← RFID test tools

Chameleon Ultra card search (experimental)

Check what type of card / fob you have. The page tries every card type the CU can read, including the Indala and Paradox reads from PR 509 and PR 489, records the raw LF signal, determines the modulation type (how the card talks), and checks for an ISO 14443-A card on HF.

Everything happens in this browser. The page talks to the CU over USB. Nothing is sent to any server, and it doesn't save anything unless you press Copy or Download.

The private details output can contain your card's credential. The report is split in two, showing what's safe to post publicly, and what might contain sensitive info.

  1. 1Connect
  2. 2Search

Connect the Chameleon Ultra

This page requires Chrome or Edge on a computer. Use USB, not Bluetooth, and close anything else using the CU, such as the CU app or the Python CLI.

Checking the firmware…
1. Measure the empty field (optional)

Take every card away from the CU, then measure. The page compares this reading with the field when the card is present. That shows whether the card is LF even if it doesn't answer. Some cards only respond after a special command, and this gives a clue that your card works that way.

2. Identify the card

Lay the card flat on the CU's button side (the antenna is on that side, not the LED side), and leave it there until the page finishes, about 15 seconds. With the experimental firmware this also checks whether the card is a T55xx (and reads its configuration) or an EM4x05.

Firmware

The LF analysis, the chip check and the Paradox and Indala reads need the experimental firmware. It's stock firmware from main with long raw captures, the chip check, PR 489's Paradox read and PR 509's Indala read added (source). Flashing replaces the CU's firmware and keeps the current slots.

What the page does
  1. Connect checks the CU's firmware version, and whether it has the chip check code. The CU's field stays off.
  2. Measure the empty field switches the CU to reader mode, turns its LF field on for about 0.1 s and records the raw signal.
  3. Search switches the CU to reader mode and runs each LF read the firmware has: EM410x, HID Prox, ioProx, Viking, PAC/Stanley, Jablotron, Farpointe/Pyramid and, on the experimental firmware, Paradox and Indala. Those all run twice if nothing is found. Each one turns the field on and listens. It then records the raw LF signal (115 ms, again if no frame repeats) and works out its modulation, bit rate and frame length in the browser. It checks the frame against each protocol the CU reads, the same way as the CU's own built-in decoders do. It also reports a frame that has the right shape but fails a check the CU's read needs, such as a checksum. The CU's read ignores those frames.
  4. With the experimental firmware, Search sends the commands Proxmark's lf search uses to try to work out the chip type. No password or login is attempted. First it tries to read the T55xx chip's page 1 block 1 (the trace block). A T55xx answers it by repeating that block, and then the page also reads page 0 block 0, the T5577's configuration block. If no T55xx answers, it attempts to read the EM4x05 chip's word 0. An EM4x05 answers with word 0. None of these can change the card.
  5. On HF it runs an ISO 14443-A scan, and for a MIFARE Classic it asks for an authentication nonce to judge its random number generator. That stops before any key is used.
  6. When it finishes, the page puts the CU back in the mode it found it in. Nothing writes to the card, and nothing changes the CU's slots.

The CU's HF reader only covers ISO 14443-A (MIFARE, NTAG, DESFire, most bank cards). An HF card of another kind, such as iCLASS, ISO 15693 or FeliCa, doesn't show up. On LF, a card that only answers commands (Hitag, EM4x50 and some others) shows as a change in the field with no signal.

Log