orangecms/NBD8016R-PL-V2.md

## NBD8016R-PL-V2.md

      
    Raw
  

              NBD8016R-PL-V2.md
            
          
    HiSilicon-based NVR (Network Video Recorder)

Acronyms

AHD - Analog High Definition
NVR - Network Video Recorder
DVR - Digital Video Recorder
IPC - IP Camera
Research

Device / Board Name

N8G5-M-V2 aka NBD8016R-PL-V2
http://www.xiongmaitech.com/en/index.php/product/product-detail/4/110/328
SPI Flash

W25Q128.V
Partitions

sbin/env_mtdparts
mtdparts=hi_sfc:320K(boot),3968K(romfs),7040K(usr),1600K(web),2816K(custom),128K(logo),512K(mtd)

Firmware

mtdblock4-custom/FirmwareInfo
NET_UPGRADE_FILE=MHK_MHK_NBD8016R-PL-V2_V4.03.R11.7601.Nat.OnvifC.20191122.bin
BURN_FILE=upall_MHK_MHK_NBD8016R-PL-V2.7601.Nat.OnvifC.20191122.bin

mtdblock4-custom/ProductDefinition
{
   "Vendor" : "General",
   "Hardware" : "NBD8008R-PL",
   "LogoPartType" : "cramfs",
   "PackSize" : 10240,
   "PreRecSize" : 2048,
   "LogoArea" : {"Begin": "0xf60000", "End": "0xf80000"},
   "CompatibleVersion" : 1
}

cloud service, possible for updates

curl -d '{}' \
  -H 'Content-Type: application/json' \
  http://pub-cfg.secu100.net:8086/
{"CfgProtocol":{"Header":{"ErrorString":"invalid protocol format args","CSeq":"1","Version":"1.0","MessageType":"any","ErrorNum":"400"}}}
MHK (Ming Hong Kai) brand

http://www.mhkdvr.com/
http://www.mhkdvr.com/en/productshow.php?id=128
Resources

https://www.unifore.net/product-highlights/nvr-dvr-hisilicon-solution-hi3536-hi3531-hi3521-hi3520d.html
https://www.hdfreaks.cc/index.php/Thread/28239-Auflistung-der-4k-Boxen-mit-HiSilicon-Chips-arm-und-HDF-Support/?postID=255012&s=bdd05f8e7b71c7021e38df5eca894f3d9071023f#post255012
Open Source Cam project

http://www.openhisiipcam.org/cctv/chinese-cctv-market/
https://github.com/OpenHisiIpCam/wrt-hisicam/
RTSP config table

https://www.ispyconnect.com/man.aspx?n=xmeye
Firmware collections

https://www.unifore.net/analog-surveillance/v4-02-r11-h-264-dvr-firmware-download.html
http://feelinlook.ru/index.php?route=information/information&information_id=9
http://www.vacron.com/IPsurveillance_support1.html
https://www.cctvsp.ru/articles/dvr-firmware-update
related camera:
https://www.cctvsp.ru/articles/obnovlenie-proshivok-dlya-ip-kamer-ot-xiong-mai
This one:
https://yadi.sk/d/QSzw_Yav3Rmi8L
Development

Sources / Hacking

https://github.com/ubis/HI3536DV100
root password

xc3511
Exploits / PoCs

https://habr.com/en/post/486856/
https://github.com/Snawoot/hisilicon-dvr-telnet
https://github.com/tothi/pwn-hisilicon-dvr
CVEs

https://sec-consult.com/en/blog/2018/10/millions-of-xiongmai-video-surveillance-devices-can-be-hacked-via-cloud-feature-xmeye-p2p-cloud/
https://www.cvedetails.com/cve/CVE-2017-16725/
OpenWrt

https://openwrt.org/docs/techref/hardware/soc/soc.hisilicon.hi35xx
related open IP camera project

https://github.com/OpenHisiIpCam/wrt-hisicam
HI3536D SDK

https://pan.baidu.com/s/1DolEGgtDezBhgUtE9DbhHQ
Related IP cam SDK

TUYA IPC SDK
Hi35xx NVR DVR series SoC manual

Link: https://pan.baidu.com/s/1DolEGgtDezBhgUtE9DbhHQ
Extraction code: 58w8
Firmware Modification

extraction

unsquashfs -d mtdblock1-romfs mtdblock1-romfs.bin
unsquashfs -d mtdblock2-user mtdblock2-user.bin
unsquashfs -d mtdblock3-web mtdblock3-web.bin
unsquashfs -d mtdblock4-custom mtdblock4-custom.bin
kernel

mtdblock1-romfs/boot/zImage.img
kernel modules

mtdblock2-user/lib/modules.tar.lzma
reference to custom script, similar to camera

mtdblock1-romfs/etc/init.d/rcS
52-ifconfig eth0 down
53-ifconfig eth0 up
54-
55-/usr/etc/pppd pty /etc/ppp/pppoe-start file /etc/ppp/pppoe-options &
56-
57:/mnt/custom/extapp.sh &
58-
59-#unrar x /usr/bin/Sofia.rar /var/
60-cp /usr/bin/Sofia.tar.lzma /var/
61-cd /var/
62-tar -axf /usr/bin/Sofia.tar.lzma

/mnt/custom/extapp.sh => mtdblock4
create script and repack

mtdblock4-custom/extapp.sh

#!/bin/sh

_MNT=/mnt/usb
mkdir -p $_MNT
mount /dev/sda1 $_MNT
cd /var
tar -xf $_MNT/u-root.tar.gz
./root-arm-core/bbin/sshd \
  -keys $_MNT/ssh-key/ssh.pub \
  -privatekey $_MNT/ssh-key/ssh
rebuild squashfs

mksquashfs mtdblock4-custom/ mtdblock4-custom-mod.bin -comp xz
align file size to partition

truncate -s 2883584 mtdblock4-custom-mod.bin
rebuild image

cat \
 mtdblock0-u-boot.bin \
 mtdblock1-romfs.bin \
 mtdblock2-user.bin \
 mtdblock3-web.bin \
 mtdblock4-custom-mod.bin \
 mtdblock5-logo.bin \
 mtdblock6-mtd.bin > fw-mod.bin
layout.txt

00000000:0004ffff mtdblock0-u-boot
00050000:0042ffff mtdblock1-romfs
00430000:00b0ffff mtdblock2-user
00b10000:00c9ffff mtdblock3-web
00ca0000:00f5ffff mtdblock4-custom
00f60000:00f7ffff mtdblock5-logo
00f80000:00ffffff mtdblock6-mtd
write back

sudo flashrom -p ft2232_spi:type=2232H,port=A \
  -l layout.txt \
  -i mtdblock4-custom \
  -w fw-mod.bin