UART/RS232 on NBD8008R - 3536DV100 V1.01

Discussion in 'Firmware' started by divx118, Aug 19, 2018.

Share This Page

  1. divx118

    divx118 n3wb

    Joined:
    Aug 18, 2018
    Messages:
    24
    Likes Received:
    4
    Location:
    Netherlands
    Hi, first post here.

    I was looking for the rs232 connection on my newly bought NBD8008R - 3536DV100 V1.01 Hangzhou Xiongmai First I was looking at the 4 pin connector CN4, but that seems to be a USB host. I finally found some chinese description online It wasn't quite the same board, but atleast I knew now I had to look close to the CN3 connector. There were 4 solder islands close together CN8, so soldered some pins on there and tried.... Success.

    [​IMG]

    [​IMG]
    [​IMG]

    I also needed to set the RS232 in the interface to InteractCmd. I used minicom on my linux machine to output the boot.

    Code:
    System startup..........
    
    System startup
    
    
    
    U-Boot 2010.06-svn1060 (May 14 2018 - 15:54:41)
    
    
    
    Check Flash Memory Controller v100 ... Found
    
    SPI Nor(cs 0) ID: 0xc2 0x20 0x18
    
    Block:64KB Chip:16MB Name:"MX25L128XX"
    
    CONFIG_CLOSE_SPI_8PIN_4IO = y.
    
    at hifmc100_setTB() mid:0xc2,chipsize:0x1000000 <no>.
    
    lk[8 => 0x800000]
    
    SPI Nor total size: 16MB
    
    In:    serial
    
    Out:   serial
    
    Err:   serial
    
    USB:   scanning bus for devices... 2 USB Device(s) found
    
    0 Storage Device(s) found
    
    i:0, No usb storage device found!
    
    Press CTRL-C to abort autoboot in 2 seconds16384 KiB hi_fmc at 0:0 is now current device
    
    CFG_BOOT_ADDR:0x0 argc 2 argv[0] logoload
    
    ### h264dvr.jpg UbootLogoload complete:bytes  oadaddr0x84000000 loaded to 0x87000000
    
    ### h264dvr.jpg UbootLogoload complete: 59577 bytes loaded to 0x87000000
    
    jpeg decoding ...
    
    <<addr=0x87000000, size=0xb85f9, vobuf=0x8711fc00>>
    
    <<imgwidth=800, imgheight=600, linebytes=1600>>
    
    decode success!!!!
    
    decode jpeg success.
    
    decode jpeg!
    
    stMaxRect.u32Width:800, stMaxRect.u32Height:600.
    
    HDMI_INFO:DispFmt2HdmiTiming[383] ,Non CEA video timing:16
    
    HDMI_INFO:Hdmi_PixelFreqSearch[127] ,u32Fmt16.
    
    srcAddr 0x82000000, dstAddr 0x81000000
    
    find_squashfs_file: name bin, start_block 0, offset 2608, type 1
    
    find_squashfs_file: name boot, start_block 0, offset 2716, type 1
    
    read inode: name boot, sb 0, of 2716, type 1
    
    find_squashfs_file: name zImage.img, start_block 0, offset 2640, type 2
    
    read inode: name zImage.img, sb 0, of 2640, type 2
    
    ### FS load complete: 2824707 bytes loaded to 0x81000000
    
    ## Booting kernel from Legacy Image at 81000000 ...
    
       Image Name:   Linux-4.9.37
    
       Image Type:   ARM Linux Kernel Image (uncompressed)
    
       Data Size:    2824643 Bytes = 2.7 MiB
    
       Load Address: 80008000
    
       Entry Point:  80008000
    
       Loading Kernel Image ... OK
    
    OK
    
    
    
    Starting kernel ...
    
    My final goal is to add some ftp server or smb server, so I can access my recordings easily. Since I am not a windows user and almost all available tools like activeX, CMS are only on windows available.
     
    Last edited: Aug 20, 2018
  2. divx118

    divx118 n3wb

    Joined:
    Aug 18, 2018
    Messages:
    24
    Likes Received:
    4
    Location:
    Netherlands
    A little follow up. I have currently the following firmware installed. General_General_NBD8008R-PL_V4.02.R11.7601.Nat.OnvifC.20180719.bin
    The .bin seems to be just a compressed zip with below files.

    Code:
    7-Zip [64] 9.20  Copyright (c) 1999-2010 Igor Pavlov  2010-11-18
    p7zip Version 9.20 (locale=en_US.UTF-8,Utf16=on,HugeFiles=on,8 CPUs)
    
    Processing archive: /home/maurice/Downloads/00000203(NBD8008R-PL)/General_General_NBD8008R-PL_V4.02.R11.7601.Nat.OnvifC.20180719.bin
    
    Testing     web-x.cramfs.img
    Testing     custom-x.cramfs.img
    Testing     user-x.cramfs.img
    Testing     romfs-x.cramfs.img
    Testing     logo-x.cramfs.img
    Testing     u-boot.bin.img
    Testing     InstallDesc
    
    Everything is Ok
    
    Files: 7
    Size:       13089492
    Compressed: 13070348
    
    Just need to figure out how to mount them, so I can see what is inside to start poking around. Just a regular cramfs mount failed. Probably an offset needed or they are somehow encrypted. See if a hexeditor can shed some light on that.
    If anyone has some more info I would be happy to hear.
     
  3. divx118

    divx118 n3wb

    Joined:
    Aug 18, 2018
    Messages:
    24
    Likes Received:
    4
    Location:
    Netherlands
    Ahh that was pretty easy
    Code:
    binwalk user-x.cramfs.img
    
    DECIMAL       HEXADECIMAL     DESCRIPTION
    --------------------------------------------------------------------------------
    0             0x0             uImage header, header size: 64 bytes, header CRC: 0x6EF60315, created: 2018-07-19 13:47:28, image size: 4718592 bytes, Data Address: 0x430000, Entry Point: 0xB10000, data CRC: 0x2A278CF8, OS: Linux, CPU: ARM, image type: OS Kernel Image, compression type: gzip, image name: "linux"
    64            0x40            Squashfs filesystem, little endian, version 4.0, compression:xz, size: 4717676 bytes, 153 inodes, blocksize: 65536 bytes, created: 2018-07-19 13:47:28
    
    Then:
    NOTE: skip is the decimal value of the binwalk output of Squashfs filesystem and count are the size in bytes of the squashfs filesystem.

    Code:
    dd if=user-x.cramfs.img bs=1 skip=64 count=4717676 of=user-x.cramfs.img.conv
    4717676+0 records in
    4717676+0 records out
    4717676 bytes (4,7 MB, 4,5 MiB) copied, 10,593 s, 445 kB/s
    
    Now you unpack the squashfs:

    Code:
    unsquashfs user-x.cramfs.img.conv
    Parallel unsquashfs: Using 8 processors
    136 inodes (297 blocks) to write
    
    [==============================================================================================================================================================================================================================================================|] 297/297 100%
    
    created 136 files
    created 17 directories
    created 0 symlinks
    created 0 devices
    created 0 fifos
    
    Then a directory is created named squashfs-root with the content for example below the content of squashfs-root.

    Code:
    squashfs-root$ ls -al
    total 28
    drwxrwxrwx 7 maurice maurice 4096 jul 19 15:47 .
    drwxrwxr-x 4 maurice maurice 4096 aug 19 14:58 ..
    drwxrwxrwx 3 maurice maurice 4096 jul 19 15:47 bin
    drwxrwxrwx 4 maurice maurice 4096 jul 19 15:47 etc
    drwxrwxrwx 2 maurice maurice 4096 jul 19 15:47 lib
    drwxrwxrwx 2 maurice maurice 4096 jul 19 15:47 sbin
    drwxrwxrwx 3 maurice maurice 4096 jul 19 15:47 share
    
    
     
  4. alastairstevenson

    alastairstevenson Known around here

    Joined:
    Oct 28, 2014
    Messages:
    9,061
    Likes Received:
    2,558
    Location:
    Scotland
    It might be interesting to check the u-boot environment variables (printenv) to see if there is one that determines the mode of the UART you are connected to.
    It may have something like ptzsupport = 1 in which case you could set it to 0 and see the full serial console detail.
     
  5. divx118

    divx118 n3wb

    Joined:
    Aug 18, 2018
    Messages:
    24
    Likes Received:
    4
    Location:
    Netherlands
    @alastairstevenson Thanks for the info, however that would mean rebuilding the firmware and flashing it? I still need to investigate more to see what is in the headers I ignore when unpacking, else I could be left with a bricked device. I noticed that there is telnetd available in the firmware (just commented out in the init script), so looking at some security hole to run that. I saw some shell scripts they run and didn't quote the strings they are using. Just need to find one where I can adjust the string in the user interface so I can start the telnetd.
     
  6. alastairstevenson

    alastairstevenson Known around here

    Joined:
    Oct 28, 2014
    Messages:
    9,061
    Likes Received:
    2,558
    Location:
    Scotland
    No, not at all, it would be a simple low-risk procedure.

    Sometimes the UART has a dual purpose - the default output from the bootloader and the early startup, and a controller for an external device.
    The latter can be the default, in which case all the useful and interesting kernel and app messages and shell access is not available after u-boot starts up the kernel.

    To check this out:
    Interrupt the bootloader at startup. Normally it will show how to do this, for example 'hit any key to interrupt' 'hit Control-U to interrupt' ' etc
    **edit If I'd read your post properly, I would have seen :
    Press CTRL-C to abort autoboot in 2 seconds **

    At the bootloader command prompt, list the existing environment variables with the command
    printenv

    Inspect for any that may be linked to the serial console / UART mode, such as 'ptzsupport = 1'
    To change that specific example, use
    setenv ptzsupport 0
    saveenv

    The reboot and see if the normal full kernel and apps messages now show.
     
    Last edited: Aug 19, 2018
  7. alastairstevenson

    alastairstevenson Known around here

    Joined:
    Oct 28, 2014
    Messages:
    9,061
    Likes Received:
    2,558
    Location:
    Scotland
    These are just standard uImage headers, look for the u-boot documentation that describes them UBootInstallTools < DULG < DENX
    You can simply strip off the 64-byte header, as you have done, or you could get info and extract the one or more images like so (from u-boot-tools) :
    Code:
    alastair@PC-I5 ~/cctv/other/NBD8008/contents $ file romfs*
    romfs-x.cramfs.img: u-boot legacy uImage, linux, Linux/ARM, OS Kernel Image (gzip), 3878912 bytes, Thu Jul 19 13:47:29 2018, Load Address: 0x00050000, Entry Point: 0x00430000, Header CRC: 0x451FEA7B, Data CRC: 0x0DC50892
    alastair@PC-I5 ~/cctv/other/NBD8008/contents $
    alastair@PC-I5 ~/cctv/other/NBD8008/contents $ dumpimage -l romfs*
    Image Name:   linux
    Created:      Thu Jul 19 14:47:29 2018
    Image Type:   ARM Linux Kernel Image (gzip compressed)
    Data Size:    3878912 Bytes = 3788.00 kB = 3.70 MB
    Load Address: 00050000
    Entry Point:  00430000
    alastair@PC-I5 ~/cctv/other/NBD8008/contents $ dumpimage -i romfs* romfs-x.squashfs
    alastair@PC-I5 ~/cctv/other/NBD8008/contents $ file *.squashfs
    romfs-x.squashfs: Squashfs filesystem, little endian, version 4.0, 3876178 bytes, 208 inodes, blocksize: 262144 bytes, created: Thu Jul 19 13:47:29 2018
    alastair@PC-I5 ~/cctv/other/NBD8008/contents $ unsquashfs -d temp romfs-x.squashfs
    Parallel unsquashfs: Using 4 processors
    175 inodes (190 blocks) to write
    
    [===================================================================================================================|] 190/190 100%
    
    created 47 files
    created 33 directories
    created 128 symlinks
    created 0 devices
    created 0 fifos
    alastair@PC-I5 ~/cctv/other/NBD8008/contents $
    
    *edit* Oh, and by the way, the root passwords as used by telnetd are
    Code:
    alastair@PC-I5 ~/cctv/other/NBD8008 $ john --show passwd_file_1.txt
    root:xc3511:0:0:root:/:/bin/sh
    root:helpme:0:0::/root:/bin/sh
    
    2 password hashes cracked, 0 left
    
     
  8. divx118

    divx118 n3wb

    Joined:
    Aug 18, 2018
    Messages:
    24
    Likes Received:
    4
    Location:
    Netherlands
    @alastairstevenson Thanks for the link and also for the root password. It was on my todo list to bruteforce the hash.

    Oops, had the tx wire wrong. that is why I couldn't interrupt the boot. I tried setting ptzsupport, it wasn't set and it also didn't have any effect after setting it. I will look into it. BTW updated the first post with a new image and the correct connections of the UART.

    Code:
    hisilicon # printenv
    
    bootcmd=sf probe 0;sf read 0x84000000 0xf60000 0x20000;logoload 0x84000000;decjpg;sf read 0x82000000 0x50000 0x500000;squashfsload 82000000;bootm 0x81000000
    
    bootdelay=1
    
    baudrate=115200
    
    ethaddr=00:0b:3f:00:00:01
    
    ipaddr=192.168.1.10
    
    serverip=192.168.1.1
    
    netmask=255.255.255.0
    
    gatewayip=192.168.0.1
    
    bootfile="uImage"
    
    da=mw.b 0x82000000 ff 1000000;tftp 0x82000000 u-boot.bin.img;sf probe 0;flwrite
    
    du=mw.b 0x82000000 ff 1000000;tftp 0x82000000 user-x.cramfs.img;sf probe 0;flwrite
    
    dr=mw.b 0x82000000 ff 1000000;tftp 0x82000000 romfs-x.cramfs.img;sf probe 0;flwrite
    
    dw=mw.b 0x82000000 ff 1000000;tftp 0x82000000 web-x.cramfs.img;sf probe 0;flwrite
    
    dl=mw.b 0x82000000 ff 1000000;tftp 0x82000000 logo-x.cramfs.img;sf probe 0;flwrite
    
    dc=mw.b 0x82000000 ff 1000000;tftp 0x82000000 custom-x.cramfs.img;sf probe 0;flwrite
    
    up=mw.b 0x82000000 ff 1000000;tftp 0x82000000 update.img;sf probe 0;flwrite
    
    tk=mw.b 0x82000000 ff 1000000;tftp 0x82000000 zImage.img; bootm 0x82000000
    
    dd=mw.b 0x82000000 ff 1000000;tftp 0x82000000 mtd-x.jffs2.img;sf probe 0;flwrite
    
    bootargs=mem=83M console=ttyAMA0,115200 root=/dev/mtdblock1 rootfstype=squashfs mtdparts=hi_sfc:320K(boot),3968K(romfs),7040K(usr),1600K(web),2816K(custom),128K(logo),512K(mtd) coherent_pool=2M
    
    appVideoStandard=PAL
    
    appSystemLanguage=English
    
    ptzsupport=0
    
    stdin=serial
    
    stdout=serial
    
    stderr=serial
    
    verify=n
    
    ver=U-Boot 2010.06-svn1060 (May 14 2018 - 15:54:41)
    
    
    
    Environment size: 1399/65532 bytes
    
    *edit* maybe the console is not the right device in the bootargs. already tried some other standard device nodes like ttyS0 - ttyS3 but still no luck. Well I will look at it at a later time.
     
    Last edited: Aug 20, 2018
  9. divx118

    divx118 n3wb

    Joined:
    Aug 18, 2018
    Messages:
    24
    Likes Received:
    4
    Location:
    Netherlands
    Time to write some progress down on how to flash a modified rootfs to the device.

    Extract the firmware, I used sudo, because I am afraid of loosing file permissions ownership of files. Didn't check yet if it is true, but for now just in case. I used dumpimage like always on linux there are a 1000 ways to do things.
    Code:
    sudo dumpimage -i romfs-x.cramfs.img romfs-x.squashfs
    Extract the squashfs
    Code:
    sudo unsquashfs -d temp romfs-x.squashfs
    Edit for example temp/etc/init.d/rcS I coudn't get the telnetd started, still looking at that, but added "&" to "dvrHelper /lib/modules /usr/bin/Sofia 127.0.0.1 9578 1 &" This will drop you into a shell on the UART.
    Now make the squashfs
    Code:
    maurice@maurice-N73SM:~/Downloads/extract$ sudo mksquashfs temp rootfs.img -b 64K -comp xz
    Parallel mksquashfs: Using 8 processors
    Creating 4.0 filesystem on rootfs.img, block size 65536.
    [==============================================================================================================================================================================================================================================================/] 132/132 100%
    
    Exportable Squashfs 4.0 filesystem, xz compressed, data block size 65536
        compressed data, compressed metadata, compressed fragments, compressed xattrs
        duplicates are removed
    Filesystem size 3832.00 Kbytes (3.74 Mbytes)
        63.66% of uncompressed filesystem size (6019.72 Kbytes)
    Inode table size 1462 bytes (1.43 Kbytes)
        19.80% of uncompressed inode table size (7384 bytes)
    Directory table size 1946 bytes (1.90 Kbytes)
        56.72% of uncompressed directory table size (3431 bytes)
    Number of duplicate files found 3
    Number of inodes 208
    Number of files 47
    Number of fragments 3
    Number of symbolic links  128
    Number of device nodes 0
    Number of fifo nodes 0
    Number of socket nodes 0
    Number of directories 33
    Number of ids (unique uids + gids) 3
    Number of uids 3
        unknown (1001)
        unknown (563)
        unknown (521)
    Number of gids 3
        unknown (1001)
        unknown (563)
        unknown (521)
    
    Now make the uboot image
    Code:
    maurice@maurice-N73SM:~/Downloads/extract$ sudo mkimage -A ARM -O linux -T kernel -a 00050000 -e 00430000 -C gzip -d "/home/maurice/Downloads/extract/rootfs.img" -n romfs-x.cramfs.img romfs-x.cramfs.img.new
    Image Name:   romfs-x.cramfs.img
    Created:      Fri Aug 24 19:08:25 2018
    Image Type:   ARM Linux Kernel Image (gzip compressed)
    Data Size:    3928064 Bytes = 3836.00 kB = 3.75 MB
    Load Address: 00050000
    Entry Point:  00430000
    
    I setup a tftp server on ubuntu
    Code:
    sudo apt-get install tftpd-hpa
    Edited /etc/default/tftpd-hpa Commented out the --secure option.
    Code:
    maurice@maurice-N73SM:~/Downloads/extract$ cat /etc/default/tftpd-hpa
    # /etc/default/tftpd-hpa
    
    TFTP_USERNAME="tftp"
    TFTP_DIRECTORY="/tftpboot"
    TFTP_ADDRESS=":69"
    #TFTP_OPTIONS="--secure"
    
    Then copied my newly made uboot image to /tftpboot.
    Now in the uboot shell
    Code:
    mw.b 0x82000000 ff 1000000;tftp 0x82000000 /tftpboot/romfs-x.cramfs.img;sf probe 0;flwrite
    You could also do this step by step. It should start downloading the image and then writing it to flash.
    After the flash just "reset" to restart.

    Some info about the device
    Code:
    ~ # cat /proc/cpuinfo
    
    processor       : 0
    
    model name      : ARMv7 Processor rev 5 (v7l)
    
    BogoMIPS        : 1699.02
    
    Features        : half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt vfpd32 lpae 
    
    CPU implementer : 0x41
    
    CPU architecture: 7
    
    CPU variant     : 0x0
    
    CPU part        : 0xc07
    
    CPU revision    : 5
    
    
    
    Hardware        : Hisilicon Hi3536DV100 (Flattened Device Tree)
    
    Revision        : 0000
    
    Serial          : 0000000000000000
    
    ~ # cat /proc/version
    
    Linux version 4.9.37 (chenwenrong@xm-5) (gcc version 6.2.1 20161016 (Hisilicon_v510_20171111) ) #13 Thu Mar 8 15:40:12 CST 2018
    
     
    Last edited: Aug 24, 2018
  10. alastairstevenson

    alastairstevenson Known around here

    Joined:
    Oct 28, 2014
    Messages:
    9,061
    Likes Received:
    2,558
    Location:
    Scotland
    Hey, you're really getting into this stuff, that's a quick learning curve!
    Good try on that.
     
  11. divx118

    divx118 n3wb

    Joined:
    Aug 18, 2018
    Messages:
    24
    Likes Received:
    4
    Location:
    Netherlands
    @alastairstevenson Well all ready had some experience with embedded arm devices, although it was quite some years ago.
    The serial port ttyAMA0 is correct, why it doesn't output the kernel messages there, I am not entirely sure. Maybe in the kernel it is somehow disabled. Telnetd crashes when I try to connect. Not going to invest more time in that, probably some config. I prefer ssh. See if I setup a crosscompiler and build openssh for it. For now the UART shell will do. Only thing is that busybox is very stripped down. No grep or find is a bit irritating. Think I am going to fix that first.
     
  12. divx118

    divx118 n3wb

    Joined:
    Aug 18, 2018
    Messages:
    24
    Likes Received:
    4
    Location:
    Netherlands
    Hmm a little set back, I was afraid of this, the recording hdd is written to directly. It doesn't use a filesystem. Although it should be possible to retrieve data from the drive it won't be of use for me. I just wanted to share it across the network, which is easy todo when it was using some sort of linux filesystem. Need to think about what my other options are.

    Sofia startup output
     
    Last edited: Aug 25, 2018
  13. alastairstevenson

    alastairstevenson Known around here

    Joined:
    Oct 28, 2014
    Messages:
    9,061
    Likes Received:
    2,558
    Location:
    Scotland
    If you don't have it already, attached is a Busybox that should work OK.
    This is how I added it in a Hikvision NVR :
    Code:
    # Add in the fuller busybox, which has telnetd in it and more.
    echo "<<1a> install full busybox and start telnetd >>"
    mv /home/app/busybox-armv7l /bin
    chmod +x /bin/busybox-armv7l
    /bin/busybox-armv7l --install -s /bin
    /bin/busybox-armv7l telnetd
    It looks like you figured out how to get the console logging active.
    The u-boot environment variables, and the name 'sofia' for the main app have the flavour of Dahua firmware.
    They have an environment variable dh_keyboard that determines the mode of the serial interface, normally it's already defined, =0 enables the console.
     

    Attached Files:

  14. divx118

    divx118 n3wb

    Joined:
    Aug 18, 2018
    Messages:
    24
    Likes Received:
    4
    Location:
    Netherlands
    @alastairstevenson Yeah, already got the busybox version busybox-1.29.2 To install it I had to do it a bit different, because of the squashfs filesystem which is readonly and there is no overlayfs present. Also there is not a lot of room on the device, this can however later be easily solved with an ext4 usb stick that I can mount on startup.
    For experimenting now I did it as described below:
    Created an nfs mount from my network on /home on the device with a folder busybox. Installed busybox in /home/busybox
    Then added that folder in front of $PATH "PATH=/home/busybox:$PATH".
    Thanks for your continuous support. It is nice to have some feedback and pointers, it brings up new ideas :)

    * edit * BTW the telnetd from this new busybox works fine. Login: root and password: xc3511
     
    Last edited: Aug 26, 2018
  15. divx118

    divx118 n3wb

    Joined:
    Aug 18, 2018
    Messages:
    24
    Likes Received:
    4
    Location:
    Netherlands
    Another little update: Installed Entware/Entware on the device, just for trying out some things. Programs I installed through entware like ffmpeg, nano work fine. This saves me some time to go through the trouble of building my own with a crosscompiler ( I can still do that if it is needed). Looking at some options now to stream the GUI over ethernet or make a backup from the hdd to my NAS on a regular base. Both options will be a though one, but still fun to see if we can get it done.
     
    alastairstevenson likes this.
  16. divx118

    divx118 n3wb

    Joined:
    Aug 18, 2018
    Messages:
    24
    Likes Received:
    4
    Location:
    Netherlands
    Just collecting the information here, found a nice python based device manager tool NeiroNx/python-dvr from NeiroNx on github. When I am making some serious progress I can add it all to the Wiki
    in some nice logical order. BTW the tool can also be used on the command line and what is most imported for me it runs on linux. MIT licensed.



    Screenshot_2018-09-02_09-31-18.png
     
  17. divx118

    divx118 n3wb

    Joined:
    Aug 18, 2018
    Messages:
    24
    Likes Received:
    4
    Location:
    Netherlands
    I got an over the air update today on the device, so I will do a little write up on how to extract the new firmware from u-boot and upload it to the tftp-server.
    Make sure you create a filename in the tftp folder from the server that is named the same way you want to use in u-boot to save your flash memory, also make it writable for anybody.
    Im my case /tftpboot is my tftp server folder.
    On my PC:
    Code:
    touch /tftpboot/romfs.img
    touch /tftpboot/user.img
    touch /tftpboot/web.img
    touch /tftpboot/custom.img
    sudo chmod 0666 /tftpboot/*.img
    
    Note that the flash offsets and length I got from the old firmware with dumpimage -l. When saving to the tftp server you need to subtract the two to get the length. 0x430000-0x50000=0x3e0000
    In u-boot:
    Code:
    mw.b 0x82000000 ff 1000000;sf probe 0;sf read 0x82000000 0x50000 0x430000;tftp 0x82000000 /tftpboot/romfs.img 0x3e0000
    mw.b 0x82000000 ff 1000000;sf probe 0;sf read 0x82000000 0x430000 0xb10000;tftp 0x82000000 /tftpboot/user.img 0x6e0000
    mw.b 0x82000000 ff 1000000;sf probe 0;sf read 0x82000000 0xb10000 0xca0000;tftp 0x82000000 /tftpboot/web.img 0x190000
    mw.b 0x82000000 ff 1000000;sf probe 0;sf read 0x82000000 0xca0000 0xf60000;tftp 0x82000000 /tftpboot/custom.img 0x2c0000
    
    * edit * web and custom image seems to have a different memory entrypoint, looking at that. For the rest, I edited the romfs image to get telnetd running and my nfs mount for entware and busybox. Repacked and flashed so I got a shell again. ;) to be continued.

    When running the above command you should get something like:
    Code:
    isilicon # mw.b 0x82000000 ff 1000000;sf probe 0;sf read 0x82000000 0x50000 0x430000;tftp 0x82000000 /tftpboot/romfs.img 0x3e0000
    
    16384 KiB hi_fmc at 0:0 is now current device
    
    Hisilicon ETH net controler
    
    MAC:   00-0B-3F-00-00-01
    
    eth0 : phy status change : LINK=DOWN : DUPLEX=FULL : SPEED=100M
    
    eth0 : phy status change : LINK=UP : DUPLEX=FULL : SPEED=100M
    
    TFTP to server 192.168.178.93; our IP address is 192.168.178.125
    
    Upload Filename '/tftpboot/romfs.img'.
    
    Upload from address: 0x82000000, 3.896 MB to be send ...
    
    Uploading: #    [ Connected ]
    
    ################################        [ 2.888 MB]
    
    ###########
    
             3.896 MB upload ok.
    
    hisilicon # mw.b 0x82000000 ff 1000000;sf probe 0;sf read 0x82000000 0x430000 0xb10000;tftp 0x82000000 /tftpboot/user.img 0x6e0000
    
    16384 KiB hi_fmc at 0:0 is now current device
    
    Hisilicon ETH net controler
    
    MAC:   00-0B-3F-00-00-01
    
    eth0 : phy status change : LINK=DOWN : DUPLEX=FULL : SPEED=100M
    
    eth0 : phy status change : LINK=UP : DUPLEX=FULL : SPEED=100M
    
    TFTP to server 192.168.178.93; our IP address is 192.168.178.125
    
    Upload Filename '/tftpboot/user.img'.
    
    Upload from address: 0x82000000, 6.896 MB to be send ...
    
    Uploading: #    [ Connected ]
    
    ################################        [ 2.888 MB]
    
    ################################        [ 5.752 MB]
    
    ############
    
             6.896 MB upload ok.
    
    Copy your image to a working directory and run unsquashfs to extract it:
    Code:
    maurice@maurice-N73SM:~/Downloads/extract/new$ sudo unsquashfs -d romfs romfs.img
    Parallel unsquashfs: Using 8 processors
    175 inodes (190 blocks) to write
    
    [=================================================================================
    
    created 47 files
    created 33 directories
    created 128 symlinks
    created 0 devices
    created 0 fifos
    
    To repack it and flash it again is explained in a couple of posts above.

    happy hacking :)

    * edit 2 * For some reason I cannot read the flash in u-boot when starting at 0xb10000 where the web squashfs files starts. It gives me an "ERROR: read/write area is out of range!" I know for sure the offsets on the flash are correct. kernel messages also tells me that. See starting at line 100

    * edit 3 * Still not sure why I don't have access in u-boot, For now I used the shell and used dd to dump the image from the flash partition.
    Code:
    dd if=/dev/mtdblock3 of=/home/web.img bs=1k
    
    1600+0 records in
    
    1600+0 records out
    
    1638400 bytes (1.6MB) copied, 0.372374 seconds, 4.2MB/s
    
    BTW current firmware

    Code:
    cat FirmwareInfo
    NET_UPGRADE_FILE=General_General_NBD8008R-PL_V4.02.R11.7601.Nat.OnvifC.20180901.bin
    BURN_FILE=upall_General_General_NBD8008R-PL.7601.Nat.OnvifC.20180901.bin
    Attached strace from starting /usr/bin/sofia

    * edit 4 * Thread to keep an eye on 求购WFS0.2、WFS0.3、WFS0.4源码 - 海思平台开放论坛 - 易百纳论坛 - Powered by Discuz! WFS0.4 hdd recording
     

    Attached Files:

    Last edited: Sep 8, 2018
    alastairstevenson likes this.
  18. divx118

    divx118 n3wb

    Joined:
    Aug 18, 2018
    Messages:
    24
    Likes Received:
    4
    Location:
    Netherlands
    My thoughts, about the device/software after playing around with it. The software/firmware is pretty solid and also looks secure especially when you look at china devices a couple of years back. When the Sofia program is started with dvrhelper it will kill any existing telnetd. (using openssh from entware-ng now) So when you want to use a telnetd you will have to start it after Sofia starts with a delay. 5 seconds was good for me. The dvrhelper will also watch the threads needed, if there crashes one like Sofia, it will auto reboot the device after about 20 seconds. USB disks are mounted by Sofia at the moment you want to write something to it and unmounted again when it is finished writing. This is a good practice and doesn't corrupt your USB disk as long as you don't disconnect when it is writing.
    My initial thought was to put this device somewhere tugged away with no monitor and backup or access the recorded files over my home network. This will however consume too much of my limited time I can spend on it. I have a rpi with google assistant running which is connected to a monitor. I see if I can get hdmi splitter with an input that I can control with the rpi and connect the NVR to the same monitor.
    The one thing I want to do is adjust the webinterface so that I can get a screenshot of my cams instead of the plugin not supported in chrome. This I think should be doable with ffmpeg.

    Following will update a snapshot image of camera 1 every second. I use stream=1 the low res url, because I run into memory issues when using the main stream. (1920x1080px vs 352x288px) See if we can improve this a bit.
    ffmpeg needed resources: CPU load is about 6-7% memory about 34%
    Code:
    ffmpeg -loglevel verbose -i rtsp://192.168.178.125:554/user=admin&password=xxxx&channel=1&stream=1.sdp?real_stream -vf fps=fps=1 -pix_fmt yuvj420p -updatefirst 1 /home/snapshot_cam1.jpg
    
     
    Last edited: Sep 9, 2018
    alastairstevenson likes this.
  19. divx118

    divx118 n3wb

    Joined:
    Aug 18, 2018
    Messages:
    24
    Likes Received:
    4
    Location:
    Netherlands
    Hmm again an OTA update This time we also have a newly build kernel.
    Code:
    ~ # cat /mnt/custom/FirmwareInfo
    NET_UPGRADE_FILE=General_General_NBD8008R-PL_V4.02.R11.7601.Nat.OnvifC.20180905.bin
    BURN_FILE=upall_General_General_NBD8008R-PL.7601.Nat.OnvifC.20180905.bin
    ~ # uname -a
    Linux localhost 4.9.37 #16 Tue Sep 4 16:29:28 CST 2018 armv7l GNU/Linux
    
    * edit * This new firmware can be downloaded at Hangzhou Xiongmai Technology Co.,LTD.-8ch 1080P H.265 NVR Board
     
    Last edited: Sep 16, 2018
  20. divx118

    divx118 n3wb

    Joined:
    Aug 18, 2018
    Messages:
    24
    Likes Received:
    4
    Location:
    Netherlands
    A little info on where the settings of the NVR/DVR are stored:
    In /mnt/mtd/Config/Json are gunzip compressed Json files which contain the settings. NetWork is one of those files it will contain your cams ip and passwords in plain text once unpacked. The .second files are I guess backups. Note that when you try to gunzip them on a modern linux system the extension must be changed to .gz For some reason someone decided in the past to force you to work with extensions on linux. IMO a stupid decision, but I guess they had there reasons.
    When you unpack them with a remote session telnet or ssh on the device /bin/gunzip and also in my case gunzip from entware doesn't have this problem.
    To unpack a file and write it to a different location in a remote session:
    Code:
    /mnt/mtd/Config/Json # gunzip -c AVEnc > /home/AVEnc
    /mnt/mtd/Config/Json # cat /home/AVEnc
    { "AHDChannelState" : [ { "EncodeInfo" : { "BitRate" : 0, "CurResolution" : 0, "FPS" : 0 }, "Resolution" : 0 }, { "EncodeInfo" : { "BitRate" : 0, "CurResolution" : 0, "FPS" : 0 }, "Resolution" : 0 }, { "EncodeInfo" : { "BitRate" : 0, "CurResolution" : 0, "FPS" : 0 }, "Resolution" : 0 }, { "EncodeInfo" : { "BitRate" : 0, "CurResolution" : 0, "FPS" : 0 }, "Resolution" : 0 }, { "EncodeInfo" : { "BitRate" : 0, "CurResolution" : 0, "FPS" : 0 }, "Resolution" : 0 }, { "EncodeInfo" : { "BitRate" : 0, "CurResolution" : 0, "FPS" : 0 }, "Resolution" : 0 }, { "EncodeInfo" : { "BitRate" : 0, "CurResolution" : 0, "FPS" : 0 }, "Resolution" : 0 }, { "EncodeInfo" : { "BitRate" : 0, "CurResolution" : 0, "FPS" : 0 }, "Resolution" : 0 }, { "EncodeInfo" : { "BitRate" : 0, "CurResolution" : 0, "FPS" : 0 }, "Resolution" : 0 }, { "EncodeInfo" : { "BitRate" : 0, "CurResolution" : 0, "FPS" : 0 }, "Resolution" : 0 }, { "EncodeInfo" : { "BitRate" : 0, "CurResolution" : 0, "FPS" : 0 }, "Resolution" : 0 }, { "EncodeInfo" : { "BitRate" : 0, "CurResolution" : 0, "FPS" : 0 }, "Resolution" : 0 }, { "EncodeInfo" : { "BitRate" : 0, "CurResolution" : 0, "FPS" : 0 }, "Resolution" : 0 }, { "EncodeInfo" : { "BitRate" : 0, "CurResolution" : 0, "FPS" : 0 }, "Resolution" : 0 }, { "EncodeInfo" : { "BitRate" : 0, "CurResolution" : 0, "FPS" : 0 }, "Resolution" : 0 }, { "EncodeInfo" : { "BitRate" : 0, "CurResolution" : 0, "FPS" : 0 }, "Resolution" : 0 }, { "EncodeInfo" : { "BitRate" : 0, "CurResolution" : 0, "FPS" : 0 }, "Resolution" : 0 }, { "EncodeInfo" : { "BitRate" : 0, "CurResolution" : 0, "FPS" : 0 }, "Resolution" : 0 }, { "EncodeInfo" : { "BitRate" : 0, "CurResolution" : 0, "FPS" : 0 }, "Resolution" : 0 }, { "EncodeInfo" : { "BitRate" : 0, "CurResolution" : 0, "FPS" : 0 }, "Resolution" : 0 }, { "EncodeInfo" : { "BitRate" : 0, "CurResolution" : 0, "FPS" : 0 }, "Resolution" : 0 }, { "EncodeInfo" : { "BitRate" : 0, "CurResolution" : 0, "FPS" : 0 }, "Resolution" : 0 }, { "EncodeInfo" : { "BitRate" : 0, "CurResolution" : 0, "FPS" : 0 }, "Resolution" : 0 }, { "EncodeInfo" : { "BitRate" : 0, "CurResolution" : 0, "FPS" : 0 }, "Resolution" : 0 }, { "EncodeInfo" : { "BitRate" : 0, "CurResolution" : 0, "FPS" : 0 }, "Resolution" : 0 }, { "EncodeInfo" : { "BitRate" : 0, "CurResolution" : 0, "FPS" : 0 }, "Resolution" : 0 }, { "EncodeInfo" : { "BitRate" : 0, "CurResolution" : 0, "FPS" : 0 }, "Resolution" : 0 }, { "EncodeInfo" : { "BitRate" : 0, "CurResolution" : 0, "FPS" : 0 }, "Resolution" : 0 }, { "EncodeInfo" : { "BitRate" : 0, "CurResolution" : 0, "FPS" : 0 }, "Resolution" : 0 }, { "EncodeInfo" : { "BitRate" : 0, "CurResolution" : 0, "FPS" : 0 }, "Resolution" : 0 }, { "EncodeInfo" : { "BitRate" : 0, "CurResolution" : 0, "FPS" : 0 }, "Resolution" : 0 }, { "EncodeInfo" : { "BitRate" : 0, "CurResolution" : 0, "FPS" : 0 }, "Resolution" : 0 } ], "CombineEncode" : [ { "ExtraFormat" : [ { "Audio" : { "BitRate" : 10, "MaxVolume" : 10, "SampleRate" : 10 }, "AudioEnable" : false, "Video" : { "BitRate" : 256, "BitRateControl" : "VBR", "Compression" : "H.264", "FPS" : 25, "GOP" : 2, "Quality" : 3, "Resolution" : "QCIF" }, "VideoEnable" : false }, { "Audio" : { "BitRate" : 10, "MaxVolume" : 10, "SampleRate" : 10 }, "AudioEnable" : false, "Video" : { "BitRate" : 256, "BitRateControl" : "VBR", "Compression" : "H.264", "FPS" : 25, "GOP" : 2, "Quality" : 3, "Resolution" : "QCIF" }, "VideoEnable" : false }, { "Audio" : { "BitRate" : 10, "MaxVolume" : 10, "SampleRate" : 10 }, "AudioEnable" : false, "Video" : { "BitRate" : 256, "BitRateControl" : "VBR", "Compression" : "H.264", "FPS" : 25, "GOP" : 2, "Quality" : 3, "Resolution" : "QCIF" }, "VideoEnable" : false } ], "MainFormat" : [ { "Audio" : { "BitRate" : 10, "MaxVolume" : 10, "SampleRate" : 10 }, "AudioEnable" : false, "Video" : { "BitRate" : 512, "BitRateControl" : "VBR", "Compression" : "H.264", "FPS" : 25, "GOP" : 2, "Quality" : 4, "Resolution" : "CIF" }, "VideoEnable" : false }, { "Audio" : { "BitRate" : 10, "MaxVolume" : 10, "SampleRate" : 10 }, "AudioEnable" : false, "Video" : { "BitRate" : 512, "BitRateControl" : "VBR", "Compression" : "H.264", "FPS" : 25, "GOP" : 2, "Quality" : 4, "Resolution" : "CIF" }, "VideoEnable" : false }, { "Audio" : { "BitRate" : 10, "MaxVolume" : 10, "SampleRate" : 10 }, "AudioEnable" : false, "Video" : { "BitRate" : 512, "BitRateControl" : "VBR", "Compression" : "H.264", "FPS" : 25, "GOP" : 2, "Quality" : 4, "Resolution" : "CIF" }, "VideoEnable" : false } ], "SnapFormat" : [ { "Audio" : { "BitRate" : 10, "MaxVolume" : 10, "SampleRate" : 10 }, "AudioEnable" : false, "Video" : { "BitRate" : 512, "BitRateControl" : "VBR", "Compression" : "H.264", "FPS" : 1, "GOP" : 2, "Quality" : 4, "Resolution" : "CIF" }, "VideoEnable" : true }, { "Audio" : { "BitRate" : 10, "MaxVolume" : 10, "SampleRate" : 10 }, "AudioEnable" : false, "Video" : { "BitRate" : 512, "BitRateControl" : "VBR", "Compression" : "H.264", "FPS" : 1, "GOP" : 2, "Quality" : 4, "Resolution" : "CIF" }, "VideoEnable" : false }, { "Audio" : { "BitRate" : 10, "MaxVolume" : 10, "SampleRate" : 10 }, "AudioEnable" : false, "Video" : { "BitRate" : 512, "BitRateControl" : "VBR", "Compression" : "H.264", "FPS" : 1, "GOP" : 2, "Quality" : 4, "Resolution" : "CIF" }, "VideoEnable" : false } ] }, { "ExtraFormat" : [ { "Audio" : { "BitRate" : 10, "MaxVolume" : 10, "SampleRate" : 10 }, "AudioEnable" : false, "Video" : { "BitRate" : 256, "BitRateControl" : "VBR", "Compression" : "H.264", "FPS" : 25, "GOP" : 2, "Quality" : 3, "Resolution" : "QCIF" }, "VideoEnable" : false }, { "Audio" : { "BitRate" : 10, "MaxVolume" : 10, "SampleRate" : 10 }, "AudioEnable" : false, "Video" : { "BitRate" : 256, "BitRateControl" : "VBR", "Compression" : "H.264", "FPS" : 25, "GOP" : 2, "Quality" : 3, "Resolution" : "QCIF" }, "VideoEnable" : false }, { "Audio" : { "BitRate" : 10, "MaxVolume" : 10, "SampleRate" : 10 }, "AudioEnable" : false, "Video" : { "BitRate" : 256, "BitRateControl" : "VBR", "Compression" : "H.264", "FPS" : 25, "GOP" : 2, "Quality" : 3, "Resolution" : "QCIF" }, "VideoEnable" : false } ], "MainFormat" : [ { "Audio" : { "BitRate" : 10, "MaxVolume" : 10, "SampleRate" : 10 }, "AudioEnable" : false, "Video" : { "BitRate" : 512, "BitRateControl" : "VBR", "Compression" : "H.264", "FPS" : 25, "GOP" : 2, "Quality" : 4, "Resolution" : "CIF" }, "VideoEnable" : false }, { "Audio" : { "BitRate" : 10, "MaxVolume" : 10, "SampleRate" : 10 }, "AudioEnable" : false, "Video" : { "BitRate" : 512, "BitRateControl" : "VBR", "Compression" : "H.264", "FPS" : 25, "GOP" : 2, "Quality" : 4, "Resolution" : "CIF" }, "VideoEnable" : false }, { "Audio" : { "BitRate" : 10, "MaxVolume" : 10, "SampleRate" : 10 }, "AudioEnable" : false, "Video" : { "BitRate" : 512, "BitRateControl" : "VBR", "Compression" : "H.264", "FPS" : 25, "GOP" : 2, "Quality" : 4, "Resolution" : "CIF" }, "VideoEnable" : false } ], "SnapFormat" : [ { "Audio" : { "BitRate" : 10, "MaxVolume" : 10, "SampleRate" : 10 }, "AudioEnable" : false, "Video" : { "BitRate" : 512, "BitRateControl" : "VBR", "Compression" : "H.264", "FPS" : 1, "GOP" : 2, "Quality" : 4, "Resolution" : "CIF" }, "VideoEnable" : true }, { "Audio" : { "BitRate" : 10, "MaxVolume" : 10, "SampleRate" : 10 }, "AudioEnable" : false, "Video" : { "BitRate" : 512, "BitRateControl" : "VBR", "Compression" : "H.264", "FPS" : 1, "GOP" : 2, "Quality" : 4, "Resolution" : "CIF" }, "VideoEnable" : false }, { "Audio" : { "BitRate" : 10, "MaxVolume" : 10, "SampleRate" : 10 }, "AudioEnable" : false, "Video" : { "BitRate" : 512, "BitRateControl" : "VBR", "Compression" : "H.264", "FPS" : 1, "GOP" : 2, "Quality" : 4, "Resolution" : "CIF" }, "VideoEnable" : false } ] } ], "Encode" : null, "SmartH264" : null, "VideoColor" : null, "VideoWidget" : [ { "ChannelTitle" : { "Name" : "Frontdoor", "SerialNo" : "20081125" }, "ChannelTitleAttribute" : { "BackColor" : "0x80000000", "EncodeBlend" : true, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : true, "RelativePos" : [ 570, 7552, 255, 24 ] }, "Covers" : [ { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] } ], "CoversNum" : 0, "TimeTitleAttribute" : { "BackColor" : "0x80000000", "EncodeBlend" : true, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : true, "RelativePos" : [ 5166, 512, 255, 24 ] } }, { "ChannelTitle" : { "Name" : "D02", "SerialNo" : "20081125" }, "ChannelTitleAttribute" : { "BackColor" : "0x80000000", "EncodeBlend" : true, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : true, "RelativePos" : [ 570, 7552, 255, 24 ] }, "Covers" : [ { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] } ], "CoversNum" : 0, "TimeTitleAttribute" : { "BackColor" : "0x80000000", "EncodeBlend" : true, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : true, "RelativePos" : [ 5166, 512, 255, 24 ] } }, { "ChannelTitle" : { "Name" : "D03", "SerialNo" : "20081125" }, "ChannelTitleAttribute" : { "BackColor" : "0x80000000", "EncodeBlend" : true, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : true, "RelativePos" : [ 570, 7552, 255, 24 ] }, "Covers" : [ { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] } ], "CoversNum" : 0, "TimeTitleAttribute" : { "BackColor" : "0x80000000", "EncodeBlend" : true, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : true, "RelativePos" : [ 5166, 512, 255, 24 ] } }, { "ChannelTitle" : { "Name" : "D04", "SerialNo" : "20081125" }, "ChannelTitleAttribute" : { "BackColor" : "0x80000000", "EncodeBlend" : true, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : true, "RelativePos" : [ 570, 7552, 255, 24 ] }, "Covers" : [ { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] } ], "CoversNum" : 0, "TimeTitleAttribute" : { "BackColor" : "0x80000000", "EncodeBlend" : true, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : true, "RelativePos" : [ 5166, 512, 255, 24 ] } }, { "ChannelTitle" : { "Name" : "D05", "SerialNo" : "20081125" }, "ChannelTitleAttribute" : { "BackColor" : "0x80000000", "EncodeBlend" : true, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : true, "RelativePos" : [ 570, 7552, 255, 24 ] }, "Covers" : [ { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] } ], "CoversNum" : 0, "TimeTitleAttribute" : { "BackColor" : "0x80000000", "EncodeBlend" : true, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : true, "RelativePos" : [ 5166, 512, 255, 24 ] } }, { "ChannelTitle" : { "Name" : "D06", "SerialNo" : "20081125" }, "ChannelTitleAttribute" : { "BackColor" : "0x80000000", "EncodeBlend" : true, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : true, "RelativePos" : [ 570, 7552, 255, 24 ] }, "Covers" : [ { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] } ], "CoversNum" : 0, "TimeTitleAttribute" : { "BackColor" : "0x80000000", "EncodeBlend" : true, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : true, "RelativePos" : [ 5166, 512, 255, 24 ] } }, { "ChannelTitle" : { "Name" : "D07", "SerialNo" : "20081125" }, "ChannelTitleAttribute" : { "BackColor" : "0x80000000", "EncodeBlend" : true, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : true, "RelativePos" : [ 570, 7552, 255, 24 ] }, "Covers" : [ { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] } ], "CoversNum" : 0, "TimeTitleAttribute" : { "BackColor" : "0x80000000", "EncodeBlend" : true, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : true, "RelativePos" : [ 5166, 512, 255, 24 ] } }, { "ChannelTitle" : { "Name" : "D08", "SerialNo" : "20081125" }, "ChannelTitleAttribute" : { "BackColor" : "0x80000000", "EncodeBlend" : true, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : true, "RelativePos" : [ 570, 7552, 255, 24 ] }, "Covers" : [ { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] } ], "CoversNum" : 0, "TimeTitleAttribute" : { "BackColor" : "0x80000000", "EncodeBlend" : true, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : true, "RelativePos" : [ 5166, 512, 255, 24 ] } } ], "WaterMark" : null }
     
    alastairstevenson likes this.
  21. Nhat Huy

    Nhat Huy n3wb

    Joined:
    Jul 27, 2018
    Messages:
    4
    Likes Received:
    0
    Location:
    Viet Nam
    can you share me backup rom hex. i unbrick my nvr i lose uboot
     
  22. kirikomori

    kirikomori n3wb

    Joined:
    Sep 18, 2018
    Messages:
    1
    Likes Received:
    0
    Location:
    japan
    Hey, nice guy.
    Thank you very much for Haching.It became very helpful.
    Before discovering this article, connect a serial console,I just looked at "Starting kernel ..." and gave it up.

    Unlike Firmware, I examined the defeat of the control panel, so keep the circuit diagram.

    [​IMG]

    For all NBD8008R users :)
     
  23. divx118

    divx118 n3wb

    Joined:
    Aug 18, 2018
    Messages:
    24
    Likes Received:
    4
    Location:
    Netherlands
    @kirikomori Thanks for the diagram, I can use that to control the menu with my raspberrypi.
    @Nhat Huy What do you exactly want? You can just download the firmware and unpack it to get the hex data.
     
  24. Nhat Huy

    Nhat Huy n3wb

    Joined:
    Jul 27, 2018
    Messages:
    4
    Likes Received:
    0
    Location:
    Viet Nam
    i have a nvr board use Hi3536D chip all schematic same NBD8008 xiongmai hardware. I try flash uboot and then flash fw via UART, nvr boot up and run but only 1 frame and serial and mac is default. Maybe i lost rom chip 24c08 ( mac + serial ) or it include master rom ( address 3FC00 to 40000) can you backup your rom via UART but I worry i do it you and me same cloud id.
     
  25. divx118

    divx118 n3wb

    Joined:
    Aug 18, 2018
    Messages:
    24
    Likes Received:
    4
    Location:
    Netherlands
    @Nyat Huy, that is what I mean. You can get the right files from the firmware file.
    General_General_NBD8008R-PL_V4.02.R11.7601.Nat.OnvifC.20180901.bin
    Just unzip the .bin to get the below files and then flash them in uboot. Reflashing romfs, web and custom should get you going again.
    web-x.cramfs.img
    custom-x.cramfs.img
    user-x.cramfs.img
    romfs-x.cramfs.img
    logo-x.cramfs.img
    u-boot.bin.img
    InstallDesc

    BTW sorry for the late reaction. a bit too busy at work lately.
     
  26. divx118

    divx118 n3wb

    Joined:
    Aug 18, 2018
    Messages:
    24
    Likes Received:
    4
    Location:
    Netherlands
    If someone wants to build a box with a 3D printer for the NBD8008R - 3536DV100 V1.01 print I have designed a simple one Search Thingiverse - Thingiverse Tinkercad links are also there so you can customize it. There are 3 parts bottom, top and back. HDD can be screwed to the top.
     
  27. runekyndal

    runekyndal n3wb

    Joined:
    Dec 19, 2017
    Messages:
    17
    Likes Received:
    0
    i have the same board. and i have unfortunately bricked it. (working U-boot)
    but corroupted kernel

    i have not been able to find the kernel in any update files yet.

    any chance you have a complete dump file, individual files to help me recover via TFTP?

    u-boot.bin.img
    user-x.cramfs.img
    romfs-x.cramfs.img
    web-x.cramfs.img
    logo-x.cramfs.img
    custom-x.cramfs.img

    update.img
    zImage.img
    mtd-x.jffs2.img

    or could pull them off your working board for me ?
    would be greatly appreciated
     
    Last edited: Oct 11, 2018
  28. runekyndal

    runekyndal n3wb

    Joined:
    Dec 19, 2017
    Messages:
    17
    Likes Received:
    0
    bit of pinout i found / fixed
     

    Attached Files:

  29. divx118

    divx118 n3wb

    Joined:
    Aug 18, 2018
    Messages:
    24
    Likes Received:
    4
    Location:
    Netherlands
    @runekyndal It loads the kernel (zImage) from the romfs image. See the output of the serial console. So if you already reflashed the romfs image, and it still doesn't want to boot the kernel, you are using the wrong firmware.

    Code:
    find_squashfs_file: name bin, start_block 0, offset 2676, type 1
    
    find_squashfs_file: name boot, start_block 0, offset 2916, type 1
    
    read inode: name boot, sb 0, of 2916, type 1
    
    find_squashfs_file: name zImage.img, start_block 0, offset 2708, type 2
    
    read inode: name zImage.img, sb 0, of 2708, type 2
    
    ### FS load complete: 2821835 bytes loaded to 0x81000000
    
    ## Booting kernel from Legacy Image at 81000000 ...
    
       Image Name:   Linux-4.9.37
    
       Image Type:   ARM Linux Kernel Image (uncompressed)
    
       Data Size:    2821771 Bytes = 2.7 MiB
    
       Load Address: 80008000
    
       Entry Point:  80008000
    
       Loading Kernel Image ... OK
    
    OK
    
    
    
    Starting kernel ...
    
    
     
  30. runekyndal

    runekyndal n3wb

    Joined:
    Dec 19, 2017
    Messages:
    17
    Likes Received:
    0
    hm.. well if that's the case, then im in a bit of a pinch. i have tried several firmwares. unpack into my TFTP folder and flashed with "run da" , du,dr,dw,dl,dc

    my most current boot up

    Code:
    U-Boot 2010.06-svn1009 (Apr 23 2018 - 15:33:45)
    
    Check Flash Memory Controller v100 ... Found
    SPI Nor(cs 0) ID: 0xef 0x40 0x18
    spi_w25q256fv_qe_enable(193): Error: Disable Quad failed! reg:0x2
    Block:64KB Chip:16MB Name:"W25Q128(B/F)V"
    CONFIG_CLOSE_SPI_8PIN_4IO = y.
    at hifmc100_setTB() mid:0xef,chipsize:0x1000000 <no>.
    unlock all.
    SPI Nor total size: 16MB
    In:    serial
    Out:   serial
    Err:   serial
    USB:   scanning bus for devices... 2 USB Device(s) found
    usb_stor_get_info->1431,blksz:512
    1 Storage Device(s) found
    device name usb!
    Interface:  USB
      Device 0: Vendor: SCSI     Rev: 1.00 Prod: DISK1.8.4.9.656
                Type: Removable Hard Disk
                Capacity: 7695.0 MB = 7.5 GB (15759456 x 512)
    
    No valid FAT fs found
    file_fat_detectfs failed, name:usb
    PHY 0x02: OUI = 0x1374, Model = 0x07, Rev = 0x02
    Net PHY: AR8035
    at higmac_demux() phy_intf:2 [0:mii,1:rmii,2:rgmii];MAC_TXCKOUT_MUX_REG value:0x1 [1,rgmii;2,mii;3,rmii;]
    PHY 0x02: OUI = 0x1374, Model = 0x07, Rev = 0x02
    change register for AR8035
    CONFIG RGMII <<222>>
    at higmac_net_adjust_link() port_mode:45,speed_mode:0
    ETH1: PHY(phyaddr=3, rgmii) link UP: DUPLEX=HALF : SPEED=10M
    MAC:   00-0B-3F-00-00-01
    Press CTRL-C to abort autoboot in 2 seconds16384 KiB hi_fmc at 0:0 is now current device
    CFG_BOOT_ADDR:0x0 argc 2 argv[0] logoload
    ### /UbootLogo/ UbootLogoload complete:bytes  oadaddr0x82000000 loaded to 0x9f000000
    cramfs: wrong magic
    cramfs: wrong magic
    ### /UbootLogo/ LOAD ERROR<ffffffff> !
    jpeg decoding ...
    <<addr=0x9f000000, size=0xb85f9, vobuf=0x9f600000>>
    addr:0x80870b24,size:755193,logoaddr:0x9f000000,:ff,dd
    load jpeg err.
    stMaxRect.u32Width:1024, stMaxRect.u32Height:768.
    HDMI_INFO:DispFmt2HdmiTiming[383] ,Non CEA video timing:17
    HDMI_INFO:Hdmi_PixelFreqSearch[127] ,u32Fmt17.
    srcAddr 0x82000000, dstAddr 0x81000000
    unknow
    read_super_m faile
    ### FS LOAD ERROR<0> for boot/zImage.img!
    Wrong Image Format for bootm command
    ERROR: can't get kernel image!
    hisilicon #
    

    and now this morning... u-boot not so much either... Sigh.

    I'm pretty sure i have a bad flash chip. and / or pretty propper bricked haha..
    i have the new part and it looks like i will need to program that and replace

    any chance of making / finding a complete working .hex file for programming direct like that ?

    R