Devrus can you write when will the version for 25.12 be available?
./alpine-fan-control_1.1-r20240105_all.ipk: UNTRUSTED signature
Pretty sure there's an option to ignore it.
I'm not familiar with you mother tongue, so I suggest you RTFM.
Finally had a chance to upgrade my AX9000 routers to 24.10.5. All looks good, except…
When I ‘reboot’ via ssh terminal, I noticed sometimes the router doesn’t come back to life. Each time that happens I have to physically switch the router off then back on.
And when it does not come back to life, the power led would stay off while other leds would still lit up. The router basically stops working however, so a power cycle becomes necessary.
Is anyone else experiencing the same thing?
For those who have the chinese version, I followed this guide (in chinese) to install ssh. No other router needed.
Yes, just replace the bin file with this one.
For persisting this across upgrades, go to Luci > System > Backup/Flash Firmware and add the below to the list:
/lib/firmware/ath11k/QCN9074/hw1.0/board-2.bin
I have a hard-bricked AX9000 with a wiped bootloader. The device shows up in EDL mode (9008) and I've confirmed the following with edl.py:
HWID: 0x000dd0e100000000 PK_HASH: 0xcc3153a80293939b90d02d3bf8b23e0292e452fef662c74998421adad42a380f
I need someone with a working AX9000 to run dd if=/dev/mtd0 of=/tmp/sbl1.bin and share the file. This is the SBL1/firehose programmer needed to recover the device via EDL. Without it the only alternative is desoldering the NAND chip.
I have an AX9000 with global firmware version 3.0.40. I installed a custom uboot, presumably working on the Chinese version, on the mtd1, mtd15, and mtd16 partitions, but the lights on the device are no longer working. I have previously created partition backups, and I can help you with the sbl1.bin file you requested. For my situation, can I use your method to write my backup back to the same partitions and recover my uboot using EDL mode? Also, how can I bring the device to test point and EDL mode to rewrite these partitions and recover the device itself? I have a UART cable, and I'm sending you the log from the UART below. Thank you in advance for your help.
Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset), D - Delta, S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.3.1-00163
S - IMAGE_VARIANT_STRING=HAACANAZA
S - OEM_IMAGE_VERSION_STRING=CRM
S - Boot Config, 0x000002e5
B - 201 - PBL, Start
B - 2736 - bootable_media_detect_entry, Start
B - 3444 - bootable_media_detect_success, Start
B - 3449 - elf_loader_entry, Start
B - 6119 - auth_hash_seg_entry, Start
B - 43696 - auth_hash_seg_exit, Start
B - 105703 - elf_segs_hash_verify_entry, Start
B - 168559 - PBL, End
B - 181933 - SBL1, Start
B - 234484 - GCC [RstStat:0x10, RstDbg:0x600000] WDog Stat : 0x4
B - 241041 - pm_device_init, Start
B - 364536 - PM_SET_VAL:Skip
D - 123037 - pm_device_init, Delta
B - 366976 - pm_driver_init, Start
D - 5398 - pm_driver_init, Delta
B - 373289 - clock_init, Start
D - 2135 - clock_init, Delta
B - 377315 - boot_flash_init, Start
D - 12535 - boot_flash_init, Delta
B - 393541 - boot_config_data_table_init, Start
D - 3080 - boot_config_data_table_init, Delta - (575 Bytes)
B - 401044 - Boot Setting : 0x00000600
B - 404979 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:0,Subtype:18
B - 411963 - sbl1_ddr_set_params, Start
B - 415715 - CPR configuration: 0x300
B - 419161 - cpr_init, Start
B - 422028 - Rail:0 Mode: 5 Voltage: 824000
B - 427152 - CL CPR settled at 776000mV
B - 430050 - Rail:1 Mode: 5 Voltage: 880000
B - 434228 - Rail:1 Mode: 7 Voltage: 920000
D - 16500 - cpr_init, Delta
B - 441091 - Pre_DDR_clock_init, Start
B - 445117 - Pre_DDR_clock_init, End
B - 448502 - DDR Type : PCDDR3
B - 454145 - do ddr sanity test, Start
D - 1067 - do ddr sanity test, Delta
B - 458994 - DDR: Start of HAL DDR Boot Training
B - 463630 - DDR: End of HAL DDR Boot Training
B - 469395 - DDR: Checksum to be stored on flash is -2069583172
B - 479826 - Image Load, Start
D - 507032 - QSEE Image Loaded, Delta - (1381328 Bytes)
B - 986949 - Image Load, Start
D - 61 - SEC Image Loaded, Delta - (0 Bytes)
B - 994635 - Image Load, Start
D - 293715 - DEVCFG Image Loaded, Delta - (32548 Bytes)
B - 1288442 - Image Load, Start
D - 304969 - RPM Image Loaded, Delta - (93060 Bytes)
B - 1593503 - Image Load, Start
B - 1598840 - Error code 37000101 at boot_config.c Line 302
Hi there people! I got one of these devices (Chinese version) and I want to exploit it. I was following the guide but I've hit a wall. It requires a file that used to be found in https://blog.kevingu.net/downloads/ax9000-ssh-access.7z. Now the link is unreachable. Can anyone provide an alternative link to the files? Thanks in advance
link never surfaced last time it was requested, in Google drive link broken Xiaomi AX3600.
check if https://mudew.com/2022/11/23/小米AX9000折腾记录/ works.
english version, but you'll probably need the content from the 1st page - https://www.right.com.cn/FORUM/forum.php?mod=viewthread&tid=8231367&extra=page%3D1&ordertype=2.
Is this what you're after?
Please report if the links suggested work, and we'll update the wiki.
Thanks a lot. I will test it soon
Yeah I am not 100% sure but I think .ipk files can no longer be used on 25.12. Only .apk files are used. So same question here - will there be .apk files for fan control (i.e. the .apk versions of alpine-fan-control_1.1-r20240105_all.ipk and luci-app-alpine-fan-control_1.1-r20240105_all.ipk)?
The content can, assuming nothing else changed.
A thorough search on the net revealed this. To all - go https://github.com/devrus91/openwrt-alpine-fan-control/releases/tag/1.1 for the .apk versions of the installer files !
Ok I finally got myself some time to try the exploit. In the step 3 it says : " 3. Execute the Exploit * Unzip and load the exploit in the correct order (images 1, 2, 3) * Wait for the router to reboot after each image"
I assume there were some firmware image files or something like that? Where can I find those?
Scroll back a couple of posts ?
Fu*k... I'm stuck in the ssh part. Just cant get the service to start... Keep getting connection refused...
I did connect to the telnet though
Update
Found out what was wrong. I needed to set ssh_en=1
Then i followed the remaining of the tutorial up to the nvram commit and reboot and tcham! The router is bricked... Its permanently with the red led on, the Ethernet lights are off except for the wan light. Dhcp doesn't work and even if i set my ip to 192.168.1.1 i cant connect to luci...
Wtf happened? 
Update 2 - Just figured out what happened. I flashed the firmware : openwrt-25.12.3-qualcommax-
ipq807x-xiaomi_ax9000-squashfs-factory.ubi instead of the initramfs. Any solutions? UART?
If anyone could help I would appreciate it a lot. I'm a beginner, I've flashed openwrt using UART like 10 years ago, I completely forgot how I did it. I will solder the headers at the UART ports as soon as I get the time (probably at the weekend). Also If there is another easier solution to my idiocy, please tell me.
Let me update what happened to my case. I discovered that Xiaomi has an excelent restore system via tftpd using it's own app (Xiaomi MiWiFi Repair Tool) and I unbricked it with the original firmware. I redid the entire process but I used the correct initramfs and it worked like a charm. @frollic you can update the link at the Wiki. I suggest that when you do, emphasize the importance of the initramfs so people like me will be able to do it in one go. I almost spent my entire weekend soldering UART headers 
Also the board-2.bin file is working flawlessly... f*ck... Thanks everyone for all the help that is spread across this thread. It helped a lot. One thing is for sure, It took me too much time to configure a single router. Next time I will buy a router that is supported natively by OpenWrt.
I hope my struggle helps someone.