Proxgrind Chameleon Ultra
INTRODUCTION
After some serious consideration do I need a chameleon ultra, I’ve decided to purchase one.
Ordered it last week, and after some drama with customs, as usual, it arrived at my door today.
What the Chameleon ultra is ? LF/HF emulator, in a tiny form factor.
The product comes in a small black box. Inside you will find the device itself, a silicon case(which is great and prevent the clear coating from scratching, usb-a to usb-c cable, a small screw driver with two spare screws in case you need to take the thing apart.
First impressions - it’s small and it looks beautiful.
Device has 8 slots which can be configured to run lf, hf or both per slot. On paper battery should give you 6 months of juice.
TESTING INCLIDING READ RANGES
Initial testing of reading range with KBR1 ~ 4-5 cm on the HF
Testing agains flipper zero - hf 3-4 cm, lf ~2cm
First thing I did after taking the chameleon out of the bag it comes in was to put it in the silicon case so it does not get scratched. Second was to start playing with the python client. In the github repo you can find everything you would need(really). Under software scripts there is a requirements txt which you need to feed into pip, and then just run chameleon_cli_main.py with device connected. People who like cli will find this client pretty useful, otherwise there is a gui which can be found under the app stores of apple and google. Gui client has the option of flashing the firmware of the device from the latest master. Tried this from both my android phone and my mac, both successfully executed.
After the firmware was updated to latest I’ve decided to test how the thing is dealing with reading cards and implants. I was using both t5577 and Mifare gen1a s50 proxgrind cards I got with the pm3rdv4.
First I’ve tried reading em4100 emulated with flipper with id ffffffffff That went fine. Next I tried to write it to the t5577 test card, this went fine as well. Bare in mind that writing for now works only via the python cli client. Next I’ve tried to read my both implants(which are again t5577, operating as em4100) and both reads were successful. Following this I tried the same with mifare classic card. Reding it just fine. Bruteforcing the keys also worked and I was able to dump the content. Unfortunately the Chameleon had no success reading my xMagic hf side(which has the same chip as the test card) nor my NeXT which is with ntag216. I have no idea what is going on, maybe tomorrow I will try better coupling angle.
After playing a lil bit more with the cli, I’ve reset all the slots, then started populating them with dumps. Again this worked pretty well.
Something I really need to mention here - the project is under heavy development and some features are missing or not coded yet. For example long pressing buttons doesn’t clone the tag id to the slot(and it sucks for fast and dirty)
Few more things on the usability side of things. The Chameleon goes into sleep around 5 seconds after a button is pressed. It goes out of sleep when detect a field of a reader, which is really neat. If you like blink and rgb shit( there are some animations on the device behaviour on unlock when brought out of sleep, but for me this just put more cycles on the leds).
TEARDOWN
I did not took it apart because I think if I try to take it out of the silicone case it may damage the case.
PROs
• Very fast and responsive emulator with ability to exec attacks against mifare classic
• Small form factor (can be carried on a keychain or in a pocket easily)
• Beautiful design
• Long lasting battery life
CONs
-
Not all functionalities are yet present ( heavy development ongoing )
-
Form factor - it can be easily lost
PRICE
USD$ - no idea
BGP 109 from KSEC
EUR 155 from lab401
SUMMARY:
Chameleon Ultra does what it’s supposed to partially right now, but it’s pretty functional and fun toy.
Does it replace stuff like flipper zero or even a proxmark - hell no, but it gives you agility, where form factor is crucial.
LINKS AND RESOURCES
POLL
Rating by the community 
PLEASE ONLY VOTE IF YOU HAVE ONE OR HAVE USED ONE
= 
= 
= 
= 
= 
- 1
- 2
- 3
- 4
- 5
