Search

Cheap DVR teardown and pinout (MVPower, Hi3520D_v1.95p)

Cheap DVR teardown and pinout (MVPower, Hi3520D_v1.95p)

I have recently purchased a no-name CCTV kit which was very inexpensive, especially considering the functionality.
DVR Front MVPOWER TM

Mine is branded MVPower CCTV DVR Model TV-7108HE, P/N:UKEX39534 HD CCTV H.264 video equipment.
DVR Bottom MVPOWER CCTV DVR MODEL TV-7108HE INPUT DC 12V System PAL P N UKEX39534
It comes with or without video cameras and with or without a hard drive. I chose the 4 camera, no hard drive option. You may have chosen some other combination.

Working on the back panel first, mine has 8 video in, 1 video out, 1 HD output, 1 audio in, 1 audio out, 1 VGA out, 1 net (ethernet, RJ45), 2 USB ports, 1 RS485 port, 1 DC12v power port, 1 power switch.
DVR Rear Video In DVR Rear VGA DVR Rear Net USB RS485 DC12V DVR Rear Alarm DVR Rear Audio

If your board comes with 4 video in ports there is a daughterboard available to extend the number to 8.
video in daughterboard

J4 is an unpopulated USB header. Be aware that this is connected to one of the existing USB slots on the back panel. It could potentially be used to mount a USB drive internally but you would lose one of the external ports.
DVR J4

 

J10 is the SATA data connector
DVR J10

J18 is a TTL serial debug port
Baud rate 115200,n,8,1
Gnd is the pin nearest the blue capacitor
TX pin 2
RX pin 3
Voltage pin 4 (I left this unconnected while exploring)
If you don’t get any text, swap TX and RX around.
The system uses U-Boot to load the embedded linux image. If you wish to explore the file system (and you know just how dangerous this is) it is trivial:
In linux:
find the name of the USB FTDI TTL device eg /dev/ttyUSB0
screen /dev/ttyUSB0 115200
Restart the DVR and press a key to stop the boot sequence. You have 1 second to do this before it starts booting Linux.
printenv bootargs
Copy everything after bootargs=
On mine it reads:

mem=106M console=ttyAMA0,115200 root=0100 init=/linuxrc mtdparts=hi_sfc:128K(U),64K(E),128K(L),128K(C),1728K(K),6016K(R) ramdisk_size=6656 single

Type in
setenv bootargs
and insert the pasted text with the word

single

at the end of the line:
setenv bootargs mem=106M console=ttyAMA0,115200 root=0100 init=/linuxrc mtdparts=hi_sfc:128K(U),64K(E),128K(L),128K(C),1728K(K),6016K(R) ramdisk_size=6656 single
Start the DVR by typing:
${s10};${s11};${s12};${s13}
Which will boot into linux and give you temporary (until it reboots) root access to the device.
If you were so inclined you could completely change the web frontend graphics by remapping /root to a hard drive or USB stick should you be competent enough.
DVR J18
At the bottom of this post is the complete u-boot and linux output from the FTDI device until the root prompt.

 

J56 is an unpopulated header. It connects to the Video Out port on the back panel.
Pin 1 Composite video out
Pin 2 Ground
DVR J56

J57 is the audio input header
Note that Audio in 1 is on the back panel
Pin 1 GND
Pin 2 Audio in 2
Pin 3 Audio in 3
Pin 4 Audio in 4
Pin 5 Audio in 5
Pin 6 Audio in 6
Pin 7 Audio in 7
Pin 8 Audio in 8
DVR J57

J58 is the aforementioned daughterboard for the 4 video ports 5-8.
Note that the PCB on the daughterboard mislabels the video ports:
Input 5 is labelled as VIN7
Input 6 is labelled as VIN8
Input 7 is labelled as VIN5
Input 8 is labelled as VIN6
All video signals are tied to ground via a tantalum capacitor (one per video signal).
Camera 5 signal to header pin 5
Camera 6 signal to header pin 6
Camera 7 signal to header pin 3
Camera 8 signal to header pin 4
Ground to header pins 1 and 2
video in daughterboard video in daughterboard connected

 

J59 is the SATA power connector.
Red is +5v
Black is Ground
Yellow is +12v
DVR J59

J60 is the rear power switch
Both wires carry voltage, the switch stops the voltage from the 12v power supply reaching the board.
DVR J60

J64 is the front panel header
Be very careful of this header, pin 1 is at the end nearest the corner of the board but when you have the 6 pin cable it goes at the end nearest the SATA connector, with pin 1 at the lastmost pin.
I would love the complete pinout from this jumper, if anyone has a different front panel I’d be happy to take a look at it either in close up pictures or with the part itself.
DVR J64

The front panel header connects to another daughterboard, in my case a very simple panel with 2 LEDs and the infrared receiver.
My front panel has a 6 pin header:
Pin 1 is +v
Pin 2 is not connected on my board
Pin 3 is IR Pin 1 (signal going through a 4.7k pullup resistor)
Pin 4 is HDD LED –
Pin 5 is N/C on my board
Pin 6 is GND
DVR Front Power LED HDD LED IR Panel DVR Front Power LED HDD LED IR Panel Rear View

I am unsure of header J68 or J76.
DVR J68DVR J76

 

I used the following table to determine pinouts, as well as exploring with a multimeter and USB-TTL device:

Name
Pin number
Type
Descriptions
System Clock / Reset
RSTB
49
DI
System Reset (Active low)
XTALO
32
DO
Crystal Out
XTAI
31
DI
Crystal Input (27MHz)
Analog Video Input/output Interface
VIN1, VIN2, VIN3, VIN4, VIN5, VIN6, VIN7, VIN8
1, 3, 4, 6, 7, 9, 10, 12
AI
Analog Video Input (1 ~ 8 Respectively)
COMP
25
A
Audio DAC Compensation pin.
REXT
24
A
Audio DAC external resistor pin
Analog Audio Input/output Interface
AIN1, AIN2, AIN3, AIN4 AIN5, AIN6, AIN7, AIN8
14, 15, 16, 17, 18, 19, 20, 21
AI
Analog Voice Input (1 ~ 8 Respectively)
MICIN
23
AI
Mic Input
AOUT
26
AO
Analog Audio Output
Digital Video Interface
VDO1[7:0]
62, 61, 60, 59, 57, 56, 55, 54
O
Video Port 1 Output
VDO2[7:0]
73, 72, 71, 70, 69, 68, 67, 66
O
Video Port 2 Output
VCLK01, VCLK02
53, 65
O
Video Clock Output (1 ~ 2 Respectively)
ETC
TEST
50
I
Test Pin (Connect to Ground)
IRQ
43
O
Interrupt Request Output
MPP1,MPP2,MPP3,MPP4
52, 63, 64, 75
O
Multi-Purpose Pin Output
Digital Audio Interface
ACLK_REC
38
B
Clock for Record (M:output, S:Input)
ASYNC_REC
39
B
Sync for Record(M:output, S:Input)
ADATA_REC
40
O
Audio Digital Data for Record
ADATA_SP
42
O
Audio Digital Data for Speaker
ADATA_CASO
48
O
Audio Digital Data for Cascade Output
ADATA_CASI
37
I
Audio Digital Data for Cascade Input
ACLK_PB
34
B
Clock for Playback (M:output, S:Input)
ASYNC_PB
35
B
Sync for Playback (M:output, S:Input)
ADATA_PB
36
I
Audio Digital Data for Playback
I2C Interface
SDA
46
B
I2C Interface R/W Data
SCL
41
I
I2C Interface Clock
SA1, SA0
44, 45
I
Slave Address
No Connect
NC
27
NC
NC
Power/Ground
VDD1D
30, 47, 51, 76
P
Digital Power (Digital 1.2V)
VDD3D
33, 58, 74
P
Digital Power (Digital 3.3V)
VDD3A
2, 5, 8, 11, 13, 22, 28, 29
P
Analog Power (Analog 3.3V)

Full output from u-boot:
U-Boot 2010.06-dirty (Aug 15 2013 - 10:09:22)

Check spi flash controller v350... Found
Spi(cs1) ID: 0xC2 0x20 0x17 0xC2 0x20 0x17
Spi(cs1): Block:64KB Chip:8MB Name:"MX25L6406E"
In: serial
Out: serial
Err: serial
Hit any key to stop autoboot: 1 0
hisilicon #
help
? - alias for 'help'
base - print or set address offset
bootm - boot application image from memory
bootp - boot image via network using BOOTP/TFTP protocol
bzr - bzr - buzzer sound out.

cmp - memory compare
cp - memory copy
crc32 - checksum calculation
decjpg - jpgd - decode jpeg picture.

fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls - list files in a directory (default /)
getinfo - print hardware information
go - start application at address 'addr'
help - print command description/usage
loadb - load binary file over serial line (kermit mode)
loady - load binary file over serial line (ymodem mode)
logo - logo - decode logo picture to show.

loop - infinite loop on address range
md - memory display
mii - MII utility commands
mm - memory modify (auto-incrementing address)
mtest - simple RAM read/write test
mw - memory write (fill)
nm - memory modify (constant address)
ping - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
rarpboot- boot image via network using RARP/TFTP protocol
reset - Perform RESET of the CPU
saveenv - save environment variables to persistent storage
setenv - set environment variables
setvobg - setvobg - set vo backgroud color.
- setvobg [dev color]
sf - SPI flash sub-system
startgx - startgx - open graphics layer.
- startgx [layer addr stride x y w h]

startvo - startvo - open interface of vo device.
- startvo [dev type sync]
stopgx - stopgx - close graphics layer.
- stopgx [layer]
stopvo - stopvo - close interface of vo device.
- stopvo [dev]
tftp - tftp - download or upload image via network using TFTP protocol
usb - USB sub-system
usbboot - boot from USB device
version - print monitor version
hisilicon # printenv
bootdelay=1
baudrate=115200
bootfile="uImage"
netmask=255.255.255.0
ipaddr=192.168.1.10
serverip=192.168.1.99
s00=sf probe 0
s01=sf read 0x84800000 0x30000 0x10000
s02=sf read 0x84900000 0x40000 0x10000
s03=logo
s10=sf probe 0
s11=sf read 0x82000000 0x070000 0x1B0000
s12=sf read 0x81000000 0x220000 0x5E0000
s13=bootm 0x82000000 0x81000000
s21=bzr 200 1
s22=bzr 55 2
s23=usb start
s24=fatload usb 0 0x82000000 help.rom
s30=sf probe 0
s31=sf erase 0x070000 0x1B0000
s32=sf erase 0x220000 0x5E0000
s33=sf write 0x82260000 0x220000 0x5E0000
s34=sf write 0x820B0000 0x070000 0x1B0000
s41=bzr 55 2
s42=bzr 500 1
s43=bzr 500 5
s44=reset
vout_vga=0x8C000000
vout_pal=0x8D000000
bootargs=mem=106M console=ttyAMA0,115200 root=0100 init=/linuxrc mtdparts=hi_sfc:128K(U),64K(E),128K(L),128K(C),1728K(K),6016K(R) ramdisk_size=6656
bootcmd=${s00};${s01};${s02};${s03};${s10};${s11};${s12};${s13};${s21};${s22};${s23};${s24};${s30};${s31};${s32};${s33};${s34};${s41};${s42};${s43};${s44};
stdin=serial
stdout=serial
stderr=serial
verify=n
ver=U-Boot 2010.06-dirty (Aug 15 2013 - 10:09:22)

Environment size: 1076/65532 bytes
hisilicon #

hisilicon # setenv bootargs mem=106M console=ttyAMA0,115200 root=0100 init=/linuxrc mtdparts=hi_sfc:128K(U),64K(E),128K(L),128K(C),1728K(K),6016K(R) ramdisk_size=6656 single
hisilicon # ${s10};${s11};${s12}
8192 KiB hi_sfc at 0:0 is now current device

hisilicon # ${s13}
## Booting kernel from Legacy Image at 82000000 ...
Image Name: Linux-3.0.8
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 1721432 Bytes = 1.6 MiB
Load Address: 80008000
Entry Point: 80008000
## Loading init Ramdisk from Legacy Image at 81000000 ...
Image Name: JUAN root filesystem(16/09/2014)
Image Type: ARM Linux RAMDisk Image (gzip compressed)
Data Size: 4399104 Bytes = 4.2 MiB
Load Address: 81000000
Entry Point: 81000000
Loading Kernel Image ... OK
OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
Linux version 3.0.8 ([email protected]) (gcc version 4.4.1 (Hisilicon_v100(gcc4.4-290+uclibc_0.9.32.1+eabi+linuxpthread)) ) #26 Tue Jan 21 12:24:20 SGT 2014
CPU: ARMv7 Processor [414fc091] revision 1 (ARMv7), cr=10c53c7f
CPU: VIPT nonaliasing data cache, VIPT aliasing instruction cache
Machine: hi3520d
Memory policy: ECC disabled, Data cache writeback
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 26924
Kernel command line: mem=106M console=ttyAMA0,115200 root=0100 init=/linuxrc mtdparts=hi_sfc:128K(U),64K(E),128K(L),128K(C),1728K(K),6016K(R) ramdisk_size=6656 single
PID hash table entries: 512 (order: -1, 2048 bytes)
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Memory: 106MB = 106MB total
Memory: 98544k/98544k available, 10000k reserved, 0K highmem
Virtual kernel memory layout:
vector : 0xffff0000 - 0xffff1000 ( 4 kB)
fixmap : 0xfff00000 - 0xfffe0000 ( 896 kB)
DMA : 0xffc00000 - 0xffe00000 ( 2 MB)
vmalloc : 0xc7000000 - 0xfe000000 ( 880 MB)
lowmem : 0xc0000000 - 0xc6a00000 ( 106 MB)
modules : 0xbf000000 - 0xc0000000 ( 16 MB)
.init : 0xc0008000 - 0xc002a000 ( 136 kB)
.text : 0xc002a000 - 0xc0447000 (4212 kB)
.data : 0xc0448000 - 0xc0473320 ( 173 kB)
.bss : 0xc0473344 - 0xc0494538 ( 133 kB)
SLUB: Genslabs=13, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
NR_IRQS:128 nr_irqs:128 128
sched_clock: 32 bits at 82MHz, resolution 12ns, wraps every 52060ms
Console: colour dummy device 80x30
Calibrating delay loop... 1318.91 BogoMIPS (lpj=6594560)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
hw perfevents: enabled with ARMv7 Cortex-A9 PMU driver, 7 counters available
devtmpfs: initialized
NET: Registered protocol family 16
hw-breakpoint: found 6 breakpoint and 1 watchpoint registers.
hw-breakpoint: 1 breakpoint(s) reserved for watchpoint single-step.
hw-breakpoint: maximum watchpoint size is 4 bytes.
Serial: AMBA PL011 UART driver
uart:0: ttyAMA0 at MMIO 0x20080000 (irq = 40) is a PL011 rev2
console [ttyAMA0] enabled
uart:1: ttyAMA1 at MMIO 0x20090000 (irq = 41) is a PL011 rev2
bio: create slab <bio-0> at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
Switching to clocksource timer1
FS-Cache: Loaded
CacheFiles: Loaded
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
RPC: Registered named UNIX socket transport module.
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
RPC: Registered tcp NFSv4.1 backchannel transport module.
Trying to unpack rootfs image as initramfs...
rootfs image is not initramfs (junk in compressed archive); looks like an initrd
Freeing initrd memory: 4296K
NetWinder Floating Point Emulator V0.97 (double precision)
L2cache cache controller enabled
squashfs: version 4.0 (2009/01/31) Phillip Lougher
fuse init (API version 7.16)
msgmni has been set to 200
alg: No test for stdrng (krng)
Block layer SCSI generic (bsg) driver version 0.4 loaded (major 254)
io scheduler noop registered
io scheduler deadline registered (default)
io scheduler cfq registered
brd: module loaded
loop: module loaded
Loading iSCSI transport class v2.0-870.
SCSI Media Changer driver v0.25
ahci: SSS flag set, parallel bus scan disabled
ahci ahci.0: AHCI 0001.0200 32 slots 2 ports 3 Gbps 0x3 impl platform mode
ahci ahci.0: flags: ncq sntf stag pm led clo only pmp pio slum part ccc sxs boh
scsi0 : ahci_platform
scsi1 : ahci_platform
ata1: SATA max UDMA/133 mmio [mem 0x10080000-0x1008ffff] port 0x100 irq 52
ata2: SATA max UDMA/133 mmio [mem 0x10080000-0x1008ffff] port 0x180 irq 52
Spi id table Version 1.22
Spi(cs1) ID: 0xC2 0x20 0x17 0xC2 0x20 0x17
SPI FLASH start_up_mode is 3 Bytes
Spi(cs1):
Block:64KB
Chip:8MB
Name:"MX25L6406E"
spi size: 0x8388608
chip num: 1
6 cmdlinepart partitions found on MTD device hi_sfc
Creating 6 MTD partitions on "hi_sfc":
0x000000000000-0x000000020000 : "U"
0x000000020000-0x000000030000 : "E"
0x000000030000-0x000000050000 : "L"
0x000000050000-0x000000070000 : "C"
0x000000070000-0x000000220000 : "K"
0x000000220000-0x000000800000 : "R"
Fixed MDIO Bus: probed
ata1: SATA link up 1.5 Gbps (SStatus 113 SControl 300)
ata1.00: ATA-8: ST3500312CS, SC13, max UDMA/133
ata1.00: 976773168 sectors, multi 0: LBA48 NCQ (depth 31/32)
ata1.00: configured for UDMA/133
scsi 0:0:0:0: Direct-Access ATA ST3500312CS SC13 PQ: 0 ANSI: 5
sd 0:0:0:0: [sda] 976773168 512-byte logical blocks: (500 GB/465 GiB)
sd 0:0:0:0: [sda] Write Protect is off
sd 0:0:0:0: Attached scsi generic sg0 type 0
sd 0:0:0:0: [sda] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA
himii: probed
sda: sda1 sda2
sd 0:0:0:0: [sda] Attached SCSI disk
Invalid HW-MAC Address: 00:00:00:00:00:00
Set Random MAC address: 06:49:78:16:3A:52
bonding: Ethernet Channel Bonding Driver: v3.7.1 (April 27, 2011)
bonding: Warning: either miimon or arp_interval and arp_ip_target module parameters must be specified, otherwise bonding will not detect link failures! see bonding.txt for details.
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
PPP MPPE Compression module registered
NET: Registered protocol family 24
SLIP: version 0.8.4-NET3.019-NEWTTY (dynamic channels, max=256).
CSLIP: code copyright 1989 Regents of the University of California.
SLIP linefill/keepalive option.
usbmon: debugfs is not available
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
hiusb-ehci hiusb-ehci.0: HIUSB EHCI
hiusb-ehci hiusb-ehci.0: new USB bus registered, assigned bus number 1
hiusb-ehci hiusb-ehci.0: irq 53, io mem 0x100b0000
hiusb-ehci hiusb-ehci.0: USB 0.0 started, EHCI 1.00
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 2 ports detected
ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
hiusb-ohci hiusb-ohci.0: HIUSB OHCI
hiusb-ohci hiusb-ohci.0: new USB bus registered, assigned bus number 2
hiusb-ohci hiusb-ohci.0: irq 54, io mem 0x100a0000
ata2: SATA link down (SStatus 0 SControl 300)
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 2 ports detected
usbcore: registered new interface driver cdc_acm
cdc_acm: USB Abstract Control Model driver for USB modems and ISDN adapters
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
usbcore: registered new interface driver ums-alauda
usbcore: registered new interface driver ums-cypress
usbcore: registered new interface driver ums-datafab
usbcore: registered new interface driver ums_eneub6250
usbcore: registered new interface driver ums-freecom
usbcore: registered new interface driver ums-isd200
usbcore: registered new interface driver ums-jumpshot
usbcore: registered new interface driver ums-karma
usbcore: registered new interface driver ums-onetouch
usbcore: registered new interface driver ums-realtek
usbcore: registered new interface driver ums-sddr09
usbcore: registered new interface driver ums-sddr55
usbcore: registered new interface driver ums-usbat
usbcore: registered new interface driver usbserial
USB Serial support registered for generic
usbcore: registered new interface driver usbserial_generic
usbserial: USB Serial Driver core
USB Serial support registered for GSM modem (1-port)
usbcore: registered new interface driver option
option: v0.7.2:USB Driver for GSM modems
mousedev: PS/2 mouse device common for all mice
usbcore: registered new interface driver usbhid
usbhid: USB HID core driver
TCP cubic registered
Initializing XFRM netlink socket
NET: Registered protocol family 10
NET: Registered protocol family 17
NET: Registered protocol family 15
RAMDISK: squashfs filesystem found at block 0
RAMDISK: Loading 4293KiB [1 disk] into ram disk...done.
VFS: Mounted root (squashfs filesystem) readonly on device 1:0.
devtmpfs: mounted
Freeing init memory: 136K
usb 1-2: new high speed USB device number 3 using hiusb-ehci

starting pid 609, tty '': '-/bin/sh'
Welcome to HiLinux.
#

Pingoat

Related posts

21 thoughts on “Cheap DVR teardown and pinout (MVPower, Hi3520D_v1.95p)

  1. Hello, thanks for the info, very useful. I had a quick pick around in the firmware and was alarmed to see http://ipofdvr/shell?whoami etc – if these are exposed to internet, they can be popped in seconds! Also, it looks like the unit emails a snapshot of channel 0 at some point; [email protected]&subject=Who are you?&content=%s&snapshot=yes&vin=0&size=320×180

    If you look up the [email protected] it appears to be the dude who wrote the firmware.

    Also the / FS seems to be mounted RW but with 0 bytes free, meaning you cannot add an entry into /etc/passwd or even change the password, yet to find out how to telnet in but with the http shell thats not really needed.

    regards,

    Paul.

    1. greg

      You and me both Paul.

      I have left a request on Frank Law’s github page for the full source code of the device so I can strip out the exploit code.
      https://github.com/lawishere/JUAN-Device/issues/1

  2. Dan

    I have this MVpower cctv dvr and wanted to update the firmware as I am having trouble with it and it actually is stuck in a loop. I have no idea which OEM company made this. Thanks for the breakdown of the innards of this thing.

    1. greg

      Dan, be aware that this device has a massive backdoor and also sends stills of the video cameras to the original author of the firmware.

      Do not plug the device into your network.

      Greg

      1. Wop

        Hey Greg

        Can you elaborate more about this sort of backdoor you mentioned ?

        Is there an online dump of the firmware ?

        1. Greg

          Hi Wop
          The team over at PenTest Partners have just published their findings and I am collaborating with them to fill in missing parts of the puzzle.
          https://www.pentestpartners.com/blog/pwning-cctv-cameras/

          There are different versions of the firmware depending on your particular device. If you give me your correct details I could give you the information I have.

          1. Martparty

            Greg,
            Any further news on this firmware backdoor? I have the MVPower CCTV DVR Model TV-7108HE which I have emailed the Chinese manufacturer about this issue. I have also reported it to Amazon UK who are conducting a full investigation of their own. I still cannot find a clean secure firmware update on this device yet. I have been reading the Pentestpartners bog on this ongoing issue and see there are indeed a number of security issues with the firmware as the story unfolds. If you hear anything on a firmware update please keep me in the loop.

      2. Wop

        Hi Greg,

        can you shed more light about this sort of backdoor ?

  3. jose

    good morning friend mo forget the admin key, as I can reset and which is the default

    1. greg

      Have you remembered the admin password yet?

  4. Igor

    can you please tell me how to do hard reset?

    1. greg

      Hi Igor
      Because of the way the DVR works, a hard reset is not possible unfortunately.
      What issue are you having?

      1. Igor

        resolution is set to high for any monitor I have.
        Basically I can not connect any monitor, and over web interface i can not enter settings to lower it :(

  5. Paul Davies

    Can you please help me? I have recently purchased a four camera HD CCTV MVPower H264 DVR and cameras? I have them connected up to a flat screen TV? They have been working fine until I was messing with the settings and now all I see on the screen is blackness with a message that says ‘ AUTO ADJUSTMENT’ flashing on and off and I cannot do anything. I have tried switching everything off and on again, disconnecting everything but nothing is working. I would appreciate it if you or anyone else can email me with a solutions to this problem. Thanks. Paul.

  6. JC

    Hi

    I recently joined the group of mvpower users when i bought this http://www.amazon.co.uk/Electronics-Security-Recorder-2x600TVL-Weatherproof-Surveillance/dp/B015XUPVVE/ref=sr_1_1?s=electronics&ie=UTF8&qid=1457256413&sr=1-1&keywords=mvpower+960h+home+cctv+system

    it seems to work just fine, but the installed firmare is from around 2012. I was concerned to hear about stills being sent to the auther, one hopes its for a good reason as it was never disclosed.

    I would be interested in updating the firmware on it though. on occasion, when set to motion detection it didnt quite capture thet motion, just the person leaving my property just as they where heading off camera.

    can you advise anything at all? there also seems to be 3 settings in the video detection from motion, tovideo cover and something else which i forget.

    1. Greg

      Hi Jason

      There is a new firmware version being released imminently, hopefully for your version too.

      Thanks for getting in contact

      Greg

      1. Martyparty

        Nice one Greg on all your help and thanks for the update on a replacement firmware. Top man. Please keep us posted on this. I too have the MVPower CCTV DVR Model TV-7108HE.

  7. juan

    I forgot helps the administrator password as I do to restart the DVR thanks

  8. Gary porter

    Hi guys. Is there any way to reset the admin password on these units. We have forgotten the password that we changed and now can’t use it. Thx in advance.

  9. Dave

    Hello,
    J68 is for alarm inputs 1 to 4 and one common alarm output. Here are the pinouts:
    Connect the inputs to GND to create an alarm. Pin 1 is nearest the arrow and counts from here to the left. Pin 5 is below pin 4.
    Pin 1 is Alarm Input 1
    Pin 2 is Alarm Input 2
    Pin 3 is Alarm Input 3
    Pin 4 is Alarm Input 4
    Pin 5 is 0V or GND
    Pin 6 is an alarm output
    Pin 7 is 0V or GND
    Pin 8 not sure

    Pin 6 is a common alarm output that goes high when an input 1 to 4 is triggered. The output is timed depending on the Alarm Duration setting with each alarm input.

  10. Andy

    Thanks for everything! I managed to unbrick mine using this info! I also managed to get the admin password via the web browser… Security on these devices is a joke! :D

Leave a Comment