HIKVISION NVR DS-7616NI-E2/8P, 4 day old Bricked

[sdearle]

I very much hope someone can help me here as I have tried many thing to get my new NVR working again.

Here is my situation;

I recently purchased this NVR and 4 Dome cameras from China (Alibaba, DSD Technology Co). I was told that they are genuine international versions (we will see). The NVR was working but it had an older firmware that didn't support the newer cameras I also purchased. I now regret that I updated the firmware (3.3.4) from the European version, all was going well until the NVR rebooted.

The NVR now boots to the Embedded NVR (HIKVISION) screen and beeps continually for about 30 seconds and then reboots and it all starts again!

The splash screen it stops on is in English and has the copyright information.



I have followed all the instructions using the HIKVISION tftpserv tool and changing my Ethernet port on my laptop to static 192.0.0.128, turning off firewall and virus scanner and disabling my WiFi. I have it running from my root directory and still I get nothing during the boot process from the NVR. It may not be getting fare enough through boot up?

This is as far as the firmware recovery tool gets "[2016-01-30 17:07:21] TFTP server[192.0.0.128] initialized".
I have let this reboot for more times than I care to mention.....The beeping is loud and very annoying after several days trying to resolve this issue:sad:

I have read through may forums including these, and tried may things without any luck, I am getting low on ideas now, so I need to ask for HELP!

Can people please, please, please help me in getting this now bricked 4 day old NVR back working again?

Very much appreciated for any assistance to help resolve.

 

[alastairstevenson]

Is your laptop running Windows 10? There have been some posts where this has been troublesome with the tftp updater tool.
If you have another PC available with Windows 7, that would be worth trying.
Another possibility is that the firewall may be blocking the access to the tftp server, though I do see you have it disabled. There was a post a while back where, strangely, even with it disabled it seemed to cause a problem.
You can check the firewall rules with 'Windows Firewall | Advanced Settings | Inbound Rules and look for any associated with 'tftpserve.exe'
The simplest way to set the rules is to delete all those already in place for tftpserve.exe, start the tftpserve.exe program, and when the Windows popup 'Windows has blocked ...' appears, tick the boxes for both public and private and click 'Allow'.
A last possibility is that Hikvision have changed the behaviour of the bootloader to no longer allow over-the-network tftp updates (they have removed the tftp updater from their websites), but I have not heard of that, though it would not surprise me. Perhaps others could comment. If so, a connection to the serial console on the main board would be needed.

 

[sdearle]

Hi alastairstevenson, my laptop is running Windows 10 but I did also read some people saying that they were having issues so I had an old laptop still running Windows 7 Pro so I tried and got the same result.

I did also check the Firewall rules and deleted 'tftpserve.exe' and reinstalled. I actually have several occurances of 'tftpserve.exe' in my Windows Firewall rules, as it seems to puts a new rule for each location I have run 'tftpserve.exe' from. ie Desktop and C:/root.

I have read about the serial console on the MB, its starting to look like my only way forward unless others have any ideas!

Thanks

 

[alastairstevenson]

Well, the serial console will certainly help find out what the problem is, and hopefully recover from it.
Are you familiar with how to do a network capture with a tool such as Wireshark? To see if the NVR is doing it's check for the tftp server?

There are some helpful posts on the forum here on the serial console about what to get and how to use it, you may have seen these already:
https://www.ipcamtalk.com/showthread.php/2666-UART-connection-to-recover-Hik-cameras?highlight=molex
These can be bought in various places for quicker delivery, eBay for example.
http://www.aliexpress.com/item/Micro-JST-ZH-1-5mm-Pitch-4-Pin-Female-connector-with-wire-and-Male-PCB-connector/1664241613.html
And the TTL to serial USB convertor.
http://www.ebay.co.uk/sch/sis.html?_nkw=USB+to+RS232/TTL+PL2303HX+Cable+COM+Module+Converter+Adapter+for+Arduino+TK&_id=331270424343&&_trksid=p2057872.m2749.l2658

 

[sdearle]

Thanks alastairstevenson, I have not used Wireshark before but I will start reading!

I have ordered both the USB to TTL and the Micro JST ZH 1.5mm Pitch 4-pin Female plugs/cables. (Now need to wait for them to arrive)

I have also found that I can ping 192.0.0.64 as the NVR boots to its splash screen and then start beeping until it reboots itself. But I still don't get anything on the tftp screen!

Thanks again for your help.

 

[alastairstevenson]

All I was thinking with doing a network capture was to find out if the NVR was sensing out its UDP 'probe' packet from 192.0.0.64 to 192.0.0.128 on startup, which would indicate that it's looking for the tftp server, but getting no response.
In which case your PC setup would be the problem area.
I didn't ask if you were using WiFi on both laptops. That usually causes problem with the tftp server.

*edit* But I see now that you said you'd disabled WiFi

 

[sdearle]

When I receive my serial cable plug and USB to TTL converter, will I be able to see the boot up of the NVR an stop the boot process an then reload firmware to fix my firmware issue?

Also as my NVR is Chinese with international firmware, will the serial output be in English or Chinese? If Chinese then that will be a issue!

thanks

 

[alastairstevenson]

The serial console will be in English - the Linux version!
With the caveat that your new NVR bootloader may behave differently from those I have seen, you should be able to interrupt it and do a manual firmware update.
You will also need a normal tftp server, not the Hikvision-specific one, this one works well: http://tftpd32.jounin.net/
And of course some firmware to try.

*edit* And of course, a copy of PuTTY : http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html

 

[sdearle]

Thanks, have you come across any instructions that I can use in the serial recovery and uploading the new firmware?

I have downloaded and installed all the tools, and I recieved the USB to TTL converter today.

Also do you have a firmware recomendation version that I should start with, and where I should get it? I believe I hade a version 4.4.3 originally on the NVR. I was told by DSD cctv (where I purchased the NVR from China) that it was a fully international English version, and the firmware could be downloaded from the European/US site for HIKVISION. However this is where I downloaded and installed the version that caused all my issues!

Thanks for all your assistance.

 

[alastairstevenson]

You're about to embark on an interesting or confusing or both journey, depending on your perspective on these things. It may not provide an immediate cure, some investigation is likely to be needed.
First you need to get the USB to TTL convertor working. Did you also receive the Molex connector?
Plug it in, find the COM port it's using. Windows Device Manager, Ports (COM and LPT).
Start PuTTY and create a serial profile, 115,200 baud rate, N,8,1 and save it with a meaningful name.
Now maybe a bit of trial and error.
If the wire colour and sequence and signal allocation is the same as this: http://www.aliexpress.com/item/Micro-JST-ZH-1-5mm-Pitch-4-Pin-Female-connector-with-wire-and-Male-PCB-connector/1664241613.html
and as this: http://www.ebay.co.uk/itm/USB-to-RS232-TTL-PL2303HX-Cable-Adapter-COM-Module-Converter-Adapter-for-Arduino-/331765852515?hash=item4d3ec92963
then
Red molex to black USB
Black molex to white USB
Yello molex to green USB
Don't connect white molex - it's power
If these connections are wrong, no harm will be done.
With the NVR power off, find the serial console connector on the main board and plug in the cable.
Power on the NVR, and hopefully there will be screen and screen of characters. If they look like normal printable characters, and not just random rubbish, all is well.

What I'd suggest, though, is some study of what is appearing on the console to try to determine the what the problem is.
In PuTTY there is a large screen rollback, and you can copy it to Notepad or similar to capture it. Click the icon at the top left of the PuTTY screen.
It would be interesting to take a look at that to see what clues there are.
You can zip it down and attach here as a file.

If you press return a few times you should get a # prompt.
Depending on what the firmware is doing - you may be able to use the 'getHardInfo' command to find out about the hardware, including the region.

That's probably enough for now.
Good luck!

 

[sdearle]

Here is a txt file of a Wireshark trace I did with the Ethernet port while the NVR booted up. It looks to me that nothing is sent from the NVR during this boot-up process.
View attachment Wireshark_output.txt

I have all the parts except the plug & cable for the connection to the motherboard. Its on the way but will be a few days away.

 

[alastairstevenson]

There are some ARP requests for the MAC address of 192.0.0.128 (your laptop) that could be the NVR starting it's probe - but no response, so it doesn't progress to showing it's IP address.

 

[sdearle]

I have finally got the serial port working through my USB TTL converter, and I can stop the boot-up.

I have tried uploading several versions of firmware but after they upload I get a error. I believe its a region error and i have tried several versions and have also tried using the hiktools05R1 to update the region, this seems to work but when i upload to the NVR I get an error regarding region.

I have attached a txt files that I dumped from my serial port comms. can you please help with this? i feel i am getting close to a solution...

View attachment Firmware upload.txt

 

[sdearle]

I also managed to get all the way through the uploading of firmware with the language flag changed from 1 (English) to 2 (Chinese). everything seemed to work until it asked to reboot, and then as it booted up I got a message....

!!!!!!your Device is illegal, please call factory!!!!!!

This kept repeating until I shut it down......

I feel like I am so close now, I just need a compatible firmware that's in English on a Chinese machine!

As i said in an earlier post, I believe I had 3.3.4 when I first got the NVR.

Help please.

 

[alastairstevenson]

Well done for getting the serial console access working.

!!!!!!!you Device is illegal, Please call factory!!!!!!
!!!!!!!you Device is illegal, Please call factory!!!!!!
!!!!!!!you Device is illegal, Please call factory!!!!!!
!!!!!!!you Device is illegal, Please call factory!!!!!!
!!!!!!!you Device is illegal, Please call factory!!!!!!
!!!!!!!you Device is illegal, Please call factory!!!!!!

I've seen this when applying US firmware to a CN NVR. Accompanied by annoying beeps in large numbers.

Looking at the PuTTY log, it seems there are a quite a few more integrity checks in place in the u-boot bootloader than there used to be.
It looks like the key to success will be finding the correct firmware version for your NVR, it's looking like the choice is narrower than it used to be.
It will likely not allow initial load of the older firmware which has less restrictions, and is usually needed as a pre-cursor to loading the CN firmware to making it stay in English.
But easy enough top experiment with.

The NVR was working but it had an older firmware that didn't support the newer cameras I also purchased. I now regret that I updated the firmware (3.3.4) from the European version, all was going well until the NVR rebooted.

There are a couple of CN firmware versions here: http://www1.hikvision.com/cn/download_more_699.html#prettyPhoto
Try the 78xx and 76xx - but they are newer than the 3.3.4 and will likely end up with CN menus.
Have you had any dialogue with the seller to see if they would send you a copy of what was originally installed?
So in terms of the original version of firmware, and the region of the NVR, do you know what the serial number was?

*edit*
By the way - you may have noticed that via the u-boot updater you don't need to set the PC IP address to 192.0.0.128, it can conveniently be left on your normal network range, you also specify a suitable value for the NVR as well. It will only use it during the update process.

 

[sdearle]

Thanks, I downloaded NVR_EXX_76 77 86_V3.4.0_150929.zip from the Chinese Hikvision site from you link. It all worked and I have attached the txt file of the boot-up.

Obviously the language is in Chinese and that is no good to me, however it shows that if we get the correct version of firmware in English I should be good!

Thanks again for you help.

View attachment Boot-up Chinese firmware.txt

 

[alastairstevenson]

That looks like a normal startup, so at least a step along the way.

 

[cenfl]

Just bricked a DS-7608NI-SE/P. Can I use a tftp server to re flash the firmware or will I need to use serial bus?

Thank you for very useful thread.

 

[Del Boy]

And the multiple thread spamming continues... have you read this?

 

[SergSV]

Dear all!
I updated it with the wrong firmware and ... came to this page.

I read everything on this page carefully several times already.
I bought a USB TTL 2032
Running different TFTP

However, when I connect over the serial port from putty or TeraTerm, I receive an error that you did not write about here
"SysRq: Emergency Remount R / O"

And after I click Ctrl+U I can not enter any commands, I can only see with any click
"[root @ dvrdvs /] # hSysRq: HELP: show-ps-info (0) hik_thread_info_dump (1) hik_show_interrupts-info (2) kill-all- tasks (I) thaw-filesystems (J) saK show-memory-usage (M) nice-all-RT-tasks (N) show-registers (P) show-all-timers (Q) unRaw Sync show-task-states (T) Unmount show-blocked-tasks (W)
eSysRq: HELP: show-ps-info (0) hik_thread_info_dump (1) hik_show_interrupts-info (2) kill-all-tasks (I) thaw-filesystems (J) saK show-memory-usage (M) nice-all-RT -tasks (N) show-registers (P) show-all-timers (Q) unRaw Sync show-task-states (T) Unmount show-blocked-tasks (W)
"
if I don't press Ctrl+U I see
!!!!!!!you Device is illegal, Please call factory!!!!!!

Log in attache

That's all (((
Please help!