准备工作

SSH工具或者系统自带工具
一台openwrt固件的路由器

降级

首先将AX9000路由器降级到1.0.108版本，固件网上搜索。直接在系统WEB界面就能升级，升级完记得恢复出厂设置，方便以后操作。

开启SSH权限，不固化的那种，重启路由器也带。

网上下载一个openwrt的SH脚本，如果没找到就复制下边的脚本，保存到sh文件，取名为wireless-ax9000.sh。文件地址要记住，后边用。

sh
#!/bin/ash
# SPDX-License-Identifier: GPL-3.0-only
#
# Copyright (C) 2021 Robert Marko <[email protected]>
# Copyright (C) 2021 Tianling Shen <[email protected]>
#
# Original thread: https://forum.openwrt.org/t/openwrt-support-for-xiaomi-ax9000/98908/34

error_font="\033[31m[Error]\033[0m"
info_font="\033[36m[Info]\033[0m"
success_font="\033[32m[Success]\033[0m"
warning_font="\033[33m[Warning]\033[0m"

echo -e "${warning_font} Please make sure your router has wireless support!"
echo -e "${warning_font} Please make sure your router is restored to factory settings (not configured)!"
echo -e "${warning_font} Please make sure you've backed up the network and wireless settings!"
echo -e "${warning_font} Please make sure you've connected the router via *wired ethernet*!"
echo -e "${warning_font} Running this script will change your *network* settings!"
read -p "Use Ctrl+C to exit or press enter key to continue..."

echo -e ""
echo -e "${info_font} Adding xqsystem controller..."
cat > "/usr/lib/lua/luci/controller/admin/xqsystem.lua" <<EOF
module("luci.controller.admin.xqsystem", package.seeall)

function index()
    local page   = node("api")
    page.target  = firstchild()
    page.title   = ("")
    page.order   = 100
    page.index = true
    page   = node("api","xqsystem")
    page.target  = firstchild()
    page.title   = ("")
    page.order   = 100
    page.index = true
    entry({"api", "xqsystem", "token"}, call("getToken"), (""), 103, 0x08)
end

local LuciHttp = require("luci.http")

function getToken()
    local result = {}
    result["code"] = 0
    result["token"] = "; nvram set ssh_en=1; nvram set uart_en=1; nvram set boot_wait=on; nvram commit; uci set wireless.@wifi-iface[0].key=\`mkxqimage -I\`; uci commit; sed -i 's/channel=.*/channel=\"debug\"/g' /etc/init.d/dropbear; /etc/init.d/dropbear start;"
    LuciHttp.write_json(result)
end
EOF

echo -e "${info_font} Detecting network specifications..."
if iw dev wlan0 info >"/dev/null" 2>&1; then
	wlan_band="$(iw dev wlan0 info | grep -Eo 'width:.[0-9]+' | awk '{print $2}')"
	wlan_channel="$(iw dev wlan0 info | grep -Eo 'channel.[0-9]+' | awk '{print $2}')"
	[ -z "${wlan_band}" ] || [ -z "${wlan_channel}" ] && {
		echo -e "${error_font} Please launch the wireless firstly."
		exit 1
	}
else
	echo -e "${error_font} Device 'wlan0' is not found."
	exit 1
fi

echo -e "${info_font} Changing network settings..."
set -x
uci set dhcp.lan.ignore='1'
uci set network.lan.ipaddr='169.254.31.1'
uci set wireless.@wifi-iface[0].ssid='MEDIATEK-ARM-IS-GREAT'
uci set wireless.@wifi-iface[0].encryption='psk2+ccmp'
uci set wireless.@wifi-iface[0].key='ARE-YOU-OK'
uci set wireless.@wifi-iface[0].mode='ap'
uci set wireless.@wifi-iface[0].network='LAN lan'
uci -q commit
set +x

echo -e "${success_font} All settings are applied.\n"
echo -e "${info_font} Please now disconnect from this router, and connect to your Xiaomi AX9000."
echo -e "${info_font} Then open your browser, access the following URL:"
echo -e "       http://192.168.31.1/cgi-bin/luci/;stok=<STOK>/api/xqsystem/extendwifi_connect_inited_router?ssid=MEDIATEK-ARM-IS-GREAT&password=ARE-YOU-OK&encryption=WPA2PSKenctype=CCMP&channel=${wlan_channel}&band=${wlan_band}&admin_username=root&admin_password=admin&admin_nonce=xxx"
echo -e "${info_font} If the return code is 0, now you can connect to your AX9000 via SSH."
echo -e "${info_font} SSH login password is 5GHz wireless connection password."
echo -e ""
echo -e "${success_font} Thanks for usage."
echo -e "          Staff: Robert Marko, Tianling Shen"

echo -e ""
echo -e "${warning_font} Restarting network..."
wifi reload >"/dev/null" 2>&1
/etc/init.d/network restart >"/dev/null" 2>&1

在wireless-ax9000.sh所在文件夹点击右键，先择在终端中打开，或者打开cmd输入


d:
cd D:\ax9000

先无线连接到刷了openwrt的路由器，要么用finalshell，要么scp上传文件到路由器root目录下。ipv4地址就是openwrt的网关，会用到root密码。


scp wireless-ax9000.sh [email protected]:/root/wireless-ax9000.sh

然后 ssh 连接到这台 openwrt 路由器。


ssh [email protected]

再执行脚本（执行本脚本会更改您的网络和无线设定，执行之前请务必备份相关数据）


sh /root/wireless-ax9000.sh

断开openwrt路由器，连接上小米AX9000，打开192.168.31.1，输入密码登录。在浏览器地址栏，找到stok后边的一组数字，替换到下边stok位置。就在本窗口复制粘贴回车，等待半分钟即可。


http://192.168.31.1/cgi-bin/luci/;stok=<stok>/api/xqsystem/extendwifi_connect_inited_router?ssid=MEDIATEK-ARM-IS-GREAT&password=ARE-YOU-OK&admin_username=root&admin_password=admin&admin_nonce=xxx

如果返回此值，为正确。


{"token":"; nvram set ssh_en=1; nvram set uart_en=1; nvram set boot_wait=on; nvram commit; uci set wireless.@wifi-iface[0].key=`mkxqimage -I`; uci commit; sed -i 's/channel=.*/channel=\u0022debug\u0022/g' /etc/init.d/dropbear; /etc/init.d/dropbear start;","code":0}

root密码就是5G的wifi密码。浏览器后退刷新即可。到此SSH权限已经拿到了，可以安装openwrt或者shellclash。