DS-7732N-E4/16P NVR Bricked - FW 3.3.4 150616 Help !

[ahspao]

Hi, I have a pair of DS-7732N-E4/16P NVR's and I used SADP to activate them both using two different passwords (I wrote both of them down), after a few days I was able to access one of them, but not the other. After several attempts and several variations of the password (assuming I just wrote down the wrong one) I decided it's time to clear things out using TFTP and new firmware.

I know this is the Chinese unit so I first tried the multilingual firmware and it transmitted it but immediately booted (meaning it didn't accept it) so I went to http://www1.hikvision.com/cn/download_more_699.html#prettyPhoto and downloaded several chinese/ml firmware versions :

NVR_EXX_V3.3.4_150616
NVR_EXX_BL_ML_STD_V3.4.0_150929
NVR_EXX_76 77 86_V3.4.6_160405

I even used the HikTools to make sure the language flag was set to 2 (CN) but to no avail, each of these firmwares will run though the TFTP and complete but then when the unit boots to the Hikvision boot screen it freezes there and beeps continuously. I've read that this means I have an illegal device of some sort. I just want to return to the firmware I had.

I can't seem to find a firmware that will make the device functional again, any clues in the right direction? I figured going back to the original version that was on the NVR was my best bet but that didn't seem to work even with the language flag set to 2

EDIT: just had a thought...silly as it may sound, is there anyway to download the firmware from my working unit and upload it onto my bricked unit?

 

[alastairstevenson]

EDIT: just had a thought...silly as it may sound, is there anyway to download the firmware from my working unit and upload it onto my bricked unit?

That would be the case if you were running older firmware (I think before 3.2.1) that still allows telnet access. But yours will have the 'psh' shell which prohibits the commands that allows changes to be made.
But as you had to 'activate' the NVR, it suggests firmware of 3.4.0 or later.

the unit boots to the Hikvision boot screen it freezes there and beeps continuously.

This happens when you have a CN NVR and load US or ML firmware to it.
But if your NVR is truly CN, this would not happen.
It could also be the 'unrollback' message when the newest firmware has messed with the bootloader to prohibit rollback.
The only way to know for sure is to use a USB to Serial TTL convertor to connect to the serial console.
That might be your next step.
Check out the connectors here : https://www.ipcamtalk.com/showthread.php/6356-Manual-Create-console-serial-access-to-Hikvision-DS-2CD2032F-I?highlight=uart+manual

What are the 4 letters in the serial number, do you recall? Maybe AARR?
If it's not actually a CN version, was it the various ML and EN versions from the Hikvision EU site that you tried, here:
http://www.hikvisioneurope.com/portal/index.php?dir=Product Firmware/Back-ends/Recorder/NVR/DS-7600NI-E1(E2) 7700NI-E4/
Worth trying as a starter is the 3.0.8, if it will accept it, and not treat it as a rollback.

Did you by any chance have any copies of the exported device configuration for the bricked NVR?
If so, the password could be extracted from that.
Not relevant now, though.

 

[ahspao]

Hi Alastair, I did not export the device config unfortunately, I hadn't really used the device at all so there wasn't anything I wanted to save. The serial number DOES contain AARR in it, guess that means its a CN version? I suppose I may just avoid buying and CN versions from now on to avoid running into this problem.