Xiaomi 3G (MIR3G) - Breed bootloader - Configure Dual boot OpenWrt / PandoraBox / Padvan


I own an Xiaomi MIR3G -and i have installed "Breed boot-loader". Actually the documentation is very poor on this boot loader but i have understood that i can dual boot flashing 2 firmware.

I would like to install as:

  • Primary Boot - OpenWrt 18.06.1 (as is evolving the most)
  • Secondary Boot - Newer vesrion of OpenWrt or PandoraBox or Padvan just for testing

Now, i was able to install them as in the breed web interface you have to choose in which partition 1 or 2 you want to install the firmware but i have no clue how to switch from one to the other and if that configuration is actually possible.


1 Like

You gotta change the boot address var to match either kernel 1/2.

See below.

I found this:

Option 6 in menu "Firmware startup settings" (
-> Click "Add Entry"
first field = autoboot.command
second field = boot flash 0x600000


  1. boot flash 0x600000 will boot Firmware 1 or Firmware 2 ? How do i calculate the value?

  2. what must i specify for the other firmware ?

  3. i tried to flash OpenWrt in the Firmware 2 but i chose the sysupgrade.tar which is not supported. How do i build a .bin for flashing OpenWrt to Firmware 2 ?

  4. I have at the moment PandoraBox in Firmware 1. I want to add Padvan or OpenWRt as Firmware 2. Can i flash Padavan directly in BREED ?

Just doing this to be agile in switching firmware to test WIFI performance.



Hello Attaros,
I found this thread because I flashed my Xiaomi 3g router with Openwrt LEDE and LuCI. After experiencing wifi problems, I installed Breed bootloader for flashing Padavan or Pandora. But since i flashed this bootloader, impossible to install any firmware. I can enter in Breed bootloader, I can flash padavan or Openwrt, the installation progression goes till 100%. When I reboot nothing happend as I have not flashed anything.
I have no access to ssh but only to Telnet. How did you managed to fix your router as you had the same issue.
Thanks for your help.

Hello Testeur. Try to restore stock (Chinese) firmware:

  1. download developers firmware: www1.miwifi.com/miwifi_download.html → ROM → ROM for R3G 开发版 (you need ROM for R3G 开发版 not ROM for R3G 稳定版)

  2. Boot to BREED, and remove all custom env variables from menu item 6 (from top, beetwen menu item "chinesesymbols R3G" and "R3G Bdata")

  3. Flash firmware to SECOND partition without reboot (uncheck "Reboot" checkbox)

  4. Flash firmware to FIRST partition with reboot

After reboot, go to and you should see default Chinese interface.

Now. you can flash Padavan. Boot to BREED again.

  1. create env variable

  2. Flash Padavan to SECOND partition without reboot

  3. Flash Padavan to FIRST partition with reboot


Hi. I have face problem like @Testeur, do all step like you do: Flash developement rom, boot ok, router boot to xiaomi firmware
I flash padavan again, but now all lan ports are no connect. How i can connect to ssh after breed to restore mtd to bootloader? tks.

Good, at least the router is not bricked.

I don't think the problem is in the Breed. You even can flash Padavan from stock without Breed.
Maybe this Padavan build is not for 3G? How you obtain it?

You want to restore original bootloader? This is easy if you create mtd backup BEFORE flashing BREED.

Tks for your reply.
Seen like that i flash firmware to a wrong partition(1 and 2)
Now my router can only run stock firmware correcly.
All lan port will not work if i flash padavan or oprnwrt or pandorabox
I want to restore like out of box but breed still there. How i can restore stock bootloader and quit of breed? Breed only acept telnet.
I want to restore via failsafe but when i press reset after power on, it boot to breed
Wait your helps. Tks you

No matter. Router can boot from any partition (autoboot.command points Breed to boot partition). For example, I always flash Padavan to both partitions.

Hmmm... maybe you just have wrong crimped cable? I met reviews that alternative firmware does not work with cables crimped crossover. Only straight will work.

If you don't have backup, created BEFORE Breed flashing, you cannot restore stock bootloader. But you can ask someone to share mtd1 partition backup. mtd1 on stock firmware = bootloader

This is mtd1 from my backup (from stock firmware)

CRC-32: 2edbfadc
MD5: efdd4d3fe0a5876243ac5a0e990134e4
you can flash this via Breed (to Bootloader partition)
or from stock firmware via mtd write /tmp/mtdblock1.bin Bootloader (issued in SSH consiole)

1 Like

Tks very much. I will try to restore bootloader. I have straight cables. Again, tks you. :slight_smile:

How can I flash stock to one partition (to flash OpenWRT) and Padavan to another? The goal is to have a dual boot system: 1. Padavan 2. OpenWRT. And how do I select which system will be started?

How can I flash stock to one partition (to flash OpenWRT) and Padavan to another?

From Breed bootloader

And how do I select which system will be started?

From Breed bootloader.

0x200000 = partition 1
0x600000 = partition 2

But if you boot to Padavan, you loose stock settings and and vice versa - if you boot into Padavan and reboot to stock, all Padavan settings will be wiped.


Cool!!! - Thanks a lot!

Hi, can I know how to install Breed on Mi Wifi 3G?

From stock firmware?

  1. obtain SSH access. You can use graphical instruction from rOOter firmware (look at xiaomi.pdf inside archive)
  2. instead of flashing rOOter firmware flash Breed
  • download Breed
    wget --no-check-certificate https://breed.hackpascal.net/breed-mt7621-xiaomi-r3g.bin -O /tmp/breed-mt7621-xiaomi-r3g.bin

  • Important! check MD5 sum and compare to https://breed.hackpascal.net/md5sum.txt
    md5sum /tmp/breed-mt7621-xiaomi-r3g.bin
    if MD5 mismatch - do not flash (maybe file is broken, etc)

  • flash Breed
    mtd write /tmp/breed-mt7621-xiaomi-r3g.bin Bootloader

  • unplug power cable, hold reset button on back side, plug power cable. After the blue LED flashes, release the button and go to the

Did anyone manage to get the stable builds to run on breed? I wasn't able to get it booting and via serial found it stopped after "init done" and then the router would go dead (temp) and had to turn off & back on again, tried to flash a merged kernel1+rootfs0 image from 4pda forums, only for it to result in erasing the default MAC addresses.
Now luckily had a backup of all MTD partitions from OpenWRT before I installed breed so got the bootloader back, but still can't get OpenWRT installed, resulting in the same error. I'd like to restore all the MTD partitions but I thought to ask for a method before trying it and maybe corrupting the u-boot itself.

I can either-

  1. Install breed, make a combined binary image from the backups and do full firmware flash via it such that breed won't install itself again, but the normal u-boot will be overwritten and if it fails then basically a near dead router unless soldering stuff, with SPI boot to try. another issue is how to combine the binary backups I have to a single image? I could try to make a new script from the merged binary script from 4pda, but I'd like assurance since it'll be the first try.
  2. Using the u-boot that is present now, restore all the partitions back. Not sure if I can via tftp or Kermit uart commands and how to flash it. I'll need full flash over read-only partitions as well since my MAC is gone & only there via backup.
  3. Using breed again but to first flash the other partitions if uboot doesn't allow a flash of read-only partitions, then restore the uboot and reboot.

Get OpenWRT (snapshots?) to work/flash from breed and boot to connect. Then use breed to restore the MAC backups.

Restore to stock dev Xiaomi firmware with breed; get ssh access and dowload openwrt firmware to usb.
flash by these command:
mtd write / extdisks /sda1 /mir3g-squashfs-kernel1.bin kernel1
mtd write /extdisks/sda1/mir3g-squashfs-rootfs0.bin rootfs0
mtd of erase kernel0

Dont use command on openwrt homepage after install breed, it will not work

Did that in past but didn't work. Might've not done properly.
So flash the xiaomi dev on first partition 2 then partition 1 via breed, then boot normally and use mtd right?
I may have found the MAC i had by bdata & config backup i had using hex editor. So maybe that won't be needed to flash & can just set values by breed.

Also what do u mean by command won't work? The UART connection or the SSH? If it won't then what about snapshots cuz they require terminal & "opkg depends" & "opkg whatdepends" type commands won't be able to be used

Restore to stock and upgrade to Openwrt like instruction this page: https://telegra.ph/Xiaomi-Router-3G-proshivka-LEDE-11-23
It work for me.