Hey, this is Dutch here at Dutch Cyberworks. I’m doing a Field Notes on the Chameleon Ultra RFID emulator. A lot of you have seen this around. I just wanted to do a Field Notes on it as it’s gaining in popularity and compatibility across platforms.

I really haven’t messed too much in the field with RFID, but I’ve had some of my friends who use it come by and show me some stuff with the Chameleon. So, I like its compatibility. You can use it on your phone, on the Windows app. Also, it’s compatible with HailHound on the 3.5. Also, it’s compatible with the Monster on the CYD C5 on the NerdMiner hat.

So when the kits come from China, they come with a bunch of stuff, but really, it’s just in a bag. You get two adapters for adapting to a phone, which I found useful, a small USB cord, the device itself, and two high-frequency tags. But you don’t get any low-frequency tags, and you don’t get a case to keep it all in where you can just pop it in your bag.

So I tried to fix that by adding two low-frequency tags and made sure they work. I tried to get my stuff in multiple colors so that all the tags will be different colors, just to try to advance on what you get with the original kit. Plus, I have a quick-start guide, because I’m trying to fix what I didn’t like when I first got it.

You can also get dual-frequency tags, but I couldn’t find any that were reliable enough yet. You can also get high-frequency stickers and use those, and you can get blank tags in a credit-card form factor.

So, in these next sections, we’ll first just give the straight specifics, and then I’ll go into some of the areas that I’ve covered here in more detail, such as setup and firmware, platforms, and so on.

Chameleon Ultra V3.0 — Specifications

The Chameleon Ultra V3.0 is a compact RFID/NFC research, testing, and emulation platform supporting both low-frequency and high-frequency RFID systems.

Core Specifications

• LF RFID: 125 kHz
• HF RFID/NFC: 13.56 MHz
• Storage: 8 selectable card slots
• Profiles per slot: 1 HF + 1 LF
• Total profiles: Up to 8 HF + 8 LF, for 16 stored profiles total
• Functions: Reading, writing, storing, and emulating supported RFID tags and cards
• Wireless connectivity: Bluetooth
• Wired connectivity: USB Type-C
• Power: Rechargeable internal lithium battery
• Battery management: Intelligent charge/discharge management with lithium-battery protection
• RF design: Tuned antenna/resonance system for improved card-reading performance

Controls & Recovery

• A + B reset: Pressing both buttons provides a quick reset/restart function
• Bluetooth: Supports quick disconnection
• USB: Supports DFU/recovery functionality when connected through USB Type-C
• Firmware: Upgradeable through supported Chameleon software

Expanded Platform Compatibility

In addition to the standard Chameleon software environment, the Chameleon Ultra can be used with supported third-party hardware and firmware platforms, including:

• CYD Monster on the NerdMiner RF Hat
• HailHound 3.5 by Jesse Hale

I’ll cover the software, firmware setup, platform compatibility, tag testing, and my experience with the device in more detail in the sections below.

Firmware & Setup

When you get the Chameleon Ultra, it comes with firmware already installed, but you’ll probably want to update it to the latest version.

In most cases, you should be able to update the firmware using the Chameleon app on your phone. In my case, the update failed twice and the Chameleon went into DFU mode, which I translated into “Dumb Effing Unit,” but it’s actually the firmware update/recovery state. It basically acts like a safety mode that keeps the device ready to accept firmware if an update fails.

After the second failed attempt, I moved over to the Chameleon Ultra Windows app. I connected the Chameleon through USB, ran the firmware update from there, and it updated without any problems.

So I’d try the phone app first since it’s convenient. If the update fails or the device ends up in DFU mode, don’t panic. Connect it to a Windows PC with USB and use the desktop Chameleon app to update or recover the firmware.

Once the firmware update finishes and the device reconnects normally, you’re ready to start working with it.

Features

The Chameleon Ultra has a pretty wide range of features, from basic RFID reading and emulation to some more advanced MIFARE Classic work.

• Read and identify supported LF and HF tags
• Write to supported rewritable tags
• Emulate stored tag profiles
• Store up to 8 HF and 8 LF profiles, for 16 profiles total
• Copy supported tag UIDs
• Use configurable buttons and slots
• Connect over Bluetooth or USB
• Recover or update firmware through DFU mode

There are also a couple of more advanced features that are important if you’re using the Chameleon for some of the things a lot of people buy these devices for:

• Multiple write behaviors, including Normal, Denied, Deceive, and Shadow modes
• Advanced MIFARE Classic analysis and key-recovery workflows with supported tools and firmware

As far as platforms go, I’ve used the Chameleon with the Windows application and with a phone. It also has support through HailHound 3.5 and Monster on the CYD C5/NerdMiner RF Hat, which I’ll get into more below.

I haven’t personally tested it under Linux yet, so I’m not going to claim Linux compatibility here until I’ve verified it.

Platform Compatibility

I actually bought the HailHound 3.5 for myself because I really like the HailHound firmware, and I didn’t even realize at first that it had Chameleon compatibility built into it. I thought it was still relying on the older RFID hardware you see on things like the NerdMiner RF Hat.

But the Chameleon support is right there in the firmware, so you can use the Chameleon Ultra directly with the HailHound 3.5, which is a pretty badass device on its own.

I also noticed that the Chameleon Ultra is supported on Monster running on the CYD C5/NerdMiner RF Hat. That’s useful because a lot of these portable builds have traditionally depended on separate RFID boards, and those seem to be getting less attention now.

From what I’m seeing, the Chameleon Ultra is becoming the more common path because it gives you a dedicated RFID/NFC device that can then plug into or work alongside multiple platforms instead of being tied to one specific board.

I’m still going to keep the exact RFID-board details for the NerdMiner Hat separate until I verify the chip model, but as far as actual use goes, Chameleon support on both HailHound 3.5 and Monster is confirmed in the firmware.

What’s Included in the Dutch CyberWorks Edition

With the Dutch CyberWorks Edition, you get two additional LF tags, a quick-start guide, and your choice of either a Field Box or Lab Box.

Both are custom sliding-lid cases with a Chameleon design on the lid. The idea was to give you something you can either throw in your bag and take with you or keep organized on the shelf, depending on how you plan to use it.

The Field Box is the smaller of the two. It’s just big enough to hold the Chameleon and the equipment you need to take with you in the field. I also made it credit-card size so that if you use RFID tags in the credit-card form factor, those will fit inside as well.

The Lab Box is a little larger and gives you some extra room for additional tags, adapters, cables, or whatever else you want to keep with the Chameleon.

So the Field Box is really about keeping the kit as compact as possible, while the Lab Box gives you some extra space if it’s mostly going to live on your bench or shelf.

Links You’ll Find Useful

I’m going to include a few links here that should be useful if you want to go further with the Chameleon Ultra.

First, I’ll have a link to the official Chameleon Ultra site, along with the GitHub repository. And if you don’t know what GitHub is yet—oh my gosh, you will learn.

I’ll also include some YouTube videos from creators I know do good videos on this kind of stuff. Most of these will probably be videos I’ve watched myself and were part of the reason I originally became interested in the Chameleon Ultra.

I haven’t personally used the Chameleon extensively in the field yet. A lot of my exposure has come from friends who use RFID equipment coming over, showing me what they’re doing, and talking about the Chameleon and what they use it for.

From what I’ve seen so far, though, the Chameleon Ultra seems to be becoming one of the go-to options for this kind of work. I’ve also been selling them pretty well locally, so there definitely seems to be growing interest in the platform.

Useful Links