This is NOT the official repository of ChameleonMini, a freely programmable, portable tool for NFC security analysis that can emulate and clone contactless cards, read RFID tags and sniff/log RF data.

Chameleon BLE API Codes.RAR

Our Project is based on the open-source project by ChameleonMini RevG by Kasper & Oswald Webshop.

Our ChameleonMini / ChameleonTiny by ProxGrind is available on Indiegogo now. Done

Our Asia & Oceania Reseller Here

Our Europe Reseller Here

Our US Reseller Here

Most information can be found on Here

Our APP can be found here: Here

Here Dropbox

Here Google Drive

(1) Prepare your Windows computer. Linux or MAC please refer to GITHUB.

(2) Prepare the firmware. Go to GITHUB to compile the latest firmware: Here

Or use the firmware in attachment.

(3) Install the DFU driver. The DFU driver comes from ATMEL's official LIBUSB driver library. You can download it yourself or find it in attachment.

(4) Enter the chameleon DFU mode. When the device is off, press and hold the yellow button near the USB (TINY is the B button), insert the USB, and then you can enter the DFU upgrade mode. Or send the command "UPGRADE" in the connected state, and it can also enter the DFU upgrade mode.

(5) Start to upgrade the firmware. Run the "ChameleonFirmwareUpgrade.bat" file in the attachment to automatically start the firmware upgrade. It usually takes 2-5 seconds. After the progress bar is complete, the firmware upgrade is complete!

(6) A description of the firmware. The chameleon REV.G version uses the same firmware for both the MINI with Bluetooth version and ITNY. The hardware design of the RF part is exactly the same. The hardware is also compatible with the official firmware of the KAOS brothers: Here

It should be noted that the Android APP is currently not compatible with the official firmware.

2. Upgrade (OTA) Bluetooth firmware for Chameleon MINI

(1) Prepare Android phone and install APP.

Google Store: Here

Password: e4g1

(2) Open the app and connect the device using Bluetooth. Press any button on the MINI, and the white battery light is on, and Bluetooth is connectable. At this time, open the app again and click Connect to automatically connect the chameleon.

(3) Start upgrade (OTA) Bluetooth firmware. In the “Device Information” column, press “BLE CMD Version” 5 times. It will pop up the OTA upgrade page, click "Auto Upgrade", and the APP will immediately start to upgrade the latest Bluetooth firmware that comes with it. Automatically exit after the upgrade is complete.

1.Detect keys and upload card files

(1) Prepare the computer GUI or Android APP.   Computer GUI download address: Here

Source: Here

Android APP download address:

Google Store:Here

Password: e4g1

(2) Connect the Chameleon MINI or TINY using the Android APP.

USB port direct connection: Both the Chameleon MINI and TINY support direct connection to the mobile phone USB port. For the MINI, an additional OTG adapter needs to be purchased. TINY uses its own dual-headed TYPE-C data cable to connect directly to TYPE-C mobile phones. Bluetooth connection: Chameleon MINI has built-in Bluetooth BLE4.0. Press any button first to wake up Bluetooth. Turn on Bluetooth on your Android phone and the app will automatically connect.

(3) Use Android APP to enable detection mode.

   After connecting, click on a single card slot and select DETECTION_1K or 4K in the "card slot mode". This card slot has the detection mode turned on. Write the original card number in the "UID Card Number" column. Click "Write." If you don't know the UID number, you can fill in it at will. Then click the "Clear" button below to clear the last detection record.

(4) Use Android APP to get keys.

At this time, take the chameleon to the access control reader and swipe. The key and access traces when the chaser reads the chameleon will be recorded by the chameleon. . At this time, connect back to the mobile phone and click the "crack" button. After few seconds, the app will automatically solve and list the results, as shown in the figure below:

The list shows which blocks the read head just visited, and what password was used for each access. At this point, click the "History" button, the APP will automatically list the keys separately and copy it automatically for easy copying to other software for next use. If your mobile phone comes with NFC function, you can directly put the original card on the mobile phone NFC at this time, the APP will automatically use the key in the list to read the entire card, and after successful, it will automatically save the entire card data file on the mobile phone. . Note: Multiple red LEDs are on at the same time during detection, which means the memory is full, just clear the memory.

(5) Use Android APP to import existing card data files in batches.

 Use QQ to send the card data file to the mobile phone QQ, or connect the mobile phone to the computer and transfer the file to any directory on the mobile phone. Open the app, click the "DUMP" column below, click the "Scanner" in the "plus sign" in the upper right corner, click the three horizontal line buttons in the upper left corner, and select this phone. Then select the root directory of the QQ receiving file or the previously copied directory, and click Allow Access. All card data files will be automatically scanned into the "DUMP file" interface, which can be uploaded or edited at will.

Click the card data file in the “DUMP” column below, and click “Upload” below to upload to the card slot corresponding to the chameleon.

2. Introduction to UID mode and SAK mode

(1) UID mode

After the UID mode is turned on, the card simulated by Chameleon will become a GEN1a card, commonly known as a UID card, Chinese magic card. Global card slot takes effect. How to open: Click the button "UID Changeable (GEN1a)" in the APP or directly send the command "UIDMODE = 1" to turn it on, and "UIDMODE = 0" to turn it off.

(2) SAK mode

After the SAK mode is turned on, the card will feedback the real SAK value when it is being found. The SAK value is determined by the 0 sector and 0 block, and the position is the position of the sixth byte immediately after the UID number. If the SAK mode is not turned on, the SAK is a fixed value of 08, and 0 blocks of data are ignored. This function is used to meet the situation that some cards with special SAK values cannot be used normally after being copied, and can achieve better compatibility. The current card slot takes effect. How to open: Click the "SAK Mode" button in the APP or directly send the command "SAKMODE = 1" to turn it on, and "SAKMODE = 0" to turn it off.

3. Card slot function introduction

UID Card Function Class

Cracking and card reading functions  

4. Button Custom Function Introduction

When the power is off, press any button once to turn on the Bluetooth power, and at the same time, display the current power with a white LED. In the Bluetooth 'ON' state, click any button to turn off the Bluetooth power, the power LED goes out, and the system sleeps. Bluetooth will sleep automatically 15 seconds after no operation. Press any button for a long time, you can quickly check the power, and immediately sleep when you release. Click the button three times to turn on the power of chameleon. Sleep automatically after 5 seconds without operation. When shutting down, press and hold the button next to USB and then connect USB. You can enter DFU mode. Charging: Any time you connect USB, it will automatically start charging. Stop automatically after filling. The white LED indicates the power level. Detect memory full: If the memory is full during dense flow detection, multiple red LEDs will be abnormally lit.

1.Button function introduction

(1)ChameleonMini Rev G

Turn on Bluetooth and check the battery: In the off state, press any button once to turn on the Bluetooth power and light up the white LED to show the current power. After 15 seconds, it will automatically shut down after no operation. Bluetooth is on. Press any button once to sleep and shut down immediately. Can be used to quickly check the battery level. Turn on the chameleon: When the Bluetooth is on, press any button twice (double-click), or in the off state, press any button three times (three-click) to turn on the chameleon. The red LED lights up to indicate the slot number. After 5 seconds without operation, it will automatically sleep and shut down. DFU firmware upgrade status: In the closed state, press and hold the yellow button near the USB, and then let go after inserting the USB, the chameleon enters the DFU firmware upgrade mode.

(2 ) ChameleonTiny

Turn on the chameleon: In the off/standby state, press the A button once to turn on the chameleon power. The red LED lights up to indicate the slot number. After 5 seconds without operation, it will automatically sleep and shut down. This can be adjusted in Android Application. DFU firmware upgrade status: In the off state, hold down the B button and connect the USB. You can enter the DFU mode to flash new firmware .

1.Feature comparison table for each version

2.Comparison Table Analog Card Characteristic

3.List of new commands

From the official: Here

Or see the instruction sheet in the attached files.

（1）Simulation Support

From the official: Here

（1）Simulation Support

（2）Sniff Mode Support Type

（3） Card Type Supported via Reading

Charging method: Plug in the USB at any time and start charging immediately. Battery type: LIR2032H replaceable lithium-ion rechargeable battery Charging time: 2 hours @ 0-100% Charging current: 40mA Start-up current: 38mA Card reading current: 65mA Sleep current: 5uA (9uA-MAX) Battery capacity: 70mAh Duration: Swipe the card 3 times a day for 5 seconds each time, and it can be used for one year on a single charge. Sleeping time: Fully charged, it can be left for two years when it is turned off and sleeping. Port type: MINI: MicroUSB TINY: Type-C

Battery Type: LIR2032h rechargeable lithium ion battery
Charging Time: 2 hours @ 0-100%
Charging Current: 40mA
Standby Current: 38ma
Sleep Current: 4uA
Card Reading Current: 65mA
Battery Capacity: 70mah
Usage Time: Use the tag 3 times a day, power on for 5 seconds each time, can use up to one year.
Port Type: Micro USB (ChameleonMini) / Type-C (ChameleonTiny)

The code repository contains

• Doc: A doxygen documentation
• Drivers: Chameleon drivers for Windows and Linux
• Dumps: Dumps of different smartcards
• Hardware: The layout and schematics of the PCB
• Firmware: The complete firmware including a modified Atmel DFU bootloader and LUFA
• Software: Contains a python tool for an easy configuration (and more) of the ChameleonMini, Note that this is currently under construction
• RevE: Contains the whole contents of the discontinued RevE repository.
• RevE-light: Contains our development files for the RevE-light - WARNING: currently not supported / not functional

Here

Iceman
Philippe Teuwen
Willok
DXL
ProxGrind aka Olaf