A google search for the model number might allow a possible match to be made.
What's the model?
Maybe another forum member also has one.
How to - Fix your 15-beep-bootloop Hikvision DS-76xxN-Ex NVR, or convert to EN and make it updatable
- Thread starter alastairstevenson
- Start date
What's the model?
Maybe another forum member also has one.
Hi Alastair,
I've a DS-7716N-E4 / 16P believe to be running hacked EN firmware. I would like to upgrade the firmware on the unit to enable some missing features (like cloud backup and SNMP). Will the steps above work for my NVR? or is there an EN firmware already available for me apply?
Also, is this the serial TTL to USB converter that i need? FTDI FT232RL USB to Serial adapt module USB TO TTL RS232 Cable 6Pin T Pd3C_AU | eBay
Yes, if the bootparms flash area is not encoded as it is on the newer firmware.
That will brick the device with the '15-beep bootloop'.
That looks OK, if a bit on the pricey side.
Maybe search for a PL2303TA-based device.
You'll also need a wired connector - 4-pin 1.5mm JST ZH
Usually come in 10-packs.
That's not something I've see on that series.
Hi,
I need some help. I am stuck at the part of uploading the modified mtd. I get this error:
TFTP from server 192.0.0.128; our IP address is 192.0.0.64
Download Filename 'mtd1_part1_mod'.
Download to address: 0x80400000
Downloading: T T T T T T
TFTP error: 'Undefined error code' (0)
Starting again
I even try uploading the original mtd but that still gives me an error:
TFTP from server 192.0.0.128; our IP address is 192.0.0.64
Download Filename 'mtd1_part1_mod'.
Download to address: 0x80400000
Downloading: T T T T T T
TFTP error: 'Undefined error code' (0)
Starting again
I already tried disabling my firewall. Any ideas? I can download to my tftp server fine but uploading always fails.
I need some help. I am stuck at the part of uploading the modified mtd. I get this error:
TFTP from server 192.0.0.128; our IP address is 192.0.0.64
Download Filename 'mtd1_part1_mod'.
Download to address: 0x80400000
Downloading: T T T T T T
TFTP error: 'Undefined error code' (0)
Starting again
I even try uploading the original mtd but that still gives me an error:
TFTP from server 192.0.0.128; our IP address is 192.0.0.64
Download Filename 'mtd1_part1_mod'.
Download to address: 0x80400000
Downloading: T T T T T T
TFTP error: 'Undefined error code' (0)
Starting again
I already tried disabling my firewall. Any ideas? I can download to my tftp server fine but uploading always fails.
Thank you for the fast reply.
I've used tftp32 with server address 192.0.0.128/32 and the PC is set to the same address. Using the same settings I can download from the NVR fine but it always timesout when uploading.
My bad, I meant I'm already using 192.0.0.128/24.
I managed to get it working with a freshly installed Windows 10 laptop. Must have been my antivirus or something that was blocking me.
Hey, well done!
So was this a bricked CN NVR, or just a CN NVR that you wanted to convert?
Be aware that on the newer firmware, and I'm not sure exactly from which version, maybe 3.4.96, the kernel will automatically read / check / encrypt and re-write the bootpara area if it finds that it is in plaintext.
Thx! I needed to convert my CN NVR because it started to give me an error that one of my cameras has "no enough network bandwidth". I did use 3.4.98 firmware but as long as the NVR doesn't give me any issues I'm probably not gonna touch the firmware again.
On a fun sidenote, I didn't have the proper cables to interface with the NVR so I stripped the ends of some jumper wires and used those instead:
Attachments
Hi,
your method is interesting. Does it works with DS-7108N-SN bought on AliExpress?
I downloaded all the firmwares. Tryed to patch the language code but I have the 15 beeps after a tftp upgrade.
71xx_snp Chinese to English 3.13_b.150503.zip => Works
NVR_(71_4_8channel_SN)BL_ML_Eurpon_West_STD_V3.0.21_170417.zip patched with hiktools05R1 => Failure with 15 beeps
I am interested to make it works.
1/ How to do the step : - "Do the equivalent of the 'classic MTD hack' to change the language byte from 02 (CN) to 01 (EN) and fix up the checksum as needed. "
All the files are here :
drive.google.com
Do you have any helpful commands ?
Kind regards,
your method is interesting. Does it works with DS-7108N-SN bought on AliExpress?
I downloaded all the firmwares. Tryed to patch the language code but I have the 15 beeps after a tftp upgrade.
71xx_snp Chinese to English 3.13_b.150503.zip => Works
NVR_(71_4_8channel_SN)BL_ML_Eurpon_West_STD_V3.0.21_170417.zip patched with hiktools05R1 => Failure with 15 beeps
I am interested to make it works.
1/ How to do the step : - "Do the equivalent of the 'classic MTD hack' to change the language byte from 02 (CN) to 01 (EN) and fix up the checksum as needed. "
All the files are here :
DS-7108N-SN - Google Drive
drive.google.com
Do you have any helpful commands ?
Kind regards,
Sorry, but I don't know if that model saves the device signature data in the same way as the 76xxN-Ex series.
These are firmware files, as far as I can see, not an extract from a flash partition.
That is presumably 'hacked to English' firmware.
Good luck!
OK, I saw a winbond flash chip, I have the tools to dump it. I'll do that before doing the uboot stuff.
Here is the result of the u-boot stuff.
I also uploaded a spi dump of the Winbond flash on the google drive : DS7108N_3.13.bin
I also uploaded a spi dump of the Winbond flash on the google drive : DS7108N_3.13.bin
Code:
Now press [u/U] key to upgrade software: b
HKVS #
HKVS #
HKVS # printenv
bootdelay=1
baudrate=115200
ipaddr=192.0.0.64
serverip=192.0.0.128
gatewayip=192.0.0.1
netmask=255.255.255.0
bootfile=uImage
bootargs_end=255.255.255.0:Hik-eth:eth0:none
bootcmd=tftp 0x80400000 $(bootfile);bootm 0x80400000;
sec=tftp 0x80400000 uImage_sec;tftp 0x80800000 ramdisk.gz;bootm 0x80400000 0x80800000;
default=fsload 0x80400000 uImage;fsload 0x80800000 ramdisk.gz;bootm 0x80400000 0x80800000;
phyaddr0=0x1d
stdin=serial
stdout=serial
stderr=serial
verify=y
ethaddr=18:68:cb:84:ef:a8
bootargs=mem=188M console=ttyS1,115200
ver=U-Boot 2010.06-svn (Jul 22 2016 - 12:22:03)
Environment size: 579/4092 bytes
HKVS # sf read 0x80400000 0x10000 0x20000
HKVS # md 0x8041e000 80
8041e000: 444c5043 ffff8174 ffffffff cd00ffff CPLDt...........
8041e010: 1f006420 03b84e29 1291cc10 e8080000 d..)N..........
8041e020: ffff0200 ffffffff ffffffff ffffffff ................
8041e030: ffffffff ffffffff ffffffff ffffffff ................
8041e040: ffffffff ffffffff ffffffff ffffffff ................
8041e050: ffffffff ffffffff ffffffff ffffffff ................
8041e060: ffffffff ffffffff ffffffff ffffffff ................
8041e070: ffffffff ffffffff ffffffff ffffffff ................
8041e080: ffffffff ffffffff ffffffff ffffffff ................
8041e090: ffffffff ffffffff ffffffff ffffffff ................
8041e0a0: ffffffff ffffffff ffffffff ffffffff ................
8041e0b0: ffffffff ffffffff ffffffff ffffffff ................
8041e0c0: ffffffff ffffffff ffffffff ffffffff ................
8041e0d0: ffffffff ffffffff ffffffff ffffffff ................
8041e0e0: ffffffff ffffffff ffffffff ffffffff ................
8041e0f0: ffffffff ffffffff ffffffff ffffffff ................
8041e100: ffffffff ffffffff ffffffff ffffffff ................
8041e110: ffffffff ffffffff ffffffff ffffffff ................
8041e120: ffffffff ffffffff ffffffff ffffffff ................
8041e130: ffffffff ffffffff ffffffff ffffffff ................
8041e140: ffffffff ffffffff ffffffff ffffffff ................
8041e150: ffffffff ffffffff ffffffff ffffffff ................
8041e160: ffffffff ffffffff ffffffff ffffffff ................
8041e170: ffffffff ffffffff ffffffff ffffffff ................
8041e180: ffffffff ffffffff ffffffff ffffffff ................
8041e190: ffffffff ffffffff ffffffff ffffffff ................
8041e1a0: ffffffff ffffffff ffffffff ffffffff ................
8041e1b0: ffffffff ffffffff ffffffff ffffffff ................
8041e1c0: ffffffff ffffffff ffffffff ffffffff ................
8041e1d0: ffffffff ffffffff ffffffff ffffffff ................
8041e1e0: ffffffff ffffffff ffffffff ffffffff ................
8041e1f0: ffffffff ffffffff ffffffff ffffffff ................I'm speculating a bit - looking at the flash dump, it seems that the bootpara data (that includes language) is not stored in a flash partition but in a separate chip.
Thanks, How did you guess that ? There is no other flash chip on the board.
the getHardInfo gives the language code 2. Perhap's it derived from a hardwar spec ?
eval_cmd is getHardInfo
getHardInfo
path=/sbin:/usr/sbin:/bin:/usr/bin:/usr/bin/dvrCmd:/opt/dvrCmd
fullpath=/usr/bin/dvrCmd/getHardInfo
Start at 2020-09-25 09:38:09
Serial NO :0820170518AARR765572728WCVU
V3.0.13 build 150503
KernelVersion: V1.0.0 build 150327
dspSoftVersion: V5.0 build 150413
codecVersion: V5.0 build 080808
hardwareVersion = 0xcd00
encodeChans = 0
decodeChans = 8
alarmInNums = 0
alarmOutNums = 0
ataCtrlNums = 1
flashsize = 0x8
ramSize = 0x0
networksNums = 1
language = 2
devType
S-7108N-SN/P
bootPartition = 2
randomCode = IOUVHP
the getHardInfo gives the language code 2. Perhap's it derived from a hardwar spec ?
eval_cmd is getHardInfo
getHardInfo
path=/sbin:/usr/sbin:/bin:/usr/bin:/usr/bin/dvrCmd:/opt/dvrCmd
fullpath=/usr/bin/dvrCmd/getHardInfo
Start at 2020-09-25 09:38:09
Serial NO :0820170518AARR765572728WCVU
V3.0.13 build 150503
KernelVersion: V1.0.0 build 150327
dspSoftVersion: V5.0 build 150413
codecVersion: V5.0 build 080808
hardwareVersion = 0xcd00
encodeChans = 0
decodeChans = 8
alarmInNums = 0
alarmOutNums = 0
ataCtrlNums = 1
flashsize = 0x8
ramSize = 0x0
networksNums = 1
language = 2
devType
S-7108N-SN/PbootPartition = 2
randomCode = IOUVHP