OpenWrt support for Xiaomi AX3000NE

For Developers
22

A brief summary of how I enabled SSH service:

I extracted the firmware of Xiaomi CR8806 because I found that they have a similar interface. In the file system, I discovered a service called elink, which related to Home Automation. It establishes a connection with the gateway's port 32768 after establishing an internet connection and registers itself to the gateway.

By decompiling this file, I found that it uses wget %s -O /tmp/update.bin to download firmware during system upgrades, and it does not check if the URL address is valid. So, if we input ; reboot ; as the address, it will execute our command (in this case, "reboot").

image-20230516231905368

I wrote a Python program to implement this idea, and it works well with my device. I have already pushed it to my repo. I haven't done a lot of testing, if it doesn't work properly, please let me know or submit a PR :slight_smile:
@lazy.guy @hquu @shiguang55 @hank9999

5 Likes
23

Thanks for your hard working, I will try it! I need flash my device to mi firmware first.

24

I have tried this. It worked very well! My firmware version is 6.2.47(6.0.16)
I use a usb network share instead of a wifi netwrok to make sure my computer is online.

result
result780×358 7.51 KB

Thanks!

1 Like
25

Thanks a million for your great works and generous sharing！

26

This method is feasible, thank you

27

since we have access to ssh now, what else could we do to get a working openwrt firmware?

I see lots of MT7981 related pr recently so it seems to be supported.

28

Is your router a WR30U or an AX3000 NE

29

WR30U I know there's 3rd party firmware but still want to use the official one

30

Maybe you can extract the official Xiaomi firmware for the AX3000 NE and flash it to work on the wr30u

31

I am waiting 360 t7 support pr to be merged. This pr have some useful changes to MT7981. After it merged, i will try adding wr30u to main branch.

1 Like