Hikvision - Clearing Passwords and/or Loading Firmware via TTL Serial

[ID-VS]

You may be needing to use a null modem cable if it's really RS232 as opposed to TTL serial..
If feasible, try swapping pins 2 & 3 on one of the DB9 connectors.

I ran by the nearest shop and got a null modem, that did the trick. Thanks

 

[alastairstevenson]

Excellent!
It seems you have pretty good shops down your way.

 

[alfaclvi]

Excellent!
It seems you have pretty good shops down your way.

Thank you this worked for me. Saved my DS-KV6113-WPE1 from continuing reboot after selecting Semi-Digital mode.
Now I have also a new one since I had not seen your method before ordering a new one.
New one has a new firmware that I cannot find on any server( V2.1.3 build 191113). The old one is V2.1.3 build 191015 and has an infra red malfunction possibly because of firmware
Is there any way to export existing new firmware and save as file by using putty or telnet and tftp server?

Thank you

 

[alastairstevenson]

Is there any way to export existing new firmware and save as file by using putty or telnet and tftp server?

If the serial console can provide root shell access to the running system - files can be extracted.
But I'd expect that root shell access will be blocked.
Sometimes also the bootloader (if there is one in the device) has flash memory commands.

 

[wirephobia]

Thanks for the tips in the original post, they helped a lot.

Posting below in case it helps someone else:

I had updated my DS-7616NI-I2/16P NVR with firmware which corrupted the user DB so instead of showing 'admin' it showed a list of users with square unicode looking characters, and my password was no longer accepted.

I could not get the TFTP server (tried both 32 bit and 64 bit versions) to upload firmware so I tried the ttl-serial method in this post. I connected fine but couldn't interrupt the bootloader process (i.e ctrl+u had no effect).

Cutting a week long story short, I ended up re-trying with the NVR and my PC connected to a network switch with IP address set on my PC accordingly, but not using the serial connection. Then using Solarwinds tftp server (and the correct firmware of course), it worked immediately. The new firmware transferred straight onto the NVR, it rebooted and was then as good as new.

Link to the tftp server that worked for me: FREE TFTP Server and SFTP/SCP Server | SolarWinds

 

[rad one]

Good Morning,

Can someone give me some input. I have a DS-7608NI-E2. I updated the firmware last week and not the login user names are a bunch of squares and the password doesn't work. I think I'm pretty close, PuTTY just can't seem to complete the download.

I'm plugged in trough the serial port. The NVR is plugged into the my swtich and another cat5 plugged in from one of the nr camera ports into my laptop.

 

[alastairstevenson]

PuTTY just can't seem to complete the download.

It's timing out, possibly because the tftp server / updater is not reachable on the network.
I'm guessing that the IP addresses you have specified may not be correct.

You should specify for the 'device' a valid IP address for your LAN. Maybe what the NVR normally uses.
And for the 'upgrade server' specify the IP address of the PC running the tftp server / updater.

 

[rad one]

It's timing out, possibly because the tftp server / updater is not reachable on the network.
I'm guessing that the IP addresses you have specified may not be correct.

You should specify for the 'device' a valid IP address for your LAN. Maybe what the NVR normally uses.
And for the 'upgrade server' specify the IP address of the PC running the tftp server / updater.

oh I thought I attached a screenshot. I’m using the 192.0.0.64 for the IP address and 192.0.0.128 for the server like in the all instructions. A bunch of T’s fill the screen “T T T T T T... retry count exceeds. Starting again” and then it’ll just keep repeating that process.

 

[alastairstevenson]

192.0.0.128 for the server

Is that what you have set the PC IP address to?
If so - the Windows firewall may be blocking access to the tftp updater. Try disabling it temporarily.
Normally you'd not need to change that, just use the normal PC IP address.

 

[rad one]

Is that what you have set the PC IP address to?
If so - the Windows firewall may be blocking access to the tftp updater. Try disabling it temporarily.
Normally you'd not need to change that, just use the normal PC IP address.

Thanks for the input alastairstevenson.

Yea, I set the IP to the same address.

I turned off the firewalls and nothing changed:


Now press [u/U] key to upgrade software: u
File system error,please upgrade by TFTP

Please input ip address of device: 192.0.0.64
Please input ip address of upgrade server: 192.0.0.128
Confirm?(y/n): y
timeout for link [4999]!
MAC:
TFTP from server 192.0.0.128; our IP address is 192.0.0.64
Download Filename 'digicap.dav'.
Download to address: 0x80008000
Downloading: T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T
Retry count exceeded; starting again
TFTP from server 192.0.0.128; our IP address is 192.0.0.64
Download Filename 'digicap.dav'.
Download to address: 0x80008000
Downloading: T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T
Retry count exceeded; starting again
TFTP from server 192.0.0.128; our IP address is 192.0.0.64
Download Filename 'digicap.dav'.

 

[alastairstevenson]

There is a networking problem.
Are both devices wired to a switch or router?

Why don't you just use the normal IP addresses on your network?
No need to match what the usual tftp updater process would use.

Maybe also try a normal tftp server such as the 32 bit one from jounin.net

 

[rad one]

Ok I figured out what was

There is a networking problem.
Are both devices wired to a switch or router?

Why don't you just use the normal IP addresses on your network?
No need to match what the usual tftp updater process would use.

Maybe also try a normal tftp server such as the 32 bit one from jounin.net

I figured out what was wrong. I had the cat5 from the laptop plugged into the back of the nvr (because that what I was used to). I unplugged it and plugged it into the same switch. Not it completes the process reboot and goes back the upgrade prompt. I this because I have the wrong firmware version? I dowloaded v 3.1.0 from the US site. Which one is the newest one I can use or should I use for my DS-7608NI-E2?


U-Boot 2010.06-svn (Aug 15 2015 - 15:18:43)

Protected at offset:0,size:20000 Protection status:[0xf88]=>[0xf8b].
Hit ctrl+u to stop autoboot: 0
### CRAMFS load complete: 3179984 bytes loaded to 0x80400000
timeout for link [5000]!
## Booting kernel from Legacy Image at 80400000 ...
System version is unrollback !
ERROR: can't get kernel image!

This program will upgrade software.
***

• ATTENTION!! PLEASE READ THIS NOTICE CAREFULLY! *
• Don't reset machine,or anything that interrupt it. *
• The upgrade process must finish in 10 minutes! *
• If this program fails,machine might be unusable, *
• and you will need to reflash again. *
• If you find this too risky,power off machine now. *

***

Now press [u/U] key to upgrade software: Hit ctrl+u to stop autoboot: 0
### CRAMFS load complete: 3179984 bytes loaded to 0x80400000
timeout for link [5000]!
## Booting kernel from Legacy Image at 80400000 ...
System version is unrollback !
ERROR: can't get kernel image!

This program will upgrade software.
***

• ATTENTION!! PLEASE READ THIS NOTICE CAREFULLY! *
• Don't reset machine,or anything that interrupt it. *
• The upgrade process must finish in 10 minutes! *
• If this program fails,machine might be unusable, *
• and you will need to reflash again. *
• If you find this too risky,power off machine now. *

***

Now press [u/U] key to upgrade software:

 

[alastairstevenson]

System version is unrollback !

The rollback block disallows installation of firmware versions older than the newest that has been attempted, whether it was successful or not.
Another of Hikvision's ways to show how they respect their customers.

I dowloaded v 3.1.0 from the US site. Which one is the newest one I can use or should I use for my DS-7608NI-E2?

Do you know what version was previously loaded?
Ideally that should be the first to try.

There is a good selection here :

DOWNLOAD EU PORTAL

www.hikvisioneurope.com

 

[rad one]

Do you know what version was previously loaded?
Ideally that should be the first to try.

[/URL]

The first one meaning the oldest one? in this case "V3.0.10build141126 English & Multi-lingual（Fix RTP security issue）?" from the EU portal

 

[alastairstevenson]

The first one meaning the oldest one?

No, what I meant and maybe didn't say it clearly was that the first firmware to try reloading would be the same one that had been already loaded.
Don't just jump to trying newer versions as that makes the rollback block even worse.

 

[rad one]

No, what I meant and maybe didn't say it clearly was that the first firmware to try reloading would be the same one that had been already loaded.
Don't just jump to trying newer versions as that makes the rollback block even worse.

The file that I have just says v3. I'm pretty sure I got it from the US site last week (the site says v3.4.96, I'm pretty sure its that one). I take it I should try v3.4.96 from the EU Portal first, hoping that works or v.3.4.97 since it stops at v3.4.98? It's not possible to load an older firmware?

This all started because I needed to reset my password. When I called in to Hikvision after the corrupted firmware update, they said I should've moved from one firmware to the next one progressively and not skip. Is that true?

 

[mirki013069]

Hello,
I have one DVR DS-7216HQHI-K1/A . I want to default all the configuration but I can't do it from software, monitor or IE.

I want to upgrade it via serial.

I had tried with command "update", after reboot nothings change.


HKVS $ setenv bootcmd ';update'
timeout for link [5000]!
MAC: F8-4D-FC-EF-29-B3
TFTP from server 192.0.0.128; our IP address is 192.0.0.64
Download Filename 'digicap.dav'.
Download to address: 0x83000000
Downloading: # [ Connected ]
################################ [ 1.000 MB]
################################ [ 2.000 MB]
################################ [ 3.000 MB]
#######################T ######### [ 4.000 MB]
################################ [ 5.000 MB]
################################ [ 6.000 MB]
################################ [ 7.000 MB]
################################ [ 8.000 MB]
###################T ############# [ 9.000 MB]
################################ [10.000 MB]
################################ [11.000 MB]
################################ [12.000 MB]
################################ [13.000 MB]
################T ################ [14.000 MB]
################################ [15.000 MB]
################################ [16.000 MB]
################################ [17.000 MB]
################################ [18.000 MB]
############T #################### [19.000 MB]
################################ [20.000 MB]
################################ [21.000 MB]
################################ [22.000 MB]
################################ [23.000 MB]
########T ######################## [24.000 MB]
################################ [25.000 MB]
################################ [26.000 MB]
################################ [27.000 MB]
################################ [28.000 MB]
####T ############################ [29.000 MB]
################################ [30.000 MB]
##############
done
Bytes transferred = 31916760 (1e702d8 hex)
cramfs.img checkSum ok !
### CRAMFS load complete: 3155424 bytes loaded to 0x82000000
## Booting kernel from Legacy Image at 82000000 ...
Verifying RSA ... OK
Loading Kernel Image ... OK
OK

Starting kernel ...

[ 1.892812] init(1) called reboot syscall, cmd: 0x0.
Thu Jan 1 00:00:01 UTC 1970

mv: can't rename 'ubi*': No such file or directory
Starting udev: [ OK ]
digicap is in the memory[f3f16c@83000000], do not need download.
RSA verifying ... OK
cramfs.img checkSum ok !

***

• ATTENTION!! PLEASE READ THIS NOTICE CAREFULLY ! *
• Don't power off or anything that interrupt it ! * ,
• The upgrade process will finish in 3 minutes ! *
• If this program fails, machine might be unusable ! *

***

Erasing cfg file ... Done
Writing ...
|######--------------------------------------------| 13%[ 4.906248] hi_gmac_v200 100a0000.ethernet eth0: Link is Up - 100Mbps/Full - flow control rx/tx
|##################################################| 100%
Done
Checking ...
|##################################################| 100%
Done
Update successfully !
Press ENTER key to reboot

 

[iTuneDVR]

Use another command than update
Maybe help can help you

 

[mirki013069]

Use another command than update
Maybe help can help you

I get help menu when I type HKVS $ setenv bootcmd ';help' but I did know how to erase the flash and to load new FW bin file .

 

[iTuneDVR]

Show help