mirror of
https://github.com/RfidResearchGroup/ChameleonUltra.git
synced 2026-10-23 00:02:00 +00:00
Milan DavídekandClaude Sonnet 4.6
fcb6eb4718
Jablotron uses differential biphase (inverted) at RF/64, 64-bit frames:
bits 0-15: 0xFFFF preamble
bits 16-55: 40-bit data (5 bytes), bit 16 must be 0
bits 56-63: 8-bit checksum = (sum of data bytes) XOR 0x3A
Firmware:
- rfid/nfctag/lf/protocols/jablotron.c - encoder/decoder codec
- rfid/nfctag/lf/utils/diphase.c - inverted-biphase state machine
(shared util, reusable by other diphase protocols)
- rfid/reader/lf/lf_jablotron_data.c - GPIO-interval reader path
- app_cmd.c: JABLOTRON_SCAN, JABLOTRON_WRITE_TO_T55XX,
JABLOTRON_SET_EMU_ID, JABLOTRON_GET_EMU_ID
- tag_base_type.h: TAG_TYPE_JABLOTRON enum
- t55xx.h: T5577_JABLOTRON_CONFIG (DIPHASE modulation, RF/64)
- lf_tag_em.c: load callback, factory-default data, save callback
Python CLI (software/script/):
- lf jablotron read - scan a real tag
- lf jablotron write --id - clone onto T55xx
- lf jablotron econfig -s N --id - set emulator ID on a slot
- hw slot list shows Jablotron ID and decimal card number
Python test (software/script/tests/test_jablotron_modulator.py):
Pure-Python round-trip validator that reimplements the modulator and
diphase decoder, expands PWM entries to an edge stream, and confirms
the decoded data matches the input. Regression guard for both the
firmware's double-frame encoding and the single-frame variant.
Notable PWM design choices:
- Constant-level diphase encoding uses the same PAC pattern:
CC=0 for LOW, CC=counter_top+1 for HIGH. counter_top=31 gives
exactly 32 carrier cycles per half-bit at NRF_PWM_CLK_125kHz.
- The 64-bit frame is encoded twice in the 256-entry PWM buffer with
the internal level variable persisting between the two passes.
This is required for clean PWM looping: a single 64-bit diphase
frame with an odd number of zero bits ends at a level opposite the
starting level, leaving no transition at the loop boundary where
the reader expects one. Encoding twice guarantees a continuous
diphase stream regardless of the data's zero-count parity.
Reference: Proxmark3 cmdlfjablotron.c
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
ChameleonUltra Authorized Distributors
Lyon, France: Lab401
Santa Ana, United States: Hackerwarehouse
Hastings, UK: KSEC
Montreal, Canada: TechSecurityTools
Shenzhen, China: Sneaktechnology
Guangdong, China: MTools Tec
Lazada One, Singapore: Aliexpress by RRG
What is it and how to use ?
Read the available documentation.
Compatible applications
Videos
Beware some of the instructions might have changed since recording, check the current documentation when in doubt!
- Downloading and compiling the official CLI
- Downloading ChameleonUltraGUI
- ChameleonUltraGUI features overview
- Using ChameleonUltraGUI and the Chameleon Ultra
- MTools BLE - How to clone a card with ChameleonUltra
Official channels
Where do you find the community?
- RFID Hacking community discord server
- Software/chameleon-dev for firmware and clients development discussions
- Devices/chameleon-ultra for usage discussions
- GameTec_live discord server