Introduction

The circuit board design of this product is derived from the open-source project Chameleon Ultra! The integration of card decoding, card writing, and analog card has been precisely tuned to simulate IC/ID card circuit parameters: precision surface mount machine production, high product consistency.

Official CU software function introduction: The decoding device supports computers, Android phones, and Grass Fruit phones without network connection.

Decoding and detection do not require network support. Ordinary semi encrypted cards can be directly decrypted, while fully encrypted cards and vulnerability free cards require on-site card swiping to detect the SAK08 key. The card cracking rate is 100%, and it does not support reading and writing CPU cards and recharge cards. If the data contains rolling codes, do not copy it, otherwise the original card will become invalid. Simulate 8 pairs of 13.56MHz IC and 125KHz ID cards, press the button to select the card slot. Mobile Bluetooth can be changed at any time. The official software currently only supports writing UID cards. Third party free software supports writing CUID cards, mobile simulation cards, and ID 5577 cards.

Software installation

Official software CU

• Apple phone: Search for "chameleonultragui" on the App Store
• Android phones and computers WIN10 access open source websites for download: https://github.com/RfidResearchGroup/ChameleonULtra
• Android phone download url https://chameleonultragui.dev/android-apk Or Google Play https://play.google.com/store/apps/details?id=io.chameleon.ultra

Suggest using the Android/iOS phone specific paid app: NFC TOOL to directly crack semi encrypted 3rd generation cards without detection. Writing cards is more convenient.

Operation points

The red light indicates a dual band card, the green light indicates a 1G card, and the blue light indicates a 1D card. Press and hold the "W" (A) key for 2 seconds and release it. How to activate Bluetooth when cloning an IDIG card number? When the power is not connected, press one of the keys to activate Bluetooth, and then press the refresh icon on the phone to connect.

When charging or reading cards from an external power source, the device automatically turns off Bluetooth. When importing data into a card slot, the action should not be too fast. You need to wait for 2 seconds to receive memory data. After importing data from a 1C card, you need to exit, click on other options, and then enter to set another card slot. Otherwise, it will lose contact and disconnect, and you need to reconnect via Bluetooth. This is not a product quality issue, it is a software bug. I hope it will be improved in the future. In short, the operation should not be too hasty.

Built in lithium battery, do not squeeze excessively and do not come into contact with open flames. If accidentally soaked in water, it can still be used normally.

Principle analysis

In fact, the detection principle analysis shows that the encryption key is not only stored in the access card, but also in the access card reader. Traditional cracking tools crack the key from the access card, but some difficult access cards cannot crack the key from the card. In this case, we need to crack the key from the access card reader. ChamelonUitra is such a tool that can disguise itself as a normal access card and communicate with the access card reader to obtain the key stored in the access card reader.

What you get

• ChameleonUltra device
• Some ID and IC cards to copy or test
• A Type-C USB cable

About ship

• From China to Europe: 7-15 days, DHL
• From China to USA: 7-15 days, USPS
• From China to Canada: 7-15 days
• From China to Austrilia: 7-15 days
• From China to Japan: 3-5 days

PS: For Japanese customers, you can place your shipping address/name in your own language in the additional instruction.

Questions or need more info? Join my Discord Channel!