I recently picked up a used Hikvision DS-7608NI-E2/8P (at auction) that was password locked. The seller was unable to tell me where it was sold, and all the Hikvision offices I contacted (US, EU, AU, CN, HK) provided the canned "purchased through an unauthorized" channel response. The stated source of the hardware seemed to have no bearing on the response either (I bought local, I bought at auction, acquired through acquisition of another company, etc). I have another identical unit (also used) that was sold in the US and they assisted with a password reset, no questions asked, no information regarding where I purchased was asked either.
The password locked unit was shipped in retail packaging with serials that matched (box + device + SADP). The firmware installed appears to be US or ML (not hacked, not CN), but the serial seems a little odd. The other used (verified US) unit that I have has a serial number that starts with 6591xxxxx and has a canned verification code for Hik-connect on the label. The manufacture date of that unit is 2016. The password locked unit has a serial number that starts with 1351xxxxx and no precreated hik-connect code. Lower serial number, same exact model? The manufacture date of the password locked unit is less than six months ago - Nov 2017. The other odd thing is that the firmware on this new (password locked) unit was one build number newer than the latest version of the firmware posted (anywhere) for their I series NVRs.
I recently had a grey market DS-2CD2132 camera that I attempted to update the firmware, which lead to tftp recovery (which consequently removes the device configuration and password). The normal tftp recovery process (where it reaches out to 192.0.0.128) seems to have been removed from the most recent versions of Hik firmware though... So I started looking for something similar to the serial recovery that I had seen on some camera posts. I did find a few posts with folks attempting the same thing on an NVR (with mixed success) but the only posts with any real details at all were related to cameras.
I'm a firm believer in the right to repair. I have huge issues with Hikvision's password reset policy / distribution polices. I understand their viewpoint / concerns about products not sold through authorized channels and could even agree with not providing support to these units, but what they have done is quite different. Not only will they not support you with your unauthorized product, but they have injected themselves into the most basic support item (password resets) which lets them force these units out of service early. They have continually worked to lock their products down as well, so even with physical access, you may just end up with a paperweight (and no way to really tell if this will be the case before buying). None of this seems to be in the interest of their customers. It all seems to be borne out of their desire to control/protect regional pricing (vs using a global pricing model) and their inability to control what their distributors/resellers are doing. So they lock things down and make it more difficult for end users. If I didn't know what I was getting into and as a hobbyist had dropped several hundred on what I thought was a DIY system and they told me to go kick rocks when I asked for a password reset, I probably would blame the source of my purchase a lot less than I blame the manufacturer of the product (with the insane policies).
So outside of sticking it to Hikvision, the main purpose of this post is to put all the information regarding Serial TTL recovery in one place, so that the next guy doesn't have to jump through quite as many hoops as I did. The cable and basic steps here are identical for Hikvision cameras (although some disassembly is usually required to get to the connector on the camera).
The first thing to note is that most of the time when serial recovery is referred to with Hikvision, it's referring to TTL serial. There are some NVRs that support RS232 connections, but you can usually tie into these on the back (without opening it up) through the terminal block and/or a dedicated serial port. A TTL Serial to USB cable can be purchased for $3-10 from various online sources. On one end you will see a USB connection, and the other will have 3-4 wires. You can read about the differences between TTL Serial and RS232 ("normal" serial) here: RS-232 vs. TTL Serial Communication - SparkFun Electronics
Supplies
You should be looking for a four pin JST ZH header on the mainboard, that looks like this:
Here it is on a camera board:
An older Analog NVR:
A DS-7604:
A DS-7608:
You may see more than one JST connector. If you do, you may need a multitester to determine the pinout, or to see if it's actually a TTL serial connection. It's fairly easy -- one outer pin should be hot, the other should be a ground. Ground is pin #1, hot is pin #4. On my unit, pin #1 (ground) had a white arrow printed on the PCB next to it. If you don't read anything from these two pins with the unit powered on, it's probably a safe bet that it's not a TTL serial port.
After finding your port you will need to get (or fabricate) a four pin JST ZH cable. The pins are 1.5mm apart. Best bet is to purchase a pre-made cable (easily sourced online):
This is a common connector (used with some LiPO cells) so I actually had a bag of two pin headers+connectors laying around. I opted to fabricate, since I didn't want to wait for the proper cables to ship. If you have two pin headers, you can simply file down one side of each so that you can get both in the four pin socket.
You'll also need that TTL Serial adapter:
Please note, the first two sections here simply tell you what the pinouts are for each side (JST And TTL Cable). These are for reference only and do not reflect how you should actually connect things up (see below the rx/tx diagram for this info). Power should be turned off (via power supply switch or cable pulled) while you are tinkering around inside.
TTL Serial Cable Pinout
Red = 5v
Black = Ground
White = RX (into USB)
Green = TX (out of USB)
JST Pinout
Pin 1 = Ground
Pin 2 = TX (out of NVR)
Pin 3 = RX (into NVR)
Pin 4 = 3.3v
When connecting, RX goes to TX as shown here:
How to connect your cable:
JST Pin 1 -> TTL Ground (black)
JST Pin 2 -> TTL RX (white)
JST Pin 3 -> TTL TX (green)
JST Pin 4 -> NO CONNECTION
IMPORTANT: THE RED (+5V) LEAD SHOULD NOT BE CONNECTED TO JST PIN 4. YOU ONLY NEED THE TX/RX/GROUND CONNECTIONS TO MAKE THIS WORK. YOU COULD POTENTIALLY DAMAGE THE UNIT IF YOU CONNECT THE RED(+) LEAD!
Here is my ghetto cable installed w/TTL Serial adapter connected. Note that the fourth pin has no connection (it's not touching the power supply in the pic either - just an angle issue with the photo):
After you are done wiring things up, you will need to connect the USB side of the TTL Serial adapter. You may need to install drivers from the manufacturers site. I did not have good luck when trying to pass one of these adapters through VMware Fusion to a Windows 10 VM. I ended up breaking out an old Windows 7 laptop in the end.
My adapter (the one shown in this pic) uses a PL2303 chip. You can get the latest drivers here:
Products
You will need to download PuTTY (or a terminal emulator of your choice that supports serial):
Download PuTTY - a free SSH and telnet client for Windows
You will need a plain TFTP server (not the one from Hikvision). I recommend using the portable version of tftpd32 (free). Extract to a subfolder of your downloads folder and run it from there:
TFTP server
You will also need an ethernet cable (crossover not required) to get the firmware (firmware is not transferred through the serial connection).
Your ethernet cable can be connected in one of two ways:
If you go with #1 (which was easiest for me), you will need to manually set the IP address on the computer. Network adapter settings, right click the network adapter, double click TCP/IP V4, enter as shown below:
Now you need to figure out what COM port that the TTL Serial adapter has been assigned to. Open Device Manager in Windows, click the > by "Ports (COM & LPT)" and you should see COM#. If you see more than one COM port listed and you aren't sure which to use, note the COM port numbers used - you may have to test each one with PuTTY as the NVR boots to figure out which is the correct one to use (trial and error).
After you have the COM Port(s) information, open up PuTTY. On the first screen you see, select "Serial" for Connection type, manually type your port under Serial line. My adapter came up on COM6 (shown below). Speed should be set to 115200:
Click on serial (bottom of the list on the left), make sure the Serial line to connect to matches what you entered on the first screen, as well as the speed. Data bits 8, Stop bits 1, Parity None (these should be the default settings). Change flow control to none/off (not a default setting!).
Once complete, click Open, then power on your NVR. If you have the correct port selected, you should see something like this when it powers on:
Let's move on to setting up the TFTP server. I'm only providing instructions for tftpd32, but the setup should be similar with other tftp server software. When you initially open tftpd32 you may see some firewall prompts etc. Adding exceptions is fine, but if your NVR and the TFTP server don't seem to be communicating, you may want to disable windows firewall as a first step when troubleshooting. Once tftpd32 is open, click the settings button at the bottom. Click the global tab, uncheck DHCP server. Click the TFTP tab and select "None" for TFTP security. Click OK, it will tell you you have to restart the app, click OK, close the app, reopen.
Now you need to download firmware from Hikvision. I had a US model, so I used the US firmware. I actually loaded a version that was one release number behind the version that was installed. I had zero issues but your mileage may vary here. If you choose the wrong firmware (and don't have a grey market model with hacked firmware) it will do the usual checksum/region mismatch and won't install the firmware file. Download the latest firmware release for the NVR and extract the zip file. The digicap.dav file inside the zip needs to be copied into the root folder of tftpd32 (this is why I recommend the portable version - configure + drop the file in the same folder).
At this point you should have the TTL Serial cable all set, the COM port verified, PuTTY setup, tftpd32 setup and running with the firmware that you want to install to the device residing inside the tftpd32 folder.
From here:
Firmware should be loaded and all configuration (including password) should be cleared. All cables can be removed and the NVR can be setup/moved/etc. It will be in an unactivated/inactive state with no password set at all. The first screen that you see at startup (if you connect it via HDMI) should be to set the password:
The password locked unit was shipped in retail packaging with serials that matched (box + device + SADP). The firmware installed appears to be US or ML (not hacked, not CN), but the serial seems a little odd. The other used (verified US) unit that I have has a serial number that starts with 6591xxxxx and has a canned verification code for Hik-connect on the label. The manufacture date of that unit is 2016. The password locked unit has a serial number that starts with 1351xxxxx and no precreated hik-connect code. Lower serial number, same exact model? The manufacture date of the password locked unit is less than six months ago - Nov 2017. The other odd thing is that the firmware on this new (password locked) unit was one build number newer than the latest version of the firmware posted (anywhere) for their I series NVRs.
I recently had a grey market DS-2CD2132 camera that I attempted to update the firmware, which lead to tftp recovery (which consequently removes the device configuration and password). The normal tftp recovery process (where it reaches out to 192.0.0.128) seems to have been removed from the most recent versions of Hik firmware though... So I started looking for something similar to the serial recovery that I had seen on some camera posts. I did find a few posts with folks attempting the same thing on an NVR (with mixed success) but the only posts with any real details at all were related to cameras.
I'm a firm believer in the right to repair. I have huge issues with Hikvision's password reset policy / distribution polices. I understand their viewpoint / concerns about products not sold through authorized channels and could even agree with not providing support to these units, but what they have done is quite different. Not only will they not support you with your unauthorized product, but they have injected themselves into the most basic support item (password resets) which lets them force these units out of service early. They have continually worked to lock their products down as well, so even with physical access, you may just end up with a paperweight (and no way to really tell if this will be the case before buying). None of this seems to be in the interest of their customers. It all seems to be borne out of their desire to control/protect regional pricing (vs using a global pricing model) and their inability to control what their distributors/resellers are doing. So they lock things down and make it more difficult for end users. If I didn't know what I was getting into and as a hobbyist had dropped several hundred on what I thought was a DIY system and they told me to go kick rocks when I asked for a password reset, I probably would blame the source of my purchase a lot less than I blame the manufacturer of the product (with the insane policies).
So outside of sticking it to Hikvision, the main purpose of this post is to put all the information regarding Serial TTL recovery in one place, so that the next guy doesn't have to jump through quite as many hoops as I did. The cable and basic steps here are identical for Hikvision cameras (although some disassembly is usually required to get to the connector on the camera).
The first thing to note is that most of the time when serial recovery is referred to with Hikvision, it's referring to TTL serial. There are some NVRs that support RS232 connections, but you can usually tie into these on the back (without opening it up) through the terminal block and/or a dedicated serial port. A TTL Serial to USB cable can be purchased for $3-10 from various online sources. On one end you will see a USB connection, and the other will have 3-4 wires. You can read about the differences between TTL Serial and RS232 ("normal" serial) here: RS-232 vs. TTL Serial Communication - SparkFun Electronics
Supplies
- TTL Serial Adapter ($5-15)
- Ethernet cable
- Four pin JST ZH cable (1.5mm pins) (Amazon, eBay, etc)
- Windows laptop/desktop
- Latest (or deisred version) firmware for NVR
- PuTTY (terminal software) - link within instructions
- tftpd32 (to send firmware to NVR) - link within instructions
You should be looking for a four pin JST ZH header on the mainboard, that looks like this:
Here it is on a camera board:
An older Analog NVR:
A DS-7604:
A DS-7608:
You may see more than one JST connector. If you do, you may need a multitester to determine the pinout, or to see if it's actually a TTL serial connection. It's fairly easy -- one outer pin should be hot, the other should be a ground. Ground is pin #1, hot is pin #4. On my unit, pin #1 (ground) had a white arrow printed on the PCB next to it. If you don't read anything from these two pins with the unit powered on, it's probably a safe bet that it's not a TTL serial port.
After finding your port you will need to get (or fabricate) a four pin JST ZH cable. The pins are 1.5mm apart. Best bet is to purchase a pre-made cable (easily sourced online):
This is a common connector (used with some LiPO cells) so I actually had a bag of two pin headers+connectors laying around. I opted to fabricate, since I didn't want to wait for the proper cables to ship. If you have two pin headers, you can simply file down one side of each so that you can get both in the four pin socket.
You'll also need that TTL Serial adapter:
Please note, the first two sections here simply tell you what the pinouts are for each side (JST And TTL Cable). These are for reference only and do not reflect how you should actually connect things up (see below the rx/tx diagram for this info). Power should be turned off (via power supply switch or cable pulled) while you are tinkering around inside.
TTL Serial Cable Pinout
Red = 5v
Black = Ground
White = RX (into USB)
Green = TX (out of USB)
JST Pinout
Pin 1 = Ground
Pin 2 = TX (out of NVR)
Pin 3 = RX (into NVR)
Pin 4 = 3.3v
When connecting, RX goes to TX as shown here:
How to connect your cable:
JST Pin 1 -> TTL Ground (black)
JST Pin 2 -> TTL RX (white)
JST Pin 3 -> TTL TX (green)
JST Pin 4 -> NO CONNECTION
IMPORTANT: THE RED (+5V) LEAD SHOULD NOT BE CONNECTED TO JST PIN 4. YOU ONLY NEED THE TX/RX/GROUND CONNECTIONS TO MAKE THIS WORK. YOU COULD POTENTIALLY DAMAGE THE UNIT IF YOU CONNECT THE RED(+) LEAD!
Here is my ghetto cable installed w/TTL Serial adapter connected. Note that the fourth pin has no connection (it's not touching the power supply in the pic either - just an angle issue with the photo):
After you are done wiring things up, you will need to connect the USB side of the TTL Serial adapter. You may need to install drivers from the manufacturers site. I did not have good luck when trying to pass one of these adapters through VMware Fusion to a Windows 10 VM. I ended up breaking out an old Windows 7 laptop in the end.
My adapter (the one shown in this pic) uses a PL2303 chip. You can get the latest drivers here:
Products
You will need to download PuTTY (or a terminal emulator of your choice that supports serial):
Download PuTTY - a free SSH and telnet client for Windows
You will need a plain TFTP server (not the one from Hikvision). I recommend using the portable version of tftpd32 (free). Extract to a subfolder of your downloads folder and run it from there:
TFTP server
You will also need an ethernet cable (crossover not required) to get the firmware (firmware is not transferred through the serial connection).
Your ethernet cable can be connected in one of two ways:
- Directly from NVR to the Laptop/Desktop that you are using
- From NVR to the same network segment (same vlan/subnet) that the Desktop/Laptop is on
If you go with #1 (which was easiest for me), you will need to manually set the IP address on the computer. Network adapter settings, right click the network adapter, double click TCP/IP V4, enter as shown below:
Now you need to figure out what COM port that the TTL Serial adapter has been assigned to. Open Device Manager in Windows, click the > by "Ports (COM & LPT)" and you should see COM#. If you see more than one COM port listed and you aren't sure which to use, note the COM port numbers used - you may have to test each one with PuTTY as the NVR boots to figure out which is the correct one to use (trial and error).
After you have the COM Port(s) information, open up PuTTY. On the first screen you see, select "Serial" for Connection type, manually type your port under Serial line. My adapter came up on COM6 (shown below). Speed should be set to 115200:
Click on serial (bottom of the list on the left), make sure the Serial line to connect to matches what you entered on the first screen, as well as the speed. Data bits 8, Stop bits 1, Parity None (these should be the default settings). Change flow control to none/off (not a default setting!).
Once complete, click Open, then power on your NVR. If you have the correct port selected, you should see something like this when it powers on:
Let's move on to setting up the TFTP server. I'm only providing instructions for tftpd32, but the setup should be similar with other tftp server software. When you initially open tftpd32 you may see some firewall prompts etc. Adding exceptions is fine, but if your NVR and the TFTP server don't seem to be communicating, you may want to disable windows firewall as a first step when troubleshooting. Once tftpd32 is open, click the settings button at the bottom. Click the global tab, uncheck DHCP server. Click the TFTP tab and select "None" for TFTP security. Click OK, it will tell you you have to restart the app, click OK, close the app, reopen.
Now you need to download firmware from Hikvision. I had a US model, so I used the US firmware. I actually loaded a version that was one release number behind the version that was installed. I had zero issues but your mileage may vary here. If you choose the wrong firmware (and don't have a grey market model with hacked firmware) it will do the usual checksum/region mismatch and won't install the firmware file. Download the latest firmware release for the NVR and extract the zip file. The digicap.dav file inside the zip needs to be copied into the root folder of tftpd32 (this is why I recommend the portable version - configure + drop the file in the same folder).
At this point you should have the TTL Serial cable all set, the COM port verified, PuTTY setup, tftpd32 setup and running with the firmware that you want to install to the device residing inside the tftpd32 folder.
From here:
- Power on NVR
- Press CTRL-U to interrupt boot process
- Press u (to upgrade software)
- IP of device (NVR)
- If you direct connected to the computer you can use 192.0.0.64 as the IP
- If you connected to your existing LAN, you need to enter an unused IP on the same subnet as the machine that is hosting tftp services
- IP of server (Laptop/Desktop with tftpd running) - mine was set to 192.0.0.128
- Press y to confirm (then press enter)
- From here it should download + install the firmware file
- At the end of the installation it will say "Press ENTER to reboot" -- press enter
Firmware should be loaded and all configuration (including password) should be cleared. All cables can be removed and the NVR can be setup/moved/etc. It will be in an unactivated/inactive state with no password set at all. The first screen that you see at startup (if you connect it via HDMI) should be to set the password:
Last edited:
It looks similary to Gregs53 problem. thx