Xiaomi Mi Router CR6609
From TechInfoDepot
Jump to navigationJump to search
| abgn+ac+ax (AX1800) | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| AX1800 WiFi 6 Mesh Router | |||||||||||||||||
|
| |||||||||||||||||
| 3rd Party Firmware | |||||||||||||||||
| dd-wrt | Status Unknown | ||||||||||||||||
| OpenWrt | Supported | ||||||||||||||||
| Tomato any flavor | Incompatible | ||||||||||||||||
| Gargoyle | Status Unknown | ||||||||||||||||
| Platform | |||||||||||||||||
| Brand • Model • Rev | Xiaomi Mi Router CR6609 | ||||||||||||||||
| FCC ID (fcc.io) | none specified | ||||||||||||||||
| FCC ID (fcc.report) | none specified | ||||||||||||||||
| Type | wireless router | ||||||||||||||||
| CPU1 | MediaTek MT7621AT | ||||||||||||||||
| CPU1 Type | MIPS 1004Kc | ||||||||||||||||
| CPU1 Speed | 880 MHz ( 2 cores ) 16-bit | ||||||||||||||||
| Flash1 Chip | ESMT F59L1G81MB | ||||||||||||||||
| Flash1 Size | 128 MiB 134,217,728 B <br />1,048,576 Kib <br />131,072 KiB <br />1,024 Mib <br />0.125 GiB <br /> (NAND) | ||||||||||||||||
| RAM1 Size | 256 MiB 268,435,456 B <br />2,097,152 Kib <br />262,144 KiB <br />2,048 Mib <br />0.25 GiB <br /> (DDR3) | ||||||||||||||||
| RAM1 Chip | ESMT M15T2G16128A | ||||||||||||||||
| ETH chip1 | MediaTek MT7621AT | ||||||||||||||||
| Switch | MediaTek MT7621AT | ||||||||||||||||
| Ethernet Port Count | 4-1GbE-LAN | ||||||||||||||||
| Wired Standard | IEEE 802.3i/3u/3ab | ||||||||||||||||
|
802dot11 OUI: none specified | |||||||||||||||||
| Stock bootloader | U-Boot | ||||||||||||||||
| Expansion IF types | none specified | ||||||||||||||||
| Power | 12 VDC, 1 A | ||||||||||||||||
| Serial Port (UART) | yes, 3.3V TTL, (115200 8N1) | ||||||||||||||||
|
| |||||||||||||||||
|
| |||||||||||||||||
| Other | |||||||||||||||||
|
| |||||||||||||||||
| 3rd Party Firmware Support |
OpenWrt • (List | Dev | DLs) | ||||||||||||||||
| Radio 1 | |||||||||||||||||
| Chip1 | MediaTek MT7905DAN | ||||||||||||||||
| Chip2 | MediaTek MT7975DN | ||||||||||||||||
| Wireless interface OUI | none specified | ||||||||||||||||
| Antenna Connector Type | none specified | ||||||||||||||||
| MIMO status | 2x2:2 | ||||||||||||||||
| Wireless Standard | IEEE 802.11b/g/n/ax | ||||||||||||||||
| 802.11ax | up to 574 Mbps | ||||||||||||||||
| 802.11n | up to 300 Mbps | ||||||||||||||||
| 802.11g | up to 54 Mbps | ||||||||||||||||
| 802.11b | up to 11 Mbps | ||||||||||||||||
| WiFi Operating Frequency | 2.4 GHz | ||||||||||||||||
| Radio 2 | |||||||||||||||||
| Chip1 | MediaTek MT7905DAN | ||||||||||||||||
| Chip2 | MediaTek MT7975DN | ||||||||||||||||
| Wireless interface OUI | none specified | ||||||||||||||||
| Antenna Connector Type | none specified | ||||||||||||||||
| MIMO status | 2x2:2 | ||||||||||||||||
| Wireless Standard | IEEE 802.11a/n/ac/ax | ||||||||||||||||
| 802.11ax | up to 1201 Mbps | ||||||||||||||||
| 802.11ac | up to 867 Mbps | ||||||||||||||||
| 802.11n | up to 300 Mbps | ||||||||||||||||
| 802.11a | up to 54 Mbps | ||||||||||||||||
| WiFi Operating Frequency | 5 GHz | ||||||||||||||||
| |||||||||||||||||
For a list of all currently documented MediaTek chipsets with specifications, see MediaTek.
For a list of all currently documented Xiaomi devices with specifications, see Xiaomi.
Flashing
| NOTE: During configuration or flashing a device, the only things that should be hooked to the device is the computer and power. |
Flashing OpenWrt
Target: ramips
Subtarget: mt7621
Package architecture: mipsel_24kc
Supported Since Commit
Support started version: 22.03.0
Current supported version: 25.12.2
Subtarget: mt7621
Package architecture: mipsel_24kc
Supported Since Commit
Support started version: 22.03.0
Current supported version: 25.12.2
LAN Hardware: MediaTek MT7621AT
WLAN Hardware: MediaTek MT7905DAN, MediaTek MT7975DN
WLAN Comment: MIMO 2x2:2 on both bands
Installation method(s):
see git-commit
WLAN Hardware: MediaTek MT7905DAN, MediaTek MT7975DN
WLAN Comment: MIMO 2x2:2 on both bands
Installation method(s):
see git-commit
| git • >> |
|---|
ramips: add support for Xiaomi Mi Router CR660x series
Xiaomi Mi Router CR6606 is a Wi-Fi6 AX1800 Router with 4 GbE Ports.
Alongside the general model, it has three carrier customized models:
CR6606 (China Unicom), CR6608 (China Mobile), CR6609 (China Telecom)
Specifications:
- SoC: MediaTek MT7621AT
- RAM: 256MB DDR3 (ESMT M15T2G16128A)
- Flash: 128MB NAND (ESMT F59L1G81MB)
- Ethernet: 1000Base-T x4 (MT7530 SoC)
- WLAN: 2x2 2.4GHz 574Mbps + 2x2 5GHz 1201Mbps (MT7905DAN + MT7975DN)
- LEDs: System (Blue, Yellow), Internet (Blue, Yellow)
- Buttons: Reset, WPS
- UART: through-hole on PCB ([VCC 3.3v](RX)(GND)(TX) 115200, 8n1)
- Power: 12VDC, 1A
Jailbreak Notes:
1. Get shell access.
1.1. Get yourself a wireless router that runs OpenWrt already.
1.2. On the OpenWrt router:
1.2.1. Access its console.
1.2.2. Create and edit
/usr/lib/lua/luci/controller/admin/xqsystem.lua
with the following code (exclude backquotes and line no.):
```
1 module("luci.controller.admin.xqsystem", package.seeall)
2
3 function index()
4 local page = node("api")
5 page.target = firstchild()
6 page.title = ("")
7 page.order = 100
8 page.index = true
9 page = node("api","xqsystem")
10 page.target = firstchild()
11 page.title = ("")
12 page.order = 100
13 page.index = true
14 entry({"api", "xqsystem", "token"}, call("getToken"), (""),
103, 0x08)
15 end
16
17 local LuciHttp = require("luci.http")
18
19 function getToken()
20 local result = {}
21 result["code"] = 0
22 result["token"] = "; nvram set ssh_en=1; nvram commit; sed -i
's/channel=.*/channel=\"debug\"/g' /etc/init.d/dropbear; /etc/init.d/drop
bear start;"
23 LuciHttp.write_json(result)
24 end
```
1.2.3. Browse http://{OWRT_ADDR}/cgi-bin/luci/api/xqsystem/token
It should give you a respond like this:
{"code":0,"token":"; nvram set ssh_en=1; nvram commit; ..."}
If so, continue; Otherwise, check the file, reboot the rout-
er, try again.
1.2.4. Set wireless network interface's IP to 169.254.31.1, turn
off DHCP of wireless interface's zone.
1.2.5. Connect to the router wirelessly, manually set your access
device's IP to 169.254.31.3, make sure
http://169.254.31.1/cgi-bin/luci/api/xqsystem/token
still have a similar result as 1.2.3 shows.
1.3. On the Xiaomi CR660x:
1.3.1. Login to the web interface. Your would be directed to a
page with URL like this:
http://{ROUTER_ADDR}/cgi-bin/luci/;stok={STOK}/web/home#r-
outer
1.3.2. Browse this URL with {STOK} from 1.3.1, {WIFI_NAME}
{PASSWORD} be your OpenWrt router's SSID and password:
http://{MIROUTER_ADDR}/cgi-bin/luci/;stok={STOK}/api/misy-
stem/extendwifi_connect?ssid={WIFI_NAME}&password={PASSWO-
RD}
It should return 0.
1.3.3. Browse this URL with {STOK} from 1.3.1:
http://{MIROUTER_ADDR}/cgi-bin/luci/;stok={STOK}/api/xqsy-
stem/oneclick_get_remote_token?username=xxx&password=xxx&-
nonce=xxx
1.4. Before rebooting, you can now access your CR660x via SSH.
For CR6606, you can calculate your root password by this project:
https://github.com/wfjsw/xiaoqiang-root-password, or at
https://www.oxygen7.cn/miwifi.
The root password for carrier-specific models should be the admi-
nistration password or the default login password on the label.
It is also feasible to change the root password at the same time
by modifying the script from step 1.2.2.
You can treat OpenWrt Router however you like from this point as
long as you don't mind go through this again if you have to expl-
oit it again. If you do have to and left your OpenWrt router unt-
ouched, start from 1.3.
2. There's no official binary firmware available, and if you lose the
content of your flash, no one except Xiaomi can help you.
Dump these partitions in case you need them:
"Bootloader" "Nvram" "Bdata" "crash" "crash_log"
"firmware" "firmware1" "overlay" "obr"
Find the corespond block device from /proc/mtd
Read from read-only block device to avoid misoperation.
It's recommended to use /tmp/syslogbackup/ as destination, since files
would be available at http://{ROUTER_ADDR}/backup/log/YOUR_DUMP
Keep an eye on memory usage though.
3. Since UART access is locked ootb, you should get UART access by modify
uboot env. Otherwise, your router may become bricked.
Excute these in stock firmware shell:
a. nvram set boot_wait=on
b. nvram set bootdelay=3
c. nvram commit
Or in OpenWrt:
a. opkg update && opkg install kmod-mtd-rw
b. insmod mtd-rw i_want_a_brick=1
c. fw_setenv boot_wait on
d. fw_setenv bootdelay 3
e. rmmod mtd-rw
Migrate to OpenWrt:
1. Transfer squashfs-firmware.bin to the router.
2. nvram set flag_try_sys1_failed=0
3. nvram set flag_try_sys2_failed=1
4. nvram commit
5. mtd -r write /path/to/image/squashfs-firmware.bin firmware
Additional Info:
1. CR660x series routers has a different nand layout compared to other
Xiaomi nand devices.
2. This router has a relatively fresh uboot (2018.09) compared to other
Xiaomi devices, and it is capable of booting fit image firmware.
Unfortunately, no successful attempt of booting OpenWrt fit image
were made so far. The cause is still yet to be known. For now, we use
legacy image instead.
|
Categories:
- Xiaomi
- Embedded system/wireless router
- Embedded System MediaTek
- Embedded System MT7621AT
- MediaTek
- Embedded System MIPS 1004Kc
- Embedded System
- OpenWrt Supported
- Embedded System MT7905DAN
- Embedded System MT7975DN
- Has Mimo Status
- Embedded System IEEE 802.11b/g/n/ax
- Embedded System IEEE 802.11a/n/ac/ax
- Dual-Radio Wireless Embedded System
- Wireless Embedded System
- Dual-Band
- English Documentation