DS-7716NI0I4(B) reset password

D

dimi3s

n3wb
Mar 31, 2024
3
0
Curaçao
Hello,

I have recently acquired a Hikvision DS-7716NI0I4(B) NVR that has not been reset and is still password protected.
Reading around online I can see that there could be various methods of resetting the unit. Unfortunately none of them have worked yet.
The ones that were already tried were:

1. Reset button. Unfortunately this unit does not have one. And removing the small battery to try to reset the onboard settings also did not help.
2. Send the exported xml file from the SADP tool to Hikvision technical support. Unfortunately the returned xml files from Hikvision support did not do much and just generated the below error.

Hikvision NVR error msg.png
and

Hikvision NVR error msg 2022.png

It was understood that the exported xml file from the NVR could not be too old and would have to be recent. This was also tried with the same results.

3. Try to upgrade the firmware of the NVR via serial connection. This was tried today but with no result. The firmware that can be used for this NVR is here.
A 1M Startech DB9 RS232 Serial Null Modem Cable F/F was bought and connected to the NVR and a laptops COM1 port.
This serial connection was configured in Putty with the below:

Baud rate: 115200
Data bit: 8
Stop bit: 1
Parity: none
Flow control: XON/XOFF

When starting up the NVR without any other interaction the below is seen.

Code: 
U-Boot 2010.06-svn58957 (Mar 29 2021 - 20:03:59)

Hit ctrl+u to stop autoboot:  0
Mounting yaffs2 mount point/partnum: nand/0
Configures yaffs mount nand success!
Copy /nand/uImage to 0x42000000...      [DONE]
   Verifying RSA ... OK
## Booting kernel from Legacy Image at 42000000 ...
   Loading Kernel Image ... OK
OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
[    0.000000] need to Authorization
[    2.639178] init(1) called reboot syscall, cmd: 0x0.
[    6.592629] libphy: 1:07 - Link is Up - 1000/Full
[   56.203052] libphy: 1:07 - Link is Up - 1000/Full
[   89.872675] libphy: 1:07 - Link is Up - 1000/Full
[  149.055503] [APP]dvr_main_sc1805<2009>: tty unauthorized
[  149.090012] [APP]dvr_main_sc1805<2009>: !!!!!!!!!!!!!!!sc_hicore is start ok time[1073610743]!!!!!!!!!!!!!!!!

And when pressing CTRL+U at the beginning (which need to be done within 2 seconds) the below is seen.
And no other command entered performs changes or does something.

Code: 
Uncompressing Linux...

U-Boot 2010.06-svn58957 (Mar 29 2021 - 20:03:59)

Hit ctrl+u to stop autoboot:  0
HKVS $
HKVS $
HKVS $
HKVS $ help
HKVS $ /?
HKVS $ ls
HKVS $ dir
HKVS $ sudo
HKVS $ ping
HKVS $ --?
HKVS $

Could someone help me out with this or point out what it is that is not done correctly from my side.
Thank you very much!
 
Last edited:
Those commands produce the below.

Code: 
HKVS $ setenv ';printenv'
bootcmd=tftp 0x42000000 $(bootfile);bootm 0x42000000;
bootdelay=1
baudrate=115200
ipaddr=192.0.0.64
serverip=192.0.0.128
gatewayip=192.0.0.1
netmask=255.255.255.0
bootfile=uImage
ver=U-Boot 2010.06-svn58957 (Mar 29 2021 - 20:03:59)
hik_ver=verison V2.0-58808-58957 (build 20210329200422 root)
passwd=4AZfVZmgV1XcxW/DbW+n1mniM29r65eMqDr90Ivrq1k=
stdin=serial
stdout=serial
stderr=serial
phyaddr0=3
phyaddr1=7
mdio_intf=rgmii
ethaddr=08:a1:89:3d:97:b6
sec=tftp 0x42000000 Ky2015-1-H3536-uImage_sec;bootm 0x42000000;
default=y2mount /nand;y2rdm /nand/uImage 0x42000000;
verify=n
tftpblocksize=8192
bootargs=mem=1148M console=ttyS0,115200n8 auth=1

Environment size: 644/4092 bytes


Code: 
HKVS $ setenv ';help'
?       - alias for 'help'
bootm   - boot application image from memory
ddr     - ddr training function
getinfo - print hardware information
go      - start application at address 'addr'
help    - print command description/usage
md      - memory display
mii     - MII utility commands
mm      - memory modify (auto-incrementing address)
mw      - memory write (fill)
nand    - NAND sub-system
nboot   - boot from NAND device
ping    - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
reset   - Perform RESET of the CPU
run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv  - set environment variables
sf      - SPI flash sub-system
tftp    - tftp  - download or upload image via network using TFTP protocol
version - print monitor version

I'm assuming I can use the tftp command to try and upload the firmware?
If so, what would the correct syntax for this be?
 
dimi3s said:
I'm assuming I can use the tftp command to try and upload the firmware?
If so, what would the correct syntax for this be?
Click to expand...
I'm guessing a bit - re-installing the firmware doesn't always also reset the device to default settings.
And I don't see a erasecfg command in your help list above.

Set the PC IP address to match what's shown for serverip above, start a normal tftp server and have the digicap.dav firmware file in the same folder as the tftp server.
At the bootloader prompt use
setenv ';update'
 
Send the exported xml file from the SADP tool to Hikvision technical support. Unfortunately the returned xml files from Hikvision support did not do much and just generated the below error.

Thats did not work because you probably received xml the next day. They work for the same day only.
 
alastairstevenson said:
I'm guessing a bit - re-installing the firmware doesn't always also reset the device to default settings.
And I don't see a erasecfg command in your help list above.

Set the PC IP address to match what's shown for serverip above, start a normal tftp server and have the digicap.dav firmware file in the same folder as the tftp server.
At the bootloader prompt use
setenv ';update'
Click to expand...

Making use of the update and tftp commands I managed to upload the new firmware. With this the NVR got in an inactive state and I could activate it again by providing a new password.
Thanks for the help!!

trempa92 said:
Send the exported xml file from the SADP tool to Hikvision technical support. Unfortunately the returned xml files from Hikvision support did not do much and just generated the below error.

Thats did not work because you probably received xml the next day. They work for the same day only.
Click to expand...

This was also done but the result remained the same.
 
You must log in or register to reply here.
Top Bottom