红米 AX3000(AX6) 解锁 SSH 教程

本篇文章适用于小米 AX3600 / AX9000 以及红米 AX6（按照其规格称之为 AX3000），对于猴米新 AX3000 产品，推荐立即退货。

1.一台搭载了 OpenWrt 系统的无线路由器（下称路由 A）

2.红米 AX3000 (aka. AX6)（下称路由 B）

3.一台支持网线连接的电脑（下称电脑）

4.完整的 shell-script/unlock-redmi-ax3000 源码（下称源码）

推荐的版本号为：MiWiFi 稳定版 1.0.18（点此下载），本教程仅保证在该版本下有效

若版本号不匹配，请先升级 / 降级固件。

进入源码目录，假设路由 A 地址为 192.168.1.1，在电脑上执行命令：

scp wireless.sh root@192.168.1.1:/root/wireless.sh

红米 AX3000(AX6) 解锁 SSH 教程

然后通过 SSH 连接，执行下面的命令（按回车确认）：

警告：执行本脚本会更改您的网络和无线设定，执行之前请务必备份相关数据

sh /root/wireless.sh

红米 AX3000(AX6) 解锁 SSH 教程

登入路由器后台，获取 STOK

（http://192.168.31.1/cgi-bin/luci/;stok=xxx 其中的 xxx 即为 STOK）

然后依次访问下面的 URL（STOK 不含尖括号）：

注意：这可能需要花费一点时间，并且有几率失败，请多尝试几次

http://192.168.31.1/cgi-bin/luci/;stok=<STOK>/api/misystem/extendwifi_connect?ssid=MEDIATEK-ARM-IS-GREAT&password=ARE-YOU-OK

如出现 connect success 则代表路由 B 已成功连接到路由 A，可以继续访问下一个 URL：

红米 AX3000(AX6) 解锁 SSH 教程

http://192.168.31.1/cgi-bin/luci/;stok=<STOK>/api/xqsystem/oneclick_get_remote_token?username=xxx&password=xxx&nonce=xxx

如出现下图中的内容，则代表 SSH 开启成功

红米 AX3000(AX6) 解锁 SSH 教程

刷新路由 B 后台界面，此时 5GHz 无线连接密码已经被自动更改为 SSH 登录密码

红米 AX3000(AX6) 解锁 SSH 教程

进入源码目录，在电脑上执行下列命令：

scp ax3000.sh root@192.168.31.1:/etc/ax3000.sh
scp fuckax3000 root@192.168.31.1:/etc/fuckax3000

然后通过 SSH 连接，执行下列命令：

<pre class="brush:xml;toolbar:false">sh /etc/ax3000.sh dump

红米 AX3000(AX6) 解锁 SSH 教程

脚本会自动导出备份数据，请通过下面的地址保存以防万一：

http://192.168.31.1/backup/log/bdata_mtd9.img

默认情况下，当路由器恢复出厂设置或者升级后，相关权限将会丢失，因此我们需要额外的操作以保留它们

通过 SSH 连接路由 B，执行下面的命令：

sh /etc/ax3000.sh unlock
    //路由器会自行重启，重启后执行
sh /etc/ax3000.sh hack

方便安装各种软件包和你想要的一些功能

通过 SSH 连接路由 B，执行下面的命令：

sh /etc/ax3000.sh mount
    //自行重启路由器，然后执行
sh /etc/ax3000.sh keep

小米固件内的 dists 源已经非常老旧且不推荐使用，更换到最新源即可享受在线安装 xray-core 等权利

将路由 B 的 /etc/opkg/distfeeds.conf 文件更改为如下内容：

src/gz openwrt_base http://downloads.openwrt.org/snapshots/packages/aarch64_cortex-a53/base
src/gz openwrt_luci http://downloads.openwrt.org/snapshots/packages/aarch64_cortex-a53/luci
src/gz openwrt_packages http://downloads.openwrt.org/snapshots/packages/aarch64_cortex-a53/packages
src/gz openwrt_routing http://downloads.openwrt.org/snapshots/packages/aarch64_cortex-a53/routing

运行 opkg update 后即可愉快食用。

[原创]红米AX6 SSH解锁和挂载overlay方法

小米ax3600获取root权限【简单快速】【修复丢ssid】

paldier/ax3600_tool

共计12人点赞，其中1人来自小程序

浮云求贵站用的又拍cdn怎么设置的缓存规则，跪谢！

mp_wx_cbb1be9b2d 大佬，小程序开源嘛

Aaron Rudenstine To Jack, I had the pleasure of working alongside Jack during our time at ButterflyMX, and I am delighted to provide this wholehearted recommendation. Jack is an exceptional professional who consistently goes above and beyond to deliver outstanding results. Jack served as our QA Director, a role that demanded meticulous attention to detail, technical expertise, and a proactive approach. He demonstrated a profound commitment to maintaining the highest quality standards for our products and services. His ability to identify even the smallest issues was instrumental in upholding our organization's reputation for excellence. What truly sets Jack apart is his collaborative approach. He worked seamlessly with cross-functional teams, ensuring open lines of communication and creating a harmonious work environment. His adeptness at bridging the gap between departments was crucial to the success of numerous projects at ButterflyMX. Jack is, without a doubt, one of the best workers I've had the privilege of working with. His work ethic is impeccable, and his adaptability and innovative thinking make him an asset to any organization. He is a professional you can trust to deliver exceptional results consistently. Although Jack has moved on from ButterflyMX and returned to China, I have no doubt that he will continue to excel in any role he takes on. I wholeheartedly endorse Jack for any future opportunities or endeavors. Any organization that has Jack as a part of their team is fortunate and will benefit from his dedication and excellence.