A little help please Onix N4-4POE (Hikvision NVR Grey Market?)

[azusbear]

Forgive me, if this is a double post or can be related to another post.
Before my wife kills me or I lose my mind, I am trying to update a Onix N4-4POE (Hikvision NVR Grey Market?) with current firmware 3.0.8 not english.
I have tried a few different firmwares but it never matches but, does not say language mismatch. I have it hooked up through ttl which works but, I did have tftp working on it I thought but, cannot get it to reconnect through network or direct wired from pc with 192.0.0.128 to 192.0.0.64 when rebooting it with any .dav file in the same folder C:\tfpt\tfpt.exe from the command line. I can log into busybox as SU but, can't log in as root in an attempt to copy the current firmware or read it since it keeps blocking me by permissions.
The logic board is stamped with DS-80109 rev1.3
serial# 0420150623BBRR524889734WCVU
Firmware v. V3.0.8 build 150209
Encoding Version V1.0 build 140828

I would be grateful for anyone that could enlighten me on a tip or trick to get past this or point out where I have lost my way so, I could speed up the process and get my wife to stop looking at me like a enraged madman.
Thankyou for reading.

 

[azusbear]

Ok tried http://192.0.0.64/SDK/language and noticed it was asking for login user and pw. if I input the user and pw i have set it would go to a blank page but, I think I tried admin or root with 12345 and got this.

<?xml version="1.0" encoding="ISO-8859-1"?>
<ResponseStatus xmlns="urnsialliance-org" version="1.0"> <requestURL>/SDK/language</requestURL> <statusCode>4</statusCode> <statusString>Invalid Operation</statusString> </ResponseStatus>

oh well, off to hikvision europe I go. psialliance.org is just another tree to beat your head against.

 

[azusbear]

What I have learned from my trip to Hik EU and playing around in busybox while hunting for a firmware or something that will give me a better response.

I wish I could find the match for it or could manage to get tftp going again just so I could get to the mtdblock1 to decode it. ( I'm overlooking something or something has changed to keep getting the message: tftp listening port initialize failed or it has been denied, Maybe tomorrow i'll go to china and try to make it through something there.

Here is the responses from busybox and commands listed you can use 95% of them do work. Help and another 5% don't work.



BusyBox v1.2.1 (2014.09.04-12:42+0000) Built-in shell (ash)
Enter 'help' for a list of davinci system commands.

# busybox
BusyBox v1.2.1 (2014.09.04-12:42+0000) multi-call binary

Usage: busybox [function] [arguments]...
or: [function] [arguments]...

BusyBox is a multi-call binary that combines many common Unix
utilities into a single executable. Most people will create a
link to busybox for each function they wish to use and BusyBox
will act like whatever it was invoked as!

Currently defined functions:
[, [[, ash, awk, busybox, cat, chmod, chown, cp, date, dd, df,
dmesg, du, echo, env, false, fdisk, free, gunzip, gzip, halt,
hdparm, hwclock, id, ifconfig, inetd, init, insmod, ip, kill,
killall, linuxrc, ln, login, ls, lsmod, mesg, mkdir, mkfs.msdos,
mknod, mount, netstat, ping, ping6, poweroff, ps, pwd, reboot,
rm, rmmod, route, sed, sh, sleep, stty, su, sync, tail, tar, telnetd,
test, tftp, top, true, umount, yes, zcat


BusyBox v1.2.1 (2014.09.04-12:42+0000) multi-call binary

Usage: dd [if=FILE] [of=FILE] [bs=N] [count=N] [skip=N]
[seek=N]

Copy a file, converting and formatting according to options

if=FILE read from FILE instead of stdin
of=FILE write to FILE instead of stdout
bs=N read and write N bytes at a time
count=N copy only N input blocks
skip=N skip N input blocks
seek=N skip N output blocks

Numbers may be suffixed by c (x1), w (x2), b (x512), kD (x1000), k (x1024),
MD (x1000000), M (x1048576), GD (x1000000000) or G (x1073741824)

# dd if=dav
dd: dav: No such file or directory
# dd if dav
BusyBox v1.2.1 (2014.09.04-12:42+0000) multi-call binary

Usage: dd [if=FILE] [of=FILE] [bs=N] [count=N] [skip=N]
[seek=N]

Copy a file, converting and formatting according to options

if=FILE read from FILE instead of stdin
of=FILE write to FILE instead of stdout
bs=N read and write N bytes at a time
count=N copy only N input blocks
skip=N skip N input blocks
seek=N skip N output blocks

Numbers may be suffixed by c (x1), w (x2), b (x512), kD (x1000), k (x1024),
MD (x1000000), M (x1048576), GD (x1000000000) or G (x1073741824)

eth0 Link encap:Ethernet HWaddr C4:2F:90:86:04:BE
inet addr:192.0.0.64 Bcast:192.0.0.255 Mask:255.255.255.0
inet6 addr: fe80::c62f:90ff:fe86:4be/64 Scope:Link
UP BROADCAST RUNNING ALLMULTI MULTICAST MTU:1500 Metric:1
RX packets:8260 errors:0 dropped:0 overruns:0 frame:0
TX packets:4565 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:1688518 (1.6 MiB) TX bytes:3645098 (3.4 MiB)
Interrupt:40

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:173 errors:0 dropped:0 overruns:0 frame:0
TX packets:173 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:31261 (30.5 KiB) TX bytes:31261 (30.5 KiB)

poe0 Link encap:Ethernet HWaddr C4:2F:90:86:04:BF
inet addr:192.168.254.1 Bcast:192.168.254.255 Mask:255.255.255.0
inet6 addr: fe80::c62f:90ff:fe86:4bf/64 Scope:Link
UP BROADCAST RUNNING ALLMULTI MULTICAST MTU:1500 Metric:1
RX packets:7999317 errors:0 dropped:0 overruns:0 frame:0
TX packets:3863418 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:2904949551 (2.7 GiB) TX bytes:270990072 (258.4 MiB)



[ERR][system/user/securityCtrl.c #100]: checkUserIdValid is ERROR
NTFS signature is missing.
Failed to mount '/dev/msb': Invalid argument
The device '/dev/msb' doesn't seem to have a valid NTFS.

Maybe the wrong device is used? Or the whole disk instead of a
partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?
ntfsCmd /home/app/ntfs-3g /dev/msb /mnt/msb ret -1

[ERR][system/upgrade/upgrade.c #326]: upgrade:device_class mismatch! device_class 41 [16]
[ERR][system/upgrade/upgrade.c #1490]: file numbers invalid!!!
[ERR][system/upgrade/upgrade.c #2427]: seem firmware not seeked!!!
[ERR][system/upgrade/upgrade.c #326]: upgrade:device_class mismatch! device_class 27 [16]
[ERR][system/upgrade/upgrade.c #1490]: file numbers invalid!!!
[ERR][system/upgrade/upgrade.c #2427]: seem firmware not seeked!!!

[ERR][system/upgrade/upgrade.c #326]: upgrade:device_class mismatch! device_class 27 [16]
[ERR][system/upgrade/upgrade.c #1490]: file numbers invalid!!!
[ERR][system/upgrade/upgrade.c #2427]: seem firmware not seeked!!!
[ERR][system/upgrade/upgrade.c #1490]: file numbers invalid!!!
[ERR][system/upgrade/upgrade.c #2427]: seem firmware not seeked!!!
[ERR][system/upgrade/upgrade.c #326]: upgrade:device_class mismatch! device_class 1500 [16]
[ERR][system/upgrade/upgrade.c #1490]: file numbers invalid!!!
[ERR][system/upgrade/upgrade.c #2427]: seem firmware not seeked!!!
[ERR][system/upgrade/upgrade.c #1490]: file numbers invalid!!!
[ERR][system/upgrade/upgrade.c #2427]: seem firmware not seeked!!!

[ERR][system/upgrade/upgrade.c #326]: upgrade:device_class mismatch! device_class 42 [16]
[ERR][system/upgrade/upgrade.c #2427]: seem firmware not seeked!!!
[ERR][system/upgrade/upgrade.c #326]: upgrade:device_class mismatch! device_class 42 [16]
[ERR][system/upgrade/upgrade.c #1490]: file numbers invalid!!!
[ERR][system/upgrade/upgrade.c #2427]: seem firmware not seeked!!!
[ERR][system/upgrade/upgrade.c #326]: upgrade:device_class mismatch! device_class 42 [16]
[ERR][system/upgrade/upgrade.c #2427]: seem firmware not seeked!!!
[ERR][system/upgrade/upgrade.c #326]: upgrade:device_class mismatch! device_class 42 [16]
[ERR][system/upgrade/upgrade.c #1490]: file numbers invalid!!!
[ERR][system/upgrade/upgrade.c #2427]: seem firmware not seeked!!!
[ERR][system/upgrade/upgrade.c #326]: upgrade:device_class mismatch! device_class 42 [16]
[ERR][system/upgrade/upgrade.c #1490]: file numbers invalid!!!
[ERR][system/upgrade/upgrade.c #2427]: seem firmware not seeked!!!

 

[azusbear]

Does anyone have any ideas or could you point at something or a post somewhere I may have missed?
I'm up for trying anything.

 

[azusbear]

Hik China didn't help.

I'm replying to my own thread and I plan to keep notes and plan to simplify the steps to help others once I do whatever needs to be done to update their NVR if I can.

I'm not familiar with the coding for busybox and if it was in a code i knew I would have fixed this situation by now.

If I can just figure out how to copy the firmware or filesystem to something else I can unlock and read encrypted or not, I might be able to get somewhere faster.

Think tomorrow if needed I'll load linux onto a bootable usb and get out an old laptop if I need to get that extreme.

Here is some more busybox info for anyone that wants to dig through this NVR's filesystem.


NTFS signature is missing.
Failed to mount '/dev/msb': Invalid argument
The device '/dev/msb' doesn't seem to have a valid NTFS.
Maybe the wrong device is used? Or the whole disk instead of a
partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?
ntfsCmd /home/app/ntfs-3g /dev/msb /mnt/msb ret -1
ntfsCmd /home/app/ntfs-3g /dev/msb1 /mnt/msb1 ret 0


$ ls
bin dev home mnt proc sbin sys var
dav etc lib opt root srv tmp
$ root
sh: root: Permission denied
$ lsusb
sh: lsusb: not found
$ ls dev
cmem loop3 pts ptypf tty7
console loop4 ptyp0 ram0 tty8
cuse loop5 ptyp1 random tty9
dbgdrv loop6 ptyp2 rtc ttyS0
etherd loop7 ptyp3 sda ttyS1
full mem ptyp4 sde ttyS2
fuse mtd0 ptyp5 sg0 urandom
hikio mtd0ro ptyp6 sg1 vcs
hw_random mtd1 ptyp7 ti81xx_mcasp vcs1
i2c-3 mtd1ro ptyp8 tty0 vcsa
input mtdblock0 ptyp9 tty1 vcsa1
kmem mtdblock1 ptypa tty2 zero
kmsg null ptypb tty3
loop0 port ptypc tty4
loop1 ppp ptypd tty5
loop2 ptmx ptype tty6
$ ls bin
[ cp free insmod mknod pwd su
[[ date getty ip modprobe reboot tar
ash dd grep kill mount rm telnetd
awk delgroup gzip killall netstat rmmod test
basename deluser halt ln ping route tftp
busybox df hwclock login ping6 sed top
cat dmesg ifconfig ls poweroff sh udhcpc
chmod echo inetd lsmod printf sleep umount
chown fdisk init mkdir ps stty
$ ls home
app hik shellpid
$ ls mnt
$ ls proc
1 177 230 35 cpu
10 178 239 36 cpuinfo
100 179 240 367 crypto
101 180 241 368 devices
11 181 242 37 diskstats
12 182 243 370 driver
13 183 2451 371 execdomains
139 184 2456 372 filesystems
14 185 246 373 flash_map
140 186 247 374 fs
141 187 248 375 interrupts
142 188 249 38 iomem
144 19 250 39 ioports
145 190 251 4 irq
148 191 252 40 kallsyms
149 192 253 41 kmsg
15 2 254 414 kpagecount
150 20 255 418 kpageflags
151 203 256 419 loadavg
152 205 257 420 locks
153 206 258 421 meminfo
154 207 259 423 misc
155 208 260 5 modules
156 209 261 564 mounts
157 21 262 565 mtd
158 210 263 566 net
159 211 264 567 nss-test
16 212 270 572 pagetypeinfo
160 213 271 573 partitions
161 214 272 574 sata
162 215 273 579 scsi
163 216 274 6 self
164 217 275 601 slabinfo
165 218 276 602 softirqs
166 219 277 7 stat
167 22 278 73 sys
168 220 3 74 sysrq-trigger
169 221 303 75 sysvipc
17 222 304 76 timer_list
170 223 307 8 tty
171 224 309 9 uptime
172 225 321 92 version
173 226 323 buddyinfo vmallocinfo
174 227 324 bus vmstat
175 228 325 cmdline zoneinfo
176 23 34 cmem
$ Adjust date/time from RTC.
ls sbin
iostat mpstat pidstat udev udevd udevinfo udevstart
$ ls sys
block class devices fs module
bus dev firmware kernel
$ ls sys firmware
ls: firmware: No such file or directory
sys:
block class devices fs module
bus dev firmware kernel
$ ls var
cmd.socket lock run
$ ls dav
$ ls etc
S_udev gshadow inittab profile services udev
TZ inetd.conf passwd protocols shadow udev.conf
group init.d passwd_nfs resolv.conf shadow-
$ ls lib
ld-uClibc.so.0 libdl.so.0 libpthread.so.0
libc.so.0 libgcc_s.so.1 librt.so.0
libcrypt.so.0 libm.so.0 libstdc++.so.6
$ ls opt
dvrCmd
$ ls root
$ ls srv
$ ls tmp
$ Adjust date/time from RTC.
ls home app
ls: app: No such file or directory
home:
app hik shellpid
$ ls home/app
ASC16 netOsd.bin pppd sysres
HZK16 nolink pppoe telnet.out
cmemdrv.ko noresource pppoed webs
hicore nosignal ptzCfg.bin
iscsi ntfs-3g sysVersion.bin
mcasp.ko player.bin sysmodel
$ ls home/hik
8107.tar.lzma dvrCmd.tar.gz uImage
app.tar.lzma hicore.tar.lzma versionctr.tar.lzma
custom_logo.tar.gz rootfs.img webs.tar.lzma
devCfg.bin start.sh
$ ls home/app/sysmodelAdjust date/time from RTC.

home/app/sysmodel
$ ls home/app/sysmodel
home/app/sysmodel
$ ls dev/hikio
dev/hikio
$ Adjust date/time from RTC.
ls -l
drwxr-xr-x 2 root root 2048 Sep 5 00:51 bin
drwxr-xr-x 2 root root 64 Sep 5 00:51 dav
drwxrwxrwt 6 root root 1580 Apr 30 01:23 dev
drwxr-xr-x 4 root root 640 Apr 30 01:23 etc
drwxr-xr-x 4 root root 160 Apr 30 01:23 home
drwxr-xr-x 2 root root 352 Sep 5 00:51 lib
drwxr-xr-x 2 root root 64 Sep 5 00:51 mnt
drwxr-xr-x 3 root root 96 Apr 30 01:23 opt
dr-xr-xr-x 190 root root 0 Jan 1 00:00 proc
drwxr-xr-x 2 root root 64 Sep 5 00:51 root
drwxr-xr-x 2 root root 288 Sep 5 00:51 sbin
drwxr-xr-x 2 root root 64 Sep 5 00:51 srv
drwxr-xr-x 11 root root 0 Apr 30 01:23 sys
drwxr-xr-x 2 root root 64 Sep 5 00:51 tmp
drwxr-xr-x 4 root root 160 Apr 30 02:23 var