---Install Breed bootloader.

Before doing anything else, you need to save your original "fullflash" and EEPROM* data of
your router with help of breed_bootloader. The "fullflash" file contains all data about firmware
partitions, EEPROM, Bdata, RF calibration and MAC address!

---After saving "fullflash" and EEPROM*, write pb-boot.bin bootloader from breed_bootloader. All
Keenetic modded firmware for Xiaomi_XXX will be flashed only by pb-boot_bootloader, do not try
to flash any Keenetic firmware from breed_bootloader.

*on a Xiaomi R3P device, EEPROM will not be saved by breed_bootloader because this is located in a different place than standard. Please
save it manually using a hex editor program. EEPROM can be found starting from 0xC0000 address (size 256KB) in the "full flash" file. See
the “Tips and tricks” page.

Page 1
---After you write the pb-boot_bootloader file, reboot the router, press the reset button for 5 seconds
and access the PandoraBox web page on address http://192.168.1.1 .
---Attention! If the PandoraBox web interface does not appear, try to clear cache browser, disable
your antivirus / firewall and try to set a manual IP address (192.168.1.2) on your PC. ---Select
Keenetic_XXX_factory.bin and press “Firmware update” only once.
---After you press “Firmware update” it will take some time to upload data because the firmware
is bigger, please be patient until the process is finished! This is a very important and dangerous
step. The whole operation takes about 3 minutes after you pressed the “Firmware update” button.

---This firmware contains new data about eeprom, RF calibration, bdata, mac address and a
special modified Breed_bootloader version by me, to prevent accidental updates and make work
easier.

DO NOT TRY to write any other official Keenetic firmware on pb-boot or breed_bootloader
because they contain a factory bootloader which will damage your router!!!

---After the router has restarted, try to access Keenetic web page on address: http://192.168.1.1 If you
see this page, it means you have succeeded. Congratulations, now you are on the Keenetic firmware!!!

Page 2
Page 3
---After successfully flashed Keenetic firmware, all original information about your router will be
modified.
---To restore the original MAC address and RF calibration data, write the EEPROM file that you
previously saved in Step 1 with help of breed_bootloader.

---Mobile app and other Keenetic services won't work if you do not edit these fields with genuine
data. If you want these services to work continuously, you need to replace these fields with a valid
sernumb, servicepass, servicetag and mac address from an original Keenetic device (this
firmware works only with data from "KN'' routers series manufactured after 2017).

---The firmware itself will not be affected by this and will work smoothly without changing
these parameters with genuine data. These changes must be made only by those who wish
to have access to the services offered by Keenetic.

Page 4
 DO NOT TRY to update or change your bootloader / firmware, as long you have the Keenetic
firmware on your router. If you want to make any other changes on bootloader or firmware
you must return to the initial state using Step 5.

---If you want to go back or install any other firmware or bootloader, you need to access
breed_bootloader, upload "fullflash" (file which you previously saved on Step.1), uncheck EEPROM
and Bootloader and press upload. In the end, after you write "fullflash", you will get original
configuration with all EEPROM calibration and data of your router which you had before installing
Keenetic.

Page 5
1. To save EEPROM from XIAOMI R3P device, you need to open “fullflash” file, that you saved on
Step.1 with HxD Hex or Winhex program. Open program, go to Edit tab / Select block / Startoffset=
C0000 / End-offset= FFFFF. / OK. Then CTRL + C / File / New / CTRL + V / File / Save as…/
EEPROM (file name). After this operation you will have a valid EEPROM with 256KB size that can
be loaded using Breed_bootloader.

2. If your Breed do not accept* your “fullflash”, you need to cut “fullflash” file from address
4000000 to the end with HxD Hex or Winhex, so your "fullflash" file must have 64MB max to be
accepted by Breed.

*only on RM/AC 2100

Page 6
3. Question:

If I forgot my username or password, how would I reset the device?

Answer:

Go to Breed_Bootloader and access Telnet service on 192.168.1.1.

Execute the following commands:

flash erase 0x1d40000 0x80000

flash erase 0x5d00000 0x80000

flash erase 0xab80000 0x80000 - (only for Xiaomi R3P)

reset

If you want to Factory reset via CLI Keenetic interface:

(config)>system

(system)>configuration factory-reset

(system)>reboot

Page 7