# ChameleonUltra

> Open-source NFC/RFID multi-tool built on the nRF52840 SoC. Reads, writes, cracks, and emulates 13.56MHz and 125kHz cards in a compact key-fob form factor with BLE 5.0 connectivity.

## Quick Facts

- **Brand:** Dim6 Tech
- **Board Type:** nfc-rfid-tool
- **Price:** ~$39.9
- **Product Readiness:** consumer
- **CPU:** nRF52840
- **CPU Architecture:** ARM Cortex-M4F
- **CPU Cores:** 1
- **RAM:** 256KB SRAM
- **Flash:** 1MB
- **USB:** USB-C 2.0
- **Power:** 5V USB-C / 3.7V LiPo
- **Operating Voltage:** 3.3V
- **Battery:** 90mAh
- **Charging Port:** USB-C
- **Antenna:** Built-in PCB

## Connectivity

- **Bluetooth:** BLE 5.0

## Open Source

- **Firmware:** Yes
- **Schematics:** Yes
- **PCB Layout:** Yes
- **License:** GPL-3.0

## Compatible Firmware

chameleon-ultra-firmware

## Use Cases

- access-control-testing
- rfid-security-research
- nfc-card-cloning
- physical-penetration-testing
- rfid-badge-emulation

## Components

- **nRF52840** (mcu): ARM Cortex-M4F BLE 5.0 SoC @ 64MHz with 256KB RAM and 1MB Flash — [Datasheet](https://openhardware.directory/r?to=https%3A%2F%2Fwww.nordicsemi.com%2FProducts%2FnRF52840&ref=openhardware.directory&product=chameleon-ultra&source=md-export)
- **MFRC522** (nfc): 13.56MHz NFC/RFID reader/writer IC with MIFARE crypto support — [Datasheet](https://openhardware.directory/r?to=https%3A%2F%2Fwww.nxp.com%2Fdocs%2Fen%2Fdata-sheet%2FMFRC522.pdf&ref=openhardware.directory&product=chameleon-ultra&source=md-export)

## Protocols

- **SPI**
- **USB**
- **BLE**
- **ISO 14443A**
- **EM4100**

## Description

# ChameleonUltra

The ChameleonUltra is a next-generation open-source NFC/RFID multi-tool built on the Nordic nRF52840 SoC. It combines card reading, writing, decryption, and emulation into a compact key-fob form factor smaller than most car keys.

## Key Features

- **Dual-frequency support**: 13.56MHz (ISO 14443A) and 125kHz (EM410x, T5577, HID Prox, Indala)
- **Card emulation**: Emulates up to 8 card slots simultaneously, switchable via button or BLE
- **MIFARE cracking**: Hardware-accelerated Darkside, Nested, and StaticNested attacks via the MFRC522 reader chip
- **BLE 5.0 control**: Fully wireless operation from phone or PC using the ChameleonUltraGUI app
- **Ultra-compact**: 24 x 40 x 8mm key-fob design with built-in 90mAh LiPo battery
- **USB-C**: Firmware updates and charging via USB-C

## Hardware Overview

The board pairs a **Nordic nRF52840** (ARM Cortex-M4F @ 64MHz, 256KB RAM, 1MB Flash) with an **NXP MFRC522** dedicated NFC reader/writer IC. The nRF52840 handles BLE communication, card emulation, and cryptographic operations, while the MFRC522 manages the RF interface for reading and attacking cards.

### Supported Card Types

**High Frequency (13.56MHz):**
- MIFARE Classic 1K/4K (read, write, crack, emulate)
- MIFARE Ultralight / NTAG21x (read, write, emulate)
- MIFARE DESFire (UID emulation)

**Low Frequency (125kHz):**
- EM410x (read, write, emulate)
- T5577 (read, write)
- HID Prox (read, emulate)
- Indala (read, emulate)

## Software Ecosystem

The ChameleonUltra firmware is fully open source and written in C, targeting the nRF52840 with the Nordic SDK. The community maintains several companion tools:

- **ChameleonUltraGUI** — Cross-platform desktop and mobile app (Flutter) for managing card slots, running attacks, and updating firmware
- **CLI tools** — Python-based command-line interface for scripting and automation
- **Proxmark3 interop** — Dump files are compatible with Proxmark3 ecosystem tools

## Use Cases

- Physical penetration testing and red team engagements
- Access control system security auditing
- RFID/NFC research and education
- Badge cloning and credential testing
- Contactless payment card analysis (read-only)

## Where to Buy

- [Tindie](https://openhardware.directory/r?to=https%3A%2F%2Fwww.tindie.com%2Fproducts%2Fdim6%2Fchameleonultra-nfcrfid-readerwritersimulator%2F&ref=openhardware.directory&product=chameleon-ultra&source=md-export) — $39.90
- [Lab401](https://openhardware.directory/r?to=https%3A%2F%2Flab401.com%2Fproducts%2Fchameleon-ultra&ref=openhardware.directory&product=chameleon-ultra&source=md-export) — $69.00

## Resources

- [product](https://openhardware.directory/r?to=https%3A%2F%2Fwww.tindie.com%2Fproducts%2Fdim6%2Fchameleonultra-nfcrfid-readerwritersimulator%2F&ref=openhardware.directory&product=chameleon-ultra&source=md-export)
- [github](https://openhardware.directory/r?to=https%3A%2F%2Fgithub.com%2FRfidResearchGroup%2FChameleonUltra&ref=openhardware.directory&product=chameleon-ultra&source=md-export)
- [wiki](https://openhardware.directory/r?to=https%3A%2F%2Fgithub.com%2FRfidResearchGroup%2FChameleonUltra%2Fwiki&ref=openhardware.directory&product=chameleon-ultra&source=md-export)
- [schematics](https://openhardware.directory/r?to=https%3A%2F%2Fraw.githubusercontent.com%2FRfidResearchGroup%2FChameleonUltra%2Fmain%2Fhardware%2Fultra%2FChameleon_nrf52_ultra_V1.0.pdf&ref=openhardware.directory&product=chameleon-ultra&source=md-export)

## Tags

`nfc`, `rfid`, `nrf52840`, `ble`, `security`, `penetration-testing`, `mifare`, `hid`, `em4100`, `card-emulation`

## Images

![ChameleonUltra](https://nbg1.your-objectstorage.com/openhardware-directory/entities/chameleon-ultra/df68c9c8cd5b.png)

> **Battery Powered:** Li-Po

---
[View full device page](https://openhardware.directory/devices/chameleon-ultra)