Longse LS-N3525D Bricked

I think i was able to flash the rootfs (extract_2) by this commands :

Code: 
setenv ipaddr 192.168.0.99
setenv serverip 192.168.0.198
setenv netmask 255.255.255.0


mw.b 82400000 ff a00000 
tftp 0x82400000 Hi3535_Rootfs 
sf erase 500000 a00000 
sf write 82400000 500000 a00000
sa

Commands from the chinese page, with the memory offsets and sizes from the bootargs..

Now I have other errors, time to write the contents_1 or Hi3535_app

Code: 
sd 0:0:0:0: [sda] Attached SCSI disk
ata2: SATA link down (SStatus 0 SControl 300)
ata3: SATA link down (SStatus 0 SControl 300)
RAMDISK: cramfs filesystem found at block 0
RAMDISK: Loading 6168KiB [1 disk] into ram disk... done.
VFS: Mounted root (cramfs filesystem) readonly on device 1:0.
Freeing init memory: 176K


            _ _ _ _ _ _ _ _ _ _ _ _
            \  _  _   _  _ _ ___
            / /__/ \ |_/
           / __   /  -  _ ___
          / /  / /  / /
  _ _ _ _/ /  /  \_/  \_ ______
___________\___\__________________


[RCS]: /etc/init.d/S00devs
[RCS]: /etc/init.d/S01udev
udevd (577): /proc/577/oom_adj is deprecated, please use /proc/577/oom_score_adj instead.
[RCS]: /etc/init.d/S80network
[RCS]: /etc/init.d/S81toe
STMMAC driver:
        platform registration...
        done!
Set system config register 0x200300ec with value 0x003f003f
        done!
        DWMAC1000 - user ID: 0x10, Synopsys ID: 0x36
        Enhanced descriptor structure
MACADDR in get is 0:0:0:0:0:0
        no valid MAC address for MAC 0;please, use ifconfig or nwhwconfig!
        eth0 - (dev. name: stmmaceth - id: 0, IRQ #59
        IO base addr: 0xfe0a0000)
STMMAC MII Bus: probed
eth0: PHY ID 001cc915 at 0 IRQ 0 (1:00)
eth0: PHY ID 001cc915 at 1 IRQ -6 (1:01) active
        DWMAC1000 - user ID: 0x10, Synopsys ID: 0x36
        Enhanced descriptor structure
MACADDR in get is 0:0:0:0:0:0
        no valid MAC address for MAC 1;please, use ifconfig or nwhwconfig!
        eth1 - (dev. name: stmmaceth - id: 0, IRQ #59
        IO base addr: 0xfe0a4000)
eth1: PHY ID 001cc915 at 0 IRQ 0 (1:00)
eth1: PHY ID 001cc915 at 1 IRQ -6 (1:01)
stmmac_reset: RESET COMPLETE!


**************************************************
*  TNK driver built on Jun 19 2014 at 11:37:03
*  TNK driver mode is TOE
**************************************************
stmmac: Rx Checksum Offload Engine supported
stmmac: Rx Checksum Offload Engine supported
mount: mounting /dev/mtdblock3 on /app_tmp/ failed: Invalid argument
mount: mounting /dev/mtdblock4 on /www/ failed: Invalid argument
eth0: generated random MAC address 42:ab:83:4c:82:88
MACADDR in set is 42:ab:83:4c:82:88
cp: can't stat '/app_tmp/*': No such file or directory
umount: can't umount /app_tmp/: Invalid argument
Hisilicon Media Memory Zone Manager
hi3535_base: module license 'Proprietary' taints kernel.
Disabling lock debugging due to kernel taint
Hisilicon UMAP device driver interface: v3.00
load sys.ko for Hi3535...OK!
Load tde.ko ...OK!
load vgs.ko for Hi3535...OK!
load venc.ko for Hi3535...OK!
load chnl.ko for Hi3535...OK!
load h264e.ko for Hi3535...OK!
load rc.ko for Hi3535...OK!
load jpege.ko for Hi3535...OK!
load vou.ko ....OK!
load vpss.ko ....OK!
load vda.ko ....OK!
load region.ko ....OK!
load vdec.ko ....OK
load vhd firmware.ko OK
load hdmi.ko ....OK!
Load hi_jpegdec.ko success.     (SDK_VERSION:[SDK_VERSION] Build Time:[Feb  6 2015, 19:48:33])
insmod: can't insert 'hi3535_jpege.ko': File exists
========== GPIO_SET_DIR:0x1
Hisilicon Watchdog Timer: 0.01 initialized. default_margin=60 sec (nowayout= 0, nodeamon= 0)
HISI_IRDA-MF @Hi3535V100R001
hiir: init ok. ver=Sep 28 2014, 15:08:47.
tlv320aic31 [tlv320aic31_device_init ,619]: init aic31(0) error
tlv320aic31 [tlv320aic31_init ,685]: tlv320aic31 device init fail,deregister it!
insmod: can't insert 'extdrv/tlv_320aic31.ko': Operation not peracodec inited!
mitted
=== Init OK ===
Welcome to HiLinux.
 app start
/root/init.sh: line 71: /app/appStart.sh: not found
/root/init.sh: line 48: /app/bin/initf: not found
(none) login: PHY: 1:01 - Link is Up - 1000/Full
 
Last edited by a moderator:
And now wrote the contents of extract_1 with

Code: 
mw.b 82400000 ff a00000 
tftp 0x82400000 Hi3535_App 
sf erase f00000 a00000 
sf write 82400000 f00000 a00000
sa

reset and ... we have image

20160302_221017.jpg

But default user admin and password 123456 not working :-(
But supose that will be a minor problem :-)
 
Wow! I am really impressed, well done!
You've mastered those 'Chinese' commands that I was a bit dismissive of and just used them like a familiar toolkit.

I'd started to look at the u-boot binary to see what it was looking for in Hi3535_rootfs, but it's slow going.
u-boot relocates in memory and it kills the normally good cross-references that are such a boon when examining disassembled code.

So, apart from not being able to log in, what's the state of the NVR?
Is it booting fully now?
On the admin access - what access do you get to the running system via the serial console?
 
alastairstevenson said:
Wow! I am really impressed, well done!
You've mastered those 'Chinese' commands that I was a bit dismissive of and just used them like a familiar toolkit.

I'd started to look at the u-boot binary to see what it was looking for in Hi3535_rootfs, but it's slow going.
u-boot relocates in memory and it kills the normally good cross-references that are such a boon when examining disassembled code.

So, apart from not being able to log in, what's the state of the NVR?
Is it booting fully now?
On the admin access - what access do you get to the running system via the serial console?
Click to expand...


root paswoord for login serial interface found here by searching on the hash in /etc/passwd: http://forum.videon.spb.ru/viewtopic.php?f=20&t=8338
it is : xc12345
With this i was able to set the network with ifconfig
now trying to login via web or gui.. but same password won't work..

it seems some config files are gone (mtd4 ? mtd5 ??) , but i think it is almost functional.
 
Does the setup wizard on your screenshot require a password?
Presumably it will do the initial config populate when complete.
I see that telnet should be active by default.

*edit* In the published firmware, according to the SQLlite configuration database /mnt/system.db, the web GUI default user=admin pwd=12345
In the running configuration system.db may reside in /config or /data
 
Last edited by a moderator:
Yep the wizards asks a password and the factory default one in the manual 123456 is not working. Also network default config was gone it tried to set 255.255.255.255 as ip.. But I was already able to log in as root with serial console and set an ip with ifconfig. Webapp or local ui app access wil be for tomorrow. Tile to sleep. Happy with the progress tonight :-)

Verstuurd vanaf mijn SM-G920F met Tapatalk
 
You have done well. Sleep soundly.

*edit* In the published firmware, according to the SQLlite configuration database /mnt/system.db, the web GUI default user=admin pwd=12345
In the running configuration system.db may reside in /config or /data
 
Last edited by a moderator:
alastairstevenson said:
You have done well. Sleep soundly.

*edit* In the published firmware, according to the SQLlite configuration database /mnt/system.db, the web GUI default user=admin pwd=12345
In the running configuration system.db may reside in /config or /data
Click to expand...

Found the password with google before reading your post. 12345 was the correct password !
system fully operational ! I hope the info in this thread will be helpfull for other people bricking their longse nvr :-)

Thx for all the help !
 
Brilliant! I was intrigued that you found the telnet password from the passwd hash with Google - that's pretty amazing when you think about it. I'd have been searching for crackers and rainbow tables, not the end result.
Based on what I've seen, I think I'll take a look at the Longse NVR range. Got some basic knowledge of the firmware internals ...
Does the device have a good set of features, does it show some polish?
This forum already has a lot of info on some of their camera range, mainly from @klasipca, and they look pretty good hardware wise, if a bit more basic feature wise than Hikvision. Interesting enough to take a punt, as they say over here.
 
Last edited by a moderator:
Webinterface is the same as theire ipcams, you need an ocx and internet explorer...
The local interface is nice, semi transprant colorfull menus


youtube cms software
Manual : http://www.longse.com/UpFile/file/Instructions/CMS User Manual.pdf

I bought it for a friend but wanted to update it after it arrived and flashed a wrong file, so I did not really use it yet.

features are basic like pelco and bosch I used before.
I bought it because the 10 ipcams i bought are the same brand and it price was verry good compared to bosch and pelco I used before. No fancy features like poe ports or alarm inputs. I asked a 16 channel and got this 25 channel at the same price ...



I hope it is stable, I'm happy with the quality and night vision of their ip cams.


http://www.longse.com/userfiles/NVR/LS-N3525E.pdf
 
  • Like
Reactions: alastairstevenson
because there is no much info for these longse recorders, I just found out how to get the different rtsp streams from the recorder (by debugging freeip android app) :

Code: 
rtsp://user:password@ipadres:[rtspport]/channelandstream

channel 1 = 0
channel 2 = 1
channel 3 = 2

stream 1 = 0
stream 2 = 1

example :

Code: 
channel 3 stream 1 : rtsp://user:password@ipadres:rtspport/20
channel 5 stream 2 : rtsp://user:password@ipadres:rtspport/41
channel 12 stream 2 : rtsp://user:password@ipadres:rtspport/111
channel 20 stream 1 : rtsp://user:password@ipadres:rtspport/190
 
  • Like
Reactions: alastairstevenson
Hello!

I have a same problem with my longse nvr. I have a Longse LS-N2109U, as i can read from sticker, but when i opened the device, i find out it is HI3521-nvr-v1.0.

It all started when i got from my dealer a new firmware update_nvr3521.tgz (should be ok, or compatible). I put it on USB stick and started update, all went ok till it restarted and it was unable to boot. All i got on tv screen was NVR Initializing....

I did read all your posts but i'm not capable to program by my self as you did :)

So, if you can help me please, is it possible, that you can send some recovery file or some files that i need to but to USB and reboot my device.

Here is some pictures as well

All best,
2017-02-08 16.59.59.jpg 2017-02-08 16.55.41.jpg 2017-02-08 13.04.20.jpg 2017-02-07 13.03.43.jpg k-i
 
k-i said:
Hello!

I have a same problem with my longse nvr. I have a Longse LS-N2109U, as i can read from sticker, but when i opened the device, i find out it is HI3521-nvr-v1.0.

It all started when i got from my dealer a new firmware update_nvr3521.tgz (should be ok, or compatible). I put it on USB stick and started update, all went ok till it restarted and it was unable to boot. All i got on tv screen was NVR Initializing....

I did read all your posts but i'm not capable to program by my self as you did :)

So, if you can help me please, is it possible, that you can send some recovery file or some files that i need to but to USB and reboot my device.

Here is some pictures as well

All best,
View attachment 14907 View attachment 14906 View attachment 14905 View attachment 14904 k-i
Click to expand...


Hi, it seems very simular but it isn't exact the same. Problem seems similar, mine also did show the boot splash.
I was never able to fix it with an usb update.
You will need serial acces to fix it the way I did.

This photo shows the longsue nvr I fixed, see the attached serial connection :
https://goo.gl/photos/pRi7VoQbSkHJ8aTs9


Last month I tried a second firmware update with the web interface and I bricked again !! but also fixed it again with serial console and tftp server. :-)

Serial console on photo is wrong connected.
It should be right GND then TXD then RXD, don't connect left most pin

Let me know if you have serial access, I will look search the needed files and instructions...
 
  • Like
Reactions: alastairstevenson
Hi,

I know this is old thread but how to you get it to read readable ? I am still getting garbage in putty.. nothing is readable. What are the settings ?

I am new to this and first time using a USB TTL dongle. I am trying to recover a bricked Xiongmai NVR.

In putty, I am not sure if I should try a different translation other the UTF-8 or is the unreadable boot up is due to bitrate.
 
extercy said:
And how do I know if my USB TTL serial dongle is faulty ?
Click to expand...

Still subscribed on the thread :-)
I did try mine on a raspberry to know sure. the first one got fried, the second one worked on a raspberry, after that I used it on the NVR

connection settings in putty (if you use that) are important but also the connected wires...
 
bheremans said:
Still subscribed on the thread :)
I did try mine on a raspberry to know sure. the first one got fried, the second one worked on a raspberry, after that I used it on the NVR

connection settings in putty (if you use that) are important but also the connected wires...
Click to expand...

I am using Linux Mint and I think it is working. But the first time, I got some gibberish like yours and never gotten clear text. Now shows a symbol like a huge dot in a box.. or an LED in a box and keep repeating.

So I don't know if there is any settings I need to do in putty ?
 
You must log in or register to reply here.
Top Bottom