miaoer

Youtube

Start#

The Redmi Router AX6000 is a mid-range wireless router released by Xiaomi.

It is equipped with the MediaTek Filogic 830, which has been tested to be close to entry-level dual-core soft routing.

It can meet gigabit internet needs, and its performance can be described as very strong.

This tutorial is neither about non-expansion flashing (partition) nor expansion flashing, but about U-Boot flashing.

I believe the U-Boot flashing part is quite enjoyable, although there are many recovery conditions. Listen to me explain them one by one, and I believe you can handle it.

I recommend that flashing carries risks, and you should proceed with caution! It is advisable to watch the entire video before attempting to flash.

I also took the risk of bricking the device and stayed up all night to fix firmware issues. I have already stepped into the pitfalls for you; isn't it worth a one-click three-link?

Preparation#

This time we will use:

• Redmi AX6000 wireless router
• Two network cables
• Toothpick (or SIM card ejector)
• WinSCP
• Telnet/SSH client
• Xiaomi router firmware version 1.2.8
• CatWrt for Redmi AX6000

Recovery requirements

• Xiaomi router official recovery tool
• Xiaomi router firmware version 1.0.48

Attachment Download Extraction code: miao

The firmware paired with this video has been updated, see CatWrt-v23.8

If you encounter problems, check the answer blog below (not mentioned in the video) 👇👇👇

¹

Install Related Software#

Download the attachments provided in the video blog, and extract them to a location you know.

Demonstrating the installation of Telnet, press the Windows key on the keyboard and type Add or Remove Programs, select Optional Features, scroll to the bottom, select More Windows Features, and check the box next to Telnet Client, so Telnet will be installed.

Open the WinSCP installation package in the attachment, choose to install for all users, and agree to proceed in the UAC.

Downgrade#

Because unlocking requires the Xiaomi MiWiFi firmware to be version 1.2.8.

In the Xiaomi router backend (192.168.31.1), select system update in the upper right corner, then click manual update.

Select the firmware version 1.2.8 that you just downloaded, and the system will downgrade or update to 1.2.8.

After rebooting, re-enter the backend.

As "For security reasons, it is not allowed to select firmware lower than the current version number for upgrade" ## Downgrade Prohibited

Unlock Telnet#

Enable Debug Mode#

In the browser address bar, enter http://192.168.31.1/cgi-bin/luci/;stok=1145141919.

Copy the stok after the Xiaomi router address, such as 1145141919 here, replace the link provided in the blog, and then press Enter.

::: banner {info}
You can click the COPY button on the right to quickly copy here.
:::

http://192.168.31.1/cgi-bin/luci/;stok={token}/api/misystem/set_sys_time?timezone=%20%27%20%3B%20zz%3D%24%28dd%20if%3D%2Fdev%2Fzero%20bs%3D1%20count%3D2%202%3E%2Fdev%2Fnull%29%20%3B%20printf%20%27%A5%5A%25c%25c%27%20%24zz%20%24zz%20%7C%20mtd%20write%20-%20crash%20%3B%20

If the API outputs {"code":0}, it means our steps are correct, and we can continue.

Also replace the stok in the reboot link; I don't know why it needs to be rebooted this way, but since the tutorial says so, just do it~ Enter and press Enter.

http://192.168.31.1/cgi-bin/luci/;stok={token}/api/misystem/set_sys_time?timezone=%20%27%20%3b%20reboot%20%3b%20

Enable Telnet#

After the machine reboots, re-enter the Xiaomi router backend, copy the stok again, and note that the stok after reboot may be different, so don't get confused.

http://192.168.31.1/cgi-bin/luci/;stok={token}/api/misystem/set_sys_time?timezone=%20%27%20%3B%20bdata%20set%20telnet_en%3D1%20%3B%20bdata%20set%20ssh_en%3D1%20%3B%20bdata%20set%20uart_en%3D1%20%3B%20bdata%20commit%20%3B%20

After successfully executing the API, it will also output {"code":0}. Then enter the following link, replace it, and press Enter; the router will reboot.

http://192.168.31.1/cgi-bin/luci/;stok={token}/api/misystem/set_sys_time?timezone=%20%27%20%3b%20reboot%20%3b%20

Unlock SSH#

After rebooting, our Telnet is enabled. We connect to the Xiaomi router in cmd or Windows Terminal, referred to as terminal here, by typing telnet 192.168.31.1.

You can enter Telnet, and next, we need to unlock SSH to complete the U-Boot flashing.

Special thanks to @Timochan for writing the unlocking script specifically for this episode, I am very grateful.

Copy the following code directly by pressing COPY with the mouse, no need to select and copy.

cd /tmp && curl --silent -O https://service.miaoer.xyz/unlock-redmi-ax6000/cn/server/setup.sh && chmod +x setup.sh && ./setup.sh

After execution, it will prompt that the connection to the host is lost. This indicates that the SSH unlocking script has executed successfully and rebooted.

After rebooting, enter the terminal and type ssh [email protected].

Password: admin, press Enter. For the first connection, type yes to save the key and press Enter.

You can enter SSH now.

Backup and Flash U-Boot#

Next, we will use the modified compiled U-Boot and accompanying scripts from @hanwckf.

First, back up the original boot partition, then download U-Boot.

cd /tmp && curl --silent -O https://service.miaoer.xyz/unlock-redmi-ax6000/cn/server/uboot.sh && chmod +x uboot.sh && ./uboot.sh

After completion, a piece of code will scroll by, with the front part downloading and verifying the hash value of the U-Boot file, backing up the boot partition, and prompting.

The prompt "Backup success! Please download it to your computer" indicates a successful backup; please download it to your computer.

We will use WinSCP to connect to the Xiaomi router, select scp as the protocol, and fill in 192.168.31.1.

Username root, password admin, click connect, agree to save and trust the certificate file.

If you default to the /root directory, double-click .. to return to the root directory.

Enter the /tmp directory to see mtd4_Factory.bin and mtd5_FIP.bin. Select these two files to copy or drag them directly to your local directory. If needed, you can back them up elsewhere.

This is very important; without it, you cannot restore to the original Xiaomi system!

While saving, I spotted the U-Boot file. Actually, you don't need to worry about whether the U-Boot script has downloaded successfully; if it hasn't, the script will prompt relevant errors.

For example: Error: mt7986_redmi_ax6000-fip-fixed-parts.bin download failed and Error: mt7986_redmi_ax6000-fip-fixed-parts.bin md5 is not correct.

Next, we will flash the U-Boot file to the local machine. Here, it is emphasized that you need to enter the following commands in the terminal in order; this is very important!

mtd erase FIP
mtd write /tmp/mt7986_redmi_ax6000-fip-fixed-parts.bin FIP
mtd verify /tmp/mt7986_redmi_ax6000-fip-fixed-parts.bin FIP

Refer to the output; a prompt of Success is sufficient, and the content needs to be exactly the same.

root@XiaoQiang:~# mtd erase FIP
Unlocking FIP ...
Erasing FIP ...
root@XiaoQiang:~# mtd write /tmp/mt7986_redmi_ax6000-fip-fixed-parts.bin FIP
Unlocking FIP ...

Writing from /tmp/mt7986_redmi_ax6000-fip-fixed-parts.bin to FIP ...
root@XiaoQiang:~# mtd verify /tmp/mt7986_redmi_ax6000-fip-fixed-parts.bin FIP
Verifying FIP against /tmp/mt7986_redmi_ax6000-fip-fixed-parts.bin ...
72a110768c7473200b863a3c5d4dd975 - FIP
72a110768c7473200b863a3c5d4dd975 - /tmp/mt7986_redmi_ax6000-fip-fixed-parts.bin
Success
root@XiaoQiang:~#

U-Boot#

::: banner {warning}
In the next steps, port 1 will serve as the WAN port, and ports 2, 3, and 4 will serve as LAN; adaptive support is not available!

Please connect the network cable to any LAN port 2, 3, or 4.
:::

Next, we need to set a static address for U-Boot.

Click the Windows key in the lower left corner of the keyboard and type Control Panel, press Enter, open Control Panel - View Network Status and Tasks, select Ethernet - Properties - Internet Protocol Version 4 (TCP/IPv4) - Properties.

Or in Windows Settings IP Allocation - Edit - IPv4.

Select Use the following IP address, and fill in:

IP Address: 192.168.31.2

Subnet Mask: 255.255.255.0

Gateway Address: 192.168.31.1

If you use Windows Settings instead of Control Panel, you also need to add Preferred DNS: 192.168.31.1 (not demonstrated in the video).

Click OK.

Tip: At this time, U-Boot will not light up the LED; you can observe whether the network port on the computer is flashing to check if the router is running. You can press reset multiple times, but it should not be less than 15 seconds!

Next, unplug the power from the Redmi AX6000, insert the toothpick into the router's reset hole while plugging in the power, hold it while mentally counting to 15 seconds, then release the reset.

You will enter the U-Boot program compiled by the master. Here, click to select the file and find the firmware I compiled for CatWrt For RedmiAX6000.

The full name is catwrt-v22.12-mediatek-filogic-xiaomi_redmi-router-ax6000-squashfs-sysupgrade.bin.

Then click Update; the firmware will be uploaded to U-Boot. Click to flash, and it will check whether your package is compatible.

The first time here, I was prompted with Update Failed error, which is normal. Return and upload the firmware again.

This time, it flashed the firmware easily, and when the message Upgrade complete! appears along with the LED white light, the U-Boot part is complete.

Settings#

::: banner {warning}
Entering U-Boot requires setting a static address; when returning to OpenWrt, you need to switch from static to DHCP for automatic acquisition.
:::

The default address of the firmware is 192.168.1.4.

Here, we need to change the static address we set earlier to DHCP for automatic acquisition.

Log in to the router backend in the browser 192.168.1.4.

Username root, Password password.

You can enter CatWrt.

First, we need to set the LAN port configuration. Click Network - Interfaces - LAN - Edit.

We will not change the address; it is fine as it is.

Gateway: set this to the local address 192.168.1.4.

Broadcast: set this to 192.168.1.0.

DNS: I set the public DNS addresses of Alibaba and Tencent to 119.29.29.99, 223.5.5.5.

IPv6 is enabled by default; DHCP is also set to start at 50, but I prefer to change it to 20; it varies from person to person.

For the IPv6 DNS, we set it to 240C::6666.

Save and apply. If you modified the local address, the router may spin indefinitely, so you need to restart and re-enter your address in the address bar.

Next, set the WAN port. Click Network - Interfaces - WAN - Edit.

If you are dialing with an optical modem, there is no need to modify this. If you are bridging the optical modem and dialing with the router, change this to PPPoE protocol, click to switch the protocol, and fill in the broadband account and password.

Save and apply.

Next, optimize the settings. Find Turbo ACC under the network for network acceleration.

PS: Later, I consulted with the Dark Cloud master, and hardware acceleration has been integrated into the open-source Flow Offloading, so there is no need to worry about performance issues under gigabit.

Traffic offloading is Flow Offloading, and the MediaTek HNAT hardware acceleration has not been enabled, which is still a slight regret that needs to wait for support from Lean and others.

Here, you only need to enable DNS caching and keep a few DNS; I only keep the DNS of Alibaba and Tencent.

Then we open the services and find UPNP, check Enable UPnP and NAT-PMP services to enable UPNP.

Note that OpenWrt's port forwarding can use Socat for forwarding IPv4/v6 ports.

The wireless part can be set simply; it can be used normally as it uses open-source wireless drivers instead of closed-source ones. The Mesh function is also disabled; I have tried compiling simple Mesh in LEDE, but it has failed.

Other functions can be researched by yourself. I have also compiled the software source as a small supplement; those interested can learn about it.

Since we just modified the LAN port configuration, restart the Redmi AX6000 to use it normally.

Performance#

I only have 300-400Mbps broadband internet performance, and the CPU usage is only about 30%.

CpuMark: 27555.110220 Scores close to entry-level dual-core soft routing standards.

chacha20-poly1305

aes-256-gcm

4k videos can also easily surpass 200,000.

Flash Back to Xiaomi Original Firmware#

If you are not satisfied with the functions of OpenWrt or the wireless part and want to flash back to the original system, it is also possible.

::: banner {error}
If you have flashed other firmware using U-Boot, it may not include kmod-mtd-rm, which means you cannot unlock partitions and restore. Please use CatWrt v22.12 for recovery.
:::

Restore Partition#

First, we will use WinSCP to connect to the Redmi AX6000. At this time, the machine is still running the CatWrt I compiled.

Upload the previously backed up mtd5_FIP.bin partition file to the /tmp directory, then execute the command to unlock the FIP partition to restore the official U-Boot partition.

insmod mtd-rw.ko i_want_a_brick=1
md5sum /tmp/mtd5_FIP.bin
mtd write /tmp/mtd5_FIP.bin FIP
mtd verify /tmp/mtd5_FIP.bin FIP

After that, you can cut the power and use the Xiaomi official recovery tool to repair it.

Xiaomi Recovery Tool#

There are several precautions for the Xiaomi recovery tool. First, temporarily turn off Windows Defender Firewall and antivirus software. If you have multiple network cards, remember to disable the extra network cards, and unplug the WAN port network cable (port 1) and power cable.

In the Xiaomi official recovery tool, select the official firmware we pre-downloaded, and proceed.

Next, use a toothpick to poke into the reset hole while plugging in the power, and hold it until the blue LED light stays on and turns into an orange blinking light, then release the reset.

After a while, a flashing window will appear, wait for the progress to complete, and the blue LED light on the router will blink, prompting you to unplug the power and restart.

We unplug the power, plug it back in, and wait a bit to restore the original firmware.

End#

This video ends here. The firmware for the Redmi AX6000 has a few small regrets, such as the 160MHz not being tested yet, which requires everyone to test it themselves.

In the status overview, you will see a mysterious 2.5G eth0, but actually, no interfaces are bound in it.

Overall, developing this Redmi AX6000 package was not difficult for me; the challenging part was the script that was handled for us. Special thanks to Timochan for the PR script, and to the boss for purchasing and providing the machine for adaptation. Whether I need to flash x-wrt or CatWrt still depends on you.

Finally, those who flashed our CatWrt can join our fan group. Thank you all for your support. I am Miao Er, and see you in the next home data center.

Help#

Firmware support is not perfect, and bugs are inevitable. If you encounter problems, leave a comment below or join the group to inquire. If you use my firmware, you can ask for simple advice; if it’s paid, that would be even better. If you use someone else's firmware, I won't respond!

• Buy the author a milk tea: Sponsor
• CatWrt QQ group (problem handling): 669190476
• Telegram Group: Miao Er's Exchange

Feel free to leave comments to encourage ( ´･･) ﾉ (._.`)

References#

U-Boot

Tutorial for Unlocking Telnet/SSH

Tutorial for Flashing U-Boot

Unlock SSH Permissions

unlock-redmi-ax6000

Video shooting authorized by @Kaka's Dabble Diary

Thanks to the masters for answering questions about the wireless driver part of CatWrt.

Thanks to the Dark Cloud master for answering questions about hardware acceleration.

This article is synchronized and updated to xLog by Mix Space. The original link is https://www.miaoer.net/posts/network/flash-redmi-ax6000