I have several DVR - CCTV from many companys and brand:
FM24C08B 2-Wire Serial EEPROM
Firmware ?
MX25L6406E - CMOS SERIAL FLASH
hour, date, password?
XM6214 ?
1 - Reset - Factory default:
- remove Bat - CR2032,
- front keys,
- others in Motherboard, we shunt 2 points, etc.
My Q:
It's possible - data chip - boot
SCL, SDA, SCLK, CS, A0, A1, A2 ---> GND or VCC in the first seconds ?
And the box write again our data to chip.
2 - I have Oscilloscopes, DMM and other Lab. equip.
Any procedure to capture the serial or I2C and decode later in a PC.
Thank you very much for your info and tutorials
Hi,
There are two ways to get it work/reset the password.
A., Get a calculated password from the.manufacturer. they need the date, and the time from the device. You will get a password, for 1 day, and You can reset the device. There are several calculators online for. Free. Try google. It is based on the cpu platform, not on the manufacturer. If You have luck, a different calculator can work..
B.,the hard way. You have to solder/read out the flash chip, and try to restore the file system on it. If you have luck, it is a standard linux based device. Just simple delete all of the user data directories. it worked for me several times... There are good videos on youtube about it... After deleting, the operating system of the device restores the admin user, with default password...
Good luck!
0
Thank you very much for your info.
A - Yes the usual procedure.
B - File System - EXT4, XFS, ZFS, ... ?
FM24C08B 2-Wire Serial EEPROM mount in / ?
MX25L6406E - CMOS SERIAL FLASH mount in /HOME, /TMP?
Or RAMDISK in Samsung CHIP?
And if we block for few seconds CS# or HOLD# in BOOT he don't read and think the flash is factory clean?
In this 2 pins there is R. - 0 Ohms.
Did you try scan with a scope 'SO/SIO1' and read the hour, date, password, etc ?
Best Regards,
0
Hi,
Sorry, but You did not told us the manufacturer, and the exact model of Your DVR..
If it is a linux based device, try ext3 first. The password is not stored in the rtc chip or in the eeprom part. In the case of a linux device, the password is stored in the user's directory.
0
In first post:
"I have several DVR - CCTV from many companys and brand"
XmEye, Hiseeu, ZOSI, XVIM, ...
And the Boxs use both and one or other chip.
" ... password is not stored in rtc chip or in the eeprom part ..." yes I know
EEPROM = Firmware = O. System
rtc chip - I remove the Bat. and the date continue in 3 ... 7 - May 2021 in every reBOOT.
FM24C08B 2-Wire Serial EEPROM
You read this or
MX25L6406E - CMOS SERIAL FLASH
What is your FLASH / EPROM programmer?
Thank you
0
Hi,
at home, i own a tl866 plus, but i have access to a xeltek superpro6100n at my workppace..
You have to read the serial flash...
Try to find a datasheet to the main cpu. I know, it has got a heatsink on it, but if You find a datasheet to it, it contains the whole file system explanation... And.. i had god resoults with yandex.ru and with duckduck to find the same main board with the same cpu but with downloadable firmware, or generator.,
The main firmwares are the same in 80%...
0
Wow !!!
I use Linux - Flashrom and PonyProg work with your devices?
Yes cpu with heatsink and the procedure ?
Test Clip - in-Circuit Programming insted of deSolder?
Regards,
0
Hi,
Ponyprog is a serial simple programmer... I don't think, that it can be used for this.. to read/write megabytes of data on rs232... Incredible slow... Does ponyprog support that kind of big flash devices?
Try to remove the heatsink.. if you have luck, it comes diwn, without to damage the soldering, or the pcb.. if not, You can buy some epoxy remover on ebay, or aliexpress...
if You have the cpu type, try to google for compatible firmwares... May be from another brands..
I don't know, never tried to use in-circuit read out.. but.. why not. Try it ot...
You can try to access the operating system via serial line.. there is a serial interface on the main board, for testing/programing. Try 9600/8/n/1 and connect it...
If You have luck, it does not ask fir a password.. i had an nvr, it did not asked for a password on serial... I simple deleted the user folder via rs232.. and all default user names, and passwords worked after a restart.. it was a noname, made in china nvr..
0
Thank you for info.
Any alternat. for Linux or Mac?
"... in-circuit read out.. but.. why not. Try it ot..."
And VCC don't blo other chips in Motherboard?
Tests
Serial interface - in back ... no
Motherboard - several CN11, CN28, CN26 ...
3, 4, 5 ... pins
Many interfaces, we test with a DMM or Scope and search for signal - V ... other type?
TX, RX, DTR, DCD, ...?
Any Welcome screen or I need special keys?
0
Hi,
You have to find the serial connection/debug interface on the motherboard. You have to search for a 4 pin connector, or just 4 pads. Rx,Tx, gnd, vcc... Try to meassure the voltage on the vcc pin, before connecting the serial adapter. Some devices are running on 5V, but the new ones are using 3.3V interfaces...
0
Thank for info.
Levels are not RS232 voltage levels, but +3.3V TTL logic. or 5V
Search the conv. chip.
Found pads near XM6214 but R. not present.
Any idea the chip?
JTAG?
Regards,
0
Hi,
You can use a simple Serial-USB adapter, with TTL inputs.. This type works for me. https://www.ebay.com/itm/273128476516
You can change the input level by a jumper to 5V or 3.3V
here you can find some info, in russian, with pictures:
https://monitor.net.ru/forum/threads/585570/
If You can't find the RX and TX pins, just search for the datasheet of the processors....
0
Thank for info.
One of the box 4 pins - VCC 5V.
and 3 pins VCC 3.3V
and I have FTDI
"... TTL-232R-3V3 operates at +3.3V levels (signals only, VCC= +5V) ..."
I need check TX and RX
The VCC in FTDI is output and the box too ...
"Found pads near XM6214 but R. not present."
no Volts in this pins
I have one BOX to test -> T4-3520D ... schematic?
Regards,
0