UART/RS232 on NBD8008R - 3536DV100 V1.01

Discussion in 'Firmware' started by divx118, Aug 19, 2018.

Share This Page

  1. Nhat Huy

    Nhat Huy n3wb

    Joined:
    Jul 27, 2018
    Messages:
    5
    Likes Received:
    1
    Location:
    Viet Nam
    can you share me backup rom hex. i unbrick my nvr i lose uboot
     
  2. kirikomori

    kirikomori n3wb

    Joined:
    Sep 18, 2018
    Messages:
    1
    Likes Received:
    0
    Location:
    japan
    Hey, nice guy.
    Thank you very much for Haching.It became very helpful.
    Before discovering this article, connect a serial console,I just looked at "Starting kernel ..." and gave it up.

    Unlike Firmware, I examined the defeat of the control panel, so keep the circuit diagram.

    [​IMG]

    For all NBD8008R users :)
     
  3. divx118

    divx118 n3wb

    Joined:
    Aug 18, 2018
    Messages:
    24
    Likes Received:
    5
    Location:
    Netherlands
    @kirikomori Thanks for the diagram, I can use that to control the menu with my raspberrypi.
    @Nhat Huy What do you exactly want? You can just download the firmware and unpack it to get the hex data.
     
  4. Nhat Huy

    Nhat Huy n3wb

    Joined:
    Jul 27, 2018
    Messages:
    5
    Likes Received:
    1
    Location:
    Viet Nam
    i have a nvr board use Hi3536D chip all schematic same NBD8008 xiongmai hardware. I try flash uboot and then flash fw via UART, nvr boot up and run but only 1 frame and serial and mac is default. Maybe i lost rom chip 24c08 ( mac + serial ) or it include master rom ( address 3FC00 to 40000) can you backup your rom via UART but I worry i do it you and me same cloud id.
     
  5. divx118

    divx118 n3wb

    Joined:
    Aug 18, 2018
    Messages:
    24
    Likes Received:
    5
    Location:
    Netherlands
    @Nyat Huy, that is what I mean. You can get the right files from the firmware file.
    General_General_NBD8008R-PL_V4.02.R11.7601.Nat.OnvifC.20180901.bin
    Just unzip the .bin to get the below files and then flash them in uboot. Reflashing romfs, web and custom should get you going again.
    web-x.cramfs.img
    custom-x.cramfs.img
    user-x.cramfs.img
    romfs-x.cramfs.img
    logo-x.cramfs.img
    u-boot.bin.img
    InstallDesc

    BTW sorry for the late reaction. a bit too busy at work lately.
     
  6. divx118

    divx118 n3wb

    Joined:
    Aug 18, 2018
    Messages:
    24
    Likes Received:
    5
    Location:
    Netherlands
    If someone wants to build a box with a 3D printer for the NBD8008R - 3536DV100 V1.01 print I have designed a simple one Search Thingiverse - Thingiverse Tinkercad links are also there so you can customize it. There are 3 parts bottom, top and back. HDD can be screwed to the top.
     
  7. runekyndal

    runekyndal n3wb

    Joined:
    Dec 19, 2017
    Messages:
    17
    Likes Received:
    0
    i have the same board. and i have unfortunately bricked it. (working U-boot)
    but corroupted kernel

    i have not been able to find the kernel in any update files yet.

    any chance you have a complete dump file, individual files to help me recover via TFTP?

    u-boot.bin.img
    user-x.cramfs.img
    romfs-x.cramfs.img
    web-x.cramfs.img
    logo-x.cramfs.img
    custom-x.cramfs.img

    update.img
    zImage.img
    mtd-x.jffs2.img

    or could pull them off your working board for me ?
    would be greatly appreciated
     
    Last edited: Oct 11, 2018
  8. runekyndal

    runekyndal n3wb

    Joined:
    Dec 19, 2017
    Messages:
    17
    Likes Received:
    0
    bit of pinout i found / fixed
     

    Attached Files:

  9. divx118

    divx118 n3wb

    Joined:
    Aug 18, 2018
    Messages:
    24
    Likes Received:
    5
    Location:
    Netherlands
    @runekyndal It loads the kernel (zImage) from the romfs image. See the output of the serial console. So if you already reflashed the romfs image, and it still doesn't want to boot the kernel, you are using the wrong firmware.

    Code:
    find_squashfs_file: name bin, start_block 0, offset 2676, type 1
    
    find_squashfs_file: name boot, start_block 0, offset 2916, type 1
    
    read inode: name boot, sb 0, of 2916, type 1
    
    find_squashfs_file: name zImage.img, start_block 0, offset 2708, type 2
    
    read inode: name zImage.img, sb 0, of 2708, type 2
    
    ### FS load complete: 2821835 bytes loaded to 0x81000000
    
    ## Booting kernel from Legacy Image at 81000000 ...
    
       Image Name:   Linux-4.9.37
    
       Image Type:   ARM Linux Kernel Image (uncompressed)
    
       Data Size:    2821771 Bytes = 2.7 MiB
    
       Load Address: 80008000
    
       Entry Point:  80008000
    
       Loading Kernel Image ... OK
    
    OK
    
    
    
    Starting kernel ...
    
    
     
  10. runekyndal

    runekyndal n3wb

    Joined:
    Dec 19, 2017
    Messages:
    17
    Likes Received:
    0
    hm.. well if that's the case, then im in a bit of a pinch. i have tried several firmwares. unpack into my TFTP folder and flashed with "run da" , du,dr,dw,dl,dc

    my most current boot up

    Code:
    U-Boot 2010.06-svn1009 (Apr 23 2018 - 15:33:45)
    
    Check Flash Memory Controller v100 ... Found
    SPI Nor(cs 0) ID: 0xef 0x40 0x18
    spi_w25q256fv_qe_enable(193): Error: Disable Quad failed! reg:0x2
    Block:64KB Chip:16MB Name:"W25Q128(B/F)V"
    CONFIG_CLOSE_SPI_8PIN_4IO = y.
    at hifmc100_setTB() mid:0xef,chipsize:0x1000000 <no>.
    unlock all.
    SPI Nor total size: 16MB
    In:    serial
    Out:   serial
    Err:   serial
    USB:   scanning bus for devices... 2 USB Device(s) found
    usb_stor_get_info->1431,blksz:512
    1 Storage Device(s) found
    device name usb!
    Interface:  USB
      Device 0: Vendor: SCSI     Rev: 1.00 Prod: DISK1.8.4.9.656
                Type: Removable Hard Disk
                Capacity: 7695.0 MB = 7.5 GB (15759456 x 512)
    
    No valid FAT fs found
    file_fat_detectfs failed, name:usb
    PHY 0x02: OUI = 0x1374, Model = 0x07, Rev = 0x02
    Net PHY: AR8035
    at higmac_demux() phy_intf:2 [0:mii,1:rmii,2:rgmii];MAC_TXCKOUT_MUX_REG value:0x1 [1,rgmii;2,mii;3,rmii;]
    PHY 0x02: OUI = 0x1374, Model = 0x07, Rev = 0x02
    change register for AR8035
    CONFIG RGMII <<222>>
    at higmac_net_adjust_link() port_mode:45,speed_mode:0
    ETH1: PHY(phyaddr=3, rgmii) link UP: DUPLEX=HALF : SPEED=10M
    MAC:   00-0B-3F-00-00-01
    Press CTRL-C to abort autoboot in 2 seconds16384 KiB hi_fmc at 0:0 is now current device
    CFG_BOOT_ADDR:0x0 argc 2 argv[0] logoload
    ### /UbootLogo/ UbootLogoload complete:bytes  oadaddr0x82000000 loaded to 0x9f000000
    cramfs: wrong magic
    cramfs: wrong magic
    ### /UbootLogo/ LOAD ERROR<ffffffff> !
    jpeg decoding ...
    <<addr=0x9f000000, size=0xb85f9, vobuf=0x9f600000>>
    addr:0x80870b24,size:755193,logoaddr:0x9f000000,:ff,dd
    load jpeg err.
    stMaxRect.u32Width:1024, stMaxRect.u32Height:768.
    HDMI_INFO:DispFmt2HdmiTiming[383] ,Non CEA video timing:17
    HDMI_INFO:Hdmi_PixelFreqSearch[127] ,u32Fmt17.
    srcAddr 0x82000000, dstAddr 0x81000000
    unknow
    read_super_m faile
    ### FS LOAD ERROR<0> for boot/zImage.img!
    Wrong Image Format for bootm command
    ERROR: can't get kernel image!
    hisilicon #
    

    and now this morning... u-boot not so much either... Sigh.

    I'm pretty sure i have a bad flash chip. and / or pretty propper bricked haha..
    i have the new part and it looks like i will need to program that and replace

    any chance of making / finding a complete working .hex file for programming direct like that ?

    R
     
  11. runekyndal

    runekyndal n3wb

    Joined:
    Dec 19, 2017
    Messages:
    17
    Likes Received:
    0
    i think something along these lines should dump the whole 128kbit flash chip to RAM, and then push to TFTP ?

    # sf probe 0;sf read 0x82000000 0x0 0x1600000
    # tftp 0x82000000 flash.bin 0x1600000

    but i'm not entirely sure? also not sure if that's usable to program direct onto the 25q128 with external programmer?

    do you mind doing that? id give it a try anyway

    R
     
    Last edited: Oct 11, 2018
  12. divx118

    divx118 n3wb

    Joined:
    Aug 18, 2018
    Messages:
    24
    Likes Received:
    5
    Location:
    Netherlands
    For some reason I cannot read the flash in u-boot when starting at ie 0xb10000 where the web squashfs files starts. It gives me an "ERROR: read/write area is out of range!" I only can read part of the flash, which is weird. It seems locked.
    So sadly I can't help you with that, however you can just use the image files and strip of the uboot header.
    Code:
    binwalk user-x.cramfs.img
    
    DECIMAL       HEXADECIMAL     DESCRIPTION
    --------------------------------------------------------------------------------
    0             0x0             uImage header, header size: 64 bytes, header CRC: 0x6EF60315, created: 2018-07-19 13:47:28, image size: 4718592 bytes, Data Address: 0x430000, Entry Point: 0xB10000, data CRC: 0x2A278CF8, OS: Linux, CPU: ARM, image type: OS Kernel Image, compression type: gzip, image name: "linux"
    64            0x40            Squashfs filesystem, little endian, version 4.0, compression:xz, size: 4717676 bytes, 153 inodes, blocksize: 65536 bytes, created: 2018-07-19 13:47:28
    
    Then:
    NOTE: skip is the decimal value of the binwalk output of Squashfs filesystem and count are the size in bytes of the squashfs filesystem. You also will see Data Address: 0x430000, Entry Point: 0xB10000 in the uboot header which is important for where it should be on the flash.


    Code:
    dd if=user-x.cramfs.img bs=1 skip=64 count=4717676 of=user-x.cramfs.img.stripped
    4717676+0 records in
    4717676+0 records out
    4717676 bytes (4,7 MB, 4,5 MiB) copied, 10,593 s, 445 kB/s
    
    When I look at your latest output on serial, it seems that you need signed firmware. This could be because you flashed a wrong uboot. I never touched the uboot on my device, too dangerous IMO. When you have a good uboot it is easy to reflash the rest if something goes wrong.
    Code:
    cramfs: wrong magic
    cramfs: wrong magic
    When I do a printenv in my uboot shell I have a variable set "verify=n" this could be the one that sets a check if you need a signed cramfs.
     
  13. runekyndal

    runekyndal n3wb

    Joined:
    Dec 19, 2017
    Messages:
    17
    Likes Received:
    0
    okay. thanks for trying..

    im 100% now that i need to replace the flash chip. so i need to program the whole thing, uboot and all.
    so stripping the uImage header off one of my user-x.cramfs.img files as per above should produce a flashable file ?

    R
     
  14. divx118

    divx118 n3wb

    Joined:
    Aug 18, 2018
    Messages:
    24
    Likes Received:
    5
    Location:
    Netherlands
    Yeah, you should do that for all the files to get the complete flash. You also could try uboot first and see if that works. Then flash the rest from the uboot shell.

    To clarify: The user-x.cramfs.img was just an example file.
     
  15. runekyndal

    runekyndal n3wb

    Joined:
    Dec 19, 2017
    Messages:
    17
    Likes Received:
    0
    ok, i got a stripped u-boot file now, just cobbling together a programmer (just ordered a dedicated one online) but i got a few options here.
    i think my buspirate is the go-to for this

    u-boot should be programmed, star starting 0x1000000 i believe?

    R
     
  16. divx118

    divx118 n3wb

    Joined:
    Aug 18, 2018
    Messages:
    24
    Likes Received:
    5
    Location:
    Netherlands
    No, at least not on my firmware and others also not that would be not logical. It would normally always start at 0x0
    Code:
    maurice@maurice-N73SM:~/Downloads/extract$ binwalk u-boot.bin.img
    
    DECIMAL       HEXADECIMAL     DESCRIPTION
    --------------------------------------------------------------------------------
    0             0x0             uImage header, header size: 64 bytes, header CRC: 0x865B27D3, created: 2018-07-19 13:47:22, image size: 140597 bytes, Data Address: 0x0, Entry Point: 0x40000, data CRC: 0x37220CE3, OS: Linux, CPU: ARM, image type: Firmware Image, compression type: gzip, image name: "linux"
    21664         0x54A0          LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 330144 bytes
    
    
    Data Address: 0x0, --> starting at address 0x0
    Entry Point: 0x40000 --> End address

    So from 0x0 to 0x40000 is reserved for u-boot.
     
  17. runekyndal

    runekyndal n3wb

    Joined:
    Dec 19, 2017
    Messages:
    17
    Likes Received:
    0
    i'm trying to find where i got the 0x1000000 from... in my various screen logs.. oh well.

    i will give 0x0 a go first.. i have converted my board to DIP8 now.. :winktongue:

    R
     
    Last edited: Oct 11, 2018
  18. runekyndal

    runekyndal n3wb

    Joined:
    Dec 19, 2017
    Messages:
    17
    Likes Received:
    0
    hm. so it took a couple of hours for flashrom to read in, write and verify u-boot.bin.img.stripped (u-boot.bin)? through my buspirate.
    (successfully)

    but no luck on boot up.

    my uboot is only 139.373 byte ?

    root@odroidxu4:~# binwalk u-boot.bin.img (before stripping uimage header)

    DECIMAL HEXADECIMAL DESCRIPTION
    --------------------------------------------------------------------------------
    0 0x0 uImage header, header size: 64 bytes, header CRC: 0x94549E76, created: 2018-03-26 07:01:23, image size: 139373 bytes, Data Address: 0x0, Entry Point: 0x40000, data CRC: 0x43AD27C1, OS: Linux, CPU: ARM, image type: Firmware Image, compression type: gzip, image name: "linux"
    19008 0x4A40 LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 335552 bytes

    am i supposed to uncompress the bin file out of the .bin out of the img file first ? (335552 bytes)
    which wont fit in the first 0-0x40000 reserved for uboot

    R
     
    Last edited: Oct 11, 2018
  19. runekyndal

    runekyndal n3wb

    Joined:
    Dec 19, 2017
    Messages:
    17
    Likes Received:
    0
    starting the cooking over.. haha

    General_General_NBD8008R-PL_V4.02.R11.7601.Nat.OnvifC.20180928.bin
    Code:
    root@odroidxu4:~# dd if=u-boot.bin.img bs=1 skip=64 count=4717676 of=u-boot.bin      (strip uimage header 64 byte)
    
    root@odroidxu4:~# dd if=u-boot.bin of=flash-u-boot.bin bs=1 count=1 seek=16777215   (Expand image size to fit Flash size to avoid flashrom error)
    
    root@odroidxu4:~# flashrom -VV -p buspirate_spi:dev=/dev/ttyUSB0 -c W25Q128.V -w flash-u-boot.bin  (flash 25q128 with flashrom and buspirate)
    
    this is the workflow.. different bin file. but that's what didn't work for me

    something obvious wrong ?

    R
     
  20. divx118

    divx118 n3wb

    Joined:
    Aug 18, 2018
    Messages:
    24
    Likes Received:
    5
    Location:
    Netherlands
    This for me will create a file with all zeros. except the last byte --> bs=1 count=1
    Try the following this will add zeros to the end of u-boot.bin until it reaches the size 16777215
    Code:
     truncate -s 16777215 u-boot.bin
    
     
    Last edited: Oct 12, 2018