Chameleon Ultra does not accept 6-byte RAW HID (HID Prox LF) – LED blinks but access reader rejects the emulation

[sdrynski]

Device: Chameleon Ultra
Firmware version:

Problem description:
I am trying to emulate a HID Prox LF card which was successfully read by a Flipper Zero.
Flipper reads the tag and reports:

Raw: 03 80 0D 84 08 A0
Hex (short): 80 52 80
Facility Code: 128
Card Number: 21120

Flipper can both read and emulate this card correctly, and a T5577 programmed with these parameters works properly on the same reader.

Symptoms on Chameleon Ultra:

• I try to enter the HID Prox data into a Chameleon Ultra slot.
• The Chameleon app allows only 5 bytes of UID, blocking the 6th byte.
• During emulation, the LED blinks (reader detects signal), but the access reader does not unlock.
• It behaves exactly like other LF/HID issues reported previously: signal detected but data rejected.

What I already tried:

• Tested multiple HID formats: 26, 34, 37 bit.
• Tried all available HID modes in the app.
• Confirmed that T5577 clone works on the same reader without any issues.
• Tried different UID permutations according to the app’s requirements.
• Verified LF antenna hardware (seating, contacts) as suggested in Issue Issues of LF emulation #175.

Suspected cause:

• The application or firmware enforces a 5-byte UID limit and does not allow entering a full 6-byte RAW HID LF UID.
• RAW HID LF mode may be incomplete or experimental in the current firmware.
• The GUI may be limiting data entry even if firmware supports more bytes.

Request:

• Is there an official method to input a full 6-byte RAW HID LF UID?
• Is there a CLI/desktop tool that bypasses the 5-byte validation?
• Is there any branch/commit/PR that expands HID Prox LF support?
• Please confirm whether RAW HID LF support is fully implemented or still under development.

I can attach additional screenshots and logs if needed.

[GameTec-live]

Please check if this is an issue with firmware, CLI or the Chameleon Ultra GUI by downloading and setting up the official CLI and replicating your issue using the CLI. Thanks!

[sdrynski]

🔄 Follow‑up: Official firmware lacks HID Prox LF support

I’ve now tested this thoroughly with the latest official release (v2.1 / v2.1.0). Unfortunately, the device still does not expose any HID Proximity support in the firmware, despite CLI and app appearing to allow configuration attempts.

📋 Reproduction steps

Connected Chameleon Ultra via CLI and confirmed firmware version:

Chameleon Ultra, Version: v2.1 (v2.1.0)

Checked LF emulation support via CLI:

[USB] chameleon --> lf em

• 410x { EM410x commands... }

Only EM410x appears, no hid section.

lf em hid help returns no HID commands:

[USB] chameleon --> lf em hid help

• 410x

This confirms firmware does not include HID Prox support even if CLI syntax exists.

Tried all available formats (26/34/37‑bit) in the GUI and CLI — device only falls back to EM410x behavior.

Flipper Zero and properly programmed T5577 tags with the same HID Prox data (Facility Code, Card Number) work with the target reader — confirming the reader itself functions and that the emulation data can be valid, just not via CU.

💡 Expected behavior

Given the issue description, and earlier references that hardware should support HID Prox capabilities, the firmware should provide HID Prox emulation — at minimum the formats listed in CLI help (h10301, etc.).

🧪 Actual behavior

Only EM410x LF emulation is available.

No HID Prox support in official firmware — HID sections in CLI do not map to implemented firmware commands.

Attempting to enter HID data (even via CLI) does not produce usable HID Prox emission.

📌 Additional observations

A properly programmed T5577 tag with the same data works reliably on the same reader where CU fails.

Flipper Zero correctly reads and emulates the HID Prox data that CU cannot emit successfully.

The GUI app also restricts inputs (e.g., 5‑byte limit) and does not allow full 6‑byte raw HID, as noted in the original issue description.

❓ Open questions / requests

Can the developers confirm whether HID Prox LF support is intentionally disabled in official releases (even though CLI has placeholders)?

Is there a branch/commit or plan to expand LF HID support (including 6‑byte raw HID)?

Is there any official method or workaround (CLI/desktop) for inputting and emitting full 6‑byte HID Prox data?

Could the GUI be updated to prevent users from attempting unsupported workflows (e.g., hide/grey out HID fields when firmware doesn’t support it)?

📄 Relevant confirmed behavior

Flipper Zero reads and emulates the tested HID Prox tag correctly.

T5577 programmed with those parameters opens the same reader.

Chameleon Ultra firmware only exposes EM410x in lf em.
GitHub

[GameTec-live]

Well this is just not true. Can you please actually test it yourself and not post AI slop?

[GameTec-live]

Well this is just not true. Can you please actually test it yourself and not post AI slop?

[sdrynski]

I'm using chatagpt for backup. The problem I'm having right now is that I can't change the hidprox format. Despite entering the commands instead of sie36, it automatically generates h10391 26-bit.:

[Offline] chameleon --> hw connect
{ Chameleon Ultra connected: v2.1 }
[USB] chameleon --> hw mode -e
Switch to { Tag Emulator } mode successfully.
[USB] chameleon --> hw slot type -s 3 -t HIDProx

• Set slot 3 tag type success.
  [USB] chameleon --> lf hid prox econfig -f SIE36
• Get hidprox tag id success.
• HIDProx/HID H10301 26-bit
  FC: 128
  CN: 8608502400
  [USB] chameleon --> lf hid prox econfig -f SIE36
• Get hidprox tag id success.
• HIDProx/HID H10301 26-bit
  FC: 128
  CN: 8608502400
  [USB] chameleon --> lf hid prox econfig --format SIE36
• Get hidprox tag id success.
• HIDProx/HID H10301 26-bit
  FC: 128
  CN: 8608502400
  [USB] chameleon --> lf hid prox econfig --format HGEN37
• Get hidprox tag id success.
• HIDProx/HID H10301 26-bit
  FC: 128
  CN: 8608502400

[GameTec-live]

ok, well, thats an issue then.
Now the question is if the firmware even supports the type of hid prox you want to use?

[wfm324]

I have encountered the same problem—LF cannot be emulates

[nfcmd]

@GameTec-live any chance this issue can be fixed in an upcoming firmware update? I'm also unable to successfully emulate multiple HID prox cards, UID reading as 5 bytes rather than 6.

[GameTec-live]

@nfcmd there most likely is, but someone needs to find the root cause and file a PR. Im no FW dev.

[MusicLeecher]

I'm using chatagpt for backup. The problem I'm having right now is that I can't change the hidprox format. Despite entering the commands instead of sie36, it automatically generates h10391 26-bit.:

[Offline] chameleon --> hw connect { Chameleon Ultra connected: v2.1 } [USB] chameleon --> hw mode -e Switch to { Tag Emulator } mode successfully. [USB] chameleon --> hw slot type -s 3 -t HIDProx

• Set slot 3 tag type success.
  [USB] chameleon --> lf hid prox econfig -f SIE36
• Get hidprox tag id success.
• HIDProx/HID H10301 26-bit
  FC: 128
  CN: 8608502400
  [USB] chameleon --> lf hid prox econfig -f SIE36
• Get hidprox tag id success.
• HIDProx/HID H10301 26-bit
  FC: 128
  CN: 8608502400
  [USB] chameleon --> lf hid prox econfig --format SIE36
• Get hidprox tag id success.
• HIDProx/HID H10301 26-bit
  FC: 128
  CN: 8608502400
  [USB] chameleon --> lf hid prox econfig --format HGEN37
• Get hidprox tag id success.
• HIDProx/HID H10301 26-bit
  FC: 128
  CN: 8608502400

I was having issues with this too, same thing try to set a different format to an already existing card would do nothing. If you want to set a different format you also need to set at least the CN variable, FC, IL, OEM are optional; if not it will call the Get function instead of the Set function... If you pay attention when you try that command to set the format the reply States: "Get hidprox tag id success." instead of "Set hidprox tag id success."

So you can try this: lf hid prox econfig --cn 8608502400 --fc 128 --format HGEN37

Also, when doing a Set command you should be greeted with an error, simple fix, will do a PR.