AX6S Hardware Configuration

CPU: MediaTek MT7622B, 2-core A53
Flash: 128 MB NAND
RAM: 256 MB
https://www.mi.com/global/product/xiaomi-router-ax3200/

Custom OpenWrt Build for the AX6S

Install Linux First; Ubuntu LTS Is Recommended

Install Build Dependencies

1
2
3
4
5
6
7
8

sudo apt update -y
sudo apt full-upgrade -y
sudo apt install -y ack antlr3 asciidoc autoconf automake autopoint binutils bison build-essential \
bzip2 ccache cmake cpio curl device-tree-compiler fastjar flex gawk gettext gcc-multilib g++-multilib \
git gperf haveged help2man intltool libc6-dev-i386 libelf-dev libglib2.0-dev libgmp3-dev libltdl-dev \
libmpc-dev libmpfr-dev libncurses5-dev libncursesw5-dev libreadline-dev libssl-dev libtool lrzsz \
mkisofs msmtp nano ninja-build p7zip p7zip-full patch pkgconf python2.7 python3 python3-pip libpython3-dev qemu-utils \
rsync scons squashfs-tools subversion swig texinfo uglifyjs upx-ucl unzip vim wget xmlto xxd zlib1g-dev

Download the Source, Update Feeds, and Select the Configuration

1
2
3
4
5

git clone https://github.com/coolsnowwolf/lede
cd lede
./scripts/feeds update -a
./scripts/feeds install -a
make menuconfig

1. Select Target Profile.
   

2. Select LuCI -> Applications ->.

Common applications:

Select the features you need, save the configuration, and exit after all selections are complete.

Download the dl Directory and Build the Firmware

The value after -j is the thread count. For the first build, using a single thread is recommended.

1
2

make download -j8
make V=s -j1

After the build succeeds, the firmware files are located under ~/lede/bin/targets/mediatek/mt7622/.

Unlocking and Flashing the AX6S

Flash the Redmi Test Firmware

You must flash the test firmware first before telnet can be used for later operations on the AX6S. Test firmware: miwifi_rb03_firmware_stable_1.2.7.bin

Calculate the Telnet Password

The calculation requires the router serial number. You can find it on the label on the back of the device, and it is also available in the router management interface.

Many online calculators are no longer available. You can run the Python script below locally:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

#!/usr/bin/env python3
import sys
import hashlib

if sys.version_info < (3,7):
    print("python version is not supported", file=sys.stderr)
    sys.exit(1)

# credit goes to zhoujiazhao:
# https://blog.csdn.net/zhoujiazhao/article/details/102578244

salt = {'r1d': 'A2E371B0-B34B-48A5-8C40-A7133F3B5D88',
        'others': 'd44fb0960aa0-a5e6-4a30-250f-6d2df50a'}


def get_salt(sn):
    if "/" not in sn:
        return salt["r1d"]

    return "-".join(reversed(salt["others"].split("-")))


def calc_passwd(sn):
    passwd = sn + get_salt(sn)
    m = hashlib.md5(passwd.encode())
    return m.hexdigest()[:8]


if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <S/N>")
        sys.exit(1)

    serial = sys.argv[1]
    print(calc_passwd(serial))

1
2

abc@openwrt-build:~$ python calc_ax6s_pwd.py SN
00d135eb

The output is the telnet password.

Connect to the AX6S by Telnet

First confirm the router IP address. You can check the LAN address from the management interface of the network the router is connected to. For example, my router IP address is 192.168.0.121. Open a terminal and run:

1

telnet 192.168.0.121

Username: root
Password: the password calculated above

After logging in successfully, run:

1
2
3

nvram set ssh_en=1 && nvram set uart_en=1 && nvram set boot_wait=on && nvram set bootdelay=3 && nvram set flag_try_sys1_failed=0 && nvram set flag_try_sys2_failed=1
nvram set flag_boot_rootfs=0 && nvram set "boot_fw1=run boot_rd_img;bootm" && nvram set flag_boot_success=1 && nvram commit 
/etc/init.d/dropbear enable && /etc/init.d/dropbear start

After the commands succeed, SCP will be enabled. Use SCP to upload the firmware to the router.

Upload the Firmware

On Windows, connect to the router with WinSCP. Upload the compiled file openwrt-mediatek-mt7622-xiaomi_redmi-router-ax6s-squashfs-factory.bin to /tmp/ and rename it to factory.bin.

Flash the Firmware

Run the following command in the telnet session:

1

mtd -r write /tmp/factory.bin firmware

After flashing, the router will reboot. The default information after reboot is:

IP address: 192.168.1.1
User: root
Password: password

Recovery After Flashing Problems

• Download the Xiaomi router repair tool:
  https://bigota.miwifi.com/xiaoqiang/tools/MIWIFIRepairTool.x86.zip

• Usage notes:
  AX6S is not listed in the supported models, but it worked in my test. The PC repair tool needs system privileges to change network adapter settings, so antivirus software must be disabled before use.
  https://web.vip.miui.com/page/info/mio/mio/detail?postId=19134127&app_version=dev.20051