Why did you make it so complicated?
I suggested that you make one image that would contain the kernel and rootfs.
Did I offer a bad option?
My version simplifies everything and provides more NAND space for data.
Until now I only flashed a redmi router over scp. Now I want to have an ax Router with OpenWRT, but I am little bit confused about the steps I have to do for flashing an AX6s router.
Therefore, I want to ask, if the following steps are correct:
Buy a China version of the AX6S Router
Buy a CH341A Programmer
Dump the firmware from the Router with the CH341A Programmer
Edit the dump with a HEX Editor to activate telnet, ssh, uart according to the description of cliobrando
Flash the edited file on the memory of the router
Connect a UART-USB Converter to the Router
Make a tftp boot with the file «openwrt-mediatek-mt7622-xiaomi_redmi-router-ax6s-initramfs-recovery.itb»
Connect to luci and install the image file «openwrt-mediatek-mt7622-xiaomi_redmi-router-ax6s-squashfs-factory»
OK, but, you still need to cut the VCC on the PCB. After that, re-connecting it still need some soldering (or use a silver conductive pen? I won't try).
PS: With a special solder tip, you can (de)solder the chip easily even if you don't have a heat gun.
If I'm not mistaken it's an 8-pin 8x6mm WSON package. And whether or not it's VCC needs to be cut for this to work depends on various factors. That said, I know that such clips/needles work just fine on a bunch of other similar devices without the need of cutting/lifting any VCC. But then, yeah, on others it just won't...
Hello, my device has telnet_en=1, so I tried to flash using telnet but it won't boot up. I already tried your build and also mine but still the same. Can you confirm my steps is correct?
I'm envious of all you guys that have that have the RB01/international version. I have the telnet disabled RB03 version. I really didn't care/pay attention when I ordered back in December, because at the time it was not apparent that RB01 had telnet enabled.
I've been combing through the files looking for obvious exploits, but I think I'll hop back over to some chinese forums to see what I can find.
I have a flasher so could reflash it, but I guess I'm in the mood for doing it the hard way.
a quick, stupid question. did anyone check pppd for [CVE-2020-8597] exploit? would it be possible to attack the router this way and get a shell? version 2.4.7 is probably buggy?
Fixed long before even the first firmware. I don't think it would work regardless, one of the models had ASLR on. I did have fun writing it up last year though.
If you're building off master, don't forget to add the switch irq.
As far as I can tell from the stock dts, it should be exactly the same.
