Chameleon Ultra

The Chameleon Ultra is the ultimate RFID emulation device : Low and high-frequency emulation, full read & write capabilities, bleeding-edge cracking, wireless control : all wrapped up in a key-chain sized, fully open-sourced device.

The Chameleon Ultra is the result of exceptional engineering ingenuity, the development team discovered that little-known RFID function in a popular Bluetooth controller could be pushed to provide high-performance, multi-frequency RFID reading, writing and cracking - and emulation performance almost identical to that of a physical card.

This discovery gave birth to the Chameleon Ultra: a tiny, high performance RFID companion device for multi-frequency RFID emulation, cracking, reading and writing.

Compared to the JLC version of the Chameleon, this model features an upgraded LF antenna, now providing stronger signal induction (from 300L+ to over 500L).

The middle frame is made of high-quality PLA material, offering durability comparable to injection-molded components.

The LF antenna itself requires a larger coil to achieve effective induction, which has always been one of the main challenges in Chameleon hardware design.

Understand the ChameleonUltra

The Chameleon Ultra's primary use is for RFID Emulation. Instead of needing physical cards, you can emulate multiple different types of chips and different frequencies with one device.

The Chameleon Ultra also has several other powerful features : cracking, reading, writing.

When working with RFID tags, there are typically five required functions:

1. Identification - identifying the badge : frequency, modulation, chipset, protocol, etc. Most tags can be easily identified. However, some tags need to be manually identified, requiring specialty hardware such as the Proxmark.
   
   
2. Cracking - many common chipsets (MIFARE Classic®, etc) require keys to read or write the contents of the badge. If the keys are unknown, they need to be cracked. The ChameleonUltra cracking capabilities equal to Proxmark.
3. Reading - Reading the data from a badge.
4. Emulation - Emulation allows for simulating a badge digitally. Instead of needing multiple physical cards, they can be replaced with an emulator. Further, emulated data and chipsets can be customised completely - something impossible with physical cards.
5. Writing - Writing data to an existing badge, or cloning data to a new badge.

The below table shows the coverage that the ChameleonUltra provides in each of these categories, and how it compares to other tools.

For users that don't require advanced identification or rapid cloning, the ChameleonUltra could be the perfect match for your needs.

ChameleonUltra Community and Ecosystem

The Chameleon Ultra is fully open-source: all firmware, hardware, software and resources are available on the Chameleon Ultra Github page.

The frequent contributions from RFID superstars such as iceman and doegox ensure that the Chameleon Ultra is a well-supported, high-performance device.

Note on LF signal operation:
If you encounter issues with the LF signal, the most likely reason is that the initial 125kHz transmission is used to wake up the Chameleon. The LF information will only be returned after the signal is transmitted a second time.
Additionally, in the Chameleon’s default factory settings, only Slot 1 and Slot 3 have low-frequency signals enabled. If switched to Slot 2, no LF signal will be detected.

What's included

• 1x ChameleonUltra
• 1x USB-A - USB-C Cable
• 1x Keychain attachment
• 1x screwdriver

Device Specifications

• HW ver 2.245
• Processor + Memory:
• NRF52840
• ARM Cortex-M4 32-bit 64 MHz (Application Processor)
• 1MB Flash
• 256KB RAM
• Tactile Controls: 2x Physical Buttons
• Internal Battery: LiPo 90mAh (6 months without charge)
• Connectivity: USB 2.0, Type-C
• Dimensions: 40 x 24 x 8 mm
• Weight: 8g

Technical Resources

• ChameleonUltra UI Tools (Windows/MacOS/Linux/Android)
• Official Github
• Community Discord Server