mirror of
https://github.com/RfidResearchGroup/ChameleonUltra.git
synced 2026-09-11 18:30:14 -07:00
matteoscrugli
b8f070851c
Adds IDTECK as a new LF protocol for tag emulation. IDTECK is a PSK1
encoding at RF/32 with a 64-bit frame: a 32-bit fixed preamble
0x4944544B ("IDTK") followed by a 32-bit card payload (one-byte
checksum + 24-bit card number in byte-reversed layout, matching the
format used by the Proxmark3 client).
The modulator drives LF_MOD (load-modulation, same hardware path used
for FSK protocols like HID Prox) via the shared utils/psk1 helper,
producing a 62.5kHz subcarrier with a 180-degree phase flip at every
differential bit transition. Because PSK1 is differential the reader
decodes phase transitions between consecutive bits rather than
absolute phase, so carrier phase-lock is not required — a free-running
subcarrier from HFXO (±40ppm) stays within the tolerance of consumer
readers.
The 16us subcarrier period is below the counter_top minimum of 3 at
the legacy 125kHz PWM base clock used for ASK/FSK protocols. To avoid
rescaling every existing protocol, pwm_init now selects the base
clock based on the active tag type (predicate IS_PSK1_TYPE): 1MHz for
PSK1, 125kHz otherwise. Legacy protocols are untouched.
The comment in lf_sense_enable is updated to reflect that the absence
of carrier phase-lock (envelope-only tag-mode antenna taps) rules out
coherent demod but does not preclude differential-phase encodings
like the one introduced here.
T5577 cloning configuration uses the existing T5577_MODULATION_PSK1
symbol combined with RF/32 bitrate and 2 data blocks. Emulation read
is not added: the tag-emulation ADC path is 125kHz envelope-filtered,
so PSK demod would need a dedicated edge-timing decoder (left as a
follow-up).
ChameleonUltra Authorized Distributors
Lyon, France: Lab401
Santa Ana, United States: Hackerwarehouse
Hastings, UK: KSEC
Montreal, Canada: TechSecurityTools
Shenzhen, China: Sneaktechnology
Guangdong, China: MTools Tec
Lazada One, Singapore: Aliexpress by RRG
What is it and how to use ?
Read the available documentation.
Compatible applications
- ChameleonUltraGUI
- MTools BLE
- Mifare Chameleon Tool (iOS only, Beta)
- Chameleon Ultra (Sailfish OS only)
Videos
Beware some of the instructions might have changed since recording, check the current documentation when in doubt!
- Downloading and compiling the official CLI
- Downloading ChameleonUltraGUI
- ChameleonUltraGUI features overview
- Using ChameleonUltraGUI and the Chameleon Ultra
- MTools BLE - How to clone a card with ChameleonUltra
Official channels
Where do you find the community?
- RFID Hacking community discord server
- Software/chameleon-dev for firmware and clients development discussions
- Devices/chameleon-ultra for usage discussions
- GameTec_live discord server