{ "commands": { "analyse a": { "command": "analyse a", "description": "Iceman's personal garbage test command", "notes": [ "analyse a -d 137AF00A0A0D" ], "offline": true, "options": [ "-h, --help This help", "-d, --data bytes to manipulate" ], "usage": "analyse a [-h] -d " }, "analyse chksum": { "command": "analyse chksum", "description": "The bytes will be added with eachother and than limited with the applied mask Finally compute ones' complement of the least significant bytes.", "notes": [ "analyse chksum -d 137AF00A0A0D -> expected output: 0x61", "analyse chksum -d 137AF00A0A0D -m FF" ], "offline": true, "options": [ "-h, --help This help", "-d, --data bytes to calc checksum", "-m, --mask bit mask to limit the output (4 hex bytes max)", "-v, --verbose verbose" ], "usage": "analyse chksum [-hv] -d [-m ]" }, "analyse crc": { "command": "analyse crc", "description": "A stub method to test different crc implementations inside the PM3 sourcecode. Just because you figured out the poly, doesn't mean you get the desired output", "notes": [ "analyse crc -d 137AF00A0A0D" ], "offline": true, "options": [ "-h, --help This help", "-d, --data bytes to calc crc" ], "usage": "analyse crc [-h] -d " }, "analyse dates": { "command": "analyse dates", "description": "Tool to look for date/time stamps in a given array of bytes", "notes": [ "analyse dates" ], "offline": true, "options": [ "-h, --help This help" ], "usage": "analyse dates [-h]" }, "analyse demodbuff": { "command": "analyse demodbuff", "description": "loads a binary string into DemodBuffer", "notes": [ "analyse demodbuff -d 0011101001001011" ], "offline": true, "options": [ "-h, --help This help", "-d, --data binary string to load" ], "usage": "analyse demodbuff [-h] -d " }, "analyse foo": { "command": "analyse foo", "description": "experiments of cliparse", "notes": [ "analyse foo -r a0000000a0002021" ], "offline": true, "options": [ "-h, --help This help", "-r, --raw raw bytes" ], "usage": "analyse foo [-h] -r " }, "analyse freq": { "command": "analyse freq", "description": "calc wave lengths", "notes": [ "analyse freq" ], "offline": true, "options": [ "-h, --help This help", "-F, --freq resonating frequency F in hertz (Hz)", "-L, --cap capacitance C in micro farads (F)", "-C, --ind inductance in micro henries (H)" ], "usage": "analyse freq [-h] [-F ] [-L ] [-C ]" }, "analyse lcr": { "command": "analyse lcr", "description": "Specifying the bytes of a UID with a known LRC will find the last byte value needed to generate that LRC with a rolling XOR. All bytes should be specified in HEX.", "notes": [ "analyse lcr -d 04008064BA -> Target (BA) requires final LRC XOR byte value: 5A" ], "offline": true, "options": [ "-h, --help This help", "-d, --data bytes to calc missing XOR in a LCR" ], "usage": "analyse lcr [-h] -d " }, "analyse lfsr": { "command": "analyse lfsr", "description": "looks at LEGIC Prime's lfsr, iterates the first 48 values", "notes": [ "analyse lfsr --iv 55" ], "offline": true, "options": [ "-h, --help This help", "--iv init vector data (1 hex byte)", "--find lfsr data to find (1 hex byte)" ], "usage": "analyse lfsr [-h] --iv [--find ]" }, "analyse nuid": { "command": "analyse nuid", "description": "Generate 4byte NUID from 7byte UID", "notes": [ "analyse nuid -d 11223344556677" ], "offline": true, "options": [ "-h, --help This help", "-d, --data bytes to send", "-t, --test self test" ], "usage": "analyse nuid [-ht] [-d ]" }, "analyse units": { "command": "analyse units", "description": "experiments of unit conversions found in HF. ETU (1/13.56mhz), US or SSP_CLK (1/3.39MHz)", "notes": [ "analyse uints --etu 10", "analyse uints --us 100" ], "offline": true, "options": [ "-h, --help This help", "--etu number in ETU", "--us number in micro seconds (us)", "-t, --selftest self tests" ], "usage": "analyse units [-ht] [--etu ] [--us ]" }, "auto": { "command": "auto", "description": "Run LF SEARCH / HF SEARCH / DATA PLOT / DATA SAVE", "notes": [ "auto" ], "offline": false, "options": [ "-h, --help This help", "-c Continue searching even after a first hit" ], "usage": "auto [-hc]" }, "clear": { "command": "clear", "description": "Clear the Proxmark3 client terminal screen", "notes": [ "clear -> clear the terminal screen", "clear -b -> clear the terminal screen and the scrollback buffer" ], "offline": true, "options": [ "-h, --help This help", "-b, --back also clear the scrollback buffer" ], "usage": "clear [-hb]" }, "data askedgedetect": { "command": "data askedgedetect", "description": "Adjust Graph for manual ASK demod using the length of sample differences to detect the edge of a wave", "notes": [ "data askedgedetect -t 20" ], "offline": true, "options": [ "-h, --help This help", "-t, --thres threshold, use 20 - 45 (def 25)" ], "usage": "data askedgedetect [-h] [-t ]" }, "data asn1": { "command": "data asn1", "description": "Decode ASN1 bytearray", "notes": [ "data asn1 -d 303381050186922305a5020500a6088101010403030008a7188516eeee4facacf4fbde5e5c49d95e55bfbca74267b02407a9020500" ], "offline": true, "options": [ "-h, --help This help", "-d ASN1 encoded byte array", "-t, --test perform selftest" ], "usage": "data asn1 [-ht] [-d ]" }, "data atr": { "command": "data atr", "description": "look up ATR record from bytearray", "notes": [ "data atr -d 3B6B00000031C064BE1B0100079000" ], "offline": true, "options": [ "-h, --help This help", "-d ASN1 encoded byte array" ], "usage": "data atr [-h] [-d ]" }, "data autocorr": { "command": "data autocorr", "description": "Autocorrelate over window is used to detect repeating sequences. We use it as detection of how long in bits a message inside the signal is", "notes": [ "data autocorr -w 4000", "data autocorr -w 4000 -g" ], "offline": true, "options": [ "-h, --help This help", "-g save back to GraphBuffer (overwrite)", "-w, --win window length for correlation. def 4000" ], "usage": "data autocorr [-hg] [-w ]" }, "data bin2hex": { "command": "data bin2hex", "description": "This function converts binary to hexadecimal. It will ignore all characters not 1 or 0 but stop reading on whitespace", "notes": [ "data bin2hex -d 0101111001010" ], "offline": true, "options": [ "-h, --help This help", "-d, --data binary string to convert" ], "usage": "data bin2hex [-h] -d " }, "data biphaserawdecode": { "command": "data biphaserawdecode", "description": "Biphase decode binary stream in DemodBuffer Converts 10 or 01 -> 1 and 11 or 00 -> 0 - must have binary sequence in DemodBuffer (run `data rawdemod --ar` before) - invert for Conditional Dephase Encoding (CDP) AKA Differential Manchester", "notes": [ "data biphaserawdecode -> decode biphase bitstream from the DemodBuffer", "data biphaserawdecode -oi -> decode biphase bitstream from the DemodBuffer, adjust offset, and invert output" ], "offline": true, "options": [ "-h, --help This help", "-o, --offset set to adjust decode start position", "-i, --inv invert output", "--err set max errors tolerated (def 20)" ], "usage": "data biphaserawdecode [-hoi] [--err ]" }, "data bitsamples": { "command": "data bitsamples", "description": "Get raw samples from device as bitstring", "notes": [ "data bitsamples" ], "offline": false, "options": [ "-h, --help This help" ], "usage": "data bitsamples [-h]" }, "data clear": { "command": "data clear", "description": "This function clears the bigbuff on deviceside and graph window", "notes": [ "data clear" ], "offline": true, "options": [ "-h, --help This help" ], "usage": "data clear [-h]" }, "data convertbitstream": { "command": "data convertbitstream", "description": "Convert GraphBuffer's 0|1 values to 127|-127", "notes": [ "data convertbitstream" ], "offline": true, "options": [ "-h, --help This help" ], "usage": "data convertbitstream [-h]" }, "data cthreshold": { "command": "data cthreshold", "description": "Inverse of dirty threshold command, all values between up and down will be average out", "notes": [ "data cthreshold -u 10 -d -10" ], "offline": true, "options": [ "-h, --help This help", "-d, --down threshold down", "-u, --up threshold up" ], "usage": "data cthreshold [-h] -d -u " }, "data decimate": { "command": "data decimate", "description": "Performs decimation, by reducing samples N times in the grapbuf. Good for PSK", "notes": [ "data decimate", "data decimate -n 4" ], "offline": true, "options": [ "-h, --help This help", "-n factor to reduce sample set (default 2)" ], "usage": "data decimate [-h] [-n ]" }, "data detectclock": { "command": "data detectclock", "description": "Detect ASK, FSK, NRZ, PSK clock rate of wave in GraphBuffer", "notes": [ "data detectclock --ask", "data detectclock --nzr -> detect clock of an nrz/direct wave in GraphBuffer" ], "offline": true, "options": [ "-h, --help This help", "--ask specify ASK modulation clock detection", "--fsk specify FSK modulation clock detection", "--nzr specify NZR/DIRECT modulation clock detection", "--psk specify PSK modulation clock detection" ], "usage": "data detectclock [-h] [--ask] [--fsk] [--nzr] [--psk]" }, "data diff": { "command": "data diff", "description": "Diff takes a multitude of input data and makes a binary compare. It accepts filenames (filesystem or RDV4 flashmem SPIFFS), emulator memory, magic gen1", "notes": [ "data diff -w 4 -a hf-mfu-01020304.bin -b hf-mfu-04030201.bin", "data diff -a fileA -b fileB", "data diff -a fileA --eb", "data diff --fa fileA -b fileB", "data diff --fa fileA --fb fileB" ], "offline": true, "options": [ "-h, --help This help", "-a input file name A", "-b input file name B", "--eb emulator memory ", "--fa input spiffs file A", "--fb input spiffs file B", "-w <4|8|16> Width of data output" ], "usage": "data diff [-h] [-a ] [-b ] [--eb] [--fa ] [--fb ] [-w <4|8|16>]" }, "data dirthreshold": { "command": "data dirthreshold", "description": "Max rising higher up-thres/ Min falling lower down-thres, keep rest as prev.", "notes": [ "data dirthreshold -u 10 -d -10" ], "offline": true, "options": [ "-h, --help This help", "-d, --down threshold down", "-u, --up threshold up" ], "usage": "data dirthreshold [-h] -d -u " }, "data envelope": { "command": "data envelope", "description": "Create an square envelop of the samples", "notes": [ "data envelop" ], "offline": true, "options": [ "-h, --help This help" ], "usage": "data envelop [-h]" }, "data fsktonrz": { "command": "data fsktonrz", "description": "Convert fsk2 to nrz wave for alternate fsk demodulating (for weak fsk) Omitted values are autodetect instead", "notes": [ "data fsktonrz", "data fsktonrz -c 32 --low 8 --hi 10" ], "offline": true, "options": [ "-h, --help This help", "-c, --clk clock", "--low low field clock", "--hi high field clock" ], "usage": "data fsktonrz [-h] [-c ] [--low ] [--hi ]" }, "data getbitstream": { "command": "data getbitstream", "description": "Convert GraphBuffer's value accordingly - larger or equal to ONE becomes ONE - less than ONE becomes ZERO", "notes": [ "data getbitstream" ], "offline": true, "options": [ "-h, --help This help" ], "usage": "data getbitstream [-h]" }, "data grid": { "command": "data grid", "description": "This function overlay grid on graph plot window. use zero value to turn off either", "notes": [ "data grid -> turn off", "data grid -x 64 -y 50" ], "offline": true, "options": [ "-h, --help This help", "-x plot grid X coord", "-y plot grid Y coord" ], "usage": "data grid [-h] [-x ] [-y ]" }, "data hex2bin": { "command": "data hex2bin", "description": "This function converts hexadecimal to binary. It will ignore all non-hexadecimal characters but stop reading on whitespace", "notes": [ "data hex2bin -d 01020304" ], "offline": true, "options": [ "-h, --help This help", "-d, --data bytes to convert" ], "usage": "data hex2bin [-h] [-d ]" }, "data hexsamples": { "command": "data hexsamples", "description": "Dump big buffer as hex bytes", "notes": [ "data hexsamples -n 128 -> dumps 128 bytes from offset 0" ], "offline": false, "options": [ "-h, --help This help", "-b, --breaks row break, def 16", "-n num of bytes to download", "-o, --offset offset in big buffer" ], "usage": "data hexsamples [-h] [-b ] [-n ] [-o ]" }, "data hide": { "command": "data hide", "description": "Show graph window", "notes": [ "data hide" ], "offline": true, "options": [ "-h, --help This help" ], "usage": "data hide [-h]" }, "data hpf": { "command": "data hpf", "description": "Remove DC offset from trace. It should centralize around 0", "notes": [ "data hpf" ], "offline": true, "options": [ "-h, --help This help" ], "usage": "data hpf [-h]" }, "data iir": { "command": "data iir", "description": "Apply IIR buttersworth filter on plot data", "notes": [ "data iir -n 2" ], "offline": true, "options": [ "-h, --help This help", "-n factor n" ], "usage": "data iir [-h] -n " }, "data load": { "command": "data load", "description": "This command loads the contents of a pm3 file into graph window", "notes": [ "data load -f myfilename" ], "offline": true, "options": [ "-h, --help This help", "-f, --file file to load", "-b, --bin binary file", "-n, --no-fix Load data from file without any transformations" ], "usage": "data load [-hbn] -f " }, "data ltrim": { "command": "data ltrim", "description": "Trim samples from left of trace", "notes": [ "data ltrim -i 300 -> keep 300 - end" ], "offline": true, "options": [ "-h, --help This help", "-i, --idx from index to beginning trace" ], "usage": "data ltrim [-h] -i " }, "data manrawdecode": { "command": "data manrawdecode", "description": "Manchester decode binary stream in DemodBuffer Converts 10 and 01 and converts to 0 and 1 respectively - must have binary sequence in DemodBuffer (run `data rawdemod --ar` before)", "notes": [ "data manrawdecode" ], "offline": true, "options": [ "-h, --help This help", "-i, --inv invert output", "--err set max errors tolerated (def 20)" ], "usage": "data manrawdecode [-hi] [--err ]" }, "data modulation": { "command": "data modulation", "description": "search LF signal after clock and modulation", "notes": [ "data modulation" ], "offline": true, "options": [ "-h, --help This help" ], "usage": "data modulation [-h]" }, "data mtrim": { "command": "data mtrim", "description": "Trim out samples from the specified start to the specified end point", "notes": [ "data mtrim -s 1000 -e 2000 -> keep between 1000 and 2000" ], "offline": true, "options": [ "-h, --help This help", "-s, --start start point", "-e, --end end point" ], "usage": "data mtrim [-h] -s -e " }, "data norm": { "command": "data norm", "description": "Normalize max/min to +/-128", "notes": [ "data norm" ], "offline": true, "options": [ "-h, --help This help" ], "usage": "data norm [-h]" }, "data num": { "command": "data num", "description": "Function takes a decimal or hexdecimal number and print it in decimal/hex/binary Will print message if number is a prime number", "notes": [ "data num --dec 2023", "data num --hex 0x1000" ], "offline": true, "options": [ "-h, --help This help", "--dec decimal value", "--hex hexadecimal value", "--bin binary value", "-i print inverted value" ], "usage": "data num [-hi] [--dec ] [--hex ] [--bin ]" }, "data plot": { "command": "data plot", "description": "Show graph window hit 'h' in window for detail keystroke help available", "notes": [ "data plot" ], "offline": true, "options": [ "-h, --help This help" ], "usage": "data plot [-h]" }, "data print": { "command": "data print", "description": "Print the data in the DemodBuffer as hex or binary. Defaults to binary output", "notes": [ "data print" ], "offline": true, "options": [ "-h, --help This help", "-i, --inv invert DemodBuffer before printing", "-o, --offset offset in # of bits", "-s, --strip strip leading zeroes, i.e. set offset to first bit equal to one", "-x, --hex output in hex (omit for binary output)" ], "usage": "data print [-hisx] [-o ]" }, "data rawdemod": { "command": "data rawdemod", "description": "Demodulate the data in the GraphBuffer and output binary", "notes": [ "data rawdemod --fs -> demod FSK - autodetect", "data rawdemod --ab -> demod ASK/BIPHASE - autodetect", "data rawdemod --am -> demod ASK/MANCHESTER - autodetect", "data rawdemod --ar -> demod ASK/RAW - autodetect", "data rawdemod --nr -> demod NRZ/DIRECT - autodetect", "data rawdemod --p1 -> demod PSK1 - autodetect", "data rawdemod --p2 -> demod PSK2 - autodetect" ], "offline": true, "options": [ "-h, --help This help", "--ab ASK/Biphase demodulation", "--am ASK/Manchester demodulation", "--ar ASK/Raw demodulation", "--fs FSK demodulation", "--nr NRZ/Direct demodulation", "--p1 PSK 1 demodulation", "--p2 PSK 2 demodulation", " params for sub command" ], "usage": "data rawdemod [-h] [--ab] [--am] [--ar] [--fs] [--nr] [--p1] [--p2] []..." }, "data rtrim": { "command": "data rtrim", "description": "Trim samples from right of trace", "notes": [ "data rtrim -i 4000 -> keep 0 - 4000" ], "offline": true, "options": [ "-h, --help This help", "-i, --idx from index to end trace" ], "usage": "data rtrim [-h] -i " }, "data samples": { "command": "data samples", "description": "Get raw samples for graph window (GraphBuffer) from device. If 0, then get whole big buffer from device.", "notes": [ "data samples", "data samples -n 10000" ], "offline": false, "options": [ "-h, --help This help", "-n num of samples (512 - 40000)", "-v, --verbose verbose output" ], "usage": "data samples [-hv] [-n ]" }, "data save": { "command": "data save", "description": "Save signal trace from graph window , i.e. the GraphBuffer This is a text file with number -127 to 127. With the option `w` you can save it as wave file Filename should be without file extension", "notes": [ "data save -f myfilename -> save graph buffer to file", "data save --wave -f myfilename -> save graph buffer to wave file" ], "offline": true, "options": [ "-h, --help This help", "-w, --wave save as wave format (.wav)", "-f, --file save file name" ], "usage": "data save [-hw] -f " }, "data setdebugmode": { "command": "data setdebugmode", "description": "Set debugging level on client side", "notes": [ "data setdebugmode" ], "offline": true, "options": [ "-h, --help This help", "-0 no debug messages", "-1 debug", "-2 verbose debugging" ], "usage": "data setdebugmode [-h012]" }, "data setgraphmarkers": { "command": "data setgraphmarkers", "description": "Set blue and orange marker in graph window", "notes": [ "data setgraphmarkers -> turn off", "data setgraphmarkers -a 64 -b 50" ], "offline": true, "options": [ "-h, --help This help", "-a orange marker", "-b blue marker" ], "usage": "data setgraphmarkers [-h] [-a ] [-b ]" }, "data shiftgraphzero": { "command": "data shiftgraphzero", "description": "Shift 0 for Graphed wave + or - shift value", "notes": [ "data shiftgraphzero -n 10 -> shift 10 points", "data shiftgraphzero -n -22 -> shift negative 22 points" ], "offline": true, "options": [ "-h, --help This help", "-n shift + or -" ], "usage": "data shiftgraphzero [-h] -n " }, "data timescale": { "command": "data timescale", "description": "Set cursor display timescale. Setting the timescale makes the differential `dt` reading between the yellow and purple markers meaningful. once the timescale is set, the differential reading between brackets can become a time duration.", "notes": [ "data timescale --sr 125 -u ms -> for LF sampled at 125 kHz. Reading will be in milliseconds", "data timescale --sr 1.695 -u us -> for HF sampled at 16 * fc/128. Reading will be in microseconds", "data timescale --sr 16 -u ETU -> for HF with 16 samples per ETU (fc/128). Reading will be in ETUs" ], "offline": true, "options": [ "-h, --help This help", "--sr sets timescale factor according to sampling rate", "-u, --unit time unit to display (max 10 chars)" ], "usage": "data timescale [-h] --sr [-u ]" }, "data tune": { "command": "data tune", "description": "Measure tuning of device antenna. Results shown in graph window. This command doesn't actively tune your antennas, it's only informative by measuring voltage that the antennas will generate", "notes": [ "data tune" ], "offline": false, "options": [ "-h, --help This help" ], "usage": "data tune [-h]" }, "data undecimate": { "command": "data undecimate", "description": "Performs un-decimation, by repeating each sample N times in the graphbuf", "notes": [ "data undecimate", "data undecimate -n 4" ], "offline": true, "options": [ "-h, --help This help", "-n factor to repeat each sample (default 2)" ], "usage": "data undecimate [-h] [-n ]" }, "data zerocrossings": { "command": "data zerocrossings", "description": "Count time between zero-crossings", "notes": [ "data zerocrossings" ], "offline": true, "options": [ "-h, --help This help" ], "usage": "data zerocrossings [-h]" }, "emv challenge": { "command": "emv challenge", "description": "Executes Generate Challenge command. It returns 4 or 8-byte random number from card. Needs a EMV applet to be selected and GPO to be executed.", "notes": [ "emv challenge -> get challenge", "emv challenge -k -> get challenge, keep filled ON" ], "offline": false, "options": [ "-h, --help This help", "-k, --keep Keep field ON for next command", "-a, --apdu Show APDU requests and responses", "-w, --wired Send data via contact (iso7816) interface. (def: Contactless interface)" ], "usage": "emv challenge [-hkaw]" }, "emv exec": { "command": "emv exec", "description": "Executes EMV contactless transaction", "notes": [ "emv exec -sat -> select card, execute MSD transaction, show APDU and TLV", "emv exec -satc -> select card, execute CDA transaction, show APDU and TLV" ], "offline": false, "options": [ "-h, --help This help", "-s, --select Activate field and select card", "-a, --apdu Show APDU requests and responses", "-t, --tlv TLV decode results", "-j, --jload Load transaction parameters from `emv_defparams.json` file", "--force Force search AID. Search AID instead of execute PPSE", "By default: Transaction type - MSD", "-v, --qvsdc Transaction type - qVSDC or M/Chip", "-c, --qvsdccda Transaction type - qVSDC or M/Chip plus CDA (SDAD generation)", "-x, --vsdc Transaction type - VSDC. For test only. Not a standard behavior", "-g, --acgpo VISA. generate AC from GPO", "-w, --wired Send data via contact (iso7816) interface. (def: Contactless interface)" ], "usage": "emv exec [-hsatjvcxgw] [--force] By default:" }, "emv genac": { "command": "emv genac", "description": "Generate Application Cryptogram command. It returns data in TLV format. Needs a EMV applet to be selected and GPO to be executed.", "notes": [ "emv genac -k 0102 -> generate AC with 2-byte CDOLdata and keep field ON after command", "emv genac -t 01020304 -> generate AC with 4-byte CDOL data, show result in TLV", "emv genac -Daac 01020304 -> generate AC with 4-byte CDOL data and terminal decision 'declined'", "emv genac -pmt 9F 37 04 -> load params from file, make CDOL data from CDOL, generate AC with CDOL, show result in TLV" ], "offline": false, "options": [ "-h, --help This help", "-k, --keep Keep field ON for next command", "-c, --cda Executes CDA transaction. Needs to get SDAD in results.", "-d, --decision Terminal decision. aac - declined, tc - approved, arqc - online authorisation requested", "-p, --params Load parameters from `emv_defparams.json` file for CDOLdata making from CDOL and parameters", "-m, --make Make CDOLdata from CDOL (tag 8C and 8D) and parameters (def: use default parameters)", "-a, --apdu Show APDU requests and responses", "-t, --tlv TLV decode results of selected applets", "-w, --wired Send data via contact (iso7816) interface. (def: Contactless interface)", " CDOLdata/CDOL" ], "usage": "emv genac [-hkcpmatw] [-d ] []..." }, "emv gpo": { "command": "emv gpo", "description": "Executes Get Processing Options command. It returns data in TLV format (0x77 - format2) or plain format (0x80 - format1). Needs a EMV applet to be selected.", "notes": [ "emv gpo -k -> execute GPO", "emv gpo -t 01020304 -> execute GPO with 4-byte PDOL data, show result in TLV", "emv gpo -pmt 9F 37 04 -> load params from file, make PDOL data from PDOL, execute GPO with PDOL, show result in TLV" ], "offline": false, "options": [ "-h, --help This help", "-k, --keep Keep field ON for next command", "-p, --params Load parameters from `emv_defparams.json` file for PDOLdata making from PDOL and parameters", "-m, --make Make PDOLdata from PDOL (tag 9F38) and parameters (def: uses default parameters)", "-a, --apdu Show APDU requests and responses", "-t, --tlv TLV decode results of selected applets", "-w, --wired Send data via contact (iso7816) interface. (def: Contactless interface)", " PDOLdata/PDOL" ], "usage": "emv gpo [-hkpmatw] []..." }, "emv intauth": { "command": "emv intauth", "description": "Generate Internal Authenticate command. Usually needs 4-byte random number. It returns data in TLV format . Needs a EMV applet to be selected and GPO to be executed.", "notes": [ "emv intauth -k 01020304 -> execute Internal Authenticate with 4-byte DDOLdata and keep field ON after command", "emv intauth -t 01020304 -> execute Internal Authenticate with 4-byte DDOL data, show result in TLV", "emv intauth -pmt 9F 37 04 -> load params from file, make DDOL data from DDOL, Internal Authenticate with DDOL, show result in TLV" ], "offline": false, "options": [ "-h, --help This help", "-k, --keep Keep field ON for next command", "-p, --params Load parameters from `emv_defparams.json` file for DDOLdata making from DDOL and parameters", "-m, --make Make DDOLdata from DDOL (tag 9F49) and parameters (def: use default parameters)", "-a, --apdu Show APDU requests and responses", "-t, --tlv TLV decode results of selected applets", "-w, --wired Send data via contact (iso7816) interface. (def: Contactless interface)", " DDOLdata/DDOL" ], "usage": "emv intauth [-hkpmatw] []..." }, "emv list": { "command": "emv list", "description": "Alias of `trace list -t 7816` with selected protocol data to annotate trace buffer You can load a trace from file (see `trace load -h`) or it be downloaded from device by default It accepts all other arguments of `trace list`. Note that some might not be relevant for this specific protocol", "notes": [ "emv list --frame -> show frame delay times", "emv list -1 -> use trace buffer" ], "offline": true, "options": [ "-h, --help This help", "-1, --buffer use data from trace buffer", "--frame show frame delay times", "-c mark CRC bytes", "-r show relative times (gap and duration)", "-u display times in microseconds instead of clock cycles", "-x show hexdump to convert to pcap(ng)", "or to import into Wireshark using encapsulation type \"ISO 14443\"", "-f, --file filename of dictionary" ], "usage": "emv list [-h1crux] [--frame] [-f ]" }, "emv pse": { "command": "emv pse", "description": "Executes PSE/PPSE select command. It returns list of applet on the card:", "notes": [ "emv pse -s1 -> select, get pse", "emv pse -st2 -> select, get ppse, show result in TLV" ], "offline": false, "options": [ "-h, --help This help", "-s, --select Activate field and select card", "-k, --keep Keep field ON for next command", "-1, --pse PSE (1PAY.SYS.DDF01) mode", "-2, --ppse PPSE (2PAY.SYS.DDF01) mode (def)", "-a, --apdu Show APDU requests and responses", "-t, --tlv TLV decode results of selected applets", "-w, --wired Send data via contact (iso7816) interface. (def: Contactless interface)" ], "usage": "emv pse [-hsk12atw]" }, "emv reader": { "command": "emv reader", "description": "Act as a EMV reader to identify tag. Look for EMV tags until Enter or the pm3 button is pressed In `verbose` mode it will also try to extract and decode the transaction logs stored on card in either channel.", "notes": [ "emv reader", "emv reader -v", "emv reader -@ -> Continuous mode" ], "offline": false, "options": [ "-h, --help This help", "-w, --wired Send data via contact (iso7816) interface. (def: Contactless interface)", "-v, --verbose verbose", "-@ continuous reader mode" ], "usage": "emv reader [-hwv@]" }, "emv readrec": { "command": "emv readrec", "description": "Executes Read Record command. It returns data in TLV format. Needs a bank applet to be selected and sometimes needs GPO to be executed.", "notes": [ "emv readrec -k 0101 -> read file SFI=01, SFIrec=01", "emv readrec -kt 0201 -> read file 0201 and show result in TLV" ], "offline": false, "options": [ "-h, --help This help", "-k, --keep Keep field ON for next command", "-a, --apdu Show APDU requests and responses", "-t, --tlv TLV decode results of selected applets", "-w, --wired Send data via contact (iso7816) interface. (def: Contactless interface)", " []..." }, "emv roca": { "command": "emv roca", "description": "Tries to extract public keys and run the ROCA test against them.", "notes": [ "emv roca -w -> select --CONTACT-- card and run test", "emv roca -> select --CONTACTLESS-- card and run test" ], "offline": false, "options": [ "-h, --help This help", "-t, --selftest Self test", "-a, --apdu Show APDU requests and responses", "-w, --wired Send data via contact (iso7816) interface. (def: Contactless interface)" ], "usage": "emv roca [-htaw]" }, "emv scan": { "command": "emv scan", "description": "Scan EMV card and save it contents to a file. It executes EMV contactless transaction and saves result to a file which can be used for emulation", "notes": [ "emv scan -at -> scan MSD transaction mode and show APDU and TLV", "emv scan -c -> scan CDA transaction mode" ], "offline": false, "options": [ "-h, --help This help", "-a, --apdu Show APDU requests and responses", "-t, --tlv TLV decode results", "-e, --extract Extract TLV elements and fill Application Data", "-j, --jload Load transaction parameters from `emv_defparams.json` file", "By default: Transaction type - MSD", "-v, --qvsdc Transaction type - qVSDC or M/Chip", "-c, --qvsdccda Transaction type - qVSDC or M/Chip plus CDA (SDAD generation)", "-x, --vsdc Transaction type - VSDC. For test only. Not a standard behavior", "-g, --acgpo VISA. generate AC from GPO", "-m, --merge Merge output file with card's data. (warning: the file may be corrupted!)", "-w, --wired Send data via contact (iso7816) interface. (def: Contactless interface)", " JSON output file name" ], "usage": "emv scan [-hatejvcxgmw] By default: " }, "emv search": { "command": "emv search", "description": "Tries to select all applets from applet list", "notes": [ "emv search -s -> select card and search", "emv search -st -> select card, search and show result in TLV" ], "offline": false, "options": [ "-h, --help This help", "-s, --select Activate field and select card", "-k, --keep Keep field ON for next command", "-a, --apdu Show APDU requests and responses", "-t, --tlv TLV decode results of selected applets", "-w, --wired Send data via contact (iso7816) interface. (def: Contactless interface)" ], "usage": "emv search [-hskatw]" }, "emv select": { "command": "emv select", "description": "Executes select applet command", "notes": [ "emv select -s a00000000101 -> select card, select applet", "emv select -st a00000000101 -> select card, select applet, show result in TLV" ], "offline": false, "options": [ "-h, --help This help", "-s, --select Activate field and select card", "-k, --keep Keep field for next command", "-a, --apdu Show APDU requests and responses", "-t, --tlv TLV decode results", "-w, --wired Send data via contact (iso7816) interface. (def: Contactless interface)", " Applet AID" ], "usage": "emv select [-hskatw] " }, "emv test": { "command": "emv test", "description": "Executes tests", "notes": [ "emv test -i", "emv test --long" ], "offline": true, "options": [ "-h, --help This help", "-i, --ignore Ignore timing tests for VM", "-l, --long Run long tests too" ], "usage": "emv test [-hil]" }, "exit": { "command": "exit", "description": "Quit the Proxmark3 client terminal", "notes": [ "quit" ], "offline": true, "options": [ "-h, --help This help" ], "usage": "quit [-h]" }, "hf 14a antifuzz": { "command": "hf 14a antifuzz", "description": "Tries to fuzz the ISO14443a anticollision phase", "notes": [ "hf 14a antifuzz -4" ], "offline": false, "options": [ "-h, --help This help", "-4 4 byte uid", "-7 7 byte uid", "--10 10 byte uid" ], "usage": "hf 14a antifuzz [-h47] [--10]" }, "hf 14a apdu": { "command": "hf 14a apdu", "description": "Sends an ISO 7816-4 APDU via ISO 14443-4 block transmission protocol (T=CL). works with all apdu types from ISO 7816-4:2013", "notes": [ "hf 14a apdu -st 00A404000E325041592E5359532E444446303100", "hf 14a apdu -sd 00A404000E325041592E5359532E444446303100 -> decode apdu", "hf 14a apdu -sm 00A40400 325041592E5359532E4444463031 -l 256 -> encode standard apdu", "hf 14a apdu -sm 00A40400 325041592E5359532E4444463031 -el 65536 -> encode extended apdu" ], "offline": false, "options": [ "-h, --help This help", "-s, --select activate field and select card", "-k, --keep keep signal field ON after receive", "-t, --tlv executes TLV decoder if it possible", "-d, --decapdu decode apdu request if it possible", "-m, --make make apdu with head from this field and data from data field. Must be 4 bytes length: ", "-e, --extended make extended length apdu if `m` parameter included", "-l, --le Le apdu parameter if `m` parameter included", " data if `m` parameter included" ], "usage": "hf 14a apdu [-hsktde] [-m ] [-l ] []..." }, "hf 14a apdufind": { "command": "hf 14a apdufind", "description": "Enumerate APDU's of ISO7816 protocol to find valid CLS/INS/P1/P2 commands. It loops all 256 possible values for each byte. The loop oder is INS -> P1/P2 (alternating) -> CLA. Tag must be on antenna before running.", "notes": [ "hf 14a apdufind", "hf 14a apdufind --cla 80", "hf 14a apdufind --cla 80 --error-limit 20 --skip-ins a4 --skip-ins b0 --with-le" ], "offline": false, "options": [ "-h, --help This help", "-c, --cla Start value of CLASS (1 hex byte)", "-i, --ins Start value of INSTRUCTION (1 hex byte)", "--p1 Start value of P1 (1 hex byte)", "--p2 Start value of P2 (1 hex byte)", "-r, --reset Minimum secondes before resetting the tag (to prevent timeout issues). Default is 5 minutes", "-e, --error-limit Maximum times an status word other than 0x9000 or 0x6D00 is shown. Default is 512.", "-s, --skip-ins Do not test an instruction (can be specified multiple times)", "-l, --with-le Search for APDUs with Le=0 (case 2S) as well", "-v, --verbose Verbose output" ], "usage": "hf 14a apdufind [-hlv] [-c ] [-i ] [--p1 ] [--p2 ] [-r ] [-e ] [-s ]..." }, "hf 14a chaining": { "command": "hf 14a chaining", "description": "Enable/Disable ISO14443a input chaining. Maximum input length goes from ATS.", "notes": [ "hf 14a chaining -> show chaining enable/disable state", "hf 14a chaining --off -> disable chaining" ], "offline": false, "options": [ "-h, --help This help", "-1, --on enabled chaining", "-0, --off disable chaining" ], "usage": "hf 14a chaining [-h10]" }, "hf 14a cuids": { "command": "hf 14a cuids", "description": "Collect n>0 ISO14443-a UIDs in one go", "notes": [ "hf 14a cuids -n 5 -> Collect 5 UIDs" ], "offline": false, "options": [ "-h, --help This help", "-n, --num Number of UIDs to collect" ], "usage": "hf 14a cuids [-h] [-n ]" }, "hf 14a info": { "command": "hf 14a info", "description": "This command makes more extensive tests against a ISO14443a tag in order to collect information", "notes": [ "hf 14a info -nsv -> shows full information about the card" ], "offline": false, "options": [ "-h, --help This help", "-v, --verbose adds some information to results", "-n, --nacktest test for nack bug", "-s, --aidsearch checks if AIDs from aidlist.json is present on the card and prints information about found AIDs" ], "usage": "hf 14a info [-hvns]" }, "hf 14a list": { "command": "hf 14a list", "description": "Alias of `trace list -t 14a -c` with selected protocol data to annotate trace buffer You can load a trace from file (see `trace load -h`) or it be downloaded from device by default It accepts all other arguments of `trace list`. Note that some might not be relevant for this specific protocol", "notes": [ "hf 14a list --frame -> show frame delay times", "hf 14a list -1 -> use trace buffer" ], "offline": true, "options": [ "-h, --help This help", "-1, --buffer use data from trace buffer", "--frame show frame delay times", "-c mark CRC bytes", "-r show relative times (gap and duration)", "-u display times in microseconds instead of clock cycles", "-x show hexdump to convert to pcap(ng)", "or to import into Wireshark using encapsulation type \"ISO 14443\"", "-f, --file filename of dictionary" ], "usage": "hf 14a list [-h1crux] [--frame] [-f ]" }, "hf 14a ndefformat": { "command": "hf 14a ndefformat", "description": "Format ISO14443-a Tag as a NFC tag with Data Exchange Format (NDEF)", "notes": [ "hf 14a ndefformat" ], "offline": false, "options": [ "-h, --help This help", "-v, --verbose show technical data" ], "usage": "hf 14a ndefformat [-hv]" }, "hf 14a ndefread": { "command": "hf 14a ndefread", "description": "Read NFC Data Exchange Format (NDEF) file on Type 4 NDEF tag", "notes": [ "hf 14a ndefread", "hf 14a ndefread -f myfilename -> save raw NDEF to file" ], "offline": false, "options": [ "-h, --help This help", "-f, --file save raw NDEF to file", "-v, --verbose show technical data" ], "usage": "hf 14a ndefread [-hv] [-f ]" }, "hf 14a ndefwrite": { "command": "hf 14a ndefwrite", "description": "Write raw NDEF hex bytes to tag. This commands assumes tag already been NFC/NDEF formatted.", "notes": [ "hf 14a ndefwrite -d 0300FE -> write empty record to tag", "hf 14a ndefwrite -f myfilename", "hf 14a ndefwrite -d 003fd1023a53709101195405656e2d55534963656d616e2054776974746572206c696e6b5101195502747769747465722e636f6d2f686572726d616e6e31303031" ], "offline": false, "options": [ "-h, --help This help", "-d raw NDEF hex bytes", "-f, --file write raw NDEF file to tag", "-p fix NDEF record headers / terminator block if missing", "-v, --verbose verbose output" ], "usage": "hf 14a ndefwrite [-hpv] [-d ] [-f ]" }, "hf 14a raw": { "command": "hf 14a raw", "description": "Sends raw bytes over ISO14443a. With option to use TOPAZ 14a mode.", "notes": [ "hf 14a raw -sc 3000 -> select, crc, where 3000 == 'read block 00'", "hf 14a raw -ak -b 7 40 -> send 7 bit byte 0x40", "hf 14a raw --ecp -s -> send ECP before select" ], "offline": false, "options": [ "-h, --help This help", "-a active signal field ON without select", "-b number of bits to send. Useful for send partial byte", "-c calculate and append CRC", "-k keep signal field ON after receive", "-3 ISO14443-3 select only (skip RATS)", "-r do not read response", "-s active signal field ON with select", "-t, --timeout timeout in milliseconds", "-v, --verbose Verbose output", "--topaz use Topaz protocol to send command", "--ecp use enhanced contactless polling", "--mag use Apple magsafe polling", " raw bytes to send" ], "usage": "hf 14a raw [-hack3rsv] [-b ] [-t ] [--topaz] [--ecp] [--mag] []..." }, "hf 14a reader": { "command": "hf 14a reader", "description": "Act as a ISO-14443a reader to identify tag. Look for ISO-14443a tags until Enter or the pm3 button is pressed", "notes": [ "hf 14a reader", "hf 14a reader -@ -> Continuous mode", "hf 14a reader --ecp -> trigger apple enhanced contactless polling", "hf 14a reader --mag -> trigger apple magsafe polling" ], "offline": false, "options": [ "-h, --help This help", "-k, --keep keep the field active after command executed", "-s, --silent silent (no messages)", "--drop just drop the signal field", "--skip ISO14443-3 select only (skip RATS)", "--ecp Use enhanced contactless polling", "--mag Use Apple magsafe polling", "-@ continuous reader mode" ], "usage": "hf 14a reader [-hks@] [--drop] [--skip] [--ecp] [--mag]" }, "hf 14a sim": { "command": "hf 14a sim", "description": "Simulate ISO/IEC 14443 type A tag with 4,7 or 10 byte UID Use type 7 for Mifare Ultralight EV1, Amiibo (NTAG215 pack 0x8080)", "notes": [ "hf 14a sim -t 1 --uid 11223344 -> MIFARE Classic 1k", "hf 14a sim -t 2 -> MIFARE Ultralight", "hf 14a sim -t 3 -> MIFARE Desfire", "hf 14a sim -t 4 -> ISO/IEC 14443-4", "hf 14a sim -t 5 -> MIFARE Tnp3xxx", "hf 14a sim -t 6 -> MIFARE Mini", "hf 14a sim -t 7 -> MFU EV1 / NTAG 215 Amiibo", "hf 14a sim -t 8 -> MIFARE Classic 4k", "hf 14a sim -t 9 -> FM11RF005SH Shanghai Metro", "hf 14a sim -t 10 -> ST25TA IKEA Rothult", "hf 14a sim -t 11 -> Javacard (JCOP)", "hf 14a sim -t 12 -> 4K Seos card" ], "offline": false, "options": [ "-h, --help This help", "-t, --type <1-12> Simulation type to use", "-u, --uid <4|7|10> hex bytes UID", "-n, --num Exit simulation after blocks have been read by reader. 0 = infinite", "-x Performs the 'reader attack', nr/ar attack against a reader", "--sk Fill simulator keys from found keys", "-v, --verbose verbose output" ], "usage": "hf 14a sim [-hxv] -t <1-12> [-u ] [-n ] [--sk]" }, "hf 14a sniff": { "command": "hf 14a sniff", "description": "Collect data from the field and save into command buffer. Buffer accessible from command 'hf 14a list'", "notes": [ "hf 14a sniff -c -r" ], "offline": false, "options": [ "-h, --help This help", "-c, --card triggered by first data from card", "-r, --reader triggered by first 7-bit request from reader (REQ,WUP,...)" ], "usage": "hf 14a sniff [-hcr]" }, "hf 14b apdu": { "command": "hf 14b apdu", "description": "Sends an ISO 7816-4 APDU via ISO 14443-4 block transmission protocol (T=CL). works with all apdu types from ISO 7816-4:2013", "notes": [ "hf 14b apdu -s -d 94a40800043f000002", "hf 14b apdu -s --decode -d 00A404000E325041592E5359532E444446303100 -> decode apdu", "hf 14b apdu -sm 00A40400 -l 256 -d 325041592E5359532E4444463031 -> encode standard apdu", "hf 14b apdu -sm 00A40400 -el 65536 -d 325041592E5359532E4444463031 -> encode extended apdu" ], "offline": false, "options": [ "-h, --help This help", "-s, --select activate field and select card", "-k, --keep leave the signal field ON after receive response", "-t, --tlv executes TLV decoder if it possible", "--decode decode apdu request if it possible", "-m, --make make apdu with head from this field and data from data field.", "must be 4 bytes: ", "-e, --extended make extended length apdu if `m` parameter included", "-l, --le Le apdu parameter if `m` parameter included", "-d, --data if `m` parameter included", "--timeout timeout in ms" ], "usage": "hf 14b apdu [-hskte] [--decode] [-m ] [-l ] -d [--timeout ]" }, "hf 14b dump": { "command": "hf 14b dump", "description": "This command dumps the contents of a ISO-14443-B tag and save it to file Tries to autodetect cardtype, memory size defaults to SRI4K", "notes": [ "hf 14b dump", "hf 14b dump -f myfilename" ], "offline": false, "options": [ "-h, --help This help", "-f, --file (optional) filename, if no UID will be used as filename", "--ns no save to file" ], "usage": "hf 14b dump [-h] [-f ] [--ns]" }, "hf 14b info": { "command": "hf 14b info", "description": "Tag information for ISO/IEC 14443 type B based tags", "notes": [ "hf 14b info" ], "offline": false, "options": [ "-h, --help This help", "-s, --aidsearch checks if AIDs from aidlist.json is present on the card and prints information about found AIDs", "-v, --verbose verbose output" ], "usage": "hf 14b info [-hsv]" }, "hf 14b list": { "command": "hf 14b list", "description": "Alias of `trace list -t 14b` with selected protocol data to annotate trace buffer You can load a trace from file (see `trace load -h`) or it be downloaded from device by default It accepts all other arguments of `trace list`. Note that some might not be relevant for this specific protocol", "notes": [ "hf 14b list --frame -> show frame delay times", "hf 14b list -1 -> use trace buffer" ], "offline": true, "options": [ "-h, --help This help", "-1, --buffer use data from trace buffer", "--frame show frame delay times", "-c mark CRC bytes", "-r show relative times (gap and duration)", "-u display times in microseconds instead of clock cycles", "-x show hexdump to convert to pcap(ng)", "or to import into Wireshark using encapsulation type \"ISO 14443\"", "-f, --file filename of dictionary" ], "usage": "hf 14b list [-h1crux] [--frame] [-f ]" }, "hf 14b ndefread": { "command": "hf 14b ndefread", "description": "Print NFC Data Exchange Format (NDEF)", "notes": [ "hf 14b ndefread", "hf 14b ndefread -f myfilename -> save raw NDEF to file" ], "offline": false, "options": [ "-h, --help This help", "-f, --file save raw NDEF to file", "-v, --verbose show technical data" ], "usage": "hf 14b ndefread [-hv] [-f ]" }, "hf 14b raw": { "command": "hf 14b raw", "description": "Sends raw bytes to card", "notes": [ "hf 14b raw -cks --data 0200a40400 -> standard select, apdu 0200a4000 (7816)", "hf 14b raw -ck --sr --data 0200a40400 -> SRx select", "hf 14b raw -ck --cts --data 0200a40400 -> C-ticket select" ], "offline": false, "options": [ "-h, --help This help", "-k, --keep leave the signal field ON after receive response", "-s, --std activate field, use ISO14B select", "--sr activate field, use SRx ST select", "--cts activate field, use ASK C-ticket select", "--xrx activate field, use Fuji/Xerox select", "-c, --crc calculate and append CRC", "-r do not read response from card", "-t, --timeout timeout in ms", "-v, --verbose verbose output", "-d, --data data, bytes to send" ], "usage": "hf 14b raw [-hkscrv] [--sr] [--cts] [--xrx] [-t ] [-d ]" }, "hf 14b rdbl": { "command": "hf 14b rdbl", "description": "Read SRI512 | SRIX4K block", "notes": [ "hf 14b rdbl -b 06" ], "offline": false, "options": [ "-h, --help This help", "-b, --block block number" ], "usage": "hf 14b rdbl [-h] [-b ]" }, "hf 14b reader": { "command": "hf 14b reader", "description": "Act as a 14443B reader to identify a tag", "notes": [ "hf 14b reader", "hf 14b reader -@ -> continuous reader mode" ], "offline": false, "options": [ "-h, --help This help", "-v, --verbose verbose output", "-@ optional - continuous reader mode" ], "usage": "hf 14b reader [-hv@]" }, "hf 14b sim": { "command": "hf 14b sim", "description": "Simulate a ISO/IEC 14443 type B tag with 4 byte UID / PUPI", "notes": [ "hf 14b sim -u 11AA33BB" ], "offline": false, "options": [ "-h, --help This help", "-u, --uid hex 4byte UID/PUPI" ], "usage": "hf 14b sim [-h] -u hex" }, "hf 14b sniff": { "command": "hf 14b sniff", "description": "Sniff the communication reader and tag", "notes": [ "hf 14b sniff" ], "offline": false, "options": [ "-h, --help This help" ], "usage": "hf 14b sniff [-h]" }, "hf 14b sriwrite": { "command": "hf 14b sriwrite", "description": "Write data to a SRI512 or SRIX4K block", "notes": [ "hf 14b sriwrite --4k -b 100 -d 11223344", "hf 14b sriwrite --4k --sb -d 11223344 -> special block write", "hf 14b sriwrite --512 -b 15 -d 11223344", "hf 14b sriwrite --512 --sb -d 11223344 -> special block write" ], "offline": false, "options": [ "-h, --help This help", "-b, --block block number", "-d, --data 4 hex bytes", "--512 target SRI 512 tag", "--4k target SRIX 4k tag", "--sb special block write at end of memory (0xFF)" ], "usage": "hf 14b sriwrite [-h] [-b ] -d [--512] [--4k] [--sb]" }, "hf 14b view": { "command": "hf 14b view", "description": "Print a ISO14443-B dump file (bin/eml/json)", "notes": [ "hf 14b view -f hf-14b-01020304-dump.bin" ], "offline": true, "options": [ "-h, --help This help", "-f, --file Specify a filename for dump file", "-v, --verbose verbose output" ], "usage": "hf 14b view [-hv] -f " }, "hf 15 csetuid": { "command": "hf 15 csetuid", "description": "Set UID for magic Chinese card (only works with such cards)", "notes": [ "hf 15 csetuid -u E011223344556677" ], "offline": false, "options": [ "-h, --help This help", "-u, --uid <8b hex> UID eg E011223344556677" ], "usage": "hf 15 csetuid [-h] -u <8b hex>" }, "hf 15 demod": { "command": "hf 15 demod", "description": "Tries to demodulate / decode ISO-15693, from downloaded samples. Gather samples with 'hf 15 samples' / 'hf 15 sniff'", "notes": [ "hf 15 demod" ], "offline": true, "options": [ "-h, --help This help" ], "usage": "hf 15 demod [-h]" }, "hf 15 dump": { "command": "hf 15 dump", "description": "This command dumps the contents of a ISO-15693 tag and save to file (bin/json)", "notes": [ "hf 15 dump", "hf 15 dump -*", "hf 15 dump -u E011223344556677 -f hf-15-my-dump.bin" ], "offline": false, "options": [ "-h, --help This help", "-u, --uid full UID, 8 bytes", "--ua unaddressed mode", "-* scan for tag", "-2 use slower '1 out of 256' mode", "-o, --opt set OPTION Flag (needed for TI)", "-f, --file Specify a filename for dump file" ], "usage": "hf 15 dump [-h*2o] [-u ] [--ua] [-f ]" }, "hf 15 eload": { "command": "hf 15 eload", "description": "Load memory image from file to be used with 'hf 15 sim'", "notes": [ "hf 15 eload -f hf-15-01020304.bin" ], "offline": false, "options": [ "-h, --help This help", "-f, --file filename of image" ], "usage": "hf 15 eload [-h] -f " }, "hf 15 esave": { "command": "hf 15 esave", "description": "Save emulator memory into two files (bin/json)", "notes": [ "hf 15 esave -f hf-15-01020304hf 15 esave -b 8 -c 42 -f hf-15-01020304" ], "offline": false, "options": [ "-h, --help This help", "-f, --file Specify a filename for dump file", "--bsize block size, defaults to 4", "-c, --count number of blocks to export, defaults to all" ], "usage": "hf 15 esave [-h] -f [--bsize ] [-c ]" }, "hf 15 eview": { "command": "hf 15 eview", "description": "It displays emulator memory", "notes": [ "hf 15 eview", "hf 15 eview -b 8 -c 60" ], "offline": false, "options": [ "-h, --help This help", "-b, --blocksize block size, defaults to 4", "-c, --count number of blocks to display, defaults to all" ], "usage": "hf 15 eview [-h] [-b ] [-c ]" }, "hf 15 findafi": { "command": "hf 15 findafi", "description": "This command attempts to brute force AFI of an ISO-15693 tag Estimated execution time is around 2 minutes", "notes": [ "hf 15 findafi" ], "offline": false, "options": [ "-h, --help This help" ], "usage": "hf 15 findafi [-h]" }, "hf 15 info": { "command": "hf 15 info", "description": "Uses the optional command `get_systeminfo` 0x2B to try and extract information", "notes": [ "hf 15 info", "hf 15 info -*", "hf 15 info -u E011223344556677" ], "offline": false, "options": [ "-h, --help This help", "-u, --uid full UID, 8 bytes", "--ua unaddressed mode", "-* scan for tag", "-2 use slower '1 out of 256' mode", "-o, --opt set OPTION Flag (needed for TI)" ], "usage": "hf 15 info [-h*2o] [-u ] [--ua]" }, "hf 15 list": { "command": "hf 15 list", "description": "Alias of `trace list -t 15` with selected protocol data to annotate trace buffer You can load a trace from file (see `trace load -h`) or it be downloaded from device by default It accepts all other arguments of `trace list`. Note that some might not be relevant for this specific protocol", "notes": [ "hf 15 list --frame -> show frame delay times", "hf 15 list -1 -> use trace buffer" ], "offline": true, "options": [ "-h, --help This help", "-1, --buffer use data from trace buffer", "--frame show frame delay times", "-c mark CRC bytes", "-r show relative times (gap and duration)", "-u display times in microseconds instead of clock cycles", "-x show hexdump to convert to pcap(ng)", "or to import into Wireshark using encapsulation type \"ISO 14443\"", "-f, --file filename of dictionary" ], "usage": "hf 15 list [-h1crux] [--frame] [-f ]" }, "hf 15 passprotectafi": { "command": "hf 15 passprotectafi", "description": "This command enables the password protect of AFI. *** OBS! This action can not be undone! ***", "notes": [ "hf 15 passprotectafi -p 00000000 --force" ], "offline": false, "options": [ "-h, --help This help", "-p, --pwd EAS/AFI password, 8 hex bytes", "--force Force execution of command (irreversible)" ], "usage": "hf 15 passprotectafi [-h] -p [--force]" }, "hf 15 passprotecteas": { "command": "hf 15 passprotecteas", "description": "This command enables the password protect of EAS. *** OBS! This action can not be undone! ***", "notes": [ "hf 15 passprotecteas -p 00000000 --force" ], "offline": false, "options": [ "-h, --help This help", "-p, --pwd EAS/AFI password, 8 hex bytes", "--force Force execution of command (irreversible)" ], "usage": "hf 15 passprotecteas [-h] -p [--force]" }, "hf 15 raw": { "command": "hf 15 raw", "description": "Sends raw bytes over ISO-15693 to card", "notes": [ "hf 15 raw -c -d 260100 -> add crc", "hf 15 raw -krc -d 260100 -> add crc, keep field on, skip response" ], "offline": false, "options": [ "-h, --help This help", "-2 use slower '1 out of 256' mode", "-c, --crc calculate and append CRC", "-k keep signal field ON after receive", "-r do not read response", "-d, --data raw bytes to send" ], "usage": "hf 15 raw [-h2ckr] -d " }, "hf 15 rdbl": { "command": "hf 15 rdbl", "description": "Read page on ISO-15693 tag", "notes": [ "hf 15 rdbl -* -b 12", "hf 15 rdbl -u E011223344556677 -b 12" ], "offline": false, "options": [ "-h, --help This help", "-u, --uid full UID, 8 bytes", "--ua unaddressed mode", "-* scan for tag", "-2 use slower '1 out of 256' mode", "-o, --opt set OPTION Flag (needed for TI)", "-b, --blk page number (0-255)" ], "usage": "hf 15 rdbl [-h*2o] [-u ] [--ua] -b " }, "hf 15 rdmulti": { "command": "hf 15 rdmulti", "description": "Read multiple pages on a ISO-15693 tag", "notes": [ "hf 15 rdmulti -* -b 1 --cnt 6 -> read 6 blocks", "hf 15 rdmulti -u E011223344556677 -b 12 --cnt 3 -> read three blocks" ], "offline": false, "options": [ "-h, --help This help", "-u, --uid full UID, 8 bytes", "--ua unaddressed mode", "-* scan for tag", "-2 use slower '1 out of 256' mode", "-o, --opt set OPTION Flag (needed for TI)", "-b first page number (0-255)", "--cnt number of pages (1-6)" ], "usage": "hf 15 rdmulti [-h*2o] [-u ] [--ua] -b --cnt " }, "hf 15 reader": { "command": "hf 15 reader", "description": "Act as a ISO-15693 reader. Look for ISO-15693 tags until Enter or the pm3 button is pressed", "notes": [ "hf 15 reader", "hf 15 reader -@ -> Continuous mode" ], "offline": false, "options": [ "-h, --help This help", "-@ continuous reader mode" ], "usage": "hf 15 reader [-h@]" }, "hf 15 restore": { "command": "hf 15 restore", "description": "This command restore the contents of a dump file (bin/eml/json) onto a ISO-15693 tag", "notes": [ "hf 15 restore", "hf 15 restore -*", "hf 15 restore -u E011223344556677 -f hf-15-my-dump.bin" ], "offline": false, "options": [ "-h, --help This help", "-u, --uid full UID, 8 bytes", "--ua unaddressed mode", "-* scan for tag", "-2 use slower '1 out of 256' mode", "-o, --opt set OPTION Flag (needed for TI)", "-f, --file Specify a filename for dump file", "-r, --retry number of retries (def 3)", "--bs block size (def 4)", "-v, --verbose verbose output" ], "usage": "hf 15 restore [-h*2ov] [-u ] [--ua] [-f ] [-r ] [--bs ]" }, "hf 15 samples": { "command": "hf 15 samples", "description": "Acquire samples as Reader (enables carrier, send inquiry and download it to graphbuffer. Try 'hf 15 demod' to try to demodulate/decode signal", "notes": [ "hf 15 samples" ], "offline": false, "options": [ "-h, --help This help" ], "usage": "hf 15 samples [-h]" }, "hf 15 sim": { "command": "hf 15 sim", "description": "Simulate a ISO-15693 tag", "notes": [ "hf 15 sim -u E011223344556677" ], "offline": false, "options": [ "-h, --help This help", "-u, --uid <8b hex> UID eg E011223344556677", "-b, --blocksize block size, defaults to 4" ], "usage": "hf 15 sim [-h] -u <8b hex> [-b ]" }, "hf 15 slixeasdisable": { "command": "hf 15 slixeasdisable", "description": "Disable EAS mode on SLIX ISO-15693 tag", "notes": [ "hf 15 slixeasdisable -p 0F0F0F0F" ], "offline": false, "options": [ "-h, --help This help", "-p, --pwd optional password, 8 hex bytes" ], "usage": "hf 15 slixeasdisable [-h] [-p ]" }, "hf 15 slixeasenable": { "command": "hf 15 slixeasenable", "description": "Enable EAS mode on SLIX ISO-15693 tag", "notes": [ "hf 15 slixeasenable -p 0F0F0F0F" ], "offline": false, "options": [ "-h, --help This help", "-p, --pwd optional password, 8 hex bytes" ], "usage": "hf 15 slixeasenable [-h] [-p ]" }, "hf 15 slixprivacydisable": { "command": "hf 15 slixprivacydisable", "description": "Disable privacy mode on SLIX ISO-15693 tag", "notes": [ "hf 15 slixdisable -p 0F0F0F0F" ], "offline": false, "options": [ "-h, --help This help", "-p, --pwd password, 8 hex bytes" ], "usage": "hf 15 slixprivacydisable [-h] -p " }, "hf 15 slixprivacyenable": { "command": "hf 15 slixprivacyenable", "description": "Enable privacy mode on SLIX ISO-15693 tag", "notes": [ "hf 15 slixenable -p 0F0F0F0F" ], "offline": false, "options": [ "-h, --help This help", "-p, --pwd password, 8 hex bytes" ], "usage": "hf 15 slixprivacyenable [-h] -p " }, "hf 15 slixwritepwd": { "command": "hf 15 slixwritepwd", "description": "Write a password on a SLIX family ISO-15693 tag.nSome tags do not support all different password types.", "notes": [ "hf 15 slixwritepwd -t READ -o 00000000 -n 12131415" ], "offline": false, "options": [ "-h, --help This help", "-t, --type which password field to write to", "-o, --old old password (if present), 8 hex bytes", "-n, --new new password, 8 hex bytes" ], "usage": "hf 15 slixwritepwd [-h] -t [-o ] -n " }, "hf 15 sniff": { "command": "hf 15 sniff", "description": "Sniff activity without enabling carrier", "notes": [ "hf 15 sniff" ], "offline": false, "options": [ "-h, --help This help" ], "usage": "hf 15 sniff [-h]" }, "hf 15 view": { "command": "hf 15 view", "description": "Print a ISO-15693 tag dump file (bin/eml/json)", "notes": [ "hf 15 view -f hf-iclass-AA162D30F8FF12F1-dump.bin" ], "offline": true, "options": [ "-h, --help This help", "-f, --file Specify a filename for dump file" ], "usage": "hf 15 view [-h] -f " }, "hf 15 wrbl": { "command": "hf 15 wrbl", "description": "Write block on ISO-15693 tag", "notes": [ "hf 15 wrbl -* -b 12 -d AABBCCDD", "hf 15 wrbl -u E011223344556677 -b 12 -d AABBCCDD" ], "offline": false, "options": [ "-h, --help This help", "-u, --uid full UID, 8 bytes", "--ua unaddressed mode", "-* scan for tag", "-2 use slower '1 out of 256' mode", "-o, --opt set OPTION Flag (needed for TI)", "-b, --blk page number (0-255)", "-d, --data data, 4 bytes", "-v, --verbose verbose output" ], "usage": "hf 15 wrbl [-h*2ov] [-u ] [--ua] -b -d " }, "hf 15 writeafi": { "command": "hf 15 writeafi", "description": "Write AFI on card", "notes": [ "hf 15 writeafi -* --afi 12", "hf 15 writeafi -u E011223344556677 --afi 12 -p 0F0F0F0F" ], "offline": false, "options": [ "-h, --help This help", "-u, --uid full UID, 8 bytes", "--afi AFI number (0-255)", "-p, --pwd optional AFI/EAS password" ], "usage": "hf 15 writeafi [-h] [-u ] --afi [-p ]" }, "hf 15 writedsfid": { "command": "hf 15 writedsfid", "description": "Write DSFID on card", "notes": [ "hf 15 writedsfid -* --dsfid 12", "hf 15 writedsfid -u E011223344556677 --dsfid 12" ], "offline": false, "options": [ "-h, --help This help", "-u, --uid full UID, 8 bytes", "--ua unaddressed mode", "-* scan for tag", "-2 use slower '1 out of 256' mode", "-o, --opt set OPTION Flag (needed for TI)", "--dsfid DSFID number (0-255)" ], "usage": "hf 15 writedsfid [-h*2o] [-u ] [--ua] --dsfid " }, "hf cipurse aread": { "command": "hf cipurse aread", "description": "Read file attributes by file ID with key ID and key. If no key is supplied, default key of 737373...7373 will be used", "notes": [ "hf cipurse aread --fid 2ff7 -> Select MF, Authenticate with keyID 1, read file attributes with id 2ff7", "hf cipurse aread --mfd -> read file attributes for master file (MF)", "hf cipurse aread --chfid 0102 -> read file 0102 attributes in the default application", "hf cipurse aread --aid 4144204632 --chfid 0102 -> read file 0102 attributes in the 4144204632 application", "hf cipurse aread -n 2 -k 65656565656565656565656565656565 --fid 2ff7 -> Authenticate keyID 2, read file attributes" ], "offline": false, "options": [ "-h, --help This help", "-a, --apdu Show APDU requests and responses", "-v, --verbose Verbose mode", "-n Key ID", "-k, --key Auth key", "--mfd Show info about master file", "--aid Select application ID (AID) ( 1..16 bytes )", "--fid File ID", "--chfid Child file ID (EF under application/master file) ( 2 bytes )", "--noauth Read file attributes without authentication", "--sreq Communication reader-PICC security level (def: mac)", "--sresp Communication PICC-reader security level (def: mac)" ], "usage": "hf cipurse aread [-hav] [-n ] [-k ] [--mfd] [--aid ] [--fid ] [--chfid ] [--noauth] [--sreq ] [--sresp ]" }, "hf cipurse auth": { "command": "hf cipurse auth", "description": "Authenticate with key ID and key. If no key is supplied, default key of 737373...7373 will be used", "notes": [ "hf cipurse auth -> Authenticate with keyID 1, default key", "hf cipurse auth -n 2 -k 65656565656565656565656565656565 -> Authenticate keyID 2 with key" ], "offline": false, "options": [ "-h, --help This help", "-a, --apdu Show APDU requests and responses", "-v, --verbose Verbose mode", "--aid Application ID (AID) ( 1..16 bytes )", "--fid Top file/application ID (FID) ( 2 bytes )", "--mfd Select masterfile by empty id", "-n Key ID", "-k, --key Auth key" ], "usage": "hf cipurse auth [-hav] [--aid ] [--fid ] [--mfd] [-n ] [-k ]" }, "hf cipurse awrite": { "command": "hf cipurse awrite", "description": "Write file attributes by file ID with key ID and key. If no key is supplied, default key of 737373...7373 will be used", "notes": [ "hf cipurse awrite --fid 2ff7 -d 080000C1C1C1C1C1C1C1C1C1 -> write default file attributes with id 2ff7", "hf cipurse awrite --mfd -d 080000FFFFFFFFFFFFFFFFFF86023232 --commit -> write file attributes for master file (MF)", "hf cipurse awrite --chfid 0102 -d 020000ffffff -> write file 0102 attributes in the default application to full access", "hf cipurse awrite --chfid 0102 -d 02000040ffff -> write file 0102 attributes in the default application to full access with keys 1 and 2" ], "offline": false, "options": [ "-h, --help This help", "-a, --apdu Show APDU requests and responses", "-v, --verbose Verbose mode", "-n Key ID", "-k, --key Auth key", "--mfd Show info about master file", "--aid Select application ID (AID) ( 1..16 bytes )", "--fid File ID", "--chfid Child file ID (EF under application/master file) ( 2 bytes )", "--noauth Read file attributes without authentication", "--sreq Communication reader-PICC security level (def: mac)", "--sresp Communication PICC-reader security level (def: mac)", "-d, --data File attributes", "--commit Commit after write" ], "usage": "hf cipurse awrite [-hav] [-n ] [-k ] [--mfd] [--aid ] [--fid ] [--chfid ] [--noauth] [--sreq ] [--sresp ] [-d ] [--commit]" }, "hf cipurse create": { "command": "hf cipurse create", "description": "Create application/file/key by provide appropriate DGI. If no key is supplied, default key of 737373...7373 will be used", "notes": [ "hf cipurse create -d 9200123F00200008000062098407A0000005070100 -> create PTSE file with FID 0x2000 and space for 8 AIDs", "hf cipurse create -d 92002438613F010A050200004040FF021009021009621084054144204631D407A0000005070100A00F2873737373737373737373737373737373015FD67B000102030405060708090A0B0C0D0E0F01C6A13B -> create default file with FID 3F01 and 2 keys", "hf cipurse create --aid 4144204631 -d 92010C010001020030020000FFFFFF -> create 0x0102 binary data EF under application 4144204631" ], "offline": false, "options": [ "-h, --help This help", "-a, --apdu Show APDU requests and responses", "-v, --verbose Verbose mode", "-n Key ID", "-k, --key Auth key", "--aid Application ID (AID) ( 1..16 bytes )", "--fid File ID (FID) ( 2 bytes )", "--mfd Select masterfile by empty id", "-d, --data Data with DGI for create", "--sreq Communication reader-PICC security level (def: mac)", "--sresp Communication PICC-reader security level (def: mac)", "--no-auth Execute without authentication", "--commit Commit after create" ], "usage": "hf cipurse create [-hav] [-n ] [-k ] [--aid ] [--fid ] [--mfd] [-d ] [--sreq ] [--sresp ] [--no-auth] [--commit]" }, "hf cipurse default": { "command": "hf cipurse default", "description": "Set default parameters for access to cipurse card", "notes": [ "hf cipurse default --reset -> reset parameters to default", "hf cipurse default -n 1 -k 65656565656565656565656565656565 --fid 2ff7 -> Set key, key id and file id", "hf cipurse default --aid 4144204632 -> set default application id" ], "offline": false, "options": [ "-h, --help This help", "--clear Resets to defaults", "-n Key ID", "-k, --key Authentication key", "--aid Application ID (AID) ( 1..16 bytes )", "--fid File ID ( 2 bytes )" ], "usage": "hf cipurse default [-h] [--clear] [-n ] [-k ] [--aid ] [--fid ]" }, "hf cipurse delete": { "command": "hf cipurse delete", "description": "Delete file by file ID with key ID and key. If no key is supplied, default key of 737373...7373 will be used", "notes": [ "hf cipurse delete --fid 2ff7 -> Authenticate with keyID 1, delete file with id 2ff7 at top level", "hf cipurse delete -n 2 -k 65656565656565656565656565656565 --fid 2ff7 -> Authenticate keyID 2 and delete file", "hf cipurse delete --aid A0000005070100 --no-auth -> delete PTSE file with AID A0000005070100 without authentication", "hf cipurse delete --aid 4144204631 --chfid 0102 -> delete EF with FID 0x0102 under default application" ], "offline": false, "options": [ "-h, --help This help", "-a, --apdu Show APDU requests and responses", "-v, --verbose Verbose mode", "-n Key ID", "-k, --key Auth key", "--fid File/application ID under MF for delete", "--aid Application ID (AID) for delete ( 1..16 bytes )", "--chfid Child file ID (EF under application/master file) ( 2 bytes )", "--sreq Communication reader-PICC security level (def: mac)", "--sresp Communication PICC-reader security level (def: mac)", "--no-auth Execute without authentication", "--commit commit after delete" ], "usage": "hf cipurse delete [-hav] [-n ] [-k ] [--fid ] [--aid ] [--chfid ] [--sreq ] [--sresp ] [--no-auth] [--commit]" }, "hf cipurse formatall": { "command": "hf cipurse formatall", "description": "Format card. Erases all the data at the card level!", "notes": [ "hf cipurse formatall -> Format card with default key", "hf cipurse formatall -n 2 -k 65656565656565656565656565656565 -> Format card with keyID 2", "hf cipurse formatall --no-auth -> Format card without authentication. Works for card in perso state" ], "offline": false, "options": [ "-h, --help This help", "-a, --apdu Show APDU requests and responses", "-v, --verbose Verbose mode", "-n Key ID", "-k, --key Auth key", "--sreq Communication reader-PICC security level (def: mac)", "--sresp Communication PICC-reader security level (def: mac)", "--no-auth Execute without authentication" ], "usage": "hf cipurse formatall [-hav] [-n ] [-k ] [--sreq ] [--sresp ] [--no-auth]" }, "hf cipurse info": { "command": "hf cipurse info", "description": "Get info from CIPURSE tags", "notes": [ "hf cipurse info" ], "offline": false, "options": [ "-h, --help This help" ], "usage": "hf cipurse info [-h]" }, "hf cipurse read": { "command": "hf cipurse read", "description": "Read file in the application by file ID with key ID and key. If no key is supplied, default key of 737373...7373 will be used", "notes": [ "hf cipurse read --fid 2ff7 -> Authenticate with keyID 1, read file with id 2ff7", "hf cipurse read -n 2 -k 65656565656565656565656565656565 --fid 2ff7 -> Authenticate keyID 2 and read file", "hf cipurse read --aid 4144204631 --fid 0102 -> read file with id 0102 from application 4144204631" ], "offline": false, "options": [ "-h, --help This help", "-a, --apdu Show APDU requests and responses", "-v, --verbose Verbose mode", "-n Key ID", "-k, --key Auth key", "--aid Application ID (AID) ( 1..16 bytes )", "--fid File ID", "-o, --offset Offset for reading data from file", "--noauth Read file without authentication", "--sreq Communication reader-PICC security level (def: mac)", "--sresp Communication PICC-reader security level (def: mac)" ], "usage": "hf cipurse read [-hav] [-n ] [-k ] [--aid ] [--fid ] [-o ] [--noauth] [--sreq ] [--sresp ]" }, "hf cipurse select": { "command": "hf cipurse select", "description": "Select application or file", "notes": [ "hf cipurse select --aid A0000005070100 -> Select PTSE application by AID", "hf cipurse select --fid 3f00 -> Select master file by FID 3f00", "hf cipurse select --fid 2ff7 -> Select attribute file by FID 2ff7", "hf cipurse select --mfd -vt -> Select default file by empty FID and show response data in plain and TLV decoded format" ], "offline": false, "options": [ "-h, --help This help", "-a, --apdu Show APDU requests and responses", "-v, --verbose Verbose mode", "-t, --tlv TLV decode returned data", "--aid Application ID (AID) 1..16 bytes", "--fid Top level file (or application) ID (FID) 2 bytes", "--mfd Select masterfile by empty id", "--chfid Child file ID (EF under application/master file) 2 bytes" ], "usage": "hf cipurse select [-havt] [--aid ] [--fid ] [--mfd] [--chfid ]" }, "hf cipurse test": { "command": "hf cipurse test", "description": "Regression tests", "notes": [ "hf cipurse test" ], "offline": true, "options": [ "-h, --help This help" ], "usage": "hf cipurse test [-h]" }, "hf cipurse updakey": { "command": "hf cipurse updakey", "description": "Update key attributes. Factory default - 0x02. b0 - Update right - 1 self b1 - Change key and rights - 0 frozen b2 - Use as key encryption key - 1 blocked b8 - Key validity - 0 valid", "notes": [ "hf cipurse updakey --trgkeyn 2 --attr 80 -> block key 2 for lifetime (WARNING!)", "hf cipurse updakey --trgkeyn 1 --attr 02 --commit -> for key 1" ], "offline": false, "options": [ "-h, --help This help", "-a, --apdu Show APDU requests and responses", "-v, --verbose Show technical data", "-n Key ID for authentication", "-k, --key Auth key", "--aid Application ID (AID)", "--fid File ID (FID)", "--mfd Select masterfile by empty id", "--trgkeyn Target key ID", "--attr Key attributes 1 byte", "--sreq Communication reader-PICC security level", "--sresp Communication PICC-reader security level", "--no-auth Execute without authentication", "--commit Commit" ], "usage": "hf cipurse updakey [-hav] [-n ] [-k ] [--aid ] [--fid ] [--mfd] [--trgkeyn ] [--attr ] [--sreq ] [--sresp ] [--no-auth] [--commit]" }, "hf cipurse updkey": { "command": "hf cipurse updkey", "description": "Update key", "notes": [ "hf cipurse updkey --aid 4144204631 --newkeyn 2 --newkeya 00 --newkey 73737373737373737373737373737373 -> update default application key 2 with default value 73..73", "hf cipurse updkey --newkeyn 1 --newkeya 00 --newkey 0102030405060708090a0b0c0d0e0f10 --commit -> for key 1" ], "offline": false, "options": [ "-h, --help This help", "-a, --apdu Show APDU requests and responses", "-v, --verbose Show technical data", "-n Key ID for authentication", "-k, --key Auth key", "--aid Application ID (AID)", "--fid File ID (FID)", "--mfd Select masterfile by empty id", "--newkeyn Target key ID", "--newkey New key", "--newkeya New key additional info (def: 0x00)", "--enckeyn Encrypt key ID (must be equal to the key on the card)", "--enckey Encrypt key (must be equal to the key on the card)", "--sreq Communication reader-PICC security level", "--sresp Communication PICC-reader security level", "--no-auth Execute without authentication", "--commit Commit" ], "usage": "hf cipurse updkey [-hav] [-n ] [-k ] [--aid ] [--fid ] [--mfd] [--newkeyn ] [--newkey ] [--newkeya ] [--enckeyn ] [--enckey ] [--sreq ] [--sresp ] [--no-auth] [--commit]" }, "hf cipurse write": { "command": "hf cipurse write", "description": "Write file in the application by file ID with key ID and key. If no key is supplied, default key of 737373...7373 will be used", "notes": [ "hf cipurse write --fid 2ff7 -d aabb -> Authenticate with keyID 1, write file with id 2ff7", "hf cipurse write -n 2 -k 65656565656565656565656565656565 --fid 2ff7 -d aabb -> Authenticate keyID 2 and write file", "hf cipurse write --aid 4144204631 --fid 0102 -d aabb -> write file with id 0102 in the 4144204631 application", "hf cipurse write --fid 0102 -d aabb --commit -> write file with id 0102 and perform commit after write" ], "offline": false, "options": [ "-h, --help This help", "-a, --apdu Show APDU requests and responses", "-v, --verbose Verbose mode", "-n Key ID", "-k, --key Auth key", "--aid Application ID (AID) ( 1..16 bytes )", "--fid File ID", "-o, --offset Offset for reading data from file", "--noauth Read file without authentication", "--sreq Communication reader-PICC security level (def: mac)", "--sresp Communication PICC-reader security level (def: mac)", "-d, --data Data to write to new file", "--commit Commit after write" ], "usage": "hf cipurse write [-hav] [-n ] [-k ] [--aid ] [--fid ] [-o ] [--noauth] [--sreq ] [--sresp ] [-d ] [--commit]" }, "hf emrtd dump": { "command": "hf emrtd dump", "description": "Dump all files on an eMRTD", "notes": [ "hf emrtd dump", "hf emrtd dump --dir ../dump", "hf emrtd dump -n 123456789 -d 19890101 -e 20250401" ], "offline": false, "options": [ "-h, --help This help", "-n, --documentnumber document number, up to 9 chars", "-d, --dateofbirth date of birth in YYMMDD format", "-e, --expiry expiry in YYMMDD format", "-m, --mrz <[0-9A-Z<]> 2nd line of MRZ, 44 chars", "--dir save dump to the given dirpath" ], "usage": "hf emrtd dump [-h] [-n ] [-d ] [-e ] [-m <[0-9A-Z<]>] [--dir ]" }, "hf emrtd info": { "command": "hf emrtd info", "description": "Display info about an eMRTD", "notes": [ "hf emrtd info", "hf emrtd info --dir ../dumps", "hf emrtd info -n 123456789 -d 19890101 -e 20250401", "hf emrtd info -n 123456789 -d 19890101 -e 20250401 -i" ], "offline": true, "options": [ "-h, --help This help", "-n, --documentnumber document number, up to 9 chars", "-d, --dateofbirth date of birth in YYMMDD format", "-e, --expiry expiry in YYMMDD format", "-m, --mrz <[0-9A-Z<]> 2nd line of MRZ, 44 chars (passports only)", "--dir display info from offline dump stored in dirpath", "-i, --images show images" ], "usage": "hf emrtd info [-hi] [-n ] [-d ] [-e ] [-m <[0-9A-Z<]>] [--dir ]" }, "hf emrtd list": { "command": "hf emrtd list", "description": "Alias of `trace list -t 7816` with selected protocol data to annotate trace buffer You can load a trace from file (see `trace load -h`) or it be downloaded from device by default It accepts all other arguments of `trace list`. Note that some might not be relevant for this specific protocol", "notes": [ "hf emrtd list --frame -> show frame delay times", "hf emrtd list -1 -> use trace buffer" ], "offline": true, "options": [ "-h, --help This help", "-1, --buffer use data from trace buffer", "--frame show frame delay times", "-c mark CRC bytes", "-r show relative times (gap and duration)", "-u display times in microseconds instead of clock cycles", "-x show hexdump to convert to pcap(ng)", "or to import into Wireshark using encapsulation type \"ISO 14443\"", "-f, --file filename of dictionary" ], "usage": "hf emrtd list [-h1crux] [--frame] [-f ]" }, "hf epa cnonces": { "command": "hf epa cnonces", "description": "Tries to collect nonces when doing part of PACE protocol.", "notes": [ "hf epa cnonces --size 4 --num 4 --delay 1" ], "offline": false, "options": [ "-h, --help This help", "--size nonce size", "--num number of nonces to collect", "-d, --delay delay between attempts" ], "usage": "hf epa cnonces [-h] --size --num -d " }, "hf epa replay": { "command": "hf epa replay", "description": "Perform PACE protocol by replaying given APDUs", "notes": [ "hf epa replay --mse 0022C1A4 --get 1068000000 --map 1086000002 --pka 1234ABCDEF --ma 1A2B3C4D" ], "offline": false, "options": [ "-h, --help This help", "--mse msesa APDU", "--get gn APDU", "--map map APDU", "--pka pka APDU", "--ma ma APDU" ], "usage": "hf epa replay [-h] --mse --get --map --pka --ma " }, "hf epa sim": { "command": "hf epa sim", "description": "Simulate PACE protocol with given password pwd of type pty. The crypto is performed on pc or proxmark", "notes": [ "hf epa sim --pwd 112233445566", "hf epa sim --pc --pty 1 --pwd 112233445566" ], "offline": false, "options": [ "-h, --help This help", "--pc perform crypto on PC", "--pty type of password", "-p, --pwd password" ], "usage": "hf epa sim [-h] --pc --pty -p " }, "hf felica auth1": { "command": "hf felica auth1", "description": "Initiate mutual authentication. This command must always be executed before Auth2 command and mutual authentication is achieve only after Auth2 command has succeeded. INCOMPLETE / EXPERIMENTAL COMMAND!!!", "notes": [ "hf felica auth1 --an 01 --acl 0000 --sn 01 --scl 8B00 --key AAAAAAAAAAAAAAAABBBBBBBBBBBBBBBB", "hf felica auth1 --an 01 --acl 0000 --sn 01 --scl 8B00 --key AAAAAAAAAAAAAAAABBBBBBBBBBBBBBBBAAAAAAAAAAAAAAAA", "hf felica auth1 -i 11100910C11BC407 --an 01 --acl 0000 --sn 01 ..scl 8B00 --key AAAAAAAAAAAAAAAABBBBBBBBBBBBBBBB" ], "offline": false, "options": [ "-h, --help This help", "--an number of areas, 1 byte", "--acl area code list, 2 bytes", "-i set custom IDm", "--sn number of service, 1 byte", "--scl service code list, 2 bytes", "-k, --key 3des key, 16 bytes", "-v, --verbose verbose output" ], "usage": "hf felica auth1 [-hv] [--an ] [--acl ] [-i ] [--sn ] [--scl ] [-k ]" }, "hf felica auth2": { "command": "hf felica auth2", "description": "Complete mutual authentication. This command can only be executed subsquent to Auth1 INCOMPLETE / EXPERIMENTAL COMMAND!!! EXPERIMENTAL COMMAND - M2c/P2c will be not checked", "notes": [ "hf felica auth2 --cc 0102030405060708 --key AAAAAAAAAAAAAAAABBBBBBBBBBBBBBBB", "hf felica auth2 -i 11100910C11BC407 --cc 0102030405060708 --key AAAAAAAAAAAAAAAABBBBBBBBBBBBBBBB" ], "offline": false, "options": [ "-h, --help This help", "-i set custom IDm", "-c, --cc M3c card challenge, 8 bytes", "-k, --key 3des M3c decryption key, 16 bytes", "-v, --verbose verbose output" ], "usage": "hf felica auth2 [-hv] [-i ] [-c ] [-k ]" }, "hf felica info": { "command": "hf felica info", "description": "Reader for FeliCa based tags", "notes": [ "hf felica info" ], "offline": false, "options": [ "-h, --help This help" ], "usage": "hf felica info [-h]" }, "hf felica list": { "command": "hf felica list", "description": "Alias of `trace list -t felica` with selected protocol data to annotate trace buffer You can load a trace from file (see `trace load -h`) or it be downloaded from device by default It accepts all other arguments of `trace list`. Note that some might not be relevant for this specific protocol", "notes": [ "hf felica list --frame -> show frame delay times", "hf felica list -1 -> use trace buffer" ], "offline": true, "options": [ "-h, --help This help", "-1, --buffer use data from trace buffer", "--frame show frame delay times", "-c mark CRC bytes", "-r show relative times (gap and duration)", "-u display times in microseconds instead of clock cycles", "-x show hexdump to convert to pcap(ng)", "or to import into Wireshark using encapsulation type \"ISO 14443\"", "-f, --file filename of dictionary" ], "usage": "hf felica list [-h1crux] [--frame] [-f ]" }, "hf felica litedump": { "command": "hf felica litedump", "description": "Dump ISO/18092 FeliCa Lite tag. It will timeout after 200sec", "notes": [ "hf felica litedump" ], "offline": false, "options": [ "-h, --help This help" ], "usage": "hf felica litedump [-h]" }, "hf felica litesim": { "command": "hf felica litesim", "description": "Emulating ISO/18092 FeliCa Lite tag", "notes": [ "hf felica litesim -u 1122334455667788" ], "offline": false, "options": [ "-h, --help This help", "-u, --uid UID/NDEF2 8 hex bytes" ], "usage": "hf felica litesim [-h] -u " }, "hf felica raw": { "command": "hf felica raw", "description": "Send raw hex data to tag", "notes": [ "hf felica raw -cs 20", "hf felica raw -cs 2008" ], "offline": false, "options": [ "-h, --help This help", "-a active signal field ON without select", "-c calculate and append CRC", "-k keep signal field ON after receive", "-n number of bits", "-r do not read response", "-s active signal field ON with select", " raw bytes to send" ], "usage": "hf felica raw [-hackrs] [-n ] " }, "hf felica rdbl": { "command": "hf felica rdbl", "description": "Use this command to read block data from authentication-not-required Service. - Mode shall be Mode0. - Successful == block data - Unsuccessful == Status Flag1 and Flag2", "notes": [ "hf felica rdbl --sn 01 --scl 8B00 --bn 01 --ble 8000", "hf felica rdbl --sn 01 --scl 4B18 --bn 01 --ble 8000 -b", "hf felica rdbl -i 01100910c11bc407 --sn 01 --scl 8B00 --bn 01 --ble 8000" ], "offline": false, "options": [ "-h, --help This help", "-b get all block list elements 00 -> FF", "-i set custom IDm", "-l, --long use 3 byte block list element block number", "--sn number of service", "--scl service code list", "--bn number of block", "--ble block list element (def 2|3 bytes)", "-v, --verbose verbose output" ], "usage": "hf felica rdbl [-hblv] [-i ] [--sn ] [--scl ] [--bn ] [--ble ]" }, "hf felica reader": { "command": "hf felica reader", "description": "Act as a ISO 18092 / FeliCa reader. Look for FeliCa tags until Enter or the pm3 button is pressed", "notes": [ "hf felica reader -@ -> Continuous mode" ], "offline": false, "options": [ "-h, --help This help", "-s, --silent silent (no messages)", "-@ optional - continuous reader mode" ], "usage": "hf felica reader [-hs@]" }, "hf felica resetmode": { "command": "hf felica resetmode", "description": "Use this command to reset Mode to Mode 0.", "notes": [ "hf felica resetmode", "hf felica resetmode -r 0001", "hf felica resetmode -i 11100910C11BC407" ], "offline": false, "options": [ "-h, --help This help", "-i set custom IDm", "-r set custom reserve", "-v, --verbose verbose output" ], "usage": "hf felica resetmode [-hv] [-i ] [-r ]" }, "hf felica rqresponse": { "command": "hf felica rqresponse", "description": "Use this command to verify the existence of a card and its Mode. - current mode of the card is returned", "notes": [ "hf felica rqresponse -i 11100910C11BC407" ], "offline": false, "options": [ "-h, --help This help", "-i set custom IDm" ], "usage": "hf felica rqresponse [-h] [-i ]" }, "hf felica rqservice": { "command": "hf felica rqservice", "description": "Use this command to verify the existence of Area and Service, and to acquire Key Version: - When the specified Area or Service exists, the card returns Key Version. - When the specified Area or Service does not exist, the card returns FFFFh as Key Version. For Node Code List of a command packet, Area Code or Service Code of the target of acquisition of Key Version shall be enumerated in Little Endian format. If Key Version of System is the target of acquisition, FFFFh shall be specified in the command packet.", "notes": [ "hf felcia rqservice --node 01 --code FFFF", "hf felcia rqservice -a --code FFFF", "hf felica rqservice -i 011204126417E405 --node 01 --code FFFF" ], "offline": false, "options": [ "-h, --help This help", "-a, --all auto node number mode, iterates through all nodes 1 < n < 32", "-n, --node Number of Node", "-c, --code Node Code List (little endian)", "-i, --idm use custom IDm" ], "usage": "hf felica rqservice [-ha] [-n ] [-c ] [-i ]" }, "hf felica rqspecver": { "command": "hf felica rqspecver", "description": "Use this command to acquire the version of card OS. Response: - Format version: Fixed value 00h. Provided only if Status Flag1 = 00h - Basic version: Each value of version is expressed in BCD notation. Provided only if Status Flag1 = 00h - Number of Option: value = 0: AES card, value = 1: AES/DES card. Provided only if Status Flag1 = 00h - Option version list: Provided only if Status Flag1 = 00h - AES card: not added - AES/DES card: DES option version is added - BCD notation", "notes": [ "hf felica rqspecver", "hf felica rqspecver -r 0001", "hf felica rqspecver -i 11100910C11BC407" ], "offline": false, "options": [ "-h, --help This help", "-i set custom IDm", "-r set custom reserve", "-v, --verbose verbose output" ], "usage": "hf felica rqspecver [-hv] [-i ] [-r ]" }, "hf felica rqsyscode": { "command": "hf felica rqsyscode", "description": "Use this command to acquire System Code registered to the card. - if a card is divided into more than one System, this command acquires System Code of each System existing in the card.", "notes": [ "hf felica rqsyscode", "hf felica rqsyscode -i 11100910C11BC407" ], "offline": false, "options": [ "-h, --help This help", "-i set custom IDm" ], "usage": "hf felica rqsyscode [-h] [-i ]" }, "hf felica scsvcode": { "command": "hf felica scsvcode", "description": "Feature not implemented yet. Feel free to contribute!", "notes": [ "hf felica scsvcode" ], "offline": false, "options": [ "-h, --help This help" ], "usage": "hf felica scsvcode [-h]" }, "hf felica sniff": { "command": "hf felica sniff", "description": "Collect data from the field and save into command buffer. Buffer accessible from `hf felica list`", "notes": [ "hf felica sniff", "hf felica sniff -s 10 -t 19" ], "offline": false, "options": [ "-h, --help This help", "-s, --samples samples to skip", "-t, --trig triggers to skip" ], "usage": "hf felica sniff [-h] [-s ] [-t ]" }, "hf felica wrbl": { "command": "hf felica wrbl", "description": "Use this command to write block data to authentication-not-required Service. - Mode shall be Mode0. - Un-/Ssuccessful == Status Flag1 and Flag2", "notes": [ "hf felica wrbl --sn 01 --scl CB10 --bn 01 --ble 8001 -d 0102030405060708090A0B0C0D0E0F10", "hf felica wrbl -i 01100910c11bc407 --sn 01 --scl CB10 --bn 01 --ble 8001 -d 0102030405060708090A0B0C0D0E0F10" ], "offline": false, "options": [ "-h, --help This help", "-d, --data data, 16 hex bytes", "-i set custom IDm", "--sn number of service", "--scl service code list", "--bn number of block", "--ble block list element (def 2|3 bytes)", "-v, --verbose verbose output" ], "usage": "hf felica wrbl [-hv] [-d ] [-i ] [--sn ] [--scl ] [--bn ] [--ble ]" }, "hf fido assert": { "command": "hf fido assert", "description": "Execute a FIDO2 Get Assertion command. Needs json file with parameters. Sample file `fido2_defparams.json` in `client/resources/`. - Needs if `rk` option is `false` (authenticator doesn't store credential to its memory) - for yubikey there must be only one option `\"up\": true` or false", "notes": [ "hf fido assert -> default parameters file `fido2_defparams.json`", "hf fido assert -f test.json -l -> use parameters file `text.json` and add to request CredentialId" ], "offline": false, "options": [ "-h, --help This help", "-a, --apdu Show APDU requests and responses", "-v, --verbose Verbose mode. vv - show full certificates data", "-c, --cbor Show CBOR decoded data", "-l, --list Add CredentialId from json to allowList", "-f, --file Parameter JSON file name" ], "usage": "hf fido assert [-havcl] [-f ]" }, "hf fido auth": { "command": "hf fido auth", "description": "Initiate a U2F token authentication. Needs key handle and two 32-byte hash numbers. key handle(var 0..255), challenge parameter (32b) and application parameter (32b) The default config filename is `fido2_defparams.json`", "notes": [ "hf fido auth --kh 000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f -> execute command with 2 parameters, filled 0x00 and key handle", "hf fido auth", "--kh 000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f", "--cpx 000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f", "--apx 000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f -> execute command with parameters" ], "offline": false, "options": [ "-h, --help This help", "-a, --apdu Show APDU requests and responses", "-v, --verbose Verbose mode", "default mode: dont-enforce-user-presence-and-sign", "-u, --user mode: enforce-user-presence-and-sign", "-c, --check mode: check-only", "-f, --file JSON file name for parameters", "-k, --key Public key to verify signature", "--kh Key handle (var 0..255b)", "--cp Challenge parameter (1..16 chars)", "--ap Application parameter (1..16 chars)", "--cpx Challenge parameter (32 bytes hex)", "--apx Application parameter (32 bytes hex)" ], "usage": "hf fido auth [-havuc] default mode: [-f ] [-k ] [--kh ] [--cp ] [--ap ] [--cpx ] [--apx ]" }, "hf fido info": { "command": "hf fido info", "description": "Get info from Fido tags", "notes": [ "hf fido info" ], "offline": false, "options": [ "-h, --help This help" ], "usage": "hf fido info [-h]" }, "hf fido list": { "command": "hf fido list", "description": "Alias of `trace list -t 14a` with selected protocol data to annotate trace buffer You can load a trace from file (see `trace load -h`) or it be downloaded from device by default It accepts all other arguments of `trace list`. Note that some might not be relevant for this specific protocol", "notes": [ "hf fido list --frame -> show frame delay times", "hf fido list -1 -> use trace buffer" ], "offline": true, "options": [ "-h, --help This help", "-1, --buffer use data from trace buffer", "--frame show frame delay times", "-c mark CRC bytes", "-r show relative times (gap and duration)", "-u display times in microseconds instead of clock cycles", "-x show hexdump to convert to pcap(ng)", "or to import into Wireshark using encapsulation type \"ISO 14443\"", "-f, --file filename of dictionary" ], "usage": "hf fido list [-h1crux] [--frame] [-f ]" }, "hf fido make": { "command": "hf fido make", "description": "Execute a FIDO2 Make Credential command. Needs json file with parameters. Sample file `fido2_defparams.json` in `client/resources/`. - for yubikey there must be only one option `\"rk\": true` or false", "notes": [ "hf fido make -> use default parameters file `fido2_defparams.json`", "hf fido make -f test.json -> use parameters file `text.json`" ], "offline": false, "options": [ "-h, --help This help", "-a, --apdu Show APDU requests and responses", "-v, --verbose Verbose mode. vv - show full certificates data", "-t, --tlv Show DER certificate contents in TLV representation", "-c, --cbor Show CBOR decoded data", "-f, --file Parameter JSON file name" ], "usage": "hf fido make [-havtc] [-f ]" }, "hf fido reg": { "command": "hf fido reg", "description": "Initiate a U2F token registration. Needs two 32-byte hash numbers. challenge parameter (32b) and application parameter (32b). The default config filename is `fido2_defparams.json`", "notes": [ "hf fido reg -> execute command with 2 parameters, filled 0x00", "hf fido reg --cp s0 --ap s1 -> execute command with plain parameters", "hf fido reg --cpx 000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f --apx 000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f", "hf fido reg -f fido2-params -> execute command with custom config file" ], "offline": false, "options": [ "-h, --help This help", "-a, --apdu Show APDU requests and responses", "-v, --verbose Verbose mode. vv - show full certificates data", "-t, --tlv Show DER certificate contents in TLV representation", "-f, --file JSON input file name for parameters", "--cp Challenge parameter (1..16 chars)", "--ap Application parameter (1..16 chars)", "--cpx Challenge parameter (32 bytes hex)", "--apx Application parameter (32 bytes hex)" ], "usage": "hf fido reg [-havt] [-f ] [--cp ] [--ap ] [--cpx ] [--apx ]" }, "hf fudan dump": { "command": "hf fudan dump", "description": "Dump FUDAN tag to file (bin/json) If no given, UID will be used as filename", "notes": [ "hf fudan dump -f mydump -> dump using filename" ], "offline": false, "options": [ "-h, --help This help", "-f, --file Specify a filename for dump file" ], "usage": "hf fudan dump [-h] [-f ]" }, "hf fudan rdbl": { "command": "hf fudan rdbl", "description": "Read fudan block", "notes": [ "hf fudan rdbl --blk 0 -k FFFFFFFFFFFF", "hf fudan rdbl --blk 3 -v" ], "offline": false, "options": [ "-h, --help This help", "--blk block number", "-k, --key key, 6 hex bytes", "-v, --verbose verbose output" ], "usage": "hf fudan rdbl [-hv] --blk [-k ]" }, "hf fudan reader": { "command": "hf fudan reader", "description": "Read a fudan tag", "notes": [ "hf fudan reader", "hf fudan reader -@ -> continuous reader mode" ], "offline": false, "options": [ "-h, --help This help", "-v, --verbose verbose output", "-@ optional - continuous reader mode" ], "usage": "hf fudan reader [-hv@]" }, "hf fudan view": { "command": "hf fudan view", "description": "Print a FUDAN dump file (bin/eml/json)", "notes": [ "hf fudan view -f hf-fudan-01020304-dump.bin" ], "offline": true, "options": [ "-h, --help This help", "-f, --file Specify a filename for dump file" ], "usage": "hf fudan view [-h] -f " }, "hf fudan wrbl": { "command": "hf fudan wrbl", "description": "Write fudan block with 4 hex bytes of data", "notes": [ "hf fudan wrbl --blk 1 -k FFFFFFFFFFFF -d 01020304" ], "offline": false, "options": [ "-h, --help This help", "--blk block number", "-k, --key key, 6 hex bytes", "-d, --data bytes to write, 4 hex bytes" ], "usage": "hf fudan wrbl [-h] --blk [-k ] [-d ]" }, "hf gallagher clone": { "command": "hf gallagher clone", "description": "Clone Gallagher credentials to a writable DESFire card Specify site key is required if using non-default key Key, lengths for the different crypto: DES 8 bytes 2TDEA or AES 16 bytes 3TDEA 24 bytes AID, default finds lowest available in range 0x??81F4, where ?? >= 0x20.", "notes": [ "hf gallagher clone --rc 1 --fc 22 --cn 3333 --il 4 --sitekey 00112233445566778899aabbccddeeff" ], "offline": false, "options": [ "-h, --help This help", "-n, --keynum PICC key number [default = 0]", "-t, --algo PICC crypt algo: DES, 2TDEA, 3TDEA, AES", "-k, --key Key for authentication to the PICC to create applications", "--rc Region code. 4 bits max", "--fc Facility code. 2 bytes max", "--cn Card number. 3 bytes max", "--il Issue level. 4 bits max", "--aid Application ID to write (3 bytes) [default automatically chooses]", "--sitekey Site key to compute diversified keys (16 bytes)", "--cadkey Custom AES key 0 to modify the Card Application Directory (16 bytes)", "--nocadupdate Don't modify the Card Application Directory (only creates the app)", "--noappcreate Don't create the application (only modifies the CAD)", "--apdu Show APDU requests and responses", "-v, --verbose Verbose mode" ], "usage": "hf gallagher clone [-hv] [-n ] [-t ] [-k ] --rc --fc --cn --il [--aid ] [--sitekey ] [--cadkey ] [--nocadupdate] [--noappcreate] [--apdu]" }, "hf gallagher decode": { "command": "hf gallagher decode", "description": "Decode Gallagher credential block Credential block can be specified with or without the bitwise inverse.", "notes": [ "hf gallagher decode --data A3B4B0C151B0A31B" ], "offline": true, "options": [ "-h, --help This help", "--data Credential block (8 or 16 bytes)" ], "usage": "hf gallagher decode [-h] --data " }, "hf gallagher delete": { "command": "hf gallagher delete", "description": "Delete Gallagher application from a DESFire card Specify site key is required if using non-default key", "notes": [ "hf gallagher delete --aid 2081f4 --sitekey 00112233445566778899aabbccddeeff" ], "offline": false, "options": [ "-h, --help This help", "--aid Application ID to delete (3 bytes)", "--sitekey Site key to compute diversified keys (16 bytes)", "--cadkey Custom AES key 0 to modify the Card Application Directory (16 bytes)", "--nocadupdate Don't modify the Card Application Directory (only deletes the app)", "--noappdelete Don't delete the application (only modifies the CAD)", "--apdu Show APDU requests and responses", "-v, --verbose Verbose mode" ], "usage": "hf gallagher delete [-hv] --aid [--sitekey ] [--cadkey ] [--nocadupdate] [--noappdelete] [--apdu]" }, "hf gallagher diversifykey": { "command": "hf gallagher diversifykey", "description": "Diversify Gallagher key Specify site key is required if using non-default key", "notes": [ "hf gallagher diversify --uid 11223344556677 --aid 2081f4" ], "offline": true, "options": [ "-h, --help This help", "--aid Application ID for diversification (3 bytes)", "--keynum Key number [default = 0]", "--uid Card UID to delete (4 or 7 bytes)", "--sitekey Site key to compute diversified keys (16 bytes)", "--apdu Show APDU requests and responses" ], "usage": "hf gallagher diversify [-h] --aid [--keynum ] [--uid ] [--sitekey ] [--apdu]" }, "hf gallagher reader": { "command": "hf gallagher reader", "description": "Read a Gallagher DESFire tag from the Card Application Directory, CAD Specify site key is required if using non-default key", "notes": [ "hf gallagher reader -@ -> continuous reader mode", "hf gallagher reader --aid 2081f4 --sitekey 00112233445566778899aabbccddeeff -> skip CAD" ], "offline": false, "options": [ "-h, --help This help", "--aid Application ID to read (3 bytes). If specified, the CAD is not used", "--sitekey Site key to compute diversified keys (16 bytes)", "-@, --continuous Continuous reader mode", "--apdu Show APDU requests and responses", "-v, --verbose Verbose mode" ], "usage": "hf gallagher reader [-h@v] [--aid ] [--sitekey ] [--apdu]" }, "hf iclass calcnewkey": { "command": "hf iclass calcnewkey", "description": "Calculate new keys for updating (blocks 3 & 4)", "notes": [ "hf iclass calcnewkey --old 1122334455667788 --new 2233445566778899 --csn deadbeafdeadbeaf --elite2 -> e key to e key given csn", "hf iclass calcnewkey --old 1122334455667788 --new 2233445566778899 --elite -> std key to e key read csn", "hf iclass calcnewkey --old 1122334455667788 --new 2233445566778899 -> std to std read csn" ], "offline": true, "options": [ "-h, --help This help", "--old Specify key as 8 hex bytes", "--oki Old key index to select key from memory 'hf iclass managekeys'", "--new Specify key as 8 hex bytes", "--nki New key index to select key from memory 'hf iclass managekeys'", "--csn Specify a Card Serial Number (CSN) to diversify the key (if omitted will attempt to read a CSN)", "--elite Elite computations applied to new key", "--elite2 Elite computations applied to both old and new key" ], "usage": "hf iclass calcnewkey [-h] [--old ] [--oki ] [--new ] [--nki ] [--csn ] [--elite] [--elite2]" }, "hf iclass chk": { "command": "hf iclass chk", "description": "Checkkeys loads a dictionary text file with 8byte hex keys to test authenticating against a iClass tag", "notes": [ "hf iclass chk -f iclass_default_keys.dic", "hf iclass chk -f iclass_default_keys.dic --elite" ], "offline": false, "options": [ "-h, --help This help", "-f, --file Dictionary file with default iclass keys", "--credit key is assumed to be the credit key", "--elite elite computations applied to key", "--raw no computations applied to key (raw)", "--shallow use shallow (ASK) reader modulation instead of OOK" ], "usage": "hf iclass chk [-h] -f [--credit] [--elite] [--raw] [--shallow]" }, "hf iclass configcard": { "command": "hf iclass configcard", "description": "Manage reader configuration card via Cardhelper, The generated config card will be uploaded to device emulator memory. You can start simulating `hf iclass sim -t 3` or use the emul commands", "notes": [ "hf iclass configcard -l -> download config card settings", "hf iclass configcard -p -> print all config cards", "hf iclass configcard --ci 1 -> view config card setting in slot 1", "hf iclass configcard -g --ci 0 -> generate config file from slot 0" ], "offline": false, "options": [ "-h, --help This help", "--ci use config slot at index", "--ki Key index to select key from memory 'hf iclass managekeys'", "-g generate card dump file", "-l load available cards", "-p print available cards" ], "usage": "hf iclass configcard [-hglp] [--ci ] [--ki ]" }, "hf iclass creditepurse": { "command": "hf iclass creditepurse", "description": "Credit the epurse on an iCLASS tag. The provided key must be the credit key. The first two bytes of the epurse are the debit value (big endian) and may be any value except FFFF. The remaining two bytes of the epurse are the credit value and must be smaller than the previous value.", "notes": [ "hf iclass creditepurse -d FEFFFFFF -k 001122334455667B", "hf iclass creditepurse -d FEFFFFFF --ki 0" ], "offline": false, "options": [ "-h, --help This help", "-k, --key Credit key as 8 hex bytes", "--ki Key index to select key from memory 'hf iclass managekeys'", "-d, --data data to write as 8 hex bytes", "--elite elite computations applied to key", "--raw no computations applied to key", "-v, --verbose verbose output", "--shallow use shallow (ASK) reader modulation instead of OOK" ], "usage": "hf iclass creditepurse [-hv] [-k ] [--ki ] -d [--elite] [--raw] [--shallow]" }, "hf iclass decrypt": { "command": "hf iclass decrypt", "description": "3DES decrypt data This is a naive implementation, it tries to decrypt every block after block 6. Correct behaviour would be to decrypt only the application areas where the key is valid, which is defined by the configuration block. OBS! In order to use this function, the file `iclass_decryptionkey.bin` must reside in the resources directory. The file must be 16 bytes binary data or... make sure your cardhelper is placed in the sim module", "notes": [ "hf iclass decrypt -f hf-iclass-AA162D30F8FF12F1-dump.bin", "hf iclass decrypt -f hf-iclass-AA162D30F8FF12F1-dump.bin -k 000102030405060708090a0b0c0d0e0f", "hf iclass decrypt -d 1122334455667788 -k 000102030405060708090a0b0c0d0e0f" ], "offline": true, "options": [ "-h, --help This help", "-f, --file Specify a filename for dump file", "-d, --data 3DES encrypted data", "-k, --key 3DES transport key", "-v, --verbose verbose output", "--d6 decode as block 6", "-z, --dense dense dump output style" ], "usage": "hf iclass decrypt [-hvz] [-f ] [-d ] [-k ] [--d6]" }, "hf iclass dump": { "command": "hf iclass dump", "description": "Dump all memory from a iCLASS tag", "notes": [ "hf iclass dump -k 001122334455667B", "hf iclass dump -k AAAAAAAAAAAAAAAA --credit 001122334455667B", "hf iclass dump -k AAAAAAAAAAAAAAAA --elite", "hf iclass dump --ki 0", "hf iclass dump --ki 0 --ci 2" ], "offline": false, "options": [ "-h, --help This help", "-f, --file save filename", "-k, --key debit key or NR/MAC for replay as 8 hex bytes", "--ki debit key index to select key from memory 'hf iclass managekeys'", "--credit credit key as 8 hex bytes", "--ci credit key index to select key from memory 'hf iclass managekeys'", "--elite elite computations applied to key", "--raw raw, the key is interpreted as raw block 3/4", "--nr replay of NR/MAC", "-z, --dense dense dump output style", "--force force unsecure card read", "--shallow use shallow (ASK) reader modulation instead of OOK" ], "usage": "hf iclass dump [-hz] [-f ] [-k ] [--ki ] [--credit ] [--ci ] [--elite] [--raw] [--nr] [--force] [--shallow]" }, "hf iclass eload": { "command": "hf iclass eload", "description": "Load emulator memory with data from (bin/json) iCLASS dump file", "notes": [ "hf iclass eload -f hf-iclass-AA162D30F8FF12F1-dump.json", "hf iclass eload -f hf-iclass-AA162D30F8FF12F1-dump.bin -m" ], "offline": false, "options": [ "-h, --help This help", "-f, --file Specify a filename for dump file", "-m, --mem use RDV4 spiffs", "-v, --verbose verbose output" ], "usage": "hf iclass eload [-hmv] -f " }, "hf iclass encode": { "command": "hf iclass encode", "description": "Encode binary wiegand to block 7,8,9 Use either --bin or --wiegand/--fc/--cn", "notes": [ "hf iclass encode --bin 10001111100000001010100011 --ki 0 -> FC 31 CN 337 (H10301)", "hf iclass encode -w H10301 --fc 31 --cn 337 --ki 0 -> FC 31 CN 337 (H10301)", "hf iclass encode --bin 10001111100000001010100011 --ki 0 --elite -> FC 31 CN 337 (H10301), writing w elite key" ], "offline": true, "options": [ "-h, --help This help", "--bin Binary string i.e 0001001001", "--ki Key index to select key from memory 'hf iclass managekeys'", "--credit key is assumed to be the credit key", "--elite elite computations applied to key", "--raw no computations applied to key", "--enckey 3DES transport key, 16 hex bytes", "--fc facility code", "--cn card number", "-w, --wiegand see `wiegand list` for available formats", "--shallow use shallow (ASK) reader modulation instead of OOK", "-v verbose (print encoded blocks)" ], "usage": "hf iclass encode [-hv] [--bin ] --ki [--credit] [--elite] [--raw] [--enckey ] [--fc ] [--cn ] [-w ] [--shallow]" }, "hf iclass encrypt": { "command": "hf iclass encrypt", "description": "3DES encrypt data OBS! In order to use this function, the file 'iclass_decryptionkey.bin' must reside in the resources directory. The file should be 16 hex bytes of binary data", "notes": [ "hf iclass encrypt -d 0102030405060708", "hf iclass encrypt -d 0102030405060708 -k 00112233445566778899AABBCCDDEEFF" ], "offline": true, "options": [ "-h, --help This help", "-d, --data data to encrypt", "-k, --key 3DES transport key", "-v, --verbose verbose output" ], "usage": "hf iclass encrypt [-hv] -d [-k ]" }, "hf iclass esave": { "command": "hf iclass esave", "description": "Save emulator memory to file (bin/json) if filename is not supplied, CSN will be used.", "notes": [ "hf iclass esave", "hf iclass esave -f hf-iclass-dump", "hf iclass esave -s 2048 -f hf-iclass-dump" ], "offline": false, "options": [ "-h, --help This help", "-f, --file Specify a filename for dump file", "-s, --size <256|2048> number of bytes to save (default 256)" ], "usage": "hf iclass esave [-h] [-f ] [-s <256|2048>]" }, "hf iclass esetblk": { "command": "hf iclass esetblk", "description": "Sets an individual block in emulator memory.", "notes": [ "hf iclass esetblk -b 7 -d 0000000000000000" ], "offline": false, "options": [ "-h, --help This help", "-b, --blk block number", "-d, --data bytes to write, 8 hex bytes" ], "usage": "hf iclass esetblk [-h] -b [-d ]" }, "hf iclass eview": { "command": "hf iclass eview", "description": "Display emulator memory. Number of bytes to download defaults to 256. Other value is 2048.", "notes": [ "hf iclass eview", "hf iclass eview -s 2048", "hf iclass eview -s 2048 -v" ], "offline": false, "options": [ "-h, --help This help", "-s, --size <256|2048> number of bytes to save (default 256)", "-v, --verbose verbose output", "-z, --dense dense dump output style" ], "usage": "hf iclass eview [-hvz] [-s <256|2048>]" }, "hf iclass info": { "command": "hf iclass info", "description": "Act as a iCLASS reader. Reads / fingerprints a iCLASS tag.", "notes": [ "hf iclass info" ], "offline": true, "options": [ "-h, --help This help", "--shallow use shallow (ASK) reader modulation instead of OOK" ], "usage": "hf iclass info [-h] [--shallow]" }, "hf iclass list": { "command": "hf iclass list", "description": "Alias of `trace list -t iclass -c` with selected protocol data to annotate trace buffer You can load a trace from file (see `trace load -h`) or it be downloaded from device by default It accepts all other arguments of `trace list`. Note that some might not be relevant for this specific protocol", "notes": [ "hf iclass list --frame -> show frame delay times", "hf iclass list -1 -> use trace buffer" ], "offline": true, "options": [ "-h, --help This help", "-1, --buffer use data from trace buffer", "--frame show frame delay times", "-c mark CRC bytes", "-r show relative times (gap and duration)", "-u display times in microseconds instead of clock cycles", "-x show hexdump to convert to pcap(ng)", "or to import into Wireshark using encapsulation type \"ISO 14443\"", "-f, --file filename of dictionary" ], "usage": "hf iclass list [-h1crux] [--frame] [-f ]" }, "hf iclass loclass": { "command": "hf iclass loclass", "description": "Execute the offline part of loclass attack An iclass dumpfile is assumed to consist of an arbitrary number of malicious CSNs, and their protocol responses The binary format of the file is expected to be as follows: <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC> <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC> <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC> ... totalling N*24 bytes", "notes": [ "hf iclass loclass -f iclass_dump.bin", "hf iclass loclass --test" ], "offline": true, "options": [ "-h, --help This help", "-f, --file filename with nr/mac data from `hf iclass sim -t 2`", "--test Perform self-test", "--long Perform self-test, including long ones" ], "usage": "hf iclass loclass [-h] [-f ] [--test] [--long]" }, "hf iclass lookup": { "command": "hf iclass lookup", "description": "Lookup keys takes some sniffed trace data and tries to verify what key was used against a dictionary file", "notes": [ "hf iclass lookup --csn 9655a400f8ff12e0 --epurse f0ffffffffffffff --macs 0000000089cb984b -f iclass_default_keys.dic", "hf iclass lookup --csn 9655a400f8ff12e0 --epurse f0ffffffffffffff --macs 0000000089cb984b -f iclass_default_keys.dic --elite" ], "offline": true, "options": [ "-h, --help This help", "-f, --file Dictionary file with default iclass keys", "--csn Specify CSN as 8 hex bytes", "--epurse Specify ePurse as 8 hex bytes", "--macs MACs", "--elite Elite computations applied to key", "--raw no computations applied to key" ], "usage": "hf iclass lookup [-h] -f --csn --epurse --macs [--elite] [--raw]" }, "hf iclass managekeys": { "command": "hf iclass managekeys", "description": "Manage iCLASS Keys in client memory", "notes": [ "hf iclass managekeys --ki 0 -k 1122334455667788 -> set key 1122334455667788 at index 0", "hf iclass managekeys -f mykeys.bin --save -> save key file", "hf iclass managekeys -f mykeys.bin --load -> load key file", "hf iclass managekeys -p -> print keys" ], "offline": true, "options": [ "-h, --help This help", "-f, --file Specify a filename for load / save operations", "-k, --key Access key as 8 hex bytes", "--ki Specify key index to set key in memory", "--save Save keys in memory to file specified by filename", "--load Load keys to memory from file specified by filename", "-p, --print Print keys loaded into memory" ], "usage": "hf iclass managekeys [-hp] [-f ] [-k ] [--ki ] [--save] [--load]" }, "hf iclass permutekey": { "command": "hf iclass permutekey", "description": "Permute function from 'heart of darkness' paper.", "notes": [ "hf iclass permutekey --reverse --key 0123456789abcdef", "hf iclass permutekey --key ff55330f0055330f" ], "offline": true, "options": [ "-h, --help This help", "-r, --reverse reverse permuted key", "--key input key, 8 hex bytes" ], "usage": "hf iclass permutekey [-hr] --key " }, "hf iclass rdbl": { "command": "hf iclass rdbl", "description": "Read a iCLASS block from tag", "notes": [ "hf iclass rdbl -b 6 -k 0011223344556677", "hf iclass rdbl -b 27 -k 0011223344556677 --credit", "hf iclass rdbl -b 10 --ki 0" ], "offline": false, "options": [ "-h, --help This help", "-k, --key Access key as 8 hex bytes", "--ki Key index to select key from memory 'hf iclass managekeys'", "-b, --block The block number to read", "--credit key is assumed to be the credit key", "--elite elite computations applied to key", "--raw no computations applied to key", "--nr replay of NR/MAC", "-v, --verbose verbose output", "--shallow use shallow (ASK) reader modulation instead of OOK" ], "usage": "hf iclass rdbl [-hv] [-k ] [--ki ] -b [--credit] [--elite] [--raw] [--nr] [--shallow]" }, "hf iclass reader": { "command": "hf iclass reader", "description": "Act as a iCLASS reader. Look for iCLASS tags until Enter or the pm3 button is pressed", "notes": [ "hf iclass reader -@ -> continuous reader mode" ], "offline": false, "options": [ "-h, --help This help", "-@ optional - continuous reader mode", "--shallow use shallow (ASK) reader modulation instead of OOK" ], "usage": "hf iclass reader [-h@] [--shallow]" }, "hf iclass restore": { "command": "hf iclass restore", "description": "Restore data from dumpfile (bin/eml/json) onto a iCLASS tag", "notes": [ "hf iclass restore -f hf-iclass-AA162D30F8FF12F1-dump.bin --first 6 --last 18 --ki 0", "hf iclass restore -f hf-iclass-AA162D30F8FF12F1-dump.bin --first 6 --last 18 --ki 0 --elite", "hf iclass restore -f hf-iclass-AA162D30F8FF12F1-dump.bin --first 6 --last 18 -k 1122334455667788 --elite" ], "offline": false, "options": [ "-h, --help This help", "-f, --file specify a filename to restore", "-k, --key Access key as 8 hex bytes", "--ki Key index to select key from memory 'hf iclass managekeys'", "--first The first block number to restore", "--last The last block number to restore", "--credit key is assumed to be the credit key", "--elite elite computations applied to key", "--raw no computations applied to key", "-v, --verbose verbose output", "--shallow use shallow (ASK) reader modulation instead of OOK" ], "usage": "hf iclass restore [-hv] -f [-k ] [--ki ] --first --last [--credit] [--elite] [--raw] [--shallow]" }, "hf iclass sam": { "command": "hf iclass sam", "description": "Manage via SAM", "notes": [ "hf iclass sam" ], "offline": false, "options": [ "-h, --help This help", "-d, --data data", "-v, --verbose verbose output" ], "usage": "hf iclass sam [-hv] [-d ]" }, "hf iclass sim": { "command": "hf iclass sim", "description": "Simulate a iCLASS legacy/standard tag", "notes": [ "hf iclass sim -t 0 --csn 031FEC8AF7FF12E0 -> simulate with specified CSN", "hf iclass sim -t 1 -> simulate with default CSN", "hf iclass sim -t 2 -> execute loclass attack online part", "hf iclass sim -t 3 -> simulate full iCLASS 2k tag", "hf iclass sim -t 4 -> Reader-attack, adapted for KeyRoll mode, gather reader responses to extract elite key" ], "offline": false, "options": [ "-h, --help This help", "-t, --type <0-4> Simulation type to use", "--csn Specify CSN as 8 hex bytes to use with sim type 0" ], "usage": "hf iclass sim [-h] -t <0-4> [--csn ]" }, "hf iclass sniff": { "command": "hf iclass sniff", "description": "Sniff the communication reader and tag", "notes": [ "hf iclass sniff", "hf iclass sniff -j -> jam e-purse updates" ], "offline": false, "options": [ "-h, --help This help", "-j, --jam Jam (prevent) e-purse updates" ], "usage": "hf iclass sniff [-hj]" }, "hf iclass view": { "command": "hf iclass view", "description": "Print a iCLASS tag dump file (bin/eml/json)", "notes": [ "hf iclass view -f hf-iclass-AA162D30F8FF12F1-dump.bin", "hf iclass view --first 1 -f hf-iclass-AA162D30F8FF12F1-dump.bin", "", "If --first is not specified it will default to the first user block", "which is block 6 for secured chips or block 3 for non-secured chips" ], "offline": true, "options": [ "-h, --help This help", "-f, --file Specify a filename for dump file", "--first Begin printing from this block (default first user block)", "--last End printing at this block (default 0, ALL)", "-v, --verbose verbose output", "-z, --dense dense dump output style" ], "usage": "hf iclass view [-hvz] -f [--first ] [--last ]" }, "hf iclass wrbl": { "command": "hf iclass wrbl", "description": "Write data to an iCLASS tag", "notes": [ "hf iclass wrbl -b 10 -d AAAAAAAAAAAAAAAA -k 001122334455667B", "hf iclass wrbl -b 10 -d AAAAAAAAAAAAAAAA -k 001122334455667B --credit", "hf iclass wrbl -b 10 -d AAAAAAAAAAAAAAAA --ki 0" ], "offline": false, "options": [ "-h, --help This help", "-k, --key Access key as 8 hex bytes", "--ki Key index to select key from memory 'hf iclass managekeys'", "-b, --block The block number to read", "-d, --data data to write as 8 hex bytes", "-m, --mac replay mac data (4 hex bytes)", "--credit key is assumed to be the credit key", "--elite elite computations applied to key", "--raw no computations applied to key", "--nr replay of NR/MAC", "-v, --verbose verbose output", "--shallow use shallow (ASK) reader modulation instead of OOK" ], "usage": "hf iclass wrbl [-hv] [-k ] [--ki ] -b -d [-m ] [--credit] [--elite] [--raw] [--nr] [--shallow]" }, "hf jooki clone": { "command": "hf jooki clone", "description": "Write a Jooki token to a Ultralight or NTAG tag", "notes": [ "hf jooki clone -d -> where hex is raw NDEF", "hf jooki clone --b64 7WzlgEzqLgwTnWNy -> using base64 url parameter" ], "offline": false, "options": [ "-h, --help This help", "-b, --b64 base64 url parameter", "-d, --data raw NDEF bytes", "-p, --pwd password for authentication (EV1/NTAG 4 bytes)" ], "usage": "hf jooki clone [-h] [-b ] [-d ] [-p ]" }, "hf jooki decode": { "command": "hf jooki decode", "description": "Decode a base64-encode Jooki token in NDEF URI format", "notes": [ "hf jooki decode -d 7WzlgEzqLgwTnWNy" ], "offline": true, "options": [ "-h, --help This help", "-d, --data base64 url parameter", "-v, --verbose verbose output" ], "usage": "hf jooki decode [-hv] -d " }, "hf jooki encode": { "command": "hf jooki encode", "description": "Encode a Jooki token to base64 NDEF URI format", "notes": [ "hf jooki encode -t -> selftest", "hf jooki encode -r --dragon -> read uid from tag and use for encoding", "hf jooki encode --uid 04010203040506 --dragon", "hf jooki encode --uid 04010203040506 --tid 1 --fid 1" ], "offline": true, "options": [ "-h, --help This help", "-u, --uid uid bytes", "-r read uid from tag instead", "-t selftest", "-v, --verbose verbose output", "--dragon figurine type", "--fox figurine type", "--ghost figurine type", "--knight figurine type", "--whale figurine type", "--blackdragon figurine type", "--blackfox figurine type", "--blackknight figurine type", "--blackwhale figurine type", "--whitedragon figurine type", "--whitefox figurine type", "--whiteknight figurine type", "--whitewhale figurine type", "--tid figurine type id", "--fid figurine id" ], "usage": "hf jooki encode [-hrtv] [-u ] [--dragon] [--fox] [--ghost] [--knight] [--whale] [--blackdragon] [--blackfox] [--blackknight] [--blackwhale] [--whitedragon] [--whitefox] [--whiteknight] [--whitewhale] [--tid ] [--fid ]" }, "hf jooki sim": { "command": "hf jooki sim", "description": "Simulate a Jooki token. Either `hf mfu eload` before or use `-d` param", "notes": [ "hf jooki sim -> use token in emulator memory", "hf jooki sim -b 7WzlgEzqLgwTnWNy -> using base64 url parameter" ], "offline": false, "options": [ "-h, --help This help", "-b, --b64 base64 url parameter" ], "usage": "hf jooki sim [-h] [-b ]" }, "hf ksx6924 balance": { "command": "hf ksx6924 balance", "description": "Gets the current purse balance", "notes": [ "hf ksx6924 balance" ], "offline": false, "options": [ "-h, --help This help", "-k, --keep keep field ON for next command", "-a, --apdu Show APDU requests and responses" ], "usage": "hf ksx6924 balance [-hka]" }, "hf ksx6924 info": { "command": "hf ksx6924 info", "description": "Get info about a KS X 6924 transit card. This application is used by T-Money (South Korea) and Snapper+ (Wellington, New Zealand).", "notes": [ "hf ksx6924 info" ], "offline": false, "options": [ "-h, --help This help", "-k, --keep keep field ON for next command", "-a, --apdu Show APDU requests and responses" ], "usage": "hf ksx6924 info [-hka]" }, "hf ksx6924 init": { "command": "hf ksx6924 init", "description": "Perform transaction initialization with Mpda (Money of Purchase Transaction)", "notes": [ "hf ksx6924 init 000003e8 -> Mpda" ], "offline": false, "options": [ "-h, --help This help", "-k, --keep keep field ON for next command", "-a, --apdu Show APDU requests and responses" ], "usage": "hf ksx6924 init [-hka] " }, "hf ksx6924 prec": { "command": "hf ksx6924 prec", "description": "Executes proprietary read record command. Data format is unknown. Other records are available with 'emv getrec'.", "notes": [ "hf ksx6924 prec 0b -> read proprietary record 0x0b" ], "offline": false, "options": [ "-h, --help This help", "-k, --keep keep field ON for next command", "-a, --apdu Show APDU requests and responses" ], "usage": "hf ksx6924 prec [-hka] " }, "hf ksx6924 select": { "command": "hf ksx6924 select", "description": "Selects KS X 6924 application, and leaves field up", "notes": [ "hf ksx6924 select" ], "offline": false, "options": [ "-h, --help This help", "-a, --apdu Show APDU requests and responses" ], "usage": "hf ksx6924 select [-ha]" }, "hf legic crc": { "command": "hf legic crc", "description": "Calculates the legic crc8/crc16 on the given data", "notes": [ "hf legic crc -d deadbeef1122", "hf legic crc -d deadbeef1122 --mcc 9A -t 16 -> CRC Type 16" ], "offline": true, "options": [ "-h, --help This help", "-d, --data bytes to calculate crc over", "--mcc MCC hex byte (UID CRC)", "-t, --type CRC Type (default: 8)" ], "usage": "hf legic crc [-h] -d [--mcc ] [-t ]" }, "hf legic dump": { "command": "hf legic dump", "description": "Read all memory from LEGIC Prime tags and saves to (bin/json) dump file It autodetects card type (MIM22, MIM256, MIM1024)", "notes": [ "hf legic dump -> use UID as filename", "hf legic dump -f myfile", "hf legic dump --de -> use UID as filename and deobfuscate data" ], "offline": false, "options": [ "-h, --help This help", "-f, --file Dump filename", "--de deobfuscate dump data (xor with MCC)" ], "usage": "hf legic dump [-h] [-f ] [--de]" }, "hf legic einfo": { "command": "hf legic einfo", "description": "It decodes and displays emulator memory", "notes": [ "hf legic einfo", "hf legic eview --22" ], "offline": false, "options": [ "-h, --help This help", "--22 LEGIC Prime MIM22", "--256 LEGIC Prime MIM256 (def)", "--1024 LEGIC Prime MIM1024" ], "usage": "hf legic einfo [-h] [--22] [--256] [--1024]" }, "hf legic eload": { "command": "hf legic eload", "description": "Loads a LEGIC Prime dump file into emulator memory", "notes": [ "hf legic eload -f myfile", "hf legic eload -f myfile --obfuscate" ], "offline": false, "options": [ "-h, --help This help", "-f, --file Filename to load", "--obfuscate Obfuscate dump data (xor with MCC)" ], "usage": "hf legic eload [-h] -f [--obfuscate]" }, "hf legic esave": { "command": "hf legic esave", "description": "Saves a (bin/json) dump file of emulator memory", "notes": [ "hf legic esave -> uses UID as filename", "hf legic esave -f myfile --22", "hf legic esave -f myfile --22 --de" ], "offline": false, "options": [ "-h, --help This help", "-f, --file Filename to save", "--22 LEGIC Prime MIM22", "--256 LEGIC Prime MIM256 (def)", "--1024 LEGIC Prime MIM1024", "--de De-obfuscate dump data (xor with MCC)" ], "usage": "hf legic esave [-h] [-f ] [--22] [--256] [--1024] [--de]" }, "hf legic eview": { "command": "hf legic eview", "description": "It displays emulator memory", "notes": [ "hf legic eview", "hf legic eview --22" ], "offline": false, "options": [ "-h, --help This help", "--22 LEGIC Prime MIM22", "--256 LEGIC Prime MIM256 (def)", "--1024 LEGIC Prime MIM1024", "-v, --verbose verbose output" ], "usage": "hf legic eview [-hv] [--22] [--256] [--1024]" }, "hf legic info": { "command": "hf legic info", "description": "Gets information from a LEGIC Prime tag like systemarea, user areas, etc", "notes": [ "hf legic info" ], "offline": false, "options": [ "-h, --help This help", "-v, --verbose verbose output" ], "usage": "hf legic info [-hv]" }, "hf legic list": { "command": "hf legic list", "description": "Alias of `trace list -t legic` with selected protocol data to annotate trace buffer You can load a trace from file (see `trace load -h`) or it be downloaded from device by default It accepts all other arguments of `trace list`. Note that some might not be relevant for this specific protocol", "notes": [ "hf legic list --frame -> show frame delay times", "hf legic list -1 -> use trace buffer" ], "offline": true, "options": [ "-h, --help This help", "-1, --buffer use data from trace buffer", "--frame show frame delay times", "-c mark CRC bytes", "-r show relative times (gap and duration)", "-u display times in microseconds instead of clock cycles", "-x show hexdump to convert to pcap(ng)", "or to import into Wireshark using encapsulation type \"ISO 14443\"", "-f, --file filename of dictionary" ], "usage": "hf legic list [-h1crux] [--frame] [-f ]" }, "hf legic rdbl": { "command": "hf legic rdbl", "description": "Read data from a LEGIC Prime tag", "notes": [ "hf legic rdbl -o 0 -l 16 -> read 16 bytes from offset 0 (system header)", "hf legic rdbl -o 0 -l 4 --iv 55 -> read 4 bytes from offset 0", "hf legic rdbl -o 0 -l 256 --iv 55 -> read 256 bytes from offset 0" ], "offline": false, "options": [ "-h, --help This help", "-o, --offset offset in data array to start download from", "-l, --length number of bytes to read", "--iv Initialization vector to use. Must be odd and 7bits max" ], "usage": "hf legic rdbl [-h] [-o ] [-l ] [--iv ]" }, "hf legic reader": { "command": "hf legic reader", "description": "Read UID and type information from a LEGIC Prime tag", "notes": [ "hf legic reader" ], "offline": false, "options": [ "-h, --help This help", "-@ optional - continuous reader mode" ], "usage": "hf legic reader [-h@]" }, "hf legic restore": { "command": "hf legic restore", "description": "Reads (bin/eml/json) file and it autodetects card type and verifies that the file has the same size Then write the data back to card. All bytes except the first 7bytes [UID(4) MCC(1) DCF(2)]", "notes": [ "hf legic restore -f myfile -> use user specified filename", "hf legic restore -f myfile --ob -> use UID as filename and obfuscate data" ], "offline": false, "options": [ "-h, --help This help", "-f, --file Specify a filename to restore", "--ob obfuscate dump data (xor with MCC)" ], "usage": "hf legic restore [-h] -f [--ob]" }, "hf legic sim": { "command": "hf legic sim", "description": "Simulates a LEGIC Prime tag. Following types supported (MIM22, MIM256, MIM1024)", "notes": [ "hf legic sim --22" ], "offline": false, "options": [ "-h, --help This help", "--22 LEGIC Prime MIM22", "--256 LEGIC Prime MIM256 (def)", "--1024 LEGIC Prime MIM1024" ], "usage": "hf legic sim [-h] [--22] [--256] [--1024]" }, "hf legic view": { "command": "hf legic view", "description": "Print a LEGIC Prime dump file (bin/eml/json)", "notes": [ "hf legic view -f hf-legic-01020304-dump.bin" ], "offline": true, "options": [ "-h, --help This help", "-f, --file Specify a filename for dump file", "-v, --verbose verbose output" ], "usage": "hf legic view [-hv] -f " }, "hf legic wipe": { "command": "hf legic wipe", "description": "Fills a LEGIC Prime tags memory with zeros. From byte7 and to the end It autodetects card type", "notes": [ "hf legic wipe" ], "offline": false, "options": [ "-h, --help This help" ], "usage": "hf legic wipe [-h]" }, "hf legic wrbl": { "command": "hf legic wrbl", "description": "Write data to a LEGIC Prime tag. It autodetects tagsize to ensure proper write", "notes": [ "hf legic wrbl -o 0 -d 11223344 -> Write 0x11223344 starting from offset 0)", "hf legic wrbl -o 10 -d DEADBEEF -> Write 0xdeadbeef starting from offset 10" ], "offline": false, "options": [ "-h, --help This help", "-o, --offset offset in data array to start writing", "-d, --data data to write", "--danger Auto-confirm dangerous operations" ], "usage": "hf legic wrbl [-h] -o -d [--danger]" }, "hf list": { "command": "hf list", "description": "Alias of `trace list -t raw` with selected protocol data to annotate trace buffer You can load a trace from file (see `trace load -h`) or it be downloaded from device by default It accepts all other arguments of `trace list`. Note that some might not be relevant for this specific protocol", "notes": [ "hf list --frame -> show frame delay times", "hf list -1 -> use trace buffer" ], "offline": true, "options": [ "-h, --help This help", "-1, --buffer use data from trace buffer", "--frame show frame delay times", "-c mark CRC bytes", "-r show relative times (gap and duration)", "-u display times in microseconds instead of clock cycles", "-x show hexdump to convert to pcap(ng)", "or to import into Wireshark using encapsulation type \"ISO 14443\"", "-f, --file filename of dictionary" ], "usage": "hf list [-h1crux] [--frame] [-f ]" }, "hf lto dump": { "command": "hf lto dump", "description": "Dump data from LTO tag", "notes": [ "hf lto dump -f myfile" ], "offline": false, "options": [ "-h, --help This help", "-f, --file specify a filename for dumpfile" ], "usage": "hf lto dump [-h] [-f ]" }, "hf lto info": { "command": "hf lto info", "description": "Get info from LTO tags", "notes": [ "hf lto info" ], "offline": false, "options": [ "-h, --help This help" ], "usage": "hf lto info [-h]" }, "hf lto list": { "command": "hf lto list", "description": "Alias of `trace list -t lto -c` with selected protocol data to annotate trace buffer You can load a trace from file (see `trace load -h`) or it be downloaded from device by default It accepts all other arguments of `trace list`. Note that some might not be relevant for this specific protocol", "notes": [ "hf lto list --frame -> show frame delay times", "hf lto list -1 -> use trace buffer" ], "offline": true, "options": [ "-h, --help This help", "-1, --buffer use data from trace buffer", "--frame show frame delay times", "-c mark CRC bytes", "-r show relative times (gap and duration)", "-u display times in microseconds instead of clock cycles", "-x show hexdump to convert to pcap(ng)", "or to import into Wireshark using encapsulation type \"ISO 14443\"", "-f, --file filename of dictionary" ], "usage": "hf lto list [-h1crux] [--frame] [-f ]" }, "hf lto rdbl": { "command": "hf lto rdbl", "description": "Reead blocks from LTO tag", "notes": [ "hf lto rdbl --first 0 --last 254" ], "offline": false, "options": [ "-h, --help This help", "--first The first block number to read as an integer", "--last The last block number to read as an integer" ], "usage": "hf lto rdbl [-h] [--first ] [--last ]" }, "hf lto reader": { "command": "hf lto reader", "description": "Act as a LTO-CM reader. Look for LTO-CM tags until Enter or the pm3 button is pressed", "notes": [ "hf lto reader -@ -> continuous reader mode" ], "offline": false, "options": [ "-h, --help This help", "-@ optional - continuous reader mode" ], "usage": "hf lto reader [-h@]" }, "hf lto restore": { "command": "hf lto restore", "description": "Restore data from dumpfile to LTO tag", "notes": [ "hf lto restore -f hf-lto-92C7842CFF.bin|.eml" ], "offline": false, "options": [ "-h, --help This help", "-f, --file specify a filename for dumpfile" ], "usage": "hf lto restore [-h] -f " }, "hf lto wrbl": { "command": "hf lto wrbl", "description": "Write data to block on LTO tag", "notes": [ "hf lto wrbl --block 128 -d 0001020304050607080910111213141516171819202122232425262728293031" ], "offline": false, "options": [ "-h, --help This help", "-d, --data 32 bytes of data to write (64 hex symbols, no spaces)", "--block The block number to write to as an integer" ], "usage": "hf lto wrbl [-h] -d --block " }, "hf mf acl": { "command": "hf mf acl", "description": "Print decoded MIFARE access rights (ACL), A = key A B = key B AB = both key A and B ACCESS = access bytes inside sector trailer block Increment, decrement, transfer, restore is for value blocks", "notes": [ "hf mf acl", "hf mf acl -d FF0780" ], "offline": true, "options": [ "-h, --help This help", "-d, --data ACL bytes specified as 3 hex bytes" ], "usage": "hf mf acl [-h] -d " }, "hf mf auth4": { "command": "hf mf auth4", "description": "Executes AES authentication command in ISO14443-4", "notes": [ "hf mf auth4 -n 4000 -k 000102030405060708090a0b0c0d0e0f -> executes authentication", "hf mf auth4 -n 9003 -k FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF -> executes authentication" ], "offline": false, "options": [ "-h, --help This help", "-n key num, 2 hex bytes", "-k, --key key, 16 hex bytes" ], "usage": "hf mf auth4 [-h] -n -k " }, "hf mf autopwn": { "command": "hf mf autopwn", "description": "This command automates the key recovery process on MIFARE Classic cards. It uses the fchk, chk, darkside, nested, hardnested and staticnested to recover keys. If all keys are found, it try dumping card content both to file and emulator memory.", "notes": [ "hf mf autopwn", "hf mf autopwn -s 0 -a -k FFFFFFFFFFFF -> target MFC 1K card, Sector 0 with known key A 'FFFFFFFFFFFF'", "hf mf autopwn --1k -f mfc_default_keys -> target MFC 1K card, default dictionary", "hf mf autopwn --1k -s 0 -a -k FFFFFFFFFFFF -f mfc_default_keys -> combo of the two above samples" ], "offline": false, "options": [ "-h, --help This help", "-k, --key Known key, 12 hex bytes", "-s, --sector Input sector number", "-a Input key A (def)", "-b Input key B", "-f, --file filename of dictionary", "--slow Slower acquisition (required by some non standard cards)", "-l, --legacy legacy mode (use the slow `hf mf chk`)", "-v, --verbose verbose output (statistics)", "--mini MIFARE Classic Mini / S20", "--1k MIFARE Classic 1k / S50 (default)", "--2k MIFARE Classic/Plus 2k", "--4k MIFARE Classic 4k / S70", "--in None (use CPU regular instruction set)", "--im MMX", "--is SSE2", "--ia AVX", "--i2 AVX2", "--i5 AVX512" ], "usage": "hf mf autopwn [-hablv] [-k ] [-s ] [-f ] [--slow] [--mini] [--1k] [--2k] [--4k] [--in] [--im] [--is] [--ia] [--i2] [--i5]" }, "hf mf cgetblk": { "command": "hf mf cgetblk", "description": "Get block data from magic Chinese card. Only works with magic gen1a cards", "notes": [ "hf mf cgetblk --blk 0 -> get block 0 (manufacturer)", "hf mf cgetblk --blk 3 -v -> get block 3, decode sector trailer" ], "offline": false, "options": [ "-h, --help This help", "-b, --blk block number", "-v, --verbose verbose output" ], "usage": "hf mf cgetblk [-hv] -b " }, "hf mf cgetsc": { "command": "hf mf cgetsc", "description": "Get sector data from magic Chinese card. Only works with magic gen1a cards", "notes": [ "hf mf cgetsc -s 0" ], "offline": false, "options": [ "-h, --help This help", "-s, --sec sector number", "-v, --verbose verbose output" ], "usage": "hf mf cgetsc [-hv] -s " }, "hf mf chk": { "command": "hf mf chk", "description": "Check keys on MIFARE Classic card", "notes": [ "hf mf chk --mini -k FFFFFFFFFFFF -> Check all sectors, all keys against MIFARE Mini", "hf mf chk --1k -k FFFFFFFFFFFF -> Check all sectors, all keys against MIFARE Classic 1k", "hf mf chk --2k -k FFFFFFFFFFFF -> Check all sectors, all keys against MIFARE 2k", "hf mf chk --4k -k FFFFFFFFFFFF -> Check all sectors, all keys against MIFARE 4k", "hf mf chk --1k --emu -> Check all sectors, all keys, 1K, and write to emulator memory", "hf mf chk --1k --dump -> Check all sectors, all keys, 1K, and write to file", "hf mf chk -a --tblk 0 -f mfc_default_keys.dic -> Check dictionary against block 0, key A" ], "offline": false, "options": [ "-h, --help This help", "-k, --key Key specified as 12 hex symbols", "--tblk Target block number", "-a Target Key A", "-b Target Key B", "-*, --all Target both key A & B (default)", "--mini MIFARE Classic Mini / S20", "--1k MIFARE Classic 1k / S50 (default)", "--2k MIFARE Classic/Plus 2k", "--4k MIFARE Classic 4k / S70", "--emu Fill simulator keys from found keys", "--dump Dump found keys to binary file", "-f, --file Filename of dictionary" ], "usage": "hf mf chk [-hab*] [-k ]... [--tblk ] [--mini] [--1k] [--2k] [--4k] [--emu] [--dump] [-f ]" }, "hf mf cload": { "command": "hf mf cload", "description": "Load magic gen1a card with data from (bin/eml/json) dump file or from emulator memory.", "notes": [ "hf mf cload --emu", "hf mf cload -f hf-mf-01020304.eml" ], "offline": false, "options": [ "-h, --help This help", "-f, --file Specify a filename for dump file", "--emu from emulator memory" ], "usage": "hf mf cload [-h] [-f ] [--emu]" }, "hf mf csave": { "command": "hf mf csave", "description": "Save magic gen1a card memory to file (bin/json)or into emulator memory", "notes": [ "hf mf csave", "hf mf csave --4k" ], "offline": false, "options": [ "-h, --help This help", "-f, --file Specify a filename for dump file", "--mini MIFARE Classic Mini / S20", "--1k MIFARE Classic 1k / S50 (def)", "--2k MIFARE Classic/Plus 2k", "--4k MIFARE Classic 4k / S70", "--emu to emulator memory" ], "usage": "hf mf csave [-h] [-f ] [--mini] [--1k] [--2k] [--4k] [--emu]" }, "hf mf csetblk": { "command": "hf mf csetblk", "description": "Set block data on a magic gen1a card", "notes": [ "hf mf csetblk --blk 1 -d 000102030405060708090a0b0c0d0e0f" ], "offline": false, "options": [ "-h, --help This help", "-b, --blk block number", "-d, --data bytes to write, 16 hex bytes", "-w, --wipe wipes card with backdoor cmd before writing" ], "usage": "hf mf csetblk [-hw] -b [-d ]" }, "hf mf csetuid": { "command": "hf mf csetuid", "description": "Set UID, ATQA, and SAK for magic gen1a card", "notes": [ "hf mf csetuid -u 01020304", "hf mf csetuid -w -u 01020304 --atqa 0004 --sak 08" ], "offline": false, "options": [ "-h, --help This help", "-w, --wipe wipes card with backdoor cmd`", "-u, --uid UID, 4/7 hex bytes", "-a, --atqa ATQA, 2 hex bytes", "-s, --sak SAK, 1 hex byte" ], "usage": "hf mf csetuid [-hw] [-u ] [-a ] [-s ]" }, "hf mf cview": { "command": "hf mf cview", "description": "View `magic gen1a` card memory", "notes": [ "hf mf cview", "hf mf cview --4k" ], "offline": false, "options": [ "-h, --help This help", "--mini MIFARE Classic Mini / S20", "--1k MIFARE Classic 1k / S50 (def)", "--2k MIFARE Classic/Plus 2k", "--4k MIFARE Classic 4k / S70", "-v, --verbose verbose output" ], "usage": "hf mf cview [-hv] [--mini] [--1k] [--2k] [--4k]" }, "hf mf cwipe": { "command": "hf mf cwipe", "description": "Wipe gen1 magic chinese card. Set UID / ATQA / SAK / Data / Keys / Access to default values", "notes": [ "hf mf cwipe", "hf mf cwipe -u 09080706 -a 0004 -s 18 -> set UID, ATQA and SAK and wipe card" ], "offline": false, "options": [ "-h, --help This help", "-u, --uid UID, 4 hex bytes", "-a, --atqa ATQA, 2 hex bytes", "-s, --sak SAK, 1 hex byte" ], "usage": "hf mf cwipe [-h] [-u ] [-a ] [-s ]" }, "hf mf darkside": { "command": "hf mf darkside", "description": "Darkside attack", "notes": [ "hf mf darkside", "hf mf darkside --blk 16", "hf mf darkside --blk 16 -b" ], "offline": false, "options": [ "-h, --help This help", "--blk Target block", "-b Target key B instead of default key A" ], "usage": "hf mf darkside [-hb] [--blk ]" }, "hf mf decrypt": { "command": "hf mf decrypt", "description": "Decrypt Crypto-1 encrypted bytes given some known state of crypto. See tracelog to gather needed values", "notes": [ "hf mf decrypt --nt b830049b --ar 9248314a --at 9280e203 -d 41e586f9", "-> 41e586f9 becomes 3003999a", "-> which annotates 30 03 [99 9a] read block 3 [crc]" ], "offline": true, "options": [ "-h, --help This help", "--nt tag nonce", "--ar ar_enc, encrypted reader response", "--at at_enc, encrypted tag response", "-d, --data encrypted data, taken directly after at_enc and forward" ], "usage": "hf mf decrypt [-h] --nt --ar --at -d " }, "hf mf dump": { "command": "hf mf dump", "description": "Dump MIFARE Classic tag to file (bin/json) If no given, UID will be used as filename", "notes": [ "hf mf dump --mini -> MIFARE Mini", "hf mf dump --1k -> MIFARE Classic 1k", "hf mf dump --2k -> MIFARE 2k", "hf mf dump --4k -> MIFARE 4k", "hf mf dump --keys hf-mf-066C8B78-key.bin -> MIFARE 1k with keys from specified file" ], "offline": false, "options": [ "-h, --help This help", "-f, --file Specify a filename for dump file", "-k, --keys filename of keys", "--mini MIFARE Classic Mini / S20", "--1k MIFARE Classic 1k / S50 (def)", "--2k MIFARE Classic/Plus 2k", "--4k MIFARE Classic 4k / S70", "--ns no save to file" ], "usage": "hf mf dump [-h] [-f ] [-k ] [--mini] [--1k] [--2k] [--4k] [--ns]" }, "hf mf ecfill": { "command": "hf mf ecfill", "description": "Dump card and transfer the data to emulator memory. Keys must be in the emulator memory", "notes": [ "hf mf ecfill -> use key type A", "hf mf ecfill --4k -b -> target 4K card with key type B" ], "offline": false, "options": [ "-h, --help This help", "-a input key type is key A(def)", "-b input key type is key B", "--mini MIFARE Classic Mini / S20", "--1k MIFARE Classic 1k / S50 (def)", "--2k MIFARE Classic/Plus 2k", "--4k MIFARE Classic 4k / S70" ], "usage": "hf mf ecfill [-hab] [--mini] [--1k] [--2k] [--4k]" }, "hf mf eclr": { "command": "hf mf eclr", "description": "It set card emulator memory to empty data blocks and key A/B FFFFFFFFFFFF", "notes": [ "hf mf eclr" ], "offline": false, "options": [ "-h, --help This help" ], "usage": "hf mf eclr [-h]" }, "hf mf egetblk": { "command": "hf mf egetblk", "description": "Get emulator memory block", "notes": [ "hf mf egetblk --blk 0 -> get block 0 (manufacturer)", "hf mf egetblk --blk 3 -v -> get block 3, decode sector trailer" ], "offline": false, "options": [ "-h, --help This help", "-b, --blk block number", "-v, --verbose verbose output" ], "usage": "hf mf egetblk [-hv] -b " }, "hf mf egetsc": { "command": "hf mf egetsc", "description": "Get emulator memory sector", "notes": [ "hf mf egetsc -s 0" ], "offline": false, "options": [ "-h, --help This help", "-s, --sec sector number", "-v, --verbose verbose output" ], "usage": "hf mf egetsc [-hv] -s " }, "hf mf ekeyprn": { "command": "hf mf ekeyprn", "description": "Download and print the keys from emulator memory", "notes": [ "hf mf ekeyprn --1k -> print MFC 1K keyset", "hf mf ekeyprn -w -> write keys to binary file" ], "offline": false, "options": [ "-h, --help This help", "-w, --write write keys to binary file `hf-mf--key.bin`", "--mini MIFARE Classic Mini / S20", "--1k MIFARE Classic 1k / S50 (def)", "--2k MIFARE Classic/Plus 2k", "--4k MIFARE Classic 4k / S70" ], "usage": "hf mf ekeyprn [-hw] [--mini] [--1k] [--2k] [--4k]" }, "hf mf eload": { "command": "hf mf eload", "description": "Load emulator memory with data from (bin/eml/json) dump file", "notes": [ "hf mf eload -f hf-mf-01020304.bin", "hf mf eload --4k -f hf-mf-01020304.eml" ], "offline": false, "options": [ "-h, --help This help", "-f, --file Specify a filename for dump file", "--mini MIFARE Classic Mini / S20", "--1k MIFARE Classic 1k / S50 (def)", "--2k MIFARE Classic/Plus 2k", "--4k MIFARE Classic 4k / S70", "--ul MIFARE Ultralight family", "-m, --mem use RDV4 spiffs", "-q, --qty manually set number of blocks (overrides)", "-v, --verbose verbose output" ], "usage": "hf mf eload [-hmv] -f [--mini] [--1k] [--2k] [--4k] [--ul] [-q ]" }, "hf mf esave": { "command": "hf mf esave", "description": "Save emulator memory to file (bin/json)", "notes": [ "hf mf esave", "hf mf esave --4k", "hf mf esave --4k -f hf-mf-01020304.eml" ], "offline": false, "options": [ "-h, --help This help", "-f, --file Specify a filename for dump file", "--mini MIFARE Classic Mini / S20", "--1k MIFARE Classic 1k / S50 (def)", "--2k MIFARE Classic/Plus 2k", "--4k MIFARE Classic 4k / S70" ], "usage": "hf mf esave [-h] [-f ] [--mini] [--1k] [--2k] [--4k]" }, "hf mf esetblk": { "command": "hf mf esetblk", "description": "Set emulator memory block", "notes": [ "hf mf esetblk --blk 1 -d 000102030405060708090a0b0c0d0e0f" ], "offline": false, "options": [ "-h, --help This help", "-b, --blk block number", "-d, --data bytes to write, 16 hex bytes" ], "usage": "hf mf esetblk [-h] -b [-d ]" }, "hf mf eview": { "command": "hf mf eview", "description": "It displays emulator memory", "notes": [ "hf mf eview", "hf mf eview --4k" ], "offline": false, "options": [ "-h, --help This help", "--mini MIFARE Classic Mini / S20", "--1k MIFARE Classic 1k / S50 (def)", "--2k MIFARE Classic/Plus 2k", "--4k MIFARE Classic 4k / S70", "-v, --verbose verbose output", "--sk Save extracted keys to file" ], "usage": "hf mf eview [-hv] [--mini] [--1k] [--2k] [--4k] [--sk]" }, "hf mf fchk": { "command": "hf mf fchk", "description": "This is a improved checkkeys method speedwise. It checks MIFARE Classic tags sector keys against a dictionary file with keys", "notes": [ "hf mf fchk --mini -k FFFFFFFFFFFF -> Key recovery against MIFARE Mini", "hf mf fchk --1k -k FFFFFFFFFFFF -> Key recovery against MIFARE Classic 1k", "hf mf fchk --2k -k FFFFFFFFFFFF -> Key recovery against MIFARE 2k", "hf mf fchk --4k -k FFFFFFFFFFFF -> Key recovery against MIFARE 4k", "hf mf fchk --1k -f mfc_default_keys.dic -> Target 1K using default dictionary file", "hf mf fchk --1k --emu -> Target 1K, write keys to emulator memory", "hf mf fchk --1k --dump -> Target 1K, write keys to file", "hf mf fchk --1k --mem -> Target 1K, use dictionary from flash memory" ], "offline": false, "options": [ "-h, --help This help", "-k, --key Key specified as 12 hex symbols", "--mini MIFARE Classic Mini / S20", "--1k MIFARE Classic 1k / S50 (default)", "--2k MIFARE Classic/Plus 2k", "--4k MIFARE Classic 4k / S70", "--emu Fill simulator keys from found keys", "--dump Dump found keys to binary file", "--mem Use dictionary from flashmemory", "-f, --file filename of dictionary" ], "usage": "hf mf fchk [-h] [-k ]... [--mini] [--1k] [--2k] [--4k] [--emu] [--dump] [--mem] [-f ]" }, "hf mf gdmcfg": { "command": "hf mf gdmcfg", "description": "Get configuration data from magic gen4 GDM card.", "notes": [ "hf mf gdmcfg" ], "offline": false, "options": [ "-h, --help This help", "-k, --key key 6 bytes" ], "usage": "hf mf gdmcfg [-h] [-k ]" }, "hf mf gdmsetblk": { "command": "hf mf gdmsetblk", "description": "Set block data on a magic gen4 GDM card `--force` param is used to override warnings like bad ACL writes. if not specified, it will exit if detected", "notes": [ "hf mf gdmsetblk --blk 1 -d 000102030405060708090a0b0c0d0e0f" ], "offline": false, "options": [ "-h, --help This help", "--blk block number", "-d, --data bytes to write, 16 hex bytes", "-k, --key key, 6 hex bytes", "--force override warnings" ], "usage": "hf mf gdmsetblk [-h] --blk [-d ] [-k ] [--force]" }, "hf mf gdmsetcfg": { "command": "hf mf gdmsetcfg", "description": "Set configuration data on a magic gen4 GDM card", "notes": [ "hf mf gdmsetcfg -d 850000000000000000005A5A00000008" ], "offline": false, "options": [ "-h, --help This help", "-d, --data bytes to write, 16 hex bytes" ], "usage": "hf mf gdmsetcfg [-h] -d " }, "hf mf gen3blk": { "command": "hf mf gen3blk", "description": "Overwrite full manufacturer block for magic Gen3 card - You can specify part of manufacturer block as 4/7-bytes for UID change only NOTE: BCC, SAK, ATQA will be calculated automatically", "notes": [ "hf mf gen3blk -> print current data", "hf mf gen3blk -d 01020304 -> set 4 byte uid", "hf mf gen3blk -d 01020304050607 -> set 7 byte uid", "hf mf gen3blk -d 01020304FFFFFFFF0102030405060708" ], "offline": false, "options": [ "-h, --help This help", "-d, --data manufacturer block data up to 16 hex bytes" ], "usage": "hf mf gen3blk [-h] [-d ]" }, "hf mf gen3freeze": { "command": "hf mf gen3freeze", "description": "Perma lock further UID changes. No more UID changes available after operation completed Note: operation is ! irreversible !", "notes": [ "hf mf gen3freeze -y" ], "offline": false, "options": [ "-h, --help This help", "-y, --yes confirm UID lock operation" ], "usage": "hf mf gen3freeze -y[h]" }, "hf mf gen3uid": { "command": "hf mf gen3uid", "description": "Set UID for magic Gen3 card _without_ changes to manufacturer block 0", "notes": [ "hf mf gen3uid --uid 01020304 -> set 4 byte uid", "hf mf gen3uid --uid 01020304050607 -> set 7 byte uid" ], "offline": false, "options": [ "-h, --help This help", "-u, --uid UID 4/7 hex bytes" ], "usage": "hf mf gen3uid [-h] [-u ]" }, "hf mf ggetblk": { "command": "hf mf ggetblk", "description": "Get block data from magic gen4 GTU card.", "notes": [ "hf mf ggetblk --blk 0 -> get block 0 (manufacturer)", "hf mf ggetblk --blk 3 -v -> get block 3, decode sector trailer" ], "offline": false, "options": [ "-h, --help This help", "-b, --blk block number", "-v, --verbose verbose output", "-p, --pwd password 4bytes" ], "usage": "hf mf ggetblk [-hv] -b [-p ]" }, "hf mf gload": { "command": "hf mf gload", "description": "Load magic gen4 gtu card with data from (bin/eml/json) dump file or from emulator memory.", "notes": [ "hf mf gload --emu", "hf mf gload -f hf-mf-01020304.eml", "hf mf gload -p AABBCCDD --4k -v -f hf-mf-01020304-dump.bin", "", "Card must be configured beforehand with `script run hf_mf_ultimatecard`.", "Blocks are 16 bytes long." ], "offline": false, "options": [ "-h, --help This help", "--mini MIFARE Classic Mini / S20", "--1k MIFARE Classic 1k / S50 (def)", "--2k MIFARE Classic/Plus 2k", "--4k MIFARE Classic 4k / S70", "-p, --pwd password 4bytes", "-v, --verbose verbose output", "-f, --file Specify a filename for dump file", "--emu from emulator memory", "--start index of block to start writing (default 0)", "--end index of block to end writing (default last block)" ], "usage": "hf mf gload [-hv] [--mini] [--1k] [--2k] [--4k] [-p ] [-f ] [--emu] [--start ] [--end ]" }, "hf mf gsave": { "command": "hf mf gsave", "description": "Save `magic gen4 gtu` card memory to file (bin/json)or into emulator memory", "notes": [ "hf mf gsave", "hf mf gsave --4k", "hf mf gsave -p DEADBEEF -f hf-mf-01020304.json" ], "offline": false, "options": [ "-h, --help This help", "--mini MIFARE Classic Mini / S20", "--1k MIFARE Classic 1k / S50 (def)", "--2k MIFARE Classic/Plus 2k", "--4k MIFARE Classic 4k / S70", "-p, --pwd password 4 bytes", "-f, --file Specify a filename for dump file", "--emu to emulator memory" ], "usage": "hf mf gsave [-h] [--mini] [--1k] [--2k] [--4k] [-p ] [-f ] [--emu]" }, "hf mf gsetblk": { "command": "hf mf gsetblk", "description": "Set block data on a magic gen4 GTU card", "notes": [ "hf mf gsetblk --blk 1 -d 000102030405060708090a0b0c0d0e0f" ], "offline": false, "options": [ "-h, --help This help", "-b, --blk block number", "-d, --data bytes to write, 16 hex bytes", "-p, --pwd password 4bytes" ], "usage": "hf mf gsetblk [-h] -b [-d ] [-p ]" }, "hf mf gview": { "command": "hf mf gview", "description": "View `magic gen4 gtu` card memory", "notes": [ "hf mf gview", "hf mf gview --4k" ], "offline": false, "options": [ "-h, --help This help", "--mini MIFARE Classic Mini / S20", "--1k MIFARE Classic 1k / S50 (def)", "--2k MIFARE Classic/Plus 2k", "--4k MIFARE Classic 4k / S70", "-p, --pwd password 4bytes", "-v, --verbose verbose output" ], "usage": "hf mf gview [-hv] [--mini] [--1k] [--2k] [--4k] [-p ]" }, "hf mf hardnested": { "command": "hf mf hardnested", "description": "Nested attack for hardened MIFARE Classic cards. if card is EV1, command can detect and use known key see example below `--i` set type of SIMD instructions. Without this flag programs autodetect it. or hf mf hardnested -r --tk [known target key] Add the known target key to check if it is present in the remaining key space hf mf hardnested --blk 0 -a -k A0A1A2A3A4A5 --tblk 4 --ta --tk FFFFFFFFFFFF", "notes": [ "hf mf hardnested --tblk 4 --ta -> works for MFC EV1", "hf mf hardnested --blk 0 -a -k FFFFFFFFFFFF --tblk 4 --ta", "hf mf hardnested --blk 0 -a -k FFFFFFFFFFFF --tblk 4 --ta -w", "hf mf hardnested --blk 0 -a -k FFFFFFFFFFFF --tblk 4 --ta -f nonces.bin -w -s", "hf mf hardnested -r", "hf mf hardnested -r --tk a0a1a2a3a4a5", "hf mf hardnested -t --tk a0a1a2a3a4a5", "hf mf hardnested --blk 0 -a -k a0a1a2a3a4a5 --tblk 4 --ta --tk FFFFFFFFFFFF" ], "offline": true, "options": [ "-h, --help This help", "-k, --key Key, 12 hex bytes", "--blk Input block number", "-a Input key A (def)", "-b Input key B", "--tblk Target block number", "--ta Target key A", "--tb Target key B", "--tk Target key, 12 hex bytes", "-u, --uid R/W `hf-mf--nonces.bin` instead of default name", "-f, --file R/W instead of default name", "-r, --read Read `hf-mf--nonces.bin` if tag present, otherwise `nonces.bin`, and start attack", "-s, --slow Slower acquisition (required by some non standard cards)", "-t, --tests Run tests", "-w, --wr Acquire nonces and UID, and write them to file `hf-mf--nonces.bin`", "--in None (use CPU regular instruction set)", "--im MMX", "--is SSE2", "--ia AVX", "--i2 AVX2", "--i5 AVX512" ], "usage": "hf mf hardnested [-habrstw] [-k ] [--blk ] [--tblk ] [--ta] [--tb] [--tk ] [-u ] [-f ] [--in] [--im] [--is] [--ia] [--i2] [--i5]" }, "hf mf list": { "command": "hf mf list", "description": "Alias of `trace list -t mf -c` with selected protocol data to annotate trace buffer You can load a trace from file (see `trace load -h`) or it be downloaded from device by default It accepts all other arguments of `trace list`. Note that some might not be relevant for this specific protocol", "notes": [ "hf mf list --frame -> show frame delay times", "hf mf list -1 -> use trace buffer" ], "offline": true, "options": [ "-h, --help This help", "-1, --buffer use data from trace buffer", "--frame show frame delay times", "-c mark CRC bytes", "-r show relative times (gap and duration)", "-u display times in microseconds instead of clock cycles", "-x show hexdump to convert to pcap(ng)", "or to import into Wireshark using encapsulation type \"ISO 14443\"", "-f, --file filename of dictionary" ], "usage": "hf mf list [-h1crux] [--frame] [-f ]" }, "hf mf mad": { "command": "hf mf mad", "description": "Checks and prints MIFARE Application Directory (MAD)", "notes": [ "hf mf mad -> shows MAD if exists", "hf mf mad --aid e103 -k ffffffffffff -b -> shows NDEF data if exists. read card with custom key and key B", "hf mf mad --dch -k ffffffffffff -> decode CardHolder information" ], "offline": true, "options": [ "-h, --help This help", "-v, --verbose show technical data", "--aid print all sectors with specified aid", "-k, --key key for printing sectors", "-b, --keyb use key B for access printing sectors (by default: key A)", "--be (optional, BigEndian)", "--dch decode Card Holder information", "-f, --file load dump file and decode MAD" ], "usage": "hf mf mad [-hvb] [--aid ] [-k ] [--be] [--dch] [-f ]" }, "hf mf nack": { "command": "hf mf nack", "description": "Test a MIFARE Classic based card for the NACK bug", "notes": [ "hf mf nack" ], "offline": false, "options": [ "-h, --help This help", "-v, --verbose verbose output`" ], "usage": "hf mf nack [-hv]" }, "hf mf ndefformat": { "command": "hf mf ndefformat", "description": "format MIFARE Classic Tag as a NFC tag with Data Exchange Format (NDEF) If no given, UID will be used as filename. It will try default keys and MAD keys to detect if tag is already formatted in order to write. If not, it will try finding a key file based on your UID. ie, if you ran autopwn before", "notes": [ "hf mf ndefformat", "hf mf ndefformat --1k -> MIFARE Classic 1k", "hf mf ndefformat --keys hf-mf-01020304-key.bin -> MIFARE 1k with keys from specified file" ], "offline": false, "options": [ "-h, --help This help", "-k, --keys filename of keys", "--mini MIFARE Classic Mini / S20", "--1k MIFARE Classic 1k / S50 (def)", "--2k MIFARE Classic/Plus 2k", "--4k MIFARE Classic 4k / S70" ], "usage": "hf mf ndefformat [-h] [-k ] [--mini] [--1k] [--2k] [--4k]" }, "hf mf ndefread": { "command": "hf mf ndefread", "description": "Prints NFC Data Exchange Format (NDEF)", "notes": [ "hf mf ndefread -> shows NDEF parsed data", "hf mf ndefread -vv -> shows NDEF parsed and raw data", "hf mf ndefread --aid e103 -k ffffffffffff -b -> shows NDEF data with custom AID, key and with key B", "hf mf ndefread -f myfilename -> save raw NDEF to file" ], "offline": false, "options": [ "-h, --help This help", "-v, --verbose show technical data", "--aid replace default aid for NDEF", "-k, --key replace default key for NDEF", "-b, --keyb use key B for access sectors (by default: key A)", "-f, --file save raw NDEF to file" ], "usage": "hf mf ndefread [-hvb] [--aid ] [-k ] [-f ]" }, "hf mf ndefwrite": { "command": "hf mf ndefwrite", "description": "Write raw NDEF hex bytes to tag. This commands assumes tag already been NFC/NDEF formatted.", "notes": [ "hf mf ndefwrite -d 0300FE -> write empty record to tag", "hf mf ndefwrite -f myfilename", "hf mf ndefwrite -d 033fd1023a53709101195405656e2d55534963656d616e2054776974746572206c696e6b5101195502747769747465722e636f6d2f686572726d616e6e31303031" ], "offline": false, "options": [ "-h, --help This help", "-d raw NDEF hex bytes", "-f, --file write raw NDEF file to tag", "-p fix NDEF record headers / terminator block if missing", "--mini MIFARE Classic Mini / S20", "--1k MIFARE Classic 1k / S50 (def)", "--2k MIFARE Classic/Plus 2k", "--4k MIFARE Classic 4k / S70", "-v, --verbose verbose output" ], "usage": "hf mf ndefwrite [-hpv] [-d ] [-f ] [--mini] [--1k] [--2k] [--4k]" }, "hf mf nested": { "command": "hf mf nested", "description": "Execute Nested attack against MIFARE Classic card for key recovery", "notes": [ "hf mf nested --blk 0 -a -k FFFFFFFFFFFF --tblk 4 --ta -> Use block 0 Key A to find block 4 Key A (single sector key recovery)", "hf mf nested --mini --blk 0 -a -k FFFFFFFFFFFF -> Key recovery against MIFARE Mini", "hf mf nested --1k --blk 0 -a -k FFFFFFFFFFFF -> Key recovery against MIFARE Classic 1k", "hf mf nested --2k --blk 0 -a -k FFFFFFFFFFFF -> Key recovery against MIFARE 2k", "hf mf nested --4k --blk 0 -a -k FFFFFFFFFFFF -> Key recovery against MIFARE 4k" ], "offline": false, "options": [ "-h, --help This help", "-k, --key Key specified as 12 hex symbols", "--mini MIFARE Classic Mini / S20", "--1k MIFARE Classic 1k / S50", "--2k MIFARE Classic/Plus 2k", "--4k MIFARE Classic 4k / S70", "--blk Input block number", "-a Input key specified is A key (default)", "-b Input key specified is B key", "--tblk Target block number", "--ta Target A key (default)", "--tb Target B key", "--emu Fill simulator keys from found keys", "--dump Dump found keys to file", "--mem Use dictionary from flashmemory" ], "usage": "hf mf nested [-hab] [-k ] [--mini] [--1k] [--2k] [--4k] [--blk ] [--tblk ] [--ta] [--tb] [--emu] [--dump] [--mem]" }, "hf mf personalize": { "command": "hf mf personalize", "description": "Personalize the UID of a MIFARE Classic EV1 card. This is only possible if it is a 7Byte UID card and if it is not already personalized.", "notes": [ "hf mf personalize --f0 -> double size UID", "hf mf personalize --f1 -> double size UID, optional usage of selection process shortcut", "hf mf personalize --f2 -> single size random ID", "hf mf personalize --f3 -> single size NUID", "hf mf personalize -b -k B0B1B2B3B4B5 --f3 -> use key B = 0xB0B1B2B3B4B5" ], "offline": false, "options": [ "-h, --help This help", "-a use key A to authenticate sector 0 (def)", "-b use key B to authenticate sector 0", "-k, --key key (def FFFFFFFFFFFF)", "--f0 UIDFO, double size UID", "--f1 UIDF1, double size UID, optional usage of selection process shortcut", "--f2 UIDF2, single size random ID", "--f3 UIDF3, single size NUID" ], "usage": "hf mf personalize [-hab] [-k ] [--f0] [--f1] [--f2] [--f3]" }, "hf mf rdbl": { "command": "hf mf rdbl", "description": "Read MIFARE Classic block", "notes": [ "hf mf rdbl --blk 0", "hf mf rdbl --blk 0 -k A0A1A2A3A4A5", "hf mf rdbl --blk 3 -v -> get block 3, decode sector trailer" ], "offline": false, "options": [ "-h, --help This help", "--blk block number", "-a input key type is key A (def)", "-b input key type is key B", "-k, --key key, 6 hex bytes", "-v, --verbose verbose output" ], "usage": "hf mf rdbl [-habv] --blk [-k ]" }, "hf mf rdsc": { "command": "hf mf rdsc", "description": "Read MIFARE Classic sector", "notes": [ "hf mf rdsc -s 0", "hf mf rdsc -s 0 -k A0A1A2A3A4A5" ], "offline": false, "options": [ "-h, --help This help", "-a input key specified is A key (def)", "-b input key specified is B key", "-k, --key key specified as 6 hex bytes", "-s, --sec sector number", "-v, --verbose verbose output" ], "usage": "hf mf rdsc [-habv] [-k ] -s " }, "hf mf restore": { "command": "hf mf restore", "description": "Restore MIFARE Classic dump file to tag. The key file and dump file will program the card sector trailers. By default we authenticate to card with key 0xFFFFFFFFFFFF. If access rights in dump file is all zeros, it will be replaced with default values `--uid` param is used for filename templates `hf-mf--dump.bin` and `hf-mf--key.bin. if not specified, it will read the card uid instead. `--ka` param you can indicate that the key file should be used for authentication instead. if so we also try both B/A keys `--force` param is used to override warnings and allow bad ACL block writes. if not specified, it will skip blocks with bad ACL.", "notes": [ "hf mf restore", "hf mf restore --1k --uid 04010203", "hf mf restore --1k --uid 04010203 -k hf-mf-AABBCCDD-key.bin", "hf mf restore --4k" ], "offline": false, "options": [ "-h, --help This help", "--mini MIFARE Classic Mini / S20", "--1k MIFARE Classic 1k / S50 (def)", "--2k MIFARE Classic/Plus 2k", "--4k MIFARE Classic 4k / S70", "-u, --uid uid, (4|7|10 hex bytes)", "-f, --file specify a filename for dump file", "-k, --kfn key filename", "--ka use specified keyfile to authenticate", "--force override warnings" ], "usage": "hf mf restore [-h] [--mini] [--1k] [--2k] [--4k] [-u ] [-f ] [-k ] [--ka] [--force]" }, "hf mf setmod": { "command": "hf mf setmod", "description": "Sets the load modulation strength of a MIFARE Classic EV1 card", "notes": [ "hf mf setmod -k ffffffffffff -0" ], "offline": false, "options": [ "-h, --help This help", "-0 normal modulation", "-1 strong modulation (def)", "-k, --key key A, Sector 0, 6 hex bytes" ], "usage": "hf mf setmod [-h01] [-k ]" }, "hf mf sim": { "command": "hf mf sim", "description": "Simulate MIFARE Classic family type based upon ISO/IEC 14443 type A tag with 4,7 or 10 byte UID from emulator memory. See `hf mf eload` first. The UID from emulator memory will be used if not specified.", "notes": [ "hf mf sim --mini -> MIFARE Mini", "hf mf sim --1k -> MIFARE Classic 1k (default)", "hf mf sim --1k -u 0a0a0a0a -> MIFARE Classic 1k with 4b UID", "hf mf sim --1k -u 11223344556677 -> MIFARE Classic 1k with 7b UID", "hf mf sim --1k -u 11223344 -i -x -> Perform reader attack in interactive mode", "hf mf sim --2k -> MIFARE 2k", "hf mf sim --4k -> MIFARE 4k" ], "offline": false, "options": [ "-h, --help This help", "-u, --uid <4|7|10> hex bytes UID", "--mini MIFARE Classic Mini / S20", "--1k MIFARE Classic 1k / S50", "--2k MIFARE Classic/Plus 2k", "--4k MIFARE Classic 4k / S70", "--atqa Provide explicit ATQA (2 bytes, overrides option t)", "--sak Provide explicit SAK (1 bytes, overrides option t)", "-n, --num Automatically exit simulation after blocks have been read by reader. 0 = infinite", "-i, --interactive Console will not be returned until simulation finishes or is aborted", "-x Performs the 'reader attack', nr/ar attack against a reader", "-e, --emukeys Fill simulator keys from found keys", "-v, --verbose verbose output", "--cve trigger CVE 2021_0430" ], "usage": "hf mf sim [-hixev] [-u ] [--mini] [--1k] [--2k] [--4k] [--atqa ] [--sak ] [-n ] [--cve]" }, "hf mf staticnested": { "command": "hf mf staticnested", "description": "Execute static nested attack against MIFARE Classic card with static nonce for key recovery. Supply a known key from one block to recover all keys", "notes": [ "hf mf staticnested --mini --blk 0 -a -k FFFFFFFFFFFF", "hf mf staticnested --1k --blk 0 -a -k FFFFFFFFFFFF", "hf mf staticnested --2k --blk 0 -a -k FFFFFFFFFFFF", "hf mf staticnested --4k --blk 0 -a -k FFFFFFFFFFFF" ], "offline": false, "options": [ "-h, --help This help", "-k, --key Known key (12 hex symbols)", "--mini MIFARE Classic Mini / S20", "--1k MIFARE Classic 1k / S50", "--2k MIFARE Classic/Plus 2k", "--4k MIFARE Classic 4k / S70", "--blk Input block number", "-a Input key specified is keyA (def)", "-b Input key specified is keyB", "-e, --emukeys Fill simulator keys from found keys", "--dumpkeys Dump found keys to file" ], "usage": "hf mf staticnested [-habe] [-k ] [--mini] [--1k] [--2k] [--4k] [--blk ] [--dumpkeys]" }, "hf mf supercard": { "command": "hf mf supercard", "description": "Extract info from a `super card`", "notes": [ "hf mf supercard -> recover key", "hf mf supercard -r -> reset card", "hf mf supercard -u 11223344 -> change UID" ], "offline": false, "options": [ "-h, --help This help", "-r, --reset Reset card", "-u, --uid New UID (4 hex bytes)", "--furui Furui detection card" ], "usage": "hf mf supercard [-hr] [-u ] [--furui]" }, "hf mf value": { "command": "hf mf value", "description": "MIFARE Classic value data commands", "notes": [ "hf mf value --blk 16 -k FFFFFFFFFFFF --set 1000", "hf mf value --blk 16 -k FFFFFFFFFFFF --inc 10", "hf mf value --blk 16 -k FFFFFFFFFFFF -b --dec 10", "hf mf value --blk 16 -k FFFFFFFFFFFF -b --get", "hf mf value --blk 16 -k FFFFFFFFFFFF --res --transfer 30 --tk FFFFFFFFFFFF -> transfer block 16 value to block 30 (even if block can't be incremented by ACL)", "hf mf value --get -d 87D612007829EDFF87D6120011EE11EE" ], "offline": true, "options": [ "-h, --help This help", "-k, --key key, 6 hex bytes", "-a input key type is key A (def)", "-b input key type is key B", "--inc Increment value by X (0 - 2147483647)", "--dec Decrement value by X (0 - 2147483647)", "--set Set value to X (-2147483647 - 2147483647)", "--transfer Transfer value to other block (after inc/dec/restore)", "--tkey transfer key, 6 hex bytes (if transfer is preformed to other sector)", "--ta transfer key type is key A (def)", "--tb transfer key type is key B", "--get Get value from block", "--res Restore (copy value to card buffer, should be used with --transfer)", "--blk block number", "-d, --data block data to extract values from (16 hex bytes)" ], "usage": "hf mf value [-hab] [-k ] [--inc ] [--dec ] [--set ] [--transfer ] [--tkey ] [--ta] [--tb] [--get] [--res] [--blk ] [-d ]" }, "hf mf view": { "command": "hf mf view", "description": "Print a MIFARE Classic dump file (bin/eml/json)", "notes": [ "hf mf view -f hf-mf-01020304-dump.bin" ], "offline": true, "options": [ "-h, --help This help", "-f, --file Specify a filename for dump file", "-v, --verbose verbose output", "--sk Save extracted keys to file" ], "usage": "hf mf view [-hv] -f [--sk]" }, "hf mf wipe": { "command": "hf mf wipe", "description": "Wipe card to zeros and default keys/acc. This command takes a key file to wipe card Will use UID from card to generate keyfile name if not specified. New A/B keys..... FF FF FF FF FF FF New acc rights... FF 07 80 New GPB.......... 69", "notes": [ "hf mf wipe -> reads card uid to generate file name", "hf mf wipe --gen2 -> force write to S0, B0 manufacture block", "hf mf wipe -f mykey.bin -> use mykey.bin" ], "offline": false, "options": [ "-h, --help This help", "-f, --file key filename", "--gen2 force write to Sector 0, block 0 (GEN2)" ], "usage": "hf mf wipe [-h] [-f ] [--gen2]" }, "hf mf wrbl": { "command": "hf mf wrbl", "description": "Write MIFARE Classic block with 16 hex bytes of data Sector 0 / Block 0 - Manufacturer block When writing to block 0 you must use a VALID block 0 data (UID, BCC, SAK, ATQA) Writing an invalid block 0 means rendering your Magic GEN2 card undetectable. Look in the magic_cards_notes.md file for help to resolve it. `--force` param is used to override warnings like bad ACL and BLOCK 0 writes. if not specified, it will exit if detected", "notes": [ "hf mf wrbl --blk 1 -d 000102030405060708090a0b0c0d0e0f", "hf mf wrbl --blk 1 -k A0A1A2A3A4A5 -d 000102030405060708090a0b0c0d0e0f" ], "offline": false, "options": [ "-h, --help This help", "--blk block number", "-a input key type is key A (def)", "-b input key type is key B", "--force override warnings", "-k, --key key, 6 hex bytes", "-d, --data bytes to write, 16 hex bytes" ], "usage": "hf mf wrbl [-hab] --blk [--force] [-k ] [-d ]" }, "hf mfdes auth": { "command": "hf mfdes auth", "description": "Select application on the card. It selects app if it is a valid one or returns an error.", "notes": [ "hf mfdes auth -n 0 -t des -k 0000000000000000 --kdf none -> select PICC level and authenticate with key num=0, key type=des, key=00..00 and key derivation = none", "hf mfdes auth -n 0 -t aes -k 00000000000000000000000000000000 -> select PICC level and authenticate with key num=0, key type=aes, key=00..00 and key derivation = none", "hf mfdes auth -n 0 -t des -k 0000000000000000 --save -> select PICC level and authenticate and in case of successful authentication - save channel parameters to defaults", "hf mfdes auth --aid 123456 -> select application 123456 and authenticate via parameters from `default` command" ], "offline": false, "options": [ "-h, --help This help", "-a, --apdu Show APDU requests and responses", "-v, --verbose Verbose mode", "-n, --keyno Key number", "-t, --algo Crypt algo", "-k, --key Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)", "--kdf Key Derivation Function (KDF)", "-i, --kdfi KDF input (1-31 hex bytes)", "-m, --cmode Communicaton mode", "-c, --ccset Communicaton command set", "--schann Secure channel", "--aid Application ID of application for some parameters (3 hex bytes, big endian)", "--isoid Application ISO ID (ISO DF ID) (2 hex bytes, big endian)", "--save saves channels parameters to defaults if authentication succeeds" ], "usage": "hf mfdes auth [-hav] [-n ] [-t ] [-k ] [--kdf ] [-i ] [-m ] [-c ] [--schann ] [--aid ] [--isoid ] [--save]" }, "hf mfdes bruteaid": { "command": "hf mfdes bruteaid", "description": "Recover AIDs by bruteforce. WARNING: This command takes a loooong time", "notes": [ "hf mfdes bruteaid -> Search all apps", "hf mfdes bruteaid --start F0000F -i 16 -> Search MAD range manually" ], "offline": false, "options": [ "-h, --help This help", "--start Starting App ID as hex bytes (3 bytes, big endian)", "--end Last App ID as hex bytes (3 bytes, big endian)", "-i, --step Increment step when bruteforcing", "-m, --mad Only bruteforce the MAD range" ], "usage": "hf mfdes bruteaid [-hm] [--start ] [--end ] [-i ]" }, "hf mfdes changekey": { "command": "hf mfdes changekey", "description": "Change PICC/Application key. Needs to provide keynum/key for a valid authentication (may get from default parameters).", "notes": [ "Change crypto algorithm for PICC key is possible,", "but for APP keys crypto algorithm is set by createapp command and can't be changed wo application delete", "", "hf mfdes changekey --aid 123456 -> execute with default factory setup. change des key 0 in the app 123456 from 00..00 to 00..00", "hf mfdes changekey --isoid df01 -t aes --schann lrp --newkeyno 01 -> change key 01 via lrp channelhf mfdes changekey -t des --newalgo aes --newkey 11223344556677889900112233445566 --newver a5 -> change card master key to AES one", "hf mfdes changekey --aid 123456 -t aes --key 00000000000000000000000000000000 --newkey 11223344556677889900112233445566 -> change app master key", "hf mfdes changekey --aid 123456 -t des -n 0 --newkeyno 1 --oldkey 5555555555555555 --newkey 1122334455667788 -> change key 1 with auth from key 0", "hf mfdes changekey --aid 123456 -t 3tdea --newkey 112233445566778899001122334455667788990011223344 -> change 3tdea key 0 from default 00..00 to provided" ], "offline": false, "options": [ "-h, --help This help", "-a, --apdu Show APDU requests and responses", "-v, --verbose Verbose mode", "-n, --keyno Key number", "-t, --algo Crypt algo", "-k, --key Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)", "--kdf Key Derivation Function (KDF)", "-i, --kdfi KDF input (1-31 hex bytes)", "-m, --cmode Communicaton mode", "-c, --ccset Communicaton command set", "--schann Secure channel", "--aid Application ID of application (3 hex bytes, big endian)", "--isoid Application ISO ID (ISO DF ID) (2 hex bytes, big endian).", "--oldalgo Old key crypto algorithm", "--oldkey Old key (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)", "--newkeyno Key number for change", "--newalgo New key crypto algorithm", "--newkey New key (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)", "--newver Version of new key (1 hex byte)" ], "usage": "hf mfdes changekey [-hav] [-n ] [-t ] [-k ] [--kdf ] [-i ] [-m ] [-c ] [--schann ] [--aid ] [--isoid ] [--oldalgo ] [--oldkey ] [--newkeyno ] [--newalgo ] [--newkey ] [--newver ]" }, "hf mfdes chfilesettings": { "command": "hf mfdes chfilesettings", "description": "Get File Settings from file from application. Master key needs to be provided or flag --no-auth set (depend on cards settings).", "notes": [ "hf mfdes chfilesettings --aid 123456 --fid 01 --amode plain --rrights free --wrights free --rwrights free --chrights key0 -> change file settings app=123456, file=01 with defaults from `default` command", "hf mfdes chfilesettings -n 0 -t des -k 0000000000000000 --kdf none --aid 123456 --fid 01 --rawdata 00EEEE -> execute with default factory setup", "hf mfdes chfilesettings --aid 123456 --fid 01 --rawdata 810000021f112f22 -> change file settings with additional rights for keys 1 and 2", "hf mfdes chfilesettings --isoid df01 --fid 00 --amode plain --rawrights eee0 --schann lrp -t aes -> change file settings via lrp channel" ], "offline": false, "options": [ "-h, --help This help", "-a, --apdu Show APDU requests and responses", "-v, --verbose Verbose mode", "-n, --keyno Key number", "-t, --algo Crypt algo", "-k, --key Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)", "--kdf Key Derivation Function (KDF)", "-i, --kdfi KDF input (1-31 hex bytes)", "-m, --cmode Communicaton mode", "-c, --ccset Communicaton command set", "--schann Secure channel", "--aid Application ID (3 hex bytes, big endian)", "--isoid Application ISO ID (ISO DF ID) (2 hex bytes, big endian)", "--fid File ID (1 hex byte)", "--rawdata File settings (HEX > 5 bytes). Have priority over the other settings", "--amode File access mode", "--rawrights Access rights for file (2 hex bytes) R/W/RW/Chg, 0x0 - 0xD Key, 0xE Free, 0xF Denied", "--rrights Read file access mode: the specified key, free, deny", "--wrights Write file access mode: the specified key, free, deny", "--rwrights Read/Write file access mode: the specified key, free, deny", "--chrights Change file settings access mode: the specified key, free, deny", "--no-auth Execute without authentication" ], "usage": "hf mfdes chfilesettings [-hav] [-n ] [-t ] [-k ] [--kdf ] [-i ] [-m ] [-c ] [--schann ] [--aid ] [--isoid ] [--fid ] [--rawdata ] [--amode ] [--rawrights ] [--rrights ] [--wrights ] [--rwrights ] [--chrights ] [--no-auth]" }, "hf mfdes chk": { "command": "hf mfdes chk", "description": "Checks keys with MIFARE DESFire card.", "notes": [ "hf mfdes chk --aid 123456 -k 000102030405060708090a0b0c0d0e0f -> check key on aid 0x123456", "hf mfdes chk -d mfdes_default_keys -> check keys against all existing aid on card", "hf mfdes chk -d mfdes_default_keys --aid 123456 -> check keys against aid 0x123456", "hf mfdes chk --aid 123456 --pattern1b -j keys -> check all 1-byte keys pattern on aid 0x123456 and save found keys to `keys.json`", "hf mfdes chk --aid 123456 --pattern2b --startp2b FA00 -> check all 2-byte keys pattern on aid 0x123456. Start from key FA00FA00...FA00" ], "offline": false, "options": [ "-h, --help This help", "--aid Use specific AID (3 hex bytes, big endian)", "-k, --key Key for checking (HEX 16 bytes)", "-d, --dict Dictionary file with keys", "--pattern1b Check all 1-byte combinations of key (0000...0000, 0101...0101, 0202...0202, ...)", "--pattern2b Check all 2-byte combinations of key (0000...0000, 0001...0001, 0002...0002, ...)", "--startp2b Start key (2-byte HEX) for 2-byte search (use with `--pattern2b`)", "-j, --json Json file name to save keys", "-v, --verbose Verbose mode", "--kdf <0|1|2> Key Derivation Function (KDF) (0=None, 1=AN10922, 2=Gallagher)", "-i, --kdfi KDF input (1-31 hex bytes)", "-a, --apdu Show APDU requests and responses" ], "usage": "hf mfdes chk [-hva] [--aid ] [-k ] [-d ] [--pattern1b] [--pattern2b] [--startp2b ] [-j ] [--kdf <0|1|2>] [-i ]" }, "hf mfdes chkeysettings": { "command": "hf mfdes chkeysettings", "description": "Change key settings for card level or application level. WARNING: card level changes may block the card!", "notes": [ "hf mfdes chkeysettings -d 0f -> set picc key settings with default key/channel setup", "hf mfdes chkeysettings --aid 123456 -d 0f -> set app 123456 key settings with default key/channel setup" ], "offline": false, "options": [ "-h, --help This help", "-a, --apdu Show APDU requests and responses", "-v, --verbose Verbose mode", "-n, --keyno Key number", "-t, --algo Crypt algo", "-k, --key Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)", "--kdf Key Derivation Function (KDF)", "-i, --kdfi KDF input (1-31 hex bytes)", "-m, --cmode Communicaton mode", "-c, --ccset Communicaton command set", "--schann Secure channel", "--aid Application ID (3 hex bytes, big endian)", "-d, --data Key settings (1 hex byte)" ], "usage": "hf mfdes chkeysettings [-hav] [-n ] [-t ] [-k ] [--kdf ] [-i ] [-m ] [-c ] [--schann ] [--aid ] [-d ]" }, "hf mfdes clearrecfile": { "command": "hf mfdes clearrecfile", "description": "Clear record file. Master key needs to be provided or flag --no-auth set (depend on cards settings).", "notes": [ "hf mfdes clearrecfile --aid 123456 --fid 01 -> clear record file for: app=123456, file=01 with defaults from `default` command", "hf mfdes clearrecfile --isoid df01 --fid 01 --schann lrp -t aes -n 3 -> clear record file for lrp channel with key number 3" ], "offline": false, "options": [ "-h, --help This help", "-a, --apdu Show APDU requests and responses", "-v, --verbose Verbose mode", "-n, --keyno Key number", "-t, --algo Crypt algo", "-k, --key Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)", "--kdf Key Derivation Function (KDF)", "-i, --kdfi KDF input (1-31 hex bytes)", "-m, --cmode Communicaton mode", "-c, --ccset Communicaton command set", "--schann Secure channel", "--aid Application ID (3 hex bytes, big endian)", "--isoid Application ISO ID (ISO DF ID) (2 hex bytes, big endian)", "--fid File ID for clearing (1 hex byte)", "--no-auth Execute without authentication" ], "usage": "hf mfdes clearrecfile [-hav] [-n ] [-t ] [-k ] [--kdf ] [-i ] [-m ] [-c ] [--schann ] [--aid ] [--isoid ] [--fid ] [--no-auth]" }, "hf mfdes createapp": { "command": "hf mfdes createapp", "description": "Create application. Master key needs to be provided.", "notes": [ "option rawdata have priority over the rest settings, and options ks1 and ks2 have priority over corresponded key settings", "", "KeySetting 1 (AMK Setting, ks1):", "0: Allow change master key. 1 - allow, 0 - frozen", "1: Free Directory list access without master key", "0: AMK auth needed for GetFileSettings and GetKeySettings", "1: No AMK auth needed for GetFileIDs, GetISOFileIDs, GetFileSettings, GetKeySettings", "2: Free create/delete without master key", "0: CreateFile/DeleteFile only with AMK auth", "1: CreateFile/DeleteFile always", "3: Configuration changeable", "0: Configuration frozen", "1: Configuration changeable if authenticated with AMK (default)", "4-7: ChangeKey Access Rights", "0: Application master key needed (default)", "0x1..0xD: Auth with specific key needed to change any key", "0xE: Auth with the key to be changed (same KeyNo) is necessary to change a key", "0xF: All Keys within this application are frozen", "", "KeySetting 2 (ks2):", "0..3: Number of keys stored within the application (max. 14 keys)", "4: ks3 is present", "5: Use of 2 byte ISO FID, 0: No, 1: Yes", "6..7: Crypto Method 00: DES|2TDEA, 01: 3TDEA, 10: AES, 11: RFU", "Example:", "2E = with FID, DES|2TDEA, 14 keys", "6E = with FID, 3TDEA, 14 keys", "AE = with FID, AES, 14 keys", "", "hf mfdes createapp --rawdata 5634122F2E4523616964313233343536 -> execute create by rawdata", "hf mfdes createapp --aid 123456 --fid 2345 --dfname aid123456 -> app aid, iso file id, and iso df name is specified", "hf mfdes createapp --aid 123456 --fid 2345 --dfname aid123456 --dstalgo aes -> with algorithm for key AES" ], "offline": false, "options": [ "-h, --help This help", "-a, --apdu Show APDU requests and responses", "-v, --verbose Verbose mode", "-n, --keyno Key number", "-t, --algo Crypt algo", "-k, --key Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)", "--kdf Key Derivation Function (KDF)", "-i, --kdfi KDF input (1-31 hex bytes)", "-m, --cmode Communicaton mode", "-c, --ccset Communicaton command set", "--schann Secure channel", "--rawdata Raw data that sends to command", "--aid Application ID for create. Mandatory. (3 hex bytes, big endian)", "--fid ISO file ID. Forbidden values: 0000 3F00, 3FFF, FFFF. (2 hex bytes, big endian)", "--dfname ISO DF Name (1..16 chars)", "--dfhex ISO DF Name as hex (1..16 bytes)", "--ks1 Key settings 1 (1 hex byte). Application Master Key Settings (def: 0x0F)", "--ks2 Key settings 2 (1 hex byte). (def: 0x0E)", "--dstalgo Application key crypt algo (def: DES)", "--numkeys Number of keys 0x00..0x0e (def: 0x0E)", "--no-auth Execute without authentication" ], "usage": "hf mfdes createapp [-hav] [-n ] [-t ] [-k ] [--kdf ] [-i ] [-m ] [-c ] [--schann ] [--rawdata ] [--aid ] [--fid ] [--dfname ] [--dfhex ] [--ks1 ] [--ks2 ] [--dstalgo ] [--numkeys ] [--no-auth]" }, "hf mfdes createfile": { "command": "hf mfdes createfile", "description": "Create Standard/Backup file in the application. Application master key needs to be provided or flag --no-auth set (depend on application settings).", "notes": [ "--rawtype/--rawdata have priority over the other settings. and with these parameters you can create any file. file id comes from parameters, all the rest data must be in the --rawdata parameter", "--rawrights have priority over the separate rights settings.", "Key/mode/etc of the authentication depends on application settings", "hf mfdes createfile --aid 123456 --fid 01 --isofid 0001 --size 000010 -> create file with iso id. Authentication with defaults from `default` command", "hf mfdes createfile --aid 123456 --fid 01 --rawtype 01 --rawdata 000100EEEE000100 -> create file via sending rawdata to the card. Can be used to create any type of file. Authentication with defaults from `default` command", "hf mfdes createfile --aid 123456 --fid 01 --amode plain --rrights free --wrights free --rwrights free --chrights key0 -> create file app=123456, file=01 and mentioned rights with defaults from `default` command", "hf mfdes createfile -n 0 -t des -k 0000000000000000 --kdf none --aid 123456 --fid 01 --rawtype 00 --rawdata 00EEEE000100 -> execute with default factory setup" ], "offline": false, "options": [ "-h, --help This help", "-a, --apdu Show APDU requests and responses", "-v, --verbose Verbose mode", "-n, --keyno Key number", "-t, --algo Crypt algo", "-k, --key Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)", "--kdf Key Derivation Function (KDF)", "-i, --kdfi KDF input (1-31 hex bytes)", "-m, --cmode Communicaton mode", "-c, --ccset Communicaton command set", "--schann Secure channel", "--aid Application ID (3 hex bytes, big endian)", "--fid File ID (1 hex byte)", "--isofid ISO File ID (2 hex bytes)", "--rawtype Raw file type (1 hex byte)", "--rawdata Raw file settings (hex > 5 bytes)", "--amode File access mode", "--rawrights Access rights for file (2 hex bytes) R/W/RW/Chg, 0x0 - 0xD Key, 0xE Free, 0xF Denied", "--rrights Read file access mode: the specified key, free, deny", "--wrights Write file access mode: the specified key, free, deny", "--rwrights Read/Write file access mode: the specified key, free, deny", "--chrights Change file settings access mode: the specified key, free, deny", "--no-auth Execute without authentication", "--size File size (3 hex bytes, big endian)", "--backup Create backupfile instead of standard file" ], "usage": "hf mfdes createfile [-hav] [-n ] [-t ] [-k ] [--kdf ] [-i ] [-m ] [-c ] [--schann ] [--aid ] [--fid ] [--isofid ] [--rawtype ] [--rawdata ] [--amode ] [--rawrights ] [--rrights ] [--wrights ] [--rwrights ] [--chrights ] [--no-auth] [--size ] [--backup]" }, "hf mfdes createmacfile": { "command": "hf mfdes createmacfile", "description": "Create Transaction MAC file in the application. Application master key needs to be provided or flag --no-auth set (depend on application settings).", "notes": [ "--rawrights have priority over the separate rights settings.", "Key/mode/etc of the authentication depends on application settings", "Write right should be always 0xF. Read-write right should be 0xF if you not need to submit CommitReaderID command each time transaction starts", "", "hf mfdes createmacfile --aid 123456 --fid 01 --rawrights 0FF0 --mackey 00112233445566778899aabbccddeeff --mackeyver 01 -> create transaction mac file with parameters. Rights from default. Authentication with defaults from `default` command", "hf mfdes createmacfile --aid 123456 --fid 01 --amode plain --rrights free --wrights deny --rwrights free --chrights key0 --mackey 00112233445566778899aabbccddeeff -> create file app=123456, file=01, with key, and mentioned rights with defaults from `default` command", "hf mfdes createmacfile -n 0 -t des -k 0000000000000000 --kdf none --aid 123456 --fid 01 -> execute with default factory setup. key and keyver == 0x00..00", "hf mfdes createmacfile --isoid df01 --fid 0f --schann lrp -t aes --rawrights 0FF0 --mackey 00112233445566778899aabbccddeeff --mackeyver 01 -> create transaction mac file via lrp channel", "hf mfdes createmacfile --isoid df01 --fid 0f --schann lrp -t aes --rawrights 0F10 --mackey 00112233445566778899aabbccddeeff --mackeyver 01 -> create transaction mac file via lrp channel with CommitReaderID command enable" ], "offline": false, "options": [ "-h, --help This help", "-a, --apdu Show APDU requests and responses", "-v, --verbose Verbose mode", "-n, --keyno Key number", "-t, --algo Crypt algo", "-k, --key Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)", "--kdf Key Derivation Function (KDF)", "-i, --kdfi KDF input (1-31 hex bytes)", "-m, --cmode Communicaton mode", "-c, --ccset Communicaton command set", "--schann Secure channel", "--aid Application ID (3 hex bytes, big endian)", "--isoid Application ISO ID (ISO DF ID) (2 hex bytes, big endian)", "--fid File ID (1 hex byte)", "--amode File access mode", "--rawrights Access rights for file (2 hex bytes) R/W/RW/Chg, 0x0 - 0xD Key, 0xE Free, 0xF Denied", "--rrights Read file access mode: the specified key, free, deny", "--wrights Write file access mode: the specified key, free, deny", "--rwrights Read/Write file access mode: the specified key, free, deny", "--chrights Change file settings access mode: the specified key, free, deny", "--no-auth Execute without authentication", "--mackey AES-128 key for MAC (16 hex bytes, big endian). (def: all zeros)", "--mackeyver AES key version for MAC (1 hex byte). (def: 0x0)" ], "usage": "hf mfdes createmacfile [-hav] [-n ] [-t ] [-k ] [--kdf ] [-i ] [-m ] [-c ] [--schann ] [--aid ] [--isoid ] [--fid ] [--amode ] [--rawrights ] [--rrights ] [--wrights ] [--rwrights ] [--chrights ] [--no-auth] [--mackey ] [--mackeyver ]" }, "hf mfdes createrecordfile": { "command": "hf mfdes createrecordfile", "description": "Create Linear/Cyclic Record file in the application. Application master key needs to be provided or flag --no-auth set (depend on application settings).", "notes": [ "--rawrights have priority over the separate rights settings.", "Key/mode/etc of the authentication depends on application settings", "hf mfdes createrecordfile --aid 123456 --fid 01 --size 000010 --maxrecord 000010 --cyclic -> create cyclic record file with parameters. Rights from default. Authentication with defaults from `default` command", "hf mfdes createrecordfile --aid 123456 --fid 01 --amode plain --rrights free --wrights free --rwrights free --chrights key0 --size 000010 --maxrecord 000010 -> create linear record file app=123456, file=01 and mentioned rights with defaults from `default` command", "hf mfdes createrecordfile -n 0 -t des -k 0000000000000000 --kdf none --aid 123456 --fid 01 --size 000010 --maxrecord 000010 -> execute with default factory setup" ], "offline": false, "options": [ "-h, --help This help", "-a, --apdu Show APDU requests and responses", "-v, --verbose Verbose mode", "-n, --keyno Key number", "-t, --algo Crypt algo", "-k, --key Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)", "--kdf Key Derivation Function (KDF)", "-i, --kdfi KDF input (1-31 hex bytes)", "-m, --cmode Communicaton mode", "-c, --ccset Communicaton command set", "--schann Secure channel", "--aid Application ID (3 hex bytes, big endian)", "--fid File ID (1 hex byte)", "--isofid ISO File ID (2 hex bytes)", "--amode File access mode", "--rawrights Access rights for file (2 hex bytes) R/W/RW/Chg, 0x0 - 0xD Key, 0xE Free, 0xF Denied", "--rrights Read file access mode: the specified key, free, deny", "--wrights Write file access mode: the specified key, free, deny", "--rwrights Read/Write file access mode: the specified key, free, deny", "--chrights Change file settings access mode: the specified key, free, deny", "--no-auth Execute without authentication", "--size Record size (3 hex bytes, big endian, 000001 to FFFFFF)", "--maxrecord Max. Number of Records (3 hex bytes, big endian)", "--cyclic Create cyclic record file instead of linear record file" ], "usage": "hf mfdes createrecordfile [-hav] [-n ] [-t ] [-k ] [--kdf ] [-i ] [-m ] [-c ] [--schann ] [--aid ] [--fid ] [--isofid ] [--amode ] [--rawrights ] [--rrights ] [--wrights ] [--rwrights ] [--chrights ] [--no-auth] [--size ] [--maxrecord ] [--cyclic]" }, "hf mfdes createvaluefile": { "command": "hf mfdes createvaluefile", "description": "Create Value file in the application. Application master key needs to be provided or flag --no-auth set (depend on application settings).", "notes": [ "--rawrights have priority over the separate rights settings.", "Key/mode/etc of the authentication depends on application settings", "hf mfdes createvaluefile --aid 123456 --fid 01 --lower 00000010 --upper 00010000 --value 00000100 -> create file with parameters. Rights from default. Authentication with defaults from `default` command", "hf mfdes createvaluefile --aid 123456 --fid 01 --amode plain --rrights free --wrights free --rwrights free --chrights key0 -> create file app=123456, file=01 and mentioned rights with defaults from `default` command", "hf mfdes createvaluefile -n 0 -t des -k 0000000000000000 --kdf none --aid 123456 --fid 01 -> execute with default factory setup" ], "offline": false, "options": [ "-h, --help This help", "-a, --apdu Show APDU requests and responses", "-v, --verbose Verbose mode", "-n, --keyno Key number", "-t, --algo Crypt algo", "-k, --key Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)", "--kdf Key Derivation Function (KDF)", "-i, --kdfi KDF input (1-31 hex bytes)", "-m, --cmode Communicaton mode", "-c, --ccset Communicaton command set", "--schann Secure channel", "--aid Application ID (3 hex bytes, big endian)", "--fid File ID (1 hex byte)", "--amode File access mode", "--rawrights Access rights for file (2 hex bytes) R/W/RW/Chg, 0x0 - 0xD Key, 0xE Free, 0xF Denied", "--rrights Read file access mode: the specified key, free, deny", "--wrights Write file access mode: the specified key, free, deny", "--rwrights Read/Write file access mode: the specified key, free, deny", "--chrights Change file settings access mode: the specified key, free, deny", "--no-auth Execute without authentication", "--lower Lower limit (4 hex bytes, big endian)", "--upper Upper limit (4 hex bytes, big endian)", "--value Value (4 hex bytes, big endian)", "--lcredit Limited Credit enabled (Bit 0 = Limited Credit, 1 = FreeValue)" ], "usage": "hf mfdes createvaluefile [-hav] [-n ] [-t ] [-k ] [--kdf ] [-i ] [-m ] [-c ] [--schann ] [--aid ] [--fid ] [--amode ] [--rawrights ] [--rrights ] [--wrights ] [--rwrights ] [--chrights ] [--no-auth] [--lower ] [--upper ] [--value ] [--lcredit ]" }, "hf mfdes default": { "command": "hf mfdes default", "description": "Set default parameters for access to MIFARE DESfire card.", "notes": [ "hf mfdes default -n 0 -t des -k 0000000000000000 --kdf none -> save to the default parameters" ], "offline": false, "options": [ "-h, --help This help", "-n, --keyno Key number", "-t, --algo Crypt algo", "-k, --key Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)", "--kdf Key Derivation Function (KDF)", "-i, --kdfi KDF input (1-31 hex bytes)", "-m, --cmode Communicaton mode", "-c, --ccset Communicaton command set", "--schann Secure channel" ], "usage": "hf mfdes default [-h] [-n ] [-t ] [-k ] [--kdf ] [-i ] [-m ] [-c ] [--schann ]" }, "hf mfdes deleteapp": { "command": "hf mfdes deleteapp", "description": "Delete application by its 3-byte AID. Master key needs to be provided.", "notes": [ "hf mfdes deleteapp --aid 123456 -> execute with default factory setup" ], "offline": false, "options": [ "-h, --help This help", "-a, --apdu Show APDU requests and responses", "-v, --verbose Verbose mode", "-n, --keyno Key number", "-t, --algo Crypt algo", "-k, --key Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)", "--kdf Key Derivation Function (KDF)", "-i, --kdfi KDF input (1-31 hex bytes)", "-m, --cmode Communicaton mode", "-c, --ccset Communicaton command set", "--schann Secure channel", "--aid Application ID of delegated application (3 hex bytes, big endian)" ], "usage": "hf mfdes deleteapp [-hav] [-n ] [-t ] [-k ] [--kdf ] [-i ] [-m ] [-c ] [--schann ] [--aid ]" }, "hf mfdes deletefile": { "command": "hf mfdes deletefile", "description": "Delete file from application. Master key needs to be provided or flag --no-auth set (depend on cards settings).", "notes": [ "hf mfdes deletefile --aid 123456 --fid 01 -> delete file for: app=123456, file=01 with defaults from `default` command", "hf mfdes deletefile --isoid df01 --fid 0f --schann lrp -t aes -> delete file for lrp channel" ], "offline": false, "options": [ "-h, --help This help", "-a, --apdu Show APDU requests and responses", "-v, --verbose Verbose mode", "-n, --keyno Key number", "-t, --algo Crypt algo", "-k, --key Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)", "--kdf Key Derivation Function (KDF)", "-i, --kdfi KDF input (1-31 hex bytes)", "-m, --cmode Communicaton mode", "-c, --ccset Communicaton command set", "--schann Secure channel", "--aid Application ID (3 hex bytes, big endian)", "--isoid Application ISO ID (ISO DF ID) (2 hex bytes, big endian)", "--fid File ID (1 hex byte)", "--no-auth Execute without authentication" ], "usage": "hf mfdes deletefile [-hav] [-n ] [-t ] [-k ] [--kdf ] [-i ] [-m ] [-c ] [--schann ] [--aid ] [--isoid ] [--fid ] [--no-auth]" }, "hf mfdes detect": { "command": "hf mfdes detect", "description": "Detect key type and tries to find one from the list.", "notes": [ "hf mfdes detect -> detect key 0 from PICC level", "hf mfdes detect --schann d40 -> detect key 0 from PICC level via secure channel D40", "hf mfdes detect --dict mfdes_default_keys -> detect key 0 from PICC level with help of the standard dictionary", "hf mfdes detect --aid 123456 -n 2 --save -> detect key 2 from app 123456 and if succeed - save params to defaults (`default` command)", "hf mfdes detect --isoid df01 --save -> detect key 0 and save to defaults with card in the LRP mode" ], "offline": false, "options": [ "-h, --help This help", "-a, --apdu Show APDU requests and responses", "-v, --verbose Verbose mode", "-n, --keyno Key number", "-t, --algo Crypt algo", "-k, --key Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)", "--kdf Key Derivation Function (KDF)", "-i, --kdfi KDF input (1-31 hex bytes)", "-m, --cmode Communicaton mode", "-c, --ccset Communicaton command set", "--schann Secure channel", "--aid Application ID (3 hex bytes, big endian)", "--isoid Application ISO ID (ISO DF ID) (2 hex bytes, big endian).", "--dict Dictionary file name with keys", "--save Save found key and parameters to defaults" ], "usage": "hf mfdes detect [-hav] [-n ] [-t ] [-k ] [--kdf ] [-i ] [-m ] [-c ] [--schann ] [--aid ] [--isoid ] [--dict ] [--save]" }, "hf mfdes dump": { "command": "hf mfdes dump", "description": "For each application show fil list and then file content. Key needs to be provided for authentication or flag --no-auth set (depend on cards settings).", "notes": [ "hf mfdes dump --aid 123456 -> show file dump for: app=123456 with channel defaults from `default` command/nhf mfdes dump --isoid df01 --schann lrp -t aes --length 000090 -> lrp default settings with length limit" ], "offline": false, "options": [ "-h, --help This help", "-a, --apdu Show APDU requests and responses", "-v, --verbose Verbose mode", "-n, --keyno Key number", "-t, --algo Crypt algo", "-k, --key Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)", "--kdf Key Derivation Function (KDF)", "-i, --kdfi KDF input (1-31 hex bytes)", "-m, --cmode Communicaton mode", "-c, --ccset Communicaton command set", "--schann Secure channel", "--aid Application ID (3 hex bytes, big endian)", "--isoid Application ISO ID (ISO DF ID) (2 hex bytes, big endian)", "-l, --length Maximum length for read data files (3 hex bytes, big endian)", "--no-auth Execute without authentication" ], "usage": "hf mfdes dump [-hav] [-n ] [-t ] [-k ] [--kdf ] [-i ] [-m ] [-c ] [--schann ] [--aid ] [--isoid ] [-l ] [--no-auth]" }, "hf mfdes formatpicc": { "command": "hf mfdes formatpicc", "description": "Format card. Can be done only if enabled in the configuration. Master key needs to be provided.", "notes": [ "hf mfdes formatpicc -> execute with default factory setup" ], "offline": false, "options": [ "-h, --help This help", "-a, --apdu Show APDU requests and responses", "-v, --verbose Verbose mode", "-n, --keyno Key number", "-t, --algo Crypt algo", "-k, --key Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)", "--kdf Key Derivation Function (KDF)", "-i, --kdfi KDF input (1-31 hex bytes)", "-m, --cmode Communicaton mode", "-c, --ccset Communicaton command set", "--schann Secure channel", "--aid Application ID of delegated application (3 hex bytes, big endian)" ], "usage": "hf mfdes formatpicc [-hav] [-n ] [-t ] [-k ] [--kdf ] [-i ] [-m ] [-c ] [--schann ] [--aid ]" }, "hf mfdes freemem": { "command": "hf mfdes freemem", "description": "Get card's free memory. Can be done with or without authentication. Master key may be provided.", "notes": [ "hf mfdes getfreemem -> execute with default factory setup" ], "offline": false, "options": [ "-h, --help This help", "-a, --apdu Show APDU requests and responses", "-v, --verbose Verbose mode", "-n, --keyno Key number", "-t, --algo Crypt algo", "-k, --key Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)", "--kdf Key Derivation Function (KDF)", "-i, --kdfi KDF input (1-31 hex bytes)", "-m, --cmode Communicaton mode", "-c, --ccset Communicaton command set", "--schann Secure channel", "--no-auth Execute without authentication" ], "usage": "hf mfdes getfreemem [-hav] [-n ] [-t ] [-k ] [--kdf ] [-i ] [-m ] [-c ] [--schann ] [--no-auth]" }, "hf mfdes getaids": { "command": "hf mfdes getaids", "description": "Get Application IDs list from card. Master key needs to be provided or flag --no-auth set.", "notes": [ "hf mfdes getaids -n 0 -t des -k 0000000000000000 --kdf none -> execute with default factory setup" ], "offline": false, "options": [ "-h, --help This help", "-a, --apdu Show APDU requests and responses", "-v, --verbose Verbose mode", "-n, --keyno Key number", "-t, --algo Crypt algo", "-k, --key Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)", "--kdf Key Derivation Function (KDF)", "-i, --kdfi KDF input (1-31 hex bytes)", "-m, --cmode Communicaton mode", "-c, --ccset Communicaton command set", "--schann Secure channel", "--no-auth Execute without authentication" ], "usage": "hf mfdes getaids [-hav] [-n ] [-t ] [-k ] [--kdf ] [-i ] [-m ] [-c ] [--schann ] [--no-auth]" }, "hf mfdes getappnames": { "command": "hf mfdes getappnames", "description": "Get Application IDs, ISO IDs and DF names from card. Master key needs to be provided or flag --no-auth set.", "notes": [ "hf mfdes getappnames -n 0 -t des -k 0000000000000000 --kdf none -> execute with default factory setup" ], "offline": false, "options": [ "-h, --help This help", "-a, --apdu Show APDU requests and responses", "-v, --verbose Verbose mode", "-n, --keyno Key number", "-t, --algo Crypt algo", "-k, --key Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)", "--kdf Key Derivation Function (KDF)", "-i, --kdfi KDF input (1-31 hex bytes)", "-m, --cmode Communicaton mode", "-c, --ccset Communicaton command set", "--schann Secure channel", "--no-auth Execute without authentication" ], "usage": "hf mfdes getappnames [-hav] [-n ] [-t ] [-k ] [--kdf ] [-i ] [-m ] [-c ] [--schann ] [--no-auth]" }, "hf mfdes getfileids": { "command": "hf mfdes getfileids", "description": "Get File IDs list from card. Master key needs to be provided or flag --no-auth set.", "notes": [ "hf mfdes getfileids --aid 123456 -> execute with defaults from `default` command", "hf mfdes getfileids -n 0 -t des -k 0000000000000000 --kdf none --aid 123456 -> execute with default factory setup" ], "offline": false, "options": [ "-h, --help This help", "-a, --apdu Show APDU requests and responses", "-v, --verbose Verbose mode", "-n, --keyno Key number", "-t, --algo Crypt algo", "-k, --key Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)", "--kdf Key Derivation Function (KDF)", "-i, --kdfi KDF input (1-31 hex bytes)", "-m, --cmode Communicaton mode", "-c, --ccset Communicaton command set", "--schann Secure channel", "--aid Application ID (3 hex bytes, big endian)", "--isoid Application ISO ID (ISO DF ID) (2 hex bytes, big endian).", "--no-auth Execute without authentication" ], "usage": "hf mfdes getfileids [-hav] [-n ] [-t ] [-k ] [--kdf ] [-i ] [-m ] [-c ] [--schann ] [--aid ] [--isoid ] [--no-auth]" }, "hf mfdes getfileisoids": { "command": "hf mfdes getfileisoids", "description": "Get File IDs list from card. Master key needs to be provided or flag --no-auth set.", "notes": [ "hf mfdes getfileisoids --aid 123456 -> execute with defaults from `default` command", "hf mfdes getfileisoids -n 0 -t des -k 0000000000000000 --kdf none --aid 123456 -> execute with default factory setup", "hf mfdes getfileisoids --isoid df01 -> get iso file ids from Desfire Light with factory card settings", "hf mfdes getfileisoids --isoid df01 --schann lrp -t aes -> get iso file ids from Desfire Light via lrp channel with default key authentication" ], "offline": false, "options": [ "-h, --help This help", "-a, --apdu Show APDU requests and responses", "-v, --verbose Verbose mode", "-n, --keyno Key number", "-t, --algo Crypt algo", "-k, --key Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)", "--kdf Key Derivation Function (KDF)", "-i, --kdfi KDF input (1-31 hex bytes)", "-m, --cmode Communicaton mode", "-c, --ccset Communicaton command set", "--schann Secure channel", "--aid Application ID (3 hex bytes, big endian)", "--isoid Application ISO ID (ISO DF ID) (2 hex bytes, big endian).", "--no-auth Execute without authentication" ], "usage": "hf mfdes getfileisoids [-hav] [-n ] [-t ] [-k ] [--kdf ] [-i ] [-m ] [-c ] [--schann ] [--aid ] [--isoid ] [--no-auth]" }, "hf mfdes getfilesettings": { "command": "hf mfdes getfilesettings", "description": "Get File Settings from file from application. Master key needs to be provided or flag --no-auth set (depend on cards settings).", "notes": [ "hf mfdes getfilesettings --aid 123456 --fid 01 -> execute with defaults from `default` command", "hf mfdes getfilesettings --isoid df01 --fid 00 --no-auth -> get file settings with select by iso id", "hf mfdes getfilesettings -n 0 -t des -k 0000000000000000 --kdf none --aid 123456 --fid 01 -> execute with default factory setup" ], "offline": false, "options": [ "-h, --help This help", "-a, --apdu Show APDU requests and responses", "-v, --verbose Verbose mode", "-n, --keyno Key number", "-t, --algo Crypt algo", "-k, --key Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)", "--kdf Key Derivation Function (KDF)", "-i, --kdfi KDF input (1-31 hex bytes)", "-m, --cmode Communicaton mode", "-c, --ccset Communicaton command set", "--schann Secure channel", "--aid Application ID (3 hex bytes, big endian)", "--isoid Application ISO ID (ISO DF ID) (2 hex bytes, big endian)", "--fid File ID (1 hex byte). (def: 1)", "--no-auth Execute without authentication" ], "usage": "hf mfdes getfilesettings [-hav] [-n ] [-t ] [-k ] [--kdf ] [-i ] [-m ] [-c ] [--schann ] [--aid ] [--isoid ] [--fid ] [--no-auth]" }, "hf mfdes getkeysettings": { "command": "hf mfdes getkeysettings", "description": "Get key settings for card level or application level.", "notes": [ "hf mfdes getkeysettings -> get picc key settings with default key/channel setup", "hf mfdes getkeysettings --aid 123456 -> get app 123456 key settings with default key/channel setup" ], "offline": false, "options": [ "-h, --help This help", "-a, --apdu Show APDU requests and responses", "-v, --verbose Verbose mode", "-n, --keyno Key number", "-t, --algo Crypt algo", "-k, --key Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)", "--kdf Key Derivation Function (KDF)", "-i, --kdfi KDF input (1-31 hex bytes)", "-m, --cmode Communicaton mode", "-c, --ccset Communicaton command set", "--schann Secure channel", "--aid Application ID (3 hex bytes, big endian)" ], "usage": "hf mfdes getkeysettings [-hav] [-n ] [-t ] [-k ] [--kdf ] [-i ] [-m ] [-c ] [--schann ] [--aid ]" }, "hf mfdes getkeyversions": { "command": "hf mfdes getkeyversions", "description": "Get key versions for card level or application level.", "notes": [ "--keynum parameter: App level: key number. PICC level: 00..0d - keys count, 21..23 vc keys, default 0x00.", "hf mfdes getkeyversions --keynum 00 -> get picc master key version with default key/channel setup", "hf mfdes getkeyversions --aid 123456 --keynum 0d -> get app 123456 all key versions with default key/channel setup", "hf mfdes getkeyversions --aid 123456 --keynum 0d --no-auth -> get key version without authentication" ], "offline": false, "options": [ "-h, --help This help", "-a, --apdu Show APDU requests and responses", "-v, --verbose Verbose mode", "-n, --keyno Key number for authentication", "-t, --algo Crypt algo", "-k, --key Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)", "--kdf Key Derivation Function (KDF)", "-i, --kdfi KDF input (1-31 hex bytes)", "-m, --cmode Communicaton mode", "-c, --ccset Communicaton command set", "--schann Secure channel", "--aid Application ID (3 hex bytes, big endian)", "--isoid Application ISO ID (ISO DF ID) (2 hex bytes, big endian).", "--keynum Key number/count (1 hex byte). (def: 0x00)", "--keyset Keyset number (1 hex byte)", "--no-auth Execute without authentication" ], "usage": "hf mfdes getkeyversions [-hav] [-n ] [-t ] [-k ] [--kdf ] [-i ] [-m ] [-c ] [--schann ] [--aid ] [--isoid ] [--keynum ] [--keyset ] [--no-auth]" }, "hf mfdes getuid": { "command": "hf mfdes getuid", "description": "Get UID from card. Get the real UID if the random UID bit is on and get the same UID as in anticollision if not. Any card's key needs to be provided.", "notes": [ "hf mfdes getuid -> execute with default factory setup", "hf mfdes getuid --isoid df01 -t aes --schan lrp -> for desfire lights default settings" ], "offline": false, "options": [ "-h, --help This help", "-a, --apdu Show APDU requests and responses", "-v, --verbose Verbose mode", "-n, --keyno Key number", "-t, --algo Crypt algo", "-k, --key Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)", "--kdf Key Derivation Function (KDF)", "-i, --kdfi KDF input (1-31 hex bytes)", "-m, --cmode Communicaton mode", "-c, --ccset Communicaton command set", "--schann Secure channel", "--aid Application ID (3 hex bytes, big endian)", "--isoid Application ISO ID (ISO DF ID) (2 hex bytes, big endian)" ], "usage": "hf mfdes getuid [-hav] [-n ] [-t ] [-k ] [--kdf ] [-i ] [-m ] [-c ] [--schann ] [--aid ] [--isoid ]" }, "hf mfdes info": { "command": "hf mfdes info", "description": "Get info from MIFARE DESfire tags", "notes": [ "hf mfdes info" ], "offline": false, "options": [ "-h, --help This help" ], "usage": "hf mfdes info [-h]" }, "hf mfdes list": { "command": "hf mfdes list", "description": "Alias of `trace list -t des -c` with selected protocol data to annotate trace buffer You can load a trace from file (see `trace load -h`) or it be downloaded from device by default It accepts all other arguments of `trace list`. Note that some might not be relevant for this specific protocol", "notes": [ "hf mfdes list --frame -> show frame delay times", "hf mfdes list -1 -> use trace buffer" ], "offline": true, "options": [ "-h, --help This help", "-1, --buffer use data from trace buffer", "--frame show frame delay times", "-c mark CRC bytes", "-r show relative times (gap and duration)", "-u display times in microseconds instead of clock cycles", "-x show hexdump to convert to pcap(ng)", "or to import into Wireshark using encapsulation type \"ISO 14443\"", "-f, --file filename of dictionary" ], "usage": "hf mfdes list [-h1crux] [--frame] [-f ]" }, "hf mfdes lsapp": { "command": "hf mfdes lsapp", "description": "Show application list. Master key needs to be provided or flag --no-auth set (depend on cards settings).", "notes": [ "hf mfdes lsapp -> show application list with defaults from `default` command", "hf mfdes lsapp --files -> show application list and show each file type/settings/etc" ], "offline": false, "options": [ "-h, --help This help", "-a, --apdu Show APDU requests and responses", "-v, --verbose Verbose mode", "-n, --keyno Key number", "-t, --algo Crypt algo", "-k, --key Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)", "--kdf Key Derivation Function (KDF)", "-i, --kdfi KDF input (1-31 hex bytes)", "-m, --cmode Communicaton mode", "-c, --ccset Communicaton command set", "--schann Secure channel", "--no-auth Execute without authentication", "--no-deep not to check authentication commands that avail for any application", "--files scan files and print file settings" ], "usage": "hf mfdes lsapp [-hav] [-n ] [-t ] [-k ] [--kdf ] [-i ] [-m ] [-c ] [--schann ] [--no-auth] [--no-deep] [--files]" }, "hf mfdes lsfiles": { "command": "hf mfdes lsfiles", "description": "This commands List files inside application AID / ISOID. Master key needs to be provided or flag --no-auth set (depend on cards settings).", "notes": [ "hf mfdes lsfiles --aid 123456 -> AID 123456, list files using `default` command creds", "hf mfdes lsfiles --isoid df01 --no-auth -> list files for DESFire light" ], "offline": false, "options": [ "-h, --help This help", "-a, --apdu Show APDU requests and responses", "-v, --verbose Verbose mode", "-n, --keyno Key number", "-t, --algo Crypt algo", "-k, --key Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)", "--kdf Key Derivation Function (KDF)", "-i, --kdfi KDF input (1-31 hex bytes)", "-m, --cmode Communicaton mode", "-c, --ccset Communicaton command set", "--schann Secure channel", "--aid Application ID (3 hex bytes, big endian)", "--isoid Application ISO ID (ISO DF ID) (2 hex bytes, big endian)", "--no-auth Execute without authentication" ], "usage": "hf mfdes lsfiles [-hav] [-n ] [-t ] [-k ] [--kdf ] [-i ] [-m ] [-c ] [--schann ] [--aid ] [--isoid ] [--no-auth]" }, "hf mfdes mad": { "command": "hf mfdes mad", "description": "Reads and prints MIFARE Application directory (MAD).", "notes": [ "MAD consists of one file with issuer info (AID ffffff) and several files with AID in the special format `faaaav` (a - MAD ID, v - multiple AID over one MAD ID)", "The MIFARE DESFire Card Master Key settings have to allow the MIFARE DESFire command GetApplicationIDs without authentication (from datasheet)", "", "hf mfdes mad -> shows MAD data", "hf mfdes mad -v -> shows MAD parsed and raw data", "hf mfdes mad -a e103 -k d3f7d3f7d3f7d3f7d3f7d3f7d3f7d3f7 -> shows MAD data with custom AID and key" ], "offline": false, "options": [ "-h, --help This help", "-a, --apdu Show APDU requests and responses", "-v, --verbose Verbose mode", "-n, --keyno Key number", "-t, --algo Crypt algo", "-k, --key Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)", "--kdf Key Derivation Function (KDF)", "-i, --kdfi KDF input (1-31 hex bytes)", "-m, --cmode Communicaton mode", "-c, --ccset Communicaton command set", "--schann Secure channel", "--aid Application ID of issuer info file, (3 hex bytes, big endian), (non-standard feature!)", "--auth Authenticate to get info from GetApplicationIDs command (non-standard feature!)" ], "usage": "hf mfdes mad [-hav] [-n ] [-t ] [-k ] [--kdf ] [-i ] [-m ] [-c ] [--schann ] [--aid ] [--auth]" }, "hf mfdes read": { "command": "hf mfdes read", "description": "Read data from file. Key needs to be provided or flag --no-auth set (depend on file settings).", "notes": [ "It reads file via all command sets.", "For ISO command set it can be read by specifying full 2-byte iso id or 1-byte short iso id (first byte of the full iso id). ISO id lays in the data in BIG ENDIAN format.", "ISO record commands: offset - record number (0-current, 1..ff-number, 1-lastest), length - if 0 - all records, if 1 - one", "", "hf mfdes read --aid 123456 --fid 01 -> read file: app=123456, file=01, offset=0, all the data. use default channel settings from `default` command", "hf mfdes read --aid 123456 --fid 01 --type record --offset 000000 --length 000001 -> read one last record from record file. use default channel settings from `default` command", "hf mfdes read --aid 123456 --fid 10 --type data -c iso -> read file via ISO channel: app=123456, short iso id=10, offset=0.", "hf mfdes read --aid 123456 --fileisoid 1000 --type data -c iso -> read file via ISO channel: app=123456, iso id=1000, offset=0. Select via native ISO wrapper", "hf mfdes read --isoid 0102 --fileisoid 1000 --type data -c iso -> read file via ISO channel: app iso id=0102, iso id=1000, offset=0. Select via ISO commands", "hf mfdes read --isoid 0102 --fileisoid 1100 --type record -c iso --offset 000005 --length 000001 -> get one record (number 5) from file 1100 via iso commands", "hf mfdes read --isoid 0102 --fileisoid 1100 --type record -c iso --offset 000005 --length 000000 -> get all record (from 5 to 1) from file 1100 via iso commands", "hf mfdes read --isoid df01 --fid 00 --schann lrp -t aes --length 000010 -> read via lrp channel", "hf mfdes read --isoid df01 --fid 00 --schann ev2 -t aes --length 000010 --isochain -> read Desfire Light via ev2 channel" ], "offline": false, "options": [ "-h, --help This help", "-a, --apdu Show APDU requests and responses", "-v, --verbose Verbose mode", "-n, --keyno Key number", "-t, --algo Crypt algo", "-k, --key Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)", "--kdf Key Derivation Function (KDF)", "-i, --kdfi KDF input (1-31 hex bytes)", "-m, --cmode Communicaton mode", "-c, --ccset Communicaton command set", "--schann Secure channel", "--aid Application ID (3 hex bytes, big endian)", "--fid File ID (1 hex byte)", "--no-auth Execute without authentication", "--type File Type, Auto - check file settings and then read. (def: auto)", "-o, --offset File Offset (3 hex bytes, big endian). For records - record number (0 - lastest record). (def: 0)", "-l, --length Length to read (3 hex bytes, big endian -> 000000 = Read all data). For records - records count (0 - all). (def: 0)", "--isoid Application ISO ID (ISO DF ID) (2 hex bytes, big endian)", "--fileisoid File ISO ID (ISO DF ID) (2 hex bytes, big endian). Works only for ISO read commands", "--isochain use iso chaining commands. Switched on by default if secure channel = lrp" ], "usage": "hf mfdes read [-hav] [-n ] [-t ] [-k ] [--kdf ] [-i ] [-m ] [-c ] [--schann ] [--aid ] [--fid ] [--no-auth] [--type ] [-o ] [-l ] [--isoid ] [--fileisoid ] [--isochain]" }, "hf mfdes selectapp": { "command": "hf mfdes selectapp", "description": "Select application on the card. It selects app if it is a valid one or returns an error.", "notes": [ "hf mfdes selectapp --aid 123456 -> select application 123456", "hf mfdes selectapp --mf -> select master file (PICC level)", "hf mfdes selectapp --dfname aid123456 -> select application aid123456 by DF name", "hf mfdes selectapp --isoid 1111 -> select application 1111 by ISO ID", "hf mfdes selectapp --isoid 1111 --fileisoid 2222 -> select application 1111 file 2222 by ISO ID", "hf mfdes selectapp --isoid 01df --fileisoid 00ef -> select file 00 on the Desfire Light" ], "offline": false, "options": [ "-h, --help This help", "-a, --apdu Show APDU requests and responses", "-v, --verbose Verbose mode", "-n, --keyno Key number", "-t, --algo Crypt algo", "-k, --key Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)", "--kdf Key Derivation Function (KDF)", "-i, --kdfi KDF input (1-31 hex bytes)", "-m, --cmode Communicaton mode", "-c, --ccset Communicaton command set", "--schann Secure channel", "--aid Application ID of application for some parameters (3 hex bytes, big endian)", "--dfname Application DF Name (string, max 16 chars). Selects application via ISO SELECT command", "--mf Select MF (master file) via ISO channel", "--isoid Application ISO ID (ISO DF ID) (2 hex bytes, big endian)", "--fileisoid Select file inside application by ISO ID (ISO DF ID) (2 hex bytes, big endian)." ], "usage": "hf mfdes selectapp [-hav] [-n ] [-t ] [-k ] [--kdf ] [-i ] [-m ] [-c ] [--schann ] [--aid ] [--dfname ] [--mf] [--isoid ] [--fileisoid ]" }, "hf mfdes setconfig": { "command": "hf mfdes setconfig", "description": "Set card configuration. WARNING! Danger zone! Needs to provide card's master key and works if not blocked by config.", "notes": [ "More about options MF2DLHX0.pdf.", "Options list:", "00h PICC configuration.", "02h ATS update.", "03h SAK update", "04h Secure Messaging Configuration.", "05h Capability data. (here change for LRP in the Desfire Light [enable 00000000010000000000])", "06h DF Name renaming (one-time)", "08h File renaming (one-time)", "09h Value file configuration (one-time)", "0Ah Failed authentication counter setting [disable 00ffffffff]", "0Bh HW configuration", "", "hf mfdes setconfig --param 03 --data 0428 -> set SAK", "hf mfdes setconfig --param 02 --data 0875778102637264 -> set ATS (first byte - length)", "hf mfdes setconfig --isoid df01 -t aes --schann ev2 --param 05 --data 00000000020000000000 -> set LRP mode enable for Desfire Light", "hf mfdes setconfig --isoid df01 -t aes --schann ev2 --param 0a --data 00ffffffff -> Disable failed auth counters for Desfire Light", "hf mfdes setconfig --isoid df01 -t aes --schann lrp --param 0a --data 00ffffffff -> Disable failed auth counters for Desfire Light via lrp" ], "offline": false, "options": [ "-h, --help This help", "-a, --apdu Show APDU requests and responses", "-v, --verbose Verbose mode", "-n, --keyno Key number", "-t, --algo Crypt algo", "-k, --key Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)", "--kdf Key Derivation Function (KDF)", "-i, --kdfi KDF input (1-31 hex bytes)", "-m, --cmode Communicaton mode", "-c, --ccset Communicaton command set", "--schann Secure channel", "--aid Application ID of application for some parameters (3 hex bytes, big endian)", "--isoid Application ISO ID (ISO DF ID) (2 hex bytes, big endian).", "-p, --param Parameter id (1 hex byte)", "-d, --data Data for parameter (1..30 hex bytes)" ], "usage": "hf mfdes setconfig [-hav] [-n ] [-t ] [-k ] [--kdf ] [-i ] [-m ] [-c ] [--schann ] [--aid ] [--isoid ] [-p ] [-d ]" }, "hf mfdes test": { "command": "hf mfdes test", "description": "Regression crypto tests", "notes": [ "hf mfdes test" ], "offline": true, "options": [ "-h, --help This help" ], "usage": "hf mfdes test [-h]" }, "hf mfdes value": { "command": "hf mfdes value", "description": "Get File Settings from file from application. Master key needs to be provided or flag --no-auth set (depend on cards settings).", "notes": [ "hf mfdes value --aid 123456 --fid 01 -> get value app=123456, file=01 with defaults from `default` command", "hf mfdes value --aid 123456 --fid 01 --op credit -d 00000001 -> credit value app=123456, file=01 with defaults from `default` command", "hf mfdes value -n 0 -t des -k 0000000000000000 --kdf none --aid 123456 --fid 01 -> get value with default factory setup", "hf mfdes val --isoid df01 --fid 03 --schann lrp -t aes -n 1 --op credit --d 00000001 -m encrypt -> credit value in the lrp encrypted mode", "hf mfdes val --isoid df01 --fid 03 --schann lrp -t aes -n 1 --op get -m plain -> get value in plain (nevertheless of mode) works for desfire light (look SetConfiguration option 0x09)" ], "offline": false, "options": [ "-h, --help This help", "-a, --apdu Show APDU requests and responses", "-v, --verbose Verbose mode", "-n, --keyno Key number", "-t, --algo Crypt algo", "-k, --key Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)", "--kdf Key Derivation Function (KDF)", "-i, --kdfi KDF input (1-31 hex bytes)", "-m, --cmode Communicaton mode", "-c, --ccset Communicaton command set", "--schann Secure channel", "--aid Application ID (3 hex bytes, big endian)", "--isoid Application ISO ID (ISO DF ID) (2 hex bytes, big endian)", "--fid File ID (1 hex byte)", "-o, --op Operation: get(default)/credit/limcredit(limited credit)/debit/clear. Operation clear: get-getopt-debit to min value", "-d, --data Value for operation (HEX 4 bytes)", "--no-auth Execute without authentication" ], "usage": "hf mfdes value [-hav] [-n ] [-t ] [-k ] [--kdf ] [-i ] [-m ] [-c ] [--schann ] [--aid ] [--isoid ] [--fid ] [-o ] [-d ] [--no-auth]" }, "hf mfdes write": { "command": "hf mfdes write", "description": "Write data from file. Key needs to be provided or flag --no-auth set (depend on file settings).", "notes": [ "In the mode with CommitReaderID to decode previous reader id command needs to read transaction counter via dump/read command and specify --trkey", "", "hf mfdes write --aid 123456 --fid 01 -d 01020304 -> AID 123456, file=01, offset=0, get file type from card. use default channel settings from `default` command", "hf mfdes write --aid 123456 --fid 01 --type data -d 01020304 --0ffset 000100 -> write data to std file with offset 0x100", "hf mfdes write --aid 123456 --fid 01 --type data -d 01020304 --commit -> write data to backup file with commit", "hf mfdes write --aid 123456 --fid 01 --type value -d 00000001 -> increment value file", "hf mfdes write --aid 123456 --fid 01 --type value -d 00000001 --debit -> decrement value file", "hf mfdes write --aid 123456 --fid 01 -d 01020304 -> write data to file with `auto` type", "hf mfdes write --aid 123456 --fid 01 --type record -d 01020304 -> write data to record file", "hf mfdes write --aid 123456 --fid 01 --type record -d 01020304 --updaterec 0 -> update record in the record file. record 0 - lastest record.", "hf mfdes write --aid 123456 --fid 01 --type record --offset 000000 -d 11223344 -> write record to record file. use default channel settings from `default` command", "hf mfdes write --isoid 1234 --fileisoid 1000 --type data -c iso -d 01020304 -> write data to std/backup file via iso commandset", "hf mfdes write --isoid 1234 --fileisoid 2000 --type record -c iso -d 01020304 -> send record to record file via iso commandset", "hf mfdes write --aid 123456 --fid 01 -d 01020304 --readerid 010203 -> write data to file with CommitReaderID command before write and CommitTransaction after write", "hf mfdes write --isoid df01 --fid 04 -d 01020304 --trkey 00112233445566778899aabbccddeeff --readerid 5532 -t aes --schann lrp -> advanced CommitReaderID via lrp channel sample" ], "offline": false, "options": [ "-h, --help This help", "-a, --apdu Show APDU requests and responses", "-v, --verbose Verbose mode", "-n, --keyno Key number", "-t, --algo Crypt algo", "-k, --key Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)", "--kdf Key Derivation Function (KDF)", "-i, --kdfi KDF input (1-31 hex bytes)", "-m, --cmode Communicaton mode", "-c, --ccset Communicaton command set", "--schann Secure channel", "--aid Application ID (3 hex bytes, big endian)", "--fid File ID (1 hex byte)", "--no-auth Execute without authentication", "--type File Type, Auto - check file settings and then write. (def: auto)", "-o, --offset File Offset (3 hex bytes, big endian). For records - record number (0 - lastest record). (def: 0)", "-d, --data data for write (data/record file), credit/debit(value file)", "--debit use for value file debit operation instead of credit", "--commit commit needs for backup file only. For the other file types and in the `auto` mode - command set it automatically", "--updaterec Record number for update record command. Updates record instead of write. Lastest record - 0", "--isoid Application ISO ID (ISO DF ID) (2 hex bytes, big endian)", "--fileisoid File ISO ID (ISO DF ID) (2 hex bytes, big endian). Works only for ISO write commands", "--readerid reader id for CommitReaderID command. If present - the command issued before write command", "--trkey key for decode previous reader id" ], "usage": "hf mfdes write [-hav] [-n ] [-t ] [-k ] [--kdf ] [-i ] [-m ] [-c ] [--schann ] [--aid ] [--fid ] [--no-auth] [--type ] [-o ] [-d ] [--debit] [--commit] [--updaterec ] [--isoid ] [--fileisoid ] [--readerid ] [--trkey ]" }, "hf mfp auth": { "command": "hf mfp auth", "description": "Executes AES authentication command for MIFARE Plus card", "notes": [ "hf mfp auth --ki 4000 --key 000102030405060708090a0b0c0d0e0f -> executes authentication", "hf mfp auth --ki 9003 --key FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF -v -> executes authentication and shows all the system data" ], "offline": false, "options": [ "-h, --help This help", "-v, --verbose Verbose mode", "--ki Key number, 2 hex bytes", "--key Key, 16 hex bytes" ], "usage": "hf mfp auth [-hv] --ki --key " }, "hf mfp chk": { "command": "hf mfp chk", "description": "Checks keys on MIFARE Plus card", "notes": [ "hf mfp chk -k 000102030405060708090a0b0c0d0e0f -> check key on sector 0 as key A and B", "hf mfp chk -s 2 -a -> check default key list on sector 2, only key A", "hf mfp chk -d mfp_default_keys -s0 -e6 -> check keys from dictionary against sectors 0-6", "hf mfp chk --pattern1b --dump -> check all 1-byte keys pattern and save found keys to file", "hf mfp chk --pattern2b --startp2b FA00 -> check all 2-byte keys pattern. Start from key FA00FA00...FA00" ], "offline": false, "options": [ "-h, --help This help", "-a, --keya Check only key A (def: check all keys)", "-b, --keyb Check only key B (def: check all keys)", "-s, --startsec <0..255> Start sector number", "-e, --endsec <0..255> End sector number", "-k, --key Key for checking (HEX 16 bytes)", "-d, --dict Dictionary file with keys", "--pattern1b Check all 1-byte combinations of key (0000...0000, 0101...0101, 0202...0202, ...)", "--pattern2b Check all 2-byte combinations of key (0000...0000, 0001...0001, 0002...0002, ...)", "--startp2b Start key (2-byte HEX) for 2-byte search (use with `--pattern2b`)", "--dump Dump found keys to JSON file", "-v, --verbose Verbose mode" ], "usage": "hf mfp chk [-habv] [-s <0..255>] [-e <0..255>] [-k ] [-d ] [--pattern1b] [--pattern2b] [--startp2b ] [--dump]" }, "hf mfp commitp": { "command": "hf mfp commitp", "description": "Executes Commit Perso command. Can be used in SL0 mode only. OBS! This command will not be executed if CardConfigKey, CardMasterKey and L3SwitchKey AES keys are not written.", "notes": [ "hf mfp commitp" ], "offline": false, "options": [ "-h, --help This help", "-v, --verbose Verbose mode" ], "usage": "hf mfp commitp [-hv]" }, "hf mfp dump": { "command": "hf mfp dump", "description": "Dump MIFARE Plus tag to file (bin/json) If no given, UID will be used as filename", "notes": [ "hf mfp dump", "hf mfp dump --keys hf-mf-066C8B78-key.bin -> MIFARE Plus with keys from specified file" ], "offline": false, "options": [ "-h, --help This help", "-f, --file Specify a filename for dump file", "-k, --keys Specify a filename for keys file", "--ns no save to file", "-v, --verbose Verbose mode" ], "usage": "hf mfp dump [-hv] [-f ] [-k ] [--ns]" }, "hf mfp info": { "command": "hf mfp info", "description": "Get info from MIFARE Plus tags", "notes": [ "hf mfp info" ], "offline": false, "options": [ "-h, --help This help" ], "usage": "hf mfp info [-h]" }, "hf mfp initp": { "command": "hf mfp initp", "description": "Executes Write Perso command for all card's keys. Can be used in SL0 mode only.", "notes": [ "hf mfp initp --key 000102030405060708090a0b0c0d0e0f -> fill all the keys with key (00..0f)", "hf mfp initp -vv -> fill all the keys with default key(0xff..0xff) and show all the data exchange" ], "offline": false, "options": [ "-h, --help This help", "-v, --verbose Verbose mode", "-k, --key Key, 16 hex bytes" ], "usage": "hf mfp initp [-hv] [-k ]" }, "hf mfp list": { "command": "hf mfp list", "description": "Alias of `trace list -t mfp -c` with selected protocol data to annotate trace buffer You can load a trace from file (see `trace load -h`) or it be downloaded from device by default It accepts all other arguments of `trace list`. Note that some might not be relevant for this specific protocol", "notes": [ "hf mfp list --frame -> show frame delay times", "hf mfp list -1 -> use trace buffer" ], "offline": true, "options": [ "-h, --help This help", "-1, --buffer use data from trace buffer", "--frame show frame delay times", "-c mark CRC bytes", "-r show relative times (gap and duration)", "-u display times in microseconds instead of clock cycles", "-x show hexdump to convert to pcap(ng)", "or to import into Wireshark using encapsulation type \"ISO 14443\"", "-f, --file filename of dictionary" ], "usage": "hf mfp list [-h1crux] [--frame] [-f ]" }, "hf mfp mad": { "command": "hf mfp mad", "description": "Checks and prints MIFARE Application Directory (MAD)", "notes": [ "hf mfp mad", "hf mfp mad --aid e103 -k d3f7d3f7d3f7d3f7d3f7d3f7d3f7d3f7 -> read and print NDEF data from MAD aid" ], "offline": false, "options": [ "-h, --help This help", "-v, --verbose Show technical data", "--aid Print all sectors with aid", "-k, --key Key for printing sectors", "-b, --keyb Use key B for access printing sectors (def: key A)", "--be (optional: BigEndian)", "--dch Decode Card Holder information" ], "usage": "hf mfp mad [-hvb] [--aid ] [-k ] [--be] [--dch]" }, "hf mfp ndefformat": { "command": "hf mfp ndefformat", "description": "format MIFARE Plus Tag as a NFC tag with Data Exchange Format (NDEF) If no given, UID will be used as filename. It will try default keys and MAD keys to detect if tag is already formatted in order to write. If not, it will try finding a key file based on your UID. ie, if you ran autopwn before", "notes": [ "hf mfp ndefformat", "hf mfp ndefformat --keys hf-mf-01020304-key.bin -> with keys from specified file" ], "offline": false, "options": [ "-h, --help This help", "-k, --keys filename of keys" ], "usage": "hf mfp ndefformat [-h] [-k ]" }, "hf mfp ndefread": { "command": "hf mfp ndefread", "description": "Prints NFC Data Exchange Format (NDEF)", "notes": [ "hf mfp ndefread", "hf mfp ndefread -vv -> shows NDEF parsed and raw data", "hf mfp ndefread --aid e103 -k d3f7d3f7d3f7d3f7d3f7d3f7d3f7d3f7 -> shows NDEF data with custom AID and key", "hf mfp ndefread -f myfilename -> save raw NDEF to file" ], "offline": false, "options": [ "-h, --help This help", "-v, --verbose show technical data", "--aid replace default aid for NDEF", "-k, --key replace default key for NDEF", "-b, --keyb use key B for access sectors (by default: key A)", "-f, --file save raw NDEF to file" ], "usage": "hf mfp ndefread [-hvb] [--aid ] [-k ] [-f ]" }, "hf mfp ndefwrite": { "command": "hf mfp ndefwrite", "description": "Write raw NDEF hex bytes to tag. This commands assumes tag already been NFC/NDEF formatted.", "notes": [ "hf mfp ndefwrite -d 0300FE -> write empty record to tag", "hf mfp ndefwrite -f myfilename", "hf mfp ndefwrite -d 033fd1023a53709101195405656e2d55534963656d616e2054776974746572206c696e6b5101195502747769747465722e636f6d2f686572726d616e6e31303031" ], "offline": false, "options": [ "-h, --help This help", "-d raw NDEF hex bytes", "-f, --file write raw NDEF file to tag", "-p fix NDEF record headers / terminator block if missing", "-v, --verbose verbose output" ], "usage": "hf mfp ndefwrite [-hpv] [-d ] [-f ]" }, "hf mfp rdbl": { "command": "hf mfp rdbl", "description": "Reads blocks from MIFARE Plus card", "notes": [ "hf mfp rdbl --blk 0 --key 000102030405060708090a0b0c0d0e0f -> executes authentication and read block 0 data", "hf mfp rdbl --blk 1 -v -> executes authentication and shows sector 1 data with default key 0xFF..0xFF" ], "offline": false, "options": [ "-h, --help This help", "-v, --verbose Verbose mode", "-n, --count Blocks count (def: 1)", "-b, --keyb Use key B (def: keyA)", "-p, --plain Plain communication mode between reader and card", "--blk <0..255> Block number", "-k, --key Key, 16 hex bytes" ], "usage": "hf mfp rdbl [-hvbp] [-n ] --blk <0..255> [-k ]" }, "hf mfp rdsc": { "command": "hf mfp rdsc", "description": "Reads one sector from MIFARE Plus card", "notes": [ "hf mfp rdsc -s 0 --key 000102030405060708090a0b0c0d0e0f -> executes authentication and read sector 0 data", "hf mfp rdsc -s 1 -v -> executes authentication and shows sector 1 data with default key" ], "offline": false, "options": [ "-h, --help This help", "-v, --verbose Verbose mode", "-b, --keyb Use key B (def: keyA)", "-p, --plain Plain communication mode between reader and card", "-s, --sn <0..255> Sector number", "-k, --key Key, 16 hex bytes" ], "usage": "hf mfp rdsc [-hvbp] -s <0..255> [-k ]" }, "hf mfp wrbl": { "command": "hf mfp wrbl", "description": "Writes one block to MIFARE Plus card", "notes": [ "hf mfp wrbl --blk 1 -d ff0000000000000000000000000000ff --key 000102030405060708090a0b0c0d0e0f -> write block 1 data", "hf mfp wrbl --blk 2 -d ff0000000000000000000000000000ff -v -> write block 2 data with default key 0xFF..0xFF" ], "offline": false, "options": [ "-h, --help This help", "-v, --verbose Verbose mode", "-b, --keyb Use key B (def: keyA)", "--blk <0..255> Block number", "-d, --data Data, 16 hex bytes", "-k, --key Key, 16 hex bytes" ], "usage": "hf mfp wrbl [-hvb] --blk <0..255> -d [-k ]" }, "hf mfp wrp": { "command": "hf mfp wrp", "description": "Executes Write Perso command. Can be used in SL0 mode only.", "notes": [ "hf mfp wrp --ki 4000 --key 000102030405060708090a0b0c0d0e0f -> write key (00..0f) to key number 4000", "hf mfp wrp --ki 4000 -> write default key(0xff..0xff) to key number 4000" ], "offline": false, "options": [ "-h, --help This help", "-v, --verbose Verbose output", "--ki Key number, 2 hex bytes", "--key Key, 16 hex bytes" ], "usage": "hf mfp wrp [-hv] --ki [--key ]" }, "hf mfu cauth": { "command": "hf mfu cauth", "description": "Tests 3DES password on Mifare Ultralight-C tag. If password is not specified, a set of known defaults will be tested.", "notes": [ "hf mfu cauth", "hf mfu cauth --key 000102030405060708090a0b0c0d0e0f" ], "offline": false, "options": [ "-h, --help This help", "--key Authentication key (UL-C 16 hex bytes)", "-l Swap entered key's endianness", "-k Keep field on (only if a password is provided)" ], "usage": "hf mfu cauth [-hlk] [--key ]" }, "hf mfu dump": { "command": "hf mfu dump", "description": "Dump MIFARE Ultralight/NTAG tag to files (bin/json) It autodetects card type.Supports: Ultralight, Ultralight-C, Ultralight EV1 NTAG 203, NTAG 210, NTAG 212, NTAG 213, NTAG 215, NTAG 216", "notes": [ "hf mfu dump -f myfile", "hf mfu dump -k AABBCCDD -> dump whole tag using pwd AABBCCDD", "hf mfu dump -p 10 -> start at page 10 and dump rest of blocks", "hf mfu dump -p 10 -q 2 -> start at page 10 and dump two blocks", "hf mfu dump --key 00112233445566778899AABBCCDDEEFF" ], "offline": false, "options": [ "-h, --help This help", "-f, --file Specify a filename for dump file", "-k, --key Key for authentication (UL-C 16 bytes, EV1/NTAG 4 bytes)", "-l Swap entered key's endianness", "-p, --page Manually set start page number to start from", "-q, --qty Manually set number of pages to dump", "--ns no save to file" ], "usage": "hf mfu dump [-hl] [-f ] [-k ] [-p ] [-q ] [--ns]" }, "hf mfu eload": { "command": "hf mfu eload", "description": "Load emulator memory with data from (bin/eml/json) dump file", "notes": [ "hf mfu eload -f hf-mfu-04010203040506.bin", "hf mfu eload -f hf-mfu-04010203040506.bin -q 57 -> load 57 blocks from myfile" ], "offline": false, "options": [ "-h, --help This help", "-f, --file Specify a filename for dump file", "-q, --qty Number of blocks to load from eml file", "-v, --verbose verbose output" ], "usage": "hf mfu eload [-hv] -f [-q ]" }, "hf mfu esave": { "command": "hf mfu esave", "description": "Saves emulator memory to a MIFARE Ultralight/NTAG dump file (bin/json) By default number of pages saved depends on defined tag type. You can override this with option --end.", "notes": [ "hf mfu esave", "hf mfu esave --end 255 -> saves whole memory", "hf mfu esave -f hf-mfu-04010203040506-dump" ], "offline": false, "options": [ "-h, --help This help", "-e, --end index of last block", "-f, --file Specify a filename for dump file" ], "usage": "hf mfu esave [-h] [-e ] [-f ]" }, "hf mfu eview": { "command": "hf mfu eview", "description": "Displays emulator memory By default number of pages shown depends on defined tag type. You can override this with option --end.", "notes": [ "hf mfu eview", "hf mfu eview --end 255 -> dumps whole memory" ], "offline": false, "options": [ "-h, --help This help", "-e, --end index of last block" ], "usage": "hf mfu eview [-h] [-e ]" }, "hf mfu info": { "command": "hf mfu info", "description": "Get info about MIFARE Ultralight Family styled tag. Sometimes the tags are locked down, and you may need a key to be able to read the information", "notes": [ "hf mfu info", "hf mfu info -k AABBCCDD", "hf mfu info --key 00112233445566778899AABBCCDDEEFF" ], "offline": false, "options": [ "-h, --help This help", "-k, --key Authentication key (UL-C 16 bytes, EV1/NTAG 4 bytes)", "-l Swap entered key's endianness" ], "usage": "hf mfu info [-hl] [-k ]" }, "hf mfu keygen": { "command": "hf mfu keygen", "description": "Set the 3DES key on MIFARE Ultralight-C tag.", "notes": [ "hf mfu keygen -r", "hf mfu keygen --uid 11223344556677" ], "offline": true, "options": [ "-h, --help This help", "-u, --uid <4|7> hex byte UID", "-r Read UID from tag" ], "usage": "hf mfu keygen [-hr] [-u ]" }, "hf mfu list": { "command": "hf mfu list", "description": "Alias of `trace list -t 14a -c` with selected protocol data to annotate trace buffer You can load a trace from file (see `trace load -h`) or it be downloaded from device by default It accepts all other arguments of `trace list`. Note that some might not be relevant for this specific protocol", "notes": [ "hf 14a list --frame -> show frame delay times", "hf 14a list -1 -> use trace buffer" ], "offline": true, "options": [ "-h, --help This help", "-1, --buffer use data from trace buffer", "--frame show frame delay times", "-c mark CRC bytes", "-r show relative times (gap and duration)", "-u display times in microseconds instead of clock cycles", "-x show hexdump to convert to pcap(ng)", "or to import into Wireshark using encapsulation type \"ISO 14443\"", "-f, --file filename of dictionary" ], "usage": "hf 14a list [-h1crux] [--frame] [-f ]" }, "hf mfu ndefread": { "command": "hf mfu ndefread", "description": "Prints NFC Data Exchange Format (NDEF)", "notes": [ "hf mfu ndefread -> shows NDEF data", "hf mfu ndefread -k ffffffff -> shows NDEF data with key", "hf mfu ndefread -f myfilename -> save raw NDEF to file" ], "offline": false, "options": [ "-h, --help This help", "-l Swap entered key's endianness", "-f, --file Save raw NDEF to file", "-v, --verbose show technical data" ], "usage": "hf mfu ndefread [-hlv] [-k Replace default key for NDEF] [-f ]" }, "hf mfu otptear": { "command": "hf mfu otptear", "description": "Tear-off test against OTP block", "notes": [ "hf mfu otptear -b 3", "hf mfu otptear -b 3 -i 100 -s 1000", "hf mfu otptear -b 3 -i 1 -e 200", "hf mfu otptear -b 3 -i 100 -s 200 -e 2500 -d FFFFFFFF -t EEEEEEEE", "hf mfu otptear -b 3 -i 100 -s 200 -e 2500 -d FFFFFFFF -t EEEEEEEE -m 00000000 -> quit when OTP is reset" ], "offline": false, "options": [ "-h, --help This help", "-b, --blk target block (def 8)", "-i, --inc increase time steps (def 500 us)", "-e, --end end time (def 3000 us)", "-s, --start start time (def 0 us)", "-d, --data initialise data before run (4 bytes)", "-t, --test test write data (4 bytes, 00000000 by default)", "-m, --match exit criteria, if block matches this value (4 bytes)" ], "usage": "hf mfu otptear [-h] [-b ] [-i ] [-e ] [-s ] [-d ] [-t ] [-m ]" }, "hf mfu pwdgen": { "command": "hf mfu pwdgen", "description": "Generate different passwords from known pwdgen algos", "notes": [ "hf mfu pwdgen -r", "hf mfu pwdgen -t", "hf mfu pwdgen --uid 11223344556677" ], "offline": true, "options": [ "-h, --help This help", "-u, --uid UID (7 hex bytes)", "-r Read UID from tag", "-t Selftest" ], "usage": "hf mfu pwdgen [-hrt] [-u ]" }, "hf mfu rdbl": { "command": "hf mfu rdbl", "description": "Read a block and print. It autodetects card type.", "notes": [ "hf mfu rdbl -b 0", "hf mfu rdbl -b 0 -k AABBCCDD", "hf mfu rdbl -b 0 --key 00112233445566778899AABBCCDDEEFF" ], "offline": false, "options": [ "-h, --help This help", "-k, --key Authentication key (UL-C 16 bytes, EV1/NTAG 4 bytes)", "-l Swap entered key's endianness", "-b, --block Nlock number to read", "--force Force operation even if address is out of range" ], "usage": "hf mfu rdbl [-hl] [-k ] -b [--force]" }, "hf mfu restore": { "command": "hf mfu restore", "description": "Restore MIFARE Ultralight/NTAG dump file (bin/eml/json) to tag.", "notes": [ "hf mfu restore -f myfile -s -> special write", "hf mfu restore -f myfile -k AABBCCDD -s -> special write, use key", "hf mfu restore -f myfile -k AABBCCDD -ser -> special write, use key, write dump pwd, ..." ], "offline": false, "options": [ "-h, --help This help", "-f, --file Specify a filename for dump file", "-k, --key key for authentication (UL-C 16 bytes, EV1/NTAG 4 bytes)", "-l swap entered key's endianness", "-s enable special write UID -MAGIC TAG ONLY-", "-e enable special write version/signature -MAGIC NTAG 21* ONLY-", "-r use password found in dumpfile to configure tag. Requires '-e' parameter to work", "-v, --verbose verbose" ], "usage": "hf mfu restore [-hlserv] -f [-k ]" }, "hf mfu setpwd": { "command": "hf mfu setpwd", "description": "Set the 3DES key on MIFARE Ultralight-C tag.", "notes": [ "hf mfu setpwd --key 000102030405060708090a0b0c0d0e0f" ], "offline": false, "options": [ "-h, --help This help", "-k, --key New key (16 hex bytes)" ], "usage": "hf mfu setpwd [-h] [-k ]" }, "hf mfu setuid": { "command": "hf mfu setuid", "description": "Set UID on MIFARE Ultralight tag. This only works for `magic Ultralight` tags.", "notes": [ "hf mfu setuid --uid 11223344556677" ], "offline": false, "options": [ "-h, --help This help", "-u, --uid New UID (7 hex bytes)" ], "usage": "hf mfu setuid [-h] [-u ]" }, "hf mfu sim": { "command": "hf mfu sim", "description": "Simulate MIFARE Ultralight family type based upon ISO/IEC 14443 type A tag with 4,7 or 10 byte UID from emulator memory. See `hf mfu eload` first. The UID from emulator memory will be used if not specified. See `hf 14a sim -h` to see available types. You want 2 or 7 usually.", "notes": [ "hf mfu sim -t 2 --uid 11223344556677 -> MIFARE Ultralight", "hf mfu sim -t 7 --uid 11223344556677 -n 5 -> MFU EV1 / NTAG 215 Amiibo", "hf mfu sim -t 7 -> MFU EV1 / NTAG 215 Amiibo" ], "offline": false, "options": [ "-h, --help This help", "-t, --type <1..12> Simulation type to use", "-u, --uid <4|7|10> hex bytes UID", "-n, --num Exit simulation after blocks. 0 = infinite", "-v, --verbose Verbose output" ], "usage": "hf mfu sim [-hv] -t <1..12> [-u ] [-n ]" }, "hf mfu tamper": { "command": "hf mfu tamper", "description": "Set the configuration of the NTAG 213TT tamper feature Supports: NTAG 213TT", "notes": [ "hf mfu tamper -e -> enable tamper feature", "hf mfu tamper -d -> disable tamper feature", "hf mfu tamper -m 0A0A0A0A -> set the tamper message to 0A0A0A0A", "hf mfu tamper --lockmessage -> permanently lock the tamper message and mask it from memory" ], "offline": false, "options": [ "-h, --help This help", "-e, --enable Enable the tamper feature", "-d, --disable Disable the tamper feature", "-m, --message Set the tamper message (4 bytes)", "--lockmessage Permanently lock the tamper message and mask it from memory (does not lock tamper feature itself)" ], "usage": "hf mfu tamper [-hed] [-m ] [--lockmessage]" }, "hf mfu view": { "command": "hf mfu view", "description": "Print a MIFARE Ultralight/NTAG dump file (bin/eml/json)", "notes": [ "hf mfu view -f hf-mfu-01020304-dump.bin" ], "offline": true, "options": [ "-h, --help This help", "-f, --file Specify a filename for dump file", "-v, --verbose Verbose output" ], "usage": "hf mfu view [-hv] -f " }, "hf mfu wrbl": { "command": "hf mfu wrbl", "description": "Write a block. It autodetects card type.", "notes": [ "hf mfu wrbl -b 0 -d 01234567", "hf mfu wrbl -b 0 -d 01234567 -k AABBCCDD", "hf mfu wrbl -b 0 -d 01234567 -k 00112233445566778899AABBCCDDEEFF" ], "offline": false, "options": [ "-h, --help This help", "-k, --key Authentication key (UL-C 16 bytes, EV1/NTAG 4 bytes)", "-l Swap entered key's endianness", "-b, --block Block number to write", "-d, --data Block data (4 or 16 hex bytes, 16 hex bytes will do a compatibility write)", "--force Force operation even if address is out of range" ], "usage": "hf mfu wrbl [-hl] [-k ] -b -d [--force]" }, "hf ntag424 info": { "command": "hf ntag424 info", "description": "Get info about NXP NTAG424 DNA Family styled tag.", "notes": [ "hf ntag424 info" ], "offline": false, "options": [ "-h, --help This help" ], "usage": "hf ntag424 info [-h]" }, "hf ntag424 sdm": { "command": "hf ntag424 sdm", "description": "Validate a SDM message", "notes": [ "hf ntag424 sdm" ], "offline": false, "options": [ "-h, --help This help" ], "usage": "hf ntag424 sdm [-h]" }, "hf ntag424 view": { "command": "hf ntag424 view", "description": "Print a NTAG 424 DNA dump file (bin/eml/json)", "notes": [ "hf ntag424 view -f hf-ntag424-01020304-dump.bin" ], "offline": true, "options": [ "-h, --help This help", "-f, --file Specify a filename for dump file", "-v, --verbose Verbose output" ], "usage": "hf ntag424 view [-hv] -f " }, "hf plot": { "command": "hf plot", "description": "Plots HF signal after RF signal path and A/D conversion.", "notes": [ "This can be used after any hf command and will show the last few milliseconds of the HF signal.", "Note: If the last hf command terminated because of a timeout you will most probably see nothing." ], "offline": false, "options": [ "-h, --help This help" ], "usage": "hf plot [-h]" }, "hf search": { "command": "hf search", "description": "Will try to find a HF read out of the unknown tag. Continues to search for all different HF protocols.", "notes": [ "hf search" ], "offline": true, "options": [ "-h, --help This help", "-v, --verbose verbose output" ], "usage": "hf search [-hv]" }, "hf seos info": { "command": "hf seos info", "description": "Get info from SEOS tags", "notes": [ "hf seos info" ], "offline": false, "options": [ "-h, --help This help" ], "usage": "hf seos info [-h]" }, "hf seos list": { "command": "hf seos list", "description": "Alias of `trace list -t 7816` with selected protocol data to annotate trace buffer You can load a trace from file (see `trace load -h`) or it be downloaded from device by default It accepts all other arguments of `trace list`. Note that some might not be relevant for this specific protocol", "notes": [ "hf seos list --frame -> show frame delay times", "hf seos list -1 -> use trace buffer" ], "offline": true, "options": [ "-h, --help This help", "-1, --buffer use data from trace buffer", "--frame show frame delay times", "-c mark CRC bytes", "-r show relative times (gap and duration)", "-u display times in microseconds instead of clock cycles", "-x show hexdump to convert to pcap(ng)", "or to import into Wireshark using encapsulation type \"ISO 14443\"", "-f, --file filename of dictionary" ], "usage": "hf seos list [-h1crux] [--frame] [-f ]" }, "hf sniff": { "command": "hf sniff", "description": "The high frequency sniffer will assign all available memory on device for sniffed data. Use `data samples` to download from device and `data plot` to visualize it. Press button to quit the sniffing.", "notes": [ "hf sniff", "hf sniff --sp 1000 --st 0 -> skip 1000 pairs, skip 0 triggers" ], "offline": false, "options": [ "-h, --help This help", "--sp skip sample pairs", "--st skip number of triggers", "--smode [none|drop|min|max|avg] Skip mode. It switches on the function that applies to several samples before they saved to memory", "--sratio Skip ratio. It applied the function above to (ratio * 2) samples. For ratio = 1 it 2 samples." ], "usage": "hf sniff [-h] [--sp ] [--st ] [--smode [none|drop|min|max|avg]] [--sratio ]" }, "hf st25ta info": { "command": "hf st25ta info", "description": "Get info about ST25TA tag", "notes": [ "hf st25ta info" ], "offline": false, "options": [ "-h, --help This help" ], "usage": "hf st25ta info [-h]" }, "hf st25ta list": { "command": "hf st25ta list", "description": "Alias of `trace list -t 7816` with selected protocol data to annotate trace buffer You can load a trace from file (see `trace load -h`) or it be downloaded from device by default It accepts all other arguments of `trace list`. Note that some might not be relevant for this specific protocol", "notes": [ "hf st25ta list --frame -> show frame delay times", "hf st25ta list -1 -> use trace buffer" ], "offline": true, "options": [ "-h, --help This help", "-1, --buffer use data from trace buffer", "--frame show frame delay times", "-c mark CRC bytes", "-r show relative times (gap and duration)", "-u display times in microseconds instead of clock cycles", "-x show hexdump to convert to pcap(ng)", "or to import into Wireshark using encapsulation type \"ISO 14443\"", "-f, --file filename of dictionary" ], "usage": "hf st25ta list [-h1crux] [--frame] [-f ]" }, "hf st25ta ndefread": { "command": "hf st25ta ndefread", "description": "Read NFC Data Exchange Format (NDEF) file on ST25TA", "notes": [ "hf st25ta ndefread -p 82E80053D4CA5C0B656D852CC696C8A1", "hf st25ta ndefread -f myfilename -> save raw NDEF to file" ], "offline": true, "options": [ "-h, --help This help", "-p, --pwd 16 byte read password", "-f, --file save raw NDEF to file", "-v, --verbose show technical data" ], "usage": "hf st25ta ndefread [-hv] [-p ] [-f ]" }, "hf st25ta protect": { "command": "hf st25ta protect", "description": "Change read or write protection for NFC Data Exchange Format (NDEF) file on ST25TA", "notes": [ "hf st25ta protect -p 82E80053D4CA5C0B656D852CC696C8A1 -r -e -> enable read protection", "hf st25ta protect -p 82E80053D4CA5C0B656D852CC696C8A1 -w -d -> disable write protection" ], "offline": false, "options": [ "-h, --help This help", "-e, --enable enable protection", "-d, --disable disable protection (default)", "-r, --read change read protection", "-w, --write change write protection (default)", "-p, --password 16 byte write password" ], "usage": "hf st25ta protect [-hedrw] -p " }, "hf st25ta pwd": { "command": "hf st25ta pwd", "description": "Change read or write password for NFC Data Exchange Format (NDEF) file on ST25TA", "notes": [ "hf st25ta pwd -p 82E80053D4CA5C0B656D852CC696C8A1 -r -n 00000000000000000000000000000000 -> change read password", "hf st25ta pwd -p 82E80053D4CA5C0B656D852CC696C8A1 -w -n 00000000000000000000000000000000 -> change write password" ], "offline": false, "options": [ "-h, --help This help", "-r, --read change the read password (default)", "-w, --write change the write password", "-p, --password current 16 byte write password", "-n, --new new 16 byte password" ], "usage": "hf st25ta pwd [-hrw] -p -n " }, "hf st25ta sim": { "command": "hf st25ta sim", "description": "Emulating ST25TA512B tag with 7 byte UID", "notes": [ "hf st25ta sim -u 02E2007D0FCA4C" ], "offline": false, "options": [ "-h, --help This help", "-u, --uid 7 byte UID" ], "usage": "hf st25ta sim [-h] -u " }, "hf tesla info": { "command": "hf tesla info", "description": "Get info about TESLA Key tag", "notes": [ "hf tesla info" ], "offline": false, "options": [ "-h, --help This help" ], "usage": "hf telsa info [-h]" }, "hf tesla list": { "command": "hf tesla list", "description": "Alias of `trace list -t 7816` with selected protocol data to annotate trace buffer You can load a trace from file (see `trace load -h`) or it be downloaded from device by default It accepts all other arguments of `trace list`. Note that some might not be relevant for this specific protocol", "notes": [ "hf tesla list --frame -> show frame delay times", "hf tesla list -1 -> use trace buffer" ], "offline": true, "options": [ "-h, --help This help", "-1, --buffer use data from trace buffer", "--frame show frame delay times", "-c mark CRC bytes", "-r show relative times (gap and duration)", "-u display times in microseconds instead of clock cycles", "-x show hexdump to convert to pcap(ng)", "or to import into Wireshark using encapsulation type \"ISO 14443\"", "-f, --file filename of dictionary" ], "usage": "hf tesla list [-h1crux] [--frame] [-f ]" }, "hf texkom reader": { "command": "hf texkom reader", "description": "Read a texkom tag", "notes": [ "hf texkom reader", "hf texkom reader -@ -> continuous reader mode" ], "offline": false, "options": [ "-h, --help This help", "-1 Use data from Graphbuffer", "-v, --verbose Verbose scan and output", "-@ optional - continuous reader mode" ], "usage": "hf texkom reader [-h1v@]" }, "hf texkom sim": { "command": "hf texkom sim", "description": "Simulate a texkom tag", "notes": [ "hf texkom sim", "hf texkom sim --raw FFFF638C7DC45553 -> simulate TK13 tag with id 8C7DC455", "hf texkom sim --tk17 --raw FFFFCA17F31EC512 -> simulate TK17 tag with id 17F31EC5", "hf texkom sim --id 8C7DC455 -> simulate TK13 tag with id 8C7DC455", "hf texkom sim --id 8C7DC455 --tk17 -> simulate TK17 tag with id 17F31EC5" ], "offline": false, "options": [ "-h, --help This help", "-v, --verbose Verbose work", "-t, --tk17 Use TK-17 modulation (TK-13 by default)", "--raw Raw data for texkom card, 8 bytes. Manual modulation select.", "--id Raw data for texkom card, 8 bytes. Manual modulation select.", "--timeout Simulation timeout in the ms. If not specified or 0 - infinite. Command can be skipped by pressing the button" ], "usage": "hf texkom sim [-hvt] [--raw ] [--id ] [--timeout ]" }, "hf thinfilm info": { "command": "hf thinfilm info", "description": "Get info from Thinfilm tags", "notes": [ "hf thinfilm info" ], "offline": false, "options": [ "-h, --help This help" ], "usage": "hf thinfilm info [-h]" }, "hf thinfilm list": { "command": "hf thinfilm list", "description": "Alias of `trace list -t thinfilm` with selected protocol data to annotate trace buffer You can load a trace from file (see `trace load -h`) or it be downloaded from device by default It accepts all other arguments of `trace list`. Note that some might not be relevant for this specific protocol", "notes": [ "hf thinfilm list --frame -> show frame delay times", "hf thinfilm list -1 -> use trace buffer" ], "offline": true, "options": [ "-h, --help This help", "-1, --buffer use data from trace buffer", "--frame show frame delay times", "-c mark CRC bytes", "-r show relative times (gap and duration)", "-u display times in microseconds instead of clock cycles", "-x show hexdump to convert to pcap(ng)", "or to import into Wireshark using encapsulation type \"ISO 14443\"", "-f, --file filename of dictionary" ], "usage": "hf thinfilm list [-h1crux] [--frame] [-f ]" }, "hf thinfilm sim": { "command": "hf thinfilm sim", "description": "Simulate Thinfilm tag", "notes": [ "hf thinfilm sim -d B70470726f786d61726b2e636f6d" ], "offline": false, "options": [ "-h, --help This help", "-d, --data bytes to send", "--raw raw, provided bytes should include CRC" ], "usage": "hf thinfilm sim [-h] -d [--raw]" }, "hf topaz dump": { "command": "hf topaz dump", "description": "Dump TOPAZ tag to file (bin/json) If no given, UID will be used as filename", "notes": [ "hf topaz dump" ], "offline": false, "options": [ "-h, --help This help", "-f, --file Specify a filename for dump file", "--ns no save to file" ], "usage": "hf topaz dump [-h] [-f ] [--ns]" }, "hf topaz info": { "command": "hf topaz info", "description": "Get info from Topaz tags", "notes": [ "hf topaz info", "hf topaz info -f myfilename -> save raw NDEF to file" ], "offline": false, "options": [ "-h, --help This help", "-f, --file save raw NDEF to file", "-v, --verbose verbose output" ], "usage": "hf topaz info [-hv] [-f ]" }, "hf topaz list": { "command": "hf topaz list", "description": "Alias of `trace list -t topaz -c` with selected protocol data to annotate trace buffer You can load a trace from file (see `trace load -h`) or it be downloaded from device by default It accepts all other arguments of `trace list`. Note that some might not be relevant for this specific protocol", "notes": [ "hf topaz list --frame -> show frame delay times", "hf topaz list -1 -> use trace buffer" ], "offline": true, "options": [ "-h, --help This help", "-1, --buffer use data from trace buffer", "--frame show frame delay times", "-c mark CRC bytes", "-r show relative times (gap and duration)", "-u display times in microseconds instead of clock cycles", "-x show hexdump to convert to pcap(ng)", "or to import into Wireshark using encapsulation type \"ISO 14443\"", "-f, --file filename of dictionary" ], "usage": "hf topaz list [-h1crux] [--frame] [-f ]" }, "hf topaz raw": { "command": "hf topaz raw", "description": "Send raw hex data to Topaz tags", "notes": [ "hf topaz raw" ], "offline": false, "options": [ "-h, --help This help" ], "usage": "hf topaz raw [-h]" }, "hf topaz rdbl": { "command": "hf topaz rdbl", "description": "Read Topaz block", "notes": [ "hf topaz rdbl --blk 7" ], "offline": false, "options": [ "-h, --help This help", "--blk Block number" ], "usage": "hf topaz rdbl [-h] --blk " }, "hf topaz reader": { "command": "hf topaz reader", "description": "Read UID from Topaz tags", "notes": [ "hf topaz reader", "hf topaz reader -@ -> Continuous mode" ], "offline": false, "options": [ "-h, --help This help", "-v, --verbose verbose output", "-@ optional - continuous reader mode" ], "usage": "hf topaz reader [-hv@]" }, "hf topaz sim": { "command": "hf topaz sim", "description": "Simulate a Topaz tag", "notes": [ "hf topaz sim -> Not yet implemented" ], "offline": false, "options": [ "-h, --help This help" ], "usage": "hf topaz sim [-h]" }, "hf topaz sniff": { "command": "hf topaz sniff", "description": "Sniff Topaz reader-tag communication", "notes": [ "hf topaz sniff" ], "offline": false, "options": [ "-h, --help This help" ], "usage": "hf topaz sniff [-h]" }, "hf topaz view": { "command": "hf topaz view", "description": "Print a Topaz tag dump file (bin/eml/json)", "notes": [ "hf topaz view -f hf-topaz-04010203-dump.bin" ], "offline": true, "options": [ "-h, --help This help", "-f, --file Specify a filename for dump file" ], "usage": "hf topaz view [-h] -f " }, "hf topaz wrbl": { "command": "hf topaz wrbl", "description": "Write Topaz block with 8 hex bytes of data", "notes": [ "hf topaz wrbl --blk 7 -d 1122334455667788" ], "offline": false, "options": [ "-h, --help This help", "--blk Block number", "-d, --data Block data (8 hex bytes)" ], "usage": "hf topaz wrbl [-h] --blk -d " }, "hf tune": { "command": "hf tune", "description": "Continuously measure HF antenna tuning. Press button or to interrupt.", "notes": [ "hf tune", "hf tune --mix" ], "offline": false, "options": [ "-h, --help This help", "-n, --iter number of iterations (default: 0=infinite)", "--bar bar style", "--mix mixed style", "--value values style" ], "usage": "hf tune [-h] [-n ] [--bar] [--mix] [--value]" }, "hf vas decrypt": { "command": "hf vas decrypt", "description": "Decrypt a previously captured cryptogram", "notes": [ "hf vas decrypt --pid pass.com.passkit.pksamples.nfcdemo -f vas_privkey.der -d c0b77375eae416b79449347f9fe838c05cdb57dc7470b97b93b806cb348771d9bfbe29d58538c7c7d7c3d015fa205b68bfccd726058a62f7f44085ac98dbf877120fd9059f1507b956e0a6d56d0a" ], "offline": true, "options": [ "-h, --help This help", "--pid PID, pass type id", "-f, --file path to terminal private key file", "-d, --data cryptogram to decrypt" ], "usage": "hf vas decrypt [-h] [--pid ] [-f ] [-d ]" }, "hf vas reader": { "command": "hf vas reader", "description": "Read and decrypt Value Added Services (VAS) message", "notes": [ "hf vas reader --url https://example.com -> URL Only mode", "hf vas reader --pid pass.com.passkit.pksamples.nfcdemo -f vas_privkey.der -@" ], "offline": false, "options": [ "-h, --help This help", "--pid PID, pass type id", "-f, --file path to terminal private key file", "--url a URL to provide to the mobile device", "-@ continuous mode", "-v, --verbose log additional information" ], "usage": "hf vas reader [-h@v] [--pid ] [-f ] [--url ]" }, "hf waveshare loadbmp": { "command": "hf waveshare loadbmp", "description": "Load BMP file to Waveshare NFC ePaper.", "notes": [ "hf waveshare loadbmp -f myfile -m 0 -> 2.13 inch e-paper ( 122, 250 )", "hf waveshare loadbmp -f myfile -m 1 -> 2.9 inch e-paper ( 296, 128 )", "hf waveshare loadbmp -f myfile -m 2 -> 4.2 inch e-paper ( 400, 300 )", "hf waveshare loadbmp -f myfile -m 3 -> 7.5 inch e-paper ( 800, 480 )", "hf waveshare loadbmp -f myfile -m 4 -> 2.7 inch e-paper ( 176, 276 )", "hf waveshare loadbmp -f myfile -m 5 -> 2.13 inch e-paper B (with red) ( 104, 212 )", "hf waveshare loadbmp -f myfile -m 6 -> 1.54 inch e-paper B (with red) ( 200, 200 )", "hf waveshare loadbmp -f myfile -m 7 -> 7.5 inch e-paper HD ( 880, 528 )" ], "offline": false, "options": [ "-h, --help This help", "-m model number [0 - 7] of your tag", "-s, --save save dithered version in filename-[n].bmp, only for RGB BMP", "-f, --file specify filename[.bmp] to upload to tag" ], "usage": "hf waveshare loadbmp [-hs] -m -f " }, "hf xerox dump": { "command": "hf xerox dump", "description": "Dump all memory from a Fuji/Xerox tag", "notes": [ "hf xerox dump" ], "offline": false, "options": [ "-h, --help This help", "-f, --file filename to save dump to", "-d, --decrypt decrypt secret blocks" ], "usage": "hf xerox dump [-hd] [-f ]" }, "hf xerox info": { "command": "hf xerox info", "description": "Tag information for ISO/IEC 14443 type B / XEROX based tags", "notes": [ "hf xerox info" ], "offline": false, "options": [ "-h, --help This help", "-v, --verbose verbose output" ], "usage": "hf xerox info [-hv]" }, "hf xerox reader": { "command": "hf xerox reader", "description": "Act as a 14443B reader to identify a tag", "notes": [ "hf xerox reader", "hf xerox reader -@" ], "offline": false, "options": [ "-h, --help This help", "-v, --verbose verbose output", "-@ optional - continuous reader mode" ], "usage": "hf xerox reader [-hv@]" }, "hints": { "command": "hints", "description": "Turn on/off hints", "notes": [ "hints --on", "hints -1" ], "offline": true, "options": [ "-h, --help This help", "-1, --on turn on hints", "-0, --off turn off hints" ], "usage": "hints [-h10]" }, "hw break": { "command": "hw break", "description": "send break loop package", "notes": [ "hw break" ], "offline": false, "options": [ "-h, --help This help" ], "usage": "hw break [-h]" }, "hw connect": { "command": "hw connect", "description": "Connects to a Proxmark3 device via specified serial port. Baudrate here is only for physical UART or UART-BT, NOT for USB-CDC or blue shark add-on", "notes": [ "hw connect -p /dev/ttyACM0", "hw connect -p /dev/ttyACM0 -b 115200" ], "offline": true, "options": [ "-h, --help This help", "-p, --port Serial port to connect to, else retry the last used one", "-b, --baud Baudrate" ], "usage": "hw connect [-h] [-p ] [-b ]" }, "hw dbg": { "command": "hw dbg", "description": "Set device side debug level output. Note: option `-4`, this option may cause malfunction itself by introducing delays in time critical functions like simulation or sniffing", "notes": [ "hw dbg -> get current log level", "hw dbg -1 -> set log level to _error_" ], "offline": false, "options": [ "-h, --help This help", "-0 no debug messages", "-1 error messages", "-2 plus information messages", "-3 plus debug messages", "-4 print even debug messages in timing critical functions" ], "usage": "hw dbg [-h01234]" }, "hw detectreader": { "command": "hw detectreader", "description": "Start to detect presences of reader field", "notes": [ "hw detectreader -L" ], "offline": false, "options": [ "-h, --help This help", "-L, --LF detect low frequency 125/134 kHz", "-H, --HF detect high frequency 13.56 MHZ" ], "usage": "hw detectreader [-hLH]" }, "hw fpgaoff": { "command": "hw fpgaoff", "description": "Turn of fpga and antenna field", "notes": [ "hw fpgaoff" ], "offline": false, "options": [ "-h, --help This help" ], "usage": "hw fpgaoff [-h]" }, "hw lcd": { "command": "hw lcd", "description": "Send command/data to LCD", "notes": [ "hw lcd -r AA -c 03 -> sends 0xAA three times" ], "offline": false, "options": [ "-h, --help This help", "-r, --raw data", "-c, --cnt number of times to send" ], "usage": "hw lcd [-h] -r -c " }, "hw lcdreset": { "command": "hw lcdreset", "description": "Hardware reset LCD", "notes": [ "hw lcdreset" ], "offline": false, "options": [ "-h, --help This help" ], "usage": "hw lcdreset [-h]" }, "hw ping": { "command": "hw ping", "description": "Test if the Proxmark3 is responsive", "notes": [ "hw ping", "hw ping --len 32" ], "offline": false, "options": [ "-h, --help This help", "-l, --len length of payload to send" ], "usage": "hw ping [-h] [-l ]" }, "hw readmem": { "command": "hw readmem", "description": "Read memory at decimal address from ARM chip flash.", "notes": [ "hw readmem -a 10000" ], "offline": false, "options": [ "-h, --help This help", "-a, --adr address to read" ], "usage": "hw readmem [-h] -a " }, "hw reset": { "command": "hw reset", "description": "Reset the Proxmark3 device.", "notes": [ "hw reset" ], "offline": false, "options": [ "-h, --help This help" ], "usage": "hw reset [-h]" }, "hw setlfdivisor": { "command": "hw setlfdivisor", "description": "Drive LF antenna at 12 MHz / (divisor + 1).", "notes": [ "hw setlfdivisor -d 88" ], "offline": false, "options": [ "-h, --help This help", "-d, --div 19 - 255 divisor value (def 95)" ], "usage": "hw setlfdivisor [-h] -d " }, "hw setmux": { "command": "hw setmux", "description": "Set the ADC mux to a specific value", "notes": [ "hw setmux --hipkd -> set HIGH PEAK" ], "offline": false, "options": [ "-h, --help This help", "--lopkd low peak", "--loraw low raw", "--hipkd high peak", "--hiraw high raw" ], "usage": "hw setmux [-h] [--lopkd] [--loraw] [--hipkd] [--hiraw]" }, "hw standalone": { "command": "hw standalone", "description": "Start standalone mode", "notes": [ "hw standalone -> start", "hw standalone -a 1 -> start and send arg 1" ], "offline": false, "options": [ "-h, --help This help", "-a, --arg argument byte" ], "usage": "hw standalone [-h] [-a ]" }, "hw status": { "command": "hw status", "description": "Show runtime status information about the connected Proxmark3", "notes": [ "hw status" ], "offline": false, "options": [ "-h, --help This help" ], "usage": "hw status [-h]" }, "hw tearoff": { "command": "hw tearoff", "description": "Configure a tear-off hook for the next write command supporting tear-off After having been triggered by a write command, the tear-off hook is deactivated Delay (in us) must be between 1 and 43000 (43ms). Precision is about 1/3us.", "notes": [ "hw tearoff --delay 1200 -> define delay of 1200us", "hw tearoff --on -> (re)activate a previously defined delay", "hw tearoff --off -> deactivate a previously activated but not yet triggered hook" ], "offline": false, "options": [ "-h, --help This help", "--delay Delay in us before triggering tear-off, must be between 1 and 43000", "--on Activate tear-off hook", "--off Deactivate tear-off hook", "-s, --silent less verbose output" ], "usage": "hw tearoff [-hs] [--delay ] [--on] [--off]" }, "hw tia": { "command": "hw tia", "description": "Trigger a Timing Interval Acquisition to re-adjust the RealTimeCounter divider", "notes": [ "hw tia" ], "offline": false, "options": [ "-h, --help This help" ], "usage": "hw tia [-h]" }, "hw timeout": { "command": "hw timeout", "description": "Set the communication timeout on the client side", "notes": [ "hw timeout -> Show current timeout", "hw timeout -t 20 -> Set the timeout to 20ms", "hw timeout -t 500 -> Set the timeout to 500ms" ], "offline": true, "options": [ "-h, --help This help", "-t, --timeout timeout in ms" ], "usage": "hw timeout [-h] [-t ]" }, "hw tune": { "command": "hw tune", "description": "Measure antenna tuning", "notes": [ "hw tune" ], "offline": false, "options": [ "-h, --help This help" ], "usage": "hw tune [-h]" }, "hw version": { "command": "hw version", "description": "Show version information about the client and the connected Proxmark3", "notes": [ "hw version" ], "offline": true, "options": [ "-h, --help This help" ], "usage": "hw version [-h]" }, "lf awid brute": { "command": "lf awid brute", "description": "Enables bruteforce of AWID reader with specified facility-code. This is a attack against reader. if cardnumber is given, it starts with it and goes up / down one step if cardnumber is not given, it starts with 1 and goes up to 65535", "notes": [ "lf awid brute --fmt 26 --fc 224", "lf awid brute --fmt 50 --fc 2001 --delay 2000", "lf awid brute --fmt 50 --fc 2001 --cn 200 --delay 2000 -v" ], "offline": false, "options": [ "-h, --help This help", "--fmt format length 26|50", "--fc 8|16bit value facility code", "--cn optional - card number to start with, max 65535", "--delay optional - delay betweens attempts in ms. Default 1000ms", "-v, --verbose verbose output" ], "usage": "lf awid brute [-hv] --fmt --fc [--cn ] [--delay ]" }, "lf awid clone": { "command": "lf awid clone", "description": "clone a AWID Prox tag to a T55x7, Q5/T5555 or EM4305/4469 tag", "notes": [ "lf awid clone --fmt 26 --fc 123 --cn 1337 -> encode for T55x7 tag", "lf awid clone --fmt 50 --fc 2001 --cn 13371337 -> encode long fmt for T55x7 tag", "lf awid clone --fmt 26 --fc 123 --cn 1337 --q5 -> encode for Q5/T5555 tag", "lf awid clone --fmt 26 --fc 123 --cn 1337 --em -> encode for EM4305/4469" ], "offline": false, "options": [ "-h, --help This help", "--fmt format length 26|34|37|50", "--fc 8|16bit value facility code", "--cn 16|32-bit value card number", "--q5 optional - specify writing to Q5/T5555 tag", "--em optional - specify writing to EM4305/4469 tag" ], "usage": "lf awid clone [-h] --fmt --fc --cn [--q5] [--em]" }, "lf awid demod": { "command": "lf awid demod", "description": "Try to find AWID Prox preamble, if found decode / descramble data", "notes": [ "lf awid demod" ], "offline": true, "options": [ "-h, --help This help" ], "usage": "lf awid demod [-h]" }, "lf awid reader": { "command": "lf awid reader", "description": "read a AWID Prox tag", "notes": [ "lf awid reader -@ -> continuous reader mode" ], "offline": false, "options": [ "-h, --help This help", "-@ optional - continuous reader mode" ], "usage": "lf awid reader [-h@]" }, "lf awid sim": { "command": "lf awid sim", "description": "Enables simulation of AWID card with specified facility-code and card number. Simulation runs until the button is pressed or another USB command is issued.", "notes": [ "lf awid sim --fmt 26 --fc 123 --cn 1337", "lf awid sim --fmt 50 --fc 2001 --cn 13371337" ], "offline": false, "options": [ "-h, --help This help", "--fmt format length 26|32|36|40", "--fc 8-bit value facility code", "--cn 16-bit value card number" ], "usage": "lf awid sim [-h] --fmt --fc --cn " }, "lf awid watch": { "command": "lf awid watch", "description": "Enables AWID compatible reader mode printing details of scanned AWID26 or AWID50 tags. Run until the button is pressed or another USB command is issued.", "notes": [ "lf awid watch" ], "offline": false, "options": [ "-h, --help This help" ], "usage": "lf awid watch [-h]" }, "lf cmdread": { "command": "lf cmdread", "description": "Modulate LF reader field to send command before read. All periods in microseconds. - use `lf config` to set parameters", "notes": [ "lf cmdread -d 50 -z 116 -o 166 -e W3000 -c W00110 -> probing for Hitag 1/S", "lf cmdread -d 50 -z 116 -o 166 -e W3000 -c W11000 -> probing for Hitag 2", "lf cmdread -d 50 -z 116 -o 166 -e W3000 -c W11000 -s 2000 -@ -> probing for Hitag 2, oscilloscope style", "lf cmdread -d 48 -z 112 -o 176 -e W3000 -e S240 -e E336 -c W0S00000010000E -> probing for Hitag (us)" ], "offline": false, "options": [ "-h, --help This help", "-d, --duration delay OFF period, (0 for bitbang mode)", "-c, --cmd <0|1|...> command symbols", "-e, --extra Extra symbol definition and duration (up to 4)", "-o, --one ONE time period", "-z, --zero ZERO time period", "-s, --samples number of samples to collect", "-v, --verbose verbose output", "-k, --keep keep signal field ON after receive", "--crc-ht calculate and append CRC-8/HITAG (also for ZX8211)", "-@ continuous mode" ], "usage": "lf cmdread [-hvk@] [-d ] [-c <0|1|...>] [-e ]... [-o ] [-z ] [-s ] [--crc-ht]" }, "lf config": { "command": "lf config", "description": "Get/Set config for LF sampling, bit/sample, decimation, frequency These changes are temporary, will be reset after a power cycle. - use `lf read` performs a read (active field) - use `lf sniff` performs a sniff (no active field)", "notes": [ "lf config -> shows current config", "lf config -b 8 --125 -> samples at 125 kHz, 8 bps", "lf config -b 4 --134 --dec 3 -> samples at 134 kHz, averages three samples into one, stored with a resolution of 4 bits per sample", "lf config --trig 20 -s 10000 -> trigger sampling when above 20, skip 10 000 first samples after triggered", "lf config --reset -> reset back to default values" ], "offline": false, "options": [ "-h, --help This help", "--125 125 kHz frequency", "--134 134 kHz frequency", "-a, --avg <0|1> averaging - if set, will average the stored sample value when decimating (default 1)", "-b, --bps <1-8> sets resolution of bits per sample (default 8)", "--dec <1-8> sets decimation. A value of N saves only 1 in N samples (default 1)", "--divisor <19-255> Manually set freq divisor. 88 -> 134 kHz, 95 -> 125 kHz", "-f, --freq <47-600> manually set frequency in kHz", "-r, --reset reset values to defaults", "-s, --skip sets a number of samples to skip before capture (default 0)", "-t, --trig <0-128> sets trigger threshold. 0 means no threshold" ], "usage": "lf config [-hr] [--125] [--134] [-a <0|1>] [-b <1-8>] [--dec <1-8>] [--divisor <19-255>] [-f <47-600>] [-s ] [-t <0-128>]" }, "lf cotag demod": { "command": "lf cotag demod", "description": "Try to find COTAG preamble, if found decode / descramble data", "notes": [ "lf cotag demod" ], "offline": true, "options": [ "-h, --help This help", "-v, --verbose verbose output" ], "usage": "lf cotag demod [-hv]" }, "lf cotag reader": { "command": "lf cotag reader", "description": "read a COTAG tag, the current support for COTAG is limited.", "notes": [ "lf cotag reader -2" ], "offline": false, "options": [ "-h, --help This help", "-1 HIGH/LOW signal; maxlength bigbuff", "-2 translation of HIGH/LOW into bytes with manchester 0,1", "-3 raw signal; maxlength bigbuff" ], "usage": "lf cotag reader [-h123]" }, "lf destron clone": { "command": "lf destron clone", "description": "clone a Destron tag to a T55x7, Q5/T5555 or EM4305/4469 tag.", "notes": [ "lf destron clone --uid 1A2B3C4D5E", "lf destron clone --q5 --uid 1A2B3C4D5E -> encode for Q5/T5555 tag", "lf destron clone --em --uid 1A2B3C4D5E -> encode for EM4305/4469" ], "offline": false, "options": [ "-h, --help This help", "-u, --uid 5 bytes max", "--q5 optional - specify writing to Q5/T5555 tag", "--em optional - specify writing to EM4305/4469 tag" ], "usage": "lf destron clone [-h] -u [--q5] [--em]" }, "lf destron demod": { "command": "lf destron demod", "description": "Try to find Destron preamble, if found decode / descramble data", "notes": [ "lf destron demod" ], "offline": true, "options": [ "-h, --help This help" ], "usage": "lf destron demod [-h]" }, "lf destron reader": { "command": "lf destron reader", "description": "read a Destron tag", "notes": [ "lf destron reader -@ -> continuous reader mode" ], "offline": false, "options": [ "-h, --help This help", "-@ optional - continuous reader mode" ], "usage": "lf destron reader [-h@]" }, "lf destron sim": { "command": "lf destron sim", "description": "Try to find Destron preamble, if found decode / descramble data", "notes": [ "lf destron sim" ], "offline": false, "options": [ "-h, --help This help" ], "usage": "lf destron sim [-h]" }, "lf em 410x brute": { "command": "lf em 410x brute", "description": "bruteforcing by emulating EM 410x tag", "notes": [ "lf em 410x brute -f ids.txt", "lf em 410x brute -f ids.txt --clk 32", "lf em 410x brute -f ids.txt --delay 3000", "lf em 410x brute -f ids.txt --delay 3000 --clk 32" ], "offline": false, "options": [ "-h, --help This help", "--clk <32|64> clock (default 64)", "--delay pause delay in milliseconds between UIDs simulation (default 1000ms)", "-f, --file file with EM Tag IDs, one id per line", "--gap gap (0's) between ID repeats (default 20)" ], "usage": "lf em 410x brute [-h] [--clk ] [--delay ] -f [--gap ]" }, "lf em 410x clone": { "command": "lf em 410x clone", "description": "clone a EM410x ID to a T55x7, Q5/T5555 or EM4305/4469 tag.", "notes": [ "lf em 410x clone --id 0F0368568B -> encode for T55x7 tag", "lf em 410x clone --id 0F0368568B --q5 -> encode for Q5/T5555 tag", "lf em 410x clone --id 0F0368568B --em -> encode for EM4305/4469" ], "offline": false, "options": [ "-h, --help This help", "--clk <16|32|40|64> clock (default 64)", "--id EM Tag ID number (5 hex bytes)", "--q5 optional - specify writing to Q5/T5555 tag", "--em optional - specify writing to EM4305/4469 tag" ], "usage": "lf em 410x clone [-h] [--clk ] --id [--q5] [--em]" }, "lf em 410x demod": { "command": "lf em 410x demod", "description": "Try to find EM 410x preamble, if found decode / descramble data", "notes": [ "lf em 410x demod -> demod an EM410x Tag ID from GraphBuffer", "lf em 410x demod --clk 32 -> demod an EM410x Tag ID from GraphBuffer using a clock of RF/32", "lf em 410x demod --clk 32 -i -> demod an EM410x Tag ID from GraphBuffer using a clock of RF/32 and inverting data", "lf em 410x demod -i -> demod an EM410x Tag ID from GraphBuffer while inverting data", "lf em 410x demod --clk 64 -i --err 0 -> demod an EM410x Tag ID from GraphBuffer using a clock of RF/64 and inverting data and allowing 0 demod errors" ], "offline": true, "options": [ "-h, --help This help", "--clk clock (default autodetect)", "--err maximum allowed errors (default 100)", "--len maximum length", "-i, --invert invert output", "-a, --amp amplify signal" ], "usage": "lf em 410x demod [-hia] [--clk ] [--err ] [--len ]" }, "lf em 410x reader": { "command": "lf em 410x reader", "description": "read EM 410x tag", "notes": [ "lf em 410x reader", "lf em 410x reader -@ -> continuous reader mode", "lf em 410x reader --clk 32 -> using a clock of RF/32", "lf em 410x reader --clk 32 -i -> using a clock of RF/32 and inverting data", "lf em 410x reader -i -> inverting data", "lf em 410x reader --clk 64 -i --err 0 -> using a clock of RF/64 and inverting data and allowing 0 demod errors" ], "offline": false, "options": [ "-h, --help This help", "--clk clock (default autodetect)", "--err maximum allowed errors (default 100)", "--len maximum length", "-i, --invert invert output", "-a, --amp amplify signal", "-b break on first found", "-@ continuous reader mode", "-v, --verbose verbose output" ], "usage": "lf em 410x reader [-hiab@v] [--clk ] [--err ] [--len ]" }, "lf em 410x sim": { "command": "lf em 410x sim", "description": "Enables simulation of EM 410x card. Simulation runs until the button is pressed or another USB command is issued.", "notes": [ "lf em 410x sim --id 0F0368568B", "lf em 410x sim --id 0F0368568B --clk 32", "lf em 410x sim --id 0F0368568B --gap 0" ], "offline": false, "options": [ "-h, --help This help", "--clk <32|64> clock (default 64)", "--id EM Tag ID number (5 hex bytes)", "--gap gap (0's) between ID repeats (default 20)" ], "usage": "lf em 410x sim [-h] [--clk ] --id [--gap ]" }, "lf em 410x spoof": { "command": "lf em 410x spoof", "description": "Watch 'nd Spoof, activates reader Waits until a EM 410x tag gets presented then Proxmark3 starts simulating the found EM Tag ID", "notes": [ "lf em 410x spoof" ], "offline": false, "options": [ "-h, --help This help" ], "usage": "lf em 410x spoof [-h]" }, "lf em 410x watch": { "command": "lf em 410x watch", "description": "Enables Electro Marine (EM) compatible reader mode printing details of scanned tags. Run until the button is pressed or another USB command is issued.", "notes": [ "lf em 410x watch" ], "offline": false, "options": [ "-h, --help This help" ], "usage": "lf em 410x watch [-h]" }, "lf em 4x05 brute": { "command": "lf em 4x05 brute", "description": "This command tries to bruteforce the password of a EM4205/4305/4469/4569 The loop is running on device side, press Proxmark3 button to abort", "notes": [ "Note: if you get many false positives, change position on the antennalf em 4x05 brute", "lf em 4x05 brute -n 1 -> stop after first candidate found", "lf em 4x05 brute -s 000022AA -> start at 000022AA" ], "offline": false, "options": [ "-h, --help This help", "-s, --start Start bruteforce enumeration from this password value", "-n Stop after having found n candidates. Default: 0 (infinite)" ], "usage": "lf em 4x05 brute [-h] [-s ] [-n ]" }, "lf em 4x05 chk": { "command": "lf em 4x05 chk", "description": "This command uses a dictionary attack against EM4205/4305/4469/4569", "notes": [ "lf em 4x05 chk", "lf em 4x05 chk -e 000022B8 -> check password 000022B8", "lf em 4x05 chk -f t55xx_default_pwds -> use T55xx default dictionary" ], "offline": false, "options": [ "-h, --help This help", "-f, --file loads a default keys dictionary file <*.dic>", "-e, --em try the calculated password from some cloners based on EM4100 ID" ], "usage": "lf em 4x05 chk [-h] [-f ] [-e ]" }, "lf em 4x05 demod": { "command": "lf em 4x05 demod", "description": "Try to find EM 4x05 preamble, if found decode / descramble data", "notes": [ "lf em 4x05 demod" ], "offline": true, "options": [ "-h, --help This help" ], "usage": "lf em 4x05 demod [-h]" }, "lf em 4x05 dump": { "command": "lf em 4x05 dump", "description": "Dump EM4x05/EM4x69. Tag must be on antenna.", "notes": [ "lf em 4x05 dump", "lf em 4x05 dump -p 11223344", "lf em 4x05 dump -f myfile -p 11223344" ], "offline": false, "options": [ "-h, --help This help", "-p, --pwd password (00000000)", "-f, --file override filename prefix (optional). Default is based on UID" ], "usage": "lf em 4x05 dump [-h] [-p ] [-f ]" }, "lf em 4x05 info": { "command": "lf em 4x05 info", "description": "Tag information EM4205/4305/4469//4569 tags. Tag must be on antenna.", "notes": [ "lf em 4x05 info", "lf em 4x05 info -p 11223344" ], "offline": false, "options": [ "-h, --help This help", "-p, --pwd optional - password, 4 hex bytes" ], "usage": "lf em 4x05 info [-h] [-p ]" }, "lf em 4x05 read": { "command": "lf em 4x05 read", "description": "Read EM4x05/EM4x69. Tag must be on antenna.", "notes": [ "lf em 4x05 read -a 1", "lf em 4x05 read --addr 1 --pwd 11223344" ], "offline": false, "options": [ "-h, --help This help", "-a, --addr memory address to read. (0-15)", "-p, --pwd optional - password, 4 bytes hex" ], "usage": "lf em 4x05 read [-h] -a [-p ]" }, "lf em 4x05 sniff": { "command": "lf em 4x05 sniff", "description": "Sniff EM4x05 commands sent from a programmer", "notes": [ "lf em 4x05 sniff -> sniff via lf sniff", "lf em 4x05 sniff -1 -> sniff from data loaded into the buffer", "lf em 4x05 sniff -r -> reverse the bit order when showing block data" ], "offline": true, "options": [ "-h, --help This help", "-1, --buf Use the data in the buffer", "-r, --rev Reverse the bit order for data blocks" ], "usage": "lf em 4x05 sniff [-h1r]" }, "lf em 4x05 unlock": { "command": "lf em 4x05 unlock", "description": "execute tear off against EM4205/4305/4469/4569", "notes": [ "lf em 4x05 unlock", "lf em 4x05 unlock -s 4100 -e 4100 -> lock on and autotune at 4100us", "lf em 4x05 unlock -n 10 -s 3000 -e 4400 -> scan delays 3000us -> 4400us" ], "offline": false, "options": [ "-h, --help This help", "-n steps to skip", "-s, --start start scan from delay (us)", "-e, --end end scan at delay (us)", "-p, --pwd password (def 00000000)", "-v, --verbose verbose output" ], "usage": "lf em 4x05 unlock [-hv] [-n ] [-s ] [-e ] [-p ]" }, "lf em 4x05 wipe": { "command": "lf em 4x05 wipe", "description": "Wipe EM4x05/EM4x69. Tag must be on antenna.", "notes": [ "lf em 4x05 wipe --4305 -p 11223344 -> wipe EM 4305 w pwd", "lf em 4x05 wipe --4205 -> wipe EM 4205", "lf em 4x05 wipe --4369 -> wipe EM 4369" ], "offline": false, "options": [ "-h, --help This help", "--4205 target chip type EM 4205", "--4305 target chip type EM 4305 (default)", "--4369 target chip type EM 4369", "--4469 target chip type EM 4469", "-p, --pwd optional - password, 4 bytes hex" ], "usage": "lf em 4x05 wipe [-h] [--4205] [--4305] [--4369] [--4469] [-p ]" }, "lf em 4x05 write": { "command": "lf em 4x05 write", "description": "Write EM4x05/EM4x69. Tag must be on antenna.", "notes": [ "lf em 4x05 write -a 1 -d deadc0de", "lf em 4x05 write --addr 1 --pwd 11223344 --data deadc0de", "lf em 4x05 write --po --pwd 11223344 --data deadc0de" ], "offline": false, "options": [ "-h, --help This help", "-a, --addr memory address to write to. (0-13)", "-d, --data data to write (4 hex bytes)", "-p, --pwd password (4 hex bytes)", "--po protect operation" ], "usage": "lf em 4x05 write [-h] [-a ] -d [-p ] [--po]" }, "lf em 4x50 brute": { "command": "lf em 4x50 brute", "description": "Tries to bruteforce the password of a EM4x50 card. Function can be stopped by pressing pm3 button.", "notes": [ "lf em 4x50 brute --mode range --begin 12330000 --end 12340000 -> tries pwds from 0x12330000 to 0x12340000", "lf em 4x50 brute --mode charset --digits --uppercase -> tries all combinations of ASCII codes for digits and uppercase letters" ], "offline": false, "options": [ "-h, --help This help", "--mode Bruteforce mode (range|charset)", "--begin Range mode - start of the key range", "--end Range mode - end of the key range", "--digits Charset mode - include ASCII codes for digits", "--uppercase Charset mode - include ASCII codes for uppercase letters" ], "usage": "lf em 4x50 brute [-h] --mode [--begin ] [--end ] [--digits] [--uppercase]" }, "lf em 4x50 chk": { "command": "lf em 4x50 chk", "description": "Run dictionary key recovery against EM4x50 card.", "notes": [ "lf em 4x50 chk -> uses T55xx default dictionary", "lf em 4x50 chk -f my.dic" ], "offline": false, "options": [ "-h, --help This help", "-f, --file specify dictionary filename" ], "usage": "lf em 4x50 chk [-h] [-f ]" }, "lf em 4x50 dump": { "command": "lf em 4x50 dump", "description": "Reads all blocks/words from EM4x50 tag and saves dump in (bin/json) format", "notes": [ "lf em 4x50 dump", "lf em 4x50 dump -f mydump", "lf em 4x50 dump -p 12345678", "lf em 4x50 dump -f mydump -p 12345678" ], "offline": false, "options": [ "-h, --help This help", "-f, --file specify dump filename", "-p, --pwd password, 4 hex bytes, lsb" ], "usage": "lf em 4x50 dump [-h] [-f ] [-p ]" }, "lf em 4x50 eload": { "command": "lf em 4x50 eload", "description": "Loads EM4x50 tag dump (bin/eml/json) into emulator memory on device", "notes": [ "lf em 4x50 eload -f mydump.bin" ], "offline": false, "options": [ "-h, --help This help", "-f, --file Specify a filename for dump file" ], "usage": "lf em 4x50 eload [-h] -f " }, "lf em 4x50 esave": { "command": "lf em 4x50 esave", "description": "Saves bin/json dump file of emulator memory.", "notes": [ "lf em 4x50 esave -> use UID as filename", "lf em 4x50 esave -f mydump" ], "offline": false, "options": [ "-h, --help This help", "-f, --file specifiy filename" ], "usage": "lf em 4x50 esave [-h] [-f ]" }, "lf em 4x50 eview": { "command": "lf em 4x50 eview", "description": "Displays em4x50 content of emulator memory.", "notes": [ "lf em 4x50 eview" ], "offline": false, "options": [ "-h, --help This help" ], "usage": "lf em 4x50 eview [-h]" }, "lf em 4x50 info": { "command": "lf em 4x50 info", "description": "Tag information EM4x50.", "notes": [ "lf em 4x50 info", "lf em 4x50 info -v -> show data section", "lf em 4x50 info -p 12345678 -> uses pwd 0x12345678" ], "offline": false, "options": [ "-h, --help This help", "-p, --pwd password, 4 hex bytes, lsb", "-v, --verbose verbose output" ], "usage": "lf em 4x50 info [-hv] [-p ]" }, "lf em 4x50 login": { "command": "lf em 4x50 login", "description": "Login into EM4x50 tag.", "notes": [ "lf em 4x50 login -p 12345678 -> login with password 12345678" ], "offline": false, "options": [ "-h, --help This help", "-p, --passsword password, 4 bytes, lsb" ], "usage": "lf em 4x50 login [-h] -p " }, "lf em 4x50 rdbl": { "command": "lf em 4x50 rdbl", "description": "Reads single EM4x50 block/word.", "notes": [ "lf em 4x50 rdbl -b 3", "lf em 4x50 rdbl -b 32 -p 12345678 -> reads block 32 with pwd 0x12345678" ], "offline": false, "options": [ "-h, --help This help", "-b, --block block/word address", "-p, --pwd password, 4 hex bytes, lsb" ], "usage": "lf em 4x50 rdbl [-h] -b [-p ]" }, "lf em 4x50 reader": { "command": "lf em 4x50 reader", "description": "Shows standard read data of EM4x50 tag.", "notes": [ "lf em 4x50 reader", "lf em 4x50 reader -@ -> continuous reader mode" ], "offline": false, "options": [ "-h, --help This help", "-@ optional - continuous reader mode" ], "usage": "lf em 4x50 reader [-h@]" }, "lf em 4x50 restore": { "command": "lf em 4x50 restore", "description": "Restores data from dumpfile (bin/eml/json) onto a EM4x50 tag. if used with -u, the filetemplate `lf-4x50-UID-dump.bin` is used as filename", "notes": [ "lf em 4x50 restore -u 1b5aff5c -> uses lf-4x50-1B5AFF5C-dump.bin", "lf em 4x50 restore -f mydump.eml", "lf em 4x50 restore -u 1b5aff5c -p 12345678", "lf em 4x50 restore -f mydump.eml -p 12345678" ], "offline": false, "options": [ "-h, --help This help", "-u, --uid uid, 4 hex bytes, msb", "-f, --file specify a filename for dump file", "-p, --pwd password, 4 hex bytes, lsb" ], "usage": "lf em 4x50 restore [-h] [-u ] [-f ] [-p ]" }, "lf em 4x50 sim": { "command": "lf em 4x50 sim", "description": "Simulates a EM4x50 tag First upload to device using `lf em 4x50 eload`", "notes": [ "lf em 4x50 sim", "lf em 4x50 sim -p 27182818 -> uses password for eload data" ], "offline": false, "options": [ "-h, --help This help", "-p, --passsword password, 4 bytes, lsb" ], "usage": "lf em 4x50 sim [-h] [-p ]" }, "lf em 4x50 wipe": { "command": "lf em 4x50 wipe", "description": "Wipes EM4x50 tag by filling it with zeros, including the new password Must give a password.", "notes": [ "lf em 4x50 wipe -p 12345678" ], "offline": false, "options": [ "-h, --help This help", "-p, --passsword password, 4 bytes, lsb" ], "usage": "lf em 4x50 wipe [-h] -p " }, "lf em 4x50 wrbl": { "command": "lf em 4x50 wrbl", "description": "Writes single block/word to EM4x50 tag.", "notes": [ "lf em 4x50 wrbl -b 3 -d 4f22e7ff", "lf em 4x50 wrbl -b 3 -d 4f22e7ff -p 12345678" ], "offline": false, "options": [ "-h, --help This help", "-b, --block block/word address, dec", "-d, --data data, 4 bytes, lsb", "-p, --pwd password, 4 bytes, lsb" ], "usage": "lf em 4x50 wrbl [-h] -b -d [-p ]" }, "lf em 4x50 wrpwd": { "command": "lf em 4x50 wrpwd", "description": "Writes EM4x50 password.", "notes": [ "lf em 4x50 wrpwd -p 4f22e7ff -n 12345678" ], "offline": false, "options": [ "-h, --help This help", "-p, --pwd password, 4 hex bytes, lsb", "-n, --new new password, 4 hex bytes, lsb" ], "usage": "lf em 4x50 wrpwd [-h] -p -n " }, "lf em 4x70 auth": { "command": "lf em 4x70 auth", "description": "Authenticate against an EM4x70 by sending random number (RN) and F(RN) If F(RN) is incorrect based on the tag crypt key, the tag will not respond", "notes": [ "lf em 4x70 auth --rnd 45F54ADA252AAC --frn 4866BB70 -> Test authentication, tag will respond if successful" ], "offline": false, "options": [ "-h, --help This help", "--par Add parity bit when sending commands", "--rnd Random 56-bit", "--frn F(RN) 28-bit as 4 hex bytes" ], "usage": "lf em 4x70 auth [-h] [--par] --rnd --frn " }, "lf em 4x70 brute": { "command": "lf em 4x70 brute", "description": "Optimized partial key-update attack of 16-bit key block 7, 8 or 9 of an EM4x70 This attack does NOT write anything to the tag. Before starting this attack, 0000 must be written to the 16-bit key block: 'lf em 4x70 write -b 9 -d 0000'. After success, the 16-bit key block have to be restored with the key found: 'lf em 4x70 write -b 9 -d c0de'", "notes": [ "lf em 4x70 brute -b 9 --rnd 45F54ADA252AAC --frn 4866BB70 -> bruteforcing key bits k95...k80" ], "offline": false, "options": [ "-h, --help This help", "--par Add parity bit when sending commands", "-b, --block block/word address, dec", "--rnd Random 56-bit", "--frn F(RN) 28-bit as 4 hex bytes", "-s, --start Start bruteforce enumeration from this key value" ], "usage": "lf em 4x70 brute [-h] [--par] -b --rnd --frn [-s ]" }, "lf em 4x70 info": { "command": "lf em 4x70 info", "description": "Tag Information EM4x70 Tag variants include ID48 automotive transponder. ID48 does not use command parity (default). V4070 and EM4170 do require parity bit.", "notes": [ "lf em 4x70 info", "lf em 4x70 info --par -> adds parity bit to command" ], "offline": false, "options": [ "-h, --help This help", "--par Add parity bit when sending commands" ], "usage": "lf em 4x70 info [-h] [--par]" }, "lf em 4x70 unlock": { "command": "lf em 4x70 unlock", "description": "Unlock EM4x70 by sending PIN Default pin may be: AAAAAAAA 00000000", "notes": [ "lf em 4x70 unlock -p 11223344 -> Unlock with PIN", "lf em 4x70 unlock -p 11223344 --par -> Unlock with PIN using parity commands" ], "offline": false, "options": [ "-h, --help This help", "--par Add parity bit when sending commands", "-p, --pin pin, 4 bytes" ], "usage": "lf em 4x70 unlock [-h] [--par] -p " }, "lf em 4x70 write": { "command": "lf em 4x70 write", "description": "Write EM4x70", "notes": [ "lf em 4x70 write -b 15 -d c0de -> write 'c0de' to block 15", "lf em 4x70 write -b 15 -d c0de --par -> adds parity bit to commands" ], "offline": false, "options": [ "-h, --help This help", "--par Add parity bit when sending commands", "-b, --block block/word address, dec", "-d, --data data, 2 bytes" ], "usage": "lf em 4x70 write [-h] [--par] -b -d " }, "lf em 4x70 writekey": { "command": "lf em 4x70 writekey", "description": "Write new 96-bit key to tag", "notes": [ "lf em 4x70 writekey -k F32AA98CF5BE4ADFA6D3480B" ], "offline": false, "options": [ "-h, --help This help", "--par Add parity bit when sending commands", "-k, --key Crypt Key as 12 hex bytes" ], "usage": "lf em 4x70 writekey [-h] [--par] -k " }, "lf em 4x70 writepin": { "command": "lf em 4x70 writepin", "description": "Write PIN", "notes": [ "lf em 4x70 writepin -p 11223344 -> Write PIN", "lf em 4x70 writepin -p 11223344 --par -> Write PIN using parity commands" ], "offline": false, "options": [ "-h, --help This help", "--par Add parity bit when sending commands", "-p, --pin pin, 4 bytes" ], "usage": "lf em 4x70 writepin [-h] [--par] -p " }, "lf fdxb clone": { "command": "lf fdxb clone", "description": "clone a FDX-B tag to a T55x7, Q5/T5555 or EM4305/4469 tag.", "notes": [ "lf fdxb clone --country 999 --national 1337 --animal -> encode for T55x7 tag, with animal bit", "lf fdxb clone --country 999 --national 1337 --extended 016A -> encode for T55x7 tag, with extended data", "lf fdxb clone --country 999 --national 1337 --q5 -> encode for Q5/T5555 tag", "lf fdxb clone --country 999 --national 1337 --em -> encode for EM4305/4469" ], "offline": false, "options": [ "-h, --help This help", "-c, --country country code", "-n, --national national code", "--extended extended data", "-a, --animal optional - set animal bit", "--q5 optional - specify writing to Q5/T5555 tag", "--em optional - specify writing to EM4305/4469 tag" ], "usage": "lf fdxb clone [-ha] -c -n [--extended ] [--q5] [--em]" }, "lf fdxb demod": { "command": "lf fdxb demod", "description": "Try to find FDX-B preamble, if found decode / descramble data", "notes": [ "lf fdxb demod" ], "offline": true, "options": [ "-h, --help This help" ], "usage": "lf fdxb demod [-h]" }, "lf fdxb reader": { "command": "lf fdxb reader", "description": "read a FDX-B animal tag Note that the continuous mode is less verbose", "notes": [ "lf fdxb reader -@ -> continuous reader mode" ], "offline": false, "options": [ "-h, --help This help", "-@ optional - continuous reader mode" ], "usage": "lf fdxb reader [-h@]" }, "lf fdxb sim": { "command": "lf fdxb sim", "description": "Enables simulation of FDX-B animal tag. Simulation runs until the button is pressed or another USB command is issued.", "notes": [ "lf fdxb sim --country 999 --national 1337 --animal", "lf fdxb sim --country 999 --national 1337 --extended 016A" ], "offline": false, "options": [ "-h, --help This help", "-c, --country country code", "-n, --national national code", "--extended extended data", "-a, --animal optional - set animal bit" ], "usage": "lf fdxb sim [-ha] -c -n [--extended ]" }, "lf gallagher clone": { "command": "lf gallagher clone", "description": "clone a GALLAGHER tag to a T55x7, Q5/T5555 or EM4305/4469 tag.", "notes": [ "lf gallagher clone --raw 0FFD5461A9DA1346B2D1AC32 -> encode for T55x7 tag", "lf gallagher clone --raw 0FFD5461A9DA1346B2D1AC32 --q5 -> encode for Q5/T5555 tag", "lf gallagher clone --raw 0FFD5461A9DA1346B2D1AC32 --em -> encode for EM4305/4469", "lf gallagher clone --rc 0 --fc 9876 --cn 1234 --il 1 -> encode for T55x7 tag from decoded data" ], "offline": false, "options": [ "-h, --help This help", "-r, --raw raw hex data. 12 bytes max", "--q5 optional - specify writing to Q5/T5555 tag", "--em optional - specify writing to EM4305/4469 tag", "--rc Region code. 4 bits max", "--fc Facility code. 2 bytes max", "--cn Card number. 3 bytes max", "--il Issue level. 4 bits max" ], "usage": "lf gallagher clone [-h] [-r ] [--q5] [--em] [--rc ] [--fc ] [--cn ] [--il ]" }, "lf gallagher demod": { "command": "lf gallagher demod", "description": "Try to find GALLAGHER preamble, if found decode / descramble data", "notes": [ "lf gallagher demod" ], "offline": true, "options": [ "-h, --help This help" ], "usage": "lf gallagher demod [-h]" }, "lf gallagher reader": { "command": "lf gallagher reader", "description": "read a GALLAGHER tag", "notes": [ "lf gallagher reader -@ -> continuous reader mode" ], "offline": false, "options": [ "-h, --help This help", "-@ optional - continuous reader mode" ], "usage": "lf gallagher reader [-h@]" }, "lf gallagher sim": { "command": "lf gallagher sim", "description": "Enables simulation of GALLAGHER card with specified card number. Simulation runs until the button is pressed or another USB command is issued.", "notes": [ "lf gallagher sim --raw 0FFD5461A9DA1346B2D1AC32", "lf gallagher sim --rc 0 --fc 9876 --cn 1234 --il 1" ], "offline": false, "options": [ "-h, --help This help", "-r, --raw raw hex data. 12 bytes max", "--rc Region code. 4 bits max", "--fc Facility code. 2 bytes max", "--cn Card number. 3 bytes max", "--il Issue level. 4 bits max" ], "usage": "lf gallagher sim [-h] [-r ] [--rc ] [--fc ] [--cn ] [--il ]" }, "lf gproxii clone": { "command": "lf gproxii clone", "description": "Clone a Guardall tag to a T55x7, Q5/T5555 or EM4305/4469 tag. The facility-code is 8-bit and the card number is 20-bit. Larger values are truncated. Currently work only on 26 | 36 bit format", "notes": [ "lf gproxii clone --xor 141 --fmt 26 --fc 123 --cn 1337 -> encode for T55x7 tag", "lf gproxii clone --xor 141 --fmt 26 --fc 123 --cn 1337 --q5 -> encode for Q5/T5555 tag", "lf gproxii clone --xor 141 --fmt 26 --fc 123 --cn 1337 --em -> encode for EM4305/4469" ], "offline": false, "options": [ "-h, --help This help", "--xor 8-bit xor value (installation dependant)", "--fmt format length 26|32|36|40", "--fc 8-bit value facility code", "--cn 16-bit value card number", "--q5 optional - specify writing to Q5/T5555 tag", "--em optional - specify writing to EM4305/4469 tag" ], "usage": "lf gproxii clone [-h] --xor --fmt --fc --cn [--q5] [--em]" }, "lf gproxii demod": { "command": "lf gproxii demod", "description": "Try to find Guardall Prox-II preamble, if found decode / descramble data", "notes": [ "lf gproxii demod -> use graphbuffer to decode", "lf gproxii demod --raw fb8ee718ee3b8cc785c11b92 ->" ], "offline": true, "options": [ "-h, --help This help", "-r, --raw raw bytes" ], "usage": "lf gproxii demod [-h] [-r ]" }, "lf gproxii reader": { "command": "lf gproxii reader", "description": "read a Guardall tag", "notes": [ "lf gproxii reader -@ -> continuous reader mode" ], "offline": false, "options": [ "-h, --help This help", "-@ optional - continuous reader mode" ], "usage": "lf gproxii reader [-h@]" }, "lf gproxii sim": { "command": "lf gproxii sim", "description": "Enables simulation of Guardall card with specified card number. Simulation runs until the button is pressed or another USB command is issued. The facility-code is 8-bit and the card number is 16-bit. Larger values are truncated. Currently work only on 26 | 36 bit format", "notes": [ "lf gproxii sim --xor 141 --fmt 26 --fc 123 --cn 1337" ], "offline": false, "options": [ "-h, --help This help", "--xor 8-bit xor value (installation dependant)", "--fmt format length 26|32|36|40", "--fc 8-bit value facility code", "--cn 16-bit value card number" ], "usage": "lf gproxii sim [-h] --xor --fmt --fc --cn " }, "lf hid brute": { "command": "lf hid brute", "description": "Enables bruteforce of HID readers with specified facility code or card number. This is an attack against the reader. If the field being bruteforced is provided, it starts with it and goes up / down one step while maintaining other supplied values. If the field being bruteforced is not provided, it will iterate through the full range while maintaining other supplied values.", "notes": [ "lf hid brute -w H10301 --field fc --fc 224 --cn 6278", "lf hid brute -w H10301 --field cn --fc 21 -d 2000", "lf hid brute -v -w H10301 --field cn --fc 21 --cn 200 -d 2000", "lf hid brute -v -w H10301 --field fc --fc 21 --cn 200 -d 2000 --up" ], "offline": false, "options": [ "-h, --help This help", "-v, --verbose verbose output", "-w, --wiegand see `wiegand list` for available formats", "--field field to bruteforce", "--fc facility code", "--cn card number", "-i, --issue issue level", "-o, --oem OEM code", "-d, --delay delay betweens attempts in ms. (def is 1000)", "--up direction to increment field value. (def is both directions)", "--down direction to decrement field value. (def is both directions)" ], "usage": "lf hid brute [-hv] -w --field [--fc ] [--cn ] [-i ] [-o ] [-d ] [--up] [--down]" }, "lf hid clone": { "command": "lf hid clone", "description": "clone a HID Prox tag to a T55x7, Q5/T5555 or EM4305/4469 tag. Tag must be on the antenna when issuing this command.", "notes": [ "lf hid clone -r 2006ec0c86 -> write raw value for T55x7 tag (HID 10301 26 bit)", "lf hid clone -r 2e0ec00c87 -> write raw value for T55x7 tag (HID Corporate 35 bit)", "lf hid clone -r 01f0760643c3 -> write raw value for T55x7 tag (HID P10001 40 bit)", "lf hid clone -r 01400076000c86 -> write raw value for T55x7 tag (HID Corporate 48 bit)", "lf hid clone -w H10301 --fc 118 --cn 1603 -> HID 10301 26 bit, encode for T55x7 tag", "lf hid clone -w H10301 --fc 118 --cn 1603 --q5 -> HID 10301 26 bit, encode for Q5/T5555 tag", "lf hid clone -w H10301 --fc 118 --cn 1603 --em -> HID 10301 26 bit, encode for EM4305/4469" ], "offline": false, "options": [ "-h, --help This help", "-w, --wiegand see `wiegand list` for available formats", "--fc facility code", "--cn card number", "-i issue level", "-o, --oem OEM code", "-r, --raw raw bytes", "--q5 optional - specify writing to Q5/T5555 tag", "--em optional - specify writing to EM4305/4469 tag", "--bin Binary string i.e 0001001001" ], "usage": "lf hid clone [-h] [-w ] [--fc ] [--cn ] [-i ] [-o ] [-r ] [--q5] [--em] [--bin ]" }, "lf hid demod": { "command": "lf hid demod", "description": "Try to find HID Prox preamble, if found decode / descramble data", "notes": [ "lf hid demod" ], "offline": true, "options": [ "-h, --help This help" ], "usage": "lf hid demod [-h]" }, "lf hid reader": { "command": "lf hid reader", "description": "read a HID Prox tag", "notes": [ "lf hid reader -@ -> continuous reader mode" ], "offline": false, "options": [ "-h, --help This help", "-@ optional - continuous reader mode" ], "usage": "lf hid reader [-h@]" }, "lf hid sim": { "command": "lf hid sim", "description": "Enables simulation of HID card with card number. Simulation runs until the button is pressed or another USB command is issued.", "notes": [ "lf hid sim -r 2006ec0c86 -> HID 10301 26 bit", "lf hid sim -r 2e0ec00c87 -> HID Corporate 35 bit", "lf hid sim -r 01f0760643c3 -> HID P10001 40 bit", "lf hid sim -r 01400076000c86 -> HID Corporate 48 bit", "lf hid sim -w H10301 --fc 118 --cn 1603 -> HID 10301 26 bit" ], "offline": false, "options": [ "-h, --help This help", "-w, --wiegand see `wiegand list` for available formats", "--fc facility code", "--cn card number", "-i issue level", "-o, --oem OEM code", "-r, --raw raw bytes" ], "usage": "lf hid sim [-h] [-w ] [--fc ] [--cn ] [-i ] [-o ] [-r ]" }, "lf hid watch": { "command": "lf hid watch", "description": "Enables HID compatible reader mode printing details. By default, values are printed and logged until the button is pressed or another USB command is issued.", "notes": [ "lf hid watch" ], "offline": false, "options": [ "-h, --help This help" ], "usage": "lf hid watch [-h]" }, "lf hitag cc": { "command": "lf hitag cc", "description": "Check challenges, load a file with saved hitag crypto challenges and test them all. The file should be 8 * 60 bytes long, the file extension defaults to `.cc`", "notes": [ "lf hitag cc -f my_hitag_challenges" ], "offline": false, "options": [ "-h, --help This help", "-f, --file filename to load ( w/o ext )" ], "usage": "lf hitag cc [-h] -f " }, "lf hitag dump": { "command": "lf hitag dump", "description": "Read all Hitag 2 card memory and save to file Crypto mode key format: ISK high + ISK low", "notes": [ "Password mode => use default key 4D494B52 (MIKR)", "lf hitag dump --pwd", "Short key = password mode", "lf hitag dump -k 4D494B52", "Challenge mode", "lf hitag dump --nrar 0102030411223344", "Crypto mode => use default key 4F4E4D494B52 (ONMIKR)", "lf hitag dump --crypto", "Long key = crypto mode", "lf hitag dump -k 4F4E4D494B52" ], "offline": false, "options": [ "-h, --help This help", "--pwd password mode", "--nrar nonce / answer reader, 8 hex bytes", "--crypto crypto mode", "-k, --key key, 4 or 6 hex bytes", "-f, --file specify file name" ], "usage": "lf hitag dump [-h] [--pwd] [--nrar ] [--crypto] [-k ] [-f ]" }, "lf hitag eload": { "command": "lf hitag eload", "description": "Loads hitag tag dump into emulator memory on device", "notes": [ "lf hitag eload -2 -f lf-hitag-11223344-dump.bin" ], "offline": false, "options": [ "-h, --help This help", "-f, --file Specify dump filename", "-1, --ht1 Card type Hitag 1", "-2, --ht2 Card type Hitag 2", "-s, --hts Card type Hitag S", "-m, --htm Card type Hitag \u03bc" ], "usage": "lf hitag eload [-h12sm] -f " }, "lf hitag info": { "command": "lf hitag info", "description": "Hitag2 tag information", "notes": [ "lf hitag info" ], "offline": false, "options": [ "-h, --help This help" ], "usage": "lf hitag info [-h]" }, "lf hitag list": { "command": "lf hitag list", "description": "Alias of `trace list -t hitag2` with selected protocol data to annotate trace buffer You can load a trace from file (see `trace load -h`) or it be downloaded from device by default It accepts all other arguments of `trace list`. Note that some might not be relevant for this specific protocol", "notes": [ "lf hitag list --frame -> show frame delay times", "lf hitag list -1 -> use trace buffer" ], "offline": true, "options": [ "-h, --help This help", "-1, --buffer use data from trace buffer", "--frame show frame delay times", "-c mark CRC bytes", "-r show relative times (gap and duration)", "-u display times in microseconds instead of clock cycles", "-x show hexdump to convert to pcap(ng)", "or to import into Wireshark using encapsulation type \"ISO 14443\"", "-f, --file filename of dictionary" ], "usage": "lf hitag list [-h1crux] [--frame] [-f ]" }, "lf hitag read": { "command": "lf hitag read", "description": "Read Hitag memory Crypto mode key format: ISK high + ISK low", "notes": [ "Hitag S, plain mode", "lf hitag read --hts", "Hitag S, challenge mode", "lf hitag read --hts --nrar 0102030411223344", "Hitag S, crypto mode => use default key 4F4E4D494B52 (ONMIKR)", "lf hitag read --hts --crypto", "Hitag S, long key = crypto mode", "lf hitag read --hts -k 4F4E4D494B52", "", "Hitag 2, password mode => use default key 4D494B52 (MIKR)", "lf hitag read --ht2 --pwd", "Hitag 2, providing a short key = password mode", "lf hitag read --ht2 -k 4D494B52", "Hitag 2, challenge mode", "lf hitag read --ht2 --nrar 0102030411223344", "Hitag 2, crypto mode => use default key 4F4E4D494B52 (ONMIKR)", "lf hitag read --ht2 --crypto", "Hitag 2, providing a long key = crypto mode", "lf hitag read --ht2 -k 4F4E4D494B52" ], "offline": false, "options": [ "-h, --help This help", "-s, --hts Hitag S", "-2, --ht2 Hitag 2", "--pwd password mode", "--nrar nonce / answer writer, 8 hex bytes", "--crypto crypto mode", "-k, --key key, 4 or 6 hex bytes" ], "usage": "lf hitag read [-hs2] [--pwd] [--nrar ] [--crypto] [-k ]" }, "lf hitag sim": { "command": "lf hitag sim", "description": "Simulate Hitag transponder You need to `lf hitag eload` first", "notes": [ "lf hitag sim -2" ], "offline": false, "options": [ "-h, --help This help", "-1, --ht1 simulate Hitag 1", "-2, --ht2 simulate Hitag 2", "-s, --hts simulate Hitag S" ], "usage": "lf hitag sim [-h12s]" }, "lf hitag sniff": { "command": "lf hitag sniff", "description": "Sniff traffic between Hitag reader and tag. Use `lf hitag list` to view collected data.", "notes": [ "lf hitag sniff" ], "offline": false, "options": [ "-h, --help This help" ], "usage": "lf hitag sniff [-h]" }, "lf hitag wrbl": { "command": "lf hitag wrbl", "description": "Write a page in Hitag memory Crypto mode key format: ISK high + ISK low", "notes": [ "Hitag S, plain mode", "lf hitag wrbl --hts -p 6 -d 01020304", "Hitag S, challenge mode", "lf hitag wrbl --hts --nrar 0102030411223344 -p 6 -d 01020304", "Hitag S, crypto mode => use default key 4F4E4D494B52 (ONMIKR)", "lf hitag wrbl --hts --crypto -p 6 -d 01020304", "Hitag S, long key = crypto mode", "lf hitag wrbl --hts -k 4F4E4D494B52 -p 6 -d 01020304", "", "Hitag 2, password mode => use default key 4D494B52 (MIKR)", "lf hitag wrbl --ht2 --pwd -p 6 -d 01020304", "Hitag 2, providing a short key = password mode", "lf hitag wrbl --ht2 -k 4D494B52 -p 6 -d 01020304", "Hitag 2, challenge mode", "lf hitag wrbl --ht2 --nrar 0102030411223344 -p 6 -d 01020304", "Hitag 2, crypto mode => use default key 4F4E4D494B52 (ONMIKR)", "lf hitag wrbl --ht2 --crypto -p 6 -d 01020304", "Hitag 2, providing a long key = crypto mode", "lf hitag wrbl --ht2 -k 4F4E4D494B52 -p 6 -d 01020304" ], "offline": false, "options": [ "-h, --help This help", "-s, --hts Hitag S", "-2, --ht2 Hitag 2", "--pwd password mode", "--nrar nonce / answer writer, 8 hex bytes", "--crypto crypto mode", "-k, --key key, 4 or 6 hex bytes", "-p, --page page address to write to", "-d, --data data, 4 hex bytes" ], "usage": "lf hitag wrbl [-hs2] [--pwd] [--nrar ] [--crypto] [-k ] -p -d " }, "lf idteck clone": { "command": "lf idteck clone", "description": "clone a Idteck tag to T55x7 or Q5/T5555 tag Tag must be on the antenna when issuing this command.", "notes": [ "lf idteck clone --raw 4944544B351FBE4B" ], "offline": false, "options": [ "-h, --help This help", "-r, --raw raw bytes", "--q5 optional - specify writing to Q5/T5555 tag", "--em optional - specify writing to EM4305/4469 tag" ], "usage": "lf idteck clone [-h] -r [--q5] [--em]" }, "lf idteck demod": { "command": "lf idteck demod", "description": "Try to find Idteck preamble, if found decode / descramble data", "notes": [ "lf idteck demod" ], "offline": true, "options": [ "-h, --help This help" ], "usage": "lf idteck demod [-h]" }, "lf idteck reader": { "command": "lf idteck reader", "description": "read a Idteck tag", "notes": [ "lf idteck reader -@ -> continuous reader mode" ], "offline": false, "options": [ "-h, --help This help", "-@ optional - continuous reader mode" ], "usage": "lf idteck reader [-h@]" }, "lf idteck sim": { "command": "lf idteck sim", "description": "Enables simulation of Idteck card. Simulation runs until the button is pressed or another USB command is issued.", "notes": [ "lf idteck sim --raw 4944544B351FBE4B" ], "offline": false, "options": [ "-h, --help This help", "-r, --raw raw bytes" ], "usage": "lf idteck sim [-h] -r " }, "lf indala altdemod": { "command": "lf indala altdemod", "description": "Tries to PSK demodulate the graphbuffer as Indala This is uses a alternative way to demodulate and was used from the beginning in the Pm3 client. It's now considered obsolete but remains because it has sometimes its advantages.", "notes": [ "lf indala altdemod", "lf indala altdemod --long -> demod a Indala tag from the GraphBuffer as 224 bit long format" ], "offline": true, "options": [ "-h, --help This help", "-l, --long optional - demod as 224b long format" ], "usage": "lf indala altdemod [-hl]" }, "lf indala brute": { "command": "lf indala brute", "description": "Enables bruteforce of INDALA readers with specified facility code. This is a attack against reader. if cardnumber is given, it starts with it and goes up / down one step if cardnumber is not given, it starts with 1 and goes up to 65535", "notes": [ "lf indala brute --fc 224", "lf indala brute --fc 21 -d 2000", "lf indala brute -v --fc 21 --cn 200 -d 2000", "lf indala brute -v --fc 21 --cn 200 -d 2000 --up" ], "offline": false, "options": [ "-h, --help This help", "-v, --verbose verbose output", "--fc facility code", "--cn card number to start with", "-d, --delay delay betweens attempts in ms. Default 1000ms", "--up direction to increment card number. (default is both directions)", "--down direction to decrement card number. (default is both directions)", "--4041x specify Indala 4041X format" ], "usage": "lf indala brute [-hv] [--fc ] [--cn ] [-d ] [--up] [--down] [--4041x]" }, "lf indala clone": { "command": "lf indala clone", "description": "clone Indala UID to T55x7 or Q5/T5555 tag using different known formats Warning, encoding with FC/CN doesn't always work", "notes": [ "lf indala clone --heden 888", "lf indala clone --fc 123 --cn 1337", "lf indala clone --fc 123 --cn 1337 --4041x", "lf indala clone -r a0000000a0002021", "lf indala clone -r 80000001b23523a6c2e31eba3cbee4afb3c6ad1fcf649393928c14e5" ], "offline": false, "options": [ "-h, --help This help", "-r, --raw raw bytes", "--heden Card number for Heden 2L format", "--fc Facility code (26 bit H10301 format)", "--cn Card number (26 bit H10301 format)", "--q5 Optional - specify writing to Q5/T5555 tag", "--em Optional - specify writing to EM4305/4469 tag", "--4041x Optional - specify Indala 4041X format, must use with fc and cn" ], "usage": "lf indala clone [-h] [-r ] [--heden ] [--fc ] [--cn ] [--q5] [--em] [--4041x]" }, "lf indala demod": { "command": "lf indala demod", "description": "Tries to PSK demodulate the graphbuffer as Indala", "notes": [ "lf indala demod", "lf indala demod --clock 32 -> demod a Indala tag from the GraphBuffer using a clock of RF/32", "lf indala demod --clock 32 -i -> demod a Indala tag from the GraphBuffer using a clock of RF/32 and inverting data", "lf indala demod --clock 64 -i --maxerror 0 -> demod a Indala tag from the GraphBuffer using a clock of RF/64, inverting data and allowing 0 demod errors" ], "offline": true, "options": [ "-h, --help This help", "--clock optional - set clock (as integer), if not set, autodetect.", "--maxerr optional - set maximum allowed errors, default = 100", "-i, --invert optional - invert output" ], "usage": "lf indala demod [-hi] [--clock ] [--maxerr ]" }, "lf indala reader": { "command": "lf indala reader", "description": "read a Indala tag", "notes": [ "lf indala reader -@ -> continuous reader mode" ], "offline": false, "options": [ "-h, --help This help", "--clock optional - set clock (as integer), if not set, autodetect.", "--maxerr optional - set maximum allowed errors, default = 100", "-i, --invert optional - invert output", "-@ optional - continuous reader mode" ], "usage": "lf indala reader [-hi@] [--clock ] [--maxerr ]" }, "lf indala sim": { "command": "lf indala sim", "description": "Enables simulation of Indala card with specified facility code and card number. Simulation runs until the button is pressed or another USB command is issued.", "notes": [ "lf indala sim --heden 888", "lf indala sim --fc 123 --cn 1337", "lf indala sim --fc 123 --cn 1337 --4041x", "lf indala sim --raw a0000000a0002021", "lf indala sim --raw 80000001b23523a6c2e31eba3cbee4afb3c6ad1fcf649393928c14e5" ], "offline": false, "options": [ "-h, --help This help", "-r, --raw raw bytes", "--heden Cardnumber for Heden 2L format", "--fc Facility code (26 bit H10301 format)", "--cn Card number (26 bit H10301 format)", "--4041x Optional - specify Indala 4041X format, must use with fc and cn" ], "usage": "lf indala sim [-h] [-r ] [--heden ] [--fc ] [--cn ] [--4041x]" }, "lf io clone": { "command": "lf io clone", "description": "clone a ioProx card with specified facility-code and card number to a T55x7, Q5/T5555 or EM4305/4469 tag. Tag must be on the antenna when issuing this command.", "notes": [ "lf io clone --vn 1 --fc 101 --cn 1337" ], "offline": false, "options": [ "-h, --help This help", "--vn 8bit version", "--fc 8bit facility code", "--cn 16bit card number", "--q5 optional - specify writing to Q5/T5555 tag", "--em optional - specify writing to EM4305/4469 tag" ], "usage": "lf io clone [-h] --vn --fc --cn [--q5] [--em]" }, "lf io demod": { "command": "lf io demod", "description": "Try to find ioProx preamble, if found decode / descramble data", "notes": [ "lf io demod" ], "offline": true, "options": [ "-h, --help This help" ], "usage": "lf io demod [-h]" }, "lf io reader": { "command": "lf io reader", "description": "read a ioProx tag", "notes": [ "lf io reader -@ -> continuous reader mode" ], "offline": false, "options": [ "-h, --help This help", "-@ optional - continuous reader mode" ], "usage": "lf io reader [-h@]" }, "lf io sim": { "command": "lf io sim", "description": "Enables simulation of ioProx card with specified facility-code and card number. Simulation runs until the button is pressed or another USB command is issued.", "notes": [ "lf io sim --vn 1 --fc 101 --cn 1337" ], "offline": false, "options": [ "-h, --help This help", "--vn 8bit version", "--fc 8bit facility code", "--cn 16bit card number" ], "usage": "lf io sim [-h] --vn --fc --cn " }, "lf io watch": { "command": "lf io watch", "description": "Enables ioProx compatible reader mode printing details. By default, values are printed and logged until the button is pressed or another USB command is issued.", "notes": [ "lf io watch" ], "offline": false, "options": [ "-h, --help This help" ], "usage": "lf io watch [-h]" }, "lf jablotron clone": { "command": "lf jablotron clone", "description": "clone a Jablotron tag to a T55x7, Q5/T5555 or EM4305/4469 tag. Tag must be on the antenna when issuing this command.", "notes": [ "lf jablotron clone --cn 01b669 -> encode for T55x7 tag", "lf jablotron clone --cn 01b669 --q5 -> encode for Q5/T5555 tag", "lf jablotron clone --cn 01b669 --em -> encode for EM4305/4469" ], "offline": false, "options": [ "-h, --help This help", "--cn Jablotron card ID - 5 bytes max", "--q5 optional - specify writing to Q5/T5555 tag", "--em optional - specify writing to EM4305/4469 tag" ], "usage": "lf jablotron clone [-h] --cn [--q5] [--em]" }, "lf jablotron demod": { "command": "lf jablotron demod", "description": "Try to find Jablotron preamble, if found decode / descramble data", "notes": [ "lf jablotron demod" ], "offline": true, "options": [ "-h, --help This help" ], "usage": "lf jablotron demod [-h]" }, "lf jablotron reader": { "command": "lf jablotron reader", "description": "read a jablotron tag", "notes": [ "lf jablotron reader -@ -> continuous reader mode" ], "offline": false, "options": [ "-h, --help This help", "-@ optional - continuous reader mode" ], "usage": "lf jablotron reader [-h@]" }, "lf jablotron sim": { "command": "lf jablotron sim", "description": "Enables simulation of jablotron card with specified card number. Simulation runs until the button is pressed or another USB command is issued.", "notes": [ "lf jablotron sim --cn 01b669" ], "offline": false, "options": [ "-h, --help This help", "--cn Jablotron card ID - 5 bytes max" ], "usage": "lf jablotron sim [-h] --cn " }, "lf keri clone": { "command": "lf keri clone", "description": "clone a KERI tag to a T55x7, Q5/T5555 or EM4305/4469 tag", "notes": [ "lf keri clone -t i --cn 12345 -> Internal ID", "lf keri clone -t m --fc 6 --cn 12345 -> MS ID" ], "offline": false, "options": [ "-h, --help This help", "-t, --type Type m - MS, i - Internal ID", "--fc Facility Code", "--cn KERI card ID", "--q5 specify writing to Q5/T5555 tag", "--em specify writing to EM4305/4469 tag" ], "usage": "lf keri clone [-h] [-t ] [--fc ] --cn [--q5] [--em]" }, "lf keri demod": { "command": "lf keri demod", "description": "Try to find KERI preamble, if found decode / descramble data", "notes": [ "lf keri demod" ], "offline": true, "options": [ "-h, --help This help" ], "usage": "lf keri demod [-h]" }, "lf keri reader": { "command": "lf keri reader", "description": "read a keri tag", "notes": [ "lf keri reader -@ -> continuous reader mode" ], "offline": false, "options": [ "-h, --help This help", "-@ optional - continuous reader mode" ], "usage": "lf keri reader [-h@]" }, "lf keri sim": { "command": "lf keri sim", "description": "Enables simulation of KERI card with internal ID. You supply a KERI card id and it will converted to a KERI internal ID.", "notes": [ "lf keri sim --cn 112233" ], "offline": false, "options": [ "-h, --help This help", "--id KERI card ID" ], "usage": "lf keri sim [-h] --id " }, "lf motorola clone": { "command": "lf motorola clone", "description": "clone Motorola UID to a T55x7, Q5/T5555 or EM4305/4469 tag. defaults to 64 bit format", "notes": [ "lf motorola clone --raw a0000000a0002021 -> encode for T55x7 tag", "lf motorola clone --raw a0000000a0002021 --q5 -> encode for Q5/T5555 tag", "lf motorola clone --raw a0000000a0002021 --em -> encode for EM4305/4469" ], "offline": false, "options": [ "-h, --help This help", "-r, --raw raw hex bytes. 8 bytes", "--q5 optional - specify writing to Q5/T5555 tag", "--em optional - specify writing to EM4305/4469 tag" ], "usage": "lf motorola clone [-h] -r [--q5] [--em]" }, "lf motorola demod": { "command": "lf motorola demod", "description": "Try to find Motorola Flexpass preamble, if found decode / descramble data", "notes": [ "lf motorola demod" ], "offline": true, "options": [ "-h, --help This help" ], "usage": "lf motorola demod [-h]" }, "lf motorola reader": { "command": "lf motorola reader", "description": "read a Motorola Flexpass tag", "notes": [ "lf motorola reader -@ -> continuous reader mode" ], "offline": false, "options": [ "-h, --help This help", "-@ optional - continuous reader mode" ], "usage": "lf motorola reader [-h@]" }, "lf motorola sim": { "command": "lf motorola sim", "description": "Enables simulation of Motorola card with specified card number. Simulation runs until the button is pressed or another USB command is issued.", "notes": [ "lf motorola sim" ], "offline": false, "options": [ "-h, --help This help" ], "usage": "lf motorola sim [-h]" }, "lf nedap clone": { "command": "lf nedap clone", "description": "clone a Nedap tag to a T55x7, Q5/T5555 or EM4305/4469 tag.", "notes": [ "lf nedap clone --st 1 --cc 101 --id 1337" ], "offline": false, "options": [ "-h, --help This help", "--st optional - sub type (default 5)", "--cc customer code (0-4095)", "--id ID (0-99999)", "-l, --long optional - long (128), default to short (64)", "--q5 optional - specify writing to Q5/T5555 tag", "--em optional - specify writing to EM4305/4469 tag" ], "usage": "lf nedap clone [-hl] [--st ] --cc --id [--q5] [--em]" }, "lf nedap demod": { "command": "lf nedap demod", "description": "Try to find Nedap preamble, if found decode / descramble data", "notes": [ "lf nedap demod" ], "offline": true, "options": [ "-h, --help This help" ], "usage": "lf nedap demod [-h]" }, "lf nedap reader": { "command": "lf nedap reader", "description": "read a Nedap tag", "notes": [ "lf nedap reader -@ -> continuous reader mode" ], "offline": false, "options": [ "-h, --help This help", "-@ optional - continuous reader mode" ], "usage": "lf nedap reader [-h@]" }, "lf nedap sim": { "command": "lf nedap sim", "description": "Enables simulation of NEDAP card with specified card number. Simulation runs until the button is pressed or another USB command is issued.", "notes": [ "lf nedap sim --st 1 --cc 101 --id 1337" ], "offline": false, "options": [ "-h, --help This help", "--st optional - sub type (default 5)", "--cc customer code (0-4095)", "--id ID (0-99999)", "-l, --long optional - long (128), default to short (64)" ], "usage": "lf nedap sim [-hl] [--st ] --cc --id " }, "lf nexwatch clone": { "command": "lf nexwatch clone", "description": "clone a Nexwatch tag to a T55x7, Q5/T5555 or EM4305/4469 tag. You can use raw hex values or create a credential based on id, mode and type of credential (Nexkey / Quadrakey / Russian)", "notes": [ "lf nexwatch clone --raw 5600000000213C9F8F150C00", "lf nexwatch clone --cn 521512301 -m 1 --nc -> Nexkey credential", "lf nexwatch clone --cn 521512301 -m 1 --qc -> Quadrakey credential", "lf nexwatch clone --cn 521512301 -m 1 --hc -> Honeywell credential" ], "offline": false, "options": [ "-h, --help This help", "-r, --raw raw hex data. 12 bytes", "--cn card id", "-m, --mode mode (decimal) (0-15, defaults to 1)", "--nc Nexkey credential", "--qc Quadrakey credential", "--hc Honeywell credential", "--q5 optional - specify writing to Q5/T5555 tag", "--em optional - specify writing to EM4305/4469 tag", "--magic optional - magic hex data. 1 byte", "--psk2 optional - specify writing a tag in psk2 modulation" ], "usage": "lf nexwatch clone [-h] [-r ] [--cn ] [-m ] [--nc] [--qc] [--hc] [--q5] [--em] [--magic ] [--psk2]" }, "lf nexwatch demod": { "command": "lf nexwatch demod", "description": "Try to find Nexwatch preamble, if found decode / descramble data", "notes": [ "lf nexwatch demod" ], "offline": true, "options": [ "-h, --help This help" ], "usage": "lf nexwatch demod [-h]" }, "lf nexwatch reader": { "command": "lf nexwatch reader", "description": "read a Nexwatch tag", "notes": [ "lf nexwatch reader -@ -> continuous reader mode" ], "offline": false, "options": [ "-h, --help This help", "-@ optional - continuous reader mode" ], "usage": "lf nexwatch reader [-h@]" }, "lf nexwatch sim": { "command": "lf nexwatch sim", "description": "Enables simulation of secura card with specified card number. Simulation runs until the button is pressed or another USB command is issued. You can use raw hex values or create a credential based on id, mode and type of credential (Nexkey/Quadrakey)", "notes": [ "lf nexwatch sim --raw 5600000000213C9F8F150C00", "lf nexwatch sim --cn 521512301 -m 1 --nc -> Nexkey credential", "lf nexwatch sim --cn 521512301 -m 1 --qc -> Quadrakey credential", "lf nexwatch sim --cn 521512301 -m 1 --hc -> Honeywell credential" ], "offline": false, "options": [ "-h, --help This help", "-r, --raw raw hex data. 12 bytes", "--cn card id", "-m, --mode mode (decimal) (0-15, defaults to 1)", "--nc Nexkey credential", "--qc Quadrakey credential", "--hc Honeywell credential", "--magic optional - magic hex data. 1 byte", "--psk2 optional - specify writing a tag in psk2 modulation" ], "usage": "lf nexwatch sim [-h] [-r ] [--cn ] [-m ] [--nc] [--qc] [--hc] [--magic ] [--psk2]" }, "lf noralsy clone": { "command": "lf noralsy clone", "description": "clone a Noralsy tag to a T55x7, Q5/T5555 or EM4305/4469 tag.", "notes": [ "lf noralsy clone --cn 112233 -> encode for T55x7 tag", "lf noralsy clone --cn 112233 --q5 -> encode for Q5/T5555 tag", "lf noralsy clone --cn 112233 --em -> encode for EM4305/4469" ], "offline": false, "options": [ "-h, --help This help", "--cn Noralsy card ID", "-y, --year tag allocation year", "--q5 optional - specify writing to Q5/T5555 tag", "--em optional - specify writing to EM4305/4469 tag" ], "usage": "lf noralsy clone [-h] --cn [-y ] [--q5] [--em]" }, "lf noralsy demod": { "command": "lf noralsy demod", "description": "Try to find Noralsy preamble, if found decode / descramble data", "notes": [ "lf noralsy demod" ], "offline": true, "options": [ "-h, --help This help" ], "usage": "lf noralsy demod [-h]" }, "lf noralsy reader": { "command": "lf noralsy reader", "description": "read a Noralsy tag", "notes": [ "lf noralsy reader -@ -> continuous reader mode" ], "offline": false, "options": [ "-h, --help This help", "-@ optional - continuous reader mode" ], "usage": "lf noralsy reader [-h@]" }, "lf noralsy sim": { "command": "lf noralsy sim", "description": "Enables simulation of Noralsy card with specified card number. Simulation runs until the button is pressed or another USB command is issued.", "notes": [ "lf noralsy sim --cn 1337", "lf noralsy sim --cn 1337 --year 2010" ], "offline": false, "options": [ "-h, --help This help", "--cn Noralsy card ID", "-y, --year tag allocation year" ], "usage": "lf noralsy sim [-h] --cn [-y ]" }, "lf pac clone": { "command": "lf pac clone", "description": "clone a PAC/Stanley tag to a T55x7, Q5/T5555 or EM4305/4469 tag.", "notes": [ "lf pac clone --cn CD4F5552 -> encode for T55x7 tag", "lf pac clone --cn CD4F5552 --q5 -> encode for Q5/T5555 tag", "lf pac clone --cn CD4F5552 --em -> encode for EM4305/4469", "lf pac clone --raw FF2049906D8511C593155B56D5B2649F -> encode for T55x7 tag, raw mode" ], "offline": false, "options": [ "-h, --help This help", "--cn 8 byte PAC/Stanley card ID", "-r, --raw raw hex data. 16 bytes max", "--q5 optional - specify writing to Q5/T5555 tag", "--em optional - specify writing to EM4305/4469 tag" ], "usage": "lf pac clone [-h] [--cn ] [-r ] [--q5] [--em]" }, "lf pac demod": { "command": "lf pac demod", "description": "Try to find PAC/Stanley preamble, if found decode / descramble data", "notes": [ "lf pac demod" ], "offline": true, "options": [ "-h, --help This help" ], "usage": "lf pac demod [-h]" }, "lf pac reader": { "command": "lf pac reader", "description": "read a PAC/Stanley tag", "notes": [ "lf pac reader -@ -> continuous reader mode" ], "offline": false, "options": [ "-h, --help This help", "-@ optional - continuous reader mode" ], "usage": "lf pac reader [-h@]" }, "lf pac sim": { "command": "lf pac sim", "description": "Enables simulation of PAC/Stanley card with specified card number. Simulation runs until the button is pressed or another USB command is issued. The card ID is 8 byte number. Larger values are truncated.", "notes": [ "lf pac sim --cn CD4F5552", "lf pac sim --raw FF2049906D8511C593155B56D5B2649F" ], "offline": false, "options": [ "-h, --help This help", "--cn 8 byte PAC/Stanley card ID", "-r, --raw raw hex data. 16 bytes max" ], "usage": "lf pac sim [-h] [--cn ] [-r ]" }, "lf paradox clone": { "command": "lf paradox clone", "description": "clone a paradox tag to a T55x7, Q5/T5555 or EM4305/4469 tag.", "notes": [ "lf paradox clone --fc 96 --cn 40426 -> encode for T55x7 tag with fc and cn", "lf paradox clone --raw 0f55555695596a6a9999a59a -> encode for T55x7 tag", "lf paradox clone --raw 0f55555695596a6a9999a59a --q5 -> encode for Q5/T5555 tag", "lf paradox clone --raw 0f55555695596a6a9999a59a --em -> encode for EM4305/4469" ], "offline": false, "options": [ "-h, --help This help", "-r, --raw raw hex data. 12 bytes max", "--fc facility code", "--cn card number", "--q5 optional - specify writing to Q5/T5555 tag", "--em optional - specify writing to EM4305/4469 tag" ], "usage": "lf paradox clone [-h] [-r ] [--fc ] [--cn ] [--q5] [--em]" }, "lf paradox demod": { "command": "lf paradox demod", "description": "Try to find Paradox preamble, if found decode / descramble data", "notes": [ "lf paradox demod --old -> Display previous checksum version" ], "offline": true, "options": [ "-h, --help This help", "--old optional - Display previous checksum version" ], "usage": "lf paradox demod [-h] [--old]" }, "lf paradox reader": { "command": "lf paradox reader", "description": "read a Paradox tag", "notes": [ "lf paradox reader -@ -> continuous reader mode", "lf paradox reader --old -> Display previous checksum version" ], "offline": false, "options": [ "-h, --help This help", "-@ optional - continuous reader mode", "--old optional - Display previous checksum version" ], "usage": "lf paradox reader [-h@] [--old]" }, "lf paradox sim": { "command": "lf paradox sim", "description": "Enables simulation of paradox card with specified card number. Simulation runs until the button is pressed or another USB command is issued.", "notes": [ "lf paradox sim --raw 0f55555695596a6a9999a59a -> simulate tag", "lf paradox sim --fc 96 --cn 40426 -> simulate tag with fc and cn" ], "offline": false, "options": [ "-h, --help This help", "-r, --raw raw hex data. 12 bytes", "--fc facility code", "--cn card number" ], "usage": "lf paradox sim [-h] [-r ] [--fc ] [--cn ]" }, "lf pcf7931 config": { "command": "lf pcf7931 config", "description": "This command tries to set the configuration used with PCF7931 commands The time offsets could be useful to correct slew rate generated by the antenna Caling without some parameter will print the current configuration.", "notes": [ "lf pcf7931 config --reset", "lf pcf7931 config --pwd 11223344556677 -d 20000", "lf pcf7931 config --pwd 11223344556677 -d 17500 --lw -10 --lp 30" ], "offline": true, "options": [ "-h, --help This help", "-r, --reset Reset configuration to default values", "-p, --pwd Password, 7bytes, LSB-order", "-d, --delay Tag initialization delay (in us)", "--lw offset, low pulses width (in us)", "--lp offset, low pulses position (in us)" ], "usage": "lf pcf7931 config [-hr] [-p ] [-d ] [--lw ] [--lp ]" }, "lf pcf7931 reader": { "command": "lf pcf7931 reader", "description": "read a PCF7931 tag", "notes": [ "lf pcf7931 reader -@ -> continuous reader mode" ], "offline": false, "options": [ "-h, --help This help", "-@ optional - continuous reader mode" ], "usage": "lf pcf7931 reader [-h@]" }, "lf pcf7931 write": { "command": "lf pcf7931 write", "description": "This command tries to write a PCF7931 tag.", "notes": [ "lf pcf7931 write --blk 2 --idx 1 -d FF -> Write 0xFF to block 2, index 1" ], "offline": false, "options": [ "-h, --help This help", "-b, --blk [0-7] block number", "-i, --idx [0-15] index of byte inside block", "-d, --data one byte to be written" ], "usage": "lf pcf7931 write [-h] -b -i -d " }, "lf presco clone": { "command": "lf presco clone", "description": "clone a presco tag to a T55x7, Q5/T5555 or EM4305/4469 tag.", "notes": [ "lf presco clone -d 018363467 -> encode for T55x7 tag", "lf presco clone -d 018363467 --q5 -> encode for Q5/T5555 tag", "lf presco clone -d 018363467 --em -> encode for EM4305/4469" ], "offline": false, "options": [ "-h, --help This help", "-c 8 digit hex card number", "-d 9 digit presco card ID", "--q5 optional - specify writing to Q5/T5555 tag", "--em optional - specify writing to EM4305/4469 tag" ], "usage": "lf presco clone [-h] [-c ] [-d ] [--q5] [--em]" }, "lf presco demod": { "command": "lf presco demod", "description": "Try to find presco preamble, if found decode / descramble data", "notes": [ "lf presco demod" ], "offline": true, "options": [ "-h, --help This help" ], "usage": "lf presco demod [-h]" }, "lf presco reader": { "command": "lf presco reader", "description": "read a presco tag", "notes": [ "lf presco reader -@ -> continuous reader mode" ], "offline": false, "options": [ "-h, --help This help", "-@ optional - continuous reader mode" ], "usage": "lf presco reader [-h@]" }, "lf presco sim": { "command": "lf presco sim", "description": "Enables simulation of presco card with specified card number. Simulation runs until the button is pressed or another USB command is issued. Per presco format, the card number is 9 digit number and can contain *# chars. Larger values are truncated.", "notes": [ "lf presco sim -d 018363467" ], "offline": false, "options": [ "-h, --help This help", "-c 8 digit hex card number", "-d 9 digit presco card ID" ], "usage": "lf presco sim [-h] [-c ] [-d ]" }, "lf pyramid clone": { "command": "lf pyramid clone", "description": "clone a Farpointe/Pyramid tag to a T55x7, Q5/T5555 or EM4305/4469 tag. The facility-code is 8-bit and the card number is 16-bit. Larger values are truncated. Currently only works on 26bit", "notes": [ "lf pyramid clone --fc 123 --cn 11223 -> encode for T55x7 tag", "lf pyramid clone --raw 0001010101010101010440013223921c -> idem, raw mode", "lf pyramid clone --fc 123 --cn 11223 --q5 -> encode for Q5/T5555 tag", "lf pyramid clone --fc 123 --cn 11223 --em -> encode for EM4305/4469" ], "offline": false, "options": [ "-h, --help This help", "--fc 8-bit value facility code", "--cn 16-bit value card number", "--q5 optional - specify writing to Q5/T5555 tag", "--em optional - specify writing to EM4305/4469 tag", "-r, --raw raw hex data. 16 bytes" ], "usage": "lf pyramid clone [-h] [--fc ] [--cn ] [--q5] [--em] [-r ]" }, "lf pyramid demod": { "command": "lf pyramid demod", "description": "Try to find Farpoint/Pyramid preamble, if found decode / descramble data", "notes": [ "lf pyramid demod" ], "offline": true, "options": [ "-h, --help This help" ], "usage": "lf pyramid demod [-h]" }, "lf pyramid reader": { "command": "lf pyramid reader", "description": "read a Farpointe/Pyramid tag", "notes": [ "lf pyramid reader -@ -> continuous reader mode" ], "offline": false, "options": [ "-h, --help This help", "-@ optional - continuous reader mode" ], "usage": "lf pyramid reader [-h@]" }, "lf pyramid sim": { "command": "lf pyramid sim", "description": "Enables simulation of Farpointe/Pyramid card with specified card number. Simulation runs until the button is pressed or another USB command is issued. The facility-code is 8-bit and the card number is 16-bit. Larger values are truncated. Currently work only on 26bit", "notes": [ "lf pyramid sim --fc 123 --cn 1337", "lf pyramid clone --raw 0001010101010101010440013223921c" ], "offline": false, "options": [ "-h, --help This help", "--fc 8-bit value facility code", "--cn 16-bit value card number", "-r, --raw raw hex data. 16 bytes" ], "usage": "lf pyramid sim [-h] [--fc ] [--cn ] [-r ]" }, "lf read": { "command": "lf read", "description": "Sniff low frequency signal. - use `lf config` to set parameters. - use `data plot` to look at it", "notes": [ "lf read -v -s 12000 -> collect 12000 samples", "lf read -s 3000 -@ -> oscilloscope style" ], "offline": false, "options": [ "-h, --help This help", "-s, --samples number of samples to collect", "-v, --verbose verbose output", "-@ continuous reading mode" ], "usage": "lf read [-hv@] [-s ]" }, "lf search": { "command": "lf search", "description": "Read and search for valid known tag. For offline mode, you can `data load` first then search.", "notes": [ "lf search -> try reading data from tag & search for known tag", "lf search -1 -> use data from the GraphBuffer & search for known tag", "lf search -u -> try reading data from tag & search for known and unknown tag", "lf search -1u -> use data from the GraphBuffer & search for known and unknown tag" ], "offline": true, "options": [ "-h, --help This help", "-1 Use data from Graphbuffer to search", "-c Continue searching even after a first hit", "-u Search for unknown tags. If not set, reads only known tags" ], "usage": "lf search [-h1cu]" }, "lf securakey clone": { "command": "lf securakey clone", "description": "clone a Securakey tag to a T55x7, Q5/T5555 or EM4305/4469 tag.", "notes": [ "lf securakey clone --raw 7FCB400001ADEA5344300000 -> encode for T55x7 tag", "lf securakey clone --raw 7FCB400001ADEA5344300000 --q5 -> encode for Q5/T5555 tag", "lf securakey clone --raw 7FCB400001ADEA5344300000 --em -> encode for EM4305/4469" ], "offline": false, "options": [ "-h, --help This help", "-r, --raw raw hex data. 12 bytes", "--q5 optional - specify writing to Q5/T5555 tag", "--em optional - specify writing to EM4305/4469 tag" ], "usage": "lf securakey clone [-h] -r [--q5] [--em]" }, "lf securakey demod": { "command": "lf securakey demod", "description": "Try to find Securakey preamble, if found decode / descramble data", "notes": [ "lf securakey demod" ], "offline": true, "options": [ "-h, --help This help" ], "usage": "lf securakey demod [-h]" }, "lf securakey reader": { "command": "lf securakey reader", "description": "read a Securakey tag", "notes": [ "lf securakey reader -@ -> continuous reader mode" ], "offline": false, "options": [ "-h, --help This help", "-@ optional - continuous reader mode" ], "usage": "lf securakey reader [-h@]" }, "lf securakey sim": { "command": "lf securakey sim", "description": "Enables simulation of secura card with specified card number. Simulation runs until the button is pressed or another USB command is issued.", "notes": [ "lf securakey sim --raw 7FCB400001ADEA5344300000" ], "offline": false, "options": [ "-h, --help This help", "-r, --raw raw hex data. 12 bytes" ], "usage": "lf securakey sim [-h] [-r ]" }, "lf sim": { "command": "lf sim", "description": "Simulate low frequency tag from graphbuffer Use `lf config` to set parameters", "notes": [ "lf sim", "lf sim --gap 240 -> start simulating with 240ms gap" ], "offline": false, "options": [ "-h, --help This help", "-g, --gap start gap in microseconds" ], "usage": "lf sim [-h] [-g ]" }, "lf simask": { "command": "lf simask", "description": "Simulate ASK tag from DemodBuffer or input", "notes": [ "lf simask --clk 32 --am -d 0102030405 -> simulate ASK/MAN rf/32", "lf simask --clk 32 --bi -d 0102030405 -> simulate ASK/BIPHASE rf/32", "", "lf simask --clk 64 --am -d ffbd8001686f1924 -> simulate a EM410x tag", "lf simask --clk 64 --am --stt -d 5649533200003F340000001B -> simulate a VISA2K tag" ], "offline": false, "options": [ "-h, --help This help", "-i, --inv invert data", "-c, --clk manually set clock - can autodetect if using DemodBuffer (default 64)", "--bi ask/biphase encoding", "--am ask/manchester encoding (default)", "--ar ask/raw encoding", "--stt add t55xx Sequence Terminator gap - default: no gaps (only manchester)", "-d, --data data to sim - omit to use DemodBuffer", "-v, --verbose verbose output" ], "usage": "lf simask [-hiv] [-c ] [--bi] [--am] [--ar] [--stt] [-d ]" }, "lf simbidir": { "command": "lf simbidir", "description": "Simulate LF tag with bidirectional data transmission between reader and tag", "notes": [ "lf simbidir" ], "offline": false, "options": [ "-h, --help This help" ], "usage": "lf simbidir [-h]" }, "lf simfsk": { "command": "lf simfsk", "description": "Simulate FSK tag from DemodBuffer or input. There are about four FSK modulations to know of. FSK1 - where fc/8 = high and fc/5 = low FSK1a - is inverted FSK1, ie: fc/5 = high and fc/8 = low FSK2 - where fc/10 = high and fc/8 = low FSK2a - is inverted FSK2, ie: fc/10 = high and fc/8 = low NOTE: if you set one clock manually set them all manually", "notes": [ "lf simfsk -c 40 --high 8 --low 5 -d 010203 -> FSK1 rf/40 data 010203", "lf simfsk -c 40 --high 5 --low 8 -d 010203 -> FSK1a rf/40 data 010203", "lf simfsk -c 64 --high 10 --low 8 -d 010203 -> FSK2 rf/64 data 010203", "lf simfsk -c 64 --high 8 --low 10 -d 010203 -> FSK2a rf/64 data 010203", "", "lf simfsk -c 50 --high 10 --low 8 -d 1D5559555569A9A555A59569 -> simulate HID Prox tag manually", "lf simfsk -c 50 --high 10 --low 8 --stt -d 011DB2487E8D811111111111 -> simulate AWID tag manually" ], "offline": false, "options": [ "-h, --help This help", "-c, --clk manually set clock - can autodetect if using DemodBuffer (default 64)", "--low manually set larger Field Clock", "--high manually set smaller Field Clock", "--stt TBD! - STT to enable a gap between playback repetitions (default: no gap)", "-d, --data data to sim - omit to use DemodBuffer", "-v, --verbose verbose output" ], "usage": "lf simfsk [-hv] [-c ] [--low ] [--high ] [--stt] [-d ]" }, "lf simpsk": { "command": "lf simpsk", "description": "Simulate PSK tag from DemodBuffer or input", "notes": [ "lf simpsk -1 --clk 40 --fc 4 -d 01020304 -> simulate PSK1 rf/40 psksub fc/4, data 01020304", "", "lf simpsk -1 --clk 32 --fc 2 -d a0000000bd989a11 -> simulate a indala tag manually" ], "offline": false, "options": [ "-h, --help This help", "-1, --psk1 set PSK1 (default)", "-2, --psk2 set PSK2", "-3, --psk3 set PSK3", "-i, --inv invert data", "-c, --clk manually set clock - can autodetect if using DemodBuffer (default 32)", "--fc 2|4|8 are valid carriers (default 2)", "-d, --data data to sim - omit to use DemodBuffer", "-v, --verbose verbose output" ], "usage": "lf simpsk [-h123iv] [-c ] [--fc ] [-d ]" }, "lf sniff": { "command": "lf sniff", "description": "Sniff low frequency signal. You need to configure the LF part on the Proxmark3 device manually. Usually a trigger and skip samples is a good thing to set before doing a low frequency sniff. - use `lf config` to set parameters. - use `data plot` to look at sniff signal. - use `lf search -1` to see if signal can be automatic decoded", "notes": [ "lf sniff -v", "lf sniff -s 3000 -@ -> oscilloscope style" ], "offline": false, "options": [ "-h, --help This help", "-s, --samples number of samples to collect", "-v, --verbose verbose output", "-@ continuous sniffing mode" ], "usage": "lf sniff [-hv@] [-s ]" }, "lf t55xx bruteforce": { "command": "lf t55xx bruteforce", "description": "This command uses bruteforce to scan a number range. Try reading Page 0, block 7 before. WARNING this may brick non-password protected chips!", "notes": [ "lf t55xx bruteforce --r2 -s aaaaaa77 -e aaaaaa99" ], "offline": false, "options": [ "-h, --help This help", "-s, --start search start password (4 hex bytes)", "-e, --end search end password (4 hex bytes)", "--r0 downlink - fixed bit length", "--r1 downlink - long leading reference", "--r2 downlink - leading zero", "--r3 downlink - 1 of 4 coding reference", "--all try all downlink modes (def)" ], "usage": "lf t55xx bruteforce [-h] -s -e [--r0] [--r1] [--r2] [--r3] [--all]" }, "lf t55xx chk": { "command": "lf t55xx chk", "description": "This command uses a dictionary attack. For some cloners, try '--em' for known pwdgen algo. Try to reading Page 0 block 7 before. WARNING: this may brick non-password protected chips!", "notes": [ "lf t55xx chk -m -> use dictionary from flash memory (RDV4)", "lf t55xx chk -f my_dictionary_pwds -> loads a default keys dictionary file", "lf t55xx chk --em aa11223344 -> try known pwdgen algo from some cloners based on EM4100 ID" ], "offline": false, "options": [ "-h, --help This help", "-m, --fm use dictionary from flash memory (RDV4)", "-f, --file file name", "--em EM4100 ID (5 hex bytes)", "--r0 downlink - fixed bit length", "--r1 downlink - long leading reference", "--r2 downlink - leading zero", "--r3 downlink - 1 of 4 coding reference", "--all try all downlink modes (def)" ], "usage": "lf t55xx chk [-hm] [-f ] [--em ] [--r0] [--r1] [--r2] [--r3] [--all]" }, "lf t55xx clonehelp": { "command": "lf t55xx clonehelp", "description": "Display a list of available commands for cloning specific techs on T5xx tags", "notes": [ "lf t55xx clonehelp" ], "offline": false, "options": [ "-h, --help This help" ], "usage": "lf t55xx clonehelp [-h]" }, "lf t55xx config": { "command": "lf t55xx config", "description": "Set/Get T55XX configuration of the pm3 client. Like modulation, inverted, offset, rate etc. Offset is start position to decode data.", "notes": [ "lf t55xx config --FSK -> FSK demodulation", "lf t55xx config --FSK -i -> FSK demodulation, inverse data", "lf t55xx config --FSK -i -o 3 -> FSK demodulation, inverse data, offset 3" ], "offline": true, "options": [ "-h, --help This help", "--FSK set demodulation FSK", "--FSK1 set demodulation FSK 1", "--FSK1A set demodulation FSK 1a (inv)", "--FSK2 set demodulation FSK 2", "--FSK2A set demodulation FSK 2a (inv)", "--ASK set demodulation ASK", "--PSK1 set demodulation PSK 1", "--PSK2 set demodulation PSK 2", "--PSK3 set demodulation PSK 3", "--NRZ set demodulation NRZ", "--BI set demodulation Biphase", "--BIA set demodulation Diphase (inverted biphase)", "-i, --inv set/reset data signal inversion", "--q5 set/reset as Q5/T5555 chip instead of T55x7", "--st set/reset Sequence Terminator on", "--rate set bitrate <8|16|32|40|50|64|100|128>", "-c, --blk0 set configuration from a block0 (4 hex bytes)", "-o, --offset <0-255> set offset, where data should start decode in bitstream", "--r0 downlink - fixed bit length (detected def)", "--r1 downlink - long leading reference", "--r2 downlink - leading zero", "--r3 downlink - 1 of 4 coding reference" ], "usage": "lf t55xx config [-hi] [--FSK] [--FSK1] [--FSK1A] [--FSK2] [--FSK2A] [--ASK] [--PSK1] [--PSK2] [--PSK3] [--NRZ] [--BI] [--BIA] [--q5] [--st] [--rate ] [-c ] [-o <0-255>] [--r0] [--r1] [--r2] [--r3]" }, "lf t55xx dangerraw": { "command": "lf t55xx dangerraw", "description": "This command allows to emit arbitrary raw commands on T5577 and cut the field after arbitrary duration. Uncontrolled usage can easily write an invalid configuration, activate lock bits, OTP bit, password protection bit, deactivate test-mode, lock your card forever. WARNING: this may lock definitively the tag in an unusable state!", "notes": [ "lf t55xx dangerraw -d 01000000000000010000100000000100000000 -t 3200" ], "offline": false, "options": [ "-h, --help This help", "-d, --data raw bit string", "-t, --time <0 - 200000> time in microseconds before dropping the field" ], "usage": "lf t55xx dangerraw [-h] -d -t " }, "lf t55xx detect": { "command": "lf t55xx detect", "description": "Try detecting the tag modulation from reading the configuration block", "notes": [ "lf t55xx detect", "lf t55xx detect -1", "lf t55xx detect -p 11223344" ], "offline": true, "options": [ "-h, --help This help", "-1 extract using data from graphbuffer", "-p, --pwd password (4 hex bytes)", "--r0 downlink - fixed bit length (detected def)", "--r1 downlink - long leading reference", "--r2 downlink - leading zero", "--r3 downlink - 1 of 4 coding reference", "--all try all downlink modes" ], "usage": "lf t55xx detect [-h1] [-p ] [--r0] [--r1] [--r2] [--r3] [--all]" }, "lf t55xx deviceconfig": { "command": "lf t55xx deviceconfig", "description": "Sets t55x7 timings for direct commands. The timings are set here in Field Clocks (FC) which is converted to (US) on device.", "notes": [ "lf t55xx deviceconfig -a 29 -b 17 -c 15 -d 47 -e 15 -> default T55XX", "lf t55xx deviceconfig -a 55 -b 14 -c 21 -d 30 -> default EM4305" ], "offline": false, "options": [ "-h, --help This help", "-a <8..255> Set start gap", "-b <8..255> Set write gap", "-c <8..255> Set write ZERO gap", "-d <8..255> Set write ONE gap", "-e <8..255> Set read gap", "-f <8..255> Set write TWO gap (1 of 4 only)", "-g <8..255> Set write THREE gap (1 of 4 only)", "-p, --persist persist to flash memory (RDV4)", "-z Set default t55x7 timings (use `-p` to save if required)", "--r0 downlink - fixed bit length (detected def)", "--r1 downlink - long leading reference", "--r2 downlink - leading zero", "--r3 downlink - 1 of 4 coding reference" ], "usage": "lf t55xx deviceconfig [-hpz] [-a <8..255>] [-b <8..255>] [-c <8..255>] [-d <8..255>] [-e <8..255>] [-f <8..255>] [-g <8..255>] [--r0] [--r1] [--r2] [--r3]" }, "lf t55xx dump": { "command": "lf t55xx dump", "description": "This command dumps a T55xx card Page 0 block 0-7. It will create two files (bin/json)", "notes": [ "lf t55xx dump", "lf t55xx dump -p aabbccdd --override", "lf t55xx dump -f my_lf_dump" ], "offline": false, "options": [ "-h, --help This help", "-f, --file filename (default is generated on blk 0)", "-o, --override override, force pwd read despite danger to card", "-p, --pwd password (4 hex bytes)", "--ns no save", "--r0 downlink - fixed bit length", "--r1 downlink - long leading reference", "--r2 downlink - leading zero", "--r3 downlink - 1 of 4 coding reference" ], "usage": "lf t55xx dump [-ho] [-f ] [-p ] [--ns] [--r0] [--r1] [--r2] [--r3]" }, "lf t55xx info": { "command": "lf t55xx info", "description": "Show T55x7 configuration data (page 0/ blk 0) from reading the configuration block from tag. Use `-c` to specify a config block data to be used instead of reading tag.", "notes": [ "lf t55xx info", "lf t55xx info -1", "lf t55xx info -p 11223344", "lf t55xx info -c 00083040", "lf t55xx info -c 6001805A --q5" ], "offline": true, "options": [ "-h, --help This help", "-1 extract using data from graphbuffer", "-p, --pwd password (4 hex bytes)", "-c, --blk0 use these data instead (4 hex bytes)", "--q5 interprete provided data as T5555/Q5 config", "--r0 downlink - fixed bit length (detected def)", "--r1 downlink - long leading reference", "--r2 downlink - leading zero", "--r3 downlink - 1 of 4 coding reference" ], "usage": "lf t55xx info [-h1] [-p ] [-c ] [--q5] [--r0] [--r1] [--r2] [--r3]" }, "lf t55xx p1detect": { "command": "lf t55xx p1detect", "description": "Detect Page 1 of a T55xx chip", "notes": [ "lf t55xx p1detect", "lf t55xx p1detect -1", "lf t55xx p1detect -p 11223344 --r3" ], "offline": false, "options": [ "-h, --help This help", "-1 extract using data from graphbuffer", "-p, --pwd password (4 hex bytes)", "--r0 downlink - fixed bit length (detected def)", "--r1 downlink - long leading reference", "--r2 downlink - leading zero", "--r3 downlink - 1 of 4 coding reference" ], "usage": "lf t55xx p1detect [-h1] [-p ] [--r0] [--r1] [--r2] [--r3]" }, "lf t55xx protect": { "command": "lf t55xx protect", "description": "This command sets the pwd bit on T5577. WARNING this locks the tag!", "notes": [ "lf t55xx protect -n 01020304 -> sets new pwd 01020304", "lf t55xx protect -p 11223344 -n 00000000 -> use pwd 11223344, sets new pwd 00000000" ], "offline": false, "options": [ "-h, --help This help", "-o, --override override safety check", "-p, --pwd password (4 hex bytes)", "-n, --new new password (4 hex bytes)", "--r0 downlink - fixed bit length (detected def)", "--r1 downlink - long leading reference", "--r2 downlink - leading zero", "--r3 downlink - 1 of 4 coding reference" ], "usage": "lf t55xx protect [-ho] [-p ] -n [--r0] [--r1] [--r2] [--r3]" }, "lf t55xx read": { "command": "lf t55xx read", "description": "Read T55xx block data. This commands defaults to page 0. * * * WARNING * * * Use of read with password on a tag not configured for a password can damage the tag * * * * * * * * * *", "notes": [ "lf t55xx read -b 0 -> read data from block 0", "lf t55xx read -b 0 --pwd 01020304 -> read data from block 0, pwd 01020304", "lf t55xx read -b 0 --pwd 01020304 -o -> read data from block 0, pwd 01020304, override" ], "offline": false, "options": [ "-h, --help This help", "-b, --blk <0-7> block number to read", "-p, --pwd password (4 hex bytes)", "-o, --override override safety check", "--pg1 read page 1", "--r0 downlink - fixed bit length (detected def)", "--r1 downlink - long leading reference", "--r2 downlink - leading zero", "--r3 downlink - 1 of 4 coding reference" ], "usage": "lf t55xx read [-ho] -b <0-7> [-p ] [--pg1] [--r0] [--r1] [--r2] [--r3]" }, "lf t55xx recoverpw": { "command": "lf t55xx recoverpw", "description": "This command uses a few tricks to try to recover mangled password. Try reading Page 0, block 7 before. WARNING this may brick non-password protected chips!", "notes": [ "lf t55xx recoverpw", "lf t55xx recoverpw -p 11223344", "lf t55xx recoverpw -p 11223344 --r3" ], "offline": false, "options": [ "-h, --help This help", "-p, --pwd password (4 hex bytes)", "--r0 downlink - fixed bit length", "--r1 downlink - long leading reference", "--r2 downlink - leading zero", "--r3 downlink - 1 of 4 coding reference", "--all try all downlink modes (def)" ], "usage": "lf t55xx recoverpw [-h] [-p ] [--r0] [--r1] [--r2] [--r3] [--all]" }, "lf t55xx resetread": { "command": "lf t55xx resetread", "description": "Send Reset Cmd then `lf read` the stream to attempt to identify the start of it (needs a demod and/or plot after)", "notes": [ "lf t55xx resetread" ], "offline": false, "options": [ "-h, --help This help", "-1 extract using data from graphbuffer", "--r0 downlink - fixed bit length (detected def)", "--r1 downlink - long leading reference", "--r2 downlink - leading zero", "--r3 downlink - 1 of 4 coding reference" ], "usage": "lf t55xx resetread [-h1] [--r0] [--r1] [--r2] [--r3]" }, "lf t55xx restore": { "command": "lf t55xx restore", "description": "Restore T55xx card page 0/1 n blocks from (bin/eml/json) dump file", "notes": [ "lf t55xx restore -f lf-t55xx-00148040-dump.bin" ], "offline": false, "options": [ "-h, --help This help", "-f, --file Specify a filename for dump file", "-p, --pwd password if target card has password set (4 hex bytes)" ], "usage": "lf t55xx restore [-h] [-f ] [-p ]" }, "lf t55xx sniff": { "command": "lf t55xx sniff", "description": "Sniff LF t55xx based trafic and decode possible cmd / blocks. Lower tolerance means tighter pulses.", "notes": [ "lf t55xx sniff", "lf t55xx sniff -1 -t 2 -> use buffer with tolerance of 2", "lf t55xx sniff -1 --zero 7 --one 14 -> use buffer, zero pulse width 7, one pulse width 15" ], "offline": true, "options": [ "-h, --help This help", "-1 extract using data from graphbuffer", "-t, --tol set tolerance level (default 5)", "-o, --one set samples width for ONE pulse (default auto)", "-z, --zero set samples width for ZERO pulse (default auto)" ], "usage": "lf t55xx sniff [-h1] [-t ] [-o ] [-z ]" }, "lf t55xx special": { "command": "lf t55xx special", "description": "Show block changes with 64 different offsets, data taken from DemodBuffer.", "notes": [ "lf t55xx special" ], "offline": false, "options": [ "-h, --help This help" ], "usage": "lf t55xx special [-h]" }, "lf t55xx trace": { "command": "lf t55xx trace", "description": "Show T55x7 configuration data (page 0/ blk 0) from reading the configuration block", "notes": [ "lf t55xx trace", "lf t55xx trace -1" ], "offline": true, "options": [ "-h, --help This help", "-1 extract using data from graphbuffer", "--r0 downlink - fixed bit length (detected def)", "--r1 downlink - long leading reference", "--r2 downlink - leading zero", "--r3 downlink - 1 of 4 coding reference" ], "usage": "lf t55xx trace [-h1] [--r0] [--r1] [--r2] [--r3]" }, "lf t55xx wakeup": { "command": "lf t55xx wakeup", "description": "This commands sends the Answer-On-Request command and leaves the readerfield ON afterwards", "notes": [ "lf t55xx wakeup -p 11223344 -> send wakeup with password" ], "offline": false, "options": [ "-h, --help This help", "-p, --pwd password (4 hex bytes)", "-v, --verbose verbose output", "--r0 downlink - fixed bit length (detected def)", "--r1 downlink - long leading reference", "--r2 downlink - leading zero", "--r3 downlink - 1 of 4 coding reference" ], "usage": "lf t55xx wakeup [-hv] [-p ] [--r0] [--r1] [--r2] [--r3]" }, "lf t55xx wipe": { "command": "lf t55xx wipe", "description": "This commands wipes a tag, fills blocks 1-7 with zeros and a default configuration block", "notes": [ "lf t55xx wipe -> wipes a T55x7 tag, config block 0x000880E0", "lf t55xx wipe --q5 -> wipes a Q5/T5555 tag, config block 0x6001F004", "lf t55xx wipe -p 11223344 -> wipes a T55x7 tag, config block 0x000880E0, using pwd" ], "offline": false, "options": [ "-h, --help This help", "-c, --cfg configuration block0 (4 hex bytes)", "-p, --pwd password (4 hex bytes)", "--q5 specify writing to Q5/T5555 tag using dedicated config block", "--r0 downlink - fixed bit length (detected def)", "--r1 downlink - long leading reference", "--r2 downlink - leading zero", "--r3 downlink - 1 of 4 coding reference" ], "usage": "lf t55xx wipe [-h] [-c ] [-p ] [--q5] [--r0] [--r1] [--r2] [--r3]" }, "lf t55xx write": { "command": "lf t55xx write", "description": "Write T55xx block data", "notes": [ "lf t55xx write -b 3 -d 11223344 -> write 11223344 to block 3", "lf t55xx write -b 3 -d 11223344 --pwd 01020304 -> write 11223344 to block 3, pwd 01020304", "lf t55xx write -b 3 -d 11223344 --pwd 01020304 --verify -> write 11223344 to block 3 and try validating write" ], "offline": false, "options": [ "-h, --help This help", "-b, --blk <0-7> block number to write", "-d, --data data to write (4 hex bytes)", "-p, --pwd password (4 hex bytes)", "-t, --tm test mode write ( danger )", "--pg1 write page 1", "--verify try validate data afterward", "--r0 downlink - fixed bit length (detected def)", "--r1 downlink - long leading reference", "--r2 downlink - leading zero", "--r3 downlink - 1 of 4 coding reference" ], "usage": "lf t55xx write [-ht] -b <0-7> [-d ] [-p ] [--pg1] [--verify] [--r0] [--r1] [--r2] [--r3]" }, "lf ti demod": { "command": "lf ti demod", "description": "Try to find TI preamble, if found decode / descramble data", "notes": [ "lf ti demod" ], "offline": true, "options": [ "-h, --help This help" ], "usage": "lf ti demod [-h]" }, "lf ti reader": { "command": "lf ti reader", "description": "read a TI tag", "notes": [ "lf ti reader -@ -> continuous reader mode" ], "offline": false, "options": [ "-h, --help This help", "-@ optional - continuous reader mode" ], "usage": "lf ti reader [-h@]" }, "lf ti write": { "command": "lf ti write", "description": "write to a r/w TI tag.", "notes": [ "lf ti write --raw 1122334455667788", "lf ti write --raw 1122334455667788 --crc 1122" ], "offline": false, "options": [ "-h, --help This help", "-r, --raw raw hex data. 8 bytes max", "--crc optional - crc" ], "usage": "lf ti write [-h] -r [--crc ]" }, "lf tune": { "command": "lf tune", "description": "Continuously measure LF antenna tuning. Press button or to interrupt.", "notes": [ "lf tune", "lf tune --mix" ], "offline": false, "options": [ "-h, --help This help", "-n, --iter number of iterations (default: 0=infinite)", "-q, --divisor Frequency divisor. 88 -> 134 kHz, 95 -> 125 kHz", "-f, --freq Frequency in kHz", "--bar bar style", "--mix mixed style", "--value values style" ], "usage": "lf tune [-h] [-n ] [-q ] [-f ] [--bar] [--mix] [--value]" }, "lf viking clone": { "command": "lf viking clone", "description": "clone a Viking AM tag to a T55x7, Q5/T5555 or EM4305/4469 tag.", "notes": [ "lf viking clone --cn 01A337 -> encode for T55x7 tag", "lf viking clone --cn 01A337 --q5 -> encode for Q5/T5555 tag", "lf viking clone --cn 112233 --em -> encode for EM4305/4469" ], "offline": false, "options": [ "-h, --help This help", "--cn 8 digit hex viking card number", "--q5 optional - specify writing to Q5/T5555 tag", "--em optional - specify writing to EM4305/4469 tag" ], "usage": "lf viking clone [-h] --cn [--q5] [--em]" }, "lf viking demod": { "command": "lf viking demod", "description": "Try to find Viking AM preamble, if found decode / descramble data", "notes": [ "lf viking demod" ], "offline": true, "options": [ "-h, --help This help" ], "usage": "lf viking demod [-h]" }, "lf viking reader": { "command": "lf viking reader", "description": "read a Viking AM tag", "notes": [ "lf viking reader -@ -> continuous reader mode" ], "offline": false, "options": [ "-h, --help This help", "-@ optional - continuous reader mode" ], "usage": "lf viking reader [-h@]" }, "lf viking sim": { "command": "lf viking sim", "description": "Enables simulation of viking card with specified card number. Simulation runs until the button is pressed or another USB command is issued. Per viking format, the card number is 8 digit hex number. Larger values are truncated.", "notes": [ "lf viking sim --cn 01A337" ], "offline": false, "options": [ "-h, --help This help", "--cn 8 digit hex viking card number" ], "usage": "lf viking sim [-h] --cn " }, "lf visa2000 clone": { "command": "lf visa2000 clone", "description": "clone a Visa2000 tag to a T55x7, Q5/T5555 or EM4305/4469 tag.", "notes": [ "lf visa2000 clone --cn 112233 -> encode for T55x7 tag", "lf visa2000 clone --cn 112233 --q5 -> encode for Q5/T5555 tag", "lf visa2000 clone --cn 112233 --em -> encode for EM4305/4469" ], "offline": false, "options": [ "-h, --help This help", "--cn Visa2k card ID", "--q5 optional - specify writing to Q5/T5555 tag", "--em optional - specify writing to EM4305/4469 tag" ], "usage": "lf visa2000 clone [-h] --cn [--q5] [--em]" }, "lf visa2000 demod": { "command": "lf visa2000 demod", "description": "Try to find visa2000 preamble, if found decode / descramble data", "notes": [ "lf visa2000 demod" ], "offline": true, "options": [ "-h, --help This help" ], "usage": "lf visa2000 demod [-h]" }, "lf visa2000 reader": { "command": "lf visa2000 reader", "description": "read a visa2000 tag", "notes": [ "lf visa2000 reader -@ -> continuous reader mode" ], "offline": false, "options": [ "-h, --help This help", "-@ optional - continuous reader mode" ], "usage": "lf visa2000 reader [-h@]" }, "lf visa2000 sim": { "command": "lf visa2000 sim", "description": "Enables simulation of visa2k card with specified card number. Simulation runs until the button is pressed or another USB command is issued.", "notes": [ "lf visa2000 sim --cn 1337" ], "offline": false, "options": [ "-h, --help This help", "--cn Visa2k card ID" ], "usage": "lf visa2000 sim [-h] --cn " }, "mem baudrate": { "command": "mem baudrate", "description": "Set the baudrate for the SPI flash memory communications. Reading Flash ID will virtually always fail under 48MHz setting. Unless you know what you are doing, please stay at 24MHz. If >= 24MHz, FASTREADS instead of READS instruction will be used.", "notes": [ "mem baudrate --mhz 48" ], "offline": false, "options": [ "-h, --help This help", "--mhz <24|48> SPI baudrate in MHz" ], "usage": "mem baudrate [-h] --mhz <24|48>" }, "mem dump": { "command": "mem dump", "description": "Dumps flash memory on device into a file or view in console", "notes": [ "mem dump -f myfile -> download all flashmem to file", "mem dump --view -o 262015 --len 128 -> display 128 bytes from offset 262015 (RSA sig)", "mem dump --view -f myfile -o 241664 --len 58 -> display 58 bytes from offset 241664 and save to file" ], "offline": false, "options": [ "-h, --help This help", "-o, --offset offset in memory", "-l, --len length", "-v, --view view dump", "-f, --file save filename", "-c, --cols column breaks (def 32)" ], "usage": "mem dump [-hv] [-o ] [-l ] [-f ] [-c ]" }, "mem info": { "command": "mem info", "description": "Collect signature and verify it from flash memory", "notes": [ "mem info" ], "offline": false, "options": [ "-h, --help This help", "-s, --sign create a signature", "-d flash memory id, 8 hex bytes", "-p, --pem key in PEM format", "-v, --verbose verbose output" ], "usage": "mem info [-hsv] [-d ] [-p ]" }, "mem load": { "command": "mem load", "description": "Loads binary file into flash memory on device Warning: mem area to be written must have been wiped first ( this is already taken care when loading dictionaries )", "notes": [ "mem load -f myfile -> upload file myfile values at default offset 0", "mem load -f myfile -o 1024 -> upload file myfile values at offset 1024", "mem load -f mfc_default_keys -m -> upload MFC keys", "mem load -f t55xx_default_pwds -t -> upload T55XX passwords", "mem load -f iclass_default_keys -i -> upload iCLASS keys" ], "offline": false, "options": [ "-h, --help This help", "-o, --offset offset in memory", "-m, --mifare, --mfc upload 6 bytes keys (mifare key dictionary)", "-i, --iclass upload 8 bytes keys (iClass key dictionary)", "-t, --t55xx upload 4 bytes keys (password dictionary)", "-f, --file file name" ], "usage": "mem load [-hmit] [-o ] -f " }, "mem spiffs check": { "command": "mem spiffs check", "description": "Check/try to defrag faulty/fragmented SPIFFS file system", "notes": [ "mem spiffs check" ], "offline": false, "options": [ "-h, --help This help" ], "usage": "mem spiffs check [-h]" }, "mem spiffs copy": { "command": "mem spiffs copy", "description": "Copy a file to another (destructively) in SPIFFS file system", "notes": [ "mem spiffs copy -s aaa.bin -d aaa_cpy.bin" ], "offline": false, "options": [ "-h, --help This help", "-s, --src source file name", "-d, --dest destination file name" ], "usage": "mem spiffs copy [-h] -s -d " }, "mem spiffs dump": { "command": "mem spiffs dump", "description": "Dumps device SPIFFS file to a local file Size is handled by first sending a STAT command against file to verify existence", "notes": [ "mem spiffs dump -s tag.bin -> download binary file from device", "mem spiffs dump -s tag.bin -d a001 -e -> download tag.bin, save as `a001.bin`" ], "offline": false, "options": [ "-h, --help This help", "-s, --src SPIFFS file to save", "-d, --dest file name to save to " ], "usage": "mem spiffs dump [-h] -s [-d ]" }, "mem spiffs info": { "command": "mem spiffs info", "description": "Print file system info and usage statistics", "notes": [ "mem spiffs info" ], "offline": false, "options": [ "-h, --help This help" ], "usage": "mem spiffs info [-h]" }, "mem spiffs mount": { "command": "mem spiffs mount", "description": "Mount the SPIFFS file system if not already mounted", "notes": [ "mem spiffs mount" ], "offline": false, "options": [ "-h, --help This help" ], "usage": "mem spiffs mount [-h]" }, "mem spiffs remove": { "command": "mem spiffs remove", "description": "Remove a file from SPIFFS filesystem", "notes": [ "mem spiffs remove -f lasttag.bin" ], "offline": false, "options": [ "-h, --help This help", "-f, --file file to remove" ], "usage": "mem spiffs remove [-h] -f " }, "mem spiffs rename": { "command": "mem spiffs rename", "description": "Rename/move a file from SPIFFS filesystem.", "notes": [ "mem spiffs rename -s aaa.bin -d bbb.bin" ], "offline": false, "options": [ "-h, --help This help", "-s, --src source file name", "-d, --dest destination file name" ], "usage": "mem spiffs rename [-h] -s -d " }, "mem spiffs test": { "command": "mem spiffs test", "description": "Test SPIFFS Operations, require wiping pages 0 and 1", "notes": [ "mem spiffs test" ], "offline": false, "options": [ "-h, --help This help" ], "usage": "mem spiffs test [-h]" }, "mem spiffs tree": { "command": "mem spiffs tree", "description": "Print the Flash memory file system tree", "notes": [ "mem spiffs tree" ], "offline": false, "options": [ "-h, --help This help" ], "usage": "mem spiffs tree [-h]" }, "mem spiffs unmount": { "command": "mem spiffs unmount", "description": "Un-mount the SPIFFS file system", "notes": [ "mem spiffs unmount" ], "offline": false, "options": [ "-h, --help This help" ], "usage": "mem spiffs unmount [-h]" }, "mem spiffs upload": { "command": "mem spiffs upload", "description": "Uploads binary-wise file into device file system Warning: mem area to be written must have been wiped first. This is already taken care when loading dictionaries. File names can only be 32 bytes long on device SPIFFS", "notes": [ "mem spiffs upload -s local.bin -d dest.bin" ], "offline": false, "options": [ "-h, --help This help", "-s, --src source file name", "-d, --dest destination file name" ], "usage": "mem spiffs upload [-h] -s -d " }, "mem spiffs view": { "command": "mem spiffs view", "description": "View a file on flash memory on devicer in console", "notes": [ "mem spiffs view -f tag.bin" ], "offline": false, "options": [ "-h, --help This help", "-f, --file SPIFFS file to view", "-c, --cols column breaks (def 16)" ], "usage": "mem spiffs view [-h] -f [-c ]" }, "mem spiffs wipe": { "command": "mem spiffs wipe", "description": "* * * Warning * * * This command wipes all files on the device SPIFFS file system", "notes": [ "mem spiffs wipe" ], "offline": false, "options": [ "-h, --help This help" ], "usage": "mem spiffs wipe [-h]" }, "mem wipe": { "command": "mem wipe", "description": "Wipe flash memory on device, which fills it with 0xFF [ !!! OBS ] use with caution", "notes": [ "mem wipe -p 0 -> wipes first page" ], "offline": false, "options": [ "-h, --help This help", "-p 0,1,2 page memory" ], "usage": "mem wipe [-h] [-p ]" }, "msleep": { "command": "msleep", "description": "Sleep for given amount of milliseconds", "notes": [ "msleep -t 100" ], "offline": true, "options": [ "-h, --help This help", "-t, --ms time in milliseconds" ], "usage": "msleep [-h] [-t ]" }, "nfc barcode read": { "command": "nfc barcode read", "description": "Get info from Thinfilm tags", "notes": [ "hf thinfilm info" ], "offline": false, "options": [ "-h, --help This help" ], "usage": "hf thinfilm info [-h]" }, "nfc barcode sim": { "command": "nfc barcode sim", "description": "Simulate Thinfilm tag", "notes": [ "hf thinfilm sim -d B70470726f786d61726b2e636f6d" ], "offline": false, "options": [ "-h, --help This help", "-d, --data bytes to send", "--raw raw, provided bytes should include CRC" ], "usage": "hf thinfilm sim [-h] -d [--raw]" }, "nfc decode": { "command": "nfc decode", "description": "Decode and print NFC Data Exchange Format (NDEF) You must provide either data in hex or a filename, but not both", "notes": [ "nfc decode -d 9101085402656e48656c6c6f5101085402656e576f726c64", "nfc decode -d 0103d020240203e02c040300fe", "nfc decode -f myfilename" ], "offline": true, "options": [ "-h, --help This help", "-d, --data NDEF data to decode", "-f, --file file to load", "-v, --verbose verbose mode" ], "usage": "nfc decode [-hv] [-d ] [-f ]" }, "nfc mf cformat": { "command": "nfc mf cformat", "description": "format MIFARE Classic Tag as a NFC tag with Data Exchange Format (NDEF) If no given, UID will be used as filename. It will try default keys and MAD keys to detect if tag is already formatted in order to write. If not, it will try finding a key file based on your UID. ie, if you ran autopwn before", "notes": [ "hf mf ndefformat", "hf mf ndefformat --1k -> MIFARE Classic 1k", "hf mf ndefformat --keys hf-mf-01020304-key.bin -> MIFARE 1k with keys from specified file" ], "offline": false, "options": [ "-h, --help This help", "-k, --keys filename of keys", "--mini MIFARE Classic Mini / S20", "--1k MIFARE Classic 1k / S50 (def)", "--2k MIFARE Classic/Plus 2k", "--4k MIFARE Classic 4k / S70" ], "usage": "hf mf ndefformat [-h] [-k ] [--mini] [--1k] [--2k] [--4k]" }, "nfc mf cread": { "command": "nfc mf cread", "description": "Prints NFC Data Exchange Format (NDEF)", "notes": [ "hf mf ndefread -> shows NDEF parsed data", "hf mf ndefread -vv -> shows NDEF parsed and raw data", "hf mf ndefread --aid e103 -k ffffffffffff -b -> shows NDEF data with custom AID, key and with key B", "hf mf ndefread -f myfilename -> save raw NDEF to file" ], "offline": false, "options": [ "-h, --help This help", "-v, --verbose show technical data", "--aid replace default aid for NDEF", "-k, --key replace default key for NDEF", "-b, --keyb use key B for access sectors (by default: key A)", "-f, --file save raw NDEF to file" ], "usage": "hf mf ndefread [-hvb] [--aid ] [-k ] [-f ]" }, "nfc mf cwrite": { "command": "nfc mf cwrite", "description": "Write raw NDEF hex bytes to tag. This commands assumes tag already been NFC/NDEF formatted.", "notes": [ "hf mf ndefwrite -d 0300FE -> write empty record to tag", "hf mf ndefwrite -f myfilename", "hf mf ndefwrite -d 033fd1023a53709101195405656e2d55534963656d616e2054776974746572206c696e6b5101195502747769747465722e636f6d2f686572726d616e6e31303031" ], "offline": false, "options": [ "-h, --help This help", "-d raw NDEF hex bytes", "-f, --file write raw NDEF file to tag", "-p fix NDEF record headers / terminator block if missing", "--mini MIFARE Classic Mini / S20", "--1k MIFARE Classic 1k / S50 (def)", "--2k MIFARE Classic/Plus 2k", "--4k MIFARE Classic 4k / S70", "-v, --verbose verbose output" ], "usage": "hf mf ndefwrite [-hpv] [-d ] [-f ] [--mini] [--1k] [--2k] [--4k]" }, "nfc mf pread": { "command": "nfc mf pread", "description": "Prints NFC Data Exchange Format (NDEF)", "notes": [ "hf mfp ndefread", "hf mfp ndefread -vv -> shows NDEF parsed and raw data", "hf mfp ndefread --aid e103 -k d3f7d3f7d3f7d3f7d3f7d3f7d3f7d3f7 -> shows NDEF data with custom AID and key", "hf mfp ndefread -f myfilename -> save raw NDEF to file" ], "offline": false, "options": [ "-h, --help This help", "-v, --verbose show technical data", "--aid replace default aid for NDEF", "-k, --key replace default key for NDEF", "-b, --keyb use key B for access sectors (by default: key A)", "-f, --file save raw NDEF to file" ], "usage": "hf mfp ndefread [-hvb] [--aid ] [-k ] [-f ]" }, "nfc type1 read": { "command": "nfc type1 read", "description": "Get info from Topaz tags", "notes": [ "hf topaz info", "hf topaz info -f myfilename -> save raw NDEF to file" ], "offline": false, "options": [ "-h, --help This help", "-f, --file save raw NDEF to file", "-v, --verbose verbose output" ], "usage": "hf topaz info [-hv] [-f ]" }, "nfc type2 read": { "command": "nfc type2 read", "description": "Prints NFC Data Exchange Format (NDEF)", "notes": [ "hf mfu ndefread -> shows NDEF data", "hf mfu ndefread -k ffffffff -> shows NDEF data with key", "hf mfu ndefread -f myfilename -> save raw NDEF to file" ], "offline": false, "options": [ "-h, --help This help", "-l Swap entered key's endianness", "-f, --file Save raw NDEF to file", "-v, --verbose show technical data" ], "usage": "hf mfu ndefread [-hlv] [-k Replace default key for NDEF] [-f ]" }, "nfc type4a format": { "command": "nfc type4a format", "description": "Format ISO14443-a Tag as a NFC tag with Data Exchange Format (NDEF)", "notes": [ "hf 14a ndefformat" ], "offline": false, "options": [ "-h, --help This help", "-v, --verbose show technical data" ], "usage": "hf 14a ndefformat [-hv]" }, "nfc type4a read": { "command": "nfc type4a read", "description": "Read NFC Data Exchange Format (NDEF) file on Type 4 NDEF tag", "notes": [ "hf 14a ndefread", "hf 14a ndefread -f myfilename -> save raw NDEF to file" ], "offline": false, "options": [ "-h, --help This help", "-f, --file save raw NDEF to file", "-v, --verbose show technical data" ], "usage": "hf 14a ndefread [-hv] [-f ]" }, "nfc type4a st25taread": { "command": "nfc type4a st25taread", "description": "Read NFC Data Exchange Format (NDEF) file on ST25TA", "notes": [ "hf st25ta ndefread -p 82E80053D4CA5C0B656D852CC696C8A1", "hf st25ta ndefread -f myfilename -> save raw NDEF to file" ], "offline": false, "options": [ "-h, --help This help", "-p, --pwd 16 byte read password", "-f, --file save raw NDEF to file", "-v, --verbose show technical data" ], "usage": "hf st25ta ndefread [-hv] [-p ] [-f ]" }, "nfc type4a write": { "command": "nfc type4a write", "description": "Write raw NDEF hex bytes to tag. This commands assumes tag already been NFC/NDEF formatted.", "notes": [ "hf 14a ndefwrite -d 0300FE -> write empty record to tag", "hf 14a ndefwrite -f myfilename", "hf 14a ndefwrite -d 003fd1023a53709101195405656e2d55534963656d616e2054776974746572206c696e6b5101195502747769747465722e636f6d2f686572726d616e6e31303031" ], "offline": false, "options": [ "-h, --help This help", "-d raw NDEF hex bytes", "-f, --file write raw NDEF file to tag", "-p fix NDEF record headers / terminator block if missing", "-v, --verbose verbose output" ], "usage": "hf 14a ndefwrite [-hpv] [-d ] [-f ]" }, "nfc type4b read": { "command": "nfc type4b read", "description": "Print NFC Data Exchange Format (NDEF)", "notes": [ "hf 14b ndefread", "hf 14b ndefread -f myfilename -> save raw NDEF to file" ], "offline": false, "options": [ "-h, --help This help", "-f, --file save raw NDEF to file", "-v, --verbose show technical data" ], "usage": "hf 14b ndefread [-hv] [-f ]" }, "piv authsign": { "command": "piv authsign", "description": "Send a nonce and ask the PIV card to sign it", "notes": [ "piv sign -sk -> select card, select applet, sign a NULL nonce" ], "offline": false, "options": [ "-h, --help This help", "-s, -S, --select Activate field and select applet", "-k, -K, --keep Keep field for next command", "-a, -A, --apdu Show APDU requests and responses", "-t, -T, --tlv TLV decode results", "-w, -W, --wired Send data via contact (iso7816) interface. (def: Contactless interface)", "--aid Applet ID to select. By default A0000003080000100 will be used", "--nonce Nonce to sign.", "--slot Slot number. Default will be 0x9E (card auth cert).", "--alg Algorithm to use to sign. Example values: 06=RSA-1024, 07=RSA-2048, 11=ECC-P256 (default), 14=ECC-P384" ], "usage": "piv sign [-hskatw] [--aid ] --nonce [--slot ] [--alg ]" }, "piv getdata": { "command": "piv getdata", "description": "Get a data container of a given tag", "notes": [ "piv getdata -s 5fc102 -> select card, select applet, get card holder unique identifer", "piv getdata -st 5fc102 -> select card, select applet, get card holder unique identifer, show result in TLV" ], "offline": false, "options": [ "-h, --help This help", "-s, -S, --select Activate field and select applet", "-k, -K, --keep Keep field for next command", "-a, -A, --apdu Show APDU requests and responses", "-t, -T, --tlv TLV decode results", "-w, -W, --wired Send data via contact (iso7816) interface. (def: Contactless interface)", "--aid Applet ID to select. By default A0000003080000100 will be used", " Tag ID to read, between 1 and 3 bytes." ], "usage": "piv getdata [-hskatw] [--aid ] " }, "piv list": { "command": "piv list", "description": "Alias of `trace list -t 7816` with selected protocol data to annotate trace buffer You can load a trace from file (see `trace load -h`) or it be downloaded from device by default It accepts all other arguments of `trace list`. Note that some might not be relevant for this specific protocol", "notes": [ "piv list --frame -> show frame delay times", "piv list -1 -> use trace buffer" ], "offline": true, "options": [ "-h, --help This help", "-1, --buffer use data from trace buffer", "--frame show frame delay times", "-c mark CRC bytes", "-r show relative times (gap and duration)", "-u display times in microseconds instead of clock cycles", "-x show hexdump to convert to pcap(ng)", "or to import into Wireshark using encapsulation type \"ISO 14443\"", "-f, --file filename of dictionary" ], "usage": "piv list [-h1crux] [--frame] [-f ]" }, "piv scan": { "command": "piv scan", "description": "Scan a PIV card for known containers", "notes": [ "piv scan -s -> select card, select applet and run scan", "piv scan -st --aid a00000030800001000 -> select card, select applet a00000030800001000, show result of the scan in TLV" ], "offline": false, "options": [ "-h, --help This help", "-s, -S, --select Activate field and select applet", "-k, -K, --keep Keep field for next command", "-a, -A, --apdu Show APDU requests and responses", "-t, -T, --tlv TLV decode results", "-w, -W, --wired Send data via contact (iso7816) interface. (def: Contactless interface)", "--aid Applet ID to select. By default A0000003080000100 will be used" ], "usage": "piv scan [-hskatw] [--aid ]" }, "piv select": { "command": "piv select", "description": "Executes select applet command", "notes": [ "piv select -s -> select card, select applet", "piv select -st --aid a00000030800001000 -> select card, select applet a00000030800001000, show result in TLV" ], "offline": false, "options": [ "-h, --help This help", "-s, -S, --select Activate field and select applet", "-k, -K, --keep Keep field for next command", "-a, -A, --apdu Show APDU requests and responses", "-t, -T, --tlv TLV decode results", "-w, -W, --wired Send data via contact (iso7816) interface. (def: Contactless interface)", "--aid Applet ID to select. By default A0000003080000100 will be used" ], "usage": "piv select [-hskatw] [--aid ]" }, "prefs get barmode": { "command": "prefs get barmode", "description": "Get preference of HF/LF tune command styled output in the client", "notes": [ "prefs get barmode" ], "offline": true, "options": [ "-h, --help This help" ], "usage": "prefs get barmode [-h]" }, "prefs get clientdebug": { "command": "prefs get clientdebug", "description": "Get preference of using clientside debug level", "notes": [ "prefs get clientdebug" ], "offline": true, "options": [ "-h, --help This help" ], "usage": "prefs get clientdebug [-h]" }, "prefs get clientdelay": { "command": "prefs get clientdelay", "description": "Get preference of delay time before execution of a command in the client", "notes": [ "prefs get clientdelay" ], "offline": true, "options": [ "-h, --help This help" ], "usage": "prefs get clientdelay [-h]" }, "prefs get color": { "command": "prefs get color", "description": "Get preference of using colors in the client", "notes": [ "prefs get color" ], "offline": true, "options": [ "-h, --help This help" ], "usage": "prefs get color [-h]" }, "prefs get emoji": { "command": "prefs get emoji", "description": "Get preference of using emojis in the client", "notes": [ "prefs get emoji" ], "offline": true, "options": [ "-h, --help This help" ], "usage": "prefs get emoji [-h]" }, "prefs get hints": { "command": "prefs get hints", "description": "Get preference of showing hint messages in the client", "notes": [ "prefs get hints" ], "offline": true, "options": [ "-h, --help This help" ], "usage": "prefs get hints [-h]" }, "prefs get output": { "command": "prefs get output", "description": "Get preference of dump output style", "notes": [ "prefs get output" ], "offline": true, "options": [ "-h, --help This help" ], "usage": "prefs get output [-h]" }, "prefs get plotsliders": { "command": "prefs get plotsliders", "description": "Get preference of showing the plotslider control in the client", "notes": [ "prefs get plotsliders" ], "offline": true, "options": [ "-h, --help This help" ], "usage": "prefs get plotsliders [-h]" }, "prefs get savepaths": { "command": "prefs get savepaths", "description": "Get preference of file paths in the client", "notes": [ "prefs get savepaths" ], "offline": true, "options": [ "-h, --help This help" ], "usage": "prefs get savepaths [-h]" }, "prefs set barmode": { "command": "prefs set barmode", "description": "Set persistent preference of HF/LF tune command styled output in the client", "notes": [ "prefs set barmode --mix" ], "offline": true, "options": [ "-h, --help This help", "--bar measured values as bar only", "--mix measured values as numbers and bar", "--val measured values only" ], "usage": "prefs set barmode [-h] [--bar] [--mix] [--val]" }, "prefs set clientdebug": { "command": "prefs set clientdebug", "description": "Set persistent preference of using clientside debug level", "notes": [ "prefs set clientdebug --simple" ], "offline": true, "options": [ "-h, --help This help", "--off no debug messages", "--simple simple debug messages", "--full full debug messages" ], "usage": "prefs set clientdebug [-h] [--off] [--simple] [--full]" }, "prefs set clientdelay": { "command": "prefs set clientdelay", "description": "Set persistent preference of delay before executing a command in the client", "notes": [ "prefs set clientdelay --ms 0 -> unsets any delay", "prefs set clientdelay --ms 1000 -> sets 1000ms delay" ], "offline": true, "options": [ "-h, --help This help", "--ms delay in micro seconds" ], "usage": "prefs set clientdelay [-h] [--ms ]" }, "prefs set color": { "command": "prefs set color", "description": "Set persistent preference of using colors in the client", "notes": [ "prefs set color --ansi" ], "offline": true, "options": [ "-h, --help This help", "--ansi use ANSI colors", "--off don't use colors" ], "usage": "prefs set color [-h] [--ansi] [--off]" }, "prefs set emoji": { "command": "prefs set emoji", "description": "Set persistent preference of using emojis in the client", "notes": [ "prefs set emoji --alias" ], "offline": true, "options": [ "-h, --help This help", "--alias show alias for emoji", "--emoji show emoji", "--alttext show alt text for emoji", "--none don't show emoji or text" ], "usage": "prefs set emoji [-h] [--alias] [--emoji] [--alttext] [--none]" }, "prefs set hints": { "command": "prefs set hints", "description": "Set persistent preference of showing hint messages in the client", "notes": [ "prefs set hints --on" ], "offline": true, "options": [ "-h, --help This help", "--off hide hints", "--on show hints" ], "usage": "prefs set hints [-h] [--off] [--on]" }, "prefs set output": { "command": "prefs set output", "description": "Set dump output style to condense consecutive repeated data", "notes": [ "prefs set output --normal -> sets the output style to normal", "prefs set output --dense -> sets the output style to dense" ], "offline": true, "options": [ "-h, --help This help", "--normal normal output", "--dense dense output" ], "usage": "prefs set output [-h] [--normal] [--dense]" }, "prefs set plotsliders": { "command": "prefs set plotsliders", "description": "Set persistent preference of showing the plotslider control in the client", "notes": [ "prefs set plotsliders --on" ], "offline": true, "options": [ "-h, --help This help", "--off hide plot slider controls", "--on show plot slider controls" ], "usage": "prefs set plotsliders [-h] [--off] [--on]" }, "prefs set savepaths": { "command": "prefs set savepaths", "description": "Set persistent preference of file paths in the client", "notes": [ "prefs set savepaths --dump /home/mydumpfolder -> all dump files will be saved into this folder", "prefs set savepaths --def /home/myfolder -c -> create if needed, all files will be saved into this folder" ], "offline": true, "options": [ "-h, --help This help", "-c, --create create directory if it does not exist", "--def default path", "--dump dump file path", "--trace trace path" ], "usage": "prefs set savepaths [-hc] [--def ] [--dump ] [--trace ]" }, "prefs show": { "command": "prefs show", "description": "Show all persistent preferences", "notes": [ "prefs show" ], "offline": true, "options": [ "-h, --help This help" ], "usage": "prefs show [-h]" }, "quit": { "command": "quit", "description": "Quit the Proxmark3 client terminal", "notes": [ "quit" ], "offline": true, "options": [ "-h, --help This help" ], "usage": "quit [-h]" }, "rem": { "command": "rem", "description": "Add a text line in log file", "notes": [ "rem my message -> adds a timestamp with `my message`" ], "offline": true, "options": [ "-h, --help This help", " message line you want inserted" ], "usage": "rem [-h] []..." }, "script list": { "command": "script list", "description": "List available Lua, Cmd and Python scripts", "notes": [ "script list" ], "offline": true, "options": [ "-h, --help This help" ], "usage": "script list [-h]" }, "script run": { "command": "script run", "description": "Run a Lua, Cmd or Python script. If no extension it will search for lua/cmd/py extensions Use `script list` to see available scripts", "notes": [ "script run my_script -h" ], "offline": true, "options": [ "-h, --help This help", " name of script to run", " script parameters" ], "usage": "script run [-h] []..." }, "smart brute": { "command": "smart brute", "description": "Tries to bruteforce SFI, using a known list of AID's", "notes": [ "smart brute -t" ], "offline": false, "options": [ "-h, --help This help", "-t, --tlv executes TLV decoder if it possible" ], "usage": "smart brute [-ht]" }, "smart info": { "command": "smart info", "description": "Extract more detailed information from smart card.", "notes": [ "smart info -v" ], "offline": false, "options": [ "-h, --help This help", "-v, --verbose verbose output" ], "usage": "smart info [-hv]" }, "smart list": { "command": "smart list", "description": "Alias of `trace list -t 7816` with selected protocol data to annotate trace buffer You can load a trace from file (see `trace load -h`) or it be downloaded from device by default It accepts all other arguments of `trace list`. Note that some might not be relevant for this specific protocol", "notes": [ "smart list --frame -> show frame delay times", "smart list -1 -> use trace buffer" ], "offline": true, "options": [ "-h, --help This help", "-1, --buffer use data from trace buffer", "--frame show frame delay times", "-c mark CRC bytes", "-r show relative times (gap and duration)", "-u display times in microseconds instead of clock cycles", "-x show hexdump to convert to pcap(ng)", "or to import into Wireshark using encapsulation type \"ISO 14443\"", "-f, --file filename of dictionary" ], "usage": "smart list [-h1crux] [--frame] [-f ]" }, "smart raw": { "command": "smart raw", "description": "Sends raw bytes to card", "notes": [ "smart raw -s -0 -d 00a404000e315041592e5359532e4444463031 -> `1PAY.SYS.DDF01` PPSE directory with get ATR", "smart raw -0 -d 00a404000e325041592e5359532e4444463031 -> `2PAY.SYS.DDF01` PPSE directory", "smart raw -0 -t -d 00a4040007a0000000041010 -> Mastercard", "smart raw -0 -t -d 00a4040007a0000000031010 -> Visa" ], "offline": false, "options": [ "-h, --help This help", "-r do not read response", "-a active smartcard without select (reset sc module)", "-s active smartcard with select (get ATR)", "-t, --tlv executes TLV decoder if it possible", "-0 use protocol T=0", "--timeout Timeout in MS waiting for SIM to respond. (def 337ms)", "-d, --data bytes to send" ], "usage": "smart raw [-hrast0] [--timeout ] -d " }, "smart reader": { "command": "smart reader", "description": "Act as a smart card reader.", "notes": [ "smart reader" ], "offline": false, "options": [ "-h, --help This help", "-v, --verbose verbose output" ], "usage": "smart reader [-hv]" }, "smart setclock": { "command": "smart setclock", "description": "Set clock speed for smart card interface.", "notes": [ "smart setclock --4mhz", "smart setclock --16mhz" ], "offline": false, "options": [ "-h, --help This help", "--16mhz 16 MHz clock speed", "--8mhz 8 MHz clock speed", "--4mhz 4 MHz clock speed" ], "usage": "smart setclock [-h] [--16mhz] [--8mhz] [--4mhz]" }, "trace extract": { "command": "trace extract", "description": "Extracts protocol authentication challenges from trace buffer", "notes": [ "trace extract", "trace extract -1" ], "offline": true, "options": [ "-h, --help This help", "-1, --buffer use data from trace buffer" ], "usage": "trace extract [-h1]" }, "trace list": { "command": "trace list", "description": "Annotate trace buffer with selected protocol data You can load a trace from file (see `trace load -h`) or it be downloaded from device by default", "notes": [ "trace list -t raw -> just show raw data without annotations", "", "trace list -t 14a -> interpret as ISO14443-A", "trace list -t 14b -> interpret as ISO14443-B", "trace list -t 15 -> interpret as ISO15693", "trace list -t 7816 -> interpret as ISO7816-4", "trace list -t cryptorf -> interpret as CryptoRF", "", "trace list -t des -> interpret as MIFARE DESFire", "trace list -t felica -> interpret as ISO18092 / FeliCa", "trace list -t hitag1 -> interpret as Hitag1", "trace list -t hitag2 -> interpret as Hitag2", "trace list -t hitags -> interpret as HitagS", "trace list -t iclass -> interpret as iCLASS", "trace list -t legic -> interpret as LEGIC", "trace list -t lto -> interpret as LTO-CM", "trace list -t mf -> interpret as MIFARE Classic and decrypt crypto1 stream", "trace list -t seos -> interpret as SEOS", "trace list -t thinfilm -> interpret as Thinfilm", "trace list -t topaz -> interpret as Topaz", "trace list -t mfp -> interpret as MIFARE Plus", "", "trace list -t mf -f mfc_default_keys.dic -> use default dictionary file", "trace list -t 14a --frame -> show frame delay times", "trace list -t 14a -1 -> use trace buffer" ], "offline": true, "options": [ "-h, --help This help", "-1, --buffer use data from trace buffer", "--frame show frame delay times", "-c mark CRC bytes", "-r show relative times (gap and duration)", "-u display times in microseconds instead of clock cycles", "-x show hexdump to convert to pcap(ng)", "or to import into Wireshark using encapsulation type \"ISO 14443\"", "-t, --type protocol to annotate the trace", "-f, --file filename of dictionary" ], "usage": "trace list [-h1crux] [--frame] [-t ] [-f ]" }, "trace load": { "command": "trace load", "description": "Load protocol data from binary file to trace buffer File extension is <.trace>", "notes": [ "trace load -f mytracefile -> w/o file extension" ], "offline": true, "options": [ "-h, --help This help", "-f, --file Specify trace file to load" ], "usage": "trace load [-h] -f " }, "trace save": { "command": "trace save", "description": "Save protocol data from trace buffer to binary file File extension is <.trace>", "notes": [ "trace save -f mytracefile -> w/o file extension" ], "offline": true, "options": [ "-h, --help This help", "-f, --file Specify trace file to save" ], "usage": "trace save [-h] -f " }, "usart btfactory": { "command": "usart btfactory", "description": "Reset BT add-on to factory settings This requires 1) BTpower to be turned ON 2) BT add-on to NOT be connected => the add-on blue LED must blink WARNING: process only if strictly needed!", "notes": [ "usart btfactory" ], "offline": false, "options": [ "-h, --help This help" ], "usage": "usart btfactory [-h]" }, "usart btpin": { "command": "usart btpin", "description": "Change BT add-on PIN. WARNING: this requires 1) BTpower to be turned ON 2) BT add-on to NOT be connected => the add-on blue LED must blink", "notes": [ "usart btpin -p 1234" ], "offline": false, "options": [ "-h, --help This help", "-p, --pin Desired PIN number (4 digits)" ], "usage": "usart btpin [-h] -p " }, "usart config": { "command": "usart config", "description": "Configure USART. WARNING: it will have side-effects if used in USART HOST mode! The changes are not permanent, restart Proxmark3 to get default settings back.", "notes": [ "usart config -b 9600", "usart config -b 9600 --none", "usart config -E" ], "offline": false, "options": [ "-h, --help This help", "-b, --baud baudrate", "-N, --none mone parity", "-E, --even even parity", "-O, --odd odd parity" ], "usage": "usart config [-hNEO] [-b ]" }, "usart rx": { "command": "usart rx", "description": "Receive string over USART. WARNING: it will have side-effects if used in USART HOST mode!", "notes": [ "usart rx -t 2000 -> 2 second timeout" ], "offline": false, "options": [ "-h, --help This help", "-t, --timeout timeout in ms, default is 0ms" ], "usage": "usart rx [-h] [-t ]" }, "usart rxhex": { "command": "usart rxhex", "description": "Receive bytes over USART. WARNING: it will have side-effects if used in USART HOST mode!", "notes": [ "usart rxhex -t 2000 -> 2 second timeout" ], "offline": false, "options": [ "-h, --help This help", "-t, --timeout timeout in ms, default is 0ms" ], "usage": "usart rxhex [-h] [-t ]" }, "usart tx": { "command": "usart tx", "description": "Send string over USART. WARNING: it will have side-effects if used in USART HOST mode!", "notes": [ "usart tx -d \"AT+VERSION\"", "usart tx -d \"AT+VERSION\\r\\n\"" ], "offline": false, "options": [ "-h, --help This help", "-d, --data string to send" ], "usage": "usart tx [-h] -d " }, "usart txhex": { "command": "usart txhex", "description": "Send bytes over USART. WARNING: it will have side-effects if used in USART HOST mode!", "notes": [ "usart txhex -d 504d33620a80000000010100f09f988ef09fa5b36233" ], "offline": false, "options": [ "-h, --help This help", "-d, --data bytes to send" ], "usage": "usart txhex [-h] -d " }, "usart txrx": { "command": "usart txrx", "description": "Send string over USART and wait for response. WARNING: if used in USART HOST mode, you can only send AT commands to add-on when BT connection is not established (LED needs to be blinking) Any other usage in USART HOST mode will have side-effects!", "notes": [ "usart txrx -d \"AT+VERSION\" -> Talking to BT add-on (when no connection)", "usart txrx -t 2000 -d \"AT+SOMESTUFF\\r\\n\" -> Talking to a target requiring longer time and end-of-line chars" ], "offline": false, "options": [ "-h, --help This help", "-t, --timeout timeout in ms, default is 1000 ms", "-d, --data string to send" ], "usage": "usart txrx [-h] [-t ] -d " }, "wiegand decode": { "command": "wiegand decode", "description": "Decode raw hex or binary to wiegand format", "notes": [ "wiegand decode --raw 2006f623ae" ], "offline": true, "options": [ "-h, --help This help", "-r, --raw raw hex to be decoded", "-b, --bin binary string to be decoded" ], "usage": "wiegand decode [-h] [-r ] [-b ]" }, "wiegand encode": { "command": "wiegand encode", "description": "Encode wiegand formatted number to raw hex", "notes": [ "wiegand encode --fc 101 --cn 1337 -> show all formats", "wiegand encode -w H10301 --fc 101 --cn 1337 -> H10301 format" ], "offline": true, "options": [ "-h, --help This help", "--fc facility number", "--cn card number", "--issue issue level", "--oem OEM code", "-w, --wiegand see `wiegand list` for available formats", "--pre add HID ProxII preamble to wiegand output" ], "usage": "wiegand encode [-h] [--fc ] --cn [--issue ] [--oem ] [-w ] [--pre]" }, "wiegand list": { "command": "wiegand list", "description": "List available wiegand formats", "notes": [ "wiegand list" ], "offline": true, "options": [ "-h, --help This help" ], "usage": "wiegand info [-h]" } }, "metadata": { "commands_extracted": 687, "extracted_by": "PM3Help2JSON v1.00", "extracted_on": "2023-10-03T15:10:12" } }