is there a "generic" firmware available for Hi3535 based NVR? (owsoo branded)

[alastairstevenson]

The numbers are verry smal,

I usually need to use a magnifying glass - and some strong lighting.
Possible candidate - 25L12......

 

[Karsten]

I have clean it, here ist the part number:

25L12835F
M2I-10G
8C286500
L161504

 

[alastairstevenson]

25L12835F

That's a 128Mbit SPI flash memory chip.
The same type that I have programmed in-situ (in place, without de-soldering) with a CH341A programmer on a PTZ camera.
That's doesn't mean that in-situ would work OK with your NVR board, but easy enough to try.

 

[Karsten]

OK, then i will buy a CH341A programmer and an SOP8 DIP8 test clip
at a chinese shop.

 

[Karsten]

So, I am back...

I have now received the programmer and the clip.
The software is installed and the chip is recognized.
Which firmware do I have to flash now?

 

[KyleRiemen]

So, everything is running?
According to page two it should be this one http://subaccount.nvsip.com/UpLoadFiles/20180130/2018013020022828.zip

 

[Karsten]

That is right, but there are three .bin files in the archive!

 

[KyleRiemen]

If this is the one that should be flashed via recovery jdvr-recover-sw-nd6004-h1-2.0-128M.bin,
maybe you should try sw-nd6004-h1-2.0-128M.bin first, the one with 1kb can be skipped i guess. But does it even matter? With a programmer "trial and error"-method can be applied i think.

 

[Karsten]

There is another problem.
the red led next to the main cpu no longer lights, I think the bootloader is no longer available.

I have both files written without success.

 

[KyleRiemen]

Serial does not say anthing?

 

[alastairstevenson]

Looking at the firmware you used that was linked to earlier in the thread, the jdvr-recover-sw-nd6004-h1-2.0-128M.bin seems to be a simple XOR-encoded monolithic flash dump of a 16MB flash chip. Presumably you decoded it before you used it? I don't think I saw that mentioned.

Did you decode the firmware before trying it?
Did the programmer give a read-verify OK?

 

[Karsten]

No, I did not decode the firmware.
Unfortunately, I do not know how to do that.
Verify failed! chip with the contents are in disagreement!
What can I do now?

 

[alastairstevenson]

No, I did not decode the firmware.

On the probably big assumption that the recovery file as published is obscured by a simple XOR encoding, attached is a possibly decoded file.
But on examining the contents - I suspect that there may be some further decoding needed, I don't see the expected signatures of a raw firmware dump.
Maybe the device update procedure relies on an external update program to process the firmware file before applying it.

However - when programming the chip, it should be possible to verify successfully. The file size looks correct.
Does the programmer software do an automatic erase prior to programming?

 

[alastairstevenson]

But on examining the contents - I suspect that there may be some further decoding needed, I don't see the expected signatures of a raw firmware dump.

I didn't do the decoding correctly - the attached version looks OK, apologies.

 

[KyleRiemen]

I didn't do the decoding correctly - the attached version looks OK, apologies.

Just out of interest, may i ask you how you did it? Can you refer to a howto maybe.

 

[alastairstevenson]

Just out of interest, may i ask you how you did it? Can you refer to a howto maybe.

Simply by inspection using a hex editor.
Flash dumps have large unused sections, which have been erased to 0s for NAND flash and FF for NOR flash.
So for a simple XOR encoding, those areas have the actual XOR key showing, which when applied reveals the original data.
On the first attachment I forgot it was NOR flash and not NAND flash, so each bit was reversed.

 

[Karsten]

I have now written all 4 files individually, without success.
The programmer does not give an error message verify is ok. I think the file I need is composed of the individual.
Serial I get no answer. As I said the led does not light up that means the board has no bootloader, I think.

 

[alastairstevenson]

The programmer does not give an error message verify is ok.

OK, so you are able to write the dump file to the flash chip and read it back correctly. That's a pretty good state to get to.

I had a look through that last decoded file and it does look like a candidate flash dump to me.
If that does not bring the device to life, it suggests that the flash dump may not be for that model.

If someone else has the same model, and has telnet access to the running system, it should be possible to take a copy of each flash partition and write them in to your board to revive it.

 

[KyleRiemen]

Does it really have to be exactly for this NVR? I found this thread for the same chip "MX25L128XX" and same CPU (Hi3520D), someone posted a uboot dump. MBD6704T-EL поделитесь uboot & env, пожалуйста. : Восстановление и настройка • Форум по системам видеонаблюдения, безопасности, пожарным и охранным сигнализациям, контролю доступа.
It is attached in the fourth post.
Could that work?

 

[Karsten]

Good news!
The system is running again. I did not believe it anymore ....
Many thanks for your help!!

I've written the flash sw-nd6004-h1-2.0-128M from V1.0.1.5927 and it worked.
This file does not exist in the V1.0.1.6964, is that the reason why the update did not work?