Unlock Xiaomi Routers

Change region of Xiaomi routers to unlock all channel:
 
1. Login to ur router in browser.
2. Open a new tab and paste this
 
http://192.168.31.1/cgi-bin/luci/;stok=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/api/xqsystem/set_country_code?country=CN
 
get the stok value from login tab and replace it in new tab and then hit enter.
 
3. Router will reboot automatically and on next login u will see all 5Ghz channel 36~48 and 149~165.
 
**u can also go with country=HK or country=TW (hongkong or taiwan)

For those who has {"msg":"操作失败","code":1606} because CountryCode hardcode within bdata partition
You can change Country Code by editing bdata mtd partition then write back to device.
Here 's some steps:

1.Get bdata partition to edit. Require ssh enabled.

• List all mtd partition to find which is bdata, in my case bdata is mtd15
  #cat /proc/mtd
• Get bdata
  #nanddump -f /tmp/bdata.bin /dev/mtd15
• Download bdata.bin to PC to edit with WinSCP or something like that.

2.Edit countrycode. Need hex editor, python 3 and some python script in https://github.com/odedlaz/ax3600-files/tree/master/scripts

• Open bdata.bin in Hex Editor, replace old Country code whith new one then save the file.
  
• Calculate CRC32 of new file with crc32.py from above github

    python C:\crc32.py "C:\Users\z**\Desktop\bdata.bin"
    new:      0xc71829ed
    original: 0x20dddf5c

• Edit bdata first 4 offset with new CRC32 checksum
  

3. Enable write permission on bdata partition. Default is readonly. SSH to Router

• Run command to some write magic bytes to crash partition that make bdata writeable
  zz=$(dd if=/dev/zero bs=1 count=2 2>/dev/null) ; printf '\xA5\x5A%c%c' $zz $zz | mtd write - crash
• Reboot device
  Reboot
• I use WinsSCP uploading edited bdada.bin to /tmp/
• Write new bdata to NAND
  mtd write /tmp/bdata.bin bdata
• Reboot device
  Reboot

4. The result
   
5. DFS channel(100-144) still not working as expected. wifi 5ghz disappeared. Maybe my device is for China only so Xiaomi blocking those channel from firmware that nothing i can do :/