First, you need to downgrade the Redmi AX6 before flashing, as using new firmware will block the vulnerabilities and prevent flashing. Before proceeding, ensure you have another router that has OpenWRT flashed on it, either hardware or software. I casually grabbed a Yuhua WR1200JS router for this purpose. The software required includes WinSCP and PuTTY. If you are not familiar with these two tools, the operation may be a bit challenging. But most people treat flashing as a piece of cake, right? Just kidding!
Since the following links cannot be opened in the public account, to have valid links, click on “Read the original text” to be redirected to my acwifi website, where the links can be directly accessed.
1. Downgrade
Download link for the Redmi AX6 downgrade firmware
After downloading the firmware above, go to the Redmi AX6 update interface for a manual upgrade.
After successfully downgrading the firmware version (1.0.16), you can start unlocking SSH on the Redmi AX6.
2. Unlock SSH
The original tutorial for unlocking is here: Unlock SSH Tutorial
I just followed this tutorial once, and it worked fine. If it doesn’t work… well, let’s not think about that!
Prepare a computer and an Ethernet cable.
The other router that has OpenWRT firmware and SSH access is the Yuhua WR1200JS, which I will refer to as the Yuhua router.
Set the LAN port IP of the Yuhua router to 169.254.31.1 and disable the DHCP service. Therefore, the computer’s network card should be set to IP 169.254.31.3; otherwise, you won’t be able to connect to this router.
Use PuTTY to SSH into the Yuhua router, with IP 169.254.31.1, port 22, username root, and password admin.
Then enter
vim /usr/lib/lua/luci/controller/admin/xqsystem.luaThis will open a vim editor. Press ‘i’ and paste the following content:
vim /usr/lib/lua/luci/controller/admin/xqsystem.luamodule(“luci.controller.admin.xqsystem”, package.seeall)
function index()local page = node(“api”)page.target = firstchild()page.title = (“”)page.order = 100page.index = truepage = node(“api”,”xqsystem”)page.target = firstchild()page.title = (“”)page.order = 100page.index = trueentry({“api”, “xqsystem”, “token”}, call(“getToken”), (“”), 103, 0x08)end
local LuciHttp = require(“luci.http”)
function getToken()local result = {}result[“code”] = 0result[“token”] = “; nvram set ssh_en=1; nvram commit; echo -e ‘admin\nadmin’ | passwd root; sed -i ‘s/channel=.*/channel=\