Skip to content

Releases: RfidResearchGroup/ChameleonUltra

Development release

Development release Pre-release
Pre-release

Choose a tag to compare

@github-actions github-actions released this 19 Aug 00:14

Auto-Generated DFU packages from latest main commit.
For development purposes only.
These are not tested, here be dragons.
Built from commit 0c1d579

What's Changed

New Contributors

Full Changelog: v2.2.0...dev

Release v2.2.0

Choose a tag to compare

@github-actions github-actions released this 04 Jul 11:28

Auto-Generated DFU packages for Release v2.2.0
Built from commit f349dbe

What's Changed

  • Fix for mf static nested key recovery by @jekkos in #285
  • Add option for NFC Field Generator by @RocketGod-git in #294
  • Use a function for colored strings by @mischif in #295
  • Fix error in lf em 410x read from color_string() by @brewt in #315
  • Fix LEDs being stuck on after battery check by @suut in #331
  • Fix some bugs & Performance improvement by @xianglin1998 in #299
  • TCP transport in the CLI to support Android (Termux) by @suut in #337
  • Fix typo in hid prox econfig and add ACTProx HID card type by @MusicLeecher in #341
  • Fix HIDProx formatting with hw slot list by @brewt in #316
  • Fixed FAST_READ command and handling of dynamic and static locks for … by @dogty in #314
  • Added FIELD_OFF_DO_RESET support to cli hf mf econfig by @tommiv in #342
  • Fix Windows build by @suut in #345
  • fix cli arg parser for FIELD_OFF_DO_RESET by @YuyangisCoding in #346
  • Add Electra intercom tag support with slot auto switch by @naaraxi in #338
  • Add hf 14a config to deal with badly configured cards by @azuwis in #307
  • fix hidprox UnboundLocalError cli arg error + hidprox slot set warning by @RickConsole in #332
  • Fix bad missing tools warning by @suut in #352
  • Adds generic ADC read functionality by @merlokk in #306
  • Fix compiler error `a label can only be part of a statement and a de… by @LupusE in #343
  • Add CLI commands to dump and clone tag by @rickNmorty2 in #201
  • Fix broken CLI after multiple merges by @LupusE in #355
  • New Symmetrical LED Animation Mode and Improved Minimal Mode by @WillyJL in #363
  • Add hf mf autopwn command with key saving and card dump by @luu176 in #364
  • feat(lf): add ioProx support (read, emulate, clone) by @bernadic in #367
  • feat(lf): add EM4x05/EM4x69 reader (RTF gap protocol) by @nieldk in #394
  • feat(lf): add raw LF field ADC capture (lf sniff) by @nieldk in #395
  • Revert "feat(lf): add raw LF field ADC capture (lf sniff)" by @GameTec-live in #398
  • feat(lf): add raw LF field ADC capture (lf sniff) by @nieldk in #399
  • feat(hf): add ISO14443A reader frame capture (hf 14a sniff) by @nieldk in #396
  • feat(data): add LF capture analysis commands by @nieldk in #397
  • Fix firmware application USB serial number by @taichunmin in #388
  • feat(cli): integrate HardNested attack into autopwn by @Crazycurly in #389
  • Add LF PAC/Stanley (125kHz) Support by @kevihiiin in #362
  • Fix param error of hf mf esave by @azuwis in #361
  • feat: add Flipper Zero .nfc file importer for MFU/NTAG slots by @fmuk in #357
  • T55xx clone by @nieldk in #401
  • fix: use native winpthreads for MinGW/MSYS2 Windows builds by @andrassmuk in #379
  • Add iOS client "MCT Mifare Chameleon Tool" to compatible applications by @DGinefra in #403
  • hf 14a sniff improvements for nonce collection and crack, fence to catch missing or blocked mfkey binaries by @nieldk in #406
  • Support for changing the wake time in the client by @naaraxi in #387
  • fix: hf14a_raw should return data bytes, not Response object by @azuwis in #419
  • fix: hf mf eview param error due to chunk exceeding 32-block limit by @azuwis in #417
  • T55write by @nieldk in #413
  • feat(firmware): Add configurable PRNG type for MF1 emulator by @nieldk in #420
  • Feature/lf: add IDTECK PSK1 tag emulation and T55xx clone by @matteoscrugli in #407
  • Add Jablotron LF tag support (read, emulate, write to T55xx) by @midlan in #404
  • Fix state machine behavior and access bits verification in MF1 emulation by @unkernet in #274
  • fix: resolve binary tools detection after PyInstaller packaging by @bob-zebedy in #317

New Contributors

Full Changelog: v2.1.0...v2.2.0

Release v2.1.0

Choose a tag to compare

@github-actions github-actions released this 02 Sep 14:32

Auto-Generated DFU packages for Release v2.1.0
Built from commit 212a9ce

What's Changed

New Contributors

Full Changelog: v2.0.0...v2.1.0

Release v2.0.0

Choose a tag to compare

@github-actions github-actions released this 26 Sep 15:59

Auto-Generated DFU packages for Release v2.0.0
Built from commit 4747d38

What's Changed

  • Changed APP_FW_VER now deduced from git tag vx.y.z (@doegox)
  • Changed initial button wakeup from 4 to 8 seconds (@aramova)
  • Added MIFARE Ultralight reading features (@FlUxIuS & @doegox)
  • Fixed MF1 write mode SHADOW was not preserved properly (@doegox)
  • Changed field LED now active also in reader mode to indicate that reader is powering the field (@doegox)
  • Changed slot enabled logic: now we have separate enabled_hf and enabled_lf, changed GET_ENABLED_SLOTS and SET_SLOT_ENABLE (@doegox)
  • Changed tag type enum to be ready for new types, changed stored slotConfig and GET_SLOT_INFO (@doegox)
  • Added HF14A_RAW and its support in hf 14a raw (@xianglin1998)
  • Removed MF1_DETECT_DARKSIDE (@doegox)
  • Added MF1_STATIC_NESTED_ACQUIRE and its support in hf mf nested (@xianglin1998)
  • Changed hf 14a scan: Automatically send RATS to 14443-4a tags (@augustozanellato)
  • Changed Darkside: use LEDs for visual feedback of attack progression (@doegox)
  • Changed Darkside: longer RF field off for reset and longer CLI timeout (@doegox)
  • Fixed Darkside: parity byte-to-array bug made it low probability to succeed (@doegox)
  • Changed hw detection decrypt show progression and remove duplicate keys (@doegox)
  • Changed dynamic cmd_map_init() by static cmd_map initialization (@doegox)
  • Changed hf slot list to add clarity and colors (@doegox)
  • Changed hf mf sim and hf mf info to support ATS (still to be used in actual emulation) (@doegox)
  • Changed hf mf eload and hf mf eread: uploads/downloads are now 30x faster (@doegox)
  • Changed CLI HF14AInfo logic merged inside HF14AScan for more consistent display of the results (@doegox)
  • Added guessed type information for NXP tags, and reorganization of HF information part. (@FlUxIuS)
  • Changed hw raw to detail status message (@doegox)
  • Changed CLI to query capabilities on connect, not on every single command if device does not support get_device_capabilities (@doegox)
  • Changed CLI to not instanciate ChameleonCMD on every single command (@doegox)
  • Changed massively the protocol and its handlers for more consistency and easier maintenance and future dev (@doegox)
  • Added hf settings blepair command to get and set ble pairing enable state, and default disable ble pair (@xianglin1998)
  • Added hf mf info command to get UID/SAK/ATQA from slot (@Foxushka)
  • Added hw raw to send raw command to Chameleon (@Foxushka)
  • Added command to fetch all available commands from Chameleon and test if Chameleon supports it (@Foxushka)
  • Fixed ChameleonLite emulation bug (@spp2000)
  • Fixed MFC emulation issues with OEM readers, also temporarily disabling NFC_MF1_FAST_SIM (@xianglin1998)
  • Fixed Chameleon crash during BLE pairing (@Foxushka)
  • Fixed CLI takes into account Lite refusing to enter Reader mode (@doegox)
  • Added BLE Security support (@xianglin1998)
  • Added hw settings blekey to get and set ble connect key (@xianglin1998)
  • Added hw ble bonds clear to delete all ble bonds (@xianglin1998)
  • Fixed argument completion bug inserting additional hyphens (@szymex73)
  • Fixed device address not the same within app (@taichunmin)
  • Added initial version of the user guides (@GameTec-live)
  • Added support for pasting several command lines at once with prompt_toolkit (@doegox)
  • Added support for interrupting sleep sequence with a button press during animation (@doegox)
  • Fixed logs corruption and app reset on FDS write, added logs flush on sleep (@doegox)
  • Added support for long-press of buttons (@nemanjan00)
  • Changed hw slot delete, now it can always delete from slot (@augustozanellato)
  • Changed CI pipeline (@augustozanellato)
  • Added offline copy EM card uid for btnpress (@nemanjan00)
  • Added offline copy ic card uid for btnpress (@xianglin1998)
  • Added hw settings btnpress to get and set button press function (@xianglin1998)
  • Added hw battery to get battery information (@xianglin1998)
  • Added hw slot delete to delete HF or LF out of a HF+LF slot (@augustozanellato)
  • Changed CLI prompt autocompletion, saved history and internal cmd registration (@szymex73)
  • Fixed SDK NFC IRQ handler busy loop (@doegox)
  • Added hf mf eread to download slot dump to file (@domints)
  • Added lf em sim get and old lf em sim is now lf em sim set (@domints)
  • Changed MF1 command ids (@domints)
  • Changed nonce randomness on nested auth for hardnested attack (@Foxushka)
  • Added commands to configure MF1 emulation magic modes and more (@Foxushka)
  • Added hw factory_reset to wipe user data (@augustozanellato)
  • Changed slot nickname encoding gbk -> utf8 (@doegox)
  • Added 5-second watchdog (@doegox)
  • Added option to enable NRF_LOG UART on SWO pin (@doegox)
  • Added hw slot list (@Foxushka)
  • Added hw version (@nemanjan00 and @augustozanellato)
  • Fixed data sanity check in MF1 emulation (@sgnusov)
  • Fixed settings/dumps/nicks data corruption in flash (@doegox)
  • Fixed slot LED on button wake-up (@doegox)
  • Added support for init, reset and migrate settings (@augustozanellato)
  • Added support to save settings in flash (@domints)
  • Added hw settings animation to configure startup animation (@domints)
  • Fixed compilation warnings from SDK (@doegox)
  • Changed TagSenseType, TagSpecificType and SlotNumber enums (@F9Alejandro and @doegox)
  • Added support for 7-byte UID MF1 emulation (@xianglin1998)
  • Added high perf MF1 emulation (@xianglin1998)
  • Added udev rules file (@iceman1001)
  • Added documentation to use BlackMagicProbe out of ST-Link and show RTT NRF_LOG (@doegox)
  • Added hw chipid and hw address (@gentilkiwi)
  • Added helper scripts to enter DFU from USB or BLE and flash over DFU (@doegox)
  • Fixed recv thread exception after hw dfu (@doegox)
  • Fixed entering sleep after BLE disconnection (@doegox)
  • Added ChameleonLite and ChameleonUltra hardware resources (@xianglin1998)
  • Added NTAG21x emulation support (@ca1e)
  • Fixed LF EM410x emulation (@doegox)
  • Added automatic file format detection in hf mf eload (@GameTec-live)
  • Fixed CLI exit exception (@doegox)
  • Added CI pipeline, producing DFU packages (@augustozanellato)
  • Added docker toolchain (@augustozanellato)
  • Added automatic port detection (@GameTec-live)
  • Added GET_MF1_DETECTION_STATUS (@Foxushka)
  • Fixed compilation errors with GCC 12 (@Foxushka)
  • Added documentation for JLink (@xianglin1998)
  • Added support for ST-Link and debugging documentation (@derGraph)

New Contributors

Full Changelog: v1.0...v2.0.0

Basic Factory Firmware

Choose a tag to compare

@xianglin1998 xianglin1998 released this 21 Jun 11:51

What are the features of this release?

  • Factory production uses this version of firmware
  • Basic simulation card and decryption card functions have been implemented

chameleon_XXX_app_update.zip

This zip file is an APP update package that can be updated through NRFUTIL or NRF DFU APP.

XXX.hex

This hex file is all in one(SD + BOOT + APP) fw file. you can flash using debug probe like JLINK or XXXLink etc.

Source code.XXX

You don't even know what this is? go ask Chatgpt.