Acti ENR-130 NVR, cannot find the firmware IC - Page 1
Forum section: electronics / repair

author: Tim88
author_rank: Regular Contributor
timestamp: December 17, 2023, 10:15:19 pm
content: I have an NVR that will not boot anymore. I compared voltages on the board coils to ones on a working board and all seems good. Only thing I can come up with is a corrupt firmware. I cannot seem to find the memory chip on this board. I thought it was the one by the small battery but google says it is a timer IC. Its marked ANW SOCA-8. That is the only IC that looks like it could be a memory chip. Does anything else on this board look like it could be it? Any other thoughts welcome.

author: fzabkar
author_rank: Super Contributor
timestamp: December 18, 2023, 02:05:17 am
content: Isn't there a TSOP-48 NAND flash IC just below the SoC?ANW = ISL1208IU8Z = I2C Real Time Clock/Calendar, Low Power RTC with Battery Backed SRAMhttp://markingcodes.com/search/c/ANW

author: Tim88
author_rank: Regular Contributor
timestamp: December 18, 2023, 02:27:16 pm
content: Yep, it's a SK Hynix H27U2G8F2CTR 2Gb NAND FLASH. Unfortunately, my reader/programmer is only a 40 pin...

author: Tim88
author_rank: Regular Contributor
timestamp: December 18, 2023, 04:00:14 pm
content: After a little digging, my programmer does have a TSOP48 adapter so I can, theoretically reprogram the chip. I have a copy of the latest firmware but it is a .upg file and need a .bin file. I renamed the file to a .bin and opened it with a hex editor and it seems to be a valid file?

author: fzabkar
author_rank: Super Contributor
timestamp: December 18, 2023, 06:27:00 pm
content: I tried to download the firmware, but the site wants me to log in. If you can upload it somewhere and send me a PM with the link, I could have a look for you. IME, firmware packages often come with a header that precedes the payload, so this header may be missing from the flash dump.https://www.acti.com/product/ENR-130?tab=resources

author: fzabkar
author_rank: Super Contributor
timestamp: December 18, 2023, 08:03:52 pm
content: The .bin file seems to be some kind of file system image. 7Zip seems to understand how to extract the individual files.Code:0x0 - 0x1FF -- enr_fw/ directory sector0x200 - 0x3FF -- enr_fw/UPG.xml directory sector0x400 - 0x5FF -- enr_fw/UPG.xml file data0x600 - 0x7FF -- enr_fw/uldr_common.bin directory sector0x800 - 0x107FF -- enr_fw/uldr_common.bin file data0x10800 - 0x109FF -- enr_fw/rootfs.arm.jffs2.nand.summarized directory sector0x10A00 - 0x3FE3BFF -- enr_fw/rootfs.arm.jffs2.nand.summarized file data0x3FE3C00 - 0x3FE3DFF -- enr_fw/enr-config.arm.jffs2.nand.summarized directory sector0x3FE3E00 - 0x3FE63FF -- enr_fw/enr-config.arm.jffs2.nand.summarized file data0x3FE6400 - 0x3FE65FF -- enr_fw/u-boot.bin directory sector0x3FE6600 - 0x403D5FF -- enr_fw/u-boot.bin file data0x403D600 - 0x403D7FF -- enr_fw/nandboot_enr.scr directory sector0x403D800 - 0x403E5FF -- enr_fw/nandboot_enr.scr file data0x403E600 - 0x403E7FF -- enr_fw/vmlinux.ub.lzma directory sector0x403E800 - 0x423F5FF -- enr_fw/vmlinux.ub.lzma file data0x423F600 - 0x423F7FF -- enr_fw/upgrade_option.xml directory sector0x423F800 - 0x423FBFF -- enr_fw/upgrade_option.xml file data

author: Tim88
author_rank: Regular Contributor
timestamp: December 18, 2023, 08:13:25 pm
content: Ok, interesting... Had no idea & Zip was so handy. Anyway, I opened the original .upg file and this is what is listed.So, question is, can I reprogram the chip and how to do it??? Am just a novice at this...

author: fzabkar
author_rank: Super Contributor
timestamp: December 18, 2023, 08:18:41 pm
content: I think it will only start to make sense after you dump the NAND IC and compare its component sections.

author: Tim88
author_rank: Regular Contributor
timestamp: December 18, 2023, 08:34:16 pm
content: Roger that, just ordered the adapter for the programmer. Man, if I pull this repair off, it will be sensational...On a sidebar, when that stuff gets corrupted, is the chip usually still good or is chip failure usually the issue, if anyone knows...?

author: fzabkar
author_rank: Super Contributor
timestamp: December 18, 2023, 08:47:14 pm
content: The date code on the PCB appears to be 2046 (week 46 of 2020). I suppose one or more cells may have leaked their charge, in which case the corresponding bits would have flipped from 0 to 1.

author: fzabkar
author_rank: Super Contributor
timestamp: December 18, 2023, 09:31:44 pm
content: If you can short the NAND's Ready/Busy* pin to ground during power-on, the NAND will stay busy and the SoC may revert to some kind of "safe mode" or "factory mode". If so, you should see something on the local monitor on the HDMI port, I would think. You can release the short as soon as you see some signs of life.Note that shorting R/B* to ground is safe because the signal is an open drain output from the NAND. It will be pulled up to Vccq via a resistor.

author: Tim88
author_rank: Regular Contributor
timestamp: December 18, 2023, 10:27:55 pm
content: Just wanna make sure we got the correct pin and don't brick this thing, pin 7?

author: fzabkar
author_rank: Super Contributor
timestamp: December 18, 2023, 11:00:45 pm
content: Yes, that's it. In fact, this is the same technique that is used to get some SanDisk SSDs to start up in "safe mode".

author: amyk
author_rank: Super Contributor
timestamp: December 19, 2023, 12:08:24 am
content: Given that it's NAND flash and the firmware found above appears to be a filesystem image, I expect there to be an FTL of some sort, and thus you won't be able to just write the image to NAND directly.

author: fzabkar
author_rank: Super Contributor
timestamp: December 19, 2023, 12:22:51 am
content: I'm hoping that the R/B* trick will cause the SoC to power up in factory mode. That is, I'm hoping that the unit will be waiting for a firmware download, just as it would be if the NAND were blank. Hopefully the UPG file is in the correct format ...

author: Tim88
author_rank: Regular Contributor
timestamp: December 19, 2023, 05:11:22 pm
content: Well, the ground pin 7 trick did not work. I did check that it is indeed getting 3.3V. Any other tips?

author: fzabkar
author_rank: Super Contributor
timestamp: December 19, 2023, 05:25:45 pm
content: The row of 6 pads below the NAND could be a JTAG or UART port, but that would require more tools (and knowledge).I was hoping that the R/B* trick would at least prove that the SoC has basic sanity, but now this is inconclusive. I don't know how to proceed, other than dumping the flash. If you have a scope, look for some signs of activity on the address and data lines.

author: Tim88
author_rank: Regular Contributor
timestamp: December 19, 2023, 06:27:21 pm
content: I scoped some of the data and address pins and there is dc voltage of around 3V but no wave of any sort. I ohmed out those 6 pins and only the left 2 pins were connected to the IC, I believe its the 3.3V and ground. Interesting stuff and learning stuff i did not know. If you have the time to walk me through any further, will do my best to crack this case...

author: Tim88
author_rank: Regular Contributor
timestamp: December 19, 2023, 06:32:35 pm
content: Check that, those other pins do connect to the ic but through resistance, Had the ohm meter on beep figgered they were 0 ohm connections.

author: fzabkar
author_rank: Super Contributor
timestamp: December 19, 2023, 09:51:09 pm
content: I don't have any other ideas. Sorry.

author: amyk
author_rank: Super Contributor
timestamp: December 20, 2023, 12:02:08 am
content: Remove the heatsink to find out what the SoC is.

author: Tim88
author_rank: Regular Contributor
timestamp: December 20, 2023, 12:31:40 am
content: Made by Entrop but nothing on the interweb for a EN7531...

author: wasedadoc
author_rank: Super Contributor
timestamp: December 20, 2023, 12:54:14 am
content: https://en.wikipedia.org/wiki/Entropic_Communications

author: fzabkar
author_rank: Super Contributor
timestamp: December 20, 2023, 01:27:55 am
content: FWIW, Xvision's ELITENVR4, ELITENVR16 and ELITENVR32 NVRs use the same SoC.

author: Tim88
author_rank: Regular Contributor
timestamp: December 20, 2023, 04:56:03 pm
content: Spent most of the past couple days researching this stuff, I guess I am too stubborn to give up, yet. Anyway, am thinking those 6 holes are UART connectors as you speculated before. Watched some videos of hacking a security camera using a UART USB CABLE with the exact same Hynix IC I have. He then desoldered the IC and read the firmware. He mentioned you could then write this to another chip but someone here mentioned FTL is a problem with that? If you are copying the chip exactly, isn’t that like cloning a hard drive?Hacking the Arlo Q Security Camera: Failed Promises and Data SecurityHacking the Arlo Q Security Camera: Firmware ExtractionHacking the Arlo Q Security Camera: Bootloader Reverse Engineering

author: fzabkar
author_rank: Super Contributor
timestamp: December 20, 2023, 08:01:58 pm
content: NAND flash chips have "spare areas" which typically store ECC bytes and other metadata that is not part of the firmware. Also, a bad block will be flagged by a bad block byte. There is no guarantee that chips are error free, so you wouldn't want to make a byte-by-byte copy that doesn't account for differences in bad blocks.JFFS2 is a file system that embeds metadata within the file data, so that's an added complication.

author: Tim88
author_rank: Regular Contributor
timestamp: December 20, 2023, 11:04:13 pm
content: Rats... Could the firmware that I have then be uploaded via the UART USB thingy?

author: fzabkar
author_rank: Super Contributor
timestamp: December 20, 2023, 11:12:01 pm
content: I don't know. It can get complicated ...Seehttps://www.eevblog.com/forum/repair/drobo-b810i-nas-half-bricked-after-failed-firmware-update/That's where you are headed.

author: Tim88
author_rank: Regular Contributor
timestamp: December 20, 2023, 11:43:11 pm
content: Wow, pretty darn sure that is way over my head... In my almost 57 years of life, I have fixed cars, overhauled engines, fixed darn near everything mechanical, built my own house and most recently, learned electronics repair the past 10 years. I don't think there is a radio I can't figger out and fix but learning the software/hacking field might be too much. That guy that made those videos I posted has inspired me a bit to drag out a box of old routers I have and play around with learning to hack inside them. Maybe one day I can revisit this NVR. Really appreciate you taking the time to comment...