How to - Fix your 15-beep-bootloop Hikvision DS-76xxN-Ex NVR, or convert to EN and make it updatable

[tomahawk]

I don't remember but the build date of the unit was 9/2015.

Below is the printout

Environment size: 456/4092 bytes
HKVS # setenv serverip 192.0.0.128
HKVS # setenv ipaddr 192.0.0.64
HKVS #
HKVS # sf probe 0
16384 KiB hi_sfc at 0:0 is now current device[4K erase supported]
HKVS #
HKVS # sf read 0x80400000 0x10000 0x20000

HKVS # md 0x8041e000 80
8041e000: a101b6ae 8f6e8ba4 7ce4b7f0 8876b1d8 ......n....|..v.
8041e010: 32854655 40e0e74d def020b7 2099b6c9 UF.2M..@. .....
8041e020: 4960fc37 8340dc43 a4b811b5 3043838a 7.`IC.@.......C0
8041e030: 2b12c6fd 6fbf1573 b3209f42 d3357b07 ...+s..oB. ..{5.
8041e040: db2fc8ce 24b01b5e b1c2219d 17ade9b8 ../.^..$.!......
8041e050: 61b0472f a660e482 9bc58df3 116ba1bf /G.a..`.......k.
8041e060: dfd9460d c36c14a5 4960fc37 8340dc43 .F....l.7.`IC.@.
8041e070: 4960fc37 8340dc43 4960fc37 8340dc43 7.`IC.@.7.`IC.@.
8041e080: 03168135 4358f453 d7bcc135 309da1e4 5...S.XC5......0
8041e090: 4960fc37 8340dc43 4960fc37 8340dc43 7.`IC.@.7.`IC.@.
8041e0a0: 4960fc37 8340dc43 4960fc37 8340dc43 7.`IC.@.7.`IC.@.
8041e0b0: 4960fc37 8340dc43 4960fc37 8340dc43 7.`IC.@.7.`IC.@.
8041e0c0: 4960fc37 8340dc43 66ee8c7c 688cd11b 7.`IC.@.|..f...h
8041e0d0: b48fb027 3d8ef48f 4960fc37 8340dc43 '......=7.`IC.@.
8041e0e0: 4960fc37 8340dc43 4960fc37 8340dc43 7.`IC.@.7.`IC.@.
8041e0f0: ea0e09a7 6d7ea5d3 4960fc37 8340dc43 ......~m7.`IC.@.
8041e100: ffff8d8f ffffffff ffffffff ffffffff ................
8041e110: ffffffff ffffffff ffffffff ffffffff ................
8041e120: ffffffff ffffffff ffffffff ffffffff ................
8041e130: ffffffff ffffffff ffffffff ffffffff ................
8041e140: ffffffff ffffffff ffffffff ffffffff ................
8041e150: ffffffff ffffffff ffffffff ffffffff ................
8041e160: ffffffff ffffffff ffffffff ffffffff ................
8041e170: ffffffff ffffffff ffffffff ffffffff ................
8041e180: ffffffff ffffffff ffffffff ffffffff ................
8041e190: ffffffff ffffffff ffffffff ffffffff ................
8041e1a0: ffffffff ffffffff ffffffff ffffffff ................
8041e1b0: ffffffff ffffffff ffffffff ffffffff ................
8041e1c0: ffffffff ffffffff ffffffff ffffffff ................
8041e1d0: ffffffff ffffffff ffffffff ffffffff ................
8041e1e0: ffffffff ffffffff ffffffff ffffffff ................
8041e1f0: ffffffff ffffffff ffffffff ffffffff ................
HKVS #
HKVS # tftp 0x80400000 mtd1_part1
timeout for link [5000]!
MAC: C4-2F-90-A3-26-8D
TFTP from server 192.0.0.128; our IP address is 192.0.0.64
Download Filename 'mtd1_part1'.
Download to address: 0x80400000
Downloading: #################################################
done
Bytes transferred = 131072 (20000 hex)
HKVS #
HKVS # md 0x8041e000 80
8041e000: a101b6ae 8f6e8ba4 7ce4b7f0 8876b1d8 ......n....|..v.
8041e010: 32854655 40e0e74d def020b7 2099b6c9 UF.2M..@. .....
8041e020: 4960fc37 8340dc43 a4b811b5 3043838a 7.`IC.@.......C0
8041e030: 2b12c6fd 6fbf1573 b3209f42 d3357b07 ...+s..oB. ..{5.
8041e040: db2fc8ce 24b01b5e b1c2219d 17ade9b8 ../.^..$.!......
8041e050: 61b0472f a660e482 9bc58df3 116ba1bf /G.a..`.......k.
8041e060: dfd9460d c36c14a5 4960fc37 8340dc43 .F....l.7.`IC.@.
8041e070: 4960fc37 8340dc43 4960fc37 8340dc43 7.`IC.@.7.`IC.@.
8041e080: 03168135 4358f453 d7bcc135 309da1e4 5...S.XC5......0
8041e090: 4960fc37 8340dc43 4960fc37 8340dc43 7.`IC.@.7.`IC.@.
8041e0a0: 4960fc37 8340dc43 4960fc37 8340dc43 7.`IC.@.7.`IC.@.
8041e0b0: 4960fc37 8340dc43 4960fc37 8340dc43 7.`IC.@.7.`IC.@.
8041e0c0: 4960fc37 8340dc43 66ee8c7c 688cd11b 7.`IC.@.|..f...h
8041e0d0: b48fb027 3d8ef48f 4960fc37 8340dc43 '......=7.`IC.@.
8041e0e0: 4960fc37 8340dc43 4960fc37 8340dc43 7.`IC.@.7.`IC.@.
8041e0f0: ea0e09a7 6d7ea5d3 4960fc37 8340dc43 ......~m7.`IC.@.
8041e100: ffff8d8f ffffffff ffffffff ffffffff ................
8041e110: ffffffff ffffffff ffffffff ffffffff ................
8041e120: ffffffff ffffffff ffffffff ffffffff ................
8041e130: ffffffff ffffffff ffffffff ffffffff ................
8041e140: ffffffff ffffffff ffffffff ffffffff ................
8041e150: ffffffff ffffffff ffffffff ffffffff ................
8041e160: ffffffff ffffffff ffffffff ffffffff ................
8041e170: ffffffff ffffffff ffffffff ffffffff ................
8041e180: ffffffff ffffffff ffffffff ffffffff ................
8041e190: ffffffff ffffffff ffffffff ffffffff ................
8041e1a0: ffffffff ffffffff ffffffff ffffffff ................
8041e1b0: ffffffff ffffffff ffffffff ffffffff ................
8041e1c0: ffffffff ffffffff ffffffff ffffffff ................
8041e1d0: ffffffff ffffffff ffffffff ffffffff ................
8041e1e0: ffffffff ffffffff ffffffff ffffffff ................
8041e1f0: ffffffff ffffffff ffffffff ffffffff ................
HKVS #
HKVS # sf erase 0x10000 0x20000

HKVS # sf write 0x80400000 0x10000 0x20000

HKVS # sf read 0x80400000 0x10000 0x20000

HKVS # md 0x8041e000 80
8041e000: a101b6ae 8f6e8ba4 7ce4b7f0 8876b1d8 ......n....|..v.
8041e010: 32854655 40e0e74d def020b7 2099b6c9 UF.2M..@. .....
8041e020: 4960fc37 8340dc43 a4b811b5 3043838a 7.`IC.@.......C0
8041e030: 2b12c6fd 6fbf1573 b3209f42 d3357b07 ...+s..oB. ..{5.
8041e040: db2fc8ce 24b01b5e b1c2219d 17ade9b8 ../.^..$.!......
8041e050: 61b0472f a660e482 9bc58df3 116ba1bf /G.a..`.......k.
8041e060: dfd9460d c36c14a5 4960fc37 8340dc43 .F....l.7.`IC.@.
8041e070: 4960fc37 8340dc43 4960fc37 8340dc43 7.`IC.@.7.`IC.@.
8041e080: 03168135 4358f453 d7bcc135 309da1e4 5...S.XC5......0
8041e090: 4960fc37 8340dc43 4960fc37 8340dc43 7.`IC.@.7.`IC.@.
8041e0a0: 4960fc37 8340dc43 4960fc37 8340dc43 7.`IC.@.7.`IC.@.
8041e0b0: 4960fc37 8340dc43 4960fc37 8340dc43 7.`IC.@.7.`IC.@.
8041e0c0: 4960fc37 8340dc43 66ee8c7c 688cd11b 7.`IC.@.|..f...h
8041e0d0: b48fb027 3d8ef48f 4960fc37 8340dc43 '......=7.`IC.@.
8041e0e0: 4960fc37 8340dc43 4960fc37 8340dc43 7.`IC.@.7.`IC.@.
8041e0f0: ea0e09a7 6d7ea5d3 4960fc37 8340dc43 ......~m7.`IC.@.
8041e100: ffff8d8f ffffffff ffffffff ffffffff ................
8041e110: ffffffff ffffffff ffffffff ffffffff ................
8041e120: ffffffff ffffffff ffffffff ffffffff ................
8041e130: ffffffff ffffffff ffffffff ffffffff ................
8041e140: ffffffff ffffffff ffffffff ffffffff ................
8041e150: ffffffff ffffffff ffffffff ffffffff ................
8041e160: ffffffff ffffffff ffffffff ffffffff ................
8041e170: ffffffff ffffffff ffffffff ffffffff ................
8041e180: ffffffff ffffffff ffffffff ffffffff ................
8041e190: ffffffff ffffffff ffffffff ffffffff ................
8041e1a0: ffffffff ffffffff ffffffff ffffffff ................
8041e1b0: ffffffff ffffffff ffffffff ffffffff ................
8041e1c0: ffffffff ffffffff ffffffff ffffffff ................
8041e1d0: ffffffff ffffffff ffffffff ffffffff ................
8041e1e0: ffffffff ffffffff ffffffff ffffffff ................
8041e1f0: ffffffff ffffffff ffffffff ffffffff ................
HKVS #
HKVS #
HKVS # reset
resetting ...

 

[alastairstevenson]

Do you remember what version of firmware was running on the NVR before the EN firmware update?

The reason for asking is that Hikvision implemented an 'anti-rollback' feature that would prevent earlier firmware versions being installed.
But attached is a version that should work OK.
For configuration management, the Batch Configuration Tool will work in English.

Batch Config Tool - Updates

ipcamtalk.com

But I'd expect that the NVR will object to EN cameras being connected.

 

[alastairstevenson]

Below is the printout

Very strange.
On the face of it, the sf erase and sf write commands are simply being ignored but sf read is OK.
One last suggestion - try the sf probe 0 command straight before the sf erase command.

 

[chadders2708]

Hi

I've been trying to do this on a DS-7732N-E4 that came to me 'bricked' after attempting to load EN/ML firmware but it also looks like the bootloader is encoded? (see attached)

Is it possible to fix ? or is there any 'hacked' firmware so I can get it running in English .. I have it working with Chinese Firmware but it would be easier with the menus in English

Many Thanks

Jon

 

[x3l4l3x]

i have DS-7832N-K2 with CN language i tried the instructions but there is a problem entering the sf command...
is there other way to change the language from CN to EN?

bootcmd=tftp 0x42000000 $(bootfile);bootm 0x42000000;
default=y2mount /nand;y2rdm /nand/uImage 0x42000000;
sec=tftp 0x42000000 Ky2015-1-H3536-uImage_sec;bootm 0x42000000;
bootdelay=1
baudrate=115200
ipaddr=192.0.0.64
serverip=192.0.0.128
gatewayip=192.0.0.1
netmask=255.255.255.0
bootfile=uImage
language=1
phyaddr1=7
mdio_intf=rgmii
bootargs=mem=1148M console=ttyS0,115200n8
ethaddr=f8:4d:fc:e9:f2:3f
stdin=serial
stdout=serial
stderr=serial
verify=y
ver=U-Boot 2010.06-svn20427 (Mar 09 2018 - 16:41:25)[V1.4.5]

Environment size: 513/4092 bytes
HKVS # sf probe 0
Unknown command 'sf' - try 'help'
HKVS #

 

[alastairstevenson]

Hikvision have removed 'sf' from the bootloader as it has proved too useful for modding activities.

 

[arunix]

Someone PM me asking for help. I'm just reiterating what Alistar already wrote on Post #1 but with some clarity.

How to connect to your device using TTL Serial. : Hikvision - Clearing Passwords and/or Loading Firmware via TTL Serial
Stop reading once your reach this point in his post because all you need from moped's post is how to connect to the device using TTL serial so stop reading it once he finishes explaining TFTP

Now you need to download firmware from Hikvision. I had a US model, so I used the US firmware.

How to Mod mtdblock1 aka (classic MTD hack): MTD HACK made easy on Video

How to extract mtdblock1 (I don't know how to tell if it's encrypted, ask Alistair): BOLD PARTS ARE THE CODE YOU NEED TO INPUT. GREEN ARE MY COMMENTS, DON'T TYPE IT

Spoiler: Code To Use

U-Boot 2010.06-svn (Jan 23 2014 - 16:38:55)

Hit ctrl+u to stop autoboot: 0 Power off then power on your device with TTL Serial connected. You will need to interrupt the autoboot. It may tell you to press ctrl+u or any key.

This program will upgrade software.
***

• ATTENTION!! PLEASE READ THIS NOTICE CAREFULLY! *
• Don't reset machine,or anything that interrupt it. *
• The upgrade process must finish in 10 minutes! *
• If this program fails,machine might be unusable, *
• and you will need to reflash again. *
• If you find this too risky,power off machine now. *

***

Now press [u/U] key to upgrade software: b
HKVS # printenv USED TO VIEW THE CURRENT SYSTEM SETTINGS OF YOUR DEVICE
bootcmd=tftp 0x80400000 $(bootfile);bootm 0x80400000;
default=cramfsload 0x80400000 uImage;
sec=tftp 0x80400000 uImage_sec;bootm 0x80400000;
verify=n
bootdelay=1
baudrate=115200
mdio_intf=rgmii
ipaddr=192.0.0.64
serverip=192.0.0.128
gatewayip=192.0.0.1
netmask=255.255.255.0
bootfile=uImage
phyaddr1=7
bootargs=mem=177M console=ttyS0,115200n8
ethaddr=8c:e7:48:76:bf:4d
stdin=serial
stdout=serial
stderr=serial
ver=U-Boot 2010.06-svn (Jan 23 2014 - 16:38:55)

Environment size: 458/4092 bytes
HKVS #
HKVS #
HKVS # help LIST THE COMMANDS THE DEVICE HAS AVAILABLE FOR USE. MAIN REASON IS TO CHECK SF COMMAND IS AVAILABLE
? - alias for 'help'
base - print or set address offset
bootm - boot application image from memory
bootp - boot image via network using BOOTP/TFTP protocol
bubt - Burn an boot image on the Boot Flash.

cmp - memory compare
cp - memory copy
cpld - write cpld info to encrypt media

cramfsload- cramfsload - load binary file from a filesystem image
cramfsls- cramfsls - list files in a directory (default /)
crc32 - checksum calculation
ddr - ddr training function
erase_env- erase envirement info on flash

getinfo - print hardware information
go - start application at address 'addr'
help - print command description/usage
loadb - load binary file over serial line (kermit mode)
loady - load binary file over serial line (ymodem mode)
loop - infinite loop on address range
md - memory display
mii - MII utility commands
mm - memory modify (auto-incrementing address)
mtest - simple RAM read/write test
mw - memory write (fill)
nm - memory modify (constant address)
ping - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
rarpboot- boot image via network using RARP/TFTP protocol
reset - Perform RESET of the CPU
run - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv - set environment variables
sf - SPI flash sub-system
tftp - tftp - download or upload image via network using TFTP protocol
update - Update the digicap of the device.

version - print monitor version
HKVS # setenv ipaddr 192.168.1.214 OPTIONAL STEP, SET THE IP ADDRESS OF THIS DEVICE
HKVS # setenv serverip 192.168.1.99 OPTIONAL STEP, SET THE IP ADDRESS OF THE FTP SERVER
HKVS #
HKVS #
HKVS # sf probe 0
16384 KiB hi_sfc at 0:0 is now current device[4K erase supported]
HKVS # sf read 0x80400000 0x10000 0x20000

HKVS # md 0x8041e000 80
8041e000: 484b5753 00000cd3 000000f4 00010000 SWKH............
8041e010: 00000002 0000002a 00000001 00000000 ....*...........
8041e020: 00000000 00000000 00000000 00080008 ................
8041e030: 00000000 48e78c02 8c4dbf76 bf7648e7 .......Hv.M..Hv.
8041e040: 3130324e 32373034 32373433 30323038 N201407234728020
8041e050: 01003937 00010101 02020002 01010001 79..............
8041e060: 00000000 0000a137 00000000 00000000 ....7...........
8041e070: 00000000 00000000 00000000 00000000 ................
8041e080: 00000000 00000000 00000000 00000000 ................
8041e090: 00000000 00000000 00000000 00000000 ................
8041e0a0: 00000000 00000000 00000000 00000000 ................
8041e0b0: 00000000 00000000 00000000 00000000 ................
8041e0c0: 00000000 00000000 00000000 000000b1 ................
8041e0d0: 0000014f 00000000 00000000 00000000 O...............
8041e0e0: 00000000 00000000 00000000 00000000 ................
8041e0f0: 00006662 00000000 00000000 00000000 bf..............
8041e100: ffffffff ffffffff ffffffff ffffffff ................
8041e110: ffffffff ffffffff ffffffff ffffffff ................
8041e120: ffffffff ffffffff ffffffff ffffffff ................
8041e130: ffffffff ffffffff ffffffff ffffffff ................
8041e140: ffffffff ffffffff ffffffff ffffffff ................
8041e150: ffffffff ffffffff ffffffff ffffffff ................
8041e160: ffffffff ffffffff ffffffff ffffffff ................
8041e170: ffffffff ffffffff ffffffff ffffffff ................
8041e180: ffffffff ffffffff ffffffff ffffffff ................
8041e190: ffffffff ffffffff ffffffff ffffffff ................
8041e1a0: ffffffff ffffffff ffffffff ffffffff ................
8041e1b0: ffffffff ffffffff ffffffff ffffffff ................
8041e1c0: ffffffff ffffffff ffffffff ffffffff ................
8041e1d0: ffffffff ffffffff ffffffff ffffffff ................
8041e1e0: ffffffff ffffffff ffffffff ffffffff ................
8041e1f0: ffffffff ffffffff ffffffff ffffffff ................
HKVS # tftp 0x80400000 mtd1_part1 0x20000 TRANSFER THE MTDBLOCK FROM THE DEVICE TO YOUR FTP SERVER AND SAVES IT AS mtd_part1
MAC: 8C-E7-48-76-BF-4D
TFTP to server 192.168.1.99; our IP address is 192.168.1.214
Upload Filename 'mtd1_part1'.
Upload from address: 0x80400000, 0.128 MB to be send ...
Uploading: # [ Connected ]
#
0.128 MB upload ok.
HKVS #[/CODE]

 

[arunix]

good time of the day everyone.
I don't know where to write about such a request.
how to change the logo on hikvision consoles?
I would be very grateful to you

Start a new thread. This is the wrong place to ask.

 

[ipcamuser11]

OK, here is a language modded version for you to try.
This is a plaintext copy, I'm not sure if a re-encrypted version will be needed.
Good luck!

@alastairstevenson Hi, can you please tell more about how to decrypt and encypt the bootpara section? I have a DS-7104N-SN and want to change language code to 01, but the bootpara section is encrypted. Thanks

 

[ipcamuser11]

U-Boot 2010.06 (Mar 27 2015 - 11:09:42)
The sf erase and sf write command from this version of uboot is useless. So I booted to the /bin/sh shell environment, tried "cat" and "dd" command to write image to /dev/mtdblock0, but got an error message "cat: write error: Operation not permitted". I guess there's some kind of write protection on mtd0? Since it's where the uboot is stored

 

[alastairstevenson]

The sf erase and sf write command from this version of uboot is useless.

In what way is it useless?
If it still exists - it should be able to read and write mtdblock1 where the bootpara data is held at least on the k41 NVRs.

I have a DS-7104N-SN and want to change language code to 01

That's not a model I've ever looked at, I don't know where that would be held.

 

[ipcamuser11]

In what way is it useless?

The "sf erase" and "sf write" command is just ignored, nothing happened when I tried to modify mtdblock0, the contents remain the same, it can read contents from flash to memory however. Same situation as I see on Dahua's new uboot, you can read, but you can't make any modification

As for the DS-7104N-SN, there are only two partitions inside the 8MB flash chip, mtdblock0 and 1. I believe the bootpara is stored inside mtdblock0 while encrypted, same as @tomahawk 's situation. There's no any other EMV chip on the PCB board

[root@dvrdvs /proc] # cat mtd
dev:    size   erasesize  name
mtd0: 00030000 00010000 "mtdblock0"
mtd1: 007d0000 00010000 "mtdblock1"

cat /proc/hkvs/bootpara
====================== BOOT INFO ====================
magicNumber   :0x484b5753
paraChecksum  :0xaa3
paraLength    :0xf4
encryptVer    :0x10000
language      :0x2
device_class  :0x2c
oemCode       :0x1
encodeChans   :0x4
decodeChans   :0x4
ipcChans      :0x0
ivsChans      :0x0
picFormat     :0x2
macAddr     :bc-ad-28-98-6f-d3
prodDate     :32:30:31:36:30:35:32:37
prodNo     :363037313438363937
devHigh       :0x0
cpuFreq       :0x1
dspFreq       :0x1
zone          :0x1
webSupport    :0x1
voipSupport   :0x0
usbNums       :0x2
lcdSupport    :0x0
voNums        :0x2
vganums       :0x2
vtSupport     :0x1
videoMaxtrix  :0x0
extendedDecoder:0x1
extendedIVS   :0x1
extendedAlarmOut:0x0
devType       :0xa043
7116 = a04f
7608 = 77a1
ubootAdrs     :0x0
ubootSize     :0x0
ubootCheckSum :0x0
tinyKernelAdrs:0x0
tinyKernelSize:0x0
tinyKernelCheckSum:0x0
============================
HKVS # printenv

bootdelay=1
baudrate=115200
gatewayip=192.0.0.1
netmask=255.255.255.0
bootfile=uImage
bootargs_end=255.255.255.0:Hik-eth:eth0:none
bootcmd=tftp 0x80400000 $(bootfile);bootm 0x80400000;
sec=tftp 0x80400000 uImage_sec;tftp 0x80800000 ramdisk.gz;bootm 0x80400000 0x80800000;
default=fsload 0x80400000 uImage;fsload 0x80800000 ramdisk.gz;bootm 0x80400000 0x80800000;
ipaddr=192.168.2.121
serverip=192.168.2.88
stdin=serial
stdout=serial
stderr=serial
verify=y
ethaddr=bc:ad:28:98:6f:d3
bootargs=mem=98M console=ttyS1,115200
ver=U-Boot 2010.06-svn (Mar 27 2015 - 11:09:42)

Environment size: 568/4092 bytes

I've also attached the original dump of mtdblock0 if you are interested

However I'm giving up now, even if I can modify the language code, still I can't write it back to mtdblock0, waste of time

 

[alastairstevenson]

The "sf erase" and "sf write" command is just ignored

Dumb question, for which apologies :
Did you select and enable the flash chip with 'sf probe 0' ?

 

[ipcamuser11]

Dumb question, for which apologies :
Did you select and enable the flash chip with 'sf probe 0' ?

Sorry for not explaining clearly

Yes I run "sf probe 0" before the "sf erase" and "sf write" command, both returned "100% complete" message, but nothing was actually erased, everything remain the same. Never tested on mtdblock1 however

Can you please tell how to decrypt and encrypt the bootpara section? In case I come across other NVRs which have bootpara encrypted too. Thanks

HKVS # sf probe 0
8192 KiB hi_sfc at 0:0 is now current device
HKVS # sf erase 0x10000 0x30000
Erasing at 0x40000 -- 100% complete.
HKVS # sf read 0x80400000 0x10000 0x30000

HKVS # md 0x8041e000 0x80
8041e000: 444c5043 ffff8149 ffffffff c600ffff    CPLDI...........
8041e010: 03007220 03b84e09 12914810 18090000     r...N...H......
8041e020: fffff23e ffffffff ffffffff ffffffff    >...............
8041e030: ffffffff ffffffff ffffffff ffffffff    ................
8041e040: ffffffff ffffffff ffffffff ffffffff    ................
8041e050: ffffffff ffffffff ffffffff ffffffff    ................
8041e060: ffffffff ffffffff ffffffff ffffffff    ................
8041e070: ffffffff ffffffff ffffffff ffffffff    ................
8041e080: ffffffff ffffffff ffffffff ffffffff    ................
8041e090: ffffffff ffffffff ffffffff ffffffff    ................
8041e0a0: ffffffff ffffffff ffffffff ffffffff    ................
8041e0b0: ffffffff ffffffff ffffffff ffffffff    ................
8041e0c0: ffffffff ffffffff ffffffff ffffffff    ................
8041e0d0: ffffffff ffffffff ffffffff ffffffff    ................
8041e0e0: ffffffff ffffffff ffffffff ffffffff    ................
8041e0f0: ffffffff ffffffff ffffffff ffffffff    ................
8041e100: ffffffff ffffffff ffffffff ffffffff    ................
8041e110: ffffffff ffffffff ffffffff ffffffff    ................
8041e120: ffffffff ffffffff ffffffff ffffffff    ................
8041e130: ffffffff ffffffff ffffffff ffffffff    ................
8041e140: ffffffff ffffffff ffffffff ffffffff    ................
8041e150: ffffffff ffffffff ffffffff ffffffff    ................
8041e160: ffffffff ffffffff ffffffff ffffffff    ................
8041e170: ffffffff ffffffff ffffffff ffffffff    ................
8041e180: ffffffff ffffffff ffffffff ffffffff    ................
8041e190: ffffffff ffffffff ffffffff ffffffff    ................
8041e1a0: ffffffff ffffffff ffffffff ffffffff    ................
8041e1b0: ffffffff ffffffff ffffffff ffffffff    ................
8041e1c0: ffffffff ffffffff ffffffff ffffffff    ................
8041e1d0: ffffffff ffffffff ffffffff ffffffff    ................
8041e1e0: ffffffff ffffffff ffffffff ffffffff    ................
8041e1f0: ffffffff ffffffff ffffffff ffffffff    ................

HKVS # tftp 0x80400000 mtd0_part1_mod
miiphy_register: non unique device name '0:3'
MAC:   BC-AD-28-98-6F-D3
UP_PORT : phy status change : LINK=UP : DUPLEX=FULL : SPEED=100M
TFTP from server 192.168.2.88; our IP address is 192.168.2.121
Download Filename 'mtd0_part1_mod'.
Download to address: 0x80400000
Downloading: #################################################
done
Bytes transferred = 196608 (30000 hex)
HKVS # sf probe 0
8192 KiB hi_sfc at 0:0 is now current device
HKVS # sf erase 0x10000 0x30000
Erasing at 0x40000 -- 100% complete.
HKVS # md 0x8041e000 80
8041e000: 484b5753 00000ddc 000000f4 00010000    SWKH............
8041e010: 00000002 0000002a 00000001 00000000    ....*...........
8041e020: 00000000 00000000 00000000 00080008    ................
8041e030: 00000000 902fc402 008d26a3 00000000    ....../..&......
8041e040: 31303200 31393035 30343534 36373139    .201509145409176
8041e050: 01003036 00010101 02020002 01010001    60..............
8041e060: 00000000 0000a04f 00000000 00000000    ....O...........
8041e070: 00000000 00000000 00000000 00000000    ................
8041e080: 372d5344 4e383036 0032452d 00000000    DS-7608N-E2.....
8041e090: 00000000 00000000 00000000 00000000    ................
8041e0a0: 00000000 00000000 00000000 00000000    ................
8041e0b0: 00000000 00000000 00000000 00000000    ................
8041e0c0: 00000000 00000000 00000000 000000b1    ................
8041e0d0: 0000014f 00000000 00000000 00000000    O...............
8041e0e0: 00000000 00000000 00000000 00000000    ................
8041e0f0: 47466662 50555459 00000000 00000000    bfFGYTUP........
8041e100: ffffffff ffffffff ffffffff ffffffff    ................
8041e110: ffffffff ffffffff ffffffff ffffffff    ................
8041e120: ffffffff ffffffff ffffffff ffffffff    ................
8041e130: ffffffff ffffffff ffffffff ffffffff    ................
8041e140: ffffffff ffffffff ffffffff ffffffff    ................
8041e150: ffffffff ffffffff ffffffff ffffffff    ................
8041e160: ffffffff ffffffff ffffffff ffffffff    ................
8041e170: ffffffff ffffffff ffffffff ffffffff    ................
8041e180: ffffffff ffffffff ffffffff ffffffff    ................
8041e190: ffffffff ffffffff ffffffff ffffffff    ................
8041e1a0: ffffffff ffffffff ffffffff ffffffff    ................
8041e1b0: ffffffff ffffffff ffffffff ffffffff    ................
8041e1c0: ffffffff ffffffff ffffffff ffffffff    ................
8041e1d0: ffffffff ffffffff ffffffff ffffffff    ................
8041e1e0: ffffffff ffffffff ffffffff ffffffff    ................
8041e1f0: ffffffff ffffffff ffffffff ffffffff    ................
HKVS # sf write 0x80400000 0x10000 0x30000
Writing at 0x40000 -- 100% complete.
HKVS # sf read 0x80400000 0x10000 0x20000
HKVS # md 0x8041e000 0x80
8041e000: 444c5043 ffff8149 ffffffff c600ffff    CPLDI...........
8041e010: 03007220 03b84e09 12914810 18090000     r...N...H......
8041e020: fffff23e ffffffff ffffffff ffffffff    >...............
8041e030: ffffffff ffffffff ffffffff ffffffff    ................
8041e040: ffffffff ffffffff ffffffff ffffffff    ................
8041e050: ffffffff ffffffff ffffffff ffffffff    ................
8041e060: ffffffff ffffffff ffffffff ffffffff    ................
8041e070: ffffffff ffffffff ffffffff ffffffff    ................
8041e080: ffffffff ffffffff ffffffff ffffffff    ................
8041e090: ffffffff ffffffff ffffffff ffffffff    ................
8041e0a0: ffffffff ffffffff ffffffff ffffffff    ................
8041e0b0: ffffffff ffffffff ffffffff ffffffff    ................
8041e0c0: ffffffff ffffffff ffffffff ffffffff    ................
8041e0d0: ffffffff ffffffff ffffffff ffffffff    ................
8041e0e0: ffffffff ffffffff ffffffff ffffffff    ................
8041e0f0: ffffffff ffffffff ffffffff ffffffff    ................
8041e100: ffffffff ffffffff ffffffff ffffffff    ................
8041e110: ffffffff ffffffff ffffffff ffffffff    ................
8041e120: ffffffff ffffffff ffffffff ffffffff    ................
8041e130: ffffffff ffffffff ffffffff ffffffff    ................
8041e140: ffffffff ffffffff ffffffff ffffffff    ................
8041e150: ffffffff ffffffff ffffffff ffffffff    ................
8041e160: ffffffff ffffffff ffffffff ffffffff    ................
8041e170: ffffffff ffffffff ffffffff ffffffff    ................
8041e180: ffffffff ffffffff ffffffff ffffffff    ................
8041e190: ffffffff ffffffff ffffffff ffffffff    ................
8041e1a0: ffffffff ffffffff ffffffff ffffffff    ................
8041e1b0: ffffffff ffffffff ffffffff ffffffff    ................
8041e1c0: ffffffff ffffffff ffffffff ffffffff    ................
8041e1d0: ffffffff ffffffff ffffffff ffffffff    ................
8041e1e0: ffffffff ffffffff ffffffff ffffffff    ................
8041e1f0: ffffffff ffffffff ffffffff ffffffff    ................

 

[alastairstevenson]

I run "sf probe 0" before the "sf erase" and "sf write" command, both returned "100% complete" message, but nothing was actually erased, everything remain the same.

Hmm.. that's certainly odd, you are right.
Just quietly doing nothing.
Not a behaviour I've previously seen.

 

[sparkles]

Did everyone give up on this project? I have a DS-7604N-E1/4P and I managed to get mtd1_part1 downloaded, but unfortunately, it appears to be encrypted.
I think the new English firmware must have overwritten and encrypted everything?
Thanks to alastairstevenson, I was able restore my NVR! Thank you so much!!!

I would still like to see if we can figure out how to get the NVR permanently updated to English even with the encrypted boot para.
If anyone wants me to try anything, please let me know while I have everything hooked up.
Thank you!

 

[nyamuk79]

sf command is not found on my DS-7816HQH-F1-N. Any other altenative solution to pull out the mtdblock1?

 

[DaveFromPeg]

I got soooo sick of these hikvision knockoffs from Amazon.. can't dare reset the dvr or cams for fear of them coming back in chinese.. ridiculous that they can sell these legally buyer beware I guess

I still use the three or four DS-2CD2032-I cams I've had for years but I saved myself a lot of aggravation and camera downtime by getting using an older computer that i jacked up with a bit more ram and a couple of large hard drives and bought Blueiris for 60 bucks
Best move I've made, haven't had any issues in over a year

 

[gwilkolek]

I've done it!!!! It's alive !!! Thank you !!!

 

[hetene]

Here is a worked example of how to permanently change a Hikvision China language DS-76xxN-Ex NVR to an EN language device that will then take the stock EN/ML firmware.
I've used a few Hikvision CN NVRs, bought at low cost off Aliexpress, and typically installed 'hacked to English' firmware to gain access to the newer firmware fixes and added features.
I thought it was time to do something different, and maybe also help out any forum members who want to update their firmware, or to unbrick devices that are suffering from the '15 beep bootloop' after an update.

This example was carried out on a Hikvision DS-7608N-E2/8P purchased at very low cost as a 'bricked' device from an on-line marketplace. Not eBay.

Note
This basic method will not work when the NVR was manufactured with an encoded version of the 'hardware descriptor block' as opposed to the plaintext version shown as an example here.
That requires some extra work.

The steps are summarised as follows :

• Connect up to the NVR serial console using a 'serial TTL to USB convertor'.
• Gain access to the bootloader by interrupting the boot process.
• Start a normal tftp server such as from TFTP server and set IP addresses to match.
• Pull a copy of the (normally hidden and protected) first half of mtdblock1. This holds the device 'hardware descriptor block'.
• Do the equivalent of the 'classic MTD hack' to change the language byte from 02 (CN) to 01 (EN) and fix up the checksum as needed.
• Write the modded section back to mtdblock1

Job done!
And the DS-76xxN-Ex NVR is now upgradeable.


This is a transcript of how to extract the normally hidden first half of mtdblock1, that holds the familiar 'hardware descriptor block'.

Spoiler: Extracting the original hardware descriptor block.

Uploading the first (hidden) half of mtdblock1 to do the
MTD hack on the hardware descriptor (bootpara) block.
For convenience, just temporarily changing the device and tftp server IP addresses.

-------------------------------------------------------

HKVS #
HKVS #
HKVS # reset
resetting ...



U-Boot 2010.06-svn (Jan 23 2014 - 16:38:55)

Hit any key to stop autoboot:  0

This program will upgrade software.
*******************************************************
*  ATTENTION!! PLEASE READ THIS NOTICE CAREFULLY!     *
*  Don't reset machine,or anything that interrupt it. *
*  The upgrade process must finish in 10 minutes!     *
*  If this program fails,machine might be unusable,   *
*  and you will need to reflash again.                *
*  If you find this too risky,power off machine now.  *
*******************************************************

Now press [u/U] key to upgrade software: b
HKVS # printenv
bootcmd=tftp 0x80400000 $(bootfile);bootm 0x80400000;
default=cramfsload 0x80400000 uImage;
sec=tftp 0x80400000 uImage_sec;bootm 0x80400000;
verify=n
bootdelay=1
baudrate=115200
mdio_intf=rgmii
ipaddr=192.0.0.64
serverip=192.0.0.128
gatewayip=192.0.0.1
netmask=255.255.255.0
bootfile=uImage
phyaddr1=7
bootargs=mem=177M console=ttyS0,115200n8
ethaddr=8c:e7:48:76:bf:4d
stdin=serial
stdout=serial
stderr=serial
ver=U-Boot 2010.06-svn (Jan 23 2014 - 16:38:55)

Environment size: 458/4092 bytes
HKVS #
HKVS #
HKVS # help
?       - alias for 'help'
base    - print or set address offset
bootm   - boot application image from memory
bootp   - boot image via network using BOOTP/TFTP protocol
bubt    - Burn an boot image on the Boot Flash.

cmp     - memory compare
cp      - memory copy
cpld    - write cpld info to  encrypt media

cramfsload- cramfsload  - load binary file from a filesystem image
cramfsls- cramfsls      - list files in a directory (default /)
crc32   - checksum calculation
ddr     - ddr training function
erase_env- erase envirement info on flash

getinfo - print hardware information
go      - start application at address 'addr'
help    - print command description/usage
loadb   - load binary file over serial line (kermit mode)
loady   - load binary file over serial line (ymodem mode)
loop    - infinite loop on address range
md      - memory display
mii     - MII utility commands
mm      - memory modify (auto-incrementing address)
mtest   - simple RAM read/write test
mw      - memory write (fill)
nm      - memory modify (constant address)
ping    - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
rarpboot- boot image via network using RARP/TFTP protocol
reset   - Perform RESET of the CPU
run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv  - set environment variables
sf      - SPI flash sub-system
tftp    - tftp  - download or upload image via network using TFTP protocol
update  - Update the digicap of the device.

version - print monitor version
HKVS # setenv ipaddr 192.168.1.214
HKVS # setenv serverip 192.168.1.99
HKVS #
HKVS #
HKVS # sf probe 0
16384 KiB hi_sfc at 0:0 is now current device[4K erase supported]
HKVS # sf read 0x80400000 0x10000 0x20000

HKVS # md 0x8041e000 80
8041e000: 484b5753 00000cd3 000000f4 00010000    SWKH............
8041e010: 00000002 0000002a 00000001 00000000    ....*...........
8041e020: 00000000 00000000 00000000 00080008    ................
8041e030: 00000000 48e78c02 8c4dbf76 bf7648e7    .......Hv.M..Hv.
8041e040: 3130324e 32373034 32373433 30323038    N201407234728020
8041e050: 01003937 00010101 02020002 01010001    79..............
8041e060: 00000000 0000a137 00000000 00000000    ....7...........
8041e070: 00000000 00000000 00000000 00000000    ................
8041e080: 00000000 00000000 00000000 00000000    ................
8041e090: 00000000 00000000 00000000 00000000    ................
8041e0a0: 00000000 00000000 00000000 00000000    ................
8041e0b0: 00000000 00000000 00000000 00000000    ................
8041e0c0: 00000000 00000000 00000000 000000b1    ................
8041e0d0: 0000014f 00000000 00000000 00000000    O...............
8041e0e0: 00000000 00000000 00000000 00000000    ................
8041e0f0: 00006662 00000000 00000000 00000000    bf..............
8041e100: ffffffff ffffffff ffffffff ffffffff    ................
8041e110: ffffffff ffffffff ffffffff ffffffff    ................
8041e120: ffffffff ffffffff ffffffff ffffffff    ................
8041e130: ffffffff ffffffff ffffffff ffffffff    ................
8041e140: ffffffff ffffffff ffffffff ffffffff    ................
8041e150: ffffffff ffffffff ffffffff ffffffff    ................
8041e160: ffffffff ffffffff ffffffff ffffffff    ................
8041e170: ffffffff ffffffff ffffffff ffffffff    ................
8041e180: ffffffff ffffffff ffffffff ffffffff    ................
8041e190: ffffffff ffffffff ffffffff ffffffff    ................
8041e1a0: ffffffff ffffffff ffffffff ffffffff    ................
8041e1b0: ffffffff ffffffff ffffffff ffffffff    ................
8041e1c0: ffffffff ffffffff ffffffff ffffffff    ................
8041e1d0: ffffffff ffffffff ffffffff ffffffff    ................
8041e1e0: ffffffff ffffffff ffffffff ffffffff    ................
8041e1f0: ffffffff ffffffff ffffffff ffffffff    ................
HKVS # tftp 0x80400000 mtd1_part1 0x20000
MAC:   8C-E7-48-76-BF-4D
TFTP to server 192.168.1.99; our IP address is 192.168.1.214
Upload Filename 'mtd1_part1'.
Upload from address: 0x80400000, 0.128 MB to be send ...
Uploading: #    [ Connected ]
#
         0.128 MB upload ok.
HKVS #

This is a transcript of how to apply the modded first half of mtdblock1, showing that the NVR now boots normally, no more 15-beep bootloop, and shows as an EN language device.
In this case it's still running the EN/ML firmware that 'bricked' it. It was then updated to the latest firmware version via the web GUI.

Spoiler: Applying the modded hardware descriptor block.

This is the bootpara edit to change language to EN from CN.
It's the same layout and method as the MTD hack on R0 cameras.
The aim is to get to :
--------------------------------------
language = 1
devType:DS-7608N-E2/8P
--------------------------------------
Initially we have the 15-beep bootloop due to EN/ML firmware
being loaded on a CN language NVR - DS-7608N-E2/8P
-----------------------------------------------------------

!!!!!!!you Device is illegal, Please call factory!!!!!!
!!!!!!!you Device is illegal, Please call factory!!!!!!
!!!!!!!you Device is illegal, Please call factory!!!!!!
!!!!!!!you Device is illegal, Please call factory!!!!!!
!!!!!!!you Device is illegal, Please call factory!!!!!!
!!!!!!!you Device is illegal, Please call factory!!!!!!
!!!!!!!you Device is illegal, Please call factory!!!!!!
!!!!!!!you Device is illegal, Please call factory!!!!!!
!!!!!!!you Device is illegal, Please call factory!!!!!!
!!!!!!!you Device is illegal, Please call factory!!!!!!
!!!!!!!you Device is illegal, Please call factory!!!!!!
!!!!!!!you Device is illegal, Please call factory!!!!!!
!!!!!!!you Device is illegal, Please call factory!!!!!!
!!!!!!!you Device is illegal, Please call factory!!!!!!
!!!!!!!you Device is illegal, Please call factory!!!!!!
!!!!!!!you Device is illegal, Please call factory!!!!!!
!!!!!!!you Device is illegal, Please call factory!!!!!!
!!!!!!!you Device buy in cn, you firmware is en err!!!!!!



U-Boot 2010.06-svn (Jan 23 2014 - 16:38:55)

Hit any key to stop autoboot:  0

This program will upgrade software.
*******************************************************
*  ATTENTION!! PLEASE READ THIS NOTICE CAREFULLY!     *
*  Don't reset machine,or anything that interrupt it. *
*  The upgrade process must finish in 10 minutes!     *
*  If this program fails,machine might be unusable,   *
*  and you will need to reflash again.                *
*  If you find this too risky,power off machine now.  *
*******************************************************

Now press [u/U] key to upgrade software: b
HKVS #
HKVS #
HKVS # printenv
bootcmd=tftp 0x80400000 $(bootfile);bootm 0x80400000;
default=cramfsload 0x80400000 uImage;
sec=tftp 0x80400000 uImage_sec;bootm 0x80400000;
verify=n
bootdelay=1
baudrate=115200
mdio_intf=rgmii
ipaddr=192.0.0.64
serverip=192.0.0.128
gatewayip=192.0.0.1
netmask=255.255.255.0
bootfile=uImage
phyaddr1=7
bootargs=mem=177M console=ttyS0,115200n8
ethaddr=8c:e7:48:76:bf:4d
stdin=serial
stdout=serial
stderr=serial
ver=U-Boot 2010.06-svn (Jan 23 2014 - 16:38:55)

Environment size: 458/4092 bytes
HKVS # setenv serverip 192.168.1.99
HKVS # setenv ipaddr 192.168.1.214
HKVS #
HKVS # sf probe 0
16384 KiB hi_sfc at 0:0 is now current device[4K erase supported]
HKVS #
HKVS # sf read 0x80400000 0x10000 0x20000

HKVS # md 0x8041e000 80
8041e000: 484b5753 00000cd3 000000f4 00010000    SWKH............
8041e010: 00000002 0000002a 00000001 00000000    ....*...........
8041e020: 00000000 00000000 00000000 00080008    ................
8041e030: 00000000 48e78c02 8c4dbf76 bf7648e7    .......Hv.M..Hv.
8041e040: 3130324e 32373034 32373433 30323038    N201407234728020
8041e050: 01003937 00010101 02020002 01010001    79..............
8041e060: 00000000 0000a137 00000000 00000000    ....7...........
8041e070: 00000000 00000000 00000000 00000000    ................
8041e080: 00000000 00000000 00000000 00000000    ................
8041e090: 00000000 00000000 00000000 00000000    ................
8041e0a0: 00000000 00000000 00000000 00000000    ................
8041e0b0: 00000000 00000000 00000000 00000000    ................
8041e0c0: 00000000 00000000 00000000 000000b1    ................
8041e0d0: 0000014f 00000000 00000000 00000000    O...............
8041e0e0: 00000000 00000000 00000000 00000000    ................
8041e0f0: 00006662 00000000 00000000 00000000    bf..............
8041e100: ffffffff ffffffff ffffffff ffffffff    ................
8041e110: ffffffff ffffffff ffffffff ffffffff    ................
8041e120: ffffffff ffffffff ffffffff ffffffff    ................
8041e130: ffffffff ffffffff ffffffff ffffffff    ................
8041e140: ffffffff ffffffff ffffffff ffffffff    ................
8041e150: ffffffff ffffffff ffffffff ffffffff    ................
8041e160: ffffffff ffffffff ffffffff ffffffff    ................
8041e170: ffffffff ffffffff ffffffff ffffffff    ................
8041e180: ffffffff ffffffff ffffffff ffffffff    ................
8041e190: ffffffff ffffffff ffffffff ffffffff    ................
8041e1a0: ffffffff ffffffff ffffffff ffffffff    ................
8041e1b0: ffffffff ffffffff ffffffff ffffffff    ................
8041e1c0: ffffffff ffffffff ffffffff ffffffff    ................
8041e1d0: ffffffff ffffffff ffffffff ffffffff    ................
8041e1e0: ffffffff ffffffff ffffffff ffffffff    ................
8041e1f0: ffffffff ffffffff ffffffff ffffffff    ................
HKVS #
HKVS # tftp 0x80400000 mtd1_part1_mod
MAC:   8C-E7-48-76-BF-4D
TFTP from server 192.168.1.99; our IP address is 192.168.1.214
Download Filename 'mtd1_part1_mod'.
Download to address: 0x80400000
Downloading: #################################################
done
Bytes transferred = 131072 (20000 hex)
HKVS #
HKVS # md 0x8041e000 80
8041e000: 484b5753 00000cd2 000000f4 00010000    SWKH............
8041e010: 00000001 0000002a 00000001 00000000    ....*...........
8041e020: 00000000 00000000 00000000 00080008    ................
8041e030: 00000000 48e78c02 8c4dbf76 bf7648e7    .......Hv.M..Hv.
8041e040: 3130324e 32373034 32373433 30323038    N201407234728020
8041e050: 01003937 00010101 02020002 01010001    79..............
8041e060: 00000000 0000a137 00000000 00000000    ....7...........
8041e070: 00000000 00000000 00000000 00000000    ................
8041e080: 00000000 00000000 00000000 00000000    ................
8041e090: 00000000 00000000 00000000 00000000    ................
8041e0a0: 00000000 00000000 00000000 00000000    ................
8041e0b0: 00000000 00000000 00000000 00000000    ................
8041e0c0: 00000000 00000000 00000000 000000b1    ................
8041e0d0: 0000014f 00000000 00000000 00000000    O...............
8041e0e0: 00000000 00000000 00000000 00000000    ................
8041e0f0: 00006662 00000000 00000000 00000000    bf..............
8041e100: ffffffff ffffffff ffffffff ffffffff    ................
8041e110: ffffffff ffffffff ffffffff ffffffff    ................
8041e120: ffffffff ffffffff ffffffff ffffffff    ................
8041e130: ffffffff ffffffff ffffffff ffffffff    ................
8041e140: ffffffff ffffffff ffffffff ffffffff    ................
8041e150: ffffffff ffffffff ffffffff ffffffff    ................
8041e160: ffffffff ffffffff ffffffff ffffffff    ................
8041e170: ffffffff ffffffff ffffffff ffffffff    ................
8041e180: ffffffff ffffffff ffffffff ffffffff    ................
8041e190: ffffffff ffffffff ffffffff ffffffff    ................
8041e1a0: ffffffff ffffffff ffffffff ffffffff    ................
8041e1b0: ffffffff ffffffff ffffffff ffffffff    ................
8041e1c0: ffffffff ffffffff ffffffff ffffffff    ................
8041e1d0: ffffffff ffffffff ffffffff ffffffff    ................
8041e1e0: ffffffff ffffffff ffffffff ffffffff    ................
8041e1f0: ffffffff ffffffff ffffffff ffffffff    ................
HKVS #
HKVS # sf erase 0x10000 0x20000
Erasing at 0x30000 -- 100% complete.
HKVS #
HKVS # sf write 0x80400000 0x10000 0x20000
Writing at 0x30000 -- 100% complete.
HKVS #
HKVS # sf read 0x80400000 0x10000 0x20000

HKVS #
HKVS # md 0x8041e000 80
8041e000: 484b5753 00000cd2 000000f4 00010000    SWKH............
8041e010: 00000001 0000002a 00000001 00000000    ....*...........
8041e020: 00000000 00000000 00000000 00080008    ................
8041e030: 00000000 48e78c02 8c4dbf76 bf7648e7    .......Hv.M..Hv.
8041e040: 3130324e 32373034 32373433 30323038    N201407234728020
8041e050: 01003937 00010101 02020002 01010001    79..............
8041e060: 00000000 0000a137 00000000 00000000    ....7...........
8041e070: 00000000 00000000 00000000 00000000    ................
8041e080: 00000000 00000000 00000000 00000000    ................
8041e090: 00000000 00000000 00000000 00000000    ................
8041e0a0: 00000000 00000000 00000000 00000000    ................
8041e0b0: 00000000 00000000 00000000 00000000    ................
8041e0c0: 00000000 00000000 00000000 000000b1    ................
8041e0d0: 0000014f 00000000 00000000 00000000    O...............
8041e0e0: 00000000 00000000 00000000 00000000    ................
8041e0f0: 00006662 00000000 00000000 00000000    bf..............
8041e100: ffffffff ffffffff ffffffff ffffffff    ................
8041e110: ffffffff ffffffff ffffffff ffffffff    ................
8041e120: ffffffff ffffffff ffffffff ffffffff    ................
8041e130: ffffffff ffffffff ffffffff ffffffff    ................
8041e140: ffffffff ffffffff ffffffff ffffffff    ................
8041e150: ffffffff ffffffff ffffffff ffffffff    ................
8041e160: ffffffff ffffffff ffffffff ffffffff    ................
8041e170: ffffffff ffffffff ffffffff ffffffff    ................
8041e180: ffffffff ffffffff ffffffff ffffffff    ................
8041e190: ffffffff ffffffff ffffffff ffffffff    ................
8041e1a0: ffffffff ffffffff ffffffff ffffffff    ................
8041e1b0: ffffffff ffffffff ffffffff ffffffff    ................
8041e1c0: ffffffff ffffffff ffffffff ffffffff    ................
8041e1d0: ffffffff ffffffff ffffffff ffffffff    ................
8041e1e0: ffffffff ffffffff ffffffff ffffffff    ................
8041e1f0: ffffffff ffffffff ffffffff ffffffff    ................
HKVS #
HKVS #
HKVS #
HKVS # reset
resetting ...



U-Boot 2010.06-svn (Jan 23 2014 - 16:38:55)

Hit any key to stop autoboot:  0
### CRAMFS load complete: 3181672 bytes loaded to 0x80400000
timeout for link [5000]!
MAC:   8C-E7-48-76-BF-4D
|NUL ethaddr| TFTP server not found
## Booting kernel from Legacy Image at 80400000 ...
   Loading Kernel Image ... OK
OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
init started: BusyBox v1.16.1 (2016-06-29 13:49:45 CST)
Starting udev:      [ OK ]
Sat Feb 16 12:08:48 UTC 2019
----------<1> tar guir webs ----------
----------<2> show logo ----------
show logo Sat Feb 16 12:08:57 UTC 2019
mv: can't rename '/home/app/exec/pppd': No such file or directory
mv: can't rename '/home/app/exec/pppoe': No such file or directory
mv: can't rename '/home/app/exec/ss': No such file or directory
mv: can't rename '/home/app/exec/dropbear': No such file or directory
mv: can't rename '/home/app/exec/dropbearkey': No such file or directory
/home/start.sh: line 29: dropbearkey: not found
chmod: /usr/bin/dvrCmd/dvrtools: No such file or directory
----------<3> load hisi sdk ----------
The system mem size is 0x1
/
load 3535 ok
----------<4> del no use res ----------
mv: can't rename '/home/app/res/adAudio.jpg': No such file or directory
/home/start.sh: line 79: ./pppoed: not found
iSCSI daemon with pid=918 started!!!! the device is not toe !!!


BusyBox v1.16.1 (2016-06-29 13:49:45 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

BusyBox v1.2.1 Protect Shell (psh)
Enter 'help' for a list of davinci system commands.
.
.

[snip lots of serial console chat]
.
.

$$$$$$$$$$$$$ iAoChans[4] $$$$$$$$$$$$$

#
#
# getHardInfo
Start at 2019-02-16 12:09:04
Serial NO :0820140723AARR472802079WCVU
V3.4.80 build 160718
softBase:/Platform/trunk:0
KernelVersion: V1.0.0 build 160629
dspSoftVersion: V5.0 build 160716
codecVersion: V5.0 build 160716
hardwareVersion = 0x0
encodeChans = 0
decodeChans = 8
alarmInNums = 0
alarmOutNums = 0
flashsize = 0x0
ramSize = 0x20000000
networksNums = 1
language = 1
devType:DS-7608N-E2/8P
bootPartition = 1
randomCode =
#
#
# help
Support Commands:
GetAnrCfgInfo                   GetAnrProcess                   GetAnrRecordList
ShowIpcAbility                  accessDvrSwitch                 channelPlayback
clearDisksMode                  ctrlArchDebug                   decStat
disableHB                       disableHik264                   dspStatus
dvrLogInfo                      dt                              enableHB
enableHik264                    enableWatchdog                  errputClose
errputOpen                      get3GMode                       getCMS
getCycleReboot                  getDbgCtrl                      getHardInfo
getIp                           getLastErrorInfo                getPlayTestCtrl
getPort                         getServerInfo                   guiChkCfg
guiEnterMenuCount               guiPrtScr                       guiStatus
helpm                           helpu                           i2cRead
megaDspConfig                   miscCmd                         netstat
outputClose                     outputOpen                      partRecDetails
ping                            printPart                       pthreadInfo
recorderChanInfo                recorderFileInfo                recorderFileKeyFrame
recorderHDIdle                  recorderMediaInfo               recorderPAllocFile
recorderParam                   recorderSegExtraInfo            recorderStatus
sendATCom                       set3GPrint                      set3GEnable
searchInfo                      setGateway                      setIp
setlang                         setMtu                          setoutputmode
setPrint                        show8107coreUseInfo             showCurPlayChanFileInfo
showDeviceTemp                  showIpcMemInfo                  showNetIpcmInfo
showNetLinksInfo                showPlayChanStatus              showPlayClipFile
showPlayScreenInfo              showPlayStatus                  showPlayTime
showPreviewInfo                 showShareSvcInfo                showSpareWorkStatus
showTagSysInfo                  showUserInfo                    showpu
t1                              t2                              transcodeResStatus
getDateInfo                     dmesg                           help

#

Thanks a lot @alastairstevenson !!
Using the USB device, I have changed the language settings from 2 to 1, and successfully upgraded the NVR to the latest version 3.4.96.
However, the device name still appears to be "N" and not "NI".