Connect to the DVR through port 9527 using Telnet or Putty.
telnet 192.168.x.x 9527
From my experience nothing is returned to the screen until you hit enter. If your using telnet or putty (without the carriage return) the text returned is not formatted and is a little annoying to read, so I suggest using Putty with "CR on every LF" turned on.
Anyway, once the shell responds with something, it should display a login prompt. The username and password its asking for is the DVR's GUI username/password. Once successfully logged in, the factory debug program should run. On my DVR it displays:
admin$ help
----------------------Console Commands----------------------------
ability Net Ability Utility!
ad AD debug interface!
alarm Alarm status!
autoshut auto shut the DVR
autotest AutoTest Command!
bitrate Dump BitRate infomation!
cfg Config Help Utility!
decoder decorder operation command!
encode Encode commands!
front front board utility!
fs Fs debug interface!
heap Dump heap status!
help Try help!
localPlay local play console!
log Log utility!
netitf NetInterFace Dump!
netm NetManager Dump!
packet Packet usage!
quit Quit!
reboot Reboot the system!
record Record console utility!
resource CPU usage!
screen snapshot current screen!
shell Linux shell prompt!
shutdown Shutdown the system!
snap Snap Console Utility!
thread Dump application threads!
time Set SystemTime!
timer Dump application timers!
upgrade Upgrade utility!
user Account Information!
ver version info!
To see details, please use 'cmd -h'
admin$
I'm not expert but I'd say this is pretty useful in the wrong hands!
