[Tutorial] MiWiFi Firmware Modification

Xiaomi router stock firmware uses a custom format and verifies an RSA signature during flashing. This makes flashing modified firmware nearly impossible through the normal process.

By analyzing the firmware tool mkxqimage, the firmware packaging and unpacking process can be understood. If you package the firmware with your own RSA private key and replace /usr/share/xiaoqiang/public.pem with the corresponding public key, the web interface can accept a self-made firmware image.

I. Unpacking the firmware

The mkxqimage tool unpacks the firmware. Before unpacking, verify the checksum and then use the RSA public key /usr/share/xiaoqiang/public.pem to verify the RSA signature. After both checks pass, use the firmware type at [0x0C] and the four offsets at [0x10], [0x14], [0x18], and [0x1C] to split the firmware. The image may contain files such as:

brcm4709_fac_update_nor.bin
brcm4709_nor.bin
fac_mode.bin
nvram_fac.bin
ramfsz
root.ext4.lzma
root.squashfs
upsetting.sh
upsetting_fac1.sh
upsetting_fac2.sh
upsetting_fac3.sh
vmlinuz.trx

II. Packaging the firmware

First, create a pair of RSA private and public keys.

The stable version 0.4.85 is used below as an example of the modification and packaging process.

• Unpack the firmware:

1
2
3
4

cd /userdisk/data
mkdir xqimage
cd xqimage
mkxqimage -x brcm4709_hdr_039ef_0.4.85.bin

The result contains two files:

1
2
3

ls
-rw-r--r-- 1 root root 16646144 May 30 08:14 brcm4709_nor.bin
-rw-r--r-- 1 root root 34853955 May 30 08:14 root.ext4.lzma

• Modify the firmware:
  • For an EXT4 image: mount -o loop -t ext4 root.ext4 /mnt
  • For SquashFS: unsquashfs rootfs.squashfs

Replace the RSA public key and enable SSH:

1
2
3
4
5

cd /mnt/usr/share/xiaoqiang
mv public.pem public.pem.orig
cp /userdisk/data/xqimage/public.pem public.pem.new
ln -s public.pem.new public.pem
sed -i 's/ssh_en=0/ssh_en=1/g' xiaoqiang-defaults.txt

Restore disabled web interfaces if needed:

1
2

cd /mnt/usr/lib/lua/luci/controller/web
sed -i 's/--entry/entry/g' index.lua

Make any other required modifications, then save the changes back to the firmware image:

1
2
3
4

cd /userdisk/data/xqimage
umount /mnt
sleep 30
# Wait before compressing the image

• Package the firmware.

Compress the modified filesystem image:

EXT4 image: ./lzma e -a0 root.ext4 root.ext4.lzma SquashFS: mksquashfs path/to/squashfs_rootfs_folder ... newrootfs.squashfs

1

./mkxqimage -o brcm4709_hdr_00000_0.4.85.bin -p ./private.pem -t 5 -f brcm4709_nor.bin -f root.ext4.lzma

III. Preparing for the upgrade

• Replace the public key.

Before upgrading the self-made firmware, replace the RSA public key on the current router:

1
2
3
4
5
6

mount -o rw,remount /
cd /usr/share/xiaoqiang
mv public.pem public.pem.orig
cp /userdisk/data/xqimage/public.pem public.pem.new
ln -s public.pem.new public.pem
mount -o ro,remount /

• Test the customized firmware.

1
2
3
4
5

cd /userdisk/data/xqimage
mkdir test
cd test
mkxqimage -x ../brcm4709_hdr_00000_0.4.85.bin
ls -l

If decompression finishes without errors and two files are listed, the image was packaged correctly:

1
2

-rw-r--r-- 1 root root 16646144 Jun 1 12:00 brcm4709_nor.bin
-rw-r--r-- 1 root root 33188560 Jun 1 12:00 root.ext4.lzma

The brcm4709_nor.bin file must be exactly 16646144 bytes.

Verify the EXT4 image:

1
2
3
4
5
6

cd /userdisk/data/xqimage/test
unlzma root.ext4.lzma
mount -o loop -t ext4 root.ext4 /mnt
ls -l /mnt/usr/share/xiaoqiang/public.pem*
grep ssh_en /mnt/usr/share/xiaoqiang/xiaoqiang-defaults.txt
umount /mnt

You should see information similar to this, although the timestamps will differ:

1
2
3
4
5

lrwxrwxrwx 1 root root 14 Jun 1 11:30 /mnt/usr/share/xiaoqiang/public.pem -> public.pem.new
-rw-r--r-- 1 root root 451 Jun 1 11:30 /mnt/usr/share/xiaoqiang/public.pem.new
-rwxr-xr-x 1 root root 451 May 27 11:33 /mnt/usr/share/xiaoqiang/public.pem.orig

ssh_en=1

Back up the customized firmware. In the computer's file manager, open \\192.168.31.1\XiaoMi\xqimage. You should see brcm4709_hdr_00000_0.4.85 and can copy the image to the computer.

IV. Upgrading the customized firmware

Log in to the Xiaomi router management page, select brcm4709_hdr_00000_0.4.85 under Routing Settings → Advanced Features → Manual Router Upgrade, click Upload and Install Firmware, and wait several minutes.

After installation, SSH may not start because the upgrade clears the ssh_en NVRAM value to 0. The first-boot defaults script sets it to 1 only after dropbear starts. Restart the router, then log in through SSH.

• Important note.

Because the router's RSA public key has been replaced, official firmware cannot be upgraded normally. To restore official firmware, replace the customized public key with the original one:

1
2
3
4

mount -o rw,remount /
cd /usr/share/xiaoqiang
cp public.pem.orig public.pem
mount -o ro,remount /

Source

Source: https://www.openwrt.pro/post-415.html