Xiaomi Mi AIoT Router AX3600 Firmware Collection and Related Information

I. Specifications

II. Stock ROM collection

III. Enable OpenSSH on stock firmware

1. Downgrade the firmware

To enable OpenSSH, first downgrade to a vulnerable firmware version. Log in to the router and downgrade to 1.0.17 using the Xiaomi CDN or mirror . The router reboots after the downgrade.

 Screenshots

2. Enable OpenSSH

After reboot, log in again. The URL contains a stok token:

http://192.168.31.1/cgi-bin/luci/;stok=d2d55f6e595e236044bfff0b444e2c51/web/home#router

Replace the remainder of the URL as follows, keeping your own stok value:

http://192.168.31.1/cgi-bin/luci/;stok=d2d55f6e595e236044bfff0b444e2c51/api/misystem/set_config_iotdev?bssid=Xiaomi&user_id=longdike&ssid=-h%3Bnvram%20set%20ssh%5Fen%3D1%3B%20nvram%20commit%3B

Press Enter. When the browser returns {"code":0}, run the second URL:

http://192.168.31.1/cgi-bin/luci/;stok=d2d55f6e595e236044bfff0b444e2c51/api/misystem/set_config_iotdev?bssid=Xiaomi&user_id=longdike&ssid=-h%3B%20nvram%20set%20ssh_en%3D1%3B%20nvram%20commit%3B%20sed%20-i%20's%2Fchannel%3D.*%2Fchannel%3D%5C%22debug%5C%22%2Fg'%20%2Fetc%2Finit.d%2Fdropbear%3B%20%2Fetc%2Finit.d%2Fdropbear%20start%3B

Log in over SSH with username root. Get the root password from the serial number:

Nhập vào mã SN có dạng: 12345/A1BC23456 vào trường bên dưới và nhấn Calculate

SN phân biệt chữ HOA chữ thường và không chứa khoảng trắng (dấu cách)

Calculate

Nhấn nút Copy để sao chép Password được tạo.

Copy

Alternatively, use this URL to change the root password to admin:

http://192.168.31.1/cgi-bin/luci/;stok=d2d55f6e595e236044bfff0b444e2c51/api/misystem/set_config_iotdev?bssid=Xiaomi&user_id=longdike&ssid=-h%3B%20echo%20-e%20'admin%5Cnadmin'%20%7C%20passwd%20root%3B

IV. Unofficial firmware

QSDK firmware

QSDK firmware is supplied by Qualcomm to vendors for customization. Its drivers are usually closed source and optimized for the device. The shared AX3600 build is based on OpenWrt 19.07 and kernel 5.4.89.

Enable the required environment variables over SSH:

1
2
3
4
5
6
7

nvram set flag_last_success=0
nvram set flag_boot_rootfs=0
nvram set boot_wait=on
nvram set uart_en=1
nvram set telnet_en=1
nvram set ssh_en=1
nvram commit

Use TFTP to copy xiaomimtd12.bin to /tmp, then run:

1

mtd write /tmp/xiaomimtd12.bin rootfs

Open the QSDK interface at 192.168.1.1, upgrade nand-ipq807x-single.img, and flash it once more after the partition table has changed. Finally, switch boot to the larger rootfs_1 partition:

1
2

fw_setenv flag_last_success 0
fw_setenv flag_boot_rootfs 0

Reference: right.com.cn