Chameleon Ultra FSK self-trim (experimental)
Flash test firmware that lets the CU match its emulated HID Prox, Paradox and ioProx cards to a reader's clock. Put the same card in several slots, with and without self-trim. Then try the slots at a reader and compare them.
- 1Connect
- 2Set up
- 3Test at a reader
- 4Results
Connect your Chameleon Ultra
Plug your CU in to USB, not Bluetooth, and close anything else using it, such as the CU app or the Python CLI. This page needs Chrome or Edge on a computer. It works with the Chameleon Ultra only, not the Lite.
Set up the slots
The page copies one HID Prox, Paradox or ioProx card into four slots: stock, stock + exact bits, self-trim, and self-trim + exact bits. Load the card into any slot first, with your usual app or by reading it here. A backup of every slot downloads before anything changes.
Start testing clears the CU's earlier results and event log. The results then come from the next reader alone. Slots and modes stay as they are.
Test at a reader
- Unplug the CU and take it to the reader. Start on the first test slot.
- Hold the CU to the reader on each slot, several times. The first time on each slot, hold it there for 2 seconds or more. Self-trim measures the reader before it sends the card, which makes its first read on each slot slower.
- Note for each slot whether it read, how quickly, and how close the CU had to be.
- Test one reader at a time. A self-trim slot learns the reader it meets and starts over at a different one.
The CU keeps its results while it sleeps. Back here, connect again and read them.
Results
| Active | Slot | LF card | Mode | Fields seen | Reader vs CU | Measurements |
|---|
⚠ A reader more than 300 ppm from the CU probably isn't crystal controlled. Stock reads such a reader only close in. Self-trim should read it further away.
About these columns
Fields seen: how many times the slot detected a reader's field arriving. A reader that switches its field off and on again quickly can count once, so read it as "the reader was seen". Reader vs CU: the clock difference self-trim measured and corrects for. It stays blank until self-trim learns a reader. Measurements: how many fields the learned value is based on. Changing a slot's mode or the active slot here takes effect at once.
Self-trim event log
Not read yet.
Send the report with your notes on which slots read. It holds no card data.
The test firmware is the Paradox pull request, fixes for answering a reader that wakes the CU, and the self-trim research (source). Flashing keeps your slots and saved cards, and clears what self-trim learned. Stock v2.3.0 has no Paradox support. When you're done, flash stock back, or use "Flash a file" for another application DFU package (a .zip).
What the modes do
- stock: works the same as stock firmware. The CU switches a load across its coil, like a real tag. Load switching can't drift against the reader, but the signal is small.
- self-trim: the CU also drives its coil, for a stronger signal, and matches that drive to the reader's clock. At the start of each field it measures the reader's carrier and trims to it. It finds readers up to about ±3.5 % off, and keeps what it learned per slot through sleep. Each field's first 0.4 s is the measurement and carries no card.
- new drive only: the stronger drive without the matching, for comparison. Its signal drifts in and out of step with the reader's clock.
- + exact bits: stock firmware sends some HID Prox and Paradox bits 4 % short. A Proxmark3 doesn't mind. A stricter reader might. This mode makes every bit the standard length on average.
At one real HID reader whose clock ran 0.42 % slow, stock read only close in and self-trim read at the edge of the field. If self-trim reads worse than stock at your reader, use stock. Send the report anyway, as that result is also useful.
Backup and restore
A backup is a file with every slot's LF side: card type, card data, whether it's enabled, its nickname and its mode. Restore puts every slot's LF side back. HF cards are never changed. The file contains your cards' data. Keep it somewhere private. The file lists card types this firmware can't read (Indala, for example), but the page can't restore those card types.
For developers
-
Command 3120 sets each slot's mode. It also reports the modes, the
fields seen and what self-trim learned.
0xC1clears the results. -
Command 3100 at offset
0xFFFEreads the self-trim event log: the last 32 events, kept while the CU sleeps. Offset0xFFFCclears it. -
The page's parsing is in
selftrim.js. The card data only passes between the CU and the page's memory. The page never shows, logs, stores or sends it, except in a backup file you download.