Build and Flash Custom OpenWrt Firmware for the Redmi AX6S Router

Sun, 04 Sep 2022 00:00:00 +0000

AX6S Hardware Configuration

CPU: MediaTek MT7622B, 2-core A53
Flash: 128 MB NAND
RAM: 256 MB
https://www.mi.com/global/product/xiaomi-router-ax3200/

Custom OpenWrt Build for the AX6S

Install Linux First; Ubuntu LTS Is Recommended

Install Build Dependencies

sudo apt update -y
sudo apt full-upgrade -y
sudo apt install -y ack antlr3 asciidoc autoconf automake autopoint binutils bison build-essential \
bzip2 ccache cmake cpio curl device-tree-compiler fastjar flex gawk gettext gcc-multilib g++-multilib \
git gperf haveged help2man intltool libc6-dev-i386 libelf-dev libglib2.0-dev libgmp3-dev libltdl-dev \
libmpc-dev libmpfr-dev libncurses5-dev libncursesw5-dev libreadline-dev libssl-dev libtool lrzsz \
mkisofs msmtp nano ninja-build p7zip p7zip-full patch pkgconf python2.7 python3 python3-pip libpython3-dev qemu-utils \
rsync scons squashfs-tools subversion swig texinfo uglifyjs upx-ucl unzip vim wget xmlto xxd zlib1g-dev

Download the Source, Update Feeds, and Select the Configuration

git clone https://github.com/coolsnowwolf/lede
cd lede
./scripts/feeds update -a
./scripts/feeds install -a
make menuconfig

Select Target Profile.
Select LuCI -> Applications ->.

	Meaning
[ * ]	Selected
[ ]	Not selected
< M >	Build as a module

Common applications:

Name	Menu Path	Description
luci-app-adbyby-plus	Services -> Adbyby Plus+	Provides ad blocking for devices on the same network.
luci-app-aliddns	Services -> AliDDNS	Aliyun DDNS resolution.
luci-app-ddns	Services -> Dynamic DNS	Dynamic DNS; does not support AliDDNS.
luci-app-autoreboot	System -> Scheduled Reboot	Configure scheduled reboot.
luci-app-arpbind	Network -> IP/MAC Binding	Bind IP and MAC addresses.
luci-app-filetransfer	System -> File Transfer	Transfer files into the OpenWrt filesystem.
luci-app-firewall	Network -> Firewall	Firewall configuration.
luci-app-frpc	Services -> Frp Client	Frp intranet penetration client.
luci-app-frps	Services -> Frps	Frp intranet penetration server.
luci-app-guest-wifi	Network -> Guest Wi-Fi	Guest Wi-Fi network.
luci-app-nlbwmon	Bandwidth Monitor	All functions under the bandwidth monitoring menu.
luci-app-qos	Network -> QoS	Quality of Service; set traffic priorities by class.
luci-app-ssr-plus	Services -> ShadowSocksR Plus+	Proxy plugin selector.
luci-app-turboacc	Network -> Turbo ACC	Network acceleration.
luci-app-unblockmusic	No menu	Unlock NetEase Cloud Music.
luci-app-upnp	Services -> UPnP	Universal Plug and Play (UPnP).
luci-app-vlmcsd	Services -> KMS Server	Microsoft product activation server.
luci-app-wireguard	Network -> Interfaces	View connection status under Status -> WireGuard Status.
luci-app-wol	Services -> Wake-on-LAN	Wake-on-LAN.

Select the features you need, save the configuration, and exit after all selections are complete.

Download the `dl` Directory and Build the Firmware

The value after -j is the thread count. For the first build, using a single thread is recommended.

1
2

make download -j8
make V=s -j1

After the build succeeds, the firmware files are located under ~/lede/bin/targets/mediatek/mt7622/.

Use Case	File
First-time flashing	openwrt-mediatek-mt7622-xiaomi_redmi-router-ax6s-squashfs-factory.bin
Upgrade from OpenWrt	openwrt-mediatek-mt7622-xiaomi_redmi-router-ax6s-squashfs-sysupgrade.bin

Unlocking and Flashing the AX6S

Flash the Redmi Test Firmware

You must flash the test firmware first before telnet can be used for later operations on the AX6S. Test firmware: miwifi_rb03_firmware_stable_1.2.7.bin

Calculate the Telnet Password

The calculation requires the router serial number. You can find it on the label on the back of the device, and it is also available in the router management interface.

Many online calculators are no longer available. You can run the Python script below locally:

#!/usr/bin/env python3
import sys
import hashlib

if sys.version_info < (3,7):
    print("python version is not supported", file=sys.stderr)
    sys.exit(1)

# credit goes to zhoujiazhao:
# https://blog.csdn.net/zhoujiazhao/article/details/102578244

salt = {'r1d': 'A2E371B0-B34B-48A5-8C40-A7133F3B5D88',
        'others': 'd44fb0960aa0-a5e6-4a30-250f-6d2df50a'}


def get_salt(sn):
    if "/" not in sn:
        return salt["r1d"]

    return "-".join(reversed(salt["others"].split("-")))


def calc_passwd(sn):
    passwd = sn + get_salt(sn)
    m = hashlib.md5(passwd.encode())
    return m.hexdigest()[:8]


if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <S/N>")
        sys.exit(1)

    serial = sys.argv[1]
    print(calc_passwd(serial))

1
2

abc@openwrt-build:~$ python calc_ax6s_pwd.py SN
00d135eb

The output is the telnet password.

Connect to the AX6S by Telnet

First confirm the router IP address. You can check the LAN address from the management interface of the network the router is connected to. For example, my router IP address is 192.168.0.121. Open a terminal and run:

`1`	`telnet 192.168.0.121`

Username: root
Password: the password calculated above

After logging in successfully, run:

1
2
3

nvram set ssh_en=1 && nvram set uart_en=1 && nvram set boot_wait=on && nvram set bootdelay=3 && nvram set flag_try_sys1_failed=0 && nvram set flag_try_sys2_failed=1
nvram set flag_boot_rootfs=0 && nvram set "boot_fw1=run boot_rd_img;bootm" && nvram set flag_boot_success=1 && nvram commit 
/etc/init.d/dropbear enable && /etc/init.d/dropbear start

After the commands succeed, SCP will be enabled. Use SCP to upload the firmware to the router.

Upload the Firmware

On Windows, connect to the router with WinSCP. Upload the compiled file openwrt-mediatek-mt7622-xiaomi_redmi-router-ax6s-squashfs-factory.bin to /tmp/ and rename it to factory.bin.

Flash the Firmware

Run the following command in the telnet session:

`1`	`mtd -r write /tmp/factory.bin firmware`

After flashing, the router will reboot. The default information after reboot is:

IP address: 192.168.1.1
User: root
Password: password

Recovery After Flashing Problems

Download the Xiaomi router repair tool:
https://bigota.miwifi.com/xiaoqiang/tools/MIWIFIRepairTool.x86.zip
Usage notes:
AX6S is not listed in the supported models, but it worked in my test. The PC repair tool needs system privileges to change network adapter settings, so antivirus software must be disabled before use.
https://web.vip.miui.com/page/info/mio/mio/detail?postId=19134127&app_version=dev.20051

Router Firmware on KnightLi Blog