Hikvision NVR DS-7804N-E1/4P Bricked

[bixpii]

Hello, i have NVR DS-7804N-E1/4P bricked when i flash wrong firmware DS-7604NI for it. So now it only boot to Logo then bip bip and auto restart. I tried flash TFTP very many time by set IP of my PC to 192.0.0.128 / subnet 255.255.255.0 and turn firewall is off. But no thing flashable although i can ping to 192.0.0.64. I have read a topic, it talk TFTP had locked in DS-7804N, it right? If can't by TFTP, can i use Raspberry Pi 3 or Usb FT232RL to serial it? I only have Raspberry and USB FT232RL Thanks you so much!!

 

[alastairstevenson]

Hello, i have NVR DS-7804N-E1/4P bricked when i flash wrong firmware DS-7604NI for it

Yes, that's a Chinese NVR, it will brick with the '15-beep bootloop' when flashed with EN/ML firmware.
If you have a TTL serial (not RS232) interface, and if the 'bootpara' data is in plaintext, not encoded, you may be in luck with this method :

How to - Fix your 15-beep-bootloop Hikvision DS-76xxN-Ex NVR, or convert to EN and make it updatable

Here is a worked example of how to permanently change a Hikvision China language DS-76xxN-Ex NVR to an EN language device that will then take the stock EN/ML firmware. I've used a few Hikvision CN NVRs, bought at low cost off Aliexpress, and typically installed 'hacked to English' firmware to...

ipcamtalk.com

 

[bixpii]

Thankyou for reply me. Can i ask you about USB serial? Can i use Raspberry Pi or FT232RL to connect serial in NVR? And which pins in NVR will connect to USB? (It has 4 pins and i don't know which pins to connect? Thanks

 

[alastairstevenson]

Can i use Raspberry Pi or FT232RL to connect serial in NVR?

Yes, provided that the device generates TTL-level signals.
These are around 0 to +3v which is different from the levels of a 'classic' RS232 interface.

Below is an example of a Hikvision serial console connector, in this case on a DS-7604-K1/4P
The location and orientation of the connector on other NVRs and cameras will vary.
Note carefully that the row of 4 pins is slightly offset away from the centre line of the connector.
That is the way to correctly determine the order of the pins.

Connection as follows :
GND on the NVR to GND on the USB to serial convertor
TX on the NVR to RX on the USB to serial convertor
RX on the NVR to TX on the USB to serial convertor
Do not connect VCC.

Baud rate 115,200 with 8 bits no parity.
PuTTY works well as a serial terminal.

 

[bixpii]

Thankyou @alastairstevenson , i can serial to it already but i can't stop u-boot use command ctrl + u. It not stop! I try very many time but not work!



U-Boot 2010.06-svn (Aug 15 2015 - 15:18:43)

Protected at offset:0,size:20000 Protection status:[0xf88]=>[0xf8b].
Hit ctrl+u to stop autoboot: 0
### CRAMFS load complete: 3183432 bytes loaded to 0x80400000
timeout for link [4999]!
## Booting kernel from Legacy Image at 80400000 ...
Loading Kernel Image ... OK
OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
init started: BusyBox v1.16.1 (2016-06-29 13:49:45 CST)
Starting udev: [ OK ]
Wed Nov 14 14:44:15 UTC 2018
----------<1> tar guir webs ----------
----------<2> show logo ----------
show logo Wed Nov 14 14:44:25 UTC 2018
mv: can't rename '/home/app/exec/pppd': No such file or directory
mv: can't rename '/home/app/exec/pppoe': No such file or directory
mv: can't rename '/home/app/exec/ss': No such file or directory
mv: can't rename '/home/app/exec/dropbear': No such file or directory
mv: can't rename '/home/app/exec/dropbearkey': No such file or directory
/home/start.sh: line 29: dropbearkey: not found
chmod: /usr/bin/dvrCmd/dvrtools: No such file or directory
----------<3> load hisi sdk ----------
The system mem size is 0x1
/
load 3535 ok
----------<4> del no use res ----------
mv: can't rename '/home/app/res/adAudio.jpg': No such file or directory
/home/start.sh: line 79: ./pppoed: not found
iSCSI daemon with pid=914 started!!!! the device is not toe !!!


BusyBox v1.16.1 (2016-06-29 13:49:45 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

BusyBox v1.2.1 Protect Shell (psh)
Enter 'help' for a list of davinci system commands.

# DDR cpld.sys.bits.ddr_bitw : 1
fun:hisi_3535_get_dev_hard_info, line:2354 * no alarm board*** *
!!!!!!!you Device is illegal, Please call factory!!!!!!
!!!!!!!you Device is illegal, Please call factory!!!!!!
!!!!!!!you Device is illegal, Please call factory!!!!!!
!!!!!!!you Device is illegal, Please call factory!!!!!!
!!!!!!!you Device is illegal, Please call factory!!!!!!
!!!!!!!you Device is illegal, Please call factory!!!!!!
!!!!!!!you Device is illegal, Please call factory!!!!!!
!!!!!!!you Device is illegal, Please call factory!!!!!!
!!!!!!!you Device is illegal, Please call factory!!!!!!
!!!!!!!you Device is illegal, Please call factory!!!!!!
▒

 

[alastairstevenson]

i can serial to it already but i can't stop u-boot use command ctrl + u.

You need to keep Control-U pressed so that it auto-repeats before you power on the NVR.

 

[bixpii]

I tried but not work for me! Try in another PC also that

 

[bixpii]

Seem as my serial port different. Can you help me detect which is GND, TX and RX in this board? RL 21 RL23 RL 24 RL22?
Thankyou

 

[alastairstevenson]

I don't think the serial port will be different.
As a quick test, disconnect the adaptor from the NVR, connect the adapter TX to RX and confirm that the characters you type are echoed.
Also try your other serial TTL adapter.

 

[Squish]

Seem as my serial port different. Can you help me detect which is GND, TX and RX in this board? RL 21 RL23 RL 24 RL22?
Thankyou
View attachment 55767

I have the same board as you. The pin furthest to the left has continuity with the chassis so that is most likely the ground pin.