First time try such things. And goes smoother than I think.

The procedure is mainly based on

link1 link2 link3

The IP address for router GUI is 192.168.31.1 by default.

Table of Contents

  1. I. Unlock SSH login
    1. 1. Revert to the firmware for development
    2. 2. Calculating root password
      1. Online
      2. Local
    3. 3. Use telnet to enable SSH
    4. 4. Connect with SSH
  2. II. Install Openwrt
    1. 1. Flash with firmware for transition
    2. 2. Upgrade to desired version of firmware
  3. III. Some others
  4. IV. What’s after

I. Unlock SSH login

1. Revert to the firmware for development

Just choose “Manual Update” with the given firmware. Pretty simple.

In common settings - System status

1

This is what will appear after this step.

2. Calculating root password

We got two choices, but first, gotta find out the SN code of the product.

It can be found in the homepage of GUI of on the box.

Online

https://www.oxygen7.cn/miwifi/

Here

Local

You may calculated it with python script, in that github repo.

3. Use telnet to enable SSH

2

Add host into Terminus (Of course it’s also reachable via terminal)

Just deleted previous server seconds ago, so there’s nothing left

Connect, and log in with username “root” and previous password

(R U OK?)

3

Copy and paste the given command, and SSH is good to go

nvram set ssh_en=1 & nvram set uart_en=1 & nvram set boot_wait=on & nvram set bootdelay=3 & nvram set flag_try_sys1_failed=0 & nvram set flag_try_sys2_failed=1

nvram set flag_boot_rootfs=0 & nvram set “boot_fw1=run boot_rd_img;bootm”

nvram set flag_boot_success=1 & nvram commit & /etc/init.d/dropbear enable & /etc/init.d/dropbear start

Which should be able to excute without problem.

4. Connect with SSH

Repeat the process to add host again, but via SSH, fill in username and password.

II. Install Openwrt

1. Flash with firmware for transition

cd /tmp curl -L https://sebs.oss-cn-shanghai.aliyuncs.com/factory.bin -o factory.bin

mtd -r write /tmp/factory.bin firmware

4

After restarting, Wi-Fi name would become openwrt-5G, with

  • backend IP: 192.168.6.1
  • Username: root
  • Password: password

2. Upgrade to desired version of firmware

Choose System - Backup/Flash Firmware - Flash new firmware image

When proceed.

5

After restart, what’s left is all minor personal settings.

III. Some others

There’re many reasons people try to unlock one router. As for me, I think it’s more like an attempt, and because I can do that. Secondary, today’s on-board firmware tends to be simple-oriented, limiting what a user can do. That does ensure that a rookie won’t mess with unecessary things. While one claims such firmware tends to be heavy, which drags down router’s performance.

Just happen to have the need to buy a new router, and why not.

The process is .. simple, as there is little variable within, hope one day I could understand what happens beneath.

IV. What’s after

lmao, never so quick that I turned it into a brick - almost.

Because I wasn’t sure what I have done specifically when tweaking the settings. I’m suspecting that I miscomprend the icons stands for lan and wan, and DHCP conflicts with somthing under certain settings, resulting the IP configuration failure.

And actually I wasn’t sure that the factory’s repairing tool worked or not, as if which worked properly, the system should be set to default, rather than being like “first boot”. Maybe press and hold reset button before plug in power is the right way to reset openwrt? Strangely that’s contradict to the info I got from internet..

Well, this is actually very normal when you try to use 3rd party firmware, but hope next time I would have more spare time to do that.