Stealth Wiegand Data Interpreter
Operating Manual for the PPE Stealth Wiegand Data Interpreter
Introduction
The PPE Stealth Wiegand Data Interpreter (WDI) v2 provides a novel approach to initial access and supports physical privilege escalation in badge-based environments (e.g., server rooms or restricted areas) using non-destructive methods.
What is Stealth Mode?
Stealth Mode serves two primary purposes:
- To reduce detectability in high-security areas where wireless detection measures are in place.
- To reduce power consumption by disabling the wireless access point, lowering CPU frequency, and slowing the main processing loop.
You can enable or disable Stealth Mode using the Stealth Card, which can be programmed with custom values.
What’s Included in the Box?
When you receive your Stealth Wiegand Data Interpreter, the box will contain the following items:
| Item | Description |
|---|---|
| HID multiCLASS SE Reader | Supports iCLASS (Legacy)/SE/SEOS (Standard Keys), HID Prox, EM, AWID, and Indala (depending on model) |
| PPE Magnetic Backplate & Electronics | Mounting platform and integrated electronics |
| PPE Stealth Card | Enables/disables wireless AP, extends battery life, improves LF card performance |
| iCLASS 2k Card | Used to write captured iCLASS/SE/SEOS card data (Proxmark3 required) |
| T5577 Card | Used to write captured HID Prox, EM, and AWID card data (Proxmark3 required) |
| Command Strips | Adhesive mounting strips (expendable item) |
| 3.7V Lithium Battery | Rechargeable via the reader’s USB-C port |
| Security & Phillips Head Screws | Secures device for anti-tamper use cases |
| Spanner Screwdriver Bit | N/A |
| Hex Key Wrench | N/A |
Stealth v1 → Stealth v2 Updates
Hardware Updates
Version 2 of the Stealth Reader has undergone a complete hardware and firmware redesign. The significantly smaller footprint enables integration into compact readers, such as HID’s SIGNO TKS20 line. Key hardware changes include:
| Item | Description |
|---|---|
| Custom ESP32-S3-MINI-1-N8 PCB | Purpose-built electronics, replacing Sparkfun Thing Plus-C |
| Power Circuit | Added a 12V boost converter, eliminating the 9V battery in favor of an integrated 1800mAh 3.7V LiPo battery |
| Fast LiPo Charger | Integrated circuit fully charges a depleted battery within two hours |
| USB-C Access | External USB-C port for charging, firmware updates, and serial debugging |
| External ON/OFF Switch | Easily accessible external switch; removing the backplate is no longer necessary |
| Improved Read Range | Increased voltage (12V) enhances reader performance |
| Extended Run Time | Increased battery life from 2.5 hours to 4 hours (see Firmware Updates) |
| Embedded Magnets | Magnets embedded within the backplate ensure a smooth surface for adhesive mounts |
Below is the Stealth v2 PCB design (dimensions: 53mm × 30mm):
Firmware Updates
Key improvements in the Stealth v2 firmware include:
| Item | Description |
|---|---|
| CPU Frequency Manipulation | Reduced CPU frequency in Normal Mode (160MHz) and Stealth Mode (40MHz) to extend battery life |
| Loop Delay | Slowed processing loop in Stealth Mode preserves battery life; card reads remain reliable |
| Hidden WiFi | Option to hide the SSID for increased stealth |
| Stealth/MFAS Merge | Unified Stealth and MFAS firmware supports capturing keypad entries when paired with compatible readers |
| Serial Debugging | Option to enable or disable serial output, enhancing OPSEC |
| Themes | Multiple themes added, including dark mode support |
Supported Card & Data Types
Wiegand Formats
The table below summarizes various card data formats supported by the Stealth Reader. Bit positions shown exclude parity bits; implementation may vary by reader.
| Card Type | Format | Facility Code Bits | Card Number Bits | Notes |
|---|---|---|---|---|
| HID H10301 | 26-bit | 8 (1–8) | 16 (9–24) | Standard Prox |
| Indala | 26-bit | 8 (1–8) | 16 (9–25) | Requires Indala-capable reader |
| Indala | 27-bit | 12 (1–12) | 13 (14–26) | Requires Indala-capable reader |
| 2804 Wiegand | 28-bit | 8 (4–11) | 14 (13–26) | Custom format |
| Indala | 29-bit | 12 (1–12) | 15 (14–28) | Requires Indala-capable reader |
| ATS Wiegand | 30-bit | 11 (2–12) | 15 (14–28) | Custom format |
| HID ADT | 31-bit | 4 (1–4) | 23 (5–27) | ADT-specific format |
| WEI32 (EM4102) | 32-bit | 15 (1–15) | 16 (16–31) | EM4102 format |
| HID D10202 | 33-bit | 7 (1–7) | 24 (8–31) | Extended format |
| HID H10306 | 34-bit | 16 (1–16) | 16 (17–32) | Extended format |
| HID Corporate 1000 | 35-bit | 12 (2–13) | 20 (14–33) | Corporate format |
| HID Simplex (S12906) | 36-bit | 8 (1–8) | 16 (19–34) | Simplex format |
| HID H10304 | 37-bit | 16 (1–16) | 19 (17–35) | Extended format |
| HID Corporate 1000 | 48-bit | 22 (2–23) | 23 (24–46) | Extended corporate format |
iCLASS Support
| Card Type | Format | Notes |
|---|---|---|
| iCLASS Legacy | Standard | Legacy 2k/16k cards |
| iCLASS SE | Standard | Secure Element cards |
| iCLASS Seos | Standard | Latest generation secure cards |
| PIV/MF Cards | Various | UID extraction only (due to data limitations in data stream) |
Additional Features
- Keypad PIN capture (4-bit)
- Raw binary data capture
- HEX data conversion
- Automatic Wiegand format detection
- Error detection and filtering
- EMI and misread filtering
Getting Started
Device Layout & Reader Compatibility
The reader arrives fully assembled, tested, and ready to operate. Reader compatibility depends on the backplate model selected. PPE currently offers backplates for these HID Global readers:
| Reader Generation | Model Number / Description |
|---|---|
| multiCLASS SE | RP40 size without keypad |
| multiCLASS SE w/Keypad | RP40 size with integrated keypad |
| SIGNO | 20TKS size without keypad |
| SIGNO w/Keypad | 20KTKS size with integrated keypad |
Example installation in HID Global 20KTKS-03-000000 reader:
Wiring Guide
Pinout for reader integration:
Power, Charging, and Connectivity
- Slide the external switch to the left to power on.
- Charge with device powered off. Charging indicator: Yellow LED (charging), Green LED (charged).
- Default Wi-Fi credentials:
- SSID:
doppelgänger_XXXX - Password:
UndertheRadar
- SSID:
Mounting the Device
You can mount Stealth either using the integrated magnets or with an adhesive material such as Command Strips.
Integrated Magnets
If using the integrated magnets, ensure the mounting surface is ferromagnetic (i.e., capable of attracting magnets) and not made of aluminum or other non-magnetic materials. Verify that the surface provides sufficient magnetic attraction to securely hold the device in place before releasing it.
Command Strips
The Stealth reader comes with large-sized 3M Command Strips for mounting. These strips are rated for 15 lbs and will more than adequately support the weight of the reader (15 ounces). However, it is absolutely critical to choose the appropriate mounting solution for each unique application.
If you’re using the Command Strips, follow the manufacturer’s guidance below. Do not attempt to mount the reader in wet, damp, or otherwise unstable conditions. Additionally, avoid mounting the reader on any surface that may be damaged upon removal (e.g., flaking or peeling paint).
SURFACE PREP:
Clean the desired surface with rubbing alcohol to remove grime and dust. This allows the wall hangers to properly bond to the surface. The indoor temperature must be between 50°F and 105°F.
REMOVAL:
Lightly hold the top of the adhesive strip and slowly pull straight down toward the floor to remove it and prevent damage to walls or surfaces.
- Reset: Access via Reset page.
- Mounting: Integrated magnets or included Command Strips.
Firmware
Refer to the Doppelgänger Stealth firmware guide for a detailed overview of how the device operates, including configuration and reset procedures.
Writing Card Data
Use the Doppelgänger Assistant for writing card data efficiently.