time I tried to load the web GUI, I intermittently got a page with: "{{szErrorTip}}" (found another forum about this, and the conclusion seems to be that there may be a corrupted firmware).

I have tried everything now.
I have tried to use the Hikvision TFTP tool on a very old Win XP PC that I have at home, connected the DVR over ethernet directly to the PC, and set the IP of the PC to 192.0.0.128.

Tried also from my personal iMac, using a VM with Win7, Network in Bridge mode. Nothing to do. Tried to assign the VM with the IP 192.0.0.128. I have tried to create a new Network location, with Ethernet interface only, and with bridged network that should be shared with the VMware Win7 VM. no luck. The TFTP server will just initialize, but won't move further.

[2020-09-19 00:54:25] TFTP server [192.0.0.128] initialized
[2020-09-19 00:55:55] Connect client success [192.0.0.128]Success
[2020-09-19 00:55:55] Open file failure[C:\Users\Marco\Desktop\TFTP-Update\AVAST-HNS-SCAN-PROBE]

In all the attempts I did, only once I got it to move forward, and I then realized I had Avast on the VM, which blocked everything. Removed Avast and disabled all the Firewalls, restarted the VM, it never moved anymore from "initialized".

Power LED is turning on
Status is off(It should be for the drive if I am not wrong).
TX/RX is blinking just in some occasion.

I then found this forum, and tried the GitHub project directly from my Mac using Python, and watching with Wireshark, as well as "sudo tcpdump -i en0 -vv -e -nn ether proto 0x0806". The Magic handshake never happens.

Tried to give multiple IP addresses to the Mac on the ethernet interface:
192.0.0.128
192.168.0.128
192.168.1.128
192.168.0.100
192.168.0.26
172.9.18.80 ( and changed the file name to digicap.mav)

Neither Wireshark nor the other command are able to see any incoming/outgoing information from the DVR(i.e.: I never see a Broadcast message from Hangzhou in Wireshark). The bash command detects only:
23:20:06.556372 MAC_ADDR_OF_iMac > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: Ethernet (len 6), IPv4 (len 4), Probe who-has 192.0.0.128 tell 0.0.0.0, length 28
23:20:06.877298 MAC_ADDR_OF_iMac > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: Ethernet (len 6), IPv4 (len 4), Probe who-has 192.0.0.128 tell 0.0.0.0, length 28
23:20:07.202313 MAC_ADDR_OF_iMac > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: Ethernet (len 6), IPv4 (len 4), Probe who-has 192.0.0.128 tell 0.0.0.0, length 28
23:20:07.526591 MAC_ADDR_OF_iMac > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: Ethernet (len 6), IPv4 (len 4), Announcement who-has 192.0.0.128 tell 192.0.0.128, length 28
23:20:07.848264 MAC_ADDR_OF_iMac > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: Ethernet (len 6), IPv4 (len 4), Announcement who-has 192.0.0.128 tell 192.0.0.128, length 28
23:20:08.170171 MAC_ADDR_OF_iMac > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: Ethernet (len 6), IPv4 (len 4), Announcement who-has 192.0.0.128 tell 192.0.0.128, length 28
23:20:08.170747 MAC_ADDR_OF_iMac > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: Ethernet (len 6), IPv4 (len 4), Request who-has 169.254.255.255 tell 192.0.0.128, length 28
23:20:08.495311 MAC_ADDR_OF_iMac > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: Ethernet (len 6), IPv4 (len 4), Request who-has 169.254.255.255 tell 192.0.0.128, length 28
23:20:08.820231 MAC_ADDR_OF_iMac > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: Ethernet (len 6), IPv4 (len 4), Request who-has 169.254.255.255 tell 192.0.0.128, length 28
23:20:09.141596 MAC_ADDR_OF_iMac > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: Ethernet (len 6), IPv4 (len 4), Request who-has 169.254.255.255 tell 192.0.0.128, length 28
23:20:09.462763 MAC_ADDR_OF_iMac > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: Ethernet (len 6), IPv4 (len 4), Request who-has 169.254.255.255 tell 192.0.0.128, length 28

Tried also multiple ethernet cable. no change.
tried also an USB-ethernet adapter. no change.

As soon as I turn on the DVR, I can see Wireshark starts seeing traffic on the ethernet interface,
1 0.000000 Apple_ff:ea:43 Broadcast ARP 42 Who has 192.0.0.128? (ARP Probe)
Some other messages....
10 0.965914 Apple_ff:ea:43 Broadcast ARP 42 ARP Announcement for 192.0.0.128

But I never see any other Hikvision related message(I don't think I have ever seen the MAC address of the the DVR showing up in Wireshark).

Any recommendation?

 

[octav]

Hi, I want to know if the model DS-7208HUHI-K1 is locked by the manufacturer to TFTP update. Thanks!