Help to recover Xiaomi AX1800 (RM1800)


when I put a firmware for recovery to my TFTP-directory like: /srv/tftpd on my ubuntu server I used the miwifi_rm1800_firmware_ed621_1.0.378.bin file and renamed it to "test.bin" like you wrote.

I used the fixed IP on my NIC on my Laptop and restartet the device with hold reset. After about 8-10 seconds the orange light on my Xiaomi RM1800 began to blink freqently. I released the button and wait now for at least 15 minutes.

Still no sign of life.

What did I do? - Was able to successfully enable ssh and did some modifications. Everything worked well until I replaced the modules in /lib/modules/4.4.60/ completly instead of just the "wireguard.ko". So since this time the router seems to be in a boot loop.

Any help possible?

Is there a reset button ?

Of course there is a reset button. As I explained. I hold down the button for 8-10 seconds after replug the power plug and then it blinks rapidly twice as also described in other devolpment discussions here, but then nothing else, the "System" LED (orange) is just on....

There's a difference between reset, and initiating a recovery.

Just the reset button down. The Ax3600 has a second button.

So you know how to open the case?

Is J2 or J3 serial and how to find out pinning? Any special serial adapter needed?

Interesting, J2 is marked with 3.3V and J3 with 1.8V (which might count as 'special' serial adapter needed) - so both could actually be it (for the penny pinchers, omitting the level shifter, more likely J3).

Next steps?

I am not sure if there are some new pains like with TP-Links soldering-bridges... but how can I messure if things go well or not before? - I have no chance with TFTPD? - But how is that possible? The device worked great even with new flashings on both partitions. I had the the newest firmware without the "home-calling-features" from here: remove home-calling and after that I rebooted both partitions successfully. But then I wanted to implement in the newest firmware .399 wireguard like described in the other big topic here.


Unfortunately I didn't read to just install wireguard.ko. I installed all of the files completely into /lib/modules from the zip-file and it seems like I ended in a boot-loop.

But I think the uboot still has to work and don't know how to proceed properly now.

Would love to get help.

Before the crash I was really satisfied with the performance messurements. I saw around 600 Mbit/s up and down via my Huawei P20 to an Iperf3-Test and a long distance wifi-client setup with around 300 Mbit/s up and down. This was amazing for me. LAN<->WAN was able 940 Mbit/s up and down.

So all in all a very good device for my purpose, but now it's just crashed...

Assuming serial is needed, you want an USB TTL serial adapter, and a volt meter, to find out which pins which on the board.

You can probably do without the power meter, but it makes things easier.

So where do you think to put in what of my sp2102 serial adapter?

1 Like

since your adapter doesn't support 1.8v, those pins can't be used, I guess.

if you keep the volt meter connected to the two pins that you haven't put any markings on,
does any of them fluctuate just after you switch on the device ? if yes, that could be the Tx pin.

No flickering... at least I can't messure it with my multimeter in DC Mode. Maybe there are soldering bridges to do. There is R107 and R109 which seems to be something like that because there is no resistor on it.

Do you think we need some crap like here: Convertor?

How can I find out if the TFTPD-Client on the AX1800 is running? - If I search with wireshark on my ETHERNET INTERFACE I can't find anything with UDP Port 69 or "TFTP" as a filter. - So even my Laptop which has for sure a running and up TFTPD-Server (AFTPD) sends no frames... - So in best case, I just need the correct addresses for a TFTPD-Recovery?

I almost suspected that, as there seem to be a number of missing components in front of the 3.3V header (J2), while you could probably add your own level shifter for 1.8V (similarly to the archer c2600), it's probably easier to get a USB-to-serial adapter with 1.8V support (some -not all- FTDI FT232RL adapters for ~10 EUR do support 1.8V, 2.5V, 3.3V and 5V). Based on your voltage measurement, J3 seems to be connected to the SOC (visually, I would guess that pin 1, 2 and rx/ tx (in random order, but probably tx=2) and GND is obvious.


it is working with the 1,8V Serial Adapter. On J2 the pinning is 1=1,8V, 2=RX, 3=Ground, 4=TX.

Here is the logfile: Xiaomi AX1800 RM1800 Log-File

Important Edit:

I found already my answer: You need to use the name miwifi.bin for the filename to get it forced downloaded via tftpd.

What should I do now? - I took the miwifi_rm1800_firmware_ed621_1.0.378.bin renamed it to miwifi.bin and copied it to /srv/tftpd for my atftpd-server in ubuntu. The correct IP-Adress should be for the tftpd-server IP.

Bootlog with manual tftpboot

Hey, I wasn't strong enough to wait. - I just set up a isc-dhcp-server to give the router the ip because it seemed like the device is still waiting for a dhcp-address.

Here is the log and I am still waiting and not sure if I should give a reboot or not. Blue-LED is still blinking.


Device is alive again!

LED is blinking blue when flash-recovery is finished!!!

I see somehow no channel 52 and 100 anymore. Somehow I guess I have the chinese version installed... Can someone provide the newest global firmware without the spyware?

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.