---

Introduction

The PPE Stealth Decoy Reader (SDR) v2 provides a novel approach to initial access and supports physical privilege escalation in badge-based environments (e.g., server rooms or restricted areas) using non-destructive methods.

What is Stealth Mode?

Stealth Mode serves two primary purposes:

1. To reduce detectability in high-security areas where wireless detection measures are in place.
2. To reduce power consumption by disabling the wireless access point, lowering CPU frequency, and slowing the main processing loop.

You can enable or disable Stealth Mode using the Stealth Card, which can be programmed with custom values. The device supports separate stealth cards for HID mode (using bit length, facility code, and card number) and Paxton mode (using hex value).

What’s Included in the Box?

When you receive your Stealth Decoy Reader, the box will contain the following items:

Stealth v1 → Stealth v2 Updates

Hardware Updates

Version 2 of the Stealth Reader has undergone a complete hardware and firmware redesign. The significantly smaller footprint enables integration into compact readers, such as HID’s SIGNO TKS20 line. Key hardware changes include:

Below is the Stealth v2 PCB design (dimensions: 53mm × 30mm):

Firmware Updates

Key improvements in the Stealth v2 firmware include:

Supported Card & Data Types

Reader Mode Selection

The Stealth v2 firmware supports two distinct reader modes that can be switched via the web interface:

• HID Mode (Default): Supports standard Wiegand protocols and HID card formats
• Paxton Mode: Supports Paxton Net2 75-bit protocol for Paxton access control systems

The device automatically configures interrupt handlers and card processing based on the selected mode. Mode selection is persistent and stored in device configuration.

Wiegand Formats (HID Mode)

The table below summarizes various card data formats supported by the Stealth Reader in HID mode. Bit positions shown exclude parity bits; implementation may vary by reader.

Paxton Net2 Support (Paxton Mode)

When operating in Paxton mode, the device captures and decodes Paxton Net2 75-bit protocol frames:

Paxton Net2 Protocol Details:

• Card Number Extraction: 8-digit decimal card number (typically 8-9 digits)
• EM410x Conversion: Automatic conversion to EM410x hex format for card cloning

iCLASS Support

Additional Features

• Keypad PIN capture (4-bit)
• Raw binary data capture
• HEX data conversion
• Automatic Wiegand format detection
• Error detection and filtering
• EMI and misread filtering

Getting Started

Device Layout & Reader Compatibility

The reader arrives fully assembled, tested, and ready to operate. Reader compatibility depends on the backplate model selected and the reader mode configured in firmware. PPE currently offers backplates for the following readers:

Example installation in HID Global 20KTKS-03-000000 reader:

Wiring Guide

Pinout for reader integration:

Power, Charging, and Connectivity

• Slide the external switch to the left to power on.
• Charge with device powered off. Charging indicator: Yellow LED (charging), Green LED (charged).
• Default Wi-Fi credentials:
  • SSID: doppelgänger_XXXX
  • Password: UndertheRadar

Mounting the Device

You can mount Stealth either using the integrated magnets or with an adhesive material such as Command Strips.

Integrated Magnets

If using the integrated magnets, ensure the mounting surface is ferromagnetic (i.e., capable of attracting magnets) and not made of aluminum or other non-magnetic materials. Verify that the surface provides sufficient magnetic attraction to securely hold the device in place before releasing it.

Command Strips

The Stealth reader comes with large-sized 3M Command Strips for mounting. These strips are rated for 15 lbs and will more than adequately support the weight of the reader (15 ounces). However, it is absolutely critical to choose the appropriate mounting solution for each unique application.

SURFACE PREP:
Clean the desired surface with rubbing alcohol to remove grime and dust. This allows the wall hangers to properly bond to the surface. The indoor temperature must be between 50°F and 105°F.

REMOVAL:
Lightly hold the top of the adhesive strip and slowly pull straight down toward the floor to remove it and prevent damage to walls or surfaces.

• Reset: Access via Reset page.
• Mounting: Integrated magnets or included Command Strips.

Firmware

Current Version: 1.2.1

Build Date: 2025-12-06

Highlights

• Bug Fix: 35-bit Card Routing
  • Fixed 35-bit cards incorrectly routed to PIV handler
  • 35-bit HID Corporate 1000 cards now properly processed

Download Firmware v1.2.1

Previous Versions

Version 1.2.0

Build Date: 2025-11-05

Highlights:

• Added Paxton Net2 Support

  • Native 75-bit Net2 protocol capture for Paxton access control systems
  • Automatic card number extraction and EM410x hex conversion
  • Dedicated Paxton reader mode with automatic interrupt configuration

• Reader Mode Switching

  • Switch between HID and Paxton modes via web interface
  • Persistent mode configuration stored in device memory
  • Automatic interrupt handler configuration based on selected mode

• Additional HID Card Format

  • Avigilon 50-bit: Avigilon 50-bit format support (FC: 16 bits, CN: 32 bits)

• Paxton Stealth Card Support

  • Separate stealth card configuration for Paxton mode
  • Paxton stealth card uses hex value matching (default: 0000001337)
  • HID stealth card continues to use bit length, facility code, and card number

Download Firmware v1.2.0

Previous Versions

Version 1.1.0

Build Date: 2025-10-02

Highlights:

• Added HID H800002 46-bit support
  • Facility Code: 14 bits (bits 1–14)
  • Card Number: 30 bits (bits 15–44)
• Added Avigilon Avig56 56-bit support
  • Default extraction mapping in firmware: FC = bits 1–32 shifted right by 12; CN = bits 33–54
  • Note: Avigilon ACM allows site-configurable FC/CN lengths within the 54-bit payload

Additional Resources

Refer to the Doppelgänger Stealth firmware guide for a detailed overview of how the device operates, including configuration and reset procedures.

Reader Mode Configuration

The Stealth v2 firmware supports switching between HID and Paxton reader modes through the web interface:

1. Access Configuration: Navigate to the device’s web interface (default SSID: doppelgänger_XXXX)
2. Select Reader Type: Choose between “HID Global” or “Paxton” from the reader type dropdown
3. Apply Changes: The device will automatically reconfigure interrupt handlers and card processing

Mode-Specific Behavior:

• HID Mode: Processes standard Wiegand protocols (26-bit through 64-bit formats)
• Paxton Mode: Captures Paxton Net2 75-bit protocol frames with automatic decoding

Stealth Card Configuration:

• HID Stealth Card: Configure using bit length (SBL), facility code (SFC), and card number (SCN)
• Paxton Stealth Card: Configure using hex value (PAXTON_HEX), default: 0000001337

Both stealth card configurations are stored independently and are mode-aware—the device will check the appropriate stealth card based on the current reader mode.

Writing Card Data

Use the Doppelgänger Assistant for writing card data efficiently.

---