openwrt-xiaomi/xmir-patcher

Firmware patcher for Xiaomi routers

XMiR-Patcher

Firmware patcher for Xiaomi routers

Usage

Windows

• Run run.bat

Linux / Mac OS

• Install python 3.8, openssl
• Run run.sh

xmir-patcher's Issues

Xiaomi Miwifi BE3600

Hello
Will there be an update for Xiaomi Miwifi BE3600 SSH access?
BR

AX3600 3.0.22 exploit don't work + WiFi problem

`Select: 2

device_name = R3600
rom_version = 3.0.22 release
mac address = 9c:7b:ef:a0:d7:fb
Telnet server already running, but FTP server not respond
Enter device WEB password: 12345678
Traceback (most recent call last):
File "connect.py", line 59, in
import connect5
File "D:\xmir-patcher-main\connect5.py", line 264, in
res = get_all_scenes()
File "D:\xmir-patcher-main\connect5.py", line 100, in get_all_scenes
return exec_smart_command("get_scene_setting")
File "D:\xmir-patcher-main\connect5.py", line 93, in exec_smart_command
raise ExploitError(f'Error on exec command "{cmd}" => {res}')
connect5.ExploitError: Error on exec command "get_scene_setting" => {"code":-100,"msg":"connect failed"}`

This exploit also broke Wi-Fi. The router itself works without problems, but it is impossible to start it.

connect to device ERROR: Xiaomi Mi Wi-Fi device not found (IP: 192.168.31.1)

xiaomi router HD(R3D)

Issue installing firmware on RA82 AX3000 INT

Thanks to @remittor for fixing the issue with reading device info from the RA82 so quickly!

The exploit now runs, the script can retrieve the device info, however I'm still having trouble installing firmware.

My router is currently on stock v1.4.21 and I am trying to downgrade to stock v1.3.27 (rx power issues on 1.4.21). I get the following output from the tool:

Detect valid SSH server on port 22 (auth OK)
Image files in directory "firmware/":
"firmware/factory.bin"
Download file: "/tmp/dmesg.log" ....
Download file: "/tmp/mtd_list.txt" ....
Download file: "/tmp/kcmdline.log" ....

ERROR: Kernel data not found!

I have tried installing v1.4.21 also and get the same error. I'm wondering if there is anything extra I need to do in order to successfully flash the RA82 or if it's just not possible?

Thanks in advance.

J

AX1800 和 AX3000解锁ssh失败，telnet和sftp都开启成功

device_name = RM1800
rom_version = 1.0.394 release
mac address = 00:0c:29:36:a3:39
CountryCode = CN
Enter device WEB password: ********
Enable smartcontroller scene executor ...
Wait smartcontroller activation ...
Unlock dropbear service ...
Unlock SSH server ...
Set password "root" for root user ...
Enabling dropbear service ...
Run SSH server on port 22 ...
Test SSH connection to port 22 ...

WARNING: SSH server not responding (IP: 192.168.31.246)

Unlock TelNet server ...
Run TelNet server on port 23 ...

TelNet server are activated!

FTP server are activated!

==========================================================

AX3000T - Error creating full backup

Router: Xiaomi AX3000T
Stock firmware version: 1.0.47

Hello, i'm getting a error when trying to create a full backup. I follow this steps.

Select: 2

device_name = RD03
rom_version = 1.0.47 release
mac address = 00:26:xx:xx:xx:xx
Current CountryCode = CN
Enter device WEB password: ********
Run SSH server on port 22 ...
#### SSH server are activated! ####

After that:

Select: 4

Download file: "/tmp/dmesg.log" ....
Download file: "/tmp/mtd_list.txt" ....
Download file: "/tmp/mtd_info.txt" ....
Download file: "/tmp/mtd_fdt.txt" ....
Download file: "/tmp/kcmdline.log" ....
Download file: "/tmp/dmesg.log" ....
Download file: "/tmp/mtd_list.txt" ....
Download file: "/tmp/mtd_info.txt" ....
Download file: "/tmp/mtd_fdt.txt" ....
Full backup creating...

ERROR: SSH execute command timed out! CMD: "dd if=/dev/mtd0 of=/tmp/mtd_dump.bin"

After that the router reboots.

Then i tried using choice 8 - 4

Choice: 4

Download file: "/tmp/dmesg.log" ....
Download file: "/tmp/mtd_list.txt" ....
Download file: "/tmp/mtd_info.txt" ....
Download file: "/tmp/mtd_fdt.txt" ....
Download file: "/tmp/kcmdline.log" ....
Download file: "/tmp/dmesg.log" ....
Download file: "/tmp/mtd_list.txt" ....
Download file: "/tmp/mtd_info.txt" ....
Download file: "/tmp/mtd_fdt.txt" ....
   0 > addr: 0x00000000  size: 0x08000000  name: "spi0.0"
   1 > addr: 0x00000000  size: 0x00100000  name: "BL2"
   2 > addr: 0x00100000  size: 0x00040000  name: "Nvram"
   3 > addr: 0x00140000  size: 0x00040000  name: "Bdata"
   4 > addr: 0x00180000  size: 0x00200000  name: "Factory"
   5 > addr: 0x00380000  size: 0x00200000  name: "FIP"
   6 > addr: 0x00580000  size: 0x00040000  name: "crash"
   7 > addr: 0x005C0000  size: 0x00040000  name: "crash_log"
   8 > addr: 0x00600000  size: 0x02200000  name: "ubi"
   9 > addr: 0x02800000  size: 0x02200000  name: "ubi1"
  10 > addr: 0x04A00000  size: 0x02000000  name: "overlay"
  11 > addr: 0x06A00000  size: 0x00C00000  name: "data"
  12 > addr: 0x07600000  size: 0x00040000  name: "KF"

Enter partition name or mtd number: 0

ERROR: SSH execute command timed out! CMD: "dd if=/dev/mtd0 of=/tmp/mtd_dump.bin"

And router reboots again.
I had the same issue with 8, 9, 10 and 11 partitions but without reboot. It's possible to be some kind of protection?

Xiaomi WR30U (MB05) looking for help

Hi Remittor ,

Thank you for your great works on Redmi AX6000 for vulnerability exploit on openwrt forum.
We have same problem of getting ssh access of a new device from xiaomi model WR30U (MB05)

Could you please kindly help to look at the device, and give us some guidance of way to exploit.

I have uploaded some resource files to my server hope it helps.
rootfs file https://hquu.net/r/rom/img-857011981_vol-rootfs.ubifs
lua file https://hquu.net/r/rom/wr30u_misystem.lua

You may find related post on forum https://forum.openwrt.org/t/openwrt-support-for-xiaomi-ax3000ne/153769
Thanks!

Error detecting and installing on Xiaomi RC01

Latest version gives error when I try to do anything with Xiaomi RC01:

Read full device info gives

Base info:
  Linux version: None
  DISTRIB_TARGET = ipq95xx/generic
  CPU arch: None
  CPU name: ipq95xx


ERROR: Can't detect CPU arch! Try to reboot device.

Content of /etc/openwrt_release

DISTRIB_ID='OpenWrt'
DISTRIB_RELEASE='18.06-SNAPSHOT'
DISTRIB_REVISION='unknown'
DISTRIB_TARGET='ipq95xx/generic'
DISTRIB_ARCH='aarch64_cortex-a73_neon-vfpv4'
DISTRIB_DESCRIPTION='OpenWrt 18.06-SNAPSHOT unknown'
DISTRIB_TAINTS='no-all busybox override'

Content of /etc/os-release:

NAME="OpenWrt"
VERSION="18.06-SNAPSHOT"
ID="openwrt"
ID_LIKE="lede openwrt"
PRETTY_NAME="OpenWrt 18.06-SNAPSHOT"
VERSION_ID="18.06-snapshot"
HOME_URL="http://openwrt.org/"
BUG_URL="http://bugs.openwrt.org/"
SUPPORT_URL="http://forum.lede-project.org/"
BUILD_ID="unknown"
LEDE_BOARD="ipq95xx/generic"
LEDE_ARCH="aarch64_cortex-a73_neon-vfpv4"
LEDE_TAINTS="no-all busybox override"
LEDE_DEVICE_MANUFACTURER="OpenWrt"
LEDE_DEVICE_MANUFACTURER_URL="http://openwrt.org/"
LEDE_DEVICE_PRODUCT="Generic"
LEDE_DEVICE_REVISION="v0"
LEDE_RELEASE="OpenWrt 18.06-SNAPSHOT unknown"

Personally, adding code

diff --git a/read_info.py b/read_info.py
index fe42cc2..e701cfa 100644
--- a/read_info.py
+++ b/read_info.py
@@ -326,6 +326,8 @@ class DevInfo():
       cpu_arch = 'arm64'
     if cpu_name.startswith('ipq60'):
       cpu_arch = 'arm64'
+    if cpu_name.startswith('ipq95'):
+      cpu_arch = 'arm64'
     ret.cpu_arch = cpu_arch if cpu_arch else None
     ret.cpu_name = cpu_name if cpu_name else None
     if verbose:

fixes problem for me

ERROR It is necessary to reorganize the device into "whc_cap" mode!

I have reset the router to factory settings.
I logged in automatically on http://router.miwifi.com/

I made the first configuration.

Administrator background: 192.168.31.1
Administrator password: 12345678

Run !START.bat and I got an error

==========================================================

Xiaomi MiR Patcher

1 - Set IP-address (current value: 192.168.31.1)
2 - Connect to device (install exploit)
3 - Read full device info
4 - Create full backup
5 - Install EN/RU languages
6 - Install Breed bootloader
7 - Install firmware (from directory "firmware")
8 - {{{ Other functions }}}
9 - [[ Reboot device ]]
0 - Exit

Select: 2

device_name = RB01
rom_version = 1.0.35 release
mac address = 70:85:c2:b1:55:cd
Enter device WEB password: 12345678

ERROR: It is necessary to reorganize the device into "whc_cap" mode!

==========================================================

Xiaomi MiR Patcher

1 - Set IP-address (current value: 192.168.31.1)
2 - Connect to device (install exploit)
3 - Read full device info
4 - Create full backup
5 - Install EN/RU languages
6 - Install Breed bootloader
7 - Install firmware (from directory "firmware")
8 - {{{ Other functions }}}
9 - [[ Reboot device ]]
0 - Exit

Select:

After checking on PC, it looks like this:

telnet 192.168.31.1
XiaoQiang login: root
Password: 12345678
Login incorrect

ssh 192.168.31.1
ssh: connect to host 192.168.31.1 port 22: Connection refused

AX3600 Device List and Network Topology View broken

Hello,
after installing EN/RU languages the Device List and Topology view is broken. Besides that: All network devices are still connected after checking through SSH. I'm using miwifi_r3600_firmware_aba17_1.1.19+SSH+MI+opt+txpwr.bin and two AX3600 in mesh mode.

I've already tried to reflash custom firmware through SSH, after that the menu is again in chinese, but the device list and network topology problem isn't fixed.

Any fix / troubleshooting for this issue?

ERROR: Partition list is empty!

Trying to push in OpenWRT on this Xiaomi AX3200 RB01, which on the OpenWRT forum it apparently is meant to support.
I did the instructions, but when I try to install the firmware, I get this:

Image files in directory "firmware/":
  "firmware/factory.bin"
Download file: "/tmp/dmesg.log" ....

ERROR: Partition list is empty!

(the firmware is the correct one, I just renamed it)
Notably, option 3 and 4 give the same result (read full device info and create full backup respectively)

ax3200 int model 1.0.83 firmware cannot execute exploit

Here is the output

Xiaomi MiR Patcher

1 - Set IP-address (current value: 192.168.31.1)
2 - Connect to device (install exploit)
3 - Read full device info
4 - Create full backup
5 - Install EN/RU languages
6 - Install Breed bootloader
7 - Install firmware (from directory "firmware")
8 - {{{ Other functions }}}
9 - [[ Reboot device ]]
0 - Exit

Select: 2

device_name = RB01
rom_version = 1.0.83 release
mac address = 40:c2:ba:dd:85:7d
Enter device WEB password: test1234
Enable smartcontroller scene executor ...
Wait smartcontroller activation ...
Unlock dropbear service ...
Traceback (most recent call last):
File "d:\python\python38\Lib\site-packages\urllib3/connectionpool.py", line 699, in urlopen
File "d:\python\python38\Lib\site-packages\urllib3/connectionpool.py", line 445, in _make_request
File "", line 3, in raise_from
File "d:\python\python38\Lib\site-packages\urllib3/connectionpool.py", line 440, in _make_request
File "http\client.py", line 1344, in getresponse
File "http\client.py", line 307, in begin
File "http\client.py", line 276, in _read_status
http.client.RemoteDisconnected: Remote end closed connection without response

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "d:\python\python38\Lib\site-packages\requests/adapters.py", line 439, in send
File "d:\python\python38\Lib\site-packages\urllib3/connectionpool.py", line 755, in urlopen
File "d:\python\python38\Lib\site-packages\urllib3/util/retry.py", line 532, in increment
File "d:\python\python38\Lib\site-packages\urllib3/packages/six.py", line 769, in reraise
File "d:\python\python38\Lib\site-packages\urllib3/connectionpool.py", line 699, in urlopen
File "d:\python\python38\Lib\site-packages\urllib3/connectionpool.py", line 445, in _make_request
File "", line 3, in raise_from
File "d:\python\python38\Lib\site-packages\urllib3/connectionpool.py", line 440, in _make_request
File "http\client.py", line 1344, in getresponse
File "http\client.py", line 307, in begin
File "http\client.py", line 276, in _read_status
urllib3.exceptions.ProtocolError: ('Connection aborted.', RemoteDisconnected('Remote end closed connection without response'))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "D:\Downloads\xmir-patcher-main\connect5.py", line 77, in exec_smart_cmd
res = requests.post(gw.apiurl + api, data = { "payload": payload }, timeout = timeout)
File "d:\python\python38\Lib\site-packages\requests/api.py", line 117, in post
File "d:\python\python38\Lib\site-packages\requests/api.py", line 61, in request
File "d:\python\python38\Lib\site-packages\requests/sessions.py", line 542, in request
File "d:\python\python38\Lib\site-packages\requests/sessions.py", line 655, in send
File "d:\python\python38\Lib\site-packages\requests/adapters.py", line 498, in send
requests.exceptions.ConnectionError: ('Connection aborted.', RemoteDisconnected('Remote end closed connection without response'))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "connect.py", line 59, in
import connect5
File "D:\Downloads\xmir-patcher-main\connect5.py", line 329, in
exec_cmd("sed -i 's/release/XXXXXX/g' /etc/init.d/dropbear")
File "D:\Downloads\xmir-patcher-main\connect5.py", line 220, in exec_cmd
exec_tiny_cmd(cmd)
File "D:\Downloads\xmir-patcher-main\connect5.py", line 137, in exec_tiny_cmd
res = exec_smart_cmd(pdata)
File "D:\Downloads\xmir-patcher-main\connect5.py", line 80, in exec_smart_cmd
raise ExploitError(f'Cannot send POST-request "{sc_command}" to SmartController service. {msg}')
connect5.ExploitError: Cannot send POST-request "scene_setting" to SmartController service. ('Connection aborted.', RemoteDisconnected('Remote end closed connection without response'))

==========================================================

Xiaomi MiR Patcher

1 - Set IP-address (current value: 192.168.31.1)
2 - Connect to device (install exploit)
3 - Read full device info
4 - Create full backup
5 - Install EN/RU languages
6 - Install Breed bootloader
7 - Install firmware (from directory "firmware")
8 - {{{ Other functions }}}
9 - [[ Reboot device ]]
0 - Exit

Select:

can you help me?

AX3000T - Unable to connect WiFi after install EN/RU languages

Hello there, i found a issue when installing the EN/RU languages on the AX3000T, after install i was unable to connect to the WiFi. I tried change the password, turn on/off the WiFi, reboot the router, uninstall EN/RU languages and this:

mtd erase crash
reboot

None of them work at all. The only way was a full reset of the system by pressing and hold the reset button. Best regards.

Error to install exploit - AX3000

First of all, thanks for the tool!!! Awesome work.
I have 5 AX3000 (4 Int and 1 Chinese)
I did for 2 exploit and permanent SSH and work, for 2 I get the error below:

device_name = RA82
rom_version = 1.4.31 release
mac address = ******************
Enter device WEB password: *************
Enable smartcontroller scene executor ...
Wait smartcontroller activation ...
============ smartcontroller failed ============
Traceback (most recent call last):
File "d:\python\python38\Lib\site-packages\urllib3/connection.py", line 174, in _new_conn
File "d:\python\python38\Lib\site-packages\urllib3/util/connection.py", line 96, in create_connection
File "d:\python\python38\Lib\site-packages\urllib3/util/connection.py", line 86, in create_connection
socket.timeout: timed out

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "d:\python\python38\Lib\site-packages\urllib3/connectionpool.py", line 699, in urlopen
File "d:\python\python38\Lib\site-packages\urllib3/connectionpool.py", line 394, in _make_request
File "d:\python\python38\Lib\site-packages\urllib3/connection.py", line 239, in request
File "http\client.py", line 1252, in request
File "http\client.py", line 1298, in _send_request
File "http\client.py", line 1247, in endheaders
File "http\client.py", line 1007, in _send_output
File "http\client.py", line 947, in send
File "d:\python\python38\Lib\site-packages\urllib3/connection.py", line 205, in connect
File "d:\python\python38\Lib\site-packages\urllib3/connection.py", line 179, in _new_conn
urllib3.exceptions.ConnectTimeoutError: (<urllib3.connection.HTTPConnection object at 0x0000027E9C4AD2B0>, 'Connection to 172.16.0.4 timed out. (connect timeout=7)')

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "d:\python\python38\Lib\site-packages\requests/adapters.py", line 439, in send
File "d:\python\python38\Lib\site-packages\urllib3/connectionpool.py", line 755, in urlopen
File "d:\python\python38\Lib\site-packages\urllib3/util/retry.py", line 574, in increment
urllib3.exceptions.MaxRetryError: HTTPConnectionPool(host='172.16.0.4', port=80): Max retries exceeded with url: /cgi-bin/luci/;stok=1f80af8895251db6c094065253924eb2/api/xqsmarthome/request_smartcontroller (Caused by ConnectTimeoutError(<urllib3.connection.HTTPConnection object at 0x0000027E9C4AD2B0>, 'Connection to 172.16.0.4 timed out. (connect timeout=7)'))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "xmir-patcher\connect5.py", line 73, in exec_smart_cmd
res = requests.post(gw.apiurl + api, data = { "payload": payload }, timeout = timeout)
File "d:\python\python38\Lib\site-packages\requests/api.py", line 117, in post
File "d:\python\python38\Lib\site-packages\requests/api.py", line 61, in request
File "d:\python\python38\Lib\site-packages\requests/sessions.py", line 542, in request
File "d:\python\python38\Lib\site-packages\requests/sessions.py", line 655, in send
File "d:\python\python38\Lib\site-packages\requests/adapters.py", line 504, in send
requests.exceptions.ConnectTimeout: HTTPConnectionPool(host='172.16.0.4', port=80): Max retries exceeded with url: /cgi-bin/luci/;stok=1f80af8895251db6c094065253924eb2/api/xqsmarthome/request_smartcontroller (Caused by ConnectTimeoutError(<urllib3.connection.HTTPConnection object at 0x0000027E9C4AD2B0>, 'Connection to 172.16.0.4 timed out. (connect timeout=7)'))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "connect.py", line 55, in
import connect5
File "xmir-patcher\connect5.py", line 293, in
res = exec_tiny_cmd("date -s 203301020304")
File "xmir-patcher\connect5.py", line 133, in exec_tiny_cmd
res = exec_smart_cmd(pdata)
File "xmir-patcher\connect5.py", line 76, in exec_smart_cmd
raise ExploitError(f'Cannot send POST-request "{sc_command}" to SmartController service. {msg}')
connect5.ExploitError: Cannot send POST-request "scene_setting" to SmartController service. HTTPConnectionPool(host='172.16.0.4', port=80): Max retries exceeded with url: /cgi-bin/luci/;stok=1f80af8895251db6c094065253924eb2/api/xqsmarthome/request_smartcontroller (Caused by ConnectTimeoutError(<urllib3.connection.HTTPConnection object at 0x0000027E9C4AD2B0>, 'Connection to 172.16.0.4 timed out. (connect timeout=7)')){
"device_ip_addr": "172.16.0.4"
}

"Xiaomi Mi Wi-Fi device not found" despite model seems to be supported

According to xqmodel.py, the model CB0401 should be supported.
However, when I try to run menu item 2, I get the following error:

ERROR: Xiaomi Mi Wi-Fi device not found (IP: 192.168.31.1)

The device currently runs MiWifi firmware 3.0.100 (2023/10/10).

error python3.10 and more

hello you're script works and thank you, but after past order i have the error:

Select: /usr/lib/python3.10/multiprocessing/resource_tracker.py:224: UserWarning: resource_tracker: There appear to be 1 leaked shared_memory objects to clean up at shutdown
warnings.warn('resource_tracker: There appear to be %d '

i have same problem with python 3.1X

AX9000 - After Firmware Installation Reboot nothing happens

Hi,
I have a RA70 with 3.0.48 release.

When installing firmware nothing happens.

==========================================================

Xiaomi MiR Patcher

1 - Set IP-address (current value: 192.168.31.1)
2 - Connect to device (install exploit)
3 - Read full device info
4 - Create full backup
5 - Install EN/RU languages
6 - Install Breed bootloader
7 - Install firmware (from directory "firmware")
8 - {{{ Other functions }}}
9 - [[ Reboot device ]]
0 - Exit

Select: 2

device_name = RA70
rom_version = 3.0.48 release
mac address = a8:5e:45:xx:xx:xx
Telnet server already running, but FTP server not respond
Enter device WEB password: XXXXXXX
Enable smartcontroller scene executor ...
Wait smartcontroller activation ...
[504]
[504]
Unlock dropbear service ...
Unlock SSH server ...
Set password "root" for root user ...
Enabling dropbear service ...
Run SSH server on port 22 ...
Test SSH connection to port 22 ...

SSH server are activated!

==========================================================

Xiaomi MiR Patcher

1 - Set IP-address (current value: 192.168.31.1)
2 - Connect to device (install exploit)
3 - Read full device info
4 - Create full backup
5 - Install EN/RU languages
6 - Install Breed bootloader
7 - Install firmware (from directory "firmware")
8 - {{{ Other functions }}}
9 - [[ Reboot device ]]
0 - Exit

Select: 7

device: "RA70"
img_write = True
Image files in directory "firmware/":
"firmware/openwrt-qualcommax-ipq807x-xiaomi_ax9000-initramfs-factory.ubi"
Download file: "/tmp/dmesg.log" ....
Download file: "/tmp/mtd_list.txt" ....
Download file: "/tmp/mtd_addr.txt" ....
Download file: "/tmp/kcmdline.log" ....
Parse all images...
UBI: filetype: b'UBI#'
UBI: Decoding UBIFS...
UBI: volume: "kernel" size: 12697600
parse_ubifs = 1
FIT size = 0xC117D4 (12357 KiB)
FIT: name = "ARM64 OpenWrt FIT (Flattened Image Tree)"
FIT: def_cfg: "config@hk14"
FIT: def_fdt: "fdt-1"
FDT: desc = "ARM64 OpenWrt xiaomi_ax9000 device tree blob"
FDT: type = "flat_dt"
FDT: arch = "arm64"
KRN: desc = "ARM64 OpenWrt Linux-6.1.60"
KRN: type = "kernel"
KRN: arch = "arm64"
KRN: compression = "gzip"
KRN: data = 12606614 bytes
FDT: compatible = ['xiaomi,ax9000', 'qcom,ipq8074']
FDT: model = "Xiaomi AX9000"
FDT: dt_part: ['/soc/nand-controller@79b0000/nand@0/partitions']
FIT: detect initrd into kernel image
fw_img: 13056 KiB | kernel: 12357 KiB | rootfs: 1 KiB
Download file: "/tmp/bl_0SBL1.bin" ....
Download file: "/tmp/bl_0APPSBL.bin" ....
Download file: "/tmp/env_0APPSBLENV.bin" ....
Download file: "/tmp/env_bdata.bin" ....
Download file: "/tmp/env_0SBL1.bin" ....
current flag_boot_rootfs = 0
install_method = 200
--------- prepare command lines -----------
fw_img: 13056 KiB | kernel: 12357 KiB | rootfs: 1 KiB
------------- flash images -------------
Upload file: "tmp/fw/fw_img.bin" ....
Run scripts for change NVRAM params...
Boot from firmware [1] activated.
Writing firmware image to addr 0x04980000 ...
mtd -e "rootfs_1" write "/tmp/fw_img.bin" "rootfs_1"
The firmware has been successfully flashed!
Send command "reboot" via SSH/Telnet ...

ERROR: SSH execute command timed out! CMD: "reboot -f"

==========================================================

Device now reboots and its still the same firmware as before.

Error creating full backup

Router: Redmi AC2100
Stock firmware version: 2.0.23

Select: 4

Download file: "/tmp/dmesg.log" ....
Download file: "/tmp/mtd_list.txt" ....
Download file: "/tmp/mtd_addr.txt" ....
Download file: "/tmp/kcmdline.log" ....
Download file: "/tmp/dmesg.log" ....
Download file: "/tmp/mtd_list.txt" ....
Download file: "/tmp/mtd_addr.txt" ....
Full backup creating...

ERROR: SSH execute command timed out! CMD: "dd if=/dev/mtd0 of=/tmp/mtd_dump.bin"

After this error web get "502 Bad Gateway" and tool no more work. And need to reboot router for fix it.

Firmware AX5400 CB401 ?

Firmware AX5400 CB401 ?

No Found