DS-7204 HGHI-SH hiktools firmware error

[advtelecom]

Hi to all...
i am new in the forum.
i have purchased regulary hikvision DS7204 model with multilanguage firmware.
I need to remove the "alarm icon" sovraimposed in video out.

-I have decompiled the digicap.dav original firmware with "hiktools split" command.
-The output file created in the new folder is "cramfs.img"=14.108 KB

-I have extract, modified and recompiled the ".png icon" in the app.tar.lzma file.
-When i have recompiled the firmware with "hiktools create digicap.dav "nameFolder" command, i obtain the new firmware ricompiled with the new name "namefolder.dav".

The magic number is OK "0X484B573" , but the DVR abort when upgraded with error message.
I have find that the dimension of the original digicap.dav and the new.dav firmware are not the same dimension.
The original digicap.dav=25.613 KB
The new (rinominated) digicap.dav=14.149 KB (as original cramfs.img decompiled image + -)

NOTE: If i recompile the ORIGINAL cramfs.img ( don't the modified) with "hiktools create" command i have the same error...!!!!

Guys....
can help me to find the error ???
regards
Maurizio

 

[alastairstevenson]

It sounds like the 'split' is not fully extracting the cramfs.img Maybe that type of firmware header isn't supported by Hiktools.
Assuming that your NVR (I'm unfamiliar with that model) holds the cramfs.img in mtdblock2, and you have access to the NVR Linux command line via telnet, you could work directly with cramfs.img and mtdblock2.
I'm going to make a big assumption here that the flash organisation on your NVR is the same as what I am familiar with on 78XXN-E2 series. Don't proceed unless this is familiar to you.

dev: size erasesize name
mtd0: 00030000 00010000 "mtdblock0"
mtd1: 00020000 00010000 "mtdblock1"
mtd2: 00fb0000 00010000 "mtdblock2"

But first check if the size of an extracted mtdblock2 is 108 bytes less than the size of the digicap.dav
I'm assuming you know how to copy mtdblock2 and to transfer files to and from the NVR. And that mtdblock2 is mounted on /home/hik as on the 78xxN-E2 series.
If you strip 108 bytes from the beginning of digicap.dav, you will be left with the cramfs.img file which you have presumably mounted and modified in a Linux environment.
Assuming you have then copied your modified cramfs.img to the NVR, you can apply it like so:
umount /dev/mtdblock2
cat cramfs.img > /dev/mtdblock2
(this can take 1-2 mins for the flash erase / write)
mount /dev/mtdblock2 /home/hik
reboot

 

[advtelecom]

Many thanks for you fast reply.

With the "df" command in telnet connection i find only mtdblock1.
In this DVR i can't see further mtdblock.

this is the telnet display:

[root@dvrdvs /] # df -a
Filesystem 1024-blocks Used Available Use% Mounted on
proc 0 0 0 0% /proc
sysfs 0 0 0 0% /sys
udev 62508 4 62504 0% /dev
devpts 0 0 0 0% /dev/pts
/dev/mtdblock1 11508 11508 0 100% /home/hik

I have unmounted mtdblock1 and installed with "cat" command the new cramfs.img, but the dvr after reboot is locked and don't work.
I must recovery firmware with tftp hikvision tool.

i am doing wrong something ?
many thanks for you patience
Maurizio

 

[alastairstevenson]

It looks like your NVR flash is not organised in the same way at 78XXN-Ex or 76XXN-Ex
It would be risky to use the same methods, or make the same assumptions, as can be used on those models.
I do hope that you can recover your NVR using TFTP.

"Don't proceed unless this is familiar to you." showed the arrangement for 78XXN-Ex, yours is different.
Clearly from your 'df' output, mtdblock1 is not in any way large enough to hold the firmware. There will be other storage. df will not show what's not mounted.
Did you check "cat /proc/mtd" to see what partitions are defined?
Did you back up the flash partitions before making any changes?

 

[advtelecom]

Hi
many thanks
with "cat /proc/mtd" i have this reply:

dev: size erasesize name
mtd0: 00030000 00010000 "mtdblock0"
mtd1: 00fa0000 00010000 "mtdblock1"

but the "mtdblock0" is used for system boot ?
i can't to erase right ?

 

[alastairstevenson]

Hello,
As the flash layout on your NVR is different from what I have seen on 78xxN-Ex and 76XXN-Ex series, I have no idea if the mtdblock0 is used for the system boot.
From your info above, mtdblock1 is sized at 16MB.
Have you managed to use TFTP to recover your NVR into a working state?
That might be the first priority before looking to modify the firmware.

 

[advtelecom]

Hi.
Yes the recovery procedure work fine.
If the mtdblock1 is sized at 16 MB i don t understand because don t work with the cramfs.IMG installed correctly.
After the installation of the new image file, i see the all files installed in /home/hik
Mistery....

 

[alastairstevenson]

Well that's good that you recovered the NVR, well done.

 

[advtelecom]

The last version of the "hiktolls" is the 04 ?

 

[alastairstevenson]

Yes, that's correct, 04R is the latest version published on this forum.
I doubt that @wzhick tested the software on a DS-7204 HGHI-SH NVR, however it's been used on multiple models of camera, and various models of NVR with good results.
Did you download the 'digicap.dav original firmware' from a Hikvision site, if so could you provide a link to it?

 

[advtelecom]

Hi
is impossible to install new cramfs.img, because the dvr go in crash. The next step is try to change only the app.tar.lzma file in the home/hik dir.
but is a read only dir.
I want to umount the mtdblock1 and modify mtdblock1 right to write/read mode, in order to change the app.tar.lzma file.
I think that the the option are: modify "fstab" in /etc/fstab, or modify "mtd" in /proc/mtd.
It can be a solution ? ( sorry but i unknow linux OS)
regards
maurizio

 

[alastairstevenson]

but is a read only dir.

Yes, cramfs is a Read-only file system (Compressed ROM File System) so you cannot change the contents while it is mounted.

is impossible to install new cramfs.img, because the dvr go in crash.

Have you tried re-applying the existing mtdblock1 unchanged to see if the NVR is happy with that?
You need to change directory to somewhere that has enough free space. Then

umount /dev/mtdblock1
cat /dev/mtdblock1 > mtd_temp
cat mtd_temp > /dev/mtdblock1
mount /dev/mtdblock1 /home/hik

Also - apologies if this is what you are already doing - you can mount cramfs.img on a Linux system, copy the files out to a new folder (as it's read-only), modify as needed, the re-assemble a new cramfs.img using
mkfs.cramfs -v source_folder destination_image_filename
and you should be able to apply the new cramfs.img directly, without using Hiktools.

 

[wzhick]

Hi to all...
The original digicap.dav=25.613 KB

Give me a link to the original firmware you use to modify.

 

[advtelecom]

many thanks...
this is the link to download the correct firmware version:
http://www.hikvisioneurope.com/portal/index.php?dir=Product Firmware/Recorder/DS-7100 7200 7300 8100 HGHI HQHI-SH/V3.0.4 build140923 Multi-lingual/

I try to use the installed firmware to modify, as your example..
thanks.....!!!!!

 

[wzhick]

many thanks...
this is the link to download the correct firmware version:
http://www.hikvisioneurope.com/portal/index.php?dir=Product Firmware/Recorder/DS-7100 7200 7300 8100 HGHI HQHI-SH/V3.0.4 build140923 Multi-lingual/

Very strange firmware. Unfortunately, I can not fully understand why it was done without the device.


This file contains two firmaware connected in series. In the header of each of them contains information about only one file. Therefore, the utility cut only one file, the length of its specified in the header, and the rest are discarded.


The second firmware begins at offset 0x00DC706C. You can cut the original file into two parts at this offset by any hex-editor like hiev. Then unpack each part separately using hiktools. You get two different cramfsimages. After editing, repack them back using hiktools.


and the last - reassemble "big" firmware using the command

copy 1.dav + 2.dav big.dav