From b655c7351a0748b2c42c933d5ce60471cf9ebbdc Mon Sep 17 00:00:00 2001 From: Dmytro Klishchevskyi Date: Mon, 5 Aug 2024 21:30:55 +0200 Subject: [PATCH 1/5] fix LF emulation; make continuous sending ID; increase field sensing period --- firmware/application/src/rfid/nfctag/lf/lf_tag_em.c | 12 ++++++++++-- firmware/application/src/rfid/nfctag/lf/lf_tag_em.h | 3 ++- 2 files changed, 12 insertions(+), 3 deletions(-) diff --git a/firmware/application/src/rfid/nfctag/lf/lf_tag_em.c b/firmware/application/src/rfid/nfctag/lf/lf_tag_em.c index faa0735..00f05bf 100644 --- a/firmware/application/src/rfid/nfctag/lf/lf_tag_em.c +++ b/firmware/application/src/rfid/nfctag/lf/lf_tag_em.c @@ -201,7 +201,8 @@ uint64_t em410x_id_to_memory64(uint8_t id[5]) { */ bool lf_is_field_exists(void) { nrf_drv_lpcomp_enable(); - bsp_delay_us(20); // Display for a period of time and sampling to avoid misjudgment + // With 20ms of delay CU was not able to detect the field of my reader after waking up. + bsp_delay_us(30); // Display for a period of time and sampling to avoid misjudgment nrf_lpcomp_task_trigger(NRF_LPCOMP_TASK_SAMPLE); //Trigger a sampling return nrf_lpcomp_result_get() == 1; //Determine the sampling results of the LF field status } @@ -261,7 +262,14 @@ void timer_ce_handler(nrf_timer_event_t event_type, void *p_context) { if (m_is_send_first_edge == true) { // The first edge of the next sends next time if (++m_bit_send_position >= LF_125KHZ_EM410X_BIT_SIZE) { m_bit_send_position = 0; // The broadcast is successful once, and the BIT position is zero - if (++m_send_id_count >= LF_125KHZ_BROADCAST_MAX) { +/* The main part of the idea. The original EM4100 tag continuously sends it's ID. +* The root problem, in my point of view, was that CU started to "feel" the field too far to be able to modulate it deep enough, +* and 3 times (LF_125KHZ_BROADCAST_MAX) of repeating takes only about 100ms, CU is still not close enough to the reader. +* That is why the emulation worked only if the CU moved past the reader quickly (fly by).*/ + if(!lf_is_field_exists()){ + m_send_id_count++; + } + if (m_send_id_count >= LF_125KHZ_BROADCAST_MAX) { m_send_id_count = 0; //The number of broadcasts reaches the upper limit, re -identifies the status of the field and re -statistically count the number of broadcast times } } diff --git a/firmware/application/src/rfid/nfctag/lf/lf_tag_em.h b/firmware/application/src/rfid/nfctag/lf/lf_tag_em.h index 85548e7..72acf73 100644 --- a/firmware/application/src/rfid/nfctag/lf/lf_tag_em.h +++ b/firmware/application/src/rfid/nfctag/lf/lf_tag_em.h @@ -11,7 +11,8 @@ * The definition of the packaging tool macro only needs to be modulated 0 and 1 */ #define LF_125KHZ_EM410X_BIT_SIZE 64 -#define LF_125KHZ_BROADCAST_MAX 3 // 32.768ms once, about 31 times in one second +// Have decided to increase the period of field sensing in this way +#define LF_125KHZ_BROADCAST_MAX 10 // 32.768ms once, about 31 times in one second #define LF_125KHZ_EM410X_BIT_CLOCK 256 #define LF_EM410X_TAG_ID_SIZE 5 From 6145f5c99bc8b986376d10b93a7b4f5e4fb2fe84 Mon Sep 17 00:00:00 2001 From: Dmytro Klishchevskyi Date: Tue, 6 Aug 2024 14:02:25 +0200 Subject: [PATCH 2/5] fix typo --- firmware/application/src/rfid/nfctag/lf/lf_tag_em.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/firmware/application/src/rfid/nfctag/lf/lf_tag_em.c b/firmware/application/src/rfid/nfctag/lf/lf_tag_em.c index 00f05bf..71e8798 100644 --- a/firmware/application/src/rfid/nfctag/lf/lf_tag_em.c +++ b/firmware/application/src/rfid/nfctag/lf/lf_tag_em.c @@ -262,7 +262,7 @@ void timer_ce_handler(nrf_timer_event_t event_type, void *p_context) { if (m_is_send_first_edge == true) { // The first edge of the next sends next time if (++m_bit_send_position >= LF_125KHZ_EM410X_BIT_SIZE) { m_bit_send_position = 0; // The broadcast is successful once, and the BIT position is zero -/* The main part of the idea. The original EM4100 tag continuously sends it's ID. +/* The main part of the idea. The original EM4100 tag continuously sends its ID. * The root problem, in my point of view, was that CU started to "feel" the field too far to be able to modulate it deep enough, * and 3 times (LF_125KHZ_BROADCAST_MAX) of repeating takes only about 100ms, CU is still not close enough to the reader. * That is why the emulation worked only if the CU moved past the reader quickly (fly by).*/ From 787e86a01a722aaa4cb3648cce851d1a8fc34fe0 Mon Sep 17 00:00:00 2001 From: mtoolstec Date: Sun, 25 Aug 2024 14:16:50 +0800 Subject: [PATCH 3/5] Update MTools BLE documentation --- README.md | 6 +++++- docs/mtoolsble.md | 50 ++++++++++++++++++++++++++++++++++++++++++++++ docs/mtoolslite.md | 42 -------------------------------------- docs/quickstart.md | 4 ++-- 4 files changed, 57 insertions(+), 45 deletions(-) create mode 100644 docs/mtoolsble.md delete mode 100644 docs/mtoolslite.md diff --git a/README.md b/README.md index 0b79449..5e2232f 100644 --- a/README.md +++ b/README.md @@ -8,7 +8,9 @@ Europe: [Lab401](https://lab401.com/) United States: [Hackerwarehouse](https://hackerwarehouse.com/) -Anywhere else: [Sneaktechnology](https://sneaktechnology.com) / [Aliexpress by RRG](https://proxgrind.aliexpress.com/store/1101312023) +MTools Tec: [MTools Tec](https://shop.mtoolstec.com/) + +Anywhere else: [Sneaktechnology](https://sneaktechnology.com) / [Aliexpress by RRG](https://proxgrind.aliexpress.com/store/1101312023) # What is it and how to use ? @@ -39,6 +41,7 @@ Table for future functionality progress # Compatible applications * [ChameleonUltraGUI](https://github.com/GameTec-live/ChameleonUltraGUI) +* [MTools BLE](docs/mtoolsble.md) # Videos @@ -47,6 +50,7 @@ Table for future functionality progress * [Downloading and compiling the official CLI](https://www.youtube.com/watch?v=VGpAeitNXH0) * [Downloading ChameleonUltraGUI](https://www.youtube.com/watch?v=rHH7iqbX3nY) * [ChameleonGUI features overview](https://www.youtube.com/watch?v=YqE8wyVSse4) +* [MTools BLE - How to clone a card with ChameleonUltra](https://youtu.be/IvH-xtdW1Wk?si=4exqgAAeJ-kxU3aN) # Official channels diff --git a/docs/mtoolsble.md b/docs/mtoolsble.md new file mode 100644 index 0000000..6586f9d --- /dev/null +++ b/docs/mtoolsble.md @@ -0,0 +1,50 @@ +# MTools BLE Introduction +MTools BLE supports managing the ChamleonUltra, ChameleonLite and DevKits via BLE connections. +## Downlaod Link +- [MTools BLE on iOS](https://apps.apple.com/app/mtools-ble-rfid-reader/id1531345398) +- [MTools BLE on Google Play](https://play.google.com/store/apps/details?id=com.mtoolstec.mtoolsLite) + +## How to connect with Bluetooth in MTools BLE +1. Click **A** or **B** button to power on. +2. Click **Bluetooth List** icon in App to search devices. +3. Click **Connect** button on the right to connect. + +#### Notice for Bluetooth Connection +1. Grant the Bluetooth permission of App on iOS. +2. Allow Location permission to scan Bluetooth devices on Android. + +## Features for ChameleonUltra +### Slot Manager +1. Fetch all slot status. +2. Enable or disable Slots. +3. Change LF and HF Slot name. +4. Set LF and HF Tag Type. +5. Delete and reset all slots. + +### Reader +1. Fast read LF and HF Tag. +2. Simulate Mifare Classic Tag with UID, SAK, ATQA and empty dump. +3. Simulate Mifare Ultralight Tag with UID, SAK, ATQA and empty dump. +4. Simulate EM410X LF tag or manually set the ID then simulate. + +### Mifare Classic Dump +1. eRead full dump from current active slot to App. +2. Upload full dump to current active slot and simulate. +3. Read Mifare Mini, 1K, 2K, 4K dump from tag with known keys. +4. Write Gen1A, Gen2, Gen3, Gen4 dump to tag with known keys. +5. Format common and magic Mifare Classic tags. +6. Modify block data and save to new dump file. + +### Mifare Ultralight Dump +1. eRead full dump from current active slot to App. +2. Upload full dump to current active slot and simulate. +3. Read Mifare Ultralight dump from tag. +4. Write Mifare Ultralight dump to tag. + +### Settings +1. Set the Animation of LEDs. +2. Set press and long press button of A and B. +3. Set the **Mifare Classic Emulation** of current slot. +4. Set the **Mifare Ultralight Emulation** of current slot. +5. DFU Tool for updating firmware. +6. Reset Chameleon Device. \ No newline at end of file diff --git a/docs/mtoolslite.md b/docs/mtoolslite.md deleted file mode 100644 index 813069c..0000000 --- a/docs/mtoolslite.md +++ /dev/null @@ -1,42 +0,0 @@ -# MTools Lite Introduction -MTools Lite supports managing the ChamleonUltra, ChameleonLite and DevKits via BLE connections. -## Downlaod Link -- [MTools Lite on iOS](https://apps.apple.com/app/mtools-ble-rfid-reader/id1531345398) -- [MTools Lite on Google Play](https://play.google.com/store/apps/details?id=com.mtoolstec.mtoolsLite) - -## How to connect with Bluetooth in MTools Lite -1. Click **A** or **B** button to power on. -2. Click **Bluetooth List** icon in App to search devices. -3. Click **Connect** button on the right to connect. - -#### Notice for Bluetooth Connection -1. Grant the Bluetooth permission of App on iOS. -2. Allow Location permission to scan Bluetooth devices on Android. - -## Functions for ChameleonUltra in MTools Lite -### Slot Manager -1. Fetch all slot status. -2. Enable or disable Slots. -3. Change LF and HF Slot name. -4. Set LF and HF Tag Type. -5. Delete and reset all slots. - -### Reader -1. Fast read LF and HF Tag. -2. Simulate Mifare Classic Tag with UID, SAK, ATQA and empty dump. -3. Simulate EM410X LF tag or manually set the ID then simulate. - -### Dumps -1. Mifare Keys Manage. -2. Get dump of Mifare Classic Mini, 1K, 2K and 4K with known keys. -3. Modify block data and save to new dump file. -4. Do quick simulation to current active slot. -5. Upload full dump to current active slot. -6. Eread full dump from current active slot to App. - -### Settings -1. Set the Animation of LEDs. -2. Set press and long press button of A and B. -3. Set the **Mifare Classic Emulation** of current slot. -4. Enter DFU Mode. -5. Reset Chameleon Device. \ No newline at end of file diff --git a/docs/quickstart.md b/docs/quickstart.md index cd82e9e..6e93a38 100644 --- a/docs/quickstart.md +++ b/docs/quickstart.md @@ -9,8 +9,8 @@ Quickly get up and running with your Chameleon and no technical skill - [ChameleonUltraGUI on Windows](https://nightly.link/GameTec-live/ChameleonUltraGUI/workflows/build-app/main/windows-installer.zip) ([or without installer](https://nightly.link/GameTec-live/ChameleonUltraGUI/workflows/build-app/main/windows.zip)) - [ChameleonUltraGUI on Linux](https://nightly.link/GameTec-live/ChameleonUltraGUI/workflows/build-app/main/linux.zip) - [ChameleonUltraGUI on macOS](https://apps.apple.com/app/chameleon-ultra-gui/id6462919364) - - [MTools Lite on iOS](https://apps.apple.com/app/mtools-ble-rfid-reader/id1531345398) - - [MTools Lite on Google Play](https://play.google.com/store/apps/details?id=com.mtoolstec.mtoolsLite) + - [MTools BLE on App Store](https://apps.apple.com/app/mtools-ble-rfid-reader/id1531345398) + - [MTools BLE on Google Play](https://play.google.com/store/apps/details?id=com.mtoolstec.mtoolsLite) 2. Connect your Chameleon via USB or BLE From 8a797b8a1681dbb8f2b000b105f18e49363afaf2 Mon Sep 17 00:00:00 2001 From: Sibachir Ahmed-Yanis Date: Tue, 27 Aug 2024 21:37:49 -0400 Subject: [PATCH 4/5] Adding Authorized Distributors TechSecurityTools (#207) * Adding Authorized Distributors TechSecurityTools - Merged By DXL - The authenticity of the authorization has been confirmed with RRG. --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 5e2232f..a2023e3 100644 --- a/README.md +++ b/README.md @@ -10,7 +10,7 @@ United States: [Hackerwarehouse](https://hackerwarehouse.com/) MTools Tec: [MTools Tec](https://shop.mtoolstec.com/) -Anywhere else: [Sneaktechnology](https://sneaktechnology.com) / [Aliexpress by RRG](https://proxgrind.aliexpress.com/store/1101312023) +Anywhere else: [Sneaktechnology](https://sneaktechnology.com) / [Aliexpress by RRG](https://proxgrind.aliexpress.com/store/1101312023) / [TechSecurityTools](https://techsecuritytools.com/product/chameleon-ultra/) # What is it and how to use ? From c7d6224b781beae08fc71904ac9aa166592fae4a Mon Sep 17 00:00:00 2001 From: Dmytro Klishchevskyi Date: Tue, 14 Jan 2025 19:39:21 +0100 Subject: [PATCH 5/5] cleanup --- firmware/application/src/rfid/nfctag/lf/lf_tag_em.c | 7 +------ firmware/application/src/rfid/nfctag/lf/lf_tag_em.h | 1 - 2 files changed, 1 insertion(+), 7 deletions(-) diff --git a/firmware/application/src/rfid/nfctag/lf/lf_tag_em.c b/firmware/application/src/rfid/nfctag/lf/lf_tag_em.c index 71e8798..9a4b183 100644 --- a/firmware/application/src/rfid/nfctag/lf/lf_tag_em.c +++ b/firmware/application/src/rfid/nfctag/lf/lf_tag_em.c @@ -201,7 +201,6 @@ uint64_t em410x_id_to_memory64(uint8_t id[5]) { */ bool lf_is_field_exists(void) { nrf_drv_lpcomp_enable(); - // With 20ms of delay CU was not able to detect the field of my reader after waking up. bsp_delay_us(30); // Display for a period of time and sampling to avoid misjudgment nrf_lpcomp_task_trigger(NRF_LPCOMP_TASK_SAMPLE); //Trigger a sampling return nrf_lpcomp_result_get() == 1; //Determine the sampling results of the LF field status @@ -262,11 +261,7 @@ void timer_ce_handler(nrf_timer_event_t event_type, void *p_context) { if (m_is_send_first_edge == true) { // The first edge of the next sends next time if (++m_bit_send_position >= LF_125KHZ_EM410X_BIT_SIZE) { m_bit_send_position = 0; // The broadcast is successful once, and the BIT position is zero -/* The main part of the idea. The original EM4100 tag continuously sends its ID. -* The root problem, in my point of view, was that CU started to "feel" the field too far to be able to modulate it deep enough, -* and 3 times (LF_125KHZ_BROADCAST_MAX) of repeating takes only about 100ms, CU is still not close enough to the reader. -* That is why the emulation worked only if the CU moved past the reader quickly (fly by).*/ - if(!lf_is_field_exists()){ + if(!lf_is_field_exists()){ // To avoid stopping sending when the reader field is present m_send_id_count++; } if (m_send_id_count >= LF_125KHZ_BROADCAST_MAX) { diff --git a/firmware/application/src/rfid/nfctag/lf/lf_tag_em.h b/firmware/application/src/rfid/nfctag/lf/lf_tag_em.h index 72acf73..62abe86 100644 --- a/firmware/application/src/rfid/nfctag/lf/lf_tag_em.h +++ b/firmware/application/src/rfid/nfctag/lf/lf_tag_em.h @@ -11,7 +11,6 @@ * The definition of the packaging tool macro only needs to be modulated 0 and 1 */ #define LF_125KHZ_EM410X_BIT_SIZE 64 -// Have decided to increase the period of field sensing in this way #define LF_125KHZ_BROADCAST_MAX 10 // 32.768ms once, about 31 times in one second #define LF_125KHZ_EM410X_BIT_CLOCK 256 #define LF_EM410X_TAG_ID_SIZE 5