On XM board have 2 ic rom (24c08 and 25FL128). 24c08 with serial id + mac address, 25FL128 is OS. If board have 2 rom you can flash uboot ( flash tool xeltek ) and then flash all by TFTP. Your NVR is recovery (not lost ID + chanel number). If board only 1 rom 25FL128 you find and backup address...