_ _
.k$$$$$g, ,g$$$$$k.
.k$$$$$$$$$$$a. .a$$$$$$$$$$$k.
.J$$$$$?' `?$?^?, ,?^?$?` `?$$$$$L.
JS$$SI!a, _.JS$ ?, ,? $SL._ ,a$!IS$$SL
k$$$SI!:?$$$$$$$$$xu$$j j$$ux$$$$$$$$$?:!IS$$$k
:I$$SI:J$$?*"$$$$4^?*?: :?*?^4$$$$"*?$$L:iIS$$I:
:IS$$SiJ?` _.'$?`/' ': :' '/'?$'._ `?LiS$$SI:
?ISSik? _ ', ` . ,' _ ?kiSSI?
?i$?` _ k$ . :. $k _ `?$i?
'?I:-?z$$I _._.' ._._ I$$z?-:I?'
'*?- '?$$a louSxuS? ?xuSxuol a$$?' -?*'
i$$$$$$$$$$$S S$$$$$$$$$$$i
?$$$?- -?$$$?
██░ ██ ▄▄▄ ██▓ ▓█████ ██░ ██ ▒█████ █ ██ ███▄ █ ▓█████▄
▓██░ ██▒▒████▄ ▓██▒ ▓█ ▀ ▓██░ ██▒▒██▒ ██▒ ██ ▓██▒ ██ ▀█ █ ▒██▀ ██▌
▒██▀▀██░▒██ ▀█▄ ▒██░ ▒███ ▒██▀▀██░▒██░ ██▒▓██ ▒██░▓██ ▀█ ██▒░██ █▌
░▓█ ░██ ░██▄▄▄▄██ ▒██░ ▒▓█ ▄ ░▓█ ░██ ▒██ ██░▓▓█ ░██░▓██▒ ▐▌██▒░▓█▄ ▌
░▓█▒░██▓ ▓█ ▓██▒░██████▒░▒████▒░▓█▒░██▓░ ████▓▒░▒▒█████▓ ▒██░ ▓██░░▒████▓
▒ ░░▒░▒ ▒▒ ▓▒█░░ ▒░▓ ░░░ ▒░ ░ ▒ ░░▒░▒░ ▒░▒░▒░ ░▒▓▒ ▒ ▒ ░ ▒░ ▒ ▒ ▒▒▓ ▒
▒ ░▒░ ░ ▒ ▒▒ ░░ ░ ▒ ░ ░ ░ ░ ▒ ░▒░ ░ ░ ▒ ▒░ ░░▒░ ░ ░ ░ ░░ ░ ▒░ ░ ▒ ▒
░ ░░ ░ ░ ▒ ░ ░ ░ ░ ░░ ░░ ░ ░ ▒ ░░░ ░ ░ ░ ░ ░ ░ ░ ░
░ ░ ░ ░ ░ ░ ░ ░ ░ ░ ░ ░ ░ ░ ░ ░ ░
HaleHound-CYD v3.8.0
A big feature release — full Chameleon Ultra control, GPS-stamped NFC tags, and a BLE recon→attack chain.
New
Chameleon Ultra control (over Bluetooth). Your HaleHound is now a portable controller for an RRG Chameleon Ultra — scan and connect, read HF and LF cards, clone a card into a slot, recover MIFARE keys (mfkey32 nonce capture, saved to SD), set up emulation, manage all 8 slots, and read/decode NDEF straight off a tag.
Huge thanks to BkBroiler for the idea — he built his own Chameleon Ultra module first, and it was such a great idea I followed suit. Full credit to him for the concept.
RFID reader, your choice. RFID opens a backend picker — PN-532, Chameleon Ultra, or ST25R3916 (coming soon). PN-532 and Chameleon now share the same NFC toolset: read, decode, and write NDEF either way.
Write NFC tags — 8 record types, GPS-aware. URL, Text, vCard, WiFi (WPA2), Bluetooth, Android app, geo location, and SMS. Pick geo and it can grab your live GPS fix and stamp it right onto the tag.
Recon straight into attack — no second scan. Predator hands a device it already found to SkeletonKey; the target carries over. A shared classifier labels AirTags, Tiles, SmartTags, Chipolo, Apple/Google Find My, Flock Safety cameras, and drone Remote-ID in one pass.
Improvements
Radio Test — new PN-532 self-test, no more false failures. One-tap PN-532 check, and every probe leaves the SPI bus clean so a failed test can't make the next radio look dead.
Readable GATT names + live progress bars. Human names beside raw IDs in GATT/SkeletonKey; tag reads, Device Info, and GPS lock now show progress bars.
Fixes
SkeletonKey no longer white-screens on Back. GPS stops fighting the radio on E32R boards.
Boards
E32R35T (3.5"), CYD (2.8"), E32R28T (2.8"), and the NM-RF Hat.
⣀⡀⣀⢀⡀⢀⡀⣀ ⣀⢀⡀ ⡀⢀ ⣀⢀⡀⢀⡀
⢀⡀⣛⠘⠿⢦⠤⣽⢟⣿⢻⡟⣾⡏⣹⣿⣿⢻⡟⣿⣾⣿⣿⡿⣿⢿⣿⣌⣿⢸⡷⢤⡄⢚⢀⡀
⣀⢀⣀⣀⣀⢀⣀⣈⣁⣉⣀⣀⣀⣀⣉⣈⣁⣀⣀⣀⣀⣉⣀⣁⣀⣁⣉⣉⣀⣈⣀⣀⣀⣉⣈⣉⣀⣀⣀⣀⣈⣈⣁⣀⣀⣀ ⣀
⣤⠐⢶⢻⡟⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡟⢠⡇
⢀⣀⣠⣄⣤⣀⣤⣤⣤⣤⣤⣤⣭⣭⣭⣭⣭⣭⣭⣭⣭⣭⣭⣭⣭⣭⣭⣭⣭⣭⣭⣭⣍⣭⣭⣭⣭⣥⣭⣭⣭⣭⣥⣭⣭⣭⣬⣭⣭⣥⣤⣤⣤⣤⣤⣤⣄⣤⣀⣄⣀⡀
⣴⠸⠟⢿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡿⢿⠿⠿⠉⠉
⢀⡀⣶⣦⣶⣴⣶⣴⣤⣴⣶⣶⣼⣦⣿⣶⣾⣶⣶⣾⣧⣿⣾⣷⣾⣷⣿⣶⣶⣶⣶⣶⣦⣶⣶⣶⣶⣷⣿⣶⣶⣶⣶⣶⣶⣿⣾⣷⣴⣦⣶⣦⣤⣤⣦⣴⣦⣴⢠⣦⣤⡆⣴⣤⣤⣤⣤⣤⣄
⠸⠇⠿⠻⢿⠿⠿⠿⠿⡿⢿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠿⠿⠿⠿⠿⠿⠿⠿⠿⠿⠿⠟⠛⠃
⡤⢰⣶⣶⣶⣾⣷⣿⣶⣿⣾⣷⣿⣶⣿⣶⣷⣿⣿⣿⣿⣿⣿⣷⣿⣿⣿⣿⣷⣿⣿⣿⣾⣿⣿⣷⣿⣾⣿⣿⣷⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣷⣿⣿⣿⣾⣷⣿⣧⣶⣰⣶⣤⣤⣤⣴⣶⣴⣶⣶⣶⣤⣶⣶
⠛⠘⠛⠛⠛⢿⠿⣿⠿⠿⠿⠿⠿⠿⠿⠿⠿⢿⠿⠿⠿⠿⣿⣿⣿⣿⣿⣿⡿⣿⣿⣿⣿⣿⣿⣿⣿⢿⣿⣿⣿⣿⣿⣿⣿⡿⣿⣿⣿⢿⣿⣿⡿⣿⠿⠿⠛⠛⠛⠛⠛⠛⠛⠛⠋⠛⠛⠛⠛⠛⠛⠁⠛⠘⠃⠐⠂
⢠⠶⣾⣶⣶⣶⣶⣶⣶⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣾⣿⣿⣿⣿⣷⣿⣿⣿⣿⣿⣿⣿⣿⣾⣿⣿⣾⣿⣿⣷⣿⣷⣿⣿⣿⣿⣿⣿⣿⣿⣿⣷⣿⣶⣿⣾⣷⣿⣷⣾⣶⣶⣶⣶⣶⣶⣶⣶⣶⣶⣶⣶⠶⣶⣶⣦⣤⣀
⠉⠉⠛⠈⠛⠙⠋⠙⠛⠛⠛⠛⣿⠿⢿⣻⣿⢿⡟⢿⠿⠿⠿⠿⢿⡿⣿⠿⠿⢿⡿⣿⠿⣿⢿⡿⢿⡟⠿⠿⣿⣿⡿⣿⠿⣿⢿⡟⠿⠿⠿⠻⡿⢿⡟⠛⠛⠛⠛⠛⠛⠛⠋⠙⠋⠛⠋⠛⠉⠛⠋ ⠘⠁⠉ ⠋⠉⠁⠈⠉⠉
⢰⢿⣷⣾⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣷⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡿⢿⡿⣿⣿⡾⢻⡟⣿⠿⣿ ⡆
⣀⢀⡀⣀⡘⢋⣀ ⣉⣉⣉⣈⣁⣙⡛⣁⣉⣉⣉⣉⣛⢛⣛⣛⣋⣛⣛⣛⣻⣿⣿⡟⣿⣿⣿⣿⡟⣿⣿⣿⣻⣟⣻⣛⣛⢛⣻⣿⣟⣛⣿⣿⣻⡟⣿⣟⣿⢛⣛⢛⣛⣛⣛⣛⣛⣛⣛⣛⣛⣛⣛⣉⡋⣛⡙⣛⠉⡀⠘⠁⠉⡈⠁⣈⡁⢉ ⠁⠈⠃
⠋⠠⠏⠘⠁⡿⢹⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡿⣿⡿⣿⢻⡿⣹⡇⣿ ⣓ ⡀
⢀⣀⣀⣈⣉⣩⣅⣄⣀⣭⣉⣍⣁⣈⣉⣩⣍⣩⣉⣭⣭⣿⣩⣍⣽⣭⣩⣭⣭⣭⣍⣭⣉⣍⣩⣍⣭⣉⣭⣩⣍⣩⣉⣭⣩⣍⣩⣍⣩⣉⣉⣉⣍⣉⣉⣭⣉⣉⣉⣍⣉⣉⣉⣩⣁⣉⢉⣉⢈⡁⣉⣀⣉⣉⣉⣁⣀⣈⣀⣈⣀⣁⣉⡁⠈ ⠁ ⠁
⠂⠚⠉⠛⠩⠟⠟⠻⣿⢿⣿⢿⣿⣿⣿⣿⣿⣿⢿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡿⣿⣿⣿⢿⣿⡿⠿⣿⢿⣿⣿⡿⣿⣿⣿⢹⣿⠿⠏⣿⢩⣿⣿⣿⣿⣿⣿⢿⡟⢹⡟⣤
⣠⣤⣤⣤⣤⣤⣤⣴⣤⣤⣤⣤⣤⣤⣤⣤⣤⣤⣤⣭⣼⣿⣿⣿⣿⣭⣭⣭⣭⣭⣭⣭⣤⣤⣤⣤⣤⣬⣥⣤⣄⣬⣭⣥⣬⣥⣭⣅⣤⣤⣬⣤⣄⣠⣄⣤ ⣤⣠⣤⣤⣴⣮⣤⣤⣤⣤⣤⣤⣤⣤⣤⣄⡀⣠⢀⣄⣤⣤⣤⣠⣤⣤⣀
⠈⠉⠛⠛⠿⠿⠛⠿⠿⠿⠿⠿⢿⠿⣿⠟⠿⠸⠟⢹⡇⢿⠘⠿⠻⠿⠟⠻⠿⠿⠿⠿⠿⠿⠿⠿⠿⠿⠿⠿⣿⢿⡿⢿⠿⠿⠿⠿⠿⠿⠿⠿⠿⢻⡟⠛⠃⠛ ⠚⠘⠏⠛⠙⠛⠻⠿⠿⠿⠛⠹⠟⠙⠃⣿⠰⡾⠛⠋⠿⠣⣿⠻⡿⠻⠇⠰
⢴⣤⣶⣶⣶⣶⣦⣶⣤⣤⣴⣤⢤⡄ ⣤⢠⣶⣶⣶⣶⣶⣶⣶⣶⣶⣶⣦⣶⣤⣤⣴⣶⣶⣶⣶⣶⣶⣦⣤⣠⣄ ⣤⠠⡆⠠⣤⣤⢠⣶⣶⡶⣤⡤⢤ ⣠⡄⣀
⠘⠋⠛⠛⠉⠋⠉⠿⠉⠿ ⠁ ⠉⠈⠁⠉⠉⠉⠉⠉⠉⠉⠋⠹⠿⠻⠏⠻⠿⠿⠻⠿⠿⠿⠟⠛⠛⠃ ⠈⠁⠘⠁⠉⠉⠛⠙⠃⠛ ⠋ ⠰⠆⠈ ⠴
⢀⡶⣶⡐⢶ ⠆ ⠠⠤⣦ ⣤⢲⣶⣶⣶⣶⣤⣤⢴⣦⢶⣶⣤⣶⣶ ⡴⢐⡆⢶⣰⣶
⠈⠁⠋ ⠂ ⠛ ⠋⠘⠛⠘⠋⠛⠛⠋⠙⠛⠛⠋⠚⠋⠛⠘⠃ ⠈⠁⠈⠁ ⠚
⢰⣷⣦⣴⣿⣾⣷⣶⣦ ⢰⡆⢲⡆
⠛ ⠉⠁⠉⠉⠋⠙⠋⠁ ⠈⠁⠈⠁ ⠛
⣀ ⣀ ⢀ ⣸⠹⣿⣿⡟⣿⢿⣿⢿⡽⠿⠞⢿⠃ ⣹⡟⣿⠇⣀ ⢀⡀⣀
⣉ ⠉ ⢀ ⡀⢀⣀⢈⡁⣉ ⠉⠈⠁ ⢀ ⡀ ⠉ ⠈ ⡉ ⡀ ⠈⠁⢉
⢘⡃⣿ ⣛⢀⡀ ⠈⣧⢸⡿⢿⣷⣹⡇ ⠘⠈⠃ ⠠⠶⢶⡿⢹⡟⣀ ⢀⡀⢘⡇⣿ ⣟⢀⡀⢀⡀
⣀⣀⣀⣀⣁⢈⠁ ⢠⣄⣀⣀⣉⣈⣀⣈⣁⠉ ⡀ ⡀ ⢀⡀⣈⣀⣄⢀⡀⢀⡀ ⢀⣁⣀⣁⣈⣀⣁ ⡁⠈
⢠⡤⢼⣿⣿⣯⡿⠸⡇⣤⠄⢤ ⣤⢠⡄⢿⠶⠿⢾⡟⣿⡏⣿⢫⣿⠹⡏⣤ ⠐⠃⠠ ⣤⠐⠶⠸⡇⢿⠻⠿⠸⡇⠙⠃⣤⠠⡤ ⢤⡄⣤⠈⠛⢽⠏⢿⠛⠿⠠⡇⢤⠄
⣠⣄⣤⣤⣤⣤⣤⣤⣄ ⣠⡄⣤⣀⣤⢀⣄⣠⣤⣄⢀⣄⡀ ⡀ ⢀ ⣠⡄⢀ ⣤⣀⣤ ⡀⢀ ⡀ ⡀⣠⣤⣤⣤⣤⣤⣤⣀⣤⣤
⠐ ⠒ ⣶⠰⠦⠉⠹⠟⢹⡿⠿⠋⠾⠛⠿⠛⠿⠉⠉⠉⠉⠉⠙⠛⢿⠟⢿⠸⡟⠻⠟⠛⠿⠟⠘⠇ ⠉⠁⠈ ⠈ ⠂ ⠶ ⠆⠘⠏⠉⠉⠉⠰⠆⠰⠆⠴⠈⠇⠘⠇⠿ ⡿⠘⠇⠉⠁⠿⠹⡿⠿⠋⠿⠉⠉⠰⠆⠰⠂
⣶⣴⣶⢶⡄⣀ ⢀⡀ ⢀⡀ ⢤⢠⣦⣤⡴⠲⡦⢤ ⣀ ⢀ ⣤⢀⡄⣠⡄⣠ ⡄ ⠴⠄⣶⣦⡴⢦ ⢠⣦⣶⣦⣴⣄⣀ ⣀⡀
⠉⠛⠛⠿⠆⠿⠰⠇⠰⠟⠛⠛⠛⠰⠆⠶⠆ ⠛⠈⠁⠘⠃⠈ ⠰⠆⠴ ⠦⠰⠆ ⠈ ⠉⠈⠁ ⠉⠰⠷⠰⠇⠶ ⠶ ⠁ ⠾ ⠁⠸⠏ ⠶⠰⠆⠰ ⠶
⠰⢶⣶⣿⣷⣶⣶⢶⣶⣶⣄⣀⡠⠦⠰⠦⠶⠄⠄ ⣀⡀ ⠠⡄⣤ ⠰⠦⠶⢤⣶⣤⡤⠠⡄⢤ ⠠⠶⣺⡷⣶⣶⣶⢶⡶⠶⠄ ⠠⣤⡤
⠉⠉⠙⠛⠛⠚⠛⠉⠈⠛ ⠘⠃⠘⠃⠛⠐⠓⠘⠃⠛ ⠙⠛⠘⠃⠛ ⠛⠘⠃ ⠈ ⠘⠉⠁ ⠁ ⠐⠛ ⠛⠂
⠤⠤⢤⠄ ⢀⠰⣶⠴⠦⣶⡆⣶⢠⡄ ⢀ ⡀ ⣀ ⡀⣶⡆⣶⣦⣤⢰⡦⢶⠆⣠ ⣒⢂⣶⢐⡒⠂
⠘⠁⠉ ⠉ ⠉⠈⠁⠈⠁⠉⠈⠉⠈⠃ ⠙⠈⠃⠈⠃⠉ ⠉⠈⠁ ⠉ ⠉⠈⠛⠈⠃
⢀⡀⢀⡀⣀ ⢀⡀⣿⢈⣿⠸⣇⣴⣴⣦⣴⣦⣹⡇⣶ ⣶⠆⣿⣶⣦⣶⡄⣿⢈⣿⣿⡿⢿⡿⠿ ⢀⡀
⠈⠁⠈⠁⠉ ⣀ ⢀⢀⡀⢈⡁⣈⣈⣁⣈⣁⣀ ⠉ ⢉ ⡀⣉ ⢉ ⢀⣀⠉⢈⣁⣈⡀⣉⠁⣀ ⠈⠁
⢀⡀⢀⡀ ⠉⠃⠉⠘⠋⢻⣿⣿⣿⣿⣻⡟⣿⠰⠶⠶⠶⣶⡶⠿⢻⣄⢀⡟⠿⠿⠿⠾⠷⣿⡟⣿⢻⡿⣿⣿⣿⣟⣿⢀⡄
⠈⠁ ⡀⣠⡄⣠⢀⡀⣀⡅⣈⣩⣭⢀⡀⢀ ⠠⡀ ⠈⠉ ⡅⢠⣤⣤⣠⡄⣈⡀⣀ ⣄⣈⡀⣈⡉⠁ ⡁
⠁⠿⠁⠼⢸⡿⠻⡿⢿⢿⠟⠛⠛⣿⠤⣤ ⠁⠚⠛⠓ ⠁⠛⠹⣿⢩⡗⢤⡜⠋⠻⠟⢽⠇⢼⠟⠻⠺⡇
⣤⣄⢠⡄⣤⢀⡄ ⠄ ⢠⡄ ⢀⡀⣤⣴⣦⣤⣤⣴⣆⢰⡄ ⢀⡀
⠛⠛⠚⠳⣿⠸⡇⠺⠏⠈⠁ ⠰⠆ ⠻⠏⢿⠈⠁⠈⠋⠛⠙⢿⠻⡿⠒⠁⠶⠈⠻⠠⠆ ⠶ ⠰⠆
⢰⡆⣴⡆⠤ ⢰⣦⣴⡶⣶⢶⡦⣄ ⣀
⠈⠁ ⠸⠇⠺⠇⠾ ⠿ ⠉ ⠛⠘⠋⠈⠁⠿ ⠶ ⠶ ⠶
⣀⡀
⡀⢀⡀
⠈⠉⠈⠁
⢀⡀⢀⡀ ⡶⢰⡆
⠈⠁⠈⠁ ⠈⠉⠈⠁
⠠⡤ ⠠⡤⠠⡄⢤
⠰⠆⠰⠆⠶⠐⠶⠰⠆⠶
⣄
⠺⠐⠇⠐⠆⠲ ⠶⠐⠇⠰⠂⠲ ⠇⠐⠇⠲ ⠲⠐⠆⠸⠂⠾ ⠖
⠘⠛⠘⠃⠛ ⠛⠘⠃⠘⠃⠛⠐⠓⠘⠃⠛ ⠛⠘⠃⠘⠃⠛⠐⠛⠐⠃