Xiaomi AX3600 INT firmware

@stangri, The easiest way would be to use the international version of the firmware (3.0.22_INT), a version with ssh was posted a bit earlier on this forum.


FYI, CN 227 firmware dated July, 4 and CN 67 firmware dated July, 7. From released date on note...


1 Like

@stangri, @Ansuel https://www.5v13.com/mesh/26276.html allows permanently adding the required telnet/ ssh and uart enabling variables to the default nvram settings of the ax3600 (by patching bdata), this makes telnet (and uart) access permanent without having to modify the OEM firmwares anymore. Yes, ssh won't work after a factory reset/ or firmware upgrade, but telnet using the serial number derived root password will - and from that you can easily fix /etc/init.d/dropbear to start up again and set your preferred custom root password, overriding the serial derived one (uart, telnet and ssh remain/ become functional that way).


No, no, don't trash the R7800 just yet :wink: I've been following your branch for a while. Just hoping you get a chance to checkout the sirq and reboot issues.

Thanks, flashed that, the Web UI is still in chinese. I'm guessing you can select language when first setting it up, but I didn't find any way to switch language from Web UI, so here's how to do it from CLI:

uci set luci.main.lang='en'; uci commit;

Unfortunately ui for CN fws is Chinese only, and it's a pain to translate it, since ui strings are stored in a bunch of js files alongside with lots of javascript code (see /www/static/js/*.js on the router)

After installing the international firmware and doing a factory reset (obviously you can only do this safely, after modifying bdata to make telnet/ UART access persistent), you can configure the region - this covers UI language, allowed channels and the mi-wifi app region.

The chinese firmware is exclusively chinese.

Sorry for a potentially dumb question, but how do you calculate this "serial number derived root password"? Couldn't figure out from the link you posted.

hehe, I had exactly the same problem and had to search quite a while. There are two scripts (one in php, the other in python) somewhere in ax3600 labelled repos on github (sorry, I'm currently not at home and don't have the links on my phone), alternatively there is https://www.oxygen7.cn/miwifi/


Thanks a lot! Looks like here's the python script:

And here's the php script:


Could you please also share 'AX3600 permanently open teleent-ssh.zip' from the article, which contains crash_unlock.img? Spent last hour+ trying to get myself a Baidu account without a Chinese cell phone in order to download it :unamused:

Xiaomi ax3600 ssh guide There is an alternative location on dropbox.

1 Like

Thanks again! And silly me, this file is also available on the same github repo with the calc_passwd.py script:

UPD: I followed the procedure, and was able to get in after web reset with the calculated password :+1:

Hey.. im planning to follow this guide and enable telnet permanently.. why we need to calculate password ... there is no default password ?

Default password (the one it's reset to during web reset) is calculated based on your router serial number (stored in bdata partition). I assume it's done this way for security's sake. Hence you need to derive it once for each router you have.

Okay and how to run that python script ? im giving bdata.img path as argument and it doesnt work ?

There's a simple mistake in the python script. I issued PR with a fix: https://github.com/odedlaz/ax3600-files/pull/1

Thanks. That worked and also i found this url which does calculation. https://www.oxygen7.cn/miwifi/

and it was present in this url referred in the script. https://www.wutaijie.cn/?p=254

I followed the guide and did everything but now i lost the SSH / Telnet access. What could be the reason ? wifi is working and im on international version

Hey... i followed the guide.. after reset on the INT firmware i lost both SSH and Telnet. Not sure what went wrong. will the permanent thing work only for Chinese version ?