Flashing OpenWRT onto the Xiaomi Router 3A

INTRO#

As of 2025/08/22, this router costs between ten and thirty yuan, which makes it an excellent cheap pickup for flashing into a soft router.

PREPARATION#

Firmware you need to download: 123684

Tools you need: termius, winSCP

Flashing the modified official firmware#

Open the MIWIFI admin panel and manually upload the upgrade firmware miwifi_r3a_all_da132_2.18.40.bin on the system maintenance page
Wait for the upgrade to finish.

Checking your Windows version#

Windows 10, at least 2004, build 19041 or later.
Windows 11

Enable Windows Subsystem Linux and Virtual Machine Platform, then restart Windows.

Run PowerShell as administrator.
Enter

PRTCL // BASH

1
dism.exe /online /enable-feature /featurename:VirtualMachinePlatform /all /norestart

You’ll get the following output

PRTCL // BASH

1
部署映像服务和管理工具
2
版本: 10.0.26100.1150
3

4
映像版本: 10.0.26100.4652
5

6
启用一个或多个功能
7
[==========================100.0%==========================]
8
操作成功完成。

PRTCL // BASH

1
Enable-WindowsOptionalFeature -Online -FeatureName VirtualMachinePlatform -NoRestart

PRTCL // BASH

1
Path          :
2
Online        : True
3
RestartNeeded : False

You need to restart Windows.

Installing WSL#

Enter

PRTCL // BASH

1
wsl --install

What follows is just a normal Ubuntu setup: set up the account and password. It’s normal for the password not to be displayed.

PRTCL // BASH

1
正在下载: Ubuntu
2
正在安装: Ubuntu
3
已成功安装分发。可以通过 “wsl.exe -d Ubuntu” 启动它
4
正在启动 Ubuntu...
5
Provisioning the new WSL instance Ubuntu
6
This might take a while...
7
Create a default Unix user account: xi
8
New password:
9
Retype new password:
10
passwd: password updated successfully
11
To run a command as administrator (user "root"), use "sudo <command>".
12
See "man sudo_root" for details.
13

14
xi@SKYCHOW:/mnt/c/Users/33960$

The Ubuntu environment is now deployed successfully.

Deploying the unlock tool#

In File Explorer, enter \\wsl.localhost\Ubuntu to open the Ubuntu file manager, then open home//
Move OpenWRTInvasion-0.0.10.tar.gz and setup_openwrt_invasion.sh into that directory.
Use the cd /home/xi command to switch to that directory (change xi to your own username)
Grant execute permission

PRTCL // BASH

1
sudo chmod +x setup_openwrt_invasion.sh

Enter the following command

PRTCL // BASH

1
cd OpenWRTInvasion-0.0.10

Change the repository address

PRTCL // BASH

1
nano script.sh

Since the original mirror is dead, we need to edit the download section to the following

PRTCL // BASH

1
download_file_from_github() {
2
    # Rationale for using --insecure: https://github.com/acecilia/OpenWRTInvasion/issues/31#issuecomment-690755250
3
    curl -L "https://gitee.com/juserzhang/OpenWRTInvasion/tree/master/script_tools$1" --insecure --output "$2"
4
}

Then press ctrl x to exit

PRTCL // BASH

1
python3 remote_command_execution_vulnerability.py

The following output appears

PRTCL // BASH

1
Router IP address [press enter for using the default 'miwifi.com']: 192.168.31.1
2
Enter router admin password: 12345678

Just enter your IP and admin password Next you’ll see

PRTCL // BASH

1
There two options to provide the files needed for invasion:
2
   1. Use a local TCP file server runing on random port to provide files in local directory `script_tools`.
3
   2. Download needed files from remote github repository. (choose this option only if github is accessable inside router device.)
4
Which option do you prefer? (default: 1)

We type 2 and press Enter to run it

PRTCL // BASH

1
****************
2
router_ip_address: 192.168.31.1
3
stok: a80675f22f75d3281445ea2c2638f97e
4
file provider: remote github repository
5
****************
6
start uploading config file...
7
start exec command...
8
done! Now you can connect to the router using several options: (user: root, password: root)
9
* telnet 192.168.31.1
10
* ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 -c 3des-cbc -o UserKnownHostsFile=/dev/null [email protected]
11
* ftp: using a program like cyberduck

If you see the output above, congratulations — this part of the process succeeded.

Flashing breed#

Open termius and connect to your router over telnet; both the username and password are root
Check and back up the partitions

PRTCL // BASH

1
cat /proc/mtd

Back up the partitions, paying attention to the mtd partitions corresponding to factory and BootLoader — the ones you need to back up are factory and BootLoader

PRTCL // BASH

1
dd if=/dev/mtd4 of=/tmp/eeprom.bin
2
dd if=/dev/mtd1 of=/tmp/Bootloader.bin

Open WinSCP, select FTP as the protocol, set the host name to the router’s IP, and use root for both the username and password.
Find the tmp directory, copy Bootloader.bin and eeprom.bin to your PC, and copy breed into tmp
Go back to the terminal, cd into the tmp directory, and start flashing breed

PRTCL // BASH

1
mtd write breed.bin Bootloader