ok, try this - https://gitlab.com/db260179/xiaomi-m4a/-/tree/stable/docker/tftpboot
the test.bin to your dnsmasq method
let me know what result you get
nope, didn't like that image 
===================================================================
MT7621 stage1 code Oct 28 2018 20:39:32 (ASIC)
CPU=500000000 HZ BUS=166666666 HZ
==================================================================
Change MPLL source from XTAL to CR...
do MEMPLL setting..
MEMPLL Config : 0x11100000
3PLL mode + External loopback
=== XTAL-40Mhz === DDR-1200Mhz ===
PLL3 FB_DL: 0x9, 1/0 = 637/387 25000000
PLL4 FB_DL: 0xe, 1/0 = 594/430 39000000
PLL2 FB_DL: 0xf, 1/0 = 584/440 3D000000
do DDR setting..[01F40000]
Apply DDR3 Setting...(use customer AC)
0 8 16 24 32 40 48 56 64 72 80 88 96 104 112 120
--------------------------------------------------------------------------------
0000:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0001:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0002:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0003:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0004:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0005:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0006:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0007:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0008:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0009:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
000A:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
000B:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
000C:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
000D:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1
000E:| 0 0 0 0 0 0 0 0 0 1 1 1 1 1 1 1
000F:| 0 0 0 1 1 1 1 1 1 1 1 1 1 1 0 0
0010:| 1 1 1 1 1 1 1 1 0 0 0 0 0 0 0 0
0011:| 1 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0
0012:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0013:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0014:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0015:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0016:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0017:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0018:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0019:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
001A:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
001B:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
001C:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
001D:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
001E:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
001F:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
DRAMC_DQSCTL1[0e0]=13000000
DRAMC_DQSGCTL[124]=80000033
rank 0 coarse = 15
rank 0 fine = 64
B:| 0 0 0 0 0 0 0 1 1 1 0 0 0 0 0 0
opt_dle value:8
DRAMC_DDR2CTL[07c]=C287220D
DRAMC_PADCTL4[0e4]=000022B3
DRAMC_DQIDLY1[210]=0C0B0A09
DRAMC_DQIDLY2[214]=06080909
DRAMC_DQIDLY3[218]=0C080607
DRAMC_DQIDLY4[21c]=09080B08
DRAMC_R0DELDLY[018]=00002021
==================================================================
RX DQS perbit delay software calibration
==================================================================
1.0-15 bit dq delay value
==================================================================
bit| 0 1 2 3 4 5 6 7 8 9
--------------------------------------
0 | 7 8 8 12 7 7 7 6 6 6
10 | 7 9 7 10 8 9
--------------------------------------
==================================================================
2.dqs window
x=pass dqs delay value (min~max)center
y=0-7bit DQ of every group
input delay:DQS0 =33 DQS1 = 32
==================================================================
bit DQS0 bit DQS1
0 (1~62)31 8 (1~62)31
1 (1~62)31 9 (1~64)32
2 (1~60)30 10 (0~63)31
3 (1~65)33 11 (1~58)29
4 (1~62)31 12 (1~62)31
5 (1~62)31 13 (1~62)31
6 (1~64)32 14 (1~64)32
7 (1~65)33 15 (2~62)32
==================================================================
3.dq delay value last
==================================================================
bit| 0 1 2 3 4 5 6 7 8 9
--------------------------------------
0 | 9 10 11 12 9 9 8 6 7 6
10 | 8 12 8 11 8 9
==================================================================
==================================================================
TX perbyte calibration
==================================================================
DQS loop = 15, cmp_err_1 = ffff0000
dqs_perbyte_dly.last_dqsdly_pass[0]=15, finish count=1
dqs_perbyte_dly.last_dqsdly_pass[1]=15, finish count=2
DQ loop=15, cmp_err_1 = ffff0080
dqs_perbyte_dly.last_dqdly_pass[1]=15, finish count=1
DQ loop=14, cmp_err_1 = ffff0000
dqs_perbyte_dly.last_dqdly_pass[0]=14, finish count=2
byte:0, (DQS,DQ)=(8,8)
byte:1, (DQS,DQ)=(8,8)
DRAMC_DQODLY1[200]=88888888
DRAMC_DQODLY2[204]=88888888
20,data:88
[EMI] DRAMC calibration passed
===================================================================
MT7621 stage1 code done
CPU=500000000 HZ BUS=166666666 HZ
===================================================================
U-Boot 1.1.3 (May 11 2020 - 10:41:20)
Board: Ralink APSoC DRAM: 128 MB
Power on memory test. Memory size= 128 MB...OK!
relocate_code Pointer at: 87fb0000
Config XHCI 40M PLL
RT2880_RSTSTAT_REG 0xc0030000
***************************
Board power on Occurred
***************************
flash manufacture id: ef, device id 40 18
find flash: W25Q128BV
============================================
Ralink UBoot Version: 5.0.0.0
--------------------------------------------
ASIC MT7621A DualCore (MAC to MT7530 Mode)
DRAM_CONF_FROM: Auto-Detection
DRAM_TYPE: DDR3
DRAM bus: 16 bit
Xtal Mode=3 OCP Ratio=1/3
Flash component: SPI Flash
Date:May 11 2020 Time:10:41:20
============================================
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:256, ways:4, linesz:32 ,total:32768
##### The CPU freq = 880 MHZ ####
estimate memory size =128 Mbytes
#Reset_MT7530
set LAN/WAN LLLLW
restore_defaults:0
NetTxPacket = 0x87FE52C0
KSEG1ADDR(NetTxPacket) = 0xA7FE52C0
NetLoop,call eth_halt !
NetLoop,call eth_init !
Trying Eth0 (10/100-M)
Waitting for RX_DMA_BUSY status Start... done
ETH_STATE_ACTIVE!!
BOOTP broadcast 1
DHCPHandler: got packet: (src=40578, dst=1900, len=146) state: 3
Filtering pkt = -1
DHCPHandler: got packet: (src=43973, dst=1900, len=146) state: 3
Filtering pkt = -1
DHCPHandler: got packet: (src=40578, dst=1900, len=146) state: 3
Filtering pkt = -1
DHCPHandler: got packet: (src=43973, dst=1900, len=146) state: 3
Filtering pkt = -1
DHCPHandler: got packet: (src=40578, dst=1900, len=146) state: 3
Filtering pkt = -1
DHCPHandler: got packet: (src=43973, dst=1900, len=146) state: 3
Filtering pkt = -1
DHCPHandler: got packet: (src=67, dst=68, len=300) state: 3
Filtering pkt = 0
DHCPHandler: got DHCP packet: (src=67, dst=68, len=300) state: 3
DHCP: state=SELECTING bp_file: "recovery.bin"
TRANSITIONING TO REQUESTING STATE
*** Unhandled DHCP Option in OFFER/ACK: 28
Bootfile: recovery.bin
DhcpSendRequestPkt: Sending DHCPREQUEST
Transmitting DHCPREQUEST packet: len = 343
DHCPHandler: got packet: (src=67, dst=68, len=300) state: 4
Filtering pkt = 0
DHCPHandler: got DHCP packet: (src=67, dst=68, len=300) state: 4
DHCP State: REQUESTING
*** Unhandled DHCP Option in OFFER/ACK: 28
Bootfile: recovery.bin
DHCP client bound to address 192.168.0.211
TFTP from server 192.168.0.2; our IP address is 192.168.0.211
Filename 'recovery.bin'.
TIMEOUT_COUNT=10,Load address: 0x82000000
Loading: Got ARP REPLY, set server/gtwy eth addr (74:2b:62:87:55:c1)
Got it
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
######################################################Got ARP REQUEST, return our IP
###########
#################################################################
###################################checksum bad
###checksum bad
###########################
#####################checksum bad
###################################checksum bad
#########
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#####
done
Bytes transferred = 11339690 (ad07aa hex)
LoadAddr=82000000 NetBootFileXferSize= 00ad07aa
TRX MAGIC error!
Header check error!
Image verify failed!
========Upgrade fail!========
Interesting, ok try the same method
if still no go, can you turn the router off, then just turn it on, and monitor via the serial, do you get uboot menu countdown?
Bytes transferred = 5361704 (51d028 hex)
LoadAddr=82000000 NetBootFileXferSize= 0051d028
TRX MAGIC error!
Header check error!
Image verify failed!
========Upgrade fail!========
and no, no uboot countdown it just loads the kernel and boots 
until the sysapihttpd service fails
U-Boot 1.1.3 (May 11 2020 - 10:41:20)
Board: Ralink APSoC DRAM: 128 MB
Power on memory test. Memory size= 128 MB...OK!
relocate_code Pointer at: 87fb0000
Config XHCI 40M PLL
RT2880_RSTSTAT_REG 0xc0030000
***************************
Board power on Occurred
***************************
flash manufacture id: ef, device id 40 18
find flash: W25Q128BV
============================================
Ralink UBoot Version: 5.0.0.0
--------------------------------------------
ASIC MT7621A DualCore (MAC to MT7530 Mode)
DRAM_CONF_FROM: Auto-Detection
DRAM_TYPE: DDR3
DRAM bus: 16 bit
Xtal Mode=3 OCP Ratio=1/3
Flash component: SPI Flash
Date:May 11 2020 Time:10:41:20
============================================
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:256, ways:4, linesz:32 ,total:32768
##### The CPU freq = 880 MHZ ####
estimate memory size =128 Mbytes
#Reset_MT7530
set LAN/WAN LLLLW
restore_defaults:0
Please choose the operation:
1: Load system code to SDRAM via TFTP.
2: Load system code then write to Flash via TFTP.
3: Boot system code via Flash (default).
4: Entr boot command line interface.
7: Load Boot Loader code then write to Flash via Serial.
9: Load Boot Loader code then write to Flash via TFTP.
n3: System Boot system code via Flash.
Booting System 1
Erasing SPI Flash...
raspi_erase: offs:30000 len:10000
.
Writing to SPI Flash...
.
done
## Booting image at bc180000 ...
Image Name: MIPS OpenWrt Linux-3.10.14
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 1863104 Bytes = 1.8 MB
Load Address: 81001000
Entry Point: 813f3080
Verifying Checksum ... OK
Uncompressing Kernel Image ... OK
Erasing SPI Flash...
raspi_erase: offs:30000 len:10000
.
Writing to SPI Flash...
.
done
commandline uart_en=0 factory_mode=0 mem=128m root=/dev/mtdblock9
No initrd
## Transferring control to Linux (at address 813f3080) ...
## Giving linux memsize in MB, 128
Starting kernel ...
OK, before this broke, did you make a note from the oem webui what firmware it was running orginally? you need that correct version otherwise it wont take the recovery process, also you need firmware upgrade only not the full update version
So, at this point the only way forward is to use the ch341 programmer method to extract the rom image, and hexedit to allow the uart_en=1 boot_wait=on bootdelay=5
As discussed here - Xiaomi WiFi Router 3G V2
You can then install my firmware version afterwards
Well, ok, I already thought about directly flashing via SPI. I don't have a ch341 here, but it should work from any device that has a supported SPI interface like a raspberry, right?
Yep any SPI flash reader will do, just make sure to connect the right pins. and voltage check.
By using the spi reader/writer you can determine if the the nor chip is no good.
ok, so just powering up my soldering iron to attach some wires to the spi flash...
@BillBluescreen Out of interest, what series of commands did you use via SSH when this happened?
Also, which SPI chip does your device have?
I think there is a Winbond one and another....
This article will help
Use flashrom tool
Once you have gained access to the uboot menu, your router is then free, as long as you dont try and install the chinese firmware again.
yes, it's a winbond 2so120jvso 2012
don't remember the exaxt sequence but I was trying to install a new openwrt image that never booted
Found Winbond flash chip "W25Q128.V" (16384 kB, SPI) on linux_spi.
1 Like
Do a backup with flashrom first - really important! then hex edit a copy as per article from this forum i mentioned, there is an openwrt article as well
Also top of this page
Using the Bless hex editor I open the SPI FLASH dump and find the "bootdelay" parameter at 0x19690 is set to "off":
I can change the value to something more convenient, say 5 seconds to, hopefully, be able to interact with the bootloader:
Also change the uart_en=0 to uart_en=1 and other variables i mentioned
ok, set all variables everywhere i found them and reflashed it. However, the device doesn't care, it just boots normally, no way to interact with uboot. i can also read the flash and i see the changes i made... what did i forget?
ok, no idea what happened but now it stopped at the uboot prompt! finally!
ok, i could boot the image you linked earlier via tftp and used it to flash openwrt-19.07.4-r11208-ce6496d796-ramips-mt7621-xiaomi_mir4ag-squashfs-sysupgrade.bin via sysupgrade. Seems to work, at least it boots and i can get to a shell. That's enough for today, thank you very much for your support!
1 Like
No problem, glad you got it working.
Its a good value router once we get all of the mt76 drivers issues resolved. and for $25 its a bargain.
5 Likes
Man,i successfully installed nft-qos in your latest build and it works like a magic i tried limitting their bandwidths by using mac addresses or IP and can't believe it really works
1 Like
I learn how to build my own firmware using chef and i used the latest snapshot,I like this latest snapshot i didn't encounter any bugs and finally activated channel 161 in 5Ghz WiFi so it can penetrate though walls,for some reasons in Araujorm's build i can't activate the those higher channels maybe it's driver related?
1 Like
Hi, @db260179
Why are the channels mentioned by @zandatsu07 not available in your build?