HIkvision DS-7716N-E4/16P - Bricked after update

JohnnyBoy

n3wb
Joined
Feb 15, 2016
Messages
26
Reaction score
2
Hi All,

installed a update (NVR_K41_BL_ML_STD_V3.4.90_161008) over the original English hack firmware V3.3.4, build 150616.

Did this via usb directly to the NVR. Now I get the dreaded 12beeps and reset loop happening. I get a logo pop up on the screen when this happens (not the 'warning you have Chinese product....")

I have tried putty and tftp with no luck. Have also given my unit to a Hikvision tech here and they couldn't use either putty or tftp to get it to work either.

These were the products I was using for putty. It didn't work for me, but may have the wrong products?
USB to DB9M RS-232 Converter, 1.5m | Jaycar Electronics
DB9 Female IDC Connector | Jaycar Electronics

The tech I gave it to recommended a new unit, but don't really have the money to replace. Do you think the unit is saveable? If someone is local that would be fantastic, would be happy to pay for your time

Perth, Australia

Thanks
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,930
Reaction score
6,779
Location
Scotland
I get a logo pop up on the screen when this happens (not the 'warning you have Chinese product....")
The warning is on the serial console.
These were the products I was using for putty. It didn't work for me, but may have the wrong products?
Presumably this unit has a DB9 RS-232 connector on the back panel. It may be that the serial console isn't available via that route.

Suggestion:
Take the lid off and check out the main board for the usual 4-pin white JST ZH connector that provides serial console access.
If you're not sure - maybe post an good image of the board.
If that does exist - then you'd need a serial TTL to USB convertor (eg a PL2303HX-based one) - and some 'hacked to English' firmware.
 

JohnnyBoy

n3wb
Joined
Feb 15, 2016
Messages
26
Reaction score
2
Presumably this unit has a DB9 RS-232 connector on the back panel. It may be that the serial console isn't available via that route.

Suggestion:
Take the lid off and check out the main board for the usual 4-pin white JST ZH connector that provides serial console access.
If you're not sure - maybe post an good image of the board.
If that does exist - then you'd need a serial TTL to USB convertor (eg a PL2303HX-based one) - and some 'hacked to English' firmware.
Hi alastairstevenson,

Thanks for the reply.

opening up the unit shows that 4pin connector is attached to a cable that connects to the DB9 RS232 on the back panel. I have been connecting directly to the back panel.

I could remove the 4pin connector and attach directly to those 4pins if that would help?

Also, would you know where I could find the hacked firmware?

Cheers
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,930
Reaction score
6,779
Location
Scotland
opening up the unit shows that 4pin connector is attached to a cable that connects to the DB9 RS232 on the back panel.
Interesting - did you get zero response with your RS-232 interface / null model cable? Using baud=115200, 8 bits no parity.
If so - either it's not a serial console during startup, or maybe not RS-232. Try swapping RX and TX if the wiring allows you to do that.
 

JohnnyBoy

n3wb
Joined
Feb 15, 2016
Messages
26
Reaction score
2
Well looks like I have found the problem as to why the RS-232 interface is not working.....very dodgy manufacturing!


There is solder on all the connection points....any idea which one connects to the black cable?

Also, its a 5pin, not 4 pin like the 7600 series?


And finally, once I get this working and talking to my PC. do you know where to find the hacked firmware?

Cheers
 

Aengus4h

Getting the hang of it
Joined
Mar 12, 2018
Messages
242
Reaction score
98
Location
UK
the black wire is probably signal ground - usually to pin 5 on the DB9 male plug.

That does look pretty poor manufacture, like the cables got mangled against the case when it was installed, not good. Warranty still good on the unit?
 

JohnnyBoy

n3wb
Joined
Feb 15, 2016
Messages
26
Reaction score
2
the black wire is probably signal ground - usually to pin 5 on the DB9 male plug.

That does look pretty poor manufacture, like the cables got mangled against the case when it was installed, not good. Warranty still good on the unit?
Pin 5 was the one, thanks for the suggestion. It had the most left over solder on it so was what I was going to try first :)
No warranty left (there should be about 6months), but as it was a ebay purchase, I don't think they will honour it.

In any case I've managed to make a new cable.
That is really shockingly shoddy.

But is there a small, white, 4-pin connector on the main board?
I'm not sure if that RS-232 gives access to the serial console.
Yup, pretty average condition.
No 4-pin on this unit, only 5pin.
Interesting - did you get zero response with your RS-232 interface / null model cable? Using baud=115200, 8 bits no parity.
If so - either it's not a serial console during startup, or maybe not RS-232. Try swapping RX and TX if the wiring allows you to do that.
Good suggestion on swapping the RX/TX wires around.

After I fixed the cable I tried with the original cable layout with nothing coming up in Putty.
Made another cable with the RX/TX swapped and we have lift off! Well slowly.

U-Boot 2010.06-svn (Aug 15 2015 - 15:18:43)
Protected at offset:0,size:20000 Protection status:[0xf88]=>[0xf8b].
Hit ctrl+u to stop autoboot: 0
### CRAMFS load complete: 3182048 bytes loaded to 0x80400000
timeout wait for link failed!
## Booting kernel from Legacy Image at 80400000 ...
Loading Kernel Image ... OK
OK
Starting kernel ...
Uncompressing Linux... done, booting the kernel.
init started: BusyBox v1.16.1 (2016-06-29 13:49:45 CST)
Starting udev: [ OK ]
Wed Jan 7 19:57:27 UTC 1970
----------<1> tar guir webs ----------
----------<2> show logo ----------
show logo Wed Jan 7 19:57:37 UTC 1970
mv: can't rename '/home/app/exec/pppd': No such file or directory
mv: can't rename '/home/app/exec/pppoe': No such file or directory
mv: can't rename '/home/app/exec/ss': No such file or directory
mv: can't rename '/home/app/exec/dropbear': No such file or directory
mv: can't rename '/home/app/exec/dropbearkey': No such file or directory
/home/start.sh: line 29: dropbearkey: not found
chmod: /usr/bin/dvrCmd/dvrtools: No such file or directory
----------<3> load hisi sdk ----------
The system mem size is 0x0
/
load 3535 ok
----------<4> del no use res ----------
mv: can't rename '/home/app/res/adAudio.jpg': No such file or directory
/home/start.sh: line 79: ./pppoed: not found
iSCSI daemon with pid=979 started!!!! the device is not toe !!!

BusyBox v1.16.1 (2016-06-29 13:49:45 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.
BusyBox v1.2.1 Protect Shell (psh)
Enter 'help' for a list of davinci system commands.
# DDR cpld.sys.bits.ddr_bitw : 0
!!!!!!!you Device is illegal, Please call factory!!!!!!
!!!!!!!you Device is illegal, Please call factory!!!!!!
!!!!!!!you Device is illegal, Please call factory!!!!!!
!!!!!!!you Device is illegal, Please call factory!!!!!!
!!!!!!!you Device is illegal, Please call factory!!!!!!
!!!!!!!you Device is illegal, Please call factory!!!!!!
!!!!!!!you Device is illegal, Please call factory!!!!!!
!!!!!!!you Device is illegal, Please call factory!!!!!!
!!!!!!!you Device is illegal, Please call factory!!!!!!
!!!!!!!you Device is illegal, Please call factory!!!!!!
!!!!!!!you Device is illegal, Please call factory!!!!!!
!!!!!!!you Device is illegal, Please call factory!!!!!!
!!!!!!!you Device is illegal, Please call factory!!!!!!
!!!!!!!you Device is illegal, Please call factory!!!!!!
!!!!!!!you Device is illegal, Please call factory!!!!!!
!!!!!!!you Device is illegal, Please call factory!!!!!!
!!!!!!!you Device is illegal, Please call factory!!!!!!
!!!!!!!you Device is illegal, Please call factory!!!!!!
!!!!!!!you Device is illegal, Please call factory!!!!!!
!!!!!!!you Device is illegal, Please call factory!!!!!!
@
At this point I tried several resets trying to get the Ctrl+U command to work but no response, even tried with another keyboard as I have heard that could be something?

Any ideas to progress from here?

Thanks
 

JohnnyBoy

n3wb
Joined
Feb 15, 2016
Messages
26
Reaction score
2
With the cable disconnected, connect RX to TX and see if what you type gets echoed.
If not - something wrong with the TX path.
Thanks for the suggestion, tried the cable echo and worked perfectly (after some googling to figure out what a cable echo was)

As it turns out the pin layout in the RS-232 that was damaged were all in the wrong spot, very very dodgy and surprised it passed QC. No wonder I wasn't having any luck. Have now managed to get the putty and tftp to talk to each other and can upload firmware.

For those who have the same issue and cannot get the RS-232 connection to work. This image is the correct pin layout, hope it helps someone in the future :)



The next issue I am having is purely based on the firmware that I was sent. It says there is a language mismatch.
The only thing I did to the firmware I received is rename it digicap.dav
Any ideas on this one?
Please input ip address of device: 192.0.0.64
Please input ip address of upgrade server: 192.0.0.128
Confirm?(y/n): y
timeout for link [5000]!
MAC: xxxx-xx-xx-xx-xx (changed)
TFTP from server 192.0.0.128; our IP address is 192.0.0.64
Download Filename 'digicap.dav'.
Download to address: 0x80008000
Downloading: # [ Connected ]
################################ [ 1.000 MB]
################################ [ 2.000 MB]
################################ [ 3.000 MB]
################################ [ 4.000 MB]
################################ [ 5.000 MB]
################################ [ 6.000 MB]
################################ [ 7.000 MB]
################################ [ 8.000 MB]
################################ [ 9.000 MB]
################################ [10.000 MB]
################################ [11.000 MB]
################################ [12.000 MB]
################################ [13.000 MB]
################################ [14.000 MB]
################################ [15.000 MB]
##################
done
Bytes transferred = 16319047 (f90247 hex)
digicap.dav match error
Language mismatch: In bootparams is 0x2 but in digicap is 0x1
Please input ip address of device: Please input ip address of upgrade server:
Thanks again for your help so far. I never would have got this far without your input.
Cheers
 
Last edited:

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,930
Reaction score
6,779
Location
Scotland
Any ideas on this one?
The firmware header language needs to be switched to 2 (CN) instead of 1 (EN), that will sort it.

And well done on figuring out the RS-232 pinout problem.
But bear in mind there are DTE (data terminal equipment - eg a PC) and DCE (data communications equipment - eg a model) which are designated differently such that when one is connected one-to-one to the other they operate OK, or for 2 the same a choice of null modem cable is needed.
But the main thing is that you have access to the serial console.
 

JohnnyBoy

n3wb
Joined
Feb 15, 2016
Messages
26
Reaction score
2
Its alive!!!!

Can't believe it, a real pain in the bum but happy i got it working.

Thanks again for all your input :)
Saved me a lot of money by not having to purchase a new DVR.

Now to figure out the apps

- PC iVMS 4200 - can control everything but cant see the camera feed
- iphone iVMS-4500 - everything works, and shows all cameras
- iphone Hik-connect - only shows 4 of 6 cameras. Says other two are offline.
 
Joined
Mar 28, 2019
Messages
1
Reaction score
0
Location
UK
Its alive!!!!

Can't believe it, a real pain in the bum but happy i got it working.

Thanks again for all your input :)
Saved me a lot of money by not having to purchase a new DVR.

Now to figure out the apps

- PC iVMS 4200 - can control everything but cant see the camera feed
- iphone iVMS-4500 - everything works, and shows all cameras
- iphone Hik-connect - only shows 4 of 6 cameras. Says other two are offline.

Hi Johnny,

any chance you could help me with my DS-7216 that's stuck in a similar loop, please?

Where are you located?

Thanks,
 

JohnnyBoy

n3wb
Joined
Feb 15, 2016
Messages
26
Reaction score
2
Hi Johnny,

any chance you could help me with my DS-7216 that's stuck in a similar loop, please?

Where are you located?

Thanks,
Hi Richard,
Sorry, im really not that great at this type of thing. It took me a long time to figure it all out. Also mine was the 7716 not the 7216 that you have. They all have difference firmware and things like that.

There are a lot of knowledgeable people on this forum that will be able to help you out.

I tried taking my unit to a hikvision repair guy, but didn't have any luck. It was just me tinkering around with it with guidance from this forum.

In Australia as well, so quite a distance.

Hopefully you get it sorted
Cheers
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,930
Reaction score
6,779
Location
Scotland
For those that are interested, this is the firmware that I used to un-brick my 7716.
Hmm... That's my 'hacked to English' NVR firmware, distributed privately.
Supposed to be kept out of public distribution.

**edit** To be fair - I may have forgotten to request that.
 

JohnnyBoy

n3wb
Joined
Feb 15, 2016
Messages
26
Reaction score
2
Hmm... That's my 'hacked to English' NVR firmware, distributed privately.
Supposed to be kept out of public distribution.

**edit** To be fair - I may have forgotten to request that.
Sorry Alastair,
Didn’t realise you wanted it private. I will remove

Sorry about that
 
Joined
Feb 1, 2018
Messages
6
Reaction score
0
hi i have kind off the same problem
this is what i get when i use putty
any idea what to do??

init started: BusyBox v1.16.1 (2016-06-29 13:49:45 CST)
Starting udev: [ OK ]
Tue Apr 23 20:27:36 UTC 2019
----------<1> tar guir webs ----------
ioctl faild. errno[5]
tar: unexpected EOF
tar: short read
ioctl faild. errno[5]
tar: unexpected EOF
tar: short read
----------<2> show logo ----------
show logo Tue Apr 23 20:27:44 UTC 2019
mv: can't rename '/home/app/exec/ss': No such file or directory
mv: can't rename '/home/app/exec/dropbear': No such file or directory
mv: can't rename '/home/app/exec/dropbearkey': No such file or directory
/home/start.sh: line 29: dropbearkey: not found
chmod: /usr/bin/dvrCmd/dvrtools: No such file or directory
----------<3> load hisi sdk ----------
The system mem size is 0x0
/
load 3535 ok
----------<4> del no use res ----------
mv: can't rename '/home/app/res/adAudio.jpg': No such file or directory
iSCSI daemon with pid=941 started!DDR cpld.sys.bits.ddr_bitw : 0
file:src/pal_api.c,line:376, pal_module_init successfully
open config file failed [/home/app/cfg/devCfg.bin] wait 2S
!!! set tnk_threshold to 1M Ok !!!
/home/start.sh: line 101: /home/app/exec/netOpenProc: not found
BusyBox v1.16.1 (2016-06-29 13:49:45 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.
open config file failed [/home/app/cfg/devCfg.bin] wait 2S
BusyBox v1.2.1 Protect Shell (psh)
Enter 'help' for a list of davinci system commands.
# DDR cpld.sys.bits.ddr_bitw : 0
file:src/pal_api.c,line:376, pal_module_init successfully
file:src/pal_api.c,line:40, *********undefine fun:pal_add_proc_info*********
fun:hisi_watchdog_init, line:1719 hisi_watchdog_init(/dev/watchdog, 4) ok iDogTimeOut:600 Sec!
[CRIT][sys_guide.c #1037][@read_execl_guide_cfg]: start
[INFO][sys_guide.c #406][@get_flash_cards_info]: ignore [msmouse].
[CRIT][sys_guide.c #447][@get_flash_cards_info]: ********can not find any usb device!********
[CRIT][sys_guide.c #1047][@read_execl_guide_cfg]: get flash cards info failed. iRet[-1]
read execl guide cfg failed. iRet[-1]DDR cpld.sys.bits.ddr_bitw : 0
file:src/pal_api.c,line:376, pal_module_init successfully
file:src/pal_api.c,line:40, *********undefine fun:pal_add_proc_info*********
DDR cpld.sys.bits.ddr_bitw : 0
file:src/pal_api.c,line:376, pal_module_init successfully
file:src/pal_api.c,line:40, *********undefine fun:pal_add_proc_info*********
remove error
fun:hisi_watchdog_init, line:1719 hisi_watchdog_init(/dev/watchdog, 34) ok iDogTimeOut:25 Sec!
/*********************init_global_error_lib*/, init_global_error_lib start!
:0
##gui_res_ini() start##[2019,4,23 20 - 27 - 47]#######
:0
t1: wait storage [1] and gui[2] and hicore[2] and ipcm[0]
open config file failed [/home/app/cfg/devCfg.bin] wait 2S
open config file failed [/home/app/cfg/devCfg.bin] wait 2S
 
Top