New Sunluxy DVR

A while ago I picked up a cheapo Sunluxy DVR but quickly discovered that it had a couple of nasty security issues. The device actually worked reasonably well as a DVR so I was keen to try and patch the issues by modifying the OS. Sunluxy didn't offer any firmware updates so modifying an existing update wasn't an option.

Cutting a long story short, I basically ended up breaking the device by manually writing to (apparently the wrong bit of) flash. U-boot is available so there is still a chance to recover the situation if I can find the correct flash image.


I eventually decided to pick up another Sunluxy DVR in the hope that I'd be able to clone the firmware and be back to two working devices. The Sunluxy was also only about 1/4 the price of similar kit I'd seen elsewhere so from that point of view it also made sense to go for the same one.

It turns out that Sunluxy have updated their product, which was a slight surprise because based on the first version it looked like the kind of product they would do once and keep churning out. The changes are fairly significant which means I won't be able to use the newer one to fix the old one, but first impressions are positive.

A quick comparison of the old and new devices:

The older device. The fairly standard TSOP flash chip can be seen just left of the larger heat sink. The heat sink prevented using a 360-clip on to dump the flash. Of course I could have removed the heat sink, dumped the flash, replaced it and this blog would have been very different. Annoyingly, I didn't.

The newer device. The extra 4 channels are now connected by a sensible ribbon connector rather than pins. The audio jack is my serial console plug that I've not yet mounted to the case. Rather nicely, they labeled the console pins on the silkscreen. Connect to it using the typical 115200 bps, 8 data bits, no parity, 1 stop bit. The case has been modified slightly, so they aren't just using their old stock of cases.

The most interesting chip is the Winbond SPI flash chip. This particular version is 16MB and can be read using the venerable MiniPro TL866. If you are unaware of this cool little device, it is a fairly inexpensive chip reader and definitely worth having. Just search ebay if you are interested.

The photo above shows a SOIC clip attached to the flash chip and that hooked into the TL866. The only minor tweak to get the setup working is to attach a dedicated power supply to the chip rather than power it from the reader. Since the chip is in circuit, the reader can't supply enough current and decides to give up. By supplying 3.3V to the chip (via a handy VCC and GND point on the white connector) and removing the VCC pin from the clip (pin 8), the reader had no problem dumping the image:

So at least this time I have a backup before getting too adventurous!

It looks like Sunluxy have moved from JuanDVR to Grain Media. Some details for this particular model, the 8283, can be found on the grain media website. Sunluxy still don't offer software updates on their site.

I've not had a chance yet to do much other than set up the serial interface, dump the flash and have a quick play. I'll have a look at the security and follow up with another post if anything crops up.