![图片[1]-红米redmi路由器AX5京东无线宝RA50路由器刷机教程+恢复原厂教程-勇爱设计Netwrok](https://www.getpicion.com/wp-content/uploads/2026/06/image-33-1024x463.png)
| 项目 | 京东云无线宝版 | 普通版 AX5 |
|---|---|---|
| 处理器 | 高通 IPQ6000:4 核 A53 1.2GHz + 单核 1.5GHz NPU | 相同 |
| 内存(RAM) | 512MB DDR4 | 256MB DDR4 |
| 存储(Flash) | 64GB(用于边缘计算 / 缓存) | 128MB |
| 无线方案 | 2.4G+5G 双频,4 路 Qorvo 独立信号放大器(2.4G/5G 各 2 颗) | 相同 |
| 无线速率 | 双频并发 1775Mbps(2.4G:574Mbps;5G:1201Mbps) | 相同 |
| 网口 | 1× 千兆 WAN + 3× 千兆 LAN | 相同 |
官方固件下载:
1.1.47:miwifi_ra50_firmware_a69aa_1.1.47.bin
1.1.60:miwifi_ra50_firmware_2fd2e_1.1.60.bin
![图片[2]-红米redmi路由器AX5京东无线宝RA50路由器刷机教程+恢复原厂教程-勇爱设计Netwrok](https://www.getpicion.com/wp-content/uploads/2026/06/image-34-1024x326.png)
第一步解锁SSH
Xiaomi MiR Patcher
1 - Set IP-address (current value: 192.168.31.1)
2 - Connect to device (install exploit)
3 - Read full device info
4 - Create full backup
5 - Install EN/RU languages
6 - Install permanent SSH
7 - Install firmware (from directory "firmware")
8 - {{{ Other functions }}}
9 - [[ Reboot device ]]
0 - Exit
Select: 2
device_name = RA50
rom_version = 1.1.46 release
mac_address = e4:54:e8:65:73:12
CountryCode = CN
Enter device WEB password: 12345678
WARN: Exploits "arn_switch/start_binding/set_mac_filter" not working!!!
Enable smartcontroller scene executor ...
Wait smartcontroller activation ...
Unlock dropbear service ...
Unlock SSH server ...
Set password "root" for root user ...
Enabling dropbear service ...
Run SSH server on port 22 ...
Test SSH connection to port 22 ...
#### SSH server are activated! ####
==========================================================
#原厂分区列表
BusyBox v1.25.1 (2021-01-08 04:25:27 UTC) built-in shell (ash)
-----------------------------------------------------
Welcome to XiaoQiang!
-----------------------------------------------------
$$$$$$\ $$$$$$$\ $$$$$$$$\ $$\ $$\ $$$$$$\ $$\ $$\
$$ __$$\ $$ __$$\ $$ _____| $$ | $$ | $$ __$$\ $$ | $$ |
$$ / $$ |$$ | $$ |$$ | $$ | $$ | $$ / $$ |$$ |$$ /
$$$$$$$$ |$$$$$$$ |$$$$$\ $$ | $$ | $$ | $$ |$$$$$ /
$$ __$$ |$$ __$$< $$ __| $$ | $$ | $$ | $$ |$$ $$<
$$ | $$ |$$ | $$ |$$ | $$ | $$ | $$ | $$ |$$ |\$$\
$$ | $$ |$$ | $$ |$$$$$$$$\ $$$$$$$$$ | $$$$$$ |$$ | \$$\
\__| \__|\__| \__|\________| \_________/ \______/ \__| \__|
root@XiaoQiang:~# cat /proc/mtd
dev: size erasesize name
root@XiaoQiang:~# blikid
-ash: blikid: not found
root@XiaoQiang:~# blkid
/dev/mmcblk0: PTUUID="98101b32-bbe2-4bf2-a06e-2bb33d000c20" PTTYPE="gpt"
/dev/mmcblk0p1: PARTLABEL="0:SBL1" PARTUUID="1e40be3e-d9e7-75cd-c4ab-1d9706ae3b3b"
/dev/mmcblk0p2: PARTLABEL="0:BOOTCONFIG" PARTUUID="72cf7698-d671-75a1-876e-45291ee3ebb2"
/dev/mmcblk0p3: PARTLABEL="0:BOOTCONFIG1" PARTUUID="b8ac588a-30a3-6ee9-41ab-66c3913c25d6"
/dev/mmcblk0p4: PARTLABEL="0:QSEE" PARTUUID="9faad1bb-3f9d-dac7-cc40-fe0f49a98a49"
/dev/mmcblk0p5: PARTLABEL="0:QSEE_1" PARTUUID="26cfc0ec-9ed1-4baf-2857-0b2c5077d1fa"
/dev/mmcblk0p6: PARTLABEL="0:DEVCFG" PARTUUID="072b1029-e109-86b8-7fde-b1df08ad831b"
/dev/mmcblk0p7: PARTLABEL="0:DEVCFG_1" PARTUUID="5534d768-103f-6ed7-0707-179a55d1e248"
/dev/mmcblk0p8: PARTLABEL="0:RPM" PARTUUID="e236ae50-f621-1ac1-bb65-885be5382352"
/dev/mmcblk0p9: PARTLABEL="0:RPM_1" PARTUUID="804d5941-52b8-6135-1ec2-2ca4c6c7a6b9"
/dev/mmcblk0p10: PARTLABEL="0:CDT" PARTUUID="43b3871e-58cf-ac22-9733-6067efce75e0"
/dev/mmcblk0p11: PARTLABEL="0:CDT_1" PARTUUID="2fbc1c89-60fa-dfe0-5dc9-12b0880bbd6b"
/dev/mmcblk0p12: PARTLABEL="0:APPSBLENV" PARTUUID="a223f63d-0db2-666b-555d-34f66a26323f"
/dev/mmcblk0p13: PARTLABEL="0:APPSBL" PARTUUID="4b5f2873-5d3e-cf9c-68d8-7d5cb0cffc8c"
/dev/mmcblk0p14: PARTLABEL="0:APPSBL_1" PARTUUID="565d4ceb-2512-41d1-1a29-a298ad6f2de2"
/dev/mmcblk0p15: PARTLABEL="0:ART" PARTUUID="4d447099-676d-b4af-f4a2-721dd4901ba5"
/dev/mmcblk0p16: PARTLABEL="0:HLOS" PARTUUID="3634c218-831e-b45f-8138-3b6bddbe902d"
/dev/mmcblk0p17: PARTLABEL="0:HLOS_1" PARTUUID="30f1c855-c630-2693-d8ee-b83e55bb4827"
/dev/mmcblk0p18: TYPE="squashfs" PARTLABEL="rootfs" PARTUUID="3dccfdd7-8da8-3515-99d4-d47a63526aeb"
/dev/mmcblk0p19: TYPE="squashfs" PARTLABEL="0:WIFIFW" PARTUUID="f50b882d-c863-450e-409f-cf648ae546c2"
/dev/mmcblk0p20: TYPE="squashfs" PARTLABEL="rootfs_1" PARTUUID="adb9e7af-73a1-75fb-1766-c922eb24bf33"
/dev/mmcblk0p21: PARTLABEL="0:WIFIFW_1" PARTUUID="045e685a-7fd2-e1e2-ffb5-8f5c15b1dfcf"
/dev/mmcblk0p22: PARTLABEL="0:ETHPHYFW" PARTUUID="4b6531e9-f159-3f79-d87a-6a644985d2a3"
/dev/mmcblk0p23: PARTLABEL="bdata" PARTUUID="4834481d-a366-e3e4-1ec0-00d3e1897a58"
/dev/mmcblk0p24: PARTLABEL="crash" PARTUUID="16ed9c47-ada6-ce39-fdf1-751b1f1cb29a"
/dev/mmcblk0p25: PARTLABEL="crash_syslog" PARTUUID="b21a8391-737f-a1af-969c-224d1b60340c"
/dev/mmcblk0p26: UUID="63a5b1ab-7e66-410a-b81b-4b7a21657373" TYPE="ext4" PARTLABEL="rootfs_data" PARTUUID="9823851e-5f82-d8a9-44e9-2756ab2b363a"
/dev/mmcblk0p27: PARTLABEL="cfg_bak" PARTUUID="e5cf6760-612c-ec80-388f-37ba1aba5d39"
/dev/mmcblk0p28: PARTLABEL="overlay" PARTUUID="6b016d7c-886c-2589-af6f-607727d29e8a"
/dev/mmcblk0p29: UUID="07fdcaa2-01bc-4cb3-ad40-33940ba49609" TYPE="ext4"
root@XiaoQiang:~#
第二步刷入临时系统和uboot
BusyBox v1.25.1 (2021-01-08 04:25:27 UTC) built-in shell (ash)
-----------------------------------------------------
Welcome to XiaoQiang!
-----------------------------------------------------
$$$$$$\ $$$$$$$\ $$$$$$$$\ $$\ $$\ $$$$$$\ $$\ $$\
$$ __$$\ $$ __$$\ $$ _____| $$ | $$ | $$ __$$\ $$ | $$ |
$$ / $$ |$$ | $$ |$$ | $$ | $$ | $$ / $$ |$$ |$$ /
$$$$$$$$ |$$$$$$$ |$$$$$\ $$ | $$ | $$ | $$ |$$$$$ /
$$ __$$ |$$ __$$< $$ __| $$ | $$ | $$ | $$ |$$ $$<
$$ | $$ |$$ | $$ |$$ | $$ | $$ | $$ | $$ |$$ |\$$\
$$ | $$ |$$ | $$ |$$$$$$$$\ $$$$$$$$$ | $$$$$$ |$$ | \$$\
\__| \__|\__| \__|\________| \_________/ \______/ \__| \__|
root@XiaoQiang:~# cd /tmp/
root@XiaoQiang:/tmp#
root@XiaoQiang:/tmp# dd if=/dev/mmcblk0 of=orig_mibib.bin bs=512 count=34
34+0 records in
34+0 records out
17408 bytes (17.0KB) copied, 0.002208 seconds, 7.5MB/s
root@XiaoQiang:/tmp# dd if=/dev/mmcblk0p13 of=orig_appsbl_p13.bin
1280+0 records in
1280+0 records out
655360 bytes (640.0KB) copied, 0.010503 seconds, 59.5MB/s
root@XiaoQiang:/tmp# dd if=/dev/mmcblk0p14 of=orig_appsbl1_p14.bin
1280+0 records in
1280+0 records out
655360 bytes (640.0KB) copied, 0.010668 seconds, 58.6MB/s
root@XiaoQiang:/tmp# dd if=/dev/mmcblk0p15 of=orig_art_p15.bin
512+0 records in
512+0 records out
262144 bytes (256.0KB) copied, 0.006394 seconds, 39.1MB/s
root@XiaoQiang:/tmp# nvram set flag_last_success=0
root@XiaoQiang:/tmp# nvram set flag_boot_rootfs=0
root@XiaoQiang:/tmp# nvram set boot_wait=on
root@XiaoQiang:/tmp# nvram set uart_en=1
root@XiaoQiang:/tmp# nvram set telnet_en=1
root@XiaoQiang:/tmp# nvram set ssh_en=1
root@XiaoQiang:/tmp# nvram set bootdelay=2
root@XiaoQiang:/tmp# nvram commit
root@XiaoQiang:/tmp#
root@XiaoQiang:/tmp# md5sum /tmp/kernel.bin /tmp/rootfs.bin
f021688480165c3c95f6fe84dcd0c12b /tmp/kernel.bin
264ddbf8c7a691f06fe75af4f0f3a5f0 /tmp/rootfs.bin
root@XiaoQiang:/tmp# dd if=/tmp/kernel.bin of=/dev/mmcblk0p17
12288+0 records in
12288+0 records out
6291456 bytes (6.0MB) copied, 0.500202 seconds, 12.0MB/s
root@XiaoQiang:/tmp# dd if=/tmp/rootfs.bin of=/dev/mmcblk0p20
55936+1 records in
55936+1 records out
28639236 bytes (27.3MB) copied, 3.537612 seconds, 7.7MB/s
root@XiaoQiang:/tmp# nvram set flag_last_success=1
root@XiaoQiang:/tmp# nvram set flag_boot_rootfs=1
root@XiaoQiang:/tmp# nvram commit
root@XiaoQiang:/tmp# reboot
root@XiaoQiang:/tmp#
第三步刷入openwrt最新版
BusyBox v1.37.0 (2026-05-15 10:20:44 UTC) built-in shell (ash)
__ ____ Commercial __
/\ \ __/\ _`\ Prohibition /\ \__
\ \ \ /\_\ \ \L\ \ __ __ __ _ __\ \ ,_\
\ \ \ __\/\ \ \ _ <'/\ \/\ \/\ \/\`'__\ \ \/
\ \ \L\ \\ \ \ \ \L\ \ \ \_/ \_/ \ \ \/ \ \ \_
\ \____/ \ \_\ \____/\ \___x___/'\ \_\ \ \__\
\/___/ \/_/\/___/ \/__//__/ \/_/ \/__/
-----------------------------------------------------
LibWrt SNAPSHOT, r0-0d80996
-----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@LibWrt:~# cat /proc/mtd
dev: size erasesize name
root@LibWrt:~# blkid
/dev/mmcblk0p12: PARTLABEL="0:APPSBLENV" PARTUUID="3e7592a0-39c1-c82c-e690-32e79a9d6c8a"
/dev/mmcblk0p9: PARTLABEL="0:RPM_1" PARTUUID="dfcfd333-93f6-5026-fee4-651b51f9aadf"
/dev/mmcblk0p10: PARTLABEL="0:CDT" PARTUUID="25b8d23c-1631-cb20-b428-dc035326e6ff"
/dev/mmcblk0p7: PARTLABEL="0:DEVCFG_1" PARTUUID="1dff0a26-88e5-d55a-b61f-008de6261233"
/dev/mmcblk0p5: PARTLABEL="0:QSEE_1" PARTUUID="710ad80d-0152-92e0-1e66-d0fb67b8009a"
/dev/mmcblk0p17: BLOCK_SIZE="262144" TYPE="squashfs" PARTLABEL="rootfs" PARTUUID="587da891-73ba-afec-4017-5cbadd8af297"
/dev/mmcblk0p3: PARTLABEL="0:BOOTCONFIG1" PARTUUID="5674d289-8237-f06d-53d7-48dbf8eb3b39"
/dev/mmcblk0p15: PARTLABEL="0:ART" PARTUUID="11d6c779-9e55-6f97-4be8-729d52d063c1"
/dev/mmcblk0p1: PARTLABEL="0:SBL1" PARTUUID="682deed0-6649-ca45-66a0-22162ade2dfe"
/dev/mmcblk0p13: PARTLABEL="0:APPSBL" PARTUUID="bb0d5083-2f62-875d-62ae-fee313706e7b"
/dev/mmcblk0p11: PARTLABEL="0:CDT_1" PARTUUID="b2c41e4b-1a2a-ea3b-5396-2ba963c44e6b"
/dev/mmcblk0p8: PARTLABEL="0:RPM" PARTUUID="e48dcd77-0a84-abbc-6e2a-3a9922fbc01f"
/dev/mmcblk0p6: PARTLABEL="0:DEVCFG" PARTUUID="2a388616-d60e-791a-bef5-1526fbd4ddc5"
/dev/mmcblk0p4: PARTLABEL="0:QSEE" PARTUUID="d73d2e9d-a279-d0ae-b8cc-c0cbc7c7919a"
/dev/mmcblk0p16: PARTLABEL="0:HLOS" PARTUUID="9dc55cfc-549d-482c-fe12-139f1f9fe85a"
/dev/mmcblk0p2: PARTLABEL="0:BOOTCONFIG" PARTUUID="7d4d4d21-54a1-0503-f099-0d3328329e4c"
/dev/mmcblk0p14: PARTLABEL="0:APPSBL_1" PARTUUID="2184fc3b-c9f9-c0fa-6d95-fa89b9340ec5"
/dev/loop0: LABEL="rootfs_data" UUID="6704841d-9747-4b8b-b925-a6d659f4cece" BLOCK_SIZE="4096" TYPE="f2fs"
/dev/zram0: TYPE="swap"
root@LibWrt:~#
恢复原厂系统
__ ____ Commercial __
/\ \ __/\ _`\ Prohibition /\ \__
\ \ \ /\_\ \ \L\ \ __ __ __ _ __\ \ ,_\
\ \ \ __\/\ \ \ _ <'/\ \/\ \/\ \/\`'__\ \ \/
\ \ \L\ \\ \ \ \ \L\ \ \ \_/ \_/ \ \ \/ \ \ \_
\ \____/ \ \_\ \____/\ \___x___/'\ \_\ \ \__\
\/___/ \/_/\/___/ \/__//__/ \/_/ \/__/
-----------------------------------------------------
LibWrt SNAPSHOT, r0-0d80996
-----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@LibWrt:~# cd /tmp/
root@LibWrt:/tmp# cd /tmp/
root@LibWrt:/tmp# md5sum orig_mibib.bin orig_appsbl_p13.bin
fdb93f2eaa05947a56b820ec27e2686e orig_mibib.bin
7637c225a3567be948edb439b30631bb orig_appsbl_p13.bin
root@LibWrt:/tmp# dd if=orig_mibib.bin of=/dev/mmcblk0 bs=512 count=34
34+0 records in
34+0 records out
root@LibWrt:/tmp# dd if=orig_appsbl_p13.bin of=/dev/mmcblk0p13
1280+0 records in
1280+0 records out
root@LibWrt:/tmp#
© 版权声明
文章版权归作者所有,未经允许请勿转载。
THE END









- 最新
- 最热
查看全部