Unbrick Xiaomi mi router 3G

Where the hell do I get the same firmware? :frowning:

Extract it from the ROM of another identical R3G, if you can't find the rom dump online....

Googling hasn't returned any result to suggest anyone has used a spi flash programmer with a R3G, so there will be steep learning curve too.

Imho, it would be far easier to just bin the router and buy a new one!

Are you sure the bootloader has been trashed, and serial TTL connection does not work?

You have not explained in detail how you bricked the R3G?

The serial port works, but not loading the bootloader, I see a completely uninform interface without menu items.

I found a Russian forum. Maybe it will help solve it my problem.

I don't know about the Russian parts it might be about the V1 which has a NAND chip. If you have a V2 it's a NOR chip and that would not apply.

I have the 4A Gigabit version. One problem with Xiaomi is their model names can be ambiguous.

Did you say you get a bunch of text about the memory and the kernel and stuff like that scrolling out of the serial port when you turn it on? That means the bootloader is running, which is a good sign. There is probably no way to stop or interact with it though. If it says "Autobooting in X seconds" where X is not 0, try hitting return at exactly that time.

May be relevant but it refers to Breed bootloader and Pandarox installed and working on R3G.

These files are supposed to work with R3P, but I think they should also work with R3G.


Can you use something like PuTTY and capture all the boot messages from serial TTL connection when you turn on the R3G, and post here? Any bootloader messages will only appear for a split second under normal circumstances.

You failed to mention 'how' you bricked the R3G despite repeated requests.

As suggested by @mk24, the bootloader may be undamaged. Therefore you may not actually need to replace the bootloader etc.

Unless I'm mistaken, I believe all the instructions you found to install a new bootloader and other firmwares, assumes the original Xiaomi bootloader is working to allow TFTP to function, to be able to install the new files!

May be helpful?

Model: Xiaomi Mi Router 3G
Architecture: MediaTek MT7621 ver:1 eco:3

Here's my backup, hope it helps.

I'm not at home right now. I will take a picture of exactly what I see when I connect via serial port. I will upload a picture next week.

Thank you! What kind of backup is this exactly? Is it a serial port? Or what is this file?


It's stock Xiaomi firmware. I think you should write MTD1-Bootloader.bin partition in first 512KB of flash memory or use MTD0-ALL.bin to overwrite all space in the chip and then get back to OpenWRT.

I don't know what to program it with. I found this video. I need to get one of these programming tools.

Just take the backup files and router to someone else to do it for you.
It's not worth to waste your time unless you have the tools already.

If you're getting text out of the serial port, the bootloader should be OK and you probably will not need to use hardware and write directly to flash. But it is still not simple.

I can only write this next week because I'm away from home. It's a national holiday in my country.

I am at home. I tried to turn on the router. When I plug in the power, the lights flash for half a second and then go out.

Whelp, it turns out I had misunderstood the instructions for returning to stock from PandoraBox (I had finally gotten around to this), since it looks like PandoraBox's bootloader prevents mtd from even reading the Bootloader (mtd0) partition.

Now I have a bootlooping router (every few seconds it turns off and then on), unless I press the reset button, in which case the LED glows and fades slowly (in both cases, the color is orange).

Nor is the router even attempting to read miwifi.bin from my flashdrive.

No access via RJ-45, and when I try hooking up a USB-to-TTL converter, I just get an error message that /dev/ttyUSB0 cannot be opened since it does not exist (dmesg tells me that is the console that now exists for the USB-to-TTL converter).

I have tried three so far, a PL2303, a CP210X and a CH341a, all with the same results.

Any ideas?

Does your user account actually have permissions to use the serial-device?

I believe it does, however adding sudo did not really help me.

Using FlashROM with my CH341a requires sudo to actually read and/or write directly to attached chips and since I don't really have any need to run it as a standard user I haven't tried giving my user the necessary permissions to so without adding sudo, so I am well aware of that.

I am using Solus, and the only time I managed to get serial working, was with my Netgear DM200 (unfortunately, it's DSL modem appears to have been fried, so it was replaced with an ISP T&W DSL699U5 (Broadcom chipset) in bridge mode) in between of me putting OpenWrt dev for playing around and putting the stable version for actual production use, however no one else running Solus has had any issues with serial connections when attempting to do so.

The error shown is with picocom, and Putty just does nothing at all.

Update: It turns out that it was not a CH341a (my CH341a needs to be repaired due to a well known issue), but a CH341b, however for all intents and purposes they are precisely the same, since the only difference is that the CH341a requires an external crystal and oscillation capacitor, while the CH341b can either use that or it's built-in clock, and my unit (arrived a few hours ago) is wired up to an external crystal and it's corresponding capacitor (the same exact models as on my CH341a).