Dual-Boot Modification for CMCC RAX3000M Computing Power Edition

Hardware Questions and Recommendations
1

Dual‑Boot Modification for CMCC RAX3000M Computing Power Edition (eMMC Version Only)

(eMMC “Computing Power Edition” / 算力版 — eMMC version only)

:warning: WARNING!

All actions described below are performed entirely at your own risk.
This guide is intended for advanced users or professionals with solid soldering skills (including BGA work).

The author is not responsible for any hardware damage caused by improper handling.

Overview

I decided to implement dual‑boot on the CMCC RAX3000M (eMMC version) by adding an SPI‑NAND chip.

Dual‑boot allows selecting which storage device the router boots from at power‑on.
For example:

  • eMMC → OpenWrt
  • SPI‑NAND → another OpenWrt or Keenetic

Required Tools & Parts

Besides steady hands :slightly_smiling_face:

1. Tools

  • Soldering iron
  • Hot air station
  • Proper (non‑active) BGA flux

2. SPI‑NAND chip

I used:

  • MX35LF1GE4AB-Z4I (≈ $1.4 on AliExpress with coins)

Alternative:

  • W25N01GVZEIG or similar

3. Resistors (0402 SMD)

  • 0Ω (1 pcs)
  • 4.7 kΩ (3 pcs)

(You may buy 10 pcs each if available; 100 pcs is unnecessary.)

The 2 kΩ (2 pcs) resistors may be:

  • Through‑hole
  • Or SMD 1206 — whatever is easier for you to solder

4. Wiring & Switch

  • Soft thin wires (recommended AWG28–AWG32 silicone insulated)
  • 2P2T slide switch (lever length ≥ 4 mm recommended)
Photo

Se5b06a6b8e3b4933812eef415f3833720
Se5b06a6b8e3b4933812eef415f3833720800×800 58.4 KB

S120861011ba240d7b65521b157af85f07
S120861011ba240d7b65521b157af85f07800×800 42.9 KB

Example:

Soft silicone wires are important — rigid thick wires may tear PCB pads when bent.

Mod Concept

The modification works by changing the boot strapping resistor configuration near the CPU (MT7981B).

The original resistors are 4.7 kΩ.
We do not remove them (impractical).
Instead, we override their logic level:

  • Logic High (1)
  • Logic Low (0)

Using stronger pull resistors:

  • 2 kΩ

This forces the desired boot source.

(See MT7981B datasheet — Boot Strapping section.)

Page from Datasheet MT7981B

MT7981B_Wi-Fi6_Platform_Datasheet_Open_V1.0.pdf - Google Chrome 30.04.2026 11_32_52
MT7981B_Wi-Fi6_Platform_Datasheet_Open_V1.0.pdf - Google Chrome 30.04.2026 11_32_52993×489 33.9 KB

Hardware Installation

:one: Install SPI‑NAND

Solder the SPI‑NAND chip on the back side of the PCB (designated footprint).

Add missing resistors:

  • 1 × 0Ω
  • 2 × 4.7 kΩ
Photo

IMG_20260430_112346
IMG_20260430_112346904×1600 489 KB

:two: Add Wiring

Solder 4 thin wires to the specified resistor pads and contacts.

Also add the missing 4.7 kΩ resistor near the button (top side).

Photos

IMG_20260430_112645
IMG_20260430_112645904×1600 449 KB

IMG_20260430_112402
IMG_20260430_112402904×1600 414 KB

:warning: Note that the USB port power mod has already been done here - resistor moved for USB_VBUS. Be extremely careful with the USB_VBUS resistor as it's located near the 12V pads - it's highly undesirable to short anything there or leave solder bridges. Why soft and thin wires are needed - if the wires are stiff and thick, they may tear off traces with pads and resistors from the board during bending

:three: Connect to Slide Switch

Wire everything according to your 2P2T switch layout.

Photo

IMG_20260430_112604
IMG_20260430_112604904×1600 314 KB

The switch lever (~1.5 mm shaft) almost fits through the ventilation slots near the USB port.
You may need slight filing or widening with a flat screwdriver.

Boot Modes

  • Switch position A → SPI‑NAND boot
  • Switch position B → eMMC boot

SPI‑NAND Initial Setup

:warning: A new SPI‑NAND chip must be erased before use.

Use UART boot method:

MTKUartBoot
https://4pda.to/forum/index.php?showtopic=1109762&view=findpost&p=138665859

After booting:

  1. Connect via serial console
  2. Press Ctrl+C to enter U‑Boot
  3. Run:

text

mtd erase spi-nand0

Bad block warnings during erase are normal for new NAND chips.

If needed, repeat the erase procedure once more.

Then start the HTTP server:

text

httpd

Flash Bootloaders

Open in browser:

text

http://192.168.1.1/bl2.html
http://192.168.1.1/uboot.html

Download latest OpenWrt bootloaders here:

Required files:

  • bl2.bin → NAND-DDR4-RELOADER.BIN
  • uboot → NAND-DDR4-BL31-UBOOT.FIP

Keenetic Setup (Optional)

For Keenetic:

  1. Flash:

text

KeenBOOT_RAX3000M_ME.bin

from:

2. Then install full KeeneticOS dump.

Factory Partition Handling

You must extract the factory (mtd) partition from eMMC (via OpenWrt shell + scp or WinSCP).

Then adapt it for SPI‑NAND.

If installing OpenWrt on SPI‑NAND:

Simply replace the corresponding mtdX factory partition.

If installing Keenetic:

More complicated.

In Keenetic format:

  • Factory is merged with bootloader.
  • Must be combined using WinHEX (or any hex editor).

In KeeneticOS 5.0.x full dump:

  • Factory appears twice:
    • Offset 0x180000
    • Offset 0x300000

You must replace both instances.

Assistance

If you need:

  • My full dump
  • Help injecting your factory partition

Send me a private message — I’ll help if possible.

Source: 4PDA

1 Like