---

Introduction

The PPE Stealth Decoy Reader (SDR) v2 provides a novel approach to initial access and supports physical privilege escalation in badge-based environments (e.g., server rooms or restricted areas) using non-destructive methods.

What is Stealth Mode?

Stealth Mode serves two primary purposes:

1. To reduce detectability in high-security areas where wireless detection measures are in place.
2. To reduce power consumption by disabling the wireless access point, lowering CPU frequency, and slowing the main processing loop.

You can enable or disable Stealth Mode using the Stealth Card, which can be programmed with custom values.

Supported Card Formats

The Stealth Decoy Reader supports two distinct reader modes:

• HID Mode (Default): Supports standard Wiegand protocols and HID card formats
• Paxton Mode: Supports Paxton Net2 75-bit protocol for Paxton access control cards / fobs

Reader mode can be switched via the web interface. The device automatically configures interrupt handlers and card processing based on the selected mode.

Wiegand Formats (HID Mode)

Below are the card data formats supported in HID mode. Bit positions listed exclude parity bits, and actual implementation may vary by reader.

Paxton Net2 Support (Paxton Mode)

When operating in Paxton mode, the device captures and decodes Paxton Net2 75-bit protocol frames:

Paxton Net2 Protocol Details:

• Card Number Extraction: 8-digit decimal card number (typically 8-9 digits)
• EM410x Conversion: Automatic conversion to EM410x hex format for card cloning

iCLASS Formats

Additional Wiegand Features

• Keypad PIN capture (4-bit)
• Raw binary data capture
• Error detection and filtering
• Parity bit validation

Differences Between Doppelgänger Stealth and Core

The primary difference between the Stealth and Core firmware lies in their wireless access point functionality, which reflects the intended use case and operational environment for each device.

• Doppelgänger Stealth is designed to be placed in a stationary location while the operator remains out of sight—or entirely off-site. For this purpose, Stealth operates as a wireless access point. You can also disable the access point entirely using the Stealth Card, which is ideal for high-security environments where wireless detection controls may flag rogue or unauthorized networks.

• Doppelgänger Core is intended for use with long-range readers, where the operator needs to maintain persistent communication or where multiple operators require access to the device’s web interface. Core also supports email notifications and haptic feedback triggers, eliminating the need for the operator to constantly refresh the web application to check for successful card reads.

Initial Setup Instructions

To get started, simply slide the power switch to the ON position (to the left) and connect to the access point doppelgänger_XXXX (default password: UndertheRadar).

Change Wireless Credentials

It is highly recommended to change the default wireless credentials. To do this, navigate to the Configuration Page and click the Modify Wireless Network button.

Stealth Card

The device supports separate stealth card configurations for HID and Paxton modes. We recommend configuring the Stealth Card with custom values.

HID Stealth Card (Default):

Custom HID Stealth Card values must fall within the following ranges:

Paxton Stealth Card:

The device is mode-aware and will check the appropriate stealth card based on the current reader mode (HID or Paxton).

Reader Mode Selection

The device supports switching between HID and Paxton reader modes:

1. Navigate to the Configuration Page
2. Select “HID Global” or “Paxton” from the reader type dropdown
3. The device will automatically reconfigure interrupt handlers and card processing

Mode-Specific Behavior:

• HID Mode: Processes standard Wiegand protocols (26-bit through 56-bit formats)
• Paxton Mode: Captures Paxton Net2 75-bit protocol frames with automatic decoding

Serial Debugging

For OPSEC purposes, you can enable or disable serial output over the USB-C connection. To modify this behavior, navigate to the Configuration Page.

Resetting the Device

To reset the device, navigate to the RESET page. Here you will have several options available. Select the desired button. In some cases the device will recycle power (e.g., Full Device Reset, Wireless Credentials).

Writing Captured Card Data

To efficiently manage and write captured RFID data, use the official Doppelgänger Assistant application. This tool simplifies generating Proxmark3 commands, writing data to blank RFID cards, and simulating captured card data. Doppelgänger Assistant supports macOS, Linux, and Windows (via WSL).

License Information

This work is licensed under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License.

You are free to:

• Share – Copy and redistribute the material in any medium or format

Under these terms:

• Attribution – Provide appropriate credit, a link to the license, and indicate if changes were made
• NonCommercial – Do not use the material for commercial purposes
• NoDerivatives – Do not distribute modified versions

Full license details are available in the LICENSE file.

Legal Notice

This device is intended strictly for authorized penetration testing and security assessments. Unauthorized or illegal use is the sole responsibility of the user. Mayweather Group LLC, Practical Physical Exploitation, and its creators assume no liability for misuse or unauthorized application of this tool.

---