What we will need:

• - LAN cable, as in OpenWRT failsafe we will not have WiFi.
  - Additional router with internet connection if you want to install the official OpenWRT snap (explained below).
  - Router with vulnerable firmware: 1.0.47 (download from https://miuirom.org/miwifi/xiaomi-router-ax3000t).
  - Windows 10/11, PuTTy, and WinSCP:
  
  • PuTTY
  • WinSCP

Starting with the Router

We plug in the router, it doesn't matter if it has Internet or not. Here we will verify two things: the firmware version and stock:

We will write down our stock in a notepad. In my case: edba79aa031a98296be4c1e4fb065f43. Note: this number changes every time we log in to the router, so it varies with each login session.

We will copy all these codes and also paste them in a notepad, adding our stock:

Now we will put our stock in the links by deleting the parameter next to stock: ${1}

Open CMD and execute commands

We open CMD with administrator privileges preferably:

We run each link one by one. If it gives us {"code":0}, it means it's OK and now we will have access to SSH.

Note, this SSH is temporary, it is lost when the router is turned off/restarted.

Installing OpenWRT

User: root, no password.

I do not recommend the official snaps, better look for ones that already have LuCI like the ones I show you:

Download Snapshots

I recommend not downloading them from here, as you will need to have an Internet connection and you will have to install the "luci" graphical interface through SSH commands. However, I explain it here, but there may be errors like "opkg not allowed" etc.

In this case, we will take: xiaomi_mi-router-ax3000t-initramfs-factory.ubi and xiaomi_mi-router-ax3000t-squashfs-sysupgrade.bin. The first one will serve to start OpenWRT on the router, it is a failsafe image so WiFi and many other features will not work until we update with the second one.

We upload xiaomi_mi-router-ax3000t-initramfs-factory.ubi to the /tmp directory of the router

Connect with PuTTY

User: root, no password.

We run the command to know in which partition we start:

nvram get flag_boot_rootfs

For me, for example, it gave me: 1. I explain it further down. There are 2 possibilities: 1 or 0.

If it gave us 1, we execute these commands one by one:

ubiformat /dev/mtd8 -y -f /tmp/openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-initramfs-factory.ubi
nvram set boot_wait=on
nvram set uart_en=1
nvram set flag_boot_rootfs=0
nvram set flag_last_success=0
nvram set flag_boot_success=1
nvram set flag_try_sys1_failed=0
nvram set flag_try_sys2_failed=0
nvram commit
reboot

If it gave you 0, you will run these commands:

If you come from a restoration with the Xiaomi tool, run the first flash command 3 times, as there will be bad sectors in that partition and if you only do it once, you will have to run the recovery tool again.

Flashing the Router

The router will restart. We wait a bit and IMPORTANT: If it is the official repo, it comes without LuCI, meaning you will not have a graphical interface through the web.

Official step (continue below): We connect to 192.168.1.1 through a web browser:

User: root, no password.

We go to system > Backup / Flash firmware

http://192.168.1.1/cgi-bin/luci/admin/system/flash

We go to the end of the page where it says "Flash new firmware image" and click on "Flash image" and select the file openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-squashfs-sysupgrade.bin and finally click on the "Upload" button.

We uncheck "Keep settings".

Then the update will start, a couple of minutes and you can now connect to 192.168.1.1 and activate the WiFi networks.

Finished ROM Step with LuCI

Official Step

We now connect with WinSCP to 192.168.1.1 user root, no password, SCP protocol as before and copy xiaomi_mi-router-ax3000t-squashfs-sysupgrade.bin to the /tmp folder.

We open PuTTY and connect to 192.168.1.1 with user root, no password and run:

sysupgrade -n /tmp/openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-squashfs-sysupgrade.bin

The router will disconnect from PuTTY and start updating. Under no circumstances should you turn off the router.

Internet Connection and Update

We will need to connect the router to a router with Internet to update the OPKG packages and install LuCI:

opkg update
opkg install luci

We connect to PuTTY once we have connected our router to the Internet and run:

More additional information: https://openwrt.org/docs/guide-user/luci/luci.essentials

Restore to Xiaomi

Read the Xiaomi repair tool or "brick" tutorial.

OpenWRT Update

In most cases, it is not necessary to restore the router (Xiaomi recovery tool), just with the new file openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-squashfs-sysupgrade.bin, update from the web or SSH. And already depending on the ROM if it is compatible or not, keep configuration.

Brick danger warning: Never install ROMs with the word UBOOT, for example: xiaomi_mi-router-ax3000t-ubootmod-squashfs-sysupgrade.itb. This could brick the router. Keep this in mind, also if you have modified the UBOOT the Xiaomi recovery tool will not work.