Hikvision - Clearing Passwords and/or Loading Firmware via TTL Serial

alastairstevenson said:
If this was from a V3.x version that is likely to be the cause of the problem.
A minimum V3.x version and staged updates were needed to progress to the NVR 4 firmware.
Worth trying an older version, certainly.

By the way - for your own notes, or for posting, if using PuTTY for the serial console, check out the 'copy rollback to clipboard' facility, top left menu button.
This can then be used to paste the rollback into such as Notepad for editing, annotating, posting as text etc much easier than screenshots.
Click to expand...

I've just tried the latest V3 (3.4.109) for the model but just get the same result - frozen at 'booting the kernel'. I've installed so many Hik NVRs in the last 10 years and never had a failure (other than PSUs) so this is the first time I've had to resort to flashing the firmware this way.
 
Here is the output from putty:


U-Boot 2010.06-svn (Dec 28 2015 - 10:42:45)[V1.2.1]

Protected at offset: 0x0, size:0x40000 Protection status:[0x22f]=>[0x22f].
Hit ctrl+u to stop autoboot: 0

This program will upgrade software.
***
  • ATTENTION!! PLEASE READ THIS NOTICE CAREFULLY! *
  • Don't reset machine,or anything that interrupt it. *
  • The upgrade process must finish in 10 minutes! *
  • If this program fails,machine might be unusable, *
  • and you will need to reflash again. *
  • If you find this too risky,power off machine now. *
***

Now press [u/U] key to upgrade software: u
File system error,please upgrade by TFTP

Please input ip address of device: 192.168.0.64
Please input ip address of upgrade server: 192.168.0.35
Confirm?(y/n): y
timeout for link [4999]!
MAC: 18-68-CB-96-B6-63
TFTP from server 192.168.0.35; our IP address is 192.168.0.64
Download Filename 'digicap.dav'.
Download to address: 0x40008000
Downloading: #################################################
done
Bytes transferred = 41872280 (27eeb98 hex)
headEx checkSum ok !
uImage checkSum ok !
start.sh checkSum ok !
sys_app.tar.lzma checkSum ok !
gui_res.tar.lzma checkSum ok !
webs.tar.lzma checkSum ok !
new_10.bin checkSum ok !
check all mounted partitions have been unmounted...
--- OK!
start to erase nand flash partition 0 start: 0x200000 end: 0x6200000 len: 0x6000000 ...
Erasing at 0x61e0000 -- 100% complete.
--- OK!
start to erase nand flash partition 1 start: 0x6200000 end: 0xC200000 len: 0x6000000 ...
Erasing at 0xc1e0000 -- 100% complete.
--- OK!
start to erase nand flash partition 2 start: 0xC200000 end: 0x10000000 len: 0x3E00000 ...
Erasing at 0xffe0000 -- 100% complete.
--- OK!

start to write files to partition 0...
Configures yaffs mount nand success!
8-1. write nand/headEx len: 1024
8-2. write nand/uImage len: 8502640
8-3. write nand/start.sh len: 7216
8-4. write nand/sys_app.tar.lzma len: 20960240
8-5. write nand/gui_res.tar.lzma len: 7354240
8-6. write nand/webs.tar.lzma len: 5045080
8-7. write nand/new_10.bin len: 680
8-8. write flag file nand/version.bin len: 4
update partition 0 success!

start to write files to partition 1...
Configures yaffs mount nand1 success!
8-1. write nand1/headEx len: 1024
8-2. write nand1/uImage len: 8502640
8-3. write nand1/start.sh len: 7216
8-4. write nand1/sys_app.tar.lzma len: 20960240
8-5. write nand1/gui_res.tar.lzma len: 7354240
8-6. write nand1/webs.tar.lzma len: 5045080
8-7. write nand1/new_10.bin len: 680
8-8. write flag file nand1/version.bin len: 4
update partition 1 success!
Press ENTER key to reboot
resetting ...


U-Boot 2010.06-svn (Dec 28 2015 - 10:42:45)[V1.2.1]

Protected at offset: 0x0, size:0x40000 Protection status:[0x22f]=>[0x22f].
Hit ctrl+u to stop autoboot: 0
Mounting yaffs2 mount point/partnum: nand/0
Configures yaffs mount nand success!
Copy /nand/uImage to 0x42000000... [DONE]
timeout for link [4999]!
MAC: 18-68-CB-96-B6-63
|NUL ethaddr| TFTP server not found
## Booting kernel from Legacy Image at 42000000 ...
Verifying Checksum ... OK
Loading Kernel Image ... OK
OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.

Is the 'Booting from legacy' normal/expected?
 
Last edited:
That transcript looks normal - almost identical to one I just compared with for a 9632.
I'd have expected the device to restart OK.
It's a puzzle.

John Williamson said:
Is the 'Booting from legacy' normal/expected?
Click to expand...
Yes, from what I've seen.
From the DS-9632NI-I8
Code: 
Press ENTER key to reboot
resetting ...


U-Boot 2010.06-svn (Aug 14 2015 - 14:50:25)

Hit ctrl+u to stop autoboot:  0
timeout for link [4442]!
yaffs: Mounting /nand
yaffs: restored from checkpoint
Copy /nand/uImage to 0x42000000...      [DONE]
MAC:   4C-BD-8F-9C-7D-B8
|NUL ethaddr| TFTP server not found
## Booting kernel from Legacy Image at 42000000 ...
   Verifying Checksum ... OK
   Loading Kernel Image ... OK
OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
[    2.616685] init(1) called reboot syscall, cmd: 0x0.
Thu Jan  1 00:00:02 UTC 1970

Starting udev:      [ OK ]
bootpart :0
[    6.572335] libphy: 1:07 - Link is Up - 1000/Full
 
jaxpher said:
good day everyone

setenv ';update'
setenv '; '

setenv in not working
any solution fot this?
HKVS $



U-Boot 2019.04 (Nov 20 2021 - 18:35:17 +0800), Build: jenkins-Backend-BSP-CCI-4941
Click to expand...
Hi, I have this same issue, HKVS $ prompt is not responding to any the upgrade commands setenv bootcmd ';update' or setenv ';update'
Does anybody know how the solution? Any help is greatly appreciated.
 
alastairstevenson said:
I don't know if it's case-sensitive - but if it doesn't get you to the bootloader prompts, use a lower-case b

Then use either
printenv
or if that is ignored
setenv ';printenv'

and check out the values shown against
serverip
ipaddr
These are what are used for the tftp updater, may be 192.168.1.128 instead of the old 192.0.0.128

If the firmware filesize is larger than 32MB, the Hikvision tftp updater won't handle it, in which case either use a standard tftp server and the command :
setenv ';update'

or the Scott Lamb tftp updater Python2 clone :
github.com

GitHub - scottlamb/hikvision-tftpd: Unbrick a Hikvision device (NVR or camera) via TFTP

Unbrick a Hikvision device (NVR or camera) via TFTP - scottlamb/hikvision-tftpd
github.com github.com
Click to expand...
Hi
how should i use this tftp python for updating?
 
Succesfull upgrade


DVR DS-7216HGHI-K1(S)、DS-7216HGHI-K2(S)

model K72HGH Turbo 4.0

firware update V4.30.120_200630

Upgrade using Python 2.7 and the script hikvision_tftpd.py

Prolific interface

Windows driver PL23XX_Prolific_DriverInstaller_v408, windows 10


Putty log


U-Boot 2010.06-svn31947 (Mar 25 2019 - 14:02:13)

Hit ctrl+u to stop autoboot: 0
HKVS $ setenv ';update'
using update v3...
### CRAMFS load complete: 3168536 bytes loaded to 0x82000000
the uImage support update_v3.
Verifying RSA ... OK
## Booting kernel from Legacy Image at 82000000 ...
Loading Kernel Image ... OK
OK

Starting kernel ...

[ 2.022804] init(1) called reboot syscall, cmd: 0x0.
Thu Jan 1 00:00:02 UTC 1970

mv: can't rename 'ubi*': No such file or directory
Starting udev: [ OK ]

This program will download and upgrade software.
***
  • ATTENTION!! PLEASE READ THIS NOTICE CAREFULLY! *
  • Don't reset machine,or anything that interrupt it. *
  • The upgrade process must finish in 10 minutes! *
  • If this program fails,machine might be unusable, *
  • and you will need to reflash again. *
  • If you find this too risky,power off machine now. *
***


waiting for net_link [10]...
waiting for net_link [9]...
[ 5.036233] hi_gmac_v200 100a0000.ethernet eth0: Link is Up - 100Mbps/Full - flow control rx/tx
ftp server not exit[-111]!

tftp transmit over,file size[8192][ 0.008 MB].

ftp server not exit[-111]!
################################ [ 8.000 MB]
############################
tftp transmit over,file size[15794540][15.064 MB].
download succeed!
[cramfs.img ]: offset is 108 size is 15794176
RSA verifying ... OK
cramfs.img checkSum ok !

***
  • ATTENTION!! PLEASE READ THIS NOTICE CAREFULLY ! *
  • Don't power off or anything that interrupt it ! *
  • The upgrade process will finish in 3 minutes ! *
  • If this program fails, machine might be unusable ! *
***

Erasing cfg file ... Done
Writing ...
|##################################################| 100%
Done
Checking ...
|##################################################| 100%
Done
Update successfully !
Press ENTER key to reboot
 
  • Like
Reactions: Sam Sam
i have a DS-2CD2542FWD-IWS20161125BBWR685297048 plugged into a tp link extender and it goes "Network Timeout" even though i have internet on my laptop
 
John Williamson said:
I've just tried the latest V3 (3.4.109) for the model but just get the same result - frozen at 'booting the kernel'. I've installed so many Hik NVRs in the last 10 years and never had a failure (other than PSUs) so this is the first time I've had to resort to flashing the firmware this way.
Click to expand...
Greetings again! I don't know if you know or maybe know other people who do know about the subject. The point is that I have the same camera as the one shown in your publication and I would like to know if you know of any program to view the videos from the memory, not directly on the camera, but by removing the SD memory and viewing it on the PC. Since the files seem to be encrypted and it tells me that I must format the memory, but if I return it to the camera I can see the videos in (ICSEE OR VMS app. Before I used this program (General_DiskPlayer_v1.0.1 from Xmeye), but now It doesn't work for me to view the files directly from the memory or PC. I think maybe the ICSEE program or app has an option to remove that encryption, right?
 
jote29 said:
Succesfull upgrade


DVR DS-7216HGHI-K1(S)、DS-7216HGHI-K2(S)

model K72HGH Turbo 4.0

firware update V4.30.120_200630

Upgrade using Python 2.7 and the script hikvision_tftpd.py

Prolific interface

Windows driver PL23XX_Prolific_DriverInstaller_v408, windows 10


Putty log


U-Boot 2010.06-svn31947 (Mar 25 2019 - 14:02:13)

Hit ctrl+u to stop autoboot: 0
HKVS $ setenv ';update'
using update v3...
### CRAMFS load complete: 3168536 bytes loaded to 0x82000000
the uImage support update_v3.
Verifying RSA ... OK
## Booting kernel from Legacy Image at 82000000 ...
Loading Kernel Image ... OK
OK

Starting kernel ...

[ 2.022804] init(1) called reboot syscall, cmd: 0x0.
Thu Jan 1 00:00:02 UTC 1970

mv: can't rename 'ubi*': No such file or directory
Starting udev: [ OK ]

This program will download and upgrade software.
***
  • ATTENTION!! PLEASE READ THIS NOTICE CAREFULLY! *
  • Don't reset machine,or anything that interrupt it. *
  • The upgrade process must finish in 10 minutes! *
  • If this program fails,machine might be unusable, *
  • and you will need to reflash again. *
  • If you find this too risky,power off machine now. *
***


waiting for net_link [10]...
waiting for net_link [9]...
[ 5.036233] hi_gmac_v200 100a0000.ethernet eth0: Link is Up - 100Mbps/Full - flow control rx/tx
ftp server not exit[-111]!

tftp transmit over,file size[8192][ 0.008 MB].

ftp server not exit[-111]!
################################ [ 8.000 MB]
############################
tftp transmit over,file size[15794540][15.064 MB].
download succeed!
[cramfs.img ]: offset is 108 size is 15794176
RSA verifying ... OK
cramfs.img checkSum ok !

***
  • ATTENTION!! PLEASE READ THIS NOTICE CAREFULLY ! *
  • Don't power off or anything that interrupt it ! *
  • The upgrade process will finish in 3 minutes ! *
  • If this program fails, machine might be unusable ! *
***

Erasing cfg file ... Done
Writing ...
|##################################################| 100%
Done
Checking ...
|##################################################| 100%
Done
Update successfully !
Press ENTER key to reboot
Click to expand...
Worked for me too !!!!!
My Hilook 216U-K2 had a boot loop after accidental update interruption1000091292.jpg
 
  • Like
Reactions: jote29 and alastairstevenson
Hello,
I'm trying to recover HiWatch DS-N308/2P(C) NVR (admin account damaged during firmware update and password recovery do not work now).
Connected COM port to USB-to-TTL as described (driver set up, 115200, 3 wires connected to according pins), but nothing can be shown on putty.
Port is open, but boot messages are not coming.
Am I doing something wrong?
Did someone try to connect this or similar NVR?
 
tangent said:
Nice write up, but I cry a little on the inside when people take screenshots of their computers with a digital camera. Next time try your print screen button or the windows snipping tool. Pro tip: Alt-print screen captures the current window only.

There are some other threads here on Hik tftp and password resets.
Click to expand...
Ho wooo is’t very great allá tha help
 
crankm said:
Hello,
I'm trying to recover HiWatch DS-N308/2P(C) NVR (admin account damaged during firmware update and password recovery do not work now).
Connected COM port to USB-to-TTL as described (driver set up, 115200, 3 wires connected to according pins), but nothing can be shown on putty.
Port is open, but boot messages are not coming.
Am I doing something wrong?
Did someone try to connect this or similar NVR?
Click to expand...
Are you sure that the COM port in putty is the same as the USB to TTL?
Make sure that:
TX on the NVR connected to TR on USB to TTL
TR on the NVR connected to TX on USB to TTL
Ground to Ground on both
 
Sam Sam said:
Are you sure that the COM port in putty is the same as the USB to TTL?
Make sure that:
TX on the NVR connected to TR on USB to TTL
TR on the NVR connected to TX on USB to TTL
Ground to Ground on both
Click to expand...
Thank you, bought another USB-to-TTL chip and it works now )

Probably, someone will need that in future )

HiWatch DS-N308 / 2P (C) NVR pins are the following:
Pin 1 (marked with triangle) = 3.3v
Pin 2 = RX
Pin 3 = TX
Pin 4 = GND
 
Last edited:
  • Like
Reactions: Sam Sam
crankm said:
Thank you, bought another USB-to-TTL chip and it works now )

Probably, someone will need that in future )

HiWatch DS-N308 / 2P (C) NVR pins are the following:
Pin 1 (marked with triangle) = 3.3v
Pin 2 = RX
Pin 3 = TX
Pin 4 = GND
Click to expand...
You are welcome
 
Hello everyone,
After the BIOS program for the Dahua ip cameras to define the MAC address and Serial no. with the TTL serial and the star button, I enter the boot and define the MAC and save the environment, it works,—- but in the case of the unv univeiw camera ipc2122LR3, after completing the BIOS program,
With the TTL serial with the star button and Control U, it does not enter the boot and I cannot define the new MAC address and at the end it asks for a login pass with the star button , which is still not possible to log in with the camera password and the password 12345, according to the image, how can I define the MAC for the unv ip camera with the TTL serial??? Thanks.
 

Attachments

  • IMG_3377.png
    IMG_3377.png
    1.9 MB · Views: 8
  • IMG_3378.png
    IMG_3378.png
    1.8 MB · Views: 8
Ashkan.shajari said:
Hello everyone,
After the BIOS program for the Dahua ip cameras to define the MAC address and Serial no. with the TTL serial and the star button, I enter the boot and define the MAC and save the environment, it works,—- but in the case of the unv univeiw camera ipc2122LR3, after completing the BIOS program,
With the TTL serial with the star button and Control U, it does not enter the boot and I cannot define the new MAC address and at the end it asks for a login pass with the star button , which is still not possible to log in with the camera password and the password 12345, according to the image, how can I define the MAC for the unv ip camera with the TTL serial??? Thanks.
Click to expand...
Show full version.
You need stop u-boot. At screen kernel started and you have another interface.
 
You must log in or register to reply here.
Top Bottom