Reverse Engineering a cheap Chinese DVR

H'okay, I recently picked up a DVR from China for about $45 ($56 actual after paying for S&H).

Here's a link to it on Ali Express.

So, what am I going to do with this? Why, a complete analysis and tear down of course.

Here's a photo of the unit itself:

It came in a small box with a some padding for shipping with a 12VDC power supply and a small mouse. (The mouse surprisingly doesn't have a recognizable device identifier.)

Onwards with the fun stuff. Here are several close up shots of the printed circuit board (PCB).

The primary integrated circuit (IC) in use is an application-specific integrated circuit (ASIC) processor made by HiSilicone, a subsidiary of Huawei electronics and is based in Shenzen, China.

For a brief overview of HiSilicone and what they do, here's a link to their website.

As indicated on the AliExpress page, the primary processor for this NDVR is a Hi3520. The capabilities of this ASIC processor are as follows:
- ARM1176 processor @ 600MHz - H.264 codec support - 16 channels @ CIF resolution, or 8 @ D1 resolution - GMAC, HDVGA, 2*CVBS

To understand what all of that means, let's break it down: It's powered by an ARM processor, which is not so uncommon for a lot of electronics these days. (Chances are, your smartphone is likely also powerd by an ARM processor.) H.264 is a video codec, which means that when video on this NDVR is recorded, it's stored in that format. The DVR's processor supports up to 16 analog cameras at a low resolution, or 8 analog cameras at a slightly higher resolution. And finally, the GMAC, HDVGA and 2*CVBS basically just refer to networking capability and display options available.

Let's have a closer look at the performance specifications for that ARM processor: The Hi3520 is integrated with an ARM1176 processor. The ARM1176 processor is a single core, older 32-bit design. (For a comparable speed reference, it's roughly equivalent to the Broadcom chip on the Raspberry Pi B+, in fact, it also features a single-core 32-bit ARM1176 processors.)

If you're wondering what the IC next to the Hi3520 is, that's a

Additionally, the other two noticeable IC's on the PCB are the two Techpoint TP2823's.


The Techpoint TP2823 is a video processing chip, which essentially interfaces with the Hi3520 to process and encode analog video. Each TP2838 supports up to four camera's.

Now, on to the fun stuff. We can see a number of unpopulated connectors on the board:


I will be delving into what those might be in the next installment of "Reverse Engineering a cheap Chinese DVR 2: Electric Boogalo", in fact, in the next post about this particular DVR; I'm going to show you how to break into hardware for fun and profit!

(Actually, there is no profit; but at least it'll be fun!)

What we'll really be doing is connecting a Raspberry Pi to the DVR using the Pi's UART TX/RX pins in order to establish a serial connection to one of the presumably unpopulated component traces that I've highlighted in the previous image.