Installing OpenWRT On The GT-704WG September 17, 2009

I recently picked up an ActionTec GT-704WG DSL router from the thrift store ($15) and wanted to flash it with OpenWRT. Checking out Google and the OpenWRT Wiki, some work has been done on the GT-701WG, but specific information for flashing the GT-704 was scarce. The GT-704 hardware is based on the AR7 from Texas Instruments, and is nearly identical in specifications to the GT-701:

Texas Instruments AR7, 150MHz
Flash: 4MB
Ethernet: 4 Ports
Wireless: TI ACX111, 802.11b/g

The firmware install is pretty straightforward, once you get the commands right. The process is very similar to that documented for generic AR7 devices, but not exactly the same. It helps to have a terminal connected to the JP603 serial port (ttys0, 38400, 8N1)during this process as well, but it is not necessary:

The serial port on the right (JP603) is ttys0; the other is not used.

The serial port on the right (JP603) is ttys0

The pinout for the serial port is, as pictured, from bottom to top: ground, transmit, receive, unknown, Vcc, unknown.

In order to flash the firmware, you’ll need to get access to the Adam2 bootloader. The easiest way to do this is to turn off the router, hold down the reset button, and turn the router back on. Keep holding the reset button until you see the Power and Internet LEDs stay on; this indicates that the router has dropped into the Adam2 shell prompt.

The prompt can be accessed via the serial connection, or via FTP. To connect via FTP, simply FTP to the router and login with the user name of ‘adam2′ and password ‘adam2′. The default adam2 IP address is If this IP address does not work, you will have to connect via the serial connection and issue the following command:


Look for the variable named ‘my_ipaddress’, which will list the Adam2 IP.

Once you have access to Adam2 (either via FTP or serial), you will have to set a couple of environment variables. First, you need to create a partition to install OpenWRT to. The existing partitions can be viewed by issuing the printenv command at the serial console. They are:

mtd2                  0×90000000,0×90010000
mtd1                  0×90010000,0x900d0000
mtd0                  0x900d0000,0x903e0000
mtd4                  0x903e0000,0x903f0000
mtd3                  0x903f0000,0×90400000

Since the OpenWRT image contains both the kernel and the file system, your new partition should cover both the existing kernel and file system partitions (mtd1 and mtd0, respectively). To create the partition via the serial console, run:

setenv mtd5,0×90010000,0x903f0000

Or via the FTP connection:

quote SETENV mtd5,0×90010000,0x903f0000

You will also have to set the MAC_PORT environment variable in order to enable the internal ethernet port. From the serial console:

setenv MAC_PORT,0

Or from FTP:


With that done, you’re ready to FTP your new firmware to the router; other reports on the GT-701 and GT-704 have noted that the ActionTec recovery utility sends a message to UDP port 5035 (actually, two messages in the case of the GT-704). However this appears to be simply for discovery of the router’s IP address and is not necessary for loading firmware onto the router.

Go to OpenWRT’s download page, and get the latest release of openwrt-ar7-squashfs.bin (currently Kamikaze 8.09.1). If you haven’t already, FTP to the router and login with the previously described credentials. You will need to issue the following commands:

ftp> binary
200 Type set to I.
ftp> quote MEDIA FLSH
200 Media set to FLSH
ftp> quote STOR openwrt-ar7-squashfs.bin mtd5
226 Transfer complete
ftp> quote REBOOT

It will take the router a minute or two to clear the flash and load the firmware. Note that you do NOT want to enter passive mode for the file transfer; doing so will slow the file transfer significantly (it would have taken about a week by my estimation). You can monitor the router’s progress via the serial console, or by watching the file transfer in Wireshark. Once the firmware transfer is complete, the reboot command will reboot the router, and you should have a working OpenWRT install:

Please press Enter to activate this console.

BusyBox v1.11.2 (2009-05-28 18:22:45 UTC) built-in shell (ash)
Enter 'help' for a list of built-in commands.

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 KAMIKAZE (8.09.1, r16278) ----------------------------
  * 10 oz Vodka       Shake well with ice and strain
  * 10 oz Triple sec  mixture into 10 shot glasses.
  * 10 oz lime juice  Salute!

So far everything checks out OK using the generic firmware image; ethernet and wireless works, opkg updates and installs packages fine. The only downside is that the wireless doesn’t seem to support WPA, possibly due to the poor open source support from TI. I haven’t tested the USB port, but it appears to be a client-only USB device, so it’s of limited use.

Bobby October 5th, 2009

Final, Somebody did it!!!!

Great work!

Craig October 6th, 2009

Thanks Bobby! It actually wasn’t very difficult, so I’m looking at working on a couple other ActionTec routers in the near future.

John January 10th, 2010

Hopefully someone can help me out on this…

I was trying to put OpenWRT on my GT704WG router. I’ve never tried hacking a router before, so I’m new to all this, but this was an extra one lying around, so I don’t really care if I brick it.

I was following the steps in the blog post, but I left out:


So I started over, running that command this time, and when I got to:

quote STOR openwrt-ar7-squashfs.bin mtd5

it gave me an error:

550 Data Socket not ready.

So I tried the command listed in the 701WG’s instructions on

put “openwrt-ar7-2.4-squashfs.bin” “openwrt-ar7-2.4-squashfs.bin mtdX”

Now the response I got was:
200 Port command successful
150 Opening BINARY mode data connection for file transfer

And it just hung there. I quit the transfer several hours later, and it said about 100K had been transfered, which I’m guessing means it was in passive mode according to the blog – although I’m not sure what that means.

I’ve tried many times now to see if I could get this to work, and now, I’m convinced it’s beyond hope. But I can still access the adam2 bootloader, so if anyone has any ideas for me to try, I’m all ears. Thanks.

John January 10th, 2010

In case I confused anyone, I did use mtd5 in the put command and not mtdX

Craig January 13th, 2010

Your FTP client is likely going into passive mode by default; adam2, for whatever reason, doesn’t like this. Make sure your FTP client is not in passive mode before you upload the file to adam2.

Also, I noticed that the local file names you used for the STOR and PUT commands were different; try using the STOR command, but instead of “openwrt-ar7-squashfs.bin”, use “openwrt-ar7-2.4-squashfs.bin” (or whatever the file is named on your hard drive). The STOR command *should* work.

Jim January 26th, 2010

I’m seeing the same issues as John. Over FTP the STOR command returns the “550 Data Socket not ready” response. Using PUT results in a REALLY slow transfer, even if I ensure that PASSIVE is turned off before the PUT command.

On a serial console I can see that a section of the flash is erased immediately after the PUT command is issued. When the erase completes, the FTP client shows that the binary transfer started. I can also use “dm” from the serial console to see how much of the mtd5 memory area has been written so far, and it goes very, very slowly.

Based on some settings I found in one of the update tools available on the web I used the serial console to “setenv StaticBuffer 128″, which seemed to speed things up quite a bit, but it still looks like it would take several days to finish.

What FTP clients have been used successfully to use the STOR command?

Jim January 27th, 2010

I was finally able to get OpenWRT flashed to my GT-704WG. From monitoring the serial console I was able to determine that the FTP transfer would start at a good speed, but then slow to a crawl. Sometimes it would transfer quite a bit before it slowed down (evidenced by many dots on the console showing progress of the flash process). By using “dm” to see how far the flash had made it before slowing down I was able to break up my transfer, starting the next stage after the last chunk that was already in flash. I created a new mtd6 variable using “setenv” and gave it a range beginning where the transfer had ended (rounded down to the prior block boundary, i.e. 0x90XX0000), then rebooted the router into adam2 and restarted the FTP connection. I would then put the remaining chuck of the openwrt image using ‘put openwrt-partx.bin “fs mtd6″‘, and see how far that made it. If I didn’t get at least 4 dots before it slowed down, I would reboot the router and try again. After many restarts and a total of 5 seperate uploads the last chunk made it to the router. I then cleaned up the mtd6 variable and rebooted the router, and OpenWRT came up.


Bobby April 19th, 2010

This command did the trick…

quote SETENV mtd5,0×90010000,0x903e0000

and this…

put “openwrt-ar7-squashfs.bin” “openwrt-ar7-squashfs.bin mtd5”

CapinWinky March 26th, 2011

If you are experiencing a problem with connection terminated by remote host, you need to add this key to the registry and reboot your computer:

TcpMaxDataRetransmissions = 40 (DWORD, value in HEX)

CapinWinky March 26th, 2011

Anyone have any pointers to get PPPoE working? It seems to be assigning the lan MAC to the wan.

Leave a Reply