Yes, sorry. The PR is in the robimarko/nss-packages repo.
1 Like
I've tried the exploit #179 on my AX9000 with FW 3.0.33, but as soon as I try to upload 1.bin, I always get the following popup: "Couldn't update. An error occured or router storage is full". Do you have any idea what might go wrong or is there any chance to find the root cause in the log files ?
I've tried that one too, with create_exploit_hdr2.js but I get the same error message.
Btw, is it possible that a manual update is blocked because there's an official update (3.0.40) pending ?
Could you try to do a reset to factory defaults before applying the exploit ?
Ok, I tried and it's a nightmare. The first 1.bin uploaded successfully, but on 2.bin I had the same error message. I did another factory reset and now I'm stucked on the init page and when I click "Try it now", I get a 500 internal error. No way to go ahead and use the router anymore. I was able to login with ssh but it's not a great help at the moment. Any idea how to unlock my router ?
If you are able to login with ssh the exploit has more or less worked. Do you have a serial acces ? If so you should be able to break in the boot phase and tftpboot an OpenWrt image.
Yes, it has somehow worked. I was able to call an init URL that allowed me to restore my settings and the router is working again. The only thing that does now show anymore is the number of connected devices on the status page, but that's a detail.
I'll get a serial access in order to try an OpenWrt image.
Thanks for the support.
hello team,
i have 2 questions,
- any of you know how to change the VLAN tagging for ax9000? i need to change to 500
- i bought the CN unit, is that possible to flash to Global firmware? im hoping global firmware have ability to change the vlan
thanks in advance!
Hi Loko,
I think this might not be the best forum to ask these questions - try Xiaomi forum instead, as both of your questions seems to be relevant to Xiaomi's firmware. I understand your confusion as Xiaomi advertises their firmware for this device as "OpenWRT based", but they simply used an older version of OpenWRT, customised it, added a bunch of their closed source code, etc...
1 Like
Found this during browsing. Hope it helps. Thanks everyone for your hardworks. God bless..
No, it does not help, has nothing to do with Openwrt.
2 Likes
Hi everyone
contemplating buying one of this ... however it seems from reading on this forum it is still in early development the openwrt version.
A quick question - are you finding the drivers are not open source ? I have a wrt3200acm and as you probably suspect don't want to end up with a driver like mwlwifi but with something that is top end, affordable and open source.
thank you & hope you enjoy the season with your loved ones 
1 Like
Well, I've just tried this with robimarko's latest built images.
root@XiaoQiang:~# nvram set ssh_en=1; nvram set uart_en=1; nvram set boot_wait=on; nvram commit;
root@XiaoQiang:~# reboot
...
root@XiaoQiang:~# ubiformat /dev/mtd22 -y -f /tmp/openwrt-ipq807x-generic-xiaomi_ax9000-squashfs-nand-factory.ubi
ubiformat: mtd22 (nand), size 58720256 bytes (56.0 MiB), 448 eraseblocks of 131072 bytes (128.0 KiB), min. I/O size 2048 bytes
libscan: scanning eraseblock 447 -- 100 % complete
ubiformat: 301 eraseblocks have valid erase counter, mean value is 0
ubiformat: 147 eraseblocks are supposedly empty
ubiformat: warning!: only 301 of 448 eraseblocks have valid erase counter
ubiformat: mean erase counter 0 will be used for the rest of eraseblock
ubiformat: use erase counter 0 for all eraseblocks
ubiformat: flashing eraseblock 92 -- 100 % complete
ubiformat: formatting eraseblock 447 -- 100 % complete
root@XiaoQiang:~# nvram get flag_last_success
0
root@XiaoQiang:~# nvram set flag_last_success=1
root@XiaoQiang:~# nvram set flag_boot_rootfs=1
root@XiaoQiang:~# nvram commit
root@XiaoQiang:~# reboot
root@XiaoQiang:~# Connection to 192.168.31.1 closed by remote host.
Connection to 192.168.31.1 closed.
Doesn't appear to come back up, and no wifi point is visible. However plugging the wan ethernet port into my computer, which acts as a DHCP server, an IP address comes up for the device, but I'm not able to ssh into it and nmap suggests all ports are closed. So I guess something's partially booted up.
I guess I'll try the recovery process, or get a debug cable that won't brick the device. Maybe this is flebourse's issue.
Ah, looks like I managed to recover it, using the recovery tool (Xiaomi Mi Router 4A Gigabit Edition (R4AG/R4A Gigabit) -- fully supported and flashable with OpenWRTInvasion - #747 by Zorro). Would be great to know if I did something wrong.
You need to flash both rootfs partitions.
mtd21: 03800000 00020000 "rootfs"
mtd22: 03800000 00020000 "rootfs_1"
Doesn't seem to be the same issue, if your PC is able to receive a correct dhcp request the uplink is working at least in the router->PC direction.
By default the firewall on the router block almost everything on the wan link, one solution would be to generate a firmware containing a permissive firewall configuration.
Yes. I think I hadn't realised how locked down the openwrt firmware would be after first installation. It's all working now.
Thanks for your, and kirdes, help.
My new & shiny AX9000 has just arrived
Is there a way to get ssh access without serial nor secondary OpenWRT router? (my current OpenWRT router has HTTPs enabled)
Is QCN PCIe working?
Is robi's image using an overlay partitions or still uses two rootfs only?
Thanks!
I would like to compile the firmware for my AX9000, but I haven't found any information about which branch to use on robimarko,s repo. Should I use IPQ807x-5.10-backports or ipq807x-5.15 ?