You can install custom buiilds for now.
OpenWrt official images are not compatible until this is merged
1 Like
Can I use remittor builds?
1 Like
Yes you can
1 Like
Thank you very much!
Is the installation process any different?(via XMir-Patcher) Or do I need to install the firmware in some other way?
1.0.84 should be vulnerable and xmir should be able to automate some steps for you.
Make sure to follow steps from Wiki to backup your partitions before flashing anything.
where is the finished assembly? i didn't find it
or what needs to be added there, what driver, i still don't understand
If using this constructor as an example, what needs to be added ?
https://firmware-selector.openwrt.org/?version=24.10.0-rc5&target=mediatek%2Ffilogic&id=xiaomi_mi-router-ax3000t
everyone just gives advice, but in fact says nothing, it's called figure it out yourself 
1 Like
Thanks a lot, I did it all right!
I've never built custom images, so I have limited knowledge in this.
I am so sorry about that. I followed the wiki instruction, but it still failed. Is it related with the firmware version I used?
I attached the operations below. Hope it could help. Really thank you!
# on host pc, turn up sshd
~/xmir-patcher$ ./run.sh
==========================================================
Xiaomi MiR Patcher
1 - Set IP-address (current value: 192.168.31.1)
2 - Connect to device (install exploit)
3 - Read full device info
4 - Create full backup
5 - Install EN/RU languages
6 - Install Breed bootloader
7 - Install firmware (from directory "firmware")
8 - {{{ Other functions }}}
9 - [[ Reboot device ]]
0 - Exit
Select: 2
device_name = RD03
rom_version = 1.0.84 release
mac address = 00:e0:4c:70:0b:fb
Detect valid SSH server on port 22 (auth OK)
Current CountryCode = CN
Enter device WEB password: mypassword
Exploit "start_binding" detected!
Run SSH server on port 22 ...
#### SSH server are activated! ####
==========================================================
~/xmir-patcher$ ssh -o StrictHostKeyChecking=no -o HostKeyAlgorithms=+ssh-rsa -o PubkeyAcceptedAlgorithms=+ssh-rsa root@192.168.31.1
root@192.168.31.1's password:
# on the router, backup
BusyBox v1.25.1 (2024-05-29 03:41:33 UTC) built-in shell (ash)
-----------------------------------------------------
Welcome to XiaoQiang!
-----------------------------------------------------
$$$$$$\ $$$$$$$\ $$$$$$$$\ $$\ $$\ $$$$$$\ $$\ $$\
$$ __$$\ $$ __$$\ $$ _____| $$ | $$ | $$ __$$\ $$ | $$ |
$$ / $$ |$$ | $$ |$$ | $$ | $$ | $$ / $$ |$$ |$$ /
$$$$$$$$ |$$$$$$$ |$$$$$\ $$ | $$ | $$ | $$ |$$$$$ /
$$ __$$ |$$ __$$< $$ __| $$ | $$ | $$ | $$ |$$ $$<
$$ | $$ |$$ | $$ |$$ | $$ | $$ | $$ | $$ |$$ |\$$\
$$ | $$ |$$ | $$ |$$$$$$$$\ $$$$$$$$$ | $$$$$$ |$$ | \$$\
\__| \__|\__| \__|\________| \_________/ \______/ \__| \__|
root@XiaoQiang:~# nanddump -f /tmp/BL2.bin /dev/mtd1
ECC failed: 0
ECC corrected: 0
Number of bad blocks: 0
Number of bbt blocks: 0
Block size 131072, page size 2048, OOB size 64
Dumping data starting at 0x00000000 and ending at 0x00100000...
root@XiaoQiang:~# nanddump -f /tmp/Nvram.bin /dev/mtd2
ECC failed: 0
ECC corrected: 0
Number of bad blocks: 0
Number of bbt blocks: 0
Block size 131072, page size 2048, OOB size 64
Dumping data starting at 0x00000000 and ending at 0x00040000...
root@XiaoQiang:~# nanddump -f /tmp/Bdata.bin /dev/mtd3
ECC failed: 0
ECC corrected: 0
Number of bad blocks: 0
Number of bbt blocks: 0
Block size 131072, page size 2048, OOB size 64
Dumping data starting at 0x00000000 and ending at 0x00040000...
root@XiaoQiang:~# nanddump -f /tmp/Factory.bin /dev/mtd4
ECC failed: 0
ECC corrected: 0
Number of bad blocks: 0
Number of bbt blocks: 0
Block size 131072, page size 2048, OOB size 64
Dumping data starting at 0x00000000 and ending at 0x00200000...
root@XiaoQiang:~# nanddump -f /tmp/FIP.bin /dev/mtd5
ECC failed: 0
ECC corrected: 0
Number of bad blocks: 0
Number of bbt blocks: 0
Block size 131072, page size 2048, OOB size 64
Dumping data starting at 0x00000000 and ending at 0x00200000...
root@XiaoQiang:~# nanddump -f /tmp/ubi.bin /dev/mtd8
ECC failed: 0
ECC corrected: 0
Number of bad blocks: 0
Number of bbt blocks: 0
Block size 131072, page size 2048, OOB size 64
Dumping data starting at 0x00000000 and ending at 0x02200000...
root@XiaoQiang:~# nanddump -f /tmp/KF.bin /dev/mtd12
ECC failed: 0
ECC corrected: 0
Number of bad blocks: 0
Number of bbt blocks: 0
Block size 131072, page size 2048, OOB size 64
Dumping data starting at 0x00000000 and ending at 0x00040000...
root@XiaoQiang:~# cd /tmp
root@XiaoQiang:/tmp# tar cf - *.bin | nc 192.168.31.157 1234
root@XiaoQiang:/tmp# cat /proc/cmdline
console=ttyS0,115200n1 loglevel=8 swiotlb=512 firmware=0 mtd=ubi uart_en=1
# On the host pc, scp the firmware
~/xmir-patcher$ scp -o StrictHostKeyChecking=no -o HostKeyAlgorithms=+ssh-rsa -o PubkeyAcceptedAlgorithms=+ssh-rsa -O firmware/openwrt-23.05.5-241111-xiaomi_mi-router-ax3000t-initramfs-factory.ubi root@192.168.31.1:/tmp/
root@192.168.31.1's password:
openwrt-23.05.5-241111-xiaomi_mi-router-ax3000t-initramfs-factory.ubi 100% 21MB 8.4MB/s 00:02
~/xmir-patcher$ scp -o StrictHostKeyChecking=no -o HostKeyAlgorithms=+ssh-rsa -o PubkeyAcceptedAlgorithms=+ssh-rsa -O firmware/openwrt-23.05.5-241111-xiaomi_mi-router-ax3000t- root@192.168.31.1:/tmp/
firmware/openwrt-23.05.5-241111-xiaomi_mi-router-ax3000t-initramfs-factory.ubi
firmware/openwrt-23.05.5-241111-xiaomi_mi-router-ax3000t-sysupgrade.bin
~/xmir-patcher$ scp -o StrictHostKeyChecking=no -o HostKeyAlgorithms=+ssh-rsa -o PubkeyAcceptedAlgorithms=+ssh-rsa -O firmware/openwrt-23.05.5-241111-xiaomi_mi-router-ax3000t-sysupgrade.bin root@192.168.31.1:/tmp/
root@192.168.31.1's password:
openwrt-23.05.5-241111-xiaomi_mi-router-ax3000t-sysupgrade.bin 100% 21MB 8.3MB/s 00:02
# on the router
root@XiaoQiang:/tmp# ubiformat /dev/mtd9 -y -f /tmp/openwrt-23.05.5-241111-xiaomi_mi-router-ax3000t-initramfs-factory.ubi
ubiformat: mtd9 (nand), size 35651584 bytes (34.0 MiB), 272 eraseblocks of 131072 bytes (128.0 KiB), min. I/O size 2048 bytes
libscan: scanning eraseblock 271 -- 100 % complete
ubiformat: 272 eraseblocks have valid erase counter, mean value is 1
ubiformat: flashing eraseblock 167 -- 100 % complete
ubiformat: formatting eraseblock 271 -- 100 % complete
root@XiaoQiang:/tmp# nvram set boot_wait=on
root@XiaoQiang:/tmp# nvram set uart_en=1
root@XiaoQiang:/tmp# nvram set flag_boot_rootfs=1
root@XiaoQiang:/tmp# nvram set flag_last_success=1
root@XiaoQiang:/tmp# nvram set flag_boot_success=1
root@XiaoQiang:/tmp# nvram set flag_try_sys1_failed=0
root@XiaoQiang:/tmp# nvram set flag_try_sys2_failed=0
root@XiaoQiang:/tmp# nvram commit
root@XiaoQiang:/tmp# reboot
root@XiaoQiang:/tmp# Connection to 192.168.31.1 closed by remote host.
Connection to 192.168.31.1 closed.
# on the host pc, test the router after a few minutes
~/xmir-patcher$ ping 192.168.31.1
PING 192.168.31.1 (192.168.31.1) 56(84) bytes of data.
64 bytes from 192.168.31.1: icmp_seq=1 ttl=64 time=0.780 ms
64 bytes from 192.168.31.1: icmp_seq=2 ttl=64 time=0.779 ms
^C
--- 192.168.31.1 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1020ms
rtt min/avg/max/mdev = 0.779/0.779/0.780/0.000 ms
Show me where in the instructions it says that you need to put everything similar that you find into the xmir-patcher/FIRMWARE folder?
I used to use xmir-patcher to flash. Inside its firmware/readme.txt it said: "In this folder, you should put the firmware for flashing." So I put firmwares into this folder.
Of course, I speak English very poorly, but I have learned to understand the difference between singular and plural.
XXXXXXX. factory only.
Then, from under it, through the web interface, flash the update file - ХХХХХ.sysupgrade
First you need to put the factory.ubi file there
and then via luci update sysupgrade.bin
if you don't speak languages, if there is a translator, then here everything in detail can be revered
https://4pda.to/forum/index.php?showtopic=1074874&ysclid=m5zjgx3s8e299430133
and it is important that the router does not become a brick after rebooting, after updating .bin they say you need to do this
Run the command in the terminal
fw_setenv flag_try_sys2_failed 6
in the file /etc/rc.local add
fw_setenv flag_try_sys1_failed 0
I don't know if it's necessary or not, see for yourself
according to rumors there is some kind of counter and a certain number of times you can reboot and get a brick if you don't add these commands
https://openwrt.org/inbox/toh/xiaomi/ax3000t#basic_configuration
Thank you for your correction. I removed multiple files from the firmware folder, leaving only openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-initramfs-factory.ubi. However, after flashing and rebooting the router, its IP address remains 192.168.31.1, and the hostname is still xiaoqiang. Therefore, I think the flashing process was unsuccessful.
What is the program log? After reflashing, the router should reboot automatically and the LED should light up WHITE (BLUE), depending on your perception of color))).
Hi,
Finally I got few minutes and I was flashing the OpenWRT uboot instead of stock one.
I have done step by step as it was in manual, (r03, 1.0.84, airoha drivers included) but in the end, router got a brick. What I get in UART:
U-Boot 2024.10-OpenWrt-r28641-7585abfb16 (Jan 19 2025 - 18:13:11 +0000)
CPU: MediaTek MT7981
Model: Xiaomi Router AX3000T
DRAM: 256 MiB
Core: 39 devices, 17 uclasses, devicetree: embed
Loading Environment from UBI... spi-nand: spi_nand spi_nand@0: unknown raw ID cd 71 71 cd
Partition ubi not found!
** Cannot find mtd partition "ubi"
In: serial@11002000
Out: serial@11002000
Err: serial@11002000
reset button found
Loading Environment from UBI... spi-nand: spi_nand spi_nand@0: unknown raw ID cd 71 71 cd
Partition ubi not found!
** Cannot find mtd partition "ubi"
Net:
Warning: ethernet@15100000 (eth0) using random MAC address - fe:88:00:af:61:20
eth0: ethernet@15100000
Error, no UBI device selected!
Error, no UBI device selected!
spi-nand: spi_nand spi_nand@0: unknown raw ID cd 71 71 cd
MTD device ubi not found, ret -19
resetting ...
F0: 102B 0000
FA: 1040 0000
FA: 1040 0000 [0200]
F9: 0000 0000
V0: 0000 0000 [0001]
00: 0000 0000
BP: 2400 0041 [0000]
G0: 1190 0000
EC: 0000 0000 [1000]
T0: 0000 0236 [010F]
Jump to BL
NOTICE: BL2: v2.10.0 (release):OpenWrt v2024.01.17~bacca82a-3 (mt7981-spim-nand-ddr3)
NOTICE: BL2: Built : 18:13:11, Jan 19 2025
NOTICE: WDT: [40000000] Software reset (reboot)
NOTICE: EMI: Using DDR3 settings
NOTICE: EMI: Detected DRAM size: 256MB
NOTICE: EMI: complex R/W mem test passed
NOTICE: CPU: MT7981 (1300MHz)
NOTICE: SPI_NAND parses attributes from parameter page.
NOTICE: SPI_NAND Detected ID 0xcd
NOTICE: Page size 2048, Block size 131072, size 134217728
NOTICE: BL2: Booting BL31
NOTICE: BL31: v2.10.0 (release):OpenWrt v2024.01.17~bacca82a-3 (mt7981-spim-nand-ddr3)
NOTICE: BL31: Built : 18:13:11, Jan 19 2025
U-Boot 2024.10-OpenWrt-r28641-7585abfb16 (Jan 19 2025 - 18:13:11 +0000)
CPU: MediaTek MT7981
Model: Xiaomi Router AX3000T
DRAM: 256 MiB
Core: 39 devices, 17 uclasses, devicetree: embed
Loading Environment from UBI... spi-nand: spi_nand spi_nand@0: unknown raw ID cd 71 71 cd
Partition ubi not found!
** Cannot find mtd partition "ubi"
In: serial@11002000
Out: serial@11002000
Err: serial@11002000
reset button found
Loading Environment from UBI... spi-nand: spi_nand spi_nand@0: unknown raw ID cd 71 71 cd
Partition ubi not found!
** Cannot find mtd partition "ubi"
Net:
Warning: ethernet@15100000 (eth0) using random MAC address - 92:54:32:00:e7:e7
eth0: ethernet@15100000
Error, no UBI device selected!
Error, no UBI device selected!
spi-nand: spi_nand spi_nand@0: unknown raw ID cd 71 71 cd
MTD device ubi not found, ret -19
resetting ...
Is something what I can do or it will be a good beer mat?
This FIP image not supported foresee nand!
1 Like
these links that I sent, I prepared for myself, my router hasn't arrived yet )
but I've already prepared, here's a link on how to restore, use Google translator if necessary
in general, as I understand it, it is flashed within a minute and also restored within a minute, in fact, there is nothing terrible, can experiment
Disable firewall, connect Ethernet cable to the 2nd or 3rd LAN port on the router, and try, try, try...
Most users can restore this router via TFTP/MiWiFi repair tool (if the router has the stock bootloader). If not, you'll need UART to check what is happening.
Thanks, but that will not help. The lan port does not stand up, it is rebooting each few seconds. I guess I need to have a programer and flash from scratch.
@remittor I thought that the warning on the top is just related for airoha support. Tomorrow will add an additional warning near the flashing u-boot manual.
1 Like