Jump to content
wzhick

Hikvision FIRMWARE TOOLS - change language, modify firmware

Recommended Posts

Firmware Mod Tool for Hikvision NVR and IP camera devices.

 

[Mod: WARNING ... Use at your own risk]

 

What is this tool?

It’s a short piece of code that makes it easily possible to change the ‘Language’ flag on the firmware update files that Hikvision provides for their range of NVRs and IP cameras. The user does not need programming expertise to use this tool.

The tool also provides some advanced facilities to extract the contents from the main body of a firmware upgrade file for inspection or further development. The tool can also re-package the updated changed or added contents into a new firmware update file that can be applied to the IP camera or NVR as a normal upgrade.

 

Why would I need it?

It’s common that after purchasing Hikvision IP cameras and NVRs from low-cost sources such as Chinese internet-based sellers, users encounter some problems such as ‘Language mismatch’ when trying to integrate the devices or update the firmware. Hikvision applies ‘Region codes’ and ‘language flags’ to their IP cameras and NVRs and to the associated firmware updates, and tries to ensure their products are sold via their ‘Authorised Distributor Network’. Sellers can modify internal region and language settings in various ways to cheaply sell products from one region in another region, in a way that can cause later problems for the buyer when updates are attempted.

Advanced users can modify or add files to the firmware image, to customise the capabilities and behaviour of their IP camera or NVR.

 

How does the tool work?

The tool scans and decodes the NVR or IP camera firmware update file that the user would like to use to update the device, and allows the ‘Language flag’ to be changed, such that ‘Language mismatch’ errors that occur on an attempted update can be eliminated.

The tool extracts all the individual files from the main section of the firmware upgrade file, making them available for inspection or changing.

 

How do I use it?

The steps are straightforward, but do need some care to be taken, and require an understanding that although the tool is reliable and has been tested, it may not take account of future changes such as the firmware update file structure being re-engineered, or new checksums being incorporated.

Please proceed as follows:

 

- Have available a Windows PC, with the Hikvision Support Tools package available, which mainly consists of a TFTP server and the instructions on how this can be used to recover a failed firmware update on an NVR or IP camera.

 

- Store in a folder on the PC the NVR or IP camera firmware upgrade file that you would like to use, along with the ‘hiktools.exe’ firmware mod tool program. This could be the same folder as used by the TFTP program.

 

- Ensure the NVR or IP camera is powered on and connected to the same local network as the PC, and ensure that you can log on to the web admin GUI with an administrator account (usually admin).

 

- On the Windows PC, start a command-line window, usually with ‘Start | CMD’. Change the drive and directory to that holding the hiktools.exe program.

 

- First check that the firmware file to be changed can be correctly decoded. Assuming that the firmware filename is ‘digicap.dav, execute the following command:

hiktools digicap.dav

and inspect the result on the screen.

The tool will show the header raw data, the header decoded data, a summary of key values in the header, and the full decoded data including a list of the embedded files and their checksums.

An important value to check in the summary of key values is that the ‘magic number’ is ‘0x484B5753’ and that the iLanguage value is 1 or 2 The iHeadTotalLen varies with the number of files in the main section of the firmware update file. The value is 64 bytes plus 44 bytes x (the number of files held in the main section). This can be 108 for NVR firmware that typically has a single CRAMFS image, and 1208 for camera firmware holding 26 files. This should give a reasonable confidence level that the file is in a format that can be decoded. If the results do not match these values – DO NOT PROCEED further.

 

- Make a backup copy of the original firmware file with the following command:

‘copy digicap.dav digicap.dav.backup’

 

- At this point it is possible to simply change the ‘Language flag’ by executing the following command, using ‘1’ for English or Multi, and ‘2’ for Chinese. If you wanf flash english firmware to chinese IPC or NVR you need set language to 2:

hiktools lang digicap.dav 2

 

- The modified firmware file is now ready to be applied to the NVR or IP camera. Log in to the web admin GUI, and use the ‘Configuration | Maintenance | Remote Upgrade’ menu to select the new firmware file, and click the ‘Upgrade’ button. Observe the progress indicator, and the reboot progress. After reboot, check that the ‘Language mismatch’ problem has been eliminated.

 

 

Advanced use of the Firmware Mod Tool

 

In addition to the ability to modify the language flag in a firmware update file, the tool can be used to split the firmware file into its header section and all the component parts of the main or rootfs section, and also to create a new firmware file by joining a header section to a new main section that holds files from within a specified folder where the user may have modified the contents.

This clearly provides opportunities for customising the behaviour of your NVR or IP camera, however it is suggested that these facilities should only be used by those knowledgeable in the structure and practice of embedded Linux firmware files as implemented by Hikvision in their NVR and IP camera products.

For reference, the advanced commands of the firmware mod tool are as follows:

 

hiktools split digicap.dav destinationdir

The output on the screen lists the names of the files extracted from the main section of the firmware file. These files are created in the specified destination directory, and can be inspected and used when the extraction is complete.

In the version 03R and later of the hiktools program, there is a facility to recombine the extracted files, some of which the user may have since modified, or added to, into an original, valid firmware file that could be used by the firmware upgrade process in the IP camera or NVR. It is therefore possible for the user to modify and customise the IP camera or NVR behaviour should they wish to do so.

 

hiktools create header_from_digicap.dav sourcedir

The tool creates a new firmware file by combining the header extracted from the first argument with the contents of the directory from the second argument. Those contents could be files previously extracted, some of which were since modified, or with additional files to be included in the firmware image.

hiktools04r.rar

Share this post


Link to post
Share on other sites

Awesome stuff. It works great to show the firmware version, change language and split the firmware into files. The only thing I'm having a problem with is the "create" option. If I give a new filename, as in hiktools.exe create digicap2.dav 525firmware it tells me "unable to open dav file". If I give it an existing firmware file, it does nothing, does not update it. Am I using it wrong?

 

For those first trying it, it's not a Windows program so you have to run it in a Windows command window.

 

CORRECTION: Didn't see that it did create a new firmware file with the same name as the directory, so 525firmware.dav and included a test file I put in there.

Share this post


Link to post
Share on other sites
Awesome stuff. It works great to show the firmware version, change language and split the firmware into files. The only thing I'm having a problem with is the "create" option. If I give a new filename, as in hiktools.exe create digicap2.dav 525firmware it tells me "unable to open dav file". If I give it an existing firmware file, it does nothing, does not update it. Am I using it wrong?

For those first trying it, it's not a Windows program so you have to run it in a Windows command window.

CORRECTION: Didn't see that it did create a new firmware file with the same name as the directory, so 525firmware.dav and included a test file I put in there.

 

Carl!

Even got a utility on your hands, you can not use it properly and for its intended purpose!

 

Small utility several options. Works as conceived by the author.

Nice.

Perhaps in future versions of the tools will solve all the nuances.

Share this post


Link to post
Share on other sites

Was able to modify files in the firmware, create a new digicap.dav file and install it and kept the changes. You were right iTuneDVR, it is easy to do this with just Windows, no Linux needed.

Share this post


Link to post
Share on other sites
Was able to modify files in the firmware, create a new digicap.dav file and install it and kept the changes. You were right iTuneDVR, it is easy to do this with just Windows, no Linux needed.

Carl!

I am glad that you finally understand.

But, there is always also the nuances

Share this post


Link to post
Share on other sites

What's interesting is that while most files end up in the /dav directory on the camera, there's 2 additional files not in that directory on the camera and that's himage and hroot.img.

 

What I can see is that;

 

himage correlates to MTD9 (krn_pri) & MTD10 (krn_sec), not exactly the same but comparing two different cameras because already had MTD dumps of this camera.

 

hroot.img correlates to MTD11 (rmd_pri) & MTD12 (rmd_sec)

 

krn_pri I assume means kernel, not sure what rmd is.

Share this post


Link to post
Share on other sites
What's interesting is that while most files end up in the /dav directory on the camera, there's 2 additional files not in that directory on the camera and that's himage and hroot.img.

What I can see is that;

himage correlates to MTD9 (krn_pri) & MTD10 (krn_sec), not exactly the same but comparing two different cameras because already had MTD dumps of this camera.

hroot.img correlates to MTD11 (rmd_pri) & MTD12 (rmd_sec)

krn_pri I assume means kernel, not sure what rmd is.

 

Carl!

Content firmware and so could get without this utility.

It is strange that you are surprised that these files and find them to conform to the blocks MTD?

It's been obvious, even a year ago!

Share this post


Link to post
Share on other sites

I checked two cameras, one unhacked, one hacked to English, both same model, same batch of cameras. The kernel MTD9/10 files were identical, the MTD11/12 are different, so for now, I feel the keep to making the day of week English is in the MTD11/12 files referred to in the MTD mapping as rmd_pri and rmd_sec but they are identical to each other. So need a closer look at the hroot.img file.

Share this post


Link to post
Share on other sites

Hi there,

 

The tool did the trick on the file.

But when applying it on my camera, my camera is still in Chinese..

 

The language on the digicap.div file was set on 2, with the tool I managed to get it to 1.

 

But like I said, camera still only available in Chinese.

 

Is there something I'm doing wrong?

My camera's number is: 2cd2132F-IS

 

Thanks for the good work!

 

Kind regards,

Checky

Share this post


Link to post
Share on other sites

Hello. I can not transfer their firmware into another language, only the Chinese. Say, maybe do it with my firmware?

661221288_cmdrec.thumb.jpg.b3787fa8a77d67eab146f7218e7b3e38.jpg

Share this post


Link to post
Share on other sites

Hi Guys!

I have a 2CD2132-I camera and it had a 5.2.0 firmware. I download the new version 5.3 (IPC_R0_EN_STD_5.3.0_150513.zip) and made the update, the update was successful but after restart it says Access Error: 404 -- Not Found - firmware language mismatch: /home/webLib

I didn't know about this language "hanky-panky" I don't want to make further toubles so I ask first; is tehere any way to recover? Is it bricked?

Many thanks!

Gyuri

Share this post


Link to post
Share on other sites

Hi Titanmanus,

 

Its probably redeemable if your hours are worth more than the cost of a new one. I did the same - upgrade 2.5.0 to 3.5.0 got the same language error and spent hours working out how to fix it. The info is all on the Internet.

Honestly I can't remember all the steps and I am sure there are shortcuts but here are some of the things I did:

 

1) There are tools that other people have created that do the above task. use this link with instructions included:

http://www.mediafire.com/download/tk6p7bzc4u09bqb/ftp583v525.rar

 

Alternatively, you may be able to use the Batch Upgrading tool in "tools.exe" available from Hikvision http://www.hikvision.com/europe/download_more.asp?id=1335 . So long as you can FIND the camera and can LOGIN using admin/12345 (or possibly your own password). If so then try upgrade with the digicap.dav in the above .rar . If the camera was supplied from China then its a Chinese version 2.5 which may or may not have English turned on. However, even if it comes up in Chinese, so long as you can login then you can proceed.

 

2) Once you upgrade the firmware, if you end up with a Chinese version, to change that back to default English, download PuTTY.exe from www.putty.org/ and 7-zip from www.7-zip.org/ and follow most of the instructions here

(Youtube "How to make Hikvision firmware multilanguage") but rather than commenting out the field in the JSlogin script as he suggested, leave that line alone and instead just change both languages in these two ChooseLanguage statements from ch to en

 

$("#divLanguageChoose").css("height", "auto");

if ("zh" != $.cookie('language')) {

chooseLanguage("en");

}

} else {

$("#divLanguageChoose").find("label[id=zh]").parent().remove();

if ("zh" == $.cookie('language')) {

chooseLanguage("en");

 

Then you'll only get English as the default and no options!

Share this post


Link to post
Share on other sites

Hi,

 

I have got Hikvision dvr: ds-7816HE-E1/M.

 

I have successfully managed to change the iLanguage flag to 1, hence english.

 

But i have tried multiple ways to upgrade the firmware to the DVR, it simply fails.

 

But I was able to successfully upgrade using the old chinese version: V3.1.4 build 150430

 

Could assist in making the modified firmware upgradeable and recognised by the DVR. The DVR replies with an error: Upgrade failed.

 

Thanks

 

 

Firmware Mod Tool for Hikvision NVR and IP camera devices.

 

[Mod: WARNING ... Use at your own risk]

 

What is this tool?

It’s a short piece of code that makes it easily possible to change the ‘Language’ flag on the firmware update files that Hikvision provides for their range of NVRs and IP cameras. The user does not need programming expertise to use this tool.

The tool also provides some advanced facilities to extract the contents from the main body of a firmware upgrade file for inspection or further development. The tool can also re-package the updated changed or added contents into a new firmware update file that can be applied to the IP camera or NVR as a normal upgrade.

 

Why would I need it?

It’s common that after purchasing Hikvision IP cameras and NVRs from low-cost sources such as Chinese internet-based sellers, users encounter some problems such as ‘Language mismatch’ when trying to integrate the devices or update the firmware. Hikvision applies ‘Region codes’ and ‘language flags’ to their IP cameras and NVRs and to the associated firmware updates, and tries to ensure their products are sold via their ‘Authorised Distributor Network’. Sellers can modify internal region and language settings in various ways to cheaply sell products from one region in another region, in a way that can cause later problems for the buyer when updates are attempted.

Advanced users can modify or add files to the firmware image, to customise the capabilities and behaviour of their IP camera or NVR.

 

How does the tool work?

The tool scans and decodes the NVR or IP camera firmware update file that the user would like to use to update the device, and allows the ‘Language flag’ to be changed, such that ‘Language mismatch’ errors that occur on an attempted update can be eliminated.

The tool extracts all the individual files from the main section of the firmware upgrade file, making them available for inspection or changing.

 

How do I use it?

The steps are straightforward, but do need some care to be taken, and require an understanding that although the tool is reliable and has been tested, it may not take account of future changes such as the firmware update file structure being re-engineered, or new checksums being incorporated.

Please proceed as follows:

 

- Have available a Windows PC, with the Hikvision Support Tools package available, which mainly consists of a TFTP server and the instructions on how this can be used to recover a failed firmware update on an NVR or IP camera.

 

- Store in a folder on the PC the NVR or IP camera firmware upgrade file that you would like to use, along with the ‘hiktools.exe’ firmware mod tool program. This could be the same folder as used by the TFTP program.

 

- Ensure the NVR or IP camera is powered on and connected to the same local network as the PC, and ensure that you can log on to the web admin GUI with an administrator account (usually admin).

 

- On the Windows PC, start a command-line window, usually with ‘Start | CMD’. Change the drive and directory to that holding the hiktools.exe program.

 

- First check that the firmware file to be changed can be correctly decoded. Assuming that the firmware filename is ‘digicap.dav, execute the following command:

hiktools digicap.dav

and inspect the result on the screen.

The tool will show the header raw data, the header decoded data, a summary of key values in the header, and the full decoded data including a list of the embedded files and their checksums.

An important value to check in the summary of key values is that the ‘magic number’ is ‘0x484B5753’ and that the iLanguage value is 1 or 2 The iHeadTotalLen varies with the number of files in the main section of the firmware update file. The value is 64 bytes plus 44 bytes x (the number of files held in the main section). This can be 108 for NVR firmware that typically has a single CRAMFS image, and 1208 for camera firmware holding 26 files. This should give a reasonable confidence level that the file is in a format that can be decoded. If the results do not match these values – DO NOT PROCEED further.

 

- Make a backup copy of the original firmware file with the following command:

‘copy digicap.dav digicap.dav.backup’

 

- At this point it is possible to simply change the ‘Language flag’ by executing the following command, using ‘1’ for English or Multi, and ‘2’ for Chinese. If you wanf flash english firmware to chinese IPC or NVR you need set language to 2:

hiktools lang digicap.dav 2

 

- The modified firmware file is now ready to be applied to the NVR or IP camera. Log in to the web admin GUI, and use the ‘Configuration | Maintenance | Remote Upgrade’ menu to select the new firmware file, and click the ‘Upgrade’ button. Observe the progress indicator, and the reboot progress. After reboot, check that the ‘Language mismatch’ problem has been eliminated.

 

 

Advanced use of the Firmware Mod Tool

 

In addition to the ability to modify the language flag in a firmware update file, the tool can be used to split the firmware file into its header section and all the component parts of the main or rootfs section, and also to create a new firmware file by joining a header section to a new main section that holds files from within a specified folder where the user may have modified the contents.

This clearly provides opportunities for customising the behaviour of your NVR or IP camera, however it is suggested that these facilities should only be used by those knowledgeable in the structure and practice of embedded Linux firmware files as implemented by Hikvision in their NVR and IP camera products.

For reference, the advanced commands of the firmware mod tool are as follows:

 

hiktools split digicap.dav destinationdir

The output on the screen lists the names of the files extracted from the main section of the firmware file. These files are created in the specified destination directory, and can be inspected and used when the extraction is complete.

In the version 03R and later of the hiktools program, there is a facility to recombine the extracted files, some of which the user may have since modified, or added to, into an original, valid firmware file that could be used by the firmware upgrade process in the IP camera or NVR. It is therefore possible for the user to modify and customise the IP camera or NVR behaviour should they wish to do so.

 

hiktools create header_from_digicap.dav sourcedir

The tool creates a new firmware file by combining the header extracted from the first argument with the contents of the directory from the second argument. Those contents could be files previously extracted, some of which were since modified, or with additional files to be included in the firmware image.

Share this post


Link to post
Share on other sites

Hi

 

Can someone tell me where I can get a copy of hiktools.exe? I downloaded the Tools software from the Hikvision ftp site but I do not see any hiktools.exe file there.

 

Thanks

 

Mark

Share this post


Link to post
Share on other sites

Hi

I buy from aliexpress.com camera IP HikVision DS-2CD2035-I chinese version with FW multilanguage 5.3.6

I know that is available for this model version 5.4.0 but seller dont want share me FW. Tell me that only his computer he can update FW.

I found on this chinese page FW for my model:

http://www1.hikvision.com/cn/download_more_714.html

 

I want change language to english/multilanguage. I don as describe in post 1. But this is info about original FW before change flag lang:

 

 HIK firmware header converter 0.4R

Head raw data(108b) :
00000000 8A FF F7 B6 DF EE DD D3 D6 B9 A3 AB BF CB B5 BE    ................
00000010 65 89 F7 D7 CB DD D3 BA 46 5C 54 40 34 4A 41 45    e.......F\T@4JAE
00000020 43 01 29 35 22 2C 45 46 5C 54 40 34 84 8C 88 FD    C.)5",EF\T@4....
00000030 CE E0 FA ED E1 8B 88 92 9A 8E FA 85 8E 88 FC BC    ................
00000040 E7 F8 EF E3 8A 8F 93 9B 8D FA 84 8F 8B FC 8D CE    ................
00000050 FA EF E2 BA 7E C3 A9 52 97 DE 24 37 CE B3 E8 11    ....~..R..$7....
00000060 B1 D3 BA B9 9F 9E B6 CA 3A 51 B7 49

Head decoded data(108b) :
00000000 30 32 4B 48 09 24 00 00 6C 00 00 00 00 00 00 00    02KH.$..l.......
00000010 A8 35 09 01 01 00 00 00 FF FF FF FF FF FF FF FF    .5..............
00000020 FF FF FF FF FF FF FF FF FF FF FF FF 31 32 32 30    ............1220
00000030 30 36 30 30 32 31 31 31 31 31 31 30 30 32 31 00    060021111110021.
00000040 31 32 32 30 30 36 30 30 32 31 31 31 31 31 31 30    1220060021111110
00000050 30 32 31 00 C7 60 02 ED 5C 6B 9A 8D 03 0F 16 C7    021..`..\k.....
00000060 6C 00 00 00 3C 35 09 01 8F EF 0D 84

Magic number :    0x484B3230
iHeaderCheckSum : 0x00002409 [9225]
iHeadTotalLen :   0x0000006C [108]
iFileNum :        0x00000000 [0]
iLanguage :       0x010935A8 [17380776]
iDeviceClass :    0x00000001
iOEMCode :        0xFFFFFFFF
iFirmwareVer :    0xFFFFFFFF
iFeature:         0xFFFFFFFF
Calculated CheckSum :        0x00002409 [9225]

Full decoded data (with full files block):
00000000 30 32 4B 48 09 24 00 00 6C 00 00 00 00 00 00 00    02KH.$..l.......
00000010 A8 35 09 01 01 00 00 00 FF FF FF FF FF FF FF FF    .5..............
00000020 FF FF FF FF FF FF FF FF FF FF FF FF 31 32 32 30    ............1220
00000030 30 36 30 30 32 31 31 31 31 31 31 30 30 32 31 00    060021111110021.
00000040 31 32 32 30 30 36 30 30 32 31 31 31 31 31 31 30    1220060021111110
00000050 30 32 31 00 C7 60 02 ED 5C 6B 9A 8D 03 0F 16 C7    021..`..\k.....
00000060 6C 00 00 00 3C 35 09 01 8F EF 0D 84
C:\hiktools04r>

 

 

 

Magic code is other as describe and iLanguage is not set 2.

 

After change flag language it looks as:

 HIK firmware header converter 0.4R

Head raw data(108b) :
00000000 8A FF F7 B6 B4 E9 DD D3 D6 B9 A3 AB BF CB B5 BE    ................
00000010 CC 89 F7 D7 CB DD D3 BA 46 5C 54 40 34 4A 41 45    ........F\T@4JAE
00000020 43 01 29 35 22 2C 45 46 5C 54 40 34 84 8C 88 FD    C.)5",EF\T@4....
00000030 CE E0 FA ED E1 8B 88 92 9A 8E FA 85 8E 88 FC BC    ................
00000040 E7 F8 EF E3 8A 8F 93 9B 8D FA 84 8F 8B FC 8D CE    ................
00000050 FA EF E2 BA 7E C3 A9 52 97 DE 24 37 CE B3 E8 11    ....~..R..$7....
00000060 B1 D3 BA B9 9F 9E B6 CA 3A 51 B7 49

Head decoded data(108b) :
00000000 30 32 4B 48 62 23 00 00 6C 00 00 00 00 00 00 00    02KHb#..l.......
00000010 01 35 09 01 01 00 00 00 FF FF FF FF FF FF FF FF    .5..............
00000020 FF FF FF FF FF FF FF FF FF FF FF FF 31 32 32 30    ............1220
00000030 30 36 30 30 32 31 31 31 31 31 31 30 30 32 31 00    060021111110021.
00000040 31 32 32 30 30 36 30 30 32 31 31 31 31 31 31 30    1220060021111110
00000050 30 32 31 00 C7 60 02 ED 5C 6B 9A 8D 03 0F 16 C7    021..`..\k.....
00000060 6C 00 00 00 3C 35 09 01 8F EF 0D 84

Magic number :    0x484B3230
iHeaderCheckSum : 0x00002362 [9058]
iHeadTotalLen :   0x0000006C [108]
iFileNum :        0x00000000 [0]
iLanguage :       0x01093501 [17380609] EN/ML
iDeviceClass :    0x00000001
iOEMCode :        0xFFFFFFFF
iFirmwareVer :    0xFFFFFFFF
iFeature:         0xFFFFFFFF
Calculated CheckSum :        0x00002362 [9058]

Full decoded data (with full files block):
00000000 30 32 4B 48 62 23 00 00 6C 00 00 00 00 00 00 00    02KHb#..l.......
00000010 01 35 09 01 01 00 00 00 FF FF FF FF FF FF FF FF    .5..............
00000020 FF FF FF FF FF FF FF FF FF FF FF FF 31 32 32 30    ............1220
00000030 30 36 30 30 32 31 31 31 31 31 31 30 30 32 31 00    060021111110021.
00000040 31 32 32 30 30 36 30 30 32 31 31 31 31 31 31 30    1220060021111110
00000050 30 32 31 00 C7 60 02 ED 5C 6B 9A 8D 03 0F 16 C7    021..`..\k.....
00000060 6C 00 00 00 3C 35 09 01 8F EF 0D 84
C:\hiktools04r>

 

 

I dont know that i can update this FW ? Seller chinese tell me that firmware chineese is hacked to english firmware... What you mean ?

Share this post


Link to post
Share on other sites

It means you have not got a genuine hikvision which is updatable multi.

 

You have a China copy and even on eBay and other sites the cameras have a warning DO NOT UPDATE.

Share this post


Link to post
Share on other sites
Ok but how i can hack fw to update in camera ? Seller can update and have hacked fw.

 

If the seller has it then why can't he help ?

 

The forum is full of China hik problems

Share this post


Link to post
Share on other sites
It means you have not got a genuine hikvision which is updatable multi.

 

You have a China copy and even on eBay and other sites the cameras have a warning DO NOT UPDATE.

Finally, some truth...the whole truth, and nothing about the truth, until now!

Share this post


Link to post
Share on other sites

before we use TFTP TOOL TO FLASH DVR'S but now they say that only people they have a special board can flash firwares.what is this board and from where I can get one so I can flash firwares on hikvision products

Share this post


Link to post
Share on other sites
Firmware Mod Tool for Hikvision NVR and IP camera devices.

 

[Mod: WARNING ... Use at your own risk]

 

What is this tool?

It’s a short piece of code that makes it easily possible to change the ‘Language’ flag on the firmware update files that Hikvision provides for their range of NVRs and IP cameras. The user does not need programming expertise to use this tool.

The tool also provides some advanced facilities to extract the contents from the main body of a firmware upgrade file for inspection or further development. The tool can also re-package the updated changed or added contents into a new firmware update file that can be applied to the IP camera or NVR as a normal upgrade.

 

Why would I need it?

It’s common that after purchasing Hikvision IP cameras and NVRs from low-cost sources such as Chinese internet-based sellers, users encounter some problems such as ‘Language mismatch’ when trying to integrate the devices or update the firmware. Hikvision applies ‘Region codes’ and ‘language flags’ to their IP cameras and NVRs and to the associated firmware updates, and tries to ensure their products are sold via their ‘Authorised Distributor Network’. Sellers can modify internal region and language settings in various ways to cheaply sell products from one region in another region, in a way that can cause later problems for the buyer when updates are attempted.

Advanced users can modify or add files to the firmware image, to customise the capabilities and behaviour of their IP camera or NVR.

 

How does the tool work?

The tool scans and decodes the NVR or IP camera firmware update file that the user would like to use to update the device, and allows the ‘Language flag’ to be changed, such that ‘Language mismatch’ errors that occur on an attempted update can be eliminated.

The tool extracts all the individual files from the main section of the firmware upgrade file, making them available for inspection or changing.

 

How do I use it?

The steps are straightforward, but do need some care to be taken, and require an understanding that although the tool is reliable and has been tested, it may not take account of future changes such as the firmware update file structure being re-engineered, or new checksums being incorporated.

Please proceed as follows:

 

- Have available a Windows PC, with the Hikvision Support Tools package available, which mainly consists of a TFTP server and the instructions on how this can be used to recover a failed firmware update on an NVR or IP camera.

 

- Store in a folder on the PC the NVR or IP camera firmware upgrade file that you would like to use, along with the ‘hiktools.exe’ firmware mod tool program. This could be the same folder as used by the TFTP program.

 

- Ensure the NVR or IP camera is powered on and connected to the same local network as the PC, and ensure that you can log on to the web admin GUI with an administrator account (usually admin).

 

- On the Windows PC, start a command-line window, usually with ‘Start | CMD’. Change the drive and directory to that holding the hiktools.exe program.

 

- First check that the firmware file to be changed can be correctly decoded. Assuming that the firmware filename is ‘digicap.dav, execute the following command:

hiktools digicap.dav

and inspect the result on the screen.

The tool will show the header raw data, the header decoded data, a summary of key values in the header, and the full decoded data including a list of the embedded files and their checksums.

An important value to check in the summary of key values is that the ‘magic number’ is ‘0x484B5753’ and that the iLanguage value is 1 or 2 The iHeadTotalLen varies with the number of files in the main section of the firmware update file. The value is 64 bytes plus 44 bytes x (the number of files held in the main section). This can be 108 for NVR firmware that typically has a single CRAMFS image, and 1208 for camera firmware holding 26 files. This should give a reasonable confidence level that the file is in a format that can be decoded. If the results do not match these values – DO NOT PROCEED further.

 

- Make a backup copy of the original firmware file with the following command:

‘copy digicap.dav digicap.dav.backup’

 

- At this point it is possible to simply change the ‘Language flag’ by executing the following command, using ‘1’ for English or Multi, and ‘2’ for Chinese. If you wanf flash english firmware to chinese IPC or NVR you need set language to 2:

hiktools lang digicap.dav 2

 

- The modified firmware file is now ready to be applied to the NVR or IP camera. Log in to the web admin GUI, and use the ‘Configuration | Maintenance | Remote Upgrade’ menu to select the new firmware file, and click the ‘Upgrade’ button. Observe the progress indicator, and the reboot progress. After reboot, check that the ‘Language mismatch’ problem has been eliminated.

 

 

Advanced use of the Firmware Mod Tool

 

In addition to the ability to modify the language flag in a firmware update file, the tool can be used to split the firmware file into its header section and all the component parts of the main or rootfs section, and also to create a new firmware file by joining a header section to a new main section that holds files from within a specified folder where the user may have modified the contents.

This clearly provides opportunities for customising the behaviour of your NVR or IP camera, however it is suggested that these facilities should only be used by those knowledgeable in the structure and practice of embedded Linux firmware files as implemented by Hikvision in their NVR and IP camera products.

For reference, the advanced commands of the firmware mod tool are as follows:

 

hiktools split digicap.dav destinationdir

The output on the screen lists the names of the files extracted from the main section of the firmware file. These files are created in the specified destination directory, and can be inspected and used when the extraction is complete.

In the version 03R and later of the hiktools program, there is a facility to recombine the extracted files, some of which the user may have since modified, or added to, into an original, valid firmware file that could be used by the firmware upgrade process in the IP camera or NVR. It is therefore possible for the user to modify and customise the IP camera or NVR behaviour should they wish to do so.

 

hiktools create header_from_digicap.dav sourcedir

The tool creates a new firmware file by combining the header extracted from the first argument with the contents of the directory from the second argument. Those contents could be files previously extracted, some of which were since modified, or with additional files to be included in the firmware image.

Share this post


Link to post
Share on other sites

Is there a way i can change the hikvision logo in the web interface? and would like to change the model number too if its possible in a firmware for ds-6717hwi encoder.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

×