StaticVERSION_The supported version of SDK.
Automatically change the device mode to mode if the current device mode is not equal to mode.
Change device mode to tag reader or tag emulator.
The mode to be changed.
Get the animation mode of device while wake-up and sleep.
The animation mode of device.
async function run (ultra) {
const { AnimationMode } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const mode = await ultra.cmdGetAnimationMode()
console.log(AnimationMode[mode]) // 'FULL'
}
await run(vm.ultra) // you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
Get the button long press action of specified button.
The button to be get.
The button long press action of specified button.
async function run (ultra) {
const { ButtonAction, ButtonType } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const btnAction = await ultra.cmdGetButtonLongPressAction(ButtonType.BUTTON_A)
console.log(ButtonAction[btnAction]) // 'CLONE_IC_UID'
}
await run(vm.ultra) // you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
Get the button press action of specified button.
The button to be get.
The button press action of specified button.
async function run (ultra) {
const { ButtonAction, ButtonType } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const btnAction = await ultra.cmdGetButtonPressAction(ButtonType.BUTTON_A)
console.log(ButtonAction[btnAction]) // 'CYCLE_SLOT_INC'
}
await run(vm.ultra) // you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
Get current mode of device.
Current mode of device.
async function run (ultra) {
const { DeviceMode } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const deviceMode = await ultra.cmdGetDeviceMode()
console.log(DeviceMode[deviceMode]) // 'TAG'
}
await run(vm.ultra) // you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
Get the device is ChameleonUltra or ChameleonLite.
async function run (ultra) {
const { DeviceModel } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const model = await ultra.cmdGetDeviceModel()
console.log(DeviceModel[model]) // 'ULTRA'
}
await run(vm.ultra) // you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
Get the settings of device.
The settings of device.
async function run (ultra) {
const settings = await ultra.cmdGetDeviceSettings()
console.log(JSON.stringify(settings)
/**
* {
* "version": 5,
* "animation": 0,
* "buttonPressAction": [1, 2],
* "buttonLongPressAction": [3, 3],
* "blePairingMode": false,
* "blePairingKey": "123456"
* }
*/
}
await run(vm.ultra) // you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
Set the animation mode of device while wake-up and sleep.
The animation mode to be set.
Set the button long press action of specified button.
The button to be set.
The button long press action to be set.
async function run (ultra) {
const { ButtonAction, ButtonType } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
await ultra.cmdSetButtonLongPressAction(ButtonType.BUTTON_A, ButtonAction.CYCLE_SLOT_INC)
}
await run(vm.ultra) // you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
Set the button press action of specified button.
The button to be set.
The button press action to be set.
async function run (ultra) {
const { ButtonAction, ButtonType } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
await ultra.cmdSetButtonPressAction(ButtonType.BUTTON_A, ButtonAction.CYCLE_SLOT_INC)
}
await run(vm.ultra) // you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
Change the emulation tag type of specified slot.
async function run (ultra) {
const { Slot, TagType } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
await ultra.cmdSlotChangeTagType(Slot.SLOT_1, TagType.MIFARE_1024)
}
await run(vm.ultra) // you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
Delete the nick name of the slot
true if success, false if slot name is empty.
async function run (ultra) {
const { Slot, FreqType } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
console.log(await ultra.cmdSlotDeleteFreqName(Slot.SLOT_1, FreqType.HF)) // true
}
await run(vm.ultra) // you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
Get the active emulation tag slot of device.
The active slot of device.
async function run (ultra) {
const { Slot } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const slot = await ultra.cmdSlotGetActive()
console.log(Slot[slot]) // 'SLOT_1'
}
await run(vm.ultra) // you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
Get the nickname of specified freq type in specified slot.
The nickname of specified freq type in specified slot.
async function run (ultra) {
const { Slot, FreqType } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const name = await ultra.cmdSlotGetFreqName(Slot.SLOT_1, FreqType.HF)
console.log(name) // 'My Tag'
}
await run(vm.ultra) // you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
Get the slot info of all slots.
The slot info of all slots.
async function run (ultra) {
const slots = await ultra.cmdSlotGetInfo()
console.log(JSON.stringify(slots))
/**
* [
* { "hfTagType": 1001, "lfTagType": 100 },
* { "hfTagType": 1001, "lfTagType": 0 },
* { "hfTagType": 0, "lfTagType": 100 },
* { "hfTagType": 0, "lfTagType": 0 },
* { "hfTagType": 0, "lfTagType": 0 },
* { "hfTagType": 0, "lfTagType": 0 },
* { "hfTagType": 0, "lfTagType": 0 },
* { "hfTagType": 0, "lfTagType": 0 }
* ]
*/
}
await run(vm.ultra) // you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
Get enabled slots.
Enabled slots.
async function run (ultra) {
const enabledSlots = await ultra.cmdSlotGetIsEnable()
console.log(JSON.stringify(enabledSlots))
// [
// { "hf": true, "lf": true },
// { "hf": true, "lf": false },
// { "hf": false, "lf": true },
// { "hf": false, "lf": false },
// { "hf": false, "lf": false },
// { "hf": false, "lf": false },
// { "hf": false, "lf": false },
// { "hf": true, "lf": false }
// ]
}
await run(vm.ultra) // you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
Reset the emulation tag data of specified tag type in specified slot to default values.
async function run (ultra) {
const { Slot, TagType } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
await ultra.cmdSlotResetTagType(Slot.SLOT_1, TagType.MIFARE_1024)
}
await run(vm.ultra) // you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
The SlotSettings, hf tag data and lf tag data will be written to persistent storage. But the slot nickname is not affected by this command.
async function run (ultra) {
const { Buffer } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
await ultra.cmdMf1EmuWriteBlock(1, Buffer.alloc(16))
await ultra.cmdSlotSaveSettings()
}
await run(vm.ultra) // you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
Set the nickname of specified freq type in specified slot.
async function run (ultra) {
const { Slot, FreqType } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
await ultra.cmdSlotSetFreqName(Slot.SLOT_1, FreqType.HF, 'My Tag')
}
await run(vm.ultra) // you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
Write id of em410x tag to t55xx tag.
The id of em410x tag.
The new key of t55xx tag.
The keys to be checked. Maximum length is 125.
async function run (ultra) {
const { Buffer } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const id = Buffer.from('deadbeef88', 'hex')
// https://github.com/RfidResearchGroup/proxmark3/blob/master/client/dictionaries/t55xx_default_pwds.dic
const newKey = Buffer.from('20206666', 'hex')
const oldKeys = Buffer.from('5124364819920427', 'hex').chunk(4)
await ultra.cmdEm410xWriteToT55xx(id, newKey, oldKeys)
}
await run(vm.ultra) // you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
Send raw NfcA data to a tag and receive the response.
OptionalactivateSet true to activate RF field. If data is not empty or autoSelect is true, activateRfField will be set to true.
OptionalappendSet true to add CRC before sending data.
OptionalautoSet true to automatically select card before sending data.
OptionalcheckSet true to verify CRC of response and remove. If CRC of response is valid, CRC will be removed from response, otherwise will throw HF_ERR_CRC error.
Optionaldata?: BufferThe data to be send. If appendCrc is true, the maximum length of data is 62, otherwise is 64.
OptionaldataNumber of bits to send. Useful for send partial byte. dataBitLength is incompatible with appendCrc.
OptionalkeepSet true to keep the RF field active after sending.
Optionaltimeout?: numberDefault value is 1000 ms. Maximum timeout for reading tag response in ms while waitResponse is true.
OptionalwaitDefault value is true. Set false to skip reading tag response.
The response from tag.
Scan 14a tag, and return basic information. The device mode must be set to READER before using this command.
The basic infomation of scanned tag.
This command will throw an error if tag not scanned or any error occured.
async function run (ultra) {
const antiColl = _.first(await ultra.cmdHf14aScan())
console.log(_.mapValues(antiColl, val => val.toString('hex')))
// { uid: '040dc4420d2981', atqa: '4400', sak: '00', ats: ''}
}
await run(vm.ultra) // you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
Get the info composed of cmdHf14aScan() and cmdMf1TestNtLevel().
The info about 14a tag and mifare protocol.
async function run (ultra) {
const { Mf1PrngType } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const tag = _.first(await ultra.hf14aInfo())
console.log(tag.nxpTypeBySak) // 'MIFARE Classic 1K | Plus SE 1K | Plug S 2K | Plus X 2K'
console.log(Mf1PrngType[tag.prngType]) // 'WEAK'
console.log(_.mapValues(tag.antiColl, val => val.toString('hex')))
// { uid: 'dbe3d63d', atqa: '0400', sak: '08', ats: '' }
}
await run(vm.ultra) // you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
Get anti-collision data from actived slot.
The anti-collision data from actived slot.
async function run (ultra) {
const res = await ultra.cmdHf14aGetAntiCollData()
console.log(JSON.stringify(res))
// {
// "uid": { "type": "Buffer", "data": [222, 173, 190, 239] },
// "atqa": { "type": "Buffer", "data": [4, 0] },
// "sak": { "type": "Buffer", "data": [8] },
// "ats": { "type": "Buffer", "data": [] }
// }
}
await run(vm.ultra) // you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
Set the mifare anti-collision data of actived slot.
2 bytes, the new atqa to be set.
Optionalats?: BufferThe new ats to be set.
1 byte, the new sak to be set.
The new uid to be set.
async function run (ultra) {
const { Buffer } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
await ultra.cmdHf14aSetAntiCollData({
atqa: Buffer.from('0400', 'hex'),
sak: Buffer.from('08', 'hex'),
uid: Buffer.from('01020304', 'hex')
})
}
await run(vm.ultra) // you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
Magic auth helper function for mifare gen1a tag.
The callback function to be executed after auth.
The result of callback function.
Acquire the data from mifare darkside attack.
The target block.
The target key type.
true if this is the first attack.
The max sync count of darkside attack.
The data from mifare darkside attack.
async function run (ultra) {
const { Mf1KeyType, DarksideStatus } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const res1 = await ultra.cmdMf1AcquireDarkside(0, Mf1KeyType.KEY_A, true)
console.log(res1)
const res2 = {
status: `${DarksideStatus[res1.status]} (${res1.status})`,
...(res1.status !== DarksideStatus.OK ? {} : {
ar: res1.ar.toString('hex'),
ks: res1.ks.toString('hex'),
nr: res1.nr.toString('hex'),
nt: res1.nt.toString('hex'),
par: res1.par.toString('hex'),
uid: res1.uid.toString('hex'),
}),
}
console.log(res2)
// {
// "ar": "00000000",
// "ks": "0c0508080f04050a",
// "nr": "00000000",
// "nt": "b346fc3d",
// "par": "0000000000000000",
// "status": "OK (0)",
// "uid": "d3efed0c"
// }
}
await run(vm.ultra) // you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
If you want to use darkside attack to recover the key, you can use the following example code:
async function run (ultra) {
const { Buffer, DarksideStatus, Mf1KeyType } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const block = 0
const keyType = Mf1KeyType.KEY_A
const key = await Crypto1.darkside(
async attempt => {
const acquired = await ultra.cmdMf1AcquireDarkside(block, keyType, attempt === 0)
console.log(_.mapValues(acquired, buf => Buffer.isBuffer(buf) ? buf.toString('hex') : buf))
if (acquired.status === DarksideStatus.LUCKY_AUTH_OK) throw new Error('LUCKY_AUTH_OK')
if (acquired.status !== DarksideStatus.OK) throw new Error('card is not vulnerable to Darkside attack')
return acquired
},
async key => {
return await ultra.cmdMf1CheckBlockKey({ block, keyType, key })
},
)
console.log(`key founded: ${key.toString('hex')}`)
}
await run(vm.ultra) // you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
Use a known key to do the mifare nested attack.
The info of known key.
The block of known key.
The known key.
The key type of known key.
The info of target key to be attack.
The block of target key.
The key type of target key.
The result of mifare nested attack.
async function run (ultra) {
const { Buffer, Mf1KeyType } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const key = Buffer.from('FFFFFFFFFFFF', 'hex')
const res1 = await ultra.cmdMf1TestNtDistance({ block: 0, keyType: Mf1KeyType.KEY_A, key })
const res2 = await ultra.cmdMf1AcquireNested(
{ block: 0, keyType: Mf1KeyType.KEY_A, key },
{ block: 4, keyType: Mf1KeyType.KEY_A },
)
const res = {
uid: res1.uid.toString('hex'),
dist: res1.dist.toString('hex'),
atks: _.map(res2, item => ({
nt1: item.nt1.toString('hex'),
nt2: item.nt2.toString('hex'),
par: item.par,
}))
}
console.log(res)
// {
// uid: '877209e1',
// dist: '00000080',
// atks: [
// { nt1: '35141fcb', nt2: '40430522', par: 7 },
// { nt1: 'cff2b3ef', nt2: '825ba8ea', par: 5 },
// ]
// }
}
await run(vm.ultra) // you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
Use a known key to do the mifare static nested attack.
The info of known key.
The block of known key.
The known key.
The key type of known key.
The info of target key to be attack.
The block of target key.
The key type of target key.
The result of mifare static nested attack.
async function run (ultra) {
const { Buffer, Mf1KeyType } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const key = Buffer.from('FFFFFFFFFFFF', 'hex')
const res1 = await ultra.cmdMf1AcquireStaticNested({
block: 0,
keyType: Mf1KeyType.KEY_A,
key
}, {
block: 4,
keyType: Mf1KeyType.KEY_A
})
const res = {
uid: res1.uid.toString('hex'),
atks: _.map(res1.atks, item => ({ nt1: item.nt1.toString('hex'), nt2: item.nt2.toString('hex') })),
}
console.log(res)
// {
// uid: 'b908a16d',
// atks: [
// { nt1: '01200145', nt2: '81901975' },
// { nt1: '01200145', nt2: 'cdd400f3' },
// ],
// }
}
await run(vm.ultra) // you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
Check if the key is valid for specified block and key type.
The info of key to be checked.
The block of key to be checked.
The key to be checked.
The type of key to be checked.
true if the key is valid for specified block and key type.
async function run (ultra) {
const { Buffer, Mf1KeyType } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const key = Buffer.from('FFFFFFFFFFFF', 'hex')
console.log(await ultra.cmdMf1CheckBlockKey({
block: 0,
keyType: Mf1KeyType.KEY_A,
key,
})) // true
}
await run(vm.ultra) // you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
Given a list of keys, check which is the correct key A and key B of the sectors. If you want to check more than 83 keys, you can use mf1CheckKeysOfSectors().
The keys to be checked. Maximum length is 83.
The mask of sectors. 80 bits, 2 bits/sector, the first bit is key A, the second bit is key B, 0b1 represent to skip checking the key.
found: 80 bits, 2 bits/sector, the first bit is key A, the second bit is key B, 0b1 represent key is found.sectorKeys: 80 keys, 2 keys/sector, the first key is key A, the second key is key B. null represent key is not found.async function run (ultra) {
const { Buffer } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const mask = Buffer.from('00000000FFFFFFFFFFFF', 'hex')
const keys = Buffer.from('FFFFFFFFFFFF\n000000000000\nA0A1A2A3A4A5\nD3F7D3F7D3F7', 'hex').chunk(6)
const tsStart = Date.now()
const result = await ultra.cmdMf1CheckKeysOfSectors({ keys, mask })
console.log(`Time: ${Date.now() - tsStart}ms`)
const replacer = function (k, v) { return Buffer.isBuffer(this[k]) ? this[k].toString('hex') : v }
console.log(JSON.stringify(result, replacer, 2))
}
// {
// "found": "ffffffff000000000000",
// "sectorKeys": [
// "ffffffffffff", "ffffffffffff", "ffffffffffff", "ffffffffffff",
// "ffffffffffff", "ffffffffffff", "ffffffffffff", "ffffffffffff",
// "ffffffffffff", "ffffffffffff", "ffffffffffff", "ffffffffffff",
// "ffffffffffff", "ffffffffffff", "ffffffffffff", "ffffffffffff",
// "ffffffffffff", "ffffffffffff", "ffffffffffff", "ffffffffffff",
// "ffffffffffff", "ffffffffffff", "ffffffffffff", "ffffffffffff",
// "ffffffffffff", "ffffffffffff", "ffffffffffff", "ffffffffffff",
// "ffffffffffff", "ffffffffffff", "ffffffffffff", "ffffffffffff",
// null, null, null, null,
// null, null, null, null,
// null, null, null, null,
// null, null, null, null,
// null, null, null, null,
// null, null, null, null,
// null, null, null, null,
// null, null, null, null,
// null, null, null, null,
// null, null, null, null,
// null, null, null, null,
// null, null, null, null,
// ]
// }
await run(vm.ultra) // you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
Get the data of mifare MFKey32 detections.
The start log of detections to be get.
The mifare MFKey32 detections.
async function run (ultra) {
const logs = await ultra.cmdMf1GetDetectionLogs(0)
console.log(logs)
/**
* {
* "block": 2,
* "isKeyB": 1,
* "isNested": 0,
* "uid": Buffer.from('65535d33', 'hex'),
* "nt": Buffer.from('cb7b9ed9', 'hex'),
* "nr": Buffer.from('5a8ffec6', 'hex'),
* "ar": Buffer.from('5c7c6f89', 'hex'),
* }
*/
}
await run(vm.ultra) // you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
Get the mifare settings of actived slot.
The mifare settings of actived slot.
async function run (ultra) {
const mf1Settings = await ultra.cmdMf1GetEmuSettings()
console.log(JSON.stringify(mf1Settings))
/**
* {
* "detection": false,
* "gen1a": false,
* "gen2": false,
* "antiColl": false,
* "write": 0
* }
*/
}
await run(vm.ultra) // you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
Get the mifare write mode of actived slot.
The mifare write mode of actived slot.
Read block data from a mifare tag.
The block to be read and the key info of the block.
The block to be read.
The key of the block.
The key type of the block.
The block data read from a mifare tag.
async function run (ultra) {
const { Buffer, Mf1KeyType } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const key = Buffer.from('FFFFFFFFFFFF', 'hex')
const block1 = await ultra.cmdMf1ReadBlock({
block: 1,
keyType: Mf1KeyType.KEY_A,
key,
})
console.log(block1.toString('hex')) // '00000000000000000000000000000000'
}
await run(vm.ultra) // you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
Set the mifare write mode of actived slot.
The mifare write mode of actived slot.
Dectect the nt distance of mifare protocol.
The info of known key.
The block of known key.
The known key.
The key type of known key.
The nt distance of mifare protocol.
async function run (ultra) {
const { Buffer, Mf1KeyType } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const key = Buffer.from('FFFFFFFFFFFF', 'hex')
const res1 = await ultra.cmdMf1TestNtDistance({ block: 0, keyType: Mf1KeyType.KEY_A, key })
const res2 = await ultra.cmdMf1AcquireNested(
{ block: 0, keyType: Mf1KeyType.KEY_A, key },
{ block: 4, keyType: Mf1KeyType.KEY_A },
)
const res = {
uid: res1.uid.toString('hex'),
dist: res1.dist.toString('hex'),
atks: _.map(res2, item => ({
nt1: item.nt1.toString('hex'),
nt2: item.nt2.toString('hex'),
par: item.par,
}))
}
console.log(res)
// {
// uid: '877209e1',
// dist: '00000080',
// atks: [
// { nt1: '35141fcb', nt2: '40430522', par: 7 },
// { nt1: 'cff2b3ef', nt2: '825ba8ea', par: 5 },
// ]
// }
}
await run(vm.ultra) // you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
Check the nt level of mifare protocol.
The nt level of mifare protocol.
async function run (ultra) {
const { Mf1PrngType } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
console.log(Mf1PrngType[await ultra.cmdMf1TestPrngType()]) // 'WEAK'
}
await run(vm.ultra) // you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
MIFARE Classic manipulate value block
X (0 ~ 2147483647) from src to dstX (0 ~ 2147483647) from src to dstThe key info of src block.
The block of src block.
The key of src block.
The key type of src block.
The operator of value block.
The operand of value block.
The key info of dst block.
The block of dst block.
The key of dst block.
The key type of dst block.
async function run (ultra) {
const { Buffer, Mf1KeyType, Mf1VblockOperator } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const key = Buffer.from('FFFFFFFFFFFF', 'hex')
const src = { block: 4, keyType: Mf1KeyType.KEY_A, key }
await ultra.mf1VblockSetValue(src, { value: 2 })
console.log(await ultra.mf1VblockGetValue(src))
await ultra.cmdMf1VblockManipulate(
{ block: 4, keyType: Mf1KeyType.KEY_A, key },
Mf1VblockOperator.DECREMENT, 1,
{ block: 4, keyType: Mf1KeyType.KEY_A, key },
)
console.log(await ultra.mf1VblockGetValue(src))
}
await run(vm.ultra) // you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
Write data to a mifare tag.
The block to be written and the key info of the block.
The block to be written.
The block data to be written.
The key of the block.
The key type of the block.
async function run (ultra) {
const { Buffer, Mf1KeyType } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const key = Buffer.from('FFFFFFFFFFFF', 'hex')
const block1 = Buffer.from('00000000000000000000000000000000', 'hex')
await ultra.cmdMf1WriteBlock({
block: 1,
keyType: Mf1KeyType.KEY_A,
key,
data: block1,
})
}
await run(vm.ultra) // you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
Mifare Classic check keys of sectors.
Optionalchunkkeys will be chunked by this size.
The keys to be checked.
Optionalmask?: BufferThe mask of sectors. 80 bits, 2 bits/sector, the first bit is key A, the second bit is key B, 0b1 represent to skip checking the key.
OptionalmaxThe max sectors to be check.
OptionalonThe callback function to be invoked before checking every chunk of keys.
Given a list of keys, check which is the correct key A and key B of the sector.
The sector number to be checked.
The keys dictionary.
The Key A and Key B of the sector.
async function run (ultra) {
const { Buffer } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const keys = Buffer.from('FFFFFFFFFFFF\n000000000000\nA0A1A2A3A4A5\nD3F7D3F7D3F7', 'hex').chunk(6)
const sectorKey = await ultra.mf1CheckSectorKeys(0, keys)
console.log(_.mapValues(sectorKey, key => key.toString('hex')))
// { "96": "ffffffffffff", "97": "ffffffffffff" }
}
await run(vm.ultra) // you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
Check acl bytes of ACL, block or sector.
Data of ACL, block or sector.
true if the acl bytes is valid, false otherwise.
async function run (ultra) {
const { Buffer } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
console.log(ultra.mf1IsValidAcl(Buffer.from('ff078069', 'hex'))) // true
}
await run(vm.ultra) // you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
Read the sector data of Mifare Classic by given keys.
The sector number to be read.
The keys dictionary.
The sector data and the read status of each block.
async function run (ultra) {
const { Buffer, Mf1KeyType } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const keys = Buffer.from('FFFFFFFFFFFF\n000000000000\nA0A1A2A3A4A5\nD3F7D3F7D3F7', 'hex').chunk(6)
const { data, success } = await ultra.mf1ReadSectorByKeys(0, keys)
console.log({ data: data.toString('hex'), success })
// { "data": "...", "success": [true, true, true, true] }
}
await run(vm.ultra) // you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
Get value from opts block (MIFARE Classic value block)
The key info of opts block.
The block of opts block.
The key of opts block.
The key type of opts block.
The value and address of opts block.
async function run (ultra) {
const { Buffer, Mf1KeyType, Mf1VblockOperator } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const key = Buffer.from('FFFFFFFFFFFF', 'hex')
const src = { block: 4, keyType: Mf1KeyType.KEY_A, key }
await ultra.mf1VblockSetValue(src, { value: 2 })
console.log(await ultra.mf1VblockGetValue(src))
}
await run(vm.ultra) // you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
Set value X (-2147483647 ~ 2147483647) to dst block (MIFARE Classic value block)
The key info of dst block.
The block of dst block.
The key of dst block.
The key type of dst block.
The value and address to be set.
Optionaladr?: numberThe address to be set. Default is dst.block.
Optionalvalue?: numberThe value to be set. Default is 0.
async function run (ultra) {
const { Buffer, Mf1KeyType, Mf1VblockOperator } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const key = Buffer.from('FFFFFFFFFFFF', 'hex')
const src = { block: 4, keyType: Mf1KeyType.KEY_A, key }
await ultra.mf1VblockSetValue(src, { value: 2 })
console.log(await ultra.mf1VblockGetValue(src))
}
await run(vm.ultra) // you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
Write the sector data of Mifare Classic by given keys.
The sector number to be written.
The key dictionary.
Sector data
the write status of each block.
async function run (ultra) {
const { Buffer } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const keys = Buffer.from('FFFFFFFFFFFF\n000000000000\nA0A1A2A3A4A5\nD3F7D3F7D3F7', 'hex').chunk(6)
const data = Buffer.concat([
Buffer.from('00000000000000000000000000000000', 'hex'),
Buffer.from('00000000000000000000000000000000', 'hex'),
Buffer.from('00000000000000000000000000000000', 'hex'),
Buffer.from('ffffffffffffff078069ffffffffffff', 'hex'),
])
const { success } = await ultra.mf1WriteSectorByKeys(1, keys, data)
console.log(success)
// [true, true, true, true]
}
await run(vm.ultra) // you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
Staticmf1Read the counter and tearing of actived slot.
NTAG21x features a NFC counter function. The NFC counter is enabled or disabled with the NFC_CNT_EN bit. This function enables NTAG21x to automatically increase the 24 bit counter value, triggered by the first valid READ or FAST_READ command after the NTAG21x tag is powered by an RF field.
The address of the counter.
Get the signature of actived slot. NTAG21x features a cryptographically supported originality check. The signature is used to verify with a certain confidence that the tag is using an IC manufactured by NXP Semiconductors. The signature digital is based on standard Elliptic Curve Cryptography (curve name secp128r1), according to the ECDSA algorithm.
The signature of actived slot.
Get the version of actived slot. The version is used to retrieve information on the NTAG family, the product version, storage size and other product data required to identify the specific NTAG21x.
The version of actived slot.
Get the magic mode of actived slot.
If the actived slot is in magic mode, all read and write protection is bypassed.
The magic mode of actived slot.
Set the counter and reset tearing of actived slot.
NTAG21x features a NFC counter function. The NFC counter is enabled or disabled with the NFC_CNT_EN bit. This function enables NTAG21x to automatically increase the 24 bit counter value, triggered by the first valid READ or FAST_READ command after the NTAG21x tag is powered by an RF field.
Optionaladdr?: numberThe address of the counter.
Optionalcounter?: numberThe counter to be write. The counter must be a 24-bit unsigned integer.
Optionalresettrue to reset tearing.
Set the signature of actived slot. NTAG21x features a cryptographically supported originality check. The signature is used to verify with a certain confidence that the tag is using an IC manufactured by NXP Semiconductors. The signature digital is based on standard Elliptic Curve Cryptography (curve name secp128r1), according to the ECDSA algorithm.
The signature. The signature must be a 32 bytes Buffer.
async function run (ultra) {
const { Buffer } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const signature = Buffer.from('0000000000000000000000000000000000000000000000000000000000000000', 'hex')
await ultra.cmdMfuSetEmuSignature(signature)
}
await run(vm.ultra) // you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
Set the version of actived slot. The version is used to retrieve information on the NTAG family, the product version, storage size and other product data required to identify the specific NTAG21x.
The version of actived slot.
async function run (ultra) {
const { Buffer } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
await ultra.cmdMfuSetEmuVersion(Buffer.from('0004040201001103', 'hex'))
}
await run(vm.ultra) // you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
Set the magic mode of actived slot.
If the actived slot is in magic mode, all read and write protection is bypassed.
The magic mode of actived slot.
Assert the tag type of actived slot is Mifare Ultralight like. Throw an error if the tag type is not Mifare Ultralight like.
The tag type of actived slot.
async function run (ultra) {
const { TagType } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const tagType = await ultra.mfuAssertEmuTagType()
console.log(TagType[tagType]) // '040dc445420d2981e7480000e1100600'
}
await run(vm.ultra) // you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
A protected memory area can be accessed only after a successful password verification using the PWD_AUTH command. The AUTH0 configuration byte defines the protected area. It specifies the first page that the password mechanism protects. The level of protection can be configured using the PROT bit either for write protection or read/write protection. The PWD_AUTH command takes the password as parameter and, if successful, returns the password authentication acknowledge, PACK. By setting the AUTHLIM configuration bits to a value larger than 000b, the number of unsuccessful password verifications can be limited. Each unsuccessful authentication is then counted in a counter featuring anti-tearing support. After reaching the limit of unsuccessful attempts, the memory access specified in PROT, is no longer possible.
Optionalautotrue to enable auto-select, false to disable auto-select.
Optionalkeeptrue to keep RF field after auth, false to disable RF field.
The password to be verified. The password must be a 4 bytes Buffer.
Optionaltimeout?: numberThe password authentication acknowledge, PACK
Detect Mifare Ultralight tag and return the tag infomation.
The tag infomation of detected tag.
async function run (ultra) {
const { MfuTagTypeName } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const MfuTagType = await ultra.mfuDetectTagType()
console.log(`tagType = ${MfuTagTypeName.get(MfuTagType)}`)
}
await run(vm.ultra) // you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
Read multiple pages from start to end. For example if the start address is 0x03 and the end address is 0x07 then pages 0x03, 0x04, 0x05, 0x06 and 0x07 are returned. If the addressed page is outside of accessible area, NTAG21x replies a NAK.
end page address
Optionalkey?: BufferThe password to be verified. The password must be a 4 bytes Buffer.
start page address
Optionaltimeout?: number4 pages (16 bytes)
MF0ICU1 MIFARE Ultralight contactless single-ticket IC
async function run (ultra) {
const data = await ultra.mfuFastReadPages({ start: 0, end: 3 })
console.log(data.toString('hex')) // '047c79896cb62a8171480000e1103e00'
}
await run(vm.ultra) // you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
Get the mifare ultralight settings of actived emulator slot.
The GET_VERSION command is used to retrieve information on the NTAG family, the product version, storage size and other product data required to identify the specific NTAG21x. This command is also available on other NTAG products to have a common way of identifying products across platforms and evolution steps. The GET_VERSION command has no arguments and replies the version information for the specific NTAG21x type.
Optionaltimeout?: number| Byte no. | Description | NTAG213 | NTAG215 | NTAG216 | Interpretation |
|---|---|---|---|---|---|
| 0 | fixed Header | 0x00 | 0x00 | 0x00 | |
| 1 | vendor ID | 0x04 | 0x04 | 0x04 | NXP Semiconductors |
| 2 | product type | 0x04 | 0x04 | 0x04 | NTAG |
| 3 | product subtype | 0x02 | 0x02 | 0x02 | 50 pF |
| 4 | major product version | 0x01 | 0x01 | 0x01 | 1 |
| 5 | minor product version | 0x00 | 0x00 | 0x00 | V0 |
| 6 | storage size | 0x0F | 0x11 | 0x13 | reference |
| 7 | protocol | 0x03 | 0x03 | 0x03 | ISO/IEC 14443-3 compliant |
The READ_CNT command is used to read out the current value of the NFC one-way counter of the Mifare Ultralight. The command has a single argument specifying the counter number and returns the 24-bit counter value of the corresponding counter. If the NFC_CNT_PWD_PROT bit is set to 1b the counter is password protected and can only be read with the READ_CNT command after a previous valid password authentication.
Optionaladdr?: numberThe counter addr to read. Must be 0, 1 or 2. Default is 2.
Optionalkey?: BufferThe password to be verified. The password must be a 4 bytes Buffer.
Read the dump of Mifare Ultralight tag.
Optionalend?: numberend page address
Optionalkey?: BufferThe key to read pages if tag is read protected.
Optionalstart?: numberstart page address
The dump of Mifare Ultralight tag.
Read 4 pages (16 bytes) from Mifare Ultralight
Optionalkey?: BufferThe password to be verified. The password must be a 4 bytes Buffer.
start page address
Optionaltimeout?: number4 pages (16 bytes)
MF0ICU1 MIFARE Ultralight contactless single-ticket IC
async function run (ultra) {
const data = await ultra.mfuReadPages({ start: 0 })
console.log(data.toString('hex')) // '040dc445420d2981e7480000e1100600'
}
await run(vm.ultra) // you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
Write new dump to the actived slot.
New dump to be write to actived slot.
async function run (ultra) {
const dump = new Buffer(540) // Dump size of NTAG_213 is 540 bytes.
dump.set(Buffer.from('04689571fa5c648042480fe0', 'hex'))
dump.set(Buffer.from('040000ff00000000ffffffff', 'hex'), 524)
await ultra.mfuWriteEmuDump(dump)
}
await run(vm.ultra) // you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
Write 1 page (4 bytes) to Mifare Ultralight
4 bytes, the page data to be written.
Optionalkey?: BufferThe password to be verified. The password must be a 4 bytes Buffer.
start page address
MF0ICU1 MIFARE Ultralight contactless single-ticket IC
async function run (ultra) {
const { Buffer } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const data = await ultra.mfuWritePage({ start: 9, data: Buffer.from('00000000', 'hex') })
}
await run(vm.ultra) // you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
Abort the DFU procedure.
Please refer to nRF5 SDK: DFU Protocol for more infomation.
async function run (ultra) {
await ultra.cmdDfuEnter()
await ultra.cmdDfuAbort()
}
await run(vm.ultra) // you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
Create selected object.
Object type.
Object size in bytes.
crc32: Current CRC.offset: Current offset.Please refer to nRF5 SDK: DFU Protocol for more infomation.
Execute selected object.
Please refer to nRF5 SDK: DFU Protocol for more infomation.
Retrieve firmware version.
addr: Firmware address in flash.len: Firmware length in bytes.type: Firmware type.version: Firmware version.Please refer to nRF5 SDK: DFU Protocol for more infomation.
async function run (ultra) {
const { DfuFwId, DfuFwType } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
await ultra.cmdDfuEnter()
for (const fwId of [DfuFwId.BOOTLOADER, DfuFwId.APPLICATION, DfuFwId.SOFTDEVICE]) {
const { type, version, addr, len } = await ultra.cmdDfuGetFirmwareVersion(fwId)
console.log(`type = ${DfuFwType[type]}, version = ${version}, addr = 0x${addr.toString(16)}, len = ${len}`)
}
await ultra.cmdDfuAbort()
// type = BOOTLOADER, version = 1, addr = 0xf3000, len = 45056
// type = SOFTDEVICE, version = 7002000, addr = 0x1000, len = 159744
// type = APPLICATION, version = 1, addr = 0x27000, len = 222844
}
await run(vm.ultra) // you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
Retrieve hardware version.
part: Hardware part, from FICR register.ramSize: RAM size, in bytes.romPageSize: ROM flash page size, in bytes.romSize: ROM size, in bytes.variant: Hardware variant, from FICR register.Please refer to nRF5 SDK: DFU Protocol for more infomation.
async function run (ultra) {
await ultra.cmdDfuEnter()
console.log(await ultra.cmdDfuGetHardwareVersion())
await ultra.cmdDfuAbort()
// {
// "part": "nRF52840",
// "variant": "AAD0",
// "romSize": 1048576,
// "ramSize": 262144,
// "romPageSize": 4096
// }
}
await run(vm.ultra) // you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
Retrieve MTU size.
The preferred MTU size on this request.
Please refer to nRF5 SDK: DFU Protocol for more infomation.
async function run (ultra) {
await ultra.cmdDfuEnter()
console.log(await ultra.cmdDfuGetMtu()) // Print: 1025
await ultra.cmdDfuAbort()
}
await run(vm.ultra) // you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
Request CRC of selected object.
crc32: Current CRC.offset: Current offset.Please refer to nRF5 SDK: DFU Protocol for more infomation.
Retrieve DFU protocol version.
Syntax and ID of this command is permanent. If protocol version changes other opcode may not be valid any more.
Protocol version.
Please refer to nRF5 SDK: DFU Protocol for more infomation.
async function run (ultra) {
await ultra.cmdDfuEnter()
console.log(await ultra.cmdDfuGetProtocol()) // Print: 1
await ultra.cmdDfuAbort()
}
await run(vm.ultra) // you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
Ping.
Ping ID that will be returned in response.
The received ID which is echoed back.
Please refer to nRF5 SDK: DFU Protocol for more infomation.
async function run (ultra) {
await ultra.cmdDfuEnter()
console.log(await ultra.cmdDfuPing(1)) // Print: 1
await ultra.cmdDfuAbort()
}
await run(vm.ultra) // you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
Select object.
Object type.
crc32: Current CRC.maxSize: Maximum size of selected object.offset: Current offset.Please refer to nRF5 SDK: DFU Protocol for more infomation.
Set receipt notification
This request configures the frequency of sending CRC responses after Write request commands.
If set to 0, then the CRC response is never sent after Write request. Otherwise, it is sent every prn'th Write request.
Please refer to nRF5 SDK: DFU Protocol for more infomation.
Write selected object.
Data.
Please refer to nRF5 SDK: DFU Protocol for more infomation.
Upload DFU image.
The DFU image.
Please refer to nRF5 SDK: DFU Protocol for more infomation.
async function run (ultra) {
const { DeviceModel } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/+esm')
const { default: DfuZip } = await import('https://cdn.jsdelivr.net/npm/chameleon-ultra.js@0/dist/plugin/DfuZip.mjs/+esm')
const model = (await ultra.cmdGetDeviceModel()) === DeviceModel.ULTRA ? 'ultra' : 'lite'
const dfuZipUrl = `https://taichunmin.idv.tw/ChameleonUltra-releases/dev/${model}-dfu-app.zip`
const dfuZip = new DfuZip(new Buffer((await axios.get(dfuZipUrl, { responseType: 'arraybuffer' }))?.data))
const image = await dfuZip.getAppImage()
const imageGitVersion = await dfuZip.getGitVersion()
console.log({ type: image.type, headerSize: image.header.length, bodySize: image.body.length, gitVersion: imageGitVersion })
// {
// "type": "application",
// "headerSize": 141,
// "bodySize": 222844,
// "gitVersion": "v2.0.0-135-g3cadd47"
// }
const gitVersion = await ultra.cmdGetGitVersion()
console.log(`gitVersion = ${gitVersion}`) // Print: gitVersion = v2.0.0-135-g3cadd47
await ultra.cmdDfuEnter()
ultra.emitter.on('progress', console.log)
// {
// "func": "dfuUpdateObject",
// "offset": 0,
// "size": 222844,
// "type": 2
// }
await ultra.dfuUpdateImage(image)
ultra.emitter.removeListener('progress', console.log)
}
await run(vm.ultra) // you can run in DevTools of https://taichunmin.idv.tw/chameleon-ultra.js/test.html
DFU: Upload object of image.
Object type.
Data.
Please refer to nRF5 SDK: DFU Protocol for more infomation.
Return true if DFU use slip encode/decode.
Please refer to SLIP and nRF5 SDK: SLIP library for more information.
InternalRegister a hook.
The hook name.
The function to register.
InternalInvoke a hook with context.
The hook name.
The context will be passed to every middleware.
Optionalnext: MiddlewareComposeFnThe next middleware function.
The return value depent on the middlewares
InternalRegister a plugin.
The plugin to register.
Optionaloption: anyThe option to pass to plugin.install().
The core library of
chameleon-ultra.js. You need to register exactly one adapter to theChameleonUltrainstance.See
You can learn how to use
@taichunmin/bufferfrom here.Example
Click here to expend import example.
Example of import the library using
importorrequire:Example of import the library in Browser (place at the end of body):
After importing the SDK, you need to register exactly one adapter to the
ChameleonUltrainstance: