Bricked Xiaomi AX3000T (Label RD23) after OpenWrt Factory Reset

Installing and Using OpenWrt
1

"Hi everyone,

I need help recovering my Xiaomi router. It is an AX3000T (label says RD23). I successfully installed OpenWrt using the following file: openwrt-23.05.5-mediatek-filogic-xiaomi_mi-router-ax3000t-squashfs-sysupgrade.bin. Everything was working perfectly until I performed a factory reset, after which the router became inaccessible.

What I've tried: I used the Mi-Router Repair Tool with these files:

  • miwifi_rd03_firmware_ef0ee_1.0.47.bin

  • miwifi_rd03_firmware_ef0ee_1.0.64.bin

The Result: In both cases, the tool completes the process (blue progress bar reaches 100%), and the router LED changes from flashing orange to solid blue. However, I still cannot reach the router (No IP assigned, No Ping response).

The Problem: I suspect I am using the wrong recovery files. My files say RD03, my label says RD23, but the hardware ran the AX3000T (RB03) OpenWrt image perfectly.

My Questions:

  1. Where can I find the correct recovery firmware (.bin) for this specific model?

  2. Does anyone have a working mirror link for the AX3000T / RB03 stock firmware? (The official Xiaomi CDN links are currently not working for me).

Thanks for any help!"

2

Which version of OpenWrt you were running (ubootmod or no)
What was the original OEM firmware version?

1 Like
3

  1. OpenWrt Version: I initially installed a Snapshot, and later updated it to 23.05.5 using the xiaomi_mi-router-ax3000t-squashfs-sysupgrade.bin file. This confirms I am still using the Stock Bootloader and the stock partition layout.

  2. Original OEM Version: The router is definitely the International/Global Version (English box/UI).

4

1.0.something installed in factory represents flash chip in the device and you may not install anything older than that.
You have to use RD23 image for recovery
latest on the page is fine (as in RCE-able) https://openwrt.org/inbox/toh/xiaomi/ax3000t

Run wireshark capture while recovering "just in case"
x https://openwrt.org/inbox/toh/xiaomi/ax3000t#tftp_instructions_for_the_stock_bootloader

1 Like
5

I tried flashing version 1.0.97 (INT). The LED went from orange to flashing blue, but it stayed like that for about 20 minutes with no further progress. After a manual reboot, the LED turned solid orange (stuck). Now, I'm trying again with version 1.0.49 (INT).

What am I missing here? Is it a flash chip compatibility issue or am I missing a step in the recovery process?

6

wireshark https://www.wireshark.org/download.html

1 Like
7

Still stuck with flashing blue LED - Need help interpreting Wireshark"

"I followed the advice and ran Wireshark during the Mi-Repair process, but I'm not sure what I'm looking at.

The transfer seems to go through, as the last TFTP line I see is: 100362 29.980078300 192.168.31.102 192.168.31.100 TFTP 60 Acknowledgement, Block: 50047

But then, the router just stays on flashing blue forever. I waited 20 minutes and nothing happens. I tried to look for the router again and all I see is my PC asking: 100561 201.545654400 ASUSTek... Broadcast ARP 42 Who has 192.168.31.1? Tell 192.168.31.100

I'm lost here:

  • Does Block 50047 mean the firmware was actually accepted, or could it still be the wrong version?

  • Why is the router not responding to the ARP request after the flash? Did it crash?

  • Could this be an issue with the flash chip not being compatible with the Global/INT firmware?

  • I've tried 1.0.49 and 1.0.97 with no luck. Am I missing a step or should I try a different firmware region?

Any ideas on what these logs might mean? I really don't want to brick this."

Edit:

The ARP request from the PC is now repeating in a continuous loop with no response from the router:

  • 100765 447.545493600 ASUSTekCOMPU_86:79:75 Broadcast ARP 42 Who has 192.168.31.1? Tell 192.168.31.100

  • 100810 460.122341200 ASUSTekCOMPU_86:79:75 Broadcast ARP 42 Who has 192.168.31.1? Tell 192.168.31.100

  • 100855 472.698122800 ASUSTekCOMPU_86:79:75 Broadcast ARP 42 Who has 192.168.31.1? Tell 192.168.31.100

8

Maybe it is rebooting?

You said you have intl device and intl firmware.

25627916/512=50055 blocks , it mens incomplete transfer.

1 Like
9

Run wireshark and capture output from each port during router boot - see what the router initially sends out. It usually tells you what IP it has, if any.

2 Likes
10

I've realized the packet transfer isn't completing, but I'm already way beyond my amateur skills. I've been stuck on this for 2 days straight and really need help. I need to know exactly what settings I can change to fix this transfer interruption (MTU, Block Size, or Server settings) so the full firmware actually reaches the router."

1 Like
11

You need to force network link up and increase timeouts.
First can be achieved using (cheap, not-smart) switch in the middle, second - just set it to some 10 minutes. To me it feels that nth to last packet is accepted only after flash is programmed. btw ubootmod reboots in like 20 seconds that youtube even does not rebuffer :wink:

12

Come on, you are skilling up, Cannot get worse.

1 Like
13

Thanks for your time, but I've been stuck for 2 days now. Can you explain in more detail what I should do?

Apparently, the transfer finally completed. My Wireshark log shows: 101055 768.448253600 192.168.31.102 192.168.31.100 TFTP 60 Acknowledgement, Block: 50055

However, the router has been blinking BLUE for over 20 minutes and nothing happens. I'm using the MiFlashTool because it's the only one that completes the transfer. Am I using the right file? How can I apply your suggestions (timeouts/switch) if the tool already says the transfer is done but the router won't boot?

1 Like
14

Rapid blinking in blue means it has been successfully flashed!
Just power off the router, then power on, and wait while it boots normally.

Login using 192.168.31.1

2 Likes
15

When i restar the router it stays with an orange color… no conection

16

First boot after flashing (with the orange light) may take some time. ~1min until the router switches to the normal solid blue light.

If the blue light does not appear, try flashing the stock firmware again.

2 Likes
17

Also, just to be on the safe side regarding hardware drivers compatibility, use the INT 1.0.76 stock firmware version for your RD23:

1 Like
18

I used that file and this is what I get in Wireshark: 199404 3044.152135600 192.168.31.102 192.168.31.100 TFTP 60 Acknowledgement, Block: 48643

The transfer seems to stop at block 48643 every time, but the full file should go up to block 50055, Right?. It never reaches the end. How can I fix this? Is it a timeout issue or a network card problem?

19

You mentioned this earlier ^. Maybe you're unable to download the firmware file completely?

Check the MD5 file checksum for the previously downloaded 1.0.76 firmware file. It should be c491b452e62fd357859c0dd80d4ae9e2

1 Like
20

The MD5 hash matches perfectly: C491B452E62FD357859C0DD80D4AE9E2.

The file is 100% correct on my PC. This confirms that the transfer stopping at block 48643 is a network/hardware issue on my end. I'm using a direct connection from my ASUS laptop to the router. What can I do to prevent the connection from dropping right at the end?"