一次小米路由器3刷机的翻车记录

下载旧版本ROM，手动降级

小米路由3miwifi_r3_all_55ac7_2.11.20.bin

登陆后拿到stock id,替换url中的id，在浏览器中打开。

第一行是修改密码的

http://192.168.31.1/cgi-bin/luci/;stok=30aa27d23b2db1881375dc53d0eace72/api/xqsystem/set_name_password?oldPwd=12345678&newPwd=1Qaz2wsx

http://192.168.31.1/cgi-bin/luci/;stok=30aa27d23b2db1881375dc53d0eace72/api/xqnetwork/set_wifi_ap?ssid=tianbao&encryption=NONE&enctype=NONE&channel=1%3Bnvram%20set%20ssh%5Fen%3D1%3B%20nvram%20commit

返回1616正常

http://192.168.31.1/cgi-bin/luci/;stok=30aa27d23b2db1881375dc53d0eace72/api/xqnetwork/set_wifi_ap?ssid=tianbao&encryption=NONE&enctype=NONE&channel=1%3Bsed%20%2Di%20%22%3Ax%3AN%3As%2Fif%20%5C%5B%2E%2A%5C%3B%20then%5Cn%2E%2Areturn%200%5Cn%2E%2Afi%2F%23tb%2F%3Bb%20x%22%20%2Fetc%2Finit.d%2Fdropbear

返回1616正常

http://192.168.31.1/cgi-bin/luci/;stok=30aa27d23b2db1881375dc53d0eace72/api/xqnetwork/set_wifi_ap?ssid=tianbao&encryption=NONE&enctype=NONE&channel=1%3B%2Fetc%2Finit.d%2Fdropbear%20start

返回1616正常

可以通过SSH登陆，以下是备份当前bin到外置存储，最终备份也没用到。

dd if=/dev/mtd0 of=/extdisks/sda/mtd0.bin
dd if=/dev/mtd1 of=/extdisks/sda/mtd1.bin
dd if=/dev/mtd2 of=/extdisks/sda/mtd2.bin
dd if=/dev/mtd3 of=/extdisks/sda/mtd3.bin
dd if=/dev/mtd4 of=/extdisks/sda/mtd4.bin
dd if=/dev/mtd5 of=/extdisks/sda/mtd5.bin
dd if=/dev/mtd6 of=/extdisks/sda/mtd6.bin
dd if=/dev/mtd7 of=/extdisks/sda/mtd7.bin
dd if=/dev/mtd8 of=/extdisks/sda/mtd8.bin
dd if=/dev/mtd9 of=/extdisks/sda/mtd9.bin
dd if=/dev/mtd10 of=/extdisks/sda/mtd10.bin
dd if=/dev/mtd11 of=/extdisks/sda/mtd11.bin
dd if=/dev/mtd12 of=/extdisks/sda/mtd12.bin

刷入uboot，关键步骤。

此处无报错，但是操作时缺乏验证，应该重启长按reset测试？

nvram set boot_wait=on
nvram set uart_en=1
nvram commit
mtd write /tmp/uboot.bin Bootloader

上传新的rom文件，切割写入kernel。

也没报错，但是重启就成砖了。。。

dd if=MI-R3G_3.4.3.9-099.trx bs=4194304 count=1 2> /dev/null | dd of=MI-R3G_3.4.3.9-099.trx.part1 2> /dev/null
mtd write MI-R3G_3.4.3.9-099.trx.part1 kernel1
dd if=MI-R3G_3.4.3.9-099.trx bs=4194304 skip=1 2> /dev/null | dd of=MI-R3G_3.4.3.9-099.trx.part2 2> /dev/null
mtd write MI-R3G_3.4.3.9-099.trx.part2 rootfs0
nvram set flag_last_success=1
nvram commit

最后给大家贴上完整的日志文件，引以为鉴。。

[d:~]$
Connecting to 192.168.31.1:22…
Connection established.
To escape to local shell, press ‘Ctrl+Alt+]’.
sh: /usr/bin/X11/xauth: not found
BusyBox v1.19.4 (2016-04-15 17:38:14 CST) built-in shell (ash)
Enter ‘help’ for a list of built-in commands.

Welcome to XiaoQiang!

---

root@XiaoQiang:~# cat /proc/mtd
dev: size erasesize name
mtd0: 08000000 00020000 “ALL”
mtd1: 00040000 00020000 “Bootloader”
mtd2: 00040000 00020000 “Config”
mtd3: 00040000 00020000 “Bdata”
mtd4: 00040000 00020000 “Factory”
mtd5: 00040000 00020000 “crash”
mtd6: 00040000 00020000 “crash_syslog”
mtd7: 00080000 00020000 “reserved0”
mtd8: 00400000 00020000 “kernel0”
mtd9: 00400000 00020000 “kernel1”
mtd10: 02000000 00020000 “rootfs0”
mtd11: 02000000 00020000 “rootfs1”
mtd12: 03600000 00020000 “overlay”
root@XiaoQiang:~# df -Th
df: invalid option – T
BusyBox v1.19.4 (2016-04-15 17:38:14 CST) multi-call binary.
Usage: df [-Pkmh] [FILESYSTEM]…
Print filesystem usage statistics
-P POSIX output format
-k 1024-byte blocks (default)
-m 1M-byte blocks
-h Human readable (e.g. 1K 243M 2G)
root@XiaoQiang:~# df -h
Filesystem Size Used Available Use% Mounted on
rootfs 25.9M 25.6M 252.0K 99% /
none 60.4M 0 60.4M 0% /dev
tmpfs 60.9M 3.7M 57.2M 6% /tmp
ubi0_0 25.9M 25.6M 252.0K 99% /
tmpfs 60.9M 3.7M 57.2M 6% /tmp
tmpfs 60.9M 3.7M 57.2M 6% /extdisks
ubi1_0 45.4M 6.1M 36.9M 14% /data
ubi1_0 45.4M 6.1M 36.9M 14% /userdisk
ubi0_0 25.9M 25.6M 252.0K 99% /userdisk/data
ubi1_0 45.4M 6.1M 36.9M 14% /etc
/dev/sda 28.6G 19.0M 28.6G 0% /extdisks/sda
root@XiaoQiang:~# ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 1000
link/ether f0:b4:29:fa:25:f4 brd ff:ff:ff:ff:ff:ff
inet6 fe80::f2b4:29ff:fefa:25f4/6