Connect to ChameleonUltra. This method will be called automatically when you call any command.
Return true if ChameleonUltra is connected.
StaticVERSION_The supported version of SDK.
Automatically change the device mode to mode if the current device mode is not equal to mode.
Delete all ble bindings.
Get the ble pairing mode of device.
true if pairing is required to connect to device, otherwise return false.
Set the ble pairing key of device.
The new ble pairing key.
Set if the ble pairing is required when connecting to device.
true to enable pairing mode, false to disable pairing mode.
Change device mode to tag reader or tag emulator.
The mode to be changed.
Get the animation mode of device while wake-up and sleep.
The animation mode of device.
// you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
await (async ultra => {
const { AnimationMode } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const mode = await ultra.cmdGetAnimationMode()
console.log(AnimationMode[mode]) // 'FULL'
})(vm.ultra)
Get current firmware version of device.
Current firmware version of device.
Get the battery info of device.
The battery info of device.
Get the button long press action of specified button.
The button to be get.
The button long press action of specified button.
// you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
await (async ultra => {
const { ButtonAction, ButtonType } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const btnAction = await ultra.cmdGetButtonLongPressAction(ButtonType.BUTTON_A)
console.log(ButtonAction[btnAction]) // 'CLONE_IC_UID'
})(vm.ultra)
Get the button press action of specified button.
The button to be get.
The button press action of specified button.
// you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
await (async ultra => {
const { ButtonAction, ButtonType } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const btnAction = await ultra.cmdGetButtonPressAction(ButtonType.BUTTON_A)
console.log(ButtonAction[btnAction]) // 'CYCLE_SLOT_INC'
})(vm.ultra)
Get current mode of device.
Current mode of device.
// you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
await (async ultra => {
const { DeviceMode } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const deviceMode = await ultra.cmdGetDeviceMode()
console.log(DeviceMode[deviceMode]) // 'TAG'
})(vm.ultra)
Get the device is ChameleonUltra or ChameleonLite.
// you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
await (async ultra => {
const { DeviceModel } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const model = await ultra.cmdGetDeviceModel()
console.log(DeviceModel[model]) // 'ULTRA'
})(vm.ultra)
Get the settings of device.
The settings of device.
// you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
await (async ultra => {
const settings = await ultra.cmdGetDeviceSettings()
console.log(JSON.stringify(settings)
/**
* {
* "version": 5,
* "animation": 0,
* "buttonPressAction": [1, 2],
* "buttonLongPressAction": [3, 3],
* "blePairingMode": false,
* "blePairingKey": "123456"
* }
*/
})(vm.ultra)
Get the git version of firmware. The returned string is the output of git describe --abbrev=7 --dirty --always --tags --match "v*.*". Depending on the status of repo, the string can be:
v2.0.0 if the firmware is built from the tagged commitv2.0.0-5-g617d6d0-dirty if the local repo contains changes not yet committed, e.g. v2.0.0-5-g617d6d0-dirtyThe git version of firmware.
Reset the settings of device to default values.
Save the settings of device to persistent storage.
Set the animation mode of device while wake-up and sleep.
The animation mode to be set.
Set the button long press action of specified button.
The button to be set.
The button long press action to be set.
// you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
await (async ultra => {
const { ButtonAction, ButtonType } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
await ultra.cmdSetButtonLongPressAction(ButtonType.BUTTON_A, ButtonAction.CYCLE_SLOT_INC)
})(vm.ultra)
Set the button press action of specified button.
The button to be set.
The button press action to be set.
// you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
await (async ultra => {
const { ButtonAction, ButtonType } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
await ultra.cmdSetButtonPressAction(ButtonType.BUTTON_A, ButtonAction.CYCLE_SLOT_INC)
})(vm.ultra)
Permanently wipes Chameleon to factory settings. This will delete all your slot data and custom settings. There's no going back.
Check if the firmware version is supported by SDK.
true if the firmware version is supported, false otherwise.
Change the emulation tag type of specified slot.
Delete the nick name of the slot
true if success, false if slot name is empty.
// you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
await (async ultra => {
const { Slot, FreqType } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
console.log(await ultra.cmdSlotDeleteFreqName(Slot.SLOT_1, FreqType.HF)) // true
})(vm.ultra)
Delete the emulation tag data of specified freq type in specified slot.
Get the nickname of specified freq type in specified slot.
The nickname of specified freq type in specified slot.
// you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
await (async ultra => {
const { Slot, FreqType } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const name = await ultra.cmdSlotGetFreqName(Slot.SLOT_1, FreqType.HF)
console.log(name) // 'My Tag'
})(vm.ultra)
Get the slot info of all slots.
The slot info of all slots.
// you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
await (async ultra => {
const slots = await ultra.cmdSlotGetInfo()
console.log(JSON.stringify(slots))
/**
* [
* { "hfTagType": 1001, "lfTagType": 100 },
* { "hfTagType": 1001, "lfTagType": 0 },
* { "hfTagType": 0, "lfTagType": 100 },
* { "hfTagType": 0, "lfTagType": 0 },
* { "hfTagType": 0, "lfTagType": 0 },
* { "hfTagType": 0, "lfTagType": 0 },
* { "hfTagType": 0, "lfTagType": 0 },
* { "hfTagType": 0, "lfTagType": 0 }
* ]
*/
})(vm.ultra)
Get enabled slots.
Enabled slots.
// you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
await (async ultra => {
const enabledSlots = await ultra.cmdSlotGetIsEnable()
console.log(JSON.stringify(enabledSlots))
// [
// { "hf": true, "lf": true },
// { "hf": true, "lf": false },
// { "hf": false, "lf": true },
// { "hf": false, "lf": false },
// { "hf": false, "lf": false },
// { "hf": false, "lf": false },
// { "hf": false, "lf": false },
// { "hf": true, "lf": false }
// ]
})(vm.ultra)
Reset the emulation tag data of specified tag type in specified slot to default values.
The SlotSettings, hf tag data and lf tag data will be written to persistent storage. But the slot nickname is not affected by this command.
// you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
await (async ultra => {
const { Buffer } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
await ultra.cmdMf1EmuWriteBlock(1, Buffer.alloc(16))
await ultra.cmdSlotSaveSettings()
})(vm.ultra)
Helper function to change slot to tagType, reset to default tagType data, enable slot, save settings and set active slot.
// you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
await (async ultra => {
const { Slot, TagType } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
await ultra.slotChangeTagTypeAndActive(Slot.SLOT_1, TagType.MIFARE_1024, TagType.EM410X)
})(vm.ultra)
Write id of em410x tag to t55xx tag.
The id of em410x tag.
The new key of t55xx tag.
The keys to be checked. Maximum length is 125.
// you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
await (async ultra => {
const { Buffer } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const id = Buffer.from('deadbeef88', 'hex')
// https://github.com/RfidResearchGroup/proxmark3/blob/master/client/dictionaries/t55xx_default_pwds.dic
const newKey = Buffer.from('20206666', 'hex')
const oldKeys = Buffer.from('5124364819920427', 'hex').chunk(4)
await ultra.cmdEm410xWriteToT55xx(id, newKey, oldKeys)
})(vm.ultra)
Send raw NfcA data to a tag and receive the response.
OptionalactivateRfField?: booleanSet true to activate RF field. If data is not empty or autoSelect is true, activateRfField will be set to true.
OptionalappendCrc?: booleanSet true to add CRC before sending data.
OptionalautoSelect?: booleanSet true to automatically select card before sending data.
OptionalcheckResponseCrc?: booleanSet true to verify CRC of response and remove. If CRC of response is valid, CRC will be removed from response, otherwise will throw HF_ERR_CRC error.
Optionaldata?: BufferThe data to be send. If appendCrc is true, the maximum length of data is 62, otherwise is 64.
OptionaldataBitLength?: numberNumber of bits to send. Useful for send partial byte. dataBitLength is incompatible with appendCrc.
OptionalkeepRfField?: booleanSet true to keep the RF field active after sending.
Optionaltimeout?: numberDefault value is 1000 ms. Maximum timeout for reading tag response in ms while waitResponse is true.
OptionalwaitResponse?: booleanDefault value is true. Set false to skip reading tag response.
The response from tag.
Scan 14a tag, and return basic information. The device mode must be set to READER before using this command.
The basic infomation of scanned tag.
// you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
await (async ultra => {
const antiColl = _.first(await ultra.cmdHf14aScan())
console.log(_.mapValues(antiColl, val => val.toString('hex')))
// { uid: '040dc4420d2981', atqa: '4400', sak: '00', ats: ''}
})(vm.ultra)
Get the info composed of cmdHf14aScan() and cmdMf1TestNtLevel().
The info about 14a tag and mifare protocol.
// you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
await (async ultra => {
const { Mf1PrngType } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const tag = _.first(await ultra.hf14aInfo())
console.log(tag.nxpTypeBySak) // 'MIFARE Classic 1K | Plus SE 1K | Plug S 2K | Plus X 2K'
console.log(Mf1PrngType[tag.prngType]) // 'WEAK'
console.log(_.mapValues(tag.antiColl, val => val.toString('hex')))
// { uid: 'dbe3d63d', atqa: '0400', sak: '08', ats: '' }
})(vm.ultra)
Set the em410x id of actived slot.
The em410x id of actived slot.
Get anti-collision data from actived slot.
The anti-collision data from actived slot.
// you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
await (async ultra => {
const res = await ultra.cmdHf14aGetAntiCollData()
console.log(JSON.stringify(res))
// {
// "uid": { "type": "Buffer", "data": [222, 173, 190, 239] },
// "atqa": { "type": "Buffer", "data": [4, 0] },
// "sak": { "type": "Buffer", "data": [8] },
// "ats": { "type": "Buffer", "data": [] }
// }
})(vm.ultra)
Set the mifare anti-collision data of actived slot.
2 bytes, the new atqa to be set.
Optionalats?: BufferThe new ats to be set.
1 byte, the new sak to be set.
The new uid to be set.
// you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
await (async ultra => {
const { Buffer } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
await ultra.cmdHf14aSetAntiCollData({
atqa: Buffer.from('0400', 'hex'),
sak: Buffer.of(0x08),
uid: Buffer.from('01020304', 'hex')
})
})(vm.ultra)
Magic auth helper function for mifare gen1a tag.
The callback function to be executed after auth.
The result of callback function.
Acquire the data from mifare darkside attack.
The target block.
The target key type.
true if this is the first attack.
The max sync count of darkside attack.
The data from mifare darkside attack.
// you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
await (async ultra => {
const { Mf1KeyType, DarksideStatus } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const res1 = await ultra.cmdMf1AcquireDarkside(0, Mf1KeyType.KEY_A, true)
console.log(res1)
const res2 = {
status: `${DarksideStatus[res1.status]} (${res1.status})`,
...(res1.status !== DarksideStatus.OK ? {} : {
ar: res1.ar.toString('hex'),
ks: res1.ks.toString('hex'),
nr: res1.nr.toString('hex'),
nt: res1.nt.toString('hex'),
par: res1.par.toString('hex'),
uid: res1.uid.toString('hex'),
}),
}
console.log(res2)
// {
// "ar": "00000000",
// "ks": "0c0508080f04050a",
// "nr": "00000000",
// "nt": "b346fc3d",
// "par": "0000000000000000",
// "status": "OK (0)",
// "uid": "d3efed0c"
// }
})(vm.ultra)
If you want to use darkside attack to recover the key, you can use the following example code:
// you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
await (async ultra => {
const { Buffer, DarksideStatus, Mf1KeyType } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const block = 0
const keyType = Mf1KeyType.KEY_A
const key = await Crypto1.darkside(
async attempt => {
const acquired = await ultra.cmdMf1AcquireDarkside(block, keyType, attempt === 0)
console.log(_.mapValues(acquired, buf => Buffer.isBuffer(buf) ? buf.toString('hex') : buf))
if (acquired.status === DarksideStatus.LUCKY_AUTH_OK) throw new Error('LUCKY_AUTH_OK')
if (acquired.status !== DarksideStatus.OK) throw new Error('card is not vulnerable to Darkside attack')
return acquired
},
async key => {
return await ultra.cmdMf1CheckBlockKey({ block, keyType, key })
},
)
console.log(`key founded: ${key.toString('hex')}`)
})(vm.ultra)
Use a known key to do the mifare hardnested attack.
The info of known key.
The block of known key.
The known key.
The key type of known key.
The info of target key to be attack.
The block of target key.
The key type of target key.
Optionalslow?: booleanIs it a low-speed acquisition mode? Low-speed acquisition is suitable for some non-standard cards.
The result of mifare hardnested attack.
// you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
await (async ultra => {
const { Buffer, Mf1KeyType } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const antiColl = _.first(await ultra.cmdHf14aScan())
const key = Buffer.from('FFFFFFFFFFFF', 'hex')
const res = await ultra.cmdMf1AcquireHardNested(
{ block: 0, keyType: Mf1KeyType.KEY_A, key },
{ block: 4, keyType: Mf1KeyType.KEY_A },
)
console.log(res)
// [
// { nt: 0xCE178123, ntEnc: 0x37ADDC14, par: 0xB8 },
// { nt: 0xD9380BBF, ntEnc: 0x0080795A, par: 0xF3 },
// // ...
// ]
})(vm.ultra)
Use a known key to do the mifare nested attack.
The info of known key.
The block of known key.
The known key.
The key type of known key.
The info of target key to be attack.
The block of target key.
The key type of target key.
The result of mifare nested attack.
// you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
await (async ultra => {
const { Buffer, Mf1KeyType } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const key = Buffer.from('FFFFFFFFFFFF', 'hex')
const res1 = await ultra.cmdMf1TestNtDistance({ block: 0, keyType: Mf1KeyType.KEY_A, key })
const res2 = await ultra.cmdMf1AcquireNested(
{ block: 0, keyType: Mf1KeyType.KEY_A, key },
{ block: 4, keyType: Mf1KeyType.KEY_A },
)
const res = {
uid: res1.uid.toString('hex'),
dist: res1.dist.toString('hex'),
atks: res2,
}
console.log(res)
// {
// uid: '877209e1',
// dist: '00000080',
// atks: [
// { nt1: 0x35141FCB, nt2: 0x40430522, par: 7 },
// { nt1: 0xCFF2B3EF, nt2: 0x825BA8EA, par: 5 },
// ]
// }
})(vm.ultra)
Use a known key to do the mifare static nested attack.
The info of known key.
The block of known key.
The known key.
The key type of known key.
The info of target key to be attack.
The block of target key.
The key type of target key.
The result of mifare static nested attack.
// you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
await (async ultra => {
const { Buffer, Mf1KeyType } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const key = Buffer.from('FFFFFFFFFFFF', 'hex')
const res1 = await ultra.cmdMf1AcquireStaticNested({
block: 0,
keyType: Mf1KeyType.KEY_A,
key
}, {
block: 4,
keyType: Mf1KeyType.KEY_A
})
const res = {
uid: res1.uid.toString('hex'),
atks: _.map(res1.atks, item => ({ nt1: item.nt1.toString('hex'), nt2: item.nt2.toString('hex') })),
}
console.log(res)
// {
// uid: 'b908a16d',
// atks: [
// { nt1: '01200145', nt2: '81901975' },
// { nt1: '01200145', nt2: 'cdd400f3' },
// ],
// }
})(vm.ultra)
Check if the key is valid for specified block and key type.
The info of key to be checked.
The block of key to be checked.
The key to be checked.
The type of key to be checked.
true if the key is valid for specified block and key type.
// you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
await (async ultra => {
const { Buffer, Mf1KeyType } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const key = Buffer.from('FFFFFFFFFFFF', 'hex')
console.log(await ultra.cmdMf1CheckBlockKey({
block: 0,
keyType: Mf1KeyType.KEY_A,
key,
})) // true
})(vm.ultra)
Given a list of keys, check which is the correct key A and key B of the sectors. If you want to check more than 83 keys, you can use mf1CheckKeysOfSectors().
The keys to be checked. Maximum length is 83.
The mask of sectors. 80 bits, 2 bits/sector, the first bit is key A, the second bit is key B, 0b1 represent to skip checking the key.
found: 80 bits, 2 bits/sector, the first bit is key A, the second bit is key B, 0b1 represent key is found.sectorKeys: 80 keys, 2 keys/sector, the first key is key A, the second key is key B. null represent key is not found.// you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
await (async ultra => {
const { Buffer } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const mask = Buffer.from('00000000FFFFFFFFFFFF', 'hex')
const keys = Buffer.from('FFFFFFFFFFFF\n000000000000\nA0A1A2A3A4A5\nD3F7D3F7D3F7', 'hex').chunk(6)
const tsStart = Date.now()
const result = await ultra.cmdMf1CheckKeysOfSectors({ keys, mask })
console.log(`Time: ${Date.now() - tsStart}ms`)
const replacer = function (k, v) { return Buffer.isBuffer(this[k]) ? this[k].toString('hex') : v }
console.log(JSON.stringify(result, replacer, 2))
})(vm.ultra)
// {
// "found": "ffffffff000000000000",
// "sectorKeys": [
// "ffffffffffff", "ffffffffffff", "ffffffffffff", "ffffffffffff",
// "ffffffffffff", "ffffffffffff", "ffffffffffff", "ffffffffffff",
// "ffffffffffff", "ffffffffffff", "ffffffffffff", "ffffffffffff",
// "ffffffffffff", "ffffffffffff", "ffffffffffff", "ffffffffffff",
// "ffffffffffff", "ffffffffffff", "ffffffffffff", "ffffffffffff",
// "ffffffffffff", "ffffffffffff", "ffffffffffff", "ffffffffffff",
// "ffffffffffff", "ffffffffffff", "ffffffffffff", "ffffffffffff",
// "ffffffffffff", "ffffffffffff", "ffffffffffff", "ffffffffffff",
// null, null, null, null,
// null, null, null, null,
// null, null, null, null,
// null, null, null, null,
// null, null, null, null,
// null, null, null, null,
// null, null, null, null,
// null, null, null, null,
// null, null, null, null,
// null, null, null, null,
// null, null, null, null,
// null, null, null, null,
// ]
// }
Get the mifare block data of actived slot.
The start block of actived slot.
The count of blocks to be get.
The mifare block data of actived slot.
Set the mifare block data of actived slot.
The start block of actived slot.
The data to be set. the length of data should be multiples of 16.
Get the mode of actived slot that using anti-collision data from block 0 for 4 byte UID tags or not.
The mode of actived slot that using anti-collision data from block 0 for 4 byte UID tags or not.
Get the count of mifare MFKey32 detections.
The count of mifare MFKey32 detections.
Get the feature of mifare MFKey32 detections is enabled or not.
true if the feature of mifare MFKey32 detections is enabled, otherwise return false.
Get the data of mifare MFKey32 detections.
The start log of detections to be get.
The mifare MFKey32 detections.
// you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
await (async ultra => {
const logs = await ultra.cmdMf1GetDetectionLogs(0)
console.log(logs)
/**
* {
* "block": 2,
* "isKeyB": 1,
* "isNested": 0,
* "uid": Buffer.from('65535d33', 'hex'),
* "nt": Buffer.from('cb7b9ed9', 'hex'),
* "nr": Buffer.from('5a8ffec6', 'hex'),
* "ar": Buffer.from('5c7c6f89', 'hex'),
* }
*/
})(vm.ultra)
Get the mifare settings of actived slot.
The mifare settings of actived slot.
// you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
await (async ultra => {
const mf1Settings = await ultra.cmdMf1GetEmuSettings()
console.log(JSON.stringify(mf1Settings))
/**
* {
* "detection": false,
* "gen1a": false,
* "gen2": false,
* "antiColl": false,
* "write": 0
* }
*/
})(vm.ultra)
Set the mifare gen1a mode of actived slot.
The mifare gen1a mode of actived slot.
Get the mifare gen2 mode of actived slot.
The mifare gen2 mode of actived slot.
Get the mifare write mode of actived slot.
The mifare write mode of actived slot.
Test whether it is mifare classic tag.
true if tag is mifare classic tag, otherwise return false.
Read block data from a mifare tag.
The block to be read and the key info of the block.
The block to be read.
The key of the block.
The key type of the block.
The block data read from a mifare tag.
// you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
await (async ultra => {
const { Buffer, Mf1KeyType } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const key = Buffer.from('FFFFFFFFFFFF', 'hex')
const block1 = await ultra.cmdMf1ReadBlock({
block: 1,
keyType: Mf1KeyType.KEY_A,
key,
})
console.log(block1.toString('hex')) // '00000000000000000000000000000000'
})(vm.ultra)
Set the mode of actived slot that using anti-collision data from block 0 for 4 byte UID tags or not.
true to enable the mode, false to disable the mode.
Enable or disable the mifare MFKey32 detection and clear the data of detections.
true to enable the detection, false to disable the detection.
Set the mifare gen1a mode of actived slot.
true to enable the gen1a mode, false to disable the gen1a mode.
Set the mifare gen2 mode of actived slot.
true to enable the gen2 mode, false to disable the gen2 mode.
Set the mifare write mode of actived slot.
The mifare write mode of actived slot.
Dectect the nt distance of mifare protocol.
The info of known key.
The block of known key.
The known key.
The key type of known key.
The nt distance of mifare protocol.
// you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
await (async ultra => {
const { Buffer, Mf1KeyType } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const key = Buffer.from('FFFFFFFFFFFF', 'hex')
const res1 = await ultra.cmdMf1TestNtDistance({ block: 0, keyType: Mf1KeyType.KEY_A, key })
const res2 = await ultra.cmdMf1AcquireNested(
{ block: 0, keyType: Mf1KeyType.KEY_A, key },
{ block: 4, keyType: Mf1KeyType.KEY_A },
)
const res = {
uid: res1.uid.toString('hex'),
dist: res1.dist.toString('hex'),
atks: _.map(res2, item => ({
nt1: item.nt1.toString('hex'),
nt2: item.nt2.toString('hex'),
par: item.par,
}))
}
console.log(res)
// {
// uid: '877209e1',
// dist: '00000080',
// atks: [
// { nt1: '35141fcb', nt2: '40430522', par: 7 },
// { nt1: 'cff2b3ef', nt2: '825ba8ea', par: 5 },
// ]
// }
})(vm.ultra)
MIFARE Classic manipulate value block
X (0 ~ 2147483647) from src to dstX (0 ~ 2147483647) from src to dstThe key info of src block.
The block of src block.
The key of src block.
The key type of src block.
The operator of value block.
The operand of value block.
The key info of dst block.
The block of dst block.
The key of dst block.
The key type of dst block.
// you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
await (async ultra => {
const { Buffer, Mf1KeyType, Mf1VblockOperator } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const key = Buffer.from('FFFFFFFFFFFF', 'hex')
const src = { block: 4, keyType: Mf1KeyType.KEY_A, key }
await ultra.mf1VblockSetValue(src, { value: 2 })
console.log(await ultra.mf1VblockGetValue(src))
await ultra.cmdMf1VblockManipulate(
{ block: 4, keyType: Mf1KeyType.KEY_A, key },
Mf1VblockOperator.DECREMENT, 1,
{ block: 4, keyType: Mf1KeyType.KEY_A, key },
)
console.log(await ultra.mf1VblockGetValue(src))
})(vm.ultra)
Write data to a mifare tag.
The block to be written and the key info of the block.
The block to be written.
The block data to be written.
The key of the block.
The key type of the block.
// you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
await (async ultra => {
const { Buffer, Mf1KeyType } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const key = Buffer.from('FFFFFFFFFFFF', 'hex')
const block1 = Buffer.from('00000000000000000000000000000000', 'hex')
await ultra.cmdMf1WriteBlock({
block: 1,
keyType: Mf1KeyType.KEY_A,
key,
data: block1,
})
})(vm.ultra)
Mifare Classic check keys of sectors.
OptionalchunkSize?: numberkeys will be chunked by this size.
The keys to be checked.
Optionalmask?: BufferThe mask of sectors. 80 bits, 2 bits/sector, the first bit is key A, the second bit is key B, 0b1 represent to skip checking the key.
OptionalmaxSectors?: numberThe max sectors to be check.
OptionalonChunkKeys?: (opts: { keys: Buffer[]; mask: Buffer }) => Promise<unknown>The callback function to be invoked before checking every chunk of keys.
Given a list of keys, check which is the correct key A and key B of the sector.
The sector number to be checked.
The keys dictionary.
The Key A and Key B of the sector.
// you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
await (async ultra => {
const { Buffer } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const keys = Buffer.from('FFFFFFFFFFFF\n000000000000\nA0A1A2A3A4A5\nD3F7D3F7D3F7', 'hex').chunk(6)
const sectorKey = await ultra.mf1CheckSectorKeys(0, keys)
console.log(_.mapValues(sectorKey, key => key.toString('hex')))
// { "96": "ffffffffffff", "97": "ffffffffffff" }
})(vm.ultra)
Read blocks from Mifare Classic Gen1a.
The start block of Mifare Classic Gen1a.
The amount of blocks to read.
The blocks data.
Write blocks to Mifare Classic Gen1a.
The start block of Mifare Classic Gen1a.
The blocks data to write.
Send Mifare Classic HALT command and close RF field.
Read a block data of Mifare Classic by given keys.
The block number to be read.
The keys dictionary.
The block data read from a mifare tag. An error is thrown if the block cannot be read.
// you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
await (async ultra => {
const { Buffer } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const keys = Buffer.from('FFFFFFFFFFFF\n000000000000\nA0A1A2A3A4A5\nD3F7D3F7D3F7', 'hex').chunk(6)
const data = await ultra.mf1ReadBlockByKeys(0, keys)
console.log(data.toString('hex'))
})(vm.ultra)
Read a sector data of Mifare Classic by given keys.
The sector number to be read.
The keys dictionary.
The sector data and the read status of each block.
// you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
await (async ultra => {
const { Buffer, Mf1KeyType } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const keys = Buffer.from('FFFFFFFFFFFF\n000000000000\nA0A1A2A3A4A5\nD3F7D3F7D3F7', 'hex').chunk(6)
const { data, success } = await ultra.mf1ReadSectorByKeys(0, keys)
console.log({ data: data.toString('hex'), success })
// { "data": "...", "success": [true, true, true, true] }
})(vm.ultra)
Get value from opts block (MIFARE Classic value block)
The key info of opts block.
The block of opts block.
The key of opts block.
The key type of opts block.
The value and address of opts block.
// you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
await (async ultra => {
const { Buffer, Mf1KeyType, Mf1VblockOperator } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const key = Buffer.from('FFFFFFFFFFFF', 'hex')
const src = { block: 4, keyType: Mf1KeyType.KEY_A, key }
await ultra.mf1VblockSetValue(src, { value: 2 })
console.log(await ultra.mf1VblockGetValue(src))
})(vm.ultra)
Set value X (-2147483647 ~ 2147483647) to dst block (MIFARE Classic value block)
The key info of dst block.
The block of dst block.
The key of dst block.
The key type of dst block.
The value and address to be set.
Optionaladr?: numberThe address to be set. Default is dst.block.
Optionalvalue?: numberThe value to be set. Default is 0.
// you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
await (async ultra => {
const { Buffer, Mf1KeyType, Mf1VblockOperator } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const key = Buffer.from('FFFFFFFFFFFF', 'hex')
const src = { block: 4, keyType: Mf1KeyType.KEY_A, key }
await ultra.mf1VblockSetValue(src, { value: 2 })
console.log(await ultra.mf1VblockGetValue(src))
})(vm.ultra)
Write a block data to Mifare Classic by given keys.
The block number to be written.
The keys dictionary.
Block data
An error is thrown if the block cannot be write.
// you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
await (async ultra => {
const { Buffer } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const keys = Buffer.from('FFFFFFFFFFFF\n000000000000\nA0A1A2A3A4A5\nD3F7D3F7D3F7', 'hex').chunk(6)
const data = Buffer.from('00000000000000000000000000000000', 'hex')
await ultra.mf1WriteBlockByKeys(1, keys, data)
})(vm.ultra)
Write a sector data to Mifare Classic by given keys.
The sector number to be written.
The key dictionary.
Sector data
the write status of each block.
// you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
await (async ultra => {
const { Buffer } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const keys = Buffer.from('FFFFFFFFFFFF\n000000000000\nA0A1A2A3A4A5\nD3F7D3F7D3F7', 'hex').chunk(6)
const data = Buffer.concat([
Buffer.from('00000000000000000000000000000000', 'hex'),
Buffer.from('00000000000000000000000000000000', 'hex'),
Buffer.from('00000000000000000000000000000000', 'hex'),
Buffer.from('ffffffffffffff078069ffffffffffff', 'hex'),
])
const { success } = await ultra.mf1WriteSectorByKeys(1, keys, data)
console.log(success)
// [true, true, true, true]
})(vm.ultra)
Staticmf1Convert Proxmark3 compatible EML string to dump for importing Mifare Classic.
The EML string of the Mifare Classic.
The dump data imported from EML.
// you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
await (async () => {
const { Buffer, ChameleonUltra, TagType } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const dump = ChameleonUltra.mf1GenEmptyDump({ tagType: TagType.MIFARE_1024 })
const eml = ChameleonUltra.mf1DumpToEml({ body: dump })
const buf = ChameleonUltra.mf1DumpFromEml(eml)
console.log(buf)
})()
Staticmf1Convert MifareClassicTool compatible MCT string to dump for importing Mifare Classic.
The MCT string of the Mifare Classic.
The dump data imported from MCT.
// you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
await (async () => {
const { Buffer, ChameleonUltra, TagType } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const dump = ChameleonUltra.mf1GenEmptyDump({ tagType: TagType.MIFARE_1024 })
const mct = ChameleonUltra.mf1DumpToMct({ body: dump })
const buf = ChameleonUltra.mf1DumpFromMct(mct)
console.log(buf)
})()
Staticmf1Convert Proxmark3 compatible JSON Object to dump for importing Mifare Classic.
Proxmark3 compatible JSON Object. If a string, Uint8Array, Buffer is provided, it will be parsed using JSON.parse.
The tag data imported from Proxmark3 JSON Object.
// you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
await (async () => {
const { Buffer, ChameleonUltra, TagType } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const dump = ChameleonUltra.mf1GenEmptyDump({ tagType: TagType.MIFARE_1024 })
const json = ChameleonUltra.mf1DumpToPm3Json({
atqa: Buffer.from('0004', 'hex').reverse(),
body: dump,
sak: Buffer.of(0x08),
uid: Buffer.from('deadbeef', 'hex'),
})
const resp = ChameleonUltra.mf1DumpFromPm3Json(json)
console.log(resp)
})()
Staticmf1Convert dump to Proxmark3 compatible EML string for exporting Mifare Classic.
The body of the tag.
The EML string for exporting Mifare Classic.
// you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
await (async () => {
const { Buffer, ChameleonUltra, TagType } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const dump = ChameleonUltra.mf1GenEmptyDump({ tagType: TagType.MIFARE_1024 })
const eml = ChameleonUltra.mf1DumpToEml({ body: dump })
console.log(eml)
})()
Staticmf1Convert dump to MifareClassicTool compatible MCT string for exporting Mifare Classic.
The body of the tag.
The MCT string for exporting Mifare Classic.
// you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
await (async () => {
const { Buffer, ChameleonUltra, TagType } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const dump = ChameleonUltra.mf1GenEmptyDump({ tagType: TagType.MIFARE_1024 })
const mct = ChameleonUltra.mf1DumpToMct({ body: dump })
console.log(mct)
})()
Staticmf1Convert dump to Proxmark3 compatible JSON Object for exporting Mifare Classic.
The ATQA of the tag.
Optionalats?: BufferThe ATS of the tag.
The body of the tag.
The SAK of the tag.
Optionalsig?: BufferThe UID of the tag.
The JSON Object for exporting Mifare Classic.
// you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
await (async () => {
const { Buffer, ChameleonUltra, TagType } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const dump = ChameleonUltra.mf1GenEmptyDump({ tagType: TagType.MIFARE_1024 })
const json = ChameleonUltra.mf1DumpToPm3Json({
atqa: Buffer.from('0004', 'hex').reverse(),
body: dump,
sak: Buffer.of(0x08),
uid: Buffer.from('deadbeef', 'hex'),
})
console.log(json)
})()
Staticmf1Generate empty dump for magic mifare classic tag.
Optionalatqa?: BufferThe ATQA of the tag.
Optionalbuf?: BufferIf provided, the data will be written to this buffer.
Optionalsak?: BufferThe SAK of the tag.
OptionaltagType?: TagTypeThe tag type of the mifare classic tag.
Optionaluid?: BufferThe UID of the tag.
The empty dump for magic mifare classic tag.
// you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
await (async () => {
const { Buffer, ChameleonUltra, TagType } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const dump = ChameleonUltra.mf1GenEmptyDump({
uid: Buffer.from('deadbeef', 'hex'),
atqa: Buffer.from('0004', 'hex').reverse(),
sak: Buffer.of(0x08),
tagType: TagType.MIFARE_1024,
})
console.log(dump.chunk(16).map(blk => blk.toString('hex')).join('\n'))
})()
Staticmf1Generate block 0 (manufacturer block) for magic mifare classic tag.
Optionalatqa?: BufferThe ATQA of the tag.
Optionalbuf?: BufferIf provided, the data will be written to this buffer.
Optionalsak?: BufferThe SAK of the tag.
The UID of the tag.
// you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
await (async () => {
const { Buffer, ChameleonUltra } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const block0 = ChameleonUltra.mf1GenMagicBlock0({
uid: Buffer.from('deadbeef', 'hex'),
atqa: Buffer.from('0004', 'hex').reverse(),
sak: Buffer.of(0x08),
})
console.log(block0.toString('hex')) // deadbeef220804000000000000000000
})()
Staticmf1Check acl bytes of ACL, block or sector.
Data of ACL, block or sector.
true if the acl bytes is valid, false otherwise.
// you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
await (async () => {
const { Buffer, ChameleonUltra } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
console.log(ChameleonUltra.mf1IsValidAcl(Buffer.from('ff078069', 'hex'))) // true
})()
Staticmf1Convert Mifare Keys .dic string to keys.
Mifare Keys .dic string
The keys imported from Mifare Keys .dic string.
// you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
await (async () => {
const { ChameleonUltra } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const dict = '#test\r\nFFFFFFFFFFFF\r\n\r\n'
const keys = ChameleonUltra.mf1KeysFromDict(dict)
console.log(keys.map(key => key.toString('hex').toUpperCase()))
// ['FFFFFFFFFFFF']
})()
Staticmf1Get the blockNo of sector trailer.
The sector number.
The blockNo of sector trailer.
Read the counter and tearing of actived slot.
NTAG21x features a NFC counter function. The NFC counter is enabled or disabled with the NFC_CNT_EN bit. This function enables NTAG21x to automatically increase the 24 bit counter value, triggered by the first valid READ or FAST_READ command after the NTAG21x tag is powered by an RF field.
The address of the counter.
Get the number of pages available in the actived slot.
The number of pages available in the actived slot.
Get the signature of actived slot. NTAG21x features a cryptographically supported originality check. The signature is used to verify with a certain confidence that the tag is using an IC manufactured by NXP Semiconductors. The signature digital is based on standard Elliptic Curve Cryptography (curve name secp128r1), according to the ECDSA algorithm.
The signature of actived slot.
Get the version of actived slot. The version is used to retrieve information on the NTAG family, the product version, storage size and other product data required to identify the specific NTAG21x.
The version of actived slot.
Get the magic mode of actived slot.
If the actived slot is in magic mode, all read and write protection is bypassed.
The magic mode of actived slot.
Get the page data of actived slot.
The start page of actived slot.
The count of pages to be get. Must satisfy: 1 <= length <= 128.
The page data of actived slot.
Reset the authentication failed counter of actived slot.
The original value of the unsuccessful auth counter before reset.
Set the counter and reset tearing of actived slot.
NTAG21x features a NFC counter function. The NFC counter is enabled or disabled with the NFC_CNT_EN bit. This function enables NTAG21x to automatically increase the 24 bit counter value, triggered by the first valid READ or FAST_READ command after the NTAG21x tag is powered by an RF field.
Optionaladdr?: numberThe address of the counter.
Optionalcounter?: numberThe counter to be write. The counter must be a 24-bit unsigned integer.
OptionalresetTearing?: booleantrue to reset tearing.
Set the signature of actived slot. NTAG21x features a cryptographically supported originality check. The signature is used to verify with a certain confidence that the tag is using an IC manufactured by NXP Semiconductors. The signature digital is based on standard Elliptic Curve Cryptography (curve name secp128r1), according to the ECDSA algorithm.
The signature. The signature must be a 32 bytes Buffer.
// you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
await (async ultra => {
const { Buffer } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const signature = Buffer.from('0000000000000000000000000000000000000000000000000000000000000000', 'hex')
await ultra.cmdMfuSetEmuSignature(signature)
})(vm.ultra)
Set the version of actived slot. The version is used to retrieve information on the NTAG family, the product version, storage size and other product data required to identify the specific NTAG21x.
The version of actived slot.
Set the magic mode of actived slot.
If the actived slot is in magic mode, all read and write protection is bypassed.
The magic mode of actived slot.
Set the page data of actived slot.
The start page of actived slot.
The data to be write. Length of data must be multiples of 4 and satisfy: 4 <= data.length <= 508.
Assert the tag type of actived slot is Mifare Ultralight like. Throw an error if the tag type is not Mifare Ultralight like.
The tag type of actived slot.
// you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
await (async ultra => {
const { TagType } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const tagType = await ultra.mfuAssertEmuTagType()
console.log(TagType[tagType]) // '040dc445420d2981e7480000e1100600'
})(vm.ultra)
A protected memory area can be accessed only after a successful password verification using the PWD_AUTH command. The AUTH0 configuration byte defines the protected area. It specifies the first page that the password mechanism protects. The level of protection can be configured using the PROT bit either for write protection or read/write protection. The PWD_AUTH command takes the password as parameter and, if successful, returns the password authentication acknowledge, PACK. By setting the AUTHLIM configuration bits to a value larger than 000b, the number of unsuccessful password verifications can be limited. Each unsuccessful authentication is then counted in a counter featuring anti-tearing support. After reaching the limit of unsuccessful attempts, the memory access specified in PROT, is no longer possible.
OptionalautoSelect?: booleantrue to enable auto-select, false to disable auto-select.
OptionalkeepRfField?: booleantrue to keep RF field after auth, false to disable RF field.
The password to be verified. The password must be a 4 bytes Buffer.
Optionaltimeout?: numberThe password authentication acknowledge, PACK
Detect Mifare Ultralight tag and return the tag infomation.
The tag infomation of detected tag.
// you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
await (async ultra => {
const { NxpMfuTypeName } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const NxpMfuType = await ultra.mfuDetectTagType()
console.log(`tagType = ${NxpMfuTypeName.get(NxpMfuType)}`)
})(vm.ultra)
Read multiple pages from start to end. For example if the start address is 0x03 and the end address is 0x07 then pages 0x03, 0x04, 0x05, 0x06 and 0x07 are returned. If the addressed page is outside of accessible area, NTAG21x replies a NAK.
end page address
Optionalkey?: BufferThe password to be verified. The password must be a 4 bytes Buffer.
start page address
Optionaltimeout?: number4 pages (16 bytes)
Get the mifare ultralight settings of actived emulator slot.
The GET_VERSION command is used to retrieve information on the NTAG family, the product version, storage size and other product data required to identify the specific NTAG21x. This command is also available on other NTAG products to have a common way of identifying products across platforms and evolution steps. The GET_VERSION command has no arguments and replies the version information for the specific NTAG21x type.
| Byte no. | Description | NTAG213 | NTAG215 | NTAG216 | Interpretation |
|---|---|---|---|---|---|
| 0 | fixed Header | 0x00 | 0x00 | 0x00 | |
| 1 | vendor ID | 0x04 | 0x04 | 0x04 | NXP Semiconductors |
| 2 | product type | 0x04 | 0x04 | 0x04 | NTAG |
| 3 | product subtype | 0x02 | 0x02 | 0x02 | 50 pF |
| 4 | major product version | 0x01 | 0x01 | 0x01 | 1 |
| 5 | minor product version | 0x00 | 0x00 | 0x00 | V0 |
| 6 | storage size | 0x0F | 0x11 | 0x13 | reference |
| 7 | protocol | 0x03 | 0x03 | 0x03 | ISO/IEC 14443-3 compliant |
The READ_CNT command is used to read out the current value of the NFC one-way counter of the Mifare Ultralight. The command has a single argument specifying the counter number and returns the 24-bit counter value of the corresponding counter. If the NFC_CNT_PWD_PROT bit is set to 1b the counter is password protected and can only be read with the READ_CNT command after a previous valid password authentication.
Optionaladdr?: numberThe counter addr to read. Must be 0, 1 or 2. Default is 2.
Optionalkey?: BufferThe password to be verified. The password must be a 4 bytes Buffer.
Read the dump of Mifare Ultralight tag.
Optionalend?: numberend page address
Optionalkey?: BufferThe key to read pages if tag is read protected.
Optionalstart?: numberstart page address
The dump of Mifare Ultralight tag.
Get the mifare ultralight emulator data of actived slot.
The mifare ultralight emulator data of actived slot.
Read 4 pages (16 bytes) from Mifare Ultralight
Optionalkey?: BufferThe password to be verified. The password must be a 4 bytes Buffer.
start page address
Optionaltimeout?: number4 pages (16 bytes)
The READ_SIG command returns an IC specific, 32-byte ECC signature, to verify NXP Semiconductors as the silicon vendor. The signature is programmed at chip production and cannot be changed afterwards.
Write new dump to the actived slot.
New dump to be write to actived slot.
// you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
await (async ultra => {
const dump = new Buffer(540) // Dump size of NTAG_213 is 540 bytes.
dump.set(Buffer.from('04689571fa5c648042480fe0', 'hex'))
dump.set(Buffer.from('040000ff00000000ffffffff', 'hex'), 524)
await ultra.mfuWriteEmuDump(dump)
})(vm.ultra)
Write 1 page (4 bytes) to Mifare Ultralight
4 bytes, the page data to be written.
Optionalkey?: BufferThe password to be verified. The password must be a 4 bytes Buffer.
start page address
// you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
await (async ultra => {
const { Buffer } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const data = await ultra.mfuWritePage({ start: 9, data: Buffer.from('00000000', 'hex') })
})(vm.ultra)
Abort the DFU procedure.
Please refer to nRF5 SDK: DFU Protocol for more infomation.
Create selected object.
Object type.
Object size in bytes.
crc32: Current CRC.offset: Current offset.Please refer to nRF5 SDK: DFU Protocol for more infomation.
Enter bootloader mode.
Execute selected object.
Please refer to nRF5 SDK: DFU Protocol for more infomation.
Retrieve firmware version.
addr: Firmware address in flash.len: Firmware length in bytes.type: Firmware type.version: Firmware version.Please refer to nRF5 SDK: DFU Protocol for more infomation.
// you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
await (async ultra => {
const { DfuFwId, DfuFwType } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
await ultra.cmdDfuEnter()
for (const fwId of [DfuFwId.BOOTLOADER, DfuFwId.APPLICATION, DfuFwId.SOFTDEVICE]) {
const { type, version, addr, len } = await ultra.cmdDfuGetFirmwareVersion(fwId)
console.log(`type = ${DfuFwType[type]}, version = ${version}, addr = 0x${addr.toString(16)}, len = ${len}`)
}
await ultra.cmdDfuAbort()
// type = BOOTLOADER, version = 1, addr = 0xf3000, len = 45056
// type = SOFTDEVICE, version = 7002000, addr = 0x1000, len = 159744
// type = APPLICATION, version = 1, addr = 0x27000, len = 222844
})(vm.ultra)
Retrieve hardware version.
part: Hardware part, from FICR register.ramSize: RAM size, in bytes.romPageSize: ROM flash page size, in bytes.romSize: ROM size, in bytes.variant: Hardware variant, from FICR register.Please refer to nRF5 SDK: DFU Protocol for more infomation.
// you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
await (async ultra => {
await ultra.cmdDfuEnter()
console.log(await ultra.cmdDfuGetHardwareVersion())
await ultra.cmdDfuAbort()
// {
// "part": "nRF52840",
// "variant": "AAD0",
// "romSize": 1048576,
// "ramSize": 262144,
// "romPageSize": 4096
// }
})(vm.ultra)
Retrieve MTU size.
The preferred MTU size on this request.
Please refer to nRF5 SDK: DFU Protocol for more infomation.
Request CRC of selected object.
crc32: Current CRC.offset: Current offset.Please refer to nRF5 SDK: DFU Protocol for more infomation.
Retrieve DFU protocol version.
Syntax and ID of this command is permanent. If protocol version changes other opcode may not be valid any more.
Protocol version.
Please refer to nRF5 SDK: DFU Protocol for more infomation.
Ping.
Ping ID that will be returned in response.
The received ID which is echoed back.
Please refer to nRF5 SDK: DFU Protocol for more infomation.
Select object.
Object type.
crc32: Current CRC.maxSize: Maximum size of selected object.offset: Current offset.Please refer to nRF5 SDK: DFU Protocol for more infomation.
Set receipt notification
This request configures the frequency of sending CRC responses after Write request commands.
If set to 0, then the CRC response is never sent after Write request. Otherwise, it is sent every prn'th Write request.
Please refer to nRF5 SDK: DFU Protocol for more infomation.
Upload DFU image.
The DFU image.
Please refer to nRF5 SDK: DFU Protocol for more infomation.
// you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
await (async ultra => {
const { DeviceModel } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const { default: DfuZip } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/dist/plugin/DfuZip.mjs/+esm')
const model = (await ultra.cmdGetDeviceModel()) === DeviceModel.ULTRA ? 'ultra' : 'lite'
const dfuZipUrl = `https://taichunmin.idv.tw/ChameleonUltra-releases/dev/${model}-dfu-app.zip`
const dfuZip = new DfuZip(new Buffer((await axios.get(dfuZipUrl, { responseType: 'arraybuffer' }))?.data))
const image = await dfuZip.getAppImage()
const imageGitVersion = await dfuZip.getGitVersion()
console.log({ type: image.type, headerSize: image.header.length, bodySize: image.body.length, gitVersion: imageGitVersion })
// {
// "type": "application",
// "headerSize": 141,
// "bodySize": 222844,
// "gitVersion": "v2.0.0-135-g3cadd47"
// }
const gitVersion = await ultra.cmdGetGitVersion()
console.log(`gitVersion = ${gitVersion}`) // Print: gitVersion = v2.0.0-135-g3cadd47
await ultra.cmdDfuEnter()
ultra.emitter.on('progress', console.log)
// {
// "func": "dfuUpdateObject",
// "offset": 0,
// "size": 222844,
// "type": 2
// }
await ultra.dfuUpdateImage(image)
ultra.emitter.removeListener('progress', console.log)
})(vm.ultra)
DFU: Upload object of image.
Object type.
Data.
Please refer to nRF5 SDK: DFU Protocol for more infomation.
Return true if ChameleonUltra is in DFU mode.
InternalRegister a plugin.
The plugin to register.
Optionaloption: anyThe option to pass to plugin.install().
The core library of
chameleon-ultra.js. You need to register exactly one adapter to theChameleonUltrainstance.See
You can learn how to use
@taichunmin/bufferfrom here.Example
Click here see how to use the SDK.
Example of import the library using
importorrequire:Example of import the library in Browser (place at the end of body):
After importing the SDK, you need to register exactly one adapter to the
ChameleonUltrainstance: