Well, that's a terrific post for a thread starter. Kudos for the level of detail, clarity and effort that's gone into it.
The thread could very well turn into a valuable reference source that many people could get some benefit from.
So, if I may, I'd like to maybe add a few more items that could be useful.
By the way - I do agree generally with your sentiments about Hikvision's practice of trying to punish those customers who have purchased on-line at much lower cost than if it had been via an 'authorised' source. That's one reason why I've been so keen to help out those whose cameras have 'bricked' when doing what should come naturally - a firmware update for bugfixes, security fixes and functionality.
Firstly - in terms of a lost password, the
tftp update of nominally the same firmware that's installed is certainly one approach.
But I'd caution people trying this to somehow find out if their NVR is a China market model running 'hacked to English' firmware. This would generally be those NVRs with the -N model suffix as opposed to the -NI suffix.
An update with stock firmware for those models will likely result in a bricked NVR having the " !!! You device is illegal !!! !!! You bought in China !!! ....." 15-beep bootloop.
So be careful.
The serial console is a powerful way to access the internals of an embedded Linux device, and particularly so on Hikvision devices, when they have been designed with deliberate traps and blocks to stop people doing what they think they should be able to on the products that they have purchased.
Despite these obstacles, there are enough clever people around who have the inquisitiveness and ability to explore them and work round them, so in reality it's a fairly pointless tactic, given the power of internet search these days.
It's not hard to see that Hikvision do take note of any openly-published 'tweaks' and incorporate measures against them in new firmware releases.
So I was going to describe here a really simple way to gain very good access to Hikvision NVR internals - but find that I'm having second thoughts about doing so.
Whilst it may be that the firmware for the DS-76xxNI/E series has probably reached end-of-life, this trick works even better on later models where the firmware is still being worked on and where there is a r/w file system instead of the previous CRAMFS r/o file system.
