Chameleon Ultra

  • €129.00 €154.80
    Unit price per 

The Chameleon Ultra is the world's smallest RFID emulation device : Low and high-frequency emulation, full read & write capabilities, bleeding-edge cracking, wireless control : all wrapped up in a key-chain sized, fully open-sourced device.

Introduction

The Chameleon Ultra is the ultimate RFID emulation device : Low and high-frequency emulation, full read & write capabilities, bleeding-edge cracking, wireless control : all wrapped up in a key-chain sized, fully open-sourced device.

The Chameleon Ultra is the result of exceptional engineering ingenuity : the development team discovered that little-known RFID function in a popular Bluetooth controller could be pushed to provide high-performance, multi-frequency RFID reading, writing and cracking - and emulation performance almost identical to that of a physical card.

This discovery gave birth to the Chameleon Ultra: a tiny, high performance RFID companion device for multi-frequency RFID emulation, cracking, reading and writing.

Lab401 is the exclusive distributor for the Chameleon Ultra in Europe.

Low & High Frequency Emulation

"Frame Delay Time" is the most important metric in emulation: slower performance means that emulation doesn't meet protocol specifications, data can be lost, and ultimately, the emulation can fail.

The Chameleon Ultra has the world's most precise emulation: it's the most precise emulator in the world.

Optimised MIFARE Classic® Cracking

The Chameleon Ultra's powerful chip supports all known MIFARE Classic® cracking algorithms - at speeds faster than the Proxmark!

The device supports all classic and modern attacks, including MFKEY32 v2, Darkside, Nested, StaticNested and Hardnested attacks - for incredibly quick key recovery.

Low & High Frequency Reading / Writing

The Chameleon Ultra hardware supports high and low frequency reading and writing - allowing it to be used as a standalone or connected reader/writer device.

For High Frequency, the device supports ISO14443A chipsets: MIFARE Classic® (1K/2K/4K, 4-byte &, 7-byte UID), NTAG® (210 - 218), Ultralight® (Standard, C, EV1), DESFire® (EV1 & 2) and MIFARE® Plus.

For Low Frequency, the device supports ASK, FSK and PSK modulations - almost 99% of 125KHz chipsets: EM410x, T5577, HID Prox, Indala, FDX-B, Paradox, AWD, PAC/Stanley, etc.

Wireless, UI and CLI Control

The Chameleon Ultra can be controlled and updated in several ways.

Firmware can be flashed via USB-C or Over-the-Air; badge dumps can be uploaded and downloaded via wireless or wired connections.

Likewise, the device can be controlled via GUI Tool, mobile phone, or via CLI - depending on your workflow.

The CLI and UI tools are continuously updated by the community, with new functionality and stability being constantly added.

Incredible hardware

The ChameleonUltra's hardware has been pushed to its limits : despite its size, it boasts better emulation than the Flipper Zero and even Proxmark 3 - and can run for 6 months off a single battery charge!

The device itself is beautiful - a masterpiece of copper, epoxy, fiberglass and stainless steel.

100% Open Source

The Chameleon Ultra is fully open-source : all firmware, hardware, software and resources are available on the Chameleon Ultra Github page.

The frequent contributions from RFID superstars such as iceman and doegox ensure that the Chameleon Ultra is a well-supported, high-performance device.

Understand the ChameleonUltra

The Chameleon Ultra's primary use is for RFID Emulation. Instead of needing physical cards, you can emulate multiple different types of chips and different frequencies with one device.

The Chameleon Ultra also has several other powerful features : cracking, reading, writing.

When working with RFID tags, there are typically five required functions:

  1. Identification - identifying the badge : frequency, modulation, chipset, protocol, etc. Most tags can be easily identified. However, some tags need to be manually identified, requiring specialty hardware such as the Proxmark.

  2. Cracking - many common chipsets (MIFARE Classic®, etc) require keys to read or write the contents of the badge. If the keys are unknown, they need to be cracked. The ChameleonUltra cracking capabilities equal to Proxmark.
  3. Reading - Reading the data from a badge.
  4. Emulation - Emulation allows for simulating a badge digitally. Instead of needing multiple physical cards, they can be replaced with an emulator. Further, emulated data and chipsets can be customised completely - something impossible with physical cards.
  5. Writing - Writing data to an existing badge, or cloning data to a new badge.

The below table shows the coverage that the ChameleonUltra provides in each of these categories, and how it compares to other tools.

Chameleon Ultra

Emulate
Crack
Read
Write
Identify

Flipper Zero

Emulate
Crack
Read
Write
Identify

Proxmark

Emulate
Crack
Read
Write
Identify

iCopy-X

Emulate
Crack
Read
Write
Identify

DL-533N

Emulate
Crack
Read
Write
Identify

Chameleon Tiny

Emulate
Crack
Read
Write
Identify

For users that don't require advanced identification or rapid cloning, the ChameleonUltra could be the perfect match for your needs.

ChameleonUltra Community and Ecosystem

The Chameleon Ultra is fully open-source : all firmware, hardware, software and resources are available on the Chameleon Ultra Github page.

The frequent contributions from RFID superstars such as iceman and doegox ensure that the Chameleon Ultra is a well-supported, high-performance device.

ChameleonUltra Product Presentation

ChameleonUltra Unboxing

What's included

  • 1x ChameleonUltra
  • 1x Silicone protective cover
  • 1x USB-A - USB-C Cable
  • 1x Keychain attachment
  • 2-year guarantee

Device Specifications

  • Processor + Memory:
    • NRF52840
    • ARM Cortex-M4 32-bit 64 MHz (Application Processor)
    • 1MB Flash
    • 256KB RAM
  • Tactile Controls: 2x Physical Buttons
  • Internal Battery: LiPo 90mAh (6 months without charge)
  • Connectivity: USB 2.0, Type-C
  • Dimensions: 40 x 24 x 8 mm
  • Weight: 8g

Technical Resources

RFID Specifications

  • Reading, Emulation
    • High Frequency / 13.56MHz
      • ISO-14443A
      • Mifare Classic® (1K / 2K / 4K - 4-byte & 7-byte UID)
      • Ultralight® (Standard, C & EV1)
      • NTAG® (210 - 218)
    • Low Frequency / 125KHz
      • Modulation: AM / PSK / FSK
      • Supported Cards:
        • EM4XX / T5577
        • HID Prox / Indala / PAC/Stanley
        • FDX-B / Paradox / Keri
        • etc (full list below)
  • Cracking
    • MIFARE Classic®
      • MFKey32v2 (Key Calculation from sniffed exchanges)
      • DarkSide (Key derivation from no known keys)
      • Nested (Key derivation from one known key)
      • StaticNested (Key derivation from static PRNG)
      • HardNested (Key derivation from hardened PRNG)
    • Low Frequency / 125KHz
      • T5577 Password Bruteforcing
      • UID Bruteforcing

Chameleon Ultra Chipset Datasheets

Device Comparison

Summary of functionality across similar devices.

 

Device Chameleon Ultra Flipper Zero Keysy Proxmark
High-Frequency
ISO14443A Emulation ✔️ 🟡 🟡
Full MIFARE® Emulation ✔️ 🟡 ✔️
ISO14443A Reading ✔️ 🟡 ✔️

 

Low-Frequency
LF Emulation ✔️ ✔️ ✔️ ✔️
LF Reading ✔️ ✔️ ✔️ ✔️

 

Cracking
Darkside ✔️ ✔️
Nested ✔️ ✔️ ✔️
StaticNested ✔️ ✔️
HardNested ✔️ ✔️
Relay attack ✔️ ✔️

High Frequency Cracking Support

Current support levels (hardware / firmware / application) support for High-Frequency Chipsets. Sniffing is not supported.

Attack Chipset Hardware Support Firmware Support Application Support
MFKEY32 V2 MIFARE Classic® ✔️ ✔️ ✔️
Darkside MIFARE Classic® ✔️ 🟡 ✔️
Nested MIFARE Classic® ✔️ 🟡 ✔️
StaticNested MIFARE Classic® ✔️ ✔️ 🟡
HardNested MIFARE Classic® ✔️ ✔️ 🟡
Relay attack ISO14443A ✔️ ✔️ 🟡

 

High Frequency Reading Support

Current support levels (hardware / firmware / application) support for High-Frequency Chipsets. Only ISO14443A chipsets are supported,

Chipset Encoding Hardware Support Software Support Application Support
NTAG® 21x (210-218) ISO14443A/106 kbit/s ✔️ ✔️ 🟡
Mifare® Ultralight ISO14443A/106 kbit/s ✔️ ✔️ 🟡
Mifare® Ultralight Ev1 ISO14443A/106 kbit/s ✔️ ✔️ 🟡
Mifare® Ultralight C ISO14443A/106 kbit/s ✔️ ✔️ 🟡
Mifare® Classic 1K/2K/4K : 4b/7b ISO14443A/106 kbit/s ✔️ ✔️ ✔️
Mifare® DESFire® ISO14443A High Rate Low bitrate only Low bitrate only 🟡
Mifare® DESFire® EV1 ISO14443A High rate Low bitrate only Low bitrate only 🟡
Mifare DESFire EV2 ISO14443A High rate Low bitrate only Low bitrate only 🟡
Mifare® PLUS ISO14443A High rate Low bitrate only Low bitrate only 🟡

 

Low Frequency Support

Current support levels (hardware / firmware / application) support for LowFrequency Chipsets. Only ASK/PSK/FSK modulation is supported.

Card Type Chipset Hardware Support Firmware Support Application Support
EM410x ASK ✔️ ✔️ ✔️
T5577 ASK ✔️ ✔️ 🟡
HID Prox FSK ✔️ ✔️ 🟡
Indala PSK ✔️ ✔️ 🟡
FDX-B ASK ✔️ ✔️ 🟡
Paradox FSK ✔️ ✔️ 🟡
Keri PSK ✔️ ✔️ 🟡
AWD FSK ✔️ ✔️ 🟡
ioProx FSK ✔️ ✔️ 🟡
securakey ASK ✔️ ✔️ 🟡
gallagher ASK ✔️ ✔️ 🟡
PAC/Stanley ASK ✔️ ✔️ 🟡
Presco ASK ✔️ ✔️ 🟡
Visa2000 ASK ✔️ ✔️ 🟡
Viking ASK ✔️ ✔️ 🟡
Noralsy ASK ✔️ ✔️ 🟡
NexWatch PSK ✔️ ✔️ 🟡
Jablotron ASK ✔️ ✔️ 🟡

SHIPPING & PACKAGING INFORMATION

Lab401's engagement is to get your orders to you as quickly as possible in a perfect condition. All packages are insured to 100% of the value, and Lab401 Delivery Protection can be used to ensure immediate re-shipment if a package is lost or damaged.

All orders are securely packaged. Premium and Express orders are further protected in an untearable polyurethane satchel, ensuring that your package is not tampered with during delivery.

To ensure privacy and reduce theft, all packages are anonymous - there is no mention of product contents or Lab401 branding on the outside of the packaging.

Shipping Options

Lab401 provides three types of shipping options:

  • Eco Delivery
  • Premium Delivery
  • Urgent Express Delivery

Eco Delivery is for available light and slim orders, particulaly cards, keyfobs and accessories. It is dispatched by La Poste (French postal system) and tracked.

Premium Delivery is our default shipping option: fast and reliable delivery via courier. Depending on the destination, Premium Delivery use UPS, DHL, FedEx, Chronopost or Colissimo.

Urgent Express Delivery uses the fastest possible delivery method possible: UPS Express, FedEx Express, DHL Express or Chronopost Express.

Lab401 provides same day shipping for Urgent Express orders made before 12PM GST+1.

Do you provide free shipping?

Yes - orders over 650€ excluding taxes have free shipping.

Customers that qualify for free shipping can still select rapid shipping options.

When will I receive my order?

Average order times can be estimated below.

Average shipping estimates can be seen by selecting the destination country / region below.

While actual shipping times may vary - these estimations are built off our real delivery statistics. To receive an order as quickly as possible, we recommend:

  • Use the Urgent Express shipping method
  • Use same day shipment by placing the order before 12PM GMT+1

Do you ship internationally?

We ship world-wide, but due to logistical or legal restrictions, we are unable to ship to the following countries: Martinique, St. Martin, Guadeloupe, Mayotte, Réunion, St. Barthélemy, St. Pierre & Miquelon, Moldova, Argentina, Belarus, Bolivia, Brazil, Cambodia, Chile, Ecuador, Georgia, India, Iraq, Kazakhstan, Kuwait, Liberia, Libya, Nepal, Oman, Panama, Peru, Russia, South Africa (Exception: Gauteng), Turkey, Ukraine, Vietnam, Egypt, Pakistan, Serbia, Spain (Balears, Ceuta,Las Palmas, Santa Cruz de Tenerif), Faroe Islands, Gibraltar, French Guiana, French Polynesia, French Southern Territories, Saudi Arabia.

Where do you ship from?

All items are dispatched from France. You will receive a tracking number upon item dispatch. The address used on your purchase is printed as a label - please double check your address to avoid mistakes.

When will my order be dispatched?

Lab401 dispatches orders Monday - Friday.
All orders placed before 12PM GMT+1 will be dispatched the same day. All orders placed after this cutoff time will be dispatched the next business day.

For example:

  • An order placed Friday, 9AM GMT+1 will be dispatched the same day.
  • An order placed on Friday, 6PM GMT+1 will be dispatched Monday.
  • An order placed on Saturday will be dispatched Monday

For any questions, please contact customer support.

How are import duties / customs handled?

For all European Union destinations, all shipments are DDP - Delivered Duty Paid. This means all applicable VAT/TVA, shipping costs and customs fees are pre-paid.
You will not be charged by the courier service / post office or customs.

For all destinations outside European Union, all shipments are DDU - Delivered Duty Unpaid. This means that your country's custom service impose a VAT/TVA/Import Duty on your shipment.

I am charged VAT ?

Lab401 (ETOILE 401 SAS) is an EU-Registered entity. VAT is applicable to purchases delivered within the EU, with exceptions for VAT Registered entities. VAT is calculated at checkout. For your convenience, you can browse Lab401 with prices Including VAT and Excluding VAT.

Sales are contractual

Please note - a purchase is an explicit agreement of our terms and conditions. Any products refused by clients will not be refunded.

Purchase Security Validation may be applied

To protect against credit card fraud, orders may be flagged for Purchase Security Validation. In this instance, we will reach out to the customer to perform a manual verification process.

Orders that are flagged for Purchase Security Validation are considered to be incomplete until validated. Our delivery deadline obligations begin only when an order is validated.

Delivery Protection

Is my delivery protected?

All Lab401 shipments are insured with the carrier.

We also provide an advanced insurance, Lab401 Delivery Protection.

Lab401 Delivery Protection means we remain fully responsible for the package right up to delivery. If the package is lost or damaged, the package can be resent immediately (48 business hours) upon receipt of proof.

For orders without Delivery Protection, lost or damaged packages will pass through the carrier's protocols, which can take well over 30 days.

For orders that are time-sensitive, we recommend Lab401 Delivery Protection.

Delivery Protection can be purchased at checkout easily and cheaply.