Okay I have Router Repai Tool & ROM but I can't get into flash mode 
Thats the process for getting into recovery mode, I found you have to launch the repair tool quite quickly after.
Have you tried flashing from the webUI and of the firmwares from the MiWIfi site?
Yes, I tried to download newest firmaware from the website above & upload .bin via router webUI - I'm always getting "Couldn't verify file" error 
https://cdn.cnbj1.fds.api.mi-img.com/xiaoqiang/rom/ra67/miwifi_ra67_firmware_5a7fd_1.0.49.bin
Try this file, it’s for the AX5.
This one worked - thanks!
Another problem now I cant use - Xiaomi ax3600 ssh guide to get SSH - I get an error:
edit:// okay, I rolled back to 1.0.16 version of firmware and got SSH access - thanks a lot for helping me 
Hi! I'm a noob and had similar issue with missing channel 149 after setting up mesh with AX1800 Chinese firmware. Would you mind sharing your method to edit the channel with browser inspector? what browser did you use? Thanks in advance
Hi! Has anyone decoded what is being sent to the broker (http://eu.broker.miwifi.com/miwifi-broker/list) on MQTT protocol (port 1883) on "xqac" topic? A lot of bytes is sent from the router to the xiaomi cloud :(. Program responsible for research: /usr/bin/messagingagent.
A liiiittle off-topic, but it piqued my interest, as I had looked at the local MQTT implementation on Xiaomi routers recently.
Check the references to json_object_new_object if you want to see what kind of responses they build to send upstream.
For example, this is what it sends on connect. (In function ma_sys_info_generate_register_payload)
However, I'm a little more worried about what they can send back to you. Sweats profusely
I really hope that does not look what I think it looks like.
Hi! Thanks for the reply!
I analysed binaries left on the device and I am worried too that there is a persistent connection to the Xiaomi network. I think this is how the mobile application for the router works - it sends commands to the Xiaomi network and the router receives them back via MQTT protocol. I think it is worth knowing for other users that this firmware is persistent-connected to receive many/different commands (RCE).
(btw. Xiaomi can send commands using api.miwifi.com/rom_config.)
I wonder if this can be used to root the router by spoofing the mqtt server IP. Is there any encryption/authentication taking place?
Xiaomi firmware uses mosquitto MQTT client.
I've installed "Mosquito MQTT server" on my linux box and redirected the connection from the router to my server (option BROKER_HOST in /etc/config/messaging on the router).
Does it uses any authentication? Yes it does but I skipped it using 'allow_anonymous true' in mosquitto config.
Does it uses any encryption? Yes it does - messages from the router are encrypted. I think that messages from the xiaomi network may be encrypted too but I haven't seen any.
I haven't made a connection to xiaomi mqtt server (yet, no time).
Can it be used to root the router (...)?- I think this may be possible if we upload our own (PEM) certificates. This path should be definitely explored.
Nobody manage to activate guest mode on all mesh nodes with fw 3.0.34??
I'm using 3.0.34 global (AX1800 white), but there's some error that reset router can't fix. Could you send me global firmware (any version) for this router?
Could you post original 3.0.34 firmware?
Tired of waiting I decided to delve into the subject, I'm researching similar things and I believe that the contents below can add into something
Anyone able to run doh or dot? DNS-over-HTTPS or stubby..
3.0.4 root version.
https://4pda.to/forum/index.php?showtopic=992964&st=1340#entry103632561
1-3
opkg isntall https-dns-proxy
???
installing, but not running
