Hikvision NVR OEM version Upgradable?

DanITman

n3wb
Joined
Apr 21, 2017
Messages
7
Reaction score
2
Hey guys....trying to upgrade an ebay find. I believe its a DS-7608NI-I2-8P but it actually has a different model in the firmware. It doesn't say Hikvision on the front instead it just says NVR. I've attempted to upgrade the firmware a couple times and it just fails. I finally got UART access to see what the error is. Here it is:

IMG_1967.jpg


I need to upgrade to support some special API endpoints for home automation. See here:


Any help is greatly appreciated.
 

Attachments

DanITman

n3wb
Joined
Apr 21, 2017
Messages
7
Reaction score
2
The model I included is the correct model for hikvision. Its an off brand so the model is weird and doesn't yield many google results.

It came with a firmware and I don't have the firmware file. I've asked the ebay seller if he has it so I can unpack it.

I included a link to the firmware page I've attempted to use.
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,930
Reaction score
6,778
Location
Scotland
I included a link to the firmware page I've attempted to use.
Sorry, I hadn't noticed that, I assumed the page was all about Control4.
The devclass for that firmware is 61, typical for the I-series.
Your screenshot of the update fail suggests the NVR has a devclass of 49 so it might be designated as a different model.

You might just get some more info in a couple of ways :
When you interrupt the bootloader with Control-U, use 'b' at the resulting update prompt.
At the bootloader use printenv to list the environment variables.

If the web GUI allows SSH to be enabled under Security settings -
See if you can establish an SSH session and use the command getHardInfo and see if it yields any info.
The command dmesg might also have some model clues embedded in it.
 

DanITman

n3wb
Joined
Apr 21, 2017
Messages
7
Reaction score
2
Ok, I was able to dump dmesg and printevn and getHardinfo. I was not able to enable ssh but having the UART it ended up printing out the getHardInfo. I could also send limited commands and was able to get the rest. I also pulled this value that was printed on the board DS-80242 Rev 2.0

Code:
getHardInfo:
Start at 2022-01-19 19:44:56
Serial NO :0820200515CCRRE42089859WCVU 
V4.1.15 build 190305
softBase:/Platform/trunk:0
KernelVersion: V1.0.0 build 180914
dspSoftVersion: V5.0 build 190215
codecVersion: V5.0 build 190215
hardwareVersion = 0x0
encodeChans = 0
decodeChans = 8
alarmInNums = 4
alarmOutNums = 1
flashsize = 0x1
ramSize = 0x80000000
networksNums = 1
language = 1
devType:NR32P8-8I/4S
bootPartition = 1
randomCode = SBNTYJ
operationCode = 
biosVersion =
dmesg just the first part to identify CPU

Code:
[    0.000000] Booting Linux on physical CPU 0x0
[    0.000000] Linux version 3.10.0_hi3536 (zhangyi23@Cpl-Backend-BSP) (gcc version 4.8.3 20131202 (prerelease) (Hisilicon_v400) ) #14 SMP Fri Sep 14 19:28:51 CST 2018
[    0.000000] CPU: ARMv7 Processor [411fc0e1] revision 1 (ARMv7), cr=10c53c7d
[    0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
[    0.000000] Machine: hi3536
[    0.000000] cpldinfo offset[0x8e000], size[0x100].
[    0.000000] Ignoring unrecognised tag 0x484b0002
[    0.000000] Ignoring unrecognised tag 0x484b0004
[    0.000000] Ignoring unrecognised tag 0x484b0003
[    0.000000] Ignoring unrecognised tag 0x484b0005
[    0.000000] [HKBSP]no_a7:0.
[    0.000000] Add memory 0x20000000@0x40000000
[    0.000000] Add memory2 0x27c00000@0x64000000
[    0.000000] HIKBASE version ##24967[kernel:24583] v2.1.0 build 2018-9-14
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,930
Reaction score
6,778
Location
Scotland
It might be interesting to know if @Bizentech succeeded in loading Hikvision firmware to the NR32P8-8 NVR, which was thought to be the DS-7608NI-K2/8P model.
Though the initial problem was the 32MB filesize limit of the old Hikvision tftp updater, which can be got round by either using Scott Lamb's Python clone, or hooking up to the serial console and using a standard tftp server.

 

DanITman

n3wb
Joined
Apr 21, 2017
Messages
7
Reaction score
2
It might be interesting to know if @Bizentech succeeded in loading Hikvision firmware to the NR32P8-8 NVR, which was thought to be the DS-7608NI-K2/8P model.
Though the initial problem was the 32MB filesize limit of the old Hikvision tftp updater, which can be got round by either using Scott Lamb's Python clone, or hooking up to the serial console and using a standard tftp server.

I'm in serial console already. My first screenshot was an attempt to upload through tftp via the uart interface. The file gets there fine, it just fails on the update.

I think my model varies slightly from @Bizentech as mine contains acusense. I think its close though. I'm attempting to get the original firmware in hoping that leads to some custom firmware building.
 
Last edited:

DanITman

n3wb
Joined
Apr 21, 2017
Messages
7
Reaction score
2
Ok, I got the original firmware from the manufacture. It looks to be very close to the hikvision original. Here are the two header outputs.

The firmware they sent me.

Code:
Head decoded data(108b) :
00000000 53 57 4B 48 B5 5B 00 00 A0 01 00 00 08 00 00 00    SWKH.[..........
00000010 01 00 00 00 49 00 00 00 FF FF FF FF FF FF FF FF    ....I...........
00000020 FF FF FF FF FF FF FF FF FF FF FF FF 00 00 00 00    ................
00000030 00 07 00 00 06 06 16 20 01 00 00 00 00 00 00 00    ......▬ ........
00000040 75 49 6D 61 67 65 00 00 00 00 00 00 00 00 00 00    uImage..........
00000050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
00000060 A0 01 00 00 10 CE 82 00 B3 46 1E 41

Magic number :    0x484B5753
iHeaderCheckSum : 0x00005BB5 [23477]
iHeadTotalLen :   0x000001A0 [416]
iFileNum :        0x00000008 [8]
iLanguage :       0x00000001 [1] EN/ML
iDeviceClass :    0x00000049
iOEMCode :        0xFFFFFFFF
iFirmwareVer :    0xFFFFFFFF
iFeature:         0xFFFFFFFF
Calculated CheckSum :        0x00005BB5 [23477]
The original HIkvision Firmware

Code:
Head decoded data(108b) :
00000000 53 57 4B 48 3A 5F 00 00 A0 01 00 00 08 00 00 00    SWKH:_..........
00000010 01 00 00 00 49 00 00 00 FF FF FF FF FF FF FF FF    ....I...........
00000020 FF FF FF FF FF FF FF FF FF FF FF FF 00 00 00 00    ................
00000030 00 07 00 00 06 06 16 20 01 00 00 00 00 00 00 00    ......▬ ........
00000040 75 49 6D 61 67 65 00 00 00 00 00 00 00 00 00 00    uImage..........
00000050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
00000060 A0 01 00 00 78 E4 82 00 C2 79 30 41

Magic number :    0x484B5753
iHeaderCheckSum : 0x00005F3A [24378]
iHeadTotalLen :   0x000001A0 [416]
iFileNum :        0x00000008 [8]
iLanguage :       0x00000001 [1] EN/ML
iDeviceClass :    0x00000049
iOEMCode :        0xFFFFFFFF
iFirmwareVer :    0xFFFFFFFF
iFeature:         0xFFFFFFFF
Calculated CheckSum :        0x00005F3A [24378]
The only differences I can find is the very top of the header. (Besides the checksum)

00000000 53 57 4B 48 3A 5F
 
Top