AX3000T Bricked

Installing and Using OpenWrt
1

Good morning

First of all I am French and I use Google translate I hope you will understand me.
So I have a Xiaomi AX3000T router with Chinese stock ROM.
I managed to install openwrt with the method: Easy method for SSH access and Install OpenWRT
And everything was ok.
I wanted to reflash it with lucy and I must have made a mistake when restarting bricked and for several weeks
impossible to recover it otherwise I managed to return to soft stock but since..................

So after recovering it with stok v1.0.47 I redid Easy method for SSH access and after
Install OpenWRT instructions but with I chose Difficult method for openwrt

Then I made a backup

nanddump -f /tmp/BL2.bin /dev/mtd1
nanddump -f /tmp/Nvram.bin /dev/mtd2
nanddump -f /tmp/Bdata.bin /dev/mtd3
nanddump -f /tmp/Factory.bin /dev/mtd4
nanddump -f /tmp/FIP.bin /dev/mtd5
nanddump -f /tmp/ubi.bin /dev/mtd8
nanddump -f /tmp/KF.bin /dev/mtd12

I did
cat /proc/cmdline
and hey it was firmware 0
But after I tried sysupgrade -n /tmp/openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-squashfs-sysupgrade.bin
and the impossible.
After several hours of searching impossible.
So I tried

Flashing with UART
And there I succeeded until

mtk_uartboot -s COM5 --payload bl2-mt7981-bga-ddr3-ram.bin --aarch64 --fip openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-bl31-uboot.fip && putty.exe -serial COM5 -sercfg 115200,8,n,1,N

And here is what I have
With UART:

mtk_uartboot - 0.1.1
Using serial port: COM3
Handshake...
hw code: 0x7981
hw sub code: 0x8a00
hw ver: 0xca00
sw ver: 0x1
Baud rate set to 460800
sending payload to 0x201000...
Checksum: 0x8f29
Setting baudrate back to 115200
Jumping to 0x201000 in aarch64...
Waiting for BL2. Message below:

NOTICE: BL2: v2.10.0 (release):v2.10.0-mtk
NOTICE: BL2: Built : 13:17:06, Mar 1 2024
NOTICE: WDT: [40000000] Software reset (reboot)
NOTICE: EMI: Using DDR3 settings
NOTICE: EMI: Detected DRAM size: 256MB
NOTICE: EMI: complex R/W mem test passed
NOTICE: CPU: MT7981 (1300MHz)
NOTICE: Starting UART download handshake ...

BL2 UART DL version: 0x10
Baudrate set to: 921600
FIP sent.

NOTICE: Received FIP 0xba609 @ 0x40400000 ...================================

And then on Putty:

Volume fit not found!
Using ethernet@15100000 device
TFTP from server 192.168.1.254; our IP address is 192.168.1.1
Filename 'openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-initramfs-recovery.itb'.
ERROR: reserving fdt memory region failed (addr=4fc00000 size=100000 flags=4)
Load address: 0x46000000
Loading: T T T T T T T T T T
Retry count exceeded; starting again
Wrong Image Format for bootm command
ERROR: can't get kernel image!
Using ethernet@15100000 device
TFTP from server 192.168.1.254; our IP address is 192.168.1.1
Filename 'openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-initramfs-recovery.itb'.
ERROR: reserving fdt memory region failed (addr=4fc00000 size=100000 flags=4)

HELP! HELP!

2

Did you try the steps for "Debriking" from the official wiki instructions for your AX3000T RD03 model?

Did you run the TFTP server? (point 7 from UART method?).

3

yes tftpd64.had the impression that it was loading data but was not going to the end

4

This is what worries me ERROR: reserving fdt memory region failed (addr=4fc00000 size=100000 flags=4)

5

This is the message when the router doesn't receive the 'itb' file. I had the same message. See my output here

I resolved it by disabling the Windows Firewall that blocked tftpd64. Could you please try disabling the Windows Firewall and see if it helps?

Also, please disable WiFi on your laptop. Leave only Ethernet cable connected between the router and your laptop.

6

I think I have all of this but I'm not sure anymore.
I'm going away and coming back in 1 week, I'll see about it later.
thank you for your help

1 Like
7

Hi, I too have a bricked AX3000T, which a friend of mine kindly asked me to unbrick.
I've downloaded all the ax3000t files as well as tftpd64. I have a serial adapter and PuTTY, and the serial connection works. However, when I follow the procedure described in the router page, whether I load openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-initramfs-kernel.bin or openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-initramfs-recovery.itb, I end up with the same error message:

lzma compressed: uncompress error 1
Must RESET board to recover
resetting ...

and a reboot. Here's the more extensive log:

Input U-Boot's IP address: 192.168.1.1
Input TFTP server's IP address: 192.168.1.254
Input IP netmask: 255.255.255.0
Input file name: openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-initramfs-recovery.itb

Using ethernet@15100000 device
TFTP from server 192.168.1.254; our IP address is 192.168.1.1
Filename 'openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-initramfs-recovery.itb'.
Load address: 0x48000000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ################################
         9.2 MiB/s
done
Bytes transferred = 7143424 (6d0000 hex)
Saving Environment to MTD... Erasing on MTD device 'nmbm0'... OK
Writing to MTD device 'nmbm0'... OK
OK

*** Loaded 7143424 (0x6d0000) bytes at 0x48000000 ***

Run loaded data now? (Y/n):

## Loading kernel from FIT Image at 48000000 ...
   Using 'config-1' configuration
   Trying 'kernel-1' kernel subimage
     Description:  ARM64 OpenWrt Linux-6.6.30
     Type:         Kernel Image
     Compression:  lzma compressed
     Data Start:   0x480000e8
     Data Size:    4257403 Bytes = 4.1 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: 0x48000000
     Entry Point:  0x48000000
     Hash algo:    crc32
     Hash value:   720d42ea
     Hash algo:    sha1
     Hash value:   9349b5673aaf9f882bc8978c7c1e3cce46d48561
   Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading ramdisk from FIT Image at 48000000 ...
   Using 'config-1' configuration
   Trying 'initrd-1' ramdisk subimage
     Description:  ARM64 OpenWrt xiaomi_mi-router-ax3000t-ubootmod initrd
     Type:         RAMDisk Image
     Compression:  Unknown Compression
     Data Start:   0x4840f8b0
     Data Size:    2799060 Bytes = 2.7 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: unavailable
     Entry Point:  unavailable
     Hash algo:    crc32
     Hash value:   8b2e357c
     Hash algo:    sha1
     Hash value:   b21ded39dc5fb7ded0a23948d939a3da1c855ce6
   Verifying Hash Integrity ... crc32+ sha1+ OK
WARNING: 'compression' nodes for ramdisks are deprecated, please fix your .its file!
## Loading fdt from FIT Image at 48000000 ...
   Using 'config-1' configuration
   Trying 'fdt-1' fdt subimage
     Description:  ARM64 OpenWrt xiaomi_mi-router-ax3000t-ubootmod device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x486bafa4
     Data Size:    23023 Bytes = 22.5 KiB
     Architecture: AArch64
     Hash algo:    crc32
     Hash value:   12b3dbff
     Hash algo:    sha1
     Hash value:   946030b9c7488f6da2917989f90f80bbc30c821e
   Verifying Hash Integrity ... crc32+ sha1+ OK
   Booting using the fdt blob at 0x486bafa4
   Uncompressing Kernel Image
lzma compressed: uncompress error 1
Must RESET board to recover
resetting ...

U-Boot version is:

RD03> version
U-Boot 2022.04 (Jul 30 2023 - 06:23:27 +0000), Build: jenkins-common_router_openwrt_ota_publish-5526

aarch64-linux-gnu-gcc (Linaro GCC 7.5-2019.12) 7.5.0
GNU ld (Linaro_Binutils-2019.12) 2.28.2.20170706

Please advice. Are the snapshot images actually broken, or is there something else that is wrong with this router? I've noticed that ramdisk compression type is indicated as unknown, but I'm not sure if it's supposed to be that way. In any case, how do I fix it? Router version is RD03.

8

Are you trying from the original Xiaomi firmware or from OpenWRT. If you just want to start from scratch, I personally would use the Xiaomi debricking tool and then hand it back to my friend for him to give it another go.

9

I guess you could say there's no working firmware ATM. He tried to install OpenWRT, but didn't succeed. He doesn't care much about which firmware he would end up with, assuming it worked. Where do I get the Xiaomi debricking tool you mentioned?

I personally would prefer to return it with OpenWRT though. Who wants a chinese firmware anyway.

Edit: I tried the MIWIFI Repair Tool in combination with stock firmware, but I guess either the load address is incorrect, or something else doesn't check out (e.g. the OpenWRT bootloader doesn't like it), because after the tool loads the image, I get this in the console, and the router still doesn't boot:

...
         #################################################################
         ###########################################################
         4.9 MiB/s
done

Bytes transferred = 23593992 (1680408 hex)
TS before image verify 1a5e9
TRX MAGIC error!
Header check error!
Image verify failed!
========Upgrade fail!========
10

The MIWIFI Repair Tool takes some getting used to. The warnings about ransom ware especially. It is best to turn of the Anti Virus temporarily. I had to try it several times before the thing started. You'll know when it's started because it takes a minute or two to upload the firmware. Don't forget it will have gone from 192.168.1.1 to 192.168.31.1

11

Was I ambiguous? I got the tool to work and to attempt flashing the router, but it wasn't any more successful at that than I was.The router still failed to boot afterwards.

However, I noticed this morning that when booting normally, the router uses start address 0x46000000 instead of 0x48000000, as mentioned in the Debricking section on the device page, so I figured I'd try that instead, and - lo and behold - I finally managed to first boot OpenWRT and then successfully flash it.

2 Likes
12

Well done, your friend will be pleased. Indeed in your first message "who wants a Chinese firmware anyway".

1 Like
13

Yep! Thanks for the help! :slight_smile: The router is now back with its owner.

14

Hello
I finally managed to recover my router here:

Well almost everything seems to me except the web interface
because when trying to install Lucy I have:
-ash: snapshots/packages/aarch64_cortex-a53/telephony/Packages.gz,: not found
root@OpenWrt:~# -ash: opkg_download:: not found
-ash: -ash:: not found
root@OpenWrt:~# root@OpenWrt:~# * opkg_download: Check your network settings an
d connectivity.

15

It seems to me that I had this connectivity problem with the DNS for the first time????

16

The C&P looks weird, look at the links at the top of https://openwrt.org/releases/snapshot

17

Good morning
I'm stuck, I'm not moving forward
I made a fw_printenv
here is the result:

root@OpenWrt:~# fw_printenv
CountryCode=CN
Router_unconfigured=0
SN=49850/F3UT69918
arch=arm
autostart=no
baudrate=115200
boot_auto=bootxq
boot_fw0=run boot_rd_img;bootm
boot_fw1=run boot_rd_img;bootm
boot_rd_img=nand read ${loadaddr} 0x2C0000 2000;image_blks 2048;nand read ${loadaddr} 0x2C0000 ${img_align_size}
boot_rd_img2=nand read ${loadaddr} 0x20C0000 2000;image_blks 2048;nand read ${loadaddr} 0x20C0000 ${img_align_size}
boot_wait=on
bootargs=console=ttyS0,115200n1 loglevel=8 swiotlb=512 rootfstype=squashfs firmware=0 mtd=ubi uart_en=1
bootcmd=bootxq
bootdelay=3
bootfile=openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-squashfs-sysupgrade.bin
bootmenu_0=Startup system (Default)=bootxq
bootmenu_1=Startup firmware0=bootxq 0
bootmenu_2=Startup firmware1=bootxq 1
bootmenu_3=Upgrade firmware=mtkupgrade fw
bootmenu_4=Upgrade ATF BL2=mtkupgrade bl2
bootmenu_5=Upgrade ATF FIP=mtkupgrade fip
bootmenu_6=Upgrade single image=mtkupgrade simg
bootmenu_7=Load image=mtkload
bootmenu_delay=5
color=101
ethact=ethernet@15100000
ethaddr=:::::
ethaddr_wan=:d8::11::89
ethaddr_wan2=:d8::76::**
ethprime=eth1
fdt_high=0x6c000000
fdtcontroladdr=4ffc4910
fileaddr=48000000
filesize=81d943
flag_boot_rootfs=0
flag_boot_success=1
flag_boot_type=2
flag_flash_permission=1
flag_last_success=1
flag_ota_reboot=0
flag_show_upgrade_info=1
flag_try_sys2_failed=8
invaild_env=no
ipaddr=192.168.1.1
loadaddr=0x48000000
mode=Router
model=RD03
mtdids=nmbm0=nmbm0
mtdparts=nmbm0:1024k(bl2),256k(Nvram),256k(Bdata),2048k(factory),2048k(fip),256k(crash),256k(crash_log),34816k(ubi),34816k(ubi1),32768k(overlay),12288k(data),256k(KF)
netmask=255.255.255.0
no_wifi_dev_times=0
rand_key=************************************************
rand_nonce=***********
restore_defaults=0
serverip=192.168.1.254
ssh_en=1
stderr=serial@11002000
stdin=serial@11002000
stdout=serial@11002000
telnet_en=0
uart_en=1
wl0_radio=1
wl0_ssid=Xiaomi_5G
wl1_radio=1
wl1_ssid=Xiaomi
flag_try_sys1_failed=0

18

Hello!!
Well finally I managed to recover my router.
With the method:

then I was on this page:

OpenWRT images:
official images: snapshot 1.6k
remittor's builds: 23.05.X 1.0k
dimfish'es builds: snapshot 429
ImmortalWRT: snapshot 315
X-WRT: 24.01 655

I clicked on remittor's builds: 23.05.X 1.
and I downloaded
openwrt-23.05.3-240325-xiaomi_mi-router-ax3000t-sysupgrade.bin
Then I flashed this file and my router is ok.

I have started configuring my router and I would like to know how to make a backup of my configuration
by creating a .bin file to re-flash it if I had a problem.
THANKS!

19

https://firmware-selector.openwrt.org/ select your device, and click the tiny arrow.

20

I would like to know how to make a backup of my router in .bin