感觉静态ip绑定二次确认不好用

那就 解包 搞自己的路由

获取开发包

获得 miwifi_rd15_firmware_23a4f_1.0.68.bin 文件

安装工具

debian bookworm

1
2
3
4
5
6
7
apt install binwalk
apt install python3.11-venv

python3 -m venv venv
source venv/bin/activate

pip install ubi_reader

解包

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
(venv) root@localhost:/route_package# tree -L 1
.
├── miwifi_rd15_firmware_23a4f_1.0.68.bin
└── venv

(venv) root@localhost:/route_package# ubireader_extract_images -w miwifi_rd15_firmware_23a4f_1.0.68.bin # 第一次解包
UBI_File Warning: end_offset - start_offset length is not block aligned, could mean missing data. # 这个错误可以不用管
(venv) root@localhost:/route_package# tree -L 1
.
├── miwifi_rd15_firmware_23a4f_1.0.68.bin
├── ubifs-root
└── venv

3 directories, 1 file

(venv) root@localhost:/route_package/ubifs-root# tree -L 1
.
└── miwifi_rd15_firmware_23a4f_1.0.68.bin # 需要再次解包

2 directories, 0 files

(venv) root@localhost:/route_package/ubifs-root# binwalk -Me miwifi_rd15_firmware_23a4f_1.0.68.bin --run-as=root  # 再次解包

(venv) root@localhost:/route_package/ubifs-root/miwifi_rd15_firmware_23a4f_1.0.68.bin# tree -L 1
.
├── img-2059293214_vol-kernel.ubifs # 内核文件
└── img-2059293214_vol-ubi_rootfs.ubifs # 程序文件

1 directory, 2 files

(venv) root@localhost:/route_package/ubifs-root/miwifi_rd15_firmware_23a4f_1.0.68.bin# unsquashfs img-2059293214_vol-ubi_rootfs.ubifs # 提取程序文件
Parallel unsquashfs: Using 2 processors
5288 inodes (4844 blocks) to write

[=====================================================================================================================================================================================================================================================================================================================================-] 10132/10132 100%

created 4779 files
created 302 directories
created 508 symlinks
created 1 device
created 0 fifos
created 0 sockets
created 0 hardlinks
(venv) root@localhost:/route_package/ubifs-root/miwifi_rd15_firmware_23a4f_1.0.68.bin# tree -L 1
.
├── img-2059293214_vol-kernel.ubifs
├── img-2059293214_vol-ubi_rootfs.ubifs
└── squashfs-root # 这是程序文件

2 directories, 2 files

(venv) root@localhost:/route_package/ubifs-root/miwifi_rd15_firmware_23a4f_1.0.68.bin/squashfs-root# tree -L 1
.
├── bin
├── data
├── dev
├── etc
├── ini
├── lib
├── mnt
├── overlay
├── proc
├── readonly
├── rom
├── root
├── run -> tmp/run
├── sawf
├── sbin
├── sys
├── tmp
├── userdisk
├── usr
├── var -> tmp
├── vendor
└── www

22 directories, 1 file

修改内容

  • 🕊

打包

用这个脚本吧 方便

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59

wget https://raw.githubusercontent.com/geekman/xqrepack/refs/heads/master/ubinize.sh

(venv) root@localhost:/route_package/ubifs-root/miwifi_rd15_firmware_23a4f_1.0.68.bin# mksquashfs squashfs-root squashfs-root.bin.new -comp xz -b 256K -no-xattrs # 将 程序重新打包为bin文件
Parallel mksquashfs: Using 2 processors
Creating 4.0 filesystem on squashfs-root.bin.new, block size 262144.
[=======================================================================================================================================================================================================================================================================================================================================/] 4844/4844 100%

Exportable Squashfs 4.0 filesystem, xz compressed, data block size 262144
  compressed data, compressed metadata, compressed fragments,
  no xattrs, compressed ids
  duplicates are removed
Filesystem size 24391.34 Kbytes (23.82 Mbytes)
  31.05% of uncompressed filesystem size (78564.39 Kbytes)
Inode table size 37534 bytes (36.65 Kbytes)
  20.36% of uncompressed inode table size (184374 bytes)
Directory table size 52864 bytes (51.62 Kbytes)
  41.62% of uncompressed directory table size (127006 bytes)
Number of duplicate files found 982
Number of inodes 5590
Number of files 4779
Number of fragments 137
Number of symbolic links 508
Number of device nodes 1
Number of fifo nodes 0
Number of socket nodes 0
Number of directories 302
Number of hard-links 0
Number of ids (unique uids + gids) 1
Number of uids 1
  root (0)
Number of gids 1
  root (0)

(venv) root@localhost:/route_package/ubifs-root/miwifi_rd15_firmware_23a4f_1.0.68.bin# tree -L 1
.
├── img-2059293214_vol-kernel.ubifs
├── img-2059293214_vol-ubi_rootfs.ubifs
├── squashfs-root
├── squashfs-root.bin.new
└── ubinize.sh

2 directories, 4 files

(venv) root@localhost:/route_package/ubifs-root/miwifi_rd15_firmware_23a4f_1.0.68.bin# ./ubinize.sh ./img-2059293214_vol-kernel.ubifs ./squashfs-root.bin.new # 第一个参数是内核文件 第二个参数是程序文件
ubinize: volume size was not specified in section "kernel", assume minimum to fit image "./img-2059293214_vol-kernel.ubifs"3174400 bytes (3.0 MiB)
ubinize: volume size was not specified in section "rootfs", assume minimum to fit image "./squashfs-root.bin.new"24977408 bytes (23.8 MiB)
done.

(venv) root@localhost:/route_package/ubifs-root/miwifi_rd15_firmware_23a4f_1.0.68.bin# tree -L 1
.
├── img-2059293214_vol-kernel.ubifs
├── img-2059293214_vol-ubi_rootfs.ubifs
├── r3600-raw-img.bin # 脚本写死了输出文件名
├── squashfs-root
├── squashfs-root.bin.new
└── ubinize.sh

2 directories, 5 files

刷入

使用 scp 连接到路由器 将新镜像进入 /tmp 目录

在 路由器中执行

1
2
3
4
5
6
7
8
9
10
11
12
13
r0_mtd=$(grep '"rootfs"'   /proc/mtd | awk -F: '{print substr($1,4)}')
r1_mtd=$(grep '"rootfs_1"' /proc/mtd | awk -F: '{print substr($1,4)}')
os_idx=$(nvram get flag_boot_rootfs)
mtd_cur=$(($r0_mtd+${os_idx:-0}))
mtd_nxt=$(($r0_mtd+$r1_mtd-$mtd_cur))
MTD_DEV=/dev/mtd$mtd_nxt

ubiformat $MTD_DEV -f r3600-raw-img.bin

nvram set flag_ota_reboot=1
nvram commit

reboot

救砖

下载 小米路由器修复工具

选择第一步下载的官方镜像等待结果的发生就行

成果展示

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
root@XiaoQiang:~# netstat -nlp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       in out PID/Program name    
tcp        0      0 127.0.0.1:784           0.0.0.0:*               LISTEN       0 0 9150/tbusd
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN       0 0 6008/nginx.conf -g 
tcp        0      0 127.0.0.1:53            0.0.0.0:*               LISTEN       0 0 9209/dnsmasq
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN       0 0 9038/dropbear
tcp        0      0 127.0.0.1:8920          0.0.0.0:*               LISTEN       0 0 6026/fcgi-cgi
tcp        0      0 127.0.0.1:6010          0.0.0.0:*               LISTEN       0 0 24201/dropbear
tcp        0      0 :::80                   :::*                    LISTEN       0 0 6008/nginx.conf -g 
tcp        0      0 ::1:53                  :::*                    LISTEN       0 0 9209/dnsmasq
tcp        0      0 :::22                   :::*                    LISTEN       0 0 9038/dropbear
udp        0      0 127.0.0.1:514           0.0.0.0:*                            0 0 10053/syslog-ng
udp        0      0 127.0.0.1:53            0.0.0.0:*                            0 0 9209/dnsmasq
udp        0      0 0.0.0.0:67              0.0.0.0:*                            0 0 9209/dnsmasq
udp        0      0 127.0.0.1:9900          0.0.0.0:*                            0 0 6301/hostapd
udp        0      0 127.0.0.1:9902          0.0.0.0:*                            0 0 6300/wpa_supplicant
udp        0      0 :::546                  :::*                                 0 0 29454/odhcp6c
udp        0      0 :::547                  :::*                                 0 0 6190/odhcpd
udp        0      0 ::1:53                  :::*                                 0 0 9209/dnsmasq
Active UNIX domain sockets (only servers)
Proto RefCnt Flags       Type       State         I-Node PID/Program name    Path
unix  2      [ ACC ]     STREAM     LISTENING      13312 10053/syslog-ng     /var/syslog-ng.ctl
unix  2      [ ACC ]     STREAM     LISTENING       8234 526/ubusd           /var/run/ubus.sock

参考地址