Hikvision DS-2TP31 series Thermal Camera Teardown - Page 1
Forum section: electronics / general

author: Fraser
author_rank: Super Contributor
timestamp: January 15, 2022, 04:00:09 pm
content: The Patient : Hikvision DS-2TP31 series, working but subject of a TeardownThe Task : To teardown the camera and assess its design, quality and potential for reconfiguration.Will there be pictures ? .... you bet there willCan the Fever Detection camera version be changed to the standard model with greater temperature measurement capability ? ..... Maybe, we will have to see.Background:I recently highlighted that a chap on eBay is selling the Hikvison DS-2TP31B Fever Detection cameras for an excellent price of around £60 plus £10 postage. (he is still selling them) So for £70 you get a camera that normally retails at around £1K ! A bargain ? Well that very much depends upon whether the camera still provides what you need. It has to be a good fit to your tasking otherwise it would be better to buy something like a UTi260B or the lower resolution but lower cost UTi120S. More about what the Hikvision camera offers in terms of temperature measurement later.I was interested in the DS-2TP31B camera as I wanted to know how the claimed measurement accuracy of +/-0.5C between 30C and 45C had been achieved. I was also interested to know what imaging core the camera contained as its 160 x 120 pixel resolution did not seem to fit the current market favourites from Infiray (IRAY) or Guide Sensmart. I doubted that the core was a FLIR Lepton and some investigation suggested that it is most likely a Hikvision 'in-house' core.I now have the opportunity to look inside the DS-2TP31B camera and the owner has given me permission to document the teardown on this forumI am pessimistic with regard to reconfiguring the cameras firmware as I suspect this Fever Detection camera may differ in hardware to that of the standard DS-2TP31 model in order to achieve the greater measurement accuracy. I will see what I can discover in the OS though. This camera needs to still be working when I return it to its owner so I am limited in how far I can go with a teardown and changes to the firmware. I need to be careful with it !So without further comment, lets get to the teardown.The first question asked by many who look at this and the Uni-T cameras is "how do I open the casing ?" The answer is... with care and patience ! These cameras usually have a number of hidden screws securing the case halves. There are normally at least two screws in the bottom of the handle, hidden behind rubber covers, and a number of screws hidden behind the LCD display window. The display window is normally attached to the cameras case with the same sort of strong double sided tape used on mobile phone screens. To remove the plastic display screen you need to warm its perimeter with a hair dyer whilst taking great care to not overheat and warp the screen plastic or camera casing. A screen removal sucker is then used to pull on the plastic screen to lift part of it away from the camera casing. A plastic screen separator (looks like a guitar plectrum) is then inserted between the plastic screen and camara case. Another separator is then used to move along the perimeter of the screen, lifting it away from the casing. Reheating of the adhesive will be needed as you go to allow it to release its grip. The whole plastic screen will come away without damage and the case securing screws will be revealed behind. Place the plastic screen on some 'easy release non stick paper' as found on the rear of shipping labels etc. the adhesive tape will then be re-useableIn the pictures that follow, you will see the hidden screw locations on the Hikvision DS-2TP31B camera and the locations will likely be similar on the Uni-T and Infray cameras. There were no plastic case clips on the Hikvision camera which was nice to see as such can be a pain to release.To the pictures now and I will comment on the design at the end.Fraser

author: Fraser
author_rank: Super Contributor
timestamp: January 15, 2022, 04:13:11 pm
content: The teardown begins.......

author: Fraser
author_rank: Super Contributor
timestamp: January 15, 2022, 04:23:52 pm
content: Continued.....

author: Fraser
author_rank: Super Contributor
timestamp: January 15, 2022, 04:26:39 pm
content: Continued.....

author: Fraser
author_rank: Super Contributor
timestamp: January 15, 2022, 04:30:28 pm
content: Continued......

author: Fraser
author_rank: Super Contributor
timestamp: January 15, 2022, 04:31:50 pm
content: Continued.....

author: Fraser
author_rank: Super Contributor
timestamp: January 15, 2022, 05:02:01 pm
content: So what do I think of the build quality ?I am pleased to say that this is a nicely made camera and I was especially pleased to see extensive use of brass screw inserts in the plastic casing as these are often deleted from a design at the cost reduction phase. The trigger design is well thought through and well engineered. There is a complex rubber cover over the trigger switch to protect it from moisture and dust ingress. Nce to seeThe PCB quality is excellent and I see no evidence of cost reduction being applied to the quality of electronic components used in the camera. Note the use of quality Coilcraft inductors. The main processor is not easily identified from its markings but may be an original part of a cheaper Chinese clone.The microbolometer assembly is a bespoke Hikvision part and is not a 3rd party core. The microbolometer is securely mounted on a quality PCB within a two part metal chassis that also acts as a heatsink via a metal 'finger' projection that contacts the rear of the microbolometer via thermal transfer paste. There is a temperature sensor IC mounted on the front of the metal microbolometer module chassis adjacent to the FFC shutter. The close proximity of this sensor to the FFC shutter assembly is intended to provide an accurate measurement of the FFC shutter temperature for calibration of the the cameras temperature measurement system. An accurate measurement of the FFC shutter temperature is essential in a Fever Detection thermal camera that produces accurate measurements of the target. Any error at this point will be introduced into the measurements of the camera as the FFC shutter behaves like a Blackbody temperature reference in this camera.The metal microbolometer modele chassis is clearly designed to be used in different configurations as it can accomodate a laser marker and a different type of FFC shutter that uses a rotary solenoid actuator rather than than the linear movement type used in this Fever Detection camera. The standard DS-2TP31 camera model incorporates a laser pointer that could not be accommodated with the tall linear FFC shutter design. To fit a laser pointer assembly, the rotary solenoid type FFC shutter would be needed. So why use the linear shutter design on the Fever Detection camera version ? I can only assume that the temperature reference accuracy of the enclosed FFC shutter is superior to that of the free air FFC flag. There is definitely some technical thought and drive behind this designIn precis, I cannot fault the design of this camera. It is a joy to dismantle and has a feel of qaulity engineering about it. Granted it is not in the same class as high end thermal imaging cameras, but compared to the Uni-T thermal cameras, it is a superior design.Fraser

author: Fraser
author_rank: Super Contributor
timestamp: January 15, 2022, 05:09:47 pm
content: For comparison purposes, the Uni-T UTi220A Pro (Believed to be the UTi260B under a different number). Note the lack of brass inserts in the casing plasticsCompare the PCB's as well.Just some points to note about the UTi220A Pro :1. The Lithium Battery is a 2 wire connection so no thermal monitoring, unlike the DS-2TP31 design which is 4 wire.2. The Trigger acts on a main PCB mounted switch rather than on a separate PCB as in the DS-2TP31 design. Not a big deal.3. The thermal window is not fixed into the casing. I prefer the window to be well sealed to the casing.4. I cannot see a metal chassis temperature sensor in the images so the sensor is likely mounted on the PCB for simplicity of build.5. I am not a fan of the visible light camera being mounted on the microbolometers heatsink as these cameras can produce heat that effectively transfers to the microbolometer assembly.The Uni-Trend UTi220A Pro appears to have had an effective cost reduction process applied to it that has reduced the cost of the cameras production. That does NOT mean that the UTi220A Pro is not a good camera ! This is just a comparison of the two camera designs... one oozes good engineering whilst the other is more typical of what to expect at the budget end of the market as production cost reduction is key to low retail price and being competitive in the marketplace.FraserNote:- These images are borrowed from this thread....https://www.eevblog.com/forum/thermal-imaging/uti220a-pro(uti260b)-disassembly/These pictures are the property of "c1400700226" and this is acknowledged.

author: Fraser
author_rank: Super Contributor
timestamp: January 15, 2022, 05:57:25 pm
content: So back to the Hikvision DS-2TP31B camera.......What about its firmware ?From what I can tell from my brief examination of the firmware it has been 'tweaked' to offer the following for Fever Detection.....1. The measurement range is specified as +30C to +45C but the camera actually measures from +25C to +50C2. Measurement accuracy is stated as +/-0.5C compared to the +/-2C of the standard DS-2TP31 model.3. The image displays <+25C or >=50C when out of measurement range but the image is correctly spanned to cover the full temperature range present in the scene between -20C and +150C.4. The saved images contain the full radiometric data of the scene within the -20C to +150C5. Saved images may be analyzed in the free Hikvision iVMS-4800 image analysis software without the Fever Detection measurement limitations.6. The low sensitivity range providing 0C to +550C measurement is not active on the Fever Detection version of the camera.7. There appears to be some form of thermal image stacking being used in the fever Detection camera to improve performance. This impacts frame rate and is very obvious if the camera i panned across a scene.8. The firmware may be upgraded by adding the "Digicap.dav" firmware file to the Micro SD card root. The camera finds the file at boot, installs the update and then deletes the file from the card. The update file is of approximately 5MB in size.9. The firmware file for the standard and Fever Detection versions of the camera are the same but the behaviour of the firmware is defined by other means. This is likely an ID check upon installation of new firmware or fixed configuration files on the camera.10. Access to the OS is not possible via the USB port as that is configured as a bulk memory device.11. There appears to be an engineering port on the cameras main PCB (JD3) This may be an UART serial port and will be investigated. If it is a UART port, OS access may be possible. JD3 may indicate a Diagnostic role for the connector ?12. I expect the camera to be running a compact embedded system version of Linux.Fraser

author: Fraser
author_rank: Super Contributor
timestamp: January 15, 2022, 06:11:58 pm
content: The chipset used in the DS-2TP31 B camera:1. HK 2015- 6 : SOC of unknown ID. Likely an ARM Cortex based SOC (Possibly a Amberella SOC as Hikvision use their IC’s in IP cameras)2. Trion T20F169 : Advanced FPGA IC3. Winbond 25M512JVE : 512Mb (2x256Mb) Serial NOR MCP Flash Memory4. BQ24295 : I2C controlled 3A single Lithium Ion cell charger

author: Fraser
author_rank: Super Contributor
timestamp: January 18, 2022, 08:34:37 pm
content: I have captured the cameras boot sequence via the serial portAs hoped, the 4 pin connector, marked JD3, is a UART Serial port. From top down, the pinout is +3V3, UART Serial In (3V3), UART Serial Out (3V3), 0V. The data settings are 115200 Baud 8,n,1.The UART Serial output presents the boot process and then repeatedly reports that it is looking for an IP AddressThe boot sequence reveals that the unknown SoC IC is the Huawei Hi3518 HD IP Camera SoC.https://cdn.hackaday.io/files/19356828127104/Hi3518%20DataSheet.pdfThe OS is Huawei LiteOS Linux.A cursory look at the boot listing did not reveal any obvious accessing of configuration files that could configure the camera for Fever Detection duties. What did surprise me was how untidy the boot sequence is. Just look at all the errors that are reported. Many appear to be due to missing hardware of software. A bit like a standard generic Linux build that was set up for a task but the unused boot elements were left in place.I attach the boot record in PDF and .txt format in case it is of interest.The beginning of the Boot sequence is reproduced here:System startupU-Boot 2010.06-788427 (Mar 27 2020 - 11:37:08)SPI Nor:"W25M512JV", Block:64KB, Chip:64MBHit Ctrl+u to stop autoboot: 0booting from pri part...Load kernel to 0x81800000 ... Done!## Booting kernel from Legacy Image at 81800000 ...Image Name: LiteOS-0.1.0-e2Image Type: ARM Linux Kernel Image (lzma compressed)Data Size: 5074736 Bytes = 4.8 MiBLoad Address: 80008000Entry Point: 80008000Uncompressing Kernel Image ... OKStarting kernel ...Fraser

author: Flukav
author_rank: Contributor
timestamp: January 25, 2022, 08:58:11 am
content: Hello Fraser,Thank you very much for this teardown and the log file.By any chance, can you identify the connector and protocol used for the screen?

author: tisher
author_rank: Contributor
timestamp: January 25, 2022, 10:48:39 am
content: Any news with configuration file unlock?Other Hikvision thermal camera use ftp for accesshttp://ftp.hikvision.ru/01.%20Firmware/01.%20Hikvision/10.%20Thermal/2.%20How%20to/07%20System/And...http://ftp.hikvision.ru/01.%20Firmware/01.%20Hikvision/10.%20Thermal/2.%20How%20to/07%20System/How%20to%20get%20thermal%20information%20by%20serial%20port.pdfOr we can try to repack firmware with some changeshttps://ipcamtalk.com/threads/hikvision-firmware-tools-change-language-extract-files-and-create-own-firmware.2664/

author: Fraser
author_rank: Super Contributor
timestamp: January 25, 2022, 11:55:32 am
content: Flukav,The connector is a standard ZIF type and the boot record includes the ID of the LCD controller IC within the LCD panel. IIRC the protocol was MIPI but I will need to check.I will add the LCD connector pin count and internal controller ID here later as I do not have it to hand.Fraser

author: Fraser
author_rank: Super Contributor
timestamp: January 25, 2022, 12:08:59 pm
content: Tisher,The other firmware access that you detail is for IP cameras that naturally have an easy access port into the cameras OS. The handheld camera does not offer network connectivity and the firmware fails to find network connectivity hardware in its boot sequence.I was thinking the same regarding modifications to the firmware and uploading a modified version to the camera. I have not tried the firmware modification tool yet. The issue will be whether the firmware in the handheld camera is close enough to that used in the IP cameras to be compatible with the firmware tools.Note that it is not a special firmware version that sets the characteristics of the camera. The standard ‘non Fever Detection’ camera firmware will install on the Fever Detection Camera but once installed, it’s configuration is set for Fever Detection. Either the firmware installation process configures the update as it is being installed, or the firmware is standard and reads something inside the camera as it boots to configure it for Fever Detection duties. This is why I studied the boot log but nothing to configure the camera was found. I suspect there is an ID somewhere in the camera that is read by the firmware but I do not know where yet. To revert the Fever Detection camera to a standard configuration may require editing of the Cameras internal ID, if such exists, or editing of the firmware to set standard firmware operation when it sees a Fever Detection Camera ID.The standard camera firmware was not on the Hikvision web site but I found it in the Hikmicrotech site. The cameras true hardware platform name is “E1L”https://www.hikmicrotech.com/en/download/5Fraser

author: Fraser
author_rank: Super Contributor
timestamp: January 25, 2022, 12:21:31 pm
content: The LCD display COG controller is an ST7789V. The boot log makes reference to a MIPI interface protocol so the LCD protocol could be MIPI ?https://www.newhavendisplay.com/appnotes/datasheets/LCDs/ST7789V.pdfFraser

author: tisher
author_rank: Contributor
timestamp: January 25, 2022, 12:22:39 pm
content: and herehttp://ftp.hikvision.ru/01.%20Firmware/01.%20Hikvision/10.%20Thermal/1.%20Firmware/"2TP Handheld Series" ?

author: Fraser
author_rank: Super Contributor
timestamp: January 25, 2022, 12:28:17 pm
content: Tisher,Interesting, that firmware link you just shared is for a 2TP31 with a hardware ID of “E2L” That firmware is also older than the Fever Detection camera firmware that was loaded on my test camera. 2019 vs 2020I shall have to investigate.

author: tisher
author_rank: Contributor
timestamp: February 08, 2022, 08:53:19 pm
content: Any good news?i try to decrypt digicap.dav file with know tools but no success for nowhttps://ipcamtalk.com/threads/mcr-hikvision-packer-unpacker-for-5-3-x-and-newer-firmware.15710/

author: Fraser
author_rank: Super Contributor
timestamp: February 08, 2022, 08:57:29 pm
content: With regret other tasking has taken priority and I have Not had time to look further into the firmware side of this camera yet.Fraser

author: knedit
author_rank: Newbie
timestamp: April 23, 2022, 05:30:05 pm
content: Anything new on being able to give these units more capabilities? they seem identical physically and with more of them showing up on ebay this is likely going to have more demand.

author: Fraser
author_rank: Super Contributor
timestamp: April 24, 2022, 11:58:25 am
content: Sadly nothing to report on the firmware front. From what I understand of the design, it is using Busybox with Hikvision specific code overlayed. Hikvision are not the tidiest of programmers so the camera firmware may be vulnerable to modification, but Hikvision have made life difficult by using encryptionThese cameras are currently locked into a fever detection specification and image processing mode, with no easy way to change that configuration. Installing the standard firmware package does nothing as the firmware just configures itself as a fever detection versionI would need to spend a lot of time reverse engineering the accessible code in the camera and sadly I am engaged in higher priority tasking at the moment. I will PM you the current situation for me.

author: daisizhou
author_rank: Super Contributor
timestamp: April 24, 2022, 02:34:12 pm
content: Hi Do you have a plan to recompile the firmware to make the measurement range larger, suitable for maintenance and inspection PCB or other plans?If it can be turned into infrared detection use, it will be a cheap test tool

author: Fraser
author_rank: Super Contributor
timestamp: April 24, 2022, 03:08:15 pm
content: Sadly no plans at the moment. Decompiling the firmware is likely beyond my skill set as I am a hardware tech and not a coderYou are quite correct though… this would make a bargain purchase if it can be reverted to the standard DS-2TP31 version with twin temperature ranges and disablement of the image stacking feature.As supplied, the fever detection version is a very accurate at Radiometric thermal camera covering the measurement range 25C to 50C. Such would be useful to a Veterinary practitioner and wayyyy cheaper than dedicated Vet camerasThe displayed and saved images are not temperature range limited and will show all temperatures in the range -20C to +150C. It is only the on-board measurement feature that is limited in this respect. To measure the pixel temperatures outside the Fever range, you have to look at ten saved image using the free image analysis software. At £70, delivered, I still find this well made thermal camera to be a bargainIt’s measurement accuracy without the use of a fixed temperature reference is truly impressive. Hikvision clearly put Some decent thought into how to achieve better accuracy through a combination of temperature calibration , hardware and firmware improvements.Fraser

author: daisizhou
author_rank: Super Contributor
timestamp: April 24, 2022, 03:32:29 pm
content: This kind of tester for measuring temperature, the most critical indicators are temperature drift and interference.Is it out of range especially when measuring in sunlight and when measuring in an air-conditioned room.The experience of using Uni-T is very poor.Now many places are using infrared thermometers to test body temperature due to new virus testing, but there is a big error in this measurement.They're just there to get the job done, not to measure everyone's temperature accurately。looks like a scam.Only through a lot of long-term use, see how the stability works.If it is indeed stable and accurate, it is meaningful to improve

author: Fraser
author_rank: Super Contributor
timestamp: April 24, 2022, 04:06:46 pm
content: Hikvision cleverly incorporated a very accurate FFC shutter design that is used as a calibration reference for the microbolometer measurement process. The standard DS-2TP31 camera uses a conventional “free air” open FFC flag that is vulnerable to temperature errors at the point of flag temperature measurement. Image stacking also appears to have been employed but I do not know the exact purpose of this except to create an average sample for measurement.I totally agree that the use of thermal imaging cameras was a mixture of science and ‘wishful thinking’ It is very difficult to accurately measure a human's core temperature at a distance, using a thermal camera.That is a topic that has been covered before on this forum though. What impressed me with ten DC-2TP31B was that the design had been enhanced in hardware and firmware to provide meaningful non contact measurements of good accuracy. How accurate the camera is over the full range of ambient temperature, I have not tested. Like some thermal camera manufacturers, Hikvision realised that a weakness in many modern budget thermal cameras was the thermal differential between the FFC flag and the temperature sensor used to enter mine it’s surface temperature. An error in this measurement is transferred to ten measurement system and introduces that error into it. Hikvision positioned a small temperature sensor in a ‘garage’ that reps the FFC shutter at a stable temperature away from air currents. The sensor obtains a reasonable measurement of the shutters surface temperature as a result. Nice ideaAs the the accuracy of any master reference for temperature….. that is not known to me at this time. I can say that my test DS-2TP31B easily met the stated specification of measurement accuracy when tested against a Professional Blackbody of known accuracy and emissivity. The permitted error was +/-0.3C between 30C and 45C. My sample unit had an error of +0.1C at 40C in an ambient of 21C and this level of error starts to challenge the accuracy of the Blackbody so an error can be in the cameras measurement, or the Blackbody control loop/deviation etc.

author: Tim Foo
author_rank: Newbie
timestamp: February 04, 2023, 03:24:39 pm
content: Before you open up your UTi260B watch this firsthttps://youtu.be/1yYN5GsLT3wThis morning my UTi260B overheated during charging. I always monitor my USB charging and it went to something like 3.5A! That's what trigger my interest.After disconnecting the charger, I placed the unit in a safer location (outdoors) as a precaution against any possibility of the unit going up in flames. Some spots are hot to the touch. The hottest spot is near the (finger) trigger switch is in excess of 54°C, measurement done with an IR Thermometer about 20 min after disconnection. It took me a bit of time to recompose myself after moving the unit.5 hours latter after letting the unit to cool down, as expected that unit wouldn't startup.I would now recommend everyone to exercise caution when charging thier UTi260Bs. It may be sensible to place the unit in some place where any fire dammage can be controlled in case the battery chargging goes wrong.I will attempt opening the unit up very soon.Meanwhile I am open to any advice.

author: vip23
author_rank: Newbie
timestamp: September 04, 2023, 12:42:01 pm
content: Hello. Found this menu, maybe it will help. Back button three times, up once.

author: nikitasius
author_rank: Regular Contributor
timestamp: September 30, 2023, 09:07:55 am
content: Some folks selling it 600€The 31B model 🤣🤣

author: Fraser
author_rank: Super Contributor
timestamp: September 30, 2023, 10:46:06 am
content: The DS-2TP31B model was a higher priced version of the DS-2TP31 aka E1 camera. The cost was likely due to the “COVID-19” effect on pricing and also the specialist nature of the camera. Whilst it is true that I bought several brand new DS2TP31B cameras at only £60 each, that was just one of those bargains that I stumbled across as the Pandemic began to recede and also people realised that thermal cameras were not the panacea to COVID-19 detection that they once thought they were. I have not seen that great price repeated. I believe it was a surplus dealer who had bought a large number of units and was just dumping them onto the market. He said as much to me and claimed I would never find a lower price.It is true that the DS-2TP31B has a limited temperature measurement range but thankfully it still offers the full high sensitivity range for the actually imaging that it produces. It is still perfect for things like PCB repair where you are looking for the hot component when injecting a voltage. For £60 they were an absolute bargain. Added to that, they are very accurate for measurements between +20C and +50C which is still a useful range. They also lend themselves to spotting wildlife in the garden. I would think that they would be great for VET work as well as VETS are looking for soft tissue issues that fall within the cameras measurement capabilities.It does not surprise me that some of these DS-2TP31B cameras are still for sale at high prices. They were not cheap to buy into stock and some dealers are trying to recover their investment so advertise them at cost of higher. They likely hope for another peak in Covid-19 events that might stimulate sales again. I will not knock someone for trying to recover their investment. Some sellers on eBay may have seen the original RRP and are thinking the cameras are still worth that sort of money. The market price of this specialist version of the DS-2TP31 is highly unstable and there are bargains to be hadI just bought the DS-2TP21B which is the bigger brother to the 31B. It is the COVID-19 fever detection version of the HikMicro M10 camera. Still 160 x 120 pixels, but a more capable camera with manual focus, touch screen, Wireless connectivity, video recording, many measurement functions, decent IFOV and it actually measures from 0C to +100C (tested by me). That has turned out to be a really nice thermal camera that is perfect for PCB work etc. I bought it, new in its hard case with two batteries, a desk charger and power supply for only £220. There is another of these cameras on eBay UK at the moment for £300. Still not a bad price for what it offers the user. The RRP on the DS-2TP21B was over 7000 EurosIt can now be bought from UK dealers for prices ranging from just over £1.5K to £3K. The prices were highly inflated during the Pandemic.https://www.conrad.com/p/hikvision-ds-2tp21b-6avfw-ir-camera-30-up-to-45-c-160-x-120-pixel-wi-fi-fever-detection-2251776Fraser

author: Fraser
author_rank: Super Contributor
timestamp: September 30, 2023, 10:59:59 am
content: Link to the DS-2TP21B auction.Consider the specification carefully and make your own decision on whether it offers value for money in the current market. I like mine, but that is because it meets my needs. Your needs may be different !https://www.ebay.co.uk/itm/256066753767?mkcid=16&mkevt=1&mkrid=711-127632-2357-0&ssspo=PxmtoXM_Ryu&sssrc=4429486&ssuid=BgpdXaaLSkK&var=&widget_ver=artemis&media=COPYHe is asking £300 or offers. I tried £200 and it was declined. I believe he will more likely accept something like £280.I have no connection to the seller or the camera they are offering.Fraser

author: Fraser
author_rank: Super Contributor
timestamp: September 30, 2023, 11:03:36 am
content: The next cheapest price I found on eBay was £549. To me that is getting into serious money for the resolution offered and I would not consider it a bargain at that price. Another seller on eBay UK wants £3.3K for this camera !https://www.ebay.co.uk/itm/234831838047?mkcid=16&mkevt=1&mkrid=711-127632-2357-0&ssspo=P_cEFmGMRQy&sssrc=4429486&ssuid=BgpdXaaLSkK&var=&widget_ver=artemis&media=COPYhttps://www.ebay.co.uk/itm/234476142785?mkcid=16&mkevt=1&mkrid=711-127632-2357-0&ssspo=L7ng4TgNRhG&sssrc=4429486&ssuid=BgpdXaaLSkK&var=&widget_ver=artemis&media=COPY

author: Fraser
author_rank: Super Contributor
timestamp: September 30, 2023, 11:07:55 am
content: A refurbished HikMicro M10 that has the full measurement range plus torch and laser function active is available for £779….https://www.ebay.co.uk/itm/235130267978?mkcid=16&mkevt=1&mkrid=711-127632-2357-0&ssspo=v18jirrrqzq&sssrc=4429486&ssuid=BgpdXaaLSkK&var=&widget_ver=artemis&media=COPYStill serious money for a 160 x 120 pixel camera though. I provide these prices only as a guide to the market price and to show the great price variation across the market.There are bargains to be had but you need to keep your eyes open to spot them before some else does.

author: Fraser
author_rank: Super Contributor
timestamp: September 30, 2023, 11:20:58 am
content: I am not going to defend the RRP of COVID-19 fever detection versions of thermal cameras but there may be some justification in the higher prices beyond just the specialist nature of the camera version and market demand at a time of crisis.I recently saw a comment on a UK thermal camera dealers site detailing the two available purchase options…… Ex Factory and Calibration Checked. The comment stated that thermal cameras come out of the factory without a calibration certificate as the factory production processes normally provide a camera that makes measurements that fall within its stated tolerances. It was stated that this was a belief of compliance and accuracy, rather than a proven fact….. just like CE marking ! The dealer stated that where the measurements of a cameras measurements need to be of known, proven accuracy, a calibration check and associated certificate is available at additional cost.With the above in mind, it is plausible that the Covid-19 fever detection cameras with their claimed enhanced measurement accuracy of +/- 0.5 Celsius (+/- 0.3 Celsius if a Blackbody is used) tolerance may have undergone enhanced calibration at the time of production to ensure accuracy. Such calibration can be time consuming so additional cost of production may result. I have no insight into the production of the fever detection versions of cameras beyond noting the hardware enhancements that were employed to improve measurement accuracy.As a side note, the DS-2TP21B provides a measurement calibration enhancement option in the menu. The camera is pointed at a known accurate Blackbody with Emissivity, distance and temperature known, and a measurement calibration correction is stored. A nice feature to have and one not offered on the DS-2TP31B camera. Such a user accessible feature would be great on all thermal imaging cameras that are capable of taking temperature measurements.

author: Fraser
author_rank: Super Contributor
timestamp: September 30, 2023, 11:52:44 am
content: To show how times have changed….I was watching an auction for a Guide IR T120H COVID-19 fever detection camera as the priced dropped over time. The camera is from the guide IR entry level series so is pretty basic. The resolution is 120 x 90 pixels provided by the Guide Sensmart TIM120 core. The “H” version firmware is heavily modified and offers two modes of operation to detect Fever in humans….. Portrait mode and bulk surveillance mode (my terms, not Guide’s). The portrait mode provides the outline of a face that the user must align with the person being tested. The bulk surveillance mode is more like a normal thermal camera and the measurement function highlights hottest target in view. The temperature measurement range is restricted to improve accuracy. Sadly only one colour palette is available and it is tuned fir fever detectionI saw that the T120H that I was watching had dropped to £80 on eBay. Some years ago I would have bought that in the blink of an eye…. But not any more. My analysis of that camera was that it’s 120 x 90 pixels was a serious restriction on its usefulness when the wide FOV lens was also considered. The fact that there was only the one colour pallet was a real downer for me, and this was a very basic camera that may be purchased from China for around £200 in its normal T120 general use format. I considered £80 too much to pay for a thermal camera with such limitations. The market has virtually exploded with affordable thermal imaging cameras so we can afford to be picky when it comes to hunting for bargainsSomeone bought the £80 T120H camera after it being listed for many weeks. Their use case may mean that it was an excellent buy for them. I certainly hope so. That camera could be used for PCB work if a close up lens were fitted. £80 is not much to pay for the benefit that a thermal camera provides when examining faulty laptops etc. Absolute temperature measurements are less important than seeing hot spots worthy of further investigation.https://www.ebay.co.uk/itm/295942607142Some may recall that I bought two camera modules from Dahua fever detection tablet kiosks. The seller did not know what they were and I took a risk that the cores within the metal casings might be useful. It turned out that the two metal camera cases contained the Guide IR MobIR AIR USB C thermal camera Dongles. They contain the same TIMO 120 core as the T120H camera. The cameras work with a mobile phone but are the fever detection model so need the fever detection APP for accurate temperature measurements. They work with the standard MobIR AIR APP but measurements are incorrect. Each of those Dahua camera modules cost me only £18.As a warning though….. I have investigated other Fever Detection kiosk solutions and determined that they use sensors like the Melexis MLX series that provide resolutions of only 32 x 24 pixels, or even less, with a slow response time. Be careful what you buy …. Do your research !Fraser

author: nikitasius
author_rank: Regular Contributor
timestamp: September 30, 2023, 06:24:14 pm
content: Thanks for info Fraser 👍But i still wanna find 17um hikvision for less than 80€ 😁It's kind of fun, négociations etc.

author: nikitasius
author_rank: Regular Contributor
timestamp: September 30, 2023, 08:54:49 pm
content: Just got brandnew 31B for 80€ + 7€ (delivery & insurance).Well, lets see next week if it's match the description, online is always risky 😁

author: nikitasius
author_rank: Regular Contributor
timestamp: October 06, 2023, 07:17:09 pm
content: Here is my Hikvision DS-2TP31B-3AUFThanks Fraser to show me this pearl, it's awesome camera!And for 87€ (delivery included) it rocks!Here is gdrivehttps://drive.google.com/drive/folders/1Meb7P2H3lyOa8La_MXdfiYTKUNFuYO-3Upd: compared 17μm pixel w/ 12μm w/ hand on the wallhttps://drive.google.com/file/d/1NP0NU7LH1SF9pdlrSCEn-YjvY02wud7L/view

author: nikitasius
author_rank: Regular Contributor
timestamp: October 07, 2023, 05:59:24 pm
content: Well, even if it display 25-45 range in UI it saves full range.On last picture it's a tea from Tefal's teapot (w/ green tea inside).89.7°C could be pretty close to real.All pictures i took w/ default settings

author: Fraser
author_rank: Super Contributor
timestamp: October 07, 2023, 06:51:40 pm
content: Yes, I noticed that the saved images are fully radiometric and contain the full temperature range rather than the limited one shown on the display. As Bill-W commented, it is likely that the firmware was just changed to only show the Fever Scanning range of temperatures and I hoped to modify the firmware to eliminate that restriction on measurement. Sadly Hikvision firmware updates are encrypted so I have not been able to dig into them. With regard to accuracy, I believe much of the accuracy gains come from the use of a better FFC flag as a temperature reference and likely a factory calibration that is targeted at the fever detection temperature range to achieve greatest accuracy. Such a limited range calibration sill locks the Radiance to Temperature unit curve to the values that came out of ten microbolometer ROIC at time of calibration. The accuracy at temperatures higher and lower than that restricted range will still be pretty accurateI really like the DS-2TP31 camera. It is well built and produces very good images co side ring it’s 160 x 120 pixel resolution. Hikvision chose wiseLy when it came to the lens FOV. From memory, the IFOV is similar to one of my 320 x 240 pixel cameras that are fitted with much wider angle lenses. I have used my camera for PCB thermal imaging and it does benefit from a close up lens and produces good imagery. That said, I recently bought the DS-2TP21B (basically a modified HikMicro M10) for £220. The 21B is also 160 x 120 pixel resolution but it has the advantage of a manual focus lens and large touch screen displayThe close focus capability of the 21B lens means I do not need a close up lens for PCB workThe 21B and 31B are well worth considering if found at a good price, as was the case for me and you NikitasiusI used the DS-2TP21B to diagnose a shorted MLCC in a £5000 rugged laptop this week. It makes life soooo easyI own a FLIR E40 (upgraded to E60+) but would not hesitate to pick up the 21B, or even the 31B for a PCB repair. As a side note, it is interesting that the 21B allows the display of temperatures outside the fever detection range, yet the 31B does not.Fraser

author: nikitasius
author_rank: Regular Contributor
timestamp: October 07, 2023, 08:52:55 pm
content: I've seen the forum you posted where folks discuss about modding hikvision firmwares. There almost 50+ pages to read lol 🤓I will read next week to see where we are and is there are any progress to do w/ that firmware.Btw here is mine (S/N photoshopped).Aren't updated yet:• maybe there are exploits for the old firmwares• maybe i can make telnet working, there are option in settings but i see no telnet, ever no com via usb (like i have w/ chinese walkietalkies).

author: nikitasius
author_rank: Regular Contributor
timestamp: October 08, 2023, 05:30:38 pm
content: Quote from: tisher on January 25, 2022, 10:48:39 amWell, just checked, it doesn't unpack E1 firmwares.We need hik_pack by leecher which is wiped out from ipcamtalk forum. If to do easy way.

author: nikitasius
author_rank: Regular Contributor
timestamp: October 08, 2023, 06:04:53 pm
content: Here is our header 02KHhttps://ipcamtalk.com/threads/02kh-firmware-header.10313/Here is an example about 03KHhttps://ipcamtalk.com/threads/you-go-hang-zhou-r6-camera-ds-2cd2x42-firmware-encoding-method.11516/

author: vip23
author_rank: Newbie
timestamp: April 22, 2024, 11:20:44 am
content: The time and date settings are lost. Can you tell me what battery is installed?

author: Fraser
author_rank: Super Contributor
timestamp: April 22, 2024, 07:36:58 pm
content: These cameras often use a rechargeable Lithium cell so yours may just need the camera to be used to recharge the cell.If the cell has failed (which would be surprising for these cells) you can just measure it’s dimensions and buy the nearest physical size of tagged rechargeable Lithium button cell that you can find.https://www.sii.co.jp/en/me/battery/products/ms-lithium-2/#:~:text=OUTLINE,and%20highly%20stable%20overdischarge%20characteristics.

author: Fraser
author_rank: Super Contributor
timestamp: April 22, 2024, 09:05:28 pm
content: I just checked my image archives for this camera and the cell is a "ML" series rechargeable LiMnO2 type. You just need the cells dimensions to match it to the correct cell in the series (dimensions form the part number as with non-rechargeable Lithium button cells). Useful details are provided in the Wiki page for button cells.https://en.wikipedia.org/wiki/Button_cellThe cell should not have failed this soon so it would be worth checking that it is not just discharged due to a lack of use. Also check that the cells very low current trickle charging circuit is working to keep it charged whilst the camera is in use.

author: Fraser
author_rank: Super Contributor
timestamp: April 22, 2024, 10:19:01 pm
content: A possible candidate for this cell….. the ML414Hhttps://www.sii.co.jp/en/me/datasheets/ms-rechargeable/ml414h/

author: pixar
author_rank: Newbie
timestamp: May 09, 2024, 09:18:34 am
content: Hi together,Fraser, thanks for your awesome teardown. I am following you already with the FLIR E4 hack and now also tried to play around with the Hikvision.Some insights from me:- next to the UART port that looks like a port for ethernet, not sure how useful this is, but potentially can be used to play around more- the things you can do with UART are pretty limited. Hikvision asks for a password pretty soon if you want to go into the "debug" mode (similar to here:https://ipcamtalk.com/threads/hikvision-ds-7816nb-how-to-enter-debug-mode.55472/)These are the supported commands:Code:helpSupport Commands:printPartprtHardInfosetIpsetV6ipsetGatewaydspStatusgetDebugsetDebuggetIpifconfignetstatpingcpuptaskfreehelpdebugIterating through the commands:Code:printPartprintPart:command not foundCode:prtHardInfoStart at 1970-01-01 00:11:00Serial NO :DS-2TP31B-3AUF20200515AAWRE42106159V5.4.22 build 200325NetProcess Version:Db Encrypt Version: 131072hardwareVersion= 0x0hardWareExtVersion = 0x0encodeChans= 1decodeChans= 1alarmInNums= 0alarmOutNums= 0ataCtrlNums= 0flashChipNums= 0ramSize= 0x40networksNums= 1language= 1devType= 0xa41402net reboot count= 0Path: /Camera/Thermography/Software/Branches/Thermal_develop_branch/LiteOS_for_temp_baselineLast Changed Rev: 787287Last Changed Date: 2020-03-25 16:08:12 +0800 (Wed, 25 Mar 2020)Code:dspStatusget_dsp_status: buf=8113eb94, len=20480, arg0=0, arg1=0<lib>dsp_build_time: Day(2020-3-5),Time(21:8:46)************************************** DSP status *************************************** ENC Chan info.----------------------------------------------------------------------------------------------------------------ChanEncEncVEncAEncVEncAVISignalVideoNumBpsBpsBpsFpsFpsFpsStatusStandard0:1411141102500FALSEVS_PAL----------------------------------------------------------------------------------------ChanVIEncVEncASubPre0Pre1Pre2DataVIPCDFDNumLostLostLostLostLostLostLostLostResetStatusStatus0:000000000FALSEFALSECode:ifconfigloip:127.0.0.1 netmask:255.0.0.0 gateway:127.0.0.1HWaddr 00 MTU:0 Runing Link Down# #Code:netstat========== total sockets 128 ====== unused sockets 122 ==========Proto Recv-Q Send-Q Local Address Foreign Address Statetcp 0 0 0.0.0.0:554 0.0.0.0:0 LISTENtcp 0 0 0.0.0.0:8000 0.0.0.0:0 LISTENtcp 0 0 127.0.0.1:443 0.0.0.0:0 LISTENtcp 0 0 127.0.0.1:80 0.0.0.0:0 LISTENProto Recv-Q Send-Q Local Address Foreign Addressudp 0 0 0.0.0.0:13724 0.0.0.0:0udp 0 0 127.0.0.1:9473 0.0.0.0:0# #I was not able to access the webservers yet...Code:ping 127.0.0.1Reply from 127.0.0.1: time=1ms TTL=255Reply from 127.0.0.1: time<1ms TTL=255Reply from 127.0.0.1: time=1ms TTL=255Reply from 127.0.0.1: time<1ms TTL=255--- 127.0.0.1 ping statistics ---4 packets transmitted, 4 received, 0 loss# #Code:cpupSysCpuUsage in 10s: 74.2# #Code:taskName TID Priority Status StackSize WaterLine StackPoint TopOfStack EventMask SemID CPUUSE CPUUSE10s CPUUSE1s MEMUSE---- --- -------- -------- --------- ---------- ---------- ---------- --------- ----- ------- --------- --------- -------Swt_Task 0x0 0 QueuePend 0x6000 0x3a0 0x81121d50 0x8111bde0 0x0 0xffff 1.8 1.7 1.7 0IdleCore000 0x1 31 Ready 0x800 0x5c 0x811225a4 0x81121e00 0x0 0xffff 24.7 26.0 26.5 0system_wq 0x2 1 Pend 0x6000 0x130 0x81129658 0x811236e8 0x1 0xffff 0.0 0.0 0.0 0app_Task 0x3 10 Delay 0x6000 0xa58 0x8112f650 0x81129700 0x1 0xffff 0.0 0.0 0.0 1247160USB_FMASS_Task 0x4 10 Pend 0x6000 0x370 0x814432a8 0x8143d358 0x1 0xffff 0.0 0.0 0.0 2507464ipc_watchdog 0x5 3 Delay 0x5000 0x138 0x815435e0 0x8153e678 0x0 0xffff 0.0 0.0 0.0 104himci_Task 0x6 10 Ready 0x1800 0x150 0x81144310 0x81142ba8 0x0 0xffff 0.0 0.0 0.0 0jffs2_gc_thread 0x7 10 Pend 0x1000 0x128 0x81156730 0x811557b8 0x3 0xffff 0.0 0.0 0.0 0jffs2_gc_thread 0x8 10 Pend 0x1000 0x340 0x8115e5d0 0x8115d658 0x3 0xffff 0.0 0.0 0.0 -4044jffs2_gc_thread 0x9 10 Pend 0x1000 0x128 0x81167cc8 0x81166d50 0x3 0xffff 0.0 0.0 0.0 0jffs2_gc_thread 0xa 10 Pend 0x1000 0x128 0x8116fe68 0x8116eef0 0x3 0xffff 0.0 0.0 0.0 0power_button_task 0xb 1 Pend 0x6000 0x130 0x81175e78 0x8116ff08 0x1 0xffff 0.0 0.0 0.0 0tcpip_thread 0xc 5 PendTimeOut 0x6000 0x310 0x8117c720 0x81176828 0xf 0xffff 0.1 0.1 0.1 2880shellTask 0xd 9 Running 0x3000 0xba0 0x81185a24 0x81182e08 0xfff 0xffff 0.0 0.0 0.0 2100356cmdParesTask 0xe 9 Pend 0x1000 0x170 0x81186d50 0x81185e20 0x1 0xffff 0.1 0.0 0.0 476mmc_data_thread 0xf 6 PendTimeOut 0x800 0x1c0 0x8120f320 0x8120ebe0 0x4 0xffff 0.0 0.0 0.0 0bcache_async_task 0x10 12 Pend 0x3000 0x1f0 0x81432938 0x8142f9e0 0xf 0xffff 0.0 0.0 0.0 0USB_GIANT_Task 0x11 5 Pend 0x6000 0x150 0x814492c0 0x81443370 0xf 0xffff 0.0 0.0 0.0 0USB_NGIAN_Task 0x12 2 Pend 0x6000 0x150 0x8144f2e0 0x81449390 0xf 0xffff 0.0 0.0 0.0 0USB_EXPLR_Task 0x13 5 Pend 0x6000 0x4c8 0x814552f8 0x8144f3a8 0xf 0xffff 0.0 0.0 0.0 2008USB_CXFER_Task 0x14 5 Pend 0x6000 0x150 0x8145b318 0x814553c8 0xf 0xffff 0.0 0.0 0.0 0USB_SWTCH_Task 0x15 10 Ready 0x6000 0x110 0x81461370 0x8145b3e0 0x0 0xffff 0.0 0.0 0.0 0ipc_reboot 0x17 3 Delay 0x5000 0x1c0 0x81548570 0x81543690 0x0 0xffff 0.0 0.0 0.0 0ipc_dsp_init 0x18 0 Delay 0x20000 0xa38 0x815c6ab8 0x815a6b50 0x0 0xffff 0.0 0.0 0.0 3487296ifr_source 0x19 2 PendTimeOut 0x20000 0xbe0 0x81927020 0x81907490 0x1 0xffff 63.6 64.0 64.0 188Dsp_Encode 0x1a 2 PendTimeOut 0x20000 0xd98 0x81947148 0x819274b0 0x0 0x11f 1.3 1.3 1.3 1484Dsp_OsdRefresh 0x1b 5 Delay 0x20000 0xa80 0x81967408 0x819474c8 0x1 0xffff 1.5 1.2 1.1 0TSK_ViSignal 0x1c 10 Delay 0x20000 0x658 0x81987450 0x819674e8 0x0 0xffff 0.0 0.0 0.0 0Dsp_Timer 0x1d 2 Delay 0x20000 0x1f8 0x819a7478 0x81987500 0x0 0xffff 0.3 0.3 0.3 0Shutter_Process 0x1e 10 Ready 0x20000 0x930 0x819c7460 0x819a7520 0x0 0xffff 0.2 0.1 0.1 120K_MatrikProcess 0x1f 10 Ready 0x20000 0x158 0x819e7490 0x819c7538 0x0 0xffff 0.0 0.0 0.0 0K_MatrikProcess 0x20 10 Ready 0x20000 0x160 0x81a074a8 0x819e7558 0x0 0xffff 0.0 0.0 0.0 0TSK_BPC_Process 0x21 10 Ready 0x20000 0x160 0x81a274c0 0x81a07570 0x0 0xffff 0.0 0.0 0.0 0TSK_PCC_Process 0x22 10 Ready 0x20000 0x168 0x81a474d8 0x81a27590 0x0 0xffff 0.0 0.0 0.0 0TM_Process 0x23 10 Ready 0x20000 0x2890 0x81a673e0 0x81a475a8 0xf 0xffff 3.9 3.7 3.5 832TSK_RawDataProcess 0x24 10 Ready 0x20000 0x6b8 0x81a87520 0x81a675c8 0x0 0xffff 0.1 0.1 0.0 604Dsp_SaveRawData 0x25 5 Delay 0x20000 0x140 0x81aa7550 0x81a875e0 0x0 0xffff 0.0 0.0 0.0 0Dsp_EncRoi 0x26 5 Delay 0x20000 0x678 0x81ac7550 0x81aa7600 0x0 0xffff 0.0 0.0 0.0 0ipc_appweb 0x27 7 Delay 0x8000 0xd58 0x81acf558 0x81ac7618 0x0 0xffff 0.0 0.0 0.0 85880menu_logo_thd 0x28 7 QueuePend 0x8000 0xa38 0x81b03210 0x81afb3e8 0x0 0xffff 0.4 0.3 0.2 54472thm_cameralib_send 0x29 16 QueuePend 0x5000 0x390 0x81b09b58 0x81b04ca8 0x0 0xffff 0.0 0.0 0.0 0ipc_blueled 0x2a 13 Ready 0x5000 0x128 0x81b0ec38 0x81b09cc0 0x0 0xffff 0.0 0.0 0.0 0ipc_usrSucurty 0x2b 16 Delay 0x5000 0x150 0x81b98478 0x81b93528 0x0 0xffff 0.0 0.0 0.0 0ipc_hdtaskctrl 0x2c 10 QueuePend 0x5000 0xb00 0x81b9f868 0x81b9b128 0x0 0xffff 0.0 0.0 0.0 1148ipc_sdctrl 0x2d 16 Delay 0x5000 0x968 0x81ba4ff8 0x81ba0140 0x0 0xffff 0.0 0.0 0.0 11648ipc_dvrNetServ 0x2e 7 Pend 0x5000 0x260 0x81bad820 0x81ba89e0 0xf 0xffff 0.0 0.0 0.0 700streamRecv 0x2f 16 Ready 0x5000 0x1740 0x81bc5048 0x81bc0e10 0x0 0xffff 0.2 0.2 0.3 107648events 0x31 7 PendTimeOut 0x10000 0x6fc 0x81adf410 0x81acf638 0x0 0xeb 0.0 0.0 0.0 -19856key_event_interface 0x32 7 QueuePend 0x8000 0x638 0x81bde120 0x81bd6278 0x0 0xffff 0.0 0.0 0.0 1136key_listen 0x33 7 Pend 0x8000 0x698 0x81be60b8 0x81bde290 0x0 0xed 0.0 0.0 0.0 916monitor_eth0 0x34 16 Ready 0x5000 0x8d8 0x81c1ba90 0x81c16bb0 0x0 0xffff 0.3 0.0 0.0 21908is_multi_eth 0x35 16 Ready 0x8000 0x1220 0x81c23168 0x81c1bbd0 0x0 0xffff 0.3 0.0 0.0 0ipc_svchandler 0x36 7 PendTimeOut 0x5000 0x6a0 0x81c28a28 0x81c23be8 0x0 0x12b 0.0 0.0 0.0 868# #Code:freetotal used freeMem: 15792896 13836396 1956500text data rodata bssMem: 6914048 220572 2064384 8488164# #Getting more powerful access requires a password (see link above). This is impossible to get, without the private key of hikvision, as it uses RSA.Code:debugCQAAAAAAAAAAAASFlkI=Password: abcHI_MPI_CIPHER_RsaPublicDec,3037: Error, u32InLen != u32KeyLen.HI_UNF_CIPHER_RsaPublicDec failedIncorrect Password. 2 Times Left# #Increasing the log levelCode:setDebug -hsetDebug : Set debug parm. module name is nessarye.g. setDebug -l 2 -m rtsp -d 111-l, --level range is 0~7:0:NON1:SYS_ERROR2:RT_ERROR3:KEY_WARN4:NORMAL_WARN5:DEBUG_NOTICE6:DEBUG_INFO7:DEBUG_ALL_DAV-d, --display from right to left:first bit'1' is show 'line';second bit'1' is show 'function name';third bit'1' is show 'file name'-m --module moudule name. below is all modules nameALLmodule class NETPRO_CLASS:RTSP WEBSERVER ONVIF PSIA CGI SDKCMD UNI_IF RTCP GENETEC EHOME EZVIZmodule class SYSFUN_CLASS:SYSINIT RECORD SYSLOG ALARM_EXP HDMANAGER SD NAS MOTDETECT FTP CAPA PIC PLAYBACK PREVIEW CLOUD BUTTON GUImodule class NETFUN_CLASS:SADP ARP SNTP DDNS EMAIL PPP 8021X GB28181 TSOCKS MOBILEmodule class HW_CLASS:HW_IF DSP FPGA RTC SENSOR PTZ MOTION DOME STRM_ANLSmodule class OTHER:OTHERmodule class IPC:IPC IPC_UNIX SDK_SECURITY DB# # [01-01 00:46:07]Default is "2":Code:getDebugmodulenameleveldisplay(FILENAME,FUNCTION,LINE)IPZOOM2111IPZOOM_AF2111IPZOOM_AE2111RTSP2111WEBSERVER2111ONVIF2111PSIA2111CGI2111SDKCMD2111UNI_IF2111RTCP2111GENETEC2111EHOME2111EZVIZ2111SYSINIT2111RECORD2111SYSLOG2111ALARM_EXP2111HDMANAGER2111SD2111NAS2111MOTDETECT2111FTP2111CAPA2111PIC2111PLAYBACK2111PREVIEW2111CLOUD2111BUTTON2111GUI2111SADP2111ARP2111SNTP2111DDNS2111EMAIL2111PPP21118021X2111GB281812111TSOCKS2111MOBILE2111HW_IF2111DSP2111FPGA2111RTC2111SENSOR2111PTZ2111MOTION2111DOME2111STRM_ANLS2111OTHER2111IPC2111IPC_UNIX2111SDK_SECURITY2111DB2111has open debug module nums is : 54# # [01-01 00:45:44]Increasing all to 7 gives the following debug messages:Code:[pid:0][netconfig.c 569]get_ipaddr failed. p_interface_name:eth0[pid:0][mainCtrl/usrMainApp.c 2177]eth0 disconnet...[pid:0][multicast/is_discovery_do.c 262]eth0: wait_net_available[pid:0][hardwareif/e2l/dsp/streamRecv.c 2743]chan 1: Unsupport type = 560, len = 8540[pid:0][hardwareif/e2l/sdcard.c 61]sd_status.name = mmc0[pid:0][hardwareif/e2l/sdcard.c 65]sd status = 1[pid:0][hdCtrl/hdmanager.c 8942]ctrl 0, drive 0: total_space 7648.[pid:0][hdCtrl/hdmanager.c 8958]partition [/dev/mmcblk0p0] exist.[pid:0][hdCtrl/hdmanager.c 8953]partition [/dev/mmcblk0p1] don't exist and errno = 2.[pid:0][hdCtrl/hdmanager.c 8962]partition numbers:.[pid:0][hdCtrl/sd_check.c 176] stfs.f_bfree=244944, stfs.f_bavail=244944, stfs.f_bsize=32768 .[pid:0][hdCtrl/sd_check.c 188] freesize=239, blocksize=32,*getsize=7648 .[pid:0][hdCtrl/hdmanager.c 8977][/mnt/mmc01] get_disksize sucess![pid:0][hdCtrl/hdmanager.c 16789]freespace=7648, totalspace=7648, percent=100 .[pid:0][menu/menu.c 2709] logo_sd_idx=16,last_logo_sd_idx=16,sd_usb_window = 0[pid:0][menu/menu.c 2735]no need to display window![pid:0][net_base_operate.c 622]time out.hi_i2c_wait_rxfifo_notempty->344: transmit error, int_raw_status: 0x750!hi_i2c_wait_rxfifo_notempty->346: tx_abrt_cause is 1.hi_i2c_abortprocess->73: tx_src: 0x1!<3>fuel_gague_i2c_read failed!<3>fuel_gauge_ioctl-118 i2c read err![pid:0][button/button_operation.c 943]get_battery_info HAL_FUEL_GAUGE_SOC failed[pid:0][button/button_operation.c 966]last_value = 0,battery_value = -1[pid:0][menu/menu.c 2820] logo_battery_idx=19,last_logo_battery_idx=19[pid:0][keying/key_event_e2.c 217]type:1, code:0x105, value:0, time:6192s 160986us[pid:0][keying/key_event_e2.c 2175]E_KEY_STATE_DOWN![pid:0][keying/key_event_e2.c 2225]E_KEY_STATE_DOWN! NOT KEY COMBINATION![pid:0][keying/key_event_e2.c 2334]init_time = 6192s 160986us[pid:0][keying/key_event_e2.c 2320]ret: 0!![pid:0][keying/key_event_e2.c 408]key5: 11!![pid:0][keying/key_event_e2.c 449]send -2118386504 msg success, ret = 0,key_statuts=11[pid:0][keying/key_event_e2.c 1174]S_KEY_TRIGGER_DOWN[pid:0][keying/key_event_e2.c 217]type:1, code:0x105, value:1, time:6192s 241034us[pid:0][keying/key_event_e2.c 1214]main_status = 1,fouce_index = 1[pid:0][keying/key_event_e2.c 2236]E_KEY_STATE_UP![pid:0][keying/key_event_e2.c 519]flag_respond = 0!![pid:0][keying/key_event_e2.c 2239]E_KEY_STATE_UP! NOT KEY COMBINATION![pid:0][keying/key_event_e2.c 2351]press_time = 80048us[pid:0][keying/key_event_e2.c 2320]ret: 1!![pid:0][keying/key_event_e2.c 408]key5: 12!![pid:0][keying/key_event_e2.c 449]send -2118386504 msg success, ret = 0,key_statuts=12[pid:0][keying/key_event_e2.c 217]type:1, code:0x105, value:0, time:6192s 290966us[pid:0][keying/key_event_e2.c 1202]S_KEY_TRIGGER_UP,L1202[pid:0][keying/key_event_e2.c 2083]main_status: 157!![pid:0][keying/key_event_e2.c 2334]init_time = 6192s 290966us[pid:0][keying/key_event_e2.c 528]main_status = 157!![pid:0][keying/key_event_e2.c 217]type:1, code:0x105, value:1, time:6192s 502092us[pid:0][keying/key_event_e2.c 1214]main_status = 157,fouce_index = 1[pid:0][keying/key_event_e2.c 2351]press_time = 211126us[pid:0][menu/menu.c 1828]type=157[pid:0][menu/menu.c 6503] width = 140 height = 108[pid:0][menu/menu.c 6730]str:Disconnect the[pid:0][menu/menu.c 6750] str:Disconnect the ,osd_config.charCnt, 15,b_selected=0[pid:0][menu/menu.c 6730]str:device from USB[pid:0][menu/menu.c 6750] str:device from USB ,osd_config.charCnt, 16,b_selected=0[pid:0][menu/menu.c 6730]str:and try again.[pid:0][menu/menu.c 6750] str:and try again.,osd_config.charCnt, 14,b_selected=0[pid:0][keying/key_event_e2.c 217]type:1, code:0x105, value:0, time:6193s 881001us[pid:0][keying/key_event_e2.c 2334]init_time = 6193s 881001us[pid:0][keying/key_event_e2.c 1214]main_status = 164,fouce_index = 1[pid:0][keying/key_event_e2.c 217]type:1, code:0x105, value:2, time:6194s 130876us[pid:0][keying/key_event_e2.c 2275]E_KEY_STATE_DOWN_REPEATE![pid:0][keying/key_event_e2.c 2351]press_time = 249875us[pid:0][keying/key_event_e2.c 408]key5: 0!![pid:0][menu/menu.c 5779]main_status = 164![pid:0][keying/key_event_e2.c 217]type:1, code:0x105, value:2, time:6194s 230871us[pid:0][keying/key_event_e2.c 2351]press_time = 349870us[pid:0][keying/key_event_e2.c 217]type:1, code:0x105, value:2, time:6194s 330872us[pid:0][keying/key_event_e2.c 2351]press_time = 449871us[pid:0][hardwareif/e2l/dsp/dsp.c 461]Waiting dsp to finish reading menu![pid:0][keying/key_event_e2.c 217]type:1, code:0x105, value:2, time:6194s 430867us[pid:0][keying/key_event_e2.c 2351]press_time = 549866us[pid:0][keying/key_event_e2.c 217]type:1, code:0x105, value:2, time:6194s 530876us[pid:0][keying/key_event_e2.c 2351]press_time = 649875us[pid:0][keying/key_event_e2.c 217]type:1, code:0x105, value:1, time:6194s 591209us[pid:0][keying/key_event_e2.c 2351]press_time = 710208us[pid:0][menu/menu.c 6852]str::0.98[pid:0][menu/menu.c 6872] str::0.98,osd_config.charCnt, 5,b_selected=1[pid:0][keying/key_event_e2.c 217]type:1, code:0x105, value:0, time:6198s 591238us[pid:0][keying/key_event_e2.c 2334]init_time = 6198s 591238us[pid:0][keying/key_event_e2.c 217]type:1, code:0x105, value:2, time:6198s 840884us[pid:0][keying/key_event_e2.c 2351]press_time = 249646us[pid:0][keying/key_event_e2.c 217]type:1, code:0x105, value:2, time:6198s 941786us[pid:0][keying/key_event_e2.c 2351]press_time = 350548us[pid:0][keying/key_event_e2.c 217]type:1, code:0x105, value:2, time:6199s 40887us[pid:0][keying/key_event_e2.c 2351]press_time = 449649us[pid:0][keying/key_event_e2.c 217]type:1, code:0x105, value:2, time:6199s 141883us[pid:0][keying/key_event_e2.c 2351]press_time = 550645us[pid:0][keying/key_event_e2.c 217]type:1, code:0x105, value:2, time:6199s 240884us[pid:0][keying/key_event_e2.c 2351]press_time = 649646us[pid:0][keying/key_event_e2.c 217]type:1, code:0x105, value:2, time:6199s 341708us[pid:0][keying/key_event_e2.c 2351]press_time = 750470us[pid:0][keying/key_event_e2.c 217]type:1, code:0x105, value:2, time:6199s 440888us[pid:0][keying/key_event_e2.c 2351]press_time = 849650us[pid:0][keying/key_event_e2.c 217]type:1, code:0x105, value:2, time:6199s 541824us[pid:0][keying/key_event_e2.c 2351]press_time = 950586us[pid:0][keying/key_event_e2.c 217]type:1, code:0x105, value:2, time:6199s 640882us[pid:0][keying/key_event_e2.c 2351]press_time = 1049644us[pid:0][keying/key_event_e2.c 2296]is_long_press = TRUE![pid:0][keying/key_event_e2.c 2320]ret: 2!![pid:0][keying/key_event_e2.c 217]type:1, code:0x105, value:2, time:6199s 741885us[pid:0][keying/key_event_e2.c 2351]press_time = 1150647us[pid:0][keying/key_event_e2.c 217]type:1, code:0x105, value:1, time:6199s 801003us[pid:0][keying/key_event_e2.c 2351]press_time = 1209765usPixar

author: Fraser
author_rank: Super Contributor
timestamp: May 09, 2024, 12:54:04 pm
content: Hi Pixar,Excellent workI have not had time to dig deeply into the cameras operating system and see that Hikvision have protected the more sensitive areas of the build with a decent encryption methodIt would appear to be a significant challenge to change this cameras configuration from a “Health screening” mode to the general use mode.As a side note, the superior DS-2TP21B series cameras are selling for very reasonable prices on eBay UK at the moment. A brand new kit sold for £225 in the last week. The DS-2TP21B model retains most of the functionality of its general-use stable mate and has a measurement range that extends well beyond the health screening range. Combined with the manual focus, desktop charger, two batteries and hard case, it is a very nice packageI find it strange that the DS-2TP31B model was so heavily restricted in terms of temperature measurement range, yet the DS-2TP21B was far less restricted in this respect. It could be due to different development teams working in the firmware during the technical response to the Pandemic.Fraser

author: pixar
author_rank: Newbie
timestamp: May 09, 2024, 06:38:12 pm
content: Thanks Fraser, also for the great tip!With UART you can also control the boot loader. After pressing CTRL + U (\x15) you are able to open the uboot console:Code:System startupU-Boot 2010.06-788427 (Mar 27 2020 - 11:37:08)SPI Nor:"W25M512JV", Block:64KB, Chip:64MBwait timeout, auto_satatus: 0xd0b00000!###read error, int_raw_satatus: 0x750!tx_abrt_cause is 0x1.iptp_thermo_poweroff: hi_i2c_read error!Hit Ctrl+u to stop autoboot: 0Net: USB: scanning bus for devices...1 USB Device(s) foundNo asix device found!Initializ AX88772B usb-net device failed !asix usb net initialize err.No ethernet found.HKVS #Code:versionU-Boot 2010.06-788427 (Mar 27 2020 - 11:37:08)HKVS #Code:help? - alias for 'help'bootm - boot application image from memorybootp - boot image via network using BOOTP/TFTP protocolddr - ddr training functionext2load- load binary file from a Ext2 filesystemext2ls - list files in a directory (default /)fatinfo - print information about filesystemfatload - load binary file from a dos filesystemfatls - list files in a directory (default /)getinfo - print hardware informationhelp - print command description/usagehwdec - hw decompressloadb - load binary file over serial line (kermit mode)loady - load binary file over serial line (ymodem mode)mii - MII utility commandsmmc - MMC sub systemmmcinfo - mmcinfo <dev num>-- display MMC infoping - send ICMP ECHO_REQUEST to network hostprintenv- print environment variablesrarpboot- boot image via network using RARP/TFTP protocolreset - Perform RESET of the CPUsaveenv - save environment variables to persistent storagesetenv - set environment variablessf - SPI flash sub-systemusb - USB sub-systemusbboot - boot from USB deviceversion - print monitor versionHKVS #AX88772B is the installed USB Ethernet adapter (which could not be loaded from the boot loader, so booting via LAN may be impossible).Code:ping 127.0.0.1No ethernet found.ping failed; host 127.0.0.1 is not aliveHKVS #Code:printenvbootcmd=loadkbootdelay=0baudrate=115200netmask=255.255.255.0bootfile="uImage"bootargs=console=ttyAMA0,115200 KRN_PRT=pri mac=00:00:23:34:45:66 bld_rev=788427 hardware_id=0x1ethact=AX88772Cipaddr=192.168.1.77serverip=192.168.1.128stdin=serialstdout=serialstderr=serialverify=nver=U-Boot 2010.06-788427 (Mar 27 2020 - 11:37:08)hardwareID=0x01(iptp_v0)ethaddr=58:50:ed:91:64:9fEnvironment size: 390/65480 bytesHKVS #Code:mmcinfoManufacturer ID: 0OEM: fd00Name: Tran Speed: 537067740Rd Block Len: 18MMC version 0.0High Capacity: YesCapacity: 2306688413412950016Bus Width: 537067520-bitHKVS #You can then boot from the flash memory using the (undocumented) commandCode:loadkbooting from pri part...Load kernel to 0x81800000 ... Done!## Booting kernel from Legacy Image at 81800000 ...Image Name: LiteOS-0.1.0-e2Image Type: ARM Linux Kernel Image (lzma compressed)Data Size: 4990000 Bytes = 4.8 MiBLoad Address: 80008000Entry Point: 80008000Uncompressing Kernel Image ... OK

author: pixar
author_rank: Newbie
timestamp: July 09, 2024, 12:51:43 pm
content: Hi guys,good news! I managed to jailbreak the device ! It was quite a journey - fun & tears - and also the first jailbreak for me. I learned a lot! If you are interested, I can provide a small tutorial/which steps I went through. Also thanks to the great tools out there that makes it a bit easier, such as Ghidra, Unicorn (Qiling / QEMU), binwalk & depthcharge.What can you do with the jailbreak?Enabe the larger temperature range by loading the config of the DS-2TP31-3AUF camera (-30...150 degrees Celsius)Enter debug menu with any passwordAccess all data in a decrypted state from the RAM and/or filesystem (RAM: using my tool; filesystem: using cp to copy files to the SD card)What main findings did you have?The U-Boot bootloader has a custom function to decrypt the OS from the flash memory and load it into the RAM (loadk)The OS is based on Huawei LiteOS - you cannot find too much documentation online and tools like binwalk have poor supportThe OS is basically a copy from other IP cameras of HIKVision, there is a lot of unused stuff regarding all the IP camera featuresThe firmware probably is very similar to other thermal cameras (see below), as there are config functions present as well. When loading config functions of other cameras you will get a slightly different interface and menus, such as a menu enabling the laserpointer, which this camera does not have - or setting a larger temperature rangeMany settings are stored in a SQLlite database -> again with many tables related to IP cameras (potentially my jailbreak can be used to hack other cameras as well...)How does the jailbreak work?Easy!You need a UART to USB converter or similar and run the attached python script. Note that the jailbreak ONLY works with the latest firmware V5.4.38build200922 (as the addresses are hard-coded for that specific firmware). If you want to use it for other devices or other firmware you would need to adapt it.Will the jailbreak be permanent?No and yes. The jailbreak itself does not modify the flash storage and only modifies the volatile RAM. So you would need to apply it at every reboot. However, some settings will be retained, even if the config of the original device is loaded again. I.e. when applying the jailbreak, you will have access to the menu of the DS-2TP31-3AUF and are able to set the temperature range. After rebooting, you will have the original menu again, but luckily the temperature range will remain. It is possible to retain the jailbreak in the flash, however this would require additional development effort.Can I remove all the traces of the jailbreak?Yes. Just reboot the device and reset the device.Is it safe?Yes. The jailbreak does not write anything permanent in the flash storage. You can abort/reboot any time.What configs can you load?The jailbreak currently is hardcoded for the DS-2TP31-3AUF camera, however, those additional configs are present on the device:Code:00A41400DS-2TP31-3AUF00A41401DS-2TPH10-3AUF00A41402DS-2TP31B-3AUF00A41403DS-2TPH10B-3AUF00A41404TB-3117M-3/U00A41405TBC-3117-3/U00A41406TB-3117-3/U00A41407TB-3117A-3/U00A41408DS-2GP1300A42A00HM-TP31-3AUF00A42A01HM-TPH10-3AUF00A42A02HM-TP31B-3AUF00A42A03TBC-3117-3 (HM-TBC3117-3/U)00A42A04HM-TB3117A-3/U00A42A05HM-TPH10B-3AUF00A42A06HM-TB3117-3/U00A42A07TB-3117M-3 (HM-TB3117M-3/U)00A42A08HM-TP31-3AUF-E1LWhat other material/info could you provide?Tool to download the content of the RAM (after the decryption of the main OS)Dumps of the flash storage and/or RAMTool to download the content of the flash storage supporting SpiStack (but the second die is empty)Annotated Ghidra project, including the naming of the relevant functionsTutorial how to write your own jailbreak, debug the bootloader and OS and simulate functions of the firmware or the jailbreak using Qiling.How does the output of the jailbreak look like?Code:(c) 2024 by pixarJailbreak IR Camera from HIKVision. Only use with V5.4.38build200922 firmware as patch addresses are hardcoded! No harm can be done, as all writes are in volatile RAM (Jailbreak needs to be repeated after every reboot.)Please press the ON button on the camera now...System startupU-Boot 2010.06-788427 (Mar 27 2020 - 11:37:08)SPI Nor:"W25M512JV", Block:64KB, Chip:64MBHit Ctrl+u to stop autoboot: 0Going into the console...booting from pri part...Load kernel to 0x81800000 ... Done!Net: USB: scanning bus for devices...1 USB Device(s) foundNo asix device found!Initializ AX88772B usb-net device failed !asix usb net initialize err.No ethernet found.HKVS #HKVS # loady 0x80e34330## Ready for binary (ymodem) download to 0x80E34330 at 115200 bps...Cstart to send: <- CRC / G: STX ->: STX ->: Reached EOF: EOT ->: <- ACK: Batch end packet ->CxyzModem - CRC mode, 0(SOH)/3(STX)/0(CAN) packets, 3 retries## Total Size = 0x00000004 = 4 BytesHKVS #loadkbooting from pri part...Load kernel to 0x81800000 ... Done!## Booting kernel from Legacy Image at 81800000 ...Image Name: LiteOS-0.1.0-e2Image Type: ARM Linux Kernel Image (lzma compressed)Data Size: 5017040 Bytes = 4.8 MiBLoad Address: 80008000Entry Point: 80008000Uncompressing Kernel Image ... OKHKVS # loady 0x8045ddbc## Ready for binary (ymodem) download to 0x8045DDBC at 115200 bps...Cstart to send: <- CRC / G: STX ->: STX ->: Reached EOF: EOT ->: <- ACK: Batch end packet ->CxyzModem - CRC mode, 0(SOH)/3(STX)/0(CAN) packets, 3 retries## Total Size = 0x00000004 = 4 BytesHKVS #loady 0x80097514## Ready for binary (ymodem) download to 0x80097514 at 115200 bps...Cstart to send: <- CRC / G: STX ->: STX ->: Reached EOF: EOT ->: <- ACK: Batch end packet ->CxyzModem - CRC mode, 0(SOH)/3(STX)/0(CAN) packets, 3 retries## Total Size = 0x00000004 = 4 BytesHKVS #go 0x80008000## Starting application at 0x80008000 ...[1;31mwait sensor level init!debugMAC ioctl error!CQAAAAAAAAAAAF66nxg=Password: [IFR_TM.c]line:9965 wait sensor level init![IFR_TM.c]line:9965 wait sensor abclevel init!Enter Debug Mode.Enter 'help' for a list of built-in commands.# [IFR_TM.c]line:9965 wait sensor level init!Jailbreak done. Use send_command("<cmd>") or any UART console to communicate with the devicehelp*******************shell commands:*************************arp call cat cat_logmpp cd cp cpup dnsdspDebug dspStatus excInfo findsym format free getBattery getDebughelp hiddrs himd himm hwi i2c_read i2c_write ifconfiglddrop ls mclose memcheck mkdir mopen mount nand_badnetstat ntpdate part partinfo partition ping prtHardInfo pwdreadreg reboot rm rmdir sem setDebug setGateway setIpsetMessageBox setTempBack setTempSens ssp_read ssp_read ssp_write statfs swtmrsync systeminfo task telnet tftp touch uart_close uart_configuart_read uart_write umount uname unit_test writeproc writereg# [IFR_TM.c]line:9965 wait sensor level init!Attached you find some photos of my setup, as well as the jailbreak script.GreetingsPixar

author: Fraser
author_rank: Super Contributor
timestamp: July 09, 2024, 04:07:06 pm
content: Excellent work. Thank you for your efforts on this camera. The encryption of the firmware in the flash memory is a real pain. Such a pity that the firmware update packages cannot easily be decrypted for editing before installation. As you will know, that is the approach used for Hikvision IP CCTV camera firmware modifications. I had hoped that the decryption utilities for CCTV camera update packages might work on these cameras as well, but sadly that is not the case. Your Jailbreak is a step in the right direction and the fact that it opens up the temperature range (at least until a camera reset) is very usefulFraser

author: pixar
author_rank: Newbie
timestamp: July 09, 2024, 05:29:34 pm
content: Thank you! I haven't really looked into the update/decryption process. Basically my approach is that I wait for the decryption to finish and then patch/modify the necessary components. However, I just checked and it should be possible to deeper analyse the update process using the decrypted RAM dump. There are many references, including the language/region lock ("digicap.dav language is English"), "parse the digicap.dav file failed", etc.Unfortunately my time is currently limited to analyse this further, but for anyone interested into looking into the decryption process/update process one approach could be to simulate those functions with Qiling in a controlled environment. That way you can follow how the digicap.dav file gets read, parsed and stored in the flash storage.

author: Hydron
author_rank: Super Contributor
timestamp: July 14, 2024, 04:53:47 pm
content: ooh fantastic - the ability to expand the measurement range will be extremely useful, and makes this a super bargain (paid well under a hundred quid). Thanks for doing the work!

author: ethermal
author_rank: Newbie
timestamp: August 02, 2024, 04:14:20 am
content: Thanks for the jailbreak @pixar! Excellent work!I made this observation on my DS-2TP31B: Even after jailbreaking and setting the temperature range to -20 to 150 (or any other possible value) the minimal measured temperature stays the same and everything below 25C is indicated as < 25. Is there a way to address that issue?I see this even when in jailbreak mode - but there both max and min temperature are indicated as < 30. The image color grade seems to indicate the temp range correctly but again measurement seems to be affected.Any help would be greatly appreciated!

author: Hydron
author_rank: Super Contributor
timestamp: August 03, 2024, 01:08:17 pm
content: When I did the jailbreak it booted up and showed negative temperatures by default - changing to the high temp (100-500C) range fixed it and it stayed there through a reboot. Downside is that anything under 95C is now shown as an approx. (with ~) temperature. I wonder if the accuracy has changed, though temps still seem to be in the right ballpark.At this point I think I'll leave it in the high range and put the camera back together - if I need to re-do the hack I'll probably bodge in a USB-serial converter for easier future access.

author: haytapot
author_rank: Newbie
timestamp: August 29, 2024, 07:59:35 pm
content: Hi Pixar,I tried to jailbrake, but it didn't work.I am using windows 10, so I had to customize the COM port.I don't know if there is anything else to customize in script to make it work.the installed fw version is V5.4.38build200922.what could be the reason why it did not workCode:(c) 2024 by pixarJailbreak IR Camera from HIKVision. Only use with V5.4.38build200922 firmware as patch addresses are hardcoded! No harm can be done, as all writes are in volatile RAM (Jailbreak needs to be repeated after every reboot.)Please press the ON button on the camera now...System startupU-Boot 2010.06-788427 (Mar 27 2020 - 11:37:08)SPI Nor:"W25M512JV", Block:64KB, Chip:64MBHit Ctrl+u to stop autoboot: 0Going into the console...booting from pri part...Load kernel to 0x81800000 ... Done!## Booting kernel from Legacy Image at 81800000 ...Image Name: LiteOS-0.1.0-e2Image Type: ARM Linux Kernel Image (lzma compressed)Data Size: 5017040 Bytes = 4.8 MiBLoad Address: 80008000Entry Point: 80008000Uncompressing Kernel Image ... OKStarting kernel ...osAppInit<4>parse_cmdline_info: parse IP= failed!<4>parse_cmdline_info: parse SERVER= failed!<4>parse_cmdline_info: parse MASK= failed!<4>parse_cmdline_info: parse dbg= failed!<4>parse_cmdline_info: parse MS_ACTION= failed!<6>hikcommon init ...<4>mmc0 power register success!<6>watchdog init ...<6>hik_rtc init ...<6>uart_dev init ...<6>uart232 init ...cur support uart: uart1(rs485)uart2(rs232)uart1 cken enable!uart2 cken enable!Successfully insmod uart232 module!<6>spi_dev init ...<6>spi_io init ...<6>dmac init ...<6>i2c_dev init ...<6>temp init ...<6>pmic init ...<6>ran_dev init ...<6>mem_dev init ...<6>framebuffer init ...<6>proc_fs init ...Mount procfs finished.<6>cppsys init ...<6>gpio_dev init ...<6>SD_MMC_Host init ...********mmc host init ! ********<6>spinor init ...Spi Nor ID:0xEF 0x71 0x19 0x00 0x00 0x00 0x00 0x00Spi Nor Flash Info:Name:"W25M512JV" Size:64MB Block:64KBspinor_chip_write_protect(168): write protect info: addr:0, size:0 enable:0!spinor_chip_write_protect(168): write protect info: addr:0, size:0x1d00000 enable:1!<6>hik_partition init ...<6>st7789V init ...<6>hikkeys init ...<6>fuel_gauge init ...<6>revision init ...<6>pwm init ...<6>led init ...<3>led_init: bd_get_dev_desc error!<6>net_init init ...Calling lwIPRegSecSspCbkenter hisi_eth_init!hisi_eth init begin.hisi_eth: User did not set phy mode, use default=rmiihisi_eth: User did not set phy addr, auto scan...Can't find PHY device - id: 0<6>cm# # [01-01 00:00:00][pid:0][hardwareif/e2l/main.c 301]hik_bsp_ini# # [01-01 00:00:00][pid:0][SYt finish!SINIT][hardwareif/e2l/main.c 301]hik_bsp_ini# # [01-01 00:00:00][pid:0]['#' Not Supported, Try 'help'# # SYt finish!SINIT][hardwareif/e2l/main.c 301]hik_bsp_ini# # [01-01 00:00:00][pid:0]['#' Not Supported, Try 'help'# # SYt finish!SINIT][hardwareif/e2l/main.c 301][use'#' Not Supported, Try 'help'Quote from: pixar on July 09, 2024, 12:51:43 pm

author: sergei66666
author_rank: Newbie
timestamp: September 28, 2024, 04:46:01 pm
content: Hi guys!Thank you for this topic and for sharing your successes. After reading this topic, I decided to take this device..And now I share my failureI could only find a device with a factory defect - the range of displayed temperatures does not correspond to reality and the minimum discernible temperature is very high.For example, the room temperature is 20 degrees Celsius, when viewing objects in this room, the device scale (the strip on the right side of the screen) displays a temperature range from 20 to 25, the entire screen is blue. After warming up, the temperature range becomes from 26 to 30, the screen remains blue.When pointing at warmer objects (hand, lamp, radiator), the temperature on the scale does not change, but a very pale outline of the object appears in the picture.When examining a freezer with a temperature of about -15 degrees Celsius, the readings on the scale do not change, but the picture becomes dark blue.When inspecting the electric stove burner (turned it on, heated it up and turned it off), there was a bright red circle from the burner on the screen, but the temperature range was the same.(the described behavior persists on firmware V5.4.38, V5.4.44, V5.4.47).As you already understood, I decided to take a risk and bought the device... in the hope that there would be a simple problem with a short circuit on one of the capacitors. I checked all possible capacitors on the main board and on the board with the sensor, but it turned out that all the capacitors were working - I did not find a short circuit. Also, voltage is present at all control points. During voltage measurement at some points on the sensor board, the picture on the screen could change greatly (random colors and, most interestingly, the readings on the scale expanded greatly - they randomly jumped up and down).I took measurements at the points on the board with the sensor marked in the picture (I used the aluminum housing of the sensor module as ground. When measuring the resistance, the sensor board was disconnected from main board).And I got the following voltage and resistance values:Code:VDDD=3.59VVDDA=3.57VVSK=7.02VV8=8.12V (used for VSK)V4=4.18V (used for VDDD and VDDA)V0=0Vp01=3.57Vp02=3.30Vp03=1.76Vp04=3.59Vp05=3.59Vp06=3.59Vp07=3.57Vp08=3.59Vp20=0Vp21=3.56V (random colors)p22=3.57Vp23=3.57Vp24=0Vp30=1.76Vp31=7.02Vp32=3.57Vp33=0V (there may be a couple of volts here, but when the probes are connected, the voltage slowly drops to zero - the picture does not changes)p34=2.1V (random colors)p35=6.97V (random colors)p36=7.02Vp37=3.57VJp5.1=3.59VJp5.2=3.29VJp5.3=3.29VJp5.4=gndVDDD=p04=p05=p06=p08 (resistance between these points is zero)VDDA=p01=p07=p22=p23=p32=p37 (resistance between these points is zero)VSK=p31=p36 (resistance between these points is zero)R(gnd, v0)= Inf (>200M)R(gnd, p20)= Inf (>200M)R(gnd, p24)= Inf (>200M)R(p03, p30)= 86ohmR(gnd, p33)= 1.07MR(gnd, p34)= 1.06MR(gnd, V4)= >1MR(gnd, V8)= >1MR(gnd, VSK)= >1MR(gnd, VDDA)= 57KR(gnd, VDDD)= >1MR(gnd, Jp5.1)= 1.250MR(gnd, Jp5.2)= Inf (>200M)R(gnd, Jp5.3)= Inf (>200M)My main assumption is that the working device generates slightly different voltages than my faulty device.I suppose these points should be checked on a working sensor board first:Code:VDDD, VDDA, VSK=7.02V, V8, V4, V0,p02, p03, p20, p21, p24, p30, p33, p34, p35,R(gnd, VSK), R(gnd, VDDA), R(gnd, VDDD),R(gnd, v0), R(gnd, p20), R(gnd, p24), R(p03, p30), R(gnd, p33), R(gnd, p34)I would be grateful if you could take measurements in your device - this would help me in further investigating the problem.I would also be glad to hear your thoughts on this strange behavior of the device.ps For the sake of interest, I used a patch (from Pixar) to change the temperature range.I selected the range -20~150 in the menu - the scale shows the range -27~-26 and a green picture with an average value of -26.5.I selected the range 100~550 in the menu, then it shows the range 25~29.pss The firmware from the factory was V5.4.22 - there was no reaction even to the freezer and the electric stove burner.

author: sergei66666
author_rank: Newbie
timestamp: September 28, 2024, 04:56:21 pm
content: I used the script on Windows 11 - everything worked fine.I can assume that pin JD3.2 (In) was not connected for you.I specifically disabled it for myself and got the same behavior as you.A small hint for future inexperienced generations (like mewho want to use the script on Windows.Run in the console as administratorCode:python -m pip install Serialpython -m pip install ymodemOpen the device manager and find the name of your COM port. For me it is COM6. Then open the script and replace "/dev/ttyUSB0" with "COM6".Then in the console (you can do it without administrator privileges):Code:python .\jailbreak_by_pixar_v.0.4.py

author: JayDee²
author_rank: Newbie
timestamp: October 04, 2024, 07:00:50 am
content: Great work! My unit will arrive tommorow and i'm looking forward to jailbreaking it.However i was unable to find firmware V5.4.38build200922 anywhere - just Firmware_E1L_V5.4.47_221101 when looking for E1L or IPTP_E2L_EN_STD_5.4.44_210108Can anyone provide a hint on how to find this version?

author: sergei66666
author_rank: Newbie
timestamp: October 04, 2024, 10:06:44 am
content: I found firmware V5.4.38build200922 atthis linkps I would be grateful if you take measurements after disassembling your device

author: schufti
author_rank: Newbie
timestamp: October 22, 2024, 08:02:28 pm
content: Hi,is it possible to (safely) downgrade from Firmware_E1L_V5.4.47_221101 to IPTP_E2L_EN_STD_5.4.38_200922?As info in E1L_V5.4.47 statesOnce the handheld thermography camera is upgraded to this version (V5.4.47), it cannot return tothe earlier firmware version

author: Fraser
author_rank: Super Contributor
timestamp: October 23, 2024, 11:32:52 am
content: I regret that I cannot provide a definitive answer but some things to consider before trying…..1. Hikvision firmware upgrade files are encrypted so modification to them, such as changing the version number is not possible unless you can decrypt and re-encrypt the file set. This has yet to be achieved for this camera.2. Firmware upgrade routines check the firmware for camera model validity and current version, so trying to install an older version of firmware will likely fail before anything is written to the cameras flash memory. An old way to trick a cameras upgrade routine was to edit an old firmware’s identification header to appear as if it is a newer version than that currently installed. See comment 1 for why this has yet to be attempted.3. Some firmware updates include updates to the chipset code as well as the operating system/camera program. Such changes can make the new camera “build” incompatible with all previous firmware versions and could result in bricking the camera even if a way was found to install such.In Précis, downgrading of the firmware version has not been tested on this camera platform yet and it carries risks that you should be aware of before trying. Recovering a bricked DS-2TP31 is by no means certain. If a way were found to decrypt the firmware update package we would know much more about what is possible in terms of firmware modifications.

author: daisizhou
author_rank: Super Contributor
timestamp: October 23, 2024, 11:39:01 am
content: Hi FraserI have noticed that thermal imagers made with Hikvision 4117 are very popular recently. I wonder if you have noticed this. Please seehttps://oshwhub.com/lxu0423/lithermal-thermal-imaging-camera

author: Fraser
author_rank: Super Contributor
timestamp: October 23, 2024, 01:21:41 pm
content: The TB-4117 appears to be yet another example of thermal imaging technology that is surplus after the Covid-19 Pandemic. Great quantities of thermal imaging equipment were manufactured for human temperature screening and we are now seeing complete cameras, or parts of systems, being offered for sale at great prices on the surplus markets. The manufacturers have no use for these finished products so they have the choice of clearing unwanted warehouse stock at give-away prices to surplus dealers, or disassembling the units to extract the valuable imaging core. Disassembly takes time and money plus the cores may be ‘specials’ for temperature screening accuracy and not suitable for reuse. Hobbyists now have the opportunity to buy thermal imaging equipment a amazingly low prices. I bought some camera modules from a temperature screening station for £18 each. They contained complete Guide MobIR thermal camera dongles, cased with USB-C connector. Once connected to a mobile phone they worked perfectly with the App.Enjoy the good times whilst they last as eventually the supply of surplus Pandemic temperature screening cameras will come to an end.

author: Fraser
author_rank: Super Contributor
timestamp: October 23, 2024, 01:46:25 pm
content: A Hikvision TB-4117 being re-cased and a USB-C connector attached…….https://makerworld.com/en/models/146837#profileId-160160TB-4117 brochure….. it is an “Integration” module for use in systems. As I suspected it has a limited temperature measurement range of 30C to 45C with a +/-0.5C claimed measurement accuracy. So it is a human temperature screening camera. It is nice that it is USB I/O and UVC outputhttps://s3-eu-west-1.amazonaws.com/files.visiotech.es/files/pdf/TB-4117-3_S_EN.pdfSadly these inexpensive modules have not reached UK market so I cannot comment on their performance.Fraser

author: sergei66666
author_rank: Newbie
timestamp: October 23, 2024, 02:07:26 pm
content: Hi.I suppose that it is possible to save a dump from the w25m512 memory chip and then restore it if there is a need to return to the old firmware version.It is definitely possible to take the dump - I personally took it (unsoldered the chip). But I have not tried to update to a new firmware and then restore the dump.It may be possible to save the dump via u-boot to the SD card. But I have not tried (I still have not fixed the sensor on my thermal imager)p.s. Just in case, I would save the dump from the second memory chip, which is located on the board with the sensor. It is unlikely, but perhaps when updating the firmware, a small piece of information is written there.

author: schufti
author_rank: Newbie
timestamp: October 25, 2024, 05:37:13 am
content: Quote from: Fraser on October 23, 2024, 01:21:41 pmwhere/how to find such bargains???

author: Fraser
author_rank: Super Contributor
timestamp: October 25, 2024, 09:23:08 am
content: All of mine appeared on eBay UK as items being sold by surplus equipment sellers. These are companies that offer disposal services to other companies and manufacturers and then sell the equipment on eBay or at auctions. One seller that I got to know had over 100 Guide Sensmart 120H handheld human temperature screening cameras and he is finding it hard to sell them, even at £100 as the resolution is only 120 x 90. His company bought pallets of surplus equipment after the Pandemic. I bought a surplus brand new Dahua DH-TPC-HT2201 (256x192 pixel) handheld camera from him for a less than £100. He only had a few so I was lucky. The other surplus seller I found had a mountain of brand new DS-2TP31B cameras that he just wanted to clear from his warehouse after he bought them as a bulk lot after the pandemic. While he was selling them at £60 each, there were still companies offering them at £1K on the internet !There are fewer such bargains to be found on eBay now as the surplus stocks built up during the response to the pandemic have likely been cleared out of the warehouses. There are still CCTV style dual spectrum cameras for human temperature measurement appearing used now and again. They are likely being removed from buildings now that the Pandemic has passed. Prices for Dahua and Hikvision CCTV thermal cameras are often around the £100 mark but they are used and not the easiest units to use for anything but IP fixed installations.If you can find a Hikvision DS-2TP21B (the next model up from the DS-2TP31B) at a good price, it is a very nice camera with a better temperature measurement range than most Human temperature screening cameras (IIRC - up to 100C) Resolution is 160 x 120 but the camera is still very useful. They were being sold on the surplus market for less than £200. I wrote a post about them on this forum.https://www.eevblog.com/forum/thermal-imaging/hikvision-ds-2tp31b-handheld-camera-an-interesting-unit/msg5059231/#msg5059231Hope this helpsFraser

author: Trainer
author_rank: Newbie
timestamp: October 29, 2024, 09:47:30 pm
content: thank you for the jailbreak.after i installed it and set 100-500°C it seems to me that the picture is no longer as sharp.I have also noticed that the coldest point is often displayed at the bottom left.Have you noticed that this has also changed the accuracy?

author: axi1
author_rank: Newbie
timestamp: November 01, 2024, 02:28:56 pm
content: Hi pixar,thank you for the Jailbreak!Do you know why the camera shows a minimal temperatur around -30°C after the Jailbreak? Is this a bug/error? The Jailbreak seems to work for me, but after selecting the temperature range and turning it off and on again if get the limited temperature range again, do you have an idea why this happens, or what I could have done wrong?Thank you and greetingsAlex

author: Trainer
author_rank: Newbie
timestamp: November 04, 2024, 04:52:35 pm
content: Hi axi1,you should change to the high temp (100-500C) to fixed it.

author: andreasub
author_rank: Newbie
timestamp: November 12, 2024, 09:36:19 am
content: https://www.ebay.it/itm/326330214033

author: danosimo
author_rank: Newbie
timestamp: November 13, 2024, 08:10:48 pm
content: Hey, thank you for sharing all your work Fraser, Kudos!!So a question for all of us with the newer firmware on these units. Does anyone know if it works for sure on the latest firmware version V5.4.47 ?. I understand that the patch is hardcoded, but if values are stored in the same addresses on the newer firmware it should work, should it?Anyone tested?

author: SpeedProg
author_rank: Newbie
timestamp: January 06, 2025, 09:09:42 pm
content: Quote from: haytapot on August 29, 2024, 07:59:35 pmI hope you already figured this out by yourself, but just in case you did not and are still interested.I had the same thing until I connected a USB cable from the PC to the Thermal Cam in addition to the Serial.

author: nikitasius
author_rank: Regular Contributor
timestamp: April 09, 2025, 01:39:33 pm
content: Hi folks! Accidentally found these sensors in the mobile form factor and pretty cheap all-in-one. Actually Deepace are selling them for 72€ (France):https://deepace.net/product/mini-uvc-thermal-25hz-160x120-usb-typec/I asked them and they are confirmed me:QuoteQuoteYou can chat w/ support to get some discounts. Actually i own Hikvision camera, but that mobile one could be a good part for DIY projects.

author: dawid_bruening
author_rank: Newbie
timestamp: August 09, 2025, 10:34:18 am
content: Hi, thank you all for your work in the Hikvision DS-2TP31B.I managed to dump the contents of the W25M512JV NOR Flash. If it helps.The description is on my github, with an python script for a waveshare CH347 USB to SPI converter.https://github.com/dawidmpunkt/W25M512JV-dump.Would it be legal to post the dump of the Flash?

author: Fraser
author_rank: Super Contributor
timestamp: August 09, 2025, 11:30:23 am
content: dawid_bruening,You are not hacking a protected file or disclosing information that cannot be accessed by anyone minded to do so. As you are not circumventing protection systems I do not see why you would not be allowed to show the data dump. That said, I understood that the firmware is encrypted and is decrypted as it is installed in RAM during boot. I am not sure what sense can be made of a firmware dump if this is the case. Decrypting an Encrypted firmware, if such is even possible without help from Hikvision, could be considered hacking so is a grey area for this forum and Dave L Jones (Site owner) should be consulted before posting decrypted data files.Fraser

author: dawid_bruening
author_rank: Newbie
timestamp: August 15, 2025, 09:24:06 pm
content: I made an autopatcher with a STM32 MCU for pixar's jailbreak. I integrated a small mcu inside the thermal camera, that runs the code only if the trigger button is pressed in the first second during startup.Code and wiring can be found here:https://github.com/dawidmpunkt/DS-2TP31-Thermal-Camera-Autopatcher