I purchased on xiaomi mi router ax3000t and flashed the router with openwrt , can is still contain malware?

No, he can not.
Yesterday I was just looking at the contents of the bootloader from this router in a disassembler.

booting process on AX3000T
  try_value = 0i64;
  _flag_try_sys1_failed_s = getenv("flag_try_sys1_failed");
  if ( _flag_try_sys1_failed_s )
    _flag_try_sys1_failed = str2ull(_flag_try_sys1_failed_s, 0i64, 10);
  else
    _flag_try_sys1_failed = 0i64;
  _flag_try_sys2_failed_s = getenv("flag_try_sys2_failed");
  if ( _flag_try_sys2_failed_s )
    _flag_try_sys2_failed = str2ull(_flag_try_sys2_failed_s, 0i64, 10);
  else
    _flag_try_sys2_failed = 0i64;
  check_reset_fw();
  if ( (unsigned int)check_factory_mode() == 1 )
  {
    setenv("uart_en", "1");
    setenv("boot_wait", "on");
  }
  if ( a3 == 2 )
  {
    boot_fw_num = str2int(*(_BYTE **)(a4 + 8), 0i64, 10i64);
  }
  else
  {
    flag_try_sys1_failed_s = getenv("flag_try_sys1_failed");
    if ( flag_try_sys1_failed_s )
      flag_try_sys1_failed = str2ull(flag_try_sys1_failed_s, 0i64, 10);
    else
      flag_try_sys1_failed = 0i64;
    flag_try_sys2_failed_s = getenv("flag_try_sys2_failed");
    if ( flag_try_sys2_failed_s )
      flag_try_sys2_failed = str2ull(flag_try_sys2_failed_s, 0i64, 10);
    else
      flag_try_sys2_failed = 0i64;
    flag_ota_reboot_s = getenv("flag_ota_reboot");
    if ( flag_ota_reboot_s )
      flag_ota_reboot = str2ull(flag_ota_reboot_s, 0i64, 10);
    else
      flag_ota_reboot = 0i64;
    flag_last_success_s = getenv("flag_last_success");
    if ( flag_last_success_s )
      flag_last_success = str2ull(flag_last_success_s, 0i64, 10);
    else
      flag_last_success = 0i64;
    if ( flag_ota_reboot > 1 || flag_last_success > 1 )
    {
      boot_fw_num = 0;
    }
    else
    {
      if ( flag_try_sys1_failed )
        try_sys_is_OK = flag_try_sys2_failed == 0;
      else
        try_sys_is_OK = 1;
      if ( !try_sys_is_OK )
        log("Boot failure detected on both systems\n");
      if ( flag_ota_reboot )
      {
        boot_fw_num = 1 - flag_last_success;
        flag_boot_success_s = getenv("flag_boot_success");
        if ( flag_boot_success_s )
        {
          if ( str2ull(flag_boot_success_s, 0i64, 10) )
          {
            zero_param = "flag_boot_success";
          }
          else
          {
            log(" INFO: ota reboot failed, swap to old firmware! \n");
            setenv("flag_ota_reboot", "0");
            boot_fw_num = flag_last_success;
            zero_param = "flag_upgrade_push";
          }
          setenv(zero_param, "0");
        }
      }
      else
      {
        if ( flag_last_success )
          _try_sys = flag_try_sys2_failed > 5;
        else
          _try_sys = flag_try_sys1_failed > 5;
        try_sys = _try_sys;
        boot_fw_num = 1 - flag_last_success;
        if ( !try_sys )
          boot_fw_num = flag_last_success;
      }
    }
  }
  v11 = sprintf_s(cmdline, 256i64, "%s", "console=ttyS0,115200n1 loglevel=8 swiotlb=512 rootfstype=squashfs");
  v12 = (unsigned int)sprintf_s(&cmdline[v11], 256i64 - v11, " firmware=%d", boot_fw_num) + v11;
  v13 = v12;
  if ( boot_fw_num )
    fw_num_s = sprintf_s(&cmdline[v12], 256 - v12, " mtd=ubi1");
  else
    fw_num_s = sprintf_s(&cmdline[v12], 256 - v12, " mtd=ubi");
  *(_QWORD *)&v15 = (unsigned int)(fw_num_s + v13);
  uart_en_s = getenv("uart_en");
  _uart_en_s = (const char *)uart_en_s;
  if ( uart_en_s && (unsigned int)sub_41E63510(uart_en_s, (__int64)"0") )
    *(_QWORD *)&v15 = v15 + (unsigned int)sprintf_s(&cmdline[v15], 256i64 - v15, " uart_en=%s", _uart_en_s);
  if ( (unsigned int)check_factory_mode() )
  {
    sprintf_s(&cmdline[*(_QWORD *)&v15], 256i64 - *(_QWORD *)&v15, " factory_mode=%s", "1");
    setenv("uart_en", "1");
    setenv("boot_wait", "on");
  }
  setenv("bootargs", cmdline);
  if ( boot_fw_num )
  {
    setenv("flag_boot_rootfs", "1");
    sprintf_s((char *)&try_value, 8i64, "%ld", _flag_try_sys2_failed + 1);
    try_name = "flag_try_sys2_failed";
  }
  else
  {
    setenv("flag_boot_rootfs", "0");
    sprintf_s((char *)&try_value, 8i64, "%ld", _flag_try_sys1_failed + 1);
    try_name = "flag_try_sys1_failed";
  }
  v19 = setenv(try_name, &try_value);
  saveenv(v19, v20);
  log(
    "Booting System %d, sys1_failed = %d, sys2_failed = %d\n",
    boot_fw_num,
    _flag_try_sys1_failed,
    _flag_try_sys2_failed);
  sub_41E24594();
  if ( boot_fw_num )
    target_ubi = "ubi1";
  else
    target_ubi = "ubi";
  v22 = bootm(target_ubi);
2 Likes