Flashing OpenWRT on Xiaomi Mini Router

Introduction

When using a router, we may want to modify it to use OpenWRT. Today, I will share the process for the Xiaomi Mini router, but the overall operation for Xiaomi routers is quite similar. First, we need to downgrade to a version that supports SSH, then use injection commands, and finally flash Breed and OpenWRT. Some routers like TP-Link can directly flash Breed.

Xiaomi Mini Router

Flashing OpenWRT on Xiaomi Mini Router

The Xiaomi Mini router was released by Xiaomi on April 23, 2014. It is equipped with an MT7620A processor and has a USB 2.0 port that can connect to a mobile hard drive.

Flashing OpenWRT on Xiaomi Mini Router

Flashing OpenWRT

Replacing the Router Version with SSH Supported Version

Flashing OpenWRT on Xiaomi Mini Router

First, the router does not have SSH permissions by default. The first step is to manually upgrade the router to a specific version. You can download the firmware from the router firmware collection website: https://mirom.ezbox.idv.tw/en/miwifi/R1CM/roms-developer/.

Flashing OpenWRT on Xiaomi Mini Router

The upgraded version is: Xiaomi WiFi Router firmware 2.7.11: miwifi_r1cm_firmware_b9d56_2.7.11.bin

Getting SSH and Flashing Breed

After upgrading, you can gain SSH access with the corresponding version. You can use a USB drive formatted as FAT or FAT32 to replace the SSH firmware and obtain SSH access.
The following is from other records, you can use USB tools:

Flashing OpenWRT on Xiaomi Mini Router

You can also operate via the web to obtain SSH access:
The method is similar to other Xiaomi routers, for example, the SSH method for AC2100 is also similar.
Flashing OpenWRT on Xiaomi Mini Router
Now let’s look at the operation method for the Mini:
  • 1. Open your browser, enter the IP address of the Xiaomi Mini in the address bar, press Enter, and input the management password you set to log in. The URL in the address bar will change to this format:
http://192.168.31.1/cgi-bin/luci/;stok=《your stok》/web/home#router
  • 2. Replace the URL in the address bar with the one below, and press Enter:
http://192.168.31.1/cgi-bin/luci/;stok=《your stok》/api/xqnetwork/set_wifi_ap?ssid=tianbao&encryption=NONE&enctype=NONE&channel=1%3Bnvram%20set%20ssh%5Fen%3D1%3B%20nvram%20commit
If you see “{“msg”:”Failed to connect to the specified WiFi (Probe timeout)”,”code”:1616}” on the webpage, it indicates that the command was executed successfully.

Flashing OpenWRT on Xiaomi Mini Router

  • 3. Continue to replace the URL with the one below, and press Enter:
http://192.168.31.1/cgi-bin/luci/;stok=《your stok》/api/xqnetwork/set_wifi_ap?ssid=tianbao&encryption=NONE&enctype=NONE&channel=1%3Bsed%20-i%20"%3Ax%3AN%3As%2Fif%20\[.*\;%20then%5Cn.*return%200%5Cn.*fi%2F%23tb%2F;%20b%20x"%20/etc/init.d/dropbear
You will see a small circle spinning in the tab, and it will show “Waiting” indicating that the command is being sent. After a while, the spinning circle will change to the router’s IP address. If you see “{“msg”:”Failed to connect to the specified WiFi (Probe timeout)”,”code”:1616}” on the webpage, it indicates that the command was executed successfully.

Flashing OpenWRT on Xiaomi Mini Router

  • 4. Continue to replace the URL with the one below, and press Enter:
http://192.168.31.1/cgi-bin/luci/;stok=《your stok》/api/xqnetwork/set_wifi_ap?ssid=tianbao&encryption=NONE&enctype=NONE&channel=1%3B%2Fetc%2Finit.d%2Fdropbear%20start
The method to determine the success of the command is the same as in steps 2 and 3.
  • 5. Continue to replace the URL with the one below, and press Enter:
http://192.168.31.1/cgi-bin/luci/;stok=《your stok》/api/xqsystem/set_name_password?oldPwd=《your current management password》&newPwd=《new password"
If you see “{“code”:0}” on the webpage, it indicates that the password has been changed successfully! You can then use SSH to log in. root-《new password》
At this point, we can see that SSH has successfully logged in.

Flashing OpenWRT on Xiaomi Mini Router

Now we can check the space allocation.

Flashing OpenWRT on Xiaomi Mini Router

The spaces we need to modify are Bootloader and OS1, used for flashing Boot and OpenWRT. Bootloader is obvious, while the OS1 area needs to be verified by ourselves. We first flash a Breed non-dead firmware, and then we can flash freely.
Start flashing the Breed non-dead firmware, which can be downloaded from: https://breed.hackpascal.net/:

Flashing OpenWRT on Xiaomi Mini Router

Proceed with the installation

Flashing OpenWRT on Xiaomi Mini Router

Copy and install:
scp  breed-mt7620-xiaomi-mini.bin [email protected]:/tmpmtd  -r  write breed-mt7620-xiaomi-mini.bin Bootloader
After finishing the Breed flashing, we start flashing OpenWRT.

Flashing OpenWRT

Enter the Breed interface to flash:
  • (1) Disconnect the power of the Xiaomi router, press the reset button with a sharp object like a toothpick, and then reconnect the power;
  • (2) Wait until the lights on the Mini router start to flash or ping successfully, indicating that it has entered Web flashing mode. Release the reset button. At this point, enter 192.168.1.1 on your computer to access the non-dead Breed control panel.
Entering bootloader mode

Flashing OpenWRT on Xiaomi Mini Router

Download the corresponding OpenWRT firmware: https://downloads.openwrt.org/releases/22.03.4/targets/ramips/mt7620/

Flashing OpenWRT on Xiaomi Mini RouterFlashing OpenWRT on Xiaomi Mini Router

Entering firmware update:

Flashing OpenWRT on Xiaomi Mini Router

Flashing OpenWRT on Xiaomi Mini Router
Directly use SSH to copy to the router and execute the command mtd to flash OpenWRT.
Since the router firmware we replaced has SSH access, we can directly copy the downloaded OpenWRT firmware to the router for mtd flashing, executing the following command:
scp openwrt-22.03.4-ramips-mt7620-xiaomi_miwifi-mini-squashfs-sysupgrade.bin [email protected]:/tmpmtd -r write  openwrt-22.03.4-ramips-mt7620-xiaomi_miwifi-mini-squashfs-sysupgrade.bin OS1
Reboot to see OpenWRT running normally.
For the manual command part, we will add some information:
After flashing OpenWRT, let’s take another look at the partition:

Flashing OpenWRT on Xiaomi Mini Router

Comparing the partitions of OpenWRT with the original firmware, the firmware partitions have changed. At this point, the Breed flashing command needs to revert the area, mtd -r write /tmp/breed-mt7620-xiaomi-mini.bin u-boot. The flashing area for OpenWRT’s sysupgrade.bin also needs to be modified accordingly: mtd -r write openwrt-22.03.4-ramips-mt7620-xiaomi_miwifi-mini-squashfs-sysupgrade.bin firmware.

Conclusion

This is my personal record of operating OpenWRT. If anyone has better ideas, feel free to add me as a friend to communicate and share!
Flashing OpenWRT on Xiaomi Mini Router
↓↓↓↓ Click Read Original to see more news.

Leave a Comment