How to: My journey with DS-7608NI-E2/8P and Firmware 3.1.0

[proxybox]

I thought I would put details of my journey to upgrade my firmware on my DS-7608NI-E2/8P since I had to reach in so many threads to piece together the entire process. I learned many facets of Linux through this process.

DS-7608NI-E2/8P
Sticker on box: May 2015, V3.3.1_150422. The NVR didn't have any identifying information for firmware or manufacture date on it's sticker. The serial number is AARR (international) with the aliexpress seller putting on, I believe, a modified version 3.0.8_140825. My goal was to add V 3.1.0_150511 based on this thread's analysis: https://www.ipcamtalk.com/showthread.php/4879-HIKVISION-NVR-DS-7616N-E2-8P-3-1-0-us-firmware-Virtual-Host-and-Smart-Event-features?p=47173&viewfull=1#post47173. Note in that post that newer versions completely disable telnet which is required to update.

1. Required. Download the Hikvision Support Tools Package TFTP firmware upload tool here: http://www.hikvision.com/europe/download_more.asp?id=1337
Download the Hikvision SADP Tool here: http://www.hikvision.com/entest/download_more.asp?id=1182

2. Plug NVR into your network switch or router (I read not to plug it directly into the PC since that fails sometimes), run SADP. You can see what version of Firmware is loaded here. Change the default IP address to one that can be accessed through your network, ie. if you pc's are all on 192.168.1.xxx, give it an unused IP address in that range. Put the default password, 12345, in the field and click save.

3. In a browser (Internet Explorer, since Chrome won't work), type in the IP address you gave the NVR. If it's your first time turning on it'll ask to download a component so comply. Restart the browser and in the menu select, Network - Advanced - Enable Telnet.

4. (Optional, but recommended since if you screw up you'll be begging others for working files - Backup your existing firmware. You will need an NAS or you can save to your PC) I have a Zyxel NSA325 NAS which allows me to download a TFTP module. There are various ways (NFS shares on NAS, copying to windows shared folder) to backup/copy the files, including copying to your PC, but since I didn't follow this route, I let others chime in on how to do this. In Windows, type CMD into the search bar. In the resulting window, type Telnet <IP address of NVR>. Enter root (or admin) for User, and 12345 for Password. Here are the commands to enter for tftp. The commands are after the #:

dvrdvs login: root
Password:

BusyBox v1.16.1 (2014-05-19 09:41:10 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.
can not change to guest!
[root@dvrdvs /] # df
Filesystem 1024-blocks Used Available Use% Mounted on
udev 263128 8 263120 0% /dev
/dev/mtdblock2 13880 13880 0 100% /home/hik
[root@dvrdvs /] # cd /dev
[root@dvrdvs /dev] # mount
rootfs on / type rootfs (rw)
proc on /proc type proc (rw,relatime)
sysfs on /sys type sysfs (rw,relatime)
udev on /dev type tmpfs (rw,relatime)
devpts on /dev/pts type devpts (rw,relatime,mode=600,ptmxmode=000)
/dev/mtdblock2 on /home/hik type cramfs (ro,relatime)
[root@dvrdvs /dev] # umount /dev/mtdblock2
[root@dvrdvs /dev] # cat /dev/mtdblock2 > mtdblock2_save
[root@dvrdvs /dev] # mount /dev/mtdblock2 /home/hik
[root@dvrdvs /dev] # tftp -p -l mtdblock2_save 192.168.1.99
mtdblock2_save 100% |*******************************| 16064k --:--:-- ETA
[root@dvrdvs /dev] # rm mtdblock2_save
[root@dvrdvs /dev] #

In this example, the NAS (tftp server) is 192.168.1.99. This process unmounted the mtdblock2 file, made a backup file called mtdblock2_save, remounted mtdblock2 and then copied the backup file to the NAS. The final command deletes mtdblock2_save from the NVR.
We also perform the same steps for mtdblock0 and mtdblock1, except for these files you can skip the mounting/unmounting commands and just perform the copy and transfer to NAS commands. Look in your tftp server folder and make sure all your backups are stored.

5. In telnet, type getHardInfo which will show the language flag. Mine showed 1 = English. If your says 2 = Chinese, please ask for help before proceeding in the forums.

6. I downloaded firmware V 3.1.0 from the US Hikvision ftp site: ftp.hikvisionusa.com (user: hikfirmware, pw: Hikvision123)

7. Unzip the folder

8. Unzip the Hikvision TFTP tool with 7zip http://www.7-zip.org/. It will create a folder called Auto Update. Copy the digicap.dav file from the firmware folder into the Auto Update folder that has the file tftpserve.exe. In your pc change the Ip address to 192.0.0.128. This is very important.

9. Turn off the NVR. Run the tftpserve.exe file which will open a dialog box. Now turn on the NVR and you should see some actions in the dialog box. Wait, wait, wait, wait until it is complete. Shut the tftp program down. If not, everytime you reboot the NVR it'll reattempt firmware upgrade. Check SADP and your firmware should show 3.1.0. You may have to reboot the NVR once to show up.

10. Return your PC to original IP address and now you are finished.

Email configuration in the NVR: Yahoo, etc cannot be used as an outgoing email provider. With this firmware, TLS (a newer security standard for email) has not been implemented which all the providers are requiring now. With gmail it will work with one change in your account settings in Google. (In the NVR, click authentication, enter your login info for gmail, Port: 465, SSL enabled). You have to go to your gmail settings, Accounts and Import, Other Google account settings, Connected apps and sites, Select Allow less secure apps to ON.

Credit: Many, and I know I'm missing people, wzhick, alastairstevenson, whoslooking. Thanks guys.

 

[alastairstevenson]

Thanks for creating that guide and sharing, it will be useful to others.

In telnet, type getHardInfo which will show the language flag. Mine showed 1 = English. If your says 2 = Chinese, please ask for help before proceeding in the forums.

Just out of interest - as the labelled firmware version was not the same as the as-delivered version - the seller may have installed firmware that masquerades the region code, to your benefit.
With a hex editor such as HxD, you could check this out by taking a peek inside your mtdblock0 file.
Do a search for the Hikvision 'magic number' SWKH, which is probably at 0x2E000 and check out the value of the byte that's 0x10 (16 decimal) bytes further down the file.
You may find that it is 02 for Chinese.

Also - a good idea after you've done the upgrade and finalised the configuration and all is working well, including the menu language still in English, is to make a backup of the device configuration, via the web GUI Maintenance menu, and save the file with a firmware version association.

 

[proxybox]

Alastairstevenson, I performed the HxD on my original firmware backup file of mtdblock0 and it looks like I have language version 1, English.



The only caveat is not to restore the device configuration to a different firmware version than it was originally taken from.

Thanks

 

[alastairstevenson]

Yes indeed, Language=EN
Perfect!

 

[voltron81]

Thanks for creating that guide and sharing, it will be useful to others.

Just out of interest - as the labelled firmware version was not the same as the as-delivered version - the seller may have installed firmware that masquerades the region code, to your benefit.
With a hex editor such as HxD, you could check this out by taking a peek inside your mtdblock0 file.
Do a search for the Hikvision 'magic number' SWKH, which is probably at 0x2E000 and check out the value of the byte that's 0x10 (16 decimal) bytes further down the file.
You may find that it is 02 for Chinese.

Also - a good idea after you've done the upgrade and finalised the configuration and all is working well, including the menu language still in English, is to make a backup of the device configuration, via the web GUI Maintenance menu, and save the file with a firmware version association.

This is a great tutorial! @alastairstevenson how can I read the hex, as you said?
I understand that I do need to read the file mtdblock0, but what is the value there that say to me the official language?

Thanks

 

[voltron81]

I think I have found my answer:
byte 0x2E010 in mtdblock0 (this is the definitive value)

1=English/ML, 2=Chinese

 

[alastairstevenson]

Yes, that is correct, the same values as are used in the cameras.

 

[voltron81]

Ok, I have done the backup of mtdblock0, mtdblock1, mtdblock2.
I have analyzed the mtdblock0 and it sounds that my NVR is in chinese version:

even if with getHardInfo I was having english version (the manufacteur have clearly changed it).
Now, I understand that I can not follow anymore this tutorial. What I should do now?
My understanding is that most probably also the cameras are on chinese version, isn't it?

Thanks

 

[alastairstevenson]

I have analyzed the mtdblock0 and it sounds that my NVR is in chinese version:

Yes, the NVR is showing Chinese region in the 'hardware descriptor block'.
But if getHardInfo is showing EN (value=1) then the modified firmware is making it appear to be EN, so you should probably not change the firmware.

 

[voltron81]

oh no, so I will be stuck with the version 3.0.8 that I am having right now?
I really need to find a way to save screenshot (1 a second for example) from my camera to a cloud or ftp, and this firmware does not offer me this possibility. Right now I am recording 24h in the NVR, but if someone enter at home, he can stole the NVR as well and I will have no images...
Any suggestion is appreciated