miaoer

Youtube

Start#

The Redmi Router AX6000 is a mid-range wireless router released by Xiaomi.

It is equipped with the MediaTek Filogic 830, which has been tested to be close to entry-level dual-core soft routing.

It can meet the needs of gigabit internet access, and its performance can be described as very strong.

This tutorial is neither about expanding the firmware (partition) nor about expanding the firmware, but rather about U-Boot flashing.

I believe the U-Boot flashing part is quite enjoyable, although there are many recovery conditions. Listen to me explain them one by one, and I believe you can handle it too.

I suggest flashing comes with risks, and you should proceed with caution! It is recommended to watch the entire video before proceeding.

I also took the risk of bricking the device and worked overnight to fix the firmware issue. I've already stepped into the pit for you, isn't it worth a one-click three-link?

Preparation#

This time we need:

• Redmi AX6000 wireless router
• Two network cables
• Toothpick (or SIM card ejector)
• WinSCP
• Telnet/SSH client
• Xiaomi router firmware version 1.2.8
• CatWrt for Redmi AX6000

Recovery needs:

• Xiaomi router official recovery tool
• Xiaomi router firmware version 1.0.48

Download attachments Extraction code: miao

The firmware paired with this video has been updated, see CatWrt-v23.8

If you encounter problems, refer to the blog below for answers (not mentioned in the video) 👇👇👇

¹

Install Related Software#

Download the attachments provided in the video blog, and after downloading, extract them to a location you know.

Demonstrating the installation of Telnet, press the Windows key on the keyboard and type Add or Remove Programs, select Optional Features, scroll to the bottom, select More Windows Features, and check the box next to Telnet Client. This way, Telnet will be installed.

Open the WinSCP installation package in the attachments, choose to install for all users, and agree to proceed in the UAC without thinking.

Downgrade#

Because unlocking requires the Xiaomi MiWiFi firmware to be version 1.2.8.

In the Xiaomi router backend (192.168.31.1), select system update in the upper right corner, then click manual update.

Select the firmware version 1.2.8 that you just downloaded, and the system will downgrade or update to 1.2.8.

After rebooting, re-enter the backend.

As "For security reasons, it is not allowed to select firmware lower than the current version number for upgrade" ## Downgrade prohibited

Unlock Telnet#

Enable Debug Mode#

In the browser address bar, enter http://192.168.31.1/cgi-bin/luci/;stok=1145141919.

Copy the stok after the Xiaomi router address, like 1145141919 here, replace it in the link provided in the blog, and then press Enter.

::: banner {info}
You can directly click the COPY button on the right to quickly copy.
:::

http://192.168.31.1/cgi-bin/luci/;stok={token}/api/misystem/set_sys_time?timezone=%20%27%20%3B%20zz%3D%24%28dd%20if%3D%2Fdev%2Fzero%20bs%3D1%20count%3D2%202%3E%2Fdev%2Fnull%29%20%3B%20printf%20%27%A5%5A%25c%25c%27%20%24zz%20%24zz%20%7C%20mtd%20write%20-%20crash%20%3B%20

If the API outputs {"code":0}, it means our steps are correct, and we can continue.

Also replace the stok in the reboot link; I don't know why it needs to be restarted this way, but since the tutorial says so, just follow it~ Enter and press Enter.

http://192.168.31.1/cgi-bin/luci/;stok={token}/api/misystem/set_sys_time?timezone=%20%27%20%3b%20reboot%20%3b%20

Enable Telnet#

After the machine restarts, re-enter the Xiaomi router backend, copy the stok again, and note that the stok after reboot may be different, so don't get confused.

http://192.168.31.1/cgi-bin/luci/;stok={token}/api/misystem/set_sys_time?timezone=%20%27%20%3B%20bdata%20set%20telnet_en%3D1%20%3B%20bdata%20set%20ssh_en%3D1%20%3B%20bdata%20set%20uart_en%3D1%20%3B%20bdata%20commit%20%3B%20

After successfully executing the API, it will also output {"code":0}, then enter the following link, replace it, and press Enter. The router will restart.

http://192.168.31.1/cgi-bin/luci/;stok={token}/api/misystem/set_sys_time?timezone=%20%27%20%3b%20reboot%20%3b%20

Unlock SSH#

After rebooting, our Telnet is enabled. We connect to the Xiaomi router in cmd or Windows Terminal, referred to here as the terminal, and type telnet 192.168.31.1.

You can enter Telnet now, and next we need to unlock SSH to complete the U-Boot flashing.

Special thanks to @Timochan for writing the unlocking script specifically for this episode, I am very grateful.

Copy the following code directly by pressing COPY with the mouse, no need to select and copy.

cd /tmp && curl --silent -O https://service.miaoer.xyz/unlock-redmi-ax6000/cn/server/setup.sh && chmod +x setup.sh && ./setup.sh

After execution, it will prompt that the connection to the host is lost. This indicates that the SSH unlocking script has executed successfully and rebooted.

After rebooting, enter the terminal and type ssh [email protected].

You can enter SSH now.

Backup and Flash U-Boot#

Next, we will use the modified and compiled U-Boot and accompanying scripts from @hanwckf.

We will back up the original boot partition before downloading U-Boot.

cd /tmp && curl --silent -O https://service.miaoer.xyz/unlock-redmi-ax6000/cn/server/uboot.sh && chmod +x uboot.sh && ./uboot.sh

After completion, a piece of code will flash by, where the front part is downloading and verifying the hash value of the U-boot file, backing up the boot partition, and the prompt part.

The prompt "Backup success! Please download it to your computer" indicates that the backup was successful, please download it to your computer.

We will use WinSCP to connect to the Xiaomi router, select scp as the protocol, and fill in 192.168.31.1.

Username root, password admin, click link, agree to save and trust the certificate file.

If you enter the /root directory by default, double-click .. to return to the root directory.

Enter the /tmp directory to see mtd4_Factory.bin and mtd5_FIP.bin. Select these two files and copy or drag them directly to your local directory. If needed, you can back them up elsewhere.

This is very important; without it, you cannot restore to the original Xiaomi system!

While saving, I noticed the U-Boot file. In fact, you don't need to worry about whether the U-Boot script was downloaded successfully; if it wasn't, the script will prompt relevant errors.

For example: Error: mt7986_redmi_ax6000-fip-fixed-parts.bin download failed and Error: mt7986_redmi_ax6000-fip-fixed-parts.bin md5 is not correct.

Next, we will flash the U-Boot file to the local machine. Here, it is emphasized that you need to enter the following commands in the terminal sequentially; this is very important!

mtd erase FIP
mtd write /tmp/mt7986_redmi_ax6000-fip-fixed-parts.bin FIP
mtd verify /tmp/mt7986_redmi_ax6000-fip-fixed-parts.bin FIP

Refer to the output; if it prompts Success, it is fine, and the content needs to be exactly the same.

root@XiaoQiang:~# mtd erase FIP
Unlocking FIP ...
Erasing FIP ...
root@XiaoQiang:~# mtd write /tmp/mt7986_redmi_ax6000-fip-fixed-parts.bin FIP
Unlocking FIP ...

Writing from /tmp/mt7986_redmi_ax6000-fip-fixed-parts.bin to FIP ...
root@XiaoQiang:~# mtd verify /tmp/mt7986_redmi_ax6000-fip-fixed-parts.bin FIP
Verifying FIP against /tmp/mt7986_redmi_ax6000-fip-fixed-parts.bin ...
72a110768c7473200b863a3c5d4dd975 - FIP
72a110768c7473200b863a3c5d4dd975 - /tmp/mt7986_redmi_ax6000-fip-fixed-parts.bin
Success
root@XiaoQiang:~#

U-Boot#

::: banner {warning}
In the next steps, port 1 will serve as the WAN port, and ports 2, 3, and 4 will be LAN; adaptive support is not available!

Please connect the network cable to any LAN port 2, 3, or 4.
:::

Next, we need to set a static address for U-Boot.

Click the Windows key in the lower left corner of the keyboard and type Control Panel, press Enter, open Control Panel - View Network Status and Tasks, select Ethernet - Properties - Internet Protocol Version 4 (TCP/IPv4) - Properties.

Or in Windows Settings, IP Allocation - Edit - IPv4.

Select Use the following IP address and fill in:

IP Address: 192.168.31.2

Subnet Mask: 255.255.255.0

Gateway Address: 192.168.31.1

If you are using Windows Settings instead of Control Panel, you also need to add Preferred DNS: 192.168.31.1 (not demonstrated in the video).

Click OK.

Tip: At this time, U-Boot will not light up the LED. You can observe whether the network port on the computer is flashing to check if the router is running. You can press reset multiple times, but it should not be less than 15 seconds!

Next, unplug the power from the Redmi AX6000, insert the toothpick into the router's reset hole while plugging in the power, hold it down while silently counting to 15, then release the reset.

You will enter the U-Boot program compiled by the expert. Here, click to select the file and find the firmware I compiled for CatWrt For RedmiAX6000.

The full name is catwrt-v22.12-mediatek-filogic-xiaomi_redmi-router-ax6000-squashfs-sysupgrade.bin.

Then click Update, and the firmware will be uploaded to U-Boot. Click Flash, and it will check whether your package is compatible.

The first time here, I was prompted with Update Failed error, which is normal. Return and upload the firmware again.

This time, it will be flashed easily, and when the upgrade completes, the LED will light up white, indicating that the U-Boot part is complete.

Settings#

::: banner {warning}
Entering U-Boot requires setting a static address; when returning to OpenWrt, you need to change it to DHCP for automatic acquisition.
:::

The default address of the firmware is 192.168.1.4.

Here, we need to change the static address we set earlier to DHCP for automatic acquisition.

Log in to the router backend in the browser 192.168.1.4.

Username root, password password.

You can enter CatWrt.

First, we need to set the LAN port configuration. Click Network - Interfaces - LAN - Edit.

We will not change the address; it is fine as it is.

Gateway: set this to the local address 192.168.1.4.

Broadcast: set this to 192.168.1.0.

DNS: I will set the public DNS addresses of Alibaba and Tencent to 119.29.29.99, 223.5.5.5.

IPv6 is enabled by default. The DHCP default start is 50, which is fine, but I prefer to change it to 20; it varies from person to person.

For IPv6 DNS, we set it to 240C::6666.

Save and apply. If you modified the local address, the router may spin indefinitely, so you may need to restart and re-enter your address in the address bar.

Next, set the WAN port. Click Network - Interfaces - WAN - Edit.

If you are dialing through an optical modem, you do not need to modify this. If you are bridging the optical modem to dial through the router, change this to PPPoE protocol, click to switch the protocol, and fill in your broadband account and password.

Save and apply.

Next, optimize the settings. Find Turbo ACC under the network for network acceleration.

PS: Later, I consulted with the expert Dark Cloud, and hardware acceleration has been integrated into the open-source Flow Offloading, so there is no need to worry about performance issues under gigabit.

Traffic offloading is Flow Offloading, and the MediaTek HNAT hardware acceleration has not been enabled, which is a bit regrettable and needs to wait for support from the experts.

Here, you only need to enable DNS caching and keep a few DNS; I only keep the DNS of Alibaba and Tencent.

Then we open the services and find UPNP, check the box to Enable UPnP and NAT-PMP services to enable UPNP.

Note that OpenWrt's port forwarding can use Socat for forwarding IPv4/v6 ports.

The wireless part can be set simply; it can be used normally as it is an open-source wireless driver rather than a closed-source one. The Mesh function is also disabled; I have tried compiling a simple Mesh in LEDE, but it has failed.

Other functions can be explored on your own. I have also compiled the software source as a small supplement; those interested can learn more.

Since we just modified the LAN port configuration, restart the Redmi AX6000 to use it normally.

Performance#

I only have 300-400Mbps broadband internet performance, and the CPU usage is only about 30%.

CpuMark: 27555.110220 Scores close to entry-level dual-core soft routing standards.

chacha20-poly1305

aes-256-gcm

4k video can also easily crush 200k.

Flash Back to Xiaomi Original Firmware#

If you are not satisfied with the functions of OpenWrt or the wireless part, you can also flash back to the original system.

::: banner {error}
If you have flashed other firmware using U-Boot, it may not include kmod-mtd-rm, which means you cannot unlock the partition and restore it. Please use CatWrt v22.12 for recovery.
:::

Restore Partition#

First, we will use WinSCP to connect to the Redmi AX6000. At this time, the machine is still running the CatWrt I compiled.

Upload the previously backed up mtd5_FIP.bin partition file to the /tmp directory, then execute the command to unlock the FIP partition to restore the official U-Boot partition.

insmod mtd-rw.ko i_want_a_brick=1
md5sum /tmp/mtd5_FIP.bin
mtd write /tmp/mtd5_FIP.bin FIP
mtd verify /tmp/mtd5_FIP.bin FIP

After that, you can cut off the power and use the Xiaomi official recovery tool to repair it.

Xiaomi Recovery Tool#

There are many precautions for the Xiaomi recovery tool. First, temporarily turn off Windows Defender Firewall and antivirus software. If you have multiple network cards, remember to disable the extra ones, unplug the WAN port network cable (port 1) and power cable.

In the Xiaomi official recovery tool, select the official firmware we pre-downloaded, and proceed.

Then, with one hand holding a toothpick in the reset hole and the other hand plugging in the power, hold it down until the blue LED light stays on and turns to orange blinking, then release the reset.

Wait a moment, and a flashing window will appear indicating that the flashing is in progress. Once the progress completes, the blue LED light on the router will blink, prompting you to unplug the power and restart.

We unplug the power, plug it back in, and wait a moment to restore the original firmware.

End#

This video ends here. The firmware for the Redmi AX6000 has a few small regrets, such as the 160MHz not being tested yet, which requires everyone to test it themselves.

In the status overview, you will see a mysterious 2.5G eth0, but actually, no interfaces are bound in it.

Overall, packaging and developing this Redmi AX6000 is not difficult for me; the challenging part is the scripts that have been handled for us. Special thanks to Timochan for the PR scripts, and to the boss for purchasing and providing the machine adaptation. Whether I need to flash x-wrt or CatWrt still depends on you.

Finally, those who flashed our CatWrt can join our fan group. Thank you all for your support. I am Miao Er, and see you next time in the family data center.

Help#

Firmware support is not perfect, and bugs are inevitable. If you encounter problems, please leave a comment below or join the group for inquiries. If you use my firmware, you can consult me briefly; if it’s a paid service, that would be even better. I won’t respond to issues with others' firmware!

• Buy the author a milk tea: Sponsor
• CatWrt QQ Group (problem handling): 669190476
• Telegram Group: Miao Er's Communication

Feel free to leave comments to encourage ( ´･･) ﾉ (._.`)

References#

U-Boot

Tutorial on Unlocking Telnet/SSH

Tutorial on Flashing U-Boot

Tutorial on Unlocking SSH Permissions

unlock-redmi-ax6000

Video shooting authorized by @Kaka's Dabble Diary

Thanks to the experts for answering questions about the wireless driver part of CatWrt.

Thanks to the expert Dark Cloud for answering questions about hardware acceleration.

This article is synchronized and updated to xLog by Mix Space. The original link is https://www.miaoer.net/posts/network/flash-redmi-ax6000