Hikvision DVR Password reset through firmware TFTP error

z0re

n3wb
Feb 5, 2020
15
0
UK
Hi,
I have a DS7608HUHI-K1 DVR which is password locked. I have tried to reset the password on the device using TFTP on IP 192.0.0.128 but the DVR does not request the file when turned on. I have then connected to the device using the 4 pin connection to force the device to request the firmware from the TFTP server. I press Ctrl + U at bootup and enter "setenv ';update'" the file is requested, but i get an error. The log is attached below. Has anyone ever come across this error before? Any way to resolve? I have tried the following commands to request the firmware

1)
setenv ipaddr 192.0.0.64
setenv serverip 192.0.0.128
setenv bootargs console=ttyS0,115200n8 root=/dev/ram0 rw initrd=0x42000000 init=/bin/sh
setenv bootcmd 'tftp 0x42000000 uImage; update'

2)
setenv bootcmd ';update'

3)
setenv ';update'

The file is being shown as sent on TFTP server but then timeout. I am trying to just remove the password, are there any commands which i can do this with? For example erase or format config section

Code:
U-Boot 2010.06-svn31947 (Jun 12 2019 - 19:49:58)

Hit ctrl+u to stop autoboot:  0
HKVS $
HKVS $ setenv ';update'
using update v3...
### CRAMFS load complete: 4415536 bytes loaded to 0x42000000
the uImage support update_v3.
   Verifying RSA ... OK
## Booting kernel from Legacy Image at 42000000 ...
   Loading Kernel Image ... OK
OK

Starting kernel ...

[    4.243102] init(1) called reboot syscall, cmd: 0x0.
Thu Jan  1 00:00:04 UTC 1970

mv: can't rename 'ubi*': No such file or directory
Starting udev:      [ OK ]

This program will download and upgrade software.
*******************************************************
*  ATTENTION!! PLEASE READ THIS NOTICE CAREFULLY!     *
*  Don't reset machine,or anything that interrupt it. *
*  The upgrade process must finish in 10 minutes!     *
*  If this program fails,machine might be unusable,   *
*  and you will need to reflash again.                *
*  If you find this too risky,power off machine now.  *
*******************************************************
waiting for net_link [10]...
waiting for net_link [9]...
[    8.376346] hi_gmac_v200 100a0000.ethernet eth0: Link is Up - 1Gbps/Full - flow control rx/tx
ftp server not exit[-110]!

tftp transmit over,file size[8192][ 0.008 MB].








U-Boot 2010.06-svn31947 (Jun 12 2019 - 19:49:58)

Hit ctrl+u to stop autoboot:  0
HKVS $ setenv ';update'
using update v3...
### CRAMFS load complete: 4415536 bytes loaded to 0x42000000
the uImage support update_v3.
   Verifying RSA ... OK
## Booting kernel from Legacy Image at 42000000 ...
   Loading Kernel Image ... OK
OK

Starting kernel ...

[    4.853101] init(1) called reboot syscall, cmd: 0x0.
Thu Jan  1 00:00:04 UTC 1970

mv: can't rename 'ubi*': No such file or directory
Starting udev:      [ OK ]

This program will download and upgrade software.
*******************************************************
*  ATTENTION!! PLEASE READ THIS NOTICE CAREFULLY!     *
*  Don't reset machine,or anything that interrupt it. *
*  The upgrade process must finish in 10 minutes!     *
*  If this program fails,machine might be unusable,   *
*  and you will need to reflash again.                *
*  If you find this too risky,power off machine now.  *
*******************************************************
waiting for net_link [10]...
waiting for net_link [9]...
[    9.248205] hi_gmac_v200 100a0000.ethernet eth0: Link is Up - 1Gbps/Full - flow control rx/tx
ftp server not exit[-110]!
T T state machine action error[-5]
download firmware error!
Press ENTER key to reboot
 
Try ping from u-boot.
That tftp you use?
Original hikvision or ... ?
TFTP original hik use 512byte packet, alternative 8192byte.
TFTP original hik use some signature in some moment, tftp32/64 no use it.
Possible use python script tftp
 
You tftp server is not accessible 1st time.
Need repeat but your boot not like in prev version .
Try.
What in printenv?
Maybe need set mask and gate