Unlock Xiaomi Routers

Change region of Xiaomi routers to unlock all channel:
 
1. Login to ur router in browser.
2. Open a new tab and paste this
 
http://192.168.31.1/cgi-bin/luci/;stok=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/api/xqsystem/set_country_code?country=CN
 
get the stok value from login tab and replace it in new tab and then hit enter.
 
3. Router will reboot automatically and on next login u will see all 5Ghz channel 36~48 and 149~165.
 
**u can also go with country=HK or country=TW (hongkong or taiwan)

I was able to unlock upper channels (149 and above) of 5GHz WiFi on Ax3000. For me what I did was

• Turned off smart connect i.e. separated 2.4GHz and 5GHz bands
• First changed the location** and country code*** of satellite router then primary router to CN.
• Changed the 5GHz bandwidth to 80MHz.

** http://192.168.31.1/cgi-bin/luci/;stok=xxxxxxxxxxxxxxxxxxxxxxxxx/api/xqsystem/set_location?location=CN
*** http://192.168.31.1/cgi-bin/luci/;stok=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/api/xqsystem/set_country_code?country=CN

If you change the primary router first it will break the mesh network and you have to reset it. Also keep the wireless channel to auto because dropdown will not show the extended channels. I initalized the router with South Korea region and after changing the location to CN I changed the time zone of primaray router to Korea again as satellite/mesh router timezone was not changed with location change

For those who has {"msg":"操作失败","code":1606} because CountryCode hardcode within bdata partition
You can change Country Code by editing bdata mtd partition then write back to device.
Here 's some steps:

1.Get bdata partition to edit. Require ssh enabled.

• List all mtd partition to find which is bdata, in my case bdata is mtd15
  #cat /proc/mtd
• Get bdata
  #nanddump -f /tmp/bdata.bin /dev/mtd15
• Download bdata.bin to PC to edit with WinSCP or something like that.

2.Edit countrycode. Need hex editor, python 3 and some python script in https://github.com/odedlaz/ax3600-files/tree/master/scripts

• Open bdata.bin in Hex Editor, replace old Country code whith new one then save the file.
  
• Calculate CRC32 of new file with crc32.py from above github

    python C:\crc32.py "C:\Users\z**\Desktop\bdata.bin"
    new:      0xc71829ed
    original: 0x20dddf5c

• Edit bdata first 4 offset with new CRC32 checksum
  

3. Enable write permission on bdata partition. Default is readonly. SSH to Router

• Run command to some write magic bytes to crash partition that make bdata writeable
  zz=$(dd if=/dev/zero bs=1 count=2 2>/dev/null) ; printf '\xA5\x5A%c%c' $zz $zz | mtd write - crash
• Reboot device
  Reboot
• I use WinsSCP uploading edited bdada.bin to /tmp/
• Write new bdata to NAND
  mtd write /tmp/bdata.bin bdata
• Reboot device
  Reboot

4. The result
   
5. DFS channel(100-144) still not working as expected. wifi 5ghz disappeared. Maybe my device is for China only so Xiaomi blocking those channel from firmware that nothing i can do :/