Bricked DS 7608n-e2p chinese model

[Greener95]

Hi, I have a DS7608n-e2 Chinese model hacked with English firmware, tried to update now bricked. Does anyone have or know how to get or change firmware.
Have tried to update via tftp. And get to the point of language mismatch.
If anyone can help will be much appreciated

 

[trempa92]

I might have found the thread someone else posted while ago that might match your device

Please Help: Upgrading chinese DS-7608N-E2 NVR Firmware

I have an old Chinese DS-7608N-E2/8P with hacked to English firmware (v3.0.5 Build 140508). I would like to upgrade the firmware so I can use newer h265 cameras. I understand the following from reading this forum (please correct me if I have this wrong): The latest version I can upgrade to is...

ipcamtalk.com

 

[Greener95]

Cheers, I think I seen this one earlier. Got so far, but hiktools051rar wouldn't install properly, so unable to language header

 

[alastairstevenson]

There are at least a couple of ways to get the CN E-series NVR back working after applying EN firmware.
If the last firmware was old enough that the 'as-built 'bootpara' data is still in plaintext, then it can be edited to permanently change the language to EN
On newer firmware (I don't recall exactly which version) Hikvision added encryption to the bootpara block after reading here on IPcamtalk how it could be changed.
The encrypted block can still be decrypted, but the encryption key isn't fixed, it's derived from another device-specific hidden block in a flash segment so a fair bit more work.
As you've already shown you know how to use the serial console, you could have a go with the bootpara edit method below.

Another way is to install 'hacked to English' firmware that has been tweaked to ignore the language byte and force it to EN from CN.

See the method here :

How to - Fix your 15-beep-bootloop Hikvision DS-76xxN-Ex NVR, or convert to EN and make it updatable

Here is a worked example of how to permanently change a Hikvision China language DS-76xxN-Ex NVR to an EN language device that will then take the stock EN/ML firmware. I've used a few Hikvision CN NVRs, bought at low cost off Aliexpress, and typically installed 'hacked to English' firmware to...

www.ipcamtalk.com

 

[alastairstevenson]

so unable to language header

Changing the language header doesn't change the language coded in the NVR - it just stops the NVR rejecting the attempt to load other-language firmware.

 

[Greener95]

Thanks Alistair, the only bit I am unsure about is....
Pull a copy of the (normally hidden and protected) first half of mtdblock1. This holds the device 'hardware descriptor block?

 

[alastairstevenson]

Pull a copy of the (normally hidden and protected) first half of mtdblock1. This holds the device 'hardware descriptor block?

The way to do that is shown in the transcript in post #1
Click the 'Spoiler' to expand, it's a bit long so would otherwise clutter up the post.

 

[Greener95]

That's great, will give it a go later, many thanks,

 

[Greener95]

hi, had this message
8041e140: ffffffff ffffffff ffffffff ffffffff ................
8041e150: ffffffff ffffffff ffffffff ffffffff ................
8041e160: ffffffff ffffffff ffffffff ffffffff ................
8041e170: ffffffff ffffffff ffffffff ffffffff ................
8041e180: ffffffff ffffffff ffffffff ffffffff ................
8041e190: ffffffff ffffffff ffffffff ffffffff ................
8041e1a0: ffffffff ffffffff ffffffff ffffffff ................
8041e1b0: ffffffff ffffffff ffffffff ffffffff ................
8041e1c0: ffffffff ffffffff ffffffff ffffffff ................
8041e1d0: ffffffff ffffffff ffffffff ffffffff ................
8041e1e0: ffffffff ffffffff ffffffff ffffffff ................
8041e1f0: ffffffff ffffffff ffffffff ffffffff ................
HKVS # tftp 0x80400000 mtd1_part1 0x20000
timeout for link [5000]!
MAC: BC-AD-28-EC-F9-75
TFTP to server 192.168.1.99; our IP address is 192.168.1.214
Upload Filename 'mtd1_part1'.
Upload from address: 0x80400000, 0.128 MB to be send ...
Uploading: *
TFTP error: 'Access violation' (2)
Not retrying...

firmware in tftp folder is

https://www.hikvisioneurope.com/eu/portal/?dir=portal/Technical%20Materials/02%20%20NVR/00%20%20Product%20Firmware/07%20E-series/%5B7600NI-E1%28E2%29%207700NI-E4%5D/V3.4.2%20build160205%20English%2B%20Multi-lingual

 

[alastairstevenson]

hi, had this message

You've only shown the end part of the serial console transcript - missing the important part from 8041e000 that will show if the bootpara block is encoded or is still plaintext.
In PuTTY, see the 'copy rollback to clipboard' option in the top left menu of the window - then you can paste the whole thing into such as Notepad to save and edit and share as needed.

TFTP to server 192.168.1.99; our IP address is 192.168.1.214

These were just the IP addresses I happened to use that were valid for my network environment.
For serverip you need to use the IP address of the PC that's running the tftp server.
For ipaddr just pick an unused IP address in the same range as the PC is using.

 

[Greener95]

Hi alastair, i have attached transcript until the point of TFTP error: 'Access violation

 

[alastairstevenson]

i have attached transcript until the point of TFTP error: 'Access violation

Well done, that's clear.
Unfortunately, it shows that the bootpara data has been encoded, it's no longer in plaintext, so that fix route isn't easily available.

The next route could be to apply 'hacked to English' firmware.
This can be applied via the tftp updater method, using the 'upgrade firmware' menu that appears just before using the 'b' command to get down to the command prompt.
Check your 'Conversations'.
But to use that, you'll need to sort the reason why the tftp server isn't responding.
It might be the Windows firewall is blocking access. Did you get an 'Allow access' prompt the first time you started the tftp server?
Or it might be file permissions in the folder where the tftp server is running.

Also - have you definitely used the actual PC IP address in the command dialogue?

 

[Greener95]

I tried download firmware via tftp just to see if working and yes it's downloads firmware then says language mismatch or something.
I also turned firewall just incase but made no difference.
PC is set to 192.0.0.128 and choosing that within tftp setting,
Will look at file permissions on the folder in tftp.

 

[alastairstevenson]

Don't worry about file permissions - that routes not useful now, no need to upload files.

But the tftp updater is working ok, so you'll be able to load the files in your conversations.

 

[Greener95]

Manage to download and install the hacked to English version first time, so now back where I started originally. Many thanks for you time.
Will just have to live with the older version

 

[alastairstevenson]

Well done, that's a good result.
3.4.96 isn't that old, there was little change after that version.