Connect
The app opens to the connect screen. Tap Scan for device to discover a nearby ChameleonUltra over BLE, or Connect via USB for wired CDC-ACM connection.
Tap "Scan for device" on the phone to see the connection flow.
Main Menu
After connecting, the main page shows the active slot, battery level with voltage, and links to all app sections. Pull down from the top edge to disconnect.
Tap any menu row to navigate to that page.
Slot Manager
Shows all 8 slots with their HF and LF tag types and enabled state. Pull down to refresh or save the slot configuration.
Tap a slot to open its detail page.
Slot Detail
Set the slot nickname, HF and LF tag types, enable or disable the slot. Get LF ID and Get HF UID activate the slot and read back the stored emulated ID.
Tap "Get LF ID" or "Get HF UID" to fetch the stored ID.
HF Scan (13.56 MHz)
Scans for ISO 14443-A tags, returning UID, ATQA, SAK, and ATS. Also supports raw frame send with optional CRC append and RF keep-on. Pull down for continuous scan or EMV/ISO 14443-4 scan.
Tap "Scan HF Tag" to see a simulated result.
LF Scan (125 kHz)
Reads EM410X, HID Prox, ioProx, Viking, PAC/Stanley cards. LF Sniff captures the raw 8 µs/sample ADC waveform and decodes modulation. The waveform plot shows the field, mean, and detection threshold.
Tap "Start Sniff" to capture and plot a waveform.
Advanced
HF 14443-A bidirectional sniff shows reader ↔ card frames with >>> reader→card and <<< card→reader directions. Also HF14A config, MF1 extras, device capabilities, and danger zone commands.
Tap "Start HF Sniff" to see a decoded frame trace.
Settings
Configure button A and B short/long press functions, LED animation mode, and BLE pairing. Changes are saved to flash automatically. Pull down to factory reset.
Tap any combo row to cycle through options.
Device Info
Shows model (Ultra/Lite), firmware version, battery percentage and voltage. Pull down to refresh all info.
About
App version, author, links to sec1.dk blog and Codeberg source, MIT license.
09:41
BLE
—
C
Chameleon Ultra
Sailfish OS Client
Scan for device
Connect via USB
Tap to scan for nearby ChameleonUltra
▼ PULL DOWN
ChameleonUltra
100% · 4.15V
Active
Slot 1
Mifare Mini · EM410X
Navigate
Slot Manager
8 slots · active slot config
HF Scan
13.56 MHz · ISO 14443-A
LF Scan
125 kHz · EM410X, HID, ioProx…
Advanced
HF sniff · config · MF1 extras
Settings
Buttons · LED · BLE pairing
Device Info
Model · firmware · battery
About
harbour-chameleon-ultra v1.0
‹ back
Identity
Nickname
cloned
Set Nickname
Activate Slot
HF Tag Type (13.56 MHz)
HF Tag TypeMifare Mini
Set HF Type
Reset HF Default
LF Tag Type (125 kHz)
LF Tag TypeEM410X
Set LF Type
Slot State
▼ PULL DOWN
‹ back
HF 14443-A
Scan HF Tag
Raw command
Hex bytes to send
60 00
Send Raw
▼ PULL DOWN
‹ back
Scan
ProtocolEM410X
Scan LF Tag
LF Sniff
Timeout (ms)
2000
Waveform plot available after sniff
Start Sniff
▼ PULL DOWN
‹ back
HF Sniff (13.56 MHz)
Timeout (ms)
5000
Start HF Sniff
HF14A Config
Get HF Config
Config data (hex)
—
Set HF Config
MF1 Emulator Extras
Block anti-collision mode
Suppress UID in anti-collision loop
Field-off do reset
Reset emulator state when RF drops
Get Detection Count
Device Info
Capabilities
Settings blob
Enabled slots
Danger Zone
These actions are irreversible or potentially destructive.
Wipe FDS
Enter Bootloader
▼ PULL DOWN
‹ back
LED Animation
LED animationFull animation
Button A
Short pressNone
Long pressClone tag
Button B
Short pressNext slot
Long pressNone
BLE Pairing
Require pairing key
PIN required to connect via BLE
Delete all BLE bonds
▼ PULL DOWN
‹ back
Hardware
Firmware
v2.0.0-16-g76c961e
BLE Address
AA:BB:CC:DD:EE:FF
Connection
BLE (Nordic UART)
Slot overview
Slot 1
Mifare Mini · EM410X
Slot 2
Mifare Classic 1K · HIDProx
Refresh battery
‹ back
C
harbour-chameleon-ultra
Version 1.0.0
Sailfish OS client for ChameleonUltra. BLE and USB transport. NFC/RFID emulation, cloning, sniffing and waveform analysis.
Author
Source
codeberg.org/nieldk