ChameleonMini

This is NOT the official repository of ChameleonMini, a freely programmable portable tool for NFC security analysis that can emulate and clone contactless cards, read RFID tags, and sniff/log RF data. This repository brings support for the Chameleon Tiny.

Our Project is based on the open-source project ChameleonMini RevG by Kasper & Oswald. They also have their own Webshop.

• Information:
  • Chameleon Tiny Site: Here
  • Chameleon BLE API: Here
  • Doxygen: Here
    • For viewing some of the documentation
    • Binaries: Here
    • Install: Here
  • Documentation (RfidResearchgroup):
    • Source: Here
      • Need to manually download and view
      • Open Doc/Doxyfile and then in application Show HTML Output
  • Documentation (emsec):
    • Doxygen: Here
    • Source: Here
• Tools:
  • Phone APP:
    • Android: Chameleon
      • The Android APP is currently NOT compatible with the official firmware
    • IOS: ChameleonTiny Manager
      • The IOS APP is currently NOT compatible with the official firmware
      • Credit to bettse
    • Password: e4g1
  • Optional GUI (Windows Only):
    • Windows: Here
    • Source: Here
  • Chameleon Firmware:
    • Compile the latest firmware: Here
      • Or use the precompiled: Here
    • The Chameleon Mini REV.G version uses the same firmware for both the Mini with Bluetooth version and Tiny
    • The hardware design of the RF part is exactly the same
    • The hardware is also compatible with the official firmware of the KAOS brothers
  • Terminal APP:
    • Putty or similar APP
  • DFU driver:
    • The DFU driver comes from ATMEL's official LIBUSB driver library
    • You can download it yourself or from the repo: Here
  • DFU Programmer:
    • Zip file from SourceForge: Here
• Resellers:
  • Our Asia & Oceania Reseller: Here
  • Our Europe Reseller: Here
  • Our US Reseller: Here
• Repository Structure:
  • Doc: A folder for doxygen documentation
  • Drivers: Chameleon drivers for Windows and Linux
  • Dumps: Dumps of different smartcards
  • Hardware: The layout and schematics of the PCB
  • Firmware: The complete firmware including a modified Atmel DFU bootloader and LUFA
  • Software: Contains a python tool for an easy configuration (and more) of the ChameleonMini
    • WARNING: This is currently under construction
  • RevE: Contains the entire contents of the discontinued RevE repository
  • RevE-light: Contains our development files for the RevE-light
    • WARNING: This is currently not supported / not functional

A. Upgrade to the latest firmware

A1. Upgrade Chameleon AVR Firmware

---

1. Obtain and Prepare Tools:

• Optional GUI (Windows Only)
• Terminal APP
• Firmware
• DFU Driver
• DFU Programmer

2. Create a Working Directory

1. Create a directory to work from
2. Place the Chameleon firmware in the directory
3. Unzip the DFU Programmer folder to the working directory
4. If you are using the auto install on Windows, place ChameleonFirmwareUpgrade.bat in the working directory as well

• Further information:
  • Here
  • emsec

3. Enter the Chameleon Direct Firmware Update (DFU) mode:

Method 1: GUI (Windows Only)

• Mini or Tiny:

  1. If it is a Chameleon Mini, ensure it is in the OFF position
  2. Connect it via USB cable to your computer
     • On the Mini, it may be a good idea to remove the battery before putting the device into DFU mode
  3. Under the Settings tab, Send the Upgrade command while the Chameleon is connected
     • This only puts the Chameleon in DFU mode
     • It does NOT start installing the firmware at all
  4. Chameleon should now be in DFU mode

• Further information:

  • emsec
  • Iceman GUI

Method 2: CLI

• Mini:

  1. With the Chameleon in the OFF state, press and hold the black (Rev E) or yellow (Rev G) button near the USB while inserting it into the USB port
     • It may be a good idea to remove the battery before putting the device into DFU mode
  2. Use your favorite terminal application to connect to it. Type upgrade and hit Enter
     • This only puts the Chameleon in DFU mode
     • It does NOT start installing the firmware at all
  3. Chameleon should now be in DFU mode

• Tiny:

  1. Press and hold the B button while inserting it into the USB port
  2. Use your favorite terminal application to connect to it. Type upgrade and hit Enter
     • This only puts the Chameleon in DFU mode
     • It does NOT start installing the firmware at all
  3. Chameleon should now be in DFU mode

4. Install DFU Driver:

Windows

• Mini or Tiny:
  1. Download the drivers from the repo
  2. Ensure you have connected your Chameleon and that it is in DFU mode
  3. You should have an unknow USB device in device manager
  4. Update the device with the driver files from the repo
  5. You should now have an 'ATxmega*' device

5. Start Firmware Upgrade:

Method 1: Automatic (Windows Only)

• Mini or Tiny:
  1. If you haven't already, place ChameleonFirmwareUpgrade.bat in your working directory with your firmware and other tools
  2. Ensure Chameleon is in DFU mode
  3. Run the ChameleonFirmwareUpgrade.bat file AS ADMIN to automatically start the firmware upgrade
  4. It usually takes 2 - 5 seconds
  5. After the progress bar is complete, the firmware upgrade is complete

Method 2: Manual

• Mini or Tiny:

  • Guides:

    • Icemans Guide (Windows): Here and Here
    • Icemans Guide (Linux): Here
    • Icemans Guide (Mac): Here

  • Note:

    • Replace any relevant files or other parts with the resources in this repo

A2. Upgrade (OTA) Bluetooth Firmware (Chameleon Mini only)

---

1. Obtain and Prepare Tools:

• Optional GUI
• Terminal APP
• Phone APP
• Firmware

2. Use APP to Connect to Chameleon Using Bluetooth:

1. Press any button on the Mini and the white battery light should come ON
   • You can now connect via Bluetooth
2. Open the APP again and click Connect to automatically connect the Chameleon

3. Start Bluetooth Firmware Upgrade:

1. In the Device Information column, press BLE CMD Version 5 times
2. On the OTA upgrade page, click Auto Upgrade
3. The APP will immediately start to upgrade to the latest Bluetooth firmware that comes with it
4. The APP will automatically exit after the upgrade is complete

B. Crash Course

B1. Detect Keys and Upload Card files

---

1. Obtain and Prepare Tools:

1. Tools:

   • Optional GUI
   • Terminal APP
   • Phone APP

2. Connect to the Chameleon Mini or Tiny using the APP

   • Connect via USB or Bluetooth

• Note:
  • Both the Chameleon Mini and Tiny support direct connection to the mobile phone USB port
    • For the Mini, an additional OTG adapter needs to be purchased
    • Tiny uses its own dual-headed TYPE-C data cable to connect directly to TYPE-C mobile phones
  • Chameleon Mini has built-in Bluetooth BLE4.0. Press any button to wake up Bluetooth
  • Turn Bluetooth ON on your phone and the APP will automatically connect

2. Use APP to Enable Detection Mode:

1. After connecting, click on a single card slot and select MF_DETECTION_1K or MF_DETECTION_4K in the Card Slot mode
2. This card slot will now have the Detection mode turned ON
3. Write the original card number in the UID Card Number column
   • If you don't know the UID number, you can fill in it at will
4. Then click the Clear button below to clear the last detection record

3. Use APP to Get Keys:

1. Take the Chameleon to the access control reader and swipe it across
2. The key and access traces are recorded by the Chameleon when you swipe
3. Connect back to the mobile phone and press the Crack button
4. After a few seconds, the APP will automatically solve and list the results, as shown in the figure below:

5. The list shows which blocks the read head just visited, and what password was used for each access
6. Click the History button. The APP will automatically list the keys separately and save them for other software to use
7. If your mobile phone comes with an NFC function, you can put the original key directly on the mobile phone
8. The APP will automatically use the key in the list to read the entire card, and after it is successful, it will automatically save the entire card data file on the mobile phone

• Note:
  • Multiple red LEDs are on at the same time during detection, which means the memory is full, just clear the memory.

4. Use APP to Import Existing Card Files:

1. Use QQ to send the card data file to the mobile phone QQ
   • Or connect the mobile phone to the computer and transfer the file to any directory on the mobile phone
2. Open the APP and click the Dump column
3. Click the Scanner in the plus sign in the upper right corner
4. Click the three horizontal line buttons in the upper left corner and select this phone
5. Select the root directory of the QQ receiving file or the previously copied directory, and click Allow Access
6. All card data files will be automatically scanned into the Dump file interface, which can be uploaded or edited at will
7. Click the card data file in the Dump column below, and click Upload below to upload to the card slot corresponding to the Chameleon

B2. Introduction to UID Mode and SAK Mode

---

1. UID Mode:

1. Click the button UID Changeable (GEN1a) in the APP or directly send the command UIDMODE = 1 to turn it ON
   • UIDMODE = 0 to turn it OFF
2. After the UID mode is turned ON, the card simulated by Chameleon will become a GEN1a card
   • Commonly known as a UID card or Chinese magic card
3. The current card slot takes effect

2. SAK Mode:

1. Click the SAK Mode button in the APP or directly send the command SAKMODE = 1 to turn it ON
   • SAKMODE = 0 to turn it OFF
2. After the SAK Mode is turned ON, the card will feedback the real SAK value when it is found
3. The SAK value is determined by the 0 sector, 0 block, and the position is the position of the sixth byte immediately after the UID number
4. If the SAK Mode is not turned on, the SAK is a fixed value of 08, and 0 blocks of data are ignored
   • This function is useful when special SAK values cannot be used normally after being copied
   • This achieves better compatibility
5. The current card slot takes effect

B3. Card Slot Functions

---

1. UID Card Function Class

2. Cracking and Card Reading Functions

3. Custom Button Functions

C. Hardware & Lights

C1. All Units

---

1. Charging:

• Any time you connect USB, it will automatically start charging
• The Mini will have a white light while the Tiny will have a red light over the USB port to indicate if it is charging

2. Charging and Standby Mode:

• Charging method: Plug in the USB at any time and start charging immediately
• Battery type: LIR2032H replaceable lithium-ion rechargeable battery
• Charging time: 2 hours @ 0-100%
• Charging current: 40mA
• Start-up current: 38mA
• Card reading current: 65mA
• Sleep current: 5uA (9uA-MAX)
• Battery capacity: 70mAh
• Duration: Swipe the card 3 times a day for 5 seconds each time, and it can be used for one year on a single charge
• Sleeping time: Fully charged, it can be left for two years when it is turned off and sleeping
• Port type:
  • Mini: MicroUSB
  • Tiny: Type-C

3. Detect Memory Full:

• If the memory is full during dense flow detection, multiple red LEDs will be abnormally lit

4. Usage Guide for New Functions:

C2. Chameleon Mini

---

1. Turn on Bluetooth and Check the Battery:

1. When the power is OFF, press any button once to turn ON the Bluetooth power, and at the same time, display the current power with a white LED
2. With the Bluetooth in the ON state, click any button to turn OFF the Bluetooth power, the power LED goes out, and the system sleeps
3. Bluetooth will sleep automatically after no operation for 15 seconds
   • Press any button once to shut down immediately

2. Turn On the Chameleon:

1. With the Bluetooth in the ON state, double click any button
   • Or in the OFF state, triple click any button times to turn ON the Chameleon
2. The red LED lights up to indicate the slot number
3. Chameleon will automatically sleep and shut down after no operation for 5 seconds

3. Bootloader/DFU Firmware Upgrade Methods:

• Section A1: Here

4. Schematics for Chameleon Mini:

• Chameleon Mini: Here

5. Demos

• ChameleonMini RevG In Lab Demo / Technical Explanation of Command Line Interface
• Mifare Reader Attack: Sniffing, Cracking, Emulation, Open! LAB401 Academy - CHAMELEON MINI Tutorial
• How to use the new Proxgrind Chameleon Tiny and Mini with the APP

C3. Chameleon Tiny

---

1. Turn Chameleon and Bluetooth On:

1. With the Chameleon in the OFF state, press the A button once to turn ON the Chameleon power
2. The red LED lights up to indicate the slot number
3. Chameleon will automatically sleep and shut down after no operation for 5 seconds
   • This can be adjusted in the APP

2. Bootloader/DFU Firmware Upgrade

• Section A1: Here

3. Schematics:

• Same as the Mini ?

4. Demos

• How to use the new Proxgrind Chameleon Tiny and Mini with the APP
• ChameleonTiny 8 Prox in1 & Sniff - Crack RFID ~ NFC ~ UID
• Chameleontiny pro -Standalone clone of a MIFARE 1K UID

D. Appendix

D1. Feature Comparison Table for Each Version

---

1. Comparison Table of Specs

2. Comparison Table of Analog Card Characteristics

3. Table of New Commands

D2. Complete Instruction List

---

1. Links:

• Instruction Sheet: Here
• emsec: Here
• AndreasBujok/ChameleonMini

D3. Supported Cards, Encoding, & Simulation Types

---

1. Links:

• emsec: Here

2. Comparison Table of Encoding/Simulation Types

3. Comparison Table of Sniff Modes

4. Comparison Table of Supported Reading Card Types

E. External Contributions

---

• @iceman1001
• Philippe Teuwen (@doegox)
• Willok
• DXL
• ProxGrind aka Olaf