This is NOT the official repository of ChameleonMini, a freely programmable, portable tool for NFC security analysis that can emulate and clone contactless cards, read RFID tags and sniff/log RF data. Thanks to over 1700 backers from our [Kickstarter project](https://www.kickstarter.com/projects/1980078555/chameleonmini-a-versatile-nfc-card-emulator-and-mo), the current Revision G has been realized by Kasper & Oswald GmbH.
This is NOT the official repository of ChameleonMini, a freely programmable, portable tool for NFC security analysis that can emulate and clone contactless cards, read RFID tags and sniff/log RF data.
Our Project is based on the open-source project by ChameleonMini RevG by Kasper & Oswald [Webshop](https://shop.kasper.it/).
Our ChameleonMini / ChameleonTiny by ProxGrind is available on Indiegogo now.
(3) Install the DFU driver. The DFU driver comes from ATMEL's official LIBUSB driver library. You can download it yourself or find it in attachment.
(4) Enter the chameleon DFU mode. When the device is off, press and hold the yellow button near the USB (TINY is the B button), insert the USB, and then you can enter the DFU upgrade mode. Or send the command "UPGRADE" in the connected state, and it can also enter the DFU upgrade mode.
(5) Start to upgrade the firmware. Run the "ChameleonFirmwareUpgrade.bat" file in the attachment to automatically start the firmware upgrade. It usually takes 2-5 seconds. After the progress bar is complete, the firmware upgrade is complete!
(6) A description of the firmware. The chameleon REV.G version uses the same firmware for both the MINI with Bluetooth version and ITNY. The hardware design of the RF part is exactly the same.
The hardware is also compatible with the official firmware of the KAOS brothers: **[Here](https://github.com/emsec/ChameleonMini)**
It should be noted that the Android APP is currently not compatible with the official firmware.
2. Upgrade (OTA) Bluetooth firmware for Chameleon MINI
(1) Prepare Android phone and install APP.
Google Store: **[Here](https://play.google.com/store/apps/details?id=com.proxgrind.chameleon)**
**Password: e4g1**
(2) Open the app and connect the device using Bluetooth. Press any button on the MINI, and the white battery light is on, and Bluetooth is connectable. At this time, open the app again and click Connect to automatically connect the chameleon.
(3) Start upgrade (OTA) Bluetooth firmware. In the “Device Information” column, press “BLE CMD Version” 5 times.
It will pop up the OTA upgrade page, click "Auto Upgrade", and the APP will immediately start to upgrade the latest Bluetooth firmware that comes with it. Automatically exit after the upgrade is complete.
Google Store:**[Here](https://play.google.com/store/apps/details?id=com.proxgrind.chameleon)**
**Password: e4g1**
(2) Connect the Chameleon MINI or TINY using the Android APP.
USB port direct connection: Both the Chameleon MINI and TINY support direct connection to the mobile phone USB port. For the MINI, an additional OTG adapter needs to be purchased. TINY uses its own dual-headed TYPEC data cable to connect directly to TYPEC mobile phones.
Bluetooth connection: Chameleon MINI has built-in Bluetooth BLE4.0. Press any button first to wake up Bluetooth. Turn on Bluetooth on your Android phone and the app will automatically connect.
(3) Use Android APP to enable detection mode.
After connecting, click on a single card slot and select DETECTION_1K or 4K in the "card slot mode". This card slot has the detection mode turned on. Write the original card number in the "UID Card Number" column. Click "Write." If you don't know the UID number, you can fill in it at will. Then click the "Clear" button below to clear the last detection record.
(4) Use Android APP to get keys.
At this time, take the chameleon to the access control reader and swipe. The key and access traces when the chaser reads the chameleon will be recorded by the chameleon.
. At this time, connect back to the mobile phone and click the "crack" button. After few seconds, the app will automatically solve and list the results, as shown in the figure below:
The list shows which blocks the read head just visited, and what password was used for each access.
At this point, click the "History" button, the APP will automatically list the keys separately and copy it automatically for easy copying to other software for next use.
If your mobile phone comes with NFC function, you can directly put the original card on the mobile phone NFC at this time, the APP will automatically use the key in the list to read the entire card, and after successful, it will automatically save the entire card data file on the mobile phone. .
Note: Multiple red LEDs are on at the same time during detection, which means the memory is full, just clear the memory.
(5) Use Android APP to import existing card data files in batches.
Use QQ to send the card data file to the mobile phone QQ, or connect the mobile phone to the computer and transfer the file to any directory on the mobile phone.
Open the app, click the "DUMP" column below, click the "SCanner" in the "plus sign" in the upper right corner, click the three horizontal line buttons in the upper left corner, and select this phone. Then select the root directory of the QQ receiving file or the previously copied directory, and click Allow Access. All card data files will be automatically scanned into the "DUMP file" interface, which can be uploaded or edited at will.
Click the card data file in the “DUM” column below, and click “Upload” below to upload to the card slot corresponding to the chameleon.
**2. Introduction to UID mode and SAK mode**
(1) UID mode
After the UID mode is turned on, the card simulated by Chameleon will become a GEN1a card, commonly known as a UID card, Chinese magic card.
Global card slot takes effect.
How to open: Click the button "UID Changeable (GEN1a)" in the APP or directly send the command "UIDMODE = 1" to turn it on, and "UIDMODE = 0" to turn it off.
(2) SAK mode
After the SAK mode is turned on, the card will feedback the real SAK value when it is being found. The SAK value is determined by the 0 sector and 0 block, and the position is the position of the sixth byte immediately after the UID number. If the SAK mode is not turned on, the SAK is a fixed value of 08, and 0 blocks of data are ignored.
This function is used to meet the situation that some cards with special SAK values cannot be used normally after being copied, and can achieve better compatibility.
The current card slot takes effect.
How to open: Click the "SAK Mode" button in the APP or directly send the command "SAKMODE = 1" to turn it on, and "SAKMODE = 0" to turn it off.
MF_DETECTION_1K|Detecting reader to obtain keys|MFKEY32V2|List results directly|
MF_DETECTION_4K|Detecting reader to obtain keys|MFKEY32V2|List results directly|
ISO14443A_READER|Reader Mode|-|Display UID|
ISO14443A_SNIFF|Sniffing|-|Not supported|
ISO15693_SNIFF|Sniffing|-|Not supported|
**4. Button Custom Function Introduction**
|Option names | Description |
| ------------------- |:-------------------:|
NONE|Set this button to have no function|
UID_RANDOM|Randomly generated UID number in the current card slot after pressing|
UID_LEFT_INCREMENT|After pressing, the highest byte of the UID number plus one (hexadecimal)|
UID_RIGHT_INCREMENT|After pressing the lowest byte of the UID number plus one (hexadecimal)|
UID_LEFT_DECREMENT|After pressing, the highest byte of the UID number is reduced by one (hexadecimal)
UID_RIGHT_DECREMENT|After pressing, the lowest byte of the UID number is reduced by one (hexadecimal)|
CYCLE_SETTINGS|Card slot number sequence will increase after pressing|
CYCLE_SETTINGS_DEC|Card slot number sequence decreases after pressing|
STORE_MEM|Immediately after pressing, the current card data in the temporary buffer is overwritten into the memory|
RECALL_MEM|Immediately after pressing, the current card data in the memory is overwritten into the temporary buffer (Can be used to quickly restore card data)|
TOGGLE_FIELD|Click once to turn off the antenna and click again to turn on the antenna function|
STORE_LOG|Write the log data in the temporary cache to the memory, which can be saved even when power is off|
CLEAR_LOG|Clear log data immediately after pressing|
CLONE|Read the UID card number immediately after pressing, continue searching, and simulate immediately after reading the card|
Button Usage
-----------
@@ -32,24 +182,148 @@ When shutting down, press and hold the button next to USB and then connect USB.
Charging: Any time you connect USB, it will automatically start charging. Stop automatically after filling. The white LED indicates the power level.
Detect memory full: If the memory is full during dense flow detection, multiple red LEDs will be abnormally lit.
C.Hardware Introduction
=======================
Supported Cards and Codecs
--------------------------
See [here](https://github.com/emsec/ChameleonMini/wiki/Supported-Cards-and--Codecs).
**1.Button function introduction**
(1)ChameleonMini Rev G
Turn on Bluetooth and check the battery:
In the off state, press any button once to turn on the Bluetooth power and light up the white LED to show the current power. After 15 seconds, it will automatically shut down after no operation. Bluetooth is on. Press any button once to sleep and shut down immediately. Can be used to quickly check the battery level.
Turn on the chameleon:
When the Bluetooth is on, press any button twice (double-click), or in the off state, press any button three times (three-click) to turn on the chameleon. The red LED lights up to indicate the slot number. After 5 seconds without operation, it will automatically sleep and shut down.
DFU firmware upgrade status:
In the closed state, press and hold the yellow button near the USB, and then let go after inserting the USB, the chameleon enters the DFU firmware upgrade mode.
(2 ) ChameleonTiny
Turn on the chameleon:
In the closed state, press the A button once to turn on the chameleon power. The red LED lights up to indicate the slot number. After 5 seconds without operation, it will automatically sleep and shut down.
DFU firmware upgrade status:
In the off state, hold down the B button and connect the USB. You can enter the DFU flash firmware mode.
**Appendix**
=================
**1.Feature comparison table for each version**
|- | Rev.G Official by KAOS | Rev.E Old Rdv2.0 by ProxGrind | Rev.G by ProxGrind |Rev.G Tiny by ProxGrind |
ISO 14443 A 106 kbit/s|Reader -> card Direction sniffing|Maybe support the other direction|Currently only supported Reader -> card Direction sniffing |Support|
（3） Card Type Supported via Reading
Card type |Encoding type| Whether the hardware stand by|Whether the software stand by|Whether the application layer supports|Note
MifareClassic1K/4K 4B/7B|ISO14443A 106 kbit/s|Support|Support|Not Supported|No card reading instruction, encryption function has been implemented|MIFARE DESFIRE|ISO14443A High rate|Supports low rates, or possibly higher rates| Only supported Low rate|Not Supported|No card reading instruction, encryption function is being supported|
2.Charging and Standby Mode
-----------------------
Charging method: Plug in the USB at any time and start charging immediately.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Willok