RECESSIM - User contributions [en]

NT98321BG

2026-03-15T17:19:23Z

HouseY2K:

NT98321BG is a SoC made by Novatek, this chip is intented to be used on DVRs

 

==SDK==
All SDKs and docs: https://drive.google.com/file/d/1hHo7R6QZg4pVAegdWrWi6Kg5OoI4kU3V

Latest SDK only; https://drive.google.com/file/d/1UByHIuTqEv13nmdBWetkyVsv7LR1lR2C/view?usp=sharing

The toolchain didn't come with the SDK, i spent months trying to find it, if anyone ever finds it, PLEASE FOR THE LOVE OF GOD contact @housey2k or discord or github
 

==Firmware modding tools==
Hacking tools made by housey2k and firmware info: https://github.com/housey2k/nt98321bg-hack

unpack.sh: unpacks firmware.sh into u-boot, bare metal bootloader, and squashfs partitions

build-img.sh: builds squashfs folder partitions into squashfs files

build-img-breaking.sh: builds everything back into a ready to flash firmware-rebuilt.bin, risks breaking stuff like u-boot log
 

==Hardware info==
CPU: ARM Cortex-A9

Arch: ARMv7-A

Word size: 32-bit

FPU: VFP hard-float (EABIhf)

Clock: 1.2GHz (wow, it could do so much but it's closed)
 

==Board specific info, worth mentioning==
Memory: DRAM 512MiB

SPI NOR: 16MB

External analog video PHY: NVP6168C (The SDK docs mentions another one that also works but i couldn't find it rn, but it's there)

NT98321BG

2026-02-22T00:02:40Z

HouseY2K:

NT98321BG is a SoC made by Novatek, this chip is intented to be used on DVRs

 

==SDK==
All SDKs and docs: https://drive.google.com/file/d/1hHo7R6QZg4pVAegdWrWi6Kg5OoI4kU3V

Latest SDK only; https://drive.google.com/file/d/1UByHIuTqEv13nmdBWetkyVsv7LR1lR2C/view?usp=sharing

The toolchain didn't come with the SDK, i spent months trying to find it, if anyone ever finds it, PLEASE FOR THE LOVE OF GOD contact @housey2k or discord or github
 

==Firmware modding tools==
Hacking tools made by housey2k: https://github.com/housey2k/nt98321bg-hack

unpack.sh: unpacks firmware.sh into u-boot, bare metal bootloader, and squashfs partitions

build-img.sh: builds squashfs folder partitions into squashfs files

build-img-breaking.sh: builds everything back into a ready to flash firmware-rebuilt.bin, risks breaking stuff like u-boot log
 

==Hardware info==
CPU: ARM Cortex-A9

Arch: ARMv7-A

Word size: 32-bit

FPU: VFP hard-float (EABIhf)

Clock: 1.2GHz (wow, it could do so much but it's closed)
 

==Board specific info, worth mentioning==
Memory: DRAM 512MiB

SPI NOR: 16MB

External analog video PHY: NVP6168C (The SDK docs mentions another one that also works but i couldn't find it rn, but it's there)

NT98321BG

2026-02-22T00:01:45Z

HouseY2K:

NT98321BG is a SoC made by Novatek, this chip is intented to be used on DVRs

 

== SDK ==
SDK: https://drive.google.com/file/d/1hHo7R6QZg4pVAegdWrWi6Kg5OoI4kU3V

The toolchain didn't come with the SDK, i spent months trying to find it, if anyone ever finds it, PLEASE FOR THE LOVE OF GOD contact @housey2k or discord or github
 

== Firmware modding tools ==
Hacking tools made by housey2k: https://github.com/housey2k/nt98321bg-hack

unpack.sh: unpacks firmware.sh into u-boot, bare metal bootloader, and squashfs partitions

build-img.sh: builds squashfs folder partitions into squashfs files

build-img-breaking.sh: builds everything back into a ready to flash firmware-rebuilt.bin, risks breaking stuff like u-boot log
 

== Hardware info ==
CPU: ARM Cortex-A9

Arch: ARMv7-A

Word size: 32-bit

FPU: VFP hard-float (EABIhf)

Clock: 1.2GHz (wow, it could do so much but it's closed)
 

== Board specific info, worth mentioning ==
Memory: DRAM 512MiB

SPI NOR: 16MB

External analog video PHY: NVP6168C (The SDK docs mentions another one that also works but i couldn't find it rn, but it's there)

NT98321BG

2026-01-03T15:38:33Z

HouseY2K:

The NT98321BG is a SoC made by Novatek, it is used on DVRs as the main CPU, it talks to the ADC/Video capture chip (NVP6861C by NextChip). It's still pretty unknown for me since I couldn't find the SDK or the datasheet for it. It runs a linux system so it probably has an MMU, It's a Non-XiP system.

There is a firmware dump + unpacking/repacking tools avaiable on my github [https://github.com/housey2k/nt98321bg-hack here]

SDK [https://drive.google.com/file/d/1hHo7R6QZg4pVAegdWrWi6Kg5OoI4kU3V here]

NT98321BG

2026-01-02T18:36:18Z

HouseY2K: create page

APC Back UPS ES 600

2025-10-14T22:41:51Z

HouseY2K: RJ50 pinout verified

Back UPS 600 is a 600VA UPS manufactured by APC. I've been doing some little repairs on tweaks on it so i'll be sharing info on it here. It's based on a PIC18F45J50 microcontroller. Board model: 640-1134-Z REV04
[[File:APC Back UPS ES 600 PNG.png|thumb|Full Picture]]

==ICSP pinout==
Pinout for the ICSP header (J25)
[[File:APC Back UPS ES 600 ICSP pinout.png|alt=ICSP|thumb]]

 

==RJ50 Pinout==
[[File:APC Back UPS ES 600 RJ50 Pinout.png|thumb|Pinout for RJ50 data port]]

APC Back UPS ES 600

2025-09-30T21:45:08Z

HouseY2K: Added RJ50

Back UPS 600 is a 600VA UPS manufactured by APC. I've been doing some little repairs on tweaks on it so i'll be sharing info on it here. It's based on a PIC18F45J50 microcontroller. Board model: 640-1134-Z REV04
[[File:APC Back UPS ES 600 PNG.png|thumb|Full Picture]]

==ICSP pinout==
Pinout for the ICSP header (J25)
[[File:APC Back UPS ES 600 ICSP pinout.png|alt=ICSP|thumb]]

 

== RJ50 Pinout ==
[[File:APC Back UPS ES 600 RJ50 Pinout.png|thumb|Pinout for RJ50 data port (not totally verified)]]

File:APC Back UPS ES 600 RJ50 Pinout.png

2025-09-30T21:19:18Z

HouseY2K:

Pinout for the RJ50 connector on the Back UPS ES 600 (and very likely other models on the Back UPS series or whole APC)

APC Back UPS ES 600

2025-09-30T20:39:42Z

HouseY2K: Changed picture to PNG

File:APC Back UPS ES 600 PNG.png

2025-09-30T20:39:02Z

HouseY2K:

UPS Full Picture

APC Back UPS ES 600

2025-09-30T20:33:40Z

HouseY2K: Created page

File:APC Back UPS ES 600.webp

2025-09-30T20:29:36Z

HouseY2K:

APC Back UPS ES 600 full picture

File:APC Back UPS ES 600 ICSP pinout.png

2025-09-30T20:28:08Z

HouseY2K:

APC Back UPS ES 600 ICSP pinout

Landis+Gyr SGP+M

2025-09-30T20:25:06Z

HouseY2K: Added information on TLI

SGP+M is a system developed by Landis+Gyr and running in Brazil (and potentially other countries), it stands for Sistema de Gestão de Perdas e Medição (System for Management of Losses and Metering). It is divided into Primary Concentrators (Concentrador Primário or CP) and Secondary Concentrators (Concentrador Secundário or CS).

Note that I don't access to the hardware described here. All of my research was done through observation and research.

 

==Known Operating Locations==

*Rio de Janeiro, Brazil

 

==Metering Module==
[[File:SGP+M Meter Module for Secondary Concentrator.png|thumb|Metering Module]]
The Metering Module (Módulo de Medição) is installed inside the CS, each utility client has one dedicated to them (or 2/3 if they have a two-phase or three-phase system).

This module has a built-in smart meter system, contactor for remote shutdown, and a phototransmitter and photoreceiver for communication with the CS computer.

==Secondary Concentrator==
[[File:SGP+M Secondary Concentrator.png|thumb|Secondary Concentrator]]
The Secondary Concentrator houses 12 Metering Modules, a CPU/Radio (metal box on the right) and a main MCCB. The Metering Modules talk with the CPU through a shared optical interface. The CPU contains the software/harwdare to communicate with each meter and a built in radio that communicates with the PC through some proprietary FHSS stuff briefly mentioned in the manual.

==Primary Concentrator==
[[File:SGP+M Primary Concentrator.png|thumb|Primary Concentrator]]

The Primary Concentratoris the heart of the system. Primary and Secondary concentrators look identical from the outside (besides the fact that the PC has less wires coming out because there are no metering modules).

The PC holds inside a computer that I assume is way stronger, a radio to communicate with all the SCs around and a GPRS radio to inform power usage data to the power company.

 

== TLI (i actually have two of these) ==
[[File:L+G SGP+M TLI.jpg|thumb|Reading Terminal]]
The TLI (Terminal de Leitura Inteligente) stands for Smart Reading Terminal. It's a RX only device that displays power usage information. Since the meter is on top of the pole, this device is the way for the client to know how much power is being used, and for manually reading in case the wide network ever goes down. It contains a [[Z8F0421]] microcontroller, ATA5744N RF RX IC, and a CF8566T LCD driver.

It has a 6 pin debug header (but DBG is locked from factory, it must be unlocked through [[Z8 Encore BYPASS]] mode, info on that soon)

1 - DBG

2 - MAIN_PWR (Capacitive dropper output)

3 - 3V3_PWR (regulated output, MCU power)

4 - NC

5 - NC

6 - GND
 
==Sources==
[https://housey2k.github.io/post-docs/SGPM-Manual.pdf Manual for the SGP+M System on my Blog]

File:L+G SGP+M TLI.jpg

2025-09-30T20:22:04Z

HouseY2K:

Smart Reading Terminal from SGP+M system by Landis Gyr

Landis+Gyr SGP+M

2025-09-02T21:02:55Z

HouseY2K: /* Primary Concentrator */

SGP+M is a system developed by Landis+Gyr and running in Brazil (and potentially other countries), it stands for Sistema de Gestão de Perdas e Medição (System for Management of Losses and Metering). It is divided into Primary Concentrators (Concentrador Primário or CP) and Secondary Concentrators (Concentrador Secundário or CS).

Note that I don't access to the hardware described here. All of my research was done through observation and research.

 

==Known Operating Locations==

*Rio de Janeiro, Brazil

 

==Metering Module==
[[File:SGP+M Meter Module for Secondary Concentrator.png|thumb|Metering Module]]
The Metering Module (Módulo de Medição) is installed inside the CS, each utility client has one dedicated to them (or 2/3 if they have a two-phase or three-phase system).

This module has a built-in smart meter system, contactor for remote shutdown, and a phototransmitter and photoreceiver for communication with the CS computer.

==Secondary Concentrator==
[[File:SGP+M Secondary Concentrator.png|thumb|Secondary Concentrator]]
The Secondary Concentrator houses 12 Metering Modules, a CPU/Radio (metal box on the right) and a main MCCB. The Metering Modules talk with the CPU through a shared optical interface. The CPU contains the software/harwdare to communicate with each meter and a built in radio that communicates with the PC through some proprietary FHSS stuff briefly mentioned in the manual.

==Primary Concentrator==
[[File:SGP+M Primary Concentrator.png|thumb|Primary Concentrator]]

The Primary Concentratoris the heart of the system. Primary and Secondary concentrators look identical from the outside (besides the fact that the PC has less wires coming out because there are no metering modules).

The PC holds inside a computer that I assume is way stronger, a radio to communicate with all the SCs around and a GPRS radio to inform power usage data to the power company.

 
==Sources==
[https://housey2k.github.io/post-docs/SGPM-Manual.pdf Manual for the SGP+M System on my Blog]

Landis+Gyr SGP+M

2025-08-22T18:16:43Z

HouseY2K: Added picture + formatting

File:SGP+M Primary Concentrator.png

2025-08-22T17:38:45Z

HouseY2K:

Primary Concentrator

Landis+Gyr SGP+M

2025-08-22T17:33:21Z

HouseY2K: Created SGP+M page, Work In Progress

File:SGP+M Secondary Concentrator.png

2025-08-22T17:27:09Z

HouseY2K:

Secondary Concentrator

File:SGP+M Meter Module for Secondary Concentrator.png

2025-08-22T17:12:32Z

HouseY2K:

A smart meter installed inside SGP+M Concentrators

User:HouseY2K

2025-07-30T19:18:35Z

HouseY2K: fixed links

HouseY2K is a hardware hacker, electronics student, and electrical engineer in the future.

My skills are mostly hardware, I truly suck when it comes to programming anything. My codes are part GitHub, part cursed blogs and part ChatGPT.

Some of my projects involve firmware dumping, hardware modding and repairs.

Links:

*[https://housey2k.github.io Blog]
*[https://github.com/housey2k GitHub]
*Discord: @brennomaturino1

User:HouseY2K

2025-07-30T19:16:57Z

HouseY2K: Created User page

HouseY2K is a hardware hacker, electronics student, and electrical engineer in the future.

My skills are mostly hardware, I truly suck when it comes to programming anything. My codes are part GitHub, part cursed blogs and part ChatGPT.

Some of my projects involve firmware dumping, hardware modding and repairs.

Links:

[Blog](<nowiki>https://housey2k.github.io</nowiki>)

[Github](<nowiki>https://github.com/housey2k</nowiki>)

Discord: @brennomaturino1