bricked Hikvision NVR (DS-7716N/16P)

[joeRS12]

Hi

I have bricked my NVR... Its a DS-7716N/16P . It boots now with constant beeps (maybe 10-15 beeps) and then reboots. I have downloaded TFTP tool from Hikvision. But it it cannot connect to the NVR. I can ping the address of it (192.0.0.64) but in TFTP it never sees it. I have tried turning off the firewall but no success. Is there any other way (serial) to recover the bricked NVR ?

Thanks for any help!

Regards

Joe

 

[alastairstevenson]

15 beeps repeating with a gap suggests that EN firmware has been loaded on to a CN NVR.
The serial console will likely be complaining something like "!!!You device is illegal !!! !!!You bought in China!!!" etc

What firmware (link) did you download to the NVR?
How critical is this NVR to you?

I can ping the address of it (192.0.0.64) but in TFTP it never sees it.

Was this the Hikvision tftp updater, and what was the IP address of the PC that it was running on?
Was the PC wired, as opposed to WiFi?

The NVR can be recovered with the use of the serial console.
But the tftp updater should work OK.
You should be able to use this firmware, 5th section down, though the result will be CN menus : 海康威视是全球领先的以视频为核心的物联网解决方案提供商

Where are you located?

 

[joeRS12]

Hello Alastair

thank you for your help.

yes - it is beeping 15 times. But I get no message from the NVR in TFTP server (just the first line - see attachment).

I have installed : http://oversea-download.hikvision.com/uploadfile/Firmware/NVR/E series/NVR_K41_BL_ML_STD_V3.4.92_170228.zip
Before that I had V3.3.4 Build 150616 Multilanguage version

The update was successful in the NVR until it rebooted beeping...

The NVR is important to me as it was not cheap...

It was the Hikvision tftp updater (see attachment).
The PC was wired to the NVR Ethernet port directly (with a regular Ethernet cable). No switch between (but I tried and it didnt make a difference). firewall turned off. Windows 10 Pro 64 bit.
I do have a serial to usb cable in case I need to access it serially - but would need to know the serial pin assignment as it is a a USB with cables attached (not RS232 plug).

Which firmware should I download ? Is it this the right one: http://download.hikvision.com/UploadFile/Soft/NVR/NVR_78_79_EXX_V3.4.95_170626.zip (it doesn't say DS-7716) ?

I am located in Austria.

Thanks

 

[joeRS12]

Hi Alastair

I have been able to connect using the serial cable. Now I just need the right firmware.. I tried this: http://www.hikvisioneurope.com/port...lingual/NVR_NETRA_BL_ML_STD_V3.3.4_150616.zip

unfotunately the firmware (above) were not accepted. During one update it stopped now I cant ping the nvr anymore ...

 

[alastairstevenson]

I tried this: http://www.hikvisioneurope.com/port...lingual/NVR_NETRA_BL_ML_STD_V3.3.4_150616.zip

That is not the correct firmware - it's for a different series of NVR.
Also - it is ML (MultiLanguage) firmware, as was the K41 firmware you installed, which will not work on your CN region NVR.
It is likely that the firmware on the Hikvision CN website that I provided a link to will install OK, though if it does, the result will be CN menus.
However - I do have some firmware that I believe will work OK, I'll send you a link via 'Conversations'.

 

[joeRS12]

Thank you Alastair. I am afraid I am done for good. I ran step 7 from these instructions posted here: http://www.hikvision.msk.ru/_fr/2/How_to_upgrade_.pdf
>> Step7: for some reasons, sometimes the DVR can not load the system and go to menu interface, so this step is necessary. Input “f” then press “enter” to confirm, afterwards input “y” to confirm to format the Flash of DVR

I believe it flashed the SPI.
During the following upgrade (Step 8) I had the wrong firmware the first time. Which completed with errors.
After that I ran the firmware upgrade using : http://www.hikvisioneurope.com/port...lingual/NVR_NETRA_BL_ML_STD_V3.3.4_150616.zip
This update hung in the middle of the update which I had to interrupt.
After the reboot there is now nothing. No 192.0.0.64 to ping. No uboot starting which I could see in the hyperterm console.

I am afraid unless I can use a flash programmer with the correct firmware I am finished ?
Heard of anybody that has used a flash programmer to write the bootloader etc. onto an NVR/camera ?
Where would I get the SW for this ?

Sorry for bothering - I feel really stupid now...

Thanks

Rupert

 

[alastairstevenson]

I ran step 7 from these instructions posted here:

That's fine, it's the normal way to do it when the serial console is available.

I believe it flashed the SPI.

Yes, but only the partition that holds the kernel and application files.

During the following upgrade (Step 8) I had the wrong firmware the first time. Which completed with errors.

Again, if it rejects it there should be no terminal problem.

This update hung in the middle of the update which I had to interrupt.

That's for a different series of NVR.
I'm wondering if it tried to update the bootloader. It depends what files are incorporated in it.
(Doesn't seem to have any bootloader files - I checked the contents)

No uboot starting which I could see in the hyperterm console.

That's not good.

Heard of anybody that has used a flash programmer to write the bootloader etc. onto an NVR/camera ?

Not something I've tried on an NVR, though I have done it on a camera which I think has the same SPI flash chip, which worked OK in-situ.
What is the part number of the SPI chip in your NVR? It is likely to be an 8-pin DIP package.

 

[joeRS12]

oh - hope dies last.. One thing I noticed: when the NVR starts all POE ports light up briefly and it keeps cycling on/off. I.e. after a couple minutes it reboots itself. So some brains atill maybe left .. Hyperterm says its connected but there is nothing showing up in the console and it does not react to keys entered

Where can I find the SPI chip part number ? What do I need to try the flashing ?

Thanks

Rupert

 

[alastairstevenson]

Hyperterm says its connected but there is nothing showing up in the console and it does not react to keys entered

Although I don't see why it should make any difference - PuTTY is a very good all-round serial, telnet / SSH client. Download PuTTY: latest release (0.70)
You have a serial TTL to USB convertor the driver for which creates a virtual COM port on the PC?
Depending on the chipset, some of those drivers can be troublesome.

after a couple minutes it reboots itself. So some brains atill maybe left

That sounds like a possibility. What does the ethernet port do - link detect, activity light?

Where can I find the SPI chip part number ? What do I need to try the flashing ?

You'd have to look around the main board, check out / look up the part numbers printed on the ICs. Tedious.

 

[joeRS12]

Although I don't see why it should make any difference - PuTTY is a very good all-round serial, telnet / SSH client. Download PuTTY: latest release (0.70)
You have a serial TTL to USB convertor the driver for which creates a virtual COM port on the PC?
Depending on the chipset, some of those drivers can be troublesome.

I have both types one which is a female RS232 to USB cable and another one that has 4 wires tangling off one side of a USB cable. I used the female RS232 to USB cable successfully when everything still worked (ie when trying to upgrade). Do I need a different setup now ?

That sounds like a possibility. What does the ethernet port do - link detect, activity light?

The ethernet port does not blink upon boot only one brief yellow/green flash on all POE ports. an inserted USB drives is also not being read (as before).

You'd have to look around the main board, check out / look up the part numbers printed on the ICs. Tedious.

What company should it be from ? I have some GroupTeks, Samsungs and M. Some are hidden under a cooler. Is there any place I can read about the process of flashing the SPI chip.

Thanks Rupert

 

[alastairstevenson]

I have both types one which is a female RS232 to USB cable and another one that has 4 wires tangling off one side of a USB cable. I used the female RS232 to USB cable successfully when everything still worked (ie when trying to upgrade). Do I need a different setup now ?

What you need is a serial TTL to USB convertor - which presumably you have as the setup was working, as opposed to an RS232 interface, which has different and incompatible signal levels.
I'd be very surprised if the updater in the bootloader would have over-written itself - but from what you've described, freezing during the update, and no longer responding, that is what seems to have happened.
The Netra firmware file that you tried is much bigger at 33MB than the SPI flash size of 16MB - I wonder if somehow it wrapped around. But I'm sure there would be a size check before any attempted write operation.

All I can suggest is to re-check your serial console connections just to be sure they are still OK. Also, from the convertor, connect the Rx to Tx and confirm that what you type is echoed.

 

[joeRS12]

thanks. do you happen to have the pin-out of the serial connection on the board. my cable I have is red, black (GND), white (RXD) and green (TXD).

On the board is yellow (CD1) , red (CD3), black (RD1) , orange (CD2) and brown.

which pins should I use ?

 

[joeRS12]

@alastairstevenson I managed to get into the boot phase. Here is what I see (attached). In order not to mess things up - what is the best way forward.

I did not have tftpserver running at the time when I got this screen. I still cant ping the NVR (192.0.0.64) from my PC.
Should I just copy the right digicap.dav to the tftserver directory, start tftpserver and hit "u" ?

 

[joeRS12]

upon starting tftpserver the boot window stopped complaining about being unable to find it.I attachec the putty terminal screen

Does it mean the NVR sees the tftpserver on the PC now ? Do I need the ethernet cable for upgrading or will everything go through the serial cable ?

 

[alastairstevenson]

I managed to get into the boot phase.

That's better! What did you do? That looks perfectly normal.

I still cant ping the NVR (192.0.0.64) from my PC.

That's not a problem - the update program configures the ethernet interface when it's needed.

Should I just copy the right digicap.dav to the tftserver directory, start tftpserver and hit "u" ?

Yes, that's the way to do it.
You will be asked to choose an IP address for the NVR to use (it's just temporary) and the IP address where the tftp server is running.
I've never used the Hikvision tftp updater at this dialogue, always used this one : TFTPD32 : an opensource IPv6 ready TFTP server/service for windows : TFTP server
But if the Hikvision one works, well and good.

upon starting tftpserver the boot window stopped complaining about being unable to find it

That's not a problem, in fact it's best not to run it at that point if you are going to do the upgrade via the bootloader dialogue. Run it after you have interrupted the bootloader, and have the update dialogue on the screen.

Do I need the ethernet cable for upgrading or will everything go through the serial cable ?

You do need the LAN connection - the serial connection is just to do the commands and get the responses.

So you are in the position where you can do a controlled firmware update.
The question now would be - with which firmware?
My view, not 100% confident as you have a 7716N-??/16P, is that :
The CN firmware that I provided a link to earlier in this thread should be OK, but you will get CN menus.
The firmware I sent a link to privately would be better as it will make the NVR into EN with EN menus.

But I think it's not a big risk - the bootloader should stay intact, and the worst would be no different from what you have, an NVR that does not boot, but does have a recovery facility.

 

[joeRS12]

Thank you SO MUCH Alastair!! I am up and running... I think it was Hyperterm that didnt show the boot process - so switching to Putty helped. I guess when I couldnt ping the NVR I was doubly confused. Only with a serial comms and Putty the NVR was able to set up the Ethernet link when upgrading. SO one just needs the TTL USB cable and Putty to get going again I believe.

Thanks Rupert

 

[alastairstevenson]

Well, that's a good result, well done for getting there. I'm glad I was able to help.

Lesson learned - be aware that there are many types of firmware of apparently the same version but for different types of hardware / NVR model.
And forcing the wrong one on via the tftp updater can have bad consequences.
And that having a CN NVR that you'd like to use outside China does impose some constraints ...

 

[scnsa]

Hi, Alastair, i have the same problem as joeRS12, i do upgrade firmware with english version and the unit beeping now.
I can connect to serial with putty and ping to 192.0.0.64. What should i do next?
i need the firmware? please Help me. My units is DS-7732N-E4.
thank you in advance.

Best Regards,

 

[Seeem]

Hi, Alastair, i have the same problem as joeRS12, and scnsa i do upgrade firmware with english version and the unit beeping now.
I can connect to serial with putty and ping to 192.0.0.64. What should i do next?
i need the firmware? please Help me. My NVR DS-7716N-E4 / P16
thank you

Best Regards,

 

[alastairstevenson]

Assuming your current profile status allows it - check your 'conversations'.