小米路由器 AX9000 开发版固件直接获取 SSH

1.下载安装开发版固件

官网下载: http://www.miwifi.com/miwifi_download.html
下载地址: miwifi_ra70_all_develop_1.0.140.bin
md5sum: a0221ec10e2197922c975bc5cf961324
sha256sum: 4471d3d9d1e047429e3baf7abc06e79f2ff949af570d9d0c2c39aea018252b66

直接在界面更新即可。

2.在路由器界面安装并开启 docker 服务，并安装第三方管理服务，打开 docker 管理界面

3.在容器管理界面单击左上角 “Add container”，进入容器部署界面，按如下参数部署容器

使用 busybox 镜像

开启 tty

挂载主机根目录

最后，单击 “Deploy the container” 部署容器

4.返回容器列表，单击 busybox 容器后的回形针图标

5.chroot 到主机根目录，获取 SSH

chroot /mnt
vi /etc/init.d/dropbear

编辑 /etc/init.d/dropbear 注释以下几行：

start_service()
{
        # 稳定版不能打开ssh服务
        #flg_ssh=`nvram get ssh_en`
        #channel=`/sbin/uci get /usr/share/xiaoqiang/xiaoqiang_version.version.CHANNEL`
        #if [ "$flg_ssh" != "1" -o "$channel" = "release" ]; then
        #       return 0
        #fi

        [ -s /etc/dropbear/dropbear_rsa_host_key ] || keygen

        . /lib/functions.sh
        . /lib/functions/network.sh

        config_load "${NAME}"
        config_foreach dropbear_instance dropbear
}

最后启动 ssh 服务：

/etc/init.d/dropbear start

6.修改 root 密码或添加 authorized_keys

修改 root 密码

passwd root

添加 authorized_keys，注意只支持 rsa 格式的公钥

vi /etc/dropbear/authorized_keys

7.固化

直接使用这个工具即可：https://github.com/paldier/ax3600_tool

工具下载页面：https://github.com/paldier/ax3600_tool/releases

注意 AX9000 的 bdata 分区是 mtd18

root@XiaoQiang:~# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00100000 00020000 "0:SBL1"
mtd1: 00100000 00020000 "0:MIBIB"
mtd2: 00080000 00020000 "0:BOOTCONFIG"
mtd3: 00080000 00020000 "0:BOOTCONFIG1"
mtd4: 00300000 00020000 "0:QSEE"
mtd5: 00300000 00020000 "0:QSEE_1"
mtd6: 00080000 00020000 "0:DEVCFG"
mtd7: 00080000 00020000 "0:DEVCFG_1"
mtd8: 00080000 00020000 "0:APDP"
mtd9: 00080000 00020000 "0:APDP_1"
mtd10: 00080000 00020000 "0:RPM"
mtd11: 00080000 00020000 "0:RPM_1"
mtd12: 00080000 00020000 "0:CDT"
mtd13: 00080000 00020000 "0:CDT_1"
mtd14: 00080000 00020000 "0:APPSBLENV"
mtd15: 00100000 00020000 "0:APPSBL_1"
mtd16: 00100000 00020000 "0:APPSBL"
mtd17: 00080000 00020000 "0:ART"
mtd18: 00080000 00020000 "bdata"
mtd19: 00080000 00020000 "crash"
mtd20: 00080000 00020000 "crash_syslog"
mtd21: 03800000 00020000 "rootfs"
mtd22: 03800000 00020000 "rootfs_1"
mtd23: 00100000 00020000 "cfg_bak"
mtd24: 03d80000 00020000 "overlay"
mtd25: 04000000 00020000 "mifw_bak"
mtd26: 005ef000 0001f000 "kernel"
mtd27: 02283000 0001f000 "ubi_rootfs"
mtd28: 0087a000 0001f000 "rootfs_data"
mtd29: 03013000 0001f000 "data"

所以备份命令是：

nanddump -f /tmp/bdata_mtd18.img /dev/mtd18