Xiaomi CR660x: ROM Collection, OpenSSH, and Related Tips

Mục Lục

Xiaomi CR660x uses the carrier number as its suffix: CR6606 is China Unicom, CR6608 is China Mobile, and CR6609 is China Telecom. The hardware is essentially the same, so the firmware and SSH procedure are similar.
Most units imported into Vietnam are CR6608.
Warning: The procedures below are collected from community reports and were not all tested by me. Following them means accepting the risk. I am not responsible for damage, although I will try to help when possible.

Overview

SoC/CPU: MediaTek MT7621AT dual-core, 4-thread, 880MHz
RAM: 256MB DDR3 (ESMT M15T2G16128A)
Flash/ROM: 128MB NAND (ESMT F59L1G81MB)
Ports: 4 Gigabit LAN ports, Auto MDI/MDIX (MT7530 SoC)
Wi-Fi: 2x2 2.4GHz 574Mbps (MT7905DAN, Wi-Fi 6) / 2x2 5GHz 1201Mbps (MT7975DN, Wi-Fi 6)
Antennas: 4 external omnidirectional 5dBi antennas
LEDs: 2
Reset buttons: 1
WPS/Mesh button: 1
Standards: IEEE 802.11 a/b/g/n/ac/ax, IEEE 802.3 3u/3ab
Features: MU-MIMO, Beamforming, BSS Coloring, WPA3, IPv6...

If the router already has PB-Boot installed, jump to Custom CR660x firmware .

OpenSSH and PB-Boot

If the CR660x was purchased with OpenWrt or Padavan already installed, skip the SSH-unlock section.

The procedure requires:

A CR660x router.
Another router running OpenWrt. A virtual machine such as VMware can also be used.
A PC or laptop with a LAN port and an Ethernet cable.
The attached xqsystem.lua and pb-boot.img files. PB-Boot is an alternative bootloader, similar to Breed, that makes firmware flashing easier.

Attachments

pb-boot.img (168kB - 0 Download.)

xqsystem.lua (716bytes - 0 Download.)

Prepare the OpenWrt router

Download xqsystem.lua and pb-boot.img.
Connect the OpenWrt router to the PC.
On Windows PowerShell (or a Linux/macOS terminal), upload xqsystem.lua:

1
scp C:\Users\xxxxxx\Desktop\xqsystem.lua [email protected]:/usr/lib/lua/luci/controller/admin/

Replace 192.168.1.1 with the OpenWrt router's actual address.

Screenshot

Open http://192.168.1.1/cgi-bin/luci/api/xqsystem/token in a browser. A response like the screenshot indicates that the upload worked.
Screenshot
Change the OpenWrt router's Wi-Fi name and LAN address, then disable DHCP:
- Under Network > Wireless, set the SSID to abc and password to 12345678, then Save & Apply.
- Under Interfaces, edit LAN, set IPv4 address to 169.254.31.1, select Ignore interface under DHCP Server, and apply.
  Screenshot

Enable OpenSSH on the CR660x

Power on the CR660x and log in. Its default address is 192.168.31.1.
The logged-in URL contains a stok token:

http://192.168.31.1/cgi-bin/luci/;stok=d2d55f6e595e236044bfff0b444e2c51/web/home#router

Replace the token and run these URLs in order.

URL1

http://192.168.31.1/cgi-bin/luci/;stok=d2d55f6e595e236044bfff0b444e2c51/api/misystem/extendwifi_connect?ssid=abc&password=12345678

Replace the green stok, SSID, and password with your values. A response of {"msg":"connect success!","code":0} indicates success.

URL2

http://192.168.31.1/cgi-bin/luci/;stok=d2d55f6e595e236044bfff0b444e2c51/api/xqsystem/oneclick_get_remote_token?username=xxx&password=xxx&nonce=xxx

A response containing "code":0 is successful.

Common errors:

1646: DHCP may still be enabled on the OpenWrt router.
1619: Check the OpenWrt LAN IP and ensure no other device is connected to it.
1655: Reset both routers and try again; some units may still fail.
Otherwise, try changing the SSID, password, or channel on the CR660x, and disable one Wi-Fi band at a time.

SSH is enabled without rebooting. The SSH username is admin; obtain the password from the serial number.

Nhập vào mã SN có dạng: 12345/A1BC23456 vào trường bên dưới và nhấn Calculate
SN phân biệt chữ HOA chữ thường và không chứa khoảng trắng (dấu cách)

Nhấn nút Copy để sao chép Password được tạo.

Install PB-Boot for custom ROMs

Upload pb-boot.img to /tmp:

1
2
3
4
5
6
7
# Windows PowerShell
scp C:\Users\xxxxxx\Desktop\pb-boot.img [email protected]:/tmp
ssh [email protected]

# Linux/macOS
scp /home/xxxxxx/pb-boot.img [email protected]:/tmp
ssh [email protected]

Then run:

1
mtd -r write /tmp/pb-boot.img Bootloader

The router reboots. To enter PB-Boot, unplug power, hold reset, reconnect power, wait about 10 seconds, release the button, connect the router to the PC, and open 192.168.1.1.

PB-Boot interface

Image by fb://Phong Nguyễn

If the browser refuses the connection even though the PC has a 192.168.1.x address and can ping 192.168.1.1, try another computer. Corporate security software can block access.

Custom firmware

Use PB-Boot to flash firmware

Enter PB-Boot as described above and follow the flashing screen:

Image provided by @Phong Nguyễn

Some routers fail to boot after flashing. Ask the seller or verify compatibility before flashing.
If the router does not boot, update PB-Boot to a newer version compatible with CR660x.
Flashing firmware accepts the risk of software conflicts, power loss, or a damaged bootloader. I am not responsible for damage.

0. Stock firmware

Return to stock only when necessary. A failed system combined with a damaged bootloader can be difficult to recover.

Original guide: SMZDM .

Download Xiaomi R3G Breed and the CR660x stock bootloader files from Google Drive .
Enter PB-Boot and flash the R3G Breed file.
Enter Breed and flash the CR660x stock bootloader.
Download Xiaomi RepairTool , enter recovery mode by holding reset while powering on, and flash stock firmware.

See the MIWIFI RepairTool guide .

Stock firmware:

CR6608: 1.0.100
CR6606: 1.0.103
Redmi AX1800 firmware with Mesh support: 1.0.88

1. Official OpenWrt

CR660x was officially supported by OpenWrt on February 7, 2022. See the OpenWrt pull request .

Stable 22.03.0: download , changelog .
Latest snapshot: OpenWrt firmware selector . Click SYSUPGRADE.

If SYSUPGRADE firmware does not boot when switching from stock or another firmware, download the matching xxx-squashfs-firmware.bin and flash it through PB-Boot.

See the OpenWrt configuration series .

2. Padavan

Hiboy

This is one of the most downloaded builds from the Newifi3 D2 firmware collection .

Download the August 8, 2022 build: CR660x_3.4.3.9-099.trx .
Check newer builds in the Padavan directory by searching for CR660x.

LAN IP: 192.168.123.1
Root username/password: admin/admin
Default Wi-Fi password: 1234567890
Flashing firmware does not restore factory settings.
SSH update command:

1
wget --no-check-certificate -O- https://opt.cn2qq.com/opt-script/up.sh > /tmp/up.sh && bash < /tmp/up.sh &

Community build

The source is unclear; use caution.

Download

3. Community firmware

3.1 ImmortalWrt by @Chấn Huy Dương

LAN IP: 192.168.5.1
Root password: password
Download from Google Drive

Screenshots

3.2 OpenWrt by Kzjj1, shared by @Duy Luu

This build includes many applications. It can enable 160MHz and MU-MIMO on both bands, but has reported issues with hidden SSID, Wi-Fi MAC accept/reject behavior, and speed compared with Padavan.

LAN IP: 192.168.6.1
Root username/password: root/password
Download

Change interface to English by Duy Luu

3.3 Continuously updated CR6608 firmware

I do not recommend unfamiliar firmware whose security has not been verified. Prefer widely used builds such as official OpenWrt.

Visit the firmware directory .
It provides Padavan Hanwckf, Padavan Hiboy, and OpenWrt. For OpenWrt, use xxx-sysupgrade.bin to preserve settings or xxx-factory.bin for a factory-style installation.

Images

4. X-WRT

Built by @ptpt52 from the LEDE/OpenWrt source, X-WRT adds several features:

Added features

Single-line multi-WAN dialing and load balancing (mwan3)
Integrated OpenVPN, VPN/PPTP deployment
QoS-Nftables flow control
DDNS, including Ali DDNS
UPnP and full-cone NAT
Samba and aria2
USB 4G network cards
Remote management interface

Wi-Fi SSID: X-WRT_XXXX; password: 88888888
LAN IP: 192.168.15.1
Root username/password: root/admin

X-WRT is updated weekly, so use the X-WRT download page and search for CR660x. Download the x-wrt-xxxxxxxx-ramips-mt7621-xiaomi_mi-router-cr660x-squashfs-sysupgrade.bin file and flash it through PB-Boot.

AIoT.IO.VN