CMCC RAX3000M CH EC 算力版刷机（中国移动 RAX3000M 算力版）刷机备份数据
我的CMCC RAX3000M CH EC 算力版
是20231216版本，不是之前的固定密码模式。
使用固定密码解密解不开。参考下面的文章
参考:
Actions-OpenWrt/Tutorial/RAX3000M-eMMC_XR30-eMMC.md at main · lgs2007m/Actions-OpenWrt
下载了配置文件。
解压的shell文件，wsl或者linux系统下面运行。后获得etc目录
#de.sh
# 替换成自己的SN
SN=081115000000000mypassword=$(openssl passwd -1 -salt aV6dW8bD "$SN")
mypassword=$(eval "echo $mypassword")
echo "$mypassword"
openssl aes-256-cbc -d -pbkdf2 -k "$mypassword" -in cfg_export_config_file.conf -out cfg_export_config_file.conf.tar.gztar -xzvf cfg_export_config_file.conf.tar.gz开启了telnet，删除了root。
rc.local文件增加
telnetd -p 23 -l /bin/ash
echo 3 > /proc/sys/vm/drop_caches即 rc.local文件
# Put your custom commands here that should be executed once
# the system init finished. By default this file does nothing.telnetd -p 23 -l /bin/ash
echo 3 > /proc/sys/vm/drop_caches
exit 0但是，没有ssh
修改shdow文件，删除root后面的第一第二个：中间的密码
root::19179:0:99999:7:::重新打包
en.sh ,wsl或linux下面执行shell脚本
#替换成自己的SN
SN=081115000000000mypassword=$(openssl passwd -1 -salt aV6dW8bD "$SN")
mypassword=$(eval "echo $mypassword")
echo "$mypassword"tar -zcvf cfg_exprot_file_new.conf.tar.gz etc
openssl aes-256-cbc -pbkdf2 -k "$mypassword" -in cfg_exprot_file_new.conf.tar.gz -out cfg_import_config_file_new.conf
然后，使用 cfg_import_config_file_new.conf文件重新恢复配置。
重启路由器。
可以使用telnet登录到路由器了。
使用下面命令备份数据：
dd if=/dev/mmcblk0boot0 bs=512 count=2048 of=/mnt/mmcblk0p12/boot0_bl2.bin conv=fsync
dd if=/dev/mmcblk0 bs=512 count=34 of=/mnt/mmcblk0p12/mmcblk0_GPT.bin conv=fsync
dd if=/dev/mmcblk0 bs=512 skip=34 count=8158 of=/mnt/mmcblk0p12/mmcblk0_unpartitioned.bin conv=fsync
dd if=/dev/mmcblk0p1 of=/mnt/mmcblk0p12/mmcblk0p1_u-boot-env.bin conv=fsync
dd if=/dev/mmcblk0p2 of=/mnt/mmcblk0p12/mmcblk0p2_factory.bin conv=fsync
dd if=/dev/mmcblk0p3 of=/mnt/mmcblk0p12/mmcblk0p3_fip.bin conv=fsync
dd if=/dev/mmcblk0p4 of=/mnt/mmcblk0p12/mmcblk0p4_kernel.bin conv=fsync
dd if=/dev/mmcblk0p5 of=/mnt/mmcblk0p12/mmcblk0p5_rootfs.bin conv=fsync
dd if=/dev/mmcblk0p6 of=/mnt/mmcblk0p12/mmcblk0p6_kernel2.bin conv=fsync
dd if=/dev/mmcblk0p7 of=/mnt/mmcblk0p12/mmcblk0p7_rootfs2.bin conv=fsync
dd if=/dev/mmcblk0p8 of=/mnt/mmcblk0p12/mmcblk0p8_rootfs_data.bin conv=fsync
dd if=/dev/mmcblk0p9 of=/mnt/mmcblk0p12/mmcblk0p9_plugins.bin conv=fsync
dd if=/dev/mmcblk0p10 of=/mnt/mmcblk0p12/mmcblk0p10_fwk.bin conv=fsync
dd if=/dev/mmcblk0p11 of=/mnt/mmcblk0p12/mmcblk0p11_fwk2.bin conv=fsync
sync然后，因为，路由器没有ssh，sftp命令，没有办法使用scp等命令copy出来。
可以telnet进入路由器后。
cd /etc/opkg
#备份
cp distfeeds.conf distfeeds.conf.backup因为wget等默认不支持https
修改distfeeds.conf 文件改为http模式，下载
wget-ssl
opkg update
opkg install wget-ssl后面可以修改distfeeds.conf 的文件改回https，可以正常下载数据就ok了
后续安装其他ssh软件
opkg update
opkg install openssh-server
opkg install openssh-client# https://openwrt.org/docs/guide-user/services/nas/sftp.server
opkg update
opkg install openssh-sftp-server
opkg install openssh-sftp-client
| 步骤 | 操作 |
| --- | --- |
| 1 | 登录OpenWrt设备 |
| 2 | 安装openssh-server软件包 |
| 3 | 启动SSH服务 |
| 4 | 设置SSH登录密码 |
| 5 | 配置SSH服务 |
| 6 | 重启SSH服务 |
接下来，我将逐步解释每一步需要做什么，并提供相应的代码示例：
### 步骤 1：登录OpenWrt设备
首先，连接到OpenWrt设备的控制台或使用SSH登录到设备上。
### 步骤 2：安装openssh-server软件包
在控制台中执行以下命令安装openssh-server软件包：
```bash
opkg update // 更新软件包列表
opkg install openssh-server // 安装openssh-server软件包
```
### 步骤 3：启动SSH服务
执行以下命令启动SSH服务：
```bash
/etc/init.d/sshd start // 启动SSH服务
```
### 步骤 4：设置SSH登录密码
执行以下命令设置SSH登录密码：
```bash
passwd root // 设置root用户的密码
```
### 步骤 5：配置SSH服务
编辑SSH配置文件，可以根据需要进行配置。以下是一个简单的配置示例：
```bash
vi /etc/ssh/sshd_config // 编辑SSH配置文件
# 将以下配置添加到文件末尾
Port 22 // SSH服务端口，默认为22
PermitRootLogin yes // 允许root用户登录
PasswordAuthentication yes // 使用密码进行认证
```
### 步骤 6：重启SSH服务
重新加载SSH配置并重启SSH服务以使更改生效：
```bash
/etc/init.d/sshd reload // 重新加载SSH配置
/etc/init.d/sshd restart // 重启SSH服务
```
至此，你已成功在OpenWrt中开启了SSH服务。现在你可以使用SSH客户端连接到OpenWrt设备，并进行远程管理操作了
启用ssh，sftp后，就可以自由的备份数据了
在电脑上面使用如下命令备份数据。
scp -R root@192.168.0.116:/extend/* .
Hardware specification:SoC: MediaTek MT7981B 2x A53Flash: 64GB eMMC or 128 MB SPI-NANDRAM: 512MBEthernet: 4x 10/100/1000 MbpsSwitch: MediaTek MT7531AEWiFi: MediaTek MT7976CButton: Reset, MeshPower: DC 12V 1A - UART: 3.3v, 115200n8--------------------------| Layout || ----------------- || 4 | GND TX VCC RX | <= || ----------------- |--------------------------Gain SSH access: 1. Login into web interface, and download the configuration. 2. Enter fakeroot, decompress the configuration:tar -zxf cfg_export_config_file.conf 3. Edit 'etc/config/dropbear', set 'enable' to '1'. 4. Edit 'etc/shadow', update (remove) root password:'root::19523:0:99999:7:::' 5. Repack 'etc' directory:tar -zcf cfg_export_config_file.conf etc/* If you find an error about 'etc/wireless/mediatek/DBDC_card0.dat',just ignore it. 6. Upload new configuration via web interface, now you can SSH to RAX3000M.Check stroage type: Check the label on the back of the device: "CH EC CMIIT ID: xxxx" is eMMC version "CH CMIIT ID: xxxx" is NAND versioneMMC Flash instructions: 1. SSH to RAX3000M, and backup everything, especially 'factory' part.('data' partition can be ignored, it's useless.) 2. Write new GPT table:dd if=openwrt-mediatek-filogic-cmcc_rax3000m-emmc-gpt.bin of=/dev/mmcblk0 bs=512 seek=0 count=34 conv=fsync 3. Erase and write new BL2:echo 0 > /sys/block/mmcblk0boot0/force_rodd if=/dev/zero of=/dev/mmcblk0boot0 bs=512 count=8192 conv=fsyncdd if=openwrt-mediatek-filogic-cmcc_rax3000m-emmc-preloader.bin of=/dev/mmcblk0boot0 bs=512 conv=fsync 4. Erase and write new FIP:dd if=/dev/zero of=/dev/mmcblk0 bs=512 seek=13312 count=8192 conv=fsyncdd if=openwrt-mediatek-filogic-cmcc_rax3000m-emmc-bl31-uboot.fip of=/dev/mmcblk0 bs=512 seek=13312 conv=fsync 5. Set static IP on your PC:IP 192.168.1.254, GW 192.168.1.1 6. Serve OpenWrt initramfs image using TFTP server. 7. Cut off the power and re-engage, wait for TFTP recovery to complete. 8. After OpenWrt has booted, perform sysupgrade. 9. Additionally, if you want to have eMMC recovery boot feature:(Don't worry! You will always have TFTP recovery boot feature.)dd if=openwrt-mediatek-filogic-cmcc_rax3000m-initramfs-recovery.itb of=/dev/mmcblk0p4 bs=512 conv=fsyncNAND Flash instructions: 1. SSH to RAX3000M, and backup everything, especially 'Factory' part. 2. Erase and write new BL2:mtd erase BL2mtd write openwrt-mediatek-filogic-cmcc_rax3000m-nand-preloader.bin BL2 3. Erase and write new FIP:mtd erase FIPmtd write openwrt-mediatek-filogic-cmcc_rax3000m-nand-bl31-uboot.fip FIP 4. Set static IP on your PC:IP 192.168.1.254, GW 192.168.1.1 5. Serve OpenWrt initramfs image using TFTP server. 6. Cut off the power and re-engage, wait for TFTP recovery to complete. 7. After OpenWrt has booted, erase UBI volumes:ubidetach -p /dev/mtd0ubiformat -y /dev/mtd0ubiattach -p /dev/mtd0 8. Create new ubootenv volumes:ubimkvol /dev/ubi0 -n 0 -N ubootenv -s 128KiBubimkvol /dev/ubi0 -n 1 -N ubootenv2 -s 128KiB 9. Additionally, if you want to have NAND recovery boot feature:(Don't worry! You will always have TFTP recovery boot feature.)ubimkvol /dev/ubi0 -n 2 -N recovery -s 20MiBubiupdatevol /dev/ubi0_2 openwrt-mediatek-filogic-cmcc_rax3000m-initramfs-recovery.itb 10. Perform sysupgrade.
刷机的时候，按照上面配置好了 IP 192.168.1.254, GW 192.168.1.1
防火墙也配置规则就是不管用。
网络配置计算机在网络上面发现不了，改成
为了防止万一临时关闭防护墙。
ok，开始传输数据了，之前大意了。
Connection received from 192.168.1.1 on port 3352 [25/04 19:53:10.377] Read request for file <openwrt-mediatek-filogic-cmcc_rax3000m-initramfs-recovery.itb>. Mode octet [25/04 19:53:10.379] OACK: <timeout=5,blksize=1468,> [25/04 19:53:10.381] Using local port 56202 [25/04 19:53:10.381] Connection received from 192.168.1.1 on port 3743 [25/04 19:53:29.235] Read request for file <openwrt-mediatek-filogic-cmcc_rax3000m-initramfs-recovery.itb>. Mode octet [25/04 19:53:29.237] OACK: <timeout=5,blksize=1468,> [25/04 19:53:29.237] Using local port 49350 [25/04 19:53:29.237] MD5 written into <D:\cmcc_rax3000m\firm\openwrt-mediatek-filogic-cmcc_rax3000m-initramfs-recovery.itb.md5> [25/04 19:53:40.070] <openwrt-mediatek-filogic-cmcc_rax3000m-initramfs-recovery.itb>: sent 6251 blks, 9175040 bytes in 11 s. 2 blks resent [25/04 19:53:40.070] TIMEOUT waiting for Ack block #3822 [25/04 19:53:43.524]openwrt-mediatek-filogic-cmcc_rax3000m-initramfs-recovery.itb
固件的名字需要改成这个才可以被找到。
TFTPD64 : an opensource IPv6 ready TFTP server/service for windows : TFTP server
然后，路由器的灯转绿，可以访问192.168.1.1 web页面了
ssh 也可以登录路由器
ssh root@192.168.1.1
root@192.168.1.1's password:BusyBox v1.36.1 (2025-04-13 16:38:32 UTC) built-in shell (ash)_______ ________ __| |.-----.-----.-----.| | | |.----.| |_| - || _ | -__| || | | || _|| _||_______|| __|_____|__|__||________||__| |____||__| W I R E L E S S F R E E D O M-----------------------------------------------------OpenWrt 24.10.1, r28597-0425664679-----------------------------------------------------参考：
https://openwrt.org/docs/guide-user/services/nas/sftp.server
mediatek: add CMCC RAX3000M support by 1715173329 · Pull Request #13513 · openwrt/openwrt
Actions-OpenWrt/Tutorial/RAX3000M-eMMC_XR30-eMMC.md at main · lgs2007m/Actions-OpenWrt