Chameleon Ultra
Introduction
Chameleon Ultra is an ultra-compact, open-source RFID development and testing tool. It supports popular LF/HF standards, provides standard tag operations and protocol analysis, and offers Bluetooth app control—all in a key-chain form factor. Born from rigorous engineering, it delivers responsive multi-frequency performance for education, labs, and prototyping in authorized use.
Low & High Frequency Emulation
Frame Delay Time (FDT) is the key metric in RFID emulation: if response timing is too slow or inconsistent, protocol requirements aren’t met, frames can be dropped, and emulation may fail. Chameleon Ultra is engineered for consistently low FDT and stable timing, delivering precise, spec-aligned behavior for authorized development and testing.
Optimised MIFARE Classic® Crackingn
The Chameleon Ultra's powerful chip supports all known MIFARE Classic® cracking algorithms - at speeds faster than the Proxmark!
The device supports all classic and modern attacks, including MFKEY32 v2, Darkside, Nested, StaticNested and Hardnested attacks - for incredibly quick key recovery.
Low & High Frequency Reading / Writing
The Chameleon Ultra hardware supports high and low frequency reading and writing - allowing it to be used as a standalone or connected reader/writer device.
For High Frequency, the device supports ISO14443A chipsets: MIFARE Classic® (1K/2K/4K, 4-byte &, 7-byte UID), NTAG® (210 - 218), Ultralight® (Standard, C, EV1), DESFire® (EV1 & 2) and MIFARE® Plus.
For Low Frequency, the device supports ASK, FSK and PSK modulations - almost 99% of 125KHz chipsets: EM410x, T5577, HID Prox, Indala, FDX-B, Paradox, AWD, PAC/Stanley, etc.
Wireless, UI and CLI Control
The Chameleon Ultra can be controlled and updated in several ways.
Firmware can be flashed via USB-C or Over-the-Air; badge dumps can be uploaded and downloaded via wireless or wired connections.
Likewise, the device can be controlled via GUI Tool, mobile phone, or via CLI - depending on your workflow.
The CLI and UI tools are continuously updated by the community, with new functionality and stability being constantly added.
Incredible hardware
The ChameleonUltra's hardware has been pushed to its limits : despite its size, it boasts better emulation than the Flipper Zero and even Proxmark 3 - and can run for 6 months off a single battery charge!
The device itself is beautiful - a masterpiece of copper, epoxy, fiberglass and stainless steel.
100% Open Source
The Chameleon Ultra is fully open-source : all firmware, hardware, software and resources are available on the Chameleon Ultra Github page.
The frequent contributions from RFID superstars such as iceman and doegox ensure that the Chameleon Ultra is a well-supported, high-performance device.
Understand the ChameleonUltra
Chameleon Ultra is designed primarily for RFID tag simulation in development and test workflows. Instead of carrying multiple cards, you can simulate common LF/HF standards with one pocket-size, open-source device. It also supports protocol analysis, tag reading, and tag writing in authorized environments.
Typical RFID tasks supported
Identification — Detects frequency, modulation, chipset family, and protocol. Most tags are identified automatically; advanced cases may require specialized procedures.
Key handling — Many technologies require valid keys to access data. Use known, authorized keys supplied by the system owner.
Reading — View permitted data for diagnostics, auditing, or migration.
Simulation — Replicate tag behavior digitally for testing and integration; simulated profiles can be configured for lab scenarios.
Writing — Update permitted fields on compatible tags or provision new tags under proper authorization.
ChameleonUltra Product Presentation
ChameleonUltra: How to tutorial
What's included
- 1x ChameleonUltra
- 1x Silicone protective cover
- 1x USB-A - USB-C Cable
- 1x Keychain attachment
Device Specifications
- Processor + Memory:
- NRF52840
- ARM Cortex-M4 32-bit 64 MHz (Application Processor)
- 1MB Flash
- 256KB RAM
- Tactile Controls: 2x Physical Buttons
- Internal Battery: LiPo 90mAh (6 months without charge)
- Connectivity: USB 2.0, Type-C
- Dimensions: 40 x 24 x 8 mm
- Weight: 8g
RFID Specifications
- Reading, Emulation
- High Frequency / 13.56MHz
- ISO-14443A
- Mifare Classic® (1K / 2K / 4K - 4-byte & 7-byte UID)
- Ultralight® (Standard, C & EV1)
- NTAG® (210 - 218)
- Low Frequency / 125KHz
- Modulation: AM / PSK / FSK
- Supported Cards:
- EM4XX / T5577
- HID Prox / Indala / PAC/Stanley
- FDX-B / Paradox / Keri
- etc (full list below)
- Cracking
- MIFARE Classic®
- MFKey32v2 (Key Calculation from sniffed exchanges)
- DarkSide (Key derivation from no known keys)
- Nested (Key derivation from one known key)
- StaticNested (Key derivation from static PRNG)
- HardNested (Key derivation from hardened PRNG)
- Low Frequency / 125KHz
- T5577 Password Bruteforcing
- UID Bruteforcing