Every function,
explained.

📡 Connection

The app communicates with the ChameleonUltra over Bluetooth Low Energy (BLE) or USB serial. Both methods are available from the main screen.

BLE (Bluetooth)

USB (CDC-ACM serial)

Reader vs Emulator mode

The device operates in one of two modes. In Reader mode it actively polls for tags. In Emulator mode it presents itself as a tag to external readers. You can toggle this from the pull-down menu on most pages, or from Device Info.

🔍 HF Scan 13.56 MHz

Scan and interact with ISO14443-A cards including MIFARE Classic, MIFARE Ultralight, NTAG, and ISO14443-4 cards. The device must be in Reader mode.

Scan Tag

Tap Scan Tag to perform a full ISO14443-A anticollision and display the UID, ATQA, SAK, and ATS (if present). The SAK byte identifies the card family.

Detect Mifare

After a scan, tap Detect Mifare to confirm whether the card responds to MIFARE Classic authentication. This is needed before running attacks.

PRNG Type

Available once a MIFARE card is detected. Identifies whether the tag uses a weak (predictable) or hard PRNG. Weak PRNG tags are vulnerable to the Darkside attack. Hard PRNG tags require Hardnested.

Mifare Block Read / Write

Enter a block number (0–255), select Key A or Key B, and enter the 12-hex-char key. Tap Read Block to fetch 16 bytes of block data. Fill in 32 hex chars and tap Write Block to write.

Raw ISO14443-A

Send arbitrary hex bytes as a raw ISO14443-A frame. Options:

Copy to Slot

After a successful scan, a panel appears at the bottom allowing you to copy the tag's UID/ATQA/SAK/ATS directly into any of the 8 emulation slots.

⚔️ HF Key Attacks MIFARE

Tools for recovering MIFARE Classic keys using cryptographic attacks. All attacks require the device to be in Reader mode with a MIFARE Classic card in the field.

Found Keys

Keys recovered by any attack are collected here automatically. They are also added to the key dictionary used for subsequent Check Keys runs.

Known Key (shared input)

Most attacks need at least one known key to start. Enter the block number, key type (A or B), and a 12-hex-char key value (default FFFFFFFFFFFF).

NT Distance Detection

Measures the distance between PRNG nonces. Required as a first step before running the Nested attack. Uses the known key entered above. Result is displayed and remembered for the session.

Nested Attack

Recovers an unknown key for a target block using a known key. Run NT Distance Detection first. Enter the target block and key type, then tap Nested. The recovered key appears in Found Keys.

Static Nested Attack

A variant of nested for tags where the PRNG does not advance between authentication attempts (static nonce). Tap Static Nested after entering known and target block details.

Darkside Attack

Works against tags with a weak PRNG (no known key required). Configure:

Tap Darkside Acquire. Data is collected on-device; the result appears in the status area.

Hardnested Attack

For tags with a hard PRNG. Requires a known key. Enable Slow mode for better reliability on difficult tags. Tap Hardnested Acquire. The collected nonces are processed on the device and the key is returned automatically.

mfkey32 — Crack from Detection Log

Uses the MF1 emulator's detection log to recover keys that a real reader used to authenticate against the ChameleonUltra emulator.

Check Keys on Block / All Sectors

Try a list of known keys against a single block or all 16/32/40 sectors in one go.

Found keys are always automatically included in the check even if not in the dictionary.

Manual mfkey32v2

Paste raw nonce data in the format uid nt nr0 ar0 nt1 nr1 ar1 (space-separated hex) and tap Run mfkey32v2 to recover a key on the device.

💳 ISO14443-4 / T=CL HF

Tools for ISO14443-4 (T=CL) contactless cards including EMV payment cards, DESFire, and custom JavaCard applications.

Emulation Anti-Collision

Set the UID (4 or 7 bytes), ATQA (4 hex chars), SAK (2 hex chars), and optionally ATS that the device presents in emulator mode. Tap Set Anti-Collision. This controls how the device is seen during card discovery.

Static APDU Responses

Pre-program command → response pairs. When a reader sends a matching APDU, the device replies automatically without needing the phone. Useful for emulating simple card applications.

• Enter the APDU command pattern in hex (e.g. 00A4040007A0000000031010)
• Enter the response in hex (e.g. 6F...9000)
• Tap Add Response
• Tap Clear All to remove all pairs (requires confirmation)

Live APDU Exchange (Emulator mode)

Manually handle incoming APDUs in real time. Tap Wait for APDU (recv) — the app blocks until a reader sends an APDU. The received command is shown in hex. Enter a response and tap Send APDU Response.

Reader APDU (Reader mode)

Send an ISO14443-4 APDU directly to a real card in the field. Enter the command hex and tap Send Reader APDU. The card's response is displayed.

EMV / ISO14443-4 Scan

Performs card detection and returns the UID, ATQA, SAK, and ATS of any ISO14443-4 card in the field. Useful for identifying EMV cards before sending APDUs.

🃏 MF1 Emulator Config HF

Configure how the ChameleonUltra behaves when emulating a MIFARE Classic card. Pull down to refresh configuration from the device.

Mode Flags

Write Mode

Detection Mode

When enabled, the device records every authentication attempt: UID, nonce, encrypted reader response. Tap Get Count to see how many events are stored. Tap Fetch Detection Log to download and display them. The log is used by the mfkey32 attack in HF Key Attacks to recover keys.

Anti-Collision Data

Get or set the UID, SAK, and ATQA the emulated card presents during anticollision. Enter a 4- or 7-byte UID in hex, SAK byte, and ATQA (4 hex chars), then tap Set Anti-Coll Data.

Emulator Block Data

Read or write raw block data in the emulator's flash storage. Enter start block and count, then tap Read Emu Blocks. To write, enter 32 hex chars (16 bytes) and tap Write Emu Block.

🏷️ MFU / NTAG Emulator HF

Configure emulation of MIFARE Ultralight and NTAG tags. Pull down to refresh config or page count.

Emulator Flags

Page Data

Enter a start page and count, then tap Read Pages to view raw page data (4 bytes per page). To write, enter hex data (multiples of 8 hex chars = 4 bytes) and tap Write Pages.

Counters

NTAG21x tags have three 24-bit counters (indices 0, 1, 2). Select a counter and tap Read. To set a value, enter a number and optionally enable Reset tearing flag, then tap Write Counter. Tap Reset Auth Cnt to clear the authentication attempt counter.

Version & Signature

Read the 8-byte version data and 32-byte ECC signature stored in the emulator. You can also set custom version data (16 hex chars) or signature (64 hex chars) to match a specific physical tag.

📻 LF Scan 125 kHz

Scan and clone low-frequency access control credentials. Switch to Reader mode before scanning.

Supported Tag Formats

For HIDProx, select the format (H10301, Indala, Tecom, etc.) from the dropdown before scanning, or leave on Auto-detect. Scanned FC and CN are pre-filled for writing.

Write to T55xx

Clone a scanned ID (or enter one manually) onto a T55xx blank card. Select the target protocol, fill in the ID, and tap Write to T55xx. For HIDProx, enter Facility Code and Card Number and choose the write format.

Generic T55xx Block Write

Write an arbitrary 4-byte value to any T55xx block (0–7). Optionally supply a password and enable Use password for password-protected tags.

ioProx Decode / Compose

Decode raw ioProx hex bytes to extract Version, FC, and CN. Or compose an ioProx ID from numeric Version, FC, and CN fields — the result can then be written directly to a T55xx.

LF Sniff

Captures raw 125 kHz field data for a configurable timeout (default 2000 ms). After capture:

• The app automatically decodes EM4100 (ASK/Manchester) and HID Prox (FSK) from the waveform
• Tap Plot waveform to see the raw ADC signal with mean and threshold lines
• Use Zoom in / out and Pan left / right to inspect specific parts of the capture
• Tap Auto range to zoom to the region where the tag was modulating
• Tap Copy hex to clipboard to export raw data for external analysis

ADC Voltage

Reads the analogue field voltage in millivolts. Useful for checking antenna coupling and field strength.

📳 LF Emulator IDs 125 kHz

Set the IDs emitted by the ChameleonUltra for each LF protocol. Each field shows the currently programmed value; tap Get to read from the device and Set to write.

📂 Slot Manager

The ChameleonUltra has 8 independent slots, each holding one HF and one LF tag profile simultaneously. Pull down to refresh, or to save slot configuration to flash.

Slot list

Each slot card shows the HF and LF nicknames, tag type, UID/ID, and whether the slot is currently active. Tap a slot to open Slot Detail.

Slot Detail

From the detail page you can:

⚙️ Settings

Pull down to save settings to flash or reset to factory defaults.

LED Animation

Choose how the LEDs behave: Full animation, Minimal, No animation, or Symmetric. Changes are saved to flash immediately when you select an option.

Button A & Button B

Each hardware button has a short-press and a long-press action. Options:

BLE Pairing

Enable Require pairing key to require a PIN before BLE connections are accepted. Tap Delete all BLE bonds to clear all paired devices (confirmation required).

🔬 Advanced EXPERT

Low-level tools for sniffing, raw configuration, and device diagnostics. Some actions here are irreversible.

HF Sniff 13.56 MHz

Passively captures all ISO14443-A traffic between a reader and a card for the configured timeout (default 5000 ms). After capture:

• Frames are decoded and displayed with direction arrows: >>> reader→card, <<< card→reader
• Common frames are labelled: [REQA], [WUPA], [ATQA], [SELECT CL1], [MFC AUTH_A], [APDU SELECT FILE], ISO7816 status words, etc.
• Tap Copy decoded to copy the annotated frame log to the clipboard
• Tap Copy raw hex to copy the unprocessed hex buffer

Sniff — Auth Nonces

If any MIFARE Classic authentication exchanges are captured, they are extracted and shown below the frame log. Each entry shows the block, key type, UID, nonce (nt), and encrypted reader values (nr, ar).

Depending on what was captured, the app shows the correct offline cracking command:

Tap the command text to copy it to the clipboard. Tap Crack on device to run the attack locally — the result appears in green (key found) or red (not found). Tap Copy next to the recovered key to copy just the key hex.

HF14A Config

Read or write the raw HF14A configuration blob (advanced hardware register settings). Tap Get HF Config to read the current value, edit the hex, then tap Set HF Config.

MF1 Emulator Extras

Quick toggles for Block anti-collision mode and Field-off do reset (same as in MF1 Emulator page). Also shows the current detection event count inline.

Device Info

Fetch and display the raw capabilities blob, settings blob, and enabled slot list as hex data.

Danger Zone IRREVERSIBLE

💾 Firmware Update

Flash new firmware to the ChameleonUltra over USB. A USB connection is required — BLE is not supported for flashing.