Xiaomi Mi Router 4A Gigabit Edition (R4AG/R4A Gigabit) -- fully supported and flashable with OpenWRTInvasion

lessload · June 3, 2020, 10:26am

@Zorro Your patch use close source ? why you not release it on github or etc.

like https://github.com/Byte-bite/OpenWRT-19.07.3-Stable-MI4A-Gigabit

.
as i test @Zorro build wifi performance speed better than @Byte (Byte-bite) build

( 300Mbps vs 200Mbps DL )

codecex · June 4, 2020, 12:31pm

When im trying to execute 0.start_main it says:

Traceback (most recent call last):
  File "main.py", line 10, in <module>
    line4 = subprocess.check_output(["cmd","/c","chcp","437","&","tracert","-d","-h","1","1.1.1.1"]).decode().split("\r\n")[4].strip().split(" ")
UnicodeDecodeError: 'utf-8' codec can't decode byte 0xa0 in position 1: invalid start byte

rRs5UPifa · June 4, 2020, 4:44pm

Your patch use close source ? why you not release it on github or etc.

Good question. @Zorro, can you do that?

Zorro · June 4, 2020, 10:06pm

Maybe this can help you ...

testomat · June 5, 2020, 10:34pm

i flashed zorros firmware.everything so far ok.but i cannot log in with root and no password. can i reset it ? I flashed firmware again, but same problem.

Zorro · June 6, 2020, 12:09pm

openwrt installation guide for windows :

https://anonfiles.com/Pez3e63ao0/openwrt-19.07.3-ramips-mt7621-xiaomi_mir3g-v2-squashfs-sysupgrade_bin

1)pip3 install -r requirements.txt

2)python remote_command_execution_vulnerability.py

3)cd /tmp

4)./busybox sha256sum openwrt-19.07.3-ramips-mt7621-xiaomi_mir3g-v2-squashfs-sysupgrade.bin

5)mtd -e OS1 -r write openwrt-19.07.3-ramips-mt7621-xiaomi_mir3g-v2-squashfs-sysupgrade.bin OS1

https://anonfiles.com/R8yee651o9/windows_openwrt_installation_guide_mp4

acecilia · June 6, 2020, 3:32pm

Hi guys and girls Any idea why the router did not get stable support when OpenWrt 19.07.03 was released?

Also, I updated the readme of the OpenWRTInvasion repo with a new openWrt prebuilt image

slh · June 6, 2020, 7:54pm

Support for your device was merged to master at the end of october 2019

github.com/openwrt/openwrt

ramips: add support for Xiaomi Mi Wi-Fi Router 3G v2

committed 11:25AM - 27 Oct 19 UTC

paulfertser

+166 -1

- CMIIT ID: 2019AP2581 - SoC: MediaTek MT7621 - Flash: 16MiB NOR SPI (Gi…gaDevice GD25Q128B) - RAM: 128MiB DDR3 (ESMT M15T1G1664A) - Serial: As marked on PCB, 3V3 logic, baudrate is 115200, 8n1 - Ethernet: 3x 10/100/1000 Mbps (switched, 2xLAN + WAN) - WIFI0: MT7603E 2.4GHz 802.11b/g/n - WIFI1: MT7612E 5GHz 802.11ac - Antennas: 4x external (2 per radio), non-detachable - LEDs: Programmable "power" LED (two-coloured, yellow/blue) Non-programmable "internet" LED (shows WAN activity) - Buttons: Reset INSTALLATION: Bootloader won't accept any serial input unless "boot_wait" u-boot environment variable is changed to "on". Vendor firmware (looks like an illegal OpenWrt fork) won't accept any serial input unless "uart_en" is set to "1". Tricks to force u-boot to use default environment do not help as it's restricted in the same way. With bootloader unlocked the easiest way would be to TFTP the sysupgrade image or to sysupgrade after loading an initramfs one. For porting the flash contents were changed externally with an SPI programmer (after lifting Vcc flash IC pin away from the PCB). Forum thread [0] indicates that this device is identical to "Xiaomi Mi Router 4A Gigabit Edition". [0] https://forum.openwrt.org/t/xiaomi-mi-router-4a-gigabit-edition-r4ag-r4a-gigabit-fully-supported-but-requires-overwriting-spi-flash-with-programmer/36685 Signed-off-by: Paul Fertser <fercerpav@gmail.com>

while openwrt-19.07 branched off master in the middle of may 2019, almost half a year before your device had been added.

openwrt-19.07 is a stable maintenance branch, it gets bugfixes, but not new features/ device additions, you'll have to wait until the release of 20.x.0 for that.

Zorro · June 7, 2020, 4:23am

http://cdn.cnbj1.fds.api.mi-img.com

http://bigota.miwifi.com/xiaoqiang/rom/r4ac/miwifi_r4ac_firmware_e9eec_2.18.58.bin
new link to download :
http://cdn.cnbj1.fds.api.mi-img.com/xiaoqiang/rom/r4ac/miwifi_r4ac_firmware_e9eec_2.18.58.bin

hoddy · June 7, 2020, 8:04am

Try pressing Ctrl+F5 or opening in a private browsing tab.

testomat · June 7, 2020, 10:10am

Suddenly it worked. I tried several times to log in with root and no pwd. Now I'm logged in. Is it possible to switch to another luci theme? How I do it? Luci is with release 19.07.3 in my Opinion slower than the old theme.

UgaBugaBoo · June 7, 2020, 10:25am

Here is the iperf test of Zoros Build (OpenWrt SNAPSHOT r12138-1e3bfbafd3 / LuCI Master git-20.064.26720-acef567).

iperf Server is Hosted on Router and tested with a 5Ghz NIC on Laptop

UgaBugaBoo · June 7, 2020, 10:28am

and here is the iperf test on a 2.4Ghz

hoddy · June 7, 2020, 12:01pm

Yes, you can download more by seaching in software for theme's then swap the theme here:

Just a note, this is probably not a queston for this device specific forum.

filipedbc · June 10, 2020, 11:12am

Greetings,
been a happy owner of the 100M version, I bought the Gigabit version. I'm using the build from @Zorro (thank you for your build ) , however I'm noticing that the range from the 5G wireless is too weak. Everything else is ok and stable. Anybody with the same issue?

Thank you

hoddy · June 10, 2020, 5:51pm

The proprietory drivers in the stock firmware are a bit more polished I think. It's worth checking you have the transmit power as high as you can for your region and it may help to change your channel and width I found. Also setting the Distance Optimization may help.
But yeah I've found the wirless range to be slightly less.

filipedbc · June 10, 2020, 7:28pm

Installed the last snapshot (r13527-61307544d1) and now I got 200mb on ethernet cable instead of 1GB
The link is established as 1Gbps

jinglei207 · June 10, 2020, 8:51pm

But why is it still in chinese?

hoddy · June 10, 2020, 9:50pm

The latest versions are unstable currently, I can't tell you exactly what versions are good and bad for now but I'm running r11063-85e04e9f46 by Zorro that works well, otherwise you can compile your own version from:

gleber · June 11, 2020, 10:04am

I am trying to use OpenWRTInvasion with my Xiaomi Mi Router 4A Gigabit Edition with - what it seems to be - a global English firmware 2.28.132. It is set as wired repeater with an cable inserted into one of the LAN ports. The router is getting an IP from a DHCP server. The exploit does not work and - after adding some debugging lines - I am getting the following response text:

{"code":401,"msg":"Invalid token"}

The full output with headers, urls, etc. is below:

gleber@ubuntu-vm:~/code/OpenWRTInvasion$ python3 remote_command_execution_vulnerability.py
Router IP address: 192.168.1.168
stok: 0150712eac08a29b11fe4dd8c591c335
****************
router_ip_address: 192.168.1.168
stok: 0150712eac08a29b11fe4dd8c591c335
****************
start uploading config file...
http://192.168.1.168/cgi-bin/luci/;stok=0150712eac08a29b11fe4dd8c591c335/api/misystem/c_upload
<Response [200]>
{"code":401,"msg":"Invalid token"}
start exec command...
{"code":401,"msg":"Invalid token"}
done! Now you can connect to the router using telnet (user: root, password: none)
In MacOS, execute in the terminal:
telnet 192.168.1.168
gleber@ubuntu-vm:~/code/OpenWRTInvasion$ less remote_command_execution_vulnerability.py
gleber@ubuntu-vm:~/code/OpenWRTInvasion$ python3 remote_command_execution_vulnerability.py^C
gleber@ubuntu-vm:~/code/OpenWRTInvasion$ zile remote_command_execution_vulnerability.py
gleber@ubuntu-vm:~/code/OpenWRTInvasion$ python3 remote_command_execution_vulnerability.py
Router IP address: 192.168.1.168
stok: 0150712eac08a29b11fe4dd8c591c335
****************
router_ip_address: 192.168.1.168
stok: 0150712eac08a29b11fe4dd8c591c335
****************
start uploading config file...
http://192.168.1.168/cgi-bin/luci/;stok=0150712eac08a29b11fe4dd8c591c335/api/misystem/c_upload
<Response [200]>
http://192.168.1.168/cgi-bin/luci/;stok=0150712eac08a29b11fe4dd8c591c335/api/misystem/c_upload
200
{'Server': 'nginx', 'Date': 'Thu, 11 Jun 2020 10:02:04 GMT', 'Content-Type': 'text/html; charset=utf-8', 'Transfer-Encoding': 'chunked', 'Connection': 'close', 'Cache-Control': 'no-cache', 'Expires': 'Thu, 01 Jan 1970 00:00:01 GMT', 'MiCGI-Switch': '1 1', 'MiCGI-Client-Ip': '192.168.1.170', 'MiCGI-Host': '192.168.1.168', 'MiCGI-Http-Host': '192.168.1.168', 'MiCGI-Server-Ip': '192.168.1.168', 'MiCGI-Server-Port': '80', 'MiCGI-Status': 'CGI', 'MiCGI-Preload': 'no'}
[]
{"code":401,"msg":"Invalid token"}
start exec command...
{"code":401,"msg":"Invalid token"}
done! Now you can connect to the router using telnet (user: root, password: none)
In MacOS, execute in the terminal:
telnet 192.168.1.168

The telnet port is closed after attempting the exploit.

Is this the right place to ask for help? Any ideas what else I could try?