eisaev / r2350

Files for Xiaomi Mi AIoT Router AC2350 (R2350)

This repository contains the files necessary to extend the capabilities of WiFi router Xiaomi Mi AIoT Router AC2350 in black (however, some of the files are also suitable for the white version).

Table of Contents

• 3.0.36.mod - diff files of root filefs modifications based on firmware version 3.0.36 (International)
• fw - official firmwares:
  • miwifi_r2350_firmware_0cc61_1.3.8.bin.7z - 1.3.8 (China)
  • miwifi_r2350_firmware_bd55f_3.0.36_INT.bin.7z - 3.0.36 (International)
• scripts - some useful scripts:
  • art.sh - patching art partition on the black version of the router to equalize the 2.4 GHz WiFi transmission power limits with the white version
  • bdata.sh - patching Bdata partition to remove some restrictions (SSH access, access to the u-boot console, etc.)
  • crash.sh - crash partition dump generator for switching the router to emergency mode, in which all partitions become writable (for example, Bdata, art)

Obtain SSH Access

• Flash the firmware version 1.3.8 (China)
• Login to the router web interface and get the value of stok= from the URL
• Open a new tab and go to the following URL (replace with the stok value gained above):

http://192.168.31.1/cgi-bin/luci/;stok=<STOK>/api/misystem/set_config_iotdev?bssid=any&user_id=any&ssid=-h%0Anvram%20set%20ssh_en%3D1%0Anvram%20commit%0Ased%20-i%20%27s%2Fchannel%3D.%2A%2Fchannel%3D%5C%5C%22debug%5C%5C%22%2Fg%27%20%2Fetc%2Finit.d%2Fdropbear%0A%2Fetc%2Finit.d%2Fdropbear%20start%0A

• Wait 30-60 seconds (this is the time required to generate keys for the SSH server on the router)

Calculate The Password

• Locally using shell (replace "12345/E0QM98765" with your router's serial number):

On Linux

printf "%s6d2df50a-250f-4a30-a5e6-d44fb0960aa0" "12345/E0QM98765" | md5sum - | head -c8 && echo

On macOS

printf "%s6d2df50a-250f-4a30-a5e6-d44fb0960aa0" "12345/E0QM98765" | md5 | head -c8

• Locally using python script (replace "12345/E0QM98765" with your router's serial number):

python3.7 -c 'from calc_passwd import calc_passwd; print(calc_passwd("12345/E0QM98765"))'

• Online

Create Full Backup

• Obtain SSH Access
• Create backup of all flash (on router):

dd if=/dev/mtd0 of=/tmp/ALL.backup

• Copy backup to PC (on PC):

scp [email protected]:/tmp/ALL.backup ./

Tip: backup of the original firmware, taken three times, increases the chances of recovery :)

Flash Modified Firmware (tested on both the white and black versions)

• Obtain SSH Access
• Download flash_fw.sh
• Copy flash_fw.sh to the router (on PC):

scp flash_fw.sh [email protected]:/tmp/

• Download firmware.7.mod.bin
• Copy firmware.7.mod.bin to the router (on PC):

scp firmware.7.mod.bin [email protected]:/tmp/

• Flash modified firmware (on router):

/bin/ash /tmp/flash_fw.sh &

• SSH connection will be interrupted - this is normal.
• Wait for the indicator to turn blue.
• Reset router to factory defaults using the physical reset button.

Patch Bdata Partition (on router)

This action is required only once.

• Generate a dump of the crash partition:

/root/scripts/crash.sh

• Flash the generated dump of the crash partition:

mtd write /tmp/crash_unlock.bin crash

• Reboot:

reboot

• Read and patch the dump of the Bdata partition:

/root/scripts/bdata.sh

• Flash modified dump of Bdata partition:

mtd write /tmp/bdata.mod.bin Bdata

• Erase the crash partition:

mtd erase crash

• Reboot:

reboot

Patch art Partition (for black version only; on router)

Required only on the black version of the router. This action is required only once.

• Generate a dump of the crash partition:

/root/scripts/crash.sh

• Flash the generated dump of the crash partition:

mtd write /tmp/crash_unlock.bin crash

• Reboot:

reboot

• Read and patch the dump of the art partition:

/root/scripts/art.sh

• Flash modified dump of Bdata partition:

mtd write /tmp/art.mod.bin art

• Erase the crash partition:

mtd erase crash

• Reboot:

reboot

Debricking (lite)

If you have a healthy bootloader, you can use recovery via TFTP using programs like TinyPXE on Windows (with firewalls disabled!) or dnsmasq on Linux.

• set up your PCs network card on the static IP address 192.168.31.100
• the router must be connected directly to the PC via the one of the routers LAN ports
• download the miwifi_r2350_firmware_0cc61_1.3.8.bin firmware or use the identical firmware from this repo and unzip it
• copy the firmware to the TFTP directory and rename it to test.img
• start the TFTP server (for TinyPXE: select test.img and set it to Online)

To switch the router to TFTP recovery mode, hold down the reset button, connect the power supply and release the reset button after the steady enlightened orange LED starts blinking (about 10 seconds after power up). The blinking orange LED also indicates that you still have a healthy bootloader.

Check the LAN LEDs (or the TinyPXE log output) to see the whether the data is transferred to the router. Once the blue LED starts flashing fast, you can reboot the router by disconnecting and reconnecting the power supply.

After the reboot the orange LED becomes steady which is fine: The original firmware waits for the initial setup.

Debricking (in the case of unhealthy bootloader)

You will need a full dump of your flash, a CH341 programmer, and a clip for in-circuit programming.

Install OpenWRT

Please use the official documentation on the OpenWRT website.

NB! Before installing OpenWrt on a black version of the router you should follow the 'Patch art Partition' section to be able to switch the 2.4 GHz WiFi transmission power limits from the OpenWrt application. The art partition can not be unlocked and altered after installing OpenWRT so you need to do this with the original firmware.

Repackaging the firmware (3.0.36 INT only!)

On macOS

1. Install required software

brew install p7zip squashfs

2. Extract international version of the stock firmware

cd utils
7z x ../fw/miwifi_r2350_firmware_bd55f_3.0.36_INT.bin.7z

3. Unpack kernel and root FS
   NB! It's really slow because it uses dd with a block size of 1, you can use binwalk as an alternative.

./unpack.sh

4. Unsquash root FS (my is the name of your mod)

sudo ./unsquash.sh my

5. Make changes in squashfs-root.my.mod directory
6. Pack firmware

sudo ./pack.sh my

7. Fix permissions

sudo chown $(id -un):$(id -gn) firmware.my.mod.bin

r2350's Issues

Can't change to AP mode

After full-reset and first configuration (wifi, password, etc) I try to change mode to AP and always fail.
The answer is:
"Couldn't use wired repeater"

Then, only after 10 sec hard-reset I can get my router back.
Can you please test this?

OpenWrt: image builder/official support

Hi!
I would like to generate custom openwrt images for this router to, for example install sqm, replace ath10k-ct with regular ath10k etc. Would it be possible to provide an image builder version with all the patches and appropriate files for this router? Or, even better, can official openwrt support be added so we can build our own images straight from the latest openwrt source instead of an outdated snapshot?
Thanks!

on router

hello,
sorry for the stupid question, but what do you mean when u say (on router), like:
Create a backup of all-flash (on router):
dd if=/dev/mtd0 of=/tmp/ALL.backup

please I need your help since you installed OpenWRT succwsfully

System orange led blinking after flashing mod firmware

Hello, I have a problem after flashing the mod firmware (firmware.6.mod.bin) and reset router the system
led blinking orange. What i can do? I have a backup, how i can it restore?

Flashing using the built in firmware updater?

Hi, I'm trying to flash the router with OpenWRT. I'm just wondering on whether we can flash the firmware directly with OpenWRT using the firmware updater that is built in the Mi Wifi ? Also, is it ok if I'm using Bash to execute the linux scripts on Windows?

Additional patches

Not an issue actually, but was wondering if its possible to add the generic patches from https://github.com/geekman/xqrepack
I tried to apply the patches from that repo manually via SSH and can confirm that it does work.
If not possible, would you be so kind to provide a guide on how I can unpack the r2350 firmware since the ubi_reader that geekman used doesn't seem to work with r2350 firmware?

Obtain SSH access returns inmediately code:0

I've flashed the CN firmware (miwifi_r2350_firmware_0cc61_1.3.8.bin.7z - 1.3.8 (China)) and after setting up a Wi-Fi password I was able to log in the device.
I've copied the stok value and paste it with in the webbrowser combined with the url from your instructions.
Badly enough the browser showed within a second this response:
{"code":0}

Did I forget to change more in the url or something else?

Can't acces to router

Hi, maybe I did a big mistake

I followed the steps in this tutorial to patch art (because I have the black/global version)
I want use the router with mi wifi app, finally I changed to RAE china to login, and don't work.
I tried access login to router with url and now, don't load, always charging.
My question is: what happens if I press the reset button? I need do the steps again or nothing?

Thanks for the help

Reverting from OpenWrt to miwifi 1.3.8

Hello @eisaev,

Maybe a trivial question, but is there any special procedure for flashing back into this version in order to apply the patch, once we are already in OpenWrt? Is it just a matter of selecting this image and flashing via the OpenWrt UI?

Thanks

Unable to SSH - missing S/N

Hello. I have been using the method to obtain the SSH access via the methods described in this repository in the past, and everything was working well for me. However, due to some glitches in the 2.4GHz connections, I rolled the router back to the INT version (3.0.36 version).

After OpenWRT became officially supported, I've decided to give it another try. I load up the web interface, pick up the stock value, send the http request with the stock to enable ssh and generate keys, wait for a few minutes to make sure the keys were generated before proceeding to calculate the ssh password according to my S/N.

But lo and behold - I have no serial number present in the router interface! The server just doesn't render anything there!

So, naturally, I've tried using the SN from the label found on the bottom of the device to generate an SSH password (and I'm sure this password is the same as it was before, so the serial number from the label is the same as the one I used to have in the router web interface).

Finally, when trying to SSH to the device as root, i keep getting: Permission denied, please try again.

I have also tried re-flashing 3.0.36, then back to 1.3.8 using all combinations of

• resetting settings while flashing from 3.0.36 to 1.3.8
• doing reflashes with and without WAN/internet connected
• doing factory resets both on 3.0.36 and 1.3.8
• tried ssh both via local router address (192.168.31.1) and thru WAN (the IP assigned by external router via DHCP, in cases when WAN/internet was connected)

After almost 4 hours, I am still in a situation where:

• I have no serial number rendered in the web interface, regardless of the current firmware version
• Any attempts to SSH using the password calculated from the serial number from the label on the bottom of the router fail with permission denied
• I am positive that the calculated password used to work in the past since I've found backup txt file where I was writing down the commands used

Any ideas? Or I am locked out of my router for good?

SCP problem

Hi,
I'm trying to update my AC2350 (black, INT version) from mod6 to mod7, but anytime I time to use scp (transfer file from me to router and vice versa) I get this:

I'm on macOS, idk if this can matter.

VPN is not functioning after updating to mod fm

2021-04-09--18-17-14.tar.gz

I have attached router log for your consideration.

MiWIFI loses connection

First of all - thanks a lot!
I did everything according to your documentation and everything worked out. But there is a small minor problem - since I set China in the settings, the application first detects the router, connects to it, and then loses connection with it forever. I tried all applications and reccomendations from 4pda but still without success.

Remove additional services from the mod

If possible could you remove some of the vendor based services and crons from the device in you mod?

https://forum.openwrt.org/t/xiaomi-ax3600-int-firmware/74276/214

# dont start crap services
for SVC in stat_points statisticsservice \
		datacenter \
		smartcontroller \
		plugincenter plugin_start_script.sh cp_preinstall_plugins.sh; do
	rm -f $FSDIR/etc/rc.d/[SK]*$SVC
done

# prevent stats phone home & auto-update
for f in StatPoints mtd_crash_log logupload.lua otapredownload wanip_check.sh; do > $FSDIR/usr/sbin/$f; done

rm -f $FSDIR/etc/hotplug.d/iface/*wanip_check

sed -i '/start_service(/a return 0' $FSDIR/etc/init.d/messagingagent.sh

# cron jobs are mostly non-OpenWRT stuff
for f in $FSDIR/etc/crontabs/*; do
	sed -i 's/^/#/' $f
done

# as a last-ditch effort, change the *.miwifi.com hostnames to localhost
sed -i 's@\w\+.miwifi.com@localhost@g' $FSDIR/etc/config/miwifi

revert the reverted crc32 to normal?

r2350/scripts/bdata.sh

Line 28 in 17351c8

dd if="${CRC32}" of="${OUTPUT}" bs=1 count=1 skip=3 seek=0 > /dev/null 2>&1