Having a hard time to downgrade the AX3000 firmware

Hey, so the AX3000 arrived in the mail yesterday, and i decided to run it stock then, because i have been struggling to set this thing back in time. This thing currently runs on 1.0.68 firmware, so i need to set it back to 1.0.18 or below to run the SSH exploit. For the record, the hardware revision that i have is ra81, and there are no older firmware for this specific one atleast from what i try to find with limited googling.

So while i know i might be toast when i open the box, i try to force on with the ra69 firmware that exists on TOH, and try the Miwifi Repair Tool to flash it back. I try through the guide for other router as it would be similar, but then... Nothing. The app would crash or pop up before force closing it (mind you i do not have chinese windows installed so its just gibberish on my end). But it does go into flash mode for a few seconds after i hold down both mesh and reset button at the same time. It just do that and then go back onto normal booting (also, any idea on why this is so slow to boot on stock firmware?). At this rate i have no clue on what could be wrong as i have made sure ive tried most if not all ways to try to cap it open. Am i screwed and pretty much left with currently unsupported hardware? Im open for any alternative possibility other than waiting. Here's also the tftp log to possibly help.

Complex DNS request : ignored [25/04 15:27:46.434]
Message truncated (length was 8) [25/04 15:27:46.436]
Complex DNS request : ignored [25/04 15:32:52.250]
Message truncated (length was 8) [25/04 15:32:52.253]
Complex DNS request : ignored [25/04 15:37:34.743]
Message truncated (length was 8) [25/04 15:37:34.745]
Rcvd DHCP Discover Msg for IP 0.0.0.0, Mac D8:BB:C1:D0:AE:86 [25/04 15:37:43.638]
DHCP: proposed address 192.168.31.101 [25/04 15:37:43.671]
Rcvd DHCP Discover Msg for IP 0.0.0.0, Mac D8:BB:C1:D0:AE:86 [25/04 15:37:47.945]
DHCP: proposed address 192.168.31.101 [25/04 15:37:47.982]
Rcvd DHCP Discover Msg for IP 0.0.0.0, Mac D8:BB:C1:D0:AE:86 [25/04 15:37:56.833]
DHCP: proposed address 192.168.31.101 [25/04 15:37:56.874]
Rcvd DHCP Rqst Msg for IP 0.0.0.0, Mac D8:BB:C1:D0:AE:86 [25/04 15:37:56.891]
Previously allocated address 192.168.31.101 acked [25/04 15:37:56.904]
Rcvd DHCP Rqst Msg for IP 192.168.31.101, Mac D8:BB:C1:D0:AE:86 [25/04 15:40:04.131]
Previously allocated address 192.168.31.101 acked [25/04 15:40:04.197]
Complex DNS request : ignored [25/04 15:48:50.142]
Message truncated (length was 8) [25/04 15:48:50.144]
Complex DNS request : ignored [25/04 15:50:32.412]
Message truncated (length was 8) [25/04 15:50:32.414]
Rcvd DHCP Discover Msg for IP 0.0.0.0, Mac D8:BB:C1:D0:AE:86 [25/04 15:50:36.398]
DHCP: proposed address 192.168.31.101 [25/04 15:50:36.421]
Rcvd DHCP Discover Msg for IP 0.0.0.0, Mac 44:DF:65:F4:B5:B5 [25/04 15:50:36.579]
DHCP: proposed address 192.168.31.102 [25/04 15:50:36.593]
Rcvd DHCP Discover Msg for IP 0.0.0.0, Mac 44:DF:65:F4:B5:B5 [25/04 15:50:38.580]
DHCP: proposed address 192.168.31.102 [25/04 15:50:38.601]
Rcvd DHCP Discover Msg for IP 0.0.0.0, Mac 44:DF:65:F4:B5:B5 [25/04 15:50:40.581]
DHCP: proposed address 192.168.31.102 [25/04 15:50:40.606]
Rcvd DHCP Discover Msg for IP 0.0.0.0, Mac D8:BB:C1:D0:AE:86 [25/04 15:50:41.359]
DHCP: proposed address 192.168.31.101 [25/04 15:50:41.384]
Rcvd DHCP Discover Msg for IP 0.0.0.0, Mac 44:DF:65:F4:B5:B5 [25/04 15:50:42.581]
DHCP: proposed address 192.168.31.102 [25/04 15:50:42.607]
Rcvd DHCP Rqst Msg for IP 0.0.0.0, Mac 44:DF:65:F4:B5:B5 [25/04 15:50:42.625]
Previously allocated address 192.168.31.102 acked [25/04 15:50:42.638]
Rcvd DHCP Discover Msg for IP 0.0.0.0, Mac D8:BB:C1:D0:AE:86 [25/04 15:50:48.739]
DHCP: proposed address 192.168.31.101 [25/04 15:50:48.764]
Rcvd DHCP Rqst Msg for IP 0.0.0.0, Mac D8:BB:C1:D0:AE:86 [25/04 15:50:48.780]
Previously allocated address 192.168.31.101 acked [25/04 15:50:48.794]
Rcvd DHCP Discover Msg for IP 0.0.0.0, Mac D8:BB:C1:D0:AE:86 [25/04 15:54:47.113]
DHCP: proposed address 192.168.31.101 [25/04 15:54:47.155]
Rcvd DHCP Rqst Msg for IP 0.0.0.0, Mac D8:BB:C1:D0:AE:86 [25/04 15:54:49.121]
Client requested address 192.168.100.3 which was not allocated by ourselves and is either outside our pool or is used by someone else [25/04 15:54:49.147]
Complex DNS request : ignored [25/04 15:54:51.087]
Message truncated (length was 8) [25/04 15:54:51.090]
Complex DNS request : ignored [25/04 16:05:13.749]
Message truncated (length was 8) [25/04 16:05:13.751]
Complex DNS request : ignored [25/04 16:06:22.620]
Message truncated (length was 8) [25/04 16:06:22.622]
Rcvd DHCP Discover Msg for IP 0.0.0.0, Mac D8:BB:C1:D0:AE:86 [25/04 16:08:10.802]
DHCP: proposed address 192.168.31.101 [25/04 16:08:10.873]
Rcvd DHCP Rqst Msg for IP 0.0.0.0, Mac D8:BB:C1:D0:AE:86 [25/04 16:08:10.891]
Previously allocated address 192.168.31.101 acked [25/04 16:08:10.903]
Rcvd DHCP Rqst Msg for IP 192.168.31.101, Mac D8:BB:C1:D0:AE:86 [25/04 16:08:55.293]
Previously allocated address 192.168.31.101 acked [25/04 16:08:55.352]
Complex DNS request : ignored [25/04 16:12:35.527]
Message truncated (length was 8) [25/04 16:12:35.529]
Rcvd DHCP Discover Msg for IP 0.0.0.0, Mac 44:DF:65:F4:B5:B5 [25/04 16:12:59.616]
DHCP: proposed address 192.168.31.102 [25/04 16:12:59.641]
Rcvd DHCP Rqst Msg for IP 0.0.0.0, Mac 44:DF:65:F4:B5:B5 [25/04 16:12:59.661]
Previously allocated address 192.168.31.102 acked [25/04 16:12:59.671]
Complex DNS request : ignored [25/04 16:14:13.743]
Message truncated (length was 8) [25/04 16:14:13.746]
Rcvd DHCP Discover Msg for IP 0.0.0.0, Mac D8:BB:C1:D0:AE:86 [25/04 16:23:52.284]
DHCP: proposed address 192.168.31.101 [25/04 16:23:52.361]
Rcvd DHCP Rqst Msg for IP 0.0.0.0, Mac D8:BB:C1:D0:AE:86 [25/04 16:23:52.386]
Previously allocated address 192.168.31.101 acked [25/04 16:23:52.400]
Rcvd DHCP Rqst Msg for IP 192.168.31.101, Mac D8:BB:C1:D0:AE:86 [25/04 16:26:00.954]
Previously allocated address 192.168.31.101 acked [25/04 16:26:01.035]
Rcvd DHCP Rqst Msg for IP 0.0.0.0, Mac D8:BB:C1:D0:AE:86 [25/04 16:29:11.361]
Previously allocated address 192.168.31.101 acked [25/04 16:29:11.438]
Rcvd DHCP Rqst Msg for IP 0.0.0.0, Mac D8:BB:C1:D0:AE:86 [25/04 16:29:21.277]
Previously allocated address 192.168.31.101 acked [25/04 16:29:21.302]
Rcvd DHCP Rqst Msg for IP 0.0.0.0, Mac D8:BB:C1:D0:AE:86 [25/04 16:29:32.316]
Previously allocated address 192.168.31.101 acked [25/04 16:29:32.353]
Rcvd DHCP Discover Msg for IP 0.0.0.0, Mac F2:AB:D9:AC:58:D3 [25/04 16:29:38.892]
DHCP: proposed address 192.168.31.103 [25/04 16:29:38.929]
Rcvd DHCP Rqst Msg for IP 0.0.0.0, Mac F2:AB:D9:AC:58:D3 [25/04 16:29:39.048]
Previously allocated address 192.168.31.103 acked [25/04 16:29:39.070]
Rcvd DHCP Rqst Msg for IP 0.0.0.0, Mac D8:BB:C1:D0:AE:86 [25/04 16:30:05.387]
Previously allocated address 192.168.31.101 acked [25/04 16:30:05.488]
Complex DNS request : ignored [25/04 16:30:06.158]
Message truncated (length was 8) [25/04 16:30:06.161]

Hi, it's a bummer that it's another version of the device.

Actually I found older firmware (oldest is 1.0.33) files for this exact model:
https://mirom.ezbox.idv.tw/en/miwifi/RA81/roms-stable/

Yeah if my research got this correctly by that point the SSH vulnerability is already fully patched. Yeah i am SOL, but thank you either way for sending me this.

Ok, pity.

I found someone is working on OpenWrt support for exactly this device (RA81):
https://github.com/hzyitc/openwrt-redmi-ax3000
They are active here on the forum as well.

But the installation method is more tricky, with serial/UART access.

@hzyitc I found no mention of the RA81 device on the wiki.
What do you think, does it make sense to create a new wiki page for this device?
So it doesn't get confused with the Redmi AX6 (RA69).

Also are you planning to upstream the support to the main repo?

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.