NBD8016R-PL-V2 NVR (Network Video Recorder) firmware

NBD8016R-PL-V2.md

HiSilicon-based NVR (Network Video Recorder)

Acronyms

AHD - Analog High Definition NVR - Network Video Recorder DVR - Digital Video Recorder IPC - IP Camera

Research

Device / Board Name

N8G5-M-V2 aka NBD8016R-PL-V2

http://www.xiongmaitech.com/en/index.php/product/product-detail/4/110/328

SPI Flash

W25Q128.V

Partitions

sbin/env_mtdparts

mtdparts=hi_sfc:320K(boot),3968K(romfs),7040K(usr),1600K(web),2816K(custom),128K(logo),512K(mtd)

Firmware

mtdblock4-custom/FirmwareInfo

NET_UPGRADE_FILE=MHK_MHK_NBD8016R-PL-V2_V4.03.R11.7601.Nat.OnvifC.20191122.bin
BURN_FILE=upall_MHK_MHK_NBD8016R-PL-V2.7601.Nat.OnvifC.20191122.bin

mtdblock4-custom/ProductDefinition

{
   "Vendor" : "General",
   "Hardware" : "NBD8008R-PL",
   "LogoPartType" : "cramfs",
   "PackSize" : 10240,
   "PreRecSize" : 2048,
   "LogoArea" : {"Begin": "0xf60000", "End": "0xf80000"},
   "CompatibleVersion" : 1
}

cloud service, possible for updates

curl -d '{}' \
  -H 'Content-Type: application/json' \
  http://pub-cfg.secu100.net:8086/

{"CfgProtocol":{"Header":{"ErrorString":"invalid protocol format args","CSeq":"1","Version":"1.0","MessageType":"any","ErrorNum":"400"}}}

MHK (Ming Hong Kai) brand

http://www.mhkdvr.com/

http://www.mhkdvr.com/en/productshow.php?id=128

Resources

https://www.unifore.net/product-highlights/nvr-dvr-hisilicon-solution-hi3536-hi3531-hi3521-hi3520d.html

https://www.hdfreaks.cc/index.php/Thread/28239-Auflistung-der-4k-Boxen-mit-HiSilicon-Chips-arm-und-HDF-Support/?postID=255012&s=bdd05f8e7b71c7021e38df5eca894f3d9071023f#post255012

Open Source Cam project

http://www.openhisiipcam.org/cctv/chinese-cctv-market/

https://github.com/OpenHisiIpCam/wrt-hisicam/

RTSP config table

https://www.ispyconnect.com/man.aspx?n=xmeye

Firmware collections

https://www.unifore.net/analog-surveillance/v4-02-r11-h-264-dvr-firmware-download.html

http://feelinlook.ru/index.php?route=information/information&information_id=9

http://www.vacron.com/IPsurveillance_support1.html

https://www.cctvsp.ru/articles/dvr-firmware-update

related camera: https://www.cctvsp.ru/articles/obnovlenie-proshivok-dlya-ip-kamer-ot-xiong-mai

This one: https://yadi.sk/d/QSzw_Yav3Rmi8L

Development

Sources / Hacking

https://github.com/ubis/HI3536DV100

root password

xc3511

Exploits / PoCs

https://habr.com/en/post/486856/

https://github.com/Snawoot/hisilicon-dvr-telnet

https://github.com/tothi/pwn-hisilicon-dvr

CVEs

https://sec-consult.com/en/blog/2018/10/millions-of-xiongmai-video-surveillance-devices-can-be-hacked-via-cloud-feature-xmeye-p2p-cloud/

https://www.cvedetails.com/cve/CVE-2017-16725/

OpenWrt

https://openwrt.org/docs/techref/hardware/soc/soc.hisilicon.hi35xx

related open IP camera project

https://github.com/OpenHisiIpCam/wrt-hisicam

HI3536D SDK

https://pan.baidu.com/s/1DolEGgtDezBhgUtE9DbhHQ

Related IP cam SDK

TUYA IPC SDK

Hi35xx NVR DVR series SoC manual

Link: https://pan.baidu.com/s/1DolEGgtDezBhgUtE9DbhHQ

Extraction code: 58w8

Firmware Modification

extraction

unsquashfs -d mtdblock1-romfs mtdblock1-romfs.bin
unsquashfs -d mtdblock2-user mtdblock2-user.bin
unsquashfs -d mtdblock3-web mtdblock3-web.bin
unsquashfs -d mtdblock4-custom mtdblock4-custom.bin

kernel

mtdblock1-romfs/boot/zImage.img

kernel modules

mtdblock2-user/lib/modules.tar.lzma

reference to custom script, similar to camera

mtdblock1-romfs/etc/init.d/rcS

52-ifconfig eth0 down
53-ifconfig eth0 up
54-
55-/usr/etc/pppd pty /etc/ppp/pppoe-start file /etc/ppp/pppoe-options &
56-
57:/mnt/custom/extapp.sh &
58-
59-#unrar x /usr/bin/Sofia.rar /var/
60-cp /usr/bin/Sofia.tar.lzma /var/
61-cd /var/
62-tar -axf /usr/bin/Sofia.tar.lzma

/mnt/custom/extapp.sh => mtdblock4

create script and repack

mtdblock4-custom/extapp.sh

#!/bin/sh

_MNT=/mnt/usb
mkdir -p $_MNT
mount /dev/sda1 $_MNT
cd /var
tar -xf $_MNT/u-root.tar.gz
./root-arm-core/bbin/sshd \
  -keys $_MNT/ssh-key/ssh.pub \
  -privatekey $_MNT/ssh-key/ssh

rebuild squashfs

mksquashfs mtdblock4-custom/ mtdblock4-custom-mod.bin -comp xz

align file size to partition

truncate -s 2883584 mtdblock4-custom-mod.bin

rebuild image

cat \
 mtdblock0-u-boot.bin \
 mtdblock1-romfs.bin \
 mtdblock2-user.bin \
 mtdblock3-web.bin \
 mtdblock4-custom-mod.bin \
 mtdblock5-logo.bin \
 mtdblock6-mtd.bin > fw-mod.bin

layout.txt

00000000:0004ffff mtdblock0-u-boot
00050000:0042ffff mtdblock1-romfs
00430000:00b0ffff mtdblock2-user
00b10000:00c9ffff mtdblock3-web
00ca0000:00f5ffff mtdblock4-custom
00f60000:00f7ffff mtdblock5-logo
00f80000:00ffffff mtdblock6-mtd

write back

sudo flashrom -p ft2232_spi:type=2232H,port=A \
  -l layout.txt \
  -i mtdblock4-custom \
  -w fw-mod.bin

@orangecms
Thank you for putting this together.

You're welcome and thanks a lot for sharing!

There is a project to get open firmware on IP cameras: https://github.com/openipc
And a similar one, seems dead by now:
https://github.com/OpenHisiIpCam

For NVR systems, there are some projects:
https://zoneminder.com/
https://www.openeye.net/products

I have seen something based on OpenWrt for the HiSilicon based NVRs on GitHub, don't recall right now.
This one is also interesting: https://github.com/lishaoliang/opendvr

If you are interested, I will give a talk on this an related work at FOSSASIA Summit: https://eventyay.com/e/fa96ae2c/session/6721