OpenWrt support for NETGEAR Arlo VMB4000

Hi everyone, I have vmb4000 arlo base station sitting around and i was wondering if i can flash a router firmware onto it. I know that arlo doesnt make their firmware public, as users can only update their base station firmware from the arlo app, so I’m quite certain there isnt any openwrt firmwares specifically for the device. is it possible for me to use a firmware from another device with the same chip?

the chip seems to be a bcm5357 and I do have serial access to the board.

thanks in advance and I apologise if the post is incomplete or out of place. :slight_smile:

https://openwrt.org/toh/asus/rt-n10u use the same SoC.

if you have serial access, post the complete boot log.

Decompressing...done


CFE for Foxconn Router VMB4000 version: v1.0.4
Build Date: Tue Aug  2 15:04:59 CST 2016
Init Arena
Init Devs.
Boot up from NAND flash...
Boot partition size = 262144(0x40000)
NFLASH Boot partition size = 524288(0x80000)
DDR Clock: 392 MHz
Info: DDR frequency set from clkfreq=900,*392*
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 9.10.178.4002 (r623328)
CPU type 0x0: 900MHz
Tot mem: 131072 KBytes

Device eth0:  hwaddr XX-XX-XX-XX-XX-XX, ipaddr 192.168.1.1, mask 255.255.255.0
        gateway not set, nameserver not set
img_boot=0

trx_failed=0 at <nflash1.trx>
Got the Linux image 0
Loader:raw Filesys:raw Dev:nflash0.os File: Options:(null)
Loading: ..... 5504736 bytes read
Entry at 0x00008000
Closing network.
Starting program at 0x00008000
console [ttyS0] enabled, bootconsole disabled
brd: module loaded
loop: module loaded
pflash: found no supported devices
ERROR: Unknown flash, device_id:0x00
bcmsflash: found no supported devices
The first offset=200000, 2nd offset=2e00000
Boot partition size = 524288(0x80000)
lookup_nflash_rootfs_offset: offset = 0x200000
nflash: squash filesystem with lzma found at block 33
lookup_nflash_rootfs_offset: offset = 0x2e00000
nflash: squash filesystem with lzma found at block 385
Creating 11 MTD partitions on "nflash":
0x000000000000-0x000000080000 : "boot"
0x000000080000-0x000000200000 : "nvram"
0x000000200000-0x000002e00000 : "linux"
0x000000434720-0x000002e00000 : "rootfs"
0x000002e00000-0x000005a00000 : "linux2"
0x0000030347ac-0x000005a00000 : "rootfs2"
0x000005a00000-0x000005b80000 : "nvram2"
0x000005b80000-0x000005bc0000 : "board_data"
0x000005bc0000-0x000005c00000 : "board_data2"
0x000005c00000-0x000005c40000 : "POT1"
0x000005c40000-0x000005c80000 : "POT2"
PPP generic driver version 2.4.2
NET: Registered protocol family 24
usbmon: debugfs is not available
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
ehci_hcd 0000:00:04.1: EHCI Host Controller
ehci_hcd 0000:00:04.1: new USB bus registered, assigned bus number 1
ehci_hcd 0000:00:04.1: irq 36, io mem 0x18004000
ehci_hcd 0000:00:04.1: USB 0.0 started, EHCI 1.00
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 2 ports detected
ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
ohci_hcd 0000:00:04.0: OHCI Host Controller
ohci_hcd 0000:00:04.0: new USB bus registered, assigned bus number 2
ohci_hcd 0000:00:04.0: irq 36, io mem 0x1800d000
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 2 ports detected
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
u32 classifier
    Actions configured
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (1941 buckets, 7764 max)
ctnetlink v0.93: registering with nfnetlink.
xt_time: kernel timezone is -0000
ip_tables: (C) 2000-2006 Netfilter Core Team
TCP cubic registered
TCP vegas registered
NET: Registered protocol family 10
ip6_tables: (C) 2000-2006 Netfilter Core Team
IPv6 over IPv4 tunneling driver
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
Northstar brcmnand NAND Flash Controller driver, Version 0.1 (c) Broadcom Inc. 2012
NAND device: Manufacturer ID: 0xef, Chip ID: 0xf1 (Unknown NAND 128MiB 3,3V 8-bit)
Spare area=64 eccbytes 28, ecc bytes located at:
 9 10 11 12 13 14 15 25 26 27 28 29 30 31 41 42 43 44 45 46 47 57 58 59 60 61 62 63
Available 35 bytes at (off,len):
(1,8) (16,9) (32,9) (48,9) (0,0) (0,0) (0,0) (0,0)
Scanning device for bad blocks
usb 1-1: new high speed USB device using ehci_hcd and address 2
hub 1-1:1.0: USB hub found
hub 1-1:1.0: 4 ports detected
Options: NO_AUTOINCR,NO_READRDY,
Creating 1 MTD partitions on "brcmnand":
0x000005c80000-0x000007c80000 : "brcmnand"
VFS: Mounted root (squashfs filesystem) readonly on device 31:3.
devtmpfs: mounted
Freeing init memory: 236K
/sbin/hotplug2: No such file or directory
Reading board data...
WSC UUID: 0x728c9ed96b759910309dc2d52381e866
wl: wl driver adapter not found
NTP synchronized date/time: Fri Jul  7 07:23:26 2017
MAC address of 1st STA connected: 00-00-00-00-00-00
wl: wl driver adapter not found
convert_wlan_params_for_all_bssid 1131 lan_ifnames: vlan1 eth1
insmod: module 'ipv6' not found
insmod: module 'bcm57xx' not found
**** lm48560_restore_setting ****
frequency       =0x3F
gain    =0x0
Hit enter to continue...WARNING: console log level set to 1
wps_aplockdown_init(90):WPS aplockdown init: force_on = 0, start_cnt = 3, forever_cnt = 3!

### wps_wfi_init(): <wl0_wfi_enable=(null)>WFI is not enabled ###
wps_set_beacon_IE(515):set beacon IE on eth1 successful, selreg is FALSE
wps_set_prb_rsp_IE(339):set probrsp IE on eth1 successful, selreg is FALSE
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...

sending "{ "action":"apLost" }", size=22
Can't connect to '127.0.0.1':4006, errno=111 - Connection refused.
acsd: Adjusted channel spec: 0x1003
acsd: selected channel spec: 0x1003
Reading board data...
WSC UUID: 0x728c9ed96b759910309dc2d52381e866
rmmod: remove 'br_dns_hijack': No such file or directory
insmod: module 'br_dns_hijack' not found
telnetenabled: No such file or directory
eth2: cmd=162: No such device
Status change. Link up
killall: udhcpc: no process killed
Renew udhcpc
lld2d: No such file or directory
POT integrity check OK.
POT time is up.
Can't open device file: /dev/acos_nat_cli
Start DHCP client daemon
udhcpc: option -h NAME is deprecated, use -x hostname:NAME
udhcpc: started, v1.30.1
eth0: No such process
killall: dnsmasq: no process killed
udhcpc: sending discover
date: invalid date '100200002020'
Could not find IP for Eth0 error = 99
pclose(pipe) in exec_ext_app(burn_hw_rev  2>&1).
MTDBLOCK DEV NAME = /dev/mtdblock11
udhcpc: sending select for 192.168.0.47
udhcpc: lease of 192.168.0.47 obtained, lease time 86400
add route eth0 0.0.0.0 mask 0.0.0.0 gw 192.168.0.1 metric 0
killall: dnsmasq: no process killed
pclose(pipe) in exec_ext_app(burnsn 2>&1).
killall: dropbear: no process killed
IP address: 192.168.0.47
 NTPC_ADJTIME >> NTPC_STATUS_INIT:
 NTPC_ADJTIME >>        waiting 600 sec for steady system .....do nothing ....
Set system timer 600 sec ....
Can't open device file: /dev/aglog
---> rc restarted
wps_close_session(188):Session closed!!
wps_set_beacon_IE(515):set beacon IE on eth1 successful, selreg is FALSE
wps_set_prb_rsp_IE(339):set probrsp IE on eth1 successful, selreg is FALSE
device eth1 is not a slave of eth1
No such device
interface  does not exist!
wps_success_mode: 0, wps_success_mode_2: 0, wps_status: 0
conver wla_ssid from wl0_ssid
old:ARLO_VMB_1601400076 new:ARLO_VMB_1601400076
conver wlg_ssid from wl1_ssid
old:NETGEAR_DF_5G_465 new:NETGEAR_DF_5G_465
wps_status:0
lan_wps_oob:disabled
restart -- wl0_wps_config_state=1
wl0_wps_config_state:1
wps_aplockdown_init(90):WPS aplockdown init: force_on = 0, start_cnt = 3, forever_cnt = 3!

### wps_wfi_init(): <wl0_wfi_enable=(null)>WFI is not enabled ###
wps_set_beacon_IE(515):set beacon IE on eth1 successful, selreg is FALSE
wps_set_prb_rsp_IE(339):set probrsp IE on eth1 successful, selreg is FALSE

    LogLevel                  = DEBUG
    BackendUrl                = https://arlo-device.messaging.arlo.com
    CameraInputIx             = eth1
    CameraInputPort           = 4000
    DoorbellInputPort         = 4100
    PresenceIx                = lo
    PresenceDataPort          = 4001
    PresenceStatusPort        = 4002
    HttpServerPort            = 80
    UpdateUrl                 = https://updates.arlo.com/arlo/fw/fw_deployed/production
    MetricUrl                 =
    SerialNum                 = 4RD1737JA4445
    ConfigPath                = /tmp/media/nand/vzdaemon/conf
    WatchdogPid               = 580
    HwRevision                = 3
    ModelId                   = VMB4000
    CertPath                  = /certs/ca-bundle-arlo.crt
    MediaServerCertPath       = /certs/wowza.netgear.com_Certificate_Only.pem
    RtspPort                  = -1
    AcsdStatusPort            = 4006
    -- version --             = 1.15.0.1_3162_d878851
    -- platform --            = VMB4000

acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
07:02:18.543 os_core_unix.c !pjlib 2.7.2 for POSIX initialized
acsd: scan in progress ...
07:02:18.668 sip_endpoint.c  .Creating endpoint instance...
07:02:18.670          pjlib  .epoll I/O Queue created (0x152c388)
07:02:18.670 sip_endpoint.c  .Module "mod-msg-print" registered
07:02:18.670 sip_transport.  .Transport manager created.
07:02:18.671   pjsua_core.c  .PJSUA state changed: NULL --> CREATED
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
/bin/sh: iptables: not found
acsd: scan in progress ...
acsd: scan in progress ...

sending "{ "action":"apLost" }", size=22
Can't resolve host '0x1f'. h_errno=1 - Unknown host.
acsd: Adjusted channel spec: 0x1003
acsd: selected channel spec: 0x1003
---> rc stopped
Hit enter to continue...sh: setptb: not found

Here's the bootlog. Just a note, it does say hit enter to continue, but hitting any key won't allow me to go into the console. Thanks for the reply btw.

Do you get any kind of reaction, or doesn't it simply accept any serial input (read only) ?

You missed the boot loader part, seems you only posted the kernel start, and onward.

That's all I can see, its from first power on to no more output. I can only Ctrl+c to get into the CFE and that accepts input. Pressing enter throughout the whole boot sequence also doesn't get me anywhere.

if your CFE can be interrupted, you could try to build an initramfs for a device with the same SoC, like the rt-n10u, and try to boot it.

Initramfs isn't meant to be written to flash, and runs in memory, so it's pretty safe to use for device exploration.

Would you be able to guide me through the process? I'm not sure how to do it.

Can you share the pinout for serial?