Menu
What's new

Hikvision - Clearing Passwords and/or Loading Firmware via TTL Serial

John Williamson

John Williamson

Getting the hang of it
Joined
Apr 9, 2019
Messages
174
Reaction score
90
Location
UK
alastairstevenson said:
If this was from a V3.x version that is likely to be the cause of the problem.
A minimum V3.x version and staged updates were needed to progress to the NVR 4 firmware.
Worth trying an older version, certainly.

By the way - for your own notes, or for posting, if using PuTTY for the serial console, check out the 'copy rollback to clipboard' facility, top left menu button.
This can then be used to paste the rollback into such as Notepad for editing, annotating, posting as text etc much easier than screenshots.
Click to expand...
I've just tried the latest V3 (3.4.109) for the model but just get the same result - frozen at 'booting the kernel'. I've installed so many Hik NVRs in the last 10 years and never had a failure (other than PSUs) so this is the first time I've had to resort to flashing the firmware this way.
 
John Williamson

John Williamson

Getting the hang of it
Joined
Apr 9, 2019
Messages
174
Reaction score
90
Location
UK
Here is the output from putty:


U-Boot 2010.06-svn (Dec 28 2015 - 10:42:45)[V1.2.1]

Protected at offset: 0x0, size:0x40000 Protection status:[0x22f]=>[0x22f].
Hit ctrl+u to stop autoboot: 0

This program will upgrade software.
***
  • ATTENTION!! PLEASE READ THIS NOTICE CAREFULLY! *
  • Don't reset machine,or anything that interrupt it. *
  • The upgrade process must finish in 10 minutes! *
  • If this program fails,machine might be unusable, *
  • and you will need to reflash again. *
  • If you find this too risky,power off machine now. *
***

Now press [u/U] key to upgrade software: u
File system error,please upgrade by TFTP

Please input ip address of device: 192.168.0.64
Please input ip address of upgrade server: 192.168.0.35
Confirm?(y/n): y
timeout for link [4999]!
MAC: 18-68-CB-96-B6-63
TFTP from server 192.168.0.35; our IP address is 192.168.0.64
Download Filename 'digicap.dav'.
Download to address: 0x40008000
Downloading: #################################################
done
Bytes transferred = 41872280 (27eeb98 hex)
headEx checkSum ok !
uImage checkSum ok !
start.sh checkSum ok !
sys_app.tar.lzma checkSum ok !
gui_res.tar.lzma checkSum ok !
webs.tar.lzma checkSum ok !
new_10.bin checkSum ok !
check all mounted partitions have been unmounted...
--- OK!
start to erase nand flash partition 0 start: 0x200000 end: 0x6200000 len: 0x6000000 ...
Erasing at 0x61e0000 -- 100% complete.
--- OK!
start to erase nand flash partition 1 start: 0x6200000 end: 0xC200000 len: 0x6000000 ...
Erasing at 0xc1e0000 -- 100% complete.
--- OK!
start to erase nand flash partition 2 start: 0xC200000 end: 0x10000000 len: 0x3E00000 ...
Erasing at 0xffe0000 -- 100% complete.
--- OK!

start to write files to partition 0...
Configures yaffs mount nand success!
8-1. write nand/headEx len: 1024
8-2. write nand/uImage len: 8502640
8-3. write nand/start.sh len: 7216
8-4. write nand/sys_app.tar.lzma len: 20960240
8-5. write nand/gui_res.tar.lzma len: 7354240
8-6. write nand/webs.tar.lzma len: 5045080
8-7. write nand/new_10.bin len: 680
8-8. write flag file nand/version.bin len: 4
update partition 0 success!

start to write files to partition 1...
Configures yaffs mount nand1 success!
8-1. write nand1/headEx len: 1024
8-2. write nand1/uImage len: 8502640
8-3. write nand1/start.sh len: 7216
8-4. write nand1/sys_app.tar.lzma len: 20960240
8-5. write nand1/gui_res.tar.lzma len: 7354240
8-6. write nand1/webs.tar.lzma len: 5045080
8-7. write nand1/new_10.bin len: 680
8-8. write flag file nand1/version.bin len: 4
update partition 1 success!
Press ENTER key to reboot
resetting ...


U-Boot 2010.06-svn (Dec 28 2015 - 10:42:45)[V1.2.1]

Protected at offset: 0x0, size:0x40000 Protection status:[0x22f]=>[0x22f].
Hit ctrl+u to stop autoboot: 0
Mounting yaffs2 mount point/partnum: nand/0
Configures yaffs mount nand success!
Copy /nand/uImage to 0x42000000... [DONE]
timeout for link [4999]!
MAC: 18-68-CB-96-B6-63
|NUL ethaddr| TFTP server not found
## Booting kernel from Legacy Image at 42000000 ...
Verifying Checksum ... OK
Loading Kernel Image ... OK
OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.

Is the 'Booting from legacy' normal/expected?
 
Last edited:
alastairstevenson

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,984
Reaction score
6,805
Location
Scotland
That transcript looks normal - almost identical to one I just compared with for a 9632.
I'd have expected the device to restart OK.
It's a puzzle.

John Williamson said:
Is the 'Booting from legacy' normal/expected?
Click to expand...
Yes, from what I've seen.
From the DS-9632NI-I8
Code: 
Press ENTER key to reboot
resetting ...


U-Boot 2010.06-svn (Aug 14 2015 - 14:50:25)

Hit ctrl+u to stop autoboot:  0
timeout for link [4442]!
yaffs: Mounting /nand
yaffs: restored from checkpoint
Copy /nand/uImage to 0x42000000...      [DONE]
MAC:   4C-BD-8F-9C-7D-B8
|NUL ethaddr| TFTP server not found
## Booting kernel from Legacy Image at 42000000 ...
   Verifying Checksum ... OK
   Loading Kernel Image ... OK
OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
[    2.616685] init(1) called reboot syscall, cmd: 0x0.
Thu Jan  1 00:00:02 UTC 1970

Starting udev:      [ OK ]
bootpart :0
[    6.572335] libphy: 1:07 - Link is Up - 1000/Full
 
S

stealthgt

n3wb
Joined
May 1, 2024
Messages
2
Reaction score
0
Location
Anywhere
jaxpher said:
good day everyone

setenv ';update'
setenv '; '

setenv in not working
any solution fot this?
HKVS $



U-Boot 2019.04 (Nov 20 2021 - 18:35:17 +0800), Build: jenkins-Backend-BSP-CCI-4941
Click to expand...
Hi, I have this same issue, HKVS $ prompt is not responding to any the upgrade commands setenv bootcmd ';update' or setenv ';update'
Does anybody know how the solution? Any help is greatly appreciated.
 
K

kiljaeded

n3wb
Joined
May 14, 2024
Messages
1
Reaction score
0
Location
narnia
stealthgt said:
Hi, I have this same issue, HKVS $ prompt is not responding to any the upgrade commands setenv bootcmd ';update' or setenv ';update'
Does anybody know how the solution? Any help is greatly appreciated.
Click to expand...
Do you know the dvr password?
 
M

mhmdysfy

n3wb
Joined
Feb 29, 2020
Messages
1
Reaction score
0
Location
iran
alastairstevenson said:
I don't know if it's case-sensitive - but if it doesn't get you to the bootloader prompts, use a lower-case b

Then use either
printenv
or if that is ignored
setenv ';printenv'

and check out the values shown against
serverip
ipaddr
These are what are used for the tftp updater, may be 192.168.1.128 instead of the old 192.0.0.128

If the firmware filesize is larger than 32MB, the Hikvision tftp updater won't handle it, in which case either use a standard tftp server and the command :
setenv ';update'

or the Scott Lamb tftp updater Python2 clone :
github.com

GitHub - scottlamb/hikvision-tftpd: Unbrick a Hikvision device (NVR or camera) via TFTP

Unbrick a Hikvision device (NVR or camera) via TFTP - scottlamb/hikvision-tftpd
github.com github.com
Click to expand...
Hi
how should i use this tftp python for updating?
 
jote29

jote29

n3wb
Joined
May 25, 2024
Messages
1
Reaction score
0
Location
Argentina
Succesfull upgrade


DVR DS-7216HGHI-K1(S)、DS-7216HGHI-K2(S)

model K72HGH Turbo 4.0

firware update V4.30.120_200630

Upgrade using Python 2.7 and the script hikvision_tftpd.py

Prolific interface

Windows driver PL23XX_Prolific_DriverInstaller_v408, windows 10


Putty log


U-Boot 2010.06-svn31947 (Mar 25 2019 - 14:02:13)

Hit ctrl+u to stop autoboot: 0
HKVS $ setenv ';update'
using update v3...
### CRAMFS load complete: 3168536 bytes loaded to 0x82000000
the uImage support update_v3.
Verifying RSA ... OK
## Booting kernel from Legacy Image at 82000000 ...
Loading Kernel Image ... OK
OK

Starting kernel ...

[ 2.022804] init(1) called reboot syscall, cmd: 0x0.
Thu Jan 1 00:00:02 UTC 1970

mv: can't rename 'ubi*': No such file or directory
Starting udev: [ OK ]

This program will download and upgrade software.
***
  • ATTENTION!! PLEASE READ THIS NOTICE CAREFULLY! *
  • Don't reset machine,or anything that interrupt it. *
  • The upgrade process must finish in 10 minutes! *
  • If this program fails,machine might be unusable, *
  • and you will need to reflash again. *
  • If you find this too risky,power off machine now. *
***


waiting for net_link [10]...
waiting for net_link [9]...
[ 5.036233] hi_gmac_v200 100a0000.ethernet eth0: Link is Up - 100Mbps/Full - flow control rx/tx
ftp server not exit[-111]!

tftp transmit over,file size[8192][ 0.008 MB].

ftp server not exit[-111]!
################################ [ 8.000 MB]
############################
tftp transmit over,file size[15794540][15.064 MB].
download succeed!
[cramfs.img ]: offset is 108 size is 15794176
RSA verifying ... OK
cramfs.img checkSum ok !

***
  • ATTENTION!! PLEASE READ THIS NOTICE CAREFULLY ! *
  • Don't power off or anything that interrupt it ! *
  • The upgrade process will finish in 3 minutes ! *
  • If this program fails, machine might be unusable ! *
***

Erasing cfg file ... Done
Writing ...
|##################################################| 100%
Done
Checking ...
|##################################################| 100%
Done
Update successfully !
Press ENTER key to reboot
 
thefoxking-bl

thefoxking-bl

n3wb
Joined
May 28, 2024
Messages
1
Reaction score
0
Location
UK
i have a DS-2CD2542FWD-IWS20161125BBWR685297048 plugged into a tp link extender and it goes "Network Timeout" even though i have internet on my laptop
 
You must log in or register to reply here.
Top