miaoer

Youtube

Start#

The Redmi Router AX6000 is a mid-range wireless router released by Xiaomi.

It is equipped with the MediaTek Filogic 830, which has been tested to be close to entry-level dual-core soft routing.

It can meet gigabit internet needs, and its performance can be said to be very strong.

This tutorial is neither about expanding the firmware (partition) nor about expanding the firmware, but about U-Boot flashing.

I believe the U-Boot flashing part is quite enjoyable, although there are many recovery conditions. If you listen to me explain them one by one, I believe you can handle it too.

I suggest that flashing has risks, and you should be cautious! It is recommended to watch the entire video before proceeding.

I also took the risk of bricking the device and stayed up all night to fix the firmware issues. I've already stepped into the pitfalls for you, isn't it worth a one-click three-link?

Preparation#

This time we will use:

• Redmi AX6000 wireless router
• Two network cables
• Toothpick (or SIM card ejector)
• WinSCP
• Telnet/SSH client
• Xiaomi router firmware version 1.2.8
• CatWrt for Redmi AX6000

Recovery needs:

• Xiaomi router official recovery tool
• Xiaomi router firmware version 1.0.48

Attachment Download Extraction code: miao

The firmware accompanying this video has been updated, see CatWrt-v23.8

For any questions, refer to the blog below (not mentioned in the video) 👇👇👇

¹

Install Related Software#

Download the attachments provided in the video blog, and extract them to a location you know.

Demonstrating the installation of Telnet, press the Windows key on your keyboard and type Add or Remove Programs, select Optional Features, scroll to the bottom to More Windows Features, select the checkbox next to Telnet Client, and Telnet will be installed.

Open the WinSCP installation package in the attachment, choose to install for all users, and agree to the UAC prompt by clicking next.

Downgrade#

Because unlocking requires the Xiaomi MiWiFi firmware to be version 1.2.8.

In the Xiaomi router backend (192.168.31.1), select system update in the upper right corner, then click manual update.

Choose the 1.2.8 version firmware that you just downloaded, and the system will downgrade or update to 1.2.8.

After rebooting, re-enter the backend.

As "For security reasons, it is not allowed to select firmware lower than the current version number for upgrade" ## Downgrade Prohibited

Unlock Telnet#

Enable Debug Mode#

In the browser address bar, enter http://192.168.31.1/cgi-bin/luci/;stok=1145141919.

Copy the stok after the Xiaomi router address, such as 1145141919 here, replace the link provided in the blog and hit enter.

::: banner {info}
You can directly click the COPY button on the right to quickly copy.
:::

http://192.168.31.1/cgi-bin/luci/;stok={token}/api/misystem/set_sys_time?timezone=%20%27%20%3B%20zz%3D%24%28dd%20if%3D%2Fdev%2Fzero%20bs%3D1%20count%3D2%202%3E%2Fdev%2Fnull%29%20%3B%20printf%20%27%A5%5A%25c%25c%27%20%24zz%20%24zz%20%7C%20mtd%20write%20-%20crash%20%3B%20

If the API outputs {"code":0}, it indicates that our steps are correct, and we can continue.

Also replace the stok in the reboot link; I don't know why it needs to be done this way, but since the tutorial says so, just follow it~ Enter and hit enter.

http://192.168.31.1/cgi-bin/luci/;stok={token}/api/misystem/set_sys_time?timezone=%20%27%20%3b%20reboot%20%3b%20

Enable Telnet#

After the machine reboots, re-enter the Xiaomi router backend, copy the stok again, and note that the stok after reboot may be different, so don't mix them up.

http://192.168.31.1/cgi-bin/luci/;stok={token}/api/misystem/set_sys_time?timezone=%20%27%20%3B%20bdata%20set%20telnet_en%3D1%20%3B%20bdata%20set%20ssh_en%3D1%20%3B%20bdata%20set%20uart_en%3D1%20%3B%20bdata%20commit%20%3B%20

After successfully executing the API, it will also output {"code":0}. Then enter the following link, replace it, and hit enter; the router will reboot.

http://192.168.31.1/cgi-bin/luci/;stok={token}/api/misystem/set_sys_time?timezone=%20%27%20%3b%20reboot%20%3b%20

Unlock SSH#

After rebooting, our Telnet is enabled. We connect to the Xiaomi router in cmd or Windows Terminal, referred to as the terminal, and type telnet 192.168.31.1.

You can enter Telnet now. Next, we need to unlock SSH to complete the U-Boot flashing.

Special thanks to @Timochan for writing the unlock script specifically for this episode, much appreciated.

Copy the following code directly by pressing COPY with your mouse, no need to select and copy.

cd /tmp && curl --silent -O https://service.miaoer.xyz/unlock-redmi-ax6000/cn/server/setup.sh && chmod +x setup.sh && ./setup.sh

After execution, it will prompt that the connection to the host is lost. This indicates that the SSH unlock script has executed successfully and rebooted.

After rebooting, enter the terminal and type ssh [email protected].

Password: admin, hit enter, and for the first connection, type yes to save the key and hit enter.

You can now enter SSH.

Backup and Flash U-Boot#

Next, we will use the modified and compiled U-Boot and accompanying scripts from @hanwckf.

First, back up the original boot partition before downloading U-Boot.

cd /tmp && curl --silent -O https://service.miaoer.xyz/unlock-redmi-ax6000/cn/server/uboot.sh && chmod +x uboot.sh && ./uboot.sh

After completion, a piece of code will scroll by, the front part is downloading and verifying the hash value of the U-boot file, backing up the boot partition, and the prompt part.

The prompt "Backup success! Please download it to your computer" indicates a successful backup, please download it to your computer.

We will use WinSCP to connect to the Xiaomi router, select scp as the protocol, and fill in 192.168.31.1.

Username root, password admin, click connect, and agree to save and trust the certificate file.

If you enter the /root directory by default, double-click .. to return to the root directory.

Enter the /tmp directory to see mtd4_Factory.bin and mtd5_FIP.bin. Select these two files and copy or drag them directly to your local directory. If needed, you can back them up elsewhere.

This is very important; without it, you cannot restore to the original Xiaomi system!

While saving, I noticed the U-Boot file. Actually, you don't need to worry about whether the U-Boot script has been downloaded successfully; if it hasn't, the script will prompt relevant errors.

For example: Error: mt7986_redmi_ax6000-fip-fixed-parts.bin download failed and Error: mt7986_redmi_ax6000-fip-fixed-parts.bin md5 is not correct.

Next, we will flash the U-Boot file to the local machine. Here, it is emphasized that the commands must be entered in sequence in the terminal; this is very important!

mtd erase FIP
mtd write /tmp/mt7986_redmi_ax6000-fip-fixed-parts.bin FIP
mtd verify /tmp/mt7986_redmi_ax6000-fip-fixed-parts.bin FIP

Refer to the output; the prompt "Success" indicates that it is correct, and the content needs to be exactly the same.

root@XiaoQiang:~# mtd erase FIP
Unlocking FIP ...
Erasing FIP ...
root@XiaoQiang:~# mtd write /tmp/mt7986_redmi_ax6000-fip-fixed-parts.bin FIP
Unlocking FIP ...

Writing from /tmp/mt7986_redmi_ax6000-fip-fixed-parts.bin to FIP ...
root@XiaoQiang:~# mtd verify /tmp/mt7986_redmi_ax6000-fip-fixed-parts.bin FIP
Verifying FIP against /tmp/mt7986_redmi_ax6000-fip-fixed-parts.bin ...
72a110768c7473200b863a3c5d4dd975 - FIP
72a110768c7473200b863a3c5d4dd975 - /tmp/mt7986_redmi_ax6000-fip-fixed-parts.bin
Success
root@XiaoQiang:~#

U-Boot#

::: banner {warning}
In the next steps, port 1 will serve as the WAN port, and ports 2, 3, and 4 will be LAN; adaptive support is not available!

Please connect the network cable to any LAN port 2, 3, or 4.
:::

Next, we need to set a static address for U-Boot.

Click the Windows key in the lower left corner of the keyboard, type Control Panel, and hit enter. Open Control Panel - View Network Status and Tasks, select Ethernet - Properties - Internet Protocol Version 4 (TCP/IPv4) - Properties.

Or in Windows Settings IP Assignment - Edit - IPv4.

Select "Use the following IP address" and fill in:

IP Address: 192.168.31.2

Subnet Mask: 255.255.255.0

Gateway Address: 192.168.31.1

If you use Windows Settings instead of Control Panel, you also need to add Preferred DNS: 192.168.31.1 (not shown in the video).

Click OK.

Tip: At this point, U-Boot will not light up the LED. You can observe whether the computer's network port is flashing to check if the router is running. You can press reset multiple times, but it should not be less than 15 seconds!

Next, unplug the power from the Redmi AX6000, insert the toothpick into the router's reset hole while connecting the power, hold it for 15 seconds while mentally counting, then release the reset.

You will enter the U-Boot program compiled by the expert. Here, click to select the file and find the firmware I compiled for CatWrt For RedmiAX6000.

The full name is catwrt-v22.12-mediatek-filogic-xiaomi_redmi-router-ax6000-squashfs-sysupgrade.bin.

Then click Update, and the firmware will be uploaded to U-Boot. Click to flash, and it will check whether your package is compatible.

The first time here, I received an Update Failed error, which is normal. Return and upload the firmware again.

This time, it will easily flash the firmware, and when the Upgrade complete! message appears along with the LED white light, the U-Boot part is complete.

Settings#

::: banner {warning}
Entering U-Boot requires setting a static address; when returning to OpenWrt, you need to change it to DHCP for automatic acquisition.
:::

The default address of the firmware is 192.168.1.4.

Here, we need to change the static address we set earlier to DHCP for automatic acquisition.

Log in to the router backend in the browser 192.168.1.4.

Username root, Password password.

You can now enter CatWrt.

First, we need to set the LAN port configuration. Click Network - Interfaces - LAN - Edit.

We will not change the address; it is fine as it is.

Gateway: set this to the local address 192.168.1.4.

Broadcast: set this to 192.168.1.0.

DNS: I will set the public DNS addresses of Alibaba and Tencent to 119.29.29.99, 223.5.5.5.

IPv6 is enabled by default, and for DHCP, the default 50 is fine, but I prefer to change it to 20; it varies from person to person.

For IPv6 DNS, we set it to 240C::6666.

Save and apply. If you modified the local address, the router may loop infinitely, so you need to restart and re-enter your address in the address bar.

Next, set the WAN port. Click Network - Interfaces - WAN - Edit.

If you are dialing with a fiber modem, there is no need to modify this. If you are bridging the router with a fiber modem, change it to PPPoE protocol, click to switch the protocol, and fill in your broadband account and password.

Save and apply.

Next, optimize the settings. Find Turbo ACC under the network for network acceleration.

PS: Later, I consulted with the expert Dark Cloud, and hardware acceleration has been integrated into the open-source Flow Offloading, so there is no need to worry about performance issues under gigabit.

Traffic offloading is Flow Offloading, and the MediaTek HNAT hardware acceleration has not been opened, which is still a bit regrettable and needs to wait for support from Lean and others.

Here, you only need to enable DNS caching and keep a few DNS; I only keep the Alibaba and Tencent DNS.

Then we open the services and find UPNP, check Enable UPnP and NAT-PMP services to enable UPNP.

Note that OpenWrt's port forwarding can use Socat to forward IPv4/v6 ports.

The wireless part can be set up simply; it can be used normally as it uses open-source wireless drivers instead of closed-source ones. The Mesh function is also disabled; I have tried compiling simple Mesh in LEDE, but all attempts have failed.

Other functions can be researched on your own. I have also compiled the software source as a small supplement; those interested can learn more.

Since we just modified the LAN port configuration, restart the Redmi AX6000 to use it normally.

Performance#

I only have 300-400Mbps broadband internet performance, and the CPU usage is only about 30%.

CpuMark: 27555.110220 Scores close to entry-level dual-core soft routing standards.

chacha20-poly1305

aes-256-gcm

4k videos can also easily surpass 200,000.

Flash Back to Xiaomi Original Firmware#

If you are not satisfied with the functions or wireless part of OpenWrt and want to flash back to the original system, it is also possible.

::: banner {error}
If you have flashed other firmware using U-Boot, it may not include kmod-mtd-rm, which cannot unlock partitions and restore. Please use CatWrt v22.12 for recovery.
:::

Restore Partition#

First, we will use WinSCP to connect to the Redmi AX6000. At this time, the machine is still running the CatWrt I compiled.

Upload the previously backed up mtd5_FIP.bin partition file to the /tmp directory, then execute the command to unlock the FIP partition to restore the official U-Boot partition.

insmod mtd-rw.ko i_want_a_brick=1
md5sum /tmp/mtd5_FIP.bin
mtd write /tmp/mtd5_FIP.bin FIP
mtd verify /tmp/mtd5_FIP.bin FIP

After that, you can cut the power and use the Xiaomi official recovery tool to repair it.

Xiaomi Recovery Tool#

There are many precautions with the Xiaomi recovery tool. First, temporarily turn off Windows Defender Firewall and antivirus software. If you have multiple network cards, remember to disable the extra ones. Unplug the WAN port cable (port 1) and the power cable.

In the Xiaomi official recovery tool, select the official firmware we downloaded in advance, and continue with the network card; I only have one.

Next, use a toothpick to poke into the reset hole while plugging in the power, and hold it until the blue LED light stays on and turns to orange blinking, then release the reset.

Wait a moment, and a flashing window will appear. Wait for the progress to finish, and the blue LED light on the router will blink, indicating that you should unplug the power and restart.

We unplug the power, plug it back in, and wait a moment to restore the original firmware.

End#

This video ends here. The Redmi AX6000 firmware has a few small regrets, such as the 160MHz not being tested yet, which requires everyone to test it themselves.

In the status overview, you will see a mysterious 2.5G eth0, but actually, no interfaces are bound in it.

Overall, packaging and developing this Redmi AX6000 is not difficult for me; the challenging part is the scripts that have been processed for us. Special thanks to Timochan for the PR scripts, and to the boss for purchasing and providing the machine adaptation. Whether I need to flash x-wrt or CatWrt depends on you.

Finally, those who have flashed our CatWrt can join our fan group. Thank you all for your support. I am Miao Er, and see you next time in the family data center.

Help#

Firmware support is not perfect, and bugs are inevitable. If you encounter problems, please leave a comment below or join the group to inquire. If you use my firmware, you can ask for simple advice; if it’s paid, that would be even better. I won’t respond to those using others' firmware!

• Buy the author a milk tea: Sponsor
• CatWrt QQ Group (problem handling): 669190476
• Telegram Group: Miao Er's Exchange

Feel free to leave comments to encourage ( ´･･) ﾉ (._.`)

References#

U-Boot

Tutorial for Unlocking Telnet/SSH

Tutorial for Flashing U-Boot

Tutorial for Unlocking SSH Permissions

unlock-redmi-ax6000

Video shooting authorized by @Kaka's Dabble Diary

Thanks to the experts for answering the wireless driver part of CatWrt.

Thanks to Dark Cloud for answering the hardware acceleration part.

This article is synchronized and updated to xLog by Mix Space. The original link is https://www.miaoer.net/posts/network/flash-redmi-ax6000