Introduction

When using a router, we often want to modify it to use OpenWrt. Today, I will share the process for the Xiaomi Mini router, but the overall operation is quite similar for most Xiaomi routers. First, we need to revert to a version that supports SSH, then use injection commands, and finally flash Breed and OpenWrt. Some routers like TP-Link can flash Breed directly.

Author: Liángzhī Yóucún

Reprint authorization and follow-up: Feel free to follow my WeChat public account: Yǔlín Jūn

Or add my personal WeChat: become_me

Xiaomi Mini Router

The Xiaomi Mini Router was released by Xiaomi on April 23, 2014. It is equipped with an MT7620A processor and has a USB 2.0 port for connecting external hard drives.

Flashing OpenWrt

Replace Router Version to an SSH-Compatible Version

First, the router does not have SSH access by default. The first step is to manually upgrade the router to a specific version that allows SSH. You can download the firmware from the router firmware collection site: https://mirom.ezbox.idv.tw/en/miwifi/R1CM/roms-developer/.

The upgraded version is: Xiaomi WiFi Router 2.7.11 firmware: miwifi_r1cm_firmware_b9d56_2.7.11.bin

Gain SSH Access and Flash Breed

After the upgrade, you can gain SSH access with the corresponding version. We can use a USB drive formatted in FAT or FAT32 to replace the SSH firmware and obtain SSH access.

The following is from other records, and you can use USB tools:You can also obtain SSH access via the web:

The operation method is similar to other Xiaomi routers, such as the AC2100 SSH method, which follows a similar process.

Now let’s look at the operation method for the Mini:

• 1. Open your browser and enter the IP address of the Xiaomi Mini in the address bar. Press Enter and input your management password to log in. The URL in the address bar will change to the following format:

http://192.168.31.1/cgi-bin/luci/;stok=《your_stok》/web/home#router

• 2. Replace the URL in the address bar with the following and press Enter:

http://192.168.31.1/cgi-bin/luci/;stok=《your_stok》/api/xqnetwork/set_wifi_ap?ssid=tianbao&encryption=NONE&enctype=NONE&channel=1%3Bnvram%20set%20ssh%5Fen%3D1%3B%20nvram%20commit

If you see the message “{\”msg\”:\”Failed to connect to the specified WiFi (Probe timeout)\”\”code\”:1616}” on the webpage, it indicates that the command executed successfully.

• 3. Continue replacing the URL with the following and press Enter:

http://192.168.31.1/cgi-bin/luci/;stok=《your_stok》/api/xqnetwork/set_wifi_ap?ssid=tianbao&encryption=NONE&enctype=NONE&channel=1%3Bsed%20%2Di%20%22%3Ax%3AN%3As%2Fif%20%5C%5B%2E%2A%5C%3B%20then%5Cn%2E%2Areturn%200%5Cn%2E%2Afi%2F%23tb%2F%3Bb%20x%22%20%2Fetc%2Finit.d%2Fdropbear

You will see a small circle spinning in the tab, and the text will change to “Waiting”, indicating that the command is being sent. Please wait! After a while, the spinning circle will turn into a webpage icon, and the text will change to the router’s IP address. If you see the message “{\”msg\”:\”Failed to connect to the specified WiFi (Probe timeout)\”\”code\”:1616}”, it indicates that the command executed successfully.

• 4. Continue replacing the URL with the following and press Enter:

http://192.168.31.1/cgi-bin/luci/;stok=《your_stok》/api/xqnetwork/set_wifi_ap?ssid=tianbao&encryption=NONE&enctype=NONE&channel=1%3B%2Fetc%2Finit.d%2Fdropbear%20start

The method to determine if the command executed successfully is the same as in steps 2 and 3.

• 5. Continue replacing the URL with the following and press Enter:

http://192.168.31.1/cgi-bin/luci/;stok=《your_stok》/api/xqsystem/set_name_password?oldPwd=《your_current_admin_password》&newPwd=《new_password》

If you see the message “{\”code\”:0}” on the webpage, it indicates that the password has been changed successfully! You can now log in using SSH. root-《new_password》

At this point, we can see that SSH login is successful

Now we can check the space allocationThe areas we need to modify are the Bootloader and OS1, which are used for flashing boot and OpenWrt. The Bootloader is obvious, and the OS1 area needs to be verified by ourselves. We first flash a Breed firmware that does not die, and then we can flash freely.

Start flashing the Breed firmware. You can download it here: https://breed.hackpascal.net/:

Proceed with installation

Copy and install:

scp  breed-mt7620-xiaomi-mini.bin [email protected]:/tmp
mtd  -r  write breed-mt7620-xiaomi-mini.bin Bootloader

The Breed flashing is complete, and we will start flashing OpenWrt.

Flashing OpenWrt

Enter the Breed interface to flash:

• (1) Disconnect the power from the Xiaomi router, use a toothpick or other sharp object to press the reset button on the router, and then reconnect the power;
• (2) Wait until the mini router’s light starts flashing or it can be pinged, indicating that it has entered the web flashing mode, then release the reset button. At this point, enter 192.168.1.1 on your computer to access the non-dead Breed control panel.

Enter bootloader mode

Download the corresponding OpenWrt firmware: https://downloads.openwrt.org/releases/22.03.4/targets/ramips/mt7620/

Enter firmware update:

Directly use SSH to copy the firmware to the router and perform manual commands to flash OpenWrt

Since we have SSH access to the replaced router firmware, we can directly copy the downloaded OpenWrt firmware to the router and execute the following commands:

scp openwrt-22.03.4-ramips-mt7620-xiaomi_miwifi-mini-squashfs-sysupgrade.bin [email protected]:/tmp
mtd -r write  openwrt-22.03.4-ramips-mt7620-xiaomi_miwifi-mini-squashfs-sysupgrade.bin OS1

Restart to see OpenWrt running normally.

We will add some information on the manual commands:

After flashing to OpenWrt, let’s take another look at the partition: The partition of OpenWrt has changed compared to the original firmware. At this point, the Breed flashing commands need to be modified accordingly: mtd -r write /tmp/breed-mt7620-xiaomi-mini.bin u-boot. The area for OpenWrt’s sysupgrade.bin also needs to be modified: mtd -r write openwrt-22.03.4-ramips-mt7620-xiaomi_miwifi-mini-squashfs-sysupgrade.bin firmware

Conclusion

This is my personal record of operating OpenWrt. If anyone has better ideas, feel free to add me as a friend to exchange and share!

Author: Liángzhī Yóucún, working hard during the day and writing original content at night. The public account content includes not only technology but also some life insights. A serious content creator and a rich life beyond technology, including photography, music, and basketball. Follow me and walk with me.

                              ‧‧‧‧‧‧‧‧‧‧‧‧‧‧‧‧  END  ‧‧‧‧‧‧‧‧‧‧‧‧‧‧‧‧

Recommended Reading

[1] Detailed sharing of the basics of Jetson Nano development

[2] Practical sharing of Linux core dump file analysis

[3] How programs run in the CPU – Must Read

[4] Establishing and testing the Cartographer environment

[5] Comparison of design patterns: simple factory pattern, factory pattern, abstract factory pattern

All original content from this public account has been organized into a directory. Reply [Resources] to obtain it.