K9604-W Bypass Firmware Verification

[oanasechzga 0]

Hey Guys,

 

about a year ago, I bought a CCTV-Kit including four IP-Cameras and a 4CH NVR to convict an old lady in some cases of vandalism. As she's under lock and key now, I wanted to use the NVR to protect our home, as there were some burglaries very near in the last months. I already had some IP-Cams around the house and was able to connect them to the NVR, but only four at one time of course.

 

I found out there is an identical 8ch model (K9608-W) and I managed to get the firmware for it, but there seems to be some kind of verification as the NVR doesn't accept the .rom-file, while it accepts the K9604-W file flawlessy. Does anyone of you know a way to bypass this? I already tried to modify the header of the rom with a hex-editor, but it didn't help anything. I just need a way to install this image, I'm pretty sure it will run perfectly, as soon as it is on the NVR. If the Device is getting bricked, it's not good, but i could live with it.

 

Thanks in advance and greetings,

Oanasechzga

[tomcctv 190]

Hey Guys,

 

about a year ago, I bought a CCTV-Kit including four IP-Cameras and a 4CH NVR to convict an old lady in some cases of vandalism. As she's under lock and key now, I wanted to use the NVR to protect our home, as there were some burglaries very near in the last months. I already had some IP-Cams around the house and was able to connect them to the NVR, but only four at one time of course.

 

I found out there is an identical 8ch model (K9608-W) and I managed to get the firmware for it, but there seems to be some kind of verification as the NVR doesn't accept the .rom-file, while it accepts the K9604-W file flawlessy. Does anyone of you know a way to bypass this? I already tried to modify the header of the rom with a hex-editor, but it didn't help anything. I just need a way to install this image, I'm pretty sure it will run perfectly, as soon as it is on the NVR. If the Device is getting bricked, it's not good, but i could live with it.

 

Thanks in advance and greetings,

Oanasechzga

 

 

Hi . You have a 4 way unit ......... Software hardware 4 way unit.

 

Going 8 way ....... Firmware will not load hardware is for a 4 way

 

You need a 8 way NVR

[oanasechzga 0]

Hi thanks four your anwer

 

I know, that it is a 4ch device, and of course it is a 4ch software too, but I think this should be the only difference, because I can't imagine they produce two different PCB-Layouts, if a simple software restriction will do the same. I already read about a guy who did something like this, but it was another NVR. Maybe anybody of you did something similar too?

 

Greetings,

oanasechzga

[tomcctv 190]

Hi thanks four your anwer

 

I know, that it is a 4ch device, and of course it is a 4ch software too, but I think this should be the only difference, because I can't imagine they produce two different PCB-Layouts, if a simple software restriction will do the same. I already read about a guy who did something like this, but it was another NVR. Maybe anybody of you did something similar too?

 

Greetings,

oanasechzga

 

 

So why did manufacturer make 4 ways .... why not just do 8 or 16

 

But if your recorder is only 4 way ..... as in hardware firmware is pointless

[Securame 0]

I know, that it is a 4ch device, and of course it is a 4ch software too, but I think this should be the only difference, because I can't imagine they produce two different PCB-Layouts, if a simple software restriction will do the same. I already read about a guy who did something like this, but it was another NVR. Maybe anybody of you did something similar too?

 

Your assumption is quite wrong.

Why stop at 8ch? Why not make it 16ch? Or 200ch?? Or infinite channels?!?

 

Your NVR has enough resources (CPU, memory, bandwidth, whatever) to deal with 4ch. If you want to work with 8ch, you need to get a 8ch unit.

[DeathCamel57 1]

Just thought I'd chime in about `K9604`/`NVR0408` device firmwares. There are two types of headers for the ROMs for this device. There's the `JUAN` header, and the non-`JUAN`. (It's been a few months since I was working with the firmware in Ghidra, so forgive me for not remembering the other firmware). From what I saw in `dvr_app`'s firmware upgrade function, it checks the header to determine which firmware decryption function to run. Since you're modifying the header, without unpacking and repacking the data, the new firmware file will not be encrypted properly, so it won't take the upgrade.

Honestly, your best bet if you're *really* trying to do this is to get a CH341A flash programmer, backup the rom, and flash a dump from another system. You won't really find this flash dump online, but can provide the ROM dump for the `NVR0408`/`K9604-W` system (motherboard `HI3520D_V318P3_NVR0408`) if you need it. This file is like 16MB large, so I can't just attach it here.