Support for Xiaomi Router AC1200 (RB02)

For Developers
2

Seems weird that a firmware image with 25/11/2021 build date would have that vulnerability still.

It's a different model, it would be a bigger problem if it did accept it.

The EU update servers don't have a firmware image for this device yet.

Nothing that you could use to flash, since they only use signed images.

All in all, should be fairly simple for someone to port, but it's risky since there's no stock image to restore to. Users would have to backup the stock firmware first.

Additionally, some Xiaomi units are shipping with some less-common SPI-NOR chips of late. Not much of an issue once identified, but can stop images from booting. Can we see a boot log?

3

Thanks for your reply.

Here is:
https://gist.githubusercontent.com/baconbao/11f8ffd7c21dfe0570b9186e6dbdee9f/raw/26533cbd51172c5468fcea7aa5f94c3ccdca6800/xaiomi-router-ac1200_rb02_bootlog.log
(The default mac addresses have been replaced as 00:11:22:33:44:**)

Other info:

root@XiaoQiang:~# cat /etc/openwrt_release
DISTRIB_ID='OpenWrt'
DISTRIB_RELEASE='18.06-SNAPSHOT'
DISTRIB_REVISION='unknown'
DISTRIB_TARGET='ramips/mt7621'
DISTRIB_ARCH='mipsel_24kc'
DISTRIB_DESCRIPTION='OpenWrt 18.06-SNAPSHOT unknown'
DISTRIB_TAINTS='no-all busybox'

root@XiaoQiang:~# df -h
Filesystem                Size      Used Available Use% Mounted on
/dev/root                12.5M     12.5M         0 100% /
devtmpfs                512.0K         0    512.0K   0% /dev
tmpfs                    60.5M         0     60.5M   0% /sys/fs/cgroup
tmpfs                    60.5M    648.0K     59.9M   1% /tmp
/dev/mtdblock7            1.0M    768.0K    256.0K  75% /data
/dev/mtdblock7            1.0M    768.0K    256.0K  75% /etc
tmpfs                   512.0K         0    512.0K   0% /dev
1 Like
4

RB02 = INT fw version (Global)
R4AV2 = CN fw version

For this router, they began to produce firmware in HDR2 format.
File xiaoqiang_version:

config core 'version'
	# ROM ver
	option ROM '2.30.20'
	# channel
	option CHANNEL 'release'
	# hardware platform R1AC or R1N etc.
	option HARDWARE 'R4AV2'
	# CFE ver
	option UBOOT '1.0.2'
	# Linux Kernel ver
	option LINUX '0.0.1'
	# RAMFS ver
	option RAMFS '0.0.1'
	# SQUASHFS ver
	option SQAFS '0.0.1'
	# ROOTFS ver
	option ROOTFS '0.0.1'
  #build time
  option BUILDTIME 'Tue, 22 Feb 2022 07:02:09 +0000'
  #build timestamp
  option BUILDTS '1645513329'
  #build git tag
   option GTAG 'commit a1bd4e74fb6a75ebeb039e33d8465bcbf2e9378d'

File openwrt.config:

CONFIG_TARGET_ramips_mt7621_R4AV2=y
CONFIG_TARGET_PROFILE="R4AV2"
CONFIG_R4AV2=y
CONFIG_SQUASHFS_XZ=y
CONFIG_XQVER=2
CONFIG_XQ_BOARD="R4AV2"

Function setConfigIotDev not fixed!!!

1 Like
5

Are you sure that the RB02 firmware contains the dropbear utility?

6

It seems to work.

20221005004451
20221005004451971×246 7.62 KB

7

Hi, it seems that the Xiaomi 4A Gigabit V2 (R4AGV2) uses the same hardware with RB02. I compiled a firmware for R4AGV2, and everything works fine except the leds.

3 Likes
8

hello! I managed to get telnet access to R4AV2 without a chip programmer (it lacks dropbear in the firmware)

Here's a link to my GitHub comment: https://github.com/acecilia/OpenWRTInvasion/issues/141#issuecomment-1296033775

I decided to post it here, as the Wiki page for Xiaomi 4A Gigabit v2 links to this thread.

2 Likes
9

@baconbao could you please upload stock firmware (or fulldump) for the rb02?

10

Could you share the firmware you used or instructions to compile this version and the exploit you used to flash it?

11

Try patch from that repository:

1 Like
12

Thank you a lot! After some time learning everything, I was finally able to compile the image (which took much longer than I expected) and get the exploit working (it took some time before I realized I had to disable the Windows firewall, lol).

But the problem now is flashing. Is the final command still this?
mtd -e OS1 -r write firmware.bin OS1

When I run it, the router hangs with the power led orange indefinitely (over 20 minutes at least). I even tried flashing the official 2.30.25 firmware, which I used to recover from brick, with no success, it behaves the same way as when I flash a firmware I compiled.

I also tried flashing another pre-compiled version for this router I found ( https://github.com/acecilia/OpenWRTInvasion/pull/155#issuecomment-1313042473 ), and with this firmware the behavior is different, the orange light slowly blinks after some minutes.

What am I doing wrong? Could I have ended up with an even different router?

13

OK, after some more trying I successfully got it working. Thank you all!

1 Like
14

I have the same problem.
How did you do fix it?

15

I eventually got a working firmware. I think it was this one (just uploaded), but I'm not sure. Got it by compiling myself, I guess.

1 Like
16

You have the source code of this firmware?

17

@Ser9ei posted the link:

18

Guys, there is my patch for r4av2/rb02

This patch inlclude correct code for the leds

3 Likes
19

Hi guys i just bought a router and want to use it only with openwrt i find now xiaomi is providing a v2 which may or maynot be supported but there is no way i can tell what version it comes with what is the status how can i flash i it comes with RB02 or R4AV2 i think you guys can tell me a proper answer thanks.

Screenshot_20230214-135753~2
Screenshot_20230214-135753~21069×1051 70.1 KB

I have some time left for delivery so i need urgent help. What is the status. I am in india right now hopefully i get a global variant.

Need information asap.
I think exploit has also been patched for v2 https://github.com/acecilia/OpenWRTInvasion/pull/155#issuecomment-1313042473
But still have doubts about.

20

I've used this patch in the latest version of WRT with some config file that I find and optimizing it for my prefrences and it works fine without any problems.
Even the LEDs are working fine.
Thank you very much!

21

Hi. I'm hoping someone can help me with this. I spent almost an entire day reading and learning about this. Finally got Docker going and then ssh fails. I then realised I had V2 and found this page.

I have the openwrt bin file from TaiKe's page. I have completed the step to enable SSH but then when I go the Docker route. It is still failing to connect.

Any advice or maybe baby steps to do this? Or should I be learning Ubuntu on VM instead of trying Docker? Thank you