Xiaomi ax3600 bricked

For Developers
123

Well, I'm not the Windows guy. But I will try to write it up for Linux. Give me bit time. I will edit in parts.

1.) Download an Ubuntu ISO and put it onto a USB stick and boot into it.

a) Ubuntu ISO: https://ubuntu.com/download/desktop/thank-you?version=22.10&architecture=amd64
b) Tool for writing ISO to USB e. g.: https://www.balena.io/etcher/
c) Reboot your PC into Ubuntu.

2.) Connect your system to the internet (if its not the case already).

3.) Open a terminal with: "CRTL + ATL + T" or by pressing the Windows key typing in "terminal" (without quotes " ")

4.) Install dnsmasq with the following command:

sudo apt update & sudo apt -y install dnsmasq

5.) Download firmware:

mkdir /tmp/tftp
chown -R ubuntu:ubuntu /tmp/tftp
cd /tmp/tftp
wget https://cdn.awsde0-fusion.fds.api.mi-img.com/xiaoqiang/rom/r3600/miwifi_r3600_all_6510e_3.0.22_INT.bin
mv miwifi_r3600_all_6510e_3.0.22_INT.bin C0A81F02.img

6.) Disconnect your PC from internet and connect it into the first lan port of your bricked router. Do not use any other port like wan or lan port 2, 3. Do not power up the unit yet.

7.) Copy and paste the following commands into the shell (block by block):

sudo mv /etc/dnsmasq.conf /etc/dnsmasq.conf.bak
sudo mv /etc/dnsmasq.d/ /etc/dnsmasq.d.bak/
sudo systemctl stop dnsmasq

sudo systemctl stop systemd-resolved
sudo systemctl stop systemd-networkd
sudo systemctl stop NetworkManager
sudo sed -i d /etc/resolv.conf
echo 'nameserver 127.0.0.1' | sudo tee -a /etc/resolv.conf

IPT4="/usr/sbin/iptables"
netdevname=$(ls /sys/class/net | grep enp)

sudo ${IPT4} -I INPUT 1 -m conntrack --ctstate NEW,ESTABLISHED -p tcp --dport 69 -j ACCEPT
sudo ${IPT4} -I INPUT 2 -m conntrack --ctstate NEW,ESTABLISHED -p udp --dport 69 -j ACCEPT
sudo ${IPT4} -I INPUT 3 -m conntrack --ctstate NEW,ESTABLISHED -p udp -m multiport --dport 67:68 -j ACCEPT

sudo ip address flush dev ${netdevname}
sudo ip address add 192.168.31.100/24 dev ${netdevname}
sudo ip link set ${netdevname} up

sudo dnsmasq --no-daemon --listen-address=192.168.31.100 --bind-interfaces --dhcp-range=192.168.31.2,192.168.31.2 --enable-tftp --tftp-root=/tmp/tftp

8.) Follow the usual procedure:

Hold the reset button pressed and plug in the power cable. Keep the reset button pressed until the orange system light starts blinking. You can release the reset button after blinking has started.

Output should look like:

sudo dnsmasq --no-daemon --listen-address=192.168.31.100 --bind-interfaces --dhcp-range=192.168.31.2,192.168.31.2 --enable-tftp --tftp-root=/tmp/tftp
dnsmasq: gestartet, Version 2.87, Zwischenspeichergröße 150
dnsmasq: Optionen bei Übersetzung: IPv6 GNU-getopt DBus no-UBus i18n IDN2 DHCP DHCPv6 no-Lua TFTP conntrack ipset nftset auth cryptohash DNSSEC loop-detect inotify dumpfile
dnsmasq-dhcp: DHCP, IP-Bereich 192.168.31.2 -- 192.168.31.2, Leasezeit 1h
dnsmasq-tftp: TFTP Wurzel ist /tmp/tftp
dnsmasq: lese /etc/resolv.conf
dnsmasq: Benutze Namensserver 127.0.0.1#53
dnsmasq: /etc/hosts gelesen - 10 Adressen
dnsmasq-dhcp: DHCPDISCOVER(eth0) 02:68:b3:29:da:98
dnsmasq-dhcp: DHCPOFFER(eth0) 192.168.31.2 02:68:b3:29:da:98
dnsmasq-dhcp: DHCPREQUEST(eth0) 192.168.31.2 02:68:b3:29:da:98
dnsmasq-dhcp: DHCPACK(eth0) 192.168.31.2 02:68:b3:29:da:98
dnsmasq-tftp: /tmp/atftp/C0A81F02.img an 192.168.31.2 verschickt

9.) Wait until the system light starts blinking blue. Now you can remove the power plug and restart the router.

EDIT: Reorganized. Now final.

1 Like