Speco N8NSL 8CH/8POE NVR

Joined
Feb 12, 2017
Messages
2
Reaction score
1
Hello,

I'm trying to figure out if this Speco N8NSL NVR is a Hikvision or Dahua rebrand, and if there is a way to flash a newer firmware on it than the manufacturer provides. Here's a link with photos: link. I presume Speco stopped supporting this device because they want to sell more NVRs. I contacted them and they provided the attached firmware file which they say works for the N4NSL and N8NSL. I've done about as much as I can with binwalk and trying to mount CramFS files with no luck:

Code:
root@parhelia:/home/pd# binwalk -e main_n4nsl_speco_5.2.2p_20180120\ \(1\).bin

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
297144        0x488B8         CRC32 polynomial table, little endian
329675        0x507CB         Copyright string: "Copyright (C) 1998, Thomas G. Lane"
348192        0x55020         uImage header, header size: 64 bytes, header CRC: 0x4AA8F10C, created: 2014-09-18 12:50:01, image size: 2078672 bytes, Data Address: 0x80008000, Entry Point: 0x80008000, data CRC: 0xE2CD8ABB, OS: Linux, CPU: ARM, image type: OS Kernel Image, compression type: none, image name: "Linux-3.0.8"
370360        0x5A6B8         gzip compressed data, maximum compression, from Unix, NULL date (1970-01-01 00:00:00)
2428976       0x251030        uImage header, header size: 64 bytes, header CRC: 0xB9A477, created: 2018-01-20 04:15:02, image size: 21491712 bytes, Data Address: 0xE1100000, Entry Point: 0xE1100000, data CRC: 0xCE6D051C, OS: Linux, CPU: ARM, image type: RAMDisk Image, compression type: none, image name: "initrd in cramfs"
2429040       0x251070        CramFS filesystem, little endian, size: 21491712 version 2 sorted_dirs CRC 0x1B4D7559, edition 0, 5724 blocks, 371 files
.

I then try to mount it with fusecram (filename) (mountpoint) which doesn't give any errors, but when I try to navigate or stat that path, I get:
Code:
bash: cd: mnt1: Transport endpoint is not connected
My goals were to try to recover the login/password for the telnet "root login: _" prompt, and to determine which hik/dahua hardware this is to download more updated firmware.

Does anyone have any thoughts on this?
 

Attachments

mat200

IPCT Contributor
Joined
Jan 17, 2017
Messages
13,940
Reaction score
23,245
Hello,

I'm trying to figure out if this Speco N8NSL NVR is a Hikvision or Dahua rebrand, and if there is a way to flash a newer firmware on it than the manufacturer provides. Here's a link with photos: link. I presume Speco stopped supporting this device because they want to sell more NVRs. I contacted them and they provided the attached firmware file which they say works for the N4NSL and N8NSL. I've done about as much as I can with binwalk and trying to mount CramFS files with no luck:

Code:
root@parhelia:/home/pd# binwalk -e main_n4nsl_speco_5.2.2p_20180120\ \(1\).bin

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
297144        0x488B8         CRC32 polynomial table, little endian
329675        0x507CB         Copyright string: "Copyright (C) 1998, Thomas G. Lane"
348192        0x55020         uImage header, header size: 64 bytes, header CRC: 0x4AA8F10C, created: 2014-09-18 12:50:01, image size: 2078672 bytes, Data Address: 0x80008000, Entry Point: 0x80008000, data CRC: 0xE2CD8ABB, OS: Linux, CPU: ARM, image type: OS Kernel Image, compression type: none, image name: "Linux-3.0.8"
370360        0x5A6B8         gzip compressed data, maximum compression, from Unix, NULL date (1970-01-01 00:00:00)
2428976       0x251030        uImage header, header size: 64 bytes, header CRC: 0xB9A477, created: 2018-01-20 04:15:02, image size: 21491712 bytes, Data Address: 0xE1100000, Entry Point: 0xE1100000, data CRC: 0xCE6D051C, OS: Linux, CPU: ARM, image type: RAMDisk Image, compression type: none, image name: "initrd in cramfs"
2429040       0x251070        CramFS filesystem, little endian, size: 21491712 version 2 sorted_dirs CRC 0x1B4D7559, edition 0, 5724 blocks, 371 files
.

I then try to mount it with fusecram (filename) (mountpoint) which doesn't give any errors, but when I try to navigate or stat that path, I get:
Code:
bash: cd: mnt1: Transport endpoint is not connected
My goals were to try to recover the login/password for the telnet "root login: _" prompt, and to determine which hik/dahua hardware this is to download more updated firmware.

Does anyone have any thoughts on this?
Hi @JOHN HANSEN

iirc Speco used Dahua OEM NVRs and IP Cameras ..
 
Top