Qihoo 360T7 is one of the routers that uses MediaTek MT7981B SoC (System-On-Chip). It is a WiFi-6 router with 128M flash and 256MB RAM. It has good performance and is very affordable. The stock firmware runs an old version of OpenWRT. To get latest security patch and features, this guide shows you how to flash latest OpenWRT on the device.
Before You Start
Before you try to access the UART via TTL, check whether telnet is enabled on the current firmware. If telnet is enabled, you don’t need to use UART. Also check if a 3rd party u-boot is installed on the device. If it is, you don’t need to use UART.
Check your USB TTL device is working properly. Plug in your device, you should see /dev/ttyUSB0 shown up in your device tree. In my case, I use a CP2102 USB device, I need to build my own kernel module for it to work.
Get latest OpenWRT files for this device. You can find them at https://firmware-selector.openwrt.org/, type in 360t7, the files will show up. You need the SYSUPGRADE, PRELOADER.BIN, BL31-UBOOT.FIP files.
Connect the UART TTL Cables
It is possible to connect 3 cables to the device without opening the case. Put the device on the table, face down. Put antenna on the left side, put RJ45 sockets on the right side. Put a cellphone flashlight on the back of the device, adjust the flashlight spotlight so you can see 4 holes on the board. The first hole is square; the rest are circles. Ignore the first hole, the remaining 3 circle holes are GND, TX, RX. You need to connect them to your TTL device’s GND, RX, TX.
Get 3 thin metal wire. Those used to fasten charging cables works fine. Remove the outside of the wire. Fold them to Z shape so they can be insert to the 360t7 device through the louver holes on the case. Use tape to fix each wire once they are in position. Connect all 3 wires to duPont wire on your USB TTL device. GND-GND, TX-RX, RX-TX.
Prepare Terminal to Connect to Serial
On Linux, install minicom package. Run minicom with
sudo minicom -D /dev/ttyUSB0Configure minicom by pressing Ctrl-A O
Serial port setup
F - Hardware Flow Control
G - Software Flow Control
Make sure both says No. Otherwise, keyboard input won’t work.
Save this configure as default in Ctrl-A O menu. Otherwise, each time you start minicom, you need to config this again.
Go To OpenWRT Failsafe Mode
With minicom running, all cables connected, now connect power cable to boot your device. You should see u-boot and kernel output in minicom terminal. After kernel boot, wait for 3s, then press F and Enter key repeatedly to enter failsafe mode.
If you never saw failsafe mode text prompt, let the router boot normally, then flash 360T7-v4.2.4.7959_upgrade.bin in stock firmware web UI. In newer firmware, failsafe mode is disabled, revert to this older version to allow OpenWRT failsafe mode.
Enable Telnet and Set Root Password in Failsafe Mode
Once you get to failsafe mode root shell, run these commands:
fw_setenv bootmenu_delay 3
mount_root
# Enable telnet service
sed -i 's/.*local debug=.*/\tlocal debug=1/' /etc/init.d/telnet
# Set password for root, type a password of your choice twice.
passwd root
cat /proc/mtd
# you should see stock Qihoo 360t7 layout.root@(none):/# cat /proc/mtd
dev: size erasesize name
mtd0: 08000000 00020000 "spi0.0"
mtd1: 00100000 00020000 "bl2"
mtd2: 00080000 00020000 "u-boot-env"
mtd3: 00200000 00020000 "Factory"
mtd4: 00200000 00020000 "fip"
mtd5: 02400000 00020000 "ubi"
mtd6: 02400000 00020000 "firmware-1"
mtd7: 02400000 00020000 "plugin"
mtd8: 00100000 00020000 "config"
mtd9: 00080000 00020000 "factory"
mtd10: 00700000 00020000 "log"Run “reboot” to reboot the device. Now you should use stock u-boot menu. You can use u-boot menu to flash u-boot and firmware, or you can do it in telnet session after the device is fully boot. I choose to use u-boot menu.
On u-boot menu, select “Upgrade ATF BL2”, serve OpenWRT preloader.bin via TFTP. Run mtkautoboot to show u-boot menu again.
Select “Upgrade ATF FIP”, serve OpenWRT bl31-uboot.fip via TFTP. Run “reset” to reboot device. Now you should see OpenWRT’s u-boot menu. It is different than stock u-boot menu.
( ( ( OpenWrt ) ) ) U-Boot 2024.10-OpenWrt-r28872-daca7c049b (Sep 19 20
1. Run default boot command.
2. Boot system via TFTP.
3. Boot production system from NAND.
4. Boot recovery system from NAND.
5. Load production system via TFTP then write to NAND.
6. Load recovery system via TFTP then write to NAND.
7. Load BL31+U-Boot FIP via TFTP then write to NAND.
8. Load BL2 preloader via TFTP then write to NAND.
9. Reboot.
a. Reset all settings to factory defaults.
0. Exit
Press UP/DOWN to move, ENTER to select, ESC to quitFlash OpenWRT
On Linux computer, serve openwrt-mediatek-filogic-qihoo_360t7-initramfs-recovery.itb via 192.168.1.254 TFTP server. In OpenWRT u-boot menu, select “Boot system via TFTP.” It will boot to OpenWRT initramfs-recovery. When initramfs-recovery boots, use ssh or luci to flash OpenWRT sysupgrade image.
After that, router will auto reboot, you will have latest OpenWRT running on Qihoo 360T7.