Xiaomi Mi Router 4C

→ Install OpenWrt (generic explanation)

1. Скачайте скрипт OpenWRTInvasion
2. Установите python3 и добавьте в PATH если еще не утановлено.
3. Установите зависимости:

   pip3 install -r requirements.txt

4. Войдите в Веб-интерфейс вашего роутера и скопируйте значение stok параметра из URL-адреса в адресной строке вашего браузера.
5. Запустите эксплоит :

   python3 remote_command_execution_vulnerability.py

6. Введите stok и IP-адрес роутера в терминал когда он попросит.
7. Теперь вы имеете доступ к telnet.
8. Залогниньтесь через Telnet. (User: root - No password)
9. Используйте эту команду, что-бы попасть в директорию tmp:

   cd /tmp

10. Скопируйте ссылку на скачивание OpenWrt.
11. Скачайте OpenWrt в директорию tmp:

    wget <Download Link> 

12. Прошейте OpenWrt в OS1:

    mtd -r write /tmp/openwrt.bin OS1

13. Это займет несколько минут и устройство перезагрузится с установленным OpenWrt.

Печатная плата

Печатная плата (Крупным планом)

dev:    size   erasesize  name
mtd0: 01000000 00010000 "ALL"
mtd1: 00020000 00010000 "Bootloader"
mtd2: 00010000 00010000 "Config"
mtd3: 00010000 00010000 "Factory"
mtd4: 00010000 00010000 "crash"
mtd5: 00010000 00010000 "cfg_bak"
mtd6: 00100000 00010000 "overlay"
mtd7: 00c60000 00010000 "OS1"
mtd8: 00af0000 00010000 "rootfs"
mtd9: 00200000 00010000 "disk"

dev:    size   erasesize  name
mtd0: 00020000 00010000 "bootloader"
mtd1: 00010000 00010000 "config"
mtd2: 00010000 00010000 "factory"
mtd3: 00010000 00010000 "crash"
mtd4: 00010000 00010000 "cfg_bak"
mtd5: 00100000 00010000 "overlay"
mtd6: 00ea0000 00010000 "firmware"
mtd7: 002052ab 00010000 "kernel"
mtd8: 00c9ad55 00010000 "rootfs"
mtd9: 00a10000 00010000 "rootfs_data"

0. Consider OpenWrt factory reset first

firstboot && reboot

1. Download STOCK firmware

• miwifi_r4cm_firmware_2.14.80_Chinese.bin
• miwifi_r4cm_firmware 3.0.16_ENG.bin
• miwifi_r4cm_firmware_3.0.23_INT.bin

2. Copy to router

scp miwifi_r4cm_firmware 3.0.16_ENG.bin root@192.168.1.1:/tmp/

3. Write to “firmware” block

mtd -r write /tmp/miwifi_r4cm_firmware 3.0.16_ENG.bin firmware

4. Router will reboot and after few minutes will boot into stock firmware with IP address 192.168.31.1

Using Mi Wifi Repair tool: Mi Wifi download PDF guide (written for R4A gigabit edition)
Numerous antivirus tools report Mi Wifi Repair Tool (files date stamped January 2019) identify it as a 'Potentially Unwanted App'. Unclear whether there is a genuine threat or it is a 'false positive'.

See the photos for break down of where to solder etc. On picture are shown all soldier points for desired pins with markings. Also you must connect 15kOhm resistors to ground from D+ and D- lines.

Software mod

Simple hardware mod does not enable USB, you must enable OHCI and AHCI in board description file and compile appropriate firmware. Board description file is on location

/{your openwrt source location}/openwrt/target/linux/ramips/dts/mt7628an_xiaomi_mi-router-4c.dts

In this file change:

&ehci {
	status = "disabled";
};
&ohci {
	status = "disabled";
};

to

&ehci {
status = "okay";
};
&ohci {
status = "okay";
};

Enable usb kernel module support in “make menuconfig”, compile firmware file and flash it.

You can use 5V power supply from router for powering on USB, but take care because its only 1A of current charge if you connect some power hungry USB peripheral it will make router unstable.

How to add tags