The ChameleonMini is a versatile contactless smartcard emulator compliant to NFC. The ChameleonMini was first developed by KAOS. This is NOT the official repo for KAOS's ChameleonMini. For further information see the Getting Started Page
This is NOT the official repository of ChameleonMini, a freely programmable portable tool for NFC security analysis that can emulate and clone contactless cards, read RFID tags, and sniff/log RF data. This repository brings support for the Chameleon Tiny.
Our Project is based on the open-source project ChameleonMini RevG by Kasper & Oswald. They also have their own Webshop.
Replace any relevant files or other parts with the resources in this repo
A2. Upgrade (OTA) Bluetooth Firmware (Chameleon Mini only)
1. Obtain and Prepare Tools:
Optional GUI
Terminal APP
Phone APP
Firmware
2. Use APP to Connect to Chameleon Using Bluetooth:
Press any button on the Mini and the white battery light should come ON
You can now connect via Bluetooth
Open the APP again and click Connect to automatically connect the Chameleon
3. Start Bluetooth Firmware Upgrade:
In the Device Information column, press BLE CMD Version 5 times
On the OTA upgrade page, click Auto Upgrade
The APP will immediately start to upgrade to the latest Bluetooth firmware that comes with it
The APP will automatically exit after the upgrade is complete
B. Crash Course
B1. Detect Keys and Upload Card files
1. Obtain and Prepare Tools:
Tools:
Optional GUI
Terminal APP
Phone APP
Connect to the Chameleon Mini or Tiny using the APP
Connect via USB or Bluetooth
Note:
Both the Chameleon Mini and Tiny support direct connection to the mobile phone USB port
For the Mini, an additional OTG adapter needs to be purchased
Tiny uses its own dual-headed TYPE-C data cable to connect directly to TYPE-C mobile phones
Chameleon Mini has built-in Bluetooth BLE4.0. Press any button to wake up Bluetooth
Turn Bluetooth ON on your phone and the APP will automatically connect
2. Use APP to Enable Detection Mode:
After connecting, click on a single card slot and select MF_DETECTION_1K or MF_DETECTION_4K in the Card Slot mode
This card slot will now have the Detection mode turned ON
Write the original card number in the UID Card Number column
If you don't know the UID number, you can fill in it at will
Then click the Clear button below to clear the last detection record
3. Use APP to Get Keys:
Take the Chameleon to the access control reader and swipe it across
The key and access traces are recorded by the Chameleon when you swipe
Connect back to the mobile phone and press the Crack button
After a few seconds, the APP will automatically solve and list the results, as shown in the figure below:
The list shows which blocks the read head just visited, and what password was used for each access
Click the History button. The APP will automatically list the keys separately and save them for other software to use
If your mobile phone comes with an NFC function, you can put the original key directly on the mobile phone
The APP will automatically use the key in the list to read the entire card, and after it is successful, it will automatically save the entire card data file on the mobile phone
Note:
Multiple red LEDs are on at the same time during detection, which means the memory is full, just clear the memory.
4. Use APP to Import Existing Card Files:
Use QQ to send the card data file to the mobile phone QQ
Or connect the mobile phone to the computer and transfer the file to any directory on the mobile phone
Open the APP and click the Dump column
Click the Scanner in the plus sign in the upper right corner
Click the three horizontal line buttons in the upper left corner and select this phone
Select the root directory of the QQ receiving file or the previously copied directory, and click Allow Access
All card data files will be automatically scanned into the Dump file interface, which can be uploaded or edited at will
Click the card data file in the Dump column below, and click Upload below to upload to the card slot corresponding to the Chameleon
B2. Introduction to UID Mode and SAK Mode
1. UID Mode:
Click the button UID Changeable (GEN1a) in the APP or directly send the command UIDMODE = 1 to turn it ON
UIDMODE = 0 to turn it OFF
After the UID mode is turned ON, the card simulated by Chameleon will become a GEN1a card
Commonly known as a UID card or Chinese magic card
The current card slot takes effect
2. SAK Mode:
Click the SAK Mode button in the APP or directly send the command SAKMODE = 1 to turn it ON
SAKMODE = 0 to turn it OFF
After the SAK Mode is turned ON, the card will feedback the real SAK value when it is found
The SAK value is determined by the 0 sector, 0 block, and the position is the position of the sixth byte immediately after the UID number
If the SAK Mode is not turned on, the SAK is a fixed value of 08, and 0 blocks of data are ignored
This function is useful when special SAK values cannot be used normally after being copied
This achieves better compatibility
The current card slot takes effect
B3. Card Slot Functions
1. UID Card Function Class
Option
Type
Length of UID
Memory Size
MF_classic_1K 4B/7B
M1 S50
4 Byte / 7 Byte
1024 byte
MF_classic_4K 4B/7B
M1 S70
4 Byte / 7 Byte
4096 byte
MF_classic_mini_4B
M1 mini S20
4 Byte / 7 Byte
320 byte
MF_ultralight_C
M0 ultralight
7 Byte
192 byte
MF_ultralight_EV1_80B
M0 ultralight
7 Byte
80 byte
MF_ultralight_EV1_164B
M0 ultralight
7 Byte
164 byte
Vicinity
-
8 Byte
8192 byte
SL2S2002
-
8 Byte
8192 byte
TITAGITSTANDARD
-
8 Byte
44 byte
EM4233
-
8 Byte
208 byte
2. Cracking and Card Reading Functions
Option
Ability
Cracking Type
APP Supported
MF_DETECTION_1K
Detecting reader to obtain keys
MFKEY32V2
List results directly
MF_DETECTION_4K
Detecting reader to obtain keys
MFKEY32V2
List results directly
ISO14443A_READER
Reader Mode
-
Display UID
ISO14443A_SNIFF
Sniffing
-
Not supported
ISO15693_SNIFF
Sniffing
-
Supported
3. Custom Button Functions
Option names
Description
NONE
Set this button to have no function
UID_RANDOM
Randomly generated UID number in the current card slot after pressing
UID_LEFT_INCREMENT
After pressing, the highest byte of the UID number plus one (hexadecimal)
UID_RIGHT_INCREMENT
After pressing the lowest byte of the UID number plus one (hexadecimal)
UID_LEFT_DECREMENT
After pressing, the highest byte of the UID number is reduced by one (hexadecimal)
UID_RIGHT_DECREMENT
After pressing, the lowest byte of the UID number is reduced by one (hexadecimal)
CYCLE_SETTINGS
Card slot number sequence will increase after pressing
CYCLE_SETTINGS_DEC
Card slot number sequence decreases after pressing
STORE_MEM
Immediately after pressing, the current card data in the temporary buffer is overwritten into the memory
RECALL_MEM
Immediately after pressing, the current card data in the memory is overwritten into the temporary buffer (Can be used to quickly restore card data)
TOGGLE_FIELD
Click once to turn off the antenna and click again to turn on the antenna function
STORE_LOG
Write the log data in the temporary cache to the memory, which can be saved even when power is off
CLEAR_LOG
Clear log data immediately after pressing
CLONE
Read the UID card number immediately after pressing, continue searching, and simulate immediately after reading the card
CLONE_MFU
Clones a Mifare Ultralight card that is in the range of the antenna to the current slot, which is then accordingly configured to emulate it
C. Hardware & Lights
C1. All Units
1. Charging:
Any time you connect USB, it will automatically start charging
The Mini will have a white light while the Tiny will have a red light over the USB port to indicate if it is charging
2. Charging and Standby Mode:
Charging method: Plug in the USB at any time and start charging immediately
Currently only supported Reader -> card Direction sniffing
ISO 15693
Support
Support
Support
Single subcarrier only
4. Comparison Table of Supported Reading Card Types
Card type
Encoding type
Whether the hardware stand by
Whether the software stand by
Whether the application layer supports
Note
Non13.56MHz
Not Supported
Not Supported
Not Supported
Mifare Ultralight
ISO14443A 106 kbit/s
Support
Support
SupportCommand: dump_mfu
MifareClassic1K/4K 4B/7B
ISO14443A 106 kbit/s
Support
Support
Not Supported
No card reading instruction, encryption function has been implemented
E. External Contributions
Iceman
Philippe Teuwen
Willok
DXL
ProxGrind aka Olaf
About
The ChameleonMini is a versatile contactless smartcard emulator compliant to NFC. The ChameleonMini was first developed by KAOS. This is NOT the official repo for KAOS's ChameleonMini. For further information see the Getting Started Page