Jump to content
Sign in to follow this  
oanasechzga

K9604-W Bypass Firmware Verification

Recommended Posts

Hey Guys,

 

about a year ago, I bought a CCTV-Kit including four IP-Cameras and a 4CH NVR to convict an old lady in some cases of vandalism. As she's under lock and key now, I wanted to use the NVR to protect our home, as there were some burglaries very near in the last months. I already had some IP-Cams around the house and was able to connect them to the NVR, but only four at one time of course.

 

I found out there is an identical 8ch model (K9608-W) and I managed to get the firmware for it, but there seems to be some kind of verification as the NVR doesn't accept the .rom-file, while it accepts the K9604-W file flawlessy. Does anyone of you know a way to bypass this? I already tried to modify the header of the rom with a hex-editor, but it didn't help anything. I just need a way to install this image, I'm pretty sure it will run perfectly, as soon as it is on the NVR. If the Device is getting bricked, it's not good, but i could live with it.

 

Thanks in advance and greetings,

Oanasechzga

Share this post


Link to post
Share on other sites

Hey Guys,

 

about a year ago, I bought a CCTV-Kit including four IP-Cameras and a 4CH NVR to convict an old lady in some cases of vandalism. As she's under lock and key now, I wanted to use the NVR to protect our home, as there were some burglaries very near in the last months. I already had some IP-Cams around the house and was able to connect them to the NVR, but only four at one time of course.

 

I found out there is an identical 8ch model (K9608-W) and I managed to get the firmware for it, but there seems to be some kind of verification as the NVR doesn't accept the .rom-file, while it accepts the K9604-W file flawlessy. Does anyone of you know a way to bypass this? I already tried to modify the header of the rom with a hex-editor, but it didn't help anything. I just need a way to install this image, I'm pretty sure it will run perfectly, as soon as it is on the NVR. If the Device is getting bricked, it's not good, but i could live with it.

 

Thanks in advance and greetings,

Oanasechzga

 

 

Hi . You have a 4 way unit ......... Software hardware 4 way unit.

 

Going 8 way ....... Firmware will not load hardware is for a 4 way

 

You need a 8 way NVR

Share this post


Link to post
Share on other sites

Hi thanks four your anwer

 

I know, that it is a 4ch device, and of course it is a 4ch software too, but I think this should be the only difference, because I can't imagine they produce two different PCB-Layouts, if a simple software restriction will do the same. I already read about a guy who did something like this, but it was another NVR. Maybe anybody of you did something similar too?

 

Greetings,

oanasechzga

Share this post


Link to post
Share on other sites
Hi thanks four your anwer

 

I know, that it is a 4ch device, and of course it is a 4ch software too, but I think this should be the only difference, because I can't imagine they produce two different PCB-Layouts, if a simple software restriction will do the same. I already read about a guy who did something like this, but it was another NVR. Maybe anybody of you did something similar too?

 

Greetings,

oanasechzga

 

 

So why did manufacturer make 4 ways .... why not just do 8 or 16

 

But if your recorder is only 4 way ..... as in hardware firmware is pointless

Share this post


Link to post
Share on other sites
I know, that it is a 4ch device, and of course it is a 4ch software too, but I think this should be the only difference, because I can't imagine they produce two different PCB-Layouts, if a simple software restriction will do the same. I already read about a guy who did something like this, but it was another NVR. Maybe anybody of you did something similar too?

 

Your assumption is quite wrong.

Why stop at 8ch? Why not make it 16ch? Or 200ch?? Or infinite channels?!?

 

Your NVR has enough resources (CPU, memory, bandwidth, whatever) to deal with 4ch. If you want to work with 8ch, you need to get a 8ch unit.

Share this post


Link to post
Share on other sites

Just thought I'd chime in about `K9604`/`NVR0408` device firmwares. There are two types of headers for the ROMs for this device. There's the `JUAN` header, and the non-`JUAN`. (It's been a few months since I was working with the firmware in Ghidra, so forgive me for not remembering the other firmware). From what I saw in `dvr_app`'s firmware upgrade function, it checks the header to determine which firmware decryption function to run. Since you're modifying the header, without unpacking and repacking the data, the new firmware file will not be encrypted properly, so it won't take the upgrade.

Honestly, your best bet if you're *really* trying to do this is to get a CH341A flash programmer, backup the rom, and flash a dump from another system. You won't really find this flash dump online, but can provide the ROM dump for the `NVR0408`/`K9604-W` system (motherboard `HI3520D_V318P3_NVR0408`) if you need it. This file is like 16MB large, so I can't just attach it here.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  

×