【笔记】记一次小米路由器固件解包

460 字

2 分钟

【笔记】记一次小米路由器固件解包

2026-07-14

笔记

Openwrt

工具准备：#

幻梦是在Debian13上完成的解包操作，以下的笔记仅针对Debian系统环境。

这次解包的为 miwifi_rc01_firmware_5a1e1_1.1.56.bin

安装 SquashFS 和 Python3

1
sudo apt install squashfs-tools
2
sudo apt install python3 python3-pip pipx git

安装 ubi_reader

1
pipx install git+https://github.com/jrspruitt/ubi_reader.git

下载ROM：#

miwifi.com

可以下载到最新的 rom 文件。

解包流程：#

1.查看 UBI 信息#

1
ubireader_display_info miwifi_rc01_firmware_5a1e1_1.1.56.bin

1
UBI_File Warning: end_offset - start_offset length is not block aligned, could mean missing data.
2
UBI File
3
---------------------
4
        Min I/O: 2048
5
        LEB Size: 126976
6
        PEB Size: 131072
7
        Total Block Count: 294
8
        Data Block Count: 292
9
        Layout Block Count: 2
10
        Internal Volume Block Count: 0
11
        Unknown Block Count: 0
12
        First UBI PEB Number: 1
13

14
        Image: 1955263782
15
        ---------------------
16
                Image Sequence Num: 1955263782
17
                Volume Name:kernel
18
                Volume Name:ubi_rootfs
19
                PEB Range: 2 - 293
20

21
                Volume: kernel
22
                ---------------------
23
                        Vol ID: 0
24
                        Name: kernel
25
                        Block Count: 42
26

27
                        Volume Record
28
                        ---------------------
29
                                alignment: 1
30
                                crc: '0xceb18f81'
31
                                data_pad: 0
32
                                errors: ''
33
                                flags: 0
34
                                name: 'kernel'
35
                                name_len: 6
36
                                padding: '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
37
                                rec_index: 0
38
                                reserved_pebs: 83
39
                                upd_marker: 0
40
                                vol_type: 'static'
41

42

43
                Volume: ubi_rootfs
44
                ---------------------
45
                        Vol ID: 1
46
                        Name: ubi_rootfs
47
                        Block Count: 250
48

49
                        Volume Record
50
                        ---------------------
51
                                alignment: 1
52
                                crc: '0xc84aa00d'
53
                                data_pad: 0
54
                                errors: ''
55
                                flags: 0
56
                                name: 'ubi_rootfs'
57
                                name_len: 10
58
                                padding: '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
59
                                rec_index: 1
60
                                reserved_pebs: 250
61
                                upd_marker: 0
62
                                vol_type: 'dynamic'

可以看到有Volume Name: kernel与Volume Name: ubi_rootfs确认是标准UBI

2.提取 UBI Volume#

1
ubireader_extract_images miwifi_rc01_firmware_5a1e1_1.1.56.bin

1
UBI_File Warning: end_offset - start_offset length is not block aligned, could mean missing data.

可能会输出这样的警告，但是先不管他，ls看一下是不是生成了ubifs-root目录

一般目录的路径是这样的。

1
ubifs-root/
2
└── miwifi_rc01_firmware_5a1e1_1.1.56.bin/
3
    ├── img-1955263782_vol-kernel.ubifs
4
    └── img-1955263782_vol-ubi_rootfs.ubifs

他这个.bin结尾的真的是一个文件夹，是可以打开的。

3.确认 RootFS 类型#

1
file ubifs-root/miwifi_rc01_firmware_5a1e1_1.1.56.bin/img-1955263782_vol-ubi_rootfs.ubifs

1
ubifs-root/miwifi_rc01_firmware_5a1e1_1.1.56.bin/img-1955263782_vol-ubi_rootfs.ubifs:
2
Squashfs filesystem, little endian,
3
version 4.0,
4
xz compressed,
5
31643602 bytes,
6
5765 inodes,
7
blocksize: 262144 bytes,
8
created: Wed May 14 07:57:33 2025

说明这个 Volume 是一个完整的 SquashFS

4.解包 RootFS#

1
unsquashfs \
2
-d rootfs \
3
ubifs-root/miwifi_rc01_firmware_5a1e1_1.1.56.bin/img-1955263782_vol-ubi_rootfs.ubifs

1
Parallel unsquashfs: Using 4 processors
2
5433 inodes (5062 blocks) to write
3

4

5
create_inode: could not create character device rootfs/dev/console, because you're not superuser!
6
[==================================================================================| ] 10494/10495  99%
7

8
created 4877 files
9
created 332 directories
10
created 555 symlinks
11
created 0 devices
12
created 0 fifos
13
created 0 sockets
14
created 0 hardlinks