3

I have a camera with Hikvision firmware. The firmware file has clear text in it, for example, there's a shell script you can see in there that coincides with a shell script when I tellnet in. There's gzip tarball, but that's OK, that's how they are suppose to end up in the camera as it untars at bootup time.

I tried binwalk but comes up with lots of stuff, none if it valid. What I need to do is map what's in the file, break up the pieces, edit what I want, then reassemble it and run the firmware update.

The files seem to be in a UBIFS file system. I can copy the files out from a camera, but trying to figure out how can I replicate what's on the firmware file. I can send a sample firmware file to anyone that can help.

Improve this question
2

2 Answers 2

Reset to default
1

Looking at the first file from the hikvision.com/en/us/download.asp page.

It seems to be simply a linux kernel, followed by several gzipped files, all concatenated.

I took DS-96128&256_Super_NVR_USA_Firmware_v3.0.2_141125 for example can be split using this:

dd if=digicap.dav bs=1 skip=$[0x00390790] | gzip -dc   > minixdsk.bin
mkdir dsk1 dsk2 dsk3
dd if=digicap.dav bs=1 skip=$[0x00639080] | gzip -dc   | tar tf - -C dsk1
dd if=digicap.dav bs=1 skip=$[0x00B397D7] count=603  of=initscript.sh
dd if=digicap.dav bs=1 skip=$[0x00b39a32] | gzip -dc   | tar xf - -C dsk2
dd if=digicap.dav bs=1 skip=$[0x01585324] | gzip -dc   | tar xf - -C dsk3
dd if=digicap.dav bs=1 skip=$[0x017E1F31] count=6966 of=1.bmp
dd if=digicap.dav bs=1 skip=$[0x017e3a67] count=6966 of=2.bmp
dd if=digicap.dav bs=1 skip=$[0x017E559D]  of=rest.bin

you can find the offsets by looking at the hexdump, and searching for gzip header bytes: 1f 8b 08 00

Improve this answer
2
  • 2
    ...or use binwalk to dump all gzip offsets.
    – tibar
    Jan 16, 2015 at 16:24
  • First, thanks for your help. Those compressed tarballs and files exists in the firmware, but they are that way in the camera, not as decompressed files (it decompresses them during bootup). So to me, the digicap.dav is a collection of concatenated files and you found the tarballs and some files. Somewhere there has to be mapping of where files start/end and what their name is so it can process them.
    – carl
    Feb 9, 2015 at 17:42
1

You can also log straight into at least some of the HIKVISION devices as root while they're live. I've only tried it on a DS-2CD2512F-IS, but if you enable ssh through the web interface, you can then ssh in direct to the device's IP as the appropriate user (usually admin). Normally, that'll give you a protected shell with sharply limited commands. However, ssh will take command arguments, and the DS-2CD2512F-IS (at least) will take /bin/bash as a command - which gives you full access. That'll let you do fun things like get a full file listing, modify... pretty much anything, install custom programs, modify the underlying asp and javascript files, read hardware information, et cetera, without having to deal with customizing the firmware.

So something like:

ssh admin@[Camera IP] '/bin/bash'

does wonders.

Improve this answer
1
  • 1
    Sadly, they removed this option from later firmware.
    – Jack Simth
    May 13, 2019 at 15:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.