# Proxmark3 command dump Some commands are available only if a Proxmark3 is actually connected. Check column "offline" for their availability. |command |offline |description |------- |------- |----------- |`help `|Y |`Use ` help` for details of a command` |`auto `|N |`Automated detection process for unknown tags` |`clear `|Y |`Clear screen` |`hints `|Y |`Turn hints on / off` |`msleep `|Y |`Add a pause in milliseconds` |`rem `|Y |`Add a text line in log file` |`quit `|Y |`` |`exit `|Y |`Exit program` ### prefs { Edit client/device preferences... } |command |offline |description |------- |------- |----------- |`prefs help `|Y |`This help` |`prefs show `|Y |`Show all preferences` ### prefs get { Get a preference } |command |offline |description |------- |------- |----------- |`prefs get barmode `|Y |`Get bar mode preference` |`prefs get client.debug `|Y |`Get client debug level preference` |`prefs get client.delay `|Y |`Get client execution delay preference` |`prefs get client.timeout`|Y |`Get client execution delay preference` |`prefs get color `|Y |`Get color support preference` |`prefs get savepaths `|Y |`Get file folder ` |`prefs get emoji `|Y |`Get emoji display preference` |`prefs get hints `|Y |`Get hint display preference` |`prefs get output `|Y |`Get dump output style preference` |`prefs get plotsliders `|Y |`Get plot slider display preference` ### prefs set { Set a preference } |command |offline |description |------- |------- |----------- |`prefs set help `|Y |`This help` |`prefs set barmode `|Y |`Set bar mode` |`prefs set client.debug `|Y |`Set client debug level` |`prefs set client.delay `|Y |`Set client execution delay` |`prefs set client.timeout`|Y |`Set client communication timeout` |`prefs set color `|Y |`Set color support` |`prefs set emoji `|Y |`Set emoji display` |`prefs set hints `|Y |`Set hint display` |`prefs set savepaths `|Y |`... to be adjusted next ... ` |`prefs set output `|Y |`Set dump output style` |`prefs set plotsliders `|Y |`Set plot slider display` ### analyse { Analyse utils... } |command |offline |description |------- |------- |----------- |`analyse help `|Y |`This help` |`analyse lcr `|Y |`Generate final byte for XOR LRC` |`analyse crc `|Y |`Stub method for CRC evaluations` |`analyse chksum `|Y |`Checksum with adding, masking and one's complement` |`analyse dates `|Y |`Look for datestamps in a given array of bytes` |`analyse lfsr `|Y |`LFSR tests` |`analyse a `|Y |`num bits test` |`analyse nuid `|Y |`create NUID from 7byte UID` |`analyse demodbuff `|Y |`Load binary string to DemodBuffer` |`analyse freq `|Y |`Calc wave lengths` |`analyse foo `|Y |`muxer` |`analyse units `|Y |`convert ETU <> US <> SSP_CLK (3.39MHz)` ### data { Plot window / data buffer manipulation... } |command |offline |description |------- |------- |----------- |`data help `|Y |`This help` |`data biphaserawdecode `|Y |`Biphase decode bin stream in DemodBuffer` |`data detectclock `|Y |`Detect ASK, FSK, NRZ, PSK clock rate of wave in GraphBuffer` |`data fsktonrz `|Y |`Convert fsk2 to nrz wave for alternate fsk demodulating (for weak fsk)` |`data manrawdecode `|Y |`Manchester decode binary stream in DemodBuffer` |`data modulation `|Y |`Identify LF signal for clock and modulation` |`data rawdemod `|Y |`Demodulate the data in the GraphBuffer and output binary` |`data askedgedetect `|Y |`Adjust Graph for manual ASK demod` |`data autocorr `|Y |`Autocorrelation over window` |`data dirthreshold `|Y |`Max rising higher up-thres/ Min falling lower down-thres` |`data decimate `|Y |`Decimate samples` |`data envelope `|Y |`Generate square envelope of samples` |`data undecimate `|Y |`Un-decimate samples` |`data hide `|Y |`Hide graph window` |`data hpf `|Y |`Remove DC offset from trace` |`data iir `|Y |`Apply IIR buttersworth filter on plot data` |`data grid `|Y |`overlay grid on graph window` |`data ltrim `|Y |`Trim samples from left of trace` |`data mtrim `|Y |`Trim out samples from the specified start to the specified stop` |`data norm `|Y |`Normalize max/min to +/-128` |`data plot `|Y |`Show graph window` |`data cthreshold `|Y |`Average out all values between` |`data rtrim `|Y |`Trim samples from right of trace` |`data setgraphmarkers `|Y |`Set blue and orange marker in graph window` |`data shiftgraphzero `|Y |`Shift 0 for Graphed wave + or - shift value` |`data timescale `|Y |`Set cursor display timescale` |`data zerocrossings `|Y |`Count time between zero-crossings` |`data convertbitstream `|Y |`Convert GraphBuffer's 0/1 values to 127 / -127` |`data getbitstream `|Y |`Convert GraphBuffer's >=1 values to 1 and <1 to 0` |`data asn1 `|Y |`ASN1 decoder` |`data atr `|Y |`ATR lookup` |`data bin2hex `|Y |`Converts binary to hexadecimal` |`data bitsamples `|N |`Get raw samples as bitstring` |`data bmap `|Y |`Convert hex value according a binary template` |`data clear `|Y |`Clears bigbuf on deviceside and graph window` |`data diff `|Y |`Diff of input files` |`data hexsamples `|N |`Dump big buffer as hex bytes` |`data hex2bin `|Y |`Converts hexadecimal to binary` |`data load `|Y |`Load contents of file into graph window` |`data num `|Y |`Converts dec/hex/bin` |`data print `|Y |`Print the data in the DemodBuffer` |`data samples `|N |`Get raw samples for graph window (GraphBuffer)` |`data save `|Y |`Save signal trace data (from graph window)` |`data setdebugmode `|Y |`Set Debugging Level on client side` |`data tune `|N |`Measure tuning of device antenna. Results shown in graph window` ### emv { EMV ISO-14443 / ISO-7816... } |command |offline |description |------- |------- |----------- |`emv help `|Y |`This help` |`emv list `|Y |`List ISO7816 history` |`emv test `|Y |`Crypto logic test` |`emv challenge `|N |`Generate challenge` |`emv exec `|N |`Executes EMV contactless transaction` |`emv genac `|N |`Generate ApplicationCryptogram` |`emv gpo `|N |`Execute GetProcessingOptions` |`emv intauth `|N |`Internal authentication` |`emv pse `|N |`Execute PPSE. It selects 2PAY.SYS.DDF01 or 1PAY.SYS.DDF01 directory` |`emv reader `|N |`Act like an EMV reader` |`emv readrec `|N |`Read files from card` |`emv roca `|N |`Extract public keys and run ROCA test` |`emv scan `|N |`Scan EMV card and save it contents to json file for emulator` |`emv search `|N |`Try to select all applets from applets list and print installed applets` |`emv select `|N |`Select applet` ### hf { High frequency commands... } |command |offline |description |------- |------- |----------- |`hf help `|Y |`This help` |`hf list `|Y |`List protocol data in trace buffer` |`hf plot `|N |`Plot signal` |`hf tune `|N |`Continuously measure HF antenna tuning` |`hf search `|Y |`Search for known HF tags` |`hf sniff `|N |`Generic HF Sniff` ### hf 14a { ISO14443A RFIDs... } |command |offline |description |------- |------- |----------- |`hf 14a help `|Y |`This help` |`hf 14a list `|Y |`List ISO 14443-a history` |`hf 14a antifuzz `|N |`Fuzzing the anticollision phase. Warning! Readers may react strange` |`hf 14a config `|N |`Configure 14a settings (use with caution)` |`hf 14a cuids `|N |`Collect n>0 ISO14443-a UIDs in one go` |`hf 14a info `|N |`Tag information` |`hf 14a sim `|N |`Simulate ISO 14443-a tag` |`hf 14a sniff `|N |`sniff ISO 14443-a traffic` |`hf 14a raw `|N |`Send raw hex data to tag` |`hf 14a reader `|N |`Act like an ISO14443-a reader` |`hf 14a apdu `|N |`Send ISO 14443-4 APDU to tag` |`hf 14a apdufind `|N |`Enumerate APDUs - CLA/INS/P1P2` |`hf 14a chaining `|N |`Control ISO 14443-4 input chaining` |`hf 14a ndefformat `|N |`Format ISO 14443-A as NFC Type 4 tag` |`hf 14a ndefread `|N |`Read an NDEF file from ISO 14443-A Type 4 tag` |`hf 14a ndefwrite `|N |`Write NDEF records to ISO 14443-A tag` ### hf 14b { ISO14443B RFIDs... } |command |offline |description |------- |------- |----------- |`hf 14b help `|Y |`This help` |`hf 14b apdu `|N |`Send ISO 14443-4 APDU to tag` |`hf 14b dump `|N |`Read all memory pages of an ISO-14443-B tag, save to file` |`hf 14b info `|N |`Tag information` |`hf 14b list `|Y |`List ISO-14443-B history` |`hf 14b ndefread `|N |`Read NDEF file on tag` |`hf 14b raw `|N |`Send raw hex data to tag` |`hf 14b reader `|N |`Act as a ISO-14443-B reader to identify a tag` |`hf 14b sim `|N |`Fake ISO ISO-14443-B tag` |`hf 14b sniff `|N |`Eavesdrop ISO-14443-B` |`hf 14b rdbl `|N |`Read SRI512/SRIX4x block` |`hf 14b sriwrite `|N |`Write data to a SRI512 or SRIX4K tag` |`hf 14b view `|Y |`Display content from tag dump file` ### hf 15 { ISO15693 RFIDs... } |command |offline |description |------- |------- |----------- |`hf 15 help `|Y |`This help` |`hf 15 list `|Y |`List ISO-15693 history` |`hf 15 demod `|Y |`Demodulate ISO-15693 from tag` |`hf 15 dump `|N |`Read all memory pages of an ISO-15693 tag, save to file` |`hf 15 info `|N |`Tag information` |`hf 15 sniff `|N |`Sniff ISO-15693 traffic` |`hf 15 raw `|N |`Send raw hex data to tag` |`hf 15 rdbl `|N |`Read a block` |`hf 15 rdmulti `|N |`Reads multiple blocks` |`hf 15 reader `|N |`Act like an ISO-15693 reader` |`hf 15 restore `|N |`Restore from file to all memory pages of an ISO-15693 tag` |`hf 15 samples `|N |`Acquire samples as reader (enables carrier, sends inquiry)` |`hf 15 view `|Y |`Display content from tag dump file` |`hf 15 wrbl `|N |`Write a block` |`hf 15 sim `|N |`Fake an ISO-15693 tag` |`hf 15 eload `|N |`Load image file into emulator to be used by 'sim' command` |`hf 15 esave `|N |`Save emulator memory into image file` |`hf 15 eview `|N |`View emulator memory` |`hf 15 slixwritepwd `|N |`Writes a password on a SLIX ISO-15693 tag` |`hf 15 slixeasdisable `|N |`Disable EAS mode on SLIX ISO-15693 tag` |`hf 15 slixeasenable `|N |`Enable EAS mode on SLIX ISO-15693 tag` |`hf 15 slixprivacydisable`|N |`Disable privacy mode on SLIX ISO-15693 tag` |`hf 15 slixprivacyenable`|N |`Enable privacy mode on SLIX ISO-15693 tag` |`hf 15 passprotectafi `|N |`Password protect AFI - Cannot be undone` |`hf 15 passprotecteas `|N |`Password protect EAS - Cannot be undone` |`hf 15 findafi `|N |`Brute force AFI of an ISO-15693 tag` |`hf 15 writeafi `|N |`Writes the AFI on an ISO-15693 tag` |`hf 15 writedsfid `|N |`Writes the DSFID on an ISO-15693 tag` |`hf 15 csetuid `|N |`Set UID for magic card` ### hf cipurse { Cipurse transport Cards... } |command |offline |description |------- |------- |----------- |`hf cipurse help `|Y |`This help.` |`hf cipurse info `|N |`Get info about CIPURSE tag` |`hf cipurse select `|N |`Select CIPURSE application or file` |`hf cipurse auth `|N |`Authenticate CIPURSE tag` |`hf cipurse read `|N |`Read binary file` |`hf cipurse write `|N |`Write binary file` |`hf cipurse aread `|N |`Read file attributes` |`hf cipurse awrite `|N |`Write file attributes` |`hf cipurse formatall `|N |`Erase all the data from chip` |`hf cipurse create `|N |`Create file, application, key via DGI record` |`hf cipurse delete `|N |`Delete file` |`hf cipurse updkey `|N |`Update key` |`hf cipurse updakey `|N |`Update key attributes` |`hf cipurse default `|N |`Set default key and file id for all the other commands` |`hf cipurse test `|Y |`Regression tests` ### hf epa { German Identification Card... } |command |offline |description |------- |------- |----------- |`hf epa help `|Y |`This help` |`hf epa cnonces `|N |`Acquire encrypted PACE nonces of specific size` |`hf epa replay `|N |`Perform PACE protocol by replaying given APDUs` |`hf epa sim `|N |`Simulate PACE protocol` ### hf emrtd { Machine Readable Travel Document... } |command |offline |description |------- |------- |----------- |`hf emrtd help `|Y |`This help` |`hf emrtd dump `|N |`Dump eMRTD files to binary files` |`hf emrtd info `|Y |`Display info about an eMRTD` |`hf emrtd list `|Y |`List ISO 14443A/7816 history` ### hf felica { ISO18092 / FeliCa RFIDs... } |command |offline |description |------- |------- |----------- |`hf felica help `|Y |`This help` |`hf felica list `|Y |`List ISO 18092/FeliCa history` |`hf felica reader `|N |`Act like an ISO18092/FeliCa reader` |`hf felica info `|N |`Tag information` |`hf felica sniff `|N |`Sniff ISO 18092/FeliCa traffic` |`hf felica raw `|N |`Send raw hex data to tag` |`hf felica rdbl `|N |`read block data from authentication-not-required Service.` |`hf felica wrbl `|N |`write block data to an authentication-not-required Service.` |`hf felica rqservice `|N |`verify the existence of Area and Service, and to acquire Key Version.` |`hf felica rqresponse `|N |`verify the existence of a card and its Mode.` |`hf felica scsvcode `|N |`acquire Area Code and Service Code.` |`hf felica rqsyscode `|N |`acquire System Code registered to the card.` |`hf felica auth1 `|N |`authenticate a card. Start mutual authentication with Auth1` |`hf felica auth2 `|N |`allow a card to authenticate a Reader/Writer. Complete mutual authentication` |`hf felica rqspecver `|N |`acquire the version of card OS.` |`hf felica resetmode `|N |`reset Mode to Mode 0.` |`hf felica litesim `|N |`Emulating ISO/18092 FeliCa Lite tag` |`hf felica litedump `|N |`Wait for and try dumping FelicaLite` ### hf fido { FIDO and FIDO2 authenticators... } |command |offline |description |------- |------- |----------- |`hf fido help `|Y |`This help.` |`hf fido list `|Y |`List ISO 14443A history` |`hf fido info `|N |`Info about FIDO tag.` |`hf fido reg `|N |`FIDO U2F Registration Message.` |`hf fido auth `|N |`FIDO U2F Authentication Message.` |`hf fido make `|N |`FIDO2 MakeCredential command.` |`hf fido assert `|N |`FIDO2 GetAssertion command.` ### hf fudan { Fudan RFIDs... } |command |offline |description |------- |------- |----------- |`hf fudan help `|Y |`This help` |`hf fudan reader `|N |`Act like a fudan reader` |`hf fudan dump `|N |`Dump FUDAN tag to binary file` |`hf fudan rdbl `|N |`Read a fudan tag` |`hf fudan view `|Y |`Display content from tag dump file` |`hf fudan wrbl `|N |`Write a fudan tag` ### hf gallagher { Gallagher DESFire RFIDs... } |command |offline |description |------- |------- |----------- |`hf gallagher help `|Y |`This help` |`hf gallagher reader `|N |`Read & decode all Gallagher credentials on a DESFire card` |`hf gallagher clone `|N |`Add Gallagher credentials to a DESFire card` |`hf gallagher delete `|N |`Delete Gallagher credentials from a DESFire card` |`hf gallagher diversifykey`|Y |`Diversify Gallagher key` |`hf gallagher decode `|Y |`Decode Gallagher credential block` ### hf ksx6924 { KS X 6924 (T-Money, Snapper+) RFIDs } |command |offline |description |------- |------- |----------- |`hf ksx6924 help `|Y |`This help` |`hf ksx6924 select `|N |`Select application, and leave field up` |`hf ksx6924 info `|N |`Get info about a KS X 6924 (T-Money, Snapper+) transit card` |`hf ksx6924 balance `|N |`Get current purse balance` |`hf ksx6924 init `|N |`Perform transaction initialization with Mpda` |`hf ksx6924 prec `|N |`Send proprietary get record command (CLA=90, INS=4C)` ### hf jooki { Jooki RFIDs... } |command |offline |description |------- |------- |----------- |`hf jooki help `|Y |`This help` |`hf jooki clone `|N |`Write a Jooki token` |`hf jooki decode `|Y |`Decode Jooki token` |`hf jooki encode `|Y |`Encode Jooki token` |`hf jooki sim `|N |`Simulate Jooki token` ### hf iclass { ICLASS RFIDs... } |command |offline |description |------- |------- |----------- |`hf iclass help `|Y |`This help` |`hf iclass list `|Y |`List iclass history` |`hf iclass dump `|N |`Dump Picopass / iCLASS tag to file` |`hf iclass info `|N |`Tag information` |`hf iclass rdbl `|N |`Read Picopass / iCLASS block` |`hf iclass reader `|N |`Act like a Picopass / iCLASS reader` |`hf iclass restore `|N |`Restore a dump file onto a Picopass / iCLASS tag` |`hf iclass sniff `|N |`Eavesdrop Picopass / iCLASS communication` |`hf iclass view `|Y |`Display content from tag dump file` |`hf iclass wrbl `|N |`Write Picopass / iCLASS block` |`hf iclass creditepurse `|N |`Credit epurse value` |`hf iclass chk `|N |`Check keys` |`hf iclass loclass `|Y |`Use loclass to perform bruteforce reader attack` |`hf iclass lookup `|Y |`Uses authentication trace to check for key in dictionary file` |`hf iclass sim `|N |`Simulate iCLASS tag` |`hf iclass eload `|N |`Load Picopass / iCLASS dump file into emulator memory` |`hf iclass esave `|N |`Save emulator memory to file` |`hf iclass esetblk `|N |`Set emulator memory block data` |`hf iclass eview `|N |`View emulator memory` |`hf iclass configcard `|N |`Reader configuration card` |`hf iclass calcnewkey `|Y |`Calc diversified keys (blocks 3 & 4) to write new keys` |`hf iclass encode `|Y |`Encode binary wiegand to block 7` |`hf iclass encrypt `|Y |`Encrypt given block data` |`hf iclass decrypt `|Y |`Decrypt given block data or tag dump file` |`hf iclass managekeys `|Y |`Manage keys to use with iclass commands` |`hf iclass permutekey `|Y |`Permute function from 'heart of darkness' paper` |`hf iclass sam `|N |`SAM tests` ### hf legic { LEGIC RFIDs... } |command |offline |description |------- |------- |----------- |`hf legic help `|Y |`This help` |`hf legic dump `|N |`Dump LEGIC Prime tag to binary file` |`hf legic info `|N |`Display deobfuscated and decoded LEGIC Prime tag data` |`hf legic list `|Y |`List LEGIC history` |`hf legic rdbl `|N |`Read bytes from a LEGIC Prime tag` |`hf legic reader `|N |`LEGIC Prime Reader UID and tag info` |`hf legic restore `|N |`Restore a dump file onto a LEGIC Prime tag` |`hf legic wipe `|N |`Wipe a LEGIC Prime tag` |`hf legic wrbl `|N |`Write data to a LEGIC Prime tag` |`hf legic sim `|N |`Start tag simulator` |`hf legic eload `|N |`Load binary dump to emulator memory` |`hf legic esave `|N |`Save emulator memory to binary file` |`hf legic eview `|N |`View emulator memory` |`hf legic einfo `|N |`Display deobfuscated and decoded emulator memory` |`hf legic crc `|Y |`Calculate Legic CRC over given bytes` |`hf legic view `|Y |`Display deobfuscated and decoded content from tag dump file` ### hf lto { LTO Cartridge Memory RFIDs... } |command |offline |description |------- |------- |----------- |`hf lto help `|Y |`This help` |`hf lto dump `|N |`Dump LTO-CM tag to file` |`hf lto info `|N |`Tag information` |`hf lto list `|Y |`List LTO-CM history` |`hf lto rdbl `|N |`Read block` |`hf lto reader `|N |`Act like a LTO-CM reader` |`hf lto restore `|N |`Restore dump file to LTO-CM tag` |`hf lto wrbl `|N |`Write block` ### hf mf { MIFARE RFIDs... } |command |offline |description |------- |------- |----------- |`hf mf help `|Y |`This help` |`hf mf list `|Y |`List MIFARE history` |`hf mf darkside `|N |`Darkside attack` |`hf mf nested `|N |`Nested attack` |`hf mf hardnested `|Y |`Nested attack for hardened MIFARE Classic cards` |`hf mf staticnested `|N |`Nested attack against static nonce MIFARE Classic cards` |`hf mf autopwn `|N |`Automatic key recovery tool for MIFARE Classic` |`hf mf nack `|N |`Test for MIFARE NACK bug` |`hf mf chk `|N |`Check keys` |`hf mf fchk `|N |`Check keys fast, targets all keys on card` |`hf mf decrypt `|Y |`Decrypt Crypto1 data from sniff or trace` |`hf mf supercard `|N |`Extract info from a `super card`` |`hf mf auth4 `|N |`ISO14443-4 AES authentication` |`hf mf acl `|Y |`Decode and print MIFARE Classic access rights bytes` |`hf mf dump `|N |`Dump MIFARE Classic tag to binary file` |`hf mf mad `|Y |`Checks and prints MAD` |`hf mf personalize `|N |`Personalize UID (MIFARE Classic EV1 only)` |`hf mf rdbl `|N |`Read MIFARE Classic block` |`hf mf rdsc `|N |`Read MIFARE Classic sector` |`hf mf restore `|N |`Restore MIFARE Classic binary file to tag` |`hf mf setmod `|N |`Set MIFARE Classic EV1 load modulation strength` |`hf mf value `|Y |`Value blocks` |`hf mf view `|Y |`Display content from tag dump file` |`hf mf wipe `|N |`Wipe card to zeros and default keys/acc` |`hf mf wrbl `|N |`Write MIFARE Classic block` |`hf mf sim `|N |`Simulate MIFARE card` |`hf mf ecfill `|N |`Fill emulator memory with help of keys from emulator` |`hf mf eclr `|N |`Clear emulator memory` |`hf mf egetblk `|N |`Get emulator memory block` |`hf mf egetsc `|N |`Get emulator memory sector` |`hf mf ekeyprn `|N |`Print keys from emulator memory` |`hf mf eload `|N |`Load from file emul dump` |`hf mf esave `|N |`Save to file emul dump` |`hf mf esetblk `|N |`Set emulator memory block` |`hf mf eview `|N |`View emulator memory` |`hf mf cgetblk `|N |`Read block from card` |`hf mf cgetsc `|N |`Read sector from card` |`hf mf cload `|N |`Load dump to card` |`hf mf csave `|N |`Save dump from card into file or emulator` |`hf mf csetblk `|N |`Write block to card` |`hf mf csetuid `|N |`Set UID on card` |`hf mf cview `|N |`View card` |`hf mf cwipe `|N |`Wipe card to default UID/Sectors/Keys` |`hf mf gen3uid `|N |`Set UID without changing manufacturer block` |`hf mf gen3blk `|N |`Overwrite manufacturer block` |`hf mf gen3freeze `|N |`Perma lock UID changes. irreversible` |`hf mf ggetblk `|N |`Read block from card` |`hf mf gload `|N |`Load dump to card` |`hf mf gsave `|N |`Save dump from card into file or emulator` |`hf mf gsetblk `|N |`Write block to card` |`hf mf gview `|N |`View card` |`hf mf gdmcfg `|N |`Read config block from card` |`hf mf gdmsetcfg `|N |`Write config block to card` |`hf mf gdmsetblk `|N |`Write block to card` |`hf mf ndefformat `|N |`Format MIFARE Classic Tag as NFC Tag` |`hf mf ndefread `|N |`Read and print NDEF records from card` |`hf mf ndefwrite `|N |`Write NDEF records to card` |`hf mf encodehid `|N |`Encode a HID Credential / NDEF record to card` ### hf mfp { MIFARE Plus RFIDs... } |command |offline |description |------- |------- |----------- |`hf mfp help `|Y |`This help` |`hf mfp list `|Y |`List MIFARE Plus history` |`hf mfp auth `|N |`Authentication` |`hf mfp chk `|N |`Check keys` |`hf mfp dump `|N |`Dump MIFARE Plus tag to binary file` |`hf mfp info `|N |`Info about MIFARE Plus tag` |`hf mfp mad `|N |`Check and print MAD` |`hf mfp rdbl `|N |`Read blocks from card` |`hf mfp rdsc `|N |`Read sectors from card` |`hf mfp wrbl `|N |`Write block to card` |`hf mfp commitp `|N |`Configure security layer (SL1/SL3 mode)` |`hf mfp initp `|N |`Fill all the card's keys in SL0 mode` |`hf mfp wrp `|N |`Write Perso command` |`hf mfp ndefformat `|N |`Format MIFARE Plus Tag as NFC Tag` |`hf mfp ndefread `|N |`Read and print NDEF records from card` |`hf mfp ndefwrite `|N |`Write NDEF records to card` ### hf mfu { MIFARE Ultralight RFIDs... } |command |offline |description |------- |------- |----------- |`hf mfu help `|Y |`This help` |`hf mfu list `|Y |`List MIFARE Ultralight / NTAG history` |`hf mfu keygen `|Y |`Generate 3DES MIFARE diversified keys` |`hf mfu pwdgen `|Y |`Generate pwd from known algos` |`hf mfu otptear `|N |`Tear-off test on OTP bits` |`hf mfu cauth `|N |`Authentication - Ultralight-C` |`hf mfu dump `|N |`Dump MIFARE Ultralight family tag to binary file` |`hf mfu info `|N |`Tag information` |`hf mfu ndefread `|N |`Prints NDEF records from card` |`hf mfu rdbl `|N |`Read block` |`hf mfu restore `|N |`Restore a dump onto a MFU MAGIC tag` |`hf mfu view `|Y |`Display content from tag dump file` |`hf mfu wrbl `|N |`Write block` |`hf mfu tamper `|N |`Configure the tamper feature on an NTAG 213TT` |`hf mfu eload `|N |`Load Ultralight dump file into emulator memory` |`hf mfu esave `|N |`Save Ultralight dump file from emulator memory` |`hf mfu eview `|N |`View emulator memory` |`hf mfu sim `|N |`Simulate MIFARE Ultralight from emulator memory` |`hf mfu setpwd `|N |`Set 3DES key - Ultralight-C` |`hf mfu setuid `|N |`Set UID - MAGIC tags only` ### hf mfdes { MIFARE Desfire RFIDs... } |command |offline |description |------- |------- |----------- |`hf mfdes help `|Y |`This help` |`hf mfdes info `|N |`Tag information` |`hf mfdes getuid `|N |`Get uid from card` |`hf mfdes default `|N |`Set defaults for all the commands` |`hf mfdes auth `|N |`MIFARE DesFire Authentication` |`hf mfdes chk `|N |`Check keys` |`hf mfdes detect `|N |`Detect key type and tries to find one from the list` |`hf mfdes freemem `|N |`Get free memory size` |`hf mfdes setconfig `|N |`Set card configuration` |`hf mfdes formatpicc `|N |`Format PICC` |`hf mfdes list `|Y |`List DESFire (ISO 14443A) history` |`hf mfdes mad `|N |`Prints MAD records / files from the card` |`hf mfdes lsapp `|N |`Show all applications with files list` |`hf mfdes getaids `|N |`Get Application IDs list` |`hf mfdes getappnames `|N |`Get Applications list` |`hf mfdes bruteaid `|N |`Recover AIDs by bruteforce` |`hf mfdes createapp `|N |`Create Application` |`hf mfdes deleteapp `|N |`Delete Application` |`hf mfdes selectapp `|N |`Select Application ID` |`hf mfdes changekey `|N |`Change Key` |`hf mfdes chkeysettings `|N |`Change Key Settings` |`hf mfdes getkeysettings`|N |`Get Key Settings` |`hf mfdes getkeyversions`|N |`Get Key Versions` |`hf mfdes getfileids `|N |`Get File IDs list` |`hf mfdes getfileisoids `|N |`Get File ISO IDs list` |`hf mfdes lsfiles `|N |`Show all files list` |`hf mfdes dump `|N |`Dump all files` |`hf mfdes createfile `|N |`Create Standard/Backup File` |`hf mfdes createvaluefile`|N |`Create Value File` |`hf mfdes createrecordfile`|N |`Create Linear/Cyclic Record File` |`hf mfdes createmacfile `|N |`Create Transaction MAC File` |`hf mfdes deletefile `|N |`Delete File` |`hf mfdes getfilesettings`|N |`Get file settings` |`hf mfdes chfilesettings`|N |`Change file settings` |`hf mfdes read `|N |`Read data from standard/backup/record/value/mac file` |`hf mfdes write `|N |`Write data to standard/backup/record/value file` |`hf mfdes value `|N |`Operations with value file (get/credit/limited credit/debit/clear)` |`hf mfdes clearrecfile `|N |`Clear record File` |`hf mfdes test `|Y |`Regression crypto tests` ### hf ntag424 { NXP NTAG 4242 DNA RFIDs... } |command |offline |description |------- |------- |----------- |`hf ntag424 help `|Y |`This help` |`hf ntag424 info `|N |`Tag information (not implemented yet)` |`hf ntag424 view `|Y |`Display content from tag dump file` |`hf ntag424 auth `|N |`Test authentication with key` |`hf ntag424 read `|N |`Read file` |`hf ntag424 write `|N |`Write file` |`hf ntag424 getfilesettings`|N |`Get file settings` |`hf ntag424 changefilesettings`|N |`Change file settings` |`hf ntag424 changekey `|N |`Change key` ### hf seos { SEOS RFIDs... } |command |offline |description |------- |------- |----------- |`hf seos help `|Y |`This help` |`hf seos info `|N |`Tag information` |`hf seos list `|Y |`List SEOS history` ### hf st25ta { ST25TA RFIDs... } |command |offline |description |------- |------- |----------- |`hf st25ta help `|Y |`This help` |`hf st25ta info `|N |`Tag information` |`hf st25ta list `|Y |`List ISO 14443A/7816 history` |`hf st25ta ndefread `|Y |`read NDEF file on tag` |`hf st25ta protect `|N |`change protection on tag` |`hf st25ta pwd `|N |`change password on tag` |`hf st25ta sim `|N |`Fake ISO 14443A/ST tag` ### hf tesla { TESLA Cards... } |command |offline |description |------- |------- |----------- |`hf tesla help `|Y |`This help` |`hf tesla info `|N |`Tag information` |`hf tesla list `|Y |`List ISO 14443A/7816 history` ### hf texkom { Texkom RFIDs... } |command |offline |description |------- |------- |----------- |`hf texkom help `|Y |`This help` |`hf texkom reader `|N |`Act like a Texkom reader` |`hf texkom sim `|N |`Simulate a Texkom tag` ### hf thinfilm { Thinfilm RFIDs... } |command |offline |description |------- |------- |----------- |`hf thinfilm help `|Y |`This help` |`hf thinfilm info `|N |`Tag information` |`hf thinfilm list `|Y |`List NFC Barcode / Thinfilm history - not correct` |`hf thinfilm sim `|N |`Fake Thinfilm tag` ### hf topaz { TOPAZ (NFC Type 1) RFIDs... } |command |offline |description |------- |------- |----------- |`hf topaz help `|Y |`This help` |`hf topaz list `|Y |`List Topaz history` |`hf topaz dump `|N |`Dump TOPAZ family tag to file` |`hf topaz info `|N |`Tag information` |`hf topaz raw `|N |`Send raw hex data to tag` |`hf topaz rdbl `|N |`Read block` |`hf topaz reader `|N |`Act like a Topaz reader` |`hf topaz sim `|N |`Simulate Topaz tag` |`hf topaz sniff `|N |`Sniff Topaz reader-tag communication` |`hf topaz view `|Y |`Display content from tag dump file` |`hf topaz wrbl `|N |`Write block` ### hf vas { Apple Value Added Service } |command |offline |description |------- |------- |----------- |`hf vas help `|Y |`This help` |`hf vas reader `|N |`Read and decrypt VAS message` |`hf vas decrypt `|Y |`Decrypt a previously captured VAS cryptogram` ### hf waveshare { Waveshare NFC ePaper... } |command |offline |description |------- |------- |----------- |`hf waveshare help `|Y |`This help` |`hf waveshare loadbmp `|N |`Load BMP file to Waveshare NFC ePaper` ### hf xerox { Fuji/Xerox cartridge RFIDs... } |command |offline |description |------- |------- |----------- |`hf xerox help `|Y |`This help` |`hf xerox info `|N |`Short info on Fuji/Xerox tag` |`hf xerox reader `|N |`Act like a Fuji/Xerox reader` |`hf xerox dump `|N |`Read all memory pages of an Fuji/Xerox tag, save to file` ### hw { Hardware commands... } |command |offline |description |------- |------- |----------- |`hw help `|Y |`This help` |`hw break `|N |`Send break loop usb command` |`hw connect `|Y |`Connect Proxmark3 to serial port` |`hw dbg `|N |`Set Proxmark3 debug level` |`hw detectreader `|N |`Detect external reader field` |`hw fpgaoff `|N |`Set FPGA off` |`hw lcd `|N |`Send command/data to LCD` |`hw lcdreset `|N |`Hardware reset LCD` |`hw ping `|N |`Test if the Proxmark3 is responsive` |`hw readmem `|N |`Read memory at decimal address from flash` |`hw reset `|N |`Reset the Proxmark3` |`hw setlfdivisor `|N |`Drive LF antenna at 12MHz / (divisor + 1)` |`hw setmux `|N |`Set the ADC mux to a specific value` |`hw standalone `|N |`Jump to the standalone mode` |`hw status `|N |`Show runtime status information about the connected Proxmark3` |`hw tearoff `|N |`Program a tearoff hook for the next command supporting tearoff` |`hw tia `|N |`Trigger a Timing Interval Acquisition to re-adjust the RealTimeCounter divider` |`hw timeout `|Y |`Set the communication timeout on the client side` |`hw tune `|N |`Measure antenna tuning` |`hw version `|Y |`Show version information about the client and the connected Proxmark3, if any` ### lf { Low frequency commands... } |command |offline |description |------- |------- |----------- |`lf help `|Y |`This help` |`lf config `|N |`Get/Set config for LF sampling, bit/sample, decimation, frequency` |`lf cmdread `|N |`Modulate LF reader field to send command before read` |`lf read `|N |`Read LF tag` |`lf search `|Y |`Read and Search for valid known tag` |`lf sim `|N |`Simulate LF tag from buffer` |`lf simask `|N |`Simulate ASK tag` |`lf simfsk `|N |`Simulate FSK tag` |`lf simpsk `|N |`Simulate PSK tag` |`lf simbidir `|N |`Simulate LF tag (with bidirectional data transmission between reader and tag)` |`lf sniff `|N |`Sniff LF traffic between reader and tag` |`lf tune `|N |`Continuously measure LF antenna tuning` ### lf awid { AWID RFIDs... } |command |offline |description |------- |------- |----------- |`lf awid help `|Y |`this help` |`lf awid demod `|Y |`demodulate an AWID FSK tag from the GraphBuffer` |`lf awid reader `|N |`attempt to read and extract tag data` |`lf awid clone `|N |`clone AWID tag to T55x7 or Q5/T5555` |`lf awid sim `|N |`simulate AWID tag` |`lf awid brute `|N |`bruteforce card number against reader` |`lf awid watch `|N |`continuously watch for cards. Reader mode` ### lf cotag { COTAG CHIPs... } |command |offline |description |------- |------- |----------- |`lf cotag help `|Y |`This help` |`lf cotag demod `|Y |`demodulate an COTAG tag` |`lf cotag reader `|N |`attempt to read and extract tag data` ### lf destron { FDX-A Destron RFIDs... } |command |offline |description |------- |------- |----------- |`lf destron help `|Y |`This help` |`lf destron demod `|Y |`demodulate an Destron tag from the GraphBuffer` |`lf destron reader `|N |`attempt to read and extract tag data` |`lf destron clone `|N |`clone Destron tag to T55x7` |`lf destron sim `|N |`simulate Destron tag` ### lf em { EM CHIPs & RFIDs... } |command |offline |description |------- |------- |----------- |`lf em help `|Y |`This help` ### lf em 410x { EM 4102 commands... } |command |offline |description |------- |------- |----------- |`lf em 410x help `|Y |`This help` |`lf em 410x demod `|Y |`demodulate a EM410x tag from the GraphBuffer` |`lf em 410x reader `|N |`attempt to read and extract tag data` |`lf em 410x sim `|N |`simulate EM410x tag` |`lf em 410x brute `|N |`reader bruteforce attack by simulating EM410x tags` |`lf em 410x watch `|N |`watches for EM410x 125/134 kHz tags` |`lf em 410x spoof `|N |`watches for EM410x 125/134 kHz tags, and replays them` |`lf em 410x clone `|N |`write EM410x Tag ID to T55x7 or Q5/T5555 tag` ### lf em 4x05 { EM 4205 / 4305 / 4369 / 4469 commands... } |command |offline |description |------- |------- |----------- |`lf em 4x05 help `|Y |`This help` |`lf em 4x05 brute `|N |`Bruteforce password` |`lf em 4x05 chk `|N |`Check passwords from dictionary` |`lf em 4x05 demod `|Y |`Demodulate a EM4x05/EM4x69 tag from the GraphBuffer` |`lf em 4x05 dump `|N |`Dump EM4x05/EM4x69 tag` |`lf em 4x05 info `|N |`Tag information` |`lf em 4x05 read `|N |`Read word data from EM4x05/EM4x69` |`lf em 4x05 sniff `|Y |`Attempt to recover em4x05 commands from sample buffer` |`lf em 4x05 unlock `|N |`Execute tear off against EM4x05/EM4x69` |`lf em 4x05 wipe `|N |`Wipe EM4x05/EM4x69 tag` |`lf em 4x05 write `|N |`Write word data to EM4x05/EM4x69` ### lf em 4x50 { EM 4350 / 4450 commands... } |command |offline |description |------- |------- |----------- |`lf em 4x50 help `|Y |`This help` |`lf em 4x50 brute `|N |`Bruteforce attack to find password` |`lf em 4x50 chk `|N |`Check passwords from dictionary` |`lf em 4x50 dump `|N |`Dump EM4x50 tag` |`lf em 4x50 info `|N |`Tag information` |`lf em 4x50 login `|N |`Login into EM4x50 tag` |`lf em 4x50 rdbl `|N |`Read EM4x50 word data` |`lf em 4x50 reader `|N |`Show standard read mode data` |`lf em 4x50 restore `|N |`Restore EM4x50 dump to tag` |`lf em 4x50 wrbl `|N |`Write EM4x50 word data` |`lf em 4x50 wrpwd `|N |`Change EM4x50 password` |`lf em 4x50 wipe `|N |`Wipe EM4x50 tag` |`lf em 4x50 eload `|N |`Upload EM4x50 dump to emulator memory` |`lf em 4x50 esave `|N |`Save emulator memory to file` |`lf em 4x50 eview `|N |`View EM4x50 content in emulator memory` |`lf em 4x50 sim `|N |`Simulate EM4x50 tag` ### lf em 4x70 { EM 4070 / 4170 commands... } |command |offline |description |------- |------- |----------- |`lf em 4x70 help `|Y |`This help` |`lf em 4x70 brute `|N |`Bruteforce EM4X70 to find partial Crypt Key` |`lf em 4x70 info `|N |`Tag information EM4x70` |`lf em 4x70 write `|N |`Write EM4x70` |`lf em 4x70 unlock `|N |`Unlock EM4x70 for writing` |`lf em 4x70 auth `|N |`Authenticate EM4x70` |`lf em 4x70 writepin `|N |`Write PIN` |`lf em 4x70 writekey `|N |`Write Crypt Key` ### lf fdxb { FDX-B RFIDs... } |command |offline |description |------- |------- |----------- |`lf fdxb help `|Y |`this help` |`lf fdxb demod `|Y |`demodulate a FDX-B ISO11784/85 tag from the GraphBuffer` |`lf fdxb reader `|N |`attempt to read at 134kHz and extract tag data` |`lf fdxb clone `|N |`clone animal ID tag to T55x7 or Q5/T5555` |`lf fdxb sim `|N |`simulate Animal ID tag` ### lf gallagher { GALLAGHER RFIDs... } |command |offline |description |------- |------- |----------- |`lf gallagher help `|Y |`This help` |`lf gallagher demod `|Y |`demodulate an GALLAGHER tag from the GraphBuffer` |`lf gallagher reader `|N |`attempt to read and extract tag data` |`lf gallagher clone `|N |`clone GALLAGHER tag to T55x7` |`lf gallagher sim `|N |`simulate GALLAGHER tag` ### lf gproxii { Guardall Prox II RFIDs... } |command |offline |description |------- |------- |----------- |`lf gproxii help `|Y |`this help` |`lf gproxii demod `|Y |`demodulate a G Prox II tag from the GraphBuffer` |`lf gproxii reader `|N |`attempt to read and extract tag data` |`lf gproxii clone `|N |`clone Guardall tag to T55x7 or Q5/T5555` |`lf gproxii sim `|N |`simulate Guardall tag` ### lf hid { HID Prox RFIDs... } |command |offline |description |------- |------- |----------- |`lf hid help `|Y |`this help` |`lf hid demod `|Y |`demodulate HID Prox tag from the GraphBuffer` |`lf hid reader `|N |`attempt to read and extract tag data` |`lf hid clone `|N |`clone HID tag to T55x7` |`lf hid sim `|N |`simulate HID tag` |`lf hid brute `|N |`bruteforce facility code or card number against reader` |`lf hid watch `|N |`continuously watch for cards. Reader mode` ### lf hitag { Hitag CHIPs... } |command |offline |description |------- |------- |----------- |`lf hitag help `|Y |`This help` |`lf hitag list `|Y |`List Hitag trace history` |`lf hitag info `|N |`Hitag 2 tag information` |`lf hitag dump `|N |`Dump Hitag 2 tag` |`lf hitag read `|N |`Read Hitag memory` |`lf hitag wrbl `|N |`Write a block (page) in Hitag memory` |`lf hitag sniff `|N |`Eavesdrop Hitag communication` |`lf hitag cc `|N |`Hitag S: test all provided challenges` |`lf hitag ta `|N |`Hitag 2: test all recorded authentications` |`lf hitag eload `|N |`Load Hitag dump file into emulator memory` |`lf hitag sim `|N |`Simulate Hitag transponder` ### lf idteck { Idteck RFIDs... } |command |offline |description |------- |------- |----------- |`lf idteck help `|Y |`This help` |`lf idteck demod `|Y |`demodulate an Idteck tag from the GraphBuffer` |`lf idteck reader `|N |`attempt to read and extract tag data` |`lf idteck clone `|N |`clone Idteck tag to T55x7 or Q5/T5555` |`lf idteck sim `|N |`simulate Idteck tag` ### lf indala { Indala RFIDs... } |command |offline |description |------- |------- |----------- |`lf indala help `|Y |`This help` |`lf indala brute `|N |`Demodulate an Indala tag (PSK1) from the GraphBuffer` |`lf indala demod `|Y |`Demodulate an Indala tag (PSK1) from the GraphBuffer` |`lf indala altdemod `|Y |`Alternative method to demodulate samples for Indala 64 bit UID (option '224' for 224 bit)` |`lf indala reader `|N |`Read an Indala tag from the antenna` |`lf indala clone `|N |`Clone Indala tag to T55x7 or Q5/T5555` |`lf indala sim `|N |`Simulate Indala tag` ### lf io { ioProx RFIDs... } |command |offline |description |------- |------- |----------- |`lf io help `|Y |`this help` |`lf io demod `|Y |`demodulate an ioProx tag from the GraphBuffer` |`lf io reader `|N |`attempt to read and extract tag data` |`lf io clone `|N |`clone ioProx tag to T55x7 or Q5/T5555` |`lf io sim `|N |`simulate ioProx tag` |`lf io watch `|N |`continuously watch for cards. Reader mode` ### lf jablotron { Jablotron RFIDs... } |command |offline |description |------- |------- |----------- |`lf jablotron help `|Y |`This help` |`lf jablotron demod `|Y |`demodulate an Jablotron tag from the GraphBuffer` |`lf jablotron reader `|N |`attempt to read and extract tag data` |`lf jablotron clone `|N |`clone jablotron tag to T55x7 or Q5/T5555` |`lf jablotron sim `|N |`simulate jablotron tag` ### lf keri { KERI RFIDs... } |command |offline |description |------- |------- |----------- |`lf keri help `|Y |`This help` |`lf keri demod `|Y |`demodulate an KERI tag from the GraphBuffer` |`lf keri reader `|N |`attempt to read and extract tag data` |`lf keri clone `|N |`clone KERI tag to T55x7 or Q5/T5555` |`lf keri sim `|N |`simulate KERI tag` ### lf motorola { Motorola Flexpass RFIDs... } |command |offline |description |------- |------- |----------- |`lf motorola help `|Y |`This help` |`lf motorola demod `|Y |`demodulate an MOTOROLA tag from the GraphBuffer` |`lf motorola reader `|N |`attempt to read and extract tag data` |`lf motorola clone `|N |`clone MOTOROLA tag to T55x7` |`lf motorola sim `|N |`simulate MOTOROLA tag` ### lf nedap { Nedap RFIDs... } |command |offline |description |------- |------- |----------- |`lf nedap help `|Y |`This help` |`lf nedap demod `|Y |`demodulate Nedap tag from the GraphBuffer` |`lf nedap reader `|N |`attempt to read and extract tag data` |`lf nedap clone `|N |`clone Nedap tag to T55x7 or Q5/T5555` |`lf nedap sim `|N |`simulate Nedap tag` ### lf nexwatch { NexWatch RFIDs... } |command |offline |description |------- |------- |----------- |`lf nexwatch help `|Y |`This help` |`lf nexwatch demod `|Y |`demodulate a NexWatch tag (nexkey, quadrakey) from the GraphBuffer` |`lf nexwatch reader `|N |`attempt to read and extract tag data` |`lf nexwatch clone `|N |`clone NexWatch tag to T55x7` |`lf nexwatch sim `|N |`simulate NexWatch tag` ### lf noralsy { Noralsy RFIDs... } |command |offline |description |------- |------- |----------- |`lf noralsy help `|Y |`This help` |`lf noralsy demod `|Y |`demodulate an Noralsy tag from the GraphBuffer` |`lf noralsy reader `|N |`attempt to read and extract tag data` |`lf noralsy clone `|N |`clone Noralsy tag to T55x7 or Q5/T5555` |`lf noralsy sim `|N |`simulate Noralsy tag` ### lf pac { PAC/Stanley RFIDs... } |command |offline |description |------- |------- |----------- |`lf pac help `|Y |`This help` |`lf pac demod `|Y |`demodulate a PAC tag from the GraphBuffer` |`lf pac reader `|N |`attempt to read and extract tag data` |`lf pac clone `|N |`clone PAC tag to T55x7` |`lf pac sim `|N |`simulate PAC tag` ### lf paradox { Paradox RFIDs... } |command |offline |description |------- |------- |----------- |`lf paradox help `|Y |`This help` |`lf paradox demod `|Y |`demodulate a Paradox FSK tag from the GraphBuffer` |`lf paradox reader `|N |`attempt to read and extract tag data` |`lf paradox clone `|N |`clone paradox tag` |`lf paradox sim `|N |`simulate paradox tag` ### lf pcf7931 { PCF7931 CHIPs... } |command |offline |description |------- |------- |----------- |`lf pcf7931 help `|Y |`This help` |`lf pcf7931 reader `|N |`Read content of a PCF7931 transponder` |`lf pcf7931 write `|N |`Write data on a PCF7931 transponder.` |`lf pcf7931 config `|Y |`Configure the password, the tags initialization delay and time offsets (optional)` ### lf presco { Presco RFIDs... } |command |offline |description |------- |------- |----------- |`lf presco help `|Y |`This help` |`lf presco demod `|Y |`demodulate Presco tag from the GraphBuffer` |`lf presco reader `|N |`attempt to read and extract tag data` |`lf presco clone `|N |`clone presco tag to T55x7 or Q5/T5555` |`lf presco sim `|N |`simulate presco tag` ### lf pyramid { Farpointe/Pyramid RFIDs... } |command |offline |description |------- |------- |----------- |`lf pyramid help `|Y |`this help` |`lf pyramid demod `|Y |`demodulate a Pyramid FSK tag from the GraphBuffer` |`lf pyramid reader `|N |`attempt to read and extract tag data` |`lf pyramid clone `|N |`clone pyramid tag to T55x7 or Q5/T5555` |`lf pyramid sim `|N |`simulate pyramid tag` ### lf securakey { Securakey RFIDs... } |command |offline |description |------- |------- |----------- |`lf securakey help `|Y |`This help` |`lf securakey demod `|Y |`demodulate an Securakey tag from the GraphBuffer` |`lf securakey reader `|N |`attempt to read and extract tag data` |`lf securakey clone `|N |`clone Securakey tag to T55x7` |`lf securakey sim `|N |`simulate Securakey tag` ### lf ti { TI CHIPs... } |command |offline |description |------- |------- |----------- |`lf ti help `|Y |`This help` |`lf ti demod `|Y |`Demodulate raw bits for TI LF tag from the GraphBuffer` |`lf ti reader `|N |`Read and decode a TI 134 kHz tag` |`lf ti write `|N |`Write new data to a r/w TI 134 kHz tag` ### lf t55xx { T55xx CHIPs... } |command |offline |description |------- |------- |----------- |`lf t55xx help `|Y |`This help` |`lf t55xx clonehelp `|N |`Shows the available clone commands` |`lf t55xx config `|Y |`Set/Get T55XX configuration (modulation, inverted, offset, rate)` |`lf t55xx dangerraw `|N |`Sends raw bitstream. Dangerous, do not use!!` |`lf t55xx detect `|Y |`Try detecting the tag modulation from reading the configuration block` |`lf t55xx deviceconfig `|N |`Set/Get T55XX device configuration` |`lf t55xx dump `|N |`Dump T55xx card Page 0 block 0-7` |`lf t55xx info `|Y |`Show T55x7 configuration data (page 0/ blk 0)` |`lf t55xx p1detect `|N |`Try detecting if this is a t55xx tag by reading page 1` |`lf t55xx read `|N |`Read T55xx block data` |`lf t55xx resetread `|N |`Send Reset Cmd then lf read the stream to attempt to identify the start of it` |`lf t55xx restore `|N |`Restore T55xx card Page 0 / Page 1 blocks` |`lf t55xx trace `|Y |`Show T55x7 traceability data (page 1/ blk 0-1)` |`lf t55xx wakeup `|N |`Send AOR wakeup command` |`lf t55xx write `|N |`Write T55xx block data` |`lf t55xx bruteforce `|N |`Simple bruteforce attack to find password` |`lf t55xx chk `|N |`Check passwords from dictionary/flash` |`lf t55xx protect `|N |`Password protect tag` |`lf t55xx recoverpw `|N |`Try to recover from bad password write from a cloner` |`lf t55xx sniff `|Y |`Attempt to recover T55xx commands from sample buffer` |`lf t55xx special `|N |`Show block changes with 64 different offsets` |`lf t55xx wipe `|N |`Wipe a T55xx tag and set defaults (will destroy any data on tag)` ### lf viking { Viking RFIDs... } |command |offline |description |------- |------- |----------- |`lf viking help `|Y |`This help` |`lf viking demod `|Y |`demodulate a Viking tag from the GraphBuffer` |`lf viking reader `|N |`attempt to read and extract tag data` |`lf viking clone `|N |`clone Viking tag to T55x7 or Q5/T5555` |`lf viking sim `|N |`simulate Viking tag` ### lf visa2000 { Visa2000 RFIDs... } |command |offline |description |------- |------- |----------- |`lf visa2000 help `|Y |`This help` |`lf visa2000 demod `|Y |`demodulate an VISA2000 tag from the GraphBuffer` |`lf visa2000 reader `|N |`attempt to read and extract tag data` |`lf visa2000 clone `|N |`clone Visa2000 tag to T55x7 or Q5/T5555` |`lf visa2000 sim `|N |`simulate Visa2000 tag` ### mem { Flash memory manipulation... } |command |offline |description |------- |------- |----------- |`mem help `|Y |`This help` |`mem baudrate `|N |`Set Flash memory Spi baudrate` |`mem dump `|N |`Dump data from flash memory` |`mem info `|N |`Flash memory information` |`mem load `|N |`Load data to flash memory` |`mem wipe `|N |`Wipe data from flash memory` ### mem spiffs { SPI File system } |command |offline |description |------- |------- |----------- |`mem spiffs help `|Y |`This help` |`mem spiffs copy `|N |`Copy a file to another (destructively) in SPIFFS file system` |`mem spiffs check `|N |`Check/try to defrag faulty/fragmented file system` |`mem spiffs dump `|N |`Dump a file from SPIFFS file system` |`mem spiffs info `|N |`Print file system info and usage statistics` |`mem spiffs mount `|N |`Mount the SPIFFS file system if not already mounted` |`mem spiffs remove `|N |`Remove a file from SPIFFS file system` |`mem spiffs rename `|N |`Rename/move a file in SPIFFS file system` |`mem spiffs test `|N |`Test SPIFFS Operations` |`mem spiffs tree `|N |`Print the Flash memory file system tree` |`mem spiffs unmount `|N |`Un-mount the SPIFFS file system` |`mem spiffs upload `|N |`Upload file into SPIFFS file system` |`mem spiffs view `|N |`View file on SPIFFS file system` |`mem spiffs wipe `|N |`Wipe all files from SPIFFS file system * dangerous *` ### nfc { NFC commands... } |command |offline |description |------- |------- |----------- |`nfc help `|Y |`This help` |`nfc decode `|Y |`Decode NDEF records` ### nfc type1 { NFC Forum Tag Type 1... } |command |offline |description |------- |------- |----------- |`nfc type1 read `|N |`read NFC Forum Tag Type 1` |`nfc type1 help `|Y |`This help` ### nfc type2 { NFC Forum Tag Type 2... } |command |offline |description |------- |------- |----------- |`nfc type2 read `|N |`read NFC Forum Tag Type 2` |`nfc type2 help `|Y |`This help` ### nfc type4a { NFC Forum Tag Type 4 ISO14443A... } |command |offline |description |------- |------- |----------- |`nfc type4a format `|N |`format ISO-14443-a tag as NFC Tag` |`nfc type4a read `|N |`read NFC Forum Tag Type 4 A` |`nfc type4a write `|N |`write NFC Forum Tag Type 4 A` |`nfc type4a st25taread `|N |`read ST25TA as NFC Forum Tag Type 4` |`nfc type4a help `|Y |`This help` ### nfc type4b { NFC Forum Tag Type 4 ISO14443B... } |command |offline |description |------- |------- |----------- |`nfc type4b read `|N |`read NFC Forum Tag Type 4 B` |`nfc type4b help `|Y |`This help` ### nfc mf { NFC Type MIFARE Classic/Plus Tag... } |command |offline |description |------- |------- |----------- |`nfc mf cformat `|N |`format MIFARE Classic Tag as NFC Tag` |`nfc mf cread `|N |`read NFC Type MIFARE Classic Tag` |`nfc mf cwrite `|N |`write NFC Type MIFARE Classic Tag` |`nfc mf pread `|N |`read NFC Type MIFARE Plus Tag` |`nfc mf help `|Y |`This help` ### nfc barcode { NFC Barcode Tag... } |command |offline |description |------- |------- |----------- |`nfc barcode read `|N |`read NFC Barcode` |`nfc barcode sim `|N |`simulate NFC Barcode` |`nfc barcode help `|Y |`This help` ### piv { PIV commands... } |command |offline |description |------- |------- |----------- |`piv help `|Y |`This help` |`piv select `|N |`Select the PIV applet` |`piv getdata `|N |`Gets a container on a PIV card` |`piv authsign `|N |`Authenticate with the card` |`piv scan `|N |`Scan PIV card for known containers` |`piv list `|Y |`List ISO7816 history` ### reveng { CRC calculations from RevEng software... } [=] reveng: no mode switch specified. Use reveng -h for help. ### smart { Smart card ISO-7816 commands... } |command |offline |description |------- |------- |----------- |`smart help `|Y |`This help` |`smart list `|Y |`List ISO 7816 history` |`smart info `|N |`Tag information` |`smart reader `|N |`Act like an IS07816 reader` |`smart raw `|N |`Send raw hex data to tag` |`smart upgrade `|Y |`Upgrade sim module firmware` |`smart setclock `|N |`Set clock speed` |`smart brute `|N |`Bruteforce SFI` ### script { Scripting commands... } |command |offline |description |------- |------- |----------- |`script help `|Y |`This help` |`script list `|Y |`List available scripts` |`script run `|Y |` - execute a script` ### trace { Trace manipulation... } |command |offline |description |------- |------- |----------- |`trace help `|Y |`This help` |`trace extract `|Y |`Extract authentication challenges found in trace` |`trace list `|Y |`List protocol data in trace buffer` |`trace load `|Y |`Load trace from file` |`trace save `|Y |`Save trace buffer to file` ### usart { USART commands... } |command |offline |description |------- |------- |----------- |`usart help `|Y |`This help` |`usart btpin `|N |`Change BT add-on PIN` |`usart btfactory `|N |`Reset BT add-on to factory settings` |`usart tx `|N |`Send string over USART` |`usart rx `|N |`Receive string over USART` |`usart txrx `|N |`Send string over USART and wait for response` |`usart txhex `|N |`Send bytes over USART` |`usart rxhex `|N |`Receive bytes over USART` |`usart config `|N |`Configure USART` ### wiegand { Wiegand format manipulation... } |command |offline |description |------- |------- |----------- |`wiegand help `|Y |`This help` |`wiegand list `|Y |`List available wiegand formats` |`wiegand encode `|Y |`Encode to wiegand raw hex (currently for HID Prox)` |`wiegand decode `|Y |`Convert raw hex to decoded wiegand format (currently for HID Prox)` Full help dump done.