Chameleon Ultra

Low & High Frequency Emulation

"Frame Delay Time" is the most important metric in emulation: slower performance means that emulation doesn't meet protocol specifications, data can be lost, and ultimately, the emulation can fail.

The Chameleon Ultra has the world's most precise emulation: it's the most precise emulator in the world.

Optimised MIFARE Classic® Cracking

The Chameleon Ultra's powerful chip supports all known MIFARE Classic® cracking algorithms - at speeds faster than the Proxmark!

The device supports all classic and modern attacks, including MFKEY32 v2, Darkside, Nested, StaticNested and Hardnested attacks - for incredibly quick key recovery.

Low & High Frequency Reading / Writing

The Chameleon Ultra hardware supports high and low frequency reading and writing - allowing it to be used as a standalone or connected reader/writer device.

For High Frequency, the device supports ISO14443A chipsets: MIFARE Classic® (1K/2K/4K, 4-byte &, 7-byte UID), NTAG® (210 - 218), Ultralight® (Standard, C, EV1), DESFire® (EV1 & 2) and MIFARE® Plus.

For Low Frequency, the device supports ASK, FSK and PSK modulations - almost 99% of 125KHz chipsets: EM410x, T5577, HID Prox, Indala, FDX-B, Paradox, AWD, PAC/Stanley, etc.

Wireless, UI and CLI Control

The Chameleon Ultra can be controlled and updated in several ways.

Firmware can be flashed via USB-C or Over-the-Air; badge dumps can be uploaded and downloaded via wireless or wired connections.

Likewise, the device can be controlled via GUI Tool, mobile phone, or via CLI - depending on your workflow.

The CLI and UI tools are continuously updated by the community, with new functionality and stability being constantly added.

Incredible hardware

The ChameleonUltra's hardware has been pushed to its limits : despite its size, it boasts better emulation than the Flipper Zero and even Proxmark 3 - and can run for 6 months off a single battery charge!

The device itself is beautiful - a masterpiece of copper, epoxy, fiberglass and stainless steel.

100% Open Source

The Chameleon Ultra is fully open-source : all firmware, hardware, software and resources are available on the Chameleon Ultra Github page.

The frequent contributions from RFID superstars such as iceman and doegox ensure that the Chameleon Ultra is a well-supported, high-performance device.

What's included

• 1x ChameleonUltra
  
• 1x Silicone protective cover
  
• 1x USB-A - USB-C Cable
• 1x Keychain attachment
• 2-year guarantee

Device Specifications

• Processor + Memory:
• NRF52840
• ARM Cortex-M4 32-bit 64 MHz (Application Processor)
  
• 1MB Flash
• 256KB RAM
  
• Tactile Controls: 2x Physical Buttons
  
• Internal Battery: LiPo 90mAh (6 months without charge)
• Connectivity: USB 2.0, Type-C
  
• Dimensions: 40 x 24 x 8 mm
  
• Weight: 8g

Technical Resources

• ChameleonUltra UI Tools (Windows/MacOS/Linux/Android)
• Official Github
  
• Community Discord Server

RFID Specifications

• Reading, Emulation
  
• High Frequency / 13.56MHz
• ISO-14443A
• Mifare Classic® (1K / 2K / 4K - 4-byte & 7-byte UID)
  
• Ultralight® (Standard, C & EV1)
  
• NTAG® (210 - 218)
  
• Low Frequency / 125KHz
• Modulation: AM / PSK / FSK
• Supported Cards:
  
• EM4XX / T5577
  
• HID Prox / Indala / PAC/Stanley
• FDX-B / Paradox / Keri
• etc (full list below)
  
• Cracking
  
• MIFARE Classic®
• MFKey32v2 (Key Calculation from sniffed exchanges)
• DarkSide (Key derivation from no known keys)
• Nested (Key derivation from one known key)
  
• StaticNested (Key derivation from static PRNG)
  
• HardNested (Key derivation from hardened PRNG)
  
• Low Frequency / 125KHz
• T5577 Password Bruteforcing
  
• UID Bruteforcing