DS-7604NI-E1/4P, DS-7608NI-E2/8P and DS-7616NI-E2/16P Firmware V. 3.3.6 Build 151229

[Travieso]

Re: DS-7604NI-E1/4P, DS-7608NI-E2/8P and DS-7616NI-E2/16P Firmware V. 3.3.6 Build 15

I usually use "Set Playback time"

 

[scn101]

Re: DS-7604NI-E1/4P, DS-7608NI-E2/8P and DS-7616NI-E2/16P Firmware V. 3.3.6 Build 15

I have a Chinese 7816N-E1 where prtHardInfo has Lang flag = 2 (same HW as the 76xxNI-Ex) that ran 3.0.10 in English. I've upgraded using the web GUI to 3.4.0 (loaded 3.4.0 with Lang = 2 flag) with no issues, all 2xx2 cams works in Hikvision mode, GUI remained in English. Here are my cams showing the orig FW version and the current running FW and if they've been treated to the mtd5/6 modification. All cams are from China (eBay and AE). Note that when I loaded 3.4.2 the NVR reverted to Chinese so I had to use the serial port u-boot tftp method to restore 3.0.10 in English and update to 3.4.0 again. I hope this helps someone.

Model Number	Orig	mtd5/6 hack	Current FW
	FW
DS-2CD2332-I	5.2.8	Yes	V5.2.5 build 141201
DS-2CD2332-I	5.1.6	Yes	V5.2.5 build 141201
DS-2CD2432F-IW	5.3.0	No	V5.2.5 build 141201
DS-2CD2332-I	5.2.8	Yes	V5.2.5 build 141201
DS-2CD2332-I	5.2.8	Yes	V5.2.5 build 141201
DS-2CD2335-I	5.3.5	No	V5.3.6 build 151221
DS-2CD2332-I	5.2.8	Yes	V5.2.5 build 141201
DS-2CD2332-I	5.2.8	Yes	V5.2.5 build 141201
DS-2CD3345-I	5.3.3	No	V5.3.3 build 150514
DS-2CD2332-I	5.3.0	No	V5.2.5 build 141201	Runs Whoslooking Downgrader
DS-2CD2532F-IS	5.2.8	Yes	V5.2.5 build 141201

Looking at the list above, I think only the cam that originally cam with 5.1.6 and has the mtd modification is eligible for FW upgrades to 3.3.x and higher. The rest I believe will cause issues if I update their FW. If anyone knows for sure please chime in.

 

[Ippo]

Re: DS-7604NI-E1/4P, DS-7608NI-E2/8P and DS-7616NI-E2/16P Firmware V. 3.3.6 Build 15

Ok so i have updated the firemware to 3.4.2_160205 yet my NVR is still bricked. by reading this forum, there won't be a problem.
can someone assist me to fix the NVR 7604.

I wish there is a forum that I can red with a Step by Step instruction on what firmware and what hack to perform to fix this.

 

[scn101]

Re: DS-7604NI-E1/4P, DS-7608NI-E2/8P and DS-7616NI-E2/16P Firmware V. 3.3.6 Build 15

If your NVR is a Chinese region NVR then most likely what has happened is that it is (language) rejecting the firmware. You can try to see if the NVR is attempting to retrieve a new firmware via TFTP during a reboot. You can then try to load in an earlier FW like 3.0.10 English. However, HV started to lock out FW downgrades so your only option will most likely be downloading 3.0.10 via a UART cable connected to the motherboard's UART connector. If you search this forum for tftp and uart you'll find a number of posts outlining how to do this. If you look for posts started be me, you'll see that I've felt your pain about one month ago.

 

[alastairstevenson]

Re: DS-7604NI-E1/4P, DS-7608NI-E2/8P and DS-7616NI-E2/16P Firmware V. 3.3.6 Build 15

I wish there is a forum that I can red with a Step by Step instruction on what firmware and what hack to perform to fix this.

Check my response to your other posts, and the PM from a week or so back.

 

[CoreyX64]

Re: DS-7604NI-E1/4P, DS-7608NI-E2/8P and DS-7616NI-E2/16P Firmware V. 3.3.6 Build 15

Hikvision NVRs do not respond to TFTP in the same manner as IPCs. A TTL-level serial connection (not RS-232 level) is required to unbrick these devices via the white 4-pin UART connector on the main logic board. With IP cameras, simply throwing up the Hikvision TFTP server with the proper firmware loaded into that directory is sufficient. Power on the camera, set the IPs accordingly, and done. It's a fairly straightforward recovery process once everything is set up correctly. NVRs are not the same. I've recovered many of these NVRs (the 3.1.x to 3.4.x upgrade bricks them every time) and all of them appear to be the same. While they still require TFTP for the transfer of the firmware itself, it's not automated like the IP cameras are.

IPCs have a version of U-Boot that within the first n seconds of power on, probe the network for a TFTP server at 192.0.0.128. If found, connect as client and attempt to pull digicap.dav, (The firmware), flash it, and reboot. (Sometimes the reboot doesn't happen I've found). In any case, that is an automated process.

NVRs on the other hand must be invoked manually. You need to PuTTY over serial/TTL directly into the boot loader to manually halt it. Once U-boot is stopped, there are a few prompts asking you for info. At this point, make sure your computer and recorder are both connected to your main network (no 192.0.0.128 necessary). It will ask you to set an IP for the recorder, then specify the IP of your TFTP server (your computer). It will start the firmware recovery process once you hit enter. It will not reboot after it's done, it requires hitting Enter in PuTTY over serial to finish it off (or a power cycle will work too).

What is remaining in my NVR stock from last year have already been bricked and firmware upgraded, so I'm not touching those again, but a friend of mine has a 7608 that is in need of a firmware upgrade which will result in a brick. I will write a step by step post sometime this week and link it here using that recorder. Details, screenshots and all. Give me until Friday. Have a few other things on my plate at the moment.


Sent from my iPhone using Tapatalk

 

[scn101]

Re: DS-7604NI-E1/4P, DS-7608NI-E2/8P and DS-7616NI-E2/16P Firmware V. 3.3.6 Build 15

I took a couple of pictures to show how to restore the NVR via U-boot and a serial UART connection. You'll need a TTL (not the higher voltage RS-232 version) UART USB dongle, a terminal program such as PuTTY or Tera Term or minicom, etc, set to 115K baud, no parity, one stop bit, 8 data bits. Lastly you'll need to connect to the motherboard of the NVR as shown in the pics for my setup. You'll also need to have a tftp server running on your PC with the new digicap.dav firmware file in the tftp send directory. When you turn on the NVR you will need to press crtl-u quickly (or the NVR will boot) to stop U-boot and you'll be presented with one option, to update as shown in the pic on the PC screen. There you'll specify the IP address for the NVR and your computer. The NVR will then do a tftp file get command looking for the file digicap.dav and your PC's tftp server should serve this file. The NVR will flash the new firmware and reboot. All done.

 

[Travieso]

Re: DS-7604NI-E1/4P, DS-7608NI-E2/8P and DS-7616NI-E2/16P Firmware V. 3.3.6 Build 15

That's pretty neat ^^

 

[benetton73]

Re: DS-7604NI-E1/4P, DS-7608NI-E2/8P and DS-7616NI-E2/16P Firmware V. 3.3.6 Build 15

I've searched everywhere, what cable do you actually use to connect to the motherboard
Thank you Brad

 

[alastairstevenson]

Re: DS-7604NI-E1/4P, DS-7608NI-E2/8P and DS-7616NI-E2/16P Firmware V. 3.3.6 Build 15

Here are a couple of pointers :
https://www.ipcamtalk.com/showthread.php/6356-Manual-Create-console-serial-access-to-Hikvision-DS-2CD2032F-I?highlight=uart+manual
https://www.ipcamtalk.com/showthread.php/2666-UART-connection-to-recover-Hik-cameras?highlight=uart

A search for "Mini. 1.25 4-Pin JST Connector" on your favourite on-line store will yield plenty of hits.

 

[benetton73]

Re: DS-7604NI-E1/4P, DS-7608NI-E2/8P and DS-7616NI-E2/16P Firmware V. 3.3.6 Build 15

Thanks for the response the only thing thats confusing is that on one post, it says a mini 1.5 4 pin jst
and another says mini 1.25 4 pin jst
i need the one that will connect to a nvr not a camera

 

[alastairstevenson]

Re: DS-7604NI-E1/4P, DS-7608NI-E2/8P and DS-7616NI-E2/16P Firmware V. 3.3.6 Build 15

That's quite confusing.
The connector is the same on Hikvision cameras and NVRs.
The correct type is "Micro JST ZH 1.5mm Pitch 4-Pin Female connector with wire "
This is where I bought mine from, ages ago. You should be able to find a more local source.
http://www.aliexpress.com/item/Micro-JST-ZH-1-5mm-Pitch-4-Pin-Female-connector-with-wire-and-Male-PCB-connector/1664241613.html?spm=2114.13010608.0.79.LSljcn

 

[benetton73]

Re: DS-7604NI-E1/4P, DS-7608NI-E2/8P and DS-7616NI-E2/16P Firmware V. 3.3.6 Build 15

thanks for clearing that up , and thanks for the link,
got everything ordered, now just waiting

 

[eXtremer]

Re: DS-7604NI-E1/4P, DS-7608NI-E2/8P and DS-7616NI-E2/16P Firmware V. 3.3.6 Build 15

Hikvision NVRs do not respond to TFTP in the same manner as IPCs. A TTL-level serial connection (not RS-232 level) is required to unbrick these devices via the white 4-pin UART connector on the main logic board. With IP cameras, simply throwing up the Hikvision TFTP server with the proper firmware loaded into that directory is sufficient. Power on the camera, set the IPs accordingly, and done. It's a fairly straightforward recovery process once everything is set up correctly. NVRs are not the same. I've recovered many of these NVRs (the 3.1.x to 3.4.x upgrade bricks them every time) and all of them appear to be the same. While they still require TFTP for the transfer of the firmware itself, it's not automated like the IP cameras are.

IPCs have a version of U-Boot that within the first n seconds of power on, probe the network for a TFTP server at 192.0.0.128. If found, connect as client and attempt to pull digicap.dav, (The firmware), flash it, and reboot. (Sometimes the reboot doesn't happen I've found). In any case, that is an automated process.

NVRs on the other hand must be invoked manually. You need to PuTTY over serial/TTL directly into the boot loader to manually halt it. Once U-boot is stopped, there are a few prompts asking you for info. At this point, make sure your computer and recorder are both connected to your main network (no 192.0.0.128 necessary). It will ask you to set an IP for the recorder, then specify the IP of your TFTP server (your computer). It will start the firmware recovery process once you hit enter. It will not reboot after it's done, it requires hitting Enter in PuTTY over serial to finish it off (or a power cycle will work too).

What is remaining in my NVR stock from last year have already been bricked and firmware upgraded, so I'm not touching those again, but a friend of mine has a 7608 that is in need of a firmware upgrade which will result in a brick. I will write a step by step post sometime this week and link it here using that recorder. Details, screenshots and all. Give me until Friday. Have a few other things on my plate at the moment.

Still waiting for you post. Need to upgrade firmware on my NVR DS-7608NI-E2, v3.4.82. Password lost.

 

[CoreyX64]

Still waiting for you post. Need to upgrade firmware on my NVR DS-7608NI-E2, v3.4.82. Password lost.

This was written before the E, I, and K series recorders came into existence due to firmware upgrades screwing up the user login info stored onboard. While the same procedure would apply, you’d be much better off contacting Hikvision regarding a password reset. If you’re using a Chinese device however then I can see your concern.

The NVRs affected by this firmware bug were older SE models which have long been discontinued. I no longer have them on hand. If I get my hands on an E series in the near future, I will try to take the time to re-write something. However it would offer no further information than what others on here have already provided, but it would merely be found in one place.

Life got too busy the last couple years and this slipped through the cracks. My apologies :/


Sent from my iPhone using Tapatalk

 

[eXtremer]

Thanks for your comment. Actually I've managed to reset the password contacting Hikvision all other the world branches, from 7 emails sent, just one gave a a reply and the import file, they really saved me. Other branches like UK didn't even want to talk about it, they said it is not from UK so goodbye. But it is a original BOX (NI version) with RR code, not chinese.

 

[eXtremer]

BTW, I will post here the export and the import file I received, maybe it will be useful to smb to find out the method used to decrypt

Export:

Spoiler

AwAAAHZ7M257uNqX/AB8aijAjpEDeUfLBtOPNgksyPgpFmLbAahRmykVvnWb3DNjolbO1n7wNOPfMmDb8+ukjcj1Z6rQWNCkpphms4VFf/Irsi7UHAll0MeJXIKofhT3E3JS76SO54I9RVkYERygLJSdDE/3O5yDGKF+e2kSXxXkU7U8DS-7608NI-E20820161009AARR658612406WCVU

Import:

Spoiler

3cc6e9d8

 

[CoreyX64]

BTW, I will post here the export and the import file I received, maybe it will be useful to smb to find out the method used to decrypt

Export:

Spoiler

AwAAAHZ7M257uNqX/AB8aijAjpEDeUfLBtOPNgksyPgpFmLbAahRmykVvnWb3DNjolbO1n7wNOPfMmDb8+ukjcj1Z6rQWNCkpphms4VFf/Irsi7UHAll0MeJXIKofhT3E3JS76SO54I9RVkYERygLJSdDE/3O5yDGKF+e2kSXxXkU7U8DS-7608NI-E20820161009AARR658612406WCVU

Import:

Spoiler

3cc6e9d8

Reset files are specific you your device serial number and time of day. They’re useless if either of those pieces of info changes or if you power cycle the device.


Sent from my iPhone using Tapatalk

 

[gpower07]

how about newer model of the 7600. I can't find the serial UART connection.

 

[Disq2020mon]

Re: DS-7604NI-E1/4P, DS-7608NI-E2/8P and DS-7616NI-E2/16P Firmware V. 3.3.6 Build 15

I took a couple of pictures to show how to restore the NVR via U-boot and a serial UART connection. You'll need a TTL (not the higher voltage RS-232 version) UART USB dongle, a terminal program such as PuTTY or Tera Term or minicom, etc, set to 115K baud, no parity, one stop bit, 8 data bits. Lastly you'll need to connect to the motherboard of the NVR as shown in the pics for my setup. You'll also need to have a tftp server running on your PC with the new digicap.dav firmware file in the tftp send directory. When you turn on the NVR you will need to press crtl-u quickly (or the NVR will boot) to stop U-boot and you'll be presented with one option, to update as shown in the pic on the PC screen. There you'll specify the IP address for the NVR and your computer. The NVR will then do a tftp file get command looking for the file digicap.dav and your PC's tftp server should serve this file. The NVR will flash the new firmware and reboot. All done.

Thanks my friend, 3 years and you have a best solution. Do you happen to know how to reset a hikvision ds-2cd1121-i camera without a reset button? Thanks again.