Huawei E970 / T-Mobile web'n'walk Box IV

This device is NOT RECOMMENDED for future use with OpenWrt due to low flash/ram.
DO NOT BUY DEVICES WITH 4MB FLASH / 32MB RAM if you intend to flash an up-to-date and secure OpenWrt version onto it! See 4/32 warning for details.

1) This device does not have sufficient resources (flash and/or RAM) to provide secure and reliable operation.
This means that even setting a password or changing simple network settings might not be possible any more, rendering the device effectively useless. See OpenWrt on 4/32 devices what you can do now.

2) OpenWrt support for this device has ended in 2022.
19.07.10 was the last official build for 4/32 devices.

As of now, this document covers an E970 labelled as T-Mobile web'n'walk Box IV. Please upgrade the document in case other devices differ.

Additionally, the device has a built-in 3G modem. Drivers are available in OpenWrt.

The modem can also be accessed independently via a USB 2.0 device port (router is disabled while USB is connected). Info from lsusb:

ID 12d1:1003 Huawei Technologies Co., Ltd. E220 HSDPA Modem / E230/E270/E870 HSDPA/HSUPA Modem

This device uses CFE as boot loader. For generic info about flash layouts, see flash.layout.

Huawei E970 Flash Layout
Layer0 Physically mapped flash -- total: 4096KiB
Layer1 mtd0 cfe 256KiB mtd1 linux 3712KiB mtd5 factory 64KiB mtd4 nvram 64KiB
Layer2 mtd2 rootfs
Layer3 mtd3 rootfs_data
description boot loader kernel read-only part writeable part factory data, see below cfe configuration
mountpoint none none /rom /overlay none none
filesystem none none SquashFS JFFS2 none none

Sizes of kernel, mtd2 and mtd3 depend on the actual image being used (which kernel modules and packages are installed, ...).

Note that this device has an additional partition called factory, located right in front of the nvram partition. It contains device-specific data such as MAC addresses and serial numbers, and is used by CFE to perform a factory reset. If this partition gets corrupt, on factory reset CFE will set a default MAC address which is the same for all devices (00:90:4c:c0:85:59)!

If that happens, restore the factory partition from a backup. If you don't have a backup, you'll have to restore this info manually after every factory reset (from the sticker on the case):

nvram set il0macaddr=00:1E:10:xx:yy:zz     # (your MAC address)
nvram set et0macaddr=00:1E:10:xx:yy:zz     # (usually the same MAC address)
nvram set serno=<your_serial_number>
nvram commit
  • Browse to your router, login as admin
  • Go to Advanced Settings/System/Upgrade software
  • Select the openwrt-.bin for E970 and click Upgrade
  • Wait for it to reboot
  • Telnet to and set a root password, or browse to if LuCI is installed.
  • Telnet to your router, login with username=admin, password=admin
  • If your OEM firmware doesn't have telnet opened, try a firmware upgrade/downgrade
  • How to backup mtdblock:
  • 1. Save mtdblocks to ramfs /tmp:
# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00040000 00010000 "cfe"
mtd1: 00340000 00010000 "linux"
mtd2: 00281f40 00010000 "rootfs"
mtd3: 00060000 00010000 "resource"
mtd4: 00010000 00010000 "factory"
mtd5: 00010000 00002000 "nvram"
cat /dev/mtd/0 > /tmp/3w/0.jpg
cat /dev/mtd/1 > /tmp/3w/1.jpg
cat /dev/mtd/2 > /tmp/3w/2.jpg
cat /dev/mtd/3 > /tmp/3w/3.jpg
cat /dev/mtd/4 > /tmp/3w/4.jpg
cat /dev/mtd/5 > /tmp/3w/5.jpg
  • 2. Download mtd blocks(download from a browser or a download manager): 
  • 3. Rename files:
0.jpg to cfe.bin
5.jpg to nvram.bin
  • [TODO: describe how to flash openwrt]

(Work-in-progress -- currently TFTP upgrade seems not to be possible with the version of CFE used by this device)


If you have already installed OpenWrt and like to reflash for e.g. upgrading to a new OpenWrt version you can upgrade using the mtd command line tool. It is important that you put the firmware image into the ramdisk (/tmp) before you start flashing.

LuCI Web Upgrade Process

  • Browse to LuCI Upgrade URL
  • Upload image file for sysupgrade to LuCI
  • Wait for reboot

Terminal Upgrade Process

  • Login as root via SSH on
  • Use the following commands to upgrade.
cd /tmp/
sysupgrade /tmp/

Basic configuration After flashing, proceed with this.
Set up your Internet connection, configure wireless, configure 3G connection, etc.

The default network configuration is:

Interface Name Description Default configuration
br-lan LAN & WiFi
vlan0 (eth0.0) LAN ports 1 to 3 None
vlan1 (eth0.1) LAN port 0 DHCP(?)
wl0 WiFi Disabled

Numbers 0-3 are the 4 LAN ports, with port 0 being the one next to the external 3G antenna connector and port 3 the one next to the telephone connector. Switch port 4 is unconnected, and 5 is the internal connection to the router itself.

hardware.button on howto use and configure the hardware button(s).

There are two buttons:

  • Factory reset: connected to GPIO 6
  • On/Off: implemented in hardware, not usable for user-defined events
Architecture MIPS
Vendor Broadcom
Bootloader CFE
System-On-Chip Broadcom BCM5354
CPU/Speed 3300 V2.9@240MHz
Flash-Chip Spansion S29GL032A
Flash size 4 MiB
RAM-Chip Hynix HY5DU561622ETP
RAM 32 MiB
Wireless Broadcom BCM5354 integrated 2.4GHz 802.11bg
Ethernet Broadcom 44xx/47xx 10/100BaseT Ethernet w/ vlan support
Internet 3G HSDPA/HSUPA, 2.5G GPRS/EDGE, wired (via LAN port)
USB 1×2.0 (internal only, used by modem)
Serial Yes
JTAG Probably, not tested

Model Number



Note: This will void your warranty!

  • Remove the four rubber pads, then unscrew

Main PCB
b970_main_pcb_t.jpg b970_main_pcb_b.jpg

Modem PCB
b970_modem_pcb_b.jpg b970_modem_pcb_f.jpg

port.serial general information about the serial port, serial port cable, etc.

How to connect to the Serial Port of this specific device:

port.jtag general information about the JTAG port, JTAG cable, etc.

How to connect to the JTAG Port of this specific device:
Insert photo of PCB with markings

  1. you could read about bootloader in general
  1. as a beginner, you really should inform yourself about soldering in general and then obtain some practical experience!
  1. Board Connector photo:

  1. Board Connector Pinout
1 : Modem Vcc 9 : Modem Vcc
2 : GND 10 : GND
3 : USB host D- 11 : *UNK
4 : USB host D+ 12 : Modem LED Signal Red
5 : Modem antenna SW 13 : Modem LED Signal Green
6 : LED Power/Power on Signal 14 : Modem LED Mode Green
7 : *UNK 15 : Modem LED Mode Blue
8 : *UNK 16 : Power on/off Button
This website uses cookies. By using the website, you agree with storing cookies on your computer. Also you acknowledge that you have read and understand our Privacy Policy. If you do not agree leave the website.More information about cookies
  • Last modified: 2024/02/12 08:58
  • by