Hikvision DVR Password reset through firmware TFTP error

z0re

n3wb
Joined
Feb 5, 2020
Messages
11
Reaction score
0
Location
UK
Hi,
I have a DS7608HUHI-K1 DVR which is password locked. I have tried to reset the password on the device using TFTP on IP 192.0.0.128 but the DVR does not request the file when turned on. I have then connected to the device using the 4 pin connection to force the device to request the firmware from the TFTP server. I press Ctrl + U at bootup and enter "setenv ';update'" the file is requested, but i get an error. The log is attached below. Has anyone ever come across this error before? Any way to resolve? I have tried the following commands to request the firmware

1)
setenv ipaddr 192.0.0.64
setenv serverip 192.0.0.128
setenv bootargs console=ttyS0,115200n8 root=/dev/ram0 rw initrd=0x42000000 init=/bin/sh
setenv bootcmd 'tftp 0x42000000 uImage; update'

2)
setenv bootcmd ';update'

3)
setenv ';update'

The file is being shown as sent on TFTP server but then timeout. I am trying to just remove the password, are there any commands which i can do this with? For example erase or format config section

Code:
U-Boot 2010.06-svn31947 (Jun 12 2019 - 19:49:58)

Hit ctrl+u to stop autoboot:  0
HKVS $
HKVS $ setenv ';update'
using update v3...
### CRAMFS load complete: 4415536 bytes loaded to 0x42000000
the uImage support update_v3.
   Verifying RSA ... OK
## Booting kernel from Legacy Image at 42000000 ...
   Loading Kernel Image ... OK
OK

Starting kernel ...

[    4.243102] init(1) called reboot syscall, cmd: 0x0.
Thu Jan  1 00:00:04 UTC 1970

mv: can't rename 'ubi*': No such file or directory
Starting udev:      [ OK ]

This program will download and upgrade software.
*******************************************************
*  ATTENTION!! PLEASE READ THIS NOTICE CAREFULLY!     *
*  Don't reset machine,or anything that interrupt it. *
*  The upgrade process must finish in 10 minutes!     *
*  If this program fails,machine might be unusable,   *
*  and you will need to reflash again.                *
*  If you find this too risky,power off machine now.  *
*******************************************************
waiting for net_link [10]...
waiting for net_link [9]...
[    8.376346] hi_gmac_v200 100a0000.ethernet eth0: Link is Up - 1Gbps/Full - flow control rx/tx
ftp server not exit[-110]!

tftp transmit over,file size[8192][ 0.008 MB].








U-Boot 2010.06-svn31947 (Jun 12 2019 - 19:49:58)

Hit ctrl+u to stop autoboot:  0
HKVS $ setenv ';update'
using update v3...
### CRAMFS load complete: 4415536 bytes loaded to 0x42000000
the uImage support update_v3.
   Verifying RSA ... OK
## Booting kernel from Legacy Image at 42000000 ...
   Loading Kernel Image ... OK
OK

Starting kernel ...

[    4.853101] init(1) called reboot syscall, cmd: 0x0.
Thu Jan  1 00:00:04 UTC 1970

mv: can't rename 'ubi*': No such file or directory
Starting udev:      [ OK ]

This program will download and upgrade software.
*******************************************************
*  ATTENTION!! PLEASE READ THIS NOTICE CAREFULLY!     *
*  Don't reset machine,or anything that interrupt it. *
*  The upgrade process must finish in 10 minutes!     *
*  If this program fails,machine might be unusable,   *
*  and you will need to reflash again.                *
*  If you find this too risky,power off machine now.  *
*******************************************************
waiting for net_link [10]...
waiting for net_link [9]...
[    9.248205] hi_gmac_v200 100a0000.ethernet eth0: Link is Up - 1Gbps/Full - flow control rx/tx
ftp server not exit[-110]!
T T state machine action error[-5]
download firmware error!
Press ENTER key to reboot
 

iTuneDVR

Pulling my weight
Joined
Aug 23, 2014
Messages
786
Reaction score
140
Location
Россия
Try ping from u-boot.
That tftp you use?
Original hikvision or ... ?
TFTP original hik use 512byte packet, alternative 8192byte.
TFTP original hik use some signature in some moment, tftp32/64 no use it.
Possible use python script tftp
 

z0re

n3wb
Joined
Feb 5, 2020
Messages
11
Reaction score
0
Location
UK
hi,
ping works
i use original tftp from hikvision. i did not use tftp32/64 or python script tftp
 

iTuneDVR

Pulling my weight
Joined
Aug 23, 2014
Messages
786
Reaction score
140
Location
Россия
You tftp server is not accessible 1st time.
Need repeat but your boot not like in prev version .
Try.
What in printenv?
Maybe need set mask and gate
 
Top