Terminal Commands

Chameleon Serial Interface

If the Chameleon is connected via USB it can be set up and controlled with a simple terminal or TeraTerm. Alternately, see userland applications for other GUI-based methods of communicating with the device over serial USB.

For easier use of the command-line using a terminal software the local-echo functionality should be activated, to be able to see what is typed into the chameleon. When using TeraTerm, this can be achieved by selecting Setup -> Terminal and check "Local Echo".

Chameleon Command Set

The current firmware supports the following commands:

• VERSIONMY
• CONFIGMY
• UIDMY
• ATQAMY
• SAKMY
• READONLYMY
• UPLOADMY
• DOWNLOADMY
• RESETMY
• UPGRADEMY
• MEMSIZEMY
• UIDSIZEMY
• BUTTONMY
• SETTINGMY
• CLEARMY
• HELPMY
• RSSIMY
• DETECTIONMY
• SPI_FLASHINFOMY

Command return codes

Subsequent to any command sent, the Chameleon responds with a status number and a corresponding status message, separated by a colon and terminated with a carriage return and line feed (CR+LF, 0D+0A hexadecimal). Status numbers are of a three-digit decimal format with the first digit showing the severity of the answer. Status numbers beginning with a '1' denote an informational item and those beginning with a '2' denote an error. See also this file in the RevE firmware source for more information about the return codes generated by these commands.

Response	Description
100:OK	The command has been successfully executed
101:OK WITH TEXT	The command has been successfully executed and this response is appended with an additional line of information, terminated with CR+LF
110:WAITING FOR XMODEM	The Chameleon is waiting for an XMODEM connection to be established
120:FALSE	The request is answered with false
121:TRUE	The request is answered with true
200:UNKNOWN COMMAND	This command is unknown to the Chameleon
201:INVALID COMMAND USAGE	This action is not supported by this command
202:INVALID PARAMETER	The format or value of the given parameter value is invalid
203:TIMEOUT	The timeout of the currently active command has expired

---

VERSIONMY

^Top

Requests version information of the current firmware.

Syntax: versionmy?
101:OK WITH TEXT
ChameleonMini-new-1.0

CONFIGMY

^Top

Get/Set the configuration of the current slot.
Note: The ChameleonMini has 8 possible slots (1-8)

Returns a list of the available configurations (see Configurations)
Syntax: configmy
101:OK WITH TEXT
NONE,MF_ULTRALIGHT,MF_CLASSIC_1K,MF_CLASSIC_4K

Set the configuration of the current slot as a MIFARE classic 4K emulation.
Syntax: configmy=MF_CLASSIC_4K
101:OK WITH TEXT

Returns the configuration of the current slot.
Syntax: configmy?
101:OK WITH TEXT
MF_CLASSIC_4K

UIDMY

^Top

Returns the UID of a card in the current slot.
Syntax: uidmy?
101:OK WITH TEXT
9E63BC03A

Sets a new UID, passed in hexadecimal notation.
Syntax: uidmy=9E63BC03A
101:OK WITH TEXT

ATQAMY

^Top

Returns the ATQA of a card in the current slot.
Syntax: atqamy?
101:OK WITH TEXT
0044

Sets a new ATQA, passed in hexadecimal notation. Must be four (4) digits.
Syntax: atqamy=0004
100:OK

SAKMY

^Top

Returns the SAK of a card in the current slot.
Syntax: sakmy?
101:OK WITH TEXT
04

Sets a new SAK, passed in hexadecimal notation. Must be two (2) digits.
Syntax: sakmy=04
100:OK

READONLYMY

^Top

Configures the read-only mode to the internal memory. Activates (1) or deactivates (0) the read-only mode (Any writing to the memory is silently ignored.)

Print the possible states.
Syntax: readonlymy
101:OK WITH TEXT
1,0

Returns the current state of the read-only mode.
Syntax: readonlymy?
101:OK WITH TEXT
0

Activate the read-only mode
Syntax: readonlymy=1
100:OK

UPLOADMY

^Top

Waits for an XModem connection in order to upload a new virtualized card into the currently selected slot, with a size up to the current memory size.

Syntax: uploadmy<ENTER>
See also: This listing of stock tag/card dumps which can be used with this command and the device.

DOWNLOADMY

^Top

Waits for an XModem connection in order to download a virtualized card with the current memory size.

Syntax: downloadmy<ENTER>

RESETMY

^Top

Reboots the Chameleon, i.e., power down and subsequent power-up. Note: A reset usually requires a new Terminal session.

Syntax: resetmy<ENTER>

UPGRADEMY

^Top

Sets the Chameleon into firmware upgrade mode (DFU). This command can be used instead of holding the BUTTON while power-on to trigger the bootloader.

Syntax: upgrademy<ENTER>

MEMSIZEMY

^Top

Returns the memory size occupied by the current configuration in Byte.

Syntax: memsizemy?
101:OK WITH TEXT
4096

UIDSIZEMY

^Top

Returns the UID size of the currently selected card type in Byte.

Syntax: uidsizemy?
101:OK WITH TEXT
4

BUTTONMY

^Top

Get/Set the action for pressing the button shortly.

Returns a list of the available button actions.
Syntax: buttonmy
101:OK WITH TEXT
NONE,RANDOM_UID,UID_LEFT_INCREMENT,UID_RIGHT_INCREMENT,UID_LEFT_DECREMENT,UID_RIGHT_DECREMENT,SWITCHCARD

Returns the currently set action for pressing the right button shortly. DEFAULT: SWITCHCARD.
Syntax: buttonmy?
101:OK WITH TEXT
SWITCHCARD

Sets the action for pressing the button shortly.
Syntax: buttonmy=random_uid

SETTINGMY

^Top

Get/Set the active slot (number between 1 and 8) for the card/reader emulation (see Settings).

Returns the currently activated slot.
Syntax: settingmy?
101:OK WITH TEXT
NO.1

Sets the active slot to 2
Syntax: settingmy=2
100:OK

CLEARMY

^Top

Clears the content of the current slot.

Syntax: clearmy<ENTER>
100:OK

HELPMY

^Top

Returns a comma-separated list of all commands supported by the current firmware.

Syntax: helpmy
101:OK WITH TEXT
VERSIONMY,CONFIGMY,UIDMY,READONLYMY,UPL....

RSSIMY

^Top

Returns the voltage measured at the antenna of the Chameleon, e.g., to detect the presence of an RF field or compare the field strength of different RFID readers.

Syntax: rssimy?<ENTER>
101:OK WITH TEXT
2648 mV

DETECTIONMY

^Top

Performs the MF Classic Key attack to a reader.

Syntax: detectionmy?<ENTER>
100:OK

SPI_FLASHINFOMY

^Top

Returns information about the embedded flash memory.

Syntax: spi_flashinfomy<ENTER>
101:OK WITH TEXT
Manufacturer ID: 1fh
Family code: 1
Density code: 5
MLC Code: 0
Product version: 0
Flash memory size: 8-Mbit (1024-KByte)

Props to @AndreasBujok for the layout