Hi,
I just got a Vanderbilt CRDN0410-PA , a 4-channel NVR.
It starts and appears to work fine, but I don't have the password for it and no way of getting it.
So, right now it's pretty useless.
From the sticker underneath:
VANDERBILT
Model: CRDN0410-PA
Part No: V54569-C112-A100
Serial No: CRDN0410-PA16100548
I opened the box, but there is no reset button anywhere. Disconnecting the battery for an hour did nothing good.
The control board is a "DS-80190Rev 1.1"
Googling that I found that it might be the same as the one used in HIKVISION DS-7604NI-E1/4P.
In SADP it gets identified as "CRDN0410-PA0420161018AARR660711486WCVU" with firmware V3.4.6build 160623, and start date 2004-01-02.
I tried to generate a code with "password reset utility" using this data, but it doesn't work.
In SADP I get an error code when trying to create a QR-code.. or do anything in the "forgot password" section.
What should I do next?
Any suggestions?
Should I try to replace the Vanderbilt firmware with a Hikvision version and see if that solves my password problem?
(Is it even possible, and how?)
Thanks,
Yes, I found the same. Further down, at least on the page I found, there are links to different tools and firmware versions.
But all links were dead.
According to some Swedish forums the company has no interest in dealing with "private" persons or their obsolete products.
Vanderbilt might be "Acre" now, but appears to have dropped old products.
I have emailed some address about a week ago but no reply so far.
Makes me think that a possible transfer to Hikvision firmware might be good.
That depends on whether you are feeling adventurous!
It's quite an old, low-level NVR.
A couple of ways to deal with the password -
Apply the Hikvision firmware with Hikvision's tftp updater. If it takes - the device will be reset.
or
Extract a flash partition and decode the contents, like so :
It should be possible to extract the password with a bit of poking around in the internals.
If you're up for trying this, you'd need :
A USB to serial TTL adaptor such as a PL2303TA based device.
A wired 4-pin 1.5mm JST ZHconnector, usually sold in 10-packs.
A PC that can run a standard tftp server.
Philip Jounin's tftp32 worked well, but no longer available for download. See attached copy.
Just for fun, as a taster, here is a worked example from the same NVR model, about 6 years ago :
(please excuse all the techy stuff)
Code:
This is the DS-7604NI-E1/4P-A I bought off eBay for £35.
No 48v power supply brick - but I have a spare one for the
PoE switches, and it works OK. 3TB HDD !
The NVR seems to work OK - but I need to figure out the
password. I could simply reset it, I suppose, but more
interesting to try to extract it!
So - remembering that the first 64KB of mtdblock1 holds the
gzipped configuration file, hopefully in plain text.
Pull out mtdblock1 via the bootloader.
-------------------------------------------------
U-Boot 2010.06-svn (Aug 15 2015 - 15:18:43)
Protected at offset:0,size:20000 Protection status:[0xf88]=>[0xf8b].
Hit ctrl+u to stop autoboot: 0
This program will upgrade software.
*******************************************************
* ATTENTION!! PLEASE READ THIS NOTICE CAREFULLY! *
* Don't reset machine,or anything that interrupt it. *
* The upgrade process must finish in 10 minutes! *
* If this program fails,machine might be unusable, *
* and you will need to reflash again. *
* If you find this too risky,power off machine now. *
*******************************************************
Now press [u/U] key to upgrade software: b
HKVS # printenv
bootcmd=tftp 0x80400000 $(bootfile);bootm 0x80400000;
default=cramfsload 0x80400000 uImage;
sec=tftp 0x80400000 uImage_sec;bootm 0x80400000;
verify=n
bootdelay=1
baudrate=115200
mdio_intf=rgmii
ipaddr=192.0.0.64
serverip=192.0.0.128
gatewayip=192.0.0.1
netmask=255.255.255.0
bootfile=uImage
device_type=DS-7604NI-E1/4P/A
identification=0000000100000001000002000000002a00000001000000020005
update_ip=192.0.0.64
phyaddr1=7
bootargs=mem=177M console=ttyS0,115200n8
ethaddr=bc:ad:28:87:7e:c4
stdin=serial
stdout=serial
stderr=serial
ver=U-Boot 2010.06-svn (Aug 15 2015 - 15:18:43)
Environment size: 577/4092 bytes
HKVS # setenv ipaddr 192.168.1.200
HKVS # setenv serverip 192.168.1.99
HKVS # sf probe 0
16384 KiB hi_sfc at 0:0 is now current device[4K erase supported]
HKVS # sf read 0x80400000 0x30000 0x20000
HKVS # tftp 0x80400000 mtd1 0x20000
timeout for link [4999]!
MAC: BC-AD-28-87-7E-C4
TFTP to server 192.168.1.99; our IP address is 192.168.1.200
Upload Filename 'mtd1'.
Upload from address: 0x80400000, 0.128 MB to be send ...
Uploading: # [ Connected ]
#
0.128 MB upload ok.
HKVS #
And pull the password out :
Code:
gunzipped mtdblock1, search for admin, and see camera passwords in plaintext
Here is the extraction :
alastair@PC-I5 ~/cctv/DS-7604NI-E1-4P-A_eBay/Custom/password_extract $ ll
total 140
drwxrwxr-x 2 alastair alastair 4096 Jan 31 20:53 ./
drwxrwxr-x 3 alastair alastair 4096 Jan 31 20:09 ../
-rw-rw-rw- 1 tftp tftp 131072 Jan 31 20:07 mtd1_via_tftp
-rw-rw-r-- 1 alastair alastair 103 Jan 31 20:44 text.txt
alastair@PC-I5 ~/cctv/DS-7604NI-E1-4P-A_eBay/Custom/password_extract $ dd if=mtd1_via_tftp of=mtd1_part1.gz bs=64k count=1
1+0 records in
1+0 records out
65536 bytes (66 kB, 64 KiB) copied, 0.00013043 s, 502 MB/s
alastair@PC-I5 ~/cctv/DS-7604NI-E1-4P-A_eBay/Custom/password_extract $ dd if=mtd1_via_tftp of=mtd1_part2.gz bs=64k count=1 skip=1
1+0 records in
1+0 records out
65536 bytes (66 kB, 64 KiB) copied, 0.000445694 s, 147 MB/s
alastair@PC-I5 ~/cctv/DS-7604NI-E1-4P-A_eBay/Custom/password_extract $ gunzip -k mtd1_part1.gz
gzip: mtd1_part1.gz: decompression OK, trailing garbage ignored
alastair@PC-I5 ~/cctv/DS-7604NI-E1-4P-A_eBay/Custom/password_extract $ gunzip -k mtd1_part2.gz
gzip: mtd1_part2.gz: decompression OK, trailing garbage ignored
alastair@PC-I5 ~/cctv/DS-7604NI-E1-4P-A_eBay/Custom/password_extract $ ll
total 9372
drwxrwxr-x 2 alastair alastair 4096 Jan 31 20:55 ./
drwxrwxr-x 3 alastair alastair 4096 Jan 31 20:09 ../
-rw-r--r-- 1 alastair alastair 4658176 Jan 31 20:54 mtd1_part1
-rw-r--r-- 1 alastair alastair 65536 Jan 31 20:54 mtd1_part1.gz
-rw-r--r-- 1 alastair alastair 4658176 Jan 31 20:54 mtd1_part2
-rw-r--r-- 1 alastair alastair 65536 Jan 31 20:54 mtd1_part2.gz
-rw-rw-rw- 1 tftp tftp 131072 Jan 31 20:07 mtd1_via_tftp
-rw-rw-r-- 1 alastair alastair 103 Jan 31 20:44 text.txt
alastair@PC-I5 ~/cctv/DS-7604NI-E1-4P-A_eBay/Custom/password_extract $ file *.gz
mtd1_part1.gz: gzip compressed data, last modified: Thu Jan 31 18:25:57 2019, max compression, from Unix
mtd1_part2.gz: gzip compressed data, last modified: Thu Jan 31 18:25:57 2019, max compression, from Unix
alastair@PC-I5 ~/cctv/DS-7604NI-E1-4P-A_eBay/Custom/password_extract $
That depends on whether you are feeling adventurous!
It's quite an old, low-level NVR.
A couple of ways to deal with the password -
Apply the Hikvision firmware with Hikvision's tftp updater. If it takes - the device will be reset.
or
Extract a flash partition and decode the contents, like so :
It should be possible to extract the password with a bit of poking around in the internals.
If you're up for trying this, you'd need :
A USB to serial TTL adaptor such as a PL2303TA based device.
A wired 4-pin 1.5mm JST ZHconnector, usually sold in 10-packs.
A PC that can run a standard tftp server.
Philip Jounin's tftp32 worked well, but no longer available for download. See attached copy.
Just for fun, as a taster, here is a worked example from the same NVR model, about 6 years ago :
(please excuse all the techy stuff)
Code:
This is the DS-7604NI-E1/4P-A I bought off eBay for £35.
No 48v power supply brick - but I have a spare one for the
PoE switches, and it works OK. 3TB HDD !
The NVR seems to work OK - but I need to figure out the
password. I could simply reset it, I suppose, but more
interesting to try to extract it!
So - remembering that the first 64KB of mtdblock1 holds the
gzipped configuration file, hopefully in plain text.
Pull out mtdblock1 via the bootloader.
-------------------------------------------------
U-Boot 2010.06-svn (Aug 15 2015 - 15:18:43)
Protected at offset:0,size:20000 Protection status:[0xf88]=>[0xf8b].
Hit ctrl+u to stop autoboot: 0
This program will upgrade software.
*******************************************************
* ATTENTION!! PLEASE READ THIS NOTICE CAREFULLY! *
* Don't reset machine,or anything that interrupt it. *
* The upgrade process must finish in 10 minutes! *
* If this program fails,machine might be unusable, *
* and you will need to reflash again. *
* If you find this too risky,power off machine now. *
*******************************************************
Now press [u/U] key to upgrade software: b
HKVS # printenv
bootcmd=tftp 0x80400000 $(bootfile);bootm 0x80400000;
default=cramfsload 0x80400000 uImage;
sec=tftp 0x80400000 uImage_sec;bootm 0x80400000;
verify=n
bootdelay=1
baudrate=115200
mdio_intf=rgmii
ipaddr=192.0.0.64
serverip=192.0.0.128
gatewayip=192.0.0.1
netmask=255.255.255.0
bootfile=uImage
device_type=DS-7604NI-E1/4P/A
identification=0000000100000001000002000000002a00000001000000020005
update_ip=192.0.0.64
phyaddr1=7
bootargs=mem=177M console=ttyS0,115200n8
ethaddr=bc:ad:28:87:7e:c4
stdin=serial
stdout=serial
stderr=serial
ver=U-Boot 2010.06-svn (Aug 15 2015 - 15:18:43)
Environment size: 577/4092 bytes
HKVS # setenv ipaddr 192.168.1.200
HKVS # setenv serverip 192.168.1.99
HKVS # sf probe 0
16384 KiB hi_sfc at 0:0 is now current device[4K erase supported]
HKVS # sf read 0x80400000 0x30000 0x20000
HKVS # tftp 0x80400000 mtd1 0x20000
timeout for link [4999]!
MAC: BC-AD-28-87-7E-C4
TFTP to server 192.168.1.99; our IP address is 192.168.1.200
Upload Filename 'mtd1'.
Upload from address: 0x80400000, 0.128 MB to be send ...
Uploading: # [ Connected ]
#
0.128 MB upload ok.
HKVS #
And pull the password out :
Code:
gunzipped mtdblock1, search for admin, and see camera passwords in plaintext
Here is the extraction :
alastair@PC-I5 ~/cctv/DS-7604NI-E1-4P-A_eBay/Custom/password_extract $ ll
total 140
drwxrwxr-x 2 alastair alastair 4096 Jan 31 20:53 ./
drwxrwxr-x 3 alastair alastair 4096 Jan 31 20:09 ../
-rw-rw-rw- 1 tftp tftp 131072 Jan 31 20:07 mtd1_via_tftp
-rw-rw-r-- 1 alastair alastair 103 Jan 31 20:44 text.txt
alastair@PC-I5 ~/cctv/DS-7604NI-E1-4P-A_eBay/Custom/password_extract $ dd if=mtd1_via_tftp of=mtd1_part1.gz bs=64k count=1
1+0 records in
1+0 records out
65536 bytes (66 kB, 64 KiB) copied, 0.00013043 s, 502 MB/s
alastair@PC-I5 ~/cctv/DS-7604NI-E1-4P-A_eBay/Custom/password_extract $ dd if=mtd1_via_tftp of=mtd1_part2.gz bs=64k count=1 skip=1
1+0 records in
1+0 records out
65536 bytes (66 kB, 64 KiB) copied, 0.000445694 s, 147 MB/s
alastair@PC-I5 ~/cctv/DS-7604NI-E1-4P-A_eBay/Custom/password_extract $ gunzip -k mtd1_part1.gz
gzip: mtd1_part1.gz: decompression OK, trailing garbage ignored
alastair@PC-I5 ~/cctv/DS-7604NI-E1-4P-A_eBay/Custom/password_extract $ gunzip -k mtd1_part2.gz
gzip: mtd1_part2.gz: decompression OK, trailing garbage ignored
alastair@PC-I5 ~/cctv/DS-7604NI-E1-4P-A_eBay/Custom/password_extract $ ll
total 9372
drwxrwxr-x 2 alastair alastair 4096 Jan 31 20:55 ./
drwxrwxr-x 3 alastair alastair 4096 Jan 31 20:09 ../
-rw-r--r-- 1 alastair alastair 4658176 Jan 31 20:54 mtd1_part1
-rw-r--r-- 1 alastair alastair 65536 Jan 31 20:54 mtd1_part1.gz
-rw-r--r-- 1 alastair alastair 4658176 Jan 31 20:54 mtd1_part2
-rw-r--r-- 1 alastair alastair 65536 Jan 31 20:54 mtd1_part2.gz
-rw-rw-rw- 1 tftp tftp 131072 Jan 31 20:07 mtd1_via_tftp
-rw-rw-r-- 1 alastair alastair 103 Jan 31 20:44 text.txt
alastair@PC-I5 ~/cctv/DS-7604NI-E1-4P-A_eBay/Custom/password_extract $ file *.gz
mtd1_part1.gz: gzip compressed data, last modified: Thu Jan 31 18:25:57 2019, max compression, from Unix
mtd1_part2.gz: gzip compressed data, last modified: Thu Jan 31 18:25:57 2019, max compression, from Unix
alastair@PC-I5 ~/cctv/DS-7604NI-E1-4P-A_eBay/Custom/password_extract $
Excellent! Thanks a lot!
I think I will give the "extract password" a try within the next few days
To change firmware from Vanderbilt to Hikvision feels a bit more risky, but if the first option fails I have nothing to loose.
I will update the thread when I have something to report.
Thanks again.
You don't need Linux to pull the copy of the mtdblock1 - just the serial TTL to USB convertor, a serial terminal program (such as PuTTY) and the tftp server.
So if you do manage the dump, and don't have Linux for the actual extract, you could attach the file here and I can check it out for you.
edit This is how the serial console connector looks :
Hello, i have NVR DS-7804N-E1/4P bricked when i flash wrong firmware DS-7604NI for it. So now it only boot to Logo then bip bip and auto restart. I tried flash TFTP very many time by set IP of my PC to 192.0.0.128 / subnet 255.255.255.0 and turn firewall is off. But no thing flashable although i...
