Hikvision - Clearing Passwords and/or Loading Firmware via TTL Serial

[hecan]

Hello friends, I have the following problem.
PART 1:
I have a Hikvision device model DS-9016HFI-RT to which the Firmware was updated from version V3.1.3141202 to version V3.3.1150423, after that the device reaches the main screen and to access the menu it only allows entering the password but the user is blank and therefore pse can not enter the menu. I tried to reset by SADP but it didn't work, then I tried to do it by Hikvision UPTOOL tool but it didn't work either. Later I dug deeper and bought a USB to Serial TTL adapter, I managed to get in through putty v0.76 and I was able to see the whole boot sequence, I managed to break it and access the command menu (which is quite limited compared to what I have seen). seen in this Post) and also managed to see the stored variables. I show them here below

Environment Variables

Marvell>> printenv
baudrate=115200
loads_echo=1
ipaddr=192.168.189.168
serverip=192.168.189.1
stdin=serial
stdout=serial
stderr=serial
cpuName=926
CASset=min
MALLOC_len=192

Environment size: 154/1020 bytes

COMMAND MENU

Marvell>> ?
? - alias for 'help'
echo - echo args to console
help - print online help
loki_boot - boot loki firmware.
printenv- print environment variables
roc multi-func cmd for roc.
saveenv - save environment variables to persistent storage
setenv - set environment variables
version - print monitor version

Marvell>> help roc
roc roc.ir reg_addr [write_data] [mask]
roc.dmem addr [write_data] [mask]
roc.dmp addr count width
roc.mtst [-all|addr len|-mask|-nommu|-bench]
roc.mvf -e bios|hba|hbainfo|pdpage|fw|suicide|cpucfg
roc.cpu -goto addr|-reset|-cfg p h d p t o
roc.al -clean|-add 0x30ABC=0x123456 0x20000=0x20000....|-pos [addr]

Attached the complete system

PART 2:

After experimenting with the commands (since I don't know anything about the area) trying to load the Firmware to recover the equipment, which by the way, I am doing with Tftpd64, without knowing I deleted the Firmware that was loaded, I deduce it because that is what it says at the end of the process. The interface no longer reaches the main screen, it just stays at the Hikvision boot logo. In the bootloader I can still access the menu and environment variables and they are still the same. Attached the complete system after erasing the firmware.

Hope to get some help here, thanks in advance.

 

[NZ_Jonny]

Greetings all

I have a problem that nobody seems to have documented anywhere. I can connect and send update via serial terminal initiation as described in original post but after file is uploaded it won't update and gives the error "update file error,file num is not 1 !!"

If I had to guess maybe there's an update counter that due to a failed update it hasn't reset so it thinks there's an unprocessed update to finish..i.e. the file I just uploaded is now say number 2 and it won't update from it until the previous update is installed and file deleted?

Hoping someone can shed some light on this. The unit does boot but cannot log in as username has been removed after the failed update via normal method, drop down box is blank.

Thanks in advance!
Jonathan

 

[Malugo]

hi all guys
i have a problem with this ds-kh6320-wte1 indoor station, i was trying to change the password by uploading a new firmware, but without success, can anyone help me?

 

[zainafzal]

timeout for link [5000]!
MAC: 98-DF-82-A8-0D-15
Up/Down PHY not link.
I'm facing this issue how can i solve it?

 

[RabidGorilla]

hi all guys
i have a problem with this ds-kh6320-wte1 indoor station, i was trying to change the password by uploading a new firmware, but without success, can anyone help me?

Same problem here. Were you able to solve it? I don't want to dive too deep if someone else has a solution.

 

[Alex Alex]

Hello all,
I hope you can help with a password reset on a Hikvision NVR. It was a backup device which wasn't used the past two years and now the password is lost.

Device Type

Status

IPv4 Address

Port

Software Version

Device Serial Number

IPv4 Gateway

HTTP Port

Subnet Mask

MAC Address

Encoding Channel(s)

DSP Version

Start Time

IPv6 Address

DS-7732NI-SP

Active

192.168.10.123

8000

V3.4.5build 190715

DS-7732NI-SP1620150701BBRR527681441WCVU

192.168.10.1

80

255.255.255.0

c4-2f-90-8b-e5-97

0

V1.0, build 170418

2020-09-03 10:31:35

fe80::c62f:90ff:fe8b:e597

I've updated the firmware via serial/u-boot and tftp server.
The problem I have is that the NVR kept its config and it is still listed as Active.
What shall I do to reset its configuration and make it inactive again?

Thank you!

Here is a log of the update process togheter with the complete boot afterwards:

Erasing at 0x7fe0000 -- 100% complete.
OK

start to write files to partition 0...
14-1.  write /nand/uImage len: 2622456
14-2.  write /nand/rootfs.img len: 1426816
14-3.  write /nand/initrun.sh len: 912
14-4.  write /nand/guirc.tar.gz len: 15638312
14-5.  write /nand/webs.tar.gz len: 3881824
14-6.  write /nand/disknoLink.bmp len: 6968
14-7.  write /nand/diskOK.bmp len: 6968
14-8.  write /nand/logo.bmp len: 2359352
14-9.  write /nand/logo_nvr.bmp len: 2359352
14-10.  write /nand/vps_logo.bin len: 92208
14-11.  write /nand/mux_top.bit len: 801576
14-12.  write /nand/ds_80101.bit len: 2879536
14-13.  write /nand/new_10.bin len: 1064
14-14.  write flag file /nand/version.bin len: 4
update partition 0 success!
umount /nand/ success!

start to write files to partition 1...
14-1.  write /nand/uImage len: 2622456
14-2.  write /nand/rootfs.img len: 1426816
14-3.  write /nand/initrun.sh len: 912
14-4.  write /nand/guirc.tar.gz len: 15638312
14-5.  write /nand/webs.tar.gz len: 3881824
14-6.  write /nand/disknoLink.bmp len: 6968
14-7.  write /nand/diskOK.bmp len: 6968
14-8.  write /nand/logo.bmp len: 2359352
14-9.  write /nand/logo_nvr.bmp len: 2359352
14-10.  write /nand/vps_logo.bin len: 92208
14-11.  write /nand/mux_top.bit len: 801576
14-12.  write /nand/ds_80101.bit len: 2879536
14-13.  write /nand/new_10.bin len: 1064
14-14.  write flag file /nand/version.bin len: 4
update partition 1 success!
umount /nand/ success!

Upgrade success!
Press ENTER key to reboot
 help
resetting ...


U-Boot 2010.03 (2012-11-30 - 01:11:11)

umount /nand/ success!

Hit ctrl+u to stop autoboot:  1  0
OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
  Linux version 2.6.34 (zhuangzeliang@Cpl-Backend-BSP) (gcc version 4.4.6 (crosstool-NG 1.13.2) ) #8 Wed Mar 15 14:53:09 CST 2017
CPU: ARMv7 Processor [413fc082] revision 2 (ARMv7), cr=10c53c7f
CPU: VIPT nonaliasing data cache, VIPT nonaliasing instruction cache
Machine: ti8168evm
arm_add_memory bank:0 addr:0x80000000 size:512 M
arm_add_memory bank:1 addr:0xC0000000 size:512 M
uImage bitflip info: bitflip_1: 0 bitflip_2: 0 bitflip_3: 0 bitflip_4: 0 bitflip_err: 0
1GB memory config mode:default 340M
bank:0 addr:0x80000000 size:340 M
Memory policy: ECC disabled, Data cache writeback
OMAP chip is TI8168 2.1
MEM_DSP_ADDR=0xc2000000, phy: 0x82000000 MEM_DSP_SIZE=0xa000000
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 86190
Kernel command line: console=ttyS0,115200n8 mem=160M dbg=7 debg=7 kdbg=7 root=/dev/ram initrd=0x80000000,1  ip=192.0.0.64:::255.255.255.0 eth=c4:2f:90:8b:e5:97 ddr3=1
PID hash table entries: 2048 (order: 1, 8192 bytes)
Dentry cache hash table entries: 65536 (order: 6, 262144 bytes)
Inode-cache hash table entries: 32768 (order: 5, 131072 bytes)
Memory: 340MB = 340MB total
Memory: 175244k/175244k available, 172916k reserved, 0K highmem
Virtual kernel memory layout:
    vector  : 0xffff0000 - 0xffff1000   (   4 kB)
    fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
    DMA     : 0xffc00000 - 0xffe00000   (   2 MB)
    vmalloc : 0xd5800000 - 0xf8000000   ( 552 MB)
    lowmem  : 0xc0000000 - 0xd5400000   ( 340 MB)
    modules : 0xbf000000 - 0xc0000000   (  16 MB)
      .init : 0xc0008000 - 0xc0032000   ( 168 kB)
      .text : 0xc0032000 - 0xc0491000   (4476 kB)
      .data : 0xc04b2000 - 0xc04deda0   ( 180 kB)
SLUB: Genslabs=11, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
Hierarchical RCU implementation.
NR_IRQS:160
GPMC revision 6.0 ... ... gpmc base:0xF9000000
cs0 config7:0xF40
[cs=0]base=0,size=1000000,ret=-16
IRQ: Found an INTC at 0xfa200000 (revision 5.0) with 128 interrupts
Total of 128 interrupts on 1 active controller
OMAP clockevent source: GPTIMER2 at 27000000 Hz
Console: colour dummy device 80x30
Calibrating delay loop... 985.08 BogoMIPS (lpj=1970176)
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
#############omap_barriers_init#############
xor: measuring software checksum speed
   arm4regs  :  1003.000 MB/sec
   8regs     :   945.000 MB/sec
   32regs    :  1003.000 MB/sec
xor: using function: 32regs (1003.000 MB/sec)
regulator: core version 0.5
regulator: dummy:
NET: Registered protocol family 16
main_pll_clk1_ck target rate:1000000000 last rounded rate:1000000575
main_pll_clk2_ck target rate:1200000000 last rounded rate:1200001598
main_pll_clk3_ck target rate:600000000 last rounded rate:600000799
main_pll_clk4_ck target rate:500000000 last rounded rate:500000287
main_pll_clk5_ck target rate:125000000 last rounded rate:125000091
main_pll_clk6_ck target rate:24000000 last rounded rate:24000000
main_pll_clk7_ck target rate:432000000 last rounded rate:504000000
audio_pll_clk2_ck target rate:160000000 last rounded rate:160012116
audio_pll_clk3_ck target rate:196608000 last rounded rate:196602710
audio_pll_clk4_ck target rate:45158400 last rounded rate:45158406
audio_pll_clk5_ck target rate:32768000 last rounded rate:32768032
Calibrating delay loop... 1196.03 BogoMIPS (lpj=2392064)
i2c_omap i2c_omap.1: bus 1 rev4.0 at 100 kHz
Found NAND on CS1
Registering NAND on CS1
registered ti816x_sr device
ti816x_pcie: Invoking PCI BIOS...
ti816x_pcie: Setting up Host Controller...
ti816x_pcie: Register base mapped @0xd5820000
ti816x_pcie: Starting PCI scan...
PCI: bus0: Fast back to back transfers enabled
ti816x_pcie: PCI scan done.
bio: create slab <bio-0> at 0
vgaarb: loaded
__tps6586x_write() : 157 reg 0x3f val 0x34
__tps6586x_write() : 157 reg 0x46 val 0x4
__tps6586x_write() : 157 reg 0x48 val 0x4
__tps6586x_write() : 157 reg 0x1c val 0x1f
__tps6586x_write() : 157 reg 0x42 val 0x4
__tps6586x_write() : 157 reg 0x28 val 0xab
__tps6586x_write() : 157 reg 0x27 val 0x5
__tps6586x_write() : 162 reg 0x29 val 0x27
__tps6586x_read() : 119 reg 0x3e val 0x39
__tps6586x_write() : 157 reg 0x3e val 0x31
__tps6586x_read() : 124 reg 0x29 val 0x27
regulator: REG-SM_0: 825 <--> 1137 mV at 1050 mV
SCSI subsystem initialized
omap2_mcspi: probe of omap2_mcspi.1 failed with error -2
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
raid6: int32x1    207 MB/s
raid6: int32x2    260 MB/s
raid6: int32x4    225 MB/s
raid6: int32x8    176 MB/s
raid6: using algorithm int32x2 (260 MB/s)
Switching to clocksource gp timer
musb_hdrc: version 6.0, pio, host, debug=0
musb_hdrc: USB Host mode controller at d580c000 using PIO, IRQ 18
musb_hdrc musb_hdrc.0: MUSB HDRC host driver
musb_hdrc musb_hdrc.0: new USB bus registered, assigned bus number 1
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
musb_hdrc: USB Host mode controller at d581e800 using PIO, IRQ 19
musb_hdrc musb_hdrc.1: MUSB HDRC host driver
musb_hdrc musb_hdrc.1: new USB bus registered, assigned bus number 2
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
NET: Registered protocol family 2
IP route cache hash table entries: 4096 (order: 2, 16384 bytes)
TCP established hash table entries: 16384 (order: 5, 131072 bytes)
TCP bind hash table entries: 16384 (order: 4, 65536 bytes)
TCP: Hash tables configured (established 16384 bind 16384)
TCP reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
RPC: Registered tcp NFSv4.1 backchannel transport module.
Successfully initialized hikio module
this board no cpld.
VBUS on (a_wait_vrise), devctl 11
VBUS on (a_wait_vrise), devctl 11
GPIO_0_25 OUT for PM1 RST
GPIO_1_20 OUT for PM0 RST
 Leave open card!!!,escape jiff is 0, now hz define is 250
======> ds dog id is 19258124
video_switch_init: unknow switch type 0x2
<M485> :Board is not 80105 or 13503
tmp75 probe
tz probe
[HIK]hikded: initialize success.
NetWinder Floating Point Emulator V0.97 (double precision)
NTFS driver 2.1.29 [Flags: R/W].
fuse init (API version 7.13)
yaffs Mar  9 2017 19:15:04 Installing.
msgmni has been set to 342
io scheduler noop registered (default)
Serial: 8250/16550 driver, 4 ports, IRQ sharing enabled
serial8250.0: ttyS0 at MMIO 0x48020000 (irq = 72) is a ST16654
console [ttyS0] enabled
serial8250.1: ttyS1 at MMIO 0x48022000 (irq = 73) is a ST16654
serial8250.2: ttyS2 at MMIO 0x48024000 (irq = 74) is a ST16654
lirc_dev: IR Remote Control driver registered, major 252
brd: module loaded
loop: module loaded
Loading iSCSI transport class v2.0-870.
iscsi: registered transport (tcp)
ata4294967295: Limit JMB321 speed negotiation to Gen-1 rate.
######## Limit JMB321 speed negotiation to Gen-1 rate.
ata4294967295: Limit JMB321 speed negotiation to Gen-1 rate.
######## Limit JMB321 speed negotiation to Gen-1 rate.
ahci ahci: AHCI 0001.0100 32 slots 2 ports 3 Gbps 0x3 impl platform mode
ahci ahci: flags: ncq sntf pm led clo only pmp pio slum part ccc
scsi0 : ahci
scsi1 : ahci
ata1: SATA max UDMA/133 mmio [mem 0x4a140000-0x4a150fff] port 0x100 irq 16
ata2: SATA max UDMA/133 mmio [mem 0x4a140000-0x4a150fff] port 0x180 irq 16
hik_set_proc 1310:set proc done
Don't reset JMB321 when System startup! ata_eh_reset, 2753
Don't reset JMB321 when System startup! ata_eh_reset, 2753
ti816x_nand driver initializing

INFO: Found ti816x_nand 0 - base 0x50000000, size 0x10000000
INFO: fill_flash_info - Found 1 Flash Devices
INFO: flash_map_init - detected 1 devices
MTD: Initialize the ti816x_nand device at address 0x50000000
INFO: Using ti816x_nand to probe ti816x_nand at address 0x50000000, size 0x10000000, width 1
INFO: gpmc_phys: 0x10000000 gpmc_virt: 0xD5826000
omap_nand_probe:use_prefetch = 1 us_dma = 0 IO_NAND_R: 0xD58260B4 IO_NAND_W: 0xD58260B4
Ecc mode: BCH4
NAND device: Manufacturer ID: 0x2c, Chip ID: 0xda (Micron NAND 256MiB 3,3V 8-bit)
 ---  --- detected OK

parse_mtd_partitions return : 3
Creating 3 MTD partitions on "ti816x_nand":
0x000000000000-0x000004000000 : "flash_sys0"
0x000004000000-0x000008000000 : "flash_sys1"
0x000008000000-0x000010000000 : "data_config"

INFO: add mtd partition succeed! - OK.
yaffs: dev is 32505856 name is "mtdblock0"
yaffs: passed flags ""
yaffs: Attempting MTD mount on 31.0, "mtdblock0"
yaffs witesize:2048, chunks/block:64 blocks:512
dev info:startblock - 1 endblock - 512
usb 1-1: new high speed USB device using musb_hdrc and address 2
hub 1-1:1.0: USB hub found
hub 1-1:1.0: 4 ports detected
ata2.00: hardreset failed after retry 0 times
 
ata2: SATA link down (SStatus 0 SControl 310)
usb 1-1.3: new full speed USB device using musb_hdrc and address 3
hub 1-1.3:1.0: USB hub found
hub 1-1.3:1.0: 4 ports detected
ata1.00: hardreset success after retry 0 times
 
usb 1-1.3.2: new low speed USB device using musb_hdrc and address 4
usb 1-1.3.4: new low speed USB device using musb_hdrc and address 5
yaffs_read_super: isCheckpointed 0
nErasedBlocks:266
mount filesystem from /dev/mtdblock0 ok.
loading rootfs ... 0x15c580/0x15c580 done.
save exit from flash_sys0 : isCheckpointed 1
save exit from flash_sys0 : isCheckpointed 1
yaffs: dev is 32505858 name is "mtdblock2"
yaffs: passed flags ""
yaffs: Attempting MTD mount on 31.2, "mtdblock2"
yaffs witesize:2048, chunks/block:64 blocks:1024
dev info:startblock - 1 endblock - 1024
yaffs_read_super: isCheckpointed 0
nErasedBlocks:860
save exit from data_config : isCheckpointed 1
save exit from data_config : isCheckpointed 1
yaffs: dev is 32505856 name is "mtdblock0"
yaffs: passed flags ""
yaffs: Attempting MTD mount on 31.0, "mtdblock0"
yaffs witesize:2048, chunks/block:64 blocks:512
yaffs: restored from checkpoint
yaffs_read_super: isCheckpointed 1
nErasedBlocks:265
mount filesystem ok logo.
ipc_stop_cpu procid is 1
ipc_stop_cpu procid is 0
ipc_stop_cpu procid is 2
Netra Ducati clock enable, Please wait .....done.
PRCM for I2c is in Progress......done.
PRCM for HDVPSS is in Progress......done.
PRCM for HDMI is in Progress......done.
Netra Video PLL Init is in Progress, Please wait .....
Netra Video PLL Init is Done.....
tmds3 = a9
configureWrapper
configureWrapper
configureCore
Descrete syncs and being sourcedconfigureCoreDataPath
configureCoreDataPath
configureHdmiPolicies
No Pixel repeatation required
configureHdmiPolicies
Pulled core out of reset
configureCore
configureAVIInfoFrame
AVI - Computed check sum 35
Check sum sent 221
Sent check sum + all bytes should 0x0
configureAVIInfoFrame
hdmiInit ok
boot addr is 0x9f80b015
block1: phys=0x00000000,size=60 download
block2: phys=0x9f50e4d0,size=940 download
block3: phys=0x9f800000,size=90696 download
pgctrl=0x9f80b015
rstctrl_reg=0x0000006f
VPS init ok...
retry = 9395
logo file name : /root/logo_nvr.bmp
ata1: SATA link up 1.5 Gbps (SStatus 113 SControl 310)
ata1.15: Port Multiplier 1.2, 0x197b:0x0325 r0, 5 ports, feat 0x5/0xf
ata1.00: hard resetting link
sata_set_spd #### scontrol 0x10
save exit from flash_sys0 : isCheckpointed 1

INFO: Found spi_flash 0 - base 0x48030100, size 0x200000
INFO: fill_flash_info - Found 1 Flash Devices
INFO: flash_map_init - detected 1 devicesMTD: Initialize the spi_flash device at address 0x48030100
INFO: Io remapped successfully - phy addr = 0x48030100, virt addr = 0xfa030100
INFO: Using spi_flash to probe spi_flash at address 0x48030100, size 0x200000, width 1
SF-Macronix: Detected MX25L1606E with page size 256, total 2097152 bytes
SPI Serial flash detected @ 0xfa030100, 2048KB (32sec x 64KB)
 ---  --- detected OK

parse_mtd_partitions return : 3
Creating 3 MTD partitions on "spi_flash":
0x0000001f0000-0x000000200000 : "sf_sys_params"
0x0000001e0000-0x0000001f0000 : "sf_cpld_info"
0x0000001c0000-0x0000001e0000 : "log_backup_info"

INFO: add mtd partition succeed! - OK.
PPP generic driver version 2.4.2
aoe: AoE v47 initialised.
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
mice: PS/2 mouse device common for all mice
rtc-pcf8563 1-0051: chip found, driver version 0.4.3
rtc-pcf8563 1-0051: rtc core: registered rtc-pcf8563 as rtc0
i2c /dev entries driver
md: raid0 personality registered for level 0
md: raid1 personality registered for level 1
md: raid10 personality registered for level 10
md: raid6 personality registered for level 6
md: raid5 personality registered for level 5
md: raid4 personality registered for level 4
input: Logitech Optical USB Mouse as /devices/platform/musb_hdrc.0/usb1/1-1/1-1.3/1-1.3.2/1-1.3.2:1.0/input/input0
&&&cjtest no match  hdev->vendor=0x46d hdev->product=0xc016
generic-usb 0003:046D:C016.0001: input: USB HID v1.10 Mouse [Logitech Optical USB Mouse] on usb-musb_hdrc.0-1.3.2/input0
input: CHESEN USB Keyboard as /devices/platform/musb_hdrc.0/usb1/1-1/1-1.3/1-1.3.4/1-1.3.4:1.0/input/input1
&&&cjtest no match  hdev->vendor=0xa81 hdev->product=0x101
generic-usb 0003:0A81:0101.0002: input: USB HID v1.10 Keyboard [CHESEN USB Keyboard] on usb-musb_hdrc.0-1.3.4/input0
input: CHESEN USB Keyboard as /devices/platform/musb_hdrc.0/usb1/1-1/1-1.3/1-1.3.4/1-1.3.4:1.1/input/input2
&&&cjtest no match  hdev->vendor=0xa81 hdev->product=0x101
generic-usb 0003:0A81:0101.0003: input: USB HID v1.10 Device [CHESEN USB Keyboard] on usb-musb_hdrc.0-1.3.4/input1
usbcore: registered new interface driver usbhid
usbhid: USB HID core driver
ip_tables: (C) 2000-2006 Netfilter Core Team
TCP cubic registered
NET: Registered protocol family 10
IPv6 over IPv4 tunneling driver
NET: Registered protocol family 17
__tps6586x_read() : 124 reg 0x29 val 0x27
__tps6586x_read() : 119 reg 0x10 val 0x0
__tps6586x_read() : 119 reg 0x10 val 0x0
__tps6586x_write() : 157 reg 0x10 val 0x2
__tps6586x_write() : 162 reg 0x29 val 0x2e
__tps6586x_write() : 162 reg 0x29 val 0x2d
__tps6586x_write() : 162 reg 0x29 val 0x2c
__tps6586x_write() : 162 reg 0x29 val 0x2b
__tps6586x_write() : 162 reg 0x29 val 0x2a
__tps6586x_write() : 162 reg 0x29 val 0x29
__tps6586x_write() : 162 reg 0x29 val 0x28
__tps6586x_write() : 162 reg 0x29 val 0x27
ata1.00: failed to resume link (SControl 0)
ata1.00: hardreset failed after retry 0 times
 
ata1.00: SATA link down (SStatus 0 SControl 0)
ata1.01: hard resetting link
sata_set_spd #### scontrol 0x310
__tps6586x_write() : 162 reg 0x29 val 0x26
__tps6586x_write() : 162 reg 0x29 val 0x25
__tps6586x_write() : 162 reg 0x29 val 0x24
__tps6586x_write() : 162 reg 0x29 val 0x23
GUARDBAND_PERCENTAGE 5
smartreflex smartreflex: SmartReflex driver initialized
VFP support v0.3: implementor 41 architecture 3 part 30 variant c rev 3
emac-mii: probed
smartreflex: prev volt 1000000 new_volt 1012870
__tps6586x_write() : 162 reg 0x29 val 0x25
mdio_bus 1:01: DaVinci EMAC: mii bus found 31
phydev = 0xd5042c00  PHYID=2
phydev = 0xd5042e00  PHYID=6
rtc-pcf8563 1-0051: setting system clock to 2020-09-03 10:30:56 UTC (1599129056)
ata1.01: hardreset success after retry 0 times
 
smartreflex: prev volt 1025000 new_volt 1025000
ata1.01: SATA link up 1.5 Gbps (SStatus 113 SControl 310)
ata1.02: hard resetting link
sata_set_spd #### scontrol 0x10
Set coalesce to 1000 usecs.
eth0: attached PHY driver [Generic PHY] (mii_bus:phy_addr=1:01, id=1410e80 phy_addr=1)
ADDRCONF(NETDEV_UP): eth0: link is not ready
Set coalesce to 1000 usecs.
poe0: attached PHY driver [Generic PHY] (mii_bus:phy_addr=1:02, id=1410c85 phy_addr=2)
ADDRCONF(NETDEV_UP): poe0: link is not ready
EMAC: poe0 link on
PHY: 1:02 - Link is Up - 100/Full
IP-Config: Complete:
     device=eth0, addr=192.0.0.64, mask=255.255.255.0, gw=255.255.255.255,
     host=192.0.0.64, domain=, nis-domain=(none),
     bootserver=255.255.255.255, rootserver=255.255.255.255, rootpath=
ata1.02: failed to resume link (SControl 0)
ata1.02: hardreset failed after retry 0 times
 
ata1.02: SATA link down (SStatus 0 SControl 0)
ata1.03: hard resetting link
sata_set_spd #### scontrol 0x10
EMAC: eth0 link on
PHY: 1:01 - Link is Up - 1000/Full
ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
ata1.03: failed to resume link (SControl 0)
ata1.03: hardreset failed after retry 0 times
 
ata1.03: SATA link down (SStatus 0 SControl 0)
ata1.04: hard resetting link
sata_set_spd #### scontrol 0x10
ata1.04: failed to resume link (SControl 0)
ata1.04: hardreset failed after retry 0 times
 
ata1.04: SATA link down (SStatus 0 SControl 0)
ata1.01: ATAPI: ATAPI   iHAS124   F, CL07, max UDMA/133, ATAPI AN
ata1.01: configured for PIO4
ata1: EH complete
scsi 0:1:0:0: CD-ROM            ATAPI    iHAS124   F      CL07 PQ: 0 ANSI: 5
sr0: scsi3-mmc drive: 48x/48x writer dvd-ram cd/rw xa/form2 cdda tray
Uniform CD-ROM driver Revision: 3.20
sr 0:1:0:0: Attached scsi generic sg0 type 5
md: Skipping autodetection of RAID arrays. (raid=autodetect will force)
RAMDISK: gzip image found at block 0
VFS: Mounted root (minix filesystem) on device 1:0.
display icon 0 detected = 0
display icon 1 detected = 1
display icon 2 detected = 0
display icon 3 detected = 0
Freeing init memory: 168K
##############udev rules not changed#################
Starting udev:      [ OK ]
yaffs: dev is 32505856 name is "mtdblock0"
yaffs: passed flags ""
yaffs: Attempting MTD mount on 31.0, "mtdblock0"
yaffs witesize:2048, chunks/block:64 blocks:512
yaffs: restored from checkpoint
yaffs_read_super: isCheckpointed 1
nErasedBlocks:265
yaffs: dev is 32505857 name is "mtdblock1"
yaffs: passed flags ""
yaffs: Attempting MTD mount on 31.1, "mtdblock1"
yaffs witesize:2048, chunks/block:64 blocks:512
dev info:startblock - 1 endblock - 512
yaffs_read_super: isCheckpointed 0
nErasedBlocks:266
yaffs: dev is 32505858 name is "mtdblock2"
yaffs: passed flags ""
yaffs: Attempting MTD mount on 31.2, "mtdblock2"
yaffs witesize:2048, chunks/block:64 blocks:1024
yaffs: restored from checkpoint
yaffs_read_super: isCheckpointed 1
nErasedBlocks:859
decompress application package done.
decompress IE control done.

file:src/pal_api.c,line:337, pal_module_init successfully
iSCSI daemon with pid=87 started!file:src/pal_api.c,line:337, pal_module_init successfully
VPS init ok...
retry = 9863
Netra Ducati clock enable, Please wait .....done.
PRCM for I2c is in Progress......done.
PRCM for HDVPSS is in Progress......done.
PRCM for HDMI is in Progress......done.
Netra Video PLL Init is in Progress, Please wait .....
Netra Video PLL Init is Done.....
TIMER 4 clock enable, Please wait .....done.
hdmi auto cts config, Please wait .....done.
register ipc irq ret is 0
register cmem driver successed.
/home/initrun.sh: /home/initrun.sh: 13: mv: not found
/home/initrun.sh: /home/initrun.sh: 14: mv: not found
Generating key, this may take a while...
chown: /opt/webs: No such file or directory
chmod: /opt/dvrCmd/dvrtools: No such file or directory
file:src/pal_api.c,line:337, pal_module_init successfully
[CRIT][sys_guide.c #1035][@read_execl_guide_cfg]: start
[CRIT][sys_guide.c #447][@get_flash_cards_info]: ********can not find any usb device!********
[CRIT][sys_guide.c #1045][@read_execl_guide_cfg]: get flash cards info failed. iRet[-1]
read execl guide cfg failed. iRet[-1][CRIT][sbus_util.c #399][@sbus_get_local_addr_from_ifname]: get ipaddr from eth0 Done!
[CRIT][sbus_sub_au.c #276][@au_init]: get local from netif addr 0x400000c0 192.0.0.64
[CRIT][sbus_main_au.c #375][@fn_sau_accept]: new session hdl [0x146d90] comming!!
[CRIT][sbus_util.c #555][@uni_hdl_info]: fn_sau_accept hdl: [0x146d90] fd:[15] type[2]
[CRIT][sbus_util.c #575][@uni_hdl_info]: Net: Local[127.0.0.1:53000]-Remote[127.0.0.1:48280]
[CRIT][union_com_api.c #212][@master_accept_svc]: handle[0x146d90] fdConn[15] sync client finished.
[CRIT][sbus_sub_au.c #174][@connect_main_au]: get szLocalAddr 192.0.0.64
file:src/pal_api.c,line:337, pal_module_init successfully
[CRIT][broker_slave.c #2292][@br_slave_init]: get local addr 192.0.0.64
file:src/pal_api.c,line:337, pal_module_init successfully
[CRIT][broker_slave.c #2292][@br_slave_init]: get local addr 192.0.0.64
[CRIT][sbus_util.c #555][@uni_hdl_info]: fn_accept_session hdl: [0x188a80] fd:[13] type[1]
[CRIT][sbus_util.c #560][@uni_hdl_info]: Unix: [/var/master]
[CRIT][union_com_api.c #212][@master_accept_svc]: handle[0x188a80] fdConn[13] sync client finished.
[CRIT][sbus_util.c #555][@uni_hdl_info]: fn_accept_session hdl: [0x1a8dd0] fd:[26] type[1]
[CRIT][sbus_util.c #560][@uni_hdl_info]: Unix: [/var/master]
[CRIT][union_com_api.c #212][@master_accept_svc]: handle[0x1a8dd0] fdConn[26] sync client finished.
/*********************init_global_error_lib*/, init_global_error_lib start!
EMAC: eth0 link off
PHY: 1:01 - Link is Down
:1
t1: wait storage [2] and gui[2] and hicore[2] and ipcm[0]
Set coalesce to 1000 usecs.
eth0: attached PHY driver [Generic PHY] (mii_bus:phy_addr=1:01, id=1410e80 phy_addr=1)
ADDRCONF(NETDEV_UP): eth0: link is not ready
:1
[CRIT][init/dvr.c #2995][@sys_init_check_md5]: szUpgDirPath[/dav0/]
getPPPOECfg: from /dav2/devCfg.bin ok.
getDevCfgPppoePara struIfName[eth0]
==================enablePPPoE failed!!!
EMAC: eth0 link on
PHY: 1:01 - Link is Up - 1000/Full
ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
t1: wait storage [2] and gui[2] and hicore[2] and ipcm[0]
[CRIT][init/dvr.c #3010][@sys_init_check_md5]: upgrade file is correct, the device can start
Set coalesce to 1000 usecs.
poe0: attached PHY driver [Generic PHY] (mii_bus:phy_addr=1:02, id=1410c85 phy_addr=2)
ADDRCONF(NETDEV_UP): poe0: link is not ready
Set coalesce to 1000 usecs.
poe0: attached PHY driver [Generic PHY] (mii_bus:phy_addr=1:02, id=1410c85 phy_addr=2)
ADDRCONF(NETDEV_UP): poe0: link is not ready
[CRIT][param/paramLib.c #10291][@readDevParam]: bFsInFlash[1]  bHisi3535OldCfg[0]  abi_sup_cfg_file_backup() is [1]
[CRIT][param/paramLib.c #10446][@readDevParam]: flash have fileSystem
[CRIT][param/paramLib.c #10466][@readDevParam]: 1:readDevParam from /dav2/devCfg.bin OK
[CRIT][param/paramLib.c #9432][@sys_cfg_patch]: pDevCfg->cfgHead.paraVersion[0x190529]
[CRIT][param/paramLib.c #9433][@sys_cfg_patch]: pBspAbility->iConfigType[2]
[CRIT][param/paramLib.c #10512][@readDevParam]: cfg is ok, but sys cfg no patched
[CRIT][param/paramLib.c #10537][@readDevParam]: length is equal! iCfgLen[8444464]  sizeof(DEVICECONFIG)[8444464]


BusyBox v1.2.1 (2015.03.19-05:42+0000) Built-in shell (ash)
Enter 'help' for a list of davinci system commands.

set net mask ioctl error:: Cannot assign requested address
<MEGA_DSP>Def Value:
<MEGA_DSP>Main mux type [0x10][0x2].
<MEGA_DSP>Sub  mux type [0x10][0x2].
<MEGA_DSP>audio enc type[0x1011][0x1].
<MEGA_DSP>arm cache line size is 0x40
voicetalk type[0x1011][0x1].
<Mdsp start mem addr(phy)=0x8a000000, extend mem size=0x6000000, totalsize=0x40000000
EGA_DSP>Need PS SysHdr[0].
iVidzzl test cmemioctl CMEM_MAP_DSPMEM########
eoEncType   : 2
iAudioEncType  zzl DSP arg: phy a0000000 virt 0 size 600000
 : 4113
iVTType         : 4113
zzl test phyaddr=a0000000 virtaddr=402c9000 cmem_ioctl 529

iMainMuxType    : 16
iSubMuxTyzzl test cmemioctl CMEM_MAP_DSPMEM########
pe        : 16
iMainPackLen    zzl DSP arg: phy 40800000 virt 402c9000 size 40000
: 1376
iSubPackLen     : 1376
zzl test phyaddr=40800000 virtaddr=408c9000 cmem_ioctl 529
bNeedPSSysHdr   : FALSE
bNeedSuzzl test cmemioctl CMEM_MAP_DSPMEM########
bQVGARes : FALSE
bMegaPlatEnablzzl DSP arg: phy 55020000 virt 408c9000 size 40000
e : FALSE
<lib>AllocShareBuf: izzl test phyaddr=55020000 virtaddr=40909000 cmem_ioctl 529
dx=1,phyAddr=0xa0000000,vaddr=0x402c9000,size=0x600000
<lib>AllocShareBuf: idx=2,phyAddr=0x40800000,vaddr=0x408c9000,size=0x40000
<lib>AllocShareBuf: idx=3,phyAddr=0x55020000,vaddr=0x40909000,size=0x40000
<lib>pDspInitPara->dspMemSize=86 zzl  dbgmem range:0xA0000000 ~ 0xA0600000
4M
map phy addr 0xa05d0000 to virt addr 0xd5900000
cmem_dbgmem_init: g_dbgmem[0] = 0xd5900000
cmem_dbgmem_init: g_dbgmem[1] = 0xd5910000
cmem_dbgmem_init: g_dbgmem[2] = 0xd5920000
<lib>Netra to host share virt address.......402c9000
uiVoutMainSpecify=0
encChanNums=16, flgEncChanEnable=0x0, chipRev = 33127
decChanCnt=16
ipcChanCnt=32, flgIpcChanEnable=0xffffffff
video_AD = 0
arm cache line size is 0x40
CMEM_MALLOC_BIG_MEM->[MAP]size=0xa000000,phy=0x82000000,virt=0x40949000
<lib>-----getHostStreamBufAddr,cipc_stop_cpu procid is 1
nt 4 phyAddr=0x82000000,vaddr=0xipc_stop_cpu procid is 0
40949000,size=0xa000000------
ipc_stop_cpu procid is 2
<lib>start to load c674 core.C64x: entry is 0

C674x is in Progress, Please wait.....done.
boot addr is 0x00800000
block1: phys=0x00800000,size=33504 download
block2: phys=0x9ef7e448,size=91028 download
block3: phys=0x9ef98fe0,size=32 download
block4: phys=0x9ef9d22c,size=1416 download
block5: phys=0x9ef9da4c,size=512 download
block6: phys=0x9ef9dd6c,size=68364 download
block7: phys=0x9f200000,size=951744 download
C64x: entry is 800000
C674x is in Progress, Please wait.....done.
BusyBox v1.2.1 Protect Shell (psh)
Enter 'help' for a list of davinci system commands.

# eth0: ip = 192.168.10.123, subnet = 255.255.255.0, router = 192.168.10.1, dns = 151.237.60.1 8.8.8.8
do_iproute_del 127.0.0.0/8.
RTNETLINK answers: No such process
do_iproute_del default.
RTNETLINK answers: No such process
RTNETLINK answers: No such file or directory
do_iproute_add 192.168.10.1.
do_iproute_add 192.168.10.1.
do_iproute_add 127.0.0.0/8.
do_iproute_add 192.168.10.0/24.
Trying 10/HALF
EMAC: poe0 link on
PHY: 1:02 - Link is Up - 1000/Full
ADDRCONF(NETDEV_CHANGE): poe0: link becomes ready
C674 buildTime : 2017-04-18 10:3boot addr is 0x9fe16185
0:16
<lib>load c674 core is ok.block1: phys=0x00000000,size=60 download
err=0
<lib>start to load vid core.
block2: phys=0x0000c000,size=10968 download
block3: phys=0x0003682c,size=4224 download
block4: phys=0x9fb65200,size=1338092 download
block5: phys=0x9fcb084c,size=512 download
block6: phys=0x9fe00000,size=102212 download
block7: phys=0x9fe19288,size=7404 download
pgctrl=0x9fe16185
rstctrl_reg=0x0000006f
VID buildTime : 2017-04-18 10:20boot addr is 0x9f824009
:13
<lib>load vid core is ok.erblock1: phys=0x00000000,size=60 download
r=0
<lib>start to load vps core.
block2: phys=0x00004000,size=27008 download
block3: phys=0x9f61ad84,size=28 download
block4: phys=0x9f64bf98,size=68200 download
block5: phys=0x9f65e200,size=512 download
block6: phys=0x9f800000,size=193092 download
pgctrl=0x9f824009
rstctrl_reg=0x0000006b
VPS buildTime : 2017-04-18 10:23zzl test cmemioctl CMEM_MAP_DSPMEM########
:02
<lib>load vps core is ok.erzzl DSP arg: phy a7200000 virt 0 size 90e00000
r=0
zzl test phyaddr=a7200000 virtaddr=4a949000 cmem_ioctl 529
<lib>-----InitShareMemHeap,cnt 5zzl test cmemioctl CMEM_MAP_DSPMEM########
 phyAddr=0xa7200000,vaddr=0x4a94zzl DSP arg: phy a5400000 virt 0 size 81c00000
9000,size=0x10e00000------
zzl test phyaddr=a5400000 virtaddr=5b749000 cmem_ioctl 529
<lib>-----InitShareMemHeap,cnt 6 phyAddr=0xa5400000,vaddr=0x5b749000,size=0x1c00000------
phy=40809cc0, virt=408d2cc0, data=00000020 00000000 000000cf 0011a800
phy=55040ee0, virt=40929ee0, data=00000003 00000000 00000013 0001b800
phy=55053540, virt=4093c540, data=00000006 00000000 00000007 00005e00
<lib>Cache seg 0 start 0x40949000 0x82000000 len 0xa000000
<lib>Cache seg 1 start 0x4a949000 0xa7200000 len 0x10e00000
<lib>Cache seg 2 start 0x5b749000 0xa5400000 len 0x1c00000
Netra Dsp Dbg file:src/netra_dsp.c,fun:netra_dsp_init,line:779, g_pstruDspInitPara->IpcRecodeNetPool[0].vAddr=(nil) error!!!
Netra Dsp Dbg file:src/netra_dsp.c,fun:netra_dsp_init,line:779, g_pstruDspInitPara->IpcRecodeNetPool[1].vAddr=(nil) error!!!
Netra Dsp Dbg file:src/netra_dsp.c,fun:netra_dsp_init,line:779, g_pstruDspInitPara->IpcRecodeNetPool[2].vAddr=(nil) error!!!
Netra Dsp Dbg file:src/netra_dsp.c,fun:netra_dsp_init,line:779, g_pstruDspInitPara->IpcRecodeNetPool[3].vAddr=(nil) error!!!
Netra Dsp Dbg file:src/netra_dsp.c,fun:netra_dsp_init,line:779, g_pstruDspInitPara->IpcRecodeNetPool[4].vAddr=(nil) error!!!
Netra Dsp Dbg file:src/netra_dsp.c,fun:netra_dsp_init,line:779, g_pstruDspInitPara->IpcRecodeNetPool[5].vAddr=(nil) error!!!
Netra Dsp Dbg file:src/netra_dsp.c,fun:netra_dsp_init,line:779, g_pstruDspInitPara->IpcRecodeNetPool[6].vAddr=(nil) error!!!
Netra Dsp Dbg file:src/netra_dsp.c,fun:netra_dsp_init,line:779, g_pstruDspInitPara->IpcRecodeNetPool[7].vAddr=(nil) error!!!
Netra Dsp Dbg file:src/netra_dsp.c,fun:netra_dsp_init,line:779, g_pstruDspInitPara->IpcRecodeNetPool[8].vAddr=(nil) error!!!
Netra Dsp Dbg file:src/netra_dsp.c,fun:netra_dsp_init,line:779, g_pstruDspInitPara->IpcRecodeNetPool[9].vAddr=(nil) error!!!
Netra Dsp Dbg file:src/netra_dsp.c,fun:netra_dsp_init,line:779, g_pstruDspInitPara->IpcRecodeNetPool[10].vAddr=(nil) error!!!
Netra Dsp Dbg file:src/netra_dsp.c,fun:netra_dsp_init,line:779, g_pstruDspInitPara->IpcRecodeNetPool[11].vAddr=(nil) error!!!
Netra Dsp Dbg file:src/netra_dsp.c,fun:netra_dsp_init,line:779, g_pstruDspInitPara->IpcRecodeNetPool[12].vAddr=(nil) error!!!
Netra Dsp Dbg file:src/netra_dsp.c,fun:netra_dsp_init,line:779, g_pstruDspInitPara->IpcRecodeNetPool[13].vAddr=(nil) error!!!
Netra Dsp Dbg file:src/netra_dsp.c,fun:netra_dsp_init,line:779, g_pstruDspInitPara->IpcRecodeNetPool[14].vAddr=(nil) error!!!
Netra Dsp Dbg file:src/netra_dsp.c,fun:netra_dsp_init,line:779, g_pstruDspInitPara->IpcRecodeNetPool[15].vAddr=(nil) error!!!
Netra Dsp Dbg file:src/netra_dsp.c,fun:netra_dsp_init,line:779, g_pstruDspInitPara->IpcRecodeNetPool[16].vAddr=(nil) error!!!
Netra Dsp Dbg file:src/netra_dsp.c,fun:netra_dsp_init,line:779, g_pstruDspInitPara->IpcRecodeNetPool[17].vAddr=(nil) error!!!
Netra Dsp Dbg file:src/netra_dsp.c,fun:netra_dsp_init,line:779, g_pstruDspInitPara->IpcRecodeNetPool[18].vAddr=(nil) error!!!
Netra Dsp Dbg file:src/netra_dsp.c,fun:netra_dsp_init,line:779, g_pstruDspInitPara->IpcRecodeNetPool[19].vAddr=(nil) error!!!
Netra Dsp Dbg file:src/netra_dsp.c,fun:netra_dsp_init,line:779, g_pstruDspInitPara->IpcRecodeNetPool[20].vAddr=(nil) error!!!
Netra Dsp Dbg file:src/netra_dsp.c,fun:netra_dsp_init,line:779, g_pstruDspInitPara->IpcRecodeNetPool[21].vAddr=(nil) error!!!
Netra Dsp Dbg file:src/netra_dsp.c,fun:netra_dsp_init,line:779, g_pstruDspInitPara->IpcRecodeNetPool[22].vAddr=(nil) error!!!
Netra Dsp Dbg file:src/netra_dsp.c,fun:netra_dsp_init,line:779, g_pstruDspInitPara->IpcRecodeNetPool[23].vAddr=(nil) error!!!
Netra Dsp Dbg file:src/netra_dsp.c,fun:netra_dsp_init,line:779, g_pstruDspInitPara->IpcRecodeNetPool[24].vAddr=(nil) error!!!
Netra Dsp Dbg file:src/netra_dsp.c,fun:netra_dsp_init,line:779, g_pstruDspInitPara->IpcRecodeNetPool[25].vAddr=(nil) error!!!
Netra Dsp Dbg file:src/netra_dsp.c,fun:netra_dsp_init,line:779, g_pstruDspInitPara->IpcRecodeNetPool[26].vAddr=(nil) error!!!
Netra Dsp Dbg file:src/netra_dsp.c,fun:netra_dsp_init,line:779, g_pstruDspInitPara->IpcRecodeNetPool[27].vAddr=(nil) error!!!
Netra Dsp Dbg file:src/netra_dsp.c,fun:netra_dsp_init,line:779, g_pstruDspInitPara->IpcRecodeNetPool[28].vAddr=(nil) error!!!
Netra Dsp Dbg file:src/netra_dsp.c,fun:netra_dsp_init,line:779, g_pstruDspInitPara->IpcRecodeNetPool[29].vAddr=(nil) error!!!
Netra Dsp Dbg file:src/netra_dsp.c,fun:netra_dsp_init,line:779, g_pstruDspInitPara->IpcRecodeNetPool[30].vAddr=(nil) error!!!
Netra Dsp Dbg file:src/netra_dsp.c,fun:netra_dsp_init,line:779, g_pstruDspInitPara->IpcRecodeNetPool[31].vAddr=(nil) error!!!
DSP START OK
!!!!!!!!!!!!!!!!!!!!!!!!!DSP Init Ok!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
fatal error!iBrCallRet[-1],func[sc_force_i_frame]
fatal error!iBrCallRet[-1],func[sc_force_i_frame]
fatal error!iBrCallRet[-1],func[sc_force_i_frame]
fatal error!iBrCallRet[-1],func[sc_force_i_frame]
fatal error!iBrCallRet[-1],func[sc_force_i_frame]
fatal error!iBrCallRet[-1],func[sc_force_i_frame]
fatal error!iBrCallRet[-1],func[sc_force_i_frame]
fatal error!iBrCallRet[-1],func[sc_force_i_frame]
fatal error!iBrCallRet[-1],func[sc_force_i_frame]
fatal error!iBrCallRet[-1],func[sc_force_i_frame]
fatal error!iBrCallRet[-1],func[sc_force_i_frame]
fatal error!iBrCallRet[-1],func[sc_force_i_frame]
fatal error!iBrCallRet[-1],func[sc_force_i_frame]
fatal error!iBrCallRet[-1],func[sc_force_i_frame]
fatal error!iBrCallRet[-1],func[sc_force_i_frame]
fatal error!iBrCallRet[-1],func[sc_force_i_frame]
fatal error!iBrCallRet[-1],func[sc_force_i_frame]
fatal error!iBrCallRet[-1],func[sc_force_i_frame]
fatal error!iBrCallRet[-1],func[sc_force_i_frame]
fatal error!iBrCallRet[-1],func[sc_force_i_frame]
fatal error!iBrCallRet[-1],func[sc_force_i_frame]
fatal error!iBrCallRet[-1],func[sc_force_i_frame]
fatal error!iBrCallRet[-1],func[sc_force_i_frame]
fatal error!iBrCallRet[-1],func[sc_force_i_frame]
fatal error!iBrCallRet[-1],func[sc_force_i_frame]
fatal error!iBrCallRet[-1],func[sc_force_i_frame]
fatal error!iBrCallRet[-1],func[sc_force_i_frame]
fatal error!iBrCallRet[-1],func[sc_force_i_frame]
fatal error!iBrCallRet[-1],func[sc_force_i_frame]
fatal error!iBrCallRet[-1],func[sc_force_i_frame]
fatal error!iBrCallRet[-1],func[sc_force_i_frame]
init_stream_buf, pInStreamBuf:0x5d85f008, pOutStreamBuf:0x5d8df008
wait storage [2] and gui[2]
fatal error!iBrCallRet[-1],func[sc_force_i_frame]
:1
:1
arm cache line size is 0x40
[CRIT][kernel/init.c #3732][@InitGUI]: End of InitGUI!!
Netra Dsp Dbg file:src/netra_dsp.c,fun:netra_get_logo_pool,line:3793, invalidate param
pal_get_logo_pool PAL_LOGO_TYPE_SHIPIN7 error!
maxIPCcount[32] maxAnalogCount[0]
panelFd[80].................
Device Is Ready
### key info: [ipcm_svc_init] 4845:ipcm svc inited. ###
>>>ipcm_chan_start_task  chan[1] start
>>>ipcm_chan_start_task  chan[2] start
>>>ipcm_chan_start_task  chan[3] start
>>>ipcm_chan_start_task  chan[4] start
big_bit_mask p[0xbb0ff8a0], idx[-1] error!func[big_bit_mask],line[63]
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@starting civil service sec!.@@@@@@@@@@@@@@@@@@@@@@@@@@
<MEGA_CFG_INFO>MegaPlatMagic      [0x484f3d45]
MegaCfgLen         [120616]
MegaParaVersion    [0x140307]
MegaParaNeedStorLen[136]
MegaCfgSuppBak     [0]
<MEGA_CFG_INFO>Enter @[mega_cfg_get_device_cfg_params]
<MEGA_CFG_INFO>Enter @[mega_cfg_read_dev_param]
<MEGA_CFG_INFO>Enter @[mega_cfg_check_and_try_repair_cfg_file]
<MEGA_CFG_INFO>Enter @[mega_cfg_util_check_cfg_file_valid]
<MEGA_CFG_INFO>Exit @[mega_cfg_util_check_cfg_file_valid]
<MEGA_CFG_INFO>Mega Cfg Valid.
<MEGA_CFG_INFO>Exit @[mega_cfg_check_and_try_repair_cfg_file]
>>>ipcm_chan_start_task  chan[5] start
<MEGA_CFG_INFO>Exit @[mega_cfg_read_dev_param]
<MEGA_CFG_INFO>Mega Cfg Init Succ.
<MEGA_CFG_INFO>Exit @[mega_cfg_get_device_cfg_params]
<MEGA_BASELINE_INIT>MegaEyes baseline resources init ok!
!!!!!!!!!!!!!!!sc_hicore is start ok!!!!!!!!!!!!!!!!
[CRIT][ipc/ipcService/ipc_pse_ctrl.c #129][@pse_ctrl_task]: Poe portNum [16], ability(1), Pse portNum [0]
============RegisterReq============
========= set alarm center addr alarmeu.ezvizlife.com:7400
 $$$$$$$$$$$$$ iAoChans[14] $$$$$$$$$$$$$
g_aoChan[0]=[1]
g_aoChan[1]=[2]
g_aoChan[2]=[3]


getHardInfo:
Start at 2020-09-03 10:31:35
Serial NO :1620150701BBRR527681441WCVU
V3.4.5 build 190715
softBase:/Platform/trunk:0
KernelVersion: V1.0.0 build 170314
dspSoftVersion: V1.0 build 170418
codecVersion: V1.0 build 170418
hardwareVersion = 0x0
encodeChans = 0
decodeChans = 16
alarmInNums = 16
alarmOutNums = 4
flashsize = 0x10000000
ramSize = 0x40000000
networksNums = 1
language = 1
devType:DS-7732NI-SP
bootPartition = 1
randomCode =


Public key portion is:
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCCZH0pIXCRkkAjq9r0dBzXz9YwhHaVp+ln2ZZnH1YJHGRnVFvcF6HDuqwt4ezhtemKcCSGCos6PM4+keLnP/dvwBZBTQ9yJoKsACgrEbbQyAlzGy9DLCw7Dm5L6TXBJ4IF3H6vmVYtDuVoTz5rD/MPG/6ayFnoA1PgF7PdoH/ofhIoVYuVLQlOoyc1AF7W61DYhl5VSisd39jyG/iOZFgMV2k5iBHmsZGmssgKPb6biy5cK/hx7X2brjOr/as73d3SUcDa9fGvJ2tw6pxS4LkS60SatyTZFgVgktHdz3wnljiqI+jUPRW8YTmc0ZPw2M1Xt7VqYf/fpTaQsPpuWeev root@192.0.0.64
Fingerprint: sha1!! 0f:5e:3e:86:1e:e7:74:81:8f:d2:e3:fb:4f:60:8b:57:bc:1c:d8:52
line:39,func:CheckUpnpReq
serial_number_:NVR-32-A1620150701BBRR527681441WCVU
appweb_check_auth g_bSendAuth[1]
1pstSecuUserStatus = 1f54810-----0 ,101361856 ,0,¡¡0
2pstSecuUserStatus = 1f54810-----0 ,101361856 ,1,¡¡0
appweb_check_auth g_bSendAuth[1]
1pstSecuUserStatus = 1f54810-----0 ,101361856 ,1,¡¡0
2pstSecuUserStatus = 1f54810-----0 ,101361856 ,2,¡¡0
appweb_check_auth g_bSendAuth[1]
1pstSecuUserStatus = 1f54810-----0 ,101361856 ,2,¡¡0
2pstSecuUserStatus = 1f54810-----0 ,101361856 ,3,¡¡0
appweb_check_auth g_bSendAuth[1]
1pstSecuUserStatus = 1f54810-----0 ,101361856 ,3,¡¡0
2pstSecuUserStatus = 1f54810-----0 ,101361856 ,4,¡¡0
appweb_check_auth g_bSendAuth[1]
1pstSecuUserStatus = 1f54810-----0 ,101361856 ,4,¡¡0
2pstSecuUserStatus = 1f54810-----0 ,101361856 ,5,¡¡0
Adjust date/time from RTC.
Adjust date/time from RTC.
Adjust date/time from RTC.
Adjust date/time from RTC.
Adjust date/time from RTC.

Let me know if more info is needed.
I'm stuck

 

[iTuneDVR]

Let me know if more info is needed.
I'm stuck

What the problem with real reset password via SADP & tech support?

If you are already at u-boot, show log

help

printenv

After show you update log

update

 

[Alex Alex]

What the problem with real reset password via SADP & tech support?

This is an old NVR that I bought 2nd hand on eBay UK - I can't(or don't know how to) use Hik support

 

[Alex Alex]

Let me know if more info is needed.
I'm stuck

Good news, I just recovered my password from an old browser password manager So happy

However, I still want to know how to force the NVR settings removal, how to 'inactivate' it?

 

[alastairstevenson]

I still want to know how to force the NVR settings removal, how to 'inactivate' it?

With the caveat that I'm unfamiliar with that specific model and firmware - given web GUI access, a reset to defaults is normally available in the Maintenance menu.

 

[Alex Alex]

With the caveat that I'm unfamiliar with that specific model and firmware - given web GUI access, a reset to defaults is normally available in the Maintenance menu.

The thing is that password was lost. I've re-flashed the firmware via serial and tftpd but it didn't restore to factory defaults.

 

[alastairstevenson]

Sorry, I thought from what you said in post 409 that you'd recovered the password.
Which would mean that you've regained admin access to the device and can therefore access the admin interface.

 

[Alex Alex]

Sorry, I thought from what you said in post 409 that you'd recovered the password.
Which would mean that you've regained admin access to the device and can therefore access the admin interface.

That's right, it is now restored to defaults via Maintenance section in the GUI menu.

But again, I'd still like to know if it is possible to to the same with tftpd via serial.

 

[iTuneDVR]

But again, I'd still like to know if it is possible to to the same with tftpd via serial.

Show
help
printenv

 

[alexandreb78]

I get : [WARNING] The NVR/DVR software is broken down!!

See attached picture. When in the CLI, no command works, not even "help".

Thank you!

 

[alastairstevenson]

See attached picture. When in the CLI, no command works, not even "help".

I'm guessing that the TX of the USB to serial TTL is not connected correctly, or is broken, so that you are not sending commands.
Also - change the default gateway of the PC to something other than 192.0.0.64, such as 192.0.0.1

 

[bpaproch]

Hello All!
It's great that such a place exists and people with great knowledge can help others!
Since few days I have DS-7616NI-K2/16P but it is bricked.
I have learned how to connect and how to update firmware by serial/TFTP but I' stucked because sth is wrong I believe at Bootloader level.
I did few trials and update firmware to different versions old and new but nothing has changed.
Can you take a look intoo my log and advice what to do?
Thanks a lot!

U-Boot 2010.06-svn20427 (Mar 09 2018 - 16:41:25)[V1.4.5]


Hit ctrl+u to stop autoboot:  0

Mounting yaffs2 mount point/partnum: nand/0

Configures yaffs mount nand success!

Copy /nand/uImage to 0x42000000...      [DONE]

timeout for link [4999]!

MAC:   F8-4D-FC-E7-F2-B7

|RCV UDP pack timeout| TFTP server not found

## Booting kernel from Legacy Image at 42000000 ...

Verifying RSA ... Bad Data RSA verify

ERROR: can't get kernel image!

Mounting yaffs2 mount point/partnum: nand1/1

Delete part:flash_sys0 nand/version.bin

Configures yaffs mount nand1 success!

Copy /nand1/uImage to 0x42000000...     [DONE]

## Booting kernel from Legacy Image at 42000000 ...

Verifying RSA ... Bad Data RSA verify

ERROR: can't get kernel image!


This program will upgrade software.

***

    ATTENTION!! PLEASE READ THIS NOTICE CAREFULLY!     *
    Don't reset machine,or anything that interrupt it. *
    The upgrade process must finish in 10 minutes!     *
    If this program fails,machine might be unusable,   *
    and you will need to reflash again.                *
    If you find this too risky,power off machine now.  *

***


Now press [u/U] key to upgrade software:

 

[fabiettoge]

Buonasera a tutti,

possiedo un DVR HIK VISION modello DS-7216HUHI-K2 che dopo 4 anni di funzionamento senza problemi ha deciso di mostrare una schermata fissa "EMBEDDED NET DVR".

Così grazie al Vostro aiuto, ed a tutto il necessario, tra cui una USB TTL, sono riuscito a collegare il DVR al Notebook.

Quando si avvia il DVR, sembra che il DVR trasmetta i dati AL PC, visto che il LED RX sulla TTL lampeggia

Quando invece si prova a fare l'UPDATE, il LED TX non lampeggia e sul monitor si ripetono una serie di

TTTTTTTTTTTTTTTTTTT TT TT TT TT TT TT TT TT TT TT TTT
TTTT TTTT TTTT TTTT TTTT TTTT
TTTT TTTT TTTT TTTT TTTT

e continua a fare vari ciclo, come se non riuscisse a scaricare il FIRMWARE.

Posso chiedere per favore il Vostro prezioso aiuto per risolvere il problema?

Grazie

 

[fabiettoge]

Buonasera a tutti,

possiedo un DVR HIK VISION modello DS-7216HUHI-K2 che dopo 4 anni di funzionamento senza problemi ha deciso di mostrare una schermata fissa "EMBEDDED NET DVR".

Così grazie al Vostro aiuto, ed a tutto il necessario, tra cui una USB TTL, sono riuscito a collegare il DVR al Notebook.

Quando si avvia il DVR, sembra che il DVR trasmetta i dati AL PC, visto che il LED RX sulla TTL lampeggia

Quando invece si prova a fare l'UPDATE, il LED TX non lampeggia e sul monitor si ripetono una serie di

TTTTTTTTTTTTTTTTTTT TT TT TT TT TT TT TT TT TT TT TT TTT
TTTT TTTT TTTT TTTT TTTT TTTT
TTTT TTTT TTTT TTTT TTTT

e continua a fare vari ciclo, come se non riuscisse a scaricare il FIRMWARE.

Posso chiedere per favore il Vostro prezioso aiuto per risolvere il problema?

Grazie
[/CITAZIONE]


HO RISOLTO: E NECESSARIO DISATTIVARE IL FIREWALL!!!

 

[motofox]

fully recovered my dead dvr using this great writeup thanks