Page 1 of 1

Recover bricked ANPVIZ IPC-D250W-S camera

Posted: Sun Dec 19, 2021 3:12 am
by winstontj
It's a long shot and they are less than $100 so I won't be upset if I need to toss it in the bin and buy a new camera.
I don't know what happened... I rebooted the PoE switch and it didn't come back up/online. I had the camera set as a static IP in the camera's web gui config. I had it set as IP address 192.168.1.12... And now I get nothing at that IP address but it does respond to pings at 192.168.1.152... Which is weird. My DHCP address range is 192.168.1.50-192.168.1.69... So I have no idea what on earth ever made it respond to pings at IP 192.168.1.152.

There is no reset button. It is a PoE IP camera and I do have both a spare PoE switch as well as the wall-wart power plug (so I can access it via laptop/pc without PoE).

There is no reset button. I have found ABSOLUTELY NOTHING online or anywhere about these cameras. They have to flash them at the factory somehow... To make things a little more complicated, the model --or the camera housing looks like it could also accept a PTZ (pan tilt zoom) camera as well as the el-cheap-o dome that I have. I attached one picture. On the side of the camera's board there is one spot where it **maybe** looks like you could short some jumpers and **maybe** reset the camera... I've tried but no luck.

It's already bricked: I can't break/brick it any worse... Any ideas?

I attached a photo. I tried to "jump", bridge or short those jumpers in various states of boot, running, etc. with no luck. I know the camera is working (mechanically) because I can hear it clicking when it turns on... But I cannot ssh (refused), tftp (also refused) or hit any http/https URL's of the camera (http times out, not refused)

Again, thanks for any ideas.

Re: Recover bricked ANPVIZ IPC-D250W-S camera

Posted: Sun Dec 19, 2021 11:01 am
by kitkat
I think you may be right about the PTZ option - This looks like a motorised-zoom version so there might be others: https://anpvizsecurity.com/https-wwwama ... 473p1.html

The manual for that model is here: https://anpvizsecurity.com/?do_action=a ... &ProId=473

Unfortunately, it doesn't show any way to reset the device, but it does say that DHCP is disabled by default which might explain why the IP address is outside your range if the device has reset itself somehow. Well, maybe anyway... 192.168.0.123 is supposed default address, but I guess the manual may be wrong.

e2a: If it is at 192.168.0.something and if you're coming from a 192.168.1.x address with a 255.255.255.0 netmask then that'd explain why you don't get a response, but it might work if you set your IP address in the 192.168.0.0/24 range.

Perhaps it's worth trying one of their Search or Config tools? https://anpvizsecurity.com/download/uprime-series_c0036

Re: Recover bricked ANPVIZ IPC-D250W-S camera

Posted: Sun Dec 19, 2021 10:19 pm
by winstontj
Shoot. I forgot that the default was 192.168.0.123... I used 192.168.1.x as an example. my home address subnet ranges are 173.xx.xx.xx/24. So I had given the camera an address of 173.10.10.12/24 with gw as 173.10.10.1 and dns 173.10.10.1+173.11.11.1. So it was 173.10.10.12 (I don't remember now if it was static or DHCP and I assigned a static at pfsense).

So when whatever happened it's like the IP address jumped from 173.10.10.12 --->>> 173.10.10.152... Weird right??

I get absolutely nothing at all at 173.10.10.12.
I can ping (and get a reply) from 173.10.10.152 (found it with nmap).
It also refuses anything/everything I can try with Ubuntu or Windows putty (ssh, tftp, ftp, scp, cp, etc.).
I get http/https "refused to connect" at 17310.10.152... Which makes me think "something" is there... But just isn't happy or doesn't want to talk to me.
I can --maybe??? Borderline??? detect an ONVIF signal at 173.10.10.152... Sometimes it shows up. But briefly.

Those two spots in the photo are probably where they would solder something for a PTZ model. My guess is they used the same board. The two solder points look like a jumper of some sort. I've seen over on Level1 (https://forum.level1techs.com/t/unbrick ... ide/161470) Wendell un-bricked a hikvision camera but when I read through that DIY/tutorial it seems like the camera he was working on was --idk "better", higher quality, not as el-cheap-o as my camera...

I know something is there because something is responding to a ping. I've got the manuals and I've read them. There's nothing I can find to help with a reset or re-flash process/tool.

Thanks.

Re: Recover bricked ANPVIZ IPC-D250W-S camera

Posted: Mon Dec 20, 2021 1:13 pm
by kitkat
Yeah, very weird.

But what if you did reset it it? Or what if it reset itself somehow?

I'd try the search tool linked above to see if that can find it. I'm kind of under the impression that these tools use MACs rather than IP addresses so that they'll work even if there's a network/mask mismatch. If it does then you can do a factory reset (manual says, "If you [...] would to reset the camera’s setting, please install the search tool to search the camera IP and click Reset factory button." ) and then set a new IP address.

If that doesn't do it then maybe it'll find a new life as a paperweight?

Re: Recover bricked ANPVIZ IPC-D250W-S camera

Posted: Tue Dec 21, 2021 9:10 pm
by winstontj
kitkat wrote: Mon Dec 20, 2021 1:13 pm Yeah, very weird.

But what if you did reset it it? Or what if it reset itself somehow?

I'd try the search tool linked above to see if that can find it. I'm kind of under the impression that these tools use MACs rather than IP addresses so that they'll work even if there's a network/mask mismatch. If it does then you can do a factory reset (manual says, "If you [...] would to reset the camera’s setting, please install the search tool to search the camera IP and click Reset factory button." ) and then set a new IP address.

If that doesn't do it then maybe it'll find a new life as a paperweight?
Yeah it's weird... Really weird. Hikvision is a HUGE HUGE HUGE company and makes cameras for lots of people under many different names. I've got all the manuals, documentation and search/discovery apps from the pages you linked as well as from a few other brands that I know and have confirmed to be using the same hardware this camera is running on.

To be honest it is/was a paperweight the minute it bricked. Amazon has them (Prime) for $59. At this point it's a fun learning experience, not an effort to save a $60 camera. I'm still curious though. I know it's old news (I probably live under a rock) but I recently learned of some crazy stories (it's on the Internet --Google it) that there are back-doors in some of these cameras and people (companies?? hackers?? firmware developers??) were using end-user cameras as an attempt to build out a massive network to mine cryptocurrency?? I thought it was funny, and interesting, and it made me curious to see what's actually in these things. It's gotta have something halfway decent in there if it can do its own on-camera/on-device motion detection, alerts and scheduling. I figured it's a little squashfs (https://en.wikipedia.org/wiki/SquashFS) or similar OS with a config file stored somewhere and that's that. I thought if I could get into one... Then I could get into a second one... And I have a known-good, working identical camera so I could pull the OS image (or maybe firmware would do it) then re-flash it and it would be good to go. But... If the boot-loader got fried somehow and it's stuck halfway between a factory reset and the old config file then maybe yes: paperweight.

Re: Recover bricked ANPVIZ IPC-D250W-S camera

Posted: Wed Dec 22, 2021 12:25 am
by iconnor
Are you sure that the device at 152 is the camera? I assume by determining mac address.

It might be in some sort of pre-boot environment like uboot. It MIGHT respond to a tftp setup. You might also look for more spots that look like jtag headers.

Isaac