OpenWrt support for Xiaomi AX3000NE

For Developers
22

A brief summary of how I enabled SSH service:

I extracted the firmware of Xiaomi CR8806 because I found that they have a similar interface. In the file system, I discovered a service called elink, which related to Home Automation. It establishes a connection with the gateway's port 32768 after establishing an internet connection and registers itself to the gateway.

By decompiling this file, I found that it uses wget %s -O /tmp/update.bin to download firmware during system upgrades, and it does not check if the URL address is valid. So, if we input ; reboot ; as the address, it will execute our command (in this case, "reboot").

image-20230516231905368

I wrote a Python program to implement this idea, and it works well with my device. I have already pushed it to my repo. I haven't done a lot of testing, if it doesn't work properly, please let me know or submit a PR :slight_smile:
@lazy.guy @hquu @shiguang55 @hank9999

7 Likes
23

Thanks for your hard working, I will try it! I need flash my device to mi firmware first.

24

I have tried this. It worked very well! My firmware version is 6.2.47(6.0.16)
I use a usb network share instead of a wifi netwrok to make sure my computer is online.

result
result780×358 7.51 KB

Thanks!

1 Like
25

Thanks a million for your great works and generous sharing！

26

This method is feasible, thank you

27

since we have access to ssh now, what else could we do to get a working openwrt firmware?

I see lots of MT7981 related pr recently so it seems to be supported.

28

Is your router a WR30U or an AX3000 NE

29

WR30U I know there's 3rd party firmware but still want to use the official one

30

Maybe you can extract the official Xiaomi firmware for the AX3000 NE and flash it to work on the wr30u

31

I am waiting 360 t7 support pr to be merged. This pr have some useful changes to MT7981. After it merged, i will try adding wr30u to main branch.

2 Likes
32

AS unlocking the AX3000NE SSH function needs run the scrip of server_emulator.py, how can I get this scrip, is it this dts?

33

it's literally in the top three hits in (my) google search ("server_emulator.py") ...

34

Check lee320's post, a repo link there.

35

You may find it on github link: https://github.com/PatriciaLee3/wr30u_ssh
Could you please share us the dumped rom file after enabled ssh.
Thanks

36

you can find server_emulator.py atPatriciaLee3/wr30u_ssh (github.com)
Can you share the original partition backup information about AX3000 NE，
You can refer to this post https://www.right.com.cn/forum/thread-8255963-1-1.html，

37

any idea why its still not merged? its been there for 2 months

38

huh ?

https://downloads.openwrt.org/snapshots/targets/mediatek/filogic/

39

no wr30u or ax3000ne?

40

ok, not the 360 t7 then :slight_smile:

did you check the wr30u commit? it was updated no later than 5 days ago.

41

yeah its already merged to other openwrt forks hope it can be done here soon