UART/RS232 on NBD8008R - 3536DV100 V1.01

[Nhat Huy]

can you share me backup rom hex. i unbrick my nvr i lose uboot

 

[kirikomori]

Hey, nice guy.
Thank you very much for Haching.It became very helpful.
Before discovering this article, connect a serial console,I just looked at "Starting kernel ..." and gave it up.

Unlike Firmware, I examined the defeat of the control panel, so keep the circuit diagram.

For all NBD8008R users

 

[divx118]

@kirikomori Thanks for the diagram, I can use that to control the menu with my raspberrypi.
@Nhat Huy What do you exactly want? You can just download the firmware and unpack it to get the hex data.

 

[Nhat Huy]

i have a nvr board use Hi3536D chip all schematic same NBD8008 xiongmai hardware. I try flash uboot and then flash fw via UART, nvr boot up and run but only 1 frame and serial and mac is default. Maybe i lost rom chip 24c08 ( mac + serial ) or it include master rom ( address 3FC00 to 40000) can you backup your rom via UART but I worry i do it you and me same cloud id.

 

[divx118]

@Nyat Huy, that is what I mean. You can get the right files from the firmware file.
General_General_NBD8008R-PL_V4.02.R11.7601.Nat.OnvifC.20180901.bin
Just unzip the .bin to get the below files and then flash them in uboot. Reflashing romfs, web and custom should get you going again.
web-x.cramfs.img
custom-x.cramfs.img
user-x.cramfs.img
romfs-x.cramfs.img
logo-x.cramfs.img
u-boot.bin.img
InstallDesc

BTW sorry for the late reaction. a bit too busy at work lately.

 

[divx118]

If someone wants to build a box with a 3D printer for the NBD8008R - 3536DV100 V1.01 print I have designed a simple one Search Thingiverse - Thingiverse Tinkercad links are also there so you can customize it. There are 3 parts bottom, top and back. HDD can be screwed to the top.

 

[runekyndal]

i have the same board. and i have unfortunately bricked it. (working U-boot)
but corroupted kernel

i have not been able to find the kernel in any update files yet.

any chance you have a complete dump file, individual files to help me recover via TFTP?

u-boot.bin.img
user-x.cramfs.img
romfs-x.cramfs.img
web-x.cramfs.img
logo-x.cramfs.img
custom-x.cramfs.img

update.img
zImage.img
mtd-x.jffs2.img

or could pull them off your working board for me ?
would be greatly appreciated

 

[runekyndal]

bit of pinout i found / fixed

 

[divx118]

@runekyndal It loads the kernel (zImage) from the romfs image. See the output of the serial console. So if you already reflashed the romfs image, and it still doesn't want to boot the kernel, you are using the wrong firmware.

find_squashfs_file: name bin, start_block 0, offset 2676, type 1

find_squashfs_file: name boot, start_block 0, offset 2916, type 1

read inode: name boot, sb 0, of 2916, type 1

find_squashfs_file: name zImage.img, start_block 0, offset 2708, type 2

read inode: name zImage.img, sb 0, of 2708, type 2

### FS load complete: 2821835 bytes loaded to 0x81000000

## Booting kernel from Legacy Image at 81000000 ...

   Image Name:   Linux-4.9.37

   Image Type:   ARM Linux Kernel Image (uncompressed)

   Data Size:    2821771 Bytes = 2.7 MiB

   Load Address: 80008000

   Entry Point:  80008000

   Loading Kernel Image ... OK

OK



Starting kernel ...

 

[runekyndal]

hm.. well if that's the case, then im in a bit of a pinch. i have tried several firmwares. unpack into my TFTP folder and flashed with "run da" , du,dr,dw,dl,dc

my most current boot up

U-Boot 2010.06-svn1009 (Apr 23 2018 - 15:33:45)

Check Flash Memory Controller v100 ... Found
SPI Nor(cs 0) ID: 0xef 0x40 0x18
spi_w25q256fv_qe_enable(193): Error: Disable Quad failed! reg:0x2
Block:64KB Chip:16MB Name:"W25Q128(B/F)V"
CONFIG_CLOSE_SPI_8PIN_4IO = y.
at hifmc100_setTB() mid:0xef,chipsize:0x1000000 <no>.
unlock all.
SPI Nor total size: 16MB
In:    serial
Out:   serial
Err:   serial
USB:   scanning bus for devices... 2 USB Device(s) found
usb_stor_get_info->1431,blksz:512
1 Storage Device(s) found
device name usb!
Interface:  USB
  Device 0: Vendor: SCSI     Rev: 1.00 Prod: DISK1.8.4.9.656
            Type: Removable Hard Disk
            Capacity: 7695.0 MB = 7.5 GB (15759456 x 512)

No valid FAT fs found
file_fat_detectfs failed, name:usb
PHY 0x02: OUI = 0x1374, Model = 0x07, Rev = 0x02
Net PHY: AR8035
at higmac_demux() phy_intf:2 [0:mii,1:rmii,2:rgmii];MAC_TXCKOUT_MUX_REG value:0x1 [1,rgmii;2,mii;3,rmii;]
PHY 0x02: OUI = 0x1374, Model = 0x07, Rev = 0x02
change register for AR8035
CONFIG RGMII <<222>>
at higmac_net_adjust_link() port_mode:45,speed_mode:0
ETH1: PHY(phyaddr=3, rgmii) link UP: DUPLEX=HALF : SPEED=10M
MAC:   00-0B-3F-00-00-01
Press CTRL-C to abort autoboot in 2 seconds16384 KiB hi_fmc at 0:0 is now current device
CFG_BOOT_ADDR:0x0 argc 2 argv[0] logoload
### /UbootLogo/ UbootLogoload complete:bytes  oadaddr0x82000000 loaded to 0x9f000000
cramfs: wrong magic
cramfs: wrong magic
### /UbootLogo/ LOAD ERROR<ffffffff> !
jpeg decoding ...
<<addr=0x9f000000, size=0xb85f9, vobuf=0x9f600000>>
addr:0x80870b24,size:755193,logoaddr:0x9f000000,:ff,dd
load jpeg err.
stMaxRect.u32Width:1024, stMaxRect.u32Height:768.
HDMI_INFO:DispFmt2HdmiTiming[383] ,Non CEA video timing:17
HDMI_INFO:Hdmi_PixelFreqSearch[127] ,u32Fmt17.
srcAddr 0x82000000, dstAddr 0x81000000
unknow
read_super_m faile
### FS LOAD ERROR<0> for boot/zImage.img!
Wrong Image Format for bootm command
ERROR: can't get kernel image!
hisilicon #

and now this morning... u-boot not so much either... Sigh.

I'm pretty sure i have a bad flash chip. and / or pretty propper bricked haha..
i have the new part and it looks like i will need to program that and replace

any chance of making / finding a complete working .hex file for programming direct like that ?

R

 

[runekyndal]

i think something along these lines should dump the whole 128kbit flash chip to RAM, and then push to TFTP ?

# sf probe 0;sf read 0x82000000 0x0 0x1600000
# tftp 0x82000000 flash.bin 0x1600000

but i'm not entirely sure? also not sure if that's usable to program direct onto the 25q128 with external programmer?

do you mind doing that? id give it a try anyway

R

 

[divx118]

For some reason I cannot read the flash in u-boot when starting at ie 0xb10000 where the web squashfs files starts. It gives me an "ERROR: read/write area is out of range!" I only can read part of the flash, which is weird. It seems locked.
So sadly I can't help you with that, however you can just use the image files and strip of the uboot header.

binwalk user-x.cramfs.img

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             uImage header, header size: 64 bytes, header CRC: 0x6EF60315, created: 2018-07-19 13:47:28, image size: 4718592 bytes, Data Address: 0x430000, Entry Point: 0xB10000, data CRC: 0x2A278CF8, OS: Linux, CPU: ARM, image type: OS Kernel Image, compression type: gzip, image name: "linux"
64            0x40            Squashfs filesystem, little endian, version 4.0, compression:xz, size: 4717676 bytes, 153 inodes, blocksize: 65536 bytes, created: 2018-07-19 13:47:28

Then:
NOTE: skip is the decimal value of the binwalk output of Squashfs filesystem and count are the size in bytes of the squashfs filesystem. You also will see Data Address: 0x430000, Entry Point: 0xB10000 in the uboot header which is important for where it should be on the flash.

dd if=user-x.cramfs.img bs=1 skip=64 count=4717676 of=user-x.cramfs.img.stripped
4717676+0 records in
4717676+0 records out
4717676 bytes (4,7 MB, 4,5 MiB) copied, 10,593 s, 445 kB/s

When I look at your latest output on serial, it seems that you need signed firmware. This could be because you flashed a wrong uboot. I never touched the uboot on my device, too dangerous IMO. When you have a good uboot it is easy to reflash the rest if something goes wrong.

cramfs: wrong magic
cramfs: wrong magic

When I do a printenv in my uboot shell I have a variable set "verify=n" this could be the one that sets a check if you need a signed cramfs.

 

[runekyndal]

okay. thanks for trying..

im 100% now that i need to replace the flash chip. so i need to program the whole thing, uboot and all.
so stripping the uImage header off one of my user-x.cramfs.img files as per above should produce a flashable file ?

R

 

[divx118]

so stripping the uImage header off one of my user-x.cramfs.img files as per above should produce a flashable file ?

Yeah, you should do that for all the files to get the complete flash. You also could try uboot first and see if that works. Then flash the rest from the uboot shell.

To clarify: The user-x.cramfs.img was just an example file.

 

[runekyndal]

ok, i got a stripped u-boot file now, just cobbling together a programmer (just ordered a dedicated one online) but i got a few options here.
i think my buspirate is the go-to for this

u-boot should be programmed, star starting 0x1000000 i believe?

R

 

[divx118]

u-boot should be programmed, star starting 0x1000000 i believe?
R

No, at least not on my firmware and others also not that would be not logical. It would normally always start at 0x0

maurice@maurice-N73SM:~/Downloads/extract$ binwalk u-boot.bin.img

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             uImage header, header size: 64 bytes, header CRC: 0x865B27D3, created: 2018-07-19 13:47:22, image size: 140597 bytes, Data Address: 0x0, Entry Point: 0x40000, data CRC: 0x37220CE3, OS: Linux, CPU: ARM, image type: Firmware Image, compression type: gzip, image name: "linux"
21664         0x54A0          LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 330144 bytes

Data Address: 0x0, --> starting at address 0x0
Entry Point: 0x40000 --> End address

So from 0x0 to 0x40000 is reserved for u-boot.

 

[runekyndal]

i'm trying to find where i got the 0x1000000 from... in my various screen logs.. oh well.

i will give 0x0 a go first.. i have converted my board to DIP8 now..

R

 

[runekyndal]

hm. so it took a couple of hours for flashrom to read in, write and verify u-boot.bin.img.stripped (u-boot.bin)? through my buspirate.
(successfully)

but no luck on boot up.

my uboot is only 139.373 byte ?

root@odroidxu4:~# binwalk u-boot.bin.img (before stripping uimage header)

DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
0 0x0 uImage header, header size: 64 bytes, header CRC: 0x94549E76, created: 2018-03-26 07:01:23, image size: 139373 bytes, Data Address: 0x0, Entry Point: 0x40000, data CRC: 0x43AD27C1, OS: Linux, CPU: ARM, image type: Firmware Image, compression type: gzip, image name: "linux"
19008 0x4A40 LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 335552 bytes

am i supposed to uncompress the bin file out of the .bin out of the img file first ? (335552 bytes)
which wont fit in the first 0-0x40000 reserved for uboot

R

 

[runekyndal]

starting the cooking over.. haha

General_General_NBD8008R-PL_V4.02.R11.7601.Nat.OnvifC.20180928.bin

root@odroidxu4:~# dd if=u-boot.bin.img bs=1 skip=64 count=4717676 of=u-boot.bin      (strip uimage header 64 byte)

root@odroidxu4:~# dd if=u-boot.bin of=flash-u-boot.bin bs=1 count=1 seek=16777215   (Expand image size to fit Flash size to avoid flashrom error)

root@odroidxu4:~# flashrom -VV -p buspirate_spi:dev=/dev/ttyUSB0 -c W25Q128.V -w flash-u-boot.bin  (flash 25q128 with flashrom and buspirate)

this is the workflow.. different bin file. but that's what didn't work for me

something obvious wrong ?

R

 

[divx118]

dd if=u-boot.bin of=flash-u-boot.bin bs=1 count=1 seek=16777215

This for me will create a file with all zeros. except the last byte --> bs=1 count=1
Try the following this will add zeros to the end of u-boot.bin until it reaches the size 16777215

 truncate -s 16777215 u-boot.bin