OpenWrt on a Xiami mini

!untested by me, but worth a try, given the mess I went through last time.
Here's a smart little exploit to enable telnet and set the root password w/o jumping chinese hoops.


This method has been successfully tested on
-> Xiaomi Mini - Stock firmware v2.6.17
-> Xiaomi Lite aka "Youth" or "Nano" - Stock firmware v2.2.8
STEPS
1) Power on and setup the Xiaomi router until it reboots and gets IP address 192.168.31.1
2) Log-in into the router and grab the value of the stok URL parameter (for instance: "9c2428de4d17e2db7e5a6a337e6f57a3")
3) Replace the <STOK> placeholder and load this URL in your browser or curl, this will start telnetd on the router:
http://192.168.31.1/cgi-bin/luci/;stok=<STOK>/api/xqnetwork/set_wifi_ap?ssid=whatever&encryption=NONE&enctype=NONE&channel=1%3B%2Fusr%2Fsbin%2Ftelnetd
It should spit out some wifi error code, that is ok, don't worry.
4) Replace the <STOK> placeholder, the current password and the desired root password and load this URL in your browser or curl, this will set the router root password
http://192.168.31.1/cgi-bin/luci/;stok=<STOK>/api/xqsystem/set_name_password?oldPwd=<CURRENTPASS>&newPwd=<NEWPASS>
It should spit out: {"code":0}
5) Telnet to the router, enter user root and NEWPASS chosen above.
6) wget your favourite .bin and flash with mtd -r write firmware.bin OS1
7) Router reboots wink


The original hard way:

it's a three/four stage process:

follow guide on this page:
http://en.miui.com/thread-64391-1-1.html

i used the old fw versions mentioned in that thread, there are updated versions available i didn't bother to try them out. i did use the latest version of the Android app (xqapp.apk) which came in english so no need to hunt for a translated version). [The only reason you need to go through all this is to get the root passwd. After flashing to pandora/wrt you can forget all this and remove the app]

the above guide ends with an install of PandoraBox (a fully modded openwrt version worth checking out on its own merits)
http://downloads.openwrt.org.cn/PandoraBox/Xiaomi-Mini-R1CM/stable/

but to go to trunk OpenWrt do:

fetch latest image from trunk here:
https://downloads.openwrt.org/snapshots/trunk/ramips/mt7620/ 

for mt7620a ie the xiami mini :
https://downloads.openwrt.org/snapshots/trunk/ramips/mt7620/openwrt-ramips-mt7620-xiaomi-miwifi-mini-squashfs-sysupgrade.bin

i flashed via PandoraBox's webinterface, no problem there, except it kept some/all settings from the Pandora image. To revert back to default settings, SSH into 192.168.1.1 with the password you set in pandora box.

firstboot (confirm:y)
reboot -f

finally: clean OpenWrt on a Xiami Mini!

[update]
just got my second mini, and what should've been a breeze to install WRT turned into significant more hoops than expected. Mainly the xiaomi registration seemed to be incapable of handling the fact that the previous mini was not available and since the miwifi_ssh.bin seems to be generated specifically per unit, registration is essential.

So I ended up creating a new account, registering via the translated android apk and then I could get a ssh bin that was accepted by the mini.
note: while figuring out what was going I ended up upgrading/downgrading firmwares as the development version 0.6.4 barfed at me with a firmware checksum error. so I ended up going to 0.5.4 but which is incompatible with the app, then letting the mini upgrade itself to another 0.5.x dev version but NOT the 1.x final version.

anyhoo, once the ssh was loaded via the USB I sshed in and flashed straight to wrt without first installing pandora as before.

in /tmp
wget https://downloads.openwrt.org/chaos_calmer/15.05/ramip
s/mt7620/openwrt-15.05-ramips-mt7620-xiaomi-miwifi-mini-squashfs-sysupgrade.bin
--no-check-certificate
mtd -r write openwrt-15.05-ramips-mt7620-xiaomi-miwifi-mini-squashfs-sysupgrade.bin OS1

done!

files:
0.6.4 dev FW (worked the first time, failed the second)
xiaomi app (chinese)
xiaomi app (translated to english, doesn't work with some FW versions)
0.5.40 (to get around the Firmware checksum failure)


Next Post Previous Post
No Comment
Add Comment
comment url