decode password

[jack7]

Revo2Maxx,
Have you ever tried something like this?
https://ipcamtalk.com/threads/hard-rese ... ks2.38597/
BTW, thanks for getting rid of that other unrelated thread yesterday.

[Revo2Maxx]

About the Cell yes and that isn't something that works today. When I had an Ex Employee hijack my 4116E-HS before he left (Guess giving the rest of the week before letting someone go isn't good idea) lol. Anyway I thought for sure my NVR was gone. I mean thought it was ok seeing it had a Reset button and I was able to Reset my 2116-HS so I thought I would be able to with my 4116e-HS but the button don't work. So I asked Amcrest if they could recover it even though the NVR was out of Warranty and in short No.. So I was told try removing the cell and I will admit if it isn't something anyone has done before Don't Do it if you don't know how to use a Soldering system. Lucky for me I have a few Hakko Soldering Stations and some others and have been soldering since I was 10 and even have a Micro pen for very small SMD and HOT Air for BGA..

So for the 41xx and many others the Cell is now soldered onto the board and only way to remove is to take out the board (Not really that hard) Just a Pain.. Then need to remove the solder from the bottom of the PCB, Best using a Desoldering unit however some Wick and good flux will work as well. Then letting the SMD Caps discharge because even with the battery out there was a good while before the circuit went zero.. Doing that, Installing the battery back turning machine on it was still not reset.. (Only the Date went back to 2000)

Took me a month to Recover mine. I got lucky really because 1 mistake they made was they used my Email server for the backup and while sending the email to the reset server never got a reply to the server (Tried a few times) the last day and was about to give up I used DMSS and was crazy I got a Reset code to my Email server

Now if only I can get my 4216E-AI NVR to get a Reset code with out getting a error back lol. I don't need to reset it just like to make sure things work Out of all my recorders that is only one that gets an error I think it has something to do with my emails coming to me with 1970 date that never changes when events email me. It is guess and is being worked on by the R&D still no reply to find out if others with the 42xx series has the same issue?

[Revo2Maxx]

Ok so I thought about another way. With all the things going on in the world it might be that the old owner no longer is around. So if they are and still have the Email that they used I mean my main email I have had back to the 90's.. Anyway here is something to try..

Bring up the unit, Depending on type GUI or WebUI click on forgot pattern if your using GUI and if they have a pattern. Then click on forgot password, then scan the QR code, Then send an email as stated to the Password server, (in the Subject line) ask them to email your email, When you get the reply it will also show that info in the Subject line and it will also be sent to the Owner of the Device. If they are nice and willing maybe they will send you the password. Or ask them to change the password to something you want.

Changing password would require you to have the NVR online and the settings in the NVR setup to something that isn't crazy or that won't work. That is why I said ask them to send you what the password is or if it has pattern what that is. If they do then your almost there..

Anyway until the reset server no longer like that fact I know subject text is both in your reply and sent to the owners email it will be up to them to pay it forward.. Good Luck, Be safe..

[Revo2Maxx]

So it is nice to have good kids Anyway call him a kid but at almost 40 he is only our kid lol.. So he took a DVR that I have there that is 8ch DVR or 10ch NVR and seeing that I only have 4 cameras there he changed out the HDD from the NVR and next day the NVR to me.. So this is pictures from my 4108-HS and here is what I have done so far today..
@jack7
First Opened it up and sure enough the button isn't there Pic1 below, and in that picture as I thought C39 is missing. Next 2 pictures is from the Button Cell, With it there and then after I removed the PCB, removed the Cell from the Board Pic 2 and 3. I then waited a little while and where it is Strange Unlike my 4116E-HS when I removed it's cell and went to 2000 when I took out my 4108-HS battery and turned back on, The date didn't go backwards it went forward.. See the last picture 2033 WTH... I will admit I was even more puzzled to see 2020 when I Installed the Button Cell and returned it to the network. It didn't go to today date it went to 8-2020..

Then to be Clear, It didn't change the system to 2000, I wasn't able to use a App to get code for Dahua devices that one can unlock older systems with codes, I tried the 3 that was generated for the NVR for that 2033 date and that didn't work. Also Tried a couple of other things as well.. Because of the size of pictures and the limit of size uploaded I loaded the images made them smaller and took screen shots to make them smaller.

Screenshot (1950).png (318.83 KiB) Viewed 2294 times

Screenshot (1951).png (298.99 KiB) Viewed 2294 times

Screenshot (1952).png (286.19 KiB) Viewed 2294 times

Screenshot (1953).png (307.25 KiB) Viewed 2294 times

[eduaqa]

Sorry not coming back recently, I gave up o the NVR
That switch on the board i tired to solder on (board do have the switch), but didn't work. So probably also disable in somewhere else
The camera that I put on the case I used just to WireShark the conversation between the NVR and the camera and maybe by luck find some password to be used on the NVR interface itself, of course could not be the same
The person that get the NVR now said that was easy to unlock using the pattern as the first letter on the email for recover the password, I'm luck he did it.

[Revo2Maxx]

Thank you for the update. Yes best not use something that is easy to decode by first glance. Email for recovery code shouldn't hold the letter someone uses if they are setting a Pattern with a letter. In general that is first area to try. I personally go counter clockwise and others I know go clockwise. In the 9 pattern settings there are over 1mil combos in the Recorders in cell phones it is less because for some systems you can't skip dots where on the DVR/NVR's you can. Sure I will admit when I first started to use patterns I used 2 then Z it was easy and had to many other things to remember lol. Then Z skipping the center top and bottom dots well you get the point. With Recorders if someone was to use a pattern like I do know it wouldn't be easy to crack. I will say that I use all 9 dots now skipping 4 before the total end. Also will change my pattern now but one of the dots I skip 3 times it self. Reason I change now only 1 dot can be skipped that many times lol so now I have to make a new one.

About that Switch on the board, adding one wouldn't have helped you nor a wire. I hope you removed your mods before you gave it away.. C39 needs a cap a very small one there to make a complete circuit.