DS-7804N-E1 / 4P - Firmware upgrading help?

Smabonham

Smabonham

n3wb
Jun 28, 2015
21
0
New Zealand
Hello all, I'm wonder if someone more experienced in updating Hikvision firmware would be willing to help talk me through the process of updating my DS-7804N-E1. I have read through the forum but as an inexperienced user, its not filled me with confidence that it's a straight forward nor simple process.

I would like to update it but I'm terrified of bricking the damn thing.

Model - DS-7804N-E1 / 4P
Serial No. - 0420141101AARR486837144WCVU
Firmware Version - V3.0.8 build 140825
Encoding Version - V5.0 build 140816

I've updated my cameras in the past, I've got three DS-2CD2332-I and frankly, it's been such a nightmare. The whole Chinese hardware and hacked English firmware thing, I'm a bit surprised I've not trashed any of them. Though that is to the credit of this forum that I was successful, there is a great deal of help on cameras here, but not so much on NVRs.

Basically, where can I get the correct current firmware? How do I install it? How do I backup the current firmware on the NVR? and is there the same Chinese/English language nightmare as there is with the cameras?

I would be grateful for any assistance.

Cheers muchly,

Steve.
 
Your NVR may be a CN region model (serial number has RR which is not CN but not WR either, something like Remaining Region) running firmware which masquerades the language so it may revert to CN menus on update or factory reset after updating.
There are various routes you could follow, but I'd suggest an initial check as follows:
Enable telnet, connect to the NVR and log in as 'root' with your admin password.
At the # prompt, there are a couple of commands that will show the internal language. Post the results back here.
getHardInfo
cat /proc/hkvs/bootpara

Both show a language value, one from a slightly deeper level than the other.
 
[root@dvrdvs /] # getHardInfo
Start at 2017-01-07 08:16:06
Serial NO :0420141101AARR486837144WCVU
V3.0.8 build 140825
KernelVersion: V1.0.0 build 140512
dspSoftVersion: V5.0 build 140816
codecVersion: V5.0 build 080808
hardwareVersion = 0xb300
encodeChans = 0
decodeChans = 4
alarmInNums = 0
alarmOutNums = 0
ataCtrlNums = 1
flashsize = 0x10
ramSize = 0x200
networksNums = 2
language = 1
devType:DS-7804N-E1/4P
bootPartition = 2
randomCode = XTARSZ
[root@dvrdvs /] #
 
[root@dvrdvs /] # cat /proc/hkvs/bootpara
====================== BOOT INFO ====================
magicNumber :0x484b5753
paraChecksum :0x1030
paraLength :0xf4
encryptVer :0x10000
language :0x1
device_class :0x2a
oemCode :0x1
encodeChans :0x4
decodeChans :0x4
ipcChans :0x0
ivsChans :0x0
picFormat :0x2
macAddr :c0-56-e3-1b-35-2f
prodDate :32:30:31:34:31:31:30:31
prodNo :343836383337313434
devHigh :0x0
cpuFreq :0x1
dspFreq :0x1
zone :0x1
webSupport :0x1
voipSupport :0x0
usbNums :0x2
lcdSupport :0x0
voNums :0x2
vganums :0x2
vtSupport :0x1
videoMaxtrix :0x0
extendedDecoder:0x1
extendedIVS :0x1
extendedAlarmOut:0x0
devType :0xa103
ubootAdrs :0x0
ubootSize :0x0
ubootCheckSum :0x0
tinyKernelAdrs:0x0
tinyKernelSize:0x0
tinyKernelCheckSum:0x0
 
Well done on doing that!
You have language=1 on both counts, that's good, suggesting that the NVR is not set as CN region, despite being a CN-only model (78xx)
So you are probably good to go on firmware updates.
What I'd suggest though is to first give yourself a fallback position by making a backup of the existing firmware and device settings.
To do this you need an ability to take the files out of the NVR.
This can be done with either a NAS NetHDD storage destination, or a USB memory stick with a FAT32 partition.
Either way, you need to know the mount point to use as thye files destination.
Example of an NFS NetHDD that has been set up via the web GUI Storage menus. The NetHDD does not need to be 'formatted' to use for copying files around.
Code: 
alastair@PC-I5 ~ $ telnet 192.168.1.211
Trying 192.168.1.211...
Connected to 192.168.1.211.
Escape character is '^]'.

dvrdvs login: root
Password:


BusyBox v1.16.1 (2016-06-29 13:49:45 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

psh: applet not found
[root@dvrdvs /root] # mount
rootfs on / type rootfs (rw)
proc on /proc type proc (rw,relatime)
sysfs on /sys type sysfs (rw,relatime)
udev on /dev type tmpfs (rw,relatime)
devpts on /dev/pts type devpts (rw,relatime,mode=600,ptmxmode=000)
/dev/mtdblock2 on /home/hik type cramfs (ro,relatime)
192.168.1.201:/cctv1 on /mnt/tnfs00 type nfs (rw,sync,relatime,vers=3,rsize=8192,wsize=8192,namlen=255,acregmin=0,acregmax=0,acdirmin=0,acdirmax=0,soft,noac,nolock,proto=udp,port=2049,timeo=7,retrans=3,sec=sys,local_lock=all,addr=192.168.1.201)
[root@dvrdvs /root] #
[root@dvrdvs /root] # ll /mnt/tnfs00
-rw-r--r--    1 root     root         65536 Jan  1 11:13 2017-01-01_cfg.gz
drwxrwxrwx    3 root     65534         4096 Jan  4 17:53 @Recycle
-rw-r--r--    1 root     root         65536 Nov 22 11:52 cfg_2016-11-22.gz
drwxr-xr-x    2 root     root         12288 Nov 20 22:08 datadir0
drwxr-xr-x    2 root     root         12288 Nov 20 22:10 datadir1
drwxr-xr-x    2 root     root         12288 Nov 20 22:11 datadir2
-rwxrwxrwx    1 root     root           360 Dec 24 12:14 dec_mcr_20.bin
-rwxrwxrwx    1 503      100            480 Nov 22 10:37 dec_new_20.bin
-rwxrwxrwx    1 65534    65534       945736 Jul 18 04:14 dropbear
-rwxrwxrwx    1 root     root           805 Dec  6 21:29 dropbear_rsa_host_key
-rwxrwxrwx    1 65534    65534       652716 Jul 18 04:14 dropbearkey
-rwxrwxrwx    1 root     root           480 Nov 22 10:40 enc_new_20_plus4.bin
-rwxrwxrwx    1 root     root            68 Nov 20 22:10 info.bin
-rwxr-xr-x    1 root     root          5955 Jan  3 22:01 initrun.sh
-rwxr-xr-x    1 root     root           469 Jan  3 22:01 load_audio_drv.sh
-rwxr-xr-x    1 root     root           369 Jan  3 22:01 load_audio_dummy_drv.sh
-rw-rw-rw-    1 65534    65534          360 Dec 24 12:08 mcr_20.bin
drwxrwxrwx    2 root     root          4096 Jan  4 17:57 tmp
[root@dvrdvs /root] #
In this case, the mount point is /mnt/tnfs00

Here is an example of the use of a USB memory stock with a FAT32 partition.
The device name may vary depending on which USB port is used. This was the front one in my 7816N-E2.
Code: 
alastair@PC-I5 ~ $ telnet 192.168.1.211
Trying 192.168.1.211...
Connected to 192.168.1.211.
Escape character is '^]'.

dvrdvs login: root
Password:


BusyBox v1.16.1 (2016-06-29 13:49:45 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

psh: applet not found
[root@dvrdvs /root] # ll /mnt
drwxr-xr-x    2 root     root             0 Jul  3  2012 esda1
drwxr-xr-x    2 root     root             0 Jul  3  2012 esda2
drwxr-xr-x    2 root     root             0 Jul  3  2012 esda3
drwxr-xr-x    2 root     root             0 Jul  3  2012 esda4
drwxr-xr-x    2 root     root             0 Jul  3  2012 esdb1
drwxr-xr-x    2 root     root             0 Jul  3  2012 esdb2
drwxr-xr-x    2 root     root             0 Jul  3  2012 esdb3
drwxr-xr-x    2 root     root             0 Jul  3  2012 esdb4
drwxr-xr-x    2 root     root             0 Jan  6 22:19 msa1
drwxrwxrwx    7 root     root          4096 Jan  3 22:01 tnfs00
d---------    2 root     root             0 Jan  1 11:01 tnfs01
[root@dvrdvs /root] #
[root@dvrdvs /root] # mount -t vfat /dev/msa1 /mnt/msa1
[root@dvrdvs /root] # mount
rootfs on / type rootfs (rw)
proc on /proc type proc (rw,relatime)
sysfs on /sys type sysfs (rw,relatime)
udev on /dev type tmpfs (rw,relatime)
devpts on /dev/pts type devpts (rw,relatime,mode=600,ptmxmode=000)
/dev/mtdblock2 on /home/hik type cramfs (ro,relatime)
192.168.1.201:/cctv1 on /mnt/tnfs00 type nfs (rw,sync,relatime,vers=3,rsize=8192,wsize=8192,namlen=255,acregmin=0,acregmax=0,acdirmin=0,acdirmax=0,soft,noac,nolock,proto=udp,port=2049,timeo=7,retrans=3,sec=sys,local_lock=all,addr=192.168.1.201)
/dev/msa1 on /mnt/msa1 type vfat (rw,relatime,fmask=0022,dmask=0022,codepage=cp437,iocharset=cp936,shortname=mixed,errors=remount-ro)
[root@dvrdvs /root] # ll /mnt/msa1
-rwxr-xr-x    1 root     root       1109128 May  2  2015 busybox-armv7l
-rwxr-xr-x    1 root     root            69 Jan  4 17:47 dav_extra_tail
[root@dvrdvs /root] #
In this case the mount point is /mnt/msa1

Then the commands to make backup copies of the installed firmware, using whichever mount point has been confirmed as available :
Code: 
[root@dvrdvs /root] # ll /mnt/msa1
-rwxr-xr-x    1 root     root       1109128 May  2  2015 busybox-armv7l
-rwxr-xr-x    1 root     root            69 Jan  4 17:47 dav_extra_tail
[root@dvrdvs /root] # dd if=/dev/mtdblock1 of=/mnt/msa1/mtdblock1_save
256+0 records in
256+0 records out
131072 bytes (128.0KB) copied, 0.026492 seconds, 4.7MB/s
[root@dvrdvs /root] # umount /home/hik                              
[root@dvrdvs /root] # dd if=/dev/mtdblock2 of=/mnt/msa1/mtdblock2_save
32128+0 records in
32128+0 records out
16449536 bytes (15.7MB) copied, 2.926189 seconds, 5.4MB/s
[root@dvrdvs /root] # mount /dev/mtdblock2 /home/hik
[root@dvrdvs /root] # dd if=/dev/mtdblock0 of=/mnt/msa1/mtdblock0_save
128+0 records in
128+0 records out
65536 bytes (64.0KB) copied, 0.012096 seconds, 5.2MB/s
[root@dvrdvs /root] # ll /mnt/msa1
-rwxr-xr-x    1 root     root       1109128 May  2  2015 busybox-armv7l
-rwxr-xr-x    1 root     root            69 Jan  4 17:47 dav_extra_tail
-rwxr-xr-x    1 root     root         65536 Jan  6 23:00 mtdblock0_save
-rwxr-xr-x    1 root     root        131072 Jan  6 22:59 mtdblock1_save
-rwxr-xr-x    1 root     root      16449536 Jan  6 22:59 mtdblock2_save
[root@dvrdvs /root] #
 
I think USB is out of the question, I just can't get it to acknowledge the USB at all I'm afraid to say.

I'm trying the NetHHD option, but it's taking a bit of time and brain power at this end, as I've never used this feature of the NVR before.

I'll post my progress as soon as I can and thanks for this, it's very much appreciated.
 
Smabonham said:
I think USB is out of the question, I just can't get it to acknowledge the USB at all I'm afraid to say.
Click to expand...
If you have the VGA/HDMI interface available, another way to implicitly mount a USB memory stick is to use the Maintenance menu, then the Import/Export selection. No further actions are needed.
If it is happy with the USB memory stick it will list it and the files on it.
At the telnet prompt, the 'mount' command will then show the mount point that has been used.
 
OK, the first stumbling block. I'm afraid to say I can not setup the NetHDD nor see the USB on the NVR.

I don't own a physical NAS, and everything I try to get the NVR to see a PC drive on my network fails.

I've tried all kinda of USB drives on all the USB ports on the NVR and nothing registers.

Short of buying a physical NAS drive for my network, I'm an open to suggestions?
 
dvrdvs login: root
Password:


BusyBox v1.16.1 (2014-05-19 09:41:10 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

can not change to guest!
[root@dvrdvs /] # mount
rootfs on / type rootfs (rw)
proc on /proc type proc (rw,relatime)
sysfs on /sys type sysfs (rw,relatime)
udev on /dev type tmpfs (rw,relatime)
devpts on /dev/pts type devpts (rw,relatime,mode=600,ptmxmode=000)
/dev/mtdblock2 on /home/hik type cramfs (ro,relatime)
/dev/msc1 on /mnt/msc1 type vfat (rw,relatime,fmask=0022,dmask=0022,codepage=cp437,iocharset=cp936,shortname=mixed,errors=remount-ro)
[root@dvrdvs /] # ll /mnt
drwxr-xr-x 2 root root 0 May 26 2014 esda1
drwxr-xr-x 2 root root 0 May 26 2014 esda2
drwxr-xr-x 2 root root 0 May 26 2014 esda3
drwxr-xr-x 2 root root 0 May 26 2014 esda4
drwxr-xr-x 2 root root 0 May 26 2014 esdb1
drwxr-xr-x 2 root root 0 May 26 2014 esdb2
drwxr-xr-x 2 root root 0 May 26 2014 esdb3
drwxr-xr-x 2 root root 0 May 26 2014 esdb4
drwxr-xr-x 3 root root 4096 Jan 1 1970 msc1
[root@dvrdvs /] # ll /mnt/msc1
drwxr-xr-x 2 root root 4096 Jan 7 23:41 NVR
[root@dvrdvs /] # dd if=/dev/mtdblock1 of=mnt/msc1/mtdblock1_save
256+0 records in
256+0 records out
131072 bytes (128.0KB) copied, 0.008078 seconds, 15.5MB/s
[root@dvrdvs /] # umount /home/hik
[root@dvrdvs /] # dd if=/dev/mtdblock2 of=/mnt/msc1/mtdblock2_save
32128+0 records in
32128+0 records out
16449536 bytes (15.7MB) copied, 0.921934 seconds, 17.0MB/s
[root@dvrdvs /] # mount /dev/mtdblock2 /home/hik
[root@dvrdvs /] # dd if=/dev/mtdblock0 of=/mnt/msc1/mtnblock0_save
384+0 records in
384+0 records out
196608 bytes (192.0KB) copied, 0.012041 seconds, 15.6MB/s
[root@dvrdvs /] # ll /mnt/msc1
-rw-r--r-- 1 root root 131072 Jan 8 00:15 mtdblock1_save
-rw-r--r-- 1 root root 16449536 Jan 8 00:17 mtdblock2_save
-rw-r--r-- 1 root root 196608 Jan 8 00:19 mtnblock0_save
[root@dvrdvs /] #

Success... :-)
 
One uncertainty would be whether your cameras are CN region and would be subject to 'language mismatch' rejection as that 'feature' gets introduced in the newer versions of NVR firmware.
I have a recollection it was about 3.2.1 though I'm not sure.
You have done firmware updates on the cameras - do you know what region they are?

If the NVR is as it appears to be a genuine EN language model - unusual I think for a 7804 - then a web GUI update using firmware from here is what I'd do next : HIKVISION EUROPE
The web GUI approach as opposed to the tftp updater will give some, but not full, protection against loading incompatible firmware.
Easy steps too along the versions, as the way the device configuration is held internally changes as you go up from those early revisions.
And starting with the 3.0.8 the EN menus should be retained, that was my experience.

Be aware that there is always some uncertainty in doing Hikvision firmware updates, it has to be your choice based on your assessment of the risk.
But there have been a lot of changes and improvements since the 3.0.8 version, so if moving up is feasible there are definite benefits.
 
Yeah, as far as I know they're all CN cameras.

I have three and I think, though I will double check when I can, that they're all DS-2CD2332-i on 5.2.5 and CN.

Also, just checking, are these the firmware for a 7804? Having a look, this model number isn't shown in any of the release notes?
 
I'm fairly sure the specific firmware for the DS-7800 is found here... 海康威视——以视频为核心的物联网解决方案和数据运营服务提供商

However, it's Chinese only, which would stand to reason that the language will not have the option for English. I've checked the firmware .dav file from this site with Hiktools05r1 and can confirm the iLanguage value is 2.

Is there a way to do a MTD hack or something similar to ensure I get English language?
 
Last edited:
Smabonham said:
However, it's Chinese only, which would stand to reason that the language will not have the option for English. I've checked the firmware .dav file from this site with Hiktools05r1 and can confirm the iLanguage value is 2.
Click to expand...
Yes, that is the official firmware for the 78xx NVRs.
It has both EN and CN menus, depending on what language the NVR has been set to in its hardware configuration.
I used firmware from there for early web GUI updates to my 7816 and it worked OK, keeping EN menus as that setting was held in the device configuration.
The flash area that the hardware language is set in (mtdblock0) is write-protected in your 3.0.8 version of firmware and hidden in later versions of firmware, so no easy MTD hack.
Using your favourite Hex editor (HxD for Windows is good) check out the 256 byte block from 0x2E000 in your mtdblock0
The language byte is at 0x2E010
In my 7816 it is 02 (CN), I expect in yours it will be 01
 
You must log in or register to reply here.
Top Bottom