Arlo

Extract executable binaries from Arlo dump & updates

See blogpost at https://www.synacktiv.com/publications/arlo-im-watching-you

Parser

arlo.py is used to parse a Flash memory dump, download and parse updates or list knwon models. It requires cryptography, asn1crypto and requests pip packages and optinally uses fastcrc package.

Known models

$ arlo.py list
- Cameras
  - VMC3030 : Arlo Wire-Free
  - VMC4030 : Arlo Pro
  - VMC4030P: Arlo Pro 2
  - VMC4040P: Arlo Pro 3
  - VMC4050P: Arlo Pro 4 (VMC4050P)
  - VMC4041P: Arlo Pro 4 (VMC4041P)
  - VMC4060P: Arlo Pro 5S
  - VMC5040 : Arlo Ultra / Ultra 2
  - VMC2050 : Arlo Essential Outdoor 2nd Gen (VMC2050)
  - VMC3050 : Arlo Essential Outdoor 2nd Gen (VMC3050)
  - VMC2052 : Arlo Essential XL Outdoor 2nd Gen (VMC2052)
  - VMC3052 : Arlo Essential XL Outdoor 2nd Gen (VMC3052)
  - VMC2020 : Arlo Essential
  - VMC2030 : Arlo Essential Spotlight
  - VMC2032 : Arlo Essential XL Spotlight
  - VMC3040 : Arlo Q
  - VMC3040S: Arlo Q+
  - VMC2060 : Arlo Essential Indoor 2nd Gen (VMC2060)
  - VMC3060 : Arlo Essential Indoor 2nd Gen (VMC3060)
  - VMC2040 : Arlo Essential Indoor
  - ABC1000 : Arlo Baby
- Base_Station_SmartHub
  - VMB3010 : Arlo Base Station (VMB3010)
  - VMB3500 : Arlo Base Station (VMB3500)
  - VMB4000 : Arlo Pro Base Station (VMB4000)
  - VMB4500 : Arlo Pro Base Station (VMB4500)
  - VMB4540 : Arlo Pro 3 SmartHub
  - VMB5000 : Arlo Ultra Smarthub
- Doorbells
  - AVD3001 : Arlo Video Doorbell 2nd Gen (AVD3001)
  - AVD4001 : Arlo Video Doorbell 2nd Gen (AVD4001)
  - AVD1001 : Arlo Video Doorbell - Wired
  - AVD2001 : Arlo Video Doorbell Wire-Free
  - AAD1001 : Arlo Audio Doorbell
  - AC2001  : Arlo Chime V2
  - AC1001  : Arlo Chime
- Floodlights
  - FB1001  : Arlo Pro 3 Floodlight
  - ABB1000 : Arlo Security Light
- Arlo_Home_Security_System
  - SH1001  : Arlo Keypad Hub
  - SLB1001 : Arlo Siren
  - MS1001  : Arlo All-in-One Sensor
  - ASB1001 : Arlo Safe Button

Usage

usage: arlo.py [-h] [-d [PREFIX]]
               [-m [{VMC3030,VMC4030,VMC4030P,VMC4040P,VMC4050P,VMC4041P,VMC4060P,VMC5040,VMC2050,VMC3050,VMC2052,VMC3052,VMC2020,VMC2030,VMC2032,VMC3040,VMC3040S,VMC2060,VMC3060,VMC2040,ABC1000,VMB3010,VMB3500,VMB4000,VMB4500,VMB4540,VMB5000,AVD3001,AVD4001,AVD1001,AVD2001,AAD1001,AC2001,AC1001,FB1001,ABB1000,SH1001,SLB1001,MS1001,ASB1001}]]
               {update,parse,list} ...

options:
  -h, --help            show this help message and exit
  -d [PREFIX]           folder where files will be written
  -m [{VMC3030,VMC4030,VMC4030P,VMC4040P,VMC4050P,VMC4041P,VMC4060P,VMC5040,VMC2050,VMC3050,VMC2052,VMC3052,VMC2020,VMC2030,VMC2032,VMC3040,VMC3040S,VMC2060,VMC3060,VMC2040,ABC1000,VMB3010,VMB3500,VMB4000,VMB4500,VMB4540,VMB5000,AVD3001,AVD4001,AVD1001,AVD2001,AAD1001,AC2001,AC1001,FB1001,ABB1000,SH1001,SLB1001,MS1001,ASB1001}]
                        Treat file as this model dump. See list command

commands:
  valid commands

  {update,parse,list}   commands specific help
    update              update help
    parse               parse help
    list                list help

Output