Xiaomi AX3600 DTS

Good news: secure boot is not enabled

credit lizhiping LonGDikE Gaojianli
need ttl log (teardown)
https://drive.google.com/drive/folders/191LUrd6LEEYbq4-F3ZbAJky066Qr_8S3?usp=sharing
SSH Xiaomi’s upcoming AX3600 Wi-Fi 6 router is based on Qualcomm’s enterprise grade networking platform

6 Likes

Enable TX input nvram set uart_en=1
TTL 1.8V

3 Likes

I thought TX didn't work on AX3600, does it work for you? Someone said that there might be some missing resistors.

Also, can I ask, why didnt your use pins ? and just soldered the wires in?

Anyway, great job, as soon as I get my replacement router I'll open up my ax3600 too.

Sorry, it's not mine.

Need your help.

TX Locked
SSH unlock command nvram set uart_en=1

1 Like

uboot bootlog
https://paste.ubuntu.com/p/mTDDYVYtcm/
thanks acwifi(teardown)
no secure boot

3 Likes

What do you want to say with that link?

The very same ipq807x target support has been in OpenWrt for longer than that, just with correct authorship attribution.

While that's a start, it's still far away from being complete or supporting any particular device.

1 Like

Thank you everyone and zhiping! Soon...

ssh command:
nvram set uart_en=1
nvram set boot_wait=on
nvram commit
now, autoboot stop is available and TX is available

1 Like

Misty patch uboot to factory mode
Now, mibib and sbl1 are unlocked

4 Likes

Is there anyway to patch their latest firmware (1.0.50) to allow ssh access?

Edit /etc/udhcpc.user add
sed -i 's/channel=.*/channel=\"debug\"/g' /etc/init.d/dropbear
Upgrade system
Login web save any network settings

1 Like

@AlexSian - did you manage to get this working? I've tried a few things and just this change doesn't seem to be opening SSH on 1.0.50. I'll keep trying.

All confirmed the above works. However, no changes to the web interface worked as I didn't have the WAN port plugged in (to prevent this router from phoning home with the plethoria of data it seems upload to Xiaomi). Merely by plugging in my laptop into the WAN port for a moment and then switching back to LAN1 was enough to trigger this script and active the changes.

1 Like

How is the value of R19 resitor? I lost it so my router can not TTL anymore, please help me!