Hikvision - Clearing Passwords and/or Loading Firmware via TTL Serial

[John Williamson]

If this was from a V3.x version that is likely to be the cause of the problem.
A minimum V3.x version and staged updates were needed to progress to the NVR 4 firmware.
Worth trying an older version, certainly.

By the way - for your own notes, or for posting, if using PuTTY for the serial console, check out the 'copy rollback to clipboard' facility, top left menu button.
This can then be used to paste the rollback into such as Notepad for editing, annotating, posting as text etc much easier than screenshots.

I've just tried the latest V3 (3.4.109) for the model but just get the same result - frozen at 'booting the kernel'. I've installed so many Hik NVRs in the last 10 years and never had a failure (other than PSUs) so this is the first time I've had to resort to flashing the firmware this way.

 

[John Williamson]

Here is the output from putty:


U-Boot 2010.06-svn (Dec 28 2015 - 10:42:45)[V1.2.1]

Protected at offset: 0x0, size:0x40000 Protection status:[0x22f]=>[0x22f].
Hit ctrl+u to stop autoboot: 0

This program will upgrade software.
***

• ATTENTION!! PLEASE READ THIS NOTICE CAREFULLY! *
• Don't reset machine,or anything that interrupt it. *
• The upgrade process must finish in 10 minutes! *
• If this program fails,machine might be unusable, *
• and you will need to reflash again. *
• If you find this too risky,power off machine now. *

***

Now press [u/U] key to upgrade software: u
File system error,please upgrade by TFTP

Please input ip address of device: 192.168.0.64
Please input ip address of upgrade server: 192.168.0.35
Confirm?(y/n): y
timeout for link [4999]!
MAC: 18-68-CB-96-B6-63
TFTP from server 192.168.0.35; our IP address is 192.168.0.64
Download Filename 'digicap.dav'.
Download to address: 0x40008000
Downloading: #################################################
done
Bytes transferred = 41872280 (27eeb98 hex)
headEx checkSum ok !
uImage checkSum ok !
start.sh checkSum ok !
sys_app.tar.lzma checkSum ok !
gui_res.tar.lzma checkSum ok !
webs.tar.lzma checkSum ok !
new_10.bin checkSum ok !
check all mounted partitions have been unmounted...
--- OK!
start to erase nand flash partition 0 start: 0x200000 end: 0x6200000 len: 0x6000000 ...
Erasing at 0x61e0000 -- 100% complete.
--- OK!
start to erase nand flash partition 1 start: 0x6200000 end: 0xC200000 len: 0x6000000 ...
Erasing at 0xc1e0000 -- 100% complete.
--- OK!
start to erase nand flash partition 2 start: 0xC200000 end: 0x10000000 len: 0x3E00000 ...
Erasing at 0xffe0000 -- 100% complete.
--- OK!

start to write files to partition 0...
Configures yaffs mount nand success!
8-1. write nand/headEx len: 1024
8-2. write nand/uImage len: 8502640
8-3. write nand/start.sh len: 7216
8-4. write nand/sys_app.tar.lzma len: 20960240
8-5. write nand/gui_res.tar.lzma len: 7354240
8-6. write nand/webs.tar.lzma len: 5045080
8-7. write nand/new_10.bin len: 680
8-8. write flag file nand/version.bin len: 4
update partition 0 success!

start to write files to partition 1...
Configures yaffs mount nand1 success!
8-1. write nand1/headEx len: 1024
8-2. write nand1/uImage len: 8502640
8-3. write nand1/start.sh len: 7216
8-4. write nand1/sys_app.tar.lzma len: 20960240
8-5. write nand1/gui_res.tar.lzma len: 7354240
8-6. write nand1/webs.tar.lzma len: 5045080
8-7. write nand1/new_10.bin len: 680
8-8. write flag file nand1/version.bin len: 4
update partition 1 success!
Press ENTER key to reboot
resetting ...


U-Boot 2010.06-svn (Dec 28 2015 - 10:42:45)[V1.2.1]

Protected at offset: 0x0, size:0x40000 Protection status:[0x22f]=>[0x22f].
Hit ctrl+u to stop autoboot: 0
Mounting yaffs2 mount point/partnum: nand/0
Configures yaffs mount nand success!
Copy /nand/uImage to 0x42000000... [DONE]
timeout for link [4999]!
MAC: 18-68-CB-96-B6-63
|NUL ethaddr| TFTP server not found
## Booting kernel from Legacy Image at 42000000 ...
Verifying Checksum ... OK
Loading Kernel Image ... OK
OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.

Is the 'Booting from legacy' normal/expected?

 

[alastairstevenson]

That transcript looks normal - almost identical to one I just compared with for a 9632.
I'd have expected the device to restart OK.
It's a puzzle.

Is the 'Booting from legacy' normal/expected?

Yes, from what I've seen.
From the DS-9632NI-I8

Press ENTER key to reboot
resetting ...


U-Boot 2010.06-svn (Aug 14 2015 - 14:50:25)

Hit ctrl+u to stop autoboot:  0
timeout for link [4442]!
yaffs: Mounting /nand
yaffs: restored from checkpoint
Copy /nand/uImage to 0x42000000...      [DONE]
MAC:   4C-BD-8F-9C-7D-B8
|NUL ethaddr| TFTP server not found
## Booting kernel from Legacy Image at 42000000 ...
   Verifying Checksum ... OK
   Loading Kernel Image ... OK
OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
[    2.616685] init(1) called reboot syscall, cmd: 0x0.
Thu Jan  1 00:00:02 UTC 1970

Starting udev:      [ OK ]
bootpart :0
[    6.572335] libphy: 1:07 - Link is Up - 1000/Full