Floureon K9604-W bad flash

Discussion in 'Firmware' started by vuli, Aug 16, 2019.

Share This Page

  1. vuli

    vuli n3wb

    Joined:
    Aug 16, 2019
    Messages:
    12
    Likes Received:
    1
    Location:
    Slovenia
    Hi,
    I have NVR from Floureon K9604-W with Hi3520D chip.
    the NVR is stuck on logo screen. I did some search but I need some help how to upload firmware via tftp because via USB port it dosnt do nothing.

    This the serial output:

    Code:
    U-Boot 2010.06-dirty (Aug 15 2013 - 10:07:00)
    
    Check spi flash controller v350... Found
    Spi(cs1) ID: 0xC2 0x20 0x18 0xC2 0x20 0x18
    Spi(cs1): Block:64KB Chip:16MB Name:"MX25L128XX"
    In:    serial
    Out:   serial
    Err:   serial
    Hit any key to stop autoboot:  0
    16384 KiB hi_sfc at 0:0 is now current device
    
    
    enable_mmu_accelerate
    <<addr=0x84800000, size=0x40000, vobuf=0x8c000000>>
    <<imgwidth=800, imgheight=600, linebytes=1600>>
    decode success!!!!
    <<addr=0x84900000, size=0x40000, vobuf=0x8d000000>>
    <<imgwidth=720, imgheight=576, linebytes=1440>>
    decode success!!!!
    disable_mmu_accelerate
    16384 KiB hi_sfc at 0:0 is now current device
    
    
    ## Booting kernel from Legacy Image at 82000000 ...
       Image Name:   Linux-3.0.8
       Image Type:   ARM Linux Kernel Image (uncompressed)
       Data Size:    2472884 Bytes = 2.4 MiB
       Load Address: 80008000
       Entry Point:  80008000
    ## Loading init Ramdisk from Legacy Image at 81000000 ...
       Image Name:   JUAN root filesystem(27/11/2018)
       Image Type:   ARM Linux RAMDisk Image (gzip compressed)
       Data Size:    8302592 Bytes = 7.9 MiB
       Load Address: 81000000
       Entry Point:  81000000
       Loading Kernel Image ... OK
    OK
    
    Starting kernel ...
    
    Uncompressing Linux... done, booting the kernel.
    Linux version 3.0.8 (root@lee) (gcc version 4.4.1 (Hisilicon_v100(gcc4.4-290+ucl                                           ibc_0.9.32.1+eabi+linuxpthread)) ) #11 Thu Nov 9 11:04:26 CST 2017
    CPU: ARMv7 Processor [414fc091] revision 1 (ARMv7), cr=10c53c7f
    CPU: VIPT nonaliasing data cache, VIPT aliasing instruction cache
    Machine: hi3520d
    Memory policy: ECC disabled, Data cache writeback
    Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 35560
    Kernel command line: mem=140M console=ttyAMA0,115200 root=0100 init=/linuxrc mtd                                           parts=hi_sfc:512K(U),256K(E),256K(L),512K(C),2560K(K),12M(R) ramdisk_size=8000
    PID hash table entries: 1024 (order: 0, 4096 bytes)
    Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
    Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
    Memory: 140MB = 140MB total
    Memory: 127056k/127056k available, 16304k reserved, 0K highmem
    Virtual kernel memory layout:
        vector  : 0xffff0000 - 0xffff1000   (   4 kB)
        fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
        DMA     : 0xffc00000 - 0xffe00000   (   2 MB)
        vmalloc : 0xc9000000 - 0xfe000000   ( 848 MB)
        lowmem  : 0xc0000000 - 0xc8c00000   ( 140 MB)
        modules : 0xbf000000 - 0xc0000000   (  16 MB)
          .init : 0xc0008000 - 0xc002d000   ( 148 kB)
          .text : 0xc002d000 - 0xc0620000   (6092 kB)
          .data : 0xc0620000 - 0xc064e3e0   ( 185 kB)
           .bss : 0xc064e404 - 0xc06aa610   ( 369 kB)
    SLUB: Genslabs=13, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
    NR_IRQS:128 nr_irqs:128 128
    sched_clock: 32 bits at 82MHz, resolution 12ns, wraps every 52060ms
    Console: colour dummy device 80x30
    Calibrating delay loop... 1318.91 BogoMIPS (lpj=6594560)
    pid_max: default: 32768 minimum: 301
    Mount-cache hash table entries: 512
    CPU: Testing write buffer coherency: ok
    hw perfevents: enabled with ARMv7 Cortex-A9 PMU driver, 7 counters available
    devtmpfs: initialized
    xor: measuring software checksum speed
       arm4regs  :  1072.000 MB/sec
       8regs     :   802.800 MB/sec
       32regs    :   851.200 MB/sec
    xor: using function: arm4regs (1072.000 MB/sec)
    NET: Registered protocol family 16
    hw-breakpoint: found 6 breakpoint and 1 watchpoint registers.
    hw-breakpoint: 1 breakpoint(s) reserved for watchpoint single-step.
    hw-breakpoint: maximum watchpoint size is 4 bytes.
    Serial: AMBA PL011 UART driver
    uart:0: ttyAMA0 at MMIO 0x20080000 (irq = 40) is a PL011 rev2
    console [ttyAMA0] enabled
    uart:1: ttyAMA1 at MMIO 0x20090000 (irq = 41) is a PL011 rev2
    uart:2: ttyAMA2 at MMIO 0x200a0000 (irq = 42) is a PL011 rev2
    uart:3: ttyAMA3 at MMIO 0x200b0000 (irq = 43) is a PL011 rev2
    bio: create slab <bio-0> at 0
    raid6: int32x1     32 MB/s
    raid6: int32x2     56 MB/s
    raid6: int32x4     75 MB/s
    raid6: int32x8    101 MB/s
    raid6: using algorithm int32x8 (101 MB/s)
    SCSI subsystem initialized
    usbcore: registered new interface driver usbfs
    usbcore: registered new interface driver hub
    usbcore: registered new device driver usb
    cfg80211: Calling CRDA to update world regulatory domain
    Switching to clocksource timer1
    FS-Cache: Loaded
    CacheFiles: Loaded
    NET: Registered protocol family 2
    IP route cache hash table entries: 2048 (order: 1, 8192 bytes)
    TCP established hash table entries: 8192 (order: 4, 65536 bytes)
    TCP bind hash table entries: 8192 (order: 3, 32768 bytes)
    TCP: Hash tables configured (established 8192 bind 8192)
    TCP reno registered
    UDP hash table entries: 256 (order: 0, 4096 bytes)
    UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
    NET: Registered protocol family 1
    RPC: Registered named UNIX socket transport module.
    RPC: Registered udp transport module.
    RPC: Registered tcp transport module.
    RPC: Registered tcp NFSv4.1 backchannel transport module.
    Trying to unpack rootfs image as initramfs...
    rootfs image is not initramfs (junk in compressed archive); looks like an initrd
    Freeing initrd memory: 8108K
    NetWinder Floating Point Emulator V0.97 (double precision)
    L2cache cache controller enabled
    VFS: Disk quotas dquot_6.5.2
    Dquot-cache hash table entries: 1024 (order 0, 4096 bytes)
    DLM installed
    squashfs: version 4.0 (2009/01/31) Phillip Lougher
    NTFS driver 2.1.30 [Flags: R/W].
    fuse init (API version 7.16)
    SGI XFS with security attributes, large block/inode numbers, no debug enabled
    msgmni has been set to 263
    alg: No test for stdrng (krng)
    Block layer SCSI generic (bsg) driver version 0.4 loaded (major 254)
    io scheduler noop registered
    io scheduler deadline registered (default)
    io scheduler cfq registered
    brd: module loaded
    loop: module loaded
    Loading iSCSI transport class v2.0-870.
    SCSI Media Changer driver v0.25
    ahci: SSS flag set, parallel bus scan disabled
    ahci ahci.0: AHCI 0001.0200 32 slots 2 ports 3 Gbps 0x3 impl platform mode
    ahci ahci.0: flags: ncq sntf stag pm led clo only pmp pio slum part ccc sxs boh
    scsi0 : ahci_platform
    scsi1 : ahci_platform
    ata1: SATA max UDMA/133 mmio [mem 0x10080000-0x1008ffff] port 0x100 irq 52
    ata2: SATA max UDMA/133 mmio [mem 0x10080000-0x1008ffff] port 0x180 irq 52
    Spi id table Version 1.22
    Spi(cs1) ID: 0xC2 0x20 0x18 0xC2 0x20 0x18
    SPI FLASH start_up_mode is 3 Bytes
    Spi(cs1):
    Block:64KB
    Chip:16MB
    Name:"MX25L128XX"
    spi size: 16MB
    chip num: 1
    6 cmdlinepart partitions found on MTD device hi_sfc
    Creating 6 MTD partitions on "hi_sfc":
    0x000000000000-0x000000080000 : "U"
    0x000000080000-0x0000000c0000 : "E"
    0x0000000c0000-0x000000100000 : "L"
    0x000000100000-0x000000180000 : "C"
    0x000000180000-0x000000400000 : "K"
    0x000000400000-0x000001000000 : "R"
    Fixed MDIO Bus: probed
    ata1: SATA link down (SStatus 0 SControl 300)
    himii: probed
    ata2: SATA link down (SStatus 0 SControl 300)
    Invalid HW-MAC Address: 00:00:00:00:00:00
    Set Random MAC address: 06:4A:5E:CF:85:F9
    PPP generic driver version 2.4.2
    PPP Deflate Compression module registered
    PPP BSD Compression module registered
    PPP MPPE Compression module registered
    NET: Registered protocol family 24
    SLIP: version 0.8.4-NET3.019-NEWTTY (dynamic channels, max=256).
    CSLIP: code copyright 1989 Regents of the University of California.
    SLIP linefill/keepalive option.
    usbmon: debugfs is not available
    ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
    hiusb-ehci hiusb-ehci.0: HIUSB EHCI
    hiusb-ehci hiusb-ehci.0: new USB bus registered, assigned bus number 1
    hiusb-ehci hiusb-ehci.0: irq 53, io mem 0x100b0000
    hiusb-ehci hiusb-ehci.0: USB 0.0 started, EHCI 1.00
    hub 1-0:1.0: USB hub found
    hub 1-0:1.0: 2 ports detected
    ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
    hiusb-ohci hiusb-ohci.0: HIUSB OHCI
    hiusb-ohci hiusb-ohci.0: new USB bus registered, assigned bus number 2
    hiusb-ohci hiusb-ohci.0: irq 54, io mem 0x100a0000
    hub 2-0:1.0: USB hub found
    hub 2-0:1.0: 2 ports detected
    usbcore: registered new interface driver cdc_acm
    cdc_acm: USB Abstract Control Model driver for USB modems and ISDN adapters
    Initializing USB Mass Storage driver...
    usbcore: registered new interface driver usb-storage
    USB Mass Storage support registered.
    usbcore: registered new interface driver ums-alauda
    usbcore: registered new interface driver ums-cypress
    usbcore: registered new interface driver ums-datafab
    usbcore: registered new interface driver ums_eneub6250
    usbcore: registered new interface driver ums-freecom
    usbcore: registered new interface driver ums-isd200
    usbcore: registered new interface driver ums-jumpshot
    usbcore: registered new interface driver ums-karma
    usbcore: registered new interface driver ums-onetouch
    usbcore: registered new interface driver ums-realtek
    usbcore: registered new interface driver ums-sddr09
    usbcore: registered new interface driver ums-sddr55
    usbcore: registered new interface driver ums-usbat
    usbcore: registered new interface driver usbserial
    USB Serial support registered for generic
    usbcore: registered new interface driver usbserial_generic
    usbserial: USB Serial Driver core
    USB Serial support registered for GSM modem (1-port)
    usbcore: registered new interface driver option
    option: v0.7.2:USB Driver for GSM modems
    mousedev: PS/2 mouse device common for all mice
    md: linear personality registered for level -1
    md: raid0 personality registered for level 0
    md: raid1 personality registered for level 1
    md: raid10 personality registered for level 10
    md: raid6 personality registered for level 6
    md: raid5 personality registered for level 5
    md: raid4 personality registered for level 4
    md: multipath personality registered for level -4
    md: faulty personality registered for level -5
    device-mapper: ioctl: 4.20.0-ioctl (2011-02-02) initialised: dm-devel@redhat.com
    device-mapper: multipath: version 1.3.0 loaded
    device-mapper: multipath round-robin: version 1.0.0 loaded
    device-mapper: multipath queue-length: version 0.1.0 loaded
    device-mapper: multipath service-time: version 0.2.0 loaded
    device-mapper: dm-log-userspace: version 1.1.0 loaded
    usbcore: registered new interface driver usbhid
    usbhid: USB HID core driver
    TCP cubic registered
    Initializing XFRM netlink socket
    NET: Registered protocol family 17
    NET: Registered protocol family 15
    802.1Q VLAN Support v1.8
    sctp: Hash tables configured (established 4096 bind 8192)
    lib80211: common routines for IEEE802.11 drivers
    md: Waiting for all devices to be available before autodetect
    md: If you don't use raid, use raid=noautodetect
    md: Autodetecting RAID arrays.
    md: Scanned 0 and added 0 devices.
    md: autorun ...
    md: ... autorun DONE.
    RAMDISK: squashfs filesystem found at block 0
    RAMDISK: image too big! (8106KiB/8000KiB)
    usb 1-1: new high speed USB device number 2 using hiusb-ehci
    UDF-fs: No partition found (1)
    List of all partitions:
    1f00             512 mtdblock0  (driver?)
    1f01             256 mtdblock1  (driver?)
    1f02             256 mtdblock2  (driver?)
    1f03             512 mtdblock3  (driver?)
    1f04            2560 mtdblock4  (driver?)
    1f05           12288 mtdblock5  (driver?)
    f000             512 romblock0  (driver?)
    f001             256 romblock1  (driver?)
    f002             256 romblock2  (driver?)
    f003             512 romblock3  (driver?)
    f004            2560 romblock4  (driver?)
    f005           12288 romblock5  (driver?)
    No filesystem could mount root, tried:  ext3 ext2 ext4 cramfs squashfs vfat msdo                                           s iso9660 ntfs fuseblk udf xfs
    Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(1,0)
    Backtrace:
    [<c0036cbc>] (dump_backtrace+0x0/0x110) from [<c04a857c>] (dump_stack+0x18/0x1c)
     r6:00008000 r5:c1209047 r4:c064e8b0 r3:c06269bc
    [<c04a8564>] (dump_stack+0x0/0x1c) from [<c04a85dc>] (panic+0x5c/0x17c)
    [<c04a8580>] (panic+0x0/0x17c) from [<c0008f28>] (mount_block_root+0x1d8/0x218)
     r3:c842bf34 r2:00000020 r1:c842bf58 r0:c059f6ff
     r7:c002615c
    [<c0008d50>] (mount_block_root+0x0/0x218) from [<c0009014>] (mount_root+0xac/0xc                                           c)
     r8:00000000 r7:00000013 r6:c0049080 r5:c002616c r4:00100000
    [<c0008f68>] (mount_root+0x0/0xcc) from [<c00091a8>] (prepare_namespace+0x174/0x                                           1d4)
     r4:c064e560
    [<c0009034>] (prepare_namespace+0x0/0x1d4) from [<c0008458>] (kernel_init+0xe8/0                                           x11c)
     r5:c0025244 r4:c064e500
    [<c0008370>] (kernel_init+0x0/0x11c) from [<c0049080>] (do_exit+0x0/0x614)
     r5:c0008370 r4:00000000
    
    
    and U-Boot

    Code:
    hisilicon # help
    ?       - alias for 'help'
    base    - print or set address offset
    bootm   - boot application image from memory
    bootp   - boot image via network using BOOTP/TFTP protocol
    bzr     - bzr - buzzer sound out.
    
    cmp     - memory compare
    cp      - memory copy
    crc32   - checksum calculation
    ddrp    - ddrp training 
    
    
    tools v200
    ddrt    - ddr training tools v200
    decjpg  - jpgd   - decode jpeg picture.
    
    fatinfo - print information about filesystem
    fatload - load binary file from a dos filesystem
    fatls   - list files in a directory (default /)
    getinfo - print hardware information
    go      - start application at address 'addr'
    help    - print command description/usage
    loadb   - load binary file over serial line (kermit mode)
    loady   - load binary file over serial line (ymodem mode)
    logo    - logo - decode logo picture to show.
    
    loop    - infinite loop on address range
    md      - memory display
    mii     - MII utility commands
    mm      - memory modify (auto-incrementing address)
    mtest   - simple RAM read/write test
    mw      - memory write (fill)
    nm      - memory modify (constant address)
    ping    - send ICMP ECHO_REQUEST to network host
    printenv- print environment variables
    rarpboot- boot image via network using RARP/TFTP protocol
    reset   - Perform RESET of the CPU
    saveenv - save environment variables to persistent storage
    setenv  - set environment variables
    setvobg - setvobg   - set vo backgroud color.
            - setvobg [dev color]
    sf      - SPI flash sub-system
    startgx - startgx   - open graphics layer.
            - startgx [layer addr stride x y w h]
    
    startvo - startvo   - open interface of vo device.
            - startvo [dev type sync]
    stopgx  - stopgx   - close graphics layer.
            - stopgx [layer]
    stopvo  - stopvo   - close interface of vo device.
            - stopvo [dev]
    tftp    - tftp  - download or upload image via network using TFTP protocol
    usb     - USB sub-system
    usbboot - boot from USB device
    version - print monitor version
    hisilicon #
    
    I only have .rom file provided by the company.
     
  2. alastairstevenson

    alastairstevenson Staff Member

    Joined:
    Oct 28, 2014
    Messages:
    11,252
    Likes Received:
    3,578
    Location:
    Scotland
    If this is a whole-flash image dump (you must ask them), then the sf command in u-boot should be able to handle it.
    Best if you ask them what the exact u-boot command would be to apply it.

    In the absence of any response, you'd have to do some investigation:
    Use 'printenv' to figure out what the RAM base address should be for loading in data via tftp.
    This might be seen in the boot command definition.
    And binwalk the rom file to get an idea what's in it.

    For example, this shows that 0x80400000 can be used to load data into.
    Code:
    HKVS # printenv
    bootcmd=tftp 0x80400000 $(bootfile);bootm 0x80400000;
    default=cramfsload 0x80400000 uImage;
    sec=tftp 0x80400000 uImage_sec;bootm 0x80400000;
    verify=n
    bootdelay=1
    baudrate=115200
    mdio_intf=rgmii
    ipaddr=192.0.0.64
    serverip=192.0.0.128
    gatewayip=192.0.0.1
    netmask=255.255.255.0
    bootfile=uImage
    phyaddr1=7
    bootargs=mem=177M console=ttyS0,115200n8
    ethaddr=8c:e7:48:76:bf:4d
    stdin=serial
    stdout=serial
    stderr=serial
    ver=U-Boot 2010.06-svn (Jan 23 2014 - 16:38:55)
    
    Environment size: 458/4092 bytes
    Then loading some data :
    Code:
    HKVS #
    HKVS # tftp 0x80400000 mtd1_part1_mod
    MAC:   8C-E7-48-76-BF-4D
    TFTP from server 192.168.1.99; our IP address is 192.168.1.214
    Download Filename 'mtd1_part1_mod'.
    Download to address: 0x80400000
    Downloading: #################################################
    done
    Bytes transferred = 131072 (20000 hex)
    HKVS #
    Then writing it to the flash:
    Code:
    HKVS #
    HKVS # sf erase 0x10000 0x20000
    Erasing at 0x30000 -- 100% complete.
    HKVS #
    HKVS # sf write 0x80400000 0x10000 0x20000
    Writing at 0x30000 -- 100% complete.
    HKVS #
    But this example avoids the bootloader area.
    If the data you've been provided with is a whole-flash dump it will also include the bootloader.
    Which if wrongly written over will permanently trash the device.
    So the detailed advice from the supplier is very important.

    I hope that makes sense.
    Good luck!
     
    mat200 likes this.
  3. vuli

    vuli n3wb

    Joined:
    Aug 16, 2019
    Messages:
    12
    Likes Received:
    1
    Location:
    Slovenia
    hmm. AS far as I know, that .rom is an upgrade file not a dump file. They gave me antoher file "help.rom".
    Code:
    hisilicon # printenv
    bootdelay=1
    baudrate=115200
    bootfile="uImage"
    s00=sf probe 0
    s01=sf read 0x84800000 0xc0000 0x20000
    s02=sf read 0x84900000 0xe0000 0x20000
    s03=logo
    s10=sf probe 0
    s11=sf read 0x82000000 0x180000 0x280000
    s12=sf read 0x81000000 0x400000 0x800000
    s13=bootm 0x82000000 0x81000000
    s21=bzr 200 1
    s22=bzr 55 2
    s23=usb start
    s24=fatload usb 0 0x82000000 help.rom
    s30=sf probe 0
    s31=sf erase 0x180000 0x280000
    s32=sf erase 0x400000 0xC00000
    s33=sf write 0x82440000 0x400000 0xC00000
    s34=sf write 0x821C0000 0x180000 0x280000
    s41=bzr 55 2
    s42=bzr 500 1
    s43=bzr 500 5
    s44=reset
    vout_vga=0x8C000000
    vout_pal=0x8D000000
    bootargs=mem=140M console=ttyAMA0,115200 root=0100 init=/linuxrc mtdparts=hi_sfc:512K(U),256K(E),256K(L),512K(C),2560K(K),12M(R) ramdisk_size=8000
    bootcmd=${s00};${s01};${s02};${s03};${s10};${s11};${s12};${s13};${s21};${s22};${s23};${s24};${s30};${s31};${s32};${s33};${s34};${s41};${s42};${s43};${s44};
    ethaddr=2A:E5:41:33:5E:86
    stdin=serial
    stdout=serial
    stderr=serial
    verify=n
    ver=U-Boot 2010.06-dirty (Aug 15 2013 - 10:07:00)
    netmask=255.255.255.0
    ipaddr=192.168.1.10
    serverip=192.168.1.99
    
    Environment size: 1101/262140 bytes
    hisilicon #
    
     
  4. vuli

    vuli n3wb

    Joined:
    Aug 16, 2019
    Messages:
    12
    Likes Received:
    1
    Location:
    Slovenia
    I just realized, a friend have the same nvr. Is it possible to make flash dump file from his device and than use it on my?
     
  5. alastairstevenson

    alastairstevenson Staff Member

    Joined:
    Oct 28, 2014
    Messages:
    11,252
    Likes Received:
    3,578
    Location:
    Scotland
    I'd say so = the 'sf' and ' tftp' bootloader commands allow flash read and write, and file transfers.
    But best avoid writing over the bootloader.
    It looks like it's the root filesystem that's corrupted.
    This, and the bootargs command-line arguments, give the flash layout that shows what areas to target.
    Code:
    6 cmdlinepart partitions found on MTD device hi_sfc
    Creating 6 MTD partitions on "hi_sfc":
    0x000000000000-0x000000080000 : "U"
    0x000000080000-0x0000000c0000 : "E"
    0x0000000c0000-0x000000100000 : "L"
    0x000000100000-0x000000180000 : "C"
    0x000000180000-0x000000400000 : "K"
    0x000000400000-0x000001000000 : "R"
     
  6. vuli

    vuli n3wb

    Joined:
    Aug 16, 2019
    Messages:
    12
    Likes Received:
    1
    Location:
    Slovenia
    Binwalk give me this reading. I tried to use -E mark to extract but it gave me .squashfs ending and some error Extractor.execute failed to run '/opt/firmware-mod-kit/trunk/unsquashfs_all.sh
    Code:
    
    DECIMAL       HEX           DESCRIPTION
    -------------------------------------------------------------------------------------------------------
    1835008       0x1C0000      uImage header, header size: 64 bytes, header CRC: 0x22F57CA3, created: Tue Jul 11 02:15:37 2017, image size: 1721596 bytes, Data Address: 0x80008000, Entry Point: 0x80008000, data CRC: 0xB8AA6D45, OS: Linux, CPU: ARM, image type: OS Kernel Image, compression type: none, image name: "Linux-3.0.8"
    4456512 
    0x440040      Squashfs filesystem, little endian, version 4.0, compression:  size: 5575612 bytes,  1136 inodes, blocksize: 1048576 bytes, created: Thu Mar 21 13:27:29 2019
    
    
    12846080      0xC40400      Squashfs filesystem, little endian, version 4.0, compression:  size: 3802899 bytes,  774 inodes, blocksize: 1048576 bytes, created: Thu Mar 21 13:27:26 2019
    
    
    
     
  7. alastairstevenson

    alastairstevenson Staff Member

    Joined:
    Oct 28, 2014
    Messages:
    11,252
    Likes Received:
    3,578
    Location:
    Scotland
    That means I think that you don't have the squashfs tools.
    sudo apt-get install squashfs-tools

    Zip up the file and attach.
    It may be a full flash dump.
     
  8. vuli

    vuli n3wb

    Joined:
    Aug 16, 2019
    Messages:
    12
    Likes Received:
    1
    Location:
    Slovenia
    Will take a look. Squashfs is installed,-dbg wasnt and cant remember if I even saw -tools in the package manager.
     
  9. vuli

    vuli n3wb

    Joined:
    Aug 16, 2019
    Messages:
    12
    Likes Received:
    1
    Location:
    Slovenia
    :banghead:
    it took me a while, but it looks ubuntu destribution gave me better results.
    Code:
    DECIMAL       HEXADECIMAL     DESCRIPTION
    --------------------------------------------------------------------------------
    1048576       0x100000        JPEG image data, JFIF standard 1.02
    1065317       0x104165        Copyright string: "Copyright (c) 1998 Hewlett-Packard Company"
    1179648       0x120000        JPEG image data, JFIF standard 1.02
    1196389       0x124165        Copyright string: "Copyright (c) 1998 Hewlett-Packard Company"
    1835008       0x1C0000        uImage header, header size: 64 bytes, header CRC: 0x22F57CA3, created: 2017-07-11 02:15:37, image size: 1721596 bytes, Data Address: 0x80008000, Entry Point: 0x80008000, data CRC: 0xB8AA6D45, OS: Linux, CPU: ARM, image type: OS Kernel Image, compression type: none, image name: "Linux-3.0.8"
    1835072       0x1C0040        Linux kernel ARM boot executable zImage (little-endian)
    1842609       0x1C1DB1        LZMA compressed data, properties: 0x5D, dictionary size: 67108864 bytes, uncompressed size: -1 bytes
    4456512       0x440040        Squashfs filesystem, little endian, version 4.0, compression:xz, size: 5575612 bytes, 1136 inodes, blocksize: 1048576 bytes, created: 2019-03-21 13:27:29
    12846080      0xC40400        Squashfs filesystem, little endian, version 4.0, compression:xz, size: 3802899 bytes, 774 inodes, blocksize: 1048576 bytes, created: 2019-03-21 13:27:26
    
    
     

    Attached Files:

  10. alastairstevenson

    alastairstevenson Staff Member

    Joined:
    Oct 28, 2014
    Messages:
    11,252
    Likes Received:
    3,578
    Location:
    Scotland
    I can't tell for sure from the already-extracted attachment if it's a full flash dump - much of the original data is missing.
    It could simply be a normal firmware file, with kernel, app and rootfs files.
    Which would need a working NVR to make use of, as opposed to using flash commands in the bootloader.
     
  11. vuli

    vuli n3wb

    Joined:
    Aug 16, 2019
    Messages:
    12
    Likes Received:
    1
    Location:
    Slovenia
    this help.rom file is used like this
    Code:
    1. Format the USB Flash to FAT32 format
    2. Copy the files "help.rom" and "systool" to the USB Flash
    3. Insert the USB flash into the USB port of NVR.
    4. Pow on the NVR it will automatically upgrade, and then you can hear the beep sounds.
       Wait 6 minutes, the NVR will upgrade successfully and restart
       Note: you cannot power off it during the upgrade process
    I follow 1st this instructions and NVR became 9ch instead of 4ch and wifi module didnt work. So, after that, they send me another fw file, which I should used and upgrade from a working system. But becasue they didnt give me any new instructions, I follow the 1st steps and this happened.
    I found the correct procedure on some 3rd company. The Solution For 04jb Nvr Crash (k8204-w)
    when i get to my lapotop, will upload that "upgrade" rom, to see if there is anydiference.
     
  12. vuli

    vuli n3wb

    Joined:
    Aug 16, 2019
    Messages:
    12
    Likes Received:
    1
    Location:
    Slovenia
    I attached that "upgrade" firmware.
     

    Attached Files:

  13. alastairstevenson

    alastairstevenson Staff Member

    Joined:
    Oct 28, 2014
    Messages:
    11,252
    Likes Received:
    3,578
    Location:
    Scotland
    Presumably due to it being for the different model.

    Actually - you attached a binwalk-extracted version, which again misses out all the many bits that binwalk does not handle.
    But no matter, out of curiosity I had a look at the firmware in the support link you posted.
    The firmware is a Juanvision product.
    It's not a full flash dump - it holds the default values for the bootloader environment variables, the Linux kernel, and the root file system which includes the app programs and data.
     
  14. vuli

    vuli n3wb

    Joined:
    Aug 16, 2019
    Messages:
    12
    Likes Received:
    1
    Location:
    Slovenia
    I think that help.rom can be used on many models.
    For example this company is selling the same models as I have. Saw same pictures with the same system info.
    I ask them, if they can provide me a full flash dump and they give me this link .
    If you look at the articles for other models, all have help.rom and than ofcuirse different upgrade firmware.
     
  15. vuli

    vuli n3wb

    Joined:
    Aug 16, 2019
    Messages:
    12
    Likes Received:
    1
    Location:
    Slovenia
    Well, I think I am gonna try this with help.rom
    Code:
    sf erase 0x180000 0x280000
    sf erase 0x400000 0xC00000
    sf write 0x82440000 0x400000 0xC00000
    sf write 0x821C0000 0x180000 0x280000
     
  16. alastairstevenson

    alastairstevenson Staff Member

    Joined:
    Oct 28, 2014
    Messages:
    11,252
    Likes Received:
    3,578
    Location:
    Scotland
    If you do that without reading the data you'll write garbage to the flash.
    Code:
    s23=usb start
    s24=fatload usb 0 0x82000000 help.rom
    s30=sf probe 0
    And if that help.rom is from the link you provided in post #11 it does not look like the help.rom or the firmware matches the rootfs splits as shown in the booloader 'run' definitions.
    The kernel looks OK though.
    Code:
    1835008       0x1C0000        uImage header, header size: 64 bytes, header CRC: 0x22F57CA3, created: 2017-07-11 02:15:37, image size: 1721596 bytes, Data Address: 0x80008000, Entry Point: 0x80008000, data CRC: 0xB8AA6D45, OS: Linux, CPU: ARM, image type: OS Kernel Image, compression type: none, image name: "Linux-3.0.8"
    1835072       0x1C0040        Linux kernel ARM boot executable zImage (little-endian)
    1842609       0x1C1DB1        LZMA compressed data, properties: 0x5D, dictionary size: 67108864 bytes, uncompressed size: -1 bytes
    4456512       0x440040        Squashfs filesystem, little endian, version 4.0, compression:xz, size: 5575612 bytes, 1136 inodes, blocksize: 1048576 bytes, created: 2019-03-21 13:27:29
    12846080      0xC40400        Squashfs filesystem, little endian, version 4.0, compression:xz, size: 3802899 bytes, 774 inodes, blocksize: 1048576 bytes, created: 2019-03-21 13:27:26
    
    
     
  17. vuli

    vuli n3wb

    Joined:
    Aug 16, 2019
    Messages:
    12
    Likes Received:
    1
    Location:
    Slovenia
    god damn it, it's working!
    Thanks for your part, this is the whole code I used:
    Code:
    usb start
    fatload usb 0 0x82000000 help.rom
    sf probe 0
    sf erase 0x180000 0x280000
    sf erase 0x400000 0xC00000
    sf write 0x82440000 0x400000 0xC00000
    sf write 0x821C0000 0x180000 0x280000
    
     
    Now it is like it was the day when I uploaded help.rom. It is a different model. Now I need to make an upgrade from the device itself and I hope I will be back on track.
     
    alastairstevenson likes this.
  18. alastairstevenson

    alastairstevenson Staff Member

    Joined:
    Oct 28, 2014
    Messages:
    11,252
    Likes Received:
    3,578
    Location:
    Scotland
    Well done, a good result.
     
  19. vuli

    vuli n3wb

    Joined:
    Aug 16, 2019
    Messages:
    12
    Likes Received:
    1
    Location:
    Slovenia
    This china stuff, is one big pain in ass.
    I thought the 2nd firmware, the upgrade firmware will work but it looks it is not accepted. I can upgrade it via internet but than it stays N9209 model instead of K9604-W.
    Will see, if that company have any other solution, else I will probably try to use that flashing procedure and flash this 2nd firmware.