Xiaomi AX3600 INT firmware

If You are planningg to spend $90 just spend $2 more, just to be sure, and LLC might come in handy in future

guys you must know if flash int firmware wifi strength signal will not decrease confirmed info from 4pda wifi signal strength is powered by software not hardware global vs chinese version


@Frifox That was expected since European legislation regulates the maximum of radiation outputted by the devices. The extra signal strength might me a reason to stick with the Chinese firmware, mainly for the 5Ghz. But when available and if it can be flashed by INT firmware each can perform an evaluation, for smaller houses might not be such a problem (and it’s healthier too).

@Ansuel: if you have FT232RL chip it's best to buy TXS0108E module 8 Channel bidirectional LLC converter (for about 1€) , then you can safely use your old hardware and have serial for 1.8V

Has anybody observed significant amount of retries while connected over 5G WiFi? I am wondering whether this is 'feature' of my device or something general.
Firmware 1.0.67
Tested with iperf3 between WiFi client and Ethernet client.
Same test Ethernet to Ethernet has 0 retries.
Verified with plain Xiaomi image with the following settings for 5G WiFi:

  • AX3600 in wired bridge mode
  • other radios disabled
  • pure WiFi 6 (no compatibility mode)
  • pure WPA3
  • channel auto
  • 160/80/40/20 MHz


wifi :: ~ » iperf3 -c copper
Connecting to host copper, port 5201
[  5] local port 58718 connected to port 5201
[ ID] Interval           Transfer     Bitrate         Retr  Cwnd
[  5]   0.00-1.00   sec  65.5 MBytes   550 Mbits/sec    0   1.34 MBytes       
[  5]   1.00-2.00   sec  96.2 MBytes   807 Mbits/sec  245   1.53 MBytes       
[  5]   2.00-3.00   sec   108 MBytes   902 Mbits/sec    0   1.63 MBytes       
[  5]   3.00-4.00   sec   105 MBytes   881 Mbits/sec    0   1.71 MBytes       
[  5]   4.00-5.00   sec   105 MBytes   881 Mbits/sec   39   1.27 MBytes       
[  5]   5.00-6.00   sec   100 MBytes   839 Mbits/sec    0   1.34 MBytes       
[  5]   6.00-7.00   sec   101 MBytes   849 Mbits/sec    0   1.39 MBytes       
[  5]   7.00-8.00   sec   101 MBytes   849 Mbits/sec    0   1.43 MBytes       
[  5]   8.00-9.00   sec  93.8 MBytes   787 Mbits/sec    0   1.46 MBytes       
[  5]   9.00-10.00  sec   102 MBytes   860 Mbits/sec    0   1.51 MBytes       
- - - - - - - - - - - - - - - - - - - - - - - - -
[ ID] Interval           Transfer     Bitrate         Retr
[  5]   0.00-10.00  sec   978 MBytes   820 Mbits/sec  284             sender
[  5]   0.00-10.01  sec   977 MBytes   818 Mbits/sec                  receiver

iperf Done.

Edit: Looks like visible only with 160MHz bandwidth or high troughput (ax200 card). With other card connected with 80MHz there are below 20 retries per 5 GBytes of transferred data.

returning back to the beggining of the thread...
I tried to use this link in order to find the firmware from the CDN

the good news is I've managed to understand how to calculate the s= field and I get in return 200 (OK) responses for my requests.

the bad news is that even if I do this request to "previous" version (3.0.15 on earlier) it doesn't seem to return 3.0.16 firmware as an upgrade.

it is important to mention that I used the same technique from the chinese CDN and I managed to get 1.0.67 link, so it seems that the problem is that 3.0.16 doesn't exist at all in the CDN.

I am pasting the script here if someone wants to take a look. I hope that it'll work on the future when a new INT firmware will be released.

import requests
import datetime
import base64
import hashlib

DEFAULT_TOKEN = "8007236f-a2d6-4847-ac83-c49395ad6d65"
LINK = 'http://sg.api.miwifi.com/rs/grayupgrade'

def md5_base64(data):
	b64_data = base64.b64encode(data.encode())
	return hashlib.md5(b64_data).hexdigest()

def calculate_s(params_to_hash):
	params_sorted = {k: v for k, v in sorted(params_to_hash.items(), key=lambda item: item[0])} 

	params_str = ''
	for k, v in params_sorted.items():
		params_str += f'{k}={v}&'
	params_str += DEFAULT_TOKEN
	result = md5_base64(params_str)
	return result

def main():
	now = datetime.datetime.now()

	params_to_hash = {
		"countryCode": 'EU',
		"rom": '3.0.16',
		"serialNumber": 'my_serial_number',
		"rootfs": '0.0.1',
		"cfe": '1.0.2',
		"deviceID": 'my_device_id',
		"ispCode": '',
		"linux": '4.4.16',
		"sqafs": '0.0.1',
		"hardware": 'R3600',
		"locale": 'en_US',
		"ramfs": '0.0.1',
		"channel": 'release',
		'time': now.strftime('%Y-%m-%d---%H:%M:%S')

	params_to_hash['s'] = calculate_s(params_to_hash)
	params_to_hash['token'] = DEFAULT_TOKEN	

	response = requests.get(LINK, params=params_to_hash)
	if response.ok:
		print("invalid token")

if __name__ == '__main__':

it worked :slight_smile: as kokesan mentions the new INT link according to the API:



From Russian Telegram forum

Thanks Ivan Kozub


:grinning: Many thanks for this great link...

Do you know anything about the compatibility of the international firmware on the chinese device?

The xqrepack script runs fine so far, I'm grepping throught the extracted rootfs for now...

Anyway I think that i will wait till 11/11 to check for discount... If someone wants to donate, I'm more than happy to accept that since i will use that money for the router 100%.


I read in 4pda that someone with INT firmware has managed to change back to chinese 1.0.17 so according to this information I assume that it'll probably work the other way around

It´s possible but i wait. because don´t want brick my router.

1 Like

So we can assume that a lock between version is absent and the bootloader accept everything... NICE!

1 Like

Hi Ansuel, how can i donate to you?


I did update my "Chinese" router to INT firmware 3.0.22 without reset and it works ok :slight_smile:


via webUI?

any differences between versions?

no as i can see

1 Like

Does the bdata based ssh/ telnet access remain (I'd assume so, just to be sure)?

I'm not quite enough understand what you are talking about.
I was able to get syslog on 3.0.22


This Xiaomi ax3600 ssh guide claims to add presistent telnet/ ssh/ uart access to the device, by changing the nvram defaults hardcoded in the bdata partition. This procedure has been confirmed by multiple users for the chinese firmware, given the way it is implemented I'd assume it would also work on the international variant, but obviously that's not guaranteed (but given that it seems to be possible to change between both variants at will, this shouldn't be that much of an issue).

Sorry but I did not do it.
Though I did downgrade to 1.0.17 a few days ago and got ssh access but I lost it after upgrade back to 1.0.67.
And today I just upgraded to 3.0.22.

1 Like