Xiaomi router 3G R3G brushes in the records of feed and openwrt 20.02.2


Xiaomi R3G parameters

  • Architecture: MIPS
  • Vendor: Mediatek
  • Bootloader: U-Boot
  • System-On-Chip: MT7621 family
  • CPU/Speed: mipsel_24kc @ 880MHz 2 core
  • Flash: 128MB ESMT NAND
  • RAM: 256MB – NT 5C C 128M16 FP-DI,DDR3-1600-11-11-11
  • Wireless: MT7603/MT7612 2.4GHz/5GHz 802.11an+ac
  • Ethernet: 1000 Mbit/s / vlan support
  • USB: 1x 3.0

The router swipes into the ROM of the development version and starts SSH

To write to bootloader, to enable SSH, you need to update the ROM of Xiaomi router to the development version

In Xiaomi’sMiwifi download pageFind the development version ROM (R3G ROM development version) corresponding to the router

There are two ways to upgrade ROM

  1. Log in to the router background for online upgrade
  2. If the previous method does not work, you can copy it to the root directory of the U disk and name it miwifi Bin, then disconnect the power supply, plug in the USB flash disk, press and hold the reset button, and then plug in the power supply. Wait until the indicator turns yellow and flashes (10-15 seconds), and then release the reset key. After that, the router will update the ROM and restart to enter the normal state (the indicator turns blue and is always on)

Get SSH permission

  1. Register Xiaomi account first
  2. Install the miwifi mobile app, connect the router WiFi and bind the router. For the binding tutorial, seehttps://zhidao.baidu.com/question/2011024461729333668.html
  3. After binding, log inhttp://d.miwifi.com/rom/ssh, click “download toolkit”
  4. There is a root password next to the link to download the toolkit. You need to remember it

Information displayed when downloading the toolkit

How to use the toolkit: Xiaomi router needs to be upgraded to development version 0.5.28 or above, Xiaomi router Mini needs to be upgraded to development version 0.3.84 or above, and Xiaomi router 3 will support it soon Note: stable version does not support

Enable SSH

  1. Copy the downloaded toolkit bin file to the root directory of the U disk (fat/fat32 format), and ensure that the file name is miwifi_ ssh. bin;
  2. Disconnect the power supply of Xiaomi router and insert the USB stick into the USB interface;
  3. Press and hold the reset button and reconnect the power supply. The indicator turns yellow and flashes (10-15 seconds) to release the reset key
  4. After the installation is completed after 3-5 seconds, the Xiaomi router will restart automatically, and the blue light is always on
  5. The password for logging in to SSH is displayed on the interface for downloading the toolkit

If the SSH connection encounters an error

Unable to negotiate with port 22: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1,diffie-hellman-group14-sha1

You need to specify okexalgorithms manually

ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 [email protected]


The flash memory of R3G is 128M NAND. Check the layout

cat /proc/mtd
dev:    size   erasesize  name
mtd0: 07f80000 00020000 "ALL"
mtd1: 00080000 00020000 "Bootloader"
mtd2: 00040000 00020000 "Config"
mtd3: 00040000 00020000 "Bdata"
mtd4: 00040000 00020000 "Factory"
mtd5: 00040000 00020000 "crash"
mtd6: 00040000 00020000 "crash_syslog"
mtd7: 00040000 00020000 "reserved0"
mtd8: 00400000 00020000 "kernel0"
mtd9: 00400000 00020000 "kernel1"
mtd10: 02000000 00020000 "rootfs0"
mtd11: 02000000 00020000 "rootfs1"
mtd12: 03580000 00020000 "overlay"
mtd13: 012a6000 0001f000 "ubi_rootfs"
mtd14: 030ec000 0001f000 "data"

Backup command

The specific path is adjusted according to the path of your own USB flash disk

dd if=/dev/mtd0 of=/extdisks/sda4/ALL.bin
dd if=/dev/mtd1 of=/extdisks/sda4/Bootloader.bin
dd if=/dev/mtd2 of=/extdisks/sda4/Config.bin
dd if=/dev/mtd3 of=/extdisks/sda4/Bdata.bin
dd if=/dev/mtd4 of=/extdisks/sda4/Factory.bin
dd if=/dev/mtd5 of=/extdisks/sda4/crash.bin
dd if=/dev/mtd6 of=/extdisks/sda4/crash_syslog.bin
dd if=/dev/mtd7 of=/extdisks/sda4/reserved0.bin
dd if=/dev/mtd8 of=/extdisks/sda4/kernel0.bin
dd if=/dev/mtd9 of=/extdisks/sda4/kernel1.bin
dd if=/dev/mtd10 of=/extdisks/sda4/rootfs0.bin
dd if=/dev/mtd11 of=/extdisks/sda4/rootfs1.bin
dd if=/dev/mtd12 of=/extdisks/sda4/overlay.bin
dd if=/dev/mtd13 of=/extdisks/sda4/ubi_rootfs.bin
dd if=/dev/mtd14 of=/extdisks/sda4/data.bin

Backup to mtd14 may prompt that the device does not exist, which can be ignored. Just back up mtd0-mtd4

Recover command

mtd write /extdisks/sda4/Bootloader.bin Bootloader
mtd write /extdisks/sda4/Config.bin Config
mtd write /extdisks/sda4/Bdata.bin Bdata
mtd write /extdisks/sda4/Factory.bin Factory
mtd write /extdisks/sda4/crash.bin crash
mtd write /extdisks/sda4/crash_syslog.bin crash_syslog
mtd write /extdisks/sda4/reserved0.bin reserved0
mtd write /extdisks/sda4/kernel0.bin kernel0
mtd write /extdisks/sda4/kernel1.bin kernel1
mtd write /extdisks/sda4/rootfs0.bin rootfs0
mtd write /extdisks/sda4/rootfs1.bin rootfs1
mtd write /extdisks/sda4/overlay.bin overlay
mtd write /extdisks/sda4/ubi_rootfs.bin ubi_rootfs
mtd write /extdisks/sda4/data.bin data

Write feed

Download brewhttps://breed.hackpascal.net/Find the feed-mt7621-xiaomi-r3g Bin, the date of the current version is 2021-12-16 This version has “Xiaomi R3G settings”, “environment variable editing” and “Xiaomi R3G bdata” configuration interfaces specially prepared for R3G

Using winscp

  1. Log in to the router using winscp
  2. Download the just downloaded feed-mt7621-xiaomi-r3g Bin is uploaded to the /tmp folder of the router, and the file name is changed to a simpler one, feed bin

Using the SCP command

scp -oKexAlgorithms=+diffie-hellman-group1-sha1 "somewhere/breed-mt7621-xiaomi-r3g.bin" [email protected]:/tmp/

Execute command

mtd -r write /tmp/breed.bin Bootloader

After restart, unplug the power supply, press and hold the reset key of the route to start the machine. When the route light flashes, release the reset key, and view the IP through ipconfig in CMD. When the computer obtains 192.168.1 After accessing in the browser, you can enter the brew console

Configure breeds

  • In Xiaomi R3G settings, deletenormal_firmware_md5This key value, because the firmware MD5 value of the refresh brush is inconsistent with the original value, it will lead to failure to start the machine (if it is deleted, whether it cannot be started without deletion is not verified)
  • In environment variable editing, add an environment variable namedxiaomi.r3g.bootfw, value is 2

For the third operation, if the feed has been written to the bootloader, this is required The startup process of brew is as follows

  1. If kernel0 exists, start kernel0
  2. If kernel0 does not exist and kernel1 exists, start kernel1
  3. If both kernel0 and kernel1 exist, check the environment variable xiaomi r3g. The value of bootfw. If it exists and the value is 2, then start kernel1. Otherwise, start kernel0
  4. After writing openwrt through MTD below, if you do not write this environment variable, you will start from kernel0, and then you cannot enter the system. Restart and start from kernel0 again. This keeps cycling

Writing firmware

Third party firmware

For the third-party firmware of a single file, you can upload and swipe in the feed

OpenWrt 20.02.2

For the openwrt firmware of R3G, the writing method is special and needs to be explained The specific method has been described in detail on the official websitehttps://openwrt.org/toh/xiaomi/mir3g

First download the firmware and visithttps://firmware-selector.openwrt.org/, enter Xiaomi and select Xiaomi router 3G. If there is no such model, select the old version in the version on the right to try. Download the following two files on the download page


These two files need to be written through MTD under SSH. Therefore, if there is no SSH, you need to brush back the official development firmware with feed and start SSH according to the previous steps

Upload the two openwrt files prepared above to the /tmp directory, and execute the following command to write the firmware

cd /tmp

Use kernel1 Bin and rootfs0 Bin write, start openwrt and passdf -hWhat you see is a normal file system. You can use it directly. You don’t need to brush sysupgrade bin

Switch between openwrt and native firmware

Original bootloader

If the original bootloader is used, the boot partition is switchedflag_try_sys1_failedandflag_try_sys2_failedVariables,

Starting with openwrt

nvram set flag_try_sys1_failed=1 
nvram set flag_try_sys2_failed=0
nvram set flag_boot_success=0 
nvram commit

Restore official system

You need to switch back to the original kernel partition for startup

  1. Put the official firmware in the root directory of the USB flash drive in FAT32 format, and rename the file miwifi Bin connected to router
  2. SSH connection router execution
fw_setenv flag_try_sys1_failed 0
fw_setenv flag_try_sys2_failed 1
fw_setenv flag_boot_success 0
  1. Power off the router, press and hold the reset key, power on, wait for the yellow light to flash, and then release it
  2. Enter the official system after startup

Using feed as bootloader

adoptxiaomi.r3g.bootfwVariable control

reference resources