Hikvision DS-9664-i8 Firmware flush to regain admin access (some questions)

C

Control Freak

n3wb
Oct 2, 2019
15
3
California
Hi - currently trying to regain admin access for a client who has a DS-9664 and has long forgotten the admin password and dot pattern sequence. It's an RR region device, so Hikvision won't help either, and the email attached to the device isn't working for us either. We would like to add some new cameras and do some integration into Control4 for him.

Current firmware is : 4.22.005 Build 191208

So - I thought that I would attempt the TFTP method as a last resort. Then I realized that the 9664 has an RS-232 port. It looks like I can use the 'firmware flush' method published by Hik in their technical bulletin to reset everything - I'm not worried about a total factory reset if that's what has to happen.

Instructions here :
I've purchased this null modem RS232-USB cable from Amazon :
The NVR has been set up with an IP address in the 10.230.99 range, but it seems that I can set that to 192.0.0.64 during the firmware flush process.

Some questions :

  1. Is this the right cable to use ?
  2. Is the published Hik process usable for this device and this firmware, or are there some other tricks that I should be aware of ?
  3. Should I use LAN1 or LAN2 for the LAN connection ?
  4. Should I use the same firmware as currently installed, or do I go to an earlier or later version first ?
  5. Will the currently set IP address cause any problems ?
  6. When I search for firmware, both the US and EU site both return the same firmware for this device. Either NVR_K51_BL_ML_STD_V4.50.000_210125 (latest) or NVR_K51_BL_ML_STD_V4.22.005_191208 (current). Am I correct in assuming that there is no difference between the firmware on the two sites ?
  7. Any other advice ?
Thanks in advance.
 
As an Amazon Associate IPCamTalk earns from qualifying purchases.
Control Freak said:
Is this the right cable to use ?
Click to expand...
1. Yes, on the basis that it is really a null modem cable as described.
You'll find out very quickly as PuTTY will not show any output if the cable is a straight through.

Control Freak said:
Is the published Hik process usable for this device and this firmware, or are there some other tricks that I should be aware of ?
Click to expand...
2. The published guidance is normal and familiar for many Hikvision NVRs and should work OK for yours.

Control Freak said:
Should I use LAN1 or LAN2 for the LAN connection ?
Click to expand...
3. I believe LAN1 is what the bootloader uses.
You'll know soon enough, the connection will time out if it's the wrong port.
If so - just use the other one and retry the menu.

Control Freak said:
Should I use the same firmware as currently installed, or do I go to an earlier or later version first ?
Click to expand...
4. No - use the same firmware as is currently installed.

Control Freak said:
Am I correct in assuming that there is no difference between the firmware on the two sites ?
Click to expand...
5. To answer that question I'd have to unpack and analyse the result.
Probably best to use the one from the US site.

Control Freak said:
The NVR has been set up with an IP address in the 10.230.99 range, but it seems that I can set that to 192.0.0.64 during the firmware flush process.
Click to expand...
For convenience, just use the IP address that's already in use on the PC that the tftp server will be running on, and pick an unused IP address for the NVR to use for the install process.
It's only a transient requirement, it doesn't get saved.

The process will result in a full reset back to factory defaults, into the 'Inactive' state.
Use SADP to 'Activate' with your own strong password, then use that to change the IP address to what you want it to be.
And then the tedious job of a full re-configure.

One thing to be aware of - under the Storage | Storage Management menu, the NVR may well take 10s of minutes after the firmware update rebuilding the indexes on the HDDs. It should start this automatically.
Go to this menu to check the status, let it run it's course and don't power off until it's complete.
You can continue the reconfiguration while its progressing.

Good luck!


And just for interest, this is what you should see during the update process -

Code: 
Updating with the same firmware as is installed.

-----------------------------------------------




Please input ip address of device: 192.168.1.79
Please input ip address of upgrade server: 192.168.1.99
Confirm?(y/n): y
timeout for link [4999]!
MAC:   4C-BD-8F-9C-7D-B8
TFTP from server 192.168.1.99; our IP address is 192.168.1.79
Download Filename 'digicap.dav'.
Download to address: 0x40008000
Downloading: #################################################
done
Bytes transferred = 53313348 (32d7f44 hex)
uImage checkSum ok !
start.sh checkSum ok !
sys_app.tar.lzma checkSum ok !
gui_res.tar.gz checkSum ok !
webs.tar.lzma checkSum ok !
TX1_Version.bin checkSum ok !
RSA checkSum ok !
new_10.bin checkSum ok !
start to erase nand flash partition 0  start: 0x200000 end: 0x6200000 len: 0x6000000 ...
Erasing at 0x61e0000 -- 100% complete.
--- OK!
start to erase nand flash partition 1  start: 0x6200000 end: 0xC200000 len: 0x6000000 ...
Erasing at 0xc1e0000 -- 100% complete.
--- OK!
start to erase nand flash partition 2  start: 0xC200000 end: 0x10000000 len: 0x3E00000 ...
Erasing at 0xffe0000 -- 100% complete.
--- OK!

start to write files to partition 0...
yaffs: Mounting /nand
9-1.  write /nand/uImage len: 8837896
9-2.  write /nand/start.sh len: 8744
9-3.  write /nand/sys_app.tar.lzma len: 26404112
9-4.  write /nand/gui_res.tar.gz len: 11668312
9-5.  write /nand/webs.tar.lzma len: 6392208
9-6.  write /nand/TX1_Version.bin len: 40
9-7.  write /nand/RSA len: 24
9-8.  write /nand/new_10.bin len: 744
9-9.  write flag file /nand/version.bin len: 4
update partition 0 success!
save exit: isCheckpointed 1

start to write files to partition 1...
yaffs: Mounting /nand
9-1.  write /nand/uImage len: 8837896
9-2.  write /nand/start.sh len: 8744
9-3.  write /nand/sys_app.tar.lzma len: 26404112
9-4.  write /nand/gui_res.tar.gz len: 11668312
9-5.  write /nand/webs.tar.lzma len: 6392208
9-6.  write /nand/TX1_Version.bin len: 40
9-7.  write /nand/RSA len: 24
9-8.  write /nand/new_10.bin len: 744
9-9.  write flag file /nand/version.bin len: 4
update partition 1 success!
save exit: isCheckpointed 1
Press ENTER key to reboot
resetting ...


U-Boot 2010.06-svn (Aug 14 2015 - 14:50:25)

Hit ctrl+u to stop autoboot:  0
timeout for link [4442]!
yaffs: Mounting /nand
yaffs: restored from checkpoint
Copy /nand/uImage to 0x42000000...      [DONE]
MAC:   4C-BD-8F-9C-7D-B8
|NUL ethaddr| TFTP server not found
## Booting kernel from Legacy Image at 42000000 ...
   Verifying Checksum ... OK
   Loading Kernel Image ... OK
OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
[    2.616685] init(1) called reboot syscall, cmd: 0x0.
Thu Jan  1 00:00:02 UTC 1970
 
So - got everything hooked up and it connected. First time it got to 10MB and then hung up. Tried again and second time it got to 21 MB and hung up. Trying again now. Is this usual, or is it a sign that things are already bricked, or it's the wrong firmware ?
 
So - the third time it got to 47MB and hung up.

But... the fourth time, it got all the way there. Activated, password reset, and all details safely filed away. Thanks for the help.

It's a great unit from what I can see. Might even persuade me to upgrade to one of these at home. Does anyone know if you can use the two HDMI outputs simultaneously, but with one set to 1080 and the other to 4K ?

Just wondering if I dare to tempt fate and upgrade it to the latest firmware...
 
Do not tempt fate LOL in case it is a hacked version and you brick it! Since the client has no idea where it was bought, it could very well not be upgradable!
 
Maybe, but I wouldn't risk it. Especially since it isn't yours LOL. Unless you are getting paid by the hour LOL.
 
Control Freak said:
First time it got to 10MB and then hung up. Tried again and second time it got to 21 MB and hung up. Trying again now. Is this usual, or is it a sign that things are already bricked, or it's the wrong firmware ?
Click to expand...
That's not normal, and may indicate a network problem between the NVR and the PC.
Presumably it's a wired (not WiFi) connection?
Normally a transmission error (showing in thr progress bar as a 'T') would just give a short timeout and re-try, not hang up.
But maybe that's down to the specific tftp server in use.

Control Freak said:
It's an RR model. I thought that meant it could be upgraded with ML firmware.
Click to expand...
It does, you can use any of the newer Hikvision stock firmware with it.

wittaj said:
Do not tempt fate LOL in case it is a hacked version and you brick it! Since the client has no idea where it was bought, it could very well not be upgradable!
Click to expand...
It's not a hacked version - the OP has just applied the stock firmware in order to reset to defaults due to a lost password.

The early NVR 4.x firmware was a bit of a work in progress for a while, and if you look at the release notes Hikvision progressively added new useful features and improved performance and broadened the camera support.
Whilst I agree that in general, just updating firmware for no good reason can carry risks, for this specific model series there may be valid reasons to do so.
 
Control Freak said:
Does anyone know if you can use the two HDMI outputs simultaneously, but with one set to 1080 and the other to 4K ?
Click to expand...
I've not tried this - but the menu suggests it's possible :
1613988037261.png


And the menu also suggests the displays can be independently configured for content :
1613987945299.png
 

Attachments

  • 1613987801450.png
    1613987801450.png
    40.3 KB · Views: 2
Thanks - when I said 'hung up', I meant that it had given me a transmission error, and then timed out - never reconnected after the retry. I have a feeling it was something to do with the 'sleep' settings on my laptop, because after I plugged my laptop into mains power, the next attempt worked.

This machine has been unused for a long time - admin credentials were lost on a house move some time back apparently. But everything seems to be working - there are 4 HDD's in it which have now been reformatted, and I have 7 cameras working so far.

Thanks for the tip on the HDMI outputs - that's what it looks like to me too. Really useful feature for this project, as one HDMI output can go to a permanently displayed 1080 small monitor in the kitchen area, and the 4K output is going to a whole-home video distribution system. We will then tie it all in to a Control4 automation - we can use line crossing/intrusion smart events to trigger a camera feed onto any chosen TV and turn lights on/off etc.
 
  • Like
Reactions: alastairstevenson
That's great! Glad it worked out. Of course we all hear about the horror stories of folks bricking their devices, but there are a larger part that obviously upgrades with no problems.

Not many come here bragging that the update worked flawlessly LOL - we only hear about the bricked ones and how to fix it LOL.
 
Thanks - the RS232 port on the back definitely helped here for the original firmware flush.

Now I need to find some good value cameras to get this system finished up. What are people using for outdoor 2.8mm domes on Hik systems ? Are the cameras in the store on this site a good choice ?
 
Control Freak said:
What are people using for outdoor 2.8mm domes on Hik systems ?
Click to expand...
Check out the discussions on DORI and focal length. The forum search works well.
The wide field of view that 2.8mm gives does look good - but reduces the level of detail such that a subject must be pretty close for not just recognition but primarily identification. Assuming that's the use case for the camera install.
Too wide a field of view is a common initial mistake.
And you may be surprised by the comments on domes.

You'll no doubt get plenty feedback to your questions from helpful and knowledgeable forum members.
 
You must log in or register to reply here.
Top Bottom