Trovare firmware del DVR

[kimbok]

Buonasera,
ho acquistato dalla rete il seguente DVR made in Cina:
Name: Hybryd Video Recorder
Model: E-CH 7004
HDMI interface.
Per ora non mi posso lamentare, ma c'è una cosa che non riesco a fargli fare: inviare delle immagini insieme al messaggio email.
Non ho trovato nessun comando "snapshot" che invece ho visto in alcuni manuali di altri DVR che hanno la medesima grafica del mio DVR.
Credo che sia una questione di firmware e non di hardware.
Mi potete aiutare a trovare il firmware adatto da dargli in pasto?
Grazie

p.s.
se può essere utile ho scansionato il DVR con ZenMap che mi ha restituito il seguente log:
_____[indent][indent][indent][i]Starting Nmap 6.47 ( http://nmap.org ) at 2015-03-21 23:13 ora solare Europa occidentale
NSE: Loaded 118 scripts for scanning.
NSE: Script Pre-scanning.
Initiating ARP Ping Scan at 23:13
Scanning 192.168.1.10 [1 port]
Completed ARP Ping Scan at 23:13, 0.09s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 23:13
Completed Parallel DNS resolution of 1 host. at 23:13, 0.02s elapsed
Initiating SYN Stealth Scan at 23:13
Scanning 192.168.1.10 [65535 ports]
Discovered open port 23/tcp on 192.168.1.10
Discovered open port 554/tcp on 192.168.1.10
Discovered open port 80/tcp on 192.168.1.10
Discovered open port 34599/tcp on 192.168.1.10
Discovered open port 9527/tcp on 192.168.1.10
Discovered open port 34567/tcp on 192.168.1.10
Completed SYN Stealth Scan at 23:13, 15.26s elapsed (65535 total ports)
Initiating Service scan at 23:13
Scanning 6 services on 192.168.1.10
Service scan Timing: About 50.00% done; ETC: 23:17 (0:01:52 remaining)
Completed Service scan at 23:15, 131.07s elapsed (6 services on 1 host)
Initiating OS detection (try #1) against 192.168.1.10
NSE: Script scanning 192.168.1.10.
Initiating NSE at 23:15
Completed NSE at 23:16, 30.12s elapsed
Nmap scan report for 192.168.1.10
Host is up (0.00047s latency).
Not shown: 65529 closed ports
PORT STATE SERVICE VERSION
23/tcp open telnet Busybox telnetd
80/tcp open tcpwrapped
|_http-favicon: Unknown favicon MD5: EC9D1C872C50DD7DA7D826D9C85FC158
|_http-methods: No Allow or Public header in OPTIONS response (status code 200)
|_http-title: NETSurveillance WEB
554/tcp open rtsp?
| rtsp-methods:
|_ OPTIONS, DESCRIBE, SETUP, TEARDOWN, GET_PARAMETER, PLAY, PAUSE
9527/tcp open unknown
34567/tcp open unknown
34599/tcp open unknown
2 services unrecognized despite returning data. If you know the service/version, please submit the following fingerprints at http://www.insecure.org/cgi-bin/servicefp-submit.cgi :

==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============

SF-Port554-TCP:V=6.47%I=7%D=3/21%Time=550DED22%P=i686-pc-windows-windows%r
SFGetRequest,7F,"HTTP/1\.1\x20200\x20OK\r\nContent-Type:\x20application/
SF:x-rtsp-tunnelled\r\nServer:\x20H264DVR\x201\.0\r\nConnection:\x20close\
SF:r\nCache-Control:\x20private\r\n\r\n")%r(RTSPRequest,70,"RTSP/1\.0\x202
SF:00\x20OK\r\nServer:\x20H264DVR\x201\.0\r\nPublic:\x20OPTIONS,\x20DESCRI
SF:BE,\x20SETUP,\x20TEARDOWN,\x20GET_PARAMETER,\x20PLAY,\x20PAUSE\r\n\r\n"
SF%r(HTTPOptions,70,"RTSP/1\.0\x20200\x20OK\r\nServer:\x20H264DVR\x201\.
SF:0\r\nPublic:\x20OPTIONS,\x20DESCRIBE,\x20SETUP,\x20TEARDOWN,\x20GET_PAR
SF:AMETER,\x20PLAY,\x20PAUSE\r\n\r\n")%r(FourOhFourRequest,7F,"HTTP/1\.1\x
SF:20200\x20OK\r\nContent-Type:\x20application/x-rtsp-tunnelled\r\nServer:
SF:\x20H264DVR\x201\.0\r\nConnection:\x20close\r\nCache-Control:\x20privat
SF:e\r\n\r\n");

==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port9527-TCP:V=6.47%I=7%D=3/21%Time=550DED1D%P=i686-pc-windows-windows%
SF:r(NULL,83,"HTTPD:\x20fd:\x20182,\x20IP:\x200x6501a8c0\nRTP:\x20onClient
SF:Connect\x20enginedId\x200\x20,\x20clientId\x200\x20,\x20iport\x20192\
SF:.168\.1\.101:16176\x20\nHTTPD:\x20invalid\x20request\n")%r(GenericLines
SF:,10F6,"HTTPD:\x20fd:\x20182,\x20IP:\x200x6501a8c0\nRTP:\x20onClientConn
SF:ect\x20enginedId\x200\x20,\x20clientId\x200\x20,\x20iport\x20192\.168
SF:\.1\.101:16176\x20\nHTTPD:\x20invalid\x20request\nRTP:\x20procGet\nRTP:
SF:\x20procGet:\x20HTTP/1\.1\x20200\x20OK\r\nContent-Type:\x20application/
SF:x-rtsp-tunnelled\r\nServer:\x20H264DVR\x201\.0\r\nConnection:\x20close\
SF:r\nCache-Control:\x20private\r\n\r\n\n2\]\x20\[client=537\]\x20ip\[0\.0
SF:\.0\.0:0\]\nCMonitorHelper:\x20======Wait\x20For\x20onCallBack\x20Exit\
SF:x20Flag0=\[1\]======\x20\nCMonitorHelper:\x20======Wait\x20For\x20onCal
SF:lBack\x20Exit\x20Flag0=\[1\]======\x20\nCMonitorHelper:\x20======Wait\x
SF:20For\x20onCallBack\x20Exit\x20Flag0=\[1\]======\x20\nCMonitorHelper:\x
SF:20======Wait\x20For\x20onCallBack\x20Exit\x20Flag0=\[1\]======\x20\nCMo
SF:nitorHelper:\x20======Wait\x20For\x20onCallBack\x20Exit\x20Flag0=\[1\]=
SF:=====\x20\nCMonitorHelper:\x20======Wait\x20For\x20onCallBack\x20Exit\x
SF:20Flag0=\[1\]======\x20\nCMonitorHelper:\x20======Wait\x20For\x20onCall
SF:Back\x20Exit\x20Flag0=\[1\]======\x20\nCMonitorHelper:\x20======Wait\x2
SF:0For\x20onCallBack\x20Exit\x20Flag0=\[1\]======\x20\nCMonitorHelper:\x2
SF:0======Wait\x20For\x20onCallBack\x20Exit\x20Flag0=\[1\]======\x20\nCMon
SF:itor")%r(GetRequest,BC,"AddData,\x20Can't\x20find\x20MSG_HEADFLAG\x20__
SF:_!___\npassword:login\(GET\x20/\x20HTTP/1\.0,\x20\*\*\*\*\*\*,\x20Conso
SF:le,\x20address:\)\nuser:GET\x20/\x20HTTP/1\.0\x20account\x20invalid\nUs
SF:er\x20not\x20valid!\nuser\x20name:RTP:\x20ClientDisconnect\x200\x200\x2
SF:0\n")%r(HTTPOptions,5C3,"COperateSet\x20===>MsgId\x20=\x201410\x20\nPro
SF:cessMsg\x20opResult\x20=\x20-2\x20\nCOperateSet\x20===>MsgId\x20=\x2014
SF:10\x20\nCMonitorHelper::SetTransPolicy\x20=\x20\[1\]\x20\nCMonitorHelpe
SF:r::StartCapture\x20chn\[0\],stream\[1\],adapter\[0\]\nProcessMsg\x20opR
SF:esult\x20=\x200\x20\nCOperateSet\x20===>MsgId\x20=\x201006\x20\nProcess
SF:Msg\x20opResult\x20=\x200\x20\nCOperateSet\x20===>MsgId\x20=\x201410\x2
SF:0\nProcessMsg\x20opResult\x20=\x20-2\x20\nCOperateSet\x20===>MsgId\x20=
SF:\x201410\x20\nCMonitorHelper::PauseCapture\nProcessMsg\x20opResult\x20=
SF:\x200\x20\n184\x20discard:0\nTPTCPServer\x20CloseClient:\x200\n@@@FILE\
SF:x20->\x20\.\./\.\.//Source/TransportServer\.cpp,\x20LINE\x20->\x201029T
SF:reansport:\x20CTransportServer:\x20revlen=\[0\],errno=\[0\]\nTransprot:
SF:\x20Client\x20ID\[26\]@\[192\.168\.1\.101:16178\]\x20Disconnect___!!!__
SF:_\n===>Disconnect\x20:\[objID=1\]\x20\[client=26\]\x20ip\[192\.168\.1\.
SF:101:16178\]\nTransprot:\x20Delete\x20Connect\x20ID\[26\]@\[192\.168\.1\
SF:.101:16178\]\x20___!!!___\nDisconnect\x20clear\x20event\ndel:\x20fd:\x2
SF:0184,\x20pEventQue:\x202ffecf0\ndel:\x20fd:\x20186,\x20pEventQue:\x2030
SF:00d98\nDEL_EVENT:\x20iFd\x20-\x20184,\x20iMode\x20-\x2018,\x20pEventQue
SF::\x202ffecf0\ndelete\x20m_pTPO");

MAC Address: 00:12:12:76:A7:92 (Plus )
Device type: specialized
Running: Hikvision Linux, Q-SEE Linux
OS CPE: cpe:/o:hikvision:linux_kernel cpe:/o:q-see:linux_kernel
OS details: Hikvision 7200 or Q-SEE QT5440 or QT5682 DVR
Network Distance: 1 hop
TCP Sequence Prediction: Difficulty=263 (Good luck!)
IP ID Sequence Generation: All zeros
Service Info: Host: LocalHost

TRACEROUTE
HOP RTT ADDRESS
1 0.47 ms 192.168.1.10

NSE: Script Post-scanning.
ead data files from: C:\Program Files (x86)\Nmap
OS and Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 181.36 seconds
Raw packets sent: 65555 (2.885MB) | Rcvd: 65841 (2.684MB)