[Tutorial] MiWiFi Firmware Modification

Xiaomi router stock firmware uses a custom format and verifies an RSA signature during flashing. This makes flashing modified firmware nearly impossible through the normal process.

{{< ads >}}

By analyzing the firmware tool mkxqimage, the firmware packaging and unpacking process can be understood. If you package the firmware with your own RSA private key and replace /usr/share/xiaoqiang/public.pem with the corresponding public key, the web interface can accept a self-made firmware image.

I. Unpacking the firmware

The mkxqimage tool unpacks the firmware. Before unpacking, verify the checksum and then use the RSA public key /usr/share/xiaoqiang/public.pem to verify the RSA signature. After both checks pass, use the firmware type at [0x0C] and the four offsets at [0x10], [0x14], [0x18], and [0x1C] to split the firmware. The image may contain files such as:

brcm4709_fac_update_nor.binbrcm4709_nor.binfac_mode.binnvram_fac.binramfszroot.ext4.lzmaroot.squashfsupsetting.shupsetting_fac1.shupsetting_fac2.shupsetting_fac3.shvmlinuz.trx

II. Packaging the firmware

First, create a pair of RSA private and public keys.

The stable version 0.4.85 is used below as an example of the modification and packaging process.

• Unpack the firmware:

cd /userdisk/datamkdir xqimagecd xqimagemkxqimage -x brcm4709_hdr_039ef_0.4.85.bin

The result contains two files:

ls-rw-r--r-- 1 root root 16646144 May 30 08:14 brcm4709_nor.bin-rw-r--r-- 1 root root 34853955 May 30 08:14 root.ext4.lzma

• Modify the firmware:
  • For an EXT4 image: mount -o loop -t ext4 root.ext4 /mnt
  • For SquashFS: unsquashfs rootfs.squashfs

Replace the RSA public key and enable SSH:

cd /mnt/usr/share/xiaoqiangmv public.pem public.pem.origcp /userdisk/data/xqimage/public.pem public.pem.newln -s public.pem.new public.pemsed -i 's/ssh_en=0/ssh_en=1/g' xiaoqiang-defaults.txt

Restore disabled web interfaces if needed:

cd /mnt/usr/lib/lua/luci/controller/websed -i 's/--entry/entry/g' index.lua

Make any other required modifications, then save the changes back to the firmware image:

cd /userdisk/data/xqimageumount /mntsleep 30# Wait before compressing the image

• Package the firmware.

Compress the modified filesystem image:

EXT4 image: ./lzma e -a0 root.ext4 root.ext4.lzma SquashFS: mksquashfs path/to/squashfs_rootfs_folder ... newrootfs.squashfs

./mkxqimage -o brcm4709_hdr_00000_0.4.85.bin -p ./private.pem -t 5 -f brcm4709_nor.bin -f root.ext4.lzma

III. Preparing for the upgrade

• Replace the public key.

Before upgrading the self-made firmware, replace the RSA public key on the current router:

mount -o rw,remount /cd /usr/share/xiaoqiangmv public.pem public.pem.origcp /userdisk/data/xqimage/public.pem public.pem.newln -s public.pem.new public.pemmount -o ro,remount /

• Test the customized firmware.

cd /userdisk/data/xqimagemkdir testcd testmkxqimage -x ../brcm4709_hdr_00000_0.4.85.binls -l

If decompression finishes without errors and two files are listed, the image was packaged correctly:

-rw-r--r-- 1 root root 16646144 Jun 1 12:00 brcm4709_nor.bin-rw-r--r-- 1 root root 33188560 Jun 1 12:00 root.ext4.lzma

The brcm4709_nor.bin file must be exactly 16646144 bytes.

Verify the EXT4 image:

cd /userdisk/data/xqimage/testunlzma root.ext4.lzmamount -o loop -t ext4 root.ext4 /mntls -l /mnt/usr/share/xiaoqiang/public.pem*grep ssh_en /mnt/usr/share/xiaoqiang/xiaoqiang-defaults.txtumount /mnt

You should see information similar to this, although the timestamps will differ:

lrwxrwxrwx 1 root root 14 Jun 1 11:30 /mnt/usr/share/xiaoqiang/public.pem -> public.pem.new-rw-r--r-- 1 root root 451 Jun 1 11:30 /mnt/usr/share/xiaoqiang/public.pem.new-rwxr-xr-x 1 root root 451 May 27 11:33 /mnt/usr/share/xiaoqiang/public.pem.origssh_en=1

Back up the customized firmware. In the computer’s file manager, open \\192.168.31.1\XiaoMi\xqimage. You should see brcm4709_hdr_00000_0.4.85 and can copy the image to the computer.

IV. Upgrading the customized firmware

Log in to the Xiaomi router management page, select brcm4709_hdr_00000_0.4.85 under Routing Settings → Advanced Features → Manual Router Upgrade, click Upload and Install Firmware, and wait several minutes.

After installation, SSH may not start because the upgrade clears the ssh_en NVRAM value to 0. The first-boot defaults script sets it to 1 only after dropbear starts. Restart the router, then log in through SSH.

• Important note.

Because the router’s RSA public key has been replaced, official firmware cannot be upgraded normally. To restore official firmware, replace the customized public key with the original one:

mount -o rw,remount /cd /usr/share/xiaoqiangcp public.pem.orig public.pemmount -o ro,remount /

Source

Source: https://www.openwrt.pro/post-415.html