Hikvision NVR DS-7804N-E1/4P Bricked

bixpii

n3wb
Joined
Feb 14, 2020
Messages
13
Reaction score
2
Location
hai duong
Hello, i have NVR DS-7804N-E1/4P bricked when i flash wrong firmware DS-7604NI for it. So now it only boot to Logo then bip bip and auto restart. I tried flash TFTP very many time by set IP of my PC to 192.0.0.128 / subnet 255.255.255.0 and turn firewall is off. But no thing flashable although i can ping to 192.0.0.64. I have read a topic, it talk TFTP had locked in DS-7804N, it right? If can't by TFTP, can i use Raspberry Pi 3 or Usb FT232RL to serial it? I only have Raspberry and USB FT232RL :( Thanks you so much!!
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
14,627
Reaction score
5,627
Location
Scotland
Hello, i have NVR DS-7804N-E1/4P bricked when i flash wrong firmware DS-7604NI for it
Yes, that's a Chinese NVR, it will brick with the '15-beep bootloop' when flashed with EN/ML firmware.
If you have a TTL serial (not RS232) interface, and if the 'bootpara' data is in plaintext, not encoded, you may be in luck with this method :
 

bixpii

n3wb
Joined
Feb 14, 2020
Messages
13
Reaction score
2
Location
hai duong
Thankyou for reply me. Can i ask you about USB serial? Can i use Raspberry Pi or FT232RL to connect serial in NVR? And which pins in NVR will connect to USB? (It has 4 pins and i don't know which pins to connect? Thanks
FT232RL-FT232-FTDI-USB-to-TTL-3.jpg_350x350.jpg
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
14,627
Reaction score
5,627
Location
Scotland
Can i use Raspberry Pi or FT232RL to connect serial in NVR?
Yes, provided that the device generates TTL-level signals.
These are around 0 to +3v which is different from the levels of a 'classic' RS232 interface.

Below is an example of a Hikvision serial console connector, in this case on a DS-7604-K1/4P
The location and orientation of the connector on other NVRs and cameras will vary.
Note carefully that the row of 4 pins is slightly offset away from the centre line of the connector.
That is the way to correctly determine the order of the pins.

Connection as follows :
GND on the NVR to GND on the USB to serial convertor
TX on the NVR to RX on the USB to serial convertor
RX on the NVR to TX on the USB to serial convertor
Do not connect VCC.

Baud rate 115,200 with 8 bits no parity.
PuTTY works well as a serial terminal.

1581951574586.jpeg
 

bixpii

n3wb
Joined
Feb 14, 2020
Messages
13
Reaction score
2
Location
hai duong
Thankyou @alastairstevenson , i can serial to it already but i can't stop u-boot use command ctrl + u. It not stop! I try very many time but not work!

Ảnh chụp Màn hình 2020-02-17 lúc 10.46.02 CH.jpg

U-Boot 2010.06-svn (Aug 15 2015 - 15:18:43)

Protected at offset:0,size:20000 Protection status:[0xf88]=>[0xf8b].
Hit ctrl+u to stop autoboot: 0
### CRAMFS load complete: 3183432 bytes loaded to 0x80400000
timeout for link [4999]!
## Booting kernel from Legacy Image at 80400000 ...
Loading Kernel Image ... OK
OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
init started: BusyBox v1.16.1 (2016-06-29 13:49:45 CST)
Starting udev: [ OK ]
Wed Nov 14 14:44:15 UTC 2018
----------<1> tar guir webs ----------
----------<2> show logo ----------
show logo Wed Nov 14 14:44:25 UTC 2018
mv: can't rename '/home/app/exec/pppd': No such file or directory
mv: can't rename '/home/app/exec/pppoe': No such file or directory
mv: can't rename '/home/app/exec/ss': No such file or directory
mv: can't rename '/home/app/exec/dropbear': No such file or directory
mv: can't rename '/home/app/exec/dropbearkey': No such file or directory
/home/start.sh: line 29: dropbearkey: not found
chmod: /usr/bin/dvrCmd/dvrtools: No such file or directory
----------<3> load hisi sdk ----------
The system mem size is 0x1
/
load 3535 ok
----------<4> del no use res ----------
mv: can't rename '/home/app/res/adAudio.jpg': No such file or directory
/home/start.sh: line 79: ./pppoed: not found
iSCSI daemon with pid=914 started!!!! the device is not toe !!!


BusyBox v1.16.1 (2016-06-29 13:49:45 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

BusyBox v1.2.1 Protect Shell (psh)
Enter 'help' for a list of davinci system commands.

# DDR cpld.sys.bits.ddr_bitw : 1
fun:hisi_3535_get_dev_hard_info, line:2354 * no alarm board*** *
!!!!!!!you Device is illegal, Please call factory!!!!!!
!!!!!!!you Device is illegal, Please call factory!!!!!!
!!!!!!!you Device is illegal, Please call factory!!!!!!
!!!!!!!you Device is illegal, Please call factory!!!!!!
!!!!!!!you Device is illegal, Please call factory!!!!!!
!!!!!!!you Device is illegal, Please call factory!!!!!!
!!!!!!!you Device is illegal, Please call factory!!!!!!
!!!!!!!you Device is illegal, Please call factory!!!!!!
!!!!!!!you Device is illegal, Please call factory!!!!!!
!!!!!!!you Device is illegal, Please call factory!!!!!!
 

bixpii

n3wb
Joined
Feb 14, 2020
Messages
13
Reaction score
2
Location
hai duong
Seem as my serial port different. Can you help me detect which is GND, TX and RX in this board? RL 21 RL23 RL 24 RL22?
Thankyou
IMG_0537 2.jpg
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
14,627
Reaction score
5,627
Location
Scotland
I don't think the serial port will be different.
As a quick test, disconnect the adaptor from the NVR, connect the adapter TX to RX and confirm that the characters you type are echoed.
Also try your other serial TTL adapter.
 
Top