How to flash multilanguage firmware to chinese DS-7608N-E2/8P and all DS-76,78,79-Ex

W

wzhick

Pulling my weight
Dec 29, 2014
60
144
UPD :
Easy way to upload english firmware on the chinese NVR - use this tool:
http://www.ipcamtalk.com/showthread...anguage-extract-files-and-create-own-firmware






attachment.php
attachment.php

1. First you need original firmware, that you want upload to you'r device.

You can use any multilanguage firmware for DS-76,77,86-Ex

NVR_(76,77,86-Ex)BL_ML_STD_V3.0.10_141126.zip
http://www.hikvisioneurope.com/port...NVR_(76,77,86-Ex)BL_ML_STD_V3.0.10_141126.zip

or english firmware for DS-76/77NI-Ex like this

Baseline Firmware_NVR (76/77NI-E)_En_V3.0.10_build141126
http://overseas.hikvision.com/en/download_89_p1.html

2. Connect NVR to network, and switch on.

3. Enter to web interface (admin/12345) and enable telnet.

4. Prepare fimware to dowload. You need cut first 108 bytes from it. This is Hikvision firmware header, it contains information about firmware language, device class and other, and used by bootloader for restrict upload "unauthorized" firmware.

Use any hex editor.

Remaining part it's pure cramfs image.

attachment.php


5. Connect to NVR using telnet. login as root with password 12345

4. Make sure that your device have /home/hik mounted from /dev/mtdblock2
[root@dvrdvs /] # df
Filesystem 1024-blocks Used Available Use% Mounted on
udev 87140 4 87136 0% /dev
/dev/mtdblock2 13908 13908 0 100% /home/hik

5. Unmount it
[root@dvrdvs /] # umount /dev/mtdblock2

6. Setup any TFTP server on your computer, and download cutted firmware to NVR
[root@dvrdvs /] # tftp -g -l firmware tftpserverip

7. Put firmware to mtdblock2, this is ROM, using cat command
[root@dvrdvs /] # cat firmware > /dev/mtdblock2

8. wait until its flashed. this take around 30 sec.8. Mount mtdblock2 again
[root@dvrdvs /] # mount -t cramfs /dev/mtdblock2 /home/hik

9. Make sure that all correct, and /home/hik avaible:


[root@dvrdvs /] # ls /home/hik
app.tar.lzma dvrCmd.tar.gz hisi.tar.lzma ntfs-3g ptzCfg.bin start.sh vca_encrypt_3535.ko webs.tar.lzma
bonding.ko hicore.tar.lzma iscsi.tar.lzma player.bin showlogo uImage versionctr.tar.lzma



10. Reboot. Thats all.

Please note! You make all this at own risk! You need understand that you may brick your NVR, and you need to have original firmware from you device for restore by tftp in this case.

Warning! Don't put anything to mtdblock0 or mtdblock1, they contain bootloader, and if do this you brick you NVR forever.
 

Attachments

  • capture2.png
    capture2.png
    91.9 KB · Views: 1,328
  • capture1.png
    capture1.png
    543.9 KB · Views: 1,302
  • capture3.png
    capture3.png
    68.7 KB · Views: 1,277
Last edited by a moderator:
  • Like
Reactions: morel, catseyenu and DaveP
Re: How to flash multilanguage firmware to chinese DS-7608N-E2/8P and all DS-76,78,79

Go on then, I'll bite....

I need the solution, what's the answer please
 
Re: How to flash multilanguage firmware to chinese DS-7608N-E2/8P and all DS-76,78,79

Interesting.
You said:
and all DS-76,78,79-Ex
Click to expand...
Have you tried this at all with a 78xx series NVR, where the only Hikvision published firmware for that series is here: http://www1.hikvision.com/cn/download_more_699.html#prettyPhoto ?
What about the files in 'versionctr.tar.lzma' This varies depending on the source of the firmware - how do they affect the working of the NVR?

Sounds like you've been chatting to iTuneDVR ...
 
Re: How to flash multilanguage firmware to chinese DS-7608N-E2/8P and all DS-76,78,79

alastairstevenson said:
Interesting.
You said:

Have you tried this at all with a 78xx series NVR, where the only Hikvision published firmware for that series is here: http://www1.hikvision.com/cn/download_more_699.html#prettyPhoto ?
What about the files in 'versionctr.tar.lzma' This varies depending on the source of the firmware - how do they affect the working of the NVR?

Sounds like you've been chatting to iTuneDVR ...
Click to expand...

I upload to my DS-7608N-E2 this firmware NVR_(78,79-Ex)QDBL_CN_STD_V3.0.10_141126.zip and it works fine.
I dont't have DS-78 or any other, but i think its have one hardware. In any case, if you have original firmware for NVR and can use tftp, you easy restore it.

One more way to check that its compatible, get mtdblock2 from NVR using this:
1. save mtdblock to file
cat /dev/mtdblock2 > out.dat

2. send it to PC
tftp -p -l out.dat tftpserverip

3. make sure that this is cramfs, by finding string "Compressed ROMFS"
Also you may explore it by Far Manager and view any file inside.




sysversion.bin in ML firmware contains "overseas_ml", in chinese firmware "standart". What affected by this i dont know.

I read all info that posts iTuneDVR, but he don't write any hint. I think he has toоls for firmware header rebuild, but dont share it and makes money on it. I have not talked with him.

I don't have any other info about another NVR. I am not a reseller, it's not my bussines, and i buy my NVR on taobao for home use. if you can add my information - you're welcome!

Now i working on firmware header decode.
 
Last edited by a moderator:
Re: How to flash multilanguage firmware to chinese DS-7608N-E2/8P and all DS-76,78,79

The firmware 3.0.10 there are different constraints and the availability of multi language that does not give you need.
I did it a couple of months ago, update firmware multilingual Chinese NVR.
The firmware 3.0.10 is simply the omission of the manufacturer, but the Chinese NVR will understand only Chinese IPC Hikvision or through ONVIF, but then not all IPC settings will be available.
Yes, the method is not entirely secure firmware, but some time working. ;)
Fortunately, TFTP recovery is always working ;) ;)
wzhick said:
Now i working on firmware header decode.
Click to expand...
It's easy ;) ;) ;)
 
Last edited by a moderator:
Re: How to flash multilanguage firmware to chinese DS-7608N-E2/8P and all DS-76,78,79

iTuneDVR said:
The firmware 3.0.10 there are different constraints and the availability of multi language that does not give you need.
I did it a couple of months ago, update firmware multilingual Chinese NVR.
The firmware 3.0.10 is simply the omission of the manufacturer, but the Chinese NVR will understand only Chinese IPC Hikvision or through ONVIF, but then not all IPC settings will be available.
Yes, the method is not entirely secure firmware, but some time working. ;)
Fortunately, TFTP recovery is always working ;) ;)
Click to expand...

It's not problem to load any language firmware by this metod, i tested english, chinese and multilanguage, all works fine.


Also any version avaible to load, 3.0.5 3.0.8 3.0.10. Here no any 3.0.10 bug, and no restrictions by loader.


In addition, when i get my NVR, it was with 3.0.10 chinese firmware. But chinese IPC was with 5.2.0 multilanguage, and they connected only by ONVIF. When i update firmware to EN or ML my NVR connect to IPC by HIKVISION protocol, and all settings avaible.

It's easy ;) ;) ;)
Click to expand...

I know. ;)
 
  • Like
Reactions: catseyenu and iTuneDVR
Re: How to flash multilanguage firmware to chinese DS-7608N-E2/8P and all DS-76,78,79

It's easy
Click to expand...

Only easy to some....... who sing their own praises and post 'GLOAT WARE' about how clever they are with no proof by giving releases to the public domain.

wzhick can be very very proud of sharing his hard work to the the members of the forum.... I'm sure that when his findings and work are refined then people will want to send him gifts as a thank you...... its easy to talk the talk but not willing or able to do the walk!
 
  • Like
Reactions: Majik_Sheff and wzhick
Re: How to flash multilanguage firmware to chinese DS-7608N-E2/8P and all DS-76,78,79

DaveP!
It's easy for all!
I'm nobody and nothing should and nothing is not obliged, therefore, to prove something to me, and someone does not need. Understanding people see and understand everything from the first screenshot;)
All screenshot on http://vk.com/albums221982133

Besides, it only spurs interest in self-study, and not simply enjoy the benefits of others. My task is to show the possibility, and the rest to decide for themselves wondering whether they do it or not. Money, fame, kudos not interested me because I do it for myself and my pleasure. ;) ;)

I am glad that there are those who deal with these simple things because there's a lot more difficult ;) ;) ;)
 
Last edited by a moderator:
Re: How to flash multilanguage firmware to chinese DS-7608N-E2/8P and all DS-76,78,79

Hi,

I used your guide with chinese version DS-7808-SHT NVR.

Firmware version V2.3.6 build131120
Encoding version V5.0 build 131115

1. Downloaded this firmware and cut bytes same as pictures
NVR_(76,77,86-Ex)BL_ML_STD_V3.0.10_141126.zip
http://www.hikvisioneurope.com/porta....10_141126.zip

2.When upload cuted digicap.dav have error ftp:write error below:

The /home/hik is located in the /dev/mtdblock1

attachment.php

Please help, may be i made some wrong ?
 

Attachments

  • 111.png
    111.png
    20.3 KB · Views: 1,110
Re: How to flash multilanguage firmware to chinese DS-7608N-E2/8P and all DS-76,78,79

It looks like the flash memory is organised differently under your 2.3.6 firmware.
The procedure shown by wzhick may not apply here. You stand a good chance of making the device not bootable.
I'm not sure if you have enough space to TFTP get the updated firmware.
Use 'mount' to find the device that the tmpfs filesystem is mounted on, that's where the most free space is.

Under firmware 3.x, the main firmware root filesystem is located in mtdblock2
mtdblock0 holds the bootloader, the u-boot environment variables and the device configuration block (which iTuneDVR claims to have decoded ...)
mtdblock1 holds additional boot-time binaries.

dvrdvs login: root
Password:

BusyBox v1.16.1 (2014-05-19 09:41:10 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.
can not change to guest!
[root@dvrdvs /] # df
Filesystem 1024-blocks Used Available Use% Mounted on
udev 263128 8 263120 0% /dev
/dev/mtdblock2 13880 13880 0 100% /home/hik
[root@dvrdvs /] # mount
rootfs on / type rootfs (rw)
proc on /proc type proc (rw,relatime)
sysfs on /sys type sysfs (rw,relatime)
udev on /dev type tmpfs (rw,relatime)
devpts on /dev/pts type devpts (rw,relatime,mode=600,ptmxmode=000)
/dev/mtdblock2 on /home/hik type cramfs (ro,relatime)
[root@dvrdvs /] #
Click to expand...
 
Re: How to flash multilanguage firmware to chinese DS-7608N-E2/8P and all DS-76,78,79

Hi

First... you must follow the instructions

4. Make sure that your device have /home/hik mounted from /dev/mtdblock2
Click to expand...

If number 4 is not good, then maybe your device is 'different' from the one used, however the question arises as to why you are using 192.0.0. subnet ?

Try again using conventional ip addresses and see if a df shows the expected /dev/mtdblock2 13908 13908 0 100% /home/hik

Also a good point to avoid confusion when altering files, is to rename the saved file from a .dav to the suggested .dat.

But if you don't have a mtdblock that complies with the instructions then you are running the risk of turning your nvr into a door stop.

su... lol
 
Re: How to flash multilanguage firmware to chinese DS-7608N-E2/8P and all DS-76,78,79

Just looked up the DS-7800H-SHT

It is not the same DS -7608N or 78 range of NVR devices so the help desk is now closed, lol
 
Re: How to flash multilanguage firmware to chinese DS-7608N-E2/8P and all DS-76,78,79

I checked again.

dvrdvs login: root
Password:


BusyBox v1.16.1 (2013-08-16 09:30:07 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

su: applet not found
[root@dvrdvs /] # df
Filesystem 1024-blocks Used Available Use% Mounted on
/dev/root 3963 2551 1208 68% /
udev 93036 4 93032 0% /dev
/dev/mtdblock1 16000 8532 7468 53% /home/hik
tmpfs 93036 12820 80216 14% /home/app
[root@dvrdvs /] # mount
rootfs on / type rootfs (rw)
/dev/root on / type ext2 (rw,relatime,errors=continue)
proc on /proc type proc (rw,relatime)
sysfs on /sys type sysfs (rw,relatime)
udev on /dev type tmpfs (rw,relatime)
devpts on /dev/pts type devpts (rw,relatime,mode=600,ptmxmode=000)
/dev/mtdblock1 on /home/hik type jffs2 (rw,relatime)
tmpfs on /home/app type tmpfs (rw,relatime)
[root@dvrdvs /] #

Not have /dev/mtdblock2 13908 13908 0 100% /home/hik.
 
Re: How to flash multilanguage firmware to chinese DS-7608N-E2/8P and all DS-76,78,79

Hi, i'm back!

Done! No more problems. Change language firmware and load it by any standard method.

And bonus! Now we can change or rebuild the kernel image.
I think it will work with any DAV firmware, including IPC. But I had no time to check it - it's not my bussines.



attachment.php
 

Attachments

  • hikt1.png
    hikt1.png
    60.9 KB · Views: 766
Last edited by a moderator:
  • Like
Reactions: whoslooking, morel, iTuneDVR and 1 other person
Re: How to flash multilanguage firmware to chinese DS-7608N-E2/8P and all DS-76,78,79

wzhick said:
Hi, i'm back!
Done! No more problems. Change language firmware and load it by any standard method.
And bonus! Now we can change or rebuild the kernel image.
I think it will work with any DAV firmware, including IPC. But I had no time to check it - it's not my bussines.
Click to expand...

As i said on top it's easy ;)
Good job! ;)
 
You must log in or register to reply here.
Top Bottom