Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision Next revisionBoth sides next revision | ||
| inbox:toh:xiaomi:ax3000t [2023/12/12 11:05] – Init dimfishr | inbox:toh:xiaomi:ax3000t [2024/12/13 04:37] – [LEDs] nachum37 | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| ====== Xiaomi AX3000T ====== | ====== Xiaomi AX3000T ====== | ||
| + | <WRAP center round important 70%> | ||
| + | **Warning!** Don't brick your router! | ||
| - | The Xiaomi | + | AX3000T |
| + | </ | ||
| + | |||
| + | <WRAP center round important 70%> | ||
| + | New AX3000T devices with stock firmware version 1.0.84 or newer have received updated hardware ([[https:// | ||
| + | |||
| + | </ | ||
| + | |||
| + | The Xiaomi AX3000T router supports 2 802.11ax streams on both 2.4GHz @40MHz and 5GHz @160MHz for a combined 3000Mbps wireless speed. It is based on the MediaTek MT7981 SoC. | ||
| + | |||
| + | There are two versions of the Xiaomi AX3000T router: | ||
| + | * model **RD03**: Chinese version | ||
| + | * model **RD23**: International (Global) version. | ||
| + | Both versions have exactly the same hardware, and the only difference is the version of the stock firmware (which is region-locked). | ||
| {{media: | {{media: | ||
| Line 9: | Line 24: | ||
| **Support Forums** https:// | **Support Forums** https:// | ||
| - | ===== Supported Versions ===== | + | There are 2 known OpenWrt installation methods for the Xiaomi AX3000T: |
| + | * **API RCE method**: the method involves executing shell commands on the stock router firmware to enable SSH access by exploiting the API RCE, either in '' | ||
| + | * **UART flash method**: the method which requires opening the device, connecting a UART cable, and following a specific set of steps. This process is recommended only for advanced users and may soft brick your device. The instructions for this process are available in this post: [[https:// | ||
| - | ---- datatable ---- | + | OpenWrt Support Status: |
| - | cols : Brand, | + | ^ Stock Firmware ver. ^Model ^ API to exploit |
| - | headers | + | | 1.0.31 (INT) | RD23 | '' |
| - | align : c, | + | | 1.0.49 (INT) | RD23 | '' |
| - | filter | + | | 1.0.47 (CN) | RD03 | '' |
| - | filter | + | | 1.0.64 (CN) | RD03 | '' |
| - | filter | + | | 1.0.84 (CN) | RD03 | '' |
| - | ---- | + | |
| + | * *note: devices with the '' | ||
| - | ===== Hardware Highlights ===== | ||
| - | ---- datatable ---- | ||
| - | cols : Model, Versions, CPU, CPU MHz, CPU Cores_numcores, | ||
| - | header | ||
| - | align : c, | ||
| - | filter | ||
| - | filter | ||
| - | ---- | ||
| + | ===== Supported Versions ===== | ||
| - | ===== Installation ===== | + | <!-- ToH: { |
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | } --> | ||
| - | ==== Install Vulnerable Version ==== | ||
| - | First, you'll need to grab a vulnerable software version. The table below shows known vulnerable versions. It is recommended to install version 1.0.48. | ||
| - | ^ Firmware Version | ||
| - | | 1.0.64 | ||
| - | | 1.0.47 (recommended) | ||
| - | **To downgrade**: navigate to the upload firmware page and select the appropriate software | + | ===== Hardware Highlights ===== |
| + | <!-- ToH: { | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | } --> | ||
| + | |||
| + | |||
| + | ===== Installation===== | ||
| ==== Flash instructions ==== | ==== Flash instructions ==== | ||
| + | <WRAP center round info 70%> | ||
| + | Besides the manual steps outlined below, there is the [[https:// | ||
| + | </ | ||
| - | 1. Get ssh access. | + | 1. Get ssh access. |
| - | ``` | + | #!/bin/sh |
| - | curl -X POST " | + | |
| - | | + | if [ $# -ne 2 ]; then |
| - | | + | cat << |
| - | | + | Usage: $0 [misystem | xqsystem] [stok] |
| - | | + | e.g. $0 xqsystem e6ea114ba2cddb0c70fbbc417bb2706c |
| - | ``` | + | Copy the stok-string from a browser' |
| + | EOF | ||
| + | exit 1 | ||
| + | fi | ||
| + | |||
| + | [ -z " | ||
| + | |||
| + | url=" | ||
| + | |||
| + | case " | ||
| + | misystem) | ||
| + | url=" | ||
| + | pre=" | ||
| + | suf="" | ||
| + | ;; | ||
| + | xqsystem) | ||
| + | url=" | ||
| + | pre=" | ||
| + | suf="'" | ||
| + | ;; | ||
| + | *) | ||
| + | echo " | ||
| + | ;; | ||
| + | esac | ||
| + | |||
| + | curl -X POST " | ||
| + | sleep 1 | ||
| + | | ||
| + | sleep 1 | ||
| + | | ||
| + | sleep 1 | ||
| + | | ||
| + | sleep 1 | ||
| + | | ||
| 2. Backup stock partitions | 2. Backup stock partitions | ||
| - | ``` | ||
| - | | ||
| - | | ||
| - | | ||
| - | | ||
| - | | ||
| - | | ||
| - | | ||
| - | ``` | ||
| - | Then transfer them to your computer in a safe place. | ||
| - | 3. Get firmware information | + | ssh -o StrictHostKeyChecking=no -o HostKeyAlgorithms=+ssh-rsa -o PubkeyAcceptedAlgorithms=+ssh-rsa -v root@192.168.31.1 |
| + | nanddump -f / | ||
| + | nanddump -f / | ||
| + | nanddump -f / | ||
| + | nanddump -f / | ||
| + | nanddump -f / | ||
| + | nanddump -f / | ||
| + | nanddump -f /tmp/KF.bin / | ||
| + | |||
| + | Then transfer them to your computer in a safe place. | ||
| + | |||
| + | To copy you can run netcat on your computer: | ||
| + | |||
| + | $ netcat -l 1234 | tar xvf - | ||
| + | |||
| + | And send the data from the router: | ||
| + | |||
| + | root@XiaoQiang: | ||
| + | root@XiaoQiang: | ||
| + | |||
| + | |||
| + | 3. Get firmware information: '' | ||
| 4. Copy openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-initramfs-factory.ubi to **/tmp** and flash | 4. Copy openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-initramfs-factory.ubi to **/tmp** and flash | ||
| - | If **firmware=0** | ||
| - | ``` | ||
| - | | ||
| - | nvram set boot_wait=on | ||
| - | nvram set uart_en=1 | ||
| - | nvram set flag_boot_rootfs=1 | ||
| - | nvram set flag_last_success=1 | ||
| - | nvram set flag_boot_success=1 | ||
| - | nvram set flag_try_sys1_failed=0 | ||
| - | nvram set flag_try_sys2_failed=0 | ||
| - | nvram commit | ||
| - | | ||
| - | ``` | ||
| - | If **firmware=1** | ||
| - | ``` | ||
| - | | ||
| - | nvram set boot_wait=on | ||
| - | nvram set uart_en=1 | ||
| - | nvram set flag_boot_rootfs=0 | ||
| - | nvram set flag_last_success=0 | ||
| - | nvram set flag_boot_success=1 | ||
| - | nvram set flag_try_sys1_failed=0 | ||
| - | nvram set flag_try_sys2_failed=0 | ||
| - | nvram commit | ||
| - | | ||
| - | ``` | ||
| - | Then reboot your router, it should boot to the OpenWrt initramfs system now. | + | * If **firmware=0** |
| - | 5. Flash openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-squashfs-sysupgrade.bin | + | ubiformat / |
| - | | + | nvram set boot_wait=on |
| + | nvram set uart_en=1 | ||
| + | nvram set flag_boot_rootfs=1 | ||
| + | nvram set flag_last_success=1 | ||
| + | nvram set flag_boot_success=1 | ||
| + | nvram set flag_try_sys1_failed=0 | ||
| + | nvram set flag_try_sys2_failed=0 | ||
| + | nvram commit | ||
| + | reboot | ||
| + | * If **firmware=1** | ||
| + | |||
| + | ubiformat /dev/mtd8 -y -f / | ||
| + | nvram set boot_wait=on | ||
| + | nvram set uart_en=1 | ||
| + | nvram set flag_boot_rootfs=0 | ||
| + | nvram set flag_last_success=0 | ||
| + | nvram set flag_boot_success=1 | ||
| + | nvram set flag_try_sys1_failed=0 | ||
| + | nvram set flag_try_sys2_failed=0 | ||
| + | nvram commit | ||
| + | reboot | ||
| + | |||
| + | {{ : | ||
| + | Once the router is rebooted, it should boot to the OpenWrt initramfs system now. To be sure to use one of OpenWrt' | ||
| + | Note that you should configure the computer' | ||
| + | |||
| + | This command will connect you to the OpenWrt system: | ||
| + | |||
| + | ssh root@192.168.1.1 | ||
| + | |||
| + | |||
| + | 5. Copy openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-squashfs-sysupgrade.bin to **/tmp** and flash: | ||
| + | sysupgrade -n / | ||
| - | <WRAP info> Default available space is **60Mb**. | ||
| - | OpenWrt U-Boot provide faster boot loading and more space: **75Mb** (with recovery) or **85Mb** (without recovery). | ||
| - | </ | ||
| ==== Change to OpenWrt U-Boot ==== | ==== Change to OpenWrt U-Boot ==== | ||
| + | <WRAP info> Default available router space is **60Mb**. It's possible to increase this size by replacing stock bootloader with the OpenWrt U-Boot bootloader. Please [[https:// | ||
| + | OpenWrt U-Boot provides faster boot loading and more space: **75Mb** (with recovery) or **85Mb** (without recovery). | ||
| + | </ | ||
| - | 1. Flash openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-initramfs-recovery.itb | + | 1. Flash openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-initramfs-factory.ubi |
| - | `ubiformat /dev/mtd8 -y -f / | + | ubiformat /dev/mtd8 -y -f / |
| - | `reboot` | + | |
| 2. Install kmod-mtd-rw | 2. Install kmod-mtd-rw | ||
| - | `opkg update && opkg install kmod-mtd-rw` | + | |
| - | `insmod | + | |
| 3. Format ubi and create new ubootenv volume | 3. Format ubi and create new ubootenv volume | ||
| - | ``` | + | ubidetach -p /dev/mtd8; ubiformat /dev/mtd8 -y; ubiattach -p /dev/mtd8 |
| - | ubidetach -p /dev/mtd8; ubiformat /dev/mtd8 -y; ubiattach -p /dev/mtd8 | + | ubimkvol /dev/ubi0 -n 0 -N ubootenv -s 128KiB |
| - | | + | ubimkvol /dev/ubi0 -n 1 -N ubootenv2 -s 128KiB |
| - | | + | |
| - | ``` | + | |
| 4. *(Optional **-10Mb** free space) Add recovery boot feature.* | 4. *(Optional **-10Mb** free space) Add recovery boot feature.* | ||
| - | ``` | + | ubimkvol /dev/ubi0 -n 2 -N recovery -s 10MiB |
| - | ubimkvol /dev/ubi0 -n 2 -N recovery -s 10MiB | + | ubiupdatevol /dev/ubi0_2 / |
| - | | + | |
| - | ``` | + | |
| 5. Flash Openwrt U-Boot | 5. Flash Openwrt U-Boot | ||
| - | ``` | + | mtd write / |
| - | mtd write / | + | mtd write / |
| - | | + | |
| - | ``` | + | |
| 6. Flash openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-squashfs-sysupgrade.itb | 6. Flash openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-squashfs-sysupgrade.itb | ||
| - | `sysupgrade -n / | + | |
| - | ## Go Back to stock from Openwrt U-Boot: | + | ==== |
| 1. Force flash openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-initramfs-recovery.itb | 1. Force flash openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-initramfs-recovery.itb | ||
| - | `sysupgrade -F -n / | + | |
| 2. Format ubi and Nvram | 2. Format ubi and Nvram | ||
| - | ``` | + | ubidetach -p /dev/mtd8; ubiformat /dev/mtd8 -y; ubiattach -p /dev/mtd8 |
| - | ubidetach -p /dev/mtd8; ubiformat /dev/mtd8 -y; ubiattach -p /dev/mtd8 | + | mtd erase Nvram |
| - | | + | |
| - | ``` | + | |
| 3. Install kmod-mtd-rw | 3. Install kmod-mtd-rw | ||
| - | `opkg update && opkg install kmod-mtd-rw` | + | |
| - | `insmod | + | |
| 4. Flash stock images from backup | 4. Flash stock images from backup | ||
| - | ``` | + | mtd write / |
| - | mtd write / | + | mtd write / |
| - | | + | mtd write / |
| - | | + | |
| - | ``` | + | |
| - | Then reboot your router, waiting it finished rollback in minutes. | + | |
| - | ## Go Back to stock from default layout Openwrt: | + | Then reboot your router, waiting it finished rollback in minutes. |
| - | | + | |
| - | Then reboot your router, waiting it finished rollback in minutes. | + | |
| + | ==== Go Back to stock firmware from stock bootloader ==== | ||
| + | ubiformat /dev/mtd8 -y -f / | ||
| + | Then reboot your router, waiting it finished rollback in minutes. | ||
| ==== OEM installation using the TFTP method ==== | ==== OEM installation using the TFTP method ==== | ||
| Line 193: | Line 259: | ||
| ==== LuCI Web Upgrade Process ==== | ==== LuCI Web Upgrade Process ==== | ||
| - | * Browse to ''< | + | * Browse to ''< |
| * Upload image file for sysupgrade to LuCI | * Upload image file for sysupgrade to LuCI | ||
| * Wait for reboot | * Wait for reboot | ||
| Line 229: | Line 295: | ||
| </ | </ | ||
| - | </WRAP> | + | ===== Downgrading stock firmware ===== |
| + | This section is kept only for historical reference, as it relates to the deprecated OpenWrt installation method that was applicable only to the RD03 (Chinese version) with stock firmware version 1.0.47. Please note that none of the current installation methods require a firmware downgrade to flash OpenWrt. | ||
| + | |||
| + | **To downgrade** a firmware version on your router, navigate to the upload firmware page and select the appropriate software version. It will complain about the downgrade. Edit the url and change the < | ||
| ===== Debricking ===== | ===== Debricking ===== | ||
| -> [[docs: | -> [[docs: | ||
| - | Assume that you have installed OpenWrt with stock layout, with original u-boot: | + | Assume that you have installed OpenWrt with stock bootloader, with original u-boot: |
| * Connect to router via UART | * Connect to router via UART | ||
| Line 246: | Line 315: | ||
| - | ==== TFTP instructions for the stock layout | + | |
| + | ==== Recover bricked bootloader ==== | ||
| + | |||
| + | If your bootloader is bricked you can use the Mediateks ability to load a bootloader directly over UART with a tool called mtk_uartboot. | ||
| + | |||
| + | Details explained in [[https:// | ||
| + | |||
| + | ==== TFTP instructions for the stock bootloader | ||
| AX3000T can be recovered from a soft-brick with TFTP. The flow is: | AX3000T can be recovered from a soft-brick with TFTP. The flow is: | ||
| * The router boots and asks for an IP address on the LAN ports via DHCP | * The router boots and asks for an IP address on the LAN ports via DHCP | ||
| Line 288: | Line 364: | ||
| ===== Basic configuration ===== | ===== Basic configuration ===== | ||
| -> [[docs: | -> [[docs: | ||
| - | Set up your Internet connection, configure wireless, configure | + | Set up your Internet connection, configure wireless, configure |
| + | |||
| + | * note: configuration reset issue after 6 reboots sometimes occurs on the AX3000T and is [[https:// | ||
| + | |||
| + | sed -i '/exit 0/i sleep 5\nfw_setenv flag_try_sys1_failed 0' / | ||
| + | |||
| + | **Don' | ||
| ===== Specific Configuration ===== | ===== Specific Configuration ===== | ||
| Line 319: | Line 401: | ||
| | Reset | | Reset | ||
| | Mesh | BTN_9 | | | Mesh | BTN_9 | | ||
| + | |||
| + | ==== LEDs ==== | ||
| + | The Xiaomi AX3000T features a front LED strip that can light up in yellow (actually orange), blue, and white. | ||
| + | |||
| + | The default OpenWRT configuration is as follows: | ||
| + | |||
| + | ^ LED ^ Behavior | ||
| + | | Yellow | ||
| + | | Blue | Solid after boot | | ||
| + | | White | Not in use | | ||
| + | |||
| + | The white LED can be activated by turning on both the yellow and blue LEDs simultaneously. | ||
| + | |||
| + | For example, the following configuration will set the white LED to be solid when the PPPoE connection is established. If the connection is lost, the color will revert to blue. | ||
| + | |||
| + | This can be configured through Luci -> System -> LED Configuration. | ||
| + | |||
| + | config led | ||
| + | option sysfs ' | ||
| + | option trigger ' | ||
| + | option dev ' | ||
| + | list mode ' | ||
| + | | ||
| + | config led | ||
| + | option sysfs ' | ||
| + | option trigger ' | ||
| + | option dev ' | ||
| + | list mode ' | ||
| + | | ||
| + | config led | ||
| + | option sysfs ' | ||
| + | option trigger ' | ||
| + | |||
| + | |||
| Line 325: | Line 441: | ||
| - | ---- datatemplatelist dttpllist ---- | + | <!-- ToH: { |
| - | template: meta:template_datatemplatelist | + | " |
| - | cols | + | " |
| - | filter | + | " |
| - | filter | + | " |
| - | ---- | + | " |
| + | | ||
| + | } --> | ||
| ==== Photos ==== | ==== Photos ==== | ||
| Line 365: | Line 483: | ||
| How to connect to the Serial Port of this specific device:\\ | How to connect to the Serial Port of this specific device:\\ | ||
| {{: | {{: | ||
| - | ^ Serial connection parameters\\ for Xiaomi AX3000T | 115200, 8N1, 3.3V | | + | ^ Serial connection parameters\\ for Xiaomi AX3000T |
| ==== JTAG ==== | ==== JTAG ==== | ||
| Line 384: | Line 502: | ||
| ===== Notes ===== | ===== Notes ===== | ||
| + | |||
| + | * DC power barrel plug dimensions 4.0mm x 1.7mm. | ||