Support for Xiaomi Mi Router 4C (R4CM)

Thanks a lot for sharing the files @xTomax . They work perfectly!
However, I need the additional functionality of IPSec servers and clients on my routers which need some kernel configurations to be set while building from source. I am able build successfully but while flashing via serial, I get 'Checksum bad' message and the image doesn't get flashed.
Might I be missing some configuration parameter needed for making it compatible with Mi R4CM?
Any help is greatly appreciated.

Xiaomi Router 4c R4CM openwrt-19.07-snapshot-r10935-21bf718b8c-ramips-mt76x8
full dump
You need to replace the "factory" section with yours.
In the original firmware dump the "factory" section is located at 0x30000-0x3FFFFF.
In openwrt the address is 0х40000-0х4FFFFF.
However, it's possible not to change anything, it will work.

1 Like

Hey bro!! I'm from India.I accidentally updated my router to Chinese rom(mi router 4c/R4CM) I WANT A GLOBAL ENGLISH FIRMWARE.DO YOU HAVE IT?? IF YES THEN SEND ME TO MY EMAIL -

I am newbie with openwrt. I have a xiaomi R4CM and want to put openwrt to it as the original firmaware is unusable for me. I have a usb uart with TX RX pin, I try to begin the flaching following @xTomax method, but, yeah stuck on the first step. I am linux user. so I try to do that with my terminal.
Would you please give a detail step to flash for a beginner?
I search a lot on the web to findout the exact step to follow but it seems that there are a lot of method and I don't know the right one.

Hello. Sorry for the late response. Did you find your how to solve this?

As I recall, after selecting the correct configs on make menuconfig I had no problems flashing openwrt. Are selecting the correct model? the 100Mb one?

Also, why not just install the IPSec package?
Maybe I didn't understand something?

Hello, I didn't found many ways to do this.

As far as I know, you really need a flash reader, something like this:

A complet kit. Open the router, connect the clip alligator to the flash directly and run the firmware to a hexeditor.

the procedure is the same for the Xiaomi 4A.

Basicaly you need to dump the firmware, change the boot time wait in Hex and them reflash the firmware. This way on the serial console you'll see the boot menu and can change the boot to tftp and do the initial boot from there.

Pay attention to the links I've posted. I also was a total beginner and manage to this to this router =)

Hi, Thanks @xTomax for the great updates. I have a simple question about Xiaomi R4CM.
Can I use the official 19.07.2 firmware for the Xiaomi R4AC directly for Xiaomi R4CM? Will it run?
As far as I know, the only difference between these two models is the 5G WiFi chip. Can I just keep the 5G disabled for the R4CM?

Hello There.
I actually haven't try it v19 out. But if you did change the bootloader timer to allow you to boot over tftp, you can try and if don't work, just put back the older version.

But as far as I know I should work. I think I did compile the previous version for this router:, so tou should be fine, ofc you won't have the 5G module, but otherwise should work.

Thanks to the exploit from @acecilia, I successfully root login into the R4CM (Factory firmware version: 2.14.81) and installed the official 19.07.2 firmware for the Xiaomi R4AC without using the SPI flash programmer.
It all works well except the WAN port. It looks like the WAN port (eth0.2?) can't get the IP address from the upstream. BTW, the LAN port and 2.4G WiFi works fine.
Now, the only thing I need is a good working firmware for R4CM :grinning:
@xTomax How did you build the image for the R4CM? What's the patch you used? Any special settings about the WAN port?
I would like to try to build the R4CM image myself.
Thanks a million!


Wow! That's awesome! An exploit is really useful to avoid the SPI Flash procedure (I know the pain I had...).

Regarding the wan port mine is not working at all, the connection is no recognised, I think I messed up when flashing the firmware and flash the whole 4A flash version. After that moment I lost the WAN port, and I think that's something to do with the different DTB file on the flash. At the time I had little knowledge about that and I end up using with 1 port WAN and another LAN ignoring the missing port. I had it working somewhere, for a year now without any problem, witch is nice.
Today and after a few more routers and stuff I kinda understand.

About compiling, just follow the:
go to make menuconfig and select the correspondent options (The version is for the 4A 100mb):

Target System: Mediatek Ralink MIPS
Subtarget: MT76x8 Based Boards
Target Profile: Xiaomi Mi Router 4A 100M edition

With this you should be good to go! but you can include more packages, I for instance like to include at least LUCI, since we have 16Mb of flash we have plenty space to have a nice GUI!

If you need more help just ask I'll try my best :wink:

Haha, I see. We met the same WAN port problem.
I agree with you. The WAN port doesn't recognise the connection at all.
Do you know how to check the DTB file or any setting file related to the WAN port? I am glad to log into the original factory firmware to check it. Let's make a perfect firmware for the R4CM :smiley:

Perfect firmware! Ahahaha! That would be a nice thing for a change! xD

We could always ask someone with the original firmware to give us a copy of it. With that we should be able to flash it and test if the problem persists or not. If not I may be able to manage the firmware change in order to put it functional again with openwrt and the WAN port.

Usually the DBT file inside one of the mtd parts of the flash, it can be place in different places, but shall be arround the same location. I actually don't have mine here. Do you have yours? Can you execute cat /proc/mtd and put the results?

I did execute "cat /proc/mtd" before flashing the OpenWRT into Xiaomi router. The result as following.

Xiaomi R4AC firmware version 2.18.58

root@XiaoQiang:~# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 01000000 00010000 "ALL"
mtd1: 00020000 00010000 "Bootloader"
mtd2: 00010000 00010000 "Config"
mtd3: 00010000 00010000 "Factory"
mtd4: 00010000 00010000 "crash"
mtd5: 00010000 00010000 "cfg_bak"
mtd6: 00100000 00010000 "overlay"
mtd7: 00c60000 00010000 "OS1"
mtd8: 00b00000 00010000 "rootfs"
mtd9: 00240000 00010000 "disk"

Xiaomi R4CM firmware version 2.14.81

root@XiaoQiang:~# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 01000000 00010000 "ALL"
mtd1: 00020000 00010000 "Bootloader"
mtd2: 00010000 00010000 "Config"
mtd3: 00010000 00010000 "Factory"
mtd4: 00010000 00010000 "crash"
mtd5: 00010000 00010000 "cfg_bak"
mtd6: 00100000 00010000 "overlay"
mtd7: 00c60000 00010000 "OS1"
mtd8: 00af0000 00010000 "rootfs"
mtd9: 00200000 00010000 "disk"

As you can see, there are some differences between the mtd8 and mtd9.

As far as I know that would not make a big difference since that is the operative system part (usually call rootfs) or the user space.

I think the big difference is in the mtd2 "config" section witch, if I'm not mistaken, shall have the DTB (hardware configuration of the board). That's why I told you I need a firmware copy of the flash, so I can access it and check the contents.

Hi @Jeffpeng i have same factory firmware as you, trid to install R4AC openwrt firmware, i keep getting verification failed, is there any trick to force it to accept it?

Hi @wzrigui
I guess you are trying to install the R4AC openwrt firmware through the factory firmware upgrade function. It will fail because you can only upgrade to the factory firmware. As I mentioned, you need the exploit to root log into the router first, and then upgrade it to openwrt with command.
And also notice, you will lose the WAN port function of R4CM because there's no perfect OpenWRT firmware for R4CM yet.

This thread work for my Mi Router 4C!!

I tried to flash Mi Nano firmware to Mi router 3C and its WAN port was behaving as LAN1 port and LAN1 as WAN, try to check if some LAN port is now a WAN.

That's great! Can you confirm that both WAN and LAN port works? How about Wi-Fi?
Also, are you using the Mi Nano firmware from the following link?