Hikvision - Clearing Passwords and/or Loading Firmware via TTL Serial

Yes sir. Directly to the RS232 port. Hadn't considered the null modem cable as I've used a USB to RS232 cable before to access devices. Thanks for pointing out where I went wrong.
 
  • Like
Reactions: alastairstevenson
Null modem cable obtained. Pressing Ctrl+U does nothing inside of Putty. I assume because of the firmware was modified by Alibi from the stock firmware of Hikvision. Looking through the help segment I can see no mention of upgrade.
 
Pressing Ctrl+U does nothing inside of Putty. I assume because of the firmware was modified by Alibi from the stock firmware of Hikvision.
I don't think that's likely, for the bootloader.
Also check out this tftp updater method of applying firmware without the need for authentication :
 
Are you seeing the bootup process now via the serial console?

Control-U needs to be pressed so it auto-repeats before the NVR is powered on.
Yes, I can see the boot process. And perhaps that's where I'm going wrong, I was pessing Control+U after powering on the unit. I will give that a try tomorrow.
 
Please someone tell me on the example of this photo how to connect?(color to color)
This cannot be done with confidence because it depends on what serial TTL signals are supplied to each wire on the USB adaptor.
The signals to wire colours arrangement can vary.

Suggestion :
Check out this image to identify the signals against the pins on the serial console connector of your Hikvision device :


Check the product info for the specific serial TTL to USB convertor that you bought to identify which signals are allocated to the wires.
Then connect the connector to the USB adaptor as follows:
GND to GND, Tx to Rx, Rx to Tx
 
Hi Guys

So I have a DS-7604NI-E1/4P - it was running v3.3.4 Build 160614. I stupidly upgraded the firmware from here:

It let me set login pattern and password etc - but now screen is blank and it won't login.

I am assuming this is the correct 'latest' firmware: NVR_K41_BL_ML_STD_V3.4.98_171121.zip - obtained from the downloads section of this forum ?

I am on a Mac Mini. I have connected the TTL Serial connector and I can interrupt the boot process. I am using CoolTerm to connect via serial port on my mac mini, I get this:

............

U-Boot 2010.06-svn (Aug 15 2015 - 15:18:43)

Protected at offset:0,size:20000 Protection status:[0xf88]=>[0xf8b].
Hit ctrl+u to stop autoboot: 1 ... 0

This program will upgrade software.
***
  • ATTENTION!! PLEASE READ THIS NOTICE CAREFULLY! *
  • Don't reset machine,or anything that interrupt it. *
  • The upgrade process must finish in 10 minutes! *
  • If this program fails,machine might be unusable, *
  • and you will need to reflash again. *
  • If you find this too risky,power off machine now. *
***

Now press [u/U] key to upgrade software: U
File system error,please upgrade by TFTP

Please input ip address of device:

Please input ip address of upgrade server:

It skips the question please input ip address of device and asks me for the server. So I enter the upgrade server ip. It then asks me for the ip address of device. It just keeps looping this. Please help!

This program will upgrade software.
***
  • ATTENTION!! PLEASE READ THIS NOTICE CAREFULLY! *
  • Don't reset machine,or anything that interrupt it. *
  • The upgrade process must finish in 10 minutes! *
  • If this program fails,machine might be unusable, *
  • and you will need to reflash again. *
  • If you find this too risky,power off machine now. *
***

Now press [u/U] key to upgrade software: U
File system error,please upgrade by TFTP

Please input ip address of device:
Please input ip address of upgrade server: 192.0.0.128
Confirm?(y/n):

Please input ip address of device: 192.0.0.64
Please input ip address of upgrade server:
Confirm?(y/n): y
timeout for link [4999]!
MAC: BC-AD-28-F4-D5-F5
*** ERROR: `serverip' not set

Please input ip address of device:

Please input ip address of upgrade server:
 
Hi Guys

So I have a DS-7604NI-E1/4P - it was running v3.3.4 Build 160614. I stupidly upgraded the firmware from here:

It let me set login pattern and password etc - but now screen is blank and it won't login.

I am assuming this is the correct 'latest' firmware: NVR_K41_BL_ML_STD_V3.4.98_171121.zip - obtained from the downloads section of this forum ?

I am on a Mac Mini. I have connected the TTL Serial connector and I can interrupt the boot process. I am using CoolTerm to connect via serial port on my mac mini, I get this:

............

U-Boot 2010.06-svn (Aug 15 2015 - 15:18:43)

Protected at offset:0,size:20000 Protection status:[0xf88]=>[0xf8b].
Hit ctrl+u to stop autoboot: 1 ... 0

This program will upgrade software.
***

    • ATTENTION!! PLEASE READ THIS NOTICE CAREFULLY! *
    • Don't reset machine,or anything that interrupt it. *
    • The upgrade process must finish in 10 minutes! *
    • If this program fails,machine might be unusable, *
    • and you will need to reflash again. *
    • If you find this too risky,power off machine now. *
***

Now press [u/U] key to upgrade software: U
File system error,please upgrade by TFTP

Please input ip address of device:

Please input ip address of upgrade server:

It skips the question please input ip address of device and asks me for the server. So I enter the upgrade server ip. It then asks me for the ip address of device. It just keeps looping this. Please help!

This program will upgrade software.
***

    • ATTENTION!! PLEASE READ THIS NOTICE CAREFULLY! *
    • Don't reset machine,or anything that interrupt it. *
    • The upgrade process must finish in 10 minutes! *
    • If this program fails,machine might be unusable, *
    • and you will need to reflash again. *
    • If you find this too risky,power off machine now. *
***

Now press [u/U] key to upgrade software: U
File system error,please upgrade by TFTP

Please input ip address of device:
Please input ip address of upgrade server: 192.0.0.128
Confirm?(y/n):

Please input ip address of device: 192.0.0.64
Please input ip address of upgrade server:
Confirm?(y/n): y
timeout for link [4999]!
MAC: BC-AD-28-F4-D5-F5
*** ERROR: `serverip' not set

Please input ip address of device:

Please input ip address of upgrade server:

I managed to get this resolved. I think some issue with CoolTerm. Used macos default screen app and it worked. Now 3 out of the 4 cameras are not connecting. I am guessing the camera's got the password screwed when I did the "borked" firmware update?
 
Hello from Romania ,
I forgot password of a dvr ds-7108HGHI-F1/N ... the support of hikvision provided me 2 keys and 2 files xml for password reset . The problem is after input key or xml , put the new password everything is ok beth after restart the new password not work . 4 times each issue
 
I try to update firmware with ttl , this is the log with U command



Now press [u/U] key to upgrade software: U
File system error,please upgrade by TFTP

Please input ip address of device: 192.0.0.64
Please input ip address of upgrade server: 192.0.0.128
Confirm?(y/n): y
timeout for link [5000]!
MAC: 44-47-CC-CA-A8-2F
TFTP from server 192.0.0.128; our IP address is 192.0.0.64
Download Filename 'digicap.dav'.
Download to address: 0x83000000
Downloading: #################################################
done
Bytes transferred = 402 (192 hex)
file header error, filenums:1529494443
The board info: language - 0x1 device_class - 0x44 oemCode - 0x1
upgrade packet mismatch, please select correct packet
Can not find correct packet for upgrade, give up!!!

Please input ip address of device:



And this is the log with B and U commands
 
Now press [u/U] key to upgrade software: b
HKVS # u
timeout for link [5000]!
MAC: 44-47-CC-CA-A8-2F
TFTP from server 192.0.0.128; our IP address is 192.0.0.64
Download Filename 'digicap.dav'.
Download to address: 0x83000000
Downloading: # [ Connected ]
################################ [ 1.000 MB]
################################ [ 2.000 MB]
################################ [ 3.000 MB]
################################ [ 4.000 MB]
################################ [ 5.000 MB]
################################ [ 6.000 MB]
################################ [ 7.000 MB]
################################ [ 8.000 MB]
################################ [ 9.000 MB]
################################ [10.000 MB]
################################ [11.000 MB]
################################ [12.000 MB]
################################ [13.000 MB]
################################ [14.000 MB]
#######
done
Bytes transferred = 14926336 (e3c200 hex)
cramfs.img checkSum ok !
Erasing SPI flash...start
Erasing at 0xec0000 -- 100% complete.
Erasing SPI flash...done
Writing SPI flash...start
Writing at 0xebc194 -- 100% complete.
Writing SPI flash...done
Upgrade check ......done
Erasing devcfg...done
HKVS #
 
This is the log of boot




▒@▒▒▒


U-Boot 2010.06-svn23323 (Jul 19 2018 - 09:54:00)[V1.4.5]

*** Warning - bad CRC, using default environment

Hit ctrl+u to stop autoboot: 0
### CRAMFS load complete: 3122232 bytes loaded to 0x82000000
## Booting kernel from Legacy Image at 82000000 ...
Loading Kernel Image ... OK
OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
Wed Dec 22 19:26:01 UTC 2021
Starting udev: [ OK ]
sdbg: serverip:192.0.0.128
fastboot is
language is 1
devtype is a807
/
----------<1> tar guir webs ----------
BusyBox v1.2.1 Protect Shell (psh)
Enter 'help' for a list of davinci system commands.

# ----------<2> show logo ----------
chmod: /dev/ttyS3: No such file or directory
read: pDevCfg->cfgHead.paraVersionis [0x170816];
read: iCkSum is [0x82d]; pDevCfg->cfgHead.paraChecksum is [0x82d]
scriptCmd: ./load3520dv300 -i 0.
a is a807
DS_7208HGH_F1_20D_v300_4Mux
mmz allot OK DS_7208HGH_F1_20D_v300_4Mux
* Board tools : ver0.0.1_20121120 *
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm
0x120f0000: 0x00000001 --> 0x00000001
[END]
* Board tools : ver0.0.1_20121120 *
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm
0x120f0048: 0x00000001 --> 0x00000001
[END]
* Board tools : ver0.0.1_20121120 *
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm
0x120400b4: 0x00000035 --> 0x00000035
[END]
check adNum tp2802:0,tp2806:0,tp2822:0,tp2823:0,tp2824:0,tp2833C:2,tw2964:0 tw2968:0 nvp6114a:0 nvp6124b:0
cmdBuf:insmod extdrv/tp2823.ko gpioType=0
[ 16.871974]
[ 16.871974] [HIKI2C_STATIS]WARNING:i2c-0 operation too often(real:576 max:576)!!!
insert audio
load K56 ok
/
----------<4> del no use res ----------
iSCSI daemon with pid=1069 started!start savelog proc!!!!!
pdev_hard_info->ataCtrlNums=1
file:src/pal_api.c,line:426, pal_module_init successfully
[CRIT]read_execl_guide_cfg()1151:start
[INFO]get_flash_cards_info()408:ignore [msmouse].

[CRIT]get_flash_cards_info()449:can not find any usb device!
[CRIT]read_execl_guide_cfg()1161:get flash cards info failed. iRet[-1]
read execl guide cfg failed. iRet[-1]file:src/pal_api.c,line:389, pal_module_init has been called
t1: wait storage [2] and gui[2] and hicore[2] and ipcm[0] and toolserver[0]
hisi_bsp_info_close[1]
:0
remove error
fun:hisi_watchdog_init, line:3673 hisi_watchdog_init(/dev/watchdog, 27) ok iDogTimeOut:25 Sec!
/********************init_global_error_lib/, init_global_error_lib start!
:0
init_lzma_mem alloc size 1048576
[DHCP] default pIpAddr: 192.168.1.64, pNetMask: 255.255.255.0
INFO : sys_manage_filefd_init() :5066:sys_manage_filefd_init OK!

fun:hisi_dsp_init, line:2208 --------------init dsp --------------------
fun:hisi_main_dsp_init, line:1506 Device Main Vo Chan is 2[0]
menuDispChan = 0
g_pDspInitPara->exNetPoolMain.vAddr =0xb2fa4008
g_pDspInitPara->exNetPoolMain.totalLen =0x80000
g_pDspInitPara->exRecPool[0].strAddr[0].vAddr =0xb2ee2000
g_pDspInitPara->exRecPool[0].strAddr[0].totalLen =0xc0000
* [HI3531] DSP Build Time: [Aug 28 2018 16:33:27] * sizeof(DSPINITPARA) 3106488 viType=61 aiType=14,support720:0 bDvs 0
--bSupportZeroEncode=0 maxD1EncChns=4 NetOsdType=2 dspIdx=0 boardType=27 boardTypeEx=0 machineType=0xa807 dispMode=5 menuDispChan 0 bSupportHalf:1 decMode:1 bNvpAutoDetect:0 --
--encChanCnt=8 decChanCnt=8 dispChanCnt=3,IpcChanCnt = 0, dspIdx=0,shipin7AesCnt 1-packetType 0x5,subPacketType 0x4 rtpPackLen:1376--voStandard:2
Func:checkAd line 351 check adNum tp2802:0,tp2806:0,tp2822:0,tp2823:0,tp2824:0,tp2833C:2
Func:checkAd line 353 check adNum tw2964:0,tw2968:0,nvp6114a:0,nvp6124b:0,nvp6134:0,nvp6134b:0
TVI Share Param bCompatibility:0
TVI Share Param bHGH:0
--reserved:[0] = 0,[1] = 0,[2] = 0,[3] = 0,[4] = 0,[5] = 0,[6] = 0,[7] = 0,[8] = 0,[9] = 0,[10] = 0,[11] = 0,[12] = 0,[13] = 0,[14] = 0,[15] = 0,[16] = 0,[17] = 0,[18] = 0,
--bdvs=0 audioChanCnt 1 audioAdType 27--
--pDspInitPara->tviShareParam.bG711A=0 --
--audio encode & decode type is G711_U --
--talkBackType=0 , old talktype 0x7110, device_info=0--
bHaveCvbsVo = 0
dispchan0:1 viChnCas:1 voDevCas:7 dispchan_1:0 viChnCas2 voDevCas:8
HI_MPI_SYS_GetCustomCode...done
HISI_CHIP_SECRET success
!!!!!!DSP Idx:0
StopVoOutput HD
-------tpBuild:6---g_pDspInitPara->tviShareParam.AdVerSions:9------
NoAnalogChanCntStat, line 228, closeChanCnt 0
--------vcaChanNum 0----ViCloseChanCnt:0------
func:InitSys, line:593, vcaChanNum 0
armNeedBufLen = 0 bEnableCache=0
Src packetType=0x5 subPacketType=0x4 RecStoreType=0x1 NetStoreType=0x4 SubRecStoreType=0x0 SubNetStoreType=0x4
----------HI_MPI_SYS_MmzAlloc ok!!!!!!!!!!
##shipin 7 plug initing...##
InitAudio aiType = 14 bExtendAi=0 analogAiMask =0 extendAiMask=0
chan=0 aiDev=1 aiChan=0 bHaveAnalogAudio = 1 bHaveExAudio=0
chan=1 aiDev=1 aiChan=1 bHaveAnalogAudio = 1 bHaveExAudio=0
chan=2 aiDev=1 aiChan=2 bHaveAnalogAudio = 1 bHaveExAudio=0
chan=3 aiDev=1 aiChan=3 bHaveAnalogAudio = 1 bHaveExAudio=0
chan=4 aiDev=1 aiChan=4 bHaveAnalogAudio = 1 bHaveExAudio=0
chan=5 aiDev=1 aiChan=5 bHaveAnalogAudio = 1 bHaveExAudio=0
chan=6 aiDev=1 aiChan=6 bHaveAnalogAudio = 1 bHaveExAudio=0
chan=7 aiDev=1 aiChan=7 bHaveAnalogAudio = 1 bHaveExAudio=0
config ai sample rate 1
aoChan=0 aoDev=0 aoTrack=0 aoTrackCnt=1 aoTrack=0
aoChan=1 aoDev=0 aoTrack=0 aoTrackCnt=1 aoTrack=1
aoChan=2 aoDev=1 aoTrack=0 aoTrackCnt=2 aoTrack=0
aoChan=2 aoDev=1 aoTrack=1 aoTrackCnt=2 aoTrack=1
talkBack aiChan = 0
[0]g722 resample alloc buf size:4032 0x2d0c8c8 inputsize:1280 outputsize:660
[1]g722 resample alloc buf size:4032 0x2d0e980 inputsize:1280 outputsize:660
[2]g722 resample alloc buf size:4032 0x2d10a38 inputsize:1280 outputsize:660
-----------Init g726 dec audio,mem size 0xf8 reserved frm len 0
[0]G722 in_frame_size 1280
[1]G722 in_frame_size 1280
[2]G722 in_frame_size 1280
[3]G722 in_frame_size 1280
[4]G722 in_frame_size 1280
[5]G722 in_frame_size 1280
[6]G722 in_frame_size 1280
[7]G722 in_frame_size 1280
InitAudio ok!!!
[InitVi] viType 61, encChanCnt = 8
InitViChnAbility chan:0 AppAbility:0
InitViChnAbility chan:1 AppAbility:0
InitViChnAbility chan:2 AppAbility:0
InitViChnAbility chan:3 AppAbility:0
InitViChnAbility chan:4 AppAbility:0
InitViChnAbility chan:5 AppAbility:0
InitViChnAbility chan:6 AppAbility:0
InitViChnAbility chan:7 AppAbility:0
chan = 0 videv = 0,vichn = 0
chan:0 IsViClosed:0
chan = 1 videv = 0,vichn = 1
chan:1 IsViClosed:0
chan = 2 videv = 0,vichn = 2
chan:2 IsViClosed:0
chan = 3 videv = 0,vichn = 3
chan:3 IsViClosed:0
chan = 4 videv = 1,vichn = 4
chan:4 IsViClosed:0
chan = 5 videv = 1,vichn = 5
chan:5 IsViClosed:0
chan = 6 videv = 1,vichn = 6
chan:6 IsViClosed:0
chan = 7 videv = 1,vichn = 7
chan:7 IsViClosed:0
voStandard = 2, boardtype = 27
[InitViTp2802] init Tp2802 ok,portStaticMode:1 bWD1Double:2
initial 720P_F_N_AD OK !
vpssParam.u32MaxW:960 vpssParam.u32MaxH:1080
1-----------initvpss grp:0
=== s32ChnId 0 chan 0
1-----------initvpss grp:1
=== s32ChnId 0 chan 1
1-----------initvpss grp:2
=== s32ChnId 0 chan 2
1-----------initvpss grp:3
=== s32ChnId 0 chan 3
1-----------initvpss grp:4
=== s32ChnId 0 chan 4
1-----------initvpss grp:5
=== s32ChnId 0 chan 5
1-----------initvpss grp:6
=== s32ChnId 0 chan 6
1-----------initvpss grp:7
=== s32ChnId 0 chan 7
3-----------initvpss grp:8 Vpss Max W H 1920 1088
4-----------initvpss grp:80
[InitVi] init video input device and channel ok
[InitDecoder] start init decoder decChanCnt = 8
Alloc Mem For Reserver PlayBack BlkSize=204800
initPlayBackEnc
initPlayBackEnc OK! chan=65 VeChn=65
--<initPlayBack>SrcDecChn=0 SrcEncChn=65 DstDecChn=9 bDstDecChnMuxed=0--
[InitDecoder] OK
[InitIpcDecoder] start init decoder shipin7AesCnt = 1, ipcChanCnt = 0, sp7ChanCnt = 10
FUNC GetNetPoolAttr line 1054 chanMode=5 err
[InitIPC] OK
17----InitDecVpssModule-----initvpss grp:9
17----InitDecVpssModule-----initvpss grp:10
17----InitDecVpssModule-----initvpss grp:11
17----InitDecVpssModule-----initvpss grp:12
17----InitDecVpssModule-----initvpss grp:13
17----InitDecVpssModule-----initvpss grp:14
17----InitDecVpssModule-----initvpss grp:15
17----InitDecVpssModule-----initvpss grp:16
InitDecVpssModule complete!
* Func: InitAes, phCipher = 0x640001 ok*
init ENC_OSD u32Size=4599808
init disp_OSD u32Size=737280
InitLogoMem u32Size=2097152
--i:0 virtRgbAddr:ab824000 menuBufSize 4608000
--InitJpgSnap Que Venc For VI_ENC_JPG:0
InitJpgSnap Que Venc For DEC_ENC_JPG:1
12---------initvpss grp:17
12---------initvpss grp:18
13---------initvpss grp:81
<InitJpgSnap> heatPool PoolID=12 size=622080
* Fun: InitEncode, start *
9---------initvpss grp:19
chan: 0 bindVpssForMinorVi: 19
chan: 0 bStaticMode: 0
9---------initvpss grp:20
chan: 1 bindVpssForMinorVi: 20
chan: 1 bStaticMode: 0
9---------initvpss grp:21
chan: 2 bindVpssForMinorVi: 21
chan: 2 bStaticMode: 0
9---------initvpss grp:22
chan: 3 bindVpssForMinorVi: 22
chan: 3 bStaticMode: 0
9---------initvpss grp:23
chan: 4 bindVpssForMinorVi: 23
chan: 4 bStaticMode: 0
9---------initvpss grp:24
chan: 5 bindVpssForMinorVi: 24
chan: 5 bStaticMode: 0
9---------initvpss grp:25
chan: 6 bindVpssForMinorVi: 25
chan: 6 bStaticMode: 0
9---------initvpss grp:26
chan: 7 bindVpssForMinorVi: 26
chan: 7 bStaticMode: 0
Func: InitEncode, end
Func: InitVo, viType:61,dispMode:5 start
InitVo voDev = 0, 1
### 1 ###
###InitVoDev 0
[InitVoDev] voDev 0, bHD 1, vgaType 130
Func: GetVoCfg_HD, voDev 0,type 130 u32Width 1280, u32Height 1024 intfType=0x24
voDev 0, voLayer 0, enPartMode 1
StartVoVideoLayer, VOLayer 0
Func: GetVoCfg_HD, voDev 0,type 130 u32Width 1280, u32Height 1024 intfType=0x24
-----------start hdmi ----------------------------------
Func SetLayerBind, Layer 0, return
StartPipLayer menuDispChan 0
stImageSize u32Width=320 u32Height=256
Func: InitVo, start OK
[RECODE_init]start...
init encoder 10
Func:RECODE_init, init vpss 27
[RECODE_init]ok...
[RECODE_init]start...
init encoder 11
Func:RECODE_init, init vpss 28
[RECODE_init]ok...
[RECODE_init]start...
init encoder 12
Func:RECODE_init, init vpss 29
[RECODE_init]ok...
[RECODE_init]start...
init encoder 13
Func:RECODE_init, init vpss 30
[RECODE_init]ok...
[### InitIAD ok! ###]
smd g_pDspInitPara->tviShareParam.SmdNum is 0, SCD g_pDspInitPara->tviShareParam.IntelligentNum = 0
<DSP>vca DspVcaInitOsd OK!
<DSP>vca Init vca success
<DSP>vca DspVcaInitMetaDataPack: ok
<DSP>vca DspVcaScdInit chanNum = 0
<DSP>vca DspVcaScdInit OK!
[dsp_smartH264Init]done...ret 0
pid:1075 tid:1172 name:TskPTZFrqSyn
stopHDMI!
Func: GetVoCfg_HD, voDev 0,type 130 u32Width 1280, u32Height 1024 intfType=0x24
pid:1075 tid:1135 name:TskProcessAudio

pid:1075 tid:1161 name:dspOsdRefresh
pid:1075 tid:1139 name:OutputVideoPro0

pid:1075 tid:1141 name:OutputVideoPro1

pid:1075 tid:1143 name:OutputVideoPro2

pid:1075 tid:1145 name:OutputVideoPro3

pid:1075 tid:1147 name:OutputVideoPro4

pid:1075 tid:1149 name:OutputVideoPro5

pid:1075 tid:1151 name:OutputVideoPro6

pid:1075 tid:1153 name:OutputVideoPro7

pid:1075 tid:1167 name:dspAllChnStream

<tsk_SendFrmToPBEnc> PoolID=31 bufnum=2
pid:1075 tid:1155 name:SendFrmToPBEnc
pid:1075 tid:1156 name:ReverseEncFrame
pid:1075 tid:1157 name:PlayGroup
pid:1075 tid:1158 name:SendDecToVpss
pid:1075 tid:1162 name:dspOsdColor
pid:1075 tid:1159 name:dspDownIPCStream10

pid:1075 tid:1163 name:dspMd
pid:1075 tid:1168 name:dspPeriod
pid:1075 tid:1138 name:dspDownStream0

pid:1075 tid:1140 name:dspDownStream1

pid:1075 tid:1142 name:dspDownStream2

pid:1075 tid:1144 name:dspDownStream3

pid:1075 tid:1146 name:dspDownStream4

pid:1075 tid:1148 name:dspDownStream5

pid:1075 tid:1150 name:dspDownStream6

pid:1075 tid:1152 name:dspDownStream7

pid:1075 tid:1154 name:DspGetDecPic

<TskGetDecPic> PoolID=32 size=622080
pid:1075 tid:1160 name:ZeroDecStream

pid:1075 tid:1169 name:tskGetVcaAiData
pid:1075 tid:1170 name:tskProcessVcaAiData
pid:1075 tid:1164 name:dspCd
pid:1075 tid:1165 name:TskProcEncJpeg
pid:1075 tid:1136 name:vidDetectmix
<videoFormatProcess> chan 0, TVI video frm 0 can't find in table. adType:0
<videoFormatProcess> chan 1, TVI video frm 0 can't find in table. adType:0
<videoFormatProcess> chan 2, TVI video frm 0 can't find in table. adType:0
<videoFormatProcess> chan 3, TVI video frm 0 can't find in table. adType:0
<videoFormatProcess> chan 4, TVI video frm 0 can't find in table. adType:0
<videoFormatProcess> chan 5, TVI video frm 0 can't find in table. adType:0
<videoFormatProcess> chan 6, TVI video frm 0 can't find in table. adType:0
<videoFormatProcess> chan 7, TVI video frm 0 can't find in table. adType:0
pid:1075 tid:1137 name:tskTp2802GetPtzData
stopHDMI ok!
Func: GetVoCfg_HD, voDev 0,type 130 u32Width 1280, u32Height 1024 intfType=0x24
voDev 0, voLayer 0, enPartMode 1
StartVoVideoLayer, VOLayer 0
stImageSize u32Width=320 u32Height=256
Func: GetVoCfg_HD, voDev 0,type 130 u32Width 1280, u32Height 1024 intfType=0x24
-----------start hdmi ----------------------------------
* InitDsp OK*****
func HostDecSetAbility set dec ability 55296000
hisi_main_dsp_init:DSPINITPARA=3106488
************g_pDspInitPara[0xb4a4d008], menuShareBuf 0[0xb4abcffc, pAddr=0x95f8b000, vAddr=0xab824000, w:1920,h1200,p:1920] 1[0xb4abd010, pAddr=0x0, vAddr=0x0, w:0,h0,p:0],
main : HIKIO_FREE_LOGO_BUFF failed errno = 38.
hisi_freelogo_buffer is succsse 0
fun:hisi_dsp_init, line:2229 ------ dsp is init Ok iRetVal:0---------
!!!!!!!!!!!!!!!!!!!!!!!!!DSP Init Ok!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
[Func]:HI_MPI_HDMI_GenEvent [Line]:113 [Info]:HDMI EVENT TYPE:0x11
orgHdmiVoChanIdx 0
NO_HI_HDMI_EVENT_HOTPLUG!!!
fun:hisi_fill_8_screen_param, line:1711 window dispInfo[w:1280, h:1024], step(320, 256), last(320, 256)
fun:hisi_fill_8_screen_param, line:1711 window dispInfo[w:704, h:576], step(176, 144), last(176, 144)
[HostAllocDispRegion ] bHaveCvbsVo = 0 ,not support
[SetEncDspDisp] bHaveCvbsVo = 0,chan=0 dispChan=2 not support
[SetEncDspDisp] bHaveCvbsVo = 0,chan=1 dispChan=2 not support
[SetEncDspDisp] bHaveCvbsVo = 0,chan=2 dispChan=2 not support
[SetEncDspDisp] bHaveCvbsVo = 0,chan=3 dispChan=2 not support
[SetEncDspDisp] bHaveCvbsVo = 0,chan=4 dispChan=2 not support
[SetEncDspDisp] bHaveCvbsVo = 0,chan=5 dispChan=2 not support
[SetEncDspDisp] bHaveCvbsVo = 0,chan=6 dispChan=2 not support
[SetEncDspDisp] bHaveCvbsVo = 0,chan=7 dispChan=2 not support
wait storage [2] and gui[2]
------------> pthreadSpawn handle_pppoe_cfg_cmd
===================handle_pppoe_cfg_cmd=====================
=============pppoe============FOREVER=====================================
:0
err! setW:960 setH:1080 imgW:1280 imgH:720
err! setW:960 setH:1080 imgW:1280 imgH:720
:0
=============pppoe============FOREVER=====================================
==============proc_cmd_data start iSock [253]
==============>>>>iCmd:0x100,rlen:4
>>>>username:,passwd:,enable:0,ifname:eth0
remove pppoed!
==================enablePPPoE failed!!!
t1: wait storage [0] and gui[2] and hicore[0] and ipcm[0] and toolserver[0]
wait storage [0] and gui[2]
t1: wait storage [0] and gui[2] and hicore[0] and ipcm[0] and toolserver[0]
standard: u32Luma = 50, u32Contrast = 50, u32Saturation = 50, u32Hue = 50, u32Gain = 20
HostSetAudioVolume chan:2,open:1,level:3,volume:50
HostSetAudioVolume chan:0,open:1,level:3,volume:50
maxIPCcount[8] maxAnalogCount[8]
err! setW:960 setH:1080 imgW:1280 imgH:720
err! setW:960 setH:1080 imgW:1280 imgH:720
err! setW:960 setH:1080 imgW:1280 imgH:720
err! setW:960 setH:1080 imgW:1280 imgH:720
err! setW:960 setH:1080 imgW:1280 imgH:720
err! setW:960 setH:1080 imgW:1280 imgH:720
err! setW:960 setH:1080 imgW:1280 imgH:720
### key info: [ipcm_svc_init]ipcm svc inited. ###
big_bit_mask p[0xa8de5800], idx[-1] error!func[big_bit_mask],line[63]
err! setW:960 setH:1080 imgW:1280 imgH:720
err! setW:960 setH:1080 imgW:1280 imgH:720
err! setW:960 setH:1080 imgW:1280 imgH:720
err! setW:960 setH:1080 imgW:1280 imgH:720
err! setW:960 setH:1080 imgW:1280 imgH:720
err! setW:960 setH:1080 imgW:1280 imgH:720
SendSnmpTrapMsg(eSnmpTrapType trapType)
@@@@do not need poc test@@@@
!!!!!!!!!!!!!!!sc_hicore is start ok!!!!!!!!!!!!!!!!
vqd_init: HIKVQD_GetMemSize succeed, i = 0 size = 512 space = 3
vqd_init: HIKVQD_GetMemSize succeed, i = 1 size = 1183744 space = 3
VQD VER: 1.0.8 DATE: 2016.12.13
10---------initvpss grp:90
HostInitVQD!!!OK!!m_i_vqdInitProcW==704,m_i_vqdInitProcH==576,m_i_vqdInitAbility==7,m_i_vqdInitValidNum==8 m_b_vqdUseSrcVi=0!!!
HostStartPollingVQD: ---OK!!!g_i_vqdEnable==1!!!g_i_vqdHostInterval=180
[12-22 19:26:33][3][1261]RemoteSession::~RemoteSession()
[12-22 19:26:33][3][1261]RemoteSession::Free
[12-22 19:26:33][3][1261]RemoteSession::~RemoteSession()
[12-22 19:26:33][3][1261]RemoteSession::Free
[12-22 19:26:33][3][1261]RemoteSession::~RemoteSession()
[12-22 19:26:33][3][1261]RemoteSession::Free
[12-22 19:26:33][3][1261]RemoteSession::~RemoteSession()
[12-22 19:26:33][3][1261]RemoteSession::Free
[12-22 19:26:33][1][1261]p2pLinkManage Destruct Ok
[12-22 19:26:33][3][1261]RemoteSession::~RemoteSession()
[12-22 19:26:33][3][1261]RemoteSession::Free
[12-22 19:26:33][3][1261]RemoteSession::~RemoteSession()
[12-22 19:26:33][3][1261]RemoteSession::Free
[12-22 19:26:33][3][1261]RemoteSession::~RemoteSession()
[12-22 19:26:33][3][1261]RemoteSession::Free
[12-22 19:26:33][3][1261]RemoteSession::~RemoteSession()
[12-22 19:26:33][3][1261]RemoteSession::Free
StartSnmpAgent(void)
[12-22 19:26:33][2][1284]check remote session thread begin
pid:1075 tid:1283 name:tskVqdProcess
read_rs485: recv data 0

Device Is Ready
$$$$$$$$$$$$$ iAoChans[4] $$$$$$$$$$$$$
g_aoChan[0]=[2]
func HostDecSetAbility set dec ability 207360000
flash mtdblock0 maybe unormal
write tar cfg to first 64k fail
flash mtdblock0 maybe unormal
write tar cfg to second 64k fail
flash mtdblock0 maybe unormal
write tar cfg to third 64k fail

# # help
Support Commands:
GetAnrCfgInfo GetAnrProcess GetAnrRecordList
ShowIpcAbility accessDvrSwitch channelPlayback
clearDisksMode ctrlArchDebug decStat
disableHB disableHik264 dspStatus
dvrLogInfo dt enableHB
enableHik264 enableWatchdog errputClose
errputOpen get3GMode getCMS
getCycleReboot getDbgCtrl getHardInfo
getIp getLastErrorInfo getPlayTestCtrl
getPort getServerInfo guiChkCfg
guiEnterMenuCount guiPrtScr guiStatus
helpm helpu i2cRead
megaDspConfig miscCmd netstat
outputClose outputOpen partRecDetails
ping printPart pthreadInfo
recorderChanInfo recorderFileInfo recorderFileKeyFrame
recorderHDIdle recorderMediaInfo recorderPAllocFile
recorderParam recorderSegExtraInfo recorderStatus
sendATCom set3GPrint set3GEnable
searchInfo setGateway setIp
setlang setMtu setoutputmode
setPrint show8107coreUseInfo showCurPlayChanFileInfo
showDeviceTemp showIpcMemInfo showNetIpcmInfo
showNetLinksInfo showPlayChanStatus showPlayClipFile
showPlayScreenInfo showPlayStatus showPlayTime
showPreviewInfo showShareSvcInfo showSpareWorkStatus
showTagSysInfo showUserInfo showpu
t1 t2 transcodeResStatus
getDateInfo dmesg help

#
 
Upgrade check ......done
Erasing devcfg...done
With that configuration file erase I'd expect the device to be reset to factory defaults, so that the status is Inactive, or the admin password is back to defaults (depending on the firmware version).

However - from your console log :
unc HostDecSetAbility set dec ability 207360000
flash mtdblock0 maybe unormal
write tar cfg to first 64k fail
flash mtdblock0 maybe unormal
write tar cfg to second 64k fail
flash mtdblock0 maybe unormal
write tar cfg to third 64k fail
It seems that there is a problem with writing the configuration to flash.
But quite strange that it's failing not just on the primary flash segment, but also on the backup segments also.
It may indicate a flash memory failure, but I don't know for sure.

Without knowing if the commands are available or what they do, at the psh prompt, try :
guiChkCfg
and
megaDspConfig
 
With that configuration file erase I'd expect the device to be reset to factory defaults, so that the status is Inactive, or the admin password is back to defaults (depending on the firmware version).

However - from your console log :

It seems that there is a problem with writing the configuration to flash.
But quite strange that it's failing not just on the primary flash segment, but also on the backup segments also.
It may indicate a flash memory failure, but I don't know for sure.

Without knowing if the commands are available or what they do, at the psh prompt, try :
guiChkCfg
and
megaDspConfig



# guiChkCfg
# megaDspConfig
cmd_exec: exec megaDspConfig error.
#