DVR Stuck at Boot -- Please Help

mand3v

mand3v

n3wb
Dec 17, 2019
9
4
India
Greetings Everyone!

I have recently acquired an used old DVR. Its an 8 channel analogue device. On the box it says IP Vision - nothing else. Hence, identifying this thing has become a great challenge, let aside the issue with the device.

While trying too boot up it says "Embedded Net DVR" on screen (please check the attachment) and stays there.

I have tried the following initial steps:

1. Disconnected the HDD and network cable and tried to boot. No go.
2. Disconnected CMOS battery and reconnected it after about an hour. Then tried to boot. No go.

At this point, I started searching for DVR motherboard pictures on the net hoping to find something similar to mine. And I found an exact match on a Chinese online market place. It was available as mother board of "DVR HMT-8". I could not progress any further from here.

Then I removed the heat-sink of the processor and scraped the cement kind of thing from it. I found the markings on the processor as "HIKVISION KY-2013-2 HP0801318". But, nothing appears on Google with this.

Finally, I connected the device to my PC through RS-232 using a USB-Serial connector. It took me some time to find the correct baud rate and the pin configs, but with patience and perseverance, I did it.

The pin which is next to the arrow is 3.3v. Moving away from this pin, rest are Rx, Tx and Ground. And the baud rate is 115200.

I have dumped the boot sequence and attached here.

Kindly suggest me where can I move onto from here.

Thanks and regards,

Dave
 

Attachments

  • DVR_Debug.txt
    DVR_Debug.txt
    1.5 KB · Views: 40
  • IMG_20191019_163633_HDR.jpg
    IMG_20191019_163633_HDR.jpg
    453.6 KB · Views: 53
  • IMG_20191019_163740_HDR.jpg
    IMG_20191019_163740_HDR.jpg
    1.6 MB · Views: 66
  • IMG_20191019_163821_HDR.jpg
    IMG_20191019_163821_HDR.jpg
    1.7 MB · Views: 56
  • IMG_20191217_144800_HDR.jpg
    IMG_20191217_144800_HDR.jpg
    965 KB · Views: 47
  • IMG_20191217_144903_HDR.jpg
    IMG_20191217_144903_HDR.jpg
    1.4 MB · Views: 45
  • IMG_20191217_144922_HDR.jpg
    IMG_20191217_144922_HDR.jpg
    1.1 MB · Views: 41
  • Like
Reactions: mat200
You've done quite well so far.
It's a Hikvision OEM DVR of unknown model.

Looking at the serial console log - I'd say that the 'app' partition is corrupt, maybe just faded, it's only really the kernel that's running.
Code: 
start decompress  Thu Mar  5 00:26:52 UTC 1970
tar: invalid tar magic
end decompress  Thu Mar  5 00:26:57 UTC 1970

The problem is going to be :
Identifying the model series.
Then finding some firmware to refresh the flash contents. Old firmware is no longer published by Hikvision.

If you interrupt the bootloader (Control-U) and list the environment variables with 'printenv' you might just be lucky with a model number definition.
 
  • Like
Reactions: mat200 and mand3v
alastairstevenson said:
You've done quite well so far.
It's a Hikvision OEM DVR of unknown model.

Looking at the serial console log - I'd say that the 'app' partition is corrupt, maybe just faded, it's only really the kernel that's running.
Code: 
start decompress  Thu Mar  5 00:26:52 UTC 1970
tar: invalid tar magic
end decompress  Thu Mar  5 00:26:57 UTC 1970

The problem is going to be :
Identifying the model series.
Then finding some firmware to refresh the flash contents. Old firmware is no longer published by Hikvision.

If you interrupt the bootloader (Control-U) and list the environment variables with 'printenv' you might just be lucky with a model number definition.
Click to expand...
Thanks a lot for your swift response. I'll post the result asap. Thanks again.
 
  • Like
Reactions: mat200
alastairstevenson said:
You've done quite well so far.
It's a Hikvision OEM DVR of unknown model.

Looking at the serial console log - I'd say that the 'app' partition is corrupt, maybe just faded, it's only really the kernel that's running.
Code: 
start decompress  Thu Mar  5 00:26:52 UTC 1970
tar: invalid tar magic
end decompress  Thu Mar  5 00:26:57 UTC 1970

The problem is going to be :
Identifying the model series.
Then finding some firmware to refresh the flash contents. Old firmware is no longer published by Hikvision.

If you interrupt the bootloader (Control-U) and list the environment variables with 'printenv' you might just be lucky with a model number definition.
Click to expand...
Hi alastairstevenson,


I have tried the process of interrupting the normal boot with Ctrl+U. However it presents me with following screen.

Code: 
This program will upgrade software.
*******************************************************
*  ATTENTION!! PLEASE READ THIS NOTICE CAREFULLY!     *
*  Don't reset machine,or anything that interrupt it. *
*  The upgrade process must finish in 10 minutes!     *
*  If this program fails,machine might be unusable,   *
*  and you will need to reflash again.                *
*  If you find this too risky,power off machine now.  *
*******************************************************

Now press [u/U] key to upgrade software:

If I enter printenv there, I get the same message.

Next I let it boot completely and then entered printenv. I get "sh: printenv: not found".

Don't know what I am doing wrong. By entering help at the prompt, i get,

Code: 
[guest@dvrdvs /] $ help
Built-in commands:
------------------
        . : [ [[ alias bg break cd chdir continue echo eval exec exit
        export false fg hash help jobs kill local printf pwd read readonly
        return set shift source test times trap true type ulimit umask
        unalias unset wait

What do I do know?

Thanks for your time and help.

Regards,
Dave
 
  • Like
Reactions: mat200
Got something, not sure what. LOL

Code: 
This program will upgrade software.
*******************************************************
*  ATTENTION!! PLEASE READ THIS NOTICE CAREFULLY!     *
*  Don't reset machine,or anything that interrupt it. *
*  The upgrade process must finish in 10 minutes!     *
*  If this program fails,machine might be unusable,   *
*  and you will need to reflash again.                *
*  If you find this too risky,power off machine now.  *
*******************************************************

Now press [u/U] key to upgrade software: b
HKVS # printenv
bootdelay=1
baudrate=115200
ipaddr=192.0.0.64
serverip=192.0.0.128
gatewayip=192.0.0.1
netmask=255.255.255.0
bootfile=uImage
bootargs_end=255.255.255.0:Hik-eth:eth0:none
bootcmd=tftp 0x80400000 $(bootfile);bootm 0x80400000;
sec=tftp 0x80400000 uImage_sec;tftp 0x80800000 ramdisk.gz;bootm 0x80400000 0x80800000;
default=fsload 0x80400000 uImage;fsload 0x80800000 ramdisk.gz;bootm 0x80400000 0x80800000;
rgmii_enable=n
phyaddr0=3
stdin=serial
stdout=serial
stderr=serial
verify=y
ethaddr=8c:e7:48:54:d5:ef
bootargs=mem=160M console=ttyS1,115200
ver=U-Boot 2010.06 (Jul 01 2013 - 16:21:32)

Environment size: 587/65532 bytes
 
That is normal enough.
Disappointingly, there isn't an environment variable that lists the model number. Some do, some don't.

For some more indications that may confirm the nature of the problem, maybe try this :

Power on and just let it boot.
At the shell prompt, try :

This will list the flash partitions.
cat /proc/mtd

This will list any that have been able to be mounted
mount

This will list the size status of the mounts
df -h

This will list the primary startup script, and show how it then splits into various components.
cat /etc/init.d/rcS

This will execute the primary startup script which should show some errors that might help indicate the problem.
/etc/init.d/rcS

This will list a more detailed startup log
dmesg

And post the results back here.
 
  • Like
Reactions: mat200
Here's the gibberish output as I got.....

Code: 
[root@dvrdvs /] # cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00020000 00010000 "mtdblock0"
mtd1: 00f40000 00010000 "mtdblock1"
[root@dvrdvs /] # mount
rootfs on / type rootfs (rw)
/dev/root on / type ext2 (rw,relatime,errors=continue)
proc on /proc type proc (rw,relatime)
sysfs on /sys type sysfs (rw,relatime)
udev on /dev type tmpfs (rw,relatime)
devpts on /dev/pts type devpts (rw,relatime,mode=600,ptmxmode=000)
/dev/mtdblock1 on /home/hik type jffs2 (rw,relatime)
tmpfs on /home/app type tmpfs (rw,relatime)
[root@dvrdvs /] # df -h
df: invalid option -- h
BusyBox v1.16.1 (2013-10-24 19:00:14 CST) multi-call binary.

Usage: df [-Pkai] [-B SIZE] [FILESYSTEM]...

Print filesystem usage statistics

Options:
        -P      POSIX output format
        -k      1024-byte blocks (default)
        -a      Show all filesystems
        -i      Inodes
        -B SIZE Blocksize

[root@dvrdvs /] # cat /etc/init.d/rcS
#!/bin/sh
# This is a minmal rcS file for target startup
# Make sure that /proc is mounted.
## Modify by Coordinates for Hi3531 platform @2012-5-15


# Mount device or filesystem listed in /etc/fstab.
/bin/mount -a

ifconfig lo 127.0.0.1 up

# Make /mnt/sd[a-h][1-4] directories if they doesn't exist.
#
# Support 8 disks and each 4 partitions
disk_id="a b c d e f g h i"
partition_id="1 2 3 4"
# First, make /mnt directory if it doesn't exist.
[ -e /mnt ] || /bin/mkdir -p /mnt
# Main loop for making dirs.

for i in $disk_id
do
        for j in $partition_id
        do
                # Making /mnt/sd* dirs...
                #[ -e /mnt/sd"$i""$j" ] || /bin/mkdir -p /mnt/sd"$i""$j"
                # Making /mnt/esd* dirs...
                if [ "x$i" = "xa" -o "x$i" = "xb" ];then
                        [ -e /mnt/esd"$i""$j" ] || /bin/mkdir -p /mnt/esd"$i""$j"
                fi
        done
done

# Application start below.
#
# Show current date.
/bin/date

# Start telnet server if it exists.
#[ -e /usr/sbin/telnetd ] && /usr/sbin/telnetd 32

# set hostname of our device
[ -e /bin/hostname ] && /bin/hostname dvrdvs

# Startup any daemon scripts in /etc/rcS.d/
# S_udev starts here.
for e in `ls /etc/rcS.d/S* 2> /dev/null`; do
        $e
done

# Change the permission of files in /home/hik.
/bin/chmod 755 /home/hik/start.sh 2>/dev/null
# If /home/app directory exists, change the
# permission of it and all its files.
#[ -e /home/app ] && /bin/chmod -R 777 /home/app
# Runing start.sh script to launch hicore.
# Search start.sh preferred in /home/hik,
# if it doesn't exist, then in /home/app.


#Hi3531 Hi3521 platform TOE engine Support
#[ -e /proc/sys/vm/min_free_kbytes ] && echo 8192 > /proc/sys/vm/min_free_kbytes
#[ -e /proc/sys/vm/vfs_cache_pressure ] && echo 200 > /proc/sys/vm/vfs_cache_pressure



if true;then
if [ -e /home/hik/start.sh ];then
        /home/hik/start.sh
elif [ -e /home/app/start.sh ];then
        /home/app/start.sh
fi
fi


exit 0
[root@dvrdvs /] # /etc/init.d/rcS
Fri Mar  6 01:54:59 UTC 1970
Starting udev:      [ FAILED ]
mount: mounting /dev/mtdblock1 on /home/hik failed: Device or resource busy
show logo Fri Mar  6 01:54:59 UTC 1970
start decompress  Fri Mar  6 01:55:00 UTC 1970
tar: invalid tar magic
end decompress  Fri Mar  6 01:55:03 UTC 1970
scriptCmd: ./load3521 -i TW2964 512M.
AD type is TW2964
Memory size is 512M
SDK_TYPE type is 16d1
*** Board tools : ver0.0.1_20120501  ***
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm
0x20110168: 0x00003F05 --> 0x00003FF2
[END]
*** Board tools : ver0.0.1_20120501  ***
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm
0x20110150: 0x00003F06 --> 0x00003FF6
[END]
insmod: can't insert 'mmz.ko': File exists
******* Error!! Shell exit for error *****
[root@dvrdvs /] # PPPoE is disabled, quit.
dmesg
[root@dvrdvs /] # dmesg
 
After reading these things just like a layman (my knowledge of Linux like systems is very limited) I assumed that the processor is called HiSilicon Hi3531. Though it doesn't help me much. However, if you check THIS link and go down to the comments section, the Hisilicon DVR roadmap might be of some help.
 
mand3v said:
start decompress Fri Mar 6 01:55:00 UTC 1970 tar: invalid tar magic end decompress Fri Mar 6 01:55:03 UTC 1970
Click to expand...
Yes, the same corrupt file diagnostic.

You could see what it's trying to do with
cat /home/hik/start.sh

or
cat /home/app/start.sh

A pity dmesg didn't show, as it may have shown the device type.
You could experiment with adding a bootloader environment variable to expand the existing log detail.
Maybe something like =
setenv loglevel=8
saveenv
reset

mand3v said:
I assumed that the processor is called HiSilicon Hi3531
Click to expand...
Yes, a very commonly use SoC for NVRs and DVRs.
 
  • Like
Reactions: mat200
Hi,

First of all, I like to wish everyone Merry Christmas and a very happy New Year.

Then I apologize for being late. Actually I got a tad busy with my day-to-day work.

@alastairstevenson, I tried your provided instructions with following output.

Code: 
[guest@dvrdvs /] $ cat /home/hik/start.sh
#!/bin/sh

echo "show logo $(date)"
/bin/tar xzf /home/hik/logo.tar.gz -C /home/app
/home/hik/showlogo

echo "start decompress  $(date)"
/bin/tar xzf /home/hik/dvrCmd.tar.gz -C /usr/bin/
/bin/tar xaf /home/hik/app.tar.lzma -C /home/app
/bin/tar xaf /home/hik/hicore.tar.lzma -C /home/app
/bin/tar xaf /home/hik/misc.tar.lzma -C /home/app
mv /home/app/ntfs-3g /usr/bin/
mv /home/app/pppd /usr/bin/
mv /home/app/pppoe /usr/bin/
/bin/tar xaf /home/hik/webs.tar.lzma -C /home/app
/bin/tar xaf /home/hik/hisi.tar.lzma -C /home/app
echo "end decompress  $(date)"

/bin/chmod a+s /usr/bin/dvrCmd/dvrtools
/bin/chmod 777 /dev/hikio
/bin/chmod 777 /dev/ttyS0
/bin/chmod 777 /dev/ttyS3
/bin/chmod 777 /dev/rtc0
/bin/chmod 777 /dev/watchdog

cd /home/app/modules
/usr/bin/dvrCmd/loadModules load3521
rm -rf /home/app/modules
rm -f /home/app/logo.jpg
rm -f /home/app/cvbs.jpg

cd /home/app
./pppoed&
./iscsid&
./hicore&

Additionally, I tried the setenv command, but, the system returned "command not found" message.

I was wondering (I beg your pardon, it I sound like an absolute moron) if there were a way to dump everything from the DVR to my PC and then inspect the files. If that is an option at all.

I was just exploring the files and practicing newly learnt basic Linux commands. I found following things by listing contents of /urs/bin/dvrCmd directory, if that helps.

Code: 
GetAnrCfgInfo            guiChkCfg                resetPasswd
GetAnrProcess            guiEnterMenuCount        searchInfo
GetAnrRecordList         guiPrtScr                setDbgCtrl
ShowIpcAbility           guiStatus                setGateway
accessDvrSwitch          helpm                    setIp
channelPlayback          i2cRead                  setMtu
decStat                  i2cWrite                 setPlayTestCtrl
disableHB                loadModules              setPort
disableHik264            miscCmd                  setVoutIdx
disableWatchdog          outputClose              show8107coreUseInfo
dspStatus                outputOpen               showCurPlayChanFileInfo
dvrtools                 partRecDetails           showDeviceTemp
enableHB                 printPart                showIpcMemInfo
enableHik264             printTaskStatus          showNetIpcmInfo
enableWatchdog           pthreadInfo              showNetLinksInfo
errputClose              rebootDev                showPlayChanStatus
errputOpen               recorderChanInfo         showPlayClipFile
getDbgCtrl               recorderFileInfo         showPlayScreenInfo
getDspInfo               recorderFileKeyFrame     showPlayTime
getGateway               recorderHDIdle           showPreviewInfo
getHardInfo              recorderMediaInfo        showSpareWorkStatus
getIp                    recorderPAllocFile       showTagSysInfo
getLastErrorInfo         recorderParam            showUserInfo
getPlayTestCtrl          recorderSegExtraInfo     t1
getPort                  recorderStatus

I'll keep fiddling with it and hope to hear from you soon.

Bye,
Dave
 
  • Like
Reactions: mat200
mand3v said:
I tried your provided instructions with following output.
Click to expand...
That's good.
From that startup scriopt, you can see that one or more of these files is corrupt :
Code: 
echo "start decompress  $(date)"
/bin/tar xzf /home/hik/dvrCmd.tar.gz -C /usr/bin/
/bin/tar xaf /home/hik/app.tar.lzma -C /home/app
/bin/tar xaf /home/hik/hicore.tar.lzma -C /home/app
/bin/tar xaf /home/hik/misc.tar.lzma -C /home/app
mv /home/app/ntfs-3g /usr/bin/
mv /home/app/pppd /usr/bin/
mv /home/app/pppoe /usr/bin/
/bin/tar xaf /home/hik/webs.tar.lzma -C /home/app
/bin/tar xaf /home/hik/hisi.tar.lzma -C /home/app
echo "end decompress  $(date)"

To determine if it's all or just one, you could run each command manually, and see which fails like so :
You can copy / paste the command in to the PuTTY command line.

Code: 
/bin/tar xzf /home/hik/dvrCmd.tar.gz -C /usr/bin/

Also worth checking are some basics about the running environment such as :
ls -al /home
ls -al /home/hik
df -h
mount
 
  • Like
Reactions: mat200
That looks like my bad memory, too many version of bootloader.
The 'loglevel=8' needs to be added to the end of the 'bootargs' environment variable.
List the variables with 'printenv'.
Copy / paste to save the 'as-is' values for reference.
Then add the 'loglevel=8' to the end of the bootarges value and use 'saveenv'
 
  • Like
Reactions: mat200
I just found the rotten egg (I mean the corrupt file). Its hicore.tar.lzma.

And below is the output of running,
ls -al /home
ls -al /home/hik
df -h
mount

Code: 
[root@dvrdvs /] # ls -al /home
drwxr-xr-x    4 root     root          1024 Jul  3  2012 .
drwxr-xr-x   15 root     root          1024 Oct 24  2013 ..
drwxrwxrwt    7 root     root           400 Mar 13 22:37 app
drwxr-xr-x    3 root     root             0 Jan  1 00:00 hik
[root@dvrdvs /] # ls -al /home/hik
drwxr-xr-x    3 root     root             0 Jan  1 00:00 .
drwxr-xr-x    4 root     root          1024 Jul  3  2012 ..
-rwxrwxrwx    1 root     root        755350 Jan  1 00:00 app.tar.lzma
----------    1 root     root        362512 May 31  2015 devCfg.bin
-rwxrwxrwx    1 root     root         10441 Jan  1 00:00 dvrCmd.tar.gz
-rwxrwxrwx    1 root     root       3325484 Jan  1 00:00 hicore.tar.lzma
-rwxrwxrwx    1 root     root        981210 Jan  1 00:00 hisi.tar.lzma
-rwxrwxrwx    1 root     root         59921 Jan  1 00:00 logo.tar.gz
-rwxrwxrwx    1 root     root        296808 Jan  1 00:00 misc.tar.lzma
----------    1 root     root          6656 May 31  2015 netOsd.bin
-rwxrwxrwx    1 root     root        432640 Jan  1 00:00 player.bin
-rwxrwxrwx    1 root     root        942190 Jan  1 00:00 ramdisk.gz
-rwxrwxrwx    1 root     root         22968 Jan  1 00:00 showlogo
-rwxr-xr-x    1 root     root           909 Jan  1 00:00 start.sh
-rwxrwxrwx    1 root     root       1925968 Jan  1 00:00 uImage
-rwxrwxrwx    1 root     root             8 Jan  1 00:00 version
-rwxrwxrwx    1 root     root       2270441 Jan  1 00:00 webs.tar.lzma
[root@dvrdvs /] # df -h
df: invalid option -- h
BusyBox v1.16.1 (2013-10-24 19:00:14 CST) multi-call binary.

Usage: df [-Pkai] [-B SIZE] [FILESYSTEM]...

Print filesystem usage statistics

Options:
        -P      POSIX output format
        -k      1024-byte blocks (default)
        -a      Show all filesystems
        -i      Inodes
        -B SIZE Blocksize

[root@dvrdvs /] # mount
rootfs on / type rootfs (rw)
/dev/root on / type ext2 (rw,relatime,errors=continue)
proc on /proc type proc (rw,relatime)
sysfs on /sys type sysfs (rw,relatime)
udev on /dev type tmpfs (rw,relatime)
devpts on /dev/pts type devpts (rw,relatime,mode=600,ptmxmode=000)
/dev/mtdblock1 on /home/hik type jffs2 (rw,relatime)
tmpfs on /home/app type tmpfs (rw,relatime)
 
You must log in or register to reply here.
Top Bottom