DS-9664NI-I16 password reset

I

Isan_B

n3wb
Jun 19, 2024
6
1
Germany
Hello,

I'm trying to reset the password of this recorder as I bought it for a lot of money on ebay by thinking there is knob where I can reset the NVR. I kenw, that I can generate a XML and send it to Hikvision but no luck. Hikvision is not answering nor willing to help me in any way.

After that I've tried the TFTP method but it wan't work as the transmitting looks weired.

Here is a log as example:

[2024-06-18 13:31:09] TFTP server[192.0.0.128] initialized
[2024-06-18 13:31:43] Device[192.0.0.64] test tftpserver
[2024-06-18 13:31:43] Connect client[192.0.0.64] success
[2024-06-18 13:31:43] Start file[C:\Hikvision\TFTP\digicap.dav] transmitting
[2024-06-18 13:33:44] Connect client[192.0.0.64] success
[2024-06-18 13:33:44] Start file[C:\Hikvision\TFTP\digicap.dav] transmitting
[2024-06-18 13:33:45] Connect client[192.0.0.64] success
[2024-06-18 13:33:45] Start file[C:\Hikvision\TFTP\digicap.dav] transmitting
[2024-06-18 13:33:46] Connect client[192.0.0.64] success
[2024-06-18 13:33:46] Start file[C:\Hikvision\TFTP\digicap.dav] transmitting
[2024-06-18 13:33:47] Connect client[192.0.0.64] success
[2024-06-18 13:33:47] Start file[C:\Hikvision\TFTP\digicap.dav] transmitting

Sometimes the transfer takes 4 minutes but than again it start with short time transmitting. The NVR sometimes restarts but I never get the message "completed" or "resend".

After a half an hour I cancel this and again it starts normally until it want's the admin or user password.

I opened the recorder to see if there is an UART link but there is nothing like this. Only a normal serial RS-232 port on the back of the recorder

I tried TFTP64, TFTP Solarwind.... these two tools not communicating with the NVR.

What's wrong with the NVR? BTW. Firewall is deactivated and the NVR is directlyy connected to a switch and from the switch to the computer.
 
Isan_B said:
After that I've tried the TFTP method but it wan't work as the transmitting looks weired.
Click to expand...
That's because the Hikvision tftp updater has a 32MB filesize limit and the firmware is larger than that.
You should instead be able to use the Scott Lamb Python2 clone of the tftp updater, no filesize limit.

github.com

GitHub - scottlamb/hikvision-tftpd: Unbrick a Hikvision device (NVR or camera) via TFTP

Unbrick a Hikvision device (NVR or camera) via TFTP - scottlamb/hikvision-tftpd
github.com github.com

Isan_B said:
Only a normal serial RS-232 port on the back of the recorder
Click to expand...
That is the serial console UART access to the NVR.
To connect to the serial console, you will need a USB to serial (RS-232 not TTL) convertor, and a null modem cable if the cable isn't configured as a null modem device.

Sample firmware update using normal tftp server, via serial console :
This from a 9632. From what I recall partition 2 is the sys config, so it gets erased and so reset to factory default values.
Code: 
U-Boot 2010.06-svn (Aug 14 2015 - 14:50:25)

Hit ctrl+u to stop autoboot:  0

This program will upgrade software.
*******************************************************
*  ATTENTION!! PLEASE READ THIS NOTICE CAREFULLY!     *
*  Don't reset machine,or anything that interrupt it. *
*  The upgrade process must finish in 10 minutes!     *
*  If this program fails,machine might be unusable,   *
*  and you will need to reflash again.                *
*  If you find this too risky,power off machine now.  *
*******************************************************

Now press [u/U] key to upgrade software: u
File system error,please upgrade by TFTP

Please input ip address of device: 192.168.1.79
Please input ip address of upgrade server: 192.168.1.99
Confirm?(y/n): y
timeout for link [4999]!
MAC:   4C-BD-8F-9C-7D-B8
TFTP from server 192.168.1.99; our IP address is 192.168.1.79
Download Filename 'digicap.dav'.
Download to address: 0x40008000
Downloading: #################################################
done
Bytes transferred = 55296204 (34bc0cc hex)
uImage checkSum ok !
start.sh checkSum ok !
sys_app.tar.lzma checkSum ok !
gui_res.tar.gz checkSum ok !
webs.tar.lzma checkSum ok !
TX1_Version.bin checkSum ok !
RSA checkSum ok !
new_10.bin checkSum ok !
start to erase nand flash partition 0  start: 0x200000 end: 0x6200000 len: 0x6000000 ...
Erasing at 0x61e0000 -- 100% complete.
--- OK!
start to erase nand flash partition 1  start: 0x6200000 end: 0xC200000 len: 0x6000000 ...
Erasing at 0xc1e0000 -- 100% complete.
--- OK!
start to erase nand flash partition 2  start: 0xC200000 end: 0x10000000 len: 0x3E00000 ...
Erasing at 0xffe0000 -- 100% complete.
--- OK!

start to write files to partition 0...
yaffs: Mounting /nand
9-1.  write /nand/uImage len: 8834120
9-2.  write /nand/start.sh len: 8976
9-3.  write /nand/sys_app.tar.lzma len: 29337672
9-4.  write /nand/gui_res.tar.gz len: 9458672
9-5.  write /nand/webs.tar.lzma len: 7654688
9-6.  write /nand/TX1_Version.bin len: 40
9-7.  write /nand/RSA len: 24
9-8.  write /nand/new_10.bin len: 744
9-9.  write flag file /nand/version.bin len: 4
update partition 0 success!
save exit: isCheckpointed 1

start to write files to partition 1...
yaffs: Mounting /nand
9-1.  write /nand/uImage len: 8834120
9-2.  write /nand/start.sh len: 8976
9-3.  write /nand/sys_app.tar.lzma len: 29337672
9-4.  write /nand/gui_res.tar.gz len: 9458672
9-5.  write /nand/webs.tar.lzma len: 7654688
9-6.  write /nand/TX1_Version.bin len: 40
9-7.  write /nand/RSA len: 24
9-8.  write /nand/new_10.bin len: 744
9-9.  write flag file /nand/version.bin len: 4
update partition 1 success!
save exit: isCheckpointed 1
Press ENTER key to reboot
resetting ...


U-Boot 2010.06-svn (Aug 14 2015 - 14:50:25)

Hit ctrl+u to stop autoboot:  0
t
 
  • Like
Reactions: Isan_B
As I think your NVR has PoE ports - here is a possible method of extracting the admin password configured for the cameras, which is often the same as the NVR admin password :

Hikvision NVR password reset

Hey all, I got an NVR from a friend of mine, and they don't remember the password, and the NVR is not one that was sold thru Hikvision here in north america, so the password reset page from Hikvision is of no help to me. I'm wondering if anyone on here can help me out with it. Thanks, Kevin
www.ipcamtalk.com www.ipcamtalk.com
 
alastairstevenson said:
As I think your NVR has PoE ports - here is a possible method of extracting the admin password configured for the cameras, which is often the same as the NVR admin password :

Hikvision NVR password reset

Hey all, I got an NVR from a friend of mine, and they don't remember the password, and the NVR is not one that was sold thru Hikvision here in north america, so the password reset page from Hikvision is of no help to me. I'm wondering if anyone on here can help me out with it. Thanks, Kevin
www.ipcamtalk.com www.ipcamtalk.com
Click to expand...

Thanks for your efforts but unfortunately it has no PoE ports. Only 2 Lan ports. I tried this method of auto camera init with a camera with lower firmware version with PoE switch which is connected to the NVR but there will be no auto registration of the camera. I can see that in the SADP Tool, that the camera is still in "not activated mode"
 
  • Like
Reactions: alastairstevenson
Hey Alastair,

just 5 minutes ago I received for my surprise a code from support@hikvision.com. I genareted the xml file by SADP tool and send them. Untill than I did not reboot computer and device.

But if I try to change this error occuring: "Failed to reset password. Device denied"

The new password is including characters and signs, letters aso

What does that mean?
 
Hey Alastair,

I bought the recorder used from the US and the seller mentioned that is not useable as the password is not known for resetting. I knew that there is a way to reset the passcode by Hikvision but I didn't knew that it is so difficult.

I had there service one time as I bought new cameras and for some reason I forgot the passwrd. They helped me very fast (12 hours) with this xml files.

I read in the comments and find out, that they didn't reset passwords if you buy it used like me. But I tried it again and for my surprise they sent me the xml code which was not working. I think someone in China founds that really funny to send me wrong codes.

I resent them after reboot again the xml yesterday and they didn't answered until now. Gues they are closed now and open again on monday.

So I decided to use your style and after some trial and errors I managed to reset this f* NVR and it rocks!

I've done it with your help!!!

Thank you so much for your time
 
  • Wow
Reactions: alastairstevenson
Its not that is wrong code, its that response was so late that xml that was generated wouldn't work anymore.

I have access to password reset for serial numbers that we distribute, and timeframe is usually around 8h.

Cheers.
 
  • Like
Reactions: alastairstevenson
Isan_B said:
I bought the recorder used from the US
Click to expand...
I'm curious if the NVR came with any disks.

I bought a DS-9632NI-I8 from the US a few years back - and unexpectedly it still had some disks installed.
The web GUI Storage menu showed that the storage had been erased. Presumably via the NVR web GUI.
But out of curiosity I ran a forensic tool that understands the Hikvision file systems against them and it listed many thousands of video files still very much available.
I was able to easily identify exactly where the NVR had been used, a commercial installation, and probably see stuff that the original owners would not have wanted.

Anyone selling a used NVR with disks still in, or criminals thinking they have wiped the CCTV evidence of their activities, should be aware there are easy ways to retrieve apparently deleted recordings.
 
You must log in or register to reply here.
Top Bottom