Terminal Commands

ChameleonMini RevE Rebooted Serial Interface

If the ChameleonMini is connected via USB it can be set up and controlled with a simple terminal or TeraTerm. Alternately, see Tools-and-utilities for other GUI-based methods of communicating with the device over serial USB. The rebootedGUI offers an embedded terminal that allows the same interaction.

For easier use of the command-line using a terminal software the local-echo functionality should be activated, to be able to see what is typed into the chameleon. When using TeraTerm, this can be achieved by selecting Setup -> Terminal and check "Local Echo".

Command Set

The current firmware supports the following commands:

• VERSION
• CONFIG
• UID
• ATQA
• SAK
• READONLY
• UPLOAD
• DOWNLOAD
• RESET
• UPGRADE
• MEMSIZE
• UIDSIZE
• BUTTON
• SETTING
• CLEAR
• HELP
• RSSI
• DETECTION
• SPI_FLASHINFO

NOTE: Original (Chameleon-new-1.0) and/or older firmwares commands all end with MYsuffix. If these doesn't work, try adding MY at the end of them all.

Command return codes

Subsequent to any command sent, the Chameleon responds with a status number and a corresponding status message, separated by a colon and terminated with a carriage return and line feed (CR+LF, 0D+0A hexadecimal). Status numbers are of a three-digit decimal format with the first digit showing the severity of the answer. Status numbers beginning with a '1' denote an informational item and those beginning with a '2' denote an error.

Response	Description
100:OK	The command has been successfully executed
101:OK WITH TEXT	The command has been successfully executed and this response is appended with an additional line of information, terminated with CR+LF
110:WAITING FOR XMODEM	The Chameleon is waiting for an XMODEM connection to be established
120:FALSE	The request is answered with false
121:TRUE	The request is answered with true
200:UNKNOWN COMMAND	This command is unknown to the Chameleon
201:INVALID COMMAND USAGE	This action is not supported by this command
202:INVALID PARAMETER	The format or value of the given parameter value is invalid
203:TIMEOUT	The timeout of the currently active command has expired

---

VERSION

^Top

Requests version information of the current firmware.

Syntax: version?
101:OK WITH TEXT
ChameleonMini-new-1.0

CONFIG

^Top

Get/Set the configuration of the current slot.
Note: The ChameleonMini has 8 possible slots (1-8)

Returns a list of the available configurations (see Configurations)
Syntax: config
101:OK WITH TEXT
NONE,MF_ULTRALIGHT,MF_CLASSIC_1K,MF_CLASSIC_4K

Set the configuration of the current slot as a MIFARE classic 4K emulation.
Syntax: config=MF_CLASSIC_4K
101:OK WITH TEXT

Returns the configuration of the current slot.
Syntax: config?
101:OK WITH TEXT
MF_CLASSIC_4K

UID

^Top

Returns the UID of a card in the current slot.
Syntax: uid?
101:OK WITH TEXT
9E63BC03A

Sets a new UID, passed in hexadecimal notation.
Syntax: uid=9E63BC03A
101:OK WITH TEXT

ATQA

^Top

Returns the ATQA of a card in the current slot.
Syntax: atqa?
101:OK WITH TEXT
0044

Sets a new ATQA, passed in hexadecimal notation. Must be four (4) digits.
Syntax: atqa=0004
100:OK

SAK

^Top

Returns the SAK of a card in the current slot.
Syntax: sak?
101:OK WITH TEXT
04

Sets a new SAK, passed in hexadecimal notation. Must be two (2) digits.
Syntax: sak=04
100:OK

READONLY

^Top

Configures the read-only mode to the internal memory. Activates (1) or deactivates (0) the read-only mode (Any writing to the memory is silently ignored.)

Print the possible states.
Syntax: readonly
101:OK WITH TEXT
1,0

Returns the current state of the read-only mode.
Syntax: readonly?
101:OK WITH TEXT
0

Activate the read-only mode
Syntax: readonly=1
100:OK

UPLOAD

^Top

Waits for an XModem connection in order to upload a new virtualized card into the currently selected slot, with a size up to the current memory size.

Syntax: upload<ENTER>
See also: This listing of stock tag/card dumps which can be used with this command and the device.

DOWNLOAD

^Top

Waits for an XModem connection in order to download a virtualized card with the current memory size.

Syntax: download<ENTER>

RESET

^Top

Reboots the Chameleon, i.e., power down and subsequent power-up. Note: A reset usually requires a new Terminal session.

Syntax: reset<ENTER>

UPGRADE

^Top

Sets the Chameleon into firmware upgrade mode (DFU). This command can be used instead of holding the BUTTON while power-on to trigger the bootloader.

Syntax: upgrade<ENTER>

MEMSIZE

^Top

Returns the memory size occupied by the current configuration in Byte.

Syntax: memsize?
101:OK WITH TEXT
4096

UIDSIZE

^Top

Returns the UID size of the currently selected card type in Byte.

Syntax: uidsize?
101:OK WITH TEXT
4

BUTTON

^Top

Get/Set the action for pressing the button shortly.

Returns a list of the available button actions.
Syntax: button
101:OK WITH TEXT
NONE,RANDOM_UID,UID_LEFT_INCREMENT,UID_RIGHT_INCREMENT,UID_LEFT_DECREMENT,UID_RIGHT_DECREMENT,SWITCHCARD

Returns the currently set action for pressing the right button shortly. DEFAULT: SWITCHCARD.
Syntax: button?
101:OK WITH TEXT
SWITCHCARD

Sets the action for pressing the button shortly.
Syntax: button=random_uid

SETTING

^Top

Get/Set the active slot (number between 1 and 8) for the card/reader emulation (see Settings).

Returns the currently activated slot.
Syntax: setting?
101:OK WITH TEXT
NO.1

Sets the active slot to 2
Syntax: setting=2
100:OK

CLEAR

^Top

Clears the content of the current slot.

Syntax: clear<ENTER>
100:OK

HELP

^Top

Returns a comma-separated list of all commands supported by the current firmware.

Syntax: help
101:OK WITH TEXT
VERSION,CONFIG,UID,READONLY,UPL....

RSSI

^Top

Returns the voltage measured at the antenna of the Chameleon, e.g., to detect the presence of an RF field or compare the field strength of different RFID readers.

Syntax: rssi?<ENTER>
101:OK WITH TEXT
2648 mV

DETECTION

^Top

Performs the MF Classic Key attack to a reader.

Syntax: detection?<ENTER>
100:OK

SPI_FLASHINFO

^Top

Returns information about the embedded flash memory.

Syntax: spi_flashinfo<ENTER>
101:OK WITH TEXT
Manufacturer ID: 1fh
Family code: 1
Density code: 5
MLC Code: 0
Product version: 0
Flash memory size: 8-Mbit (1024-KByte)

Props to @AndreasBujok for the layout