OpenWrt support for Xiaomi AX9000

TempestJunior · 2023-02-17T18:37:08.067Z

I'm following the SSH instructions and currently having a hard time uploading the 1.bin file.
I'm using the router admin GUI to upload the file and always end up with the error:

"Couldn't verify file"

Have I done something wrong?

robimarko · 2023-02-17T18:54:13.115Z

Which directions are you following?

You need to be following ones for the international model:

OpenWrt Wiki – 12 Jun 21

Xiaomi Mi Router AX9000

Xiaomi Mi Router AX9000 The Xiaomi Mi Router AX9000 is an 802.11ax OFDMA and MU-MIMO Tri-Band WiFi router, which has the following WiFi Interfaces.: * one 2.4GHz (QCN9024 4×4 ax) * two 5GHz (QCN5024 4×4 ax + QCN9024 2×2/4×4 ax) * one AIoT...

TempestJunior · 2023-02-17T18:59:58.464Z

Yes, I'm using those instructions, currently stuck at the Obtain SSH Access step.

I am unable to upload the 1.bin file due to the error: "Couldn't verify file"

Seems some other persons on this thread had same experience but I don't find a solution to the problem on this thread.

Any help will be appreciated?

dpeti · 2023-02-17T19:14:40.207Z

I had something similar. I ended up regenerating the bin with a different exploit, let me look it up.

robimarko · 2023-02-17T19:14:45.922Z

I am sure somebody found a way around, as I am not sure what stock FW version was that tested against, Xiaomi could have patched it

dpeti · 2023-02-17T19:29:03.946Z

https://drive.google.com/file/d/1OEBGq5T87tTbYQ9nqqUE9S9kRReZ_hJ7/view

Try this. Try the hdr2 version, that worked for me!

I have no idea what hdr2 exactly is, maybe someone could enlighten me

TempestJunior · 2023-02-17T20:21:15.209Z

The hdr2 version worked.

Thanks a bunch @dpeti

TempestJunior · 2023-02-17T23:16:26.031Z

Can anyone here spot what may have gone wrong, my ax9000 is frozen, refuses to start up or assign IPs to clients connected to the LAN ports.

mtd21: 03800000 00020000 "rootfs"
mtd22: 03800000 00020000 "rootfs_1"

root@XiaoQiang:~# nvram get flag_boot_rootfs
0
root@XiaoQiang:~# ubiformat /dev/mtd22 -y -f /tmp/openwrt-ipq807x-generic-xiaomi_ax9000-squashfs-factory.ubi && nvram set flag_boot_rootfs=1 && nvram set flag_last_success=1 && nvram commit
ubiformat: mtd22 (nand), size 58720256 bytes (56.0 MiB), 448 eraseblocks of 131072 bytes (128.0 KiB), min. I/O size 2048 bytes
libscan: scanning eraseblock 447 -- 100 % complete
ubiformat: 316 eraseblocks have valid erase counter, mean value is 0
ubiformat: 132 eraseblocks are supposedly empty
ubiformat: warning!: only 316 of 448 eraseblocks have valid erase counter
ubiformat: mean erase counter 0 will be used for the rest of eraseblock
ubiformat: use erase counter 0 for all eraseblocks
ubiformat: flashing eraseblock 108 -- 100 % complete
ubiformat: formatting eraseblock 447 -- 100 % complete

Where do I find information on how to debrick?

Thanks

mattimat · 2023-02-18T05:24:19.891Z

In this thread you can find uart method of flashing working single partition firmware for international version. Discussion within last two weeks. I think that wiki is not updated.

TempestJunior · 2023-02-18T08:09:25.039Z

Thanks @mattimat

The wiki suggests that UART is not enabled by default, hence I'm left wondering how I'm supposed to restore the router if SSH is required to enabled UART.

mattimat · 2023-02-18T08:33:42.671Z

In wiki you can find the info how to enable uart also, both the oem and openwrt versions are covered. You can also restore to oem version with tftp by following/adapting instructions under wiki for ax3600 ( [OpenWrt Wiki] Xiaomi Mi AIoT Router AX3600)

dpeti · 2023-02-18T08:48:56.935Z

The create exploit js turns on UART permanently, If I am not mistaken.
Have a try.
Also, as suggested, with miwifi repair tool you can start all over again

TempestJunior · 2023-02-18T10:05:42.405Z

Thanks @mattimat

I'll rather do the ftp restore to stock than start all over. Do you have a link to download the 3.0.33 stock firmware?

Could you also confirm the correct name of the image file in the case of ax9000, should the file also be named C0A81F02.img ?

mattimat · 2023-02-18T10:39:26.322Z

The 3.0.33 is not available as fas as I know. If you use 3.0.40 for tftp restore or with miwifi repair tool, the already enabled telnet remains available. The the filename need to be the tftpserver address in hex. 192.168.31.100 equals C0A81F02.
Pls. make sure that the telnet is enabled. This tftprestore also resets everything just the same way as miwifi repair tool. Also notice that there are no known exploits for 3.0.40 firmware !!

TempestJunior · 2023-02-18T10:53:45.992Z

Thanks for your reply.

I had telnet enabled before the router got bricked but do you mean that the 3.0.40 firmware should have telnet enabled after the restore?

Would you have a link to the firmware version that has telnet enabled?

mattimat · 2023-02-18T11:01:26.688Z

If the telnet was enabled when using 3.0.33 and has not been disabled it remains enabled after tftp restore with 3.0.40. The ssh can be started with following commands:

1. restore the oem fw 1.0.40
2. telnet 192.168.31.1
3. nvram set ssh_en=1
4. nvram set atf=1
5. nvram commit
6. sed -i 's/channel=.*/channel="debug"/g' /etc/init.d/dropbear
7. /etc/init.d/dropbear start

Please get an UART adapter to be on safe side

TempestJunior · 2023-02-18T12:55:24.358Z

My TFTP64 server log shows that the router is expecting [C0A81F02.img] but I may actually have the firmware named as [C0A81F02.img.bin] , since the stock firmware is bin format.

@mattimat
Could you please suggest how to rename the file correctly with img extension ?

image1074×185 40.4 KB

mattimat · 2023-02-18T13:09:24.681Z

Rename the file to C0A81F02.img

TempestJunior · 2023-02-18T13:11:45.252Z

Yes, I did that but the file extension is bin, so I effectively end up with C0A81F02.img.bin after renaming the file in Windows. Or do I need to rename the file in Linux?

mattimat · 2023-02-18T13:13:13.528Z

in unix cp C0A81F02.img.bin C0A81F02.img in windows copy C0A81F02.img.bin C0A81F02.img.

The file extension has to be img