Hikvision NVR OEM version Upgradable?

D

DanITman

n3wb
Apr 21, 2017
7
2
Hey guys....trying to upgrade an ebay find. I believe its a DS-7608NI-I2-8P but it actually has a different model in the firmware. It doesn't say Hikvision on the front instead it just says NVR. I've attempted to upgrade the firmware a couple times and it just fails. I finally got UART access to see what the error is. Here it is:

IMG_1967.jpg


I need to upgrade to support some special API endpoints for home automation. See here:

Control4 Smart Home Solution

Control4 Smart Home Solution Hikvision’s Integrated Smart Home Solution Everything you need for home security What we offer Hikvision offers smart home security made easy with a range of modern solutions that integrate with the Control4 remote smart home automation and control systems.
us.hikvision.com us.hikvision.com

Any help is greatly appreciated.
 

Attachments

  • IMG_1967.jpg
    IMG_1967.jpg
    3.6 MB · Views: 54
The model I included is the correct model for hikvision. Its an off brand so the model is weird and doesn't yield many google results.

It came with a firmware and I don't have the firmware file. I've asked the ebay seller if he has it so I can unpack it.

I included a link to the firmware page I've attempted to use.
 
DanITman said:
I included a link to the firmware page I've attempted to use.
Click to expand...
Sorry, I hadn't noticed that, I assumed the page was all about Control4.
The devclass for that firmware is 61, typical for the I-series.
Your screenshot of the update fail suggests the NVR has a devclass of 49 so it might be designated as a different model.

You might just get some more info in a couple of ways :
When you interrupt the bootloader with Control-U, use 'b' at the resulting update prompt.
At the bootloader use printenv to list the environment variables.

If the web GUI allows SSH to be enabled under Security settings -
See if you can establish an SSH session and use the command getHardInfo and see if it yields any info.
The command dmesg might also have some model clues embedded in it.
 
  • Like
Reactions: DanITman
Ok, I was able to dump dmesg and printevn and getHardinfo. I was not able to enable ssh but having the UART it ended up printing out the getHardInfo. I could also send limited commands and was able to get the rest. I also pulled this value that was printed on the board DS-80242 Rev 2.0

Code: 
getHardInfo:
Start at 2022-01-19 19:44:56
Serial NO :0820200515CCRRE42089859WCVU 
V4.1.15 build 190305
softBase:/Platform/trunk:0
KernelVersion: V1.0.0 build 180914
dspSoftVersion: V5.0 build 190215
codecVersion: V5.0 build 190215
hardwareVersion = 0x0
encodeChans = 0
decodeChans = 8
alarmInNums = 4
alarmOutNums = 1
flashsize = 0x1
ramSize = 0x80000000
networksNums = 1
language = 1
devType:NR32P8-8I/4S
bootPartition = 1
randomCode = SBNTYJ
operationCode = 
biosVersion =

dmesg just the first part to identify CPU

Code: 
[    0.000000] Booting Linux on physical CPU 0x0
[    0.000000] Linux version 3.10.0_hi3536 (zhangyi23@Cpl-Backend-BSP) (gcc version 4.8.3 20131202 (prerelease) (Hisilicon_v400) ) #14 SMP Fri Sep 14 19:28:51 CST 2018
[    0.000000] CPU: ARMv7 Processor [411fc0e1] revision 1 (ARMv7), cr=10c53c7d
[    0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
[    0.000000] Machine: hi3536
[    0.000000] cpldinfo offset[0x8e000], size[0x100].
[    0.000000] Ignoring unrecognised tag 0x484b0002
[    0.000000] Ignoring unrecognised tag 0x484b0004
[    0.000000] Ignoring unrecognised tag 0x484b0003
[    0.000000] Ignoring unrecognised tag 0x484b0005
[    0.000000] [HKBSP]no_a7:0.
[    0.000000] Add memory 0x20000000@0x40000000
[    0.000000] Add memory2 0x27c00000@0x64000000
[    0.000000] HIKBASE version ##24967[kernel:24583] v2.1.0 build 2018-9-14
 
  • Like
Reactions: mat200
It might be interesting to know if @Bizentech succeeded in loading Hikvision firmware to the NR32P8-8 NVR, which was thought to be the DS-7608NI-K2/8P model.
Though the initial problem was the 32MB filesize limit of the old Hikvision tftp updater, which can be got round by either using Scott Lamb's Python clone, or hooking up to the serial console and using a standard tftp server.
github.com

GitHub - scottlamb/hikvision-tftpd: Unbrick a Hikvision device (NVR or camera) via TFTP

Unbrick a Hikvision device (NVR or camera) via TFTP - scottlamb/hikvision-tftpd
github.com github.com

Cant upload different firmware (TFTP) Rebranded Hikvision NVR

Hello, I have fortunately not bricked my rebranded Hikvision NVR... But, the 3rd party firmware is lacking some features and is few and far between when it comes to pushing out new firmware. Would like to upload Hikvision firmware. Found the Hikvision firmware (I think) is for this rebranded...
ipcamtalk.com ipcamtalk.com
 
  • Like
Reactions: mat200
alastairstevenson said:
It might be interesting to know if @Bizentech succeeded in loading Hikvision firmware to the NR32P8-8 NVR, which was thought to be the DS-7608NI-K2/8P model.
Though the initial problem was the 32MB filesize limit of the old Hikvision tftp updater, which can be got round by either using Scott Lamb's Python clone, or hooking up to the serial console and using a standard tftp server.
github.com

GitHub - scottlamb/hikvision-tftpd: Unbrick a Hikvision device (NVR or camera) via TFTP

Unbrick a Hikvision device (NVR or camera) via TFTP - scottlamb/hikvision-tftpd
github.com github.com

Cant upload different firmware (TFTP) Rebranded Hikvision NVR

Hello, I have fortunately not bricked my rebranded Hikvision NVR... But, the 3rd party firmware is lacking some features and is few and far between when it comes to pushing out new firmware. Would like to upload Hikvision firmware. Found the Hikvision firmware (I think) is for this rebranded...
ipcamtalk.com ipcamtalk.com
Click to expand...

I'm in serial console already. My first screenshot was an attempt to upload through tftp via the uart interface. The file gets there fine, it just fails on the update.

I think my model varies slightly from @Bizentech as mine contains acusense. I think its close though. I'm attempting to get the original firmware in hoping that leads to some custom firmware building.
 
Last edited:
Ok, I got the original firmware from the manufacture. It looks to be very close to the hikvision original. Here are the two header outputs.

The firmware they sent me.

Code: 
Head decoded data(108b) :
00000000 53 57 4B 48 B5 5B 00 00 A0 01 00 00 08 00 00 00    SWKH.[..........
00000010 01 00 00 00 49 00 00 00 FF FF FF FF FF FF FF FF    ....I...........
00000020 FF FF FF FF FF FF FF FF FF FF FF FF 00 00 00 00    ................
00000030 00 07 00 00 06 06 16 20 01 00 00 00 00 00 00 00    ......▬ ........
00000040 75 49 6D 61 67 65 00 00 00 00 00 00 00 00 00 00    uImage..........
00000050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
00000060 A0 01 00 00 10 CE 82 00 B3 46 1E 41

Magic number :    0x484B5753
iHeaderCheckSum : 0x00005BB5 [23477]
iHeadTotalLen :   0x000001A0 [416]
iFileNum :        0x00000008 [8]
iLanguage :       0x00000001 [1] EN/ML
iDeviceClass :    0x00000049
iOEMCode :        0xFFFFFFFF
iFirmwareVer :    0xFFFFFFFF
iFeature:         0xFFFFFFFF
Calculated CheckSum :        0x00005BB5 [23477]

The original HIkvision Firmware

Code: 
Head decoded data(108b) :
00000000 53 57 4B 48 3A 5F 00 00 A0 01 00 00 08 00 00 00    SWKH:_..........
00000010 01 00 00 00 49 00 00 00 FF FF FF FF FF FF FF FF    ....I...........
00000020 FF FF FF FF FF FF FF FF FF FF FF FF 00 00 00 00    ................
00000030 00 07 00 00 06 06 16 20 01 00 00 00 00 00 00 00    ......▬ ........
00000040 75 49 6D 61 67 65 00 00 00 00 00 00 00 00 00 00    uImage..........
00000050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
00000060 A0 01 00 00 78 E4 82 00 C2 79 30 41

Magic number :    0x484B5753
iHeaderCheckSum : 0x00005F3A [24378]
iHeadTotalLen :   0x000001A0 [416]
iFileNum :        0x00000008 [8]
iLanguage :       0x00000001 [1] EN/ML
iDeviceClass :    0x00000049
iOEMCode :        0xFFFFFFFF
iFirmwareVer :    0xFFFFFFFF
iFeature:         0xFFFFFFFF
Calculated CheckSum :        0x00005F3A [24378]

The only differences I can find is the very top of the header. (Besides the checksum)

00000000 53 57 4B 48 3A 5F
 
  • Like
Reactions: alastairstevenson
I have a box that I believe is an OEM DS-7608NXI-I2/8P/S(C), but its tricky to determine the exact version since there's quite a few variants quite similar to this one.

V4.1.18 build 200120
devType:NR32P8-8I/4S
Nand: Micron MT29F4G08ABAEA
Nand(HW-Auto): Block:256KB Page:4KB OOB:200B ECC:24bit/1KB Chip:512MB*1

It has a 2MB SPI NOR Flash, Model - W25Q16(B/C)V/S25FL016K
I tried reading it, but got some error.

Flashing firmware over TFTP, the serial termal says...

The board info: language - 0x1 device_class - 0x49 oemCode - 0x1
upgrade packet mismatch, please select correct packet
Can not find correct packet for upgrade, give up!!!

Does anyone know how to change this in the firmware? The ones I found so far all show the same thing, both the device class and OEM code appear to mismatch.
iLanguage : 0x00000001 [1] EN/ML
iDeviceClass : 0x00000614
iOEMCode : 0xFFFFFFFF
iFirmwareVer : 0xFFFFFFFF
iFeature: 0xFFFFFFFF
 
Looks like my box is a 1st generation variant, the K51_MA. It has a MA2155 chip in it. The current version IS the latest available for that config. I wonder if its possible to force a later version and not use the AcuSense.

The K51_H92 and K51_A8 variants are presumably the same unit, with a different VPU module.

1621797362983-png.5872
 
You must log in or register to reply here.
Top Bottom