[Tutorial] MiWiFi Firmware Modification

Xiaomi router stock firmware uses a custom format and verifies an RSA signature during flashing. This makes flashing modified firmware nearly impossible through the normal process.

By analyzing the firmware tool mkxqimage, the firmware packaging and unpacking process can be understood. If you package the firmware with your own RSA private key and replace /usr/share/xiaoqiang/public.pem with the corresponding public key, the web interface can accept a self-made firmware image.

I. Unpacking the firmware

The mkxqimage tool unpacks the firmware. Before unpacking, verify the checksum and then use the RSA public key /usr/share/xiaoqiang/public.pem to verify the RSA signature. After both checks pass, use the firmware type at [0x0C] and the four offsets at [0x10], [0x14], [0x18], and [0x1C] to split the firmware. The image may contain files such as:

brcm4709_fac_update_nor.binbrcm4709_nor.binfac_mode.binnvram_fac.binramfszroot.ext4.lzmaroot.squashfsupsetting.shupsetting_fac1.shupsetting_fac2.shupsetting_fac3.shvmlinuz.trx

II. Packaging the firmware

First, create a pair of RSA private and public keys.

The stable version 0.4.85 is used below as an example of the modification and packaging process.

• Unpack the firmware:

cd /userdisk/datamkdir xqimagecd xqimagemkxqimage -x brcm4709_hdr_039ef_0.4.85.bin

The result contains two files:

ls-rw-r--r-- 1 root root 16646144 May 30 08:14 brcm4709_nor.bin-rw-r--r-- 1 root root 34853955 May 30 08:14 root.ext4.lzma

• Modify the firmware:
  • For an EXT4 image: mount -o loop -t ext4 root.ext4 /mnt
  • For SquashFS: unsquashfs rootfs.squashfs

Replace the RSA public key and enable SSH:

cd /mnt/usr/share/xiaoqiangmv public.pem public.pem.origcp /userdisk/data/xqimage/public.pem public.pem.newln -s public.pem.new public.pemsed -i 's/ssh_en=0/ssh_en=1/g' xiaoqiang-defaults.txt

Restore disabled web interfaces if needed:

cd /mnt/usr/lib/lua/luci/controller/websed -i 's/--entry/entry/g' index.lua

Make any other required modifications, then save the changes back to the firmware image:

cd /userdisk/data/xqimageumount /mntsleep 30# Wait before compressing the image

• Package the firmware.

Compress the modified filesystem image:

EXT4 image: ./lzma e -a0 root.ext4 root.ext4.lzma SquashFS: mksquashfs path/to/squashfs_rootfs_folder ... newrootfs.squashfs

./mkxqimage -o brcm4709_hdr_00000_0.4.85.bin -p ./private.pem -t 5 -f brcm4709_nor.bin -f root.ext4.lzma

III. Preparing for the upgrade

• Replace the public key.

Before upgrading the self-made firmware, replace the RSA public key on the current router:

mount -o rw,remount /cd /usr/share/xiaoqiangmv public.pem public.pem.origcp /userdisk/data/xqimage/public.pem public.pem.newln -s public.pem.new public.pemmount -o ro,remount /

• Test the customized firmware.

cd /userdisk/data/xqimagemkdir testcd testmkxqimage -x ../brcm4709_hdr_00000_0.4.85.binls -l

If decompression finishes without errors and two files are listed, the image was packaged correctly:

-rw-r--r-- 1 root root 16646144 Jun 1 12:00 brcm4709_nor.bin-rw-r--r-- 1 root root 33188560 Jun 1 12:00 root.ext4.lzma

The brcm4709_nor.bin file must be exactly 16646144 bytes.

Verify the EXT4 image:

cd /userdisk/data/xqimage/testunlzma root.ext4.lzmamount -o loop -t ext4 root.ext4 /mntls -l /mnt/usr/share/xiaoqiang/public.pem*grep ssh_en /mnt/usr/share/xiaoqiang/xiaoqiang-defaults.txtumount /mnt

You should see information similar to this, although the timestamps will differ:

lrwxrwxrwx 1 root root 14 Jun 1 11:30 /mnt/usr/share/xiaoqiang/public.pem -> public.pem.new-rw-r--r-- 1 root root 451 Jun 1 11:30 /mnt/usr/share/xiaoqiang/public.pem.new-rwxr-xr-x 1 root root 451 May 27 11:33 /mnt/usr/share/xiaoqiang/public.pem.origssh_en=1

Back up the customized firmware. In the computer’s file manager, open \\192.168.31.1\XiaoMi\xqimage. You should see brcm4709_hdr_00000_0.4.85 and can copy the image to the computer.

IV. Upgrading the customized firmware

Log in to the Xiaomi router management page, select brcm4709_hdr_00000_0.4.85 under Routing Settings → Advanced Features → Manual Router Upgrade, click Upload and Install Firmware, and wait several minutes.

After installation, SSH may not start because the upgrade clears the ssh_en NVRAM value to 0. The first-boot defaults script sets it to 1 only after dropbear starts. Restart the router, then log in through SSH.

• Important note.

Because the router’s RSA public key has been replaced, official firmware cannot be upgraded normally. To restore official firmware, replace the customized public key with the original one:

mount -o rw,remount /cd /usr/share/xiaoqiangcp public.pem.orig public.pemmount -o ro,remount /

Source

Source: https://www.openwrt.pro/post-415.html