0

The firmware update page on Hikvision provide .dav files. I've been trying to disassemble these files, but to no success. Binwalk isn't helping here as well. This is what it outputs:

enter image description here

Here's a link to one of the .dav files: Firmware

Any help is appreciated.

1

The .dav file is composed of multiple archives which need to be decompressed. If it's the PE files you are interested in disassembling then consider the following:

If you run binwalk -e digicap.dav and navigate to the _digicap.dav.extracted/ directory, you should see the following:

_digicap.dav.extracted $ ll
total 26724
drwxr-xr-x 3 user01 user01     4096 Aug 27 15:16 ./
drwxr-xr-x 3 user01 user01     4096 Aug 27 15:16 ../
-rw-r--r-- 1 user01 user01      840 Aug 27 15:16 1FAB025
-rw-r--r-- 1 user01 user01  1452355 Aug 27 15:16 1FAB025.7z
-rw-r--r-- 1 user01 user01 25869132 Aug 27 15:16 861E14.zip
drwxr-xr-x 2 user01 user01     4096 Aug 27 15:16 Player_EN/

There are PE binaries present in the Player_EN directory:

$ ll
total 7104
drwxr-xr-x 2 user01 user01    4096 Aug 27 15:16 ./
drwxr-xr-x 3 user01 user01    4096 Aug 27 15:16 ../
-rw-r--r-- 1 user01 user01  146432 Aug 25  2016 AudioRender.dll
-rw-r--r-- 1 user01 user01 1998168 Jul 19  2016 D3DX9_43.dll
-rw-r--r-- 1 user01 user01 3871744 Oct 28  2016 PlayCtrl.dll
-rw-r--r-- 1 user01 user01  352768 Oct 22  2016 SuperRender.dll
-rw-r--r-- 1 user01 user01  847872 Nov  9  2016 VSPlayer.exe

Example hexdump of VSPlayer.exe:

00000000  4d 5a 90 00 03 00 00 00  04 00 00 00 ff ff 00 00  |MZ..............|
00000010  b8 00 00 00 00 00 00 00  40 00 00 00 00 00 00 00  |........@.......|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00  00 00 00 00 f0 00 00 00  |................|
00000040  0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000050  69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000060  74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000070  6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|
00000080  7f 27 dc c1 3b 46 b2 92  3b 46 b2 92 3b 46 b2 92  |.'..;F..;F..;F..|
00000090  1c 80 df 92 38 46 b2 92  1c 80 c9 92 2f 46 b2 92  |....8F....../F..|
000000a0  32 3e 21 92 3c 46 b2 92  3b 46 b3 92 45 44 b2 92  |2>!.<F..;F..ED..|
000000b0  86 09 24 92 3a 46 b2 92  32 3e 27 92 3e 46 b2 92  |..$.:F..2>'.>F..|
000000c0  32 3e 31 92 2c 46 b2 92  32 3e 36 92 25 46 b2 92  |2>1.,F..2>6.%F..|
000000d0  25 14 26 92 3a 46 b2 92  32 3e 23 92 3a 46 b2 92  |%.&.:F..2>#.:F..|
000000e0  52 69 63 68 3b 46 b2 92  00 00 00 00 00 00 00 00  |Rich;F..........|
000000f0  50 45 00 00 4c 01 04 00  34 bb 22 58 00 00 00 00  |PE..L...4."X....|
00000100  00 00 00 00 e0 00 03 01  0b 01 09 00 00 44 02 00  |.............D..|
00000110  00 a8 0a 00 00 00 00 00  57 1e 02 00 00 10 00 00  |........W.......|
00000120  00 60 02 00 00 00 40 00  00 10 00 00 00 02 00 00  |.`....@.........|
00000130  05 00 00 00 00 00 00 00  05 00 00 00 00 00 00 00  |................|
00000140  00 20 0d 00 00 04 00 00  a8 11 0d 00 02 00 00 80  |. ..............|

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.