RfidResearchGroup/proxmark3
1
1
Fork 0
mirror of https://github.com/RfidResearchGroup/proxmark3.git synced 2024-11-15 06:09:13 +08:00
Code Issues Projects Releases Packages Wiki Activity
proxmark3/doc/commands.json
iceman1001 b3285cce8a style
2024-11-02 15:13:40 +01:00

13010 lines
655 KiB
JSON
Raw Blame History

{
"commands": {
"analyse a": {
"command": "analyse a",
"description": "Iceman's personal garbage test command",
"notes": [
"analyse a -d 137AF00A0A0D"
],
"offline": true,
"options": [
"-h, --help This help",
"-d, --data <hex> bytes to manipulate"
],
"usage": "analyse a [-h] -d <hex>"
},
"analyse chksum": {
"command": "analyse chksum",
"description": "The bytes will be added with eachother and than limited with the applied mask Finally compute ones' complement of the least significant bytes.",
"notes": [
"analyse chksum -d 137AF00A0A0D -> expected output: 0x61",
"analyse chksum -d 137AF00A0A0D -m FF"
],
"offline": true,
"options": [
"-h, --help This help",
"-d, --data <hex> bytes to calc checksum",
"-m, --mask <hex> bit mask to limit the output (4 hex bytes max)",
"-v, --verbose verbose output"
],
"usage": "analyse chksum [-hv] -d <hex> [-m <hex>]"
},
"analyse crc": {
"command": "analyse crc",
"description": "A stub method to test different crc implementations inside the PM3 sourcecode. Just because you figured out the poly, doesn't mean you get the desired output",
"notes": [
"analyse crc -d 137AF00A0A0D"
],
"offline": true,
"options": [
"-h, --help This help",
"-d, --data <hex> bytes to calc crc"
],
"usage": "analyse crc [-h] -d <hex>"
},
"analyse dates": {
"command": "analyse dates",
"description": "Tool to look for date/time stamps in a given array of bytes",
"notes": [
"analyse dates"
],
"offline": true,
"options": [
"-h, --help This help"
],
"usage": "analyse dates [-h]"
},
"analyse demodbuff": {
"command": "analyse demodbuff",
"description": "loads a binary string into DemodBuffer",
"notes": [
"analyse demodbuff -d 0011101001001011"
],
"offline": true,
"options": [
"-h, --help This help",
"-d, --data <bin> binary string to load"
],
"usage": "analyse demodbuff [-h] -d <bin>"
},
"analyse foo": {
"command": "analyse foo",
"description": "experiments of cliparse",
"notes": [
"analyse foo -r a0000000a0002021"
],
"offline": true,
"options": [
"-h, --help This help",
"-r, --raw <hex> raw bytes"
],
"usage": "analyse foo [-h] -r <hex>"
},
"analyse freq": {
"command": "analyse freq",
"description": "calc wave lengths",
"notes": [
"analyse freq"
],
"offline": true,
"options": [
"-h, --help This help",
"-F, --freq <int> resonating frequency F in hertz (Hz)",
"-L, --cap <int> capacitance C in micro farads (F)",
"-C, --ind <int> inductance in micro henries (H)"
],
"usage": "analyse freq [-h] [-F <int>] [-L <int>] [-C <int>]"
},
"analyse help": {
"command": "analyse help",
"description": "help This help lrc Generate final byte for XOR LRC crc Stub method for CRC evaluations chksum Checksum with adding, masking and one's complement dates Look for datestamps in a given array of bytes lfsr LFSR tests a num bits test nuid create NUID from 7byte UID demodbuff Load binary string to DemodBuffer freq Calc wave lengths foo muxer units convert ETU <> US <> SSP_CLK (3.39MHz) --------------------------------------------------------------------------------------- analyse lrc available offline: yes Specifying the bytes of a UID with a known LRC will find the last byte value needed to generate that LRC with a rolling XOR. All bytes should be specified in HEX.",
"notes": [
"analyse lrc -d 04008064BA -> Target (BA) requires final LRC XOR byte value: 5A"
],
"offline": true,
"options": [
"-h, --help This help",
"-d, --data <hex> bytes to calc missing XOR in a LRC"
],
"usage": "analyse lrc [-h] -d <hex>"
},
"analyse lfsr": {
"command": "analyse lfsr",
"description": "looks at LEGIC Prime's lfsr, iterates the first 48 values",
"notes": [
"analyse lfsr --iv 55"
],
"offline": true,
"options": [
"-h, --help This help",
"--iv <hex> init vector data (1 hex byte)",
"--find <hex> lfsr data to find (1 hex byte)"
],
"usage": "analyse lfsr [-h] --iv <hex> [--find <hex>]"
},
"analyse nuid": {
"command": "analyse nuid",
"description": "Generate 4byte NUID from 7byte UID",
"notes": [
"analyse nuid -d 11223344556677"
],
"offline": true,
"options": [
"-h, --help This help",
"-d, --data <hex> bytes to send",
"-t, --test self test"
],
"usage": "analyse nuid [-ht] [-d <hex>]"
},
"analyse units": {
"command": "analyse units",
"description": "experiments of unit conversions found in HF. ETU (1/13.56mhz), US or SSP_CLK (1/3.39MHz)",
"notes": [
"analyse uints --etu 10",
"analyse uints --us 100"
],
"offline": true,
"options": [
"-h, --help This help",
"--etu <dec> number in ETU",
"--us <dec> number in micro seconds (us)",
"-t, --selftest self tests"
],
"usage": "analyse units [-ht] [--etu <dec>] [--us <dec>]"
},
"clear": {
"command": "clear",
"description": "Clear the Proxmark3 client terminal screen",
"notes": [
"clear -> clear the terminal screen",
"clear -b -> clear the terminal screen and the scrollback buffer"
],
"offline": true,
"options": [
"-h, --help This help",
"-b, --back also clear the scrollback buffer"
],
"usage": "clear [-hb]"
},
"data askedgedetect": {
"command": "data askedgedetect",
"description": "Adjust Graph for manual ASK demod using the length of sample differences to detect the edge of a wave",
"notes": [
"data askedgedetect -t 20"
],
"offline": true,
"options": [
"-h, --help This help",
"-t, --thres <dec> threshold, use 20 - 45 (def 25)"
],
"usage": "data askedgedetect [-h] [-t <dec>]"
},
"data asn1": {
"command": "data asn1",
"description": "Decode ASN1 bytearray",
"notes": [
"data asn1 -d 303381050186922305a5020500a6088101010403030008a7188516eeee4facacf4fbde5e5c49d95e55bfbca74267b02407a9020500"
],
"offline": true,
"options": [
"-h, --help This help",
"-d <hex> ASN1 encoded byte array",
"--test perform self tests"
],
"usage": "data asn1 [-h] [-d <hex>] [--test]"
},
"data atr": {
"command": "data atr",
"description": "look up ATR record from bytearray",
"notes": [
"data atr -d 3B6B00000031C064BE1B0100079000"
],
"offline": true,
"options": [
"-h, --help This help",
"-d <hex> ASN1 encoded byte array"
],
"usage": "data atr [-h] [-d <hex>]"
},
"data autocorr": {
"command": "data autocorr",
"description": "Autocorrelate over window is used to detect repeating sequences. We use it as detection of how long in bits a message inside the signal is",
"notes": [
"data autocorr -w 4000",
"data autocorr -w 4000 -g"
],
"offline": true,
"options": [
"-h, --help This help",
"-g save back to GraphBuffer (overwrite)",
"-w, --win <dec> window length for correlation. def 4000"
],
"usage": "data autocorr [-hg] [-w <dec>]"
},
"data biphaserawdecode": {
"command": "data biphaserawdecode",
"description": "Biphase decode binary stream in DemodBuffer Converts 10 or 01 -> 1 and 11 or 00 -> 0 - must have binary sequence in DemodBuffer (run `data rawdemod --ar` before) - invert for Conditional Dephase Encoding (CDP) AKA Differential Manchester",
"notes": [
"data biphaserawdecode -> decode biphase bitstream from the DemodBuffer",
"data biphaserawdecode -oi -> decode biphase bitstream from the DemodBuffer, adjust offset, and invert output"
],
"offline": true,
"options": [
"-h, --help This help",
"-o, --offset set to adjust decode start position",
"-i, --inv invert output",
"--err <dec> set max errors tolerated (def 20)"
],
"usage": "data biphaserawdecode [-hoi] [--err <dec>]"
},
"data bitsamples": {
"command": "data bitsamples",
"description": "Get raw samples from device as bitstring",
"notes": [
"data bitsamples"
],
"offline": false,
"options": [
"-h, --help This help"
],
"usage": "data bitsamples [-h]"
},
"data bmap": {
"command": "data bmap",
"description": "Breaks down a hex value to binary according a template data bmap -d 16 -m 4,4 This will give two rows each with four bits",
"notes": [
"data bmap -d 3B",
"data bmap -d 3B -m 2,5,1"
],
"offline": true,
"options": [
"-h, --help This help",
"-d <hex> hex string",
"-m <str> binary template"
],
"usage": "data bmap [-h] [-d <hex>] [-m <str>]"
},
"data convertbitstream": {
"command": "data convertbitstream",
"description": "Convert GraphBuffer's 0|1 values to 127|-127",
"notes": [
"data convertbitstream"
],
"offline": true,
"options": [
"-h, --help This help"
],
"usage": "data convertbitstream [-h]"
},
"data crypto": {
"command": "data crypto",
"description": "Encrypt data, right here, right now. Or decrypt.",
"notes": [
"Supply data, key, IV (needed for des MAC or aes), and cryptography action.",
"To calculate a MAC for FMCOS, supply challenge as IV, data as data, and session/line protection key as key.",
"To calculate a MAC for FeliCa, supply first RC as IV, BLE+data as data and session key as key.",
"data crypto -d 04D6850E06AABB80 -k FFFFFFFFFFFFFFFF --iv 9EA0401A00000000 --des -> Calculate a MAC for FMCOS chip. The result should be ED3A0133"
],
"offline": true,
"options": [
"-h, --help This help",
"-d, --data <hex> Data to process",
"-k, --key <hex> Key to use",
"-r, --rev Decrypt, not encrypt",
"--des Cipher with DES, not AES",
"--mac Calculate AES CMAC/FeliCa Lite MAC",
"--iv <hex> IV value if needed"
],
"usage": "data crypto [-hr] -d <hex> -k <hex> [--des] [--mac] [--iv <hex>]"
},
"data cthreshold": {
"command": "data cthreshold",
"description": "Inverse of dirty threshold command, all values between up and down will be average out",
"notes": [
"data cthreshold -u 10 -d -10"
],
"offline": true,
"options": [
"-h, --help This help",
"-d, --down <dec> threshold down",
"-u, --up <dec> threshold up"
],
"usage": "data cthreshold [-h] -d <dec> -u <dec>"
},
"data decimate": {
"command": "data decimate",
"description": "Performs decimation, by reducing samples N times in the grapbuf. Good for PSK",
"notes": [
"data decimate",
"data decimate -n 4"
],
"offline": true,
"options": [
"-h, --help This help",
"-n <dec> factor to reduce sample set (default 2)"
],
"usage": "data decimate [-h] [-n <dec>]"
},
"data detectclock": {
"command": "data detectclock",
"description": "Detect ASK, FSK, NRZ, PSK clock rate of wave in GraphBuffer",
"notes": [
"data detectclock --ask",
"data detectclock --nzr -> detect clock of an nrz/direct wave in GraphBuffer"
],
"offline": true,
"options": [
"-h, --help This help",
"--ask specify ASK modulation clock detection",
"--fsk specify FSK modulation clock detection",
"--nzr specify NZR/DIRECT modulation clock detection",
"--psk specify PSK modulation clock detection"
],
"usage": "data detectclock [-h] [--ask] [--fsk] [--nzr] [--psk]"
},
"data diff": {
"command": "data diff",
"description": "Diff takes a multitude of input data and makes a binary compare. It accepts filenames (filesystem or RDV4 flashmem SPIFFS), emulator memory, magic gen1",
"notes": [
"data diff -w 4 -a hf-mfu-01020304.bin -b hf-mfu-04030201.bin",
"data diff -a fileA -b fileB",
"data diff -a fileA --eb",
"data diff --fa fileA -b fileB",
"data diff --fa fileA --fb fileB"
],
"offline": true,
"options": [
"-h, --help This help",
"-a <fn> input file name A",
"-b <fn> input file name B",
"--eb emulator memory <hf mf esave>",
"--fa <fn> input spiffs file A",
"--fb <fn> input spiffs file B",
"-w <4|8|16> Width of data output"
],
"usage": "data diff [-h] [-a <fn>] [-b <fn>] [--eb] [--fa <fn>] [--fb <fn>] [-w <4|8|16>]"
},
"data dirthreshold": {
"command": "data dirthreshold",
"description": "Max rising higher up-thres/ Min falling lower down-thres, keep rest as prev.",
"notes": [
"data dirthreshold -u 10 -d -10"
],
"offline": true,
"options": [
"-h, --help This help",
"-d, --down <dec> threshold down",
"-u, --up <dec> threshold up"
],
"usage": "data dirthreshold [-h] -d <dec> -u <dec>"
},
"data envelope": {
"command": "data envelope",
"description": "Create an square envelope of the samples",
"notes": [
"data envelope"
],
"offline": true,
"options": [
"-h, --help This help"
],
"usage": "data envelope [-h]"
},
"data fsktonrz": {
"command": "data fsktonrz",
"description": "Convert fsk2 to nrz wave for alternate fsk demodulating (for weak fsk) Omitted values are autodetect instead",
"notes": [
"data fsktonrz",
"data fsktonrz -c 32 --low 8 --hi 10"
],
"offline": true,
"options": [
"-h, --help This help",
"-c, --clk <dec> clock",
"--low <dec> low field clock",
"--hi <dec> high field clock"
],
"usage": "data fsktonrz [-h] [-c <dec>] [--low <dec>] [--hi <dec>]"
},
"data getbitstream": {
"command": "data getbitstream",
"description": "Convert GraphBuffer's value accordingly - larger or equal to ONE becomes ONE - less than ONE becomes ZERO",
"notes": [
"data getbitstream"
],
"offline": true,
"options": [
"-h, --help This help"
],
"usage": "data getbitstream [-h]"
},
"data grid": {
"command": "data grid",
"description": "This function overlay grid on graph plot window. use zero value to turn off either",
"notes": [
"data grid -> turn off",
"data grid -x 64 -y 50"
],
"offline": true,
"options": [
"-h, --help This help",
"-x <dec> plot grid X coord",
"-y <dec> plot grid Y coord"
],
"usage": "data grid [-h] [-x <dec>] [-y <dec>]"
},
"data help": {
"command": "data help",
"description": "help This help ----------- ------------------------- General------------------------- clear Clears various buffers used by the graph window hide Hide the graph window load Load contents of file into graph window num Converts dec/hex/bin plot Show the graph window print Print the data in the DemodBuffer save Save signal trace data setdebugmode Set Debugging Level on client side xor Xor a input string ----------- ------------------------- Modulation------------------------- biphaserawdecode Biphase decode bin stream in DemodBuffer detectclock Detect ASK, FSK, NRZ, PSK clock rate of wave in GraphBuffer fsktonrz Convert fsk2 to nrz wave for alternate fsk demodulating (for weak fsk) manrawdecode Manchester decode binary stream in DemodBuffer modulation Identify LF signal for clock and modulation rawdemod Demodulate the data in the GraphBuffer and output binary ----------- ------------------------- Graph------------------------- askedgedetect Adjust Graph for manual ASK demod autocorr Autocorrelation over window convertbitstream Convert GraphBuffer's 0/1 values to 127 / -127 cthreshold Average out all values between dirthreshold Max rising higher up-thres/ Min falling lower down-thres decimate Decimate samples envelope Generate square envelope of samples grid overlay grid on graph window getbitstream Convert GraphBuffer's >=1 values to 1 and <1 to 0 hpf Remove DC offset from trace iir Apply IIR buttersworth filter on plot data ltrim Trim samples from left of trace mtrim Trim out samples from the specified start to the specified stop norm Normalize max/min to +/-128 rtrim Trim samples from right of trace setgraphmarkers Set the markers in the graph window shiftgraphzero Shift 0 for Graphed wave + or - shift value timescale Set cursor display timescale undecimate Un-decimate samples zerocrossings Count time between zero-crossings ----------- ------------------------- Operations------------------------- asn1 ASN1 decoder atr ATR lookup bmap Convert hex value according a binary template crypto Encrypt and decrypt data diff Diff of input files --------------------------------------------------------------------------------------- data clear available offline: yes This function clears the BigBuf on device side and graph window ( graphbuffer )",
"notes": [
"data clear"
],
"offline": true,
"options": [
"-h, --help This help"
],
"usage": "data clear [-h]"
},
"data hexsamples": {
"command": "data hexsamples",
"description": "Dump big buffer as hex bytes",
"notes": [
"data hexsamples -n 128 -> dumps 128 bytes from offset 0"
],
"offline": false,
"options": [
"-h, --help This help",
"-b, --breaks <dec> row break, def 16",
"-n <dec> num of bytes to download",
"-o, --offset <hex> offset in big buffer"
],
"usage": "data hexsamples [-h] [-b <dec>] [-n <dec>] [-o <hex>]"
},
"data hide": {
"command": "data hide",
"description": "Show graph window",
"notes": [
"data hide"
],
"offline": true,
"options": [
"-h, --help This help"
],
"usage": "data hide [-h]"
},
"data hpf": {
"command": "data hpf",
"description": "Remove DC offset from trace. It should centralize around 0",
"notes": [
"data hpf"
],
"offline": true,
"options": [
"-h, --help This help"
],
"usage": "data hpf [-h]"
},
"data iir": {
"command": "data iir",
"description": "Apply IIR buttersworth filter on plot data",
"notes": [
"data iir -n 2"
],
"offline": true,
"options": [
"-h, --help This help",
"-n <dec> factor n"
],
"usage": "data iir [-h] -n <dec>"
},
"data load": {
"command": "data load",
"description": "This command loads the contents of a pm3 file into graph window",
"notes": [
"data load -f myfilename"
],
"offline": true,
"options": [
"-h, --help This help",
"-f, --file <fn> file to load",
"-b, --bin binary file",
"-n, --no-fix Load data from file without any transformations"
],
"usage": "data load [-hbn] -f <fn>"
},
"data ltrim": {
"command": "data ltrim",
"description": "Trim samples from left of trace",
"notes": [
"data ltrim -i 300 -> remove from start 0 to index 300"
],
"offline": true,
"options": [
"-h, --help This help",
"-i, --idx <dec> index in graph buffer"
],
"usage": "data ltrim [-h] -i <dec>"
},
"data manrawdecode": {
"command": "data manrawdecode",
"description": "Manchester decode binary stream in DemodBuffer Converts 10 and 01 and converts to 0 and 1 respectively - must have binary sequence in DemodBuffer (run `data rawdemod --ar` before)",
"notes": [
"data manrawdecode"
],
"offline": true,
"options": [
"-h, --help This help",
"-i, --inv invert output",
"--err <dec> set max errors tolerated (def 20)"
],
"usage": "data manrawdecode [-hi] [--err <dec>]"
},
"data modulation": {
"command": "data modulation",
"description": "search LF signal after clock and modulation",
"notes": [
"data modulation"
],
"offline": true,
"options": [
"-h, --help This help"
],
"usage": "data modulation [-h]"
},
"data mtrim": {
"command": "data mtrim",
"description": "Trim out samples from start 0 to `-s index` AND from `-e index` to end of graph buffer",
"notes": [
"data mtrim -s 1000 -e 2000 -> keep all between index 1000 and 2000"
],
"offline": true,
"options": [
"-h, --help This help",
"-s, --start <dec> start point",
"-e, --end <dec> end point"
],
"usage": "data mtrim [-h] -s <dec> -e <dec>"
},
"data norm": {
"command": "data norm",
"description": "Normalize max/min to +/-128",
"notes": [
"data norm"
],
"offline": true,
"options": [
"-h, --help This help"
],
"usage": "data norm [-h]"
},
"data num": {
"command": "data num",
"description": "Function takes a decimal or hexdecimal number and print it in decimal/hex/binary Will print message if number is a prime number",
"notes": [
"data num --dec 2023",
"data num --hex 2A"
],
"offline": true,
"options": [
"-h, --help This help",
"--dec <dec> decimal value",
"--hex <hex> hexadecimal value",
"--bin <bin> binary value",
"-i print inverted value",
"-r print reversed value"
],
"usage": "data num [-hir] [--dec <dec>] [--hex <hex>] [--bin <bin>]"
},
"data plot": {
"command": "data plot",
"description": "Show graph window hit 'h' in window for detail keystroke help available",
"notes": [
"data plot"
],
"offline": true,
"options": [
"-h, --help This help"
],
"usage": "data plot [-h]"
},
"data print": {
"command": "data print",
"description": "Print the data in the DemodBuffer as hex or binary. Defaults to binary output",
"notes": [
"data print"
],
"offline": true,
"options": [
"-h, --help This help",
"-i, --inv invert DemodBuffer before printing",
"-o, --offset <dec> offset in # of bits",
"-s, --strip strip leading zeroes, i.e. set offset to first bit equal to one",
"-x, --hex output in hex (omit for binary output)"
],
"usage": "data print [-hisx] [-o <dec>]"
},
"data rawdemod": {
"command": "data rawdemod",
"description": "Demodulate the data in the GraphBuffer and output binary",
"notes": [
"data rawdemod --fs -> demod FSK - autodetect",
"data rawdemod --ab -> demod ASK/BIPHASE - autodetect",
"data rawdemod --am -> demod ASK/MANCHESTER - autodetect",
"data rawdemod --ar -> demod ASK/RAW - autodetect",
"data rawdemod --nr -> demod NRZ/DIRECT - autodetect",
"data rawdemod --p1 -> demod PSK1 - autodetect",
"data rawdemod --p2 -> demod PSK2 - autodetect"
],
"offline": true,
"options": [
"-h, --help This help",
"--ab ASK/Biphase demodulation",
"--am ASK/Manchester demodulation",
"--ar ASK/Raw demodulation",
"--fs FSK demodulation",
"--nr NRZ/Direct demodulation",
"--p1 PSK 1 demodulation",
"--p2 PSK 2 demodulation",
"<params> params for sub command"
],
"usage": "data rawdemod [-h] [--ab] [--am] [--ar] [--fs] [--nr] [--p1] [--p2] [<params>]..."
},
"data rtrim": {
"command": "data rtrim",
"description": "Trim samples from right of trace",
"notes": [
"data rtrim -i 4000 -> remove from index 4000 to end of graph buffer"
],
"offline": true,
"options": [
"-h, --help This help",
"-i, --idx <dec> index in graph buffer"
],
"usage": "data rtrim [-h] -i <dec>"
},
"data samples": {
"command": "data samples",
"description": "Get raw samples for graph window (GraphBuffer) from device. If 0, then get whole big buffer from device.",
"notes": [
"data samples",
"data samples -n 10000"
],
"offline": false,
"options": [
"-h, --help This help",
"-n <dec> num of samples (512 - 40000)",
"-v, --verbose verbose output"
],
"usage": "data samples [-hv] [-n <dec>]"
},
"data save": {
"command": "data save",
"description": "Save signal trace from graph window , i.e. the GraphBuffer This is a text file with number -127 to 127. With the option `w` you can save it as wave file Filename should be without file extension",
"notes": [
"data save -f myfilename -> save graph buffer to file",
"data save --wave -f myfilename -> save graph buffer to wave file"
],
"offline": true,
"options": [
"-h, --help This help",
"-w, --wave save as wave format (.wav)",
"-f, --file <fn w/o ext> save file name"
],
"usage": "data save [-hw] -f <fn w/o ext>"
},
"data setdebugmode": {
"command": "data setdebugmode",
"description": "Set debugging level on client side",
"notes": [
"data setdebugmode"
],
"offline": true,
"options": [
"-h, --help This help",
"-0 no debug messages",
"-1 debug",
"-2 verbose debugging"
],
"usage": "data setdebugmode [-h012]"
},
"data setgraphmarkers": {
"command": "data setgraphmarkers",
"description": "Set the locations of the markers in the graph window",
"notes": [
"data setgraphmarkers -> reset the markers",
"data setgraphmarkers -a 64 -> set A, reset the rest",
"data setgraphmarkers -d --keep -> set D, keep the rest"
],
"offline": true,
"options": [
"-h, --help This help",
"--keep keep the current values of the markers",
"-a <dec> yellow marker",
"-b <dec> purple marker",
"-c <dec> orange marker",
"-d <dec> blue marker"
],
"usage": "data setgraphmarkers [-h] [--keep] [-a <dec>] [-b <dec>] [-c <dec>] [-d <dec>]"
},
"data shiftgraphzero": {
"command": "data shiftgraphzero",
"description": "Shift 0 for Graphed wave + or - shift value",
"notes": [
"data shiftgraphzero -n 10 -> shift 10 points",
"data shiftgraphzero -n -22 -> shift negative 22 points"
],
"offline": true,
"options": [
"-h, --help This help",
"-n <dec> shift + or -"
],
"usage": "data shiftgraphzero [-h] -n <dec>"
},
"data test_ss32": {
"command": "data test_ss32",
"description": "Tests the implementation of Buffer Save States (32-bit buffer)",
"notes": [
"data test_ss32"
],
"offline": false,
"options": [
"-h, --help This help"
],
"usage": "data test_ss32 [-h]"
},
"data test_ss32s": {
"command": "data test_ss32s",
"description": "Tests the implementation of Buffer Save States (32-bit signed buffer)",
"notes": [
"data test_ss32s"
],
"offline": false,
"options": [
"-h, --help This help"
],
"usage": "data test_ss32s [-h]"
},
"data test_ss8": {
"command": "data test_ss8",
"description": "Tests the implementation of Buffer Save States (8-bit buffer)",
"notes": [
"data test_ss8"
],
"offline": false,
"options": [
"-h, --help This help"
],
"usage": "data test_ss8 [-h]"
},
"data timescale": {
"command": "data timescale",
"description": "Set cursor display timescale. Setting the timescale makes the differential `dt` reading between the yellow and purple markers meaningful. once the timescale is set, the differential reading between brackets can become a time duration.",
"notes": [
"data timescale --sr 125 -u ms -> for LF sampled at 125 kHz. Reading will be in milliseconds",
"data timescale --sr 1.695 -u us -> for HF sampled at 16 * fc/128. Reading will be in microseconds",
"data timescale --sr 16 -u ETU -> for HF with 16 samples per ETU (fc/128). Reading will be in ETUs"
],
"offline": true,
"options": [
"-h, --help This help",
"--sr <float> sets timescale factor according to sampling rate",
"-u, --unit <string> time unit to display (max 10 chars)"
],
"usage": "data timescale [-h] --sr <float> [-u <string>]"
},
"data undecimate": {
"command": "data undecimate",
"description": "Performs un-decimation, by repeating each sample N times in the graphbuf",
"notes": [
"data undecimate",
"data undecimate -n 4"
],
"offline": true,
"options": [
"-h, --help This help",
"-n <dec> factor to repeat each sample (default 2)"
],
"usage": "data undecimate [-h] [-n <dec>]"
},
"data xor": {
"command": "data xor",
"description": "takes input string and xor string. Perform xor on it. If no xor string, try the most reoccuring value to xor against",
"notes": [
"data xor -d 99aabbcc8888888888",
"data xor -d 99aabbcc --xor 88888888"
],
"offline": true,
"options": [
"-h, --help This help",
"-d, --data <hex> input hex string",
"-x, --xor <str> input xor string"
],
"usage": "data xor [-h] -d <hex> [-x <str>]"
},
"data zerocrossings": {
"command": "data zerocrossings",
"description": "Count time between zero-crossings",
"notes": [
"data zerocrossings"
],
"offline": true,
"options": [
"-h, --help This help"
],
"usage": "data zerocrossings [-h]"
},
"emv challenge": {
"command": "emv challenge",
"description": "Executes Generate Challenge command. It returns 4 or 8-byte random number from card. Needs a EMV applet to be selected and GPO to be executed.",
"notes": [
"emv challenge -> get challenge",
"emv challenge -k -> get challenge, keep filled ON"
],
"offline": false,
"options": [
"-h, --help This help",
"-k, --keep Keep field ON for next command",
"-a, --apdu Show APDU requests and responses",
"-w, --wired Send data via contact (iso7816) interface. (def: Contactless interface)"
],
"usage": "emv challenge [-hkaw]"
},
"emv exec": {
"command": "emv exec",
"description": "Executes EMV contactless transaction",
"notes": [
"emv exec -sat -> select card, execute MSD transaction, show APDU and TLV",
"emv exec -satc -> select card, execute CDA transaction, show APDU and TLV"
],
"offline": false,
"options": [
"-h, --help This help",
"-s, --select Activate field and select card",
"-a, --apdu Show APDU requests and responses",
"-t, --tlv TLV decode results",
"-j, --jload Load transaction parameters from `emv_defparams.json` file",
"--force Force search AID. Search AID instead of execute PPSE",
"By default: Transaction type - MSD",
"--qvsdc Transaction type - qVSDC or M/Chip",
"-c, --qvsdccda Transaction type - qVSDC or M/Chip plus CDA (SDAD generation)",
"-x, --vsdc Transaction type - VSDC. For test only. Not a standard behavior",
"-g, --acgpo VISA. generate AC from GPO",
"-w, --wired Send data via contact (iso7816) interface. (def: Contactless interface)"
],
"usage": "emv exec [-hsatjcxgw] [--force] By default: [--qvsdc]"
},
"emv genac": {
"command": "emv genac",
"description": "Generate Application Cryptogram command. It returns data in TLV format. Needs a EMV applet to be selected and GPO to be executed.",
"notes": [
"emv genac -k 0102 -> generate AC with 2-byte CDOLdata and keep field ON after command",
"emv genac -t 01020304 -> generate AC with 4-byte CDOL data, show result in TLV",
"emv genac -Daac 01020304 -> generate AC with 4-byte CDOL data and terminal decision 'declined'",
"emv genac -pmt 9F 37 04 -> load params from file, make CDOL data from CDOL, generate AC with CDOL, show result in TLV"
],
"offline": false,
"options": [
"-h, --help This help",
"-k, --keep Keep field ON for next command",
"-c, --cda Executes CDA transaction. Needs to get SDAD in results.",
"-d, --decision <aac|tc|arqc> Terminal decision. aac - declined, tc - approved, arqc - online authorisation requested",
"-p, --params Load parameters from `emv_defparams.json` file for CDOLdata making from CDOL and parameters",
"-m, --make Make CDOLdata from CDOL (tag 8C and 8D) and parameters (def: use default parameters)",
"-a, --apdu Show APDU requests and responses",
"-t, --tlv TLV decode results of selected applets",
"-w, --wired Send data via contact (iso7816) interface. (def: Contactless interface)",
"<hex> CDOLdata/CDOL"
],
"usage": "emv genac [-hkcpmatw] [-d <aac|tc|arqc>] <hex> [<hex>]..."
},
"emv gpo": {
"command": "emv gpo",
"description": "Executes Get Processing Options command. It returns data in TLV format (0x77 - format2) or plain format (0x80 - format1). Needs a EMV applet to be selected.",
"notes": [
"emv gpo -k -> execute GPO",
"emv gpo -t 01020304 -> execute GPO with 4-byte PDOL data, show result in TLV",
"emv gpo -pmt 9F 37 04 -> load params from file, make PDOL data from PDOL, execute GPO with PDOL, show result in TLV"
],
"offline": false,
"options": [
"-h, --help This help",
"-k, --keep Keep field ON for next command",
"-p, --params Load parameters from `emv_defparams.json` file for PDOLdata making from PDOL and parameters",
"-m, --make Make PDOLdata from PDOL (tag 9F38) and parameters (def: uses default parameters)",
"-a, --apdu Show APDU requests and responses",
"-t, --tlv TLV decode results of selected applets",
"-w, --wired Send data via contact (iso7816) interface. (def: Contactless interface)",
"<hex> PDOLdata/PDOL"
],
"usage": "emv gpo [-hkpmatw] [<hex>]..."
},
"emv help": {
"command": "emv help",
"description": "----------- ----------------------- General ----------------------- help This help list List ISO7816 history test Crypto logic selftest --------------------------------------------------------------------------------------- emv list available offline: yes Alias of `trace list -t 7816` with selected protocol data to annotate trace buffer You can load a trace from file (see `trace load -h`) or it be downloaded from device by default It accepts all other arguments of `trace list`. Note that some might not be relevant for this specific protocol",
"notes": [
"emv list --frame -> show frame delay times",
"emv list -1 -> use trace buffer"
],
"offline": true,
"options": [
"-h, --help This help",
"-1, --buffer use data from trace buffer",
"--frame show frame delay times",
"-c mark CRC bytes",
"-r show relative times (gap and duration)",
"-u display times in microseconds instead of clock cycles",
"-x show hexdump to convert to pcap(ng)",
"or to import into Wireshark using encapsulation type \"ISO 14443\"",
"-f, --file <fn> filename of dictionary"
],
"usage": "emv list [-h1crux] [--frame] [-f <fn>]"
},
"emv intauth": {
"command": "emv intauth",
"description": "Generate Internal Authenticate command. Usually needs 4-byte random number. It returns data in TLV format . Needs a EMV applet to be selected and GPO to be executed.",
"notes": [
"emv intauth -k 01020304 -> execute Internal Authenticate with 4-byte DDOLdata and keep field ON after command",
"emv intauth -t 01020304 -> execute Internal Authenticate with 4-byte DDOL data, show result in TLV",
"emv intauth -pmt 9F 37 04 -> load params from file, make DDOL data from DDOL, Internal Authenticate with DDOL, show result in TLV"
],
"offline": false,
"options": [
"-h, --help This help",
"-k, --keep Keep field ON for next command",
"-p, --params Load parameters from `emv_defparams.json` file for DDOLdata making from DDOL and parameters",
"-m, --make Make DDOLdata from DDOL (tag 9F49) and parameters (def: use default parameters)",
"-a, --apdu Show APDU requests and responses",
"-t, --tlv TLV decode results of selected applets",
"-w, --wired Send data via contact (iso7816) interface. (def: Contactless interface)",
"<hex> DDOLdata/DDOL"
],
"usage": "emv intauth [-hkpmatw] <hex> [<hex>]..."
},
"emv pse": {
"command": "emv pse",
"description": "Executes PSE/PPSE select command. It returns list of applet on the card:",
"notes": [
"emv pse -s1 -> select, get pse",
"emv pse -st2 -> select, get ppse, show result in TLV"
],
"offline": false,
"options": [
"-h, --help This help",
"-s, --select Activate field and select card",
"-k, --keep Keep field ON for next command",
"-1, --pse PSE (1PAY.SYS.DDF01) mode",
"-2, --ppse PPSE (2PAY.SYS.DDF01) mode (def)",
"-a, --apdu Show APDU requests and responses",
"-t, --tlv TLV decode results of selected applets",
"-w, --wired Send data via contact (iso7816) interface. (def: Contactless interface)"
],
"usage": "emv pse [-hsk12atw]"
},
"emv reader": {
"command": "emv reader",
"description": "Act as a EMV reader to identify tag. Look for EMV tags until Enter or the pm3 button is pressed In `verbose` mode it will also try to extract and decode the transaction logs stored on card in either channel.",
"notes": [
"emv reader",
"emv reader -v",
"emv reader -@ -> Continuous mode"
],
"offline": false,
"options": [
"-h, --help This help",
"-w, --wired Send data via contact (iso7816) interface. (def: Contactless interface)",
"-v, --verbose Verbose output",
"-@ continuous reader mode"
],
"usage": "emv reader [-hwv@]"
},
"emv readrec": {
"command": "emv readrec",
"description": "Executes Read Record command. It returns data in TLV format. Needs a bank applet to be selected and sometimes needs GPO to be executed.",
"notes": [
"emv readrec -k 0101 -> read file SFI=01, SFIrec=01",
"emv readrec -kt 0201 -> read file 0201 and show result in TLV"
],
"offline": false,
"options": [
"-h, --help This help",
"-k, --keep Keep field ON for next command",
"-a, --apdu Show APDU requests and responses",
"-t, --tlv TLV decode results of selected applets",
"-w, --wired Send data via contact (iso7816) interface. (def: Contactless interface)",
"<hex> <SFI 1 byte><SFIrecord 1 byte"
],
"usage": "emv readrec [-hkatw] <hex> [<hex>]..."
},
"emv roca": {
"command": "emv roca",
"description": "Tries to extract public keys and run the ROCA test against them.",
"notes": [
"emv roca -w -> select --CONTACT-- card and run test",
"emv roca -> select --CONTACTLESS-- card and run test"
],
"offline": false,
"options": [
"-h, --help This help",
"-t, --selftest Self test",
"-a, --apdu Show APDU requests and responses",
"-w, --wired Send data via contact (iso7816) interface. (def: Contactless interface)"
],
"usage": "emv roca [-htaw]"
},
"emv scan": {
"command": "emv scan",
"description": "Scan EMV card and save it contents to a file. It executes EMV contactless transaction and saves result to a file which can be used for emulation",
"notes": [
"emv scan -at -> scan MSD transaction mode and show APDU and TLV",
"emv scan -c -> scan CDA transaction mode"
],
"offline": false,
"options": [
"-h, --help This help",
"-a, --apdu Show APDU requests and responses",
"-t, --tlv TLV decode results",
"-e, --extract Extract TLV elements and fill Application Data",
"-j, --jload Load transaction parameters from `emv_defparams.json` file",
"By default: Transaction type - MSD",
"--qvsdc Transaction type - qVSDC or M/Chip",
"-c, --qvsdccda Transaction type - qVSDC or M/Chip plus CDA (SDAD generation)",
"-x, --vsdc Transaction type - VSDC. For test only. Not a standard behavior",
"-g, --acgpo VISA. generate AC from GPO",
"-m, --merge Merge output file with card's data. (warning: the file may be corrupted!)",
"-w, --wired Send data via contact (iso7816) interface. (def: Contactless interface)",
"<fn> JSON output file name"
],
"usage": "emv scan [-hatejcxgmw] By default: [--qvsdc] <fn>"
},
"emv search": {
"command": "emv search",
"description": "Tries to select all applets from applet list",
"notes": [
"emv search -s -> select card and search",
"emv search -st -> select card, search and show result in TLV"
],
"offline": false,
"options": [
"-h, --help This help",
"-s, --select Activate field and select card",
"-k, --keep Keep field ON for next command",
"-a, --apdu Show APDU requests and responses",
"-t, --tlv TLV decode results of selected applets",
"-w, --wired Send data via contact (iso7816) interface. (def: Contactless interface)"
],
"usage": "emv search [-hskatw]"
},
"emv select": {
"command": "emv select",
"description": "Executes select applet command",
"notes": [
"emv select -s a00000000101 -> select card, select applet",
"emv select -st a00000000101 -> select card, select applet, show result in TLV"
],
"offline": false,
"options": [
"-h, --help This help",
"-s, --select Activate field and select card",
"-k, --keep Keep field for next command",
"-a, --apdu Show APDU requests and responses",
"-t, --tlv TLV decode results",
"-w, --wired Send data via contact (iso7816) interface. (def: Contactless interface)",
"<hex> Applet AID"
],
"usage": "emv select [-hskatw] <hex>"
},
"emv test": {
"command": "emv test",
"description": "Executes tests",
"notes": [
"emv test -i",
"emv test --long"
],
"offline": true,
"options": [
"-h, --help This help",
"-i, --ignore Ignore timing tests for VM",
"-l, --long Run long tests too"
],
"usage": "emv test [-hil]"
},
"exit": {
"command": "exit",
"description": "Quit the Proxmark3 client terminal",
"notes": [
"quit"
],
"offline": true,
"options": [
"-h, --help This help"
],
"usage": "quit [-h]"
},
"help": {
"command": "help",
"description": "help Use `<command> help` for details of a command prefs { Edit client/device preferences... } -------- ----------------------- Technology ----------------------- analyse { Analyse utils... } data { Plot window / data buffer manipulation... } emv { EMV ISO-14443 / ISO-7816... } hf { High frequency commands... } hw { Hardware commands... } lf { Low frequency commands... } nfc { NFC commands... } piv { PIV commands... } reveng { CRC calculations from RevEng software... } smart { Smart card ISO-7816 commands... } script { Scripting commands... } trace { Trace manipulation... } wiegand { Wiegand format manipulation... } -------- ----------------------- General ----------------------- clear Clear screen hints Turn hints on / off msleep Add a pause in milliseconds rem Add a text line in log file quit exit Exit program --------------------------------------------------------------------------------------- auto available offline: no Run LF SEARCH / HF SEARCH / DATA PLOT / DATA SAVE",
"notes": [
"auto"
],
"offline": true,
"options": [
"-h, --help This help",
"-c Continue searching even after a first hit"
],
"usage": "auto [-hc]"
},
"hf 14a antifuzz": {
"command": "hf 14a antifuzz",
"description": "Tries to fuzz the ISO14443a anticollision phase",
"notes": [
"hf 14a antifuzz -4"
],
"offline": false,
"options": [
"-h, --help This help",
"-4 4 byte uid",
"-7 7 byte uid",
"--10 10 byte uid"
],
"usage": "hf 14a antifuzz [-h47] [--10]"
},
"hf 14a apdu": {
"command": "hf 14a apdu",
"description": "Sends an ISO 7816-4 APDU via ISO 14443-4 block transmission protocol (T=CL). Works with all APDU types from ISO 7816-4:2013 note: `-m` and `-d` goes hand in hand -m <CLA INS P1 P2> -d 325041592E5359532E4444463031 OR use `-d` with complete APDU data -d 00A404000E325041592E5359532E444446303100",
"notes": [
"hf 14a apdu -st -d 00A404000E325041592E5359532E444446303100",
"hf 14a apdu -sd -d 00A404000E325041592E5359532E444446303100 -> decode apdu",
"hf 14a apdu -sm 00A40400 -d 325041592E5359532E4444463031 -l 256 -> encode standard apdu",
"hf 14a apdu -sm 00A40400 -d 325041592E5359532E4444463031 -el 65536 -> encode extended apdu"
],
"offline": false,
"options": [
"-h, --help This help",
"-s, --select activate field and select card",
"-k, --keep keep signal field ON after receive",
"-t, --tlv decode TLV",
"--decode decode APDU request",
"-m, --make <hex> APDU header, 4 bytes <CLA INS P1 P2>",
"-e, --extended make extended length apdu if `m` parameter included",
"-l, --le <dec> Le APDU parameter if `m` parameter included",
"-d, --data <hex> full APDU package or data if `m` parameter included"
],
"usage": "hf 14a apdu [-hskte] [--decode] [-m <hex>] [-l <dec>] -d <hex> [-d <hex>]..."
},
"hf 14a apdufind": {
"command": "hf 14a apdufind",
"description": "Enumerate APDU's of ISO7816 protocol to find valid CLS/INS/P1/P2 commands. It loops all 256 possible values for each byte. The loop oder is INS -> P1/P2 (alternating) -> CLA. Tag must be on antenna before running.",
"notes": [
"hf 14a apdufind",
"hf 14a apdufind --cla 80",
"hf 14a apdufind --cla 80 --error-limit 20 --skip-ins a4 --skip-ins b0 --with-le"
],
"offline": false,
"options": [
"-h, --help This help",
"-c, --cla <hex> Start value of CLASS (1 hex byte)",
"-i, --ins <hex> Start value of INSTRUCTION (1 hex byte)",
"--p1 <hex> Start value of P1 (1 hex byte)",
"--p2 <hex> Start value of P2 (1 hex byte)",
"-r, --reset <number> Minimum secondes before resetting the tag (to prevent timeout issues). Default is 5 minutes",
"-e, --error-limit <number> Maximum times an status word other than 0x9000 or 0x6D00 is shown. Default is 512.",
"-s, --skip-ins <hex> Do not test an instruction (can be specified multiple times)",
"-l, --with-le Search for APDUs with Le=0 (case 2S) as well",
"-v, --verbose Verbose output"
],
"usage": "hf 14a apdufind [-hlv] [-c <hex>] [-i <hex>] [--p1 <hex>] [--p2 <hex>] [-r <number>] [-e <number>] [-s <hex>]..."
},
"hf 14a chaining": {
"command": "hf 14a chaining",
"description": "Enable/Disable ISO14443a input chaining. Maximum input length goes from ATS.",
"notes": [
"hf 14a chaining -> show chaining enable/disable state",
"hf 14a chaining --off -> disable chaining"
],
"offline": false,
"options": [
"-h, --help This help",
"-1, --on enabled chaining",
"-0, --off disable chaining"
],
"usage": "hf 14a chaining [-h10]"
},
"hf 14a cuids": {
"command": "hf 14a cuids",
"description": "Collect n>0 ISO14443-a UIDs in one go",
"notes": [
"hf 14a cuids -n 5 -> Collect 5 UIDs"
],
"offline": false,
"options": [
"-h, --help This help",
"-n, --num <dec> Number of UIDs to collect"
],
"usage": "hf 14a cuids [-h] [-n <dec>]"
},
"hf 14a help": {
"command": "hf 14a help",
"description": "----------- ----------------------- General ----------------------- help This help list List ISO 14443-a history --------------------------------------------------------------------------------------- hf 14a list available offline: yes Alias of `trace list -t 14a -c` with selected protocol data to annotate trace buffer You can load a trace from file (see `trace load -h`) or it be downloaded from device by default It accepts all other arguments of `trace list`. Note that some might not be relevant for this specific protocol",
"notes": [
"hf 14a list --frame -> show frame delay times",
"hf 14a list -1 -> use trace buffer"
],
"offline": true,
"options": [
"-h, --help This help",
"-1, --buffer use data from trace buffer",
"--frame show frame delay times",
"-c mark CRC bytes",
"-r show relative times (gap and duration)",
"-u display times in microseconds instead of clock cycles",
"-x show hexdump to convert to pcap(ng)",
"or to import into Wireshark using encapsulation type \"ISO 14443\"",
"-f, --file <fn> filename of dictionary"
],
"usage": "hf 14a list [-h1crux] [--frame] [-f <fn>]"
},
"hf 14a info": {
"command": "hf 14a info",
"description": "This command makes more extensive tests against a ISO14443a tag in order to collect information",
"notes": [
"hf 14a info -nsv -> shows full information about the card"
],
"offline": false,
"options": [
"-h, --help This help",
"-v, --verbose verbose output",
"-n, --nacktest test for nack bug",
"-s, --aidsearch checks if AIDs from aidlist.json is present on the card and prints information about found AIDs"
],
"usage": "hf 14a info [-hvns]"
},
"hf 14a ndefformat": {
"command": "hf 14a ndefformat",
"description": "Format ISO14443-a Tag as a NFC tag with Data Exchange Format (NDEF)",
"notes": [
"hf 14a ndefformat"
],
"offline": false,
"options": [
"-h, --help This help",
"-v, --verbose verbose output"
],
"usage": "hf 14a ndefformat [-hv]"
},
"hf 14a ndefread": {
"command": "hf 14a ndefread",
"description": "Read NFC Data Exchange Format (NDEF) file on Type 4 NDEF tag",
"notes": [
"hf 14a ndefread",
"hf 14a ndefread -f myfilename -> save raw NDEF to file"
],
"offline": false,
"options": [
"-h, --help This help",
"-f, --file <fn> save raw NDEF to file",
"-v, --verbose verbose output"
],
"usage": "hf 14a ndefread [-hv] [-f <fn>]"
},
"hf 14a ndefwrite": {
"command": "hf 14a ndefwrite",
"description": "Write raw NDEF hex bytes to tag. This commands assumes tag already been NFC/NDEF formatted.",
"notes": [
"hf 14a ndefwrite -d 0300FE -> write empty record to tag",
"hf 14a ndefwrite -f myfilename",
"hf 14a ndefwrite -d 003fd1023a53709101195405656e2d55534963656d616e2054776974746572206c696e6b5101195502747769747465722e636f6d2f686572726d616e6e31303031"
],
"offline": false,
"options": [
"-h, --help This help",
"-d <hex> raw NDEF hex bytes",
"-f, --file <fn> write raw NDEF file to tag",
"-p fix NDEF record headers / terminator block if missing",
"-v, --verbose verbose output"
],
"usage": "hf 14a ndefwrite [-hpv] [-d <hex>] [-f <fn>]"
},
"hf 14a raw": {
"command": "hf 14a raw",
"description": "Sends raw bytes over ISO14443a. With option to use TOPAZ 14a mode.",
"notes": [
"hf 14a raw -sc 3000 -> select, crc, where 3000 == 'read block 00'",
"hf 14a raw -ak -b 7 40 -> send 7 bit byte 0x40",
"hf 14a raw --ecp -s -> send ECP before select",
"Crypto1 session example, with special auth shortcut 6xxx<key>:",
"hf 14a raw --crypto1 -skc 6000FFFFFFFFFFFF",
"hf 14a raw --crypto1 -kc 3000",
"hf 14a raw --crypto1 -kc 6007FFFFFFFFFFFF",
"hf 14a raw --crypto1 -c 3007"
],
"offline": false,
"options": [
"-h, --help This help",
"-a Active signal field ON without select",
"-c Calculate and append CRC",
"-k Keep signal field ON after receive",
"-3 ISO14443-3 select only (skip RATS)",
"-r Do not read response",
"-s Active signal field ON with select",
"-t, --timeout <ms> Timeout in milliseconds",
"-b <dec> Number of bits to send. Useful for send partial byte",
"-v, --verbose Verbose output",
"--ecp Use enhanced contactless polling",
"--mag Use Apple magsafe polling",
"--topaz Use Topaz protocol to send command",
"--crypto1 Use crypto1 session",
"<hex> Raw bytes to send"
],
"usage": "hf 14a raw [-hack3rsv] [-t <ms>] [-b <dec>] [--ecp] [--mag] [--topaz] [--crypto1] <hex> [<hex>]..."
},
"hf 14a reader": {
"command": "hf 14a reader",
"description": "Act as a ISO-14443a reader to identify tag. Look for ISO-14443a tags until Enter or the pm3 button is pressed",
"notes": [
"hf 14a reader",
"hf 14a reader -@ -> Continuous mode",
"hf 14a reader --ecp -> trigger apple enhanced contactless polling",
"hf 14a reader --mag -> trigger apple magsafe polling"
],
"offline": false,
"options": [
"-h, --help This help",
"-k, --keep keep the field active after command executed",
"-s, --silent silent (no messages)",
"--drop just drop the signal field",
"--skip ISO14443-3 select only (skip RATS)",
"--ecp Use enhanced contactless polling",
"--mag Use Apple magsafe polling",
"-@ continuous reader mode",
"-w, --wait wait for card"
],
"usage": "hf 14a reader [-hks@w] [--drop] [--skip] [--ecp] [--mag]"
},
"hf 14a sim": {
"command": "hf 14a sim",
"description": "Simulate ISO/IEC 14443 type A tag with 4,7 or 10 byte UID Use type 7 for Mifare Ultralight EV1, Amiibo (NTAG215 pack 0x8080)",
"notes": [
"hf 14a sim -t 1 --uid 11223344 -> MIFARE Classic 1k",
"hf 14a sim -t 2 -> MIFARE Ultralight",
"hf 14a sim -t 3 -> MIFARE Desfire",
"hf 14a sim -t 4 -> ISO/IEC 14443-4",
"hf 14a sim -t 5 -> MIFARE Tnp3xxx",
"hf 14a sim -t 6 -> MIFARE Mini",
"hf 14a sim -t 7 -> MFU EV1 / NTAG 215 Amiibo",
"hf 14a sim -t 8 -> MIFARE Classic 4k",
"hf 14a sim -t 9 -> FM11RF005SH Shanghai Metro",
"hf 14a sim -t 10 -> ST25TA IKEA Rothult",
"hf 14a sim -t 11 -> Javacard (JCOP)",
"hf 14a sim -t 12 -> 4K Seos card"
],
"offline": false,
"options": [
"-h, --help This help",
"-t, --type <1-12> Simulation type to use",
"-u, --uid <hex> <4|7|10> hex bytes UID",
"-n, --num <dec> Exit simulation after <numreads> blocks have been read by reader. 0 = infinite",
"-x Performs the 'reader attack', nr/ar attack against a reader",
"--sk Fill simulator keys from found keys",
"-v, --verbose verbose output"
],
"usage": "hf 14a sim [-hxv] -t <1-12> [-u <hex>] [-n <dec>] [--sk]"
},
"hf 14a simaid": {
"command": "hf 14a simaid",
"description": "Simulate ISO/IEC 14443 type A tag with 4,7 or 10 byte UID, and filter for AID Values These AID Values can be responded to and include extra APDU commands on GetData after response",
"notes": [
"hf 14a simaid -t 3 -> MIFARE Desfire",
"hf 14a simaid -t 4 -> ISO/IEC 14443-4",
"hf 14a simaid -t 11 -> Javacard (JCOP)",
"hf 14a simaid -t 3 --aid a000000000000000000000 --response 9000 --apdu 9000 -> AID, Response and APDU",
"hf 14a simaid -t 3 --rats 05788172220101 --response 01009000 --apdu 86009000 -> Custom RATS Added",
"hf 14a simaid -t 3 --rats 05788172220101 -x -> Enumerate AID Values"
],
"offline": false,
"options": [
"-h, --help This help",
"-t, --type <1-12> Simulation type to use",
"-u, --uid <hex> <4|7|10> hex bytes UID",
"-r, --rats <hex> <0-20> hex bytes RATS",
"-a, --aid <hex> <0-100> hex bytes for AID to respond to (Default: A000000000000000000000)",
"-e, --response <hex> <0-100> hex bytes for APDU Response to AID Select (Default: 9000)",
"-p, --apdu <hex> <0-100> hex bytes for APDU Response to Get Data request after AID (Default: 9000)",
"-x, --enumerate Enumerate all AID values via returning Not Found and print them to console"
],
"usage": "hf 14a simaid [-hx] -t <1-12> [-u <hex>] [-r <hex>] [-a <hex>] [-e <hex>] [-p <hex>]"
},
"hf 14a sniff": {
"command": "hf 14a sniff",
"description": "Sniff the communication between reader and tag Use `hf 14a list` to view collected data.",
"notes": [
"hf 14a sniff -c -r"
],
"offline": false,
"options": [
"-h, --help This help",
"-c, --card triggered by first data from card",
"-r, --reader triggered by first 7-bit request from reader (REQ, WUP)",
"-i, --interactive Console will not be returned until sniff finishes or is aborted"
],
"usage": "hf 14a sniff [-hcri]"
},
"hf 14b apdu": {
"command": "hf 14b apdu",
"description": "Sends an ISO 7816-4 APDU via ISO 14443-4 block transmission protocol (T=CL). works with all apdu types from ISO 7816-4:2013",
"notes": [
"hf 14b apdu -s -d 94a40800043f000002",
"hf 14b apdu -s --decode -d 00A404000E325041592E5359532E444446303100 -> decode apdu",
"hf 14b apdu -sm 00A40400 -l 256 -d 325041592E5359532E4444463031 -> encode standard apdu",
"hf 14b apdu -sm 00A40400 -el 65536 -d 325041592E5359532E4444463031 -> encode extended apdu"
],
"offline": false,
"options": [
"-h, --help This help",
"-s, --select activate field and select card",
"-k, --keep leave the signal field ON after receive response",
"-t, --tlv executes TLV decoder if it possible",
"--decode decode apdu request if it possible",
"-m, --make <hex> make apdu with head from this field and data from data field.",
"must be 4 bytes: <CLA INS P1 P2>",
"-e, --extended make extended length apdu if `m` parameter included",
"-l, --le <int> Le apdu parameter if `m` parameter included",
"-d, --data <hex> <APDU | data> if `m` parameter included",
"--timeout <dec> timeout in ms"
],
"usage": "hf 14b apdu [-hskte] [--decode] [-m <hex>] [-l <int>] -d <hex> [--timeout <dec>]"
},
"hf 14b calypso": {
"command": "hf 14b calypso",
"description": "Reads out the contents of a ISO14443B Calypso card",
"notes": [
"hf 14b calypso"
],
"offline": false,
"options": [
"-h, --help This help"
],
"usage": "hf 14b calypso [-h]"
},
"hf 14b dump": {
"command": "hf 14b dump",
"description": "This command dumps the contents of a ISO-14443-B tag and save it to file Tries to autodetect cardtype, memory size defaults to SRI4K",
"notes": [
"hf 14b dump",
"hf 14b dump -f myfilename"
],
"offline": false,
"options": [
"-h, --help This help",
"-f, --file <fn> (optional) filename, if no <name> UID will be used as filename",
"--ns no save to file",
"-z, --dense dense dump output style"
],
"usage": "hf 14b dump [-hz] [-f <fn>] [--ns]"
},
"hf 14b help": {
"command": "hf 14b help",
"description": "--------- ----------------------- General ----------------------- help This help list List ISO-14443-B history --------- ----------------------- Operations ----------------------- view Display content from tag dump file valid SRIX4 checksum test --------- ------------------ Calypso / Mobib ------------------ --------------------------------------------------------------------------------------- hf 14b list available offline: yes Alias of `trace list -t 14b -c` with selected protocol data to annotate trace buffer You can load a trace from file (see `trace load -h`) or it be downloaded from device by default It accepts all other arguments of `trace list`. Note that some might not be relevant for this specific protocol",
"notes": [
"hf 14b list --frame -> show frame delay times",
"hf 14b list -1 -> use trace buffer"
],
"offline": true,
"options": [
"-h, --help This help",
"-1, --buffer use data from trace buffer",
"--frame show frame delay times",
"-c mark CRC bytes",
"-r show relative times (gap and duration)",
"-u display times in microseconds instead of clock cycles",
"-x show hexdump to convert to pcap(ng)",
"or to import into Wireshark using encapsulation type \"ISO 14443\"",
"-f, --file <fn> filename of dictionary"
],
"usage": "hf 14b list [-h1crux] [--frame] [-f <fn>]"
},
"hf 14b info": {
"command": "hf 14b info",
"description": "Tag information for ISO/IEC 14443 type B based tags",
"notes": [
"hf 14b info"
],
"offline": false,
"options": [
"-h, --help This help",
"-s, --aidsearch checks if AIDs from aidlist.json is present on the card and prints information about found AIDs",
"-v, --verbose verbose output"
],
"usage": "hf 14b info [-hsv]"
},
"hf 14b mobib": {
"command": "hf 14b mobib",
"description": "Reads out the contents of a ISO14443B Mobib card",
"notes": [
"hf 14b mobib"
],
"offline": false,
"options": [
"-h, --help This help"
],
"usage": "hf 14b mobib [-h]"
},
"hf 14b ndefread": {
"command": "hf 14b ndefread",
"description": "Print NFC Data Exchange Format (NDEF)",
"notes": [
"hf 14b ndefread",
"hf 14b ndefread -f myfilename -> save raw NDEF to file"
],
"offline": false,
"options": [
"-h, --help This help",
"-f, --file <fn> Save raw NDEF to file",
"-v, --verbose Verbose output"
],
"usage": "hf 14b ndefread [-hv] [-f <fn>]"
},
"hf 14b raw": {
"command": "hf 14b raw",
"description": "Sends raw bytes to card. Activates field by default",
"notes": [
"hf 14b raw -cks --data 0200a40400 -> standard select, apdu 0200a4000 (7816)",
"hf 14b raw -ck --sr --data 0200a40400 -> SRx select",
"hf 14b raw -ck --cts --data 0200a40400 -> C-ticket select"
],
"offline": false,
"options": [
"-h, --help This help",
"-a active signal field ON without select",
"-c, --crc calculate and append CRC",
"-k, --keep leave the signal field ON after receive response",
"-d, --data <hex> data, bytes to send",
"-r do not read response from card",
"-t, --timeout <dec> timeout in ms",
"-s, --std use ISO14B select",
"--sr use SRx ST select",
"--cts use ASK C-ticket select",
"--xrx use Fuji/Xerox select",
"--pico use Picopass select",
"-v, --verbose verbose output"
],
"usage": "hf 14b raw [-hackrsv] [-d <hex>] [-t <dec>] [--sr] [--cts] [--xrx] [--pico]"
},
"hf 14b rdbl": {
"command": "hf 14b rdbl",
"description": "Read SRI512 | SRIX4K block",
"notes": [
"hf 14b rdbl -b 06"
],
"offline": false,
"options": [
"-h, --help This help",
"-b, --block <dec> block number"
],
"usage": "hf 14b rdbl [-h] [-b <dec>]"
},
"hf 14b reader": {
"command": "hf 14b reader",
"description": "Act as a 14443B reader to identify a tag",
"notes": [
"hf 14b reader",
"hf 14b reader -@ -> continuous reader mode"
],
"offline": false,
"options": [
"-h, --help This help",
"--plot show anticollision signal trace in plot window",
"-v, --verbose verbose output",
"-@ optional - continuous reader mode"
],
"usage": "hf 14b reader [-hv@] [--plot]"
},
"hf 14b restore": {
"command": "hf 14b restore",
"description": "Restore data from (bin/eml/json) dump file to tag If the dump file includes the special block at the end it will be ignored",
"notes": [
"hf 14b restore --4k -f myfilename",
"hf 14b restore --512 -f myfilename"
],
"offline": false,
"options": [
"-h, --help This help",
"-f, --file <fn> (optional) filename, if no <name> UID will be used as filename",
"--512 target SRI 512 tag",
"--4k target SRIX 4k tag (def)"
],
"usage": "hf 14b restore [-h] [-f <fn>] [--512] [--4k]"
},
"hf 14b setuid": {
"command": "hf 14b setuid",
"description": "Set UID for magic card (only works with such cards)",
"notes": [
"hf 14b setuid -u 11223344"
],
"offline": false,
"options": [
"-h, --help This help",
"-u, --uid <hex> UID, 4 hex bytes"
],
"usage": "hf 14b setuid [-h] -u <hex>"
},
"hf 14b sim": {
"command": "hf 14b sim",
"description": "Simulate a ISO/IEC 14443 type B tag with 4 byte UID / PUPI",
"notes": [
"hf 14b sim -u 11AA33BB"
],
"offline": false,
"options": [
"-h, --help This help",
"-u, --uid hex 4byte UID/PUPI"
],
"usage": "hf 14b sim [-h] -u hex"
},
"hf 14b sniff": {
"command": "hf 14b sniff",
"description": "Sniff the communication between reader and tag Use `hf 14b list` to view collected data.",
"notes": [
"hf 14b sniff"
],
"offline": false,
"options": [
"-h, --help This help"
],
"usage": "hf 14b sniff [-h]"
},
"hf 14b valid": {
"command": "hf 14b valid",
"description": "SRIX checksum test",
"notes": [
"hf 14b valid"
],
"offline": true,
"options": [
"-h, --help This help"
],
"usage": "hf 14b valid [-h]"
},
"hf 14b view": {
"command": "hf 14b view",
"description": "Print a ISO14443-B dump file (bin/eml/json) note: - command expects the filename to contain a UID which is needed to determine card memory type",
"notes": [
"hf 14b view -f hf-14b-01020304-dump.bin"
],
"offline": true,
"options": [
"-h, --help This help",
"-f, --file <fn> Specify a filename for dump file",
"-v, --verbose verbose output",
"-z, --dense dense dump output style"
],
"usage": "hf 14b view [-hvz] -f <fn>"
},
"hf 14b wrbl": {
"command": "hf 14b wrbl",
"description": "Write data to a SRI512 or SRIX4K block If writing to a block out-of-range, use `--force` to override checks Special block at end denots OTP and lock bits among others",
"notes": [
"hf 14b wrbl --4k -b 100 -d 11223344",
"hf 14b wrbl --4k --sb -d 11223344 -> special block write",
"hf 14b wrbl --512 -b 15 -d 11223344",
"hf 14b wrbl --512 --sb -d 11223344 -> special block write"
],
"offline": false,
"options": [
"-h, --help This help",
"-b, --block <dec> block number",
"-d, --data <hex> 4 hex bytes",
"--512 target SRI 512 tag",
"--4k target SRIX 4k tag (def)",
"--sb special block write at end of memory (0xFF)",
"--force overrides block range checks"
],
"usage": "hf 14b wrbl [-h] [-b <dec>] -d <hex> [--512] [--4k] [--sb] [--force]"
},
"hf 15 csetuid": {
"command": "hf 15 csetuid",
"description": "Set UID for magic Chinese card (only works with such cards)",
"notes": [
"hf 15 csetuid -u E011223344556677 -> use gen1 command",
"hf 15 csetuid -u E011223344556677 --v2 -> use gen2 command"
],
"offline": false,
"options": [
"-h, --help This help",
"-u, --uid <hex> UID, 8 hex bytes",
"-2, --v2 Use gen2 magic command"
],
"usage": "hf 15 csetuid [-h2] -u <hex>"
},
"hf 15 demod": {
"command": "hf 15 demod",
"description": "Tries to demodulate / decode ISO-15693, from downloaded samples. Gather samples with 'hf 15 samples' / 'hf 15 sniff'",
"notes": [
"hf 15 demod"
],
"offline": true,
"options": [
"-h, --help This help"
],
"usage": "hf 15 demod [-h]"
},
"hf 15 dump": {
"command": "hf 15 dump",
"description": "This command dumps the contents of a ISO-15693 tag and save to file (bin/json)",
"notes": [
"hf 15 dump",
"hf 15 dump -*",
"hf 15 dump -u E011223344556677 -f hf-15-my-dump.bin"
],
"offline": false,
"options": [
"-h, --help This help",
"-u, --uid <hex> full UID (8 hex bytes)",
"--ua unaddressed mode",
"-* scan for tag",
"-2 use slower '1 out of 256' mode",
"-o, --opt set OPTION Flag (needed for TI)",
"-f, --file <fn> Specify a filename for dump file",
"--bs <dec> block size (def 4)",
"--ns no save to file",
"-v, --verbose verbose output",
"-z, --dense dense dump output style"
],
"usage": "hf 15 dump [-h*2ovz] [-u <hex>] [--ua] [-f <fn>] [--bs <dec>] [--ns]"
},
"hf 15 eload": {
"command": "hf 15 eload",
"description": "Load memory dump from file to be used with 'hf 15 sim'",
"notes": [
"hf 15 eload -f hf-15-01020304.bin"
],
"offline": false,
"options": [
"-h, --help This help",
"-f, --file <fn> filename of dump"
],
"usage": "hf 15 eload [-h] -f <fn>"
},
"hf 15 esave": {
"command": "hf 15 esave",
"description": "Save emulator memory into two files (bin/json)",
"notes": [
"hf 15 esave -f hf-15-01020304"
],
"offline": false,
"options": [
"-h, --help This help",
"-f, --file <fn> Specify a filename for dump file"
],
"usage": "hf 15 esave [-h] -f <fn>"
},
"hf 15 eview": {
"command": "hf 15 eview",
"description": "It displays emulator memory",
"notes": [
"hf 15 eview",
"hf 15 eview -z"
],
"offline": false,
"options": [
"-h, --help This help",
"-z, --dense dense dump output style"
],
"usage": "hf 15 eview [-hz]"
},
"hf 15 findafi": {
"command": "hf 15 findafi",
"description": "This command attempts to brute force AFI of an ISO-15693 tag Estimated execution time is around 2 minutes",
"notes": [
"hf 15 findafi"
],
"offline": false,
"options": [
"-h, --help This help",
"-2 use slower '1 out of 256' mode"
],
"usage": "hf 15 findafi [-h2]"
},
"hf 15 help": {
"command": "hf 15 help",
"description": "----------- ----------------------- General ----------------------- help This help list List ISO-15693 history ----------- ----------------------- Operations ----------------------- demod Demodulate ISO-15693 from tag view Display content from tag dump file --------------------------------------------------------------------------------------- hf 15 list available offline: yes Alias of `trace list -t 15 -c` with selected protocol data to annotate trace buffer You can load a trace from file (see `trace load -h`) or it be downloaded from device by default It accepts all other arguments of `trace list`. Note that some might not be relevant for this specific protocol",
"notes": [
"hf 15 list --frame -> show frame delay times",
"hf 15 list -1 -> use trace buffer"
],
"offline": true,
"options": [
"-h, --help This help",
"-1, --buffer use data from trace buffer",
"--frame show frame delay times",
"-c mark CRC bytes",
"-r show relative times (gap and duration)",
"-u display times in microseconds instead of clock cycles",
"-x show hexdump to convert to pcap(ng)",
"or to import into Wireshark using encapsulation type \"ISO 14443\"",
"-f, --file <fn> filename of dictionary"
],
"usage": "hf 15 list [-h1crux] [--frame] [-f <fn>]"
},
"hf 15 info": {
"command": "hf 15 info",
"description": "Uses the optional command `get_systeminfo` 0x2B to try and extract information",
"notes": [
"hf 15 info",
"hf 15 info -*",
"hf 15 info -u E011223344556677"
],
"offline": false,
"options": [
"-h, --help This help",
"-u, --uid <hex> full UID (8 hex bytes)",
"--ua unaddressed mode",
"-* scan for tag",
"-2 use slower '1 out of 256' mode",
"-o, --opt set OPTION Flag (needed for TI)"
],
"usage": "hf 15 info [-h*2o] [-u <hex>] [--ua]"
},
"hf 15 passprotectafi": {
"command": "hf 15 passprotectafi",
"description": "This command enables the password protect of AFI. *** OBS! This action can not be undone! ***",
"notes": [
"hf 15 passprotectafi -p 00000000 --force"
],
"offline": false,
"options": [
"-h, --help This help",
"-p, --pwd <hex> EAS/AFI password, 4 hex bytes",
"--force Force execution of command (irreversible)"
],
"usage": "hf 15 passprotectafi [-h] -p <hex> [--force]"
},
"hf 15 passprotecteas": {
"command": "hf 15 passprotecteas",
"description": "This command enables the password protect of EAS. *** OBS! This action can not be undone! ***",
"notes": [
"hf 15 passprotecteas -p 00000000 --force"
],
"offline": false,
"options": [
"-h, --help This help",
"-p, --pwd <hex> EAS/AFI password, 4 hex bytes",
"--force Force execution of command (irreversible)"
],
"usage": "hf 15 passprotecteas [-h] -p <hex> [--force]"
},
"hf 15 raw": {
"command": "hf 15 raw",
"description": "Sends raw bytes over ISO-15693 to card",
"notes": [
"hf 15 raw -ac -d 260100 -> activate, add crc",
"hf 15 raw -akrc -d 260100 -> activate, add crc, keep field on, skip response"
],
"offline": false,
"options": [
"-h, --help This help",
"-a activate field",
"-c, --crc calculate and append CRC",
"-k keep signal field ON after receive",
"-2 use slower '1 out of 256' mode",
"-r do not read response",
"-d, --data <hex> raw bytes to send",
"-w, --wait wait longer for response. For writes etc."
],
"usage": "hf 15 raw [-hack2rw] -d <hex>"
},
"hf 15 rdbl": {
"command": "hf 15 rdbl",
"description": "Read page on ISO-15693 tag",
"notes": [
"hf 15 rdbl -* -b 12",
"hf 15 rdbl -u E011223344556677 -b 12"
],
"offline": false,
"options": [
"-h, --help This help",
"-u, --uid <hex> full UID (8 hex bytes)",
"--ua unaddressed mode",
"-* scan for tag",
"-2 use slower '1 out of 256' mode",
"-o, --opt set OPTION Flag (needed for TI)",
"-b, --blk <dec> page number (0-255)",
"--bs <dec> block size (def 4)",
"-v, --verbose verbose output"
],
"usage": "hf 15 rdbl [-h*2ov] [-u <hex>] [--ua] -b <dec> [--bs <dec>]"
},
"hf 15 rdmulti": {
"command": "hf 15 rdmulti",
"description": "Read multiple pages on a ISO-15693 tag",
"notes": [
"hf 15 rdmulti -* -b 1 --cnt 6 -> read 6 blocks",
"hf 15 rdmulti -u E011223344556677 -b 12 --cnt 3 -> read three blocks"
],
"offline": false,
"options": [
"-h, --help This help",
"-u, --uid <hex> full UID (8 hex bytes)",
"--ua unaddressed mode",
"-* scan for tag",
"-2 use slower '1 out of 256' mode",
"-o, --opt set OPTION Flag (needed for TI)",
"-b <dec> first page number (0-255)",
"--cnt <dec> number of pages (1-6)",
"--bs <dec> block size (def 4)",
"-v, --verbose verbose output"
],
"usage": "hf 15 rdmulti [-h*2ov] [-u <hex>] [--ua] -b <dec> --cnt <dec> [--bs <dec>]"
},
"hf 15 reader": {
"command": "hf 15 reader",
"description": "Act as a ISO-15693 reader. Look for ISO-15693 tags until Enter or the pm3 button is pressed",
"notes": [
"hf 15 reader",
"hf 15 reader -@ -> Continuous mode"
],
"offline": false,
"options": [
"-h, --help This help",
"-@ continuous reader mode"
],
"usage": "hf 15 reader [-h@]"
},
"hf 15 restore": {
"command": "hf 15 restore",
"description": "This command restore the contents of a dump file (bin/eml/json) onto a ISO-15693 tag",
"notes": [
"hf 15 restore",
"hf 15 restore -*",
"hf 15 restore -u E011223344556677 -f hf-15-my-dump.bin"
],
"offline": false,
"options": [
"-h, --help This help",
"-u, --uid <hex> full UID (8 hex bytes)",
"--ua unaddressed mode",
"-* scan for tag",
"-2 use slower '1 out of 256' mode",
"-o, --opt set OPTION Flag (needed for TI)",
"-f, --file <fn> Specify a filename for dump file",
"-r, --retry <dec> number of retries (def 3)",
"-v, --verbose verbose output"
],
"usage": "hf 15 restore [-h*2ov] [-u <hex>] [--ua] [-f <fn>] [-r <dec>]"
},
"hf 15 samples": {
"command": "hf 15 samples",
"description": "Acquire samples as Reader (enables carrier, send inquiry and download it to graphbuffer. Try 'hf 15 demod' to try to demodulate/decode signal",
"notes": [
"hf 15 samples"
],
"offline": false,
"options": [
"-h, --help This help"
],
"usage": "hf 15 samples [-h]"
},
"hf 15 sim": {
"command": "hf 15 sim",
"description": "Simulate a ISO-15693 tag",
"notes": [
"hf 15 sim",
"hf 15 sim -u E011223344556677"
],
"offline": false,
"options": [
"-h, --help This help",
"-u, --uid <hex> UID, 8 hex bytes",
"-b, --blocksize <dec> block size (def 4)"
],
"usage": "hf 15 sim [-h] [-u <hex>] [-b <dec>]"
},
"hf 15 slixeasdisable": {
"command": "hf 15 slixeasdisable",
"description": "Disable EAS mode on SLIX ISO-15693 tag",
"notes": [
"hf 15 slixeasdisable -p 0F0F0F0F"
],
"offline": false,
"options": [
"-h, --help This help",
"-p, --pwd <hex> optional password, 4 hex bytes"
],
"usage": "hf 15 slixeasdisable [-h] [-p <hex>]"
},
"hf 15 slixeasenable": {
"command": "hf 15 slixeasenable",
"description": "Enable EAS mode on SLIX ISO-15693 tag",
"notes": [
"hf 15 slixeasenable -p 0F0F0F0F"
],
"offline": false,
"options": [
"-h, --help This help",
"-p, --pwd <hex> optional password, 4 hex bytes"
],
"usage": "hf 15 slixeasenable [-h] [-p <hex>]"
},
"hf 15 slixprivacydisable": {
"command": "hf 15 slixprivacydisable",
"description": "Disable privacy mode on SLIX ISO-15693 tag",
"notes": [
"hf 15 slixprivacydisable -p 0F0F0F0F"
],
"offline": false,
"options": [
"-h, --help This help",
"-p, --pwd <hex> password, 4 hex bytes"
],
"usage": "hf 15 slixprivacydisable [-h] -p <hex>"
},
"hf 15 slixprivacyenable": {
"command": "hf 15 slixprivacyenable",
"description": "Enable privacy mode on SLIX ISO-15693 tag",
"notes": [
"hf 15 slixprivacyenable -p 0F0F0F0F"
],
"offline": false,
"options": [
"-h, --help This help",
"-p, --pwd <hex> password, 4 hex bytes"
],
"usage": "hf 15 slixprivacyenable [-h] -p <hex>"
},
"hf 15 slixwritepwd": {
"command": "hf 15 slixwritepwd",
"description": "Write a password on a SLIX family ISO-15693 tag.nSome tags do not support all different password types.",
"notes": [
"hf 15 slixwritepwd -t READ -o 00000000 -n 12131415"
],
"offline": false,
"options": [
"-h, --help This help",
"-t, --type <read|write|privacy|destroy|easafi> which password field to write to",
"-o, --old <hex> old password (if present), 4 hex bytes",
"-n, --new <hex> new password, 4 hex bytes"
],
"usage": "hf 15 slixwritepwd [-h] -t <read|write|privacy|destroy|easafi> [-o <hex>] -n <hex>"
},
"hf 15 sniff": {
"command": "hf 15 sniff",
"description": "Sniff activity without enabling carrier",
"notes": [
"hf 15 sniff"
],
"offline": false,
"options": [
"-h, --help This help"
],
"usage": "hf 15 sniff [-h]"
},
"hf 15 view": {
"command": "hf 15 view",
"description": "Print a ISO-15693 tag dump file (bin/eml/json)",
"notes": [
"hf 15 view -f hf-iclass-AA162D30F8FF12F1-dump.bin"
],
"offline": true,
"options": [
"-h, --help This help",
"-f, --file <fn> Specify a filename for dump file",
"-z, --dense dense dump output style"
],
"usage": "hf 15 view [-hz] -f <fn>"
},
"hf 15 wipe": {
"command": "hf 15 wipe",
"description": "Wipe a ISO-15693 tag by filled memory with zeros",
"notes": [
"hf 15 wipe"
],
"offline": false,
"options": [
"-h, --help This help",
"-u, --uid <hex> full UID (8 hex bytes)",
"--ua unaddressed mode",
"-* scan for tag",
"-2 use slower '1 out of 256' mode",
"-o, --opt set OPTION Flag (needed for TI)",
"--bs <dec> block size (def 4)",
"-v, --verbose verbose output"
],
"usage": "hf 15 wipe [-h*2ov] [-u <hex>] [--ua] [--bs <dec>]"
},
"hf 15 wrbl": {
"command": "hf 15 wrbl",
"description": "Write block on ISO-15693 tag",
"notes": [
"hf 15 wrbl -* -b 12 -d AABBCCDD",
"hf 15 wrbl -u E011223344556677 -b 12 -d AABBCCDD"
],
"offline": false,
"options": [
"-h, --help This help",
"-u, --uid <hex> full UID (8 hex bytes)",
"--ua unaddressed mode",
"-* scan for tag",
"-2 use slower '1 out of 256' mode",
"-o, --opt set OPTION Flag (needed for TI)",
"-b, --blk <dec> page number (0-255)",
"-d, --data <hex> data, 4 bytes",
"-v, --verbose verbose output"
],
"usage": "hf 15 wrbl [-h*2ov] [-u <hex>] [--ua] -b <dec> -d <hex>"
},
"hf 15 writeafi": {
"command": "hf 15 writeafi",
"description": "Write AFI on card",
"notes": [
"hf 15 writeafi -* --afi 12",
"hf 15 writeafi -u E011223344556677 --afi 12 -p 0F0F0F0F"
],
"offline": false,
"options": [
"-h, --help This help",
"-u, --uid <hex> full UID, 8 hex bytes",
"--afi <dec> AFI number (0-255)",
"-p, --pwd <hex> optional AFI/EAS password"
],
"usage": "hf 15 writeafi [-h] [-u <hex>] --afi <dec> [-p <hex>]"
},
"hf 15 writedsfid": {
"command": "hf 15 writedsfid",
"description": "Write DSFID on card",
"notes": [
"hf 15 writedsfid -* --dsfid 12",
"hf 15 writedsfid -u E011223344556677 --dsfid 12"
],
"offline": false,
"options": [
"-h, --help This help",
"-u, --uid <hex> full UID (8 hex bytes)",
"--ua unaddressed mode",
"-* scan for tag",
"-2 use slower '1 out of 256' mode",
"-o, --opt set OPTION Flag (needed for TI)",
"--dsfid <dec> DSFID number (0-255)",
"-v, --verbose verbose output"
],
"usage": "hf 15 writedsfid [-h*2ov] [-u <hex>] [--ua] --dsfid <dec>"
},
"hf cipurse aread": {
"command": "hf cipurse aread",
"description": "Read file attributes by file ID with key ID and key. If no key is supplied, default key of 737373...7373 will be used",
"notes": [
"hf cipurse aread --fid 2ff7 -> Select MF, Authenticate with keyID 1, read file attributes with id 2ff7",
"hf cipurse aread --mfd -> read file attributes for master file (MF)",
"hf cipurse aread --chfid 0102 -> read file 0102 attributes in the default application",
"hf cipurse aread --aid 4144204632 --chfid 0102 -> read file 0102 attributes in the 4144204632 application",
"hf cipurse aread -n 2 -k 65656565656565656565656565656565 --fid 2ff7 -> Authenticate keyID 2, read file attributes"
],
"offline": false,
"options": [
"-h, --help This help",
"-a, --apdu Show APDU requests and responses",
"-v, --verbose Verbose mode",
"-n <dec> Key ID",
"-k, --key <hex> Auth key",
"--mfd Show info about master file",
"--aid <hex> Select application ID (AID) ( 1..16 bytes )",
"--fid <hex> File ID",
"--chfid <hex> Child file ID (EF under application/master file) ( 2 bytes )",
"--noauth Read file attributes without authentication",
"--sreq <plain|mac|encode> Communication reader-PICC security level (def: mac)",
"--sresp <plain|mac|encode> Communication PICC-reader security level (def: mac)"
],
"usage": "hf cipurse aread [-hav] [-n <dec>] [-k <hex>] [--mfd] [--aid <hex>] [--fid <hex>] [--chfid <hex>] [--noauth] [--sreq <plain|mac|encode>] [--sresp <plain|mac|encode>]"
},
"hf cipurse auth": {
"command": "hf cipurse auth",
"description": "Authenticate with key ID and key. If no key is supplied, default key of 737373...7373 will be used",
"notes": [
"hf cipurse auth -> Authenticate with keyID 1, default key",
"hf cipurse auth -n 2 -k 65656565656565656565656565656565 -> Authenticate keyID 2 with key"
],
"offline": false,
"options": [
"-h, --help This help",
"-a, --apdu Show APDU requests and responses",
"-v, --verbose Verbose mode",
"--aid <hex> Application ID (AID) ( 1..16 bytes )",
"--fid <hex> Top file/application ID (FID) ( 2 bytes )",
"--mfd Select masterfile by empty id",
"-n <dec> Key ID",
"-k, --key <hex> Auth key"
],
"usage": "hf cipurse auth [-hav] [--aid <hex>] [--fid <hex>] [--mfd] [-n <dec>] [-k <hex>]"
},
"hf cipurse awrite": {
"command": "hf cipurse awrite",
"description": "Write file attributes by file ID with key ID and key. If no key is supplied, default key of 737373...7373 will be used",
"notes": [
"hf cipurse awrite --fid 2ff7 -d 080000C1C1C1C1C1C1C1C1C1 -> write default file attributes with id 2ff7",
"hf cipurse awrite --mfd -d 080000FFFFFFFFFFFFFFFFFF86023232 --commit -> write file attributes for master file (MF)",
"hf cipurse awrite --chfid 0102 -d 020000ffffff -> write file 0102 attributes in the default application to full access",
"hf cipurse awrite --chfid 0102 -d 02000040ffff -> write file 0102 attributes in the default application to full access with keys 1 and 2"
],
"offline": false,
"options": [
"-h, --help This help",
"-a, --apdu Show APDU requests and responses",
"-v, --verbose Verbose mode",
"-n <dec> Key ID",
"-k, --key <hex> Auth key",
"--mfd Show info about master file",
"--aid <hex> Select application ID (AID) ( 1..16 bytes )",
"--fid <hex> File ID",
"--chfid <hex> Child file ID (EF under application/master file) ( 2 bytes )",
"--noauth Read file attributes without authentication",
"--sreq <plain|mac|encode> Communication reader-PICC security level (def: mac)",
"--sresp <plain|mac|encode> Communication PICC-reader security level (def: mac)",
"-d, --data <hex> File attributes",
"--commit Commit after write"
],
"usage": "hf cipurse awrite [-hav] [-n <dec>] [-k <hex>] [--mfd] [--aid <hex>] [--fid <hex>] [--chfid <hex>] [--noauth] [--sreq <plain|mac|encode>] [--sresp <plain|mac|encode>] [-d <hex>] [--commit]"
},
"hf cipurse create": {
"command": "hf cipurse create",
"description": "Create application/file/key by provide appropriate DGI. If no key is supplied, default key of 737373...7373 will be used",
"notes": [
"hf cipurse create -d 9200123F00200008000062098407A0000005070100 -> create PTSE file with FID 0x2000 and space for 8 AIDs",
"hf cipurse create -d 92002438613F010A050200004040FF021009021009621084054144204631D407A0000005070100A00F2873737373737373737373737373737373015FD67B000102030405060708090A0B0C0D0E0F01C6A13B -> create default file with FID 3F01 and 2 keys",
"hf cipurse create --aid 4144204631 -d 92010C010001020030020000FFFFFF -> create 0x0102 binary data EF under application 4144204631"
],
"offline": false,
"options": [
"-h, --help This help",
"-a, --apdu Show APDU requests and responses",
"-v, --verbose Verbose mode",
"-n <dec> Key ID",
"-k, --key <hex> Auth key",
"--aid <hex> Application ID (AID) ( 1..16 bytes )",
"--fid <hex> File ID (FID) ( 2 bytes )",
"--mfd Select masterfile by empty id",
"-d, --data <hex> Data with DGI for create",
"--sreq <plain|mac|encode> Communication reader-PICC security level (def: mac)",
"--sresp <plain|mac|encode> Communication PICC-reader security level (def: mac)",
"--no-auth Execute without authentication",
"--commit Commit after create"
],
"usage": "hf cipurse create [-hav] [-n <dec>] [-k <hex>] [--aid <hex>] [--fid <hex>] [--mfd] [-d <hex>] [--sreq <plain|mac|encode>] [--sresp <plain|mac|encode>] [--no-auth] [--commit]"
},
"hf cipurse default": {
"command": "hf cipurse default",
"description": "Set default parameters for access to cipurse card",
"notes": [
"hf cipurse default --reset -> reset parameters to default",
"hf cipurse default -n 1 -k 65656565656565656565656565656565 --fid 2ff7 -> Set key, key id and file id",
"hf cipurse default --aid 4144204632 -> set default application id"
],
"offline": false,
"options": [
"-h, --help This help",
"--clear Resets to defaults",
"-n <dec> Key ID",
"-k, --key <hex> Authentication key",
"--aid <hex> Application ID (AID) ( 1..16 bytes )",
"--fid <hex> File ID ( 2 bytes )"
],
"usage": "hf cipurse default [-h] [--clear] [-n <dec>] [-k <hex>] [--aid <hex>] [--fid <hex>]"
},
"hf cipurse delete": {
"command": "hf cipurse delete",
"description": "Delete file by file ID with key ID and key. If no key is supplied, default key of 737373...7373 will be used",
"notes": [
"hf cipurse delete --fid 2ff7 -> Authenticate with keyID 1, delete file with id 2ff7 at top level",
"hf cipurse delete -n 2 -k 65656565656565656565656565656565 --fid 2ff7 -> Authenticate keyID 2 and delete file",
"hf cipurse delete --aid A0000005070100 --no-auth -> delete PTSE file with AID A0000005070100 without authentication",
"hf cipurse delete --aid 4144204631 --chfid 0102 -> delete EF with FID 0x0102 under default application"
],
"offline": false,
"options": [
"-h, --help This help",
"-a, --apdu Show APDU requests and responses",
"-v, --verbose Verbose mode",
"-n <dec> Key ID",
"-k, --key <hex> Auth key",
"--fid <hex> File/application ID under MF for delete",
"--aid <hex> Application ID (AID) for delete ( 1..16 bytes )",
"--chfid <hex> Child file ID (EF under application/master file) ( 2 bytes )",
"--sreq <plain|mac|encode> Communication reader-PICC security level (def: mac)",
"--sresp <plain|mac|encode> Communication PICC-reader security level (def: mac)",
"--no-auth Execute without authentication",
"--commit commit after delete"
],
"usage": "hf cipurse delete [-hav] [-n <dec>] [-k <hex>] [--fid <hex>] [--aid <hex>] [--chfid <hex>] [--sreq <plain|mac|encode>] [--sresp <plain|mac|encode>] [--no-auth] [--commit]"
},
"hf cipurse formatall": {
"command": "hf cipurse formatall",
"description": "Format card. Erases all the data at the card level!",
"notes": [
"hf cipurse formatall -> Format card with default key",
"hf cipurse formatall -n 2 -k 65656565656565656565656565656565 -> Format card with keyID 2",
"hf cipurse formatall --no-auth -> Format card without authentication. Works for card in perso state"
],
"offline": false,
"options": [
"-h, --help This help",
"-a, --apdu Show APDU requests and responses",
"-v, --verbose Verbose mode",
"-n <dec> Key ID",
"-k, --key <hex> Auth key",
"--sreq <plain|mac|encode> Communication reader-PICC security level (def: mac)",
"--sresp <plain|mac|encode> Communication PICC-reader security level (def: mac)",
"--no-auth Execute without authentication"
],
"usage": "hf cipurse formatall [-hav] [-n <dec>] [-k <hex>] [--sreq <plain|mac|encode>] [--sresp <plain|mac|encode>] [--no-auth]"
},
"hf cipurse help": {
"command": "hf cipurse help",
"description": "help This help. test Regression tests --------------------------------------------------------------------------------------- hf cipurse info available offline: no Get info from CIPURSE tags",
"notes": [
"hf cipurse info"
],
"offline": true,
"options": [
"-h, --help This help"
],
"usage": "hf cipurse info [-h]"
},
"hf cipurse read": {
"command": "hf cipurse read",
"description": "Read file in the application by file ID with key ID and key. If no key is supplied, default key of 737373...7373 will be used",
"notes": [
"hf cipurse read --fid 2ff7 -> Authenticate with keyID 1, read file with id 2ff7",
"hf cipurse read -n 2 -k 65656565656565656565656565656565 --fid 2ff7 -> Authenticate keyID 2 and read file",
"hf cipurse read --aid 4144204631 --fid 0102 -> read file with id 0102 from application 4144204631"
],
"offline": false,
"options": [
"-h, --help This help",
"-a, --apdu Show APDU requests and responses",
"-v, --verbose Verbose mode",
"-n <dec> Key ID",
"-k, --key <hex> Auth key",
"--aid <hex> Application ID (AID) ( 1..16 bytes )",
"--fid <hex> File ID",
"-o, --offset <dec> Offset for reading data from file",
"--noauth Read file without authentication",
"--sreq <plain|mac|encode> Communication reader-PICC security level (def: mac)",
"--sresp <plain|mac|encode> Communication PICC-reader security level (def: mac)"
],
"usage": "hf cipurse read [-hav] [-n <dec>] [-k <hex>] [--aid <hex>] [--fid <hex>] [-o <dec>] [--noauth] [--sreq <plain|mac|encode>] [--sresp <plain|mac|encode>]"
},
"hf cipurse select": {
"command": "hf cipurse select",
"description": "Select application or file",
"notes": [
"hf cipurse select --aid A0000005070100 -> Select PTSE application by AID",
"hf cipurse select --fid 3f00 -> Select master file by FID 3f00",
"hf cipurse select --fid 2ff7 -> Select attribute file by FID 2ff7",
"hf cipurse select --mfd -vt -> Select default file by empty FID and show response data in plain and TLV decoded format"
],
"offline": false,
"options": [
"-h, --help This help",
"-a, --apdu Show APDU requests and responses",
"-v, --verbose Verbose mode",
"-t, --tlv TLV decode returned data",
"--aid <hex> Application ID (AID) 1..16 bytes",
"--fid <hex> Top level file (or application) ID (FID) 2 bytes",
"--mfd Select masterfile by empty id",
"--chfid <hex> Child file ID (EF under application/master file) 2 bytes"
],
"usage": "hf cipurse select [-havt] [--aid <hex>] [--fid <hex>] [--mfd] [--chfid <hex>]"
},
"hf cipurse test": {
"command": "hf cipurse test",
"description": "Regression tests",
"notes": [
"hf cipurse test"
],
"offline": true,
"options": [
"-h, --help This help"
],
"usage": "hf cipurse test [-h]"
},
"hf cipurse updakey": {
"command": "hf cipurse updakey",
"description": "Update key attributes. Factory default - 0x02. b0 - Update right - 1 self b1 - Change key and rights - 0 frozen b2 - Use as key encryption key - 1 blocked b8 - Key validity - 0 valid",
"notes": [
"hf cipurse updakey --trgkeyn 2 --attr 80 -> block key 2 for lifetime (WARNING!)",
"hf cipurse updakey --trgkeyn 1 --attr 02 --commit -> for key 1"
],
"offline": false,
"options": [
"-h, --help This help",
"-a, --apdu Show APDU requests and responses",
"-v, --verbose Show technical data",
"-n <dec> Key ID for authentication",
"-k, --key <hex> Auth key",
"--aid <hex 1..16 bytes> Application ID (AID)",
"--fid <hex 2 bytes> File ID (FID)",
"--mfd Select masterfile by empty id",
"--trgkeyn <dec> Target key ID",
"--attr <hex 1 byte> Key attributes 1 byte",
"--sreq <plain|mac(default)|encode> Communication reader-PICC security level",
"--sresp <plain|mac(default)|encode> Communication PICC-reader security level",
"--no-auth Execute without authentication",
"--commit Commit"
],
"usage": "hf cipurse updakey [-hav] [-n <dec>] [-k <hex>] [--aid <hex 1..16 bytes>] [--fid <hex 2 bytes>] [--mfd] [--trgkeyn <dec>] [--attr <hex 1 byte>] [--sreq <plain|mac(default)|encode>] [--sresp <plain|mac(default)|encode>] [--no-auth] [--commit]"
},
"hf cipurse updkey": {
"command": "hf cipurse updkey",
"description": "Update key",
"notes": [
"hf cipurse updkey --aid 4144204631 --newkeyn 2 --newkeya 00 --newkey 73737373737373737373737373737373 -> update default application key 2 with default value 73..73",
"hf cipurse updkey --newkeyn 1 --newkeya 00 --newkey 0102030405060708090a0b0c0d0e0f10 --commit -> for key 1"
],
"offline": false,
"options": [
"-h, --help This help",
"-a, --apdu Show APDU requests and responses",
"-v, --verbose Show technical data",
"-n <dec> Key ID for authentication",
"-k, --key <hex> Auth key",
"--aid <hex 1..16 bytes> Application ID (AID)",
"--fid <hex 2 bytes> File ID (FID)",
"--mfd Select masterfile by empty id",
"--newkeyn <dec> Target key ID",
"--newkey <hex 16 byte> New key",
"--newkeya <hex 1 byte> New key additional info (def: 0x00)",
"--enckeyn <dec> Encrypt key ID (must be equal to the key on the card)",
"--enckey <hex 16 byte> Encrypt key (must be equal to the key on the card)",
"--sreq <plain|mac(default)|encode> Communication reader-PICC security level",
"--sresp <plain|mac(default)|encode> Communication PICC-reader security level",
"--no-auth Execute without authentication",
"--commit Commit"
],
"usage": "hf cipurse updkey [-hav] [-n <dec>] [-k <hex>] [--aid <hex 1..16 bytes>] [--fid <hex 2 bytes>] [--mfd] [--newkeyn <dec>] [--newkey <hex 16 byte>] [--newkeya <hex 1 byte>] [--enckeyn <dec>] [--enckey <hex 16 byte>] [--sreq <plain|mac(default)|encode>] [--sresp <plain|mac(default)|encode>] [--no-auth] [--commit]"
},
"hf cipurse write": {
"command": "hf cipurse write",
"description": "Write file in the application by file ID with key ID and key. If no key is supplied, default key of 737373...7373 will be used",
"notes": [
"hf cipurse write --fid 2ff7 -d aabb -> Authenticate with keyID 1, write file with id 2ff7",
"hf cipurse write -n 2 -k 65656565656565656565656565656565 --fid 2ff7 -d aabb -> Authenticate keyID 2 and write file",
"hf cipurse write --aid 4144204631 --fid 0102 -d aabb -> write file with id 0102 in the 4144204631 application",
"hf cipurse write --fid 0102 -d aabb --commit -> write file with id 0102 and perform commit after write"
],
"offline": false,
"options": [
"-h, --help This help",
"-a, --apdu Show APDU requests and responses",
"-v, --verbose Verbose mode",
"-n <dec> Key ID",
"-k, --key <hex> Auth key",
"--aid <hex> Application ID (AID) ( 1..16 bytes )",
"--fid <hex> File ID",
"-o, --offset <dec> Offset for reading data from file",
"--noauth Read file without authentication",
"--sreq <plain|mac|encode> Communication reader-PICC security level (def: mac)",
"--sresp <plain|mac|encode> Communication PICC-reader security level (def: mac)",
"-d, --data <hex> Data to write to new file",
"--commit Commit after write"
],
"usage": "hf cipurse write [-hav] [-n <dec>] [-k <hex>] [--aid <hex>] [--fid <hex>] [-o <dec>] [--noauth] [--sreq <plain|mac|encode>] [--sresp <plain|mac|encode>] [-d <hex>] [--commit]"
},
"hf emrtd help": {
"command": "hf emrtd help",
"description": "help This help info Display info about an eMRTD list List ISO 14443A/7816 history --------------------------------------------------------------------------------------- hf emrtd dump available offline: no Dump all files on an eMRTD",
"notes": [
"hf emrtd dump",
"hf emrtd dump --dir ../dump",
"hf emrtd dump -n 123456789 -d 890101 -e 250401"
],
"offline": true,
"options": [
"-h, --help This help",
"-n, --doc <alphanum> document number, up to 9 chars",
"-d, --date <YYMMDD> date of birth in YYMMDD format",
"-e, --expiry <YYMMDD> expiry in YYMMDD format",
"-m, --mrz <[0-9A-Z<]> 2nd line of MRZ, 44 chars",
"--dir <str> save dump to the given dirpath"
],
"usage": "hf emrtd dump [-h] [-n <alphanum>] [-d <YYMMDD>] [-e <YYMMDD>] [-m <[0-9A-Z<]>] [--dir <str>]"
},
"hf emrtd info": {
"command": "hf emrtd info",
"description": "Display info about an eMRTD",
"notes": [
"hf emrtd info",
"hf emrtd info --dir ../dumps",
"hf emrtd info -n 123456789 -d 890101 -e 250401",
"hf emrtd info -n 123456789 -d 890101 -e 250401 -i"
],
"offline": true,
"options": [
"-h, --help This help",
"-n, --doc <alphanum> document number, up to 9 chars",
"-d, --date <YYMMDD> date of birth in YYMMDD format",
"-e, --expiry <YYMMDD> expiry in YYMMDD format",
"-m, --mrz <[0-9A-Z<]> 2nd line of MRZ, 44 chars (passports only)",
"--dir <str> display info from offline dump stored in dirpath",
"-i, --images show images"
],
"usage": "hf emrtd info [-hi] [-n <alphanum>] [-d <YYMMDD>] [-e <YYMMDD>] [-m <[0-9A-Z<]>] [--dir <str>]"
},
"hf emrtd list": {
"command": "hf emrtd list",
"description": "Alias of `trace list -t 7816` with selected protocol data to annotate trace buffer You can load a trace from file (see `trace load -h`) or it be downloaded from device by default It accepts all other arguments of `trace list`. Note that some might not be relevant for this specific protocol",
"notes": [
"hf emrtd list --frame -> show frame delay times",
"hf emrtd list -1 -> use trace buffer"
],
"offline": true,
"options": [
"-h, --help This help",
"-1, --buffer use data from trace buffer",
"--frame show frame delay times",
"-c mark CRC bytes",
"-r show relative times (gap and duration)",
"-u display times in microseconds instead of clock cycles",
"-x show hexdump to convert to pcap(ng)",
"or to import into Wireshark using encapsulation type \"ISO 14443\"",
"-f, --file <fn> filename of dictionary"
],
"usage": "hf emrtd list [-h1crux] [--frame] [-f <fn>]"
},
"hf epa help": {
"command": "hf epa help",
"description": "help This help --------------------------------------------------------------------------------------- hf epa cnonces available offline: no Tries to collect nonces when doing part of PACE protocol.",
"notes": [
"hf epa cnonces --size 4 --num 4 --delay 1"
],
"offline": true,
"options": [
"-h, --help This help",
"--size <dec> nonce size",
"--num <dec> number of nonces to collect",
"-d, --delay <dec> delay between attempts"
],
"usage": "hf epa cnonces [-h] --size <dec> --num <dec> -d <dec>"
},
"hf epa replay": {
"command": "hf epa replay",
"description": "Perform PACE protocol by replaying given APDUs",
"notes": [
"hf epa replay --mse 0022C1A4 --get 1068000000 --map 1086000002 --pka 1234ABCDEF --ma 1A2B3C4D"
],
"offline": false,
"options": [
"-h, --help This help",
"--mse <hex> msesa APDU",
"--get <hex> gn APDU",
"--map <hex> map APDU",
"--pka <hex> pka APDU",
"--ma <hex> ma APDU"
],
"usage": "hf epa replay [-h] --mse <hex> --get <hex> --map <hex> --pka <hex> --ma <hex>"
},
"hf epa sim": {
"command": "hf epa sim",
"description": "Simulate PACE protocol with given password pwd of type pty. The crypto is performed on pc or proxmark",
"notes": [
"hf epa sim --pwd 112233445566",
"hf epa sim --pc --pty 1 --pwd 112233445566"
],
"offline": false,
"options": [
"-h, --help This help",
"--pc perform crypto on PC",
"--pty <hex> type of password",
"-p, --pwd <hex> password"
],
"usage": "hf epa sim [-h] --pc --pty <hex> -p <hex>"
},
"hf felica auth1": {
"command": "hf felica auth1",
"description": "Initiate mutual authentication. This command must always be executed before Auth2 command and mutual authentication is achieve only after Auth2 command has succeeded. INCOMPLETE / EXPERIMENTAL COMMAND!!!",
"notes": [
"hf felica auth1 --an 01 --acl 0000 --sn 01 --scl 8B00 --key AAAAAAAAAAAAAAAABBBBBBBBBBBBBBBB",
"hf felica auth1 --an 01 --acl 0000 --sn 01 --scl 8B00 --key AAAAAAAAAAAAAAAABBBBBBBBBBBBBBBBAAAAAAAAAAAAAAAA",
"hf felica auth1 -i 11100910C11BC407 --an 01 --acl 0000 --sn 01 ..scl 8B00 --key AAAAAAAAAAAAAAAABBBBBBBBBBBBBBBB"
],
"offline": false,
"options": [
"-h, --help This help",
"--an <hex> number of areas, 1 byte",
"--acl <hex> area code list, 2 bytes",
"-i <hex> set custom IDm",
"--sn <hex> number of service, 1 byte",
"--scl <hex> service code list, 2 bytes",
"-k, --key <hex> 3des key, 16 bytes",
"-v, --verbose verbose output"
],
"usage": "hf felica auth1 [-hv] [--an <hex>] [--acl <hex>] [-i <hex>] [--sn <hex>] [--scl <hex>] [-k <hex>]"
},
"hf felica auth2": {
"command": "hf felica auth2",
"description": "Complete mutual authentication. This command can only be executed subsquent to Auth1 INCOMPLETE / EXPERIMENTAL COMMAND!!! EXPERIMENTAL COMMAND - M2c/P2c will be not checked",
"notes": [
"hf felica auth2 --cc 0102030405060708 --key AAAAAAAAAAAAAAAABBBBBBBBBBBBBBBB",
"hf felica auth2 -i 11100910C11BC407 --cc 0102030405060708 --key AAAAAAAAAAAAAAAABBBBBBBBBBBBBBBB"
],
"offline": false,
"options": [
"-h, --help This help",
"-i <hex> set custom IDm",
"-c, --cc <hex> M3c card challenge, 8 bytes",
"-k, --key <hex> 3des M3c decryption key, 16 bytes",
"-v, --verbose verbose output"
],
"usage": "hf felica auth2 [-hv] [-i <hex>] [-c <hex>] [-k <hex>]"
},
"hf felica help": {
"command": "hf felica help",
"description": "----------- ----------------------- General ----------------------- help This help list List ISO 18092/FeliCa history ----------- ----------------------- Operations ----------------------- ----------- ----------------------- FeliCa Standard ----------------------- ----------- ----------------------- FeliCa Light ----------------------- --------------------------------------------------------------------------------------- hf felica list available offline: yes Alias of `trace list -t felica` with selected protocol data to annotate trace buffer You can load a trace from file (see `trace load -h`) or it be downloaded from device by default It accepts all other arguments of `trace list`. Note that some might not be relevant for this specific protocol",
"notes": [
"hf felica list --frame -> show frame delay times",
"hf felica list -1 -> use trace buffer"
],
"offline": true,
"options": [
"-h, --help This help",
"-1, --buffer use data from trace buffer",
"--frame show frame delay times",
"-c mark CRC bytes",
"-r show relative times (gap and duration)",
"-u display times in microseconds instead of clock cycles",
"-x show hexdump to convert to pcap(ng)",
"or to import into Wireshark using encapsulation type \"ISO 14443\"",
"-f, --file <fn> filename of dictionary"
],
"usage": "hf felica list [-h1crux] [--frame] [-f <fn>]"
},
"hf felica info": {
"command": "hf felica info",
"description": "Reader for FeliCa based tags",
"notes": [
"hf felica info"
],
"offline": false,
"options": [
"-h, --help This help"
],
"usage": "hf felica info [-h]"
},
"hf felica litedump": {
"command": "hf felica litedump",
"description": "Dump ISO/18092 FeliCa Lite tag. It will timeout after 200sec",
"notes": [
"hf felica litedump"
],
"offline": false,
"options": [
"-h, --help This help"
],
"usage": "hf felica litedump [-h]"
},
"hf felica litesim": {
"command": "hf felica litesim",
"description": "Emulating ISO/18092 FeliCa Lite tag",
"notes": [
"hf felica litesim -u 1122334455667788"
],
"offline": false,
"options": [
"-h, --help This help",
"-u, --uid <hex> UID/NDEF2 8 hex bytes"
],
"usage": "hf felica litesim [-h] -u <hex>"
},
"hf felica raw": {
"command": "hf felica raw",
"description": "Send raw hex data to tag",
"notes": [
"hf felica raw -cs 20",
"hf felica raw -cs 2008"
],
"offline": false,
"options": [
"-h, --help This help",
"-a active signal field ON without select",
"-c calculate and append CRC",
"-k keep signal field ON after receive",
"-n <dec> number of bits",
"-r do not read response",
"-s active signal field ON with select",
"<hex> raw bytes to send"
],
"usage": "hf felica raw [-hackrs] [-n <dec>] <hex>"
},
"hf felica rdbl": {
"command": "hf felica rdbl",
"description": "Use this command to read block data from authentication-not-required Service. - Mode shall be Mode0. - Successful == block data - Unsuccessful == Status Flag1 and Flag2",
"notes": [
"hf felica rdbl --sn 01 --scl 8B00 --bn 01 --ble 8000",
"hf felica rdbl --sn 01 --scl 4B18 --bn 01 --ble 8000 -b",
"hf felica rdbl -i 01100910c11bc407 --sn 01 --scl 8B00 --bn 01 --ble 8000"
],
"offline": false,
"options": [
"-h, --help This help",
"-b get all block list elements 00 -> FF",
"-i <hex> set custom IDm",
"-l, --long use 3 byte block list element block number",
"--sn <hex> number of service",
"--scl <hex> service code list",
"--bn <hex> number of block",
"--ble <hex> block list element (def 2|3 bytes)",
"-v, --verbose verbose output"
],
"usage": "hf felica rdbl [-hblv] [-i <hex>] [--sn <hex>] [--scl <hex>] [--bn <hex>] [--ble <hex>]"
},
"hf felica reader": {
"command": "hf felica reader",
"description": "Act as a ISO 18092 / FeliCa reader. Look for FeliCa tags until Enter or the pm3 button is pressed",
"notes": [
"hf felica reader -@ -> Continuous mode"
],
"offline": false,
"options": [
"-h, --help This help",
"-s, --silent silent (no messages)",
"-@ optional - continuous reader mode"
],
"usage": "hf felica reader [-hs@]"
},
"hf felica resetmode": {
"command": "hf felica resetmode",
"description": "Use this command to reset Mode to Mode 0.",
"notes": [
"hf felica resetmode",
"hf felica resetmode -r 0001",
"hf felica resetmode -i 11100910C11BC407"
],
"offline": false,
"options": [
"-h, --help This help",
"-i <hex> set custom IDm",
"-r <hex> set custom reserve",
"-v, --verbose verbose output"
],
"usage": "hf felica resetmode [-hv] [-i <hex>] [-r <hex>]"
},
"hf felica rqresponse": {
"command": "hf felica rqresponse",
"description": "Use this command to verify the existence of a card and its Mode. - current mode of the card is returned",
"notes": [
"hf felica rqresponse -i 11100910C11BC407"
],
"offline": false,
"options": [
"-h, --help This help",
"-i <hex> set custom IDm"
],
"usage": "hf felica rqresponse [-h] [-i <hex>]"
},
"hf felica rqservice": {
"command": "hf felica rqservice",
"description": "Use this command to verify the existence of Area and Service, and to acquire Key Version: - When the specified Area or Service exists, the card returns Key Version. - When the specified Area or Service does not exist, the card returns FFFFh as Key Version. For Node Code List of a command packet, Area Code or Service Code of the target of acquisition of Key Version shall be enumerated in Little Endian format. If Key Version of System is the target of acquisition, FFFFh shall be specified in the command packet.",
"notes": [
"hf felcia rqservice --node 01 --code FFFF",
"hf felcia rqservice -a --code FFFF",
"hf felica rqservice -i 011204126417E405 --node 01 --code FFFF"
],
"offline": false,
"options": [
"-h, --help This help",
"-a, --all auto node number mode, iterates through all nodes 1 < n < 32",
"-n, --node <hex> Number of Node",
"-c, --code <hex> Node Code List (little endian)",
"-i, --idm <hex> use custom IDm"
],
"usage": "hf felica rqservice [-ha] [-n <hex>] [-c <hex>] [-i <hex>]"
},
"hf felica rqspecver": {
"command": "hf felica rqspecver",
"description": "Use this command to acquire the version of card OS. Response: - Format version: Fixed value 00h. Provided only if Status Flag1 = 00h - Basic version: Each value of version is expressed in BCD notation. Provided only if Status Flag1 = 00h - Number of Option: value = 0: AES card, value = 1: AES/DES card. Provided only if Status Flag1 = 00h - Option version list: Provided only if Status Flag1 = 00h - AES card: not added - AES/DES card: DES option version is added - BCD notation",
"notes": [
"hf felica rqspecver",
"hf felica rqspecver -r 0001",
"hf felica rqspecver -i 11100910C11BC407"
],
"offline": false,
"options": [
"-h, --help This help",
"-i <hex> set custom IDm",
"-r <hex> set custom reserve",
"-v, --verbose verbose output"
],
"usage": "hf felica rqspecver [-hv] [-i <hex>] [-r <hex>]"
},
"hf felica rqsyscode": {
"command": "hf felica rqsyscode",
"description": "Use this command to acquire System Code registered to the card. - if a card is divided into more than one System, this command acquires System Code of each System existing in the card.",
"notes": [
"hf felica rqsyscode",
"hf felica rqsyscode -i 11100910C11BC407"
],
"offline": false,
"options": [
"-h, --help This help",
"-i <hex> set custom IDm"
],
"usage": "hf felica rqsyscode [-h] [-i <hex>]"
},
"hf felica scsvcode": {
"command": "hf felica scsvcode",
"description": "Feature not implemented yet. Feel free to contribute!",
"notes": [
"hf felica scsvcode"
],
"offline": false,
"options": [
"-h, --help This help"
],
"usage": "hf felica scsvcode [-h]"
},
"hf felica sniff": {
"command": "hf felica sniff",
"description": "Collect data from the field and save into command buffer. Buffer accessible from `hf felica list`",
"notes": [
"hf felica sniff",
"hf felica sniff -s 10 -t 19"
],
"offline": false,
"options": [
"-h, --help This help",
"-s, --samples <dec> samples to skip",
"-t, --trig <dec> triggers to skip"
],
"usage": "hf felica sniff [-h] [-s <dec>] [-t <dec>]"
},
"hf felica wrbl": {
"command": "hf felica wrbl",
"description": "Use this command to write block data to authentication-not-required Service. - Mode shall be Mode0. - Un-/Ssuccessful == Status Flag1 and Flag2",
"notes": [
"hf felica wrbl --sn 01 --scl CB10 --bn 01 --ble 8001 -d 0102030405060708090A0B0C0D0E0F10",
"hf felica wrbl -i 01100910c11bc407 --sn 01 --scl CB10 --bn 01 --ble 8001 -d 0102030405060708090A0B0C0D0E0F10"
],
"offline": false,
"options": [
"-h, --help This help",
"-d, --data <hex> data, 16 hex bytes",
"-i <hex> set custom IDm",
"--sn <hex> number of service",
"--scl <hex> service code list",
"--bn <hex> number of block",
"--ble <hex> block list element (def 2|3 bytes)",
"-v, --verbose verbose output"
],
"usage": "hf felica wrbl [-hv] [-d <hex>] [-i <hex>] [--sn <hex>] [--scl <hex>] [--bn <hex>] [--ble <hex>]"
},
"hf fido assert": {
"command": "hf fido assert",
"description": "Execute a FIDO2 Get Assertion command. Needs json file with parameters. Sample file `fido2_defparams.json` in `client/resources/`. - Needs if `rk` option is `false` (authenticator doesn't store credential to its memory) - for yubikey there must be only one option `\"up\": true` or false note: `-vv` shows full certificates data",
"notes": [
"hf fido assert -> default parameters file `fido2_defparams.json`",
"hf fido assert -f test.json -l -> use parameters file `text.json` and add to request CredentialId"
],
"offline": false,
"options": [
"-h, --help This help",
"-a, --apdu Show APDU requests and responses",
"-v, --verbose Verbose output",
"-c, --cbor Show CBOR decoded data",
"-l, --list Add CredentialId from json to allowList",
"-f, --file <fn> Parameter JSON file name"
],
"usage": "hf fido assert [-havcl] [-f <fn>]"
},
"hf fido auth": {
"command": "hf fido auth",
"description": "Initiate a U2F token authentication. Needs key handle and two 32-byte hash numbers. key handle(var 0..255), challenge parameter (32b) and application parameter (32b) The default config filename is `fido2_defparams.json`",
"notes": [
"hf fido auth --kh 000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f -> execute command with 2 parameters, filled 0x00 and key handle",
"hf fido auth",
"--kh 000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f",
"--cpx 000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f",
"--apx 000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f -> execute command with parameters"
],
"offline": false,
"options": [
"-h, --help This help",
"-a, --apdu Show APDU requests and responses",
"-v, --verbose Verbose output",
"default mode: dont-enforce-user-presence-and-sign",
"-u, --user mode: enforce-user-presence-and-sign",
"-c, --check mode: check-only",
"-f, --file <fn> JSON file name for parameters",
"-k, --key <hex> Public key to verify signature",
"--kh <hex> Key handle (var 0..255b)",
"--cp <str> Challenge parameter (1..16 chars)",
"--ap <str> Application parameter (1..16 chars)",
"--cpx <hex> Challenge parameter (32 bytes hex)",
"--apx <hex> Application parameter (32 bytes hex)"
],
"usage": "hf fido auth [-havuc] default mode: [-f <fn>] [-k <hex>] [--kh <hex>] [--cp <str>] [--ap <str>] [--cpx <hex>] [--apx <hex>]"
},
"hf fido help": {
"command": "hf fido help",
"description": "help This help. list List ISO 14443A history --------------------------------------------------------------------------------------- hf fido list available offline: yes Alias of `trace list -t 14a` with selected protocol data to annotate trace buffer You can load a trace from file (see `trace load -h`) or it be downloaded from device by default It accepts all other arguments of `trace list`. Note that some might not be relevant for this specific protocol",
"notes": [
"hf fido list --frame -> show frame delay times",
"hf fido list -1 -> use trace buffer"
],
"offline": true,
"options": [
"-h, --help This help",
"-1, --buffer use data from trace buffer",
"--frame show frame delay times",
"-c mark CRC bytes",
"-r show relative times (gap and duration)",
"-u display times in microseconds instead of clock cycles",
"-x show hexdump to convert to pcap(ng)",
"or to import into Wireshark using encapsulation type \"ISO 14443\"",
"-f, --file <fn> filename of dictionary"
],
"usage": "hf fido list [-h1crux] [--frame] [-f <fn>]"
},
"hf fido info": {
"command": "hf fido info",
"description": "Get info from Fido tags",
"notes": [
"hf fido info"
],
"offline": false,
"options": [
"-h, --help This help"
],
"usage": "hf fido info [-h]"
},
"hf fido make": {
"command": "hf fido make",
"description": "Execute a FIDO2 Make Credential command. Needs json file with parameters. Sample file `fido2_defparams.json` in `client/resources/`. - for yubikey there must be only one option `\"rk\": true` or false note: `-vv` shows full certificates data",
"notes": [
"hf fido make -> use default parameters file `fido2_defparams.json`",
"hf fido make -f test.json -> use parameters file `text.json`"
],
"offline": false,
"options": [
"-h, --help This help",
"-a, --apdu Show APDU requests and responses",
"-v, --verbose Verbose output",
"-t, --tlv Show DER certificate contents in TLV representation",
"-c, --cbor Show CBOR decoded data",
"-f, --file <fn> Parameter JSON file name"
],
"usage": "hf fido make [-havtc] [-f <fn>]"
},
"hf fido reg": {
"command": "hf fido reg",
"description": "Initiate a U2F token registration. Needs two 32-byte hash numbers. challenge parameter (32b) and application parameter (32b). The default config filename is `fido2_defparams.json` note: `-vv` shows full certificates data",
"notes": [
"hf fido reg -> execute command with 2 parameters, filled 0x00",
"hf fido reg --cp s0 --ap s1 -> execute command with plain parameters",
"hf fido reg --cpx 000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f --apx 000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f",
"hf fido reg -f fido2-params -> execute command with custom config file"
],
"offline": false,
"options": [
"-h, --help This help",
"-a, --apdu Show APDU requests and responses",
"-v, --verbose Verbose output",
"-t, --tlv Show DER certificate contents in TLV representation",
"-f, --file <fn> JSON input file name for parameters",
"--cp <str> Challenge parameter (1..16 chars)",
"--ap <str> Application parameter (1..16 chars)",
"--cpx <hex> Challenge parameter (32 bytes hex)",
"--apx <hex> Application parameter (32 bytes hex)"
],
"usage": "hf fido reg [-havt] [-f <fn>] [--cp <str>] [--ap <str>] [--cpx <hex>] [--apx <hex>]"
},
"hf fudan dump": {
"command": "hf fudan dump",
"description": "Dump FUDAN tag to file (bin/json) If no <name> given, UID will be used as filename",
"notes": [
"hf fudan dump -f mydump -> dump using filename"
],
"offline": false,
"options": [
"-h, --help This help",
"-f, --file <fn> Specify a filename for dump file",
"--ns no save to file"
],
"usage": "hf fudan dump [-h] [-f <fn>] [--ns]"
},
"hf fudan help": {
"command": "hf fudan help",
"description": "help This help view Display content from tag dump file --------------------------------------------------------------------------------------- hf fudan reader available offline: no Read a fudan tag",
"notes": [
"hf fudan reader",
"hf fudan reader -@ -> continuous reader mode"
],
"offline": true,
"options": [
"-h, --help This help",
"-v, --verbose verbose output",
"-@ optional - continuous reader mode"
],
"usage": "hf fudan reader [-hv@]"
},
"hf fudan rdbl": {
"command": "hf fudan rdbl",
"description": "Read fudan block",
"notes": [
"hf fudan rdbl --blk 0 -k FFFFFFFFFFFF",
"hf fudan rdbl --blk 3 -v"
],
"offline": false,
"options": [
"-h, --help This help",
"--blk <dec> block number",
"-k, --key <hex> key, 6 hex bytes",
"-v, --verbose verbose output"
],
"usage": "hf fudan rdbl [-hv] --blk <dec> [-k <hex>]"
},
"hf fudan view": {
"command": "hf fudan view",
"description": "Print a FUDAN dump file (bin/eml/json)",
"notes": [
"hf fudan view -f hf-fudan-01020304-dump.bin"
],
"offline": true,
"options": [
"-h, --help This help",
"-f, --file <fn> Specify a filename for dump file"
],
"usage": "hf fudan view [-h] -f <fn>"
},
"hf fudan wrbl": {
"command": "hf fudan wrbl",
"description": "Write fudan block with 4 hex bytes of data",
"notes": [
"hf fudan wrbl --blk 1 -k FFFFFFFFFFFF -d 01020304"
],
"offline": false,
"options": [
"-h, --help This help",
"--blk <dec> block number",
"-k, --key <hex> key, 6 hex bytes",
"-d, --data <hex> bytes to write, 4 hex bytes"
],
"usage": "hf fudan wrbl [-h] --blk <dec> [-k <hex>] [-d <hex>]"
},
"hf gallagher clone": {
"command": "hf gallagher clone",
"description": "Clone Gallagher credentials to a writable DESFire card Specify site key is required if using non-default key Key, lengths for the different crypto: DES 8 bytes 2TDEA or AES 16 bytes 3TDEA 24 bytes AID, default finds lowest available in range 0x??81F4, where ?? >= 0x20.",
"notes": [
"hf gallagher clone --rc 1 --fc 22 --cn 3333 --il 4 --sitekey 00112233445566778899aabbccddeeff"
],
"offline": false,
"options": [
"-h, --help This help",
"-n, --keynum <dec> PICC key number [default = 0]",
"-t, --algo <DES|2TDEA|3TDEA|AES> PICC crypt algo: DES, 2TDEA, 3TDEA, AES",
"-k, --key <hex> Key for authentication to the PICC to create applications",
"--rc <dec> Region code. 4 bits max",
"--fc <dec> Facility code. 2 bytes max",
"--cn <dec> Card number. 3 bytes max",
"--il <dec> Issue level. 4 bits max",
"--aid <hex> Application ID to write (3 bytes) [default automatically chooses]",
"--sitekey <hex> Site key to compute diversified keys (16 bytes)",
"--cadkey <hex> Custom AES key 0 to modify the Card Application Directory (16 bytes)",
"--nocadupdate Don't modify the Card Application Directory (only creates the app)",
"--noappcreate Don't create the application (only modifies the CAD)",
"--apdu Show APDU requests and responses",
"-v, --verbose Verbose output"
],
"usage": "hf gallagher clone [-hv] [-n <dec>] [-t <DES|2TDEA|3TDEA|AES>] [-k <hex>] --rc <dec> --fc <dec> --cn <dec> --il <dec> [--aid <hex>] [--sitekey <hex>] [--cadkey <hex>] [--nocadupdate] [--noappcreate] [--apdu]"
},
"hf gallagher decode": {
"command": "hf gallagher decode",
"description": "Decode Gallagher credential block Credential block can be specified with or without the bitwise inverse.",
"notes": [
"hf gallagher decode --data A3B4B0C151B0A31B"
],
"offline": true,
"options": [
"-h, --help This help",
"--data <hex> Credential block (8 or 16 bytes)"
],
"usage": "hf gallagher decode [-h] --data <hex>"
},
"hf gallagher delete": {
"command": "hf gallagher delete",
"description": "Delete Gallagher application from a DESFire card Specify site key is required if using non-default key",
"notes": [
"hf gallagher delete --aid 2081f4 --sitekey 00112233445566778899aabbccddeeff"
],
"offline": false,
"options": [
"-h, --help This help",
"--aid <hex> Application ID to delete (3 bytes)",
"--sitekey <hex> Site key to compute diversified keys (16 bytes)",
"--cadkey <hex> Custom AES key 0 to modify the Card Application Directory (16 bytes)",
"--nocadupdate Don't modify the Card Application Directory (only deletes the app)",
"--noappdelete Don't delete the application (only modifies the CAD)",
"--apdu Show APDU requests and responses",
"-v, --verbose Verbose output"
],
"usage": "hf gallagher delete [-hv] --aid <hex> [--sitekey <hex>] [--cadkey <hex>] [--nocadupdate] [--noappdelete] [--apdu]"
},
"hf gallagher diversifykey": {
"command": "hf gallagher diversifykey",
"description": "Diversify Gallagher key Specify site key is required if using non-default key",
"notes": [
"hf gallagher diversify --uid 11223344556677 --aid 2081f4"
],
"offline": true,
"options": [
"-h, --help This help",
"--aid <hex> Application ID for diversification (3 bytes)",
"--keynum <dec> Key number [default = 0]",
"--uid <hex> Card UID to delete (4 or 7 bytes)",
"--sitekey <hex> Site key to compute diversified keys (16 bytes)",
"--apdu Show APDU requests and responses"
],
"usage": "hf gallagher diversify [-h] --aid <hex> [--keynum <dec>] [--uid <hex>] [--sitekey <hex>] [--apdu]"
},
"hf gallagher encode": {
"command": "hf gallagher encode",
"description": "Encode a Gallagher credential block Credential block can be specified with or without the bitwise inverse.",
"notes": [
"hf gallagher encode --rc 1 --fc 22153 --cn 1253518 --il 1"
],
"offline": true,
"options": [
"-h, --help This help",
"-r, --rc <dec> Region code. 4 bits max",
"-f, --fc <dec> Facility code. 2 bytes max",
"-c, --cn <dec> Card number. 3 bytes max",
"-i, --il <dec> Issue level. 4 bits max"
],
"usage": "hf gallagher encode [-h] -r <dec> -f <dec> -c <dec> -i <dec>"
},
"hf gallagher help": {
"command": "hf gallagher help",
"description": "help This help diversifykey Diversify Gallagher key decode Decode Gallagher credential block encode Encode Gallagher credential block --------------------------------------------------------------------------------------- hf gallagher reader available offline: no Read a Gallagher DESFire tag from the Card Application Directory, CAD Specify site key is required if using non-default key",
"notes": [
"hf gallagher reader -@ -> continuous reader mode",
"hf gallagher reader --aid 2081f4 --sitekey 00112233445566778899aabbccddeeff -> skip CAD"
],
"offline": true,
"options": [
"-h, --help This help",
"--aid <hex> Application ID to read (3 bytes). If specified, the CAD is not used",
"--sitekey <hex> Site key to compute diversified keys (16 bytes)",
"-@, --continuous Continuous reader mode",
"--apdu Show APDU requests and responses",
"-v, --verbose Verbose output"
],
"usage": "hf gallagher reader [-h@v] [--aid <hex>] [--sitekey <hex>] [--apdu]"
},
"hf help": {
"command": "hf help",
"description": "-------- ----------------------- High Frequency ----------------------- 14a { ISO14443A RFIDs... } 14b { ISO14443B RFIDs... } 15 { ISO15693 RFIDs... } cipurse { Cipurse transport Cards... } epa { German Identification Card... } emrtd { Machine Readable Travel Document... } felica { ISO18092 / FeliCa RFIDs... } fido { FIDO and FIDO2 authenticators... } fudan { Fudan RFIDs... } gallagher { Gallagher DESFire RFIDs... } iclass { ICLASS RFIDs... } ict { ICT MFC/DESfire RFIDs... } jooki { Jooki RFIDs... } ksx6924 { KS X 6924 (T-Money, Snapper+) RFIDs } legic { LEGIC RFIDs... } lto { LTO Cartridge Memory RFIDs... } mf { MIFARE RFIDs... } mfp { MIFARE Plus RFIDs... } mfu { MIFARE Ultralight RFIDs... } mfdes { MIFARE Desfire RFIDs... } ntag424 { NXP NTAG 4242 DNA RFIDs... } seos { SEOS RFIDs... } st25ta { ST25TA RFIDs... } tesla { TESLA Cards... } texkom { Texkom RFIDs... } thinfilm { Thinfilm RFIDs... } topaz { TOPAZ (NFC Type 1) RFIDs... } vas { Apple Value Added Service } waveshare { Waveshare NFC ePaper... } xerox { Fuji/Xerox cartridge RFIDs... } ----------- --------------------- General --------------------- help This help list List protocol data in trace buffer search Search for known HF tags --------------------------------------------------------------------------------------- hf list available offline: yes Alias of `trace list -t raw` with selected protocol data to annotate trace buffer You can load a trace from file (see `trace load -h`) or it be downloaded from device by default It accepts all other arguments of `trace list`. Note that some might not be relevant for this specific protocol",
"notes": [
"hf list --frame -> show frame delay times",
"hf list -1 -> use trace buffer"
],
"offline": true,
"options": [
"-h, --help This help",
"-1, --buffer use data from trace buffer",
"--frame show frame delay times",
"-c mark CRC bytes",
"-r show relative times (gap and duration)",
"-u display times in microseconds instead of clock cycles",
"-x show hexdump to convert to pcap(ng)",
"or to import into Wireshark using encapsulation type \"ISO 14443\"",
"-f, --file <fn> filename of dictionary"
],
"usage": "hf list [-h1crux] [--frame] [-f <fn>]"
},
"hf iclass calcnewkey": {
"command": "hf iclass calcnewkey",
"description": "Calculate new keys for updating (blocks 3 & 4)",
"notes": [
"hf iclass calcnewkey --old 1122334455667788 --new 2233445566778899 --csn deadbeafdeadbeaf --elite2 -> e key to e key given csn",
"hf iclass calcnewkey --old 1122334455667788 --new 2233445566778899 --elite -> std key to e key read csn",
"hf iclass calcnewkey --old 1122334455667788 --new 2233445566778899 -> std to std read csn"
],
"offline": true,
"options": [
"-h, --help This help",
"--old <hex> Specify key as 8 hex bytes",
"--oki <dec> Old key index to select key from memory 'hf iclass managekeys'",
"--new <hex> Specify key as 8 hex bytes",
"--nki <dec> New key index to select key from memory 'hf iclass managekeys'",
"--csn <hex> Specify a Card Serial Number (CSN) to diversify the key (if omitted will attempt to read a CSN)",
"--elite Elite computations applied to new key",
"--elite2 Elite computations applied to both old and new key",
"--oldelite Elite computations applied only to old key"
],
"usage": "hf iclass calcnewkey [-h] [--old <hex>] [--oki <dec>] [--new <hex>] [--nki <dec>] [--csn <hex>] [--elite] [--elite2] [--oldelite]"
},
"hf iclass chk": {
"command": "hf iclass chk",
"description": "Checkkeys loads a dictionary text file with 8byte hex keys to test authenticating against a iClass tag",
"notes": [
"hf iclass chk -f iclass_default_keys.dic",
"hf iclass chk -f iclass_elite_keys.dic --elite",
"hf iclass chk --vb6kdf"
],
"offline": false,
"options": [
"-h, --help This help",
"-f, --file <fn> Dictionary file with default iclass keys",
"--credit key is assumed to be the credit key",
"--elite elite computations applied to key",
"--raw no computations applied to key (raw)",
"--shallow use shallow (ASK) reader modulation instead of OOK",
"--vb6kdf use the VB6 elite KDF instead of a file"
],
"usage": "hf iclass chk [-h] [-f <fn>] [--credit] [--elite] [--raw] [--shallow] [--vb6kdf]"
},
"hf iclass configcard": {
"command": "hf iclass configcard",
"description": "Manage reader configuration card via Cardhelper or internal database, The generated config card will be uploaded to device emulator memory. You can start simulating `hf iclass sim -t 3` or use the emul commands",
"notes": [
"hf iclass configcard -l -> download config card settings from cardhelper",
"hf iclass configcard -p -> print all config cards in the database",
"hf iclass configcard --ci 1 -> view config card setting in slot 1",
"hf iclass configcard -g --ci 0 -> generate config file from slot 0"
],
"offline": false,
"options": [
"-h, --help This help",
"--ci <dec> use config slot at index",
"--ki <dec> Card Key - index to select key from memory 'hf iclass managekeys'",
"--krki <dec> Elite Keyroll Key - index to select key from memory 'hf iclass managekeys'",
"--elite Use elite key for the the Card Key ki",
"-g generate card dump file",
"-l load available cards",
"-p print available cards"
],
"usage": "hf iclass configcard [-hglp] [--ci <dec>] [--ki <dec>] [--krki <dec>] [--elite]"
},
"hf iclass creditepurse": {
"command": "hf iclass creditepurse",
"description": "Credit the epurse on an iCLASS tag. The provided key must be the credit key. The first two bytes of the epurse are the debit value (big endian) and may be any value except FFFF. The remaining two bytes of the epurse are the credit value and must be smaller than the previous value.",
"notes": [
"hf iclass creditepurse -d FEFFFFFF -k 001122334455667B",
"hf iclass creditepurse -d FEFFFFFF --ki 0"
],
"offline": false,
"options": [
"-h, --help This help",
"-k, --key <hex> Credit key as 8 hex bytes",
"--ki <dec> Key index to select key from memory 'hf iclass managekeys'",
"-d, --data <hex> data to write as 8 hex bytes",
"--elite elite computations applied to key",
"--raw no computations applied to key",
"-v, --verbose verbose output",
"--shallow use shallow (ASK) reader modulation instead of OOK"
],
"usage": "hf iclass creditepurse [-hv] [-k <hex>] [--ki <dec>] -d <hex> [--elite] [--raw] [--shallow]"
},
"hf iclass decrypt": {
"command": "hf iclass decrypt",
"description": "3DES decrypt data This is a naive implementation, it tries to decrypt every block after block 6. Correct behaviour would be to decrypt only the application areas where the key is valid, which is defined by the configuration block. OBS! In order to use this function, the file `iclass_decryptionkey.bin` must reside in the resources directory. The file must be 16 bytes binary data or... make sure your cardhelper is placed in the sim module",
"notes": [
"hf iclass decrypt -f hf-iclass-AA162D30F8FF12F1-dump.bin",
"hf iclass decrypt -f hf-iclass-AA162D30F8FF12F1-dump.bin -k 000102030405060708090a0b0c0d0e0f",
"hf iclass decrypt -d 1122334455667788 -k 000102030405060708090a0b0c0d0e0f"
],
"offline": true,
"options": [
"-h, --help This help",
"-f, --file <fn> Specify a filename for dump file",
"-d, --data <hex> 3DES encrypted data",
"-k, --key <hex> 3DES transport key",
"-v, --verbose verbose output",
"--d6 decode as block 6",
"-z, --dense dense dump output style",
"--ns no save to file"
],
"usage": "hf iclass decrypt [-hvz] [-f <fn>] [-d <hex>] [-k <hex>] [--d6] [--ns]"
},
"hf iclass dump": {
"command": "hf iclass dump",
"description": "Dump all memory from a iCLASS tag",
"notes": [
"hf iclass dump -k 001122334455667B",
"hf iclass dump -k AAAAAAAAAAAAAAAA --credit 001122334455667B",
"hf iclass dump -k AAAAAAAAAAAAAAAA --elite",
"hf iclass dump --ki 0",
"hf iclass dump --ki 0 --ci 2"
],
"offline": false,
"options": [
"-h, --help This help",
"-f, --file <fn> save filename",
"-k, --key <hex> debit key or NR/MAC for replay as 8 hex bytes",
"--ki <dec> debit key index to select key from memory 'hf iclass managekeys'",
"--credit <hex> credit key as 8 hex bytes",
"--ci <dec> credit key index to select key from memory 'hf iclass managekeys'",
"--elite elite computations applied to key",
"--raw raw, the key is interpreted as raw block 3/4",
"--nr replay of NR/MAC",
"-z, --dense dense dump output style",
"--force force unsecure card read",
"--shallow use shallow (ASK) reader modulation instead of OOK",
"--ns no save to file"
],
"usage": "hf iclass dump [-hz] [-f <fn>] [-k <hex>] [--ki <dec>] [--credit <hex>] [--ci <dec>] [--elite] [--raw] [--nr] [--force] [--shallow] [--ns]"
},
"hf iclass eload": {
"command": "hf iclass eload",
"description": "Load emulator memory with data from (bin/json) iCLASS dump file",
"notes": [
"hf iclass eload -f hf-iclass-AA162D30F8FF12F1-dump.json",
"hf iclass eload -f hf-iclass-AA162D30F8FF12F1-dump.bin -m"
],
"offline": false,
"options": [
"-h, --help This help",
"-f, --file <fn> Specify a filename for dump file",
"-m, --mem use RDV4 spiffs",
"-v, --verbose verbose output"
],
"usage": "hf iclass eload [-hmv] -f <fn>"
},
"hf iclass encode": {
"command": "hf iclass encode",
"description": "Encode binary wiegand to block 7,8,9 Use either --bin or --wiegand/--fc/--cn",
"notes": [
"hf iclass encode --bin 10001111100000001010100011 --ki 0 -> FC 31 CN 337 (H10301)",
"hf iclass encode -w H10301 --fc 31 --cn 337 --ki 0 -> FC 31 CN 337 (H10301)",
"hf iclass encode --bin 10001111100000001010100011 --ki 0 --elite -> FC 31 CN 337 (H10301), writing w elite key",
"hf iclass encode -w H10301 --fc 31 --cn 337 --emu -> Writes the ecoded data to emulator memory",
"When using emulator you have to first load a credential into emulator memory"
],
"offline": true,
"options": [
"-h, --help This help",
"--bin <bin> Binary string i.e 0001001001",
"--ki <dec> Key index to select key from memory 'hf iclass managekeys'",
"--credit key is assumed to be the credit key",
"--elite elite computations applied to key",
"--raw no computations applied to key",
"--enckey <hex> 3DES transport key, 16 hex bytes",
"--fc <dec> facility code",
"--cn <dec> card number",
"--issue <dec> issue level",
"-w, --wiegand <format> see `wiegand list` for available formats",
"--emu Write to emulation memory instead of card",
"--shallow use shallow (ASK) reader modulation instead of OOK",
"-v verbose (print encoded blocks)"
],
"usage": "hf iclass encode [-hv] [--bin <bin>] [--ki <dec>] [--credit] [--elite] [--raw] [--enckey <hex>] [--fc <dec>] [--cn <dec>] [--issue <dec>] [-w <format>] [--emu] [--shallow]"
},
"hf iclass encrypt": {
"command": "hf iclass encrypt",
"description": "3DES encrypt data OBS! In order to use this function, the file 'iclass_decryptionkey.bin' must reside in the resources directory. The file should be 16 hex bytes of binary data",
"notes": [
"hf iclass encrypt -d 0102030405060708",
"hf iclass encrypt -d 0102030405060708 -k 00112233445566778899AABBCCDDEEFF"
],
"offline": true,
"options": [
"-h, --help This help",
"-d, --data <hex> data to encrypt",
"-k, --key <hex> 3DES transport key",
"-v, --verbose verbose output"
],
"usage": "hf iclass encrypt [-hv] -d <hex> [-k <hex>]"
},
"hf iclass esave": {
"command": "hf iclass esave",
"description": "Save emulator memory to file (bin/json) if filename is not supplied, CSN will be used.",
"notes": [
"hf iclass esave",
"hf iclass esave -f hf-iclass-dump",
"hf iclass esave -s 2048 -f hf-iclass-dump"
],
"offline": false,
"options": [
"-h, --help This help",
"-f, --file <fn> Specify a filename for dump file",
"-s, --size <256|2048> number of bytes to save (default 256)"
],
"usage": "hf iclass esave [-h] [-f <fn>] [-s <256|2048>]"
},
"hf iclass esetblk": {
"command": "hf iclass esetblk",
"description": "Sets an individual block in emulator memory.",
"notes": [
"hf iclass esetblk --blk 7 -d 0000000000000000"
],
"offline": false,
"options": [
"-h, --help This help",
"--blk <dec> block number",
"-d, --data <hex> bytes to write, 8 hex bytes"
],
"usage": "hf iclass esetblk [-h] --blk <dec> [-d <hex>]"
},
"hf iclass eview": {
"command": "hf iclass eview",
"description": "Display emulator memory. Number of bytes to download defaults to 256. Other value is 2048.",
"notes": [
"hf iclass eview",
"hf iclass eview -s 2048",
"hf iclass eview -s 2048 -v"
],
"offline": false,
"options": [
"-h, --help This help",
"-s, --size <256|2048> number of bytes to save (default 256)",
"-v, --verbose verbose output",
"-z, --dense dense dump output style"
],
"usage": "hf iclass eview [-hvz] [-s <256|2048>]"
},
"hf iclass help": {
"command": "hf iclass help",
"description": "help This help list List iclass history view Display content from tag dump file ----------- --------------------- Recovery -------------------- loclass Use loclass to perform bruteforce reader attack lookup Uses authentication trace to check for key in dictionary file legbrute Bruteforces 40 bits of a partial diversified key, provided 24 bits of the key and two valid nr-macs unhash Reverses a diversified key to retrieve hash0 pre-images after DES encryption ----------- ---------------------- Utils ---------------------- calcnewkey Calc diversified keys (blocks 3 & 4) to write new keys encode Encode binary wiegand to block 7 encrypt Encrypt given block data decrypt Decrypt given block data or tag dump file managekeys Manage keys to use with iclass commands permutekey Permute function from 'heart of darkness' paper --------------------------------------------------------------------------------------- hf iclass list available offline: yes Alias of `trace list -t iclass -c` with selected protocol data to annotate trace buffer You can load a trace from file (see `trace load -h`) or it be downloaded from device by default It accepts all other arguments of `trace list`. Note that some might not be relevant for this specific protocol",
"notes": [
"hf iclass list --frame -> show frame delay times",
"hf iclass list -1 -> use trace buffer"
],
"offline": true,
"options": [
"-h, --help This help",
"-1, --buffer use data from trace buffer",
"--frame show frame delay times",
"-c mark CRC bytes",
"-r show relative times (gap and duration)",
"-u display times in microseconds instead of clock cycles",
"-x show hexdump to convert to pcap(ng)",
"or to import into Wireshark using encapsulation type \"ISO 14443\"",
"-f, --file <fn> filename of dictionary"
],
"usage": "hf iclass list [-h1crux] [--frame] [-f <fn>]"
},
"hf iclass info": {
"command": "hf iclass info",
"description": "Act as a iCLASS reader. Reads / fingerprints a iCLASS tag.",
"notes": [
"hf iclass info"
],
"offline": false,
"options": [
"-h, --help This help",
"--shallow use shallow (ASK) reader modulation instead of OOK"
],
"usage": "hf iclass info [-h] [--shallow]"
},
"hf iclass legbrute": {
"command": "hf iclass legbrute",
"description": "This command take sniffed trace data and partial raw key and bruteforces the remaining 40 bits of the raw key.",
"notes": [
"hf iclass legbrute --epurse feffffffffffffff --macs1 1306cad9b6c24466 --macs2 f0bf905e35f97923 --pk B4F12AADC5301225"
],
"offline": true,
"options": [
"-h, --help This help",
"--epurse <hex> Specify ePurse as 8 hex bytes",
"--macs1 <hex> MACs captured from the reader",
"--macs2 <hex> MACs captured from the reader, different than the first set (with the same csn and epurse value)",
"--pk <hex> Partial Key from legrec or starting key of keyblock from legbrute",
"--index <dec> Where to start from to retrieve the key, default 0 - value in millions e.g. 1 is 1 million"
],
"usage": "hf iclass legbrute [-h] --epurse <hex> --macs1 <hex> --macs2 <hex> --pk <hex> [--index <dec>]"
},
"hf iclass legrec": {
"command": "hf iclass legrec",
"description": "Attempts to recover the diversified key of a specific iClass card. This may take a long time. The Card must remain be on the PM3 antenna during the whole process! This process may brick the card!",
"notes": [
"hf iclass legrec --macs 0000000089cb984b",
"hf iclass legrec --macs 0000000089cb984b --index 0 --loop 100 --notest"
],
"offline": false,
"options": [
"-h, --help This help",
"--macs <hex> AA1 Authentication MACs",
"--index <dec> Where to start from to retrieve the key, default 0",
"--loop <dec> The number of key retrieval cycles to perform, max 10000, default 100",
"--debug Re-enables tracing for debugging. Limits cycles to 1.",
"--notest Perform real writes on the card!",
"--allnight Loops the loop for 10 times, recommended loop value of 5000."
],
"usage": "hf iclass legrec [-h] --macs <hex> [--index <dec>] [--loop <dec>] [--debug] [--notest] [--allnight]"
},
"hf iclass loclass": {
"command": "hf iclass loclass",
"description": "Execute the offline part of loclass attack An iclass dumpfile is assumed to consist of an arbitrary number of malicious CSNs, and their protocol responses The binary format of the file is expected to be as follows: <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC> <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC> <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC> ... totalling N*24 bytes",
"notes": [
"hf iclass loclass -f iclass_dump.bin",
"hf iclass loclass --test"
],
"offline": true,
"options": [
"-h, --help This help",
"-f, --file <fn> filename with nr/mac data from `hf iclass sim -t 2`",
"--test Perform self test",
"--long Perform self test, including long ones"
],
"usage": "hf iclass loclass [-h] [-f <fn>] [--test] [--long]"
},
"hf iclass lookup": {
"command": "hf iclass lookup",
"description": "This command take sniffed trace data and try to recovery a iCLASS Standard or iCLASS Elite key.",
"notes": [
"hf iclass lookup --csn 9655a400f8ff12e0 --epurse f0ffffffffffffff --macs 0000000089cb984b -f iclass_default_keys.dic",
"hf iclass lookup --csn 9655a400f8ff12e0 --epurse f0ffffffffffffff --macs 0000000089cb984b -f iclass_default_keys.dic --elite",
"hf iclass lookup --csn 9655a400f8ff12e0 --epurse f0ffffffffffffff --macs 0000000089cb984b --vb6rng"
],
"offline": true,
"options": [
"-h, --help This help",
"-f, --file <fn> Dictionary file with default iclass keys",
"--csn <hex> Specify CSN as 8 hex bytes",
"--epurse <hex> Specify ePurse as 8 hex bytes",
"--macs <hex> MACs",
"--elite Elite computations applied to key",
"--raw no computations applied to key",
"--vb6rng use the VB6 rng for elite keys instead of a dictionary file"
],
"usage": "hf iclass lookup [-h] [-f <fn>] --csn <hex> --epurse <hex> --macs <hex> [--elite] [--raw] [--vb6rng]"
},
"hf iclass managekeys": {
"command": "hf iclass managekeys",
"description": "Manage iCLASS Keys in client memory",
"notes": [
"hf iclass managekeys --ki 0 -k 1122334455667788 -> set key 1122334455667788 at index 0",
"hf iclass managekeys -f mykeys.bin --save -> save key file",
"hf iclass managekeys -f mykeys.bin --load -> load key file",
"hf iclass managekeys -p -> print keys"
],
"offline": true,
"options": [
"-h, --help This help",
"-f, --file <fn> Specify a filename for load / save operations",
"-k, --key <hex> Access key as 8 hex bytes",
"--ki <dec> Specify key index to set key in memory",
"--save Save keys in memory to file specified by filename",
"--load Load keys to memory from file specified by filename",
"-p, --print Print keys loaded into memory"
],
"usage": "hf iclass managekeys [-hp] [-f <fn>] [-k <hex>] [--ki <dec>] [--save] [--load]"
},
"hf iclass permutekey": {
"command": "hf iclass permutekey",
"description": "Permute function from 'heart of darkness' paper.",
"notes": [
"hf iclass permutekey --reverse --key 0123456789abcdef",
"hf iclass permutekey --key ff55330f0055330f"
],
"offline": true,
"options": [
"-h, --help This help",
"-r, --reverse reverse permuted key",
"--key <hex> input key, 8 hex bytes"
],
"usage": "hf iclass permutekey [-hr] --key <hex>"
},
"hf iclass rdbl": {
"command": "hf iclass rdbl",
"description": "Read a iCLASS block from tag",
"notes": [
"hf iclass rdbl --blk 6 -k 0011223344556677",
"hf iclass rdbl --blk 27 -k 0011223344556677 --credit",
"hf iclass rdbl --blk 10 --ki 0"
],
"offline": false,
"options": [
"-h, --help This help",
"-k, --key <hex> Access key as 8 hex bytes",
"--ki <dec> Key index to select key from memory 'hf iclass managekeys'",
"--blk <dec> Block number",
"--credit key is assumed to be the credit key",
"--elite elite computations applied to key",
"--raw no computations applied to key",
"--nr replay of NR/MAC",
"-v, --verbose verbose output",
"--shallow use shallow (ASK) reader modulation instead of OOK"
],
"usage": "hf iclass rdbl [-hv] [-k <hex>] [--ki <dec>] --blk <dec> [--credit] [--elite] [--raw] [--nr] [--shallow]"
},
"hf iclass reader": {
"command": "hf iclass reader",
"description": "Act as a iCLASS reader. Look for iCLASS tags until Enter or the pm3 button is pressed",
"notes": [
"hf iclass reader -@ -> continuous reader mode"
],
"offline": false,
"options": [
"-h, --help This help",
"-@ optional - continuous reader mode",
"--shallow use shallow (ASK) reader modulation instead of OOK"
],
"usage": "hf iclass reader [-h@] [--shallow]"
},
"hf iclass restore": {
"command": "hf iclass restore",
"description": "Restore data from dumpfile (bin/eml/json) onto a iCLASS tag",
"notes": [
"hf iclass restore -f hf-iclass-AA162D30F8FF12F1-dump.bin --first 6 --last 18 --ki 0",
"hf iclass restore -f hf-iclass-AA162D30F8FF12F1-dump.bin --first 6 --last 18 --ki 0 --elite",
"hf iclass restore -f hf-iclass-AA162D30F8FF12F1-dump.bin --first 6 --last 18 -k 1122334455667788 --elite"
],
"offline": false,
"options": [
"-h, --help This help",
"-f, --file <fn> specify a filename to restore",
"-k, --key <hex> Access key as 8 hex bytes",
"--ki <dec> Key index to select key from memory 'hf iclass managekeys'",
"--first <dec> The first block number to restore",
"--last <dec> The last block number to restore",
"--credit key is assumed to be the credit key",
"--elite elite computations applied to key",
"--raw no computations applied to key",
"-v, --verbose verbose output",
"--shallow use shallow (ASK) reader modulation instead of OOK"
],
"usage": "hf iclass restore [-hv] -f <fn> [-k <hex>] [--ki <dec>] --first <dec> --last <dec> [--credit] [--elite] [--raw] [--shallow]"
},
"hf iclass sam": {
"command": "hf iclass sam",
"description": "Extract PACS via a HID SAM",
"notes": [
"hf iclass sam"
],
"offline": false,
"options": [
"-h, --help This help",
"-v, --verbose verbose output"
],
"usage": "hf iclass sam [-hv]"
},
"hf iclass sim": {
"command": "hf iclass sim",
"description": "Simulate a iCLASS legacy/standard tag",
"notes": [
"hf iclass sim -t 0 --csn 031FEC8AF7FF12E0 -> simulate with specified CSN",
"hf iclass sim -t 1 -> simulate with default CSN",
"hf iclass sim -t 2 -> execute loclass attack online part",
"hf iclass sim -t 3 -> simulate full iCLASS 2k tag",
"hf iclass sim -t 4 -> Reader-attack, adapted for KeyRoll mode, gather reader responses to extract elite key"
],
"offline": false,
"options": [
"-h, --help This help",
"-t, --type <0-4> Simulation type to use",
"--csn <hex> Specify CSN as 8 hex bytes to use with sim type 0"
],
"usage": "hf iclass sim [-h] -t <0-4> [--csn <hex>]"
},
"hf iclass sniff": {
"command": "hf iclass sniff",
"description": "Sniff the communication between reader and tag",
"notes": [
"hf iclass sniff",
"hf iclass sniff -j -> jam e-purse updates"
],
"offline": false,
"options": [
"-h, --help This help",
"-j, --jam Jam (prevent) e-purse updates"
],
"usage": "hf iclass sniff [-hj]"
},
"hf iclass unhash": {
"command": "hf iclass unhash",
"description": "Reverses the hash0 function used generate iclass diversified keys after DES encryption, Function returns the DES crypted CSN. Next step bruteforcing.",
"notes": [
"hf iclass unhash -k B4F12AADC5301A2D"
],
"offline": true,
"options": [
"-h, --help This help",
"-k, --divkey <hex> Card diversified key"
],
"usage": "hf iclass unhash [-h] -k <hex>"
},
"hf iclass view": {
"command": "hf iclass view",
"description": "Print a iCLASS tag dump file (bin/eml/json)",
"notes": [
"hf iclass view -f hf-iclass-AA162D30F8FF12F1-dump.bin",
"hf iclass view --first 1 -f hf-iclass-AA162D30F8FF12F1-dump.bin",
"",
"If --first is not specified it will default to the first user block",
"which is block 6 for secured chips or block 3 for non-secured chips"
],
"offline": true,
"options": [
"-h, --help This help",
"-f, --file <fn> Specify a filename for dump file",
"--first <dec> Begin printing from this block (default first user block)",
"--last <dec> End printing at this block (default 0, ALL)",
"-v, --verbose verbose output",
"-z, --dense dense dump output style"
],
"usage": "hf iclass view [-hvz] -f <fn> [--first <dec>] [--last <dec>]"
},
"hf iclass wrbl": {
"command": "hf iclass wrbl",
"description": "Write data to an iCLASS tag",
"notes": [
"hf iclass wrbl --blk 10 -d AAAAAAAAAAAAAAAA -k 001122334455667B",
"hf iclass wrbl --blk 10 -d AAAAAAAAAAAAAAAA -k 001122334455667B --credit",
"hf iclass wrbl --blk 10 -d AAAAAAAAAAAAAAAA --ki 0"
],
"offline": false,
"options": [
"-h, --help This help",
"-k, --key <hex> Access key as 8 hex bytes",
"--ki <dec> Key index to select key from memory 'hf iclass managekeys'",
"--blk <dec> block number",
"-d, --data <hex> data to write as 8 hex bytes",
"-m, --mac <hex> replay mac data (4 hex bytes)",
"--credit key is assumed to be the credit key",
"--elite elite computations applied to key",
"--raw no computations applied to key",
"--nr replay of NR/MAC",
"-v, --verbose verbose output",
"--shallow use shallow (ASK) reader modulation instead of OOK"
],
"usage": "hf iclass wrbl [-hv] [-k <hex>] [--ki <dec>] --blk <dec> -d <hex> [-m <hex>] [--credit] [--elite] [--raw] [--nr] [--shallow]"
},
"hf ict help": {
"command": "hf ict help",
"description": "help This help list List ICT history reader Act like an IS14443-a reader --------------------------------------------------------------------------------------- hf ict credential available offline: no Read ICT sector from tag and decode",
"notes": [
"hf ict credential"
],
"offline": true,
"options": [
"-h, --help This help",
"-v, --verbose verbose output"
],
"usage": "hf ict credential [-hv]"
},
"hf ict info": {
"command": "hf ict info",
"description": "Get info from ICT encoded credential tags (MIFARE Classic / DESfire)",
"notes": [
"hf ict info"
],
"offline": false,
"options": [
"-h, --help This help"
],
"usage": "hf ict info [-h]"
},
"hf ict list": {
"command": "hf ict list",
"description": "Alias of `trace list -t 14a -c` with selected protocol data to annotate trace buffer You can load a trace from file (see `trace load -h`) or it be downloaded from device by default It accepts all other arguments of `trace list`. Note that some might not be relevant for this specific protocol",
"notes": [
"hf ict list --frame -> show frame delay times",
"hf ict list -1 -> use trace buffer"
],
"offline": true,
"options": [
"-h, --help This help",
"-1, --buffer use data from trace buffer",
"--frame show frame delay times",
"-c mark CRC bytes",
"-r show relative times (gap and duration)",
"-u display times in microseconds instead of clock cycles",
"-x show hexdump to convert to pcap(ng)",
"or to import into Wireshark using encapsulation type \"ISO 14443\"",
"-f, --file <fn> filename of dictionary"
],
"usage": "hf ict list [-h1crux] [--frame] [-f <fn>]"
},
"hf ict reader": {
"command": "hf ict reader",
"description": "Act as a reader",
"notes": [
"hf ict reader"
],
"offline": true,
"options": [
"-h, --help This help"
],
"usage": "hf ict reader [-h]"
},
"hf jooki decode": {
"command": "hf jooki decode",
"description": "Decode a base64-encode Jooki token in NDEF URI format",
"notes": [
"hf jooki decode -d 7WzlgEzqLgwTnWNy"
],
"offline": true,
"options": [
"-h, --help This help",
"-d, --data <base64> base64 url parameter",
"-v, --verbose verbose output"
],
"usage": "hf jooki decode [-hv] -d <base64>"
},
"hf jooki encode": {
"command": "hf jooki encode",
"description": "Encode a Jooki token to base64 NDEF URI format",
"notes": [
"hf jooki encode --test -> self tests",
"hf jooki encode -r --dragon -> read uid from tag and use for encoding",
"hf jooki encode --uid 04010203040506 --dragon",
"hf jooki encode --uid 04010203040506 --tid 1 --fid 1"
],
"offline": true,
"options": [
"-h, --help This help",
"-u, --uid <hex> uid bytes",
"-r read uid from tag instead",
"--test self test",
"-v, --verbose verbose output",
"--dragon figurine type",
"--fox figurine type",
"--ghost figurine type",
"--knight figurine type",
"--whale figurine type",
"--blackdragon figurine type",
"--blackfox figurine type",
"--blackknight figurine type",
"--blackwhale figurine type",
"--whitedragon figurine type",
"--whitefox figurine type",
"--whiteknight figurine type",
"--whitewhale figurine type",
"--tid <dec> figurine type id",
"--fid <dec> figurine id"
],
"usage": "hf jooki encode [-hrv] [-u <hex>] [--test] [--dragon] [--fox] [--ghost] [--knight] [--whale] [--blackdragon] [--blackfox] [--blackknight] [--blackwhale] [--whitedragon] [--whitefox] [--whiteknight] [--whitewhale] [--tid <dec>] [--fid <dec>]"
},
"hf jooki help": {
"command": "hf jooki help",
"description": "help This help decode Decode Jooki token encode Encode Jooki token --------------------------------------------------------------------------------------- hf jooki clone available offline: no Write a Jooki token to a Ultralight or NTAG tag",
"notes": [
"hf jooki clone -d <hex bytes> -> where hex is raw NDEF",
"hf jooki clone --b64 7WzlgEzqLgwTnWNy -> using base64 url parameter"
],
"offline": true,
"options": [
"-h, --help This help",
"-b, --b64 <base64> base64 url parameter",
"-d, --data <hex> raw NDEF bytes",
"-p, --pwd <hex> password for authentication (EV1/NTAG 4 bytes)"
],
"usage": "hf jooki clone [-h] [-b <base64>] [-d <hex>] [-p <hex>]"
},
"hf jooki sim": {
"command": "hf jooki sim",
"description": "Simulate a Jooki token. Either `hf mfu eload` before or use `-d` param",
"notes": [
"hf jooki sim -> use token in emulator memory",
"hf jooki sim -b 7WzlgEzqLgwTnWNy -> using base64 url parameter"
],
"offline": false,
"options": [
"-h, --help This help",
"-b, --b64 <base64> base64 url parameter"
],
"usage": "hf jooki sim [-h] [-b <base64>]"
},
"hf ksx6924 balance": {
"command": "hf ksx6924 balance",
"description": "Gets the current purse balance",
"notes": [
"hf ksx6924 balance"
],
"offline": false,
"options": [
"-h, --help This help",
"-k, --keep keep field ON for next command",
"-a, --apdu Show APDU requests and responses"
],
"usage": "hf ksx6924 balance [-hka]"
},
"hf ksx6924 help": {
"command": "hf ksx6924 help",
"description": "help This help --------------------------------------------------------------------------------------- hf ksx6924 select available offline: no Selects KS X 6924 application, and leaves field up",
"notes": [
"hf ksx6924 select"
],
"offline": true,
"options": [
"-h, --help This help",
"-a, --apdu Show APDU requests and responses"
],
"usage": "hf ksx6924 select [-ha]"
},
"hf ksx6924 info": {
"command": "hf ksx6924 info",
"description": "Get info about a KS X 6924 transit card. This application is used by T-Money (South Korea) and Snapper+ (Wellington, New Zealand).",
"notes": [
"hf ksx6924 info"
],
"offline": false,
"options": [
"-h, --help This help",
"-k, --keep keep field ON for next command",
"-a, --apdu Show APDU requests and responses"
],
"usage": "hf ksx6924 info [-hka]"
},
"hf ksx6924 init": {
"command": "hf ksx6924 init",
"description": "Perform transaction initialization with Mpda (Money of Purchase Transaction)",
"notes": [
"hf ksx6924 init 000003e8 -> Mpda"
],
"offline": false,
"options": [
"-h, --help This help",
"-k, --keep keep field ON for next command",
"-a, --apdu Show APDU requests and responses"
],
"usage": "hf ksx6924 init [-hka] <Mpda 4 bytes hex>"
},
"hf ksx6924 prec": {
"command": "hf ksx6924 prec",
"description": "Executes proprietary read record command. Data format is unknown. Other records are available with 'emv getrec'.",
"notes": [
"hf ksx6924 prec 0b -> read proprietary record 0x0b"
],
"offline": false,
"options": [
"-h, --help This help",
"-k, --keep keep field ON for next command",
"-a, --apdu Show APDU requests and responses"
],
"usage": "hf ksx6924 prec [-hka] <record 1byte HEX>"
},
"hf legic crc": {
"command": "hf legic crc",
"description": "Calculates the legic crc8/crc16 on the given data",
"notes": [
"hf legic crc -d deadbeef1122",
"hf legic crc -d deadbeef1122 --mcc 9A -t 16 -> CRC Type 16"
],
"offline": true,
"options": [
"-h, --help This help",
"-d, --data <hex> bytes to calculate crc over",
"--mcc <hex> MCC hex byte (UID CRC)",
"-t, --type <dec> CRC Type (default: 8)"
],
"usage": "hf legic crc [-h] -d <hex> [--mcc <hex>] [-t <dec>]"
},
"hf legic einfo": {
"command": "hf legic einfo",
"description": "It decodes and displays emulator memory",
"notes": [
"hf legic einfo",
"hf legic eview --22"
],
"offline": false,
"options": [
"-h, --help This help",
"--22 LEGIC Prime MIM22",
"--256 LEGIC Prime MIM256 (def)",
"--1024 LEGIC Prime MIM1024"
],
"usage": "hf legic einfo [-h] [--22] [--256] [--1024]"
},
"hf legic eload": {
"command": "hf legic eload",
"description": "Loads a LEGIC Prime dump file into emulator memory",
"notes": [
"hf legic eload -f myfile",
"hf legic eload -f myfile --obfuscate"
],
"offline": false,
"options": [
"-h, --help This help",
"-f, --file <fn> Filename to load",
"--obfuscate Obfuscate dump data (xor with MCC)"
],
"usage": "hf legic eload [-h] -f <fn> [--obfuscate]"
},
"hf legic esave": {
"command": "hf legic esave",
"description": "Saves a (bin/json) dump file of emulator memory",
"notes": [
"hf legic esave -> uses UID as filename",
"hf legic esave -f myfile --22",
"hf legic esave -f myfile --22 --de"
],
"offline": false,
"options": [
"-h, --help This help",
"-f, --file <fn> Filename to save",
"--22 LEGIC Prime MIM22",
"--256 LEGIC Prime MIM256 (def)",
"--1024 LEGIC Prime MIM1024",
"--de De-obfuscate dump data (xor with MCC)"
],
"usage": "hf legic esave [-h] [-f <fn>] [--22] [--256] [--1024] [--de]"
},
"hf legic eview": {
"command": "hf legic eview",
"description": "It displays emulator memory",
"notes": [
"hf legic eview",
"hf legic eview --22"
],
"offline": false,
"options": [
"-h, --help This help",
"--22 LEGIC Prime MIM22",
"--256 LEGIC Prime MIM256 (def)",
"--1024 LEGIC Prime MIM1024",
"-v, --verbose verbose output"
],
"usage": "hf legic eview [-hv] [--22] [--256] [--1024]"
},
"hf legic help": {
"command": "hf legic help",
"description": "----------- --------------------- operations --------------------- help This help list List LEGIC history ----------- --------------------- simulation --------------------- ----------- --------------------- utils --------------------- crc Calculate Legic CRC over given bytes view Display deobfuscated and decoded content from tag dump file --------------------------------------------------------------------------------------- hf legic dump available offline: no Read all memory from LEGIC Prime tags and saves to (bin/json) dump file It autodetects card type (MIM22, MIM256, MIM1024)",
"notes": [
"hf legic dump -> use UID as filename",
"hf legic dump -f myfile",
"hf legic dump --de -> use UID as filename and deobfuscate data"
],
"offline": true,
"options": [
"-h, --help This help",
"-f, --file <fn> Dump filename",
"--de deobfuscate dump data (xor with MCC)"
],
"usage": "hf legic dump [-h] [-f <fn>] [--de]"
},
"hf legic info": {
"command": "hf legic info",
"description": "Gets information from a LEGIC Prime tag like systemarea, user areas, etc",
"notes": [
"hf legic info"
],
"offline": false,
"options": [
"-h, --help This help",
"-v, --verbose verbose output"
],
"usage": "hf legic info [-hv]"
},
"hf legic list": {
"command": "hf legic list",
"description": "Alias of `trace list -t legic` with selected protocol data to annotate trace buffer You can load a trace from file (see `trace load -h`) or it be downloaded from device by default It accepts all other arguments of `trace list`. Note that some might not be relevant for this specific protocol",
"notes": [
"hf legic list --frame -> show frame delay times",
"hf legic list -1 -> use trace buffer"
],
"offline": true,
"options": [
"-h, --help This help",
"-1, --buffer use data from trace buffer",
"--frame show frame delay times",
"-c mark CRC bytes",
"-r show relative times (gap and duration)",
"-u display times in microseconds instead of clock cycles",
"-x show hexdump to convert to pcap(ng)",
"or to import into Wireshark using encapsulation type \"ISO 14443\"",
"-f, --file <fn> filename of dictionary"
],
"usage": "hf legic list [-h1crux] [--frame] [-f <fn>]"
},
"hf legic rdbl": {
"command": "hf legic rdbl",
"description": "Read data from a LEGIC Prime tag",
"notes": [
"hf legic rdbl -o 0 -l 16 -> read 16 bytes from offset 0 (system header)",
"hf legic rdbl -o 0 -l 4 --iv 55 -> read 4 bytes from offset 0",
"hf legic rdbl -o 0 -l 256 --iv 55 -> read 256 bytes from offset 0"
],
"offline": false,
"options": [
"-h, --help This help",
"-o, --offset <dec> offset in data array to start download from",
"-l, --length <dec> number of bytes to read",
"--iv <hex> Initialization vector to use. Must be odd and 7bits max"
],
"usage": "hf legic rdbl [-h] [-o <dec>] [-l <dec>] [--iv <hex>]"
},
"hf legic reader": {
"command": "hf legic reader",
"description": "Read UID and type information from a LEGIC Prime tag",
"notes": [
"hf legic reader"
],
"offline": false,
"options": [
"-h, --help This help",
"-@ optional - continuous reader mode"
],
"usage": "hf legic reader [-h@]"
},
"hf legic restore": {
"command": "hf legic restore",
"description": "Reads (bin/eml/json) file and it autodetects card type and verifies that the file has the same size Then write the data back to card. All bytes except the first 7bytes [UID(4) MCC(1) DCF(2)]",
"notes": [
"hf legic restore -f myfile -> use user specified filename",
"hf legic restore -f myfile --ob -> use UID as filename and obfuscate data"
],
"offline": false,
"options": [
"-h, --help This help",
"-f, --file <fn> Specify a filename to restore",
"--ob obfuscate dump data (xor with MCC)"
],
"usage": "hf legic restore [-h] -f <fn> [--ob]"
},
"hf legic sim": {
"command": "hf legic sim",
"description": "Simulates a LEGIC Prime tag. Following types supported (MIM22, MIM256, MIM1024)",
"notes": [
"hf legic sim --22"
],
"offline": false,
"options": [
"-h, --help This help",
"--22 LEGIC Prime MIM22",
"--256 LEGIC Prime MIM256 (def)",
"--1024 LEGIC Prime MIM1024"
],
"usage": "hf legic sim [-h] [--22] [--256] [--1024]"
},
"hf legic view": {
"command": "hf legic view",
"description": "Print a LEGIC Prime dump file (bin/eml/json)",
"notes": [
"hf legic view -f hf-legic-01020304-dump.bin"
],
"offline": true,
"options": [
"-h, --help This help",
"-f, --file <fn> Specify a filename for dump file",
"-v, --verbose verbose output"
],
"usage": "hf legic view [-hv] -f <fn>"
},
"hf legic wipe": {
"command": "hf legic wipe",
"description": "Fills a LEGIC Prime tags memory with zeros. From byte7 and to the end It autodetects card type",
"notes": [
"hf legic wipe"
],
"offline": false,
"options": [
"-h, --help This help"
],
"usage": "hf legic wipe [-h]"
},
"hf legic wrbl": {
"command": "hf legic wrbl",
"description": "Write data to a LEGIC Prime tag. It autodetects tagsize to ensure proper write",
"notes": [
"hf legic wrbl -o 0 -d 11223344 -> Write 0x11223344 starting from offset 0)",
"hf legic wrbl -o 10 -d DEADBEEF -> Write 0xdeadbeef starting from offset 10"
],
"offline": false,
"options": [
"-h, --help This help",
"-o, --offset <dec> offset in data array to start writing",
"-d, --data <hex> data to write",
"--danger Auto-confirm dangerous operations"
],
"usage": "hf legic wrbl [-h] -o <dec> -d <hex> [--danger]"
},
"hf lto help": {
"command": "hf lto help",
"description": "help This help list List LTO-CM history --------------------------------------------------------------------------------------- hf lto dump available offline: no Dump data from LTO tag",
"notes": [
"hf lto dump -f myfile"
],
"offline": true,
"options": [
"-h, --help This help",
"-f, --file <fn> specify a filename for dumpfile"
],
"usage": "hf lto dump [-h] [-f <fn>]"
},
"hf lto info": {
"command": "hf lto info",
"description": "Get info from LTO tags",
"notes": [
"hf lto info"
],
"offline": false,
"options": [
"-h, --help This help"
],
"usage": "hf lto info [-h]"
},
"hf lto list": {
"command": "hf lto list",
"description": "Alias of `trace list -t lto -c` with selected protocol data to annotate trace buffer You can load a trace from file (see `trace load -h`) or it be downloaded from device by default It accepts all other arguments of `trace list`. Note that some might not be relevant for this specific protocol",
"notes": [
"hf lto list --frame -> show frame delay times",
"hf lto list -1 -> use trace buffer"
],
"offline": true,
"options": [
"-h, --help This help",
"-1, --buffer use data from trace buffer",
"--frame show frame delay times",
"-c mark CRC bytes",
"-r show relative times (gap and duration)",
"-u display times in microseconds instead of clock cycles",
"-x show hexdump to convert to pcap(ng)",
"or to import into Wireshark using encapsulation type \"ISO 14443\"",
"-f, --file <fn> filename of dictionary"
],
"usage": "hf lto list [-h1crux] [--frame] [-f <fn>]"
},
"hf lto rdbl": {
"command": "hf lto rdbl",
"description": "Reead blocks from LTO tag",
"notes": [
"hf lto rdbl --first 0 --last 254"
],
"offline": false,
"options": [
"-h, --help This help",
"--first <dec> The first block number to read as an integer",
"--last <dec> The last block number to read as an integer"
],
"usage": "hf lto rdbl [-h] [--first <dec>] [--last <dec>]"
},
"hf lto reader": {
"command": "hf lto reader",
"description": "Act as a LTO-CM reader. Look for LTO-CM tags until Enter or the pm3 button is pressed",
"notes": [
"hf lto reader -@ -> continuous reader mode"
],
"offline": false,
"options": [
"-h, --help This help",
"-@ optional - continuous reader mode"
],
"usage": "hf lto reader [-h@]"
},
"hf lto restore": {
"command": "hf lto restore",
"description": "Restore data from dumpfile to LTO tag",
"notes": [
"hf lto restore -f hf-lto-92C7842CFF.bin|.eml"
],
"offline": false,
"options": [
"-h, --help This help",
"-f, --file <fn> specify a filename for dumpfile"
],
"usage": "hf lto restore [-h] -f <fn>"
},
"hf lto wrbl": {
"command": "hf lto wrbl",
"description": "Write data to block on LTO tag",
"notes": [
"hf lto wrbl --blk 128 -d 0001020304050607080910111213141516171819202122232425262728293031"
],
"offline": false,
"options": [
"-h, --help This help",
"-d, --data <hex> 32 bytes of data to write (64 hex symbols, no spaces)",
"--blk <dec> The block number to write to as an integer"
],
"usage": "hf lto wrbl [-h] -d <hex> --blk <dec>"
},
"hf mf acl": {
"command": "hf mf acl",
"description": "Print decoded MIFARE access rights (ACL), A = key A B = key B AB = both key A and B ACCESS = access bytes inside sector trailer block Increment, decrement, transfer, restore is for value blocks",
"notes": [
"hf mf acl",
"hf mf acl -d FF0780"
],
"offline": true,
"options": [
"-h, --help This help",
"-d, --data <hex> ACL bytes specified as 3 hex bytes"
],
"usage": "hf mf acl [-h] -d <hex>"
},
"hf mf auth4": {
"command": "hf mf auth4",
"description": "Executes AES authentication command in ISO14443-4",
"notes": [
"hf mf auth4 -n 4000 -k 000102030405060708090a0b0c0d0e0f -> executes authentication",
"hf mf auth4 -n 9003 -k FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF -> executes authentication"
],
"offline": false,
"options": [
"-h, --help This help",
"-n <hex> key num, 2 hex bytes",
"-k, --key <hex> key, 16 hex bytes"
],
"usage": "hf mf auth4 [-h] -n <hex> -k <hex>"
},
"hf mf autopwn": {
"command": "hf mf autopwn",
"description": "This command automates the key recovery process on MIFARE Classic cards. It uses the fchk, chk, darkside, nested, hardnested and staticnested to recover keys. If all keys are found, it try dumping card content both to file and emulator memory.",
"notes": [
"hf mf autopwn",
"hf mf autopwn -s 0 -a -k FFFFFFFFFFFF -> target MFC 1K card, Sector 0 with known key A 'FFFFFFFFFFFF'",
"hf mf autopwn --1k -f mfc_default_keys -> target MFC 1K card, default dictionary",
"hf mf autopwn --1k -s 0 -a -k FFFFFFFFFFFF -f mfc_default_keys -> combo of the two above samples",
"hf mf autopwn --1k -s 0 -a -k FFFFFFFFFFFF -k a0a1a2a3a4a5 -> multiple user supplied keys"
],
"offline": false,
"options": [
"-h, --help This help",
"-k, --key <hex> Known key, 12 hex bytes",
"-s, --sector <dec> Input sector number",
"-a Input key A (def)",
"-b Input key B",
"-f, --file <fn> filename of dictionary",
"--slow Slower acquisition (required by some non standard cards)",
"-l, --legacy legacy mode (use the slow `hf mf chk`)",
"-v, --verbose verbose output",
"--ns No save to file",
"--mini MIFARE Classic Mini / S20",
"--1k MIFARE Classic 1k / S50 (default)",
"--2k MIFARE Classic/Plus 2k",
"--4k MIFARE Classic 4k / S70",
"--in None (use CPU regular instruction set)",
"--im MMX",
"--is SSE2",
"--ia AVX",
"--i2 AVX2",
"--i5 AVX512"
],
"usage": "hf mf autopwn [-hablv] [-k <hex>]... [-s <dec>] [-f <fn>] [--slow] [--ns] [--mini] [--1k] [--2k] [--4k] [--in] [--im] [--is] [--ia] [--i2] [--i5]"
},
"hf mf brute": {
"command": "hf mf brute",
"description": "This is a smart bruteforce, exploiting common patterns, bugs and bad designs in key generators.",
"notes": [
"hf mf brute --mini -> Key recovery against MIFARE Mini",
"hf mf brute --1k -> Key recovery against MIFARE Classic 1k",
"hf mf brute --2k -> Key recovery against MIFARE 2k",
"hf mf brute --4k -> Key recovery against MIFARE 4k",
"hf mf brute --1k --emu -> Target 1K, write keys to emulator memory",
"hf mf brute --1k --dump -> Target 1K, write keys to file"
],
"offline": false,
"options": [
"-h, --help This help",
"--mini MIFARE Classic Mini / S20",
"--1k MIFARE Classic 1k / S50 (default)",
"--2k MIFARE Classic/Plus 2k",
"--4k MIFARE Classic 4k / S70",
"--emu Fill simulator keys from found keys",
"--dump Dump found keys to binary file"
],
"usage": "hf mf brute [-h] [--mini] [--1k] [--2k] [--4k] [--emu] [--dump]"
},
"hf mf cgetblk": {
"command": "hf mf cgetblk",
"description": "Get block data from magic Chinese card. Only works with magic gen1a cards",
"notes": [
"hf mf cgetblk --blk 0 -> get block 0 (manufacturer)",
"hf mf cgetblk --blk 3 -v -> get block 3, decode sector trailer"
],
"offline": false,
"options": [
"-h, --help This help",
"-b, --blk <dec> block number",
"-v, --verbose verbose output",
"--gdm use gdm alt (20/23) magic wakeup"
],
"usage": "hf mf cgetblk [-hv] -b <dec> [--gdm]"
},
"hf mf cgetsc": {
"command": "hf mf cgetsc",
"description": "Get sector data from magic Chinese card. Only works with magic gen1a cards",
"notes": [
"hf mf cgetsc -s 0"
],
"offline": false,
"options": [
"-h, --help This help",
"-s, --sec <dec> sector number",
"-v, --verbose verbose output",
"--gdm use gdm alt (20/23) magic wakeup"
],
"usage": "hf mf cgetsc [-hv] -s <dec> [--gdm]"
},
"hf mf chk": {
"command": "hf mf chk",
"description": "Check keys on MIFARE Classic card",
"notes": [
"hf mf chk --mini -k FFFFFFFFFFFF -> Check all sectors, all keys against MIFARE Mini",
"hf mf chk --1k -k FFFFFFFFFFFF -> Check all sectors, all keys against MIFARE Classic 1k",
"hf mf chk --2k -k FFFFFFFFFFFF -> Check all sectors, all keys against MIFARE 2k",
"hf mf chk --4k -k FFFFFFFFFFFF -> Check all sectors, all keys against MIFARE 4k",
"hf mf chk --1k --emu -> Check all sectors, all keys, 1K, and write to emulator memory",
"hf mf chk --1k --dump -> Check all sectors, all keys, 1K, and write to file",
"hf mf chk -a --tblk 0 -f mfc_default_keys.dic -> Check dictionary against block 0, key A"
],
"offline": false,
"options": [
"-h, --help This help",
"-k, --key <hex> Key specified as 12 hex symbols",
"--tblk <dec> Target block number",
"-a Target Key A",
"-b Target Key B",
"-*, --all Target both key A & B (default)",
"--mini MIFARE Classic Mini / S20",
"--1k MIFARE Classic 1k / S50 (default)",
"--2k MIFARE Classic/Plus 2k",
"--4k MIFARE Classic 4k / S70",
"--emu Fill simulator keys from found keys",
"--dump Dump found keys to binary file",
"-f, --file <fn> Filename of dictionary",
"--no-default Skip check default keys"
],
"usage": "hf mf chk [-hab*] [-k <hex>]... [--tblk <dec>] [--mini] [--1k] [--2k] [--4k] [--emu] [--dump] [-f <fn>] [--no-default]"
},
"hf mf cload": {
"command": "hf mf cload",
"description": "Load magic gen1a card with data from (bin/eml/json) dump file or from emulator memory.",
"notes": [
"hf mf cload --emu",
"hf mf cload -f hf-mf-01020304.eml"
],
"offline": false,
"options": [
"-h, --help This help",
"-f, --file <fn> Specify a filename for dump file",
"--mini MIFARE Classic Mini / S20",
"--1k MIFARE Classic 1k / S50 (def)",
"--2k MIFARE Classic/Plus 2k",
"--4k MIFARE Classic 4k / S70",
"--emu from emulator memory",
"--gdm use gdm alt (20/23) magic wakeup"
],
"usage": "hf mf cload [-h] [-f <fn>] [--mini] [--1k] [--2k] [--4k] [--emu] [--gdm]"
},
"hf mf csave": {
"command": "hf mf csave",
"description": "Save magic gen1a card memory to file (bin/json)or into emulator memory",
"notes": [
"hf mf csave",
"hf mf csave --4k"
],
"offline": false,
"options": [
"-h, --help This help",
"-f, --file <fn> Specify a filename for dump file",
"--mini MIFARE Classic Mini / S20",
"--1k MIFARE Classic 1k / S50 (def)",
"--2k MIFARE Classic/Plus 2k",
"--4k MIFARE Classic 4k / S70",
"--emu to emulator memory",
"--gdm to emulator memory"
],
"usage": "hf mf csave [-h] [-f <fn>] [--mini] [--1k] [--2k] [--4k] [--emu] [--gdm]"
},
"hf mf csetblk": {
"command": "hf mf csetblk",
"description": "Set block data on a magic gen1a card",
"notes": [
"hf mf csetblk --blk 1 -d 000102030405060708090a0b0c0d0e0f"
],
"offline": false,
"options": [
"-h, --help This help",
"-b, --blk <dec> block number",
"-d, --data <hex> bytes to write, 16 hex bytes",
"-w, --wipe wipes card with backdoor cmd before writing",
"--gdm use gdm alt (20/23) magic wakeup"
],
"usage": "hf mf csetblk [-hw] -b <dec> [-d <hex>] [--gdm]"
},
"hf mf csetuid": {
"command": "hf mf csetuid",
"description": "Set UID, ATQA, and SAK for magic gen1a card",
"notes": [
"hf mf csetuid -u 01020304",
"hf mf csetuid -w -u 01020304 --atqa 0004 --sak 08"
],
"offline": false,
"options": [
"-h, --help This help",
"-w, --wipe wipes card with backdoor cmd`",
"-u, --uid <hex> UID, 4/7 hex bytes",
"-a, --atqa <hex> ATQA, 2 hex bytes",
"-s, --sak <hex> SAK, 1 hex byte",
"--gdm use gdm alt (20/23) magic wakeup"
],
"usage": "hf mf csetuid [-hw] [-u <hex>] [-a <hex>] [-s <hex>] [--gdm]"
},
"hf mf cview": {
"command": "hf mf cview",
"description": "View `magic gen1a` card memory",
"notes": [
"hf mf cview",
"hf mf cview --4k"
],
"offline": false,
"options": [
"-h, --help This help",
"--mini MIFARE Classic Mini / S20",
"--1k MIFARE Classic 1k / S50 (def)",
"--2k MIFARE Classic/Plus 2k",
"--4k MIFARE Classic 4k / S70",
"-v, --verbose verbose output",
"--gdm use gdm alt (20/23) magic wakeup"
],
"usage": "hf mf cview [-hv] [--mini] [--1k] [--2k] [--4k] [--gdm]"
},
"hf mf cwipe": {
"command": "hf mf cwipe",
"description": "Wipe gen1 magic chinese card. Set UID / ATQA / SAK / Data / Keys / Access to default values",
"notes": [
"hf mf cwipe",
"hf mf cwipe -u 09080706 -a 0004 -s 18 -> set UID, ATQA and SAK and wipe card"
],
"offline": false,
"options": [
"-h, --help This help",
"-u, --uid <hex> UID, 4 hex bytes",
"-a, --atqa <hex> ATQA, 2 hex bytes",
"-s, --sak <hex> SAK, 1 hex byte",
"--gdm use gdm alt (20/23) magic wakeup"
],
"usage": "hf mf cwipe [-h] [-u <hex>] [-a <hex>] [-s <hex>] [--gdm]"
},
"hf mf darkside": {
"command": "hf mf darkside",
"description": "Darkside attack",
"notes": [
"hf mf darkside",
"hf mf darkside --blk 16",
"hf mf darkside --blk 16 -b"
],
"offline": false,
"options": [
"-h, --help This help",
"--blk <dec> Target block",
"-b Target key B instead of default key A",
"-c <dec> Target Auth 6x"
],
"usage": "hf mf darkside [-hb] [--blk <dec> ] [-c <dec>]"
},
"hf mf decrypt": {
"command": "hf mf decrypt",
"description": "Decrypt Crypto-1 encrypted bytes given some known state of crypto. See tracelog to gather needed values",
"notes": [
"hf mf decrypt --nt b830049b --ar 9248314a --at 9280e203 -d 41e586f9",
"-> 41e586f9 becomes 3003999a",
"-> which annotates 30 03 [99 9a] read block 3 [crc]"
],
"offline": true,
"options": [
"-h, --help This help",
"--nt <hex> tag nonce",
"--ar <hex> ar_enc, encrypted reader response",
"--at <hex> at_enc, encrypted tag response",
"-d, --data <hex> encrypted data, taken directly after at_enc and forward"
],
"usage": "hf mf decrypt [-h] --nt <hex> --ar <hex> --at <hex> -d <hex>"
},
"hf mf dump": {
"command": "hf mf dump",
"description": "Dump MIFARE Classic tag to file (bin/json) If no <name> given, UID will be used as filename",
"notes": [
"hf mf dump --mini -> MIFARE Mini",
"hf mf dump --1k -> MIFARE Classic 1k",
"hf mf dump --2k -> MIFARE 2k",
"hf mf dump --4k -> MIFARE 4k",
"hf mf dump --keys hf-mf-066C8B78-key.bin -> MIFARE 1k with keys from specified file"
],
"offline": false,
"options": [
"-h, --help This help",
"-f, --file <fn> Specify a filename for dump file",
"-k, --keys <fn> filename of keys",
"--mini MIFARE Classic Mini / S20",
"--1k MIFARE Classic 1k / S50 (def)",
"--2k MIFARE Classic/Plus 2k",
"--4k MIFARE Classic 4k / S70",
"--ns no save to file",
"-v, --verbose verbose output"
],
"usage": "hf mf dump [-hv] [-f <fn>] [-k <fn>] [--mini] [--1k] [--2k] [--4k] [--ns]"
},
"hf mf ecfill": {
"command": "hf mf ecfill",
"description": "Dump card and transfer the data to emulator memory. Keys must be in the emulator memory",
"notes": [
"hf mf ecfill -> use key type A",
"hf mf ecfill --4k -b -> target 4K card with key type B"
],
"offline": false,
"options": [
"-h, --help This help",
"-a input key type is key A(def)",
"-b input key type is key B",
"-c <dec> input key type is key A + offset",
"-k, --key <hex> key, 6 hex bytes, only for option -c",
"--mini MIFARE Classic Mini / S20",
"--1k MIFARE Classic 1k / S50 (def)",
"--2k MIFARE Classic/Plus 2k",
"--4k MIFARE Classic 4k / S70"
],
"usage": "hf mf ecfill [-hab] [-c <dec>] [-k <hex>] [--mini] [--1k] [--2k] [--4k]"
},
"hf mf eclr": {
"command": "hf mf eclr",
"description": "It set card emulator memory to empty data blocks and key A/B FFFFFFFFFFFF",
"notes": [
"hf mf eclr"
],
"offline": false,
"options": [
"-h, --help This help"
],
"usage": "hf mf eclr [-h]"
},
"hf mf egetblk": {
"command": "hf mf egetblk",
"description": "Get emulator memory block",
"notes": [
"hf mf egetblk --blk 0 -> get block 0 (manufacturer)",
"hf mf egetblk --blk 3 -v -> get block 3, decode sector trailer"
],
"offline": false,
"options": [
"-h, --help This help",
"-b, --blk <dec> block number",
"-v, --verbose verbose output"
],
"usage": "hf mf egetblk [-hv] -b <dec>"
},
"hf mf egetsc": {
"command": "hf mf egetsc",
"description": "Get emulator memory sector",
"notes": [
"hf mf egetsc -s 0"
],
"offline": false,
"options": [
"-h, --help This help",
"-s, --sec <dec> sector number",
"-v, --verbose verbose output"
],
"usage": "hf mf egetsc [-hv] -s <dec>"
},
"hf mf ekeyprn": {
"command": "hf mf ekeyprn",
"description": "Download and print the keys from emulator memory",
"notes": [
"hf mf ekeyprn --1k -> print MFC 1K keyset",
"hf mf ekeyprn -w -> write keys to binary file"
],
"offline": false,
"options": [
"-h, --help This help",
"-w, --write write keys to binary file `hf-mf-<UID>-key.bin`",
"--mini MIFARE Classic Mini / S20",
"--1k MIFARE Classic 1k / S50 (def)",
"--2k MIFARE Classic/Plus 2k",
"--4k MIFARE Classic 4k / S70"
],
"usage": "hf mf ekeyprn [-hw] [--mini] [--1k] [--2k] [--4k]"
},
"hf mf eload": {
"command": "hf mf eload",
"description": "Load emulator memory with data from (bin/eml/json) dump file",
"notes": [
"hf mf eload -f hf-mf-01020304.bin",
"hf mf eload --4k -f hf-mf-01020304.eml"
],
"offline": false,
"options": [
"-h, --help This help",
"-f, --file <fn> Specify a filename for dump file",
"--mini MIFARE Classic Mini / S20",
"--1k MIFARE Classic 1k / S50 (def)",
"--2k MIFARE Classic/Plus 2k",
"--4k MIFARE Classic 4k / S70",
"--ul MIFARE Ultralight family",
"-m, --mem use RDV4 spiffs",
"-q, --qty <dec> manually set number of blocks (overrides)",
"-v, --verbose verbose output"
],
"usage": "hf mf eload [-hmv] -f <fn> [--mini] [--1k] [--2k] [--4k] [--ul] [-q <dec>]"
},
"hf mf encodehid": {
"command": "hf mf encodehid",
"description": "Encode binary wiegand to card Use either --bin or --wiegand/--fc/--cn",
"notes": [
"hf mf encodehid --bin 10001111100000001010100011 -> FC 31 CN 337 (H10301)",
"hf mf encodehid -w H10301 --fc 31 --cn 337"
],
"offline": false,
"options": [
"-h, --help This help",
"--bin <bin> Binary string i.e 0001001001",
"--fc <dec> facility code",
"--cn <dec> card number",
"-w, --wiegand <format> see `wiegand list` for available formats",
"-v, --verbose verbose output"
],
"usage": "hf mf encodehid [-hv] [--bin <bin>] [--fc <dec>] [--cn <dec>] [-w <format>]"
},
"hf mf esave": {
"command": "hf mf esave",
"description": "Save emulator memory to file (bin/json)",
"notes": [
"hf mf esave",
"hf mf esave --4k",
"hf mf esave --4k -f hf-mf-01020304.eml"
],
"offline": false,
"options": [
"-h, --help This help",
"-f, --file <fn> Specify a filename for dump file",
"--mini MIFARE Classic Mini / S20",
"--1k MIFARE Classic 1k / S50 (def)",
"--2k MIFARE Classic/Plus 2k",
"--4k MIFARE Classic 4k / S70"
],
"usage": "hf mf esave [-h] [-f <fn>] [--mini] [--1k] [--2k] [--4k]"
},
"hf mf esetblk": {
"command": "hf mf esetblk",
"description": "Set emulator memory block",
"notes": [
"hf mf esetblk --blk 1 -d 000102030405060708090a0b0c0d0e0f"
],
"offline": false,
"options": [
"-h, --help This help",
"-b, --blk <dec> block number",
"-d, --data <hex> bytes to write, 16 hex bytes"
],
"usage": "hf mf esetblk [-h] -b <dec> [-d <hex>]"
},
"hf mf eview": {
"command": "hf mf eview",
"description": "It displays emulator memory",
"notes": [
"hf mf eview",
"hf mf eview --4k"
],
"offline": false,
"options": [
"-h, --help This help",
"--mini MIFARE Classic Mini / S20",
"--1k MIFARE Classic 1k / S50 (def)",
"--2k MIFARE Classic/Plus 2k",
"--4k MIFARE Classic 4k / S70",
"-v, --verbose verbose output",
"--sk Save extracted keys to binary file"
],
"usage": "hf mf eview [-hv] [--mini] [--1k] [--2k] [--4k] [--sk]"
},
"hf mf fchk": {
"command": "hf mf fchk",
"description": "This is a improved checkkeys method speedwise. It checks MIFARE Classic tags sector keys against a dictionary file with keys",
"notes": [
"hf mf fchk --mini -k FFFFFFFFFFFF -> Key recovery against MIFARE Mini",
"hf mf fchk --1k -k FFFFFFFFFFFF -> Key recovery against MIFARE Classic 1k",
"hf mf fchk --2k -k FFFFFFFFFFFF -> Key recovery against MIFARE 2k",
"hf mf fchk --4k -k FFFFFFFFFFFF -> Key recovery against MIFARE 4k",
"hf mf fchk --1k -f mfc_default_keys.dic -> Target 1K using default dictionary file",
"hf mf fchk --1k --emu -> Target 1K, write keys to emulator memory",
"hf mf fchk --1k --dump -> Target 1K, write keys to file",
"hf mf fchk --1k --mem -> Target 1K, use dictionary from flash memory"
],
"offline": false,
"options": [
"-h, --help This help",
"-k, --key <hex> Key specified as 12 hex symbols",
"--mini MIFARE Classic Mini / S20",
"--1k MIFARE Classic 1k / S50 (default)",
"--2k MIFARE Classic/Plus 2k",
"--4k MIFARE Classic 4k / S70",
"--emu Fill simulator keys from found keys",
"--dump Dump found keys to binary file",
"--mem Use dictionary from flashmemory",
"-f, --file <fn> filename of dictionary",
"--blk <dec> block number (single block recovery mode)",
"-a single block recovery key A",
"-b single block recovery key B",
"--no-default Skip check default keys"
],
"usage": "hf mf fchk [-hab] [-k <hex>]... [--mini] [--1k] [--2k] [--4k] [--emu] [--dump] [--mem] [-f <fn>] [--blk <dec>] [--no-default]"
},
"hf mf gchpwd": {
"command": "hf mf gchpwd",
"description": "Change access password for Gen4 GTU card. WARNING! If you dont KNOW the password - you CAN'T access it!!!",
"notes": [
"hf mf gchpwd --pwd 00000000 --newpwd 01020304"
],
"offline": false,
"options": [
"-h, --help This help",
"-p, --pwd <hex> password 4 bytes",
"-n, --newpwd <hex> new password 4 bytes",
"-v, --verbose verbose output"
],
"usage": "hf mf gchpwd [-hv] [-p <hex>] [-n <hex>]"
},
"hf mf gdmcfg": {
"command": "hf mf gdmcfg",
"description": "Get configuration data from magic gen4 GDM card.",
"notes": [
"hf mf gdmcfg"
],
"offline": false,
"options": [
"-h, --help This help",
"-k, --key <hex> key 6 bytes (only for regular wakeup)",
"--gen1a use gen1a (40/43) magic wakeup",
"--gdm use gdm alt (20/23) magic wakeup"
],
"usage": "hf mf gdmcfg [-h] [-k <hex>] [--gen1a] [--gdm]"
},
"hf mf gdmparsecfg": {
"command": "hf mf gdmparsecfg",
"description": "Parse configuration data on a magic gen4 GDM card",
"notes": [
"hf mf gdmparsecfg -d 850000000000000000005A5A00000008"
],
"offline": true,
"options": [
"-h, --help This help",
"-d, --data <hex> bytes to write, 16 hex bytes"
],
"usage": "hf mf gdmparsecfg [-h] -d <hex>"
},
"hf mf gdmsetblk": {
"command": "hf mf gdmsetblk",
"description": "Set block data on a magic gen4 GDM card `--force` param is used to override warnings like bad ACL writes. if not specified, it will exit if detected",
"notes": [
"hf mf gdmsetblk --blk 1 -d 000102030405060708090a0b0c0d0e0f"
],
"offline": false,
"options": [
"-h, --help This help",
"--blk <dec> block number",
"-d, --data <hex> bytes to write, 16 hex bytes",
"-k, --key <hex> key, 6 hex bytes",
"--force override warnings"
],
"usage": "hf mf gdmsetblk [-h] --blk <dec> [-d <hex>] [-k <hex>] [--force]"
},
"hf mf gdmsetcfg": {
"command": "hf mf gdmsetcfg",
"description": "Set configuration data on a magic gen4 GDM card",
"notes": [
"hf mf gdmsetcfg -d 850000000000000000005A5A00000008"
],
"offline": false,
"options": [
"-h, --help This help",
"-d, --data <hex> bytes to write, 16 hex bytes",
"-k, --key <hex> key 6 bytes (only for regular wakeup)",
"--gen1a use gen1a (40/43) magic wakeup",
"--gdm use gdm alt (20/23) magic wakeup"
],
"usage": "hf mf gdmsetcfg [-h] -d <hex> [-k <hex>] [--gen1a] [--gdm]"
},
"hf mf gen3blk": {
"command": "hf mf gen3blk",
"description": "Overwrite full manufacturer block for magic Gen3 card - You can specify part of manufacturer block as 4/7-bytes for UID change only NOTE: BCC, SAK, ATQA will be calculated automatically",
"notes": [
"hf mf gen3blk -> print current data",
"hf mf gen3blk -d 01020304 -> set 4 byte uid",
"hf mf gen3blk -d 01020304050607 -> set 7 byte uid",
"hf mf gen3blk -d 01020304FFFFFFFF0102030405060708"
],
"offline": false,
"options": [
"-h, --help This help",
"-d, --data <hex> manufacturer block data up to 16 hex bytes"
],
"usage": "hf mf gen3blk [-h] [-d <hex>]"
},
"hf mf gen3freeze": {
"command": "hf mf gen3freeze",
"description": "Perma lock further UID changes. No more UID changes available after operation completed Note: operation is ! irreversible !",
"notes": [
"hf mf gen3freeze -y"
],
"offline": false,
"options": [
"-h, --help This help",
"-y, --yes confirm UID lock operation"
],
"usage": "hf mf gen3freeze -y[h]"
},
"hf mf gen3uid": {
"command": "hf mf gen3uid",
"description": "Set UID for magic Gen3 card _without_ changes to manufacturer block 0",
"notes": [
"hf mf gen3uid --uid 01020304 -> set 4 byte uid",
"hf mf gen3uid --uid 01020304050607 -> set 7 byte uid"
],
"offline": false,
"options": [
"-h, --help This help",
"-u, --uid <hex> UID 4/7 hex bytes"
],
"usage": "hf mf gen3uid [-h] [-u <hex>]"
},
"hf mf ggetblk": {
"command": "hf mf ggetblk",
"description": "Get block data from magic gen4 GTU card.",
"notes": [
"hf mf ggetblk --blk 0 -> get block 0 (manufacturer)",
"hf mf ggetblk --blk 3 -v -> get block 3, decode sector trailer"
],
"offline": false,
"options": [
"-h, --help This help",
"-b, --blk <dec> block number",
"-v, --verbose verbose output",
"-p, --pwd <hex> password 4bytes"
],
"usage": "hf mf ggetblk [-hv] -b <dec> [-p <hex>]"
},
"hf mf ginfo": {
"command": "hf mf ginfo",
"description": "Read info about magic gen4 GTU card.",
"notes": [
"hf mf ginfo -> get info with default password 00000000",
"hf mf ginfo --pwd 01020304 -> get info with password",
"hf mf ginfo -d 00000000000002090978009102BDAC19131011121314151604001800FF0002FD -v -> decode config block"
],
"offline": false,
"options": [
"-h, --help This help",
"-v, --verbose verbose output",
"-p, --pwd <hex> password 4 bytes",
"-d, --data <hex> config bytes 32 bytes"
],
"usage": "hf mf ginfo [-hv] [-p <hex>] [-d <hex>]"
},
"hf mf gload": {
"command": "hf mf gload",
"description": "Load magic gen4 gtu card with data from (bin/eml/json) dump file or from emulator memory.",
"notes": [
"hf mf gload --emu",
"hf mf gload -f hf-mf-01020304.eml",
"hf mf gload -p AABBCCDD --4k -v -f hf-mf-01020304-dump.bin",
"",
"Card must be configured beforehand with `script run hf_mf_ultimatecard`.",
"Blocks are 16 bytes long."
],
"offline": false,
"options": [
"-h, --help This help",
"--mini MIFARE Classic Mini / S20",
"--1k MIFARE Classic 1k / S50 (def)",
"--2k MIFARE Classic/Plus 2k",
"--4k MIFARE Classic 4k / S70",
"-p, --pwd <hex> password 4bytes",
"-v, --verbose verbose output",
"-f, --file <fn> Specify a filename for dump file",
"--emu from emulator memory",
"--start <dec> index of block to start writing (default 0)",
"--end <dec> index of block to end writing (default last block)"
],
"usage": "hf mf gload [-hv] [--mini] [--1k] [--2k] [--4k] [-p <hex>] [-f <fn>] [--emu] [--start <dec>] [--end <dec>]"
},
"hf mf gsave": {
"command": "hf mf gsave",
"description": "Save `magic gen4 gtu` card memory to file (bin/json)or into emulator memory",
"notes": [
"hf mf gsave",
"hf mf gsave --4k",
"hf mf gsave -p DEADBEEF -f hf-mf-01020304.json"
],
"offline": false,
"options": [
"-h, --help This help",
"--mini MIFARE Classic Mini / S20",
"--1k MIFARE Classic 1k / S50 (def)",
"--2k MIFARE Classic/Plus 2k",
"--4k MIFARE Classic 4k / S70",
"-p, --pwd <hex> password 4 bytes",
"-f, --file <fn> Specify a filename for dump file",
"--emu to emulator memory"
],
"usage": "hf mf gsave [-h] [--mini] [--1k] [--2k] [--4k] [-p <hex>] [-f <fn>] [--emu]"
},
"hf mf gsetblk": {
"command": "hf mf gsetblk",
"description": "Set block data on a magic gen4 GTU card",
"notes": [
"hf mf gsetblk --blk 1 -d 000102030405060708090a0b0c0d0e0f"
],
"offline": false,
"options": [
"-h, --help This help",
"-b, --blk <dec> block number",
"-d, --data <hex> bytes to write, 16 hex bytes",
"-p, --pwd <hex> password 4bytes"
],
"usage": "hf mf gsetblk [-h] -b <dec> [-d <hex>] [-p <hex>]"
},
"hf mf gview": {
"command": "hf mf gview",
"description": "View `magic gen4 gtu` card memory",
"notes": [
"hf mf gview",
"hf mf gview --4k"
],
"offline": false,
"options": [
"-h, --help This help",
"--mini MIFARE Classic Mini / S20",
"--1k MIFARE Classic 1k / S50 (def)",
"--2k MIFARE Classic/Plus 2k",
"--4k MIFARE Classic 4k / S70",
"-p, --pwd <hex> password 4bytes",
"-v, --verbose verbose output"
],
"usage": "hf mf gview [-hv] [--mini] [--1k] [--2k] [--4k] [-p <hex>]"
},
"hf mf hardnested": {
"command": "hf mf hardnested",
"description": "Nested attack for hardened MIFARE Classic cards. if card is EV1, command can detect and use known key see example below `--i<X>` set type of SIMD instructions. Without this flag programs autodetect it. or hf mf hardnested -r --tk [known target key] Add the known target key to check if it is present in the remaining key space hf mf hardnested --blk 0 -a -k A0A1A2A3A4A5 --tblk 4 --ta --tk FFFFFFFFFFFF",
"notes": [
"hf mf hardnested --tblk 4 --ta -> works for MFC EV1",
"hf mf hardnested --blk 0 -a -k FFFFFFFFFFFF --tblk 4 --ta",
"hf mf hardnested --blk 0 -a -k FFFFFFFFFFFF --tblk 4 --ta -w",
"hf mf hardnested --blk 0 -a -k FFFFFFFFFFFF --tblk 4 --ta -f nonces.bin -w -s",
"hf mf hardnested -r",
"hf mf hardnested -r --tk a0a1a2a3a4a5",
"hf mf hardnested -t --tk a0a1a2a3a4a5",
"hf mf hardnested --blk 0 -a -k a0a1a2a3a4a5 --tblk 4 --ta --tk FFFFFFFFFFFF"
],
"offline": true,
"options": [
"-h, --help This help",
"-k, --key <hex> Key, 12 hex bytes",
"--blk <dec> Input block number",
"-a Input key A (def)",
"-b Input key B",
"--tblk <dec> Target block number",
"--ta Target key A",
"--tb Target key B",
"--tk <hex> Target key, 12 hex bytes",
"-u, --uid <hex> R/W `hf-mf-<UID>-nonces.bin` instead of default name",
"-f, --file <fn> R/W <name> instead of default name",
"-r, --read Read `hf-mf-<UID>-nonces.bin` if tag present, otherwise `nonces.bin`, and start attack",
"-s, --slow Slower acquisition (required by some non standard cards)",
"-t, --tests Run tests",
"-w, --wr Acquire nonces and UID, and write them to file `hf-mf-<UID>-nonces.bin`",
"--in None (use CPU regular instruction set)",
"--im MMX",
"--is SSE2",
"--ia AVX",
"--i2 AVX2",
"--i5 AVX512"
],
"usage": "hf mf hardnested [-habrstw] [-k <hex>] [--blk <dec>] [--tblk <dec>] [--ta] [--tb] [--tk <hex>] [-u <hex>] [-f <fn>] [--in] [--im] [--is] [--ia] [--i2] [--i5]"
},
"hf mf help": {
"command": "hf mf help",
"description": "help This help list List MIFARE history hardnested Nested attack for hardened MIFARE Classic cards decrypt Decrypt Crypto1 data from sniff or trace acl Decode and print MIFARE Classic access rights bytes mad Checks and prints MAD value Value blocks view Display content from tag dump file gdmparsecfg Parse config block to card --------------------------------------------------------------------------------------- hf mf list available offline: yes Alias of `trace list -t mf -c` with selected protocol data to annotate trace buffer You can load a trace from file (see `trace load -h`) or it be downloaded from device by default It accepts all other arguments of `trace list`. Note that some might not be relevant for this specific protocol",
"notes": [
"hf mf list --frame -> show frame delay times",
"hf mf list -1 -> use trace buffer"
],
"offline": true,
"options": [
"-h, --help This help",
"-1, --buffer use data from trace buffer",
"--frame show frame delay times",
"-c mark CRC bytes",
"-r show relative times (gap and duration)",
"-u display times in microseconds instead of clock cycles",
"-x show hexdump to convert to pcap(ng)",
"or to import into Wireshark using encapsulation type \"ISO 14443\"",
"-f, --file <fn> filename of dictionary"
],
"usage": "hf mf list [-h1crux] [--frame] [-f <fn>]"
},
"hf mf info": {
"command": "hf mf info",
"description": "Information and check vulnerabilities in a MIFARE Classic card Some cards in order to extract information you need to specify key and/or specific keys in the command line",
"notes": [
"hf mf info",
"hf mf info -k FFFFFFFFFFFF -n -v"
],
"offline": false,
"options": [
"-h, --help This help",
"--blk <dec> block number",
"-a input key type is key A (def)",
"-b input key type is key B",
"-k, --key <hex> key, 6 hex bytes",
"-n, --nack do nack test",
"-v, --verbose verbose output"
],
"usage": "hf mf info [-habnv] [--blk <dec>] [-k <hex>]"
},
"hf mf isen": {
"command": "hf mf isen",
"description": "Information about Static Encrypted Nonce properties in a MIFARE Classic card",
"notes": [
"hf mf isen",
"Default behavior:",
"auth(blk)-auth(blk2)-auth(blk2)-...",
"Default behavior when wrong key2:",
"auth(blk)-auth(blk2) auth(blk)-auth(blk2) ..."
],
"offline": false,
"options": [
"-h, --help This help",
"--blk <dec> block number",
"-a input key type is key A (def)",
"-b input key type is key B",
"-c <dec> input key type is key A + offset",
"-k, --key <hex> key, 6 hex bytes",
"--blk2 <dec> nested block number (default=same)",
"--a2 nested input key type is key A (default=same)",
"--b2 nested input key type is key B (default=same)",
"--c2 <dec> nested input key type is key A + offset",
"--key2 <hex> nested key, 6 hex bytes (default=same)",
"-n <dec> number of nonces (default=2)",
"--reset reset between attempts, even if auth was successful",
"--hardreset hard reset (RF off/on) between attempts, even if auth was successful",
"--addread auth(blk)-read(blk)-auth(blk2)",
"--addauth auth(blk)-auth(blk)-auth(blk2)",
"--incblk2 auth(blk)-auth(blk2)-auth(blk2+4)-...",
"--corruptnrar corrupt {nR}{aR}, but with correct parity",
"--corruptnrarparity correct {nR}{aR}, but with corrupted parity",
"",
"FM11RF08S specific options: Incompatible with above options, except -k; output in JSON",
"--collect_fm11rf08s collect all nT/{nT}/par_err.",
"--collect_fm11rf08s_with_data collect all nT/{nT}/par_err and data blocks.",
"-f, --file <fn> Specify a filename for collected data"
],
"usage": "hf mf isen [-hab] [--blk <dec>] [-c <dec>] [-k <hex>] [--blk2 <dec>] [--a2] [--b2] [--c2 <dec>] [--key2 <hex>] [-n <dec>] [--reset] [--hardreset] [--addread] [--addauth] [--incblk2] [--corruptnrar] [--corruptnrarparity] FM11RF08S specific options: [--collect_fm11rf08s] [--collect_fm11rf08s_with_data] [-f <fn>]"
},
"hf mf mad": {
"command": "hf mf mad",
"description": "Checks and prints MIFARE Application Directory (MAD)",
"notes": [
"hf mf mad -> shows MAD if exists",
"hf mf mad --aid e103 -k ffffffffffff -b -> shows NDEF data if exists. read card with custom key and key B",
"hf mf mad --dch -k ffffffffffff -> decode CardHolder information"
],
"offline": true,
"options": [
"-h, --help This help",
"-v, --verbose verbose output",
"--aid <hex> print all sectors with specified aid",
"-k, --key <hex> key for printing sectors",
"-b, --keyb use key B for access printing sectors (by default: key A)",
"--be (optional, BigEndian)",
"--dch decode Card Holder information",
"-f, --file <fn> load dump file and decode MAD"
],
"usage": "hf mf mad [-hvb] [--aid <hex>] [-k <hex>] [--be] [--dch] [-f <fn>]"
},
"hf mf nack": {
"command": "hf mf nack",
"description": "Test a MIFARE Classic based card for the NACK bug",
"notes": [
"hf mf nack"
],
"offline": false,
"options": [
"-h, --help This help",
"-v, --verbose verbose output`"
],
"usage": "hf mf nack [-hv]"
},
"hf mf ndefformat": {
"command": "hf mf ndefformat",
"description": "format MIFARE Classic Tag as a NFC tag with Data Exchange Format (NDEF) If no <name> given, UID will be used as filename. It will try default keys and MAD keys to detect if tag is already formatted in order to write. If not, it will try finding a key file based on your UID. ie, if you ran autopwn before",
"notes": [
"hf mf ndefformat",
"hf mf ndefformat --1k -> MIFARE Classic 1k",
"hf mf ndefformat --keys hf-mf-01020304-key.bin -> MIFARE 1k with keys from specified file"
],
"offline": false,
"options": [
"-h, --help This help",
"-k, --keys <fn> filename of keys",
"--mini MIFARE Classic Mini / S20",
"--1k MIFARE Classic 1k / S50 (def)",
"--2k MIFARE Classic/Plus 2k",
"--4k MIFARE Classic 4k / S70"
],
"usage": "hf mf ndefformat [-h] [-k <fn>] [--mini] [--1k] [--2k] [--4k]"
},
"hf mf ndefread": {
"command": "hf mf ndefread",
"description": "Prints NFC Data Exchange Format (NDEF)",
"notes": [
"hf mf ndefread -> shows NDEF parsed data",
"hf mf ndefread -vv -> shows NDEF parsed and raw data",
"hf mf ndefread --aid e103 -k ffffffffffff -b -> shows NDEF data with custom AID, key and with key B",
"hf mf ndefread -f myfilename -> save raw NDEF to file"
],
"offline": false,
"options": [
"-h, --help This help",
"-v, --verbose Verbose output",
"--aid <aid> replace default aid for NDEF",
"-k, --key <key> replace default key for NDEF",
"-b, --keyb use key B for access sectors (by default: key A)",
"-f, --file <fn> save raw NDEF to file"
],
"usage": "hf mf ndefread [-hvb] [--aid <aid>] [-k <key>] [-f <fn>]"
},
"hf mf ndefwrite": {
"command": "hf mf ndefwrite",
"description": "Write raw NDEF hex bytes to tag. This commands assumes tag already been NFC/NDEF formatted.",
"notes": [
"hf mf ndefwrite -d 0300FE -> write empty record to tag",
"hf mf ndefwrite -f myfilename",
"hf mf ndefwrite -d 033fd1023a53709101195405656e2d55534963656d616e2054776974746572206c696e6b5101195502747769747465722e636f6d2f686572726d616e6e31303031"
],
"offline": false,
"options": [
"-h, --help This help",
"-d <hex> raw NDEF hex bytes",
"-f, --file <fn> write raw NDEF file to tag",
"-p fix NDEF record headers / terminator block if missing",
"--mini MIFARE Classic Mini / S20",
"--1k MIFARE Classic 1k / S50 (def)",
"--2k MIFARE Classic/Plus 2k",
"--4k MIFARE Classic 4k / S70",
"-v, --verbose verbose output"
],
"usage": "hf mf ndefwrite [-hpv] [-d <hex>] [-f <fn>] [--mini] [--1k] [--2k] [--4k]"
},
"hf mf nested": {
"command": "hf mf nested",
"description": "Execute Nested attack against MIFARE Classic card for key recovery",
"notes": [
"hf mf nested --blk 0 -a -k FFFFFFFFFFFF --tblk 4 --ta -> Use block 0 Key A to find block 4 Key A (single sector key recovery)",
"hf mf nested --mini --blk 0 -a -k FFFFFFFFFFFF -> Key recovery against MIFARE Mini",
"hf mf nested --1k --blk 0 -a -k FFFFFFFFFFFF -> Key recovery against MIFARE Classic 1k",
"hf mf nested --2k --blk 0 -a -k FFFFFFFFFFFF -> Key recovery against MIFARE 2k",
"hf mf nested --4k --blk 0 -a -k FFFFFFFFFFFF -> Key recovery against MIFARE 4k"
],
"offline": false,
"options": [
"-h, --help This help",
"-k, --key <hex> Key specified as 12 hex symbols",
"--mini MIFARE Classic Mini / S20",
"--1k MIFARE Classic 1k / S50",
"--2k MIFARE Classic/Plus 2k",
"--4k MIFARE Classic 4k / S70",
"--blk <dec> Input block number",
"-a Input key specified is A key (default)",
"-b Input key specified is B key",
"-c <dec> input key type is key A + offset",
"--tblk <dec> Target block number",
"--ta Target A key (default)",
"--tb Target B key",
"--tc <dec> Nested input key type is key A + offset (you must specify a single block as well!)",
"--emu Fill simulator keys from found keys",
"--dump Dump found keys to file",
"--mem Use dictionary from flashmemory",
"-i Ignore static encrypted nonces"
],
"usage": "hf mf nested [-habi] [-k <hex>] [--mini] [--1k] [--2k] [--4k] [--blk <dec>] [-c <dec>] [--tblk <dec>] [--ta] [--tb] [--tc <dec>] [--emu] [--dump] [--mem]"
},
"hf mf personalize": {
"command": "hf mf personalize",
"description": "Personalize the UID of a MIFARE Classic EV1 card. This is only possible if it is a 7Byte UID card and if it is not already personalized.",
"notes": [
"hf mf personalize --f0 -> double size UID",
"hf mf personalize --f1 -> double size UID, optional usage of selection process shortcut",
"hf mf personalize --f2 -> single size random ID",
"hf mf personalize --f3 -> single size NUID",
"hf mf personalize -b -k B0B1B2B3B4B5 --f3 -> use key B = 0xB0B1B2B3B4B5"
],
"offline": false,
"options": [
"-h, --help This help",
"-a use key A to authenticate sector 0 (def)",
"-b use key B to authenticate sector 0",
"-k, --key <hex> key (def FFFFFFFFFFFF)",
"--f0 UIDFO, double size UID",
"--f1 UIDF1, double size UID, optional usage of selection process shortcut",
"--f2 UIDF2, single size random ID",
"--f3 UIDF3, single size NUID"
],
"usage": "hf mf personalize [-hab] [-k <hex>] [--f0] [--f1] [--f2] [--f3]"
},
"hf mf rdbl": {
"command": "hf mf rdbl",
"description": "Read MIFARE Classic block",
"notes": [
"hf mf rdbl --blk 0",
"hf mf rdbl --blk 0 -k A0A1A2A3A4A5",
"hf mf rdbl --blk 3 -v -> get block 3, decode sector trailer"
],
"offline": false,
"options": [
"-h, --help This help",
"--blk <dec> block number",
"-a input key type is key A (def)",
"-b input key type is key B",
"-c <dec> input key type is key A + offset",
"-k, --key <hex> key, 6 hex bytes",
"-v, --verbose verbose output"
],
"usage": "hf mf rdbl [-habv] --blk <dec> [-c <dec>] [-k <hex>]"
},
"hf mf rdsc": {
"command": "hf mf rdsc",
"description": "Read MIFARE Classic sector",
"notes": [
"hf mf rdsc -s 0",
"hf mf rdsc -s 0 -k A0A1A2A3A4A5"
],
"offline": false,
"options": [
"-h, --help This help",
"-a input key specified is A key (def)",
"-b input key specified is B key",
"-c <dec> input key type is key A + offset",
"-k, --key <hex> key specified as 6 hex bytes",
"-s, --sec <dec> sector number",
"-v, --verbose verbose output"
],
"usage": "hf mf rdsc [-habv] [-c <dec>] [-k <hex>] -s <dec>"
},
"hf mf restore": {
"command": "hf mf restore",
"description": "Restore MIFARE Classic dump file to tag. The key file and dump file will program the card sector trailers. By default we authenticate to card with key 0xFFFFFFFFFFFF. If access rights in dump file is all zeros, it will be replaced with default values `--uid` param is used for filename templates `hf-mf-<uid>-dump.bin` and `hf-mf-<uid>-key.bin. if not specified, it will read the card uid instead. `--ka` param you can indicate that the key file should be used for authentication instead. if so we also try both B/A keys `--force` param is used to override warnings and allow bad ACL block writes. if not specified, it will skip blocks with bad ACL.",
"notes": [
"hf mf restore",
"hf mf restore --1k --uid 04010203",
"hf mf restore --1k --uid 04010203 -k hf-mf-AABBCCDD-key.bin",
"hf mf restore --4k"
],
"offline": false,
"options": [
"-h, --help This help",
"--mini MIFARE Classic Mini / S20",
"--1k MIFARE Classic 1k / S50 (def)",
"--2k MIFARE Classic/Plus 2k",
"--4k MIFARE Classic 4k / S70",
"-u, --uid <hex> uid, (4|7|10 hex bytes)",
"-f, --file <fn> specify a filename for dump file",
"-k, --kfn <fn> key filename",
"--ka use specified keyfile to authenticate",
"--force override warnings"
],
"usage": "hf mf restore [-h] [--mini] [--1k] [--2k] [--4k] [-u <hex>] [-f <fn>] [-k <fn>] [--ka] [--force]"
},
"hf mf setmod": {
"command": "hf mf setmod",
"description": "Sets the load modulation strength of a MIFARE Classic EV1 card",
"notes": [
"hf mf setmod -k ffffffffffff -0"
],
"offline": false,
"options": [
"-h, --help This help",
"-0 normal modulation",
"-1 strong modulation (def)",
"-k, --key <hex> key A, Sector 0, 6 hex bytes"
],
"usage": "hf mf setmod [-h01] [-k <hex>]"
},
"hf mf sim": {
"command": "hf mf sim",
"description": "Simulate MIFARE Classic family type based upon ISO/IEC 14443 type A tag with 4,7 or 10 byte UID from emulator memory. See `hf mf eload` first. The UID from emulator memory will be used if not specified.",
"notes": [
"hf mf sim --mini -> MIFARE Mini",
"hf mf sim --1k -> MIFARE Classic 1k (default)",
"hf mf sim --1k -u 0a0a0a0a -> MIFARE Classic 1k with 4b UID",
"hf mf sim --1k -u 11223344556677 -> MIFARE Classic 1k with 7b UID",
"hf mf sim --1k -u 11223344 -i -x -> Perform reader attack in interactive mode",
"hf mf sim --2k -> MIFARE 2k",
"hf mf sim --4k -> MIFARE 4khf mf sim --1k -x -e --> Keep simulation running and populate with found reader keys"
],
"offline": false,
"options": [
"-h, --help This help",
"-u, --uid <hex> <4|7|10> hex bytes UID",
"--mini MIFARE Classic Mini / S20",
"--1k MIFARE Classic 1k / S50",
"--2k MIFARE Classic/Plus 2k",
"--4k MIFARE Classic 4k / S70",
"--atqa <hex> Provide explicit ATQA (2 bytes)",
"--sak <hex> Provide explicit SAK (1 bytes)",
"-n, --num <dec> Automatically exit simulation after <numreads> blocks have been read by reader. 0 = infinite",
"-i, --interactive Console will not be returned until simulation finishes or is aborted",
"-x Performs the 'reader attack', nr/ar attack against a reader.",
"-y Performs the nested 'reader attack'. This requires preloading nt & nt_enc in emulator memory. Implies -x.",
"-e, --emukeys Fill simulator keys from found keys. Requires -x or -y. Implies -i. Simulation will restart automatically.",
"--allowkeyb Allow key B even if readable",
"-v, --verbose Verbose output",
"--cve Trigger CVE 2021_0430"
],
"usage": "hf mf sim [-hixyev] [-u <hex>] [--mini] [--1k] [--2k] [--4k] [--atqa <hex>] [--sak <hex>] [-n <dec> ] [--allowkeyb] [--cve]"
},
"hf mf staticnested": {
"command": "hf mf staticnested",
"description": "Execute static nested attack against MIFARE Classic card with static nonce for key recovery. Supply a known key from one block to recover all keys",
"notes": [
"hf mf staticnested --mini --blk 0 -a -k FFFFFFFFFFFF",
"hf mf staticnested --1k --blk 0 -a -k FFFFFFFFFFFF",
"hf mf staticnested --2k --blk 0 -a -k FFFFFFFFFFFF",
"hf mf staticnested --4k --blk 0 -a -k FFFFFFFFFFFF"
],
"offline": false,
"options": [
"-h, --help This help",
"-k, --key <hex> Known key (12 hex symbols)",
"--mini MIFARE Classic Mini / S20",
"--1k MIFARE Classic 1k / S50",
"--2k MIFARE Classic/Plus 2k",
"--4k MIFARE Classic 4k / S70",
"--blk <dec> Input block number",
"-a Input key specified is keyA (def)",
"-b Input key specified is keyB",
"-e, --emukeys Fill simulator keys from found keys",
"--dumpkeys Dump found keys to file"
],
"usage": "hf mf staticnested [-habe] [-k <hex>] [--mini] [--1k] [--2k] [--4k] [--blk <dec>] [--dumpkeys]"
},
"hf mf supercard": {
"command": "hf mf supercard",
"description": "Extract info from a `super card`",
"notes": [
"hf mf supercard -> recover key",
"hf mf supercard -r -> reset card",
"hf mf supercard -u 11223344 -> change UID"
],
"offline": false,
"options": [
"-h, --help This help",
"-r, --reset Reset card",
"-u, --uid <hex> New UID (4 hex bytes)",
"--furui Furui detection card"
],
"usage": "hf mf supercard [-hr] [-u <hex>] [--furui]"
},
"hf mf value": {
"command": "hf mf value",
"description": "MIFARE Classic value data commands",
"notes": [
"hf mf value --blk 16 -k FFFFFFFFFFFF --set 1000",
"hf mf value --blk 16 -k FFFFFFFFFFFF --inc 10",
"hf mf value --blk 16 -k FFFFFFFFFFFF -b --dec 10",
"hf mf value --blk 16 -k FFFFFFFFFFFF -b --get",
"hf mf value --blk 16 -k FFFFFFFFFFFF --res --transfer 30 --tk FFFFFFFFFFFF -> transfer block 16 value to block 30 (even if block can't be incremented by ACL)",
"hf mf value --get -d 87D612007829EDFF87D6120011EE11EE"
],
"offline": true,
"options": [
"-h, --help This help",
"-k, --key <hex> key, 6 hex bytes",
"-a input key type is key A (def)",
"-b input key type is key B",
"--inc <dec> Increment value by X (0 - 2147483647)",
"--dec <dec> Decrement value by X (0 - 2147483647)",
"--set <dec> Set value to X (-2147483647 - 2147483647)",
"--transfer <dec> Transfer value to other block (after inc/dec/restore)",
"--tkey <hex> transfer key, 6 hex bytes (if transfer is preformed to other sector)",
"--ta transfer key type is key A (def)",
"--tb transfer key type is key B",
"--get Get value from block",
"--res Restore (copy value to card buffer, should be used with --transfer)",
"--blk <dec> block number",
"-d, --data <hex> block data to extract values from (16 hex bytes)"
],
"usage": "hf mf value [-hab] [-k <hex>] [--inc <dec>] [--dec <dec>] [--set <dec>] [--transfer <dec>] [--tkey <hex>] [--ta] [--tb] [--get] [--res] [--blk <dec>] [-d <hex>]"
},
"hf mf view": {
"command": "hf mf view",
"description": "Print a MIFARE Classic dump file (bin/eml/json)",
"notes": [
"hf mf view -f hf-mf-01020304-dump.bin"
],
"offline": true,
"options": [
"-h, --help This help",
"-f, --file <fn> Specify a filename for dump file",
"-v, --verbose verbose output",
"--sk Save extracted keys to binary file"
],
"usage": "hf mf view [-hv] -f <fn> [--sk]"
},
"hf mf wipe": {
"command": "hf mf wipe",
"description": "Wipe card to zeros and default keys/acc. This command takes a key file to wipe card Will use UID from card to generate keyfile name if not specified. New A/B keys..... FF FF FF FF FF FF New acc rights... FF 07 80 New GPB.......... 69",
"notes": [
"hf mf wipe -> reads card uid to generate file name",
"hf mf wipe --gen2 -> force write to S0, B0 manufacture block",
"hf mf wipe -f mykey.bin -> use mykey.bin"
],
"offline": false,
"options": [
"-h, --help This help",
"-f, --file <fn> key filename",
"--gen2 force write to Sector 0, block 0 (GEN2)"
],
"usage": "hf mf wipe [-h] [-f <fn>] [--gen2]"
},
"hf mf wrbl": {
"command": "hf mf wrbl",
"description": "Write MIFARE Classic block with 16 hex bytes of data Sector 0 / Block 0 - Manufacturer block When writing to block 0 you must use a VALID block 0 data (UID, BCC, SAK, ATQA) Writing an invalid block 0 means rendering your Magic GEN2 card undetectable. Look in the magic_cards_notes.md file for help to resolve it. `--force` param is used to override warnings like bad ACL and BLOCK 0 writes. if not specified, it will exit if detected",
"notes": [
"hf mf wrbl --blk 1 -d 000102030405060708090a0b0c0d0e0f",
"hf mf wrbl --blk 1 -k A0A1A2A3A4A5 -d 000102030405060708090a0b0c0d0e0f"
],
"offline": false,
"options": [
"-h, --help This help",
"--blk <dec> block number",
"-a input key type is key A (def)",
"-b input key type is key B",
"-c <dec> input key type is key A + offset",
"--force override warnings",
"-k, --key <hex> key, 6 hex bytes",
"-d, --data <hex> bytes to write, 16 hex bytes"
],
"usage": "hf mf wrbl [-hab] --blk <dec> [-c <dec>] [--force] [-k <hex>] [-d <hex>]"
},
"hf mfdes auth": {
"command": "hf mfdes auth",
"description": "Select application on the card. It selects app if it is a valid one or returns an error.",
"notes": [
"hf mfdes auth -n 0 -t des -k 0000000000000000 --kdf none -> select PICC level and authenticate with key num=0, key type=des, key=00..00 and key derivation = none",
"hf mfdes auth -n 0 -t aes -k 00000000000000000000000000000000 -> select PICC level and authenticate with key num=0, key type=aes, key=00..00 and key derivation = none",
"hf mfdes auth -n 0 -t des -k 0000000000000000 --save -> select PICC level and authenticate and in case of successful authentication - save channel parameters to defaults",
"hf mfdes auth --aid 123456 -> select application 123456 and authenticate via parameters from `default` command"
],
"offline": false,
"options": [
"-h, --help This help",
"-a, --apdu Show APDU requests and responses",
"-v, --verbose Verbose output",
"-n, --keyno <dec> Key number",
"-t, --algo <DES|2TDEA|3TDEA|AES> Crypt algo",
"-k, --key <hex> Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)",
"--kdf <none|AN10922|gallagher> Key Derivation Function (KDF)",
"-i, --kdfi <hex> KDF input (1-31 hex bytes)",
"-m, --cmode <plain|mac|encrypt> Communicaton mode",
"-c, --ccset <native|niso|iso> Communicaton command set",
"--schann <d40|ev1|ev2|lrp> Secure channel",
"--aid <hex> Application ID of application for some parameters (3 hex bytes, big endian)",
"--isoid <hex> Application ISO ID (ISO DF ID) (2 hex bytes, big endian)",
"--save saves channels parameters to defaults if authentication succeeds"
],
"usage": "hf mfdes auth [-hav] [-n <dec>] [-t <DES|2TDEA|3TDEA|AES>] [-k <hex>] [--kdf <none|AN10922|gallagher>] [-i <hex>] [-m <plain|mac|encrypt>] [-c <native|niso|iso>] [--schann <d40|ev1|ev2|lrp>] [--aid <hex>] [--isoid <hex>] [--save]"
},
"hf mfdes bruteaid": {
"command": "hf mfdes bruteaid",
"description": "Recover AIDs by bruteforce. WARNING: This command takes a loooong time",
"notes": [
"hf mfdes bruteaid -> Search all apps",
"hf mfdes bruteaid --start F0000F -i 16 -> Search MAD range manually"
],
"offline": false,
"options": [
"-h, --help This help",
"--start <hex> Starting App ID as hex bytes (3 bytes, big endian)",
"--end <hex> Last App ID as hex bytes (3 bytes, big endian)",
"-i, --step <dec> Increment step when bruteforcing",
"-m, --mad Only bruteforce the MAD range"
],
"usage": "hf mfdes bruteaid [-hm] [--start <hex>] [--end <hex>] [-i <dec>]"
},
"hf mfdes changekey": {
"command": "hf mfdes changekey",
"description": "Change PICC/Application key. Needs to provide keynum/key for a valid authentication (may get from default parameters).",
"notes": [
"Change crypto algorithm for PICC key is possible,",
"but for APP keys crypto algorithm is set by createapp command and can't be changed wo application delete",
"",
"hf mfdes changekey --aid 123456 -> execute with default factory setup. change des key 0 in the app 123456 from 00..00 to 00..00",
"hf mfdes changekey --isoid df01 -t aes --schann lrp --newkeyno 01 -> change key 01 via lrp channelhf mfdes changekey -t des --newalgo aes --newkey 11223344556677889900112233445566 --newver a5 -> change card master key to AES one",
"hf mfdes changekey --aid 123456 -t aes --key 00000000000000000000000000000000 --newkey 11223344556677889900112233445566 -> change app master key",
"hf mfdes changekey --aid 123456 -t des -n 0 --newkeyno 1 --oldkey 5555555555555555 --newkey 1122334455667788 -> change key 1 with auth from key 0",
"hf mfdes changekey --aid 123456 -t 3tdea --newkey 112233445566778899001122334455667788990011223344 -> change 3tdea key 0 from default 00..00 to provided"
],
"offline": false,
"options": [
"-h, --help This help",
"-a, --apdu Show APDU requests and responses",
"-v, --verbose Verbose output",
"-n, --keyno <dec> Key number",
"-t, --algo <DES|2TDEA|3TDEA|AES> Crypt algo",
"-k, --key <hex> Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)",
"--kdf <none|AN10922|gallagher> Key Derivation Function (KDF)",
"-i, --kdfi <hex> KDF input (1-31 hex bytes)",
"-m, --cmode <plain|mac|encrypt> Communicaton mode",
"-c, --ccset <native|niso|iso> Communicaton command set",
"--schann <d40|ev1|ev2|lrp> Secure channel",
"--aid <hex> Application ID of application (3 hex bytes, big endian)",
"--isoid <hex> Application ISO ID (ISO DF ID) (2 hex bytes, big endian).",
"--oldalgo <DES|2TDEA|3TDEA|AES> Old key crypto algorithm",
"--oldkey <old key> Old key (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)",
"--newkeyno <dec> Key number for change",
"--newalgo <DES|2TDEA|3TDEA|AES> New key crypto algorithm",
"--newkey <hex> New key (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)",
"--newver <hex> Version of new key (1 hex byte)"
],
"usage": "hf mfdes changekey [-hav] [-n <dec>] [-t <DES|2TDEA|3TDEA|AES>] [-k <hex>] [--kdf <none|AN10922|gallagher>] [-i <hex>] [-m <plain|mac|encrypt>] [-c <native|niso|iso>] [--schann <d40|ev1|ev2|lrp>] [--aid <hex>] [--isoid <hex>] [--oldalgo <DES|2TDEA|3TDEA|AES>] [--oldkey <old key>] [--newkeyno <dec>] [--newalgo <DES|2TDEA|3TDEA|AES>] [--newkey <hex>] [--newver <hex>]"
},
"hf mfdes chfilesettings": {
"command": "hf mfdes chfilesettings",
"description": "Get File Settings from file from application. Master key needs to be provided or flag --no-auth set (depend on cards settings).",
"notes": [
"hf mfdes chfilesettings --aid 123456 --fid 01 --amode plain --rrights free --wrights free --rwrights free --chrights key0 -> change file settings app=123456, file=01 with defaults from `default` command",
"hf mfdes chfilesettings -n 0 -t des -k 0000000000000000 --kdf none --aid 123456 --fid 01 --rawdata 00EEEE -> execute with default factory setup",
"hf mfdes chfilesettings --aid 123456 --fid 01 --rawdata 810000021f112f22 -> change file settings with additional rights for keys 1 and 2",
"hf mfdes chfilesettings --isoid df01 --fid 00 --amode plain --rawrights eee0 --schann lrp -t aes -> change file settings via lrp channel"
],
"offline": false,
"options": [
"-h, --help This help",
"-a, --apdu Show APDU requests and responses",
"-v, --verbose Verbose output",
"-n, --keyno <dec> Key number",
"-t, --algo <DES|2TDEA|3TDEA|AES> Crypt algo",
"-k, --key <hex> Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)",
"--kdf <none|AN10922|gallagher> Key Derivation Function (KDF)",
"-i, --kdfi <hex> KDF input (1-31 hex bytes)",
"-m, --cmode <plain|mac|encrypt> Communicaton mode",
"-c, --ccset <native|niso|iso> Communicaton command set",
"--schann <d40|ev1|ev2|lrp> Secure channel",
"--aid <hex> Application ID (3 hex bytes, big endian)",
"--isoid <hex> Application ISO ID (ISO DF ID) (2 hex bytes, big endian)",
"--fid <hex> File ID (1 hex byte)",
"--rawdata <hex> File settings (HEX > 5 bytes). Have priority over the other settings",
"--amode <plain|mac|encrypt> File access mode",
"--rawrights <hex> Access rights for file (2 hex bytes) R/W/RW/Chg, 0x0 - 0xD Key, 0xE Free, 0xF Denied",
"--rrights <key0..13|free|deny> Read file access mode: the specified key, free, deny",
"--wrights <key0..13|free|deny> Write file access mode: the specified key, free, deny",
"--rwrights <key0..13|free|deny> Read/Write file access mode: the specified key, free, deny",
"--chrights <key0..13|free|deny> Change file settings access mode: the specified key, free, deny",
"--no-auth Execute without authentication"
],
"usage": "hf mfdes chfilesettings [-hav] [-n <dec>] [-t <DES|2TDEA|3TDEA|AES>] [-k <hex>] [--kdf <none|AN10922|gallagher>] [-i <hex>] [-m <plain|mac|encrypt>] [-c <native|niso|iso>] [--schann <d40|ev1|ev2|lrp>] [--aid <hex>] [--isoid <hex>] [--fid <hex>] [--rawdata <hex>] [--amode <plain|mac|encrypt>] [--rawrights <hex>] [--rrights <key0..13|free|deny>] [--wrights <key0..13|free|deny>] [--rwrights <key0..13|free|deny>] [--chrights <key0..13|free|deny>] [--no-auth]"
},
"hf mfdes chk": {
"command": "hf mfdes chk",
"description": "Checks keys with MIFARE DESFire card.",
"notes": [
"hf mfdes chk --aid 123456 -k 000102030405060708090a0b0c0d0e0f -> check key on aid 0x123456",
"hf mfdes chk -d mfdes_default_keys -> check keys against all existing aid on card",
"hf mfdes chk -d mfdes_default_keys --aid 123456 -> check keys against aid 0x123456",
"hf mfdes chk --aid 123456 --pattern1b -j keys -> check all 1-byte keys pattern on aid 0x123456 and save found keys to `keys.json`",
"hf mfdes chk --aid 123456 --pattern2b --startp2b FA00 -> check all 2-byte keys pattern on aid 0x123456. Start from key FA00FA00...FA00"
],
"offline": false,
"options": [
"-h, --help This help",
"--aid <hex> Use specific AID (3 hex bytes, big endian)",
"-k, --key <hex> Key for checking (HEX 16 bytes)",
"-d, --dict <fn> Dictionary file with keys",
"--pattern1b Check all 1-byte combinations of key (0000...0000, 0101...0101, 0202...0202, ...)",
"--pattern2b Check all 2-byte combinations of key (0000...0000, 0001...0001, 0002...0002, ...)",
"--startp2b <pattern> Start key (2-byte HEX) for 2-byte search (use with `--pattern2b`)",
"-j, --json <fn> Json file name to save keys",
"-v, --verbose Verbose output",
"--kdf <0|1|2> Key Derivation Function (KDF) (0=None, 1=AN10922, 2=Gallagher)",
"-i, --kdfi <hex> KDF input (1-31 hex bytes)",
"-a, --apdu Show APDU requests and responses"
],
"usage": "hf mfdes chk [-hva] [--aid <hex>] [-k <hex>] [-d <fn>] [--pattern1b] [--pattern2b] [--startp2b <pattern>] [-j <fn>] [--kdf <0|1|2>] [-i <hex>]"
},
"hf mfdes chkeysettings": {
"command": "hf mfdes chkeysettings",
"description": "Change key settings for card level or application level. WARNING: card level changes may block the card!",
"notes": [
"hf mfdes chkeysettings -d 0f -> set picc key settings with default key/channel setup",
"hf mfdes chkeysettings --aid 123456 -d 0f -> set app 123456 key settings with default key/channel setup"
],
"offline": false,
"options": [
"-h, --help This help",
"-a, --apdu Show APDU requests and responses",
"-v, --verbose Verbose output",
"-n, --keyno <dec> Key number",
"-t, --algo <DES|2TDEA|3TDEA|AES> Crypt algo",
"-k, --key <hex> Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)",
"--kdf <none|AN10922|gallagher> Key Derivation Function (KDF)",
"-i, --kdfi <hex> KDF input (1-31 hex bytes)",
"-m, --cmode <plain|mac|encrypt> Communicaton mode",
"-c, --ccset <native|niso|iso> Communicaton command set",
"--schann <d40|ev1|ev2|lrp> Secure channel",
"--aid <hex> Application ID (3 hex bytes, big endian)",
"-d, --data <HEX> Key settings (1 hex byte)"
],
"usage": "hf mfdes chkeysettings [-hav] [-n <dec>] [-t <DES|2TDEA|3TDEA|AES>] [-k <hex>] [--kdf <none|AN10922|gallagher>] [-i <hex>] [-m <plain|mac|encrypt>] [-c <native|niso|iso>] [--schann <d40|ev1|ev2|lrp>] [--aid <hex>] [-d <HEX>]"
},
"hf mfdes clearrecfile": {
"command": "hf mfdes clearrecfile",
"description": "Clear record file. Master key needs to be provided or flag --no-auth set (depend on cards settings).",
"notes": [
"hf mfdes clearrecfile --aid 123456 --fid 01 -> clear record file for: app=123456, file=01 with defaults from `default` command",
"hf mfdes clearrecfile --isoid df01 --fid 01 --schann lrp -t aes -n 3 -> clear record file for lrp channel with key number 3"
],
"offline": false,
"options": [
"-h, --help This help",
"-a, --apdu Show APDU requests and responses",
"-v, --verbose Verbose output",
"-n, --keyno <dec> Key number",
"-t, --algo <DES|2TDEA|3TDEA|AES> Crypt algo",
"-k, --key <hex> Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)",
"--kdf <none|AN10922|gallagher> Key Derivation Function (KDF)",
"-i, --kdfi <hex> KDF input (1-31 hex bytes)",
"-m, --cmode <plain|mac|encrypt> Communicaton mode",
"-c, --ccset <native|niso|iso> Communicaton command set",
"--schann <d40|ev1|ev2|lrp> Secure channel",
"--aid <hex> Application ID (3 hex bytes, big endian)",
"--isoid <hex> Application ISO ID (ISO DF ID) (2 hex bytes, big endian)",
"--fid <hex> File ID for clearing (1 hex byte)",
"--no-auth Execute without authentication"
],
"usage": "hf mfdes clearrecfile [-hav] [-n <dec>] [-t <DES|2TDEA|3TDEA|AES>] [-k <hex>] [--kdf <none|AN10922|gallagher>] [-i <hex>] [-m <plain|mac|encrypt>] [-c <native|niso|iso>] [--schann <d40|ev1|ev2|lrp>] [--aid <hex>] [--isoid <hex>] [--fid <hex>] [--no-auth]"
},
"hf mfdes createapp": {
"command": "hf mfdes createapp",
"description": "Create application. Master key needs to be provided.",
"notes": [
"option rawdata have priority over the rest settings, and options ks1 and ks2 have priority over corresponded key settings",
"",
"KeySetting 1 (AMK Setting, ks1):",
"0: Allow change master key. 1 - allow, 0 - frozen",
"1: Free Directory list access without master key",
"0: AMK auth needed for GetFileSettings and GetKeySettings",
"1: No AMK auth needed for GetFileIDs, GetISOFileIDs, GetFileSettings, GetKeySettings",
"2: Free create/delete without master key",
"0: CreateFile/DeleteFile only with AMK auth",
"1: CreateFile/DeleteFile always",
"3: Configuration changeable",
"0: Configuration frozen",
"1: Configuration changeable if authenticated with AMK (default)",
"4-7: ChangeKey Access Rights",
"0: Application master key needed (default)",
"0x1..0xD: Auth with specific key needed to change any key",
"0xE: Auth with the key to be changed (same KeyNo) is necessary to change a key",
"0xF: All Keys within this application are frozen",
"",
"KeySetting 2 (ks2):",
"0..3: Number of keys stored within the application (max. 14 keys)",
"4: ks3 is present",
"5: Use of 2 byte ISO FID, 0: No, 1: Yes",
"6..7: Crypto Method 00: DES|2TDEA, 01: 3TDEA, 10: AES, 11: RFU",
"Example:",
"2E = with FID, DES|2TDEA, 14 keys",
"6E = with FID, 3TDEA, 14 keys",
"AE = with FID, AES, 14 keys",
"",
"hf mfdes createapp --rawdata 5634122F2E4523616964313233343536 -> execute create by rawdata",
"hf mfdes createapp --aid 123456 --fid 2345 --dfname aid123456 -> app aid, iso file id, and iso df name is specified",
"hf mfdes createapp --aid 123456 --fid 2345 --dfname aid123456 --dstalgo aes -> with algorithm for key AES"
],
"offline": false,
"options": [
"-h, --help This help",
"-a, --apdu Show APDU requests and responses",
"-v, --verbose Verbose output",
"-n, --keyno <dec> Key number",
"-t, --algo <DES|2TDEA|3TDEA|AES> Crypt algo",
"-k, --key <hex> Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)",
"--kdf <none|AN10922|gallagher> Key Derivation Function (KDF)",
"-i, --kdfi <hex> KDF input (1-31 hex bytes)",
"-m, --cmode <plain|mac|encrypt> Communicaton mode",
"-c, --ccset <native|niso|iso> Communicaton command set",
"--schann <d40|ev1|ev2|lrp> Secure channel",
"--rawdata <hex> Raw data that sends to command",
"--aid <hex> Application ID for create. Mandatory. (3 hex bytes, big endian)",
"--fid <hex> ISO file ID. Forbidden values: 0000 3F00, 3FFF, FFFF. (2 hex bytes, big endian)",
"--dfname <string> ISO DF Name (1..16 chars)",
"--dfhex <hex> ISO DF Name as hex (1..16 bytes)",
"--ks1 <hex> Key settings 1 (1 hex byte). Application Master Key Settings (def: 0x0F)",
"--ks2 <hex> Key settings 2 (1 hex byte). (def: 0x0E)",
"--dstalgo <DES|2TDEA|3TDEA|AES> Application key crypt algo (def: DES)",
"--numkeys <dec> Number of keys 0x00..0x0e (def: 0x0E)",
"--no-auth Execute without authentication"
],
"usage": "hf mfdes createapp [-hav] [-n <dec>] [-t <DES|2TDEA|3TDEA|AES>] [-k <hex>] [--kdf <none|AN10922|gallagher>] [-i <hex>] [-m <plain|mac|encrypt>] [-c <native|niso|iso>] [--schann <d40|ev1|ev2|lrp>] [--rawdata <hex>] [--aid <hex>] [--fid <hex>] [--dfname <string>] [--dfhex <hex>] [--ks1 <hex>] [--ks2 <hex>] [--dstalgo <DES|2TDEA|3TDEA|AES>] [--numkeys <dec>] [--no-auth]"
},
"hf mfdes createfile": {
"command": "hf mfdes createfile",
"description": "Create Standard/Backup file in the application. Application master key needs to be provided or flag --no-auth set (depend on application settings).",
"notes": [
"--rawtype/--rawdata have priority over the other settings. and with these parameters you can create any file. file id comes from parameters, all the rest data must be in the --rawdata parameter",
"--rawrights have priority over the separate rights settings.",
"Key/mode/etc of the authentication depends on application settings",
"hf mfdes createfile --aid 123456 --fid 01 --isofid 0001 --size 000010 -> create file with iso id. Authentication with defaults from `default` command",
"hf mfdes createfile --aid 123456 --fid 01 --rawtype 01 --rawdata 000100EEEE000100 -> create file via sending rawdata to the card. Can be used to create any type of file. Authentication with defaults from `default` command",
"hf mfdes createfile --aid 123456 --fid 01 --amode plain --rrights free --wrights free --rwrights free --chrights key0 -> create file app=123456, file=01 and mentioned rights with defaults from `default` command",
"hf mfdes createfile -n 0 -t des -k 0000000000000000 --kdf none --aid 123456 --fid 01 --rawtype 00 --rawdata 00EEEE000100 -> execute with default factory setup"
],
"offline": false,
"options": [
"-h, --help This help",
"-a, --apdu Show APDU requests and responses",
"-v, --verbose Verbose output",
"-n, --keyno <dec> Key number",
"-t, --algo <DES|2TDEA|3TDEA|AES> Crypt algo",
"-k, --key <hex> Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)",
"--kdf <none|AN10922|gallagher> Key Derivation Function (KDF)",
"-i, --kdfi <hex> KDF input (1-31 hex bytes)",
"-m, --cmode <plain|mac|encrypt> Communicaton mode",
"-c, --ccset <native|niso|iso> Communicaton command set",
"--schann <d40|ev1|ev2|lrp> Secure channel",
"--aid <hex> Application ID (3 hex bytes, big endian)",
"--fid <hex> File ID (1 hex byte)",
"--isofid <hex> ISO File ID (2 hex bytes)",
"--rawtype <hex> Raw file type (1 hex byte)",
"--rawdata <hex> Raw file settings (hex > 5 bytes)",
"--amode <plain|mac|encrypt> File access mode",
"--rawrights <hex> Access rights for file (2 hex bytes) R/W/RW/Chg, 0x0 - 0xD Key, 0xE Free, 0xF Denied",
"--rrights <key0..key13|free|deny> Read file access mode: the specified key, free, deny",
"--wrights <key0..key13|free|deny> Write file access mode: the specified key, free, deny",
"--rwrights <key0..key13|free|deny> Read/Write file access mode: the specified key, free, deny",
"--chrights <key0..key13|free|deny> Change file settings access mode: the specified key, free, deny",
"--no-auth Execute without authentication",
"--size <hex> File size (3 hex bytes, big endian)",
"--backup Create backupfile instead of standard file"
],
"usage": "hf mfdes createfile [-hav] [-n <dec>] [-t <DES|2TDEA|3TDEA|AES>] [-k <hex>] [--kdf <none|AN10922|gallagher>] [-i <hex>] [-m <plain|mac|encrypt>] [-c <native|niso|iso>] [--schann <d40|ev1|ev2|lrp>] [--aid <hex>] [--fid <hex>] [--isofid <hex>] [--rawtype <hex>] [--rawdata <hex>] [--amode <plain|mac|encrypt>] [--rawrights <hex>] [--rrights <key0..key13|free|deny>] [--wrights <key0..key13|free|deny>] [--rwrights <key0..key13|free|deny>] [--chrights <key0..key13|free|deny>] [--no-auth] [--size <hex>] [--backup]"
},
"hf mfdes createmacfile": {
"command": "hf mfdes createmacfile",
"description": "Create Transaction MAC file in the application. Application master key needs to be provided or flag --no-auth set (depend on application settings).",
"notes": [
"--rawrights have priority over the separate rights settings.",
"Key/mode/etc of the authentication depends on application settings",
"Write right should be always 0xF. Read-write right should be 0xF if you not need to submit CommitReaderID command each time transaction starts",
"",
"hf mfdes createmacfile --aid 123456 --fid 01 --rawrights 0FF0 --mackey 00112233445566778899aabbccddeeff --mackeyver 01 -> create transaction mac file with parameters. Rights from default. Authentication with defaults from `default` command",
"hf mfdes createmacfile --aid 123456 --fid 01 --amode plain --rrights free --wrights deny --rwrights free --chrights key0 --mackey 00112233445566778899aabbccddeeff -> create file app=123456, file=01, with key, and mentioned rights with defaults from `default` command",
"hf mfdes createmacfile -n 0 -t des -k 0000000000000000 --kdf none --aid 123456 --fid 01 -> execute with default factory setup. key and keyver == 0x00..00",
"hf mfdes createmacfile --isoid df01 --fid 0f --schann lrp -t aes --rawrights 0FF0 --mackey 00112233445566778899aabbccddeeff --mackeyver 01 -> create transaction mac file via lrp channel",
"hf mfdes createmacfile --isoid df01 --fid 0f --schann lrp -t aes --rawrights 0F10 --mackey 00112233445566778899aabbccddeeff --mackeyver 01 -> create transaction mac file via lrp channel with CommitReaderID command enable"
],
"offline": false,
"options": [
"-h, --help This help",
"-a, --apdu Show APDU requests and responses",
"-v, --verbose Verbose output",
"-n, --keyno <dec> Key number",
"-t, --algo <DES|2TDEA|3TDEA|AES> Crypt algo",
"-k, --key <hex> Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)",
"--kdf <none|AN10922|gallagher> Key Derivation Function (KDF)",
"-i, --kdfi <hex> KDF input (1-31 hex bytes)",
"-m, --cmode <plain|mac|encrypt> Communicaton mode",
"-c, --ccset <native|niso|iso> Communicaton command set",
"--schann <d40|ev1|ev2|lrp> Secure channel",
"--aid <hex> Application ID (3 hex bytes, big endian)",
"--isoid <hex> Application ISO ID (ISO DF ID) (2 hex bytes, big endian)",
"--fid <hex> File ID (1 hex byte)",
"--amode <plain|mac|encrypt> File access mode",
"--rawrights <hex> Access rights for file (2 hex bytes) R/W/RW/Chg, 0x0 - 0xD Key, 0xE Free, 0xF Denied",
"--rrights <key0..key13|free|deny> Read file access mode: the specified key, free, deny",
"--wrights <key0..key13|free|deny> Write file access mode: the specified key, free, deny",
"--rwrights <key0..key13|free|deny> Read/Write file access mode: the specified key, free, deny",
"--chrights <key0..key13|free|deny> Change file settings access mode: the specified key, free, deny",
"--no-auth Execute without authentication",
"--mackey <hex> AES-128 key for MAC (16 hex bytes, big endian). (def: all zeros)",
"--mackeyver <hex> AES key version for MAC (1 hex byte). (def: 0x0)"
],
"usage": "hf mfdes createmacfile [-hav] [-n <dec>] [-t <DES|2TDEA|3TDEA|AES>] [-k <hex>] [--kdf <none|AN10922|gallagher>] [-i <hex>] [-m <plain|mac|encrypt>] [-c <native|niso|iso>] [--schann <d40|ev1|ev2|lrp>] [--aid <hex>] [--isoid <hex>] [--fid <hex>] [--amode <plain|mac|encrypt>] [--rawrights <hex>] [--rrights <key0..key13|free|deny>] [--wrights <key0..key13|free|deny>] [--rwrights <key0..key13|free|deny>] [--chrights <key0..key13|free|deny>] [--no-auth] [--mackey <hex>] [--mackeyver <hex>]"
},
"hf mfdes createrecordfile": {
"command": "hf mfdes createrecordfile",
"description": "Create Linear/Cyclic Record file in the application. Application master key needs to be provided or flag --no-auth set (depend on application settings).",
"notes": [
"--rawrights have priority over the separate rights settings.",
"Key/mode/etc of the authentication depends on application settings",
"hf mfdes createrecordfile --aid 123456 --fid 01 --size 000010 --maxrecord 000010 --cyclic -> create cyclic record file with parameters. Rights from default. Authentication with defaults from `default` command",
"hf mfdes createrecordfile --aid 123456 --fid 01 --amode plain --rrights free --wrights free --rwrights free --chrights key0 --size 000010 --maxrecord 000010 -> create linear record file app=123456, file=01 and mentioned rights with defaults from `default` command",
"hf mfdes createrecordfile -n 0 -t des -k 0000000000000000 --kdf none --aid 123456 --fid 01 --size 000010 --maxrecord 000010 -> execute with default factory setup"
],
"offline": false,
"options": [
"-h, --help This help",
"-a, --apdu Show APDU requests and responses",
"-v, --verbose Verbose output",
"-n, --keyno <dec> Key number",
"-t, --algo <DES|2TDEA|3TDEA|AES> Crypt algo",
"-k, --key <hex> Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)",
"--kdf <none|AN10922|gallagher> Key Derivation Function (KDF)",
"-i, --kdfi <hex> KDF input (1-31 hex bytes)",
"-m, --cmode <plain|mac|encrypt> Communicaton mode",
"-c, --ccset <native|niso|iso> Communicaton command set",
"--schann <d40|ev1|ev2|lrp> Secure channel",
"--aid <hex> Application ID (3 hex bytes, big endian)",
"--fid <hex> File ID (1 hex byte)",
"--isofid <hex> ISO File ID (2 hex bytes)",
"--amode <plain|mac|encrypt> File access mode",
"--rawrights <hex> Access rights for file (2 hex bytes) R/W/RW/Chg, 0x0 - 0xD Key, 0xE Free, 0xF Denied",
"--rrights <key0..key13|free|deny> Read file access mode: the specified key, free, deny",
"--wrights <key0..key13|free|deny> Write file access mode: the specified key, free, deny",
"--rwrights <key0..key13|free|deny> Read/Write file access mode: the specified key, free, deny",
"--chrights <key0..key13|free|deny> Change file settings access mode: the specified key, free, deny",
"--no-auth Execute without authentication",
"--size <hex> Record size (3 hex bytes, big endian, 000001 to FFFFFF)",
"--maxrecord <hex> Max. Number of Records (3 hex bytes, big endian)",
"--cyclic Create cyclic record file instead of linear record file"
],
"usage": "hf mfdes createrecordfile [-hav] [-n <dec>] [-t <DES|2TDEA|3TDEA|AES>] [-k <hex>] [--kdf <none|AN10922|gallagher>] [-i <hex>] [-m <plain|mac|encrypt>] [-c <native|niso|iso>] [--schann <d40|ev1|ev2|lrp>] [--aid <hex>] [--fid <hex>] [--isofid <hex>] [--amode <plain|mac|encrypt>] [--rawrights <hex>] [--rrights <key0..key13|free|deny>] [--wrights <key0..key13|free|deny>] [--rwrights <key0..key13|free|deny>] [--chrights <key0..key13|free|deny>] [--no-auth] [--size <hex>] [--maxrecord <hex>] [--cyclic]"
},
"hf mfdes createvaluefile": {
"command": "hf mfdes createvaluefile",
"description": "Create Value file in the application. Application master key needs to be provided or flag --no-auth set (depend on application settings).",
"notes": [
"--rawrights have priority over the separate rights settings.",
"Key/mode/etc of the authentication depends on application settings",
"hf mfdes createvaluefile --aid 123456 --fid 01 --lower 00000010 --upper 00010000 --value 00000100 -> create file with parameters. Rights from default. Authentication with defaults from `default` command",
"hf mfdes createvaluefile --aid 123456 --fid 01 --amode plain --rrights free --wrights free --rwrights free --chrights key0 -> create file app=123456, file=01 and mentioned rights with defaults from `default` command",
"hf mfdes createvaluefile -n 0 -t des -k 0000000000000000 --kdf none --aid 123456 --fid 01 -> execute with default factory setup"
],
"offline": false,
"options": [
"-h, --help This help",
"-a, --apdu Show APDU requests and responses",
"-v, --verbose Verbose output",
"-n, --keyno <dec> Key number",
"-t, --algo <DES|2TDEA|3TDEA|AES> Crypt algo",
"-k, --key <hex> Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)",
"--kdf <none|AN10922|gallagher> Key Derivation Function (KDF)",
"-i, --kdfi <hex> KDF input (1-31 hex bytes)",
"-m, --cmode <plain|mac|encrypt> Communicaton mode",
"-c, --ccset <native|niso|iso> Communicaton command set",
"--schann <d40|ev1|ev2|lrp> Secure channel",
"--aid <hex> Application ID (3 hex bytes, big endian)",
"--fid <hex> File ID (1 hex byte)",
"--amode <plain|mac|encrypt> File access mode",
"--rawrights <hex> Access rights for file (2 hex bytes) R/W/RW/Chg, 0x0 - 0xD Key, 0xE Free, 0xF Denied",
"--rrights <key0..key13|free|deny> Read file access mode: the specified key, free, deny",
"--wrights <key0..key13|free|deny> Write file access mode: the specified key, free, deny",
"--rwrights <key0..key13|free|deny> Read/Write file access mode: the specified key, free, deny",
"--chrights <key0..key13|free|deny> Change file settings access mode: the specified key, free, deny",
"--no-auth Execute without authentication",
"--lower <hex> Lower limit (4 hex bytes, big endian)",
"--upper <hex> Upper limit (4 hex bytes, big endian)",
"--value <hex> Value (4 hex bytes, big endian)",
"--lcredit <dec> Limited Credit enabled (Bit 0 = Limited Credit, 1 = FreeValue)"
],
"usage": "hf mfdes createvaluefile [-hav] [-n <dec>] [-t <DES|2TDEA|3TDEA|AES>] [-k <hex>] [--kdf <none|AN10922|gallagher>] [-i <hex>] [-m <plain|mac|encrypt>] [-c <native|niso|iso>] [--schann <d40|ev1|ev2|lrp>] [--aid <hex>] [--fid <hex>] [--amode <plain|mac|encrypt>] [--rawrights <hex>] [--rrights <key0..key13|free|deny>] [--wrights <key0..key13|free|deny>] [--rwrights <key0..key13|free|deny>] [--chrights <key0..key13|free|deny>] [--no-auth] [--lower <hex>] [--upper <hex>] [--value <hex>] [--lcredit <dec>]"
},
"hf mfdes default": {
"command": "hf mfdes default",
"description": "Set default parameters for access to MIFARE DESfire card.",
"notes": [
"hf mfdes default -n 0 -t des -k 0000000000000000 --kdf none -> save to the default parameters"
],
"offline": false,
"options": [
"-h, --help This help",
"-n, --keyno <dec> Key number",
"-t, --algo <DES|2TDEA|3TDEA|AES> Crypt algo",
"-k, --key <hex> Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)",
"--kdf <none|AN10922|gallagher> Key Derivation Function (KDF)",
"-i, --kdfi <hex> KDF input (1-31 hex bytes)",
"-m, --cmode <plain|mac|encrypt> Communicaton mode",
"-c, --ccset <native|niso|iso> Communicaton command set",
"--schann <d40|ev1|ev2|lrp> Secure channel"
],
"usage": "hf mfdes default [-h] [-n <dec>] [-t <DES|2TDEA|3TDEA|AES>] [-k <hex>] [--kdf <none|AN10922|gallagher>] [-i <hex>] [-m <plain|mac|encrypt>] [-c <native|niso|iso>] [--schann <d40|ev1|ev2|lrp>]"
},
"hf mfdes deleteapp": {
"command": "hf mfdes deleteapp",
"description": "Delete application by its 3-byte AID. Master key needs to be provided.",
"notes": [
"hf mfdes deleteapp --aid 123456 -> execute with default factory setup"
],
"offline": false,
"options": [
"-h, --help This help",
"-a, --apdu Show APDU requests and responses",
"-v, --verbose Verbose output",
"-n, --keyno <dec> Key number",
"-t, --algo <DES|2TDEA|3TDEA|AES> Crypt algo",
"-k, --key <hex> Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)",
"--kdf <none|AN10922|gallagher> Key Derivation Function (KDF)",
"-i, --kdfi <hex> KDF input (1-31 hex bytes)",
"-m, --cmode <plain|mac|encrypt> Communicaton mode",
"-c, --ccset <native|niso|iso> Communicaton command set",
"--schann <d40|ev1|ev2|lrp> Secure channel",
"--aid <hex> Application ID to delete (3 hex bytes, big endian)"
],
"usage": "hf mfdes deleteapp [-hav] [-n <dec>] [-t <DES|2TDEA|3TDEA|AES>] [-k <hex>] [--kdf <none|AN10922|gallagher>] [-i <hex>] [-m <plain|mac|encrypt>] [-c <native|niso|iso>] [--schann <d40|ev1|ev2|lrp>] [--aid <hex>]"
},
"hf mfdes deletefile": {
"command": "hf mfdes deletefile",
"description": "Delete file from application. Master key needs to be provided or flag --no-auth set (depend on cards settings).",
"notes": [
"hf mfdes deletefile --aid 123456 --fid 01 -> delete file for: app=123456, file=01 with defaults from `default` command",
"hf mfdes deletefile --isoid df01 --fid 0f --schann lrp -t aes -> delete file for lrp channel"
],
"offline": false,
"options": [
"-h, --help This help",
"-a, --apdu Show APDU requests and responses",
"-v, --verbose Verbose output",
"-n, --keyno <dec> Key number",
"-t, --algo <DES|2TDEA|3TDEA|AES> Crypt algo",
"-k, --key <hex> Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)",
"--kdf <none|AN10922|gallagher> Key Derivation Function (KDF)",
"-i, --kdfi <hex> KDF input (1-31 hex bytes)",
"-m, --cmode <plain|mac|encrypt> Communicaton mode",
"-c, --ccset <native|niso|iso> Communicaton command set",
"--schann <d40|ev1|ev2|lrp> Secure channel",
"--aid <hex> Application ID (3 hex bytes, big endian)",
"--isoid <hex> Application ISO ID (ISO DF ID) (2 hex bytes, big endian)",
"--fid <hex> File ID (1 hex byte)",
"--no-auth Execute without authentication"
],
"usage": "hf mfdes deletefile [-hav] [-n <dec>] [-t <DES|2TDEA|3TDEA|AES>] [-k <hex>] [--kdf <none|AN10922|gallagher>] [-i <hex>] [-m <plain|mac|encrypt>] [-c <native|niso|iso>] [--schann <d40|ev1|ev2|lrp>] [--aid <hex>] [--isoid <hex>] [--fid <hex>] [--no-auth]"
},
"hf mfdes detect": {
"command": "hf mfdes detect",
"description": "Detect key type and tries to find one from the list.",
"notes": [
"hf mfdes detect -> detect key 0 from PICC level",
"hf mfdes detect --schann d40 -> detect key 0 from PICC level via secure channel D40",
"hf mfdes detect --dict mfdes_default_keys -> detect key 0 from PICC level with help of the standard dictionary",
"hf mfdes detect --aid 123456 -n 2 --save -> detect key 2 from app 123456 and if succeed - save params to defaults (`default` command)",
"hf mfdes detect --isoid df01 --save -> detect key 0 and save to defaults with card in the LRP mode"
],
"offline": false,
"options": [
"-h, --help This help",
"-a, --apdu Show APDU requests and responses",
"-v, --verbose Verbose output",
"-n, --keyno <dec> Key number",
"-t, --algo <DES|2TDEA|3TDEA|AES> Crypt algo",
"-k, --key <hex> Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)",
"--kdf <none|AN10922|gallagher> Key Derivation Function (KDF)",
"-i, --kdfi <hex> KDF input (1-31 hex bytes)",
"-m, --cmode <plain|mac|encrypt> Communicaton mode",
"-c, --ccset <native|niso|iso> Communicaton command set",
"--schann <d40|ev1|ev2|lrp> Secure channel",
"--aid <hex> Application ID (3 hex bytes, big endian)",
"--isoid <hex> Application ISO ID (ISO DF ID) (2 hex bytes, big endian).",
"--dict <fn> Dictionary file name with keys",
"--save Save found key and parameters to defaults"
],
"usage": "hf mfdes detect [-hav] [-n <dec>] [-t <DES|2TDEA|3TDEA|AES>] [-k <hex>] [--kdf <none|AN10922|gallagher>] [-i <hex>] [-m <plain|mac|encrypt>] [-c <native|niso|iso>] [--schann <d40|ev1|ev2|lrp>] [--aid <hex>] [--isoid <hex>] [--dict <fn>] [--save]"
},
"hf mfdes dump": {
"command": "hf mfdes dump",
"description": "For each application show fil list and then file content. Key needs to be provided for authentication or flag --no-auth set (depend on cards settings).",
"notes": [
"hf mfdes dump --aid 123456 -> show file dump for: app=123456 with channel defaults from `default` command/nhf mfdes dump --isoid df01 --schann lrp -t aes --length 000090 -> lrp default settings with length limit"
],
"offline": false,
"options": [
"-h, --help This help",
"-a, --apdu Show APDU requests and responses",
"-v, --verbose Verbose output",
"-n, --keyno <dec> Key number",
"-t, --algo <DES|2TDEA|3TDEA|AES> Crypt algo",
"-k, --key <hex> Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)",
"--kdf <none|AN10922|gallagher> Key Derivation Function (KDF)",
"-i, --kdfi <hex> KDF input (1-31 hex bytes)",
"-m, --cmode <plain|mac|encrypt> Communicaton mode",
"-c, --ccset <native|niso|iso> Communicaton command set",
"--schann <d40|ev1|ev2|lrp> Secure channel",
"--aid <hex> Application ID (3 hex bytes, big endian)",
"--isoid <hex> Application ISO ID (ISO DF ID) (2 hex bytes, big endian)",
"-l, --length <hex> Maximum length for read data files (3 hex bytes, big endian)",
"--no-auth Execute without authentication"
],
"usage": "hf mfdes dump [-hav] [-n <dec>] [-t <DES|2TDEA|3TDEA|AES>] [-k <hex>] [--kdf <none|AN10922|gallagher>] [-i <hex>] [-m <plain|mac|encrypt>] [-c <native|niso|iso>] [--schann <d40|ev1|ev2|lrp>] [--aid <hex>] [--isoid <hex>] [-l <hex>] [--no-auth]"
},
"hf mfdes formatpicc": {
"command": "hf mfdes formatpicc",
"description": "Format card. Can be done only if enabled in the configuration. Master key needs to be provided.",
"notes": [
"hf mfdes formatpicc -> execute with default factory setup"
],
"offline": false,
"options": [
"-h, --help This help",
"-a, --apdu Show APDU requests and responses",
"-v, --verbose Verbose output",
"-n, --keyno <dec> Key number",
"-t, --algo <DES|2TDEA|3TDEA|AES> Crypt algo",
"-k, --key <hex> Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)",
"--kdf <none|AN10922|gallagher> Key Derivation Function (KDF)",
"-i, --kdfi <hex> KDF input (1-31 hex bytes)",
"-m, --cmode <plain|mac|encrypt> Communicaton mode",
"-c, --ccset <native|niso|iso> Communicaton command set",
"--schann <d40|ev1|ev2|lrp> Secure channel",
"--aid <hex> Application ID of delegated application (3 hex bytes, big endian)"
],
"usage": "hf mfdes formatpicc [-hav] [-n <dec>] [-t <DES|2TDEA|3TDEA|AES>] [-k <hex>] [--kdf <none|AN10922|gallagher>] [-i <hex>] [-m <plain|mac|encrypt>] [-c <native|niso|iso>] [--schann <d40|ev1|ev2|lrp>] [--aid <hex>]"
},
"hf mfdes freemem": {
"command": "hf mfdes freemem",
"description": "Get card's free memory. Can be done with or without authentication. Master key may be provided.",
"notes": [
"hf mfdes getfreemem -> execute with default factory setup"
],
"offline": false,
"options": [
"-h, --help This help",
"-a, --apdu Show APDU requests and responses",
"-v, --verbose Verbose output",
"-n, --keyno <dec> Key number",
"-t, --algo <DES|2TDEA|3TDEA|AES> Crypt algo",
"-k, --key <hex> Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)",
"--kdf <none|AN10922|gallagher> Key Derivation Function (KDF)",
"-i, --kdfi <hex> KDF input (1-31 hex bytes)",
"-m, --cmode <plain|mac|encrypt> Communicaton mode",
"-c, --ccset <native|niso|iso> Communicaton command set",
"--schann <d40|ev1|ev2|lrp> Secure channel",
"--no-auth Execute without authentication"
],
"usage": "hf mfdes getfreemem [-hav] [-n <dec>] [-t <DES|2TDEA|3TDEA|AES>] [-k <hex>] [--kdf <none|AN10922|gallagher>] [-i <hex>] [-m <plain|mac|encrypt>] [-c <native|niso|iso>] [--schann <d40|ev1|ev2|lrp>] [--no-auth]"
},
"hf mfdes getaids": {
"command": "hf mfdes getaids",
"description": "Get Application IDs list from card. Master key needs to be provided or flag --no-auth set.",
"notes": [
"hf mfdes getaids -n 0 -t des -k 0000000000000000 --kdf none -> execute with default factory setup"
],
"offline": false,
"options": [
"-h, --help This help",
"-a, --apdu Show APDU requests and responses",
"-v, --verbose Verbose output",
"-n, --keyno <dec> Key number",
"-t, --algo <DES|2TDEA|3TDEA|AES> Crypt algo",
"-k, --key <hex> Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)",
"--kdf <none|AN10922|gallagher> Key Derivation Function (KDF)",
"-i, --kdfi <hex> KDF input (1-31 hex bytes)",
"-m, --cmode <plain|mac|encrypt> Communicaton mode",
"-c, --ccset <native|niso|iso> Communicaton command set",
"--schann <d40|ev1|ev2|lrp> Secure channel",
"--no-auth Execute without authentication"
],
"usage": "hf mfdes getaids [-hav] [-n <dec>] [-t <DES|2TDEA|3TDEA|AES>] [-k <hex>] [--kdf <none|AN10922|gallagher>] [-i <hex>] [-m <plain|mac|encrypt>] [-c <native|niso|iso>] [--schann <d40|ev1|ev2|lrp>] [--no-auth]"
},
"hf mfdes getappnames": {
"command": "hf mfdes getappnames",
"description": "Get Application IDs, ISO IDs and DF names from card. Master key needs to be provided or flag --no-auth set.",
"notes": [
"hf mfdes getappnames -n 0 -t des -k 0000000000000000 --kdf none -> execute with default factory setup"
],
"offline": false,
"options": [
"-h, --help This help",
"-a, --apdu Show APDU requests and responses",
"-v, --verbose Verbose output",
"-n, --keyno <dec> Key number",
"-t, --algo <DES|2TDEA|3TDEA|AES> Crypt algo",
"-k, --key <hex> Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)",
"--kdf <none|AN10922|gallagher> Key Derivation Function (KDF)",
"-i, --kdfi <hex> KDF input (1-31 hex bytes)",
"-m, --cmode <plain|mac|encrypt> Communicaton mode",
"-c, --ccset <native|niso|iso> Communicaton command set",
"--schann <d40|ev1|ev2|lrp> Secure channel",
"--no-auth Execute without authentication"
],
"usage": "hf mfdes getappnames [-hav] [-n <dec>] [-t <DES|2TDEA|3TDEA|AES>] [-k <hex>] [--kdf <none|AN10922|gallagher>] [-i <hex>] [-m <plain|mac|encrypt>] [-c <native|niso|iso>] [--schann <d40|ev1|ev2|lrp>] [--no-auth]"
},
"hf mfdes getfileids": {
"command": "hf mfdes getfileids",
"description": "Get File IDs list from card. Master key needs to be provided or flag --no-auth set.",
"notes": [
"hf mfdes getfileids --aid 123456 -> execute with defaults from `default` command",
"hf mfdes getfileids -n 0 -t des -k 0000000000000000 --kdf none --aid 123456 -> execute with default factory setup"
],
"offline": false,
"options": [
"-h, --help This help",
"-a, --apdu Show APDU requests and responses",
"-v, --verbose Verbose output",
"-n, --keyno <dec> Key number",
"-t, --algo <DES|2TDEA|3TDEA|AES> Crypt algo",
"-k, --key <hex> Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)",
"--kdf <none|AN10922|gallagher> Key Derivation Function (KDF)",
"-i, --kdfi <hex> KDF input (1-31 hex bytes)",
"-m, --cmode <plain|mac|encrypt> Communicaton mode",
"-c, --ccset <native|niso|iso> Communicaton command set",
"--schann <d40|ev1|ev2|lrp> Secure channel",
"--aid <hex> Application ID (3 hex bytes, big endian)",
"--isoid <hex> Application ISO ID (ISO DF ID) (2 hex bytes, big endian).",
"--no-auth Execute without authentication"
],
"usage": "hf mfdes getfileids [-hav] [-n <dec>] [-t <DES|2TDEA|3TDEA|AES>] [-k <hex>] [--kdf <none|AN10922|gallagher>] [-i <hex>] [-m <plain|mac|encrypt>] [-c <native|niso|iso>] [--schann <d40|ev1|ev2|lrp>] [--aid <hex>] [--isoid <hex>] [--no-auth]"
},
"hf mfdes getfileisoids": {
"command": "hf mfdes getfileisoids",
"description": "Get File IDs list from card. Master key needs to be provided or flag --no-auth set.",
"notes": [
"hf mfdes getfileisoids --aid 123456 -> execute with defaults from `default` command",
"hf mfdes getfileisoids -n 0 -t des -k 0000000000000000 --kdf none --aid 123456 -> execute with default factory setup",
"hf mfdes getfileisoids --isoid df01 -> get iso file ids from Desfire Light with factory card settings",
"hf mfdes getfileisoids --isoid df01 --schann lrp -t aes -> get iso file ids from Desfire Light via lrp channel with default key authentication"
],
"offline": false,
"options": [
"-h, --help This help",
"-a, --apdu Show APDU requests and responses",
"-v, --verbose Verbose output",
"-n, --keyno <dec> Key number",
"-t, --algo <DES|2TDEA|3TDEA|AES> Crypt algo",
"-k, --key <hex> Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)",
"--kdf <none|AN10922|gallagher> Key Derivation Function (KDF)",
"-i, --kdfi <hex> KDF input (1-31 hex bytes)",
"-m, --cmode <plain|mac|encrypt> Communicaton mode",
"-c, --ccset <native|niso|iso> Communicaton command set",
"--schann <d40|ev1|ev2|lrp> Secure channel",
"--aid <hex> Application ID (3 hex bytes, big endian)",
"--isoid <hex> Application ISO ID (ISO DF ID) (2 hex bytes, big endian).",
"--no-auth Execute without authentication"
],
"usage": "hf mfdes getfileisoids [-hav] [-n <dec>] [-t <DES|2TDEA|3TDEA|AES>] [-k <hex>] [--kdf <none|AN10922|gallagher>] [-i <hex>] [-m <plain|mac|encrypt>] [-c <native|niso|iso>] [--schann <d40|ev1|ev2|lrp>] [--aid <hex>] [--isoid <hex>] [--no-auth]"
},
"hf mfdes getfilesettings": {
"command": "hf mfdes getfilesettings",
"description": "Get File Settings from file from application. Master key needs to be provided or flag --no-auth set (depend on cards settings).",
"notes": [
"hf mfdes getfilesettings --aid 123456 --fid 01 -> execute with defaults from `default` command",
"hf mfdes getfilesettings --isoid df01 --fid 00 --no-auth -> get file settings with select by iso id",
"hf mfdes getfilesettings -n 0 -t des -k 0000000000000000 --kdf none --aid 123456 --fid 01 -> execute with default factory setup"
],
"offline": false,
"options": [
"-h, --help This help",
"-a, --apdu Show APDU requests and responses",
"-v, --verbose Verbose output",
"-n, --keyno <dec> Key number",
"-t, --algo <DES|2TDEA|3TDEA|AES> Crypt algo",
"-k, --key <hex> Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)",
"--kdf <none|AN10922|gallagher> Key Derivation Function (KDF)",
"-i, --kdfi <hex> KDF input (1-31 hex bytes)",
"-m, --cmode <plain|mac|encrypt> Communicaton mode",
"-c, --ccset <native|niso|iso> Communicaton command set",
"--schann <d40|ev1|ev2|lrp> Secure channel",
"--aid <hex> Application ID (3 hex bytes, big endian)",
"--isoid <hex> Application ISO ID (ISO DF ID) (2 hex bytes, big endian)",
"--fid <hex> File ID (1 hex byte). (def: 1)",
"--no-auth Execute without authentication"
],
"usage": "hf mfdes getfilesettings [-hav] [-n <dec>] [-t <DES|2TDEA|3TDEA|AES>] [-k <hex>] [--kdf <none|AN10922|gallagher>] [-i <hex>] [-m <plain|mac|encrypt>] [-c <native|niso|iso>] [--schann <d40|ev1|ev2|lrp>] [--aid <hex>] [--isoid <hex>] [--fid <hex>] [--no-auth]"
},
"hf mfdes getkeysettings": {
"command": "hf mfdes getkeysettings",
"description": "Get key settings for card level or application level.",
"notes": [
"hf mfdes getkeysettings -> get picc key settings with default key/channel setup",
"hf mfdes getkeysettings --aid 123456 -> get app 123456 key settings with default key/channel setup"
],
"offline": false,
"options": [
"-h, --help This help",
"-a, --apdu Show APDU requests and responses",
"-v, --verbose Verbose output",
"-n, --keyno <dec> Key number",
"-t, --algo <DES|2TDEA|3TDEA|AES> Crypt algo",
"-k, --key <hex> Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)",
"--kdf <none|AN10922|gallagher> Key Derivation Function (KDF)",
"-i, --kdfi <hex> KDF input (1-31 hex bytes)",
"-m, --cmode <plain|mac|encrypt> Communicaton mode",
"-c, --ccset <native|niso|iso> Communicaton command set",
"--schann <d40|ev1|ev2|lrp> Secure channel",
"--aid <hex> Application ID (3 hex bytes, big endian)"
],
"usage": "hf mfdes getkeysettings [-hav] [-n <dec>] [-t <DES|2TDEA|3TDEA|AES>] [-k <hex>] [--kdf <none|AN10922|gallagher>] [-i <hex>] [-m <plain|mac|encrypt>] [-c <native|niso|iso>] [--schann <d40|ev1|ev2|lrp>] [--aid <hex>]"
},
"hf mfdes getkeyversions": {
"command": "hf mfdes getkeyversions",
"description": "Get key versions for card level or application level.",
"notes": [
"--keynum parameter: App level: key number. PICC level: 00..0d - keys count, 21..23 vc keys, default 0x00.",
"hf mfdes getkeyversions --keynum 00 -> get picc master key version with default key/channel setup",
"hf mfdes getkeyversions --aid 123456 --keynum 0d -> get app 123456 all key versions with default key/channel setup",
"hf mfdes getkeyversions --aid 123456 --keynum 0d --no-auth -> get key version without authentication"
],
"offline": false,
"options": [
"-h, --help This help",
"-a, --apdu Show APDU requests and responses",
"-v, --verbose Verbose output",
"-n, --keyno <dec> Key number for authentication",
"-t, --algo <DES|2TDEA|3TDEA|AES> Crypt algo",
"-k, --key <hex> Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)",
"--kdf <none|AN10922|gallagher> Key Derivation Function (KDF)",
"-i, --kdfi <hex> KDF input (1-31 hex bytes)",
"-m, --cmode <plain|mac|encrypt> Communicaton mode",
"-c, --ccset <native|niso|iso> Communicaton command set",
"--schann <d40|ev1|ev2|lrp> Secure channel",
"--aid <hex> Application ID (3 hex bytes, big endian)",
"--isoid <hex> Application ISO ID (ISO DF ID) (2 hex bytes, big endian).",
"--keynum <hex> Key number/count (1 hex byte). (def: 0x00)",
"--keyset <hex> Keyset number (1 hex byte)",
"--no-auth Execute without authentication"
],
"usage": "hf mfdes getkeyversions [-hav] [-n <dec>] [-t <DES|2TDEA|3TDEA|AES>] [-k <hex>] [--kdf <none|AN10922|gallagher>] [-i <hex>] [-m <plain|mac|encrypt>] [-c <native|niso|iso>] [--schann <d40|ev1|ev2|lrp>] [--aid <hex>] [--isoid <hex>] [--keynum <hex>] [--keyset <hex>] [--no-auth]"
},
"hf mfdes getuid": {
"command": "hf mfdes getuid",
"description": "Get UID from card. Get the real UID if the random UID bit is on and get the same UID as in anticollision if not. Any card's key needs to be provided.",
"notes": [
"hf mfdes getuid -> execute with default factory setup",
"hf mfdes getuid --isoid df01 -t aes --schan lrp -> for desfire lights default settings"
],
"offline": false,
"options": [
"-h, --help This help",
"-a, --apdu Show APDU requests and responses",
"-v, --verbose Verbose output",
"-n, --keyno <dec> Key number",
"-t, --algo <DES|2TDEA|3TDEA|AES> Crypt algo",
"-k, --key <hex> Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)",
"--kdf <none|AN10922|gallagher> Key Derivation Function (KDF)",
"-i, --kdfi <hex> KDF input (1-31 hex bytes)",
"-m, --cmode <plain|mac|encrypt> Communicaton mode",
"-c, --ccset <native|niso|iso> Communicaton command set",
"--schann <d40|ev1|ev2|lrp> Secure channel",
"--aid <hex> Application ID (3 hex bytes, big endian)",
"--isoid <hex> Application ISO ID (ISO DF ID) (2 hex bytes, big endian)"
],
"usage": "hf mfdes getuid [-hav] [-n <dec>] [-t <DES|2TDEA|3TDEA|AES>] [-k <hex>] [--kdf <none|AN10922|gallagher>] [-i <hex>] [-m <plain|mac|encrypt>] [-c <native|niso|iso>] [--schann <d40|ev1|ev2|lrp>] [--aid <hex>] [--isoid <hex>]"
},
"hf mfdes help": {
"command": "hf mfdes help",
"description": "help This help list List DESFire (ISO 14443A) history test Regression crypto tests --------------------------------------------------------------------------------------- hf mfdes list available offline: yes Alias of `trace list -t des -c` with selected protocol data to annotate trace buffer You can load a trace from file (see `trace load -h`) or it be downloaded from device by default It accepts all other arguments of `trace list`. Note that some might not be relevant for this specific protocol",
"notes": [
"hf mfdes list --frame -> show frame delay times",
"hf mfdes list -1 -> use trace buffer"
],
"offline": true,
"options": [
"-h, --help This help",
"-1, --buffer use data from trace buffer",
"--frame show frame delay times",
"-c mark CRC bytes",
"-r show relative times (gap and duration)",
"-u display times in microseconds instead of clock cycles",
"-x show hexdump to convert to pcap(ng)",
"or to import into Wireshark using encapsulation type \"ISO 14443\"",
"-f, --file <fn> filename of dictionary"
],
"usage": "hf mfdes list [-h1crux] [--frame] [-f <fn>]"
},
"hf mfdes info": {
"command": "hf mfdes info",
"description": "Get info from MIFARE DESfire tags",
"notes": [
"hf mfdes info"
],
"offline": false,
"options": [
"-h, --help This help"
],
"usage": "hf mfdes info [-h]"
},
"hf mfdes lsapp": {
"command": "hf mfdes lsapp",
"description": "Show application list. Master key needs to be provided or flag --no-auth set (depend on cards settings).",
"notes": [
"hf mfdes lsapp -> show application list with defaults from `default` command",
"hf mfdes lsapp --files -> show application list and show each file type/settings/etc"
],
"offline": false,
"options": [
"-h, --help This help",
"-a, --apdu Show APDU requests and responses",
"-v, --verbose Verbose output",
"-n, --keyno <dec> Key number",
"-t, --algo <DES|2TDEA|3TDEA|AES> Crypt algo",
"-k, --key <hex> Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)",
"--kdf <none|AN10922|gallagher> Key Derivation Function (KDF)",
"-i, --kdfi <hex> KDF input (1-31 hex bytes)",
"-m, --cmode <plain|mac|encrypt> Communicaton mode",
"-c, --ccset <native|niso|iso> Communicaton command set",
"--schann <d40|ev1|ev2|lrp> Secure channel",
"--no-auth Execute without authentication",
"--no-deep not to check authentication commands that avail for any application",
"--files scan files and print file settings"
],
"usage": "hf mfdes lsapp [-hav] [-n <dec>] [-t <DES|2TDEA|3TDEA|AES>] [-k <hex>] [--kdf <none|AN10922|gallagher>] [-i <hex>] [-m <plain|mac|encrypt>] [-c <native|niso|iso>] [--schann <d40|ev1|ev2|lrp>] [--no-auth] [--no-deep] [--files]"
},
"hf mfdes lsfiles": {
"command": "hf mfdes lsfiles",
"description": "This commands List files inside application AID / ISOID. Master key needs to be provided or flag --no-auth set (depend on cards settings).",
"notes": [
"hf mfdes lsfiles --aid 123456 -> AID 123456, list files using `default` command creds",
"hf mfdes lsfiles --isoid df01 --no-auth -> list files for DESFire light"
],
"offline": false,
"options": [
"-h, --help This help",
"-a, --apdu Show APDU requests and responses",
"-v, --verbose Verbose output",
"-n, --keyno <dec> Key number",
"-t, --algo <DES|2TDEA|3TDEA|AES> Crypt algo",
"-k, --key <hex> Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)",
"--kdf <none|AN10922|gallagher> Key Derivation Function (KDF)",
"-i, --kdfi <hex> KDF input (1-31 hex bytes)",
"-m, --cmode <plain|mac|encrypt> Communicaton mode",
"-c, --ccset <native|niso|iso> Communicaton command set",
"--schann <d40|ev1|ev2|lrp> Secure channel",
"--aid <hex> Application ID (3 hex bytes, big endian)",
"--isoid <hex> Application ISO ID (ISO DF ID) (2 hex bytes, big endian)",
"--no-auth Execute without authentication"
],
"usage": "hf mfdes lsfiles [-hav] [-n <dec>] [-t <DES|2TDEA|3TDEA|AES>] [-k <hex>] [--kdf <none|AN10922|gallagher>] [-i <hex>] [-m <plain|mac|encrypt>] [-c <native|niso|iso>] [--schann <d40|ev1|ev2|lrp>] [--aid <hex>] [--isoid <hex>] [--no-auth]"
},
"hf mfdes mad": {
"command": "hf mfdes mad",
"description": "Reads and prints MIFARE Application directory (MAD).",
"notes": [
"MAD consists of one file with issuer info (AID ffffff) and several files with AID in the special format `faaaav` (a - MAD ID, v - multiple AID over one MAD ID)",
"The MIFARE DESFire Card Master Key settings have to allow the MIFARE DESFire command GetApplicationIDs without authentication (from datasheet)",
"",
"hf mfdes mad -> shows MAD data",
"hf mfdes mad -v -> shows MAD parsed and raw data",
"hf mfdes mad -a e103 -k d3f7d3f7d3f7d3f7d3f7d3f7d3f7d3f7 -> shows MAD data with custom AID and key"
],
"offline": false,
"options": [
"-h, --help This help",
"-a, --apdu Show APDU requests and responses",
"-v, --verbose Verbose output",
"-n, --keyno <dec> Key number",
"-t, --algo <DES|2TDEA|3TDEA|AES> Crypt algo",
"-k, --key <hex> Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)",
"--kdf <none|AN10922|gallagher> Key Derivation Function (KDF)",
"-i, --kdfi <hex> KDF input (1-31 hex bytes)",
"-m, --cmode <plain|mac|encrypt> Communicaton mode",
"-c, --ccset <native|niso|iso> Communicaton command set",
"--schann <d40|ev1|ev2|lrp> Secure channel",
"--aid <hex> Application ID of issuer info file, (3 hex bytes, big endian), (non-standard feature!)",
"--auth Authenticate to get info from GetApplicationIDs command (non-standard feature!)"
],
"usage": "hf mfdes mad [-hav] [-n <dec>] [-t <DES|2TDEA|3TDEA|AES>] [-k <hex>] [--kdf <none|AN10922|gallagher>] [-i <hex>] [-m <plain|mac|encrypt>] [-c <native|niso|iso>] [--schann <d40|ev1|ev2|lrp>] [--aid <hex>] [--auth]"
},
"hf mfdes read": {
"command": "hf mfdes read",
"description": "Read data from file. Key needs to be provided or flag --no-auth set (depend on file settings).",
"notes": [
"It reads file via all command sets.",
"For ISO command set it can be read by specifying full 2-byte iso id or 1-byte short iso id (first byte of the full iso id). ISO id lays in the data in BIG ENDIAN format.",
"ISO record commands: offset - record number (0-current, 1..ff-number, 1-lastest), length - if 0 - all records, if 1 - one",
"",
"hf mfdes read --aid 123456 --fid 01 -> read file: app=123456, file=01, offset=0, all the data. use default channel settings from `default` command",
"hf mfdes read --aid 123456 --fid 01 --type record --offset 000000 --length 000001 -> read one last record from record file. use default channel settings from `default` command",
"hf mfdes read --aid 123456 --fid 10 --type data -c iso -> read file via ISO channel: app=123456, short iso id=10, offset=0.",
"hf mfdes read --aid 123456 --fileisoid 1000 --type data -c iso -> read file via ISO channel: app=123456, iso id=1000, offset=0. Select via native ISO wrapper",
"hf mfdes read --isoid 0102 --fileisoid 1000 --type data -c iso -> read file via ISO channel: app iso id=0102, iso id=1000, offset=0. Select via ISO commands",
"hf mfdes read --isoid 0102 --fileisoid 1100 --type record -c iso --offset 000005 --length 000001 -> get one record (number 5) from file 1100 via iso commands",
"hf mfdes read --isoid 0102 --fileisoid 1100 --type record -c iso --offset 000005 --length 000000 -> get all record (from 5 to 1) from file 1100 via iso commands",
"hf mfdes read --isoid df01 --fid 00 --schann lrp -t aes --length 000010 -> read via lrp channel",
"hf mfdes read --isoid df01 --fid 00 --schann ev2 -t aes --length 000010 --isochain -> read Desfire Light via ev2 channel"
],
"offline": false,
"options": [
"-h, --help This help",
"-a, --apdu Show APDU requests and responses",
"-v, --verbose Verbose output",
"-n, --keyno <dec> Key number",
"-t, --algo <DES|2TDEA|3TDEA|AES> Crypt algo",
"-k, --key <hex> Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)",
"--kdf <none|AN10922|gallagher> Key Derivation Function (KDF)",
"-i, --kdfi <hex> KDF input (1-31 hex bytes)",
"-m, --cmode <plain|mac|encrypt> Communicaton mode",
"-c, --ccset <native|niso|iso> Communicaton command set",
"--schann <d40|ev1|ev2|lrp> Secure channel",
"--aid <hex> Application ID (3 hex bytes, big endian)",
"--fid <hex> File ID (1 hex byte)",
"--no-auth Execute without authentication",
"--type <auto|data|value|record|mac> File Type, Auto - check file settings and then read. (def: auto)",
"-o, --offset <hex> File Offset (3 hex bytes, big endian). For records - record number (0 - lastest record). (def: 0)",
"-l, --length <hex> Length to read (3 hex bytes, big endian -> 000000 = Read all data). For records - records count (0 - all). (def: 0)",
"--isoid <hex> Application ISO ID (ISO DF ID) (2 hex bytes, big endian)",
"--fileisoid <hex> File ISO ID (ISO DF ID) (2 hex bytes, big endian). Works only for ISO read commands",
"--isochain use iso chaining commands. Switched on by default if secure channel = lrp"
],
"usage": "hf mfdes read [-hav] [-n <dec>] [-t <DES|2TDEA|3TDEA|AES>] [-k <hex>] [--kdf <none|AN10922|gallagher>] [-i <hex>] [-m <plain|mac|encrypt>] [-c <native|niso|iso>] [--schann <d40|ev1|ev2|lrp>] [--aid <hex>] [--fid <hex>] [--no-auth] [--type <auto|data|value|record|mac>] [-o <hex>] [-l <hex>] [--isoid <hex>] [--fileisoid <hex>] [--isochain]"
},
"hf mfdes selectapp": {
"command": "hf mfdes selectapp",
"description": "Select application on the card. It selects app if it is a valid one or returns an error.",
"notes": [
"hf mfdes selectapp --aid 123456 -> select application 123456",
"hf mfdes selectapp --mf -> select master file (PICC level)",
"hf mfdes selectapp --dfname aid123456 -> select application aid123456 by DF name",
"hf mfdes selectapp --isoid 1111 -> select application 1111 by ISO ID",
"hf mfdes selectapp --isoid 1111 --fileisoid 2222 -> select application 1111 file 2222 by ISO ID",
"hf mfdes selectapp --isoid 01df --fileisoid 00ef -> select file 00 on the Desfire Light"
],
"offline": false,
"options": [
"-h, --help This help",
"-a, --apdu Show APDU requests and responses",
"-v, --verbose Verbose output",
"-n, --keyno <dec> Key number",
"-t, --algo <DES|2TDEA|3TDEA|AES> Crypt algo",
"-k, --key <hex> Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)",
"--kdf <none|AN10922|gallagher> Key Derivation Function (KDF)",
"-i, --kdfi <hex> KDF input (1-31 hex bytes)",
"-m, --cmode <plain|mac|encrypt> Communicaton mode",
"-c, --ccset <native|niso|iso> Communicaton command set",
"--schann <d40|ev1|ev2|lrp> Secure channel",
"--aid <hex> Application ID of application for some parameters (3 hex bytes, big endian)",
"--dfname <str> Application DF Name (string, max 16 chars). Selects application via ISO SELECT command",
"--mf Select MF (master file) via ISO channel",
"--isoid <hex> Application ISO ID (ISO DF ID) (2 hex bytes, big endian)",
"--fileisoid <hex> Select file inside application by ISO ID (ISO DF ID) (2 hex bytes, big endian)."
],
"usage": "hf mfdes selectapp [-hav] [-n <dec>] [-t <DES|2TDEA|3TDEA|AES>] [-k <hex>] [--kdf <none|AN10922|gallagher>] [-i <hex>] [-m <plain|mac|encrypt>] [-c <native|niso|iso>] [--schann <d40|ev1|ev2|lrp>] [--aid <hex>] [--dfname <str>] [--mf] [--isoid <hex>] [--fileisoid <hex>]"
},
"hf mfdes setconfig": {
"command": "hf mfdes setconfig",
"description": "Set card configuration. WARNING! Danger zone! Needs to provide card's master key and works if not blocked by config.",
"notes": [
"More about options MF2DLHX0.pdf.",
"Options list:",
"00h PICC configuration.",
"02h ATS update.",
"03h SAK update",
"04h Secure Messaging Configuration.",
"05h Capability data. (here change for LRP in the Desfire Light [enable 00000000010000000000])",
"06h DF Name renaming (one-time)",
"08h File renaming (one-time)",
"09h Value file configuration (one-time)",
"0Ah Failed authentication counter setting [disable 00ffffffff]",
"0Bh HW configuration",
"",
"hf mfdes setconfig --param 03 --data 0428 -> set SAK",
"hf mfdes setconfig --param 02 --data 0875778102637264 -> set ATS (first byte - length)",
"hf mfdes setconfig --isoid df01 -t aes --schann ev2 --param 05 --data 00000000020000000000 -> set LRP mode enable for Desfire Light",
"hf mfdes setconfig --isoid df01 -t aes --schann ev2 --param 0a --data 00ffffffff -> Disable failed auth counters for Desfire Light",
"hf mfdes setconfig --isoid df01 -t aes --schann lrp --param 0a --data 00ffffffff -> Disable failed auth counters for Desfire Light via lrp"
],
"offline": false,
"options": [
"-h, --help This help",
"-a, --apdu Show APDU requests and responses",
"-v, --verbose Verbose output",
"-n, --keyno <dec> Key number",
"-t, --algo <DES|2TDEA|3TDEA|AES> Crypt algo",
"-k, --key <hex> Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)",
"--kdf <none|AN10922|gallagher> Key Derivation Function (KDF)",
"-i, --kdfi <hex> KDF input (1-31 hex bytes)",
"-m, --cmode <plain|mac|encrypt> Communicaton mode",
"-c, --ccset <native|niso|iso> Communicaton command set",
"--schann <d40|ev1|ev2|lrp> Secure channel",
"--aid <hex> Application ID of application for some parameters (3 hex bytes, big endian)",
"--isoid <hex> Application ISO ID (ISO DF ID) (2 hex bytes, big endian).",
"-p, --param <hex> Parameter id (1 hex byte)",
"-d, --data <hex> Data for parameter (1..30 hex bytes)"
],
"usage": "hf mfdes setconfig [-hav] [-n <dec>] [-t <DES|2TDEA|3TDEA|AES>] [-k <hex>] [--kdf <none|AN10922|gallagher>] [-i <hex>] [-m <plain|mac|encrypt>] [-c <native|niso|iso>] [--schann <d40|ev1|ev2|lrp>] [--aid <hex>] [--isoid <hex>] [-p <hex>] [-d <hex>]"
},
"hf mfdes test": {
"command": "hf mfdes test",
"description": "Regression crypto tests",
"notes": [
"hf mfdes test"
],
"offline": true,
"options": [
"-h, --help This help"
],
"usage": "hf mfdes test [-h]"
},
"hf mfdes value": {
"command": "hf mfdes value",
"description": "Get File Settings from file from application. Master key needs to be provided or flag --no-auth set (depend on cards settings).",
"notes": [
"hf mfdes value --aid 123456 --fid 01 -> get value app=123456, file=01 with defaults from `default` command",
"hf mfdes value --aid 123456 --fid 01 --op credit -d 00000001 -> credit value app=123456, file=01 with defaults from `default` command",
"hf mfdes value -n 0 -t des -k 0000000000000000 --kdf none --aid 123456 --fid 01 -> get value with default factory setup",
"hf mfdes val --isoid df01 --fid 03 --schann lrp -t aes -n 1 --op credit --d 00000001 -m encrypt -> credit value in the lrp encrypted mode",
"hf mfdes val --isoid df01 --fid 03 --schann lrp -t aes -n 1 --op get -m plain -> get value in plain (nevertheless of mode) works for desfire light (look SetConfiguration option 0x09)"
],
"offline": false,
"options": [
"-h, --help This help",
"-a, --apdu Show APDU requests and responses",
"-v, --verbose Verbose output",
"-n, --keyno <dec> Key number",
"-t, --algo <DES|2TDEA|3TDEA|AES> Crypt algo",
"-k, --key <hex> Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)",
"--kdf <none|AN10922|gallagher> Key Derivation Function (KDF)",
"-i, --kdfi <hex> KDF input (1-31 hex bytes)",
"-m, --cmode <plain|mac|encrypt> Communicaton mode",
"-c, --ccset <native|niso|iso> Communicaton command set",
"--schann <d40|ev1|ev2|lrp> Secure channel",
"--aid <hex> Application ID (3 hex bytes, big endian)",
"--isoid <hex> Application ISO ID (ISO DF ID) (2 hex bytes, big endian)",
"--fid <hex> File ID (1 hex byte)",
"-o, --op <get/credit/limcredit/debit/clear> Operation: get(default)/credit/limcredit(limited credit)/debit/clear. Operation clear: get-getopt-debit to min value",
"-d, --data <hex> Value for operation (HEX 4 bytes)",
"--no-auth Execute without authentication"
],
"usage": "hf mfdes value [-hav] [-n <dec>] [-t <DES|2TDEA|3TDEA|AES>] [-k <hex>] [--kdf <none|AN10922|gallagher>] [-i <hex>] [-m <plain|mac|encrypt>] [-c <native|niso|iso>] [--schann <d40|ev1|ev2|lrp>] [--aid <hex>] [--isoid <hex>] [--fid <hex>] [-o <get/credit/limcredit/debit/clear>] [-d <hex>] [--no-auth]"
},
"hf mfdes write": {
"command": "hf mfdes write",
"description": "Write data from file. Key needs to be provided or flag --no-auth set (depend on file settings).",
"notes": [
"In the mode with CommitReaderID to decode previous reader id command needs to read transaction counter via dump/read command and specify --trkey",
"",
"hf mfdes write --aid 123456 --fid 01 -d 01020304 -> AID 123456, file=01, offset=0, get file type from card. use default channel settings from `default` command",
"hf mfdes write --aid 123456 --fid 01 --type data -d 01020304 --0ffset 000100 -> write data to std file with offset 0x100",
"hf mfdes write --aid 123456 --fid 01 --type data -d 01020304 --commit -> write data to backup file with commit",
"hf mfdes write --aid 123456 --fid 01 --type value -d 00000001 -> increment value file",
"hf mfdes write --aid 123456 --fid 01 --type value -d 00000001 --debit -> decrement value file",
"hf mfdes write --aid 123456 --fid 01 -d 01020304 -> write data to file with `auto` type",
"hf mfdes write --aid 123456 --fid 01 --type record -d 01020304 -> write data to record file",
"hf mfdes write --aid 123456 --fid 01 --type record -d 01020304 --updaterec 0 -> update record in the record file. record 0 - lastest record.",
"hf mfdes write --aid 123456 --fid 01 --type record --offset 000000 -d 11223344 -> write record to record file. use default channel settings from `default` command",
"hf mfdes write --isoid 1234 --fileisoid 1000 --type data -c iso -d 01020304 -> write data to std/backup file via iso commandset",
"hf mfdes write --isoid 1234 --fileisoid 2000 --type record -c iso -d 01020304 -> send record to record file via iso commandset",
"hf mfdes write --aid 123456 --fid 01 -d 01020304 --readerid 010203 -> write data to file with CommitReaderID command before write and CommitTransaction after write",
"hf mfdes write --isoid df01 --fid 04 -d 01020304 --trkey 00112233445566778899aabbccddeeff --readerid 5532 -t aes --schann lrp -> advanced CommitReaderID via lrp channel sample"
],
"offline": false,
"options": [
"-h, --help This help",
"-a, --apdu Show APDU requests and responses",
"-v, --verbose Verbose output",
"-n, --keyno <dec> Key number",
"-t, --algo <DES|2TDEA|3TDEA|AES> Crypt algo",
"-k, --key <hex> Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)",
"--kdf <none|AN10922|gallagher> Key Derivation Function (KDF)",
"-i, --kdfi <hex> KDF input (1-31 hex bytes)",
"-m, --cmode <plain|mac|encrypt> Communicaton mode",
"-c, --ccset <native|niso|iso> Communicaton command set",
"--schann <d40|ev1|ev2|lrp> Secure channel",
"--aid <hex> Application ID (3 hex bytes, big endian)",
"--fid <hex> File ID (1 hex byte)",
"--no-auth Execute without authentication",
"--type <auto|data|value|record|mac> File Type, Auto - check file settings and then write. (def: auto)",
"-o, --offset <hex> File Offset (3 hex bytes, big endian). For records - record number (0 - lastest record). (def: 0)",
"-d, --data <hex> data for write (data/record file), credit/debit(value file)",
"--debit use for value file debit operation instead of credit",
"--commit commit needs for backup file only. For the other file types and in the `auto` mode - command set it automatically",
"--updaterec <dec> Record number for update record command. Updates record instead of write. Lastest record - 0",
"--isoid <hex> Application ISO ID (ISO DF ID) (2 hex bytes, big endian)",
"--fileisoid <hex> File ISO ID (ISO DF ID) (2 hex bytes, big endian). Works only for ISO write commands",
"--readerid <hex> reader id for CommitReaderID command. If present - the command issued before write command",
"--trkey <hex> key for decode previous reader id"
],
"usage": "hf mfdes write [-hav] [-n <dec>] [-t <DES|2TDEA|3TDEA|AES>] [-k <hex>] [--kdf <none|AN10922|gallagher>] [-i <hex>] [-m <plain|mac|encrypt>] [-c <native|niso|iso>] [--schann <d40|ev1|ev2|lrp>] [--aid <hex>] [--fid <hex>] [--no-auth] [--type <auto|data|value|record|mac>] [-o <hex>] [-d <hex>] [--debit] [--commit] [--updaterec <dec>] [--isoid <hex>] [--fileisoid <hex>] [--readerid <hex>] [--trkey <hex>]"
},
"hf mfp auth": {
"command": "hf mfp auth",
"description": "Executes AES authentication command for MIFARE Plus card",
"notes": [
"hf mfp auth --ki 4000 --key 000102030405060708090a0b0c0d0e0f -> executes authentication",
"hf mfp auth --ki 9003 --key FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF -v -> executes authentication and shows all the system data"
],
"offline": false,
"options": [
"-h, --help This help",
"-v, --verbose Verbose output",
"--ki <hex> Key number, 2 hex bytes",
"--key <hex> Key, 16 hex bytes"
],
"usage": "hf mfp auth [-hv] --ki <hex> --key <hex>"
},
"hf mfp chconf": {
"command": "hf mfp chconf",
"description": "Change the configuration on a Mifare Plus tag. DANGER!",
"notes": [
"This requires Card Master Key (9000) or Card Configuration Key (9001).",
"Configuration block info can be found below.",
"* Block B000 (00; CMK): Max amount of commands without MAC (byte 0), as well as plain mode access (unknown).",
"* Block B001 (01; CCK): Installation identifier for Virtual Card. Please consult NXP for data.",
"* Block B002 (02; CCK): ATS data.",
"* Block B003 (03; CCK): Use Random ID in SL3, decide whether proximity check is mandatory.",
"* DO NOT WRITE THIS BLOCK UNDER ANY CIRCUMSTANCES! Risk of bricking.",
"More configuration tips to follow. Check JMY600 Series IC Card Module.",
"hf mfp chconf -c 00 -d 10ffffffffffffffffffffffffffffff --key A0A1A2A3A4A5A6A7A0A1A2A3A4A5A6A7 -> Allow 16 commands without MAC in a single transaction."
],
"offline": false,
"options": [
"-h, --help This help",
"-v, --verbose Verbose output",
"--nmr Do not expect MAC in response",
"-c, --conf <hex> Config block number, 0-3",
"-k, --key <hex> Card key, 16 hex bytes",
"--cck Auth as Card Configuration key instead of Card Master Key",
"-d, --data <hex> New configuration data, 16 hex bytes"
],
"usage": "hf mfp chconf [-hv] [--nmr] -c <hex> [-k <hex>] [--cck] -d <hex>"
},
"hf mfp chk": {
"command": "hf mfp chk",
"description": "Checks keys on MIFARE Plus card",
"notes": [
"hf mfp chk -k 000102030405060708090a0b0c0d0e0f -> check key on sector 0 as key A and B",
"hf mfp chk -s 2 -a -> check default key list on sector 2, only key A",
"hf mfp chk -d mfp_default_keys -s0 -e6 -> check keys from dictionary against sectors 0-6",
"hf mfp chk --pattern1b --dump -> check all 1-byte keys pattern and save found keys to file",
"hf mfp chk --pattern2b --startp2b FA00 -> check all 2-byte keys pattern. Start from key FA00FA00...FA00"
],
"offline": false,
"options": [
"-h, --help This help",
"-a, --keya Check only key A (def: check all keys)",
"-b, --keyb Check only key B (def: check all keys)",
"-s, --startsec <0..255> Start sector number",
"-e, --endsec <0..255> End sector number",
"-k, --key <hex> Key for checking (HEX 16 bytes)",
"-d, --dict <fn> Dictionary file with keys",
"--pattern1b Check all 1-byte combinations of key (0000...0000, 0101...0101, 0202...0202, ...)",
"--pattern2b Check all 2-byte combinations of key (0000...0000, 0001...0001, 0002...0002, ...)",
"--startp2b <pattern> Start key (2-byte HEX) for 2-byte search (use with `--pattern2b`)",
"--dump Dump found keys to JSON file",
"-v, --verbose Verbose output"
],
"usage": "hf mfp chk [-habv] [-s <0..255>] [-e <0..255>] [-k <hex>] [-d <fn>] [--pattern1b] [--pattern2b] [--startp2b <pattern>] [--dump]"
},
"hf mfp chkey": {
"command": "hf mfp chkey",
"description": "Change the keys on a Mifare Plus tag",
"notes": [
"This requires the key that can update the key that you are trying to update.",
"hf mfp chkey --ki 401f -d FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF --key A0A1A2A3A4A5A6A7A0A1A2A3A4A5A6A7 -> Change key B for Sector 15 from MAD to default",
"hf mfp chkey --ki 9000 -d 32F9351A1C02B35FF97E0CA943F814F6 --key FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF -> Change card master key to custom from default"
],
"offline": false,
"options": [
"-h, --help This help",
"-v, --verbose Verbose output",
"--nmr Do not expect MAC in response",
"--ki <hex> Key Index, 2 hex bytes",
"-k, --key <hex> Current sector key, 16 hex bytes",
"-b, --typeb Sector key is key B",
"-d, --data <hex> New key, 16 hex bytes"
],
"usage": "hf mfp chkey [-hvb] [--nmr] --ki <hex> [-k <hex>] -d <hex>"
},
"hf mfp commitp": {
"command": "hf mfp commitp",
"description": "Executes Commit Perso command. Can be used in SL0 mode only. OBS! This command will not be executed if CardConfigKey, CardMasterKey and L3SwitchKey AES keys are not written.",
"notes": [
"hf mfp commitp"
],
"offline": false,
"options": [
"-h, --help This help",
"-v, --verbose Verbose output"
],
"usage": "hf mfp commitp [-hv]"
},
"hf mfp dump": {
"command": "hf mfp dump",
"description": "Dump MIFARE Plus tag to file (bin/json) If no <name> given, UID will be used as filename",
"notes": [
"hf mfp dump",
"hf mfp dump --keys hf-mf-066C8B78-key.bin -> MIFARE Plus with keys from specified file"
],
"offline": false,
"options": [
"-h, --help This help",
"-f, --file <fn> Specify a filename for dump file",
"-k, --keys <fn> Specify a filename for keys file"
],
"usage": "hf mfp dump [-h] [-f <fn>] [-k <fn>]"
},
"hf mfp help": {
"command": "hf mfp help",
"description": "help This help list List MIFARE Plus history --------------------------------------------------------------------------------------- hf mfp list available offline: yes Alias of `trace list -t mfp -c` with selected protocol data to annotate trace buffer You can load a trace from file (see `trace load -h`) or it be downloaded from device by default It accepts all other arguments of `trace list`. Note that some might not be relevant for this specific protocol",
"notes": [
"hf mfp list --frame -> show frame delay times",
"hf mfp list -1 -> use trace buffer"
],
"offline": true,
"options": [
"-h, --help This help",
"-1, --buffer use data from trace buffer",
"--frame show frame delay times",
"-c mark CRC bytes",
"-r show relative times (gap and duration)",
"-u display times in microseconds instead of clock cycles",
"-x show hexdump to convert to pcap(ng)",
"or to import into Wireshark using encapsulation type \"ISO 14443\"",
"-f, --file <fn> filename of dictionary"
],
"usage": "hf mfp list [-h1crux] [--frame] [-f <fn>]"
},
"hf mfp info": {
"command": "hf mfp info",
"description": "Get info from MIFARE Plus tags",
"notes": [
"hf mfp info"
],
"offline": false,
"options": [
"-h, --help This help"
],
"usage": "hf mfp info [-h]"
},
"hf mfp initp": {
"command": "hf mfp initp",
"description": "Executes Write Perso command for all card's keys. Can be used in SL0 mode only.",
"notes": [
"hf mfp initp --key 000102030405060708090a0b0c0d0e0f -> fill all the keys with key (00..0f)",
"hf mfp initp -vv -> fill all the keys with default key(0xff..0xff) and show all the data exchange"
],
"offline": false,
"options": [
"-h, --help This help",
"-v, --verbose Verbose output",
"-k, --key <hex> Key, 16 hex bytes"
],
"usage": "hf mfp initp [-hv] [-k <hex>]"
},
"hf mfp mad": {
"command": "hf mfp mad",
"description": "Checks and prints MIFARE Application Directory (MAD)",
"notes": [
"hf mfp mad",
"hf mfp mad --aid e103 -k d3f7d3f7d3f7d3f7d3f7d3f7d3f7d3f7 -> read and print NDEF data from MAD aid"
],
"offline": false,
"options": [
"-h, --help This help",
"-v, --verbose Verbose output",
"--aid <hex> Print all sectors with aid",
"-k, --key <hex> Key for printing sectors",
"-b, --keyb Use key B for access printing sectors (def: key A)",
"--be (optional: BigEndian)",
"--dch Decode Card Holder information"
],
"usage": "hf mfp mad [-hvb] [--aid <hex>] [-k <hex>] [--be] [--dch]"
},
"hf mfp ndefformat": {
"command": "hf mfp ndefformat",
"description": "format MIFARE Plus Tag as a NFC tag with Data Exchange Format (NDEF) If no <name> given, UID will be used as filename. It will try default keys and MAD keys to detect if tag is already formatted in order to write. If not, it will try finding a key file based on your UID. ie, if you ran autopwn before",
"notes": [
"hf mfp ndefformat",
"hf mfp ndefformat --keys hf-mf-01020304-key.bin -> with keys from specified file"
],
"offline": false,
"options": [
"-h, --help This help",
"-k, --keys <fn> filename of keys"
],
"usage": "hf mfp ndefformat [-h] [-k <fn>]"
},
"hf mfp ndefread": {
"command": "hf mfp ndefread",
"description": "Prints NFC Data Exchange Format (NDEF)",
"notes": [
"hf mfp ndefread",
"hf mfp ndefread -vv -> shows NDEF parsed and raw data",
"hf mfp ndefread --aid e103 -k d3f7d3f7d3f7d3f7d3f7d3f7d3f7d3f7 -> shows NDEF data with custom AID and key",
"hf mfp ndefread -f myfilename -> save raw NDEF to file"
],
"offline": false,
"options": [
"-h, --help This help",
"-v, --verbose verbose output",
"--aid <aid> replace default aid for NDEF",
"-k, --key <key> replace default key for NDEF",
"-b, --keyb use key B for access sectors (by default: key A)",
"-f, --file <fn> save raw NDEF to file"
],
"usage": "hf mfp ndefread [-hvb] [--aid <aid>] [-k <key>] [-f <fn>]"
},
"hf mfp ndefwrite": {
"command": "hf mfp ndefwrite",
"description": "Write raw NDEF hex bytes to tag. This commands assumes tag already been NFC/NDEF formatted.",
"notes": [
"hf mfp ndefwrite -d 0300FE -> write empty record to tag",
"hf mfp ndefwrite -f myfilename",
"hf mfp ndefwrite -d 033fd1023a53709101195405656e2d55534963656d616e2054776974746572206c696e6b5101195502747769747465722e636f6d2f686572726d616e6e31303031"
],
"offline": false,
"options": [
"-h, --help This help",
"-d <hex> raw NDEF hex bytes",
"-f, --file <fn> write raw NDEF file to tag",
"-p fix NDEF record headers / terminator block if missing",
"-v, --verbose verbose output"
],
"usage": "hf mfp ndefwrite [-hpv] [-d <hex>] [-f <fn>]"
},
"hf mfp rdbl": {
"command": "hf mfp rdbl",
"description": "Reads blocks from MIFARE Plus card",
"notes": [
"hf mfp rdbl --blk 0 --key 000102030405060708090a0b0c0d0e0f -> executes authentication and read block 0 data",
"hf mfp rdbl --blk 1 -v -> executes authentication and shows sector 1 data with default key 0xFF..0xFF"
],
"offline": false,
"options": [
"-h, --help This help",
"-v, --verbose Verbose output",
"-n, --count <dec> Blocks count (def: 1)",
"-b, --keyb Use key B (def: keyA)",
"-p, --plain Do not use encrypted communication mode between reader and card",
"--nmc Do not append MAC to command",
"--nmr Do not expect MAC in reply",
"--blk <0..255> Block number",
"-k, --key <hex> Key, 16 hex bytes"
],
"usage": "hf mfp rdbl [-hvbp] [-n <dec>] [--nmc] [--nmr] --blk <0..255> [-k <hex>]"
},
"hf mfp rdsc": {
"command": "hf mfp rdsc",
"description": "Reads one sector from MIFARE Plus card",
"notes": [
"hf mfp rdsc -s 0 --key 000102030405060708090a0b0c0d0e0f -> executes authentication and read sector 0 data",
"hf mfp rdsc -s 1 -v -> executes authentication and shows sector 1 data with default key"
],
"offline": false,
"options": [
"-h, --help This help",
"-v, --verbose Verbose output",
"-b, --keyb Use key B (def: keyA)",
"-p, --plain Do not use encrypted communication mode between reader and card",
"--nmc Do not append MAC to command",
"--nmr Do not expect MAC in reply",
"-s, --sn <0..255> Sector number",
"-k, --key <hex> Key, 16 hex bytes"
],
"usage": "hf mfp rdsc [-hvbp] [--nmc] [--nmr] -s <0..255> [-k <hex>]"
},
"hf mfp wrbl": {
"command": "hf mfp wrbl",
"description": "Writes one block to MIFARE Plus card",
"notes": [
"hf mfp wrbl --blk 1 -d ff0000000000000000000000000000ff --key 000102030405060708090a0b0c0d0e0f -> write block 1 data",
"hf mfp wrbl --blk 2 -d ff0000000000000000000000000000ff -v -> write block 2 data with default key 0xFF..0xFF"
],
"offline": false,
"options": [
"-h, --help This help",
"-v, --verbose Verbose output",
"-b, --keyb Use key B (def: keyA)",
"--blk <0..255> Block number",
"-p, --plain Do not use encrypted transmission",
"--nmr Do not expect MAC in response",
"-d, --data <hex> Data, 16 hex bytes",
"-k, --key <hex> Key, 16 hex bytes"
],
"usage": "hf mfp wrbl [-hvbp] --blk <0..255> [--nmr] -d <hex> [-k <hex>]"
},
"hf mfp wrp": {
"command": "hf mfp wrp",
"description": "Executes Write Perso command. Can be used in SL0 mode only.",
"notes": [
"Use this command to program AES keys, as well as personalize other data on the tag.",
"You can program:",
"* Address 00 [00-FF]: Memory blocks (as well as ACLs and Crypto1 keys)",
"* Address 40 [00-40]: AES sector keys",
"* Address 90 [00-04]: AES administrative keys",
"* Address A0 [00, 01, 80, 81]: Virtual Card keys",
"* Address B0 [00-03]: Configuration data (DO NOT TOUCH B003)",
"Examples:",
"hf mfp wrp --adr 4000 --data 000102030405060708090a0b0c0d0e0f -> write key (00..0f) to key number 4000",
"hf mfp wrp --adr 4000 -> write default key(0xff..0xff) to key number 4000",
"hf mfp wrp --adr b000 -d FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF -> allow 255 commands without MAC in configuration block (B000)",
"hf mfp wrp --adr 0003 -d 1234561234567F078869B0B1B2B3B4B5 -> write crypto1 keys A: 123456123456 and B: B0B1B2B3B4B5 to block 3"
],
"offline": false,
"options": [
"-h, --help This help",
"-v, --verbose Verbose output",
"-a, --adr <hex> Address, 2 hex bytes",
"-d, --data <hex> Data, 16 hex bytes"
],
"usage": "hf mfp wrp [-hv] -a <hex> [-d <hex>]"
},
"hf mfu amiibo": {
"command": "hf mfu amiibo",
"description": "Tries to read all memory from amiibo tag and decrypt it",
"notes": [
"hf mfu amiiboo --dec -f hf-mfu-04579DB27C4880-dump.bin -> decrypt file",
"hf mfu amiiboo -v --dec -> decrypt tag"
],
"offline": false,
"options": [
"-h, --help This help",
"--dec Decrypt memory",
"--enc Encrypt memory",
"-i, --in <fn> Specify a filename for input dump file",
"-o, --out <fn> Specify a filename for output dump file",
"-v, --verbose Verbose output"
],
"usage": "hf mfu amiibo [-hv] [--dec] [--enc] [-i <fn>] [-o <fn>]"
},
"hf mfu cauth": {
"command": "hf mfu cauth",
"description": "Tests 3DES password on Mifare Ultralight-C tag. If password is not specified, a set of known defaults will be tested.",
"notes": [
"hf mfu cauth",
"hf mfu cauth --key 000102030405060708090a0b0c0d0e0f"
],
"offline": false,
"options": [
"-h, --help This help",
"--key <hex> Authentication key (UL-C 16 hex bytes)",
"-l Swap entered key's endianness",
"-k Keep field on (only if a password is provided)"
],
"usage": "hf mfu cauth [-hlk] [--key <hex>]"
},
"hf mfu dump": {
"command": "hf mfu dump",
"description": "Dump MIFARE Ultralight/NTAG tag to files (bin/json) It autodetects card type.Supports: Ultralight, Ultralight-C, Ultralight EV1 NTAG 203, NTAG 210, NTAG 212, NTAG 213, NTAG 215, NTAG 216",
"notes": [
"hf mfu dump -f myfile",
"hf mfu dump -k AABBCCDD -> dump whole tag using pwd AABBCCDD",
"hf mfu dump -p 10 -> start at page 10 and dump rest of blocks",
"hf mfu dump -p 10 -q 2 -> start at page 10 and dump two blocks",
"hf mfu dump --key 00112233445566778899AABBCCDDEEFF"
],
"offline": false,
"options": [
"-h, --help This help",
"-f, --file <fn> Specify a filename for dump file",
"-k, --key <hex> Key for authentication (UL-C 16 bytes, EV1/NTAG 4 bytes)",
"-l Swap entered key's endianness",
"-p, --page <dec> Manually set start page number to start from",
"-q, --qty <dec> Manually set number of pages to dump",
"--ns no save to file",
"-z, --dense dense dump output style"
],
"usage": "hf mfu dump [-hlz] [-f <fn>] [-k <hex>] [-p <dec>] [-q <dec>] [--ns]"
},
"hf mfu eload": {
"command": "hf mfu eload",
"description": "Load emulator memory with data from (bin/eml/json) dump file",
"notes": [
"hf mfu eload -f hf-mfu-04010203040506.bin",
"hf mfu eload -f hf-mfu-04010203040506.bin -q 57 -> load 57 blocks from myfile"
],
"offline": false,
"options": [
"-h, --help This help",
"-f, --file <fn> Specify a filename for dump file",
"-q, --qty <dec> Number of blocks to load from eml file",
"-v, --verbose verbose output"
],
"usage": "hf mfu eload [-hv] -f <fn> [-q <dec>]"
},
"hf mfu esave": {
"command": "hf mfu esave",
"description": "Saves emulator memory to a MIFARE Ultralight/NTAG dump file (bin/json) By default number of pages saved depends on defined tag type. You can override this with option --end.",
"notes": [
"hf mfu esave",
"hf mfu esave --end 255 -> saves whole memory",
"hf mfu esave -f hf-mfu-04010203040506-dump"
],
"offline": false,
"options": [
"-h, --help This help",
"-e, --end <dec> index of last block",
"-f, --file <fn> Specify a filename for dump file"
],
"usage": "hf mfu esave [-h] [-e <dec>] [-f <fn>]"
},
"hf mfu eview": {
"command": "hf mfu eview",
"description": "Displays emulator memory By default number of pages shown depends on defined tag type. You can override this with option --end.",
"notes": [
"hf mfu eview",
"hf mfu eview --end 255 -> dumps whole memory"
],
"offline": false,
"options": [
"-h, --help This help",
"-e, --end <dec> index of last block",
"-z, --dense dense dump output style"
],
"usage": "hf mfu eview [-hz] [-e <dec>]"
},
"hf mfu help": {
"command": "hf mfu help",
"description": "help This help list List MIFARE Ultralight / NTAG history keygen Generate DES/3DES/AES MIFARE diversified keys pwdgen Generate pwd from known algos view Display content from tag dump file --------------------------------------------------------------------------------------- hf mfu list available offline: yes Alias of `trace list -t 14a -c` with selected protocol data to annotate trace buffer You can load a trace from file (see `trace load -h`) or it be downloaded from device by default It accepts all other arguments of `trace list`. Note that some might not be relevant for this specific protocol",
"notes": [
"hf 14a list --frame -> show frame delay times",
"hf 14a list -1 -> use trace buffer"
],
"offline": true,
"options": [
"-h, --help This help",
"-1, --buffer use data from trace buffer",
"--frame show frame delay times",
"-c mark CRC bytes",
"-r show relative times (gap and duration)",
"-u display times in microseconds instead of clock cycles",
"-x show hexdump to convert to pcap(ng)",
"or to import into Wireshark using encapsulation type \"ISO 14443\"",
"-f, --file <fn> filename of dictionary"
],
"usage": "hf 14a list [-h1crux] [--frame] [-f <fn>]"
},
"hf mfu info": {
"command": "hf mfu info",
"description": "Get info about MIFARE Ultralight Family styled tag. Sometimes the tags are locked down, and you may need a key to be able to read the information",
"notes": [
"hf mfu info",
"hf mfu info -k AABBCCDD",
"hf mfu info --key 00112233445566778899AABBCCDDEEFF"
],
"offline": false,
"options": [
"-h, --help This help",
"-k, --key <hex> Authentication key (UL-C 16 bytes, EV1/NTAG 4 bytes)",
"-l Swap entered key's endianness",
"--force override `hw dbg` settings"
],
"usage": "hf mfu info [-hl] [-k <hex>] [--force]"
},
"hf mfu keygen": {
"command": "hf mfu keygen",
"description": "Calculate MFC keys based",
"notes": [
"hf mfu keygen -r",
"hf mfu keygen --uid 11223344556677"
],
"offline": true,
"options": [
"-h, --help This help",
"-u, --uid <hex> <4|7> hex byte UID",
"-r Read UID from tag",
"-b, --blk <dec> Block number"
],
"usage": "hf mfu keygen [-hr] [-u <hex>] [-b <dec>]"
},
"hf mfu ndefread": {
"command": "hf mfu ndefread",
"description": "Prints NFC Data Exchange Format (NDEF)",
"notes": [
"hf mfu ndefread -> shows NDEF data",
"hf mfu ndefread -k ffffffff -> shows NDEF data with key",
"hf mfu ndefread -f myfilename -> save raw NDEF to file"
],
"offline": false,
"options": [
"-h, --help This help",
"-l Swap entered key's endianness",
"-f, --file <fn> Save raw NDEF to file",
"-v, --verbose Verbose output"
],
"usage": "hf mfu ndefread [-hlv] [-k Replace default key for NDEF] [-f <fn>]"
},
"hf mfu otptear": {
"command": "hf mfu otptear",
"description": "Tear-off test against OTP block",
"notes": [
"hf mfu otptear -b 3",
"hf mfu otptear -b 3 -i 100 -s 1000",
"hf mfu otptear -b 3 -i 1 -e 200",
"hf mfu otptear -b 3 -i 100 -s 200 -e 2500 -d FFFFFFFF -t EEEEEEEE",
"hf mfu otptear -b 3 -i 100 -s 200 -e 2500 -d FFFFFFFF -t EEEEEEEE -m 00000000 -> quit when OTP is reset"
],
"offline": false,
"options": [
"-h, --help This help",
"-b, --blk <dec> target block (def 8)",
"-i, --inc <dec> increase time steps (def 500 us)",
"-e, --end <dec> end time (def 3000 us)",
"-s, --start <dec> start time (def 0 us)",
"-d, --data <hex> initialise data before run (4 bytes)",
"-t, --test <hex> test write data (4 bytes, 00000000 by default)",
"-m, --match <hex> exit criteria, if block matches this value (4 bytes)"
],
"usage": "hf mfu otptear [-h] [-b <dec>] [-i <dec>] [-e <dec>] [-s <dec>] [-d <hex>] [-t <hex>] [-m <hex>]"
},
"hf mfu pwdgen": {
"command": "hf mfu pwdgen",
"description": "Generate different passwords from known pwdgen algos",
"notes": [
"hf mfu pwdgen -r",
"hf mfu pwdgen --uid 11223344556677",
"hf mfu pwdgen --test"
],
"offline": true,
"options": [
"-h, --help This help",
"-u, --uid <hex> UID (7 hex bytes)",
"-r Read UID from tag",
"--test self test"
],
"usage": "hf mfu pwdgen [-hr] [-u <hex>] [--test]"
},
"hf mfu rdbl": {
"command": "hf mfu rdbl",
"description": "Read a block and print. It autodetects card type.",
"notes": [
"hf mfu rdbl -b 0",
"hf mfu rdbl -b 0 -k AABBCCDD",
"hf mfu rdbl -b 0 --key 00112233445566778899AABBCCDDEEFF"
],
"offline": false,
"options": [
"-h, --help This help",
"-k, --key <hex> Authentication key (UL-C 16 bytes, EV1/NTAG 4 bytes)",
"-l Swap entered key's endianness",
"-b, --block <dec> Block number to read",
"--force Force operation even if address is out of range"
],
"usage": "hf mfu rdbl [-hl] [-k <hex>] -b <dec> [--force]"
},
"hf mfu restore": {
"command": "hf mfu restore",
"description": "Restore MIFARE Ultralight/NTAG dump file (bin/eml/json) to tag.",
"notes": [
"hf mfu restore -f myfile -s -> special write",
"hf mfu restore -f myfile -k AABBCCDD -s -> special write, use key",
"hf mfu restore -f myfile -k AABBCCDD -ser -> special write, use key, write dump pwd, ..."
],
"offline": false,
"options": [
"-h, --help This help",
"-f, --file <fn> Specify a filename for dump file",
"-k, --key <hex> key for authentication (UL-C 16 bytes, EV1/NTAG 4 bytes)",
"-l swap entered key's endianness",
"-s enable special write UID -MAGIC TAG ONLY-",
"-e enable special write version/signature -MAGIC NTAG 21* ONLY-",
"-r use password found in dumpfile to configure tag. Requires '-e' parameter to work",
"-v, --verbose verbose output",
"-z, --dense dense dump output style"
],
"usage": "hf mfu restore [-hlservz] -f <fn> [-k <hex>]"
},
"hf mfu setpwd": {
"command": "hf mfu setpwd",
"description": "Set the 3DES key on MIFARE Ultralight-C tag.",
"notes": [
"hf mfu setpwd --key 000102030405060708090a0b0c0d0e0f"
],
"offline": false,
"options": [
"-h, --help This help",
"-k, --key <hex> New key (16 hex bytes)"
],
"usage": "hf mfu setpwd [-h] [-k <hex>]"
},
"hf mfu setuid": {
"command": "hf mfu setuid",
"description": "Set UID on MIFARE Ultralight tag. This only works for `magic Ultralight` tags.",
"notes": [
"hf mfu setuid --uid 11223344556677"
],
"offline": false,
"options": [
"-h, --help This help",
"-u, --uid <hex> New UID (7 hex bytes)"
],
"usage": "hf mfu setuid [-h] [-u <hex>]"
},
"hf mfu sim": {
"command": "hf mfu sim",
"description": "Simulate MIFARE Ultralight family type based upon ISO/IEC 14443 type A tag with 4,7 or 10 byte UID from emulator memory. See `hf mfu eload` first. The UID from emulator memory will be used if not specified. See `hf 14a sim -h` to see available types. You want 2 or 7 usually.",
"notes": [
"hf mfu sim -t 2 --uid 11223344556677 -> MIFARE Ultralight",
"hf mfu sim -t 7 --uid 11223344556677 -n 5 -> MFU EV1 / NTAG 215 Amiibo",
"hf mfu sim -t 7 -> MFU EV1 / NTAG 215 Amiibo"
],
"offline": false,
"options": [
"-h, --help This help",
"-t, --type <1..12> Simulation type to use",
"-u, --uid <hex> <4|7|10> hex bytes UID",
"-n, --num <dec> Exit simulation after <numreads> blocks. 0 = infinite",
"-v, --verbose Verbose output"
],
"usage": "hf mfu sim [-hv] -t <1..12> [-u <hex>] [-n <dec>]"
},
"hf mfu tamper": {
"command": "hf mfu tamper",
"description": "Set the configuration of the NTAG 213TT tamper feature Supports: NTAG 213TT",
"notes": [
"hf mfu tamper -e -> enable tamper feature",
"hf mfu tamper -d -> disable tamper feature",
"hf mfu tamper -m 0A0A0A0A -> set the tamper message to 0A0A0A0A",
"hf mfu tamper --lockmessage -> permanently lock the tamper message and mask it from memory"
],
"offline": false,
"options": [
"-h, --help This help",
"-e, --enable Enable the tamper feature",
"-d, --disable Disable the tamper feature",
"-m, --message <hex> Set the tamper message (4 bytes)",
"--lockmessage Permanently lock the tamper message and mask it from memory (does not lock tamper feature itself)"
],
"usage": "hf mfu tamper [-hed] [-m <hex>] [--lockmessage]"
},
"hf mfu view": {
"command": "hf mfu view",
"description": "Print a MIFARE Ultralight/NTAG dump file (bin/eml/json)",
"notes": [
"hf mfu view -f hf-mfu-01020304-dump.bin"
],
"offline": true,
"options": [
"-h, --help This help",
"-f, --file <fn> Specify a filename for dump file",
"-v, --verbose Verbose output",
"-z, --dense dense dump output style"
],
"usage": "hf mfu view [-hvz] -f <fn>"
},
"hf mfu wipe": {
"command": "hf mfu wipe",
"description": "Wipe card to zeros. It will ignore block0,1,2,3 you will need to call it with password in order to wipe the config and sett default pwd/pack Abort by pressing a key New password.... FFFFFFFF New 3-DES key... 49454D4B41455242214E4143554F5946",
"notes": [
"hf mfu wipe",
"hf mfu wipe -k 49454D4B41455242214E4143554F5946"
],
"offline": false,
"options": [
"-h, --help This help",
"-k, --key <hex> Key for authentication (UL-C 16 bytes, EV1/NTAG 4 bytes)",
"-l Swap entered key's endianness"
],
"usage": "hf mfu wipe [-hl] [-k <hex>]"
},
"hf mfu wrbl": {
"command": "hf mfu wrbl",
"description": "Write a block. It autodetects card type.",
"notes": [
"hf mfu wrbl -b 0 -d 01234567",
"hf mfu wrbl -b 0 -d 01234567 -k AABBCCDD",
"hf mfu wrbl -b 0 -d 01234567 -k 00112233445566778899AABBCCDDEEFF"
],
"offline": false,
"options": [
"-h, --help This help",
"-k, --key <hex> Authentication key (UL-C 16 bytes, EV1/NTAG 4 bytes)",
"-l Swap entered key's endianness",
"-b, --block <dec> Block number to write",
"-d, --data <hex> Block data (4 or 16 hex bytes, 16 hex bytes will do a compatibility write)",
"--force Force operation even if address is out of range"
],
"usage": "hf mfu wrbl [-hl] [-k <hex>] -b <dec> -d <hex> [--force]"
},
"hf ntag424 auth": {
"command": "hf ntag424 auth",
"description": "Authenticate with selected key against NTAG424.",
"notes": [
"hf ntag424 auth --keyno 0 -k 00000000000000000000000000000000"
],
"offline": false,
"options": [
"-h, --help This help",
"--keyno <dec> Key number",
"-k, --key <hex> Key for authenticate (HEX 16 bytes)"
],
"usage": "hf ntag424 auth [-h] --keyno <dec> -k <hex>"
},
"hf ntag424 changefs": {
"command": "hf ntag424 changefs",
"description": "Updates file settings for file, must be authenticated. This is a short explanation of the settings. See AN12196 for more information: options: byte with bit flags Bit: Setting: 6 Enable SDM and mirroring access: two byte access rights. Each nibble is a key number, or E for free access. Order is key for readwrite, change, read and write sdmoptions: byte with bit flags Bit: Setting: 0 ASCII encoding 4 SDMEncFileData 5 SDMReadCtrLimit 6 SDMReadCtr 7 SDMOptionsUID sdmaccess: two byte access rights. Each nibble is a key, or E for plain mirror and F for no mirroring Order is Reserved, SDMCtrRet, SDMMetaRead and SDMFileRead sdm_data: Three bytes of data used to control SDM settings. Can be specified multiple times. Data means different things depending on settings. Note: Not all of these settings will be written. It depends on the option byte, and the keys set. See AN12196 for more information. You must also start with sdmdata1, then sdmdata2, up to the number of sdm_data you want to write",
"notes": [
"hf ntag424 changefs --fileno 2 --keyno 0 -k 00000000000000000000000000000000 -o 40 -a 00E0 -s C1 -c F000 --data1 000020 --data2 000043 --data3 000043"
],
"offline": false,
"options": [
"-h, --help This help",
"--fileno <dec> File number",
"--keyno <dec> Key number",
"-k, --key <hex> Key for authentication (HEX 16 bytes)",
"-o, --options <hex> File options byte (HEX 1 byte)",
"-a, --access <hex> File access settings (HEX 2 bytes)",
"-s, --sdmoptions <hex> SDM options (HEX 1 byte)",
"-c, --sdmaccess <hex> SDM access settings (HEX 2 bytes)",
"--data1 <hex> SDM data (HEX 3 bytes)",
"--data2 <hex> SDM data (HEX 3 bytes)",
"--data3 <hex> SDM data (HEX 3 bytes)",
"--data4 <hex> SDM data (HEX 3 bytes)",
"--data5 <hex> SDM data (HEX 3 bytes)",
"--data6 <hex> SDM data (HEX 3 bytes)",
"--data7 <hex> SDM data (HEX 3 bytes)",
"--data8 <hex> SDM data (HEX 3 bytes)"
],
"usage": "hf ntag424 changefs [-h] --fileno <dec> --keyno <dec> -k <hex> [-o <hex>] [-a <hex>] [-s <hex>] [-c <hex>] [--data1 <hex>] [--data2 <hex>] [--data3 <hex>] [--data4 <hex>] [--data5 <hex>] [--data6 <hex>] [--data7 <hex>] [--data8 <hex>]"
},
"hf ntag424 changekey": {
"command": "hf ntag424 changekey",
"description": "Change a key. Authentication key must currently be different to the one we want to change.",
"notes": [
"hf ntag424 changekey --keyno 1 --oldkey 00000000000000000000000000000000 --newkey 11111111111111111111111111111111 --key0 00000000000000000000000000000000 --kv 1",
"hf ntag424 changekey --keyno 0 --newkey 11111111111111111111111111111111 --key0 00000000000000000000000000000000 --kv 1"
],
"offline": false,
"options": [
"-h, --help This help",
"--keyno <dec> Key number to change",
"--oldkey <hex> Old key (only needed when changing key 1-4, HEX 16 bytes)",
"--newkey <hex> New key (HEX 16 bytes)",
"--key0 <hex> Authentication key (must be key 0, HEX 16 bytes)",
"--kv <dec> New key version number"
],
"usage": "hf ntag424 changekey [-h] --keyno <dec> [--oldkey <hex>] --newkey <hex> --key0 <hex> --kv <dec>"
},
"hf ntag424 getfs": {
"command": "hf ntag424 getfs",
"description": "Read and print file settings for file",
"notes": [
"hf ntag424 getfs --fileno 2"
],
"offline": false,
"options": [
"-h, --help This help",
"--fileno <dec> File number"
],
"usage": "hf ntag424 getfs [-h] --fileno <dec>"
},
"hf ntag424 help": {
"command": "hf ntag424 help",
"description": "help This help view Display content from tag dump file --------------------------------------------------------------------------------------- hf ntag424 info available offline: no Get info about NXP NTAG424 DNA Family styled tag.",
"notes": [
"hf ntag424 info"
],
"offline": true,
"options": [
"-h, --help This help"
],
"usage": "hf ntag424 info [-h]"
},
"hf ntag424 read": {
"command": "hf ntag424 read",
"description": "Read and print data from file on NTAG424 tag. Will authenticate if key information is provided.",
"notes": [
"hf ntag424 read --fileno 1 --keyno 0 -k 00000000000000000000000000000000 -o 0 -l 32",
"hf ntag424 read --fileno 2 --keyno 0 -k 00000000000000000000000000000000 -o 0 -l 256",
"hf ntag424 read --fileno 3 --keyno 3 -k 00000000000000000000000000000000 -o 0 -l 128 -m encrypt"
],
"offline": false,
"options": [
"-h, --help This help",
"--fileno <1|2|3> File number",
"--keyno <dec> Key number",
"-k, --key <hex> Key for authentication (HEX 16 bytes)",
"-o, --offset <dec> Offset to read in file (def 0)",
"-l, --length <dec> Number of bytes to read",
"-m, --cmode <plain|mac|encrypt> Communication mode"
],
"usage": "hf ntag424 read [-h] --fileno <1|2|3> [--keyno <dec>] [-k <hex>] [-o <dec>] -l <dec> [-m <plain|mac|encrypt>]"
},
"hf ntag424 view": {
"command": "hf ntag424 view",
"description": "Print a NTAG 424 DNA dump file (bin/eml/json)",
"notes": [
"hf ntag424 view -f hf-ntag424-01020304-dump.bin"
],
"offline": true,
"options": [
"-h, --help This help",
"-f, --file <fn> Specify a filename for dump file",
"-v, --verbose Verbose output"
],
"usage": "hf ntag424 view [-hv] -f <fn>"
},
"hf ntag424 write": {
"command": "hf ntag424 write",
"description": "Write data to file on NTAG424 tag. Will authenticate if key information is provided.",
"notes": [
"hf ntag424 write --fileno 2 --keyno 0 -k 00000000000000000000000000000000 -o 0 -d 1122334455667788",
"hf ntag424 write --fileno 3 --keyno 3 -k 00000000000000000000000000000000 -o 0 -d 1122334455667788 -m encrypt"
],
"offline": false,
"options": [
"-h, --help This help",
"--fileno <1|2|3> File number (def 2)",
"--keyno <dec> Key number",
"-k, --key <hex> Key for authentication (HEX 16 bytes)",
"-o, --offset <dec> Offset to write in file (def 0)",
"-d, --data <hex> Data to write",
"-m, --cmode <plain|mac|encrypt> Communication mode"
],
"usage": "hf ntag424 write [-h] --fileno <1|2|3> [--keyno <dec>] [-k <hex>] [-o <dec>] -d <hex> [-m <plain|mac|encrypt>]"
},
"hf plot": {
"command": "hf plot",
"description": "Plots HF signal after RF signal path and A/D conversion.",
"notes": [
"This can be used after any hf command and will show the last few milliseconds of the HF signal.",
"Note: If the last hf command terminated because of a timeout you will most probably see nothing."
],
"offline": false,
"options": [
"-h, --help This help"
],
"usage": "hf plot [-h]"
},
"hf search": {
"command": "hf search",
"description": "Will try to find a HF read out of the unknown tag. Continues to search for all different HF protocols.",
"notes": [
"hf search"
],
"offline": true,
"options": [
"-h, --help This help",
"-v, --verbose verbose output"
],
"usage": "hf search [-hv]"
},
"hf seos help": {
"command": "hf seos help",
"description": "help This help list List SEOS history --------------------------------------------------------------------------------------- hf seos info available offline: no Get info from SEOS tags",
"notes": [
"hf seos info"
],
"offline": true,
"options": [
"-h, --help This help"
],
"usage": "hf seos info [-h]"
},
"hf seos list": {
"command": "hf seos list",
"description": "Alias of `trace list -t seos -c` with selected protocol data to annotate trace buffer You can load a trace from file (see `trace load -h`) or it be downloaded from device by default It accepts all other arguments of `trace list`. Note that some might not be relevant for this specific protocol",
"notes": [
"hf seos list --frame -> show frame delay times",
"hf seos list -1 -> use trace buffer"
],
"offline": true,
"options": [
"-h, --help This help",
"-1, --buffer use data from trace buffer",
"--frame show frame delay times",
"-c mark CRC bytes",
"-r show relative times (gap and duration)",
"-u display times in microseconds instead of clock cycles",
"-x show hexdump to convert to pcap(ng)",
"or to import into Wireshark using encapsulation type \"ISO 14443\"",
"-f, --file <fn> filename of dictionary"
],
"usage": "hf seos list [-h1crux] [--frame] [-f <fn>]"
},
"hf sniff": {
"command": "hf sniff",
"description": "The high frequency sniffer will assign all available memory on device for sniffed data. Use `data samples` to download from device and `data plot` to visualize it. Press button to quit the sniffing.",
"notes": [
"hf sniff",
"hf sniff --sp 1000 --st 0 -> skip 1000 pairs, skip 0 triggers"
],
"offline": false,
"options": [
"-h, --help This help",
"--sp <dec> skip sample pairs",
"--st <dec> skip number of triggers",
"--smode [none|drop|min|max|avg] Skip mode. It switches on the function that applies to several samples before they saved to memory",
"--sratio <dec, ms> Skip ratio. It applied the function above to (ratio * 2) samples. For ratio = 1 it 2 samples."
],
"usage": "hf sniff [-h] [--sp <dec>] [--st <dec>] [--smode [none|drop|min|max|avg]] [--sratio <dec, ms>]"
},
"hf st25ta help": {
"command": "hf st25ta help",
"description": "help This help list List ISO 14443A/7816 history ndefread read NDEF file on tag --------------------------------------------------------------------------------------- hf st25ta info available offline: no Get info about ST25TA tag",
"notes": [
"hf st25ta info"
],
"offline": true,
"options": [
"-h, --help This help"
],
"usage": "hf st25ta info [-h]"
},
"hf st25ta list": {
"command": "hf st25ta list",
"description": "Alias of `trace list -t 7816` with selected protocol data to annotate trace buffer You can load a trace from file (see `trace load -h`) or it be downloaded from device by default It accepts all other arguments of `trace list`. Note that some might not be relevant for this specific protocol",
"notes": [
"hf st25ta list --frame -> show frame delay times",
"hf st25ta list -1 -> use trace buffer"
],
"offline": true,
"options": [
"-h, --help This help",
"-1, --buffer use data from trace buffer",
"--frame show frame delay times",
"-c mark CRC bytes",
"-r show relative times (gap and duration)",
"-u display times in microseconds instead of clock cycles",
"-x show hexdump to convert to pcap(ng)",
"or to import into Wireshark using encapsulation type \"ISO 14443\"",
"-f, --file <fn> filename of dictionary"
],
"usage": "hf st25ta list [-h1crux] [--frame] [-f <fn>]"
},
"hf st25ta ndefread": {
"command": "hf st25ta ndefread",
"description": "Read NFC Data Exchange Format (NDEF) file on ST25TA",
"notes": [
"hf st25ta ndefread -p 82E80053D4CA5C0B656D852CC696C8A1",
"hf st25ta ndefread -f myfilename -> save raw NDEF to file"
],
"offline": true,
"options": [
"-h, --help This help",
"-p, --pwd <hex> 16 byte read password",
"-f, --file <fn> save raw NDEF to file",
"-v, --verbose verbose output"
],
"usage": "hf st25ta ndefread [-hv] [-p <hex>] [-f <fn>]"
},
"hf st25ta protect": {
"command": "hf st25ta protect",
"description": "Change read or write protection for NFC Data Exchange Format (NDEF) file on ST25TA",
"notes": [
"hf st25ta protect -p 82E80053D4CA5C0B656D852CC696C8A1 -r -e -> enable read protection",
"hf st25ta protect -p 82E80053D4CA5C0B656D852CC696C8A1 -w -d -> disable write protection"
],
"offline": false,
"options": [
"-h, --help This help",
"-e, --enable enable protection",
"-d, --disable disable protection (default)",
"-r, --read change read protection",
"-w, --write change write protection (default)",
"-p, --password <hex> 16 byte write password"
],
"usage": "hf st25ta protect [-hedrw] -p <hex>"
},
"hf st25ta pwd": {
"command": "hf st25ta pwd",
"description": "Change read or write password for NFC Data Exchange Format (NDEF) file on ST25TA",
"notes": [
"hf st25ta pwd -p 82E80053D4CA5C0B656D852CC696C8A1 -r -n 00000000000000000000000000000000 -> change read password",
"hf st25ta pwd -p 82E80053D4CA5C0B656D852CC696C8A1 -w -n 00000000000000000000000000000000 -> change write password"
],
"offline": false,
"options": [
"-h, --help This help",
"-r, --read change the read password (default)",
"-w, --write change the write password",
"-p, --password <hex> current 16 byte write password",
"-n, --new <hex> new 16 byte password"
],
"usage": "hf st25ta pwd [-hrw] -p <hex> -n <hex>"
},
"hf st25ta sim": {
"command": "hf st25ta sim",
"description": "Emulating ST25TA512B tag with 7 byte UID",
"notes": [
"hf st25ta sim -u 02E2007D0FCA4C"
],
"offline": false,
"options": [
"-h, --help This help",
"-u, --uid <hex> 7 byte UID"
],
"usage": "hf st25ta sim [-h] -u <hex>"
},
"hf tesla help": {
"command": "hf tesla help",
"description": "help This help list List ISO 14443A/7816 history --------------------------------------------------------------------------------------- hf tesla info available offline: no Get info about TESLA Key tag",
"notes": [
"hf tesla info"
],
"offline": true,
"options": [
"-h, --help This help"
],
"usage": "hf telsa info [-h]"
},
"hf tesla list": {
"command": "hf tesla list",
"description": "Alias of `trace list -t 7816` with selected protocol data to annotate trace buffer You can load a trace from file (see `trace load -h`) or it be downloaded from device by default It accepts all other arguments of `trace list`. Note that some might not be relevant for this specific protocol",
"notes": [
"hf tesla list --frame -> show frame delay times",
"hf tesla list -1 -> use trace buffer"
],
"offline": true,
"options": [
"-h, --help This help",
"-1, --buffer use data from trace buffer",
"--frame show frame delay times",
"-c mark CRC bytes",
"-r show relative times (gap and duration)",
"-u display times in microseconds instead of clock cycles",
"-x show hexdump to convert to pcap(ng)",
"or to import into Wireshark using encapsulation type \"ISO 14443\"",
"-f, --file <fn> filename of dictionary"
],
"usage": "hf tesla list [-h1crux] [--frame] [-f <fn>]"
},
"hf texkom help": {
"command": "hf texkom help",
"description": "help This help --------------------------------------------------------------------------------------- hf texkom reader available offline: no Read a texkom tag",
"notes": [
"hf texkom reader",
"hf texkom reader -@ -> continuous reader mode"
],
"offline": true,
"options": [
"-h, --help This help",
"-1 Use data from Graphbuffer (offline mode)",
"-v, --verbose Verbose output",
"-@ optional - continuous reader mode"
],
"usage": "hf texkom reader [-h1v@]"
},
"hf texkom sim": {
"command": "hf texkom sim",
"description": "Simulate a texkom tag",
"notes": [
"hf texkom sim",
"hf texkom sim --raw FFFF638C7DC45553 -> simulate TK13 tag with id 8C7DC455",
"hf texkom sim --tk17 --raw FFFFCA17F31EC512 -> simulate TK17 tag with id 17F31EC5",
"hf texkom sim --id 8C7DC455 -> simulate TK13 tag with id 8C7DC455",
"hf texkom sim --id 8C7DC455 --tk17 -> simulate TK17 tag with id 17F31EC5"
],
"offline": false,
"options": [
"-h, --help This help",
"-v, --verbose Verbose output",
"-t, --tk17 Use TK-17 modulation (TK-13 by default)",
"--raw <hex 8 bytes> Raw data for texkom card, 8 bytes. Manual modulation select.",
"--id <hex 4 bytes> Raw data for texkom card, 8 bytes. Manual modulation select.",
"--timeout <dec, ms> Simulation timeout in the ms. If not specified or 0 - infinite. Command can be skipped by pressing the button"
],
"usage": "hf texkom sim [-hvt] [--raw <hex 8 bytes>] [--id <hex 4 bytes>] [--timeout <dec, ms>]"
},
"hf thinfilm help": {
"command": "hf thinfilm help",
"description": "help This help list List NFC Barcode / Thinfilm history - not correct --------------------------------------------------------------------------------------- hf thinfilm info available offline: no Get info from Thinfilm tags",
"notes": [
"hf thinfilm info"
],
"offline": true,
"options": [
"-h, --help This help"
],
"usage": "hf thinfilm info [-h]"
},
"hf thinfilm list": {
"command": "hf thinfilm list",
"description": "Alias of `trace list -t thinfilm` with selected protocol data to annotate trace buffer You can load a trace from file (see `trace load -h`) or it be downloaded from device by default It accepts all other arguments of `trace list`. Note that some might not be relevant for this specific protocol",
"notes": [
"hf thinfilm list --frame -> show frame delay times",
"hf thinfilm list -1 -> use trace buffer"
],
"offline": true,
"options": [
"-h, --help This help",
"-1, --buffer use data from trace buffer",
"--frame show frame delay times",
"-c mark CRC bytes",
"-r show relative times (gap and duration)",
"-u display times in microseconds instead of clock cycles",
"-x show hexdump to convert to pcap(ng)",
"or to import into Wireshark using encapsulation type \"ISO 14443\"",
"-f, --file <fn> filename of dictionary"
],
"usage": "hf thinfilm list [-h1crux] [--frame] [-f <fn>]"
},
"hf thinfilm sim": {
"command": "hf thinfilm sim",
"description": "Simulate Thinfilm tag",
"notes": [
"hf thinfilm sim -d B70470726f786d61726b2e636f6d"
],
"offline": false,
"options": [
"-h, --help This help",
"-d, --data <hex> bytes to send",
"--raw raw, provided bytes should include CRC"
],
"usage": "hf thinfilm sim [-h] -d <hex> [--raw]"
},
"hf topaz dump": {
"command": "hf topaz dump",
"description": "Dump TOPAZ tag to file (bin/json) If no <name> given, UID will be used as filename",
"notes": [
"hf topaz dump"
],
"offline": false,
"options": [
"-h, --help This help",
"-f, --file <fn> Specify a filename for dump file",
"--ns no save to file"
],
"usage": "hf topaz dump [-h] [-f <fn>] [--ns]"
},
"hf topaz help": {
"command": "hf topaz help",
"description": "help This help list List Topaz history view Display content from tag dump file --------------------------------------------------------------------------------------- hf topaz list available offline: yes Alias of `trace list -t topaz -c` with selected protocol data to annotate trace buffer You can load a trace from file (see `trace load -h`) or it be downloaded from device by default It accepts all other arguments of `trace list`. Note that some might not be relevant for this specific protocol",
"notes": [
"hf topaz list --frame -> show frame delay times",
"hf topaz list -1 -> use trace buffer"
],
"offline": true,
"options": [
"-h, --help This help",
"-1, --buffer use data from trace buffer",
"--frame show frame delay times",
"-c mark CRC bytes",
"-r show relative times (gap and duration)",
"-u display times in microseconds instead of clock cycles",
"-x show hexdump to convert to pcap(ng)",
"or to import into Wireshark using encapsulation type \"ISO 14443\"",
"-f, --file <fn> filename of dictionary"
],
"usage": "hf topaz list [-h1crux] [--frame] [-f <fn>]"
},
"hf topaz info": {
"command": "hf topaz info",
"description": "Get info from Topaz tags",
"notes": [
"hf topaz info",
"hf topaz info -f myfilename -> save raw NDEF to file"
],
"offline": false,
"options": [
"-h, --help This help",
"-f, --file <fn> save raw NDEF to file",
"-v, --verbose verbose output"
],
"usage": "hf topaz info [-hv] [-f <fn>]"
},
"hf topaz raw": {
"command": "hf topaz raw",
"description": "Send raw hex data to Topaz tags",
"notes": [
"hf topaz raw"
],
"offline": false,
"options": [
"-h, --help This help"
],
"usage": "hf topaz raw [-h]"
},
"hf topaz rdbl": {
"command": "hf topaz rdbl",
"description": "Read Topaz block",
"notes": [
"hf topaz rdbl --blk 7"
],
"offline": false,
"options": [
"-h, --help This help",
"--blk <dec> Block number"
],
"usage": "hf topaz rdbl [-h] --blk <dec>"
},
"hf topaz reader": {
"command": "hf topaz reader",
"description": "Read UID from Topaz tags",
"notes": [
"hf topaz reader",
"hf topaz reader -@ -> Continuous mode"
],
"offline": false,
"options": [
"-h, --help This help",
"-v, --verbose verbose output",
"-@ optional - continuous reader mode"
],
"usage": "hf topaz reader [-hv@]"
},
"hf topaz sim": {
"command": "hf topaz sim",
"description": "Simulate a Topaz tag",
"notes": [
"hf topaz sim -> Not yet implemented"
],
"offline": false,
"options": [
"-h, --help This help"
],
"usage": "hf topaz sim [-h]"
},
"hf topaz sniff": {
"command": "hf topaz sniff",
"description": "Sniff Topaz reader-tag communication",
"notes": [
"hf topaz sniff"
],
"offline": false,
"options": [
"-h, --help This help"
],
"usage": "hf topaz sniff [-h]"
},
"hf topaz view": {
"command": "hf topaz view",
"description": "Print a Topaz tag dump file (bin/eml/json)",
"notes": [
"hf topaz view -f hf-topaz-04010203-dump.bin"
],
"offline": true,
"options": [
"-h, --help This help",
"-f, --file <fn> Specify a filename for dump file"
],
"usage": "hf topaz view [-h] -f <fn>"
},
"hf topaz wrbl": {
"command": "hf topaz wrbl",
"description": "Write Topaz block with 8 hex bytes of data",
"notes": [
"hf topaz wrbl --blk 7 -d 1122334455667788"
],
"offline": false,
"options": [
"-h, --help This help",
"--blk <dec> Block number",
"-d, --data <hex> Block data (8 hex bytes)"
],
"usage": "hf topaz wrbl [-h] --blk <dec> -d <hex>"
},
"hf tune": {
"command": "hf tune",
"description": "Continuously measure HF antenna tuning. Press pm3 button or <Enter> to interrupt.",
"notes": [
"hf tune",
"hf tune --mix"
],
"offline": false,
"options": [
"-h, --help This help",
"-n, --iter <dec> number of iterations (default: 0=infinite)",
"--bar bar style",
"--mix mixed style",
"--value values style",
"-v, --verbose verbose output"
],
"usage": "hf tune [-hv] [-n <dec>] [--bar] [--mix] [--value]"
},
"hf vas decrypt": {
"command": "hf vas decrypt",
"description": "Decrypt a previously captured cryptogram",
"notes": [
"hf vas decrypt --pid pass.com.passkit.pksamples.nfcdemo -f vas_privkey.der -d c0b77375eae416b79449347f9fe838c05cdb57dc7470b97b93b806cb348771d9bfbe29d58538c7c7d7c3d015fa205b68bfccd726058a62f7f44085ac98dbf877120fd9059f1507b956e0a6d56d0a"
],
"offline": true,
"options": [
"-h, --help This help",
"--pid <str> PID, pass type id",
"-f, --file <fn> path to terminal private key file",
"-d, --data <hex> cryptogram to decrypt"
],
"usage": "hf vas decrypt [-h] [--pid <str>] [-f <fn>] [-d <hex>]"
},
"hf vas help": {
"command": "hf vas help",
"description": "-------- ----------- Value Added Service ----------- help This help -------- ----------------- General ----------------- decrypt Decrypt a previously captured VAS cryptogram --------------------------------------------------------------------------------------- hf vas reader available offline: no Read and decrypt Value Added Services (VAS) message",
"notes": [
"hf vas reader --url https://example.com -> URL Only mode",
"hf vas reader --pid pass.com.passkit.pksamples.nfcdemo -f vas_privkey.der -@"
],
"offline": true,
"options": [
"-h, --help This help",
"--pid <str> PID, pass type id",
"-f, --file <fn> path to terminal private key file",
"--url <str> a URL to provide to the mobile device",
"-@ continuous mode",
"-v, --verbose Verbose output"
],
"usage": "hf vas reader [-h@v] [--pid <str>] [-f <fn>] [--url <str>]"
},
"hf waveshare help": {
"command": "hf waveshare help",
"description": "help This help load Load image file to Waveshare NFC ePaper --------------------------------------------------------------------------------------- hf waveshare load available offline: yes Load image file to Waveshare NFC ePaper",
"notes": [
"hf waveshare load -f myfile -m 0 -> 2.13 inch e-paper ( 122, 250 )",
"hf waveshare load -f myfile -m 1 -> 2.9 inch e-paper ( 296, 128 )",
"hf waveshare load -f myfile -m 2 -> 4.2 inch e-paper ( 400, 300 )",
"hf waveshare load -f myfile -m 3 -> 7.5 inch e-paper ( 800, 480 )",
"hf waveshare load -f myfile -m 4 -> 2.7 inch e-paper ( 176, 276 )",
"hf waveshare load -f myfile -m 5 -> 2.13 inch e-paper B (with red) ( 104, 212 )",
"hf waveshare load -f myfile -m 6 -> 1.54 inch e-paper B (with red) ( 200, 200 )",
"hf waveshare load -f myfile -m 7 -> 7.5 inch e-paper HD ( 880, 528 )"
],
"offline": true,
"options": [
"-h, --help This help",
"-m <nr> model number [0 - 7] of your tag",
"-f, --file <fn> specify image to upload to tag",
"-s, --save <fn> save paletized version in file"
],
"usage": "hf waveshare load [-h] -m <nr> -f <fn> [-s <fn>]"
},
"hf xerox dump": {
"command": "hf xerox dump",
"description": "Dump all memory from a Fuji/Xerox tag ISO/IEC 14443 type B based communications",
"notes": [
"hf xerox dump"
],
"offline": false,
"options": [
"-h, --help This help",
"-f, --file <fn> filename to save dump to",
"-d, --decrypt decrypt secret blocks",
"--ns no save to file",
"-v, --verbose verbose output",
"-z, --dense dense dump output style"
],
"usage": "hf xerox dump [-hdvz] [-f <fn>] [--ns]"
},
"hf xerox help": {
"command": "hf xerox help",
"description": "help This help list List ISO-14443B history -------- ----------------------- General ----------------------- view Display content from tag dump file --------------------------------------------------------------------------------------- hf xerox list available offline: yes Alias of `trace list -t 14b -c` with selected protocol data to annotate trace buffer You can load a trace from file (see `trace load -h`) or it be downloaded from device by default It accepts all other arguments of `trace list`. Note that some might not be relevant for this specific protocol",
"notes": [
"hf 14b list --frame -> show frame delay times",
"hf 14b list -1 -> use trace buffer"
],
"offline": true,
"options": [
"-h, --help This help",
"-1, --buffer use data from trace buffer",
"--frame show frame delay times",
"-c mark CRC bytes",
"-r show relative times (gap and duration)",
"-u display times in microseconds instead of clock cycles",
"-x show hexdump to convert to pcap(ng)",
"or to import into Wireshark using encapsulation type \"ISO 14443\"",
"-f, --file <fn> filename of dictionary"
],
"usage": "hf 14b list [-h1crux] [--frame] [-f <fn>]"
},
"hf xerox info": {
"command": "hf xerox info",
"description": "Tag information for Fuji Xerox based tags ISO/IEC 14443 type B based communications",
"notes": [
"hf xerox info"
],
"offline": false,
"options": [
"-h, --help This help",
"-v, --verbose verbose output"
],
"usage": "hf xerox info [-hv]"
},
"hf xerox rdbl": {
"command": "hf xerox rdbl",
"description": "Read a Fuji/Xerox tag block",
"notes": [
"hf xerox rdbl -b 1"
],
"offline": false,
"options": [
"-h, --help This help",
"-b, --blk <dec> page number (0-255)"
],
"usage": "hf xerox rdbl [-h] -b <dec>"
},
"hf xerox reader": {
"command": "hf xerox reader",
"description": "Act as a 14443B reader to identify a Fuji Xerox based tag ISO/IEC 14443 type B based communications",
"notes": [
"hf xerox reader",
"hf xerox reader -@"
],
"offline": false,
"options": [
"-h, --help This help",
"-v, --verbose verbose output",
"-@ optional - continuous reader mode"
],
"usage": "hf xerox reader [-hv@]"
},
"hf xerox view": {
"command": "hf xerox view",
"description": "Print a Fuji/Xerox dump file (bin/eml/json) note: - command expects the filename to contain a UID which is needed to determine card memory type",
"notes": [
"hf xerox view -f hf-xerox-0102030405060708-dump.bin"
],
"offline": true,
"options": [
"-h, --help This help",
"-f, --file <fn> Specify a filename for dump file",
"-v, --verbose verbose output",
"-z, --dense dense dump output style"
],
"usage": "hf xerox view [-hvz] -f <fn>"
},
"hints": {
"command": "hints",
"description": "Turn on/off hints",
"notes": [
"hints --on",
"hints -1"
],
"offline": true,
"options": [
"-h, --help This help",
"-1, --on turn on hints",
"-0, --off turn off hints"
],
"usage": "hints [-h10]"
},
"hw bootloader": {
"command": "hw bootloader",
"description": "Reboot Proxmark3 into bootloader mode",
"notes": [
"hw bootloader"
],
"offline": false,
"options": [
"-h, --help This help"
],
"usage": "hw bootloader [-h]"
},
"hw break": {
"command": "hw break",
"description": "send break loop package",
"notes": [
"hw break"
],
"offline": false,
"options": [
"-h, --help This help"
],
"usage": "hw break [-h]"
},
"hw connect": {
"command": "hw connect",
"description": "Connects to a Proxmark3 device via specified serial port. Baudrate here is only for physical UART or UART-BT, NOT for USB-CDC or blue shark add-on",
"notes": [
"hw connect -p /dev/ttyACM0",
"hw connect -p /dev/ttyACM0 -b 115200"
],
"offline": true,
"options": [
"-h, --help This help",
"-p, --port <string> Serial port to connect to, else retry the last used one",
"-b, --baud <dec> Baudrate"
],
"usage": "hw connect [-h] [-p <string>] [-b <dec>]"
},
"hw dbg": {
"command": "hw dbg",
"description": "Set device side debug level output. Note: option `-4`, this option may cause malfunction itself by introducing delays in time critical functions like simulation or sniffing",
"notes": [
"hw dbg -> get current log level",
"hw dbg -1 -> set log level to _error_"
],
"offline": false,
"options": [
"-h, --help This help",
"-0 no debug messages",
"-1 error messages",
"-2 plus information messages",
"-3 plus debug messages",
"-4 print even debug messages in timing critical functions"
],
"usage": "hw dbg [-h01234]"
},
"hw fpgaoff": {
"command": "hw fpgaoff",
"description": "Turn of fpga and antenna field",
"notes": [
"hw fpgaoff"
],
"offline": false,
"options": [
"-h, --help This help"
],
"usage": "hw fpgaoff [-h]"
},
"hw help": {
"command": "hw help",
"description": "help This help ------------- ----------------------- Operation ----------------------- timeout Set the communication timeout on the client side version Show version information about the client and Proxmark3 ------------- ----------------------- Hardware ----------------------- connect Connect to the device via serial port --------------------------------------------------------------------------------------- hw detectreader available offline: no Start to detect presences of reader field",
"notes": [
"hw detectreader",
"hw detectreader -L"
],
"offline": true,
"options": [
"-h, --help This help",
"-L, --LF only detect low frequency 125/134 kHz",
"-H, --HF only detect high frequency 13.56 MHZ"
],
"usage": "hw detectreader [-hLH]"
},
"hw lcd": {
"command": "hw lcd",
"description": "Send command/data to LCD",
"notes": [
"hw lcd -r AA -c 03 -> sends 0xAA three times"
],
"offline": false,
"options": [
"-h, --help This help",
"-r, --raw <hex> data",
"-c, --cnt <dec> number of times to send"
],
"usage": "hw lcd [-h] -r <hex> -c <dec>"
},
"hw lcdreset": {
"command": "hw lcdreset",
"description": "Hardware reset LCD",
"notes": [
"hw lcdreset"
],
"offline": false,
"options": [
"-h, --help This help"
],
"usage": "hw lcdreset [-h]"
},
"hw ping": {
"command": "hw ping",
"description": "Test if the Proxmark3 is responsive",
"notes": [
"hw ping",
"hw ping --len 32"
],
"offline": false,
"options": [
"-h, --help This help",
"-l, --len <dec> length of payload to send"
],
"usage": "hw ping [-h] [-l <dec>]"
},
"hw readmem": {
"command": "hw readmem",
"description": "Reads processor flash memory into a file or views on console",
"notes": [
"hw readmem -f myfile -> save 512KB processor flash memory to file",
"hw readmem -a 8192 -l 512 -> display 512 bytes from offset 8192"
],
"offline": false,
"options": [
"-h, --help This help",
"-a, --adr <dec> flash address to start reading from",
"-l, --len <dec> length (default 32 or 512KB)",
"-f, --file <fn> save to file",
"-c, --cols <dec> column breaks",
"-r, --raw use raw address mode: read from anywhere, not just flash"
],
"usage": "hw readmem [-hr] [-a <dec>] [-l <dec>] [-f <fn>] [-c <dec>]"
},
"hw reset": {
"command": "hw reset",
"description": "Reset the Proxmark3 device.",
"notes": [
"hw reset"
],
"offline": false,
"options": [
"-h, --help This help"
],
"usage": "hw reset [-h]"
},
"hw sethfthresh": {
"command": "hw sethfthresh",
"description": "Set thresholds in HF/14a and Legic mode.",
"notes": [
"hw sethfthresh -t 7 -i 20 -l 8"
],
"offline": false,
"options": [
"-h, --help This help",
"-t, --thresh <dec> threshold, used in 14a reader mode (def 7)",
"-i, --high <dec> high threshold, used in 14a sniff mode (def 20)",
"-l, --legic <dec> threshold used in Legic mode (def 8)"
],
"usage": "hw sethfthresh [-h] [-t <dec>] [-i <dec>] [-l <dec>]"
},
"hw setlfdivisor": {
"command": "hw setlfdivisor",
"description": "Drive LF antenna at 12 MHz / (divisor + 1).",
"notes": [
"hw setlfdivisor -d 88"
],
"offline": false,
"options": [
"-h, --help This help",
"-d, --div <dec> 19 - 255 divisor value (def 95)"
],
"usage": "hw setlfdivisor [-h] -d <dec>"
},
"hw setmux": {
"command": "hw setmux",
"description": "Set the ADC mux to a specific value",
"notes": [
"hw setmux --hipkd -> set HIGH PEAK"
],
"offline": false,
"options": [
"-h, --help This help",
"--lopkd low peak",
"--loraw low raw",
"--hipkd high peak",
"--hiraw high raw"
],
"usage": "hw setmux [-h] [--lopkd] [--loraw] [--hipkd] [--hiraw]"
},
"hw standalone": {
"command": "hw standalone",
"description": "Start standalone mode",
"notes": [
"hw standalone -> start",
"hw standalone -a 1 -> start and send arg 1"
],
"offline": false,
"options": [
"-h, --help This help",
"-a, --arg <dec> argument byte",
"-b <str> UniSniff arg: 14a, 14b, 15, iclass"
],
"usage": "hw standalone [-h] [-a <dec>] [-b <str>]"
},
"hw status": {
"command": "hw status",
"description": "Show runtime status information about the connected Proxmark3",
"notes": [
"hw status",
"hw status --ms 1000 -> Test connection speed with 1000ms timeout"
],
"offline": false,
"options": [
"-h, --help This help",
"-m, --ms <ms> speed test timeout in micro seconds"
],
"usage": "hw status [-h] [-m <ms>]"
},
"hw tearoff": {
"command": "hw tearoff",
"description": "Configure a tear-off hook for the next write command supporting tear-off After having been triggered by a write command, the tear-off hook is deactivated Delay (in us) must be between 1 and 43000 (43ms). Precision is about 1/3us.",
"notes": [
"hw tearoff --delay 1200 -> define delay of 1200us",
"hw tearoff --on -> (re)activate a previously defined delay",
"hw tearoff --off -> deactivate a previously activated but not yet triggered hook"
],
"offline": false,
"options": [
"-h, --help This help",
"--delay <dec> Delay in us before triggering tear-off, must be between 1 and 43000",
"--on Activate tear-off hook",
"--off Deactivate tear-off hook",
"-s, --silent less verbose output"
],
"usage": "hw tearoff [-hs] [--delay <dec>] [--on] [--off]"
},
"hw tia": {
"command": "hw tia",
"description": "Trigger a Timing Interval Acquisition to re-adjust the RealTimeCounter divider",
"notes": [
"hw tia"
],
"offline": false,
"options": [
"-h, --help This help"
],
"usage": "hw tia [-h]"
},
"hw timeout": {
"command": "hw timeout",
"description": "Set the communication timeout on the client side",
"notes": [
"hw timeout -> Show current timeout",
"hw timeout -m 20 -> Set the timeout to 20ms",
"hw timeout --ms 500 -> Set the timeout to 500ms"
],
"offline": true,
"options": [
"-h, --help This help",
"-m, --ms <ms> timeout in micro seconds"
],
"usage": "hw timeout [-h] [-m <ms>]"
},
"hw tune": {
"command": "hw tune",
"description": "Measure tuning of device antenna. Results shown in graph window. This command doesn't actively tune your antennas, it's only informative by measuring voltage that the antennas will generate",
"notes": [
"hw tune"
],
"offline": false,
"options": [
"-h, --help This help"
],
"usage": "hw tune [-h]"
},
"hw version": {
"command": "hw version",
"description": "Show version information about the client and the connected Proxmark3",
"notes": [
"hw version"
],
"offline": true,
"options": [
"-h, --help This help"
],
"usage": "hw version [-h]"
},
"lf awid brute": {
"command": "lf awid brute",
"description": "Enables bruteforce of AWID reader with specified facility-code. This is a attack against reader. if cardnumber is given, it starts with it and goes up / down one step if cardnumber is not given, it starts with 1 and goes up to 65535",
"notes": [
"lf awid brute --fmt 26 --fc 224",
"lf awid brute --fmt 50 --fc 2001 --delay 2000",
"lf awid brute --fmt 50 --fc 2001 --cn 200 --delay 2000 -v"
],
"offline": false,
"options": [
"-h, --help This help",
"--fmt <dec> format length 26|50",
"--fc <dec> 8|16bit value facility code",
"--cn <dec> optional - card number to start with, max 65535",
"--delay <dec> optional - delay betweens attempts in ms. Default 1000ms",
"-v, --verbose verbose output"
],
"usage": "lf awid brute [-hv] --fmt <dec> --fc <dec> [--cn <dec>] [--delay <dec>]"
},
"lf awid clone": {
"command": "lf awid clone",
"description": "clone a AWID Prox tag to a T55x7, Q5/T5555 or EM4305/4469 tag",
"notes": [
"lf awid clone --fmt 26 --fc 123 --cn 1337 -> encode for T55x7 tag",
"lf awid clone --fmt 50 --fc 2001 --cn 13371337 -> encode long fmt for T55x7 tag",
"lf awid clone --fmt 26 --fc 123 --cn 1337 --q5 -> encode for Q5/T5555 tag",
"lf awid clone --fmt 26 --fc 123 --cn 1337 --em -> encode for EM4305/4469"
],
"offline": false,
"options": [
"-h, --help This help",
"--fmt <dec> format length 26|34|37|50",
"--fc <dec> 8|16bit value facility code",
"--cn <dec> 16|32-bit value card number",
"--q5 optional - specify writing to Q5/T5555 tag",
"--em optional - specify writing to EM4305/4469 tag"
],
"usage": "lf awid clone [-h] --fmt <dec> --fc <dec> --cn <dec> [--q5] [--em]"
},
"lf awid demod": {
"command": "lf awid demod",
"description": "Try to find AWID Prox preamble, if found decode / descramble data",
"notes": [
"lf awid demod",
"lf awid demod --raw"
],
"offline": true,
"options": [
"-h, --help This help"
],
"usage": "lf awid demod [-h]"
},
"lf awid help": {
"command": "lf awid help",
"description": "help this help demod demodulate an AWID FSK tag from the GraphBuffer --------------------------------------------------------------------------------------- lf awid brute available offline: no Enables bruteforce of AWID reader with specified facility-code. This is a attack against reader. if cardnumber is given, it starts with it and goes up / down one step if cardnumber is not given, it starts with 1 and goes up to 65535",
"notes": [
"lf awid brute --fmt 26 --fc 224",
"lf awid brute --fmt 50 --fc 2001 --delay 2000",
"lf awid brute --fmt 50 --fc 2001 --cn 200 --delay 2000 -v"
],
"offline": true,
"options": [
"-h, --help This help",
"--fmt <dec> format length 26|50",
"--fc <dec> 8|16bit value facility code",
"--cn <dec> optional - card number to start with, max 65535",
"--delay <dec> optional - delay betweens attempts in ms. Default 1000ms",
"-v, --verbose verbose output"
],
"usage": "lf awid brute [-hv] --fmt <dec> --fc <dec> [--cn <dec>] [--delay <dec>]"
},
"lf awid reader": {
"command": "lf awid reader",
"description": "read a AWID Prox tag",
"notes": [
"lf awid reader -@ -> continuous reader mode"
],
"offline": false,
"options": [
"-h, --help This help",
"-@ optional - continuous reader mode"
],
"usage": "lf awid reader [-h@]"
},
"lf awid sim": {
"command": "lf awid sim",
"description": "Enables simulation of AWID card with specified facility-code and card number. Simulation runs until the button is pressed or another USB command is issued.",
"notes": [
"lf awid sim --fmt 26 --fc 123 --cn 1337",
"lf awid sim --fmt 50 --fc 2001 --cn 13371337"
],
"offline": false,
"options": [
"-h, --help This help",
"--fmt <dec> format length 26|32|36|40",
"--fc <dec> 8-bit value facility code",
"--cn <dec> 16-bit value card number"
],
"usage": "lf awid sim [-h] --fmt <dec> --fc <dec> --cn <dec>"
},
"lf awid watch": {
"command": "lf awid watch",
"description": "Enables AWID compatible reader mode printing details of scanned AWID26 or AWID50 tags. Run until the button is pressed or another USB command is issued.",
"notes": [
"lf awid watch"
],
"offline": false,
"options": [
"-h, --help This help"
],
"usage": "lf awid watch [-h]"
},
"lf cmdread": {
"command": "lf cmdread",
"description": "Modulate LF reader field to send command before read. All periods in microseconds. - use `lf config` to set parameters",
"notes": [
"lf cmdread -d 50 -z 116 -o 166 -e W3000 -c W00110 -> probing for Hitag 1/S",
"lf cmdread -d 50 -z 116 -o 166 -e W3000 -c W11000 -> probing for Hitag 2/S",
"lf cmdread -d 50 -z 116 -o 166 -e W3000 -c W11010 -> probing for Hitag S",
"lf cmdread -d 50 -z 116 -o 166 -e W3000 -c W11000 -s 2000 -@ -> probing for Hitag 2/S, oscilloscope style",
"lf cmdread -d 48 -z 112 -o 176 -e W3000 -e S240 -e E336 -c W0S00000010000E -> probing for Hitag \u00b5(micro)"
],
"offline": false,
"options": [
"-h, --help This help",
"-d, --duration <us> delay OFF period, (0 for bitbang mode)",
"-c, --cmd <0|1|...> command symbols",
"-e, --extra <us> Extra symbol definition and duration (up to 4)",
"-o, --one <us> ONE time period",
"-z, --zero <us> ZERO time period",
"-s, --samples <dec> number of samples to collect",
"-v, --verbose verbose output",
"-k, --keep keep signal field ON after receive",
"--crc-ht calculate and append CRC-8/HITAG (also for ZX8211)",
"-@ continuous mode"
],
"usage": "lf cmdread [-hvk@] [-d <us>] [-c <0|1|...>] [-e <us>]... [-o <us>] [-z <us>] [-s <dec>] [--crc-ht]"
},
"lf cotag help": {
"command": "lf cotag help",
"description": "help This help demod demodulate an COTAG tag --------------------------------------------------------------------------------------- lf cotag demod available offline: yes Try to find COTAG preamble, if found decode / descramble data",
"notes": [
"lf cotag demod"
],
"offline": true,
"options": [
"-h, --help This help",
"-v, --verbose verbose output"
],
"usage": "lf cotag demod [-hv]"
},
"lf cotag reader": {
"command": "lf cotag reader",
"description": "read a COTAG tag, the current support for COTAG is limited.",
"notes": [
"lf cotag reader -2"
],
"offline": false,
"options": [
"-h, --help This help",
"-1 HIGH/LOW signal; maxlength bigbuff",
"-2 translation of HIGH/LOW into bytes with manchester 0,1",
"-3 raw signal; maxlength bigbuff"
],
"usage": "lf cotag reader [-h123]"
},
"lf destron clone": {
"command": "lf destron clone",
"description": "clone a Destron tag to a T55x7, Q5/T5555 or EM4305/4469 tag.",
"notes": [
"lf destron clone --uid 1A2B3C4D5E",
"lf destron clone --q5 --uid 1A2B3C4D5E -> encode for Q5/T5555 tag",
"lf destron clone --em --uid 1A2B3C4D5E -> encode for EM4305/4469"
],
"offline": false,
"options": [
"-h, --help This help",
"-u, --uid <hex> 5 bytes max",
"--q5 optional - specify writing to Q5/T5555 tag",
"--em optional - specify writing to EM4305/4469 tag"
],
"usage": "lf destron clone [-h] -u <hex> [--q5] [--em]"
},
"lf destron help": {
"command": "lf destron help",
"description": "help This help demod demodulate an Destron tag from the GraphBuffer --------------------------------------------------------------------------------------- lf destron demod available offline: yes Try to find Destron preamble, if found decode / descramble data",
"notes": [
"lf destron demod"
],
"offline": true,
"options": [
"-h, --help This help"
],
"usage": "lf destron demod [-h]"
},
"lf destron reader": {
"command": "lf destron reader",
"description": "read a Destron tag",
"notes": [
"lf destron reader -@ -> continuous reader mode"
],
"offline": false,
"options": [
"-h, --help This help",
"-@ optional - continuous reader mode"
],
"usage": "lf destron reader [-h@]"
},
"lf destron sim": {
"command": "lf destron sim",
"description": "Try to find Destron preamble, if found decode / descramble data",
"notes": [
"lf destron sim"
],
"offline": false,
"options": [
"-h, --help This help"
],
"usage": "lf destron sim [-h]"
},
"lf em 410x brute": {
"command": "lf em 410x brute",
"description": "bruteforcing by emulating EM 410x tag",
"notes": [
"lf em 410x brute -f ids.txt",
"lf em 410x brute -f ids.txt --clk 32",
"lf em 410x brute -f ids.txt --delay 3000",
"lf em 410x brute -f ids.txt --delay 3000 --clk 32"
],
"offline": false,
"options": [
"-h, --help This help",
"--clk <dec> <32|64> clock (default 64)",
"--delay <dec> pause delay in milliseconds between UIDs simulation (default 1000ms)",
"-f, --file <hex> file with EM Tag IDs, one id per line",
"--gap <dec> gap (0's) between ID repeats (default 20)"
],
"usage": "lf em 410x brute [-h] [--clk <dec>] [--delay <dec>] -f <hex> [--gap <dec>]"
},
"lf em 410x clone": {
"command": "lf em 410x clone",
"description": "clone a EM410x ID to a T55x7, Q5/T5555, EM4305/4469 or Hitag S/8211/8268/8310 tag.",
"notes": [
"lf em 410x clone --id 0F0368568B -> encode for T55x7 tag",
"lf em 410x clone --id 0F0368568B --q5 -> encode for Q5/T5555 tag",
"lf em 410x clone --id 0F0368568B --em -> encode for EM4305/4469",
"lf em 410x clone --id 0F0368568B --hts -> encode for Hitag S/8211/8268/8310"
],
"offline": false,
"options": [
"-h, --help This help",
"--clk <dec> <16|32|40|64> clock (default 64)",
"--id <hex> EM Tag ID number (5 hex bytes)",
"--q5 optional - specify writing to Q5/T5555 tag",
"--em optional - specify writing to EM4305/4469 tag",
"--hts optional - specify writing to Hitag S/8211/8268/8310 tag",
"--electra optional - add Electra blocks to tag"
],
"usage": "lf em 410x clone [-h] [--clk <dec>] --id <hex> [--q5] [--em] [--hts] [--electra]"
},
"lf em 410x reader": {
"command": "lf em 410x reader",
"description": "read EM 410x tag",
"notes": [
"lf em 410x reader",
"lf em 410x reader -@ -> continuous reader mode",
"lf em 410x reader --clk 32 -> using a clock of RF/32",
"lf em 410x reader --clk 32 -i -> using a clock of RF/32 and inverting data",
"lf em 410x reader -i -> inverting data",
"lf em 410x reader --clk 64 -i --err 0 -> using a clock of RF/64 and inverting data and allowing 0 demod errors"
],
"offline": false,
"options": [
"-h, --help This help",
"--clk <dec> clock (default autodetect)",
"--err <dec> maximum allowed errors (default 100)",
"--len <dec> maximum length",
"-i, --invert invert output",
"-a, --amp amplify signal",
"-b break on first found",
"-@ continuous reader mode",
"-v, --verbose verbose output"
],
"usage": "lf em 410x reader [-hiab@v] [--clk <dec>] [--err <dec>] [--len <dec>]"
},
"lf em 410x sim": {
"command": "lf em 410x sim",
"description": "Enables simulation of EM 410x card. Simulation runs until the button is pressed or another USB command is issued.",
"notes": [
"lf em 410x sim --id 0F0368568B",
"lf em 410x sim --id 0F0368568B --clk 32",
"lf em 410x sim --id 0F0368568B --gap 0"
],
"offline": false,
"options": [
"-h, --help This help",
"--clk <dec> <32|64> clock (default 64)",
"--id <hex> EM Tag ID number (5 hex bytes)",
"--gap <dec> gap (0's) between ID repeats (default 20)"
],
"usage": "lf em 410x sim [-h] [--clk <dec>] --id <hex> [--gap <dec>]"
},
"lf em 410x spoof": {
"command": "lf em 410x spoof",
"description": "Watch 'nd Spoof, activates reader Waits until a EM 410x tag gets presented then Proxmark3 starts simulating the found EM Tag ID",
"notes": [
"lf em 410x spoof"
],
"offline": false,
"options": [
"-h, --help This help"
],
"usage": "lf em 410x spoof [-h]"
},
"lf em 410x watch": {
"command": "lf em 410x watch",
"description": "Enables Electro Marine (EM) compatible reader mode printing details of scanned tags. Run until the button is pressed or another USB command is issued.",
"notes": [
"lf em 410x watch"
],
"offline": false,
"options": [
"-h, --help This help"
],
"usage": "lf em 410x watch [-h]"
},
"lf em 4x05 brute": {
"command": "lf em 4x05 brute",
"description": "This command tries to bruteforce the password of a EM4205/4305/4469/4569 The loop is running on device side, press Proxmark3 button to abort",
"notes": [
"Note: if you get many false positives, change position on the antennalf em 4x05 brute",
"lf em 4x05 brute -n 1 -> stop after first candidate found",
"lf em 4x05 brute -s 000022AA -> start at 000022AA"
],
"offline": false,
"options": [
"-h, --help This help",
"-s, --start <hex> Start bruteforce enumeration from this password value",
"-n <dec> Stop after having found n candidates. Default: 0 (infinite)"
],
"usage": "lf em 4x05 brute [-h] [-s <hex>] [-n <dec>]"
},
"lf em 4x05 chk": {
"command": "lf em 4x05 chk",
"description": "This command uses a dictionary attack against EM4205/4305/4469/4569",
"notes": [
"lf em 4x05 chk",
"lf em 4x05 chk -e 000022B8 -> check password 000022B8",
"lf em 4x05 chk -f t55xx_default_pwds -> use T55xx default dictionary"
],
"offline": false,
"options": [
"-h, --help This help",
"-f, --file <fn> loads a default keys dictionary file <*.dic>",
"-e, --em <EM4100> try the calculated password from some cloners based on EM4100 ID"
],
"usage": "lf em 4x05 chk [-h] [-f <fn>] [-e <EM4100>]"
},
"lf em 4x05 config": {
"command": "lf em 4x05 config",
"description": "Create common configuration blocks",
"notes": [
"lf em 4x05 config"
],
"offline": true,
"options": [
"-h, --help This help"
],
"usage": "lf em 4x05 config [-h]"
},
"lf em 4x05 demod": {
"command": "lf em 4x05 demod",
"description": "Try to find EM 4x05 preamble, if found decode / descramble data",
"notes": [
"lf em 4x05 demod"
],
"offline": true,
"options": [
"-h, --help This help"
],
"usage": "lf em 4x05 demod [-h]"
},
"lf em 4x05 dump": {
"command": "lf em 4x05 dump",
"description": "Dump EM4x05/EM4x69. Tag must be on antenna.",
"notes": [
"lf em 4x05 dump",
"lf em 4x05 dump -p 11223344",
"lf em 4x05 dump -f myfile -p 11223344"
],
"offline": false,
"options": [
"-h, --help This help",
"-p, --pwd <hex> password (00000000)",
"-f, --file <fn> override filename prefix (optional). Default is based on UID",
"--ns no save to file"
],
"usage": "lf em 4x05 dump [-h] [-p <hex>] [-f <fn>] [--ns]"
},
"lf em 4x05 help": {
"command": "lf em 4x05 help",
"description": "----------- ----------------------- General ----------------------- help This help ----------- ----------------------- Operations ----------------------- config Create common configuration words demod Demodulate a EM4x05/EM4x69 tag from the GraphBuffer sniff Attempt to recover em4x05 commands from sample buffer view Display content from tag dump file --------------------------------------------------------------------------------------- lf em 4x05 clonehelp available offline: no Display a list of available commands for cloning specific techs on EM4305/4469 tags",
"notes": [
"lf em 4x05 clonehelp"
],
"offline": true,
"options": [
"-h, --help This help"
],
"usage": "lf em 4x05 clonehelp [-h]"
},
"lf em 4x05 info": {
"command": "lf em 4x05 info",
"description": "Tag information EM4205/4305/4469//4569 tags. Tag must be on antenna.",
"notes": [
"lf em 4x05 info",
"lf em 4x05 info -p 11223344"
],
"offline": false,
"options": [
"-h, --help This help",
"-p, --pwd <hex> optional - password, 4 hex bytes",
"-v, --verbose Verbose output"
],
"usage": "lf em 4x05 info [-hv] [-p <hex>]"
},
"lf em 4x05 read": {
"command": "lf em 4x05 read",
"description": "Read EM4x05/EM4x69. Tag must be on antenna.",
"notes": [
"lf em 4x05 read -a 1",
"lf em 4x05 read --addr 1 --pwd 11223344"
],
"offline": false,
"options": [
"-h, --help This help",
"-a, --addr <dec> memory address to read. (0-15)",
"-p, --pwd <hex> optional - password, 4 bytes hex"
],
"usage": "lf em 4x05 read [-h] -a <dec> [-p <hex>]"
},
"lf em 4x05 sniff": {
"command": "lf em 4x05 sniff",
"description": "Sniff EM4x05 commands sent from a programmer",
"notes": [
"lf em 4x05 sniff -> sniff via lf sniff",
"lf em 4x05 sniff -1 -> sniff from data loaded into the buffer",
"lf em 4x05 sniff -r -> reverse the bit order when showing block data"
],
"offline": true,
"options": [
"-h, --help This help",
"-1, --buf Use the data in the buffer",
"-r, --rev Reverse the bit order for data blocks"
],
"usage": "lf em 4x05 sniff [-h1r]"
},
"lf em 4x05 unlock": {
"command": "lf em 4x05 unlock",
"description": "execute tear off against EM4205/4305/4469/4569",
"notes": [
"lf em 4x05 unlock",
"lf em 4x05 unlock -s 4100 -e 4100 -> lock on and autotune at 4100us",
"lf em 4x05 unlock -n 10 -s 3000 -e 4400 -> scan delays 3000us -> 4400us"
],
"offline": false,
"options": [
"-h, --help This help",
"-n <int> steps to skip",
"-s, --start <us> start scan from delay (us)",
"-e, --end <us> end scan at delay (us)",
"-p, --pwd <hex> password (def 00000000)",
"-v, --verbose verbose output"
],
"usage": "lf em 4x05 unlock [-hv] [-n <int>] [-s <us>] [-e <us>] [-p <hex>]"
},
"lf em 4x05 view": {
"command": "lf em 4x05 view",
"description": "Print a EM4205/4305/4369/4469 dump file note: We don't track if password is known in current dump file formats. All zeros password block might be filler data",
"notes": [
"lf em 4x05 view -f lf-4x05-01020304-dump.json"
],
"offline": true,
"options": [
"-h, --help This help",
"-f, --file <fn> Specify a filename for dump file",
"-v, --verbose Verbose output"
],
"usage": "lf em 4x05 view [-hv] -f <fn>"
},
"lf em 4x05 wipe": {
"command": "lf em 4x05 wipe",
"description": "Wipe EM4x05/EM4x69. Tag must be on antenna.",
"notes": [
"lf em 4x05 wipe --4305 -p 11223344 -> wipe EM 4305 w pwd",
"lf em 4x05 wipe --4205 -> wipe EM 4205",
"lf em 4x05 wipe --4369 -> wipe EM 4369"
],
"offline": false,
"options": [
"-h, --help This help",
"--4205 target chip type EM 4205",
"--4305 target chip type EM 4305 (default)",
"--4369 target chip type EM 4369",
"--4469 target chip type EM 4469",
"-p, --pwd <hex> optional - password, 4 bytes hex"
],
"usage": "lf em 4x05 wipe [-h] [--4205] [--4305] [--4369] [--4469] [-p <hex>]"
},
"lf em 4x05 write": {
"command": "lf em 4x05 write",
"description": "Write EM4x05/EM4x69. Tag must be on antenna.",
"notes": [
"lf em 4x05 write -a 1 -d deadc0de",
"lf em 4x05 write --addr 1 --pwd 11223344 --data deadc0de",
"lf em 4x05 write --po --pwd 11223344 --data deadc0de"
],
"offline": false,
"options": [
"-h, --help This help",
"-a, --addr <dec> memory address to write to. (0-13)",
"-d, --data <hex> data to write (4 hex bytes)",
"-p, --pwd <hex> password (4 hex bytes)",
"--po protect operation"
],
"usage": "lf em 4x05 write [-h] [-a <dec>] -d <hex> [-p <hex>] [--po]"
},
"lf em 4x50 chk": {
"command": "lf em 4x50 chk",
"description": "Run dictionary key recovery against EM4x50 card.",
"notes": [
"lf em 4x50 chk -> uses T55xx default dictionary",
"lf em 4x50 chk -f my.dic"
],
"offline": false,
"options": [
"-h, --help This help",
"-f, --file <fn> specify dictionary filename"
],
"usage": "lf em 4x50 chk [-h] [-f <fn>]"
},
"lf em 4x50 dump": {
"command": "lf em 4x50 dump",
"description": "Reads all blocks/words from EM4x50 tag and saves dump in (bin/json) format",
"notes": [
"lf em 4x50 dump",
"lf em 4x50 dump -f mydump",
"lf em 4x50 dump -p 12345678",
"lf em 4x50 dump -f mydump -p 12345678"
],
"offline": false,
"options": [
"-h, --help This help",
"-f, --file <fn> specify dump filename",
"-p, --pwd <hex> password, 4 hex bytes, lsb",
"--ns no save to file"
],
"usage": "lf em 4x50 dump [-h] [-f <fn>] [-p <hex>] [--ns]"
},
"lf em 4x50 eload": {
"command": "lf em 4x50 eload",
"description": "Loads EM4x50 tag dump (bin/eml/json) into emulator memory on device",
"notes": [
"lf em 4x50 eload -f mydump.bin"
],
"offline": false,
"options": [
"-h, --help This help",
"-f, --file <fn> Specify a filename for dump file"
],
"usage": "lf em 4x50 eload [-h] -f <fn>"
},
"lf em 4x50 esave": {
"command": "lf em 4x50 esave",
"description": "Saves bin/json dump file of emulator memory.",
"notes": [
"lf em 4x50 esave -> use UID as filename",
"lf em 4x50 esave -f mydump"
],
"offline": false,
"options": [
"-h, --help This help",
"-f, --file <fn> specifiy filename"
],
"usage": "lf em 4x50 esave [-h] [-f <fn>]"
},
"lf em 4x50 eview": {
"command": "lf em 4x50 eview",
"description": "Displays em4x50 content of emulator memory.",
"notes": [
"lf em 4x50 eview"
],
"offline": false,
"options": [
"-h, --help This help"
],
"usage": "lf em 4x50 eview [-h]"
},
"lf em 4x50 help": {
"command": "lf em 4x50 help",
"description": "help This help ----------- --------------------- operations --------------------- view Display content from tag dump file ----------- --------------------- simulation --------------------- --------------------------------------------------------------------------------------- lf em 4x50 brute available offline: no Tries to bruteforce the password of a EM4x50 card. Function can be stopped by pressing pm3 button.",
"notes": [
"lf em 4x50 brute --mode range --begin 12330000 --end 12340000 -> tries pwds from 0x12330000 to 0x12340000",
"lf em 4x50 brute --mode charset --digits --uppercase -> tries all combinations of ASCII codes for digits and uppercase letters",
"lf em 4x50 brute --mode smart -> enable 'smart' pattern key cracking"
],
"offline": true,
"options": [
"-h, --help This help",
"--mode <str> Bruteforce mode (range|charset|smart)",
"--begin <hex> Range mode - start of the key range",
"--end <hex> Range mode - end of the key range",
"--digits Charset mode - include ASCII codes for digits",
"--uppercase Charset mode - include ASCII codes for uppercase letters"
],
"usage": "lf em 4x50 brute [-h] --mode <str> [--begin <hex>] [--end <hex>] [--digits] [--uppercase]"
},
"lf em 4x50 info": {
"command": "lf em 4x50 info",
"description": "Tag information EM4x50.",
"notes": [
"lf em 4x50 info",
"lf em 4x50 info -v -> show data section",
"lf em 4x50 info -p 12345678 -> uses pwd 0x12345678"
],
"offline": false,
"options": [
"-h, --help This help",
"-p, --pwd <hex> password, 4 hex bytes, lsb",
"-v, --verbose verbose output"
],
"usage": "lf em 4x50 info [-hv] [-p <hex>]"
},
"lf em 4x50 login": {
"command": "lf em 4x50 login",
"description": "Login into EM4x50 tag.",
"notes": [
"lf em 4x50 login -p 12345678 -> login with password 12345678"
],
"offline": false,
"options": [
"-h, --help This help",
"-p, --passsword <hex> password, 4 bytes, lsb"
],
"usage": "lf em 4x50 login [-h] -p <hex>"
},
"lf em 4x50 rdbl": {
"command": "lf em 4x50 rdbl",
"description": "Reads single EM4x50 block/word.",
"notes": [
"lf em 4x50 rdbl -b 3",
"lf em 4x50 rdbl -b 32 -p 12345678 -> reads block 32 with pwd 0x12345678"
],
"offline": false,
"options": [
"-h, --help This help",
"-b, --block <dec> block/word address",
"-p, --pwd <hex> password, 4 hex bytes, lsb"
],
"usage": "lf em 4x50 rdbl [-h] -b <dec> [-p <hex>]"
},
"lf em 4x50 reader": {
"command": "lf em 4x50 reader",
"description": "Shows standard read data of EM4x50 tag.",
"notes": [
"lf em 4x50 reader",
"lf em 4x50 reader -@ -> continuous reader mode"
],
"offline": false,
"options": [
"-h, --help This help",
"-@ optional - continuous reader mode"
],
"usage": "lf em 4x50 reader [-h@]"
},
"lf em 4x50 restore": {
"command": "lf em 4x50 restore",
"description": "Restores data from dumpfile (bin/eml/json) onto a EM4x50 tag. if used with -u, the filetemplate `lf-4x50-UID-dump.bin` is used as filename",
"notes": [
"lf em 4x50 restore -u 1b5aff5c -> uses lf-4x50-1B5AFF5C-dump.bin",
"lf em 4x50 restore -f mydump.eml",
"lf em 4x50 restore -u 1b5aff5c -p 12345678",
"lf em 4x50 restore -f mydump.eml -p 12345678"
],
"offline": false,
"options": [
"-h, --help This help",
"-u, --uid <hex> uid, 4 hex bytes, msb",
"-f, --file <fn> specify a filename for dump file",
"-p, --pwd <hex> password, 4 hex bytes, lsb"
],
"usage": "lf em 4x50 restore [-h] [-u <hex>] [-f <fn>] [-p <hex>]"
},
"lf em 4x50 sim": {
"command": "lf em 4x50 sim",
"description": "Simulates a EM4x50 tag First upload to device using `lf em 4x50 eload`",
"notes": [
"lf em 4x50 sim",
"lf em 4x50 sim -p 27182818 -> uses password for eload data"
],
"offline": false,
"options": [
"-h, --help This help",
"-p, --passsword <hex> password, 4 bytes, lsb"
],
"usage": "lf em 4x50 sim [-h] [-p <hex>]"
},
"lf em 4x50 view": {
"command": "lf em 4x50 view",
"description": "Print a EM4x50 dump file",
"notes": [
"lf em 4x50 view -f lf-4x50-01020304-dump.json"
],
"offline": true,
"options": [
"-h, --help This help",
"-f, --file <fn> specify a filename for dump file"
],
"usage": "lf em 4x50 view [-h] [-f <fn>]"
},
"lf em 4x50 wipe": {
"command": "lf em 4x50 wipe",
"description": "Wipes EM4x50 tag by filling it with zeros, including the new password Must give a password.",
"notes": [
"lf em 4x50 wipe -p 12345678"
],
"offline": false,
"options": [
"-h, --help This help",
"-p, --passsword <hex> password, 4 bytes, lsb"
],
"usage": "lf em 4x50 wipe [-h] -p <hex>"
},
"lf em 4x50 wrbl": {
"command": "lf em 4x50 wrbl",
"description": "Writes single block/word to EM4x50 tag.",
"notes": [
"lf em 4x50 wrbl -b 3 -d 4f22e7ff",
"lf em 4x50 wrbl -b 3 -d 4f22e7ff -p 12345678"
],
"offline": false,
"options": [
"-h, --help This help",
"-b, --block <dec> block/word address, dec",
"-d, --data <hex> data, 4 bytes, lsb",
"-p, --pwd <hex> password, 4 bytes, lsb"
],
"usage": "lf em 4x50 wrbl [-h] -b <dec> -d <hex> [-p <hex>]"
},
"lf em 4x50 wrpwd": {
"command": "lf em 4x50 wrpwd",
"description": "Writes EM4x50 password.",
"notes": [
"lf em 4x50 wrpwd -p 4f22e7ff -n 12345678"
],
"offline": false,
"options": [
"-h, --help This help",
"-p, --pwd <hex> password, 4 hex bytes, lsb",
"-n, --new <hex> new password, 4 hex bytes, lsb"
],
"usage": "lf em 4x50 wrpwd [-h] -p <hex> -n <hex>"
},
"lf em 4x70 auth": {
"command": "lf em 4x70 auth",
"description": "Authenticate against an EM4x70 by sending random number (RN) and F(RN) If F(RN) is incorrect based on the tag key, the tag will not respond If F(RN) is correct based on the tag key, the tag will give a 20-bit response",
"notes": [
"lf em 4x70 auth --rnd 45F54ADA252AAC --frn 4866BB70 -> (using pm3 test key)",
"lf em 4x70 auth --rnd 3FFE1FB6CC513F --frn F355F1A0 -> (using research paper key)",
"lf em 4x70 auth --rnd 7D5167003571F8 --frn 982DBCC0 -> (autorecovery test key)"
],
"offline": false,
"options": [
"-h, --help This help",
"--par Add parity bit when sending commands",
"--rnd <hex> Random 56-bit",
"--frn <hex> F(RN) 28-bit as 4 hex bytes"
],
"usage": "lf em 4x70 auth [-h] [--par] --rnd <hex> --frn <hex>"
},
"lf em 4x70 autorecover": {
"command": "lf em 4x70 autorecover",
"description": "This command will perform automatic recovery of the key from a writable tag. All steps are possible to do manually. The corresponding sequence, if done manually, is as follows: 1. Verify passed parameters authenticate with the tag (safety check) lf em 4x70 auth --rnd <rnd_1> --frn <frn_1> 2. Brute force the key bits in block 9 lf em 4x70 write -b 9 -d 0000 lf em 4x70 recover -b 9 --rnd <rnd_1> --frn <frn_1> lf em 4x70 write -b 9 -d <key_block_9> 3. Brute force the key bits in block 8 lf em 4x70 write -b 8 -d 0000 lf em 4x70 recover -b 8 --rnd <rnd_1> --frn <frn_1> lf em 4x70 write -b 8 -d <key_block_8> 4. Brute force the key bits in block 7 lf em 4x70 write -b 7 -d 0000) lf em 4x70 recover -b 7 --rnd <rnd_1> --frn <frn_1> lf em 4x70 write -b 7 -d <key_block_7> 5. Recover potential values of the lower 48 bits of the key lf em 4x70 recover --key <key_block_9><key_block_8><key_block_7> --rnd <rnd_1> --frn <frn_1> 6. Verify which potential key is actually on the tag (using a different rnd/frn combination) lf em 4x70 auth --rnd <rnd_2> --frn <frn_N> 7. Print the validated key This command simply requires the rnd/frn/grn from a single known-good authentication.",
"notes": [
"lf em 4x70 autorecover --rnd 45F54ADA252AAC --frn 4866BB70 --grn 9BD180 (pm3 test key)",
"lf em 4x70 autorecover --rnd 3FFE1FB6CC513F --frn F355F1A0 --grn 609D60 (research paper key)",
"lf em 4x70 autorecover --rnd 7D5167003571F8 --frn 982DBCC0 --grn 36C0E0 (autorecovery test key)"
],
"offline": false,
"options": [
"-h, --help This help",
"--par Add parity bit when sending commands",
"--rnd <hex> Random 56-bit from known-good authentication",
"--frn <hex> F(RN) 28-bit as 4 hex bytes from known-good authentication",
"--grn <hex> G(RN) 20-bit as 3 hex bytes from known-good authentication"
],
"usage": "lf em 4x70 autorecover [-h] [--par] --rnd <hex> --frn <hex> --grn <hex>"
},
"lf em 4x70 calc": {
"command": "lf em 4x70 calc",
"description": "Calculates both the reader and tag challenge for a user-provided key and rnd.",
"notes": [
"lf em 4x70 calc --key F32AA98CF5BE4ADFA6D3480B --rnd 45F54ADA252AAC (pm3 test key)",
"lf em 4x70 calc --key A090A0A02080000000000000 --rnd 3FFE1FB6CC513F (research paper key)",
"lf em 4x70 calc --key 022A028C02BE000102030405 --rnd 7D5167003571F8 (autorecovery test key)"
],
"offline": true,
"options": [
"-h, --help This help",
"--key <hex> Key 96-bit as 12 hex bytes",
"--rnd <hex> 56-bit random value sent to tag for authentication"
],
"usage": "lf em 4x70 calc [-h] --key <hex> --rnd <hex>"
},
"lf em 4x70 help": {
"command": "lf em 4x70 help",
"description": "help This help calc Calculate EM4x70 challenge and response recover Recover remaining key from partial key --------------------------------------------------------------------------------------- lf em 4x70 brute available offline: no Optimized partial key-update attack of 16-bit key block 7, 8 or 9 of an EM4x70 This attack does NOT write anything to the tag. Before starting this attack, 0000 must be written to the 16-bit key block: 'lf em 4x70 write -b 9 -d 0000'. After success, the 16-bit key block have to be restored with the key found: 'lf em 4x70 write -b 9 -d c0de'",
"notes": [
"lf em 4x70 brute -b 9 --rnd 45F54ADA252AAC --frn 4866BB70 -> bruteforcing key bits k95...k80 (pm3 test key)",
"lf em 4x70 brute -b 8 --rnd 3FFE1FB6CC513F --frn F355F1A0 -> bruteforcing key bits k79...k64 (research paper key)",
"lf em 4x70 brute -b 7 --rnd 7D5167003571F8 --frn 982DBCC0 -> bruteforcing key bits k63...k48 (autorecovery test key)"
],
"offline": true,
"options": [
"-h, --help This help",
"--par Add parity bit when sending commands",
"-b, --block <dec> block/word address, dec",
"--rnd <hex> Random 56-bit",
"--frn <hex> F(RN) 28-bit as 4 hex bytes",
"-s, --start <hex> Start bruteforce enumeration from this key value"
],
"usage": "lf em 4x70 brute [-h] [--par] -b <dec> --rnd <hex> --frn <hex> [-s <hex>]"
},
"lf em 4x70 info": {
"command": "lf em 4x70 info",
"description": "Tag Information EM4x70 Tag variants include ID48 automotive transponder. ID48 does not use command parity (default). V4070 and EM4170 do require parity bit.",
"notes": [
"lf em 4x70 info",
"lf em 4x70 info --par -> adds parity bit to command"
],
"offline": false,
"options": [
"-h, --help This help",
"--par Add parity bit when sending commands"
],
"usage": "lf em 4x70 info [-h] [--par]"
},
"lf em 4x70 recover": {
"command": "lf em 4x70 recover",
"description": "After obtaining key bits 95..48 (such as via 'lf em 4x70 brute'), this command will recover key bits 47..00. By default, this process does NOT require a tag to be present. By default, the potential keys are shown (typically 1-6) along with a corresponding 'lf em 4x70 auth' command that will authenticate, if that potential key is correct. The user can copy/paste these commands when the tag is present to manually check which of the potential keys is correct.",
"notes": [
"lf em 4x70 recover --key F32AA98CF5BE --rnd 45F54ADA252AAC --frn 4866BB70 --grn 9BD180 (pm3 test key)",
"lf em 4x70 recover --key A090A0A02080 --rnd 3FFE1FB6CC513F --frn F355F1A0 --grn 609D60 (research paper key)",
"lf em 4x70 recover --key 022A028C02BE --rnd 7D5167003571F8 --frn 982DBCC0 --grn 36C0E0 (autorecovery test key)"
],
"offline": true,
"options": [
"-h, --help This help",
"--par Add parity bit when sending commands",
"-k, --key <hex> Key as 6 hex bytes",
"--rnd <hex> Random 56-bit",
"--frn <hex> F(RN) 28-bit as 4 hex bytes",
"--grn <hex> G(RN) 20-bit as 3 hex bytes"
],
"usage": "lf em 4x70 recover [-h] [--par] -k <hex> --rnd <hex> --frn <hex> --grn <hex>"
},
"lf em 4x70 setkey": {
"command": "lf em 4x70 setkey",
"description": "Write new 96-bit key to tag",
"notes": [
"lf em 4x70 setkey -k F32AA98CF5BE4ADFA6D3480B (pm3 test key)",
"lf em 4x70 setkey -k A090A0A02080000000000000 (research paper key)",
"lf em 4x70 setkey -k 022A028C02BE000102030405 (autorecovery test key)"
],
"offline": false,
"options": [
"-h, --help This help",
"--par Add parity bit when sending commands",
"-k, --key <hex> Key as 12 hex bytes"
],
"usage": "lf em 4x70 setkey [-h] [--par] -k <hex>"
},
"lf em 4x70 setpin": {
"command": "lf em 4x70 setpin",
"description": "Write new PIN",
"notes": [
"lf em 4x70 setpin -p 11223344 -> Write new PIN",
"lf em 4x70 setpin -p 11223344 --par -> Write new PIN using parity commands"
],
"offline": false,
"options": [
"-h, --help This help",
"--par Add parity bit when sending commands",
"-p, --pin <hex> pin, 4 bytes"
],
"usage": "lf em 4x70 setpin [-h] [--par] -p <hex>"
},
"lf em 4x70 unlock": {
"command": "lf em 4x70 unlock",
"description": "Unlock EM4x70 by sending PIN Default pin may be: AAAAAAAA 00000000",
"notes": [
"lf em 4x70 unlock -p 11223344 -> Unlock with PIN",
"lf em 4x70 unlock -p 11223344 --par -> Unlock with PIN using parity commands"
],
"offline": false,
"options": [
"-h, --help This help",
"--par Add parity bit when sending commands",
"-p, --pin <hex> pin, 4 bytes"
],
"usage": "lf em 4x70 unlock [-h] [--par] -p <hex>"
},
"lf em 4x70 write": {
"command": "lf em 4x70 write",
"description": "Write EM4x70",
"notes": [
"lf em 4x70 write -b 15 -d c0de -> write 'c0de' to block 15",
"lf em 4x70 write -b 15 -d c0de --par -> adds parity bit to commands"
],
"offline": false,
"options": [
"-h, --help This help",
"--par Add parity bit when sending commands",
"-b, --block <dec> block/word address, dec",
"-d, --data <hex> data, 2 bytes"
],
"usage": "lf em 4x70 write [-h] [--par] -b <dec> -d <hex>"
},
"lf em help": {
"command": "lf em help",
"description": "help This help 410x { EM 4102 commands... } 4x05 { EM 4205 / 4305 / 4369 / 4469 commands... } 4x50 { EM 4350 / 4450 commands... } 4x70 { EM 4070 / 4170 commands... } ======================================================================================= lf em 410x { EM 4102 commands... } --------------------------------------------------------------------------------------- lf em 410x help available offline: yes help This help demod demodulate a EM410x tag from the GraphBuffer --------------------------------------------------------------------------------------- lf em 410x demod available offline: yes Try to find EM 410x preamble, if found decode / descramble data",
"notes": [
"lf em 410x demod -> demod an EM410x Tag ID from GraphBuffer",
"lf em 410x demod --clk 32 -> demod an EM410x Tag ID from GraphBuffer using a clock of RF/32",
"lf em 410x demod --clk 32 -i -> demod an EM410x Tag ID from GraphBuffer using a clock of RF/32 and inverting data",
"lf em 410x demod -i -> demod an EM410x Tag ID from GraphBuffer while inverting data",
"lf em 410x demod --clk 64 -i --err 0 -> demod an EM410x Tag ID from GraphBuffer using a clock of RF/64 and inverting data and allowing 0 demod errors"
],
"offline": true,
"options": [
"-h, --help This help",
"--clk <dec> clock (default autodetect)",
"--err <dec> maximum allowed errors (default 100)",
"--len <dec> maximum length",
"-i, --invert invert output",
"-a, --amp amplify signal",
"--bin <bin> Binary string i.e 0001001001"
],
"usage": "lf em 410x demod [-hia] [--clk <dec>] [--err <dec>] [--len <dec>] [--bin <bin>]"
},
"lf fdxb clone": {
"command": "lf fdxb clone",
"description": "clone a FDX-B tag to a T55x7, Q5/T5555 or EM4305/4469 tag.",
"notes": [
"lf fdxb clone --country 999 --national 1337 --animal -> encode for T55x7 tag, with animal bit",
"lf fdxb clone --country 999 --national 1337 --extended 016A -> encode for T55x7 tag, with extended data",
"lf fdxb clone --country 999 --national 1337 --q5 -> encode for Q5/T5555 tag",
"lf fdxb clone --country 999 --national 1337 --em -> encode for EM4305/4469"
],
"offline": false,
"options": [
"-h, --help This help",
"-c, --country <dec> country code",
"-n, --national <dec> national code",
"--extended <hex> extended data",
"-a, --animal optional - set animal bit",
"--q5 optional - specify writing to Q5/T5555 tag",
"--em optional - specify writing to EM4305/4469 tag"
],
"usage": "lf fdxb clone [-ha] -c <dec> -n <dec> [--extended <hex>] [--q5] [--em]"
},
"lf fdxb help": {
"command": "lf fdxb help",
"description": "help this help demod demodulate a FDX-B ISO11784/85 tag from the GraphBuffer --------------------------------------------------------------------------------------- lf fdxb demod available offline: yes Try to find FDX-B preamble, if found decode / descramble data",
"notes": [
"lf fdxb demod"
],
"offline": true,
"options": [
"-h, --help This help"
],
"usage": "lf fdxb demod [-h]"
},
"lf fdxb reader": {
"command": "lf fdxb reader",
"description": "read a FDX-B animal tag Note that the continuous mode is less verbose",
"notes": [
"lf fdxb reader -@ -> continuous reader mode"
],
"offline": false,
"options": [
"-h, --help This help",
"-@ optional - continuous reader mode"
],
"usage": "lf fdxb reader [-h@]"
},
"lf fdxb sim": {
"command": "lf fdxb sim",
"description": "Enables simulation of FDX-B animal tag. Simulation runs until the button is pressed or another USB command is issued.",
"notes": [
"lf fdxb sim --country 999 --national 1337 --animal",
"lf fdxb sim --country 999 --national 1337 --extended 016A"
],
"offline": false,
"options": [
"-h, --help This help",
"-c, --country <dec> country code",
"-n, --national <dec> national code",
"--extended <hex> extended data",
"-a, --animal optional - set animal bit"
],
"usage": "lf fdxb sim [-ha] -c <dec> -n <dec> [--extended <hex>]"
},
"lf gallagher clone": {
"command": "lf gallagher clone",
"description": "clone a GALLAGHER tag to a T55x7, Q5/T5555 or EM4305/4469 tag.",
"notes": [
"lf gallagher clone --raw 0FFD5461A9DA1346B2D1AC32 -> encode for T55x7 tag",
"lf gallagher clone --raw 0FFD5461A9DA1346B2D1AC32 --q5 -> encode for Q5/T5555 tag",
"lf gallagher clone --raw 0FFD5461A9DA1346B2D1AC32 --em -> encode for EM4305/4469",
"lf gallagher clone --rc 0 --fc 9876 --cn 1234 --il 1 -> encode for T55x7 tag from decoded data"
],
"offline": false,
"options": [
"-h, --help This help",
"-r, --raw <hex> raw hex data. 12 bytes max",
"--q5 optional - specify writing to Q5/T5555 tag",
"--em optional - specify writing to EM4305/4469 tag",
"--rc <decimal> Region code. 4 bits max",
"--fc <decimal> Facility code. 2 bytes max",
"--cn <decimal> Card number. 3 bytes max",
"--il <decimal> Issue level. 4 bits max"
],
"usage": "lf gallagher clone [-h] [-r <hex>] [--q5] [--em] [--rc <decimal>] [--fc <decimal>] [--cn <decimal>] [--il <decimal>]"
},
"lf gallagher help": {
"command": "lf gallagher help",
"description": "help This help demod demodulate an GALLAGHER tag from the GraphBuffer --------------------------------------------------------------------------------------- lf gallagher demod available offline: yes Try to find GALLAGHER preamble, if found decode / descramble data",
"notes": [
"lf gallagher demod"
],
"offline": true,
"options": [
"-h, --help This help"
],
"usage": "lf gallagher demod [-h]"
},
"lf gallagher reader": {
"command": "lf gallagher reader",
"description": "read a GALLAGHER tag",
"notes": [
"lf gallagher reader -@ -> continuous reader mode"
],
"offline": false,
"options": [
"-h, --help This help",
"-@ optional - continuous reader mode"
],
"usage": "lf gallagher reader [-h@]"
},
"lf gallagher sim": {
"command": "lf gallagher sim",
"description": "Enables simulation of GALLAGHER card with specified card number. Simulation runs until the button is pressed or another USB command is issued.",
"notes": [
"lf gallagher sim --raw 0FFD5461A9DA1346B2D1AC32",
"lf gallagher sim --rc 0 --fc 9876 --cn 1234 --il 1"
],
"offline": false,
"options": [
"-h, --help This help",
"-r, --raw <hex> raw hex data. 12 bytes max",
"--rc <decimal> Region code. 4 bits max",
"--fc <decimal> Facility code. 2 bytes max",
"--cn <decimal> Card number. 3 bytes max",
"--il <decimal> Issue level. 4 bits max"
],
"usage": "lf gallagher sim [-h] [-r <hex>] [--rc <decimal>] [--fc <decimal>] [--cn <decimal>] [--il <decimal>]"
},
"lf gproxii clone": {
"command": "lf gproxii clone",
"description": "Clone a Guardall tag to a T55x7, Q5/T5555 or EM4305/4469 tag. The facility-code is 8-bit and the card number is 20-bit. Larger values are truncated. Currently work only on 26 | 36 bit format",
"notes": [
"lf gproxii clone --xor 141 --fmt 26 --fc 123 --cn 1337 -> encode for T55x7 tag",
"lf gproxii clone --xor 141 --fmt 26 --fc 123 --cn 1337 --q5 -> encode for Q5/T5555 tag",
"lf gproxii clone --xor 141 --fmt 26 --fc 123 --cn 1337 --em -> encode for EM4305/4469"
],
"offline": false,
"options": [
"-h, --help This help",
"--xor <dec> 8-bit xor value (installation dependant)",
"--fmt <dec> format length 26|32|36|40",
"--fc <dec> 8-bit value facility code",
"--cn <dec> 16-bit value card number",
"--q5 optional - specify writing to Q5/T5555 tag",
"--em optional - specify writing to EM4305/4469 tag"
],
"usage": "lf gproxii clone [-h] --xor <dec> --fmt <dec> --fc <dec> --cn <dec> [--q5] [--em]"
},
"lf gproxii help": {
"command": "lf gproxii help",
"description": "help this help demod demodulate a G Prox II tag from the GraphBuffer --------------------------------------------------------------------------------------- lf gproxii demod available offline: yes Try to find Guardall Prox-II preamble, if found decode / descramble data",
"notes": [
"lf gproxii demod -> use graphbuffer to decode",
"lf gproxii demod --raw fb8ee718ee3b8cc785c11b92 ->"
],
"offline": true,
"options": [
"-h, --help This help",
"-r, --raw <hex> raw bytes"
],
"usage": "lf gproxii demod [-h] [-r <hex>]"
},
"lf gproxii reader": {
"command": "lf gproxii reader",
"description": "read a Guardall tag",
"notes": [
"lf gproxii reader -@ -> continuous reader mode"
],
"offline": false,
"options": [
"-h, --help This help",
"-@ optional - continuous reader mode"
],
"usage": "lf gproxii reader [-h@]"
},
"lf gproxii sim": {
"command": "lf gproxii sim",
"description": "Enables simulation of Guardall card with specified card number. Simulation runs until the button is pressed or another USB command is issued. The facility-code is 8-bit and the card number is 16-bit. Larger values are truncated. Currently work only on 26 | 36 bit format",
"notes": [
"lf gproxii sim --xor 141 --fmt 26 --fc 123 --cn 1337"
],
"offline": false,
"options": [
"-h, --help This help",
"--xor <dec> 8-bit xor value (installation dependant)",
"--fmt <dec> format length 26|32|36|40",
"--fc <dec> 8-bit value facility code",
"--cn <dec> 16-bit value card number"
],
"usage": "lf gproxii sim [-h] --xor <dec> --fmt <dec> --fc <dec> --cn <dec>"
},
"lf help": {
"command": "lf help",
"description": "help This help ----------- -------------- Low Frequency -------------- awid { AWID RFIDs... } cotag { COTAG CHIPs... } destron { FDX-A Destron RFIDs... } em { EM CHIPs & RFIDs... } fdxb { FDX-B RFIDs... } gallagher { GALLAGHER RFIDs... } gproxii { Guardall Prox II RFIDs... } hid { HID Prox RFIDs... } hitag { Hitag CHIPs... } idteck { Idteck RFIDs... } indala { Indala RFIDs... } io { ioProx RFIDs... } jablotron { Jablotron RFIDs... } keri { KERI RFIDs... } motorola { Motorola Flexpass RFIDs... } nedap { Nedap RFIDs... } nexwatch { NexWatch RFIDs... } noralsy { Noralsy RFIDs... } pac { PAC/Stanley RFIDs... } paradox { Paradox RFIDs... } pcf7931 { PCF7931 CHIPs... } presco { Presco RFIDs... } pyramid { Farpointe/Pyramid RFIDs... } securakey { Securakey RFIDs... } ti { TI CHIPs... } t55xx { T55xx CHIPs... } viking { Viking RFIDs... } visa2000 { Visa2000 RFIDs... } ----------- --------------------- General --------------------- search Read and Search for valid known tag --------------------------------------------------------------------------------------- lf config available offline: no Get/Set config for LF sampling, bit/sample, decimation, frequency These changes are temporary, will be reset after a power cycle. - use `lf read` performs a read (active field) - use `lf sniff` performs a sniff (no active field)",
"notes": [
"lf config -> shows current config",
"lf config -b 8 --125 -> samples at 125 kHz, 8 bps",
"lf config -b 4 --134 --dec 3 -> samples at 134 kHz, averages three samples into one, stored with a resolution of 4 bits per sample",
"lf config --trig 20 -s 10000 -> trigger sampling when above 20, skip 10 000 first samples after triggered",
"lf config --reset -> reset back to default values"
],
"offline": true,
"options": [
"-h, --help This help",
"--125 125 kHz frequency",
"--134 134 kHz frequency",
"-a, --avg <0|1> averaging - if set, will average the stored sample value when decimating (default 1)",
"-b, --bps <1-8> sets resolution of bits per sample (default 8)",
"--dec <1-8> sets decimation. A value of N saves only 1 in N samples (default 1)",
"--divisor <19-255> Manually set freq divisor. 88 -> 134 kHz, 95 -> 125 kHz",
"-f, --freq <47-600> manually set frequency in kHz",
"-r, --reset reset values to defaults",
"-s, --skip <dec> sets a number of samples to skip before capture (default 0)",
"-t, --trig <0-128> sets trigger threshold. 0 means no threshold"
],
"usage": "lf config [-hr] [--125] [--134] [-a <0|1>] [-b <1-8>] [--dec <1-8>] [--divisor <19-255>] [-f <47-600>] [-s <dec>] [-t <0-128>]"
},
"lf hid brute": {
"command": "lf hid brute",
"description": "Enables bruteforce of HID readers with specified facility code or card number. This is an attack against the reader. If the field being bruteforced is provided, it starts with it and goes up / down one step while maintaining other supplied values. If the field being bruteforced is not provided, it will iterate through the full range while maintaining other supplied values.",
"notes": [
"lf hid brute -w H10301 --field fc --fc 224 --cn 6278",
"lf hid brute -w H10301 --field cn --fc 21 -d 2000",
"lf hid brute -v -w H10301 --field cn --fc 21 --cn 200 -d 2000",
"lf hid brute -v -w H10301 --field fc --fc 21 --cn 200 -d 2000 --up"
],
"offline": false,
"options": [
"-h, --help This help",
"-v, --verbose verbose output",
"-w, --wiegand <format> see `wiegand list` for available formats",
"--field <fc|cn> field to bruteforce",
"--fc <dec> facility code",
"--cn <dec> card number",
"-i, --issue <dec> issue level",
"-o, --oem <dec> OEM code",
"-d, --delay <dec> delay betweens attempts in ms. (def is 1000)",
"--up direction to increment field value. (def is both directions)",
"--down direction to decrement field value. (def is both directions)"
],
"usage": "lf hid brute [-hv] -w <format> --field <fc|cn> [--fc <dec>] [--cn <dec>] [-i <dec>] [-o <dec>] [-d <dec>] [--up] [--down]"
},
"lf hid clone": {
"command": "lf hid clone",
"description": "clone a HID Prox tag to a T55x7, Q5/T5555 or EM4305/4469 tag. Tag must be on the antenna when issuing this command.",
"notes": [
"lf hid clone -r 2006ec0c86 -> write raw value for T55x7 tag (HID 10301 26 bit)",
"lf hid clone -r 2e0ec00c87 -> write raw value for T55x7 tag (HID Corporate 35 bit)",
"lf hid clone -r 01f0760643c3 -> write raw value for T55x7 tag (HID P10001 40 bit)",
"lf hid clone -r 01400076000c86 -> write raw value for T55x7 tag (HID Corporate 48 bit)",
"lf hid clone -w H10301 --fc 118 --cn 1603 -> HID 10301 26 bit, encode for T55x7 tag",
"lf hid clone -w H10301 --fc 118 --cn 1603 --q5 -> HID 10301 26 bit, encode for Q5/T5555 tag",
"lf hid clone -w H10301 --fc 118 --cn 1603 --em -> HID 10301 26 bit, encode for EM4305/4469"
],
"offline": false,
"options": [
"-h, --help This help",
"-w, --wiegand <format> see `wiegand list` for available formats",
"--fc <dec> facility code",
"--cn <dec> card number",
"-i <dec> issue level",
"-o, --oem <dec> OEM code",
"-r, --raw <hex> raw bytes",
"--q5 optional - specify writing to Q5/T5555 tag",
"--em optional - specify writing to EM4305/4469 tag",
"--bin <bin> Binary string i.e 0001001001"
],
"usage": "lf hid clone [-h] [-w <format>] [--fc <dec>] [--cn <dec>] [-i <dec>] [-o <dec>] [-r <hex>] [--q5] [--em] [--bin <bin>]"
},
"lf hid help": {
"command": "lf hid help",
"description": "help this help demod demodulate HID Prox tag from the GraphBuffer --------------------------------------------------------------------------------------- lf hid demod available offline: yes Try to find HID Prox preamble, if found decode / descramble data",
"notes": [
"lf hid demod"
],
"offline": true,
"options": [
"-h, --help This help"
],
"usage": "lf hid demod [-h]"
},
"lf hid reader": {
"command": "lf hid reader",
"description": "read a HID Prox tag",
"notes": [
"lf hid reader -@ -> continuous reader mode"
],
"offline": false,
"options": [
"-h, --help This help",
"-@ optional - continuous reader mode"
],
"usage": "lf hid reader [-h@]"
},
"lf hid sim": {
"command": "lf hid sim",
"description": "Enables simulation of HID card with card number. Simulation runs until the button is pressed or another USB command is issued.",
"notes": [
"lf hid sim -r 2006ec0c86 -> HID 10301 26 bit",
"lf hid sim -r 2e0ec00c87 -> HID Corporate 35 bit",
"lf hid sim -r 01f0760643c3 -> HID P10001 40 bit",
"lf hid sim -r 01400076000c86 -> HID Corporate 48 bit",
"lf hid sim -w H10301 --fc 118 --cn 1603 -> HID 10301 26 bit"
],
"offline": false,
"options": [
"-h, --help This help",
"-w, --wiegand <format> see `wiegand list` for available formats",
"--fc <dec> facility code",
"--cn <dec> card number",
"-i <dec> issue level",
"-o, --oem <dec> OEM code",
"-r, --raw <hex> raw bytes"
],
"usage": "lf hid sim [-h] [-w <format>] [--fc <dec>] [--cn <dec>] [-i <dec>] [-o <dec>] [-r <hex>]"
},
"lf hid watch": {
"command": "lf hid watch",
"description": "Enables HID compatible reader mode printing details. By default, values are printed and logged until the button is pressed or another USB command is issued.",
"notes": [
"lf hid watch"
],
"offline": false,
"options": [
"-h, --help This help"
],
"usage": "lf hid watch [-h]"
},
"lf hitag cc": {
"command": "lf hitag cc",
"description": "Check challenges, load a file with saved hitag crypto challenges and test them all. The file should be 8 * 60 bytes long, the file extension defaults to `.cc`",
"notes": [
"lf hitag cc -f my_hitag_challenges"
],
"offline": false,
"options": [
"-h, --help This help",
"-f, --file <fn> filename to load ( w/o ext )"
],
"usage": "lf hitag cc [-h] -f <fn>"
},
"lf hitag chk": {
"command": "lf hitag chk",
"description": "Run dictionary key or password recovery against Hitag card.",
"notes": [
"lf hitag chk",
"-> checks for both pwd / crypto keyslf hitag chk --crypto -> use def dictionary",
"lf hitag chk --pwd -f my.dic -> pwd mode, custom dictionary"
],
"offline": false,
"options": [
"-h, --help This help",
"-f, --file <fn> specify dictionary filename",
"--pwd password mode",
"--crypto crypto mode"
],
"usage": "lf hitag chk [-h] [-f <fn>] [--pwd] [--crypto]"
},
"lf hitag crack2": {
"command": "lf hitag crack2",
"description": "This command tries to recover 2048 bits of Hitag 2 crypto stream data.",
"notes": [
"lf hitag crack2 --nrar 73AA5A62EAB8529C"
],
"offline": false,
"options": [
"-h, --help This help",
"--nrar <hex> specify nonce / answer as 8 hex bytes"
],
"usage": "lf hitag crack2 [-h] [--nrar <hex>]"
},
"lf hitag dump": {
"command": "lf hitag dump",
"description": "Read all Hitag 2 card memory and save to file Crypto mode key format: ISK high + ISK low, 4F4E4D494B52 (ONMIKR) Password mode, default key 4D494B52 (MIKR)",
"notes": [
"lf hitag dump --pwd -> use def pwd",
"lf hitag dump -k 4D494B52 -> pwd mode",
"lf hitag dump --crypto -> use def crypto",
"lf hitag dump -k 4F4E4D494B52 -> crypto mode",
"lf hitag dump --nrar 0102030411223344"
],
"offline": false,
"options": [
"-h, --help This help",
"--pwd password mode",
"--nrar <hex> nonce / answer reader, 8 hex bytes",
"--crypto crypto mode",
"-k, --key <hex> key, 4 or 6 hex bytes",
"-f, --file <fn> specify file name",
"--ns no save to file"
],
"usage": "lf hitag dump [-h] [--pwd] [--nrar <hex>] [--crypto] [-k <hex>] [-f <fn>] [--ns]"
},
"lf hitag eload": {
"command": "lf hitag eload",
"description": "Loads hitag tag dump into emulator memory on device",
"notes": [
"lf hitag eload -2 -f lf-hitag-11223344-dump.bin"
],
"offline": false,
"options": [
"-h, --help This help",
"-f, --file <fn> Specify dump filename",
"-1, --ht1 Card type Hitag 1",
"-2, --ht2 Card type Hitag 2",
"-s, --hts Card type Hitag S",
"-m, --htm Card type Hitag \u03bc"
],
"usage": "lf hitag eload [-h12sm] -f <fn>"
},
"lf hitag eview": {
"command": "lf hitag eview",
"description": "It displays emulator memory",
"notes": [
"lf hitag eview"
],
"offline": false,
"options": [
"-h, --help This help",
"-v, --verbose Verbose output"
],
"usage": "lf hitag eview [-hv]"
},
"lf hitag help": {
"command": "lf hitag help",
"description": "help This help list List Hitag trace history hts { Hitag S/8211 operations } test Perform self tests view Display content from tag dump file lookup Uses authentication trace to check for key in dictionary file --------------------------------------------------------------------------------------- lf hitag list available offline: yes Alias of `trace list -t hitag2` with selected protocol data to annotate trace buffer You can load a trace from file (see `trace load -h`) or it be downloaded from device by default It accepts all other arguments of `trace list`. Note that some might not be relevant for this specific protocol",
"notes": [
"lf hitag list --frame -> show frame delay times",
"lf hitag list -1 -> use trace buffer"
],
"offline": true,
"options": [
"-h, --help This help",
"-1, --buffer use data from trace buffer",
"--frame show frame delay times",
"-c mark CRC bytes",
"-r show relative times (gap and duration)",
"-u display times in microseconds instead of clock cycles",
"-x show hexdump to convert to pcap(ng)",
"or to import into Wireshark using encapsulation type \"ISO 14443\"",
"-f, --file <fn> filename of dictionary"
],
"usage": "lf hitag list [-h1crux] [--frame] [-f <fn>]"
},
"lf hitag hts help": {
"command": "lf hitag hts help",
"description": "help This help list List Hitag S trace history --------------------------------------------------------------------------------------- lf hitag hts list available offline: yes Alias of `trace list -t hitags` with selected protocol data to annotate trace buffer You can load a trace from file (see `trace load -h`) or it be downloaded from device by default It accepts all other arguments of `trace list`. Note that some might not be relevant for this specific protocol",
"notes": [
"lf hitag hts list --frame -> show frame delay times",
"lf hitag hts list -1 -> use trace buffer"
],
"offline": true,
"options": [
"-h, --help This help",
"-1, --buffer use data from trace buffer",
"--frame show frame delay times",
"-c mark CRC bytes",
"-r show relative times (gap and duration)",
"-u display times in microseconds instead of clock cycles",
"-x show hexdump to convert to pcap(ng)",
"or to import into Wireshark using encapsulation type \"ISO 14443\"",
"-f, --file <fn> filename of dictionary"
],
"usage": "lf hitag hts list [-h1crux] [--frame] [-f <fn>]"
},
"lf hitag hts rdbl": {
"command": "lf hitag hts rdbl",
"description": "Read Hitag S memory. Crypto mode: - key format ISK high + ISK low - default key 4F4E4D494B52 (ONMIKR) 8268/8310 password mode: - default password BBDD3399",
"notes": [
"lf hitag hts rdbl -p 1 -> Hitag S/8211, plain mode",
"lf hitag hts rdbl -p 1 --82xx -k BBDD3399 -> 8268/8310, password mode",
"lf hitag hts rdbl -p 1 --nrar 0102030411223344 -> Hitag S, challenge mode",
"lf hitag hts rdbl -p 1 --crypto -> Hitag S, crypto mode, def key",
"lf hitag hts rdbl -p 1 -k 4F4E4D494B52 -> Hitag S, crypto mode"
],
"offline": false,
"options": [
"-h, --help This help",
"-8, --82xx 8268/8310 mode",
"--nrar <hex> nonce / answer writer, 8 hex bytes",
"--crypto crypto mode",
"-k, --key <hex> pwd or key, 4 or 6 hex bytes",
"-m, --mode <dec> response protocol mode. 0 (Standard 00110), 1 (Advanced 11000), 2 (Advanced 11001), 3 (Fast Advanced 11010) (def: 3)",
"-p, --page <dec> page address to read from",
"-c, --count <dec> how many pages to read. '0' reads all pages up to the end page (def: 1)"
],
"usage": "lf hitag hts rdbl [-h8] [--nrar <hex>] [--crypto] [-k <hex>] [-m <dec>] [-p <dec>] [-c <dec>]"
},
"lf hitag hts reader": {
"command": "lf hitag hts reader",
"description": "Act as a Hitag S reader. Look for Hitag S tags until Enter or the pm3 button is pressed",
"notes": [
"lf hitag hts reader",
"lf hitag hts reader -@ -> Continuous mode"
],
"offline": false,
"options": [
"-h, --help This help",
"-@ continuous reader mode"
],
"usage": "lf hitag hts reader [-h@]"
},
"lf hitag hts sim": {
"command": "lf hitag hts sim",
"description": "Simulate Hitag S transponder You need to `lf hitag hts eload` first",
"notes": [
"lf hitag hts sim",
"lf hitag hts sim --82xx"
],
"offline": false,
"options": [
"-h, --help This help",
"-8, --82xx simulate 8268/8310"
],
"usage": "lf hitag hts sim [-h8]"
},
"lf hitag hts wrbl": {
"command": "lf hitag hts wrbl",
"description": "Write a page in Hitag S memory. Crypto mode: - key format ISK high + ISK low - default key 4F4E4D494B52 (ONMIKR) 8268/8310 password mode: - default password BBDD3399",
"notes": [
"lf hitag hts wrbl -p 6 -d 01020304 -> Hitag S/8211, plain mode",
"lf hitag hts wrbl -p 6 -d 01020304 --82xx -k BBDD3399 -> 8268/8310, password mode",
"lf hitag hts wrbl -p 6 -d 01020304 --nrar 0102030411223344 -> Hitag S, challenge mode",
"lf hitag hts wrbl -p 6 -d 01020304 --crypto -> Hitag S, crypto mode, default key",
"lf hitag hts wrbl -p 6 -d 01020304 -k 4F4E4D494B52 -> Hitag S, crypto mode"
],
"offline": false,
"options": [
"-h, --help This help",
"-8, --82xx 8268/8310 mode",
"--nrar <hex> nonce / answer writer, 8 hex bytes",
"--crypto crypto mode",
"-k, --key <hex> pwd or key, 4 or 6 hex bytes",
"-m, --mode <dec> response protocol mode. 0 (Standard 00110), 1 (Advanced 11000), 2 (Advanced 11001), 3 (Fast Advanced 11010) (def: 3)",
"-p, --page <dec> page address to write to",
"-d, --data <hex> data, 4 hex bytes"
],
"usage": "lf hitag hts wrbl [-h8] [--nrar <hex>] [--crypto] [-k <hex>] [-m <dec>] -p <dec> -d <hex>"
},
"lf hitag info": {
"command": "lf hitag info",
"description": "Hitag 2 tag information",
"notes": [
"lf hitag info"
],
"offline": false,
"options": [
"-h, --help This help"
],
"usage": "lf hitag info [-h]"
},
"lf hitag lookup": {
"command": "lf hitag lookup",
"description": "This command take sniffed trace data and try to recovery a Hitag 2 crypto key. You can either - verify that NR/AR matches a known crypto key - verify if NR/AR matches a known 6 byte crypto key in a dictionary",
"notes": [
"lf hitag lookup --uid 11223344 --nr 73AA5A62 --ar EAB8529C -k 010203040506 -> check key",
"lf hitag lookup --uid 11223344 --nr 73AA5A62 --ar EAB8529C -> use def dictionary",
"lf hitag lookup --uid 11223344 --nr 73AA5A62 --ar EAB8529C -f my.dic -> use custom dictionary",
"lf hitag lookup --uid 11223344 --nrar 73AA5A62EAB8529C"
],
"offline": true,
"options": [
"-h, --help This help",
"-f, --file <fn> specify dictionary filename",
"-k, --key <hex> specify known cryptokey as 6 bytes",
"-u, --uid <hex> specify UID as 4 hex bytes",
"--nr <hex> specify nonce as 4 hex bytes",
"--ar <hex> specify answer as 4 hex bytes",
"--nrar <hex> specify nonce / answer as 8 hex bytes"
],
"usage": "lf hitag lookup [-h] [-f <fn>] [-k <hex>] -u <hex> [--nr <hex>] [--ar <hex>] [--nrar <hex>]"
},
"lf hitag read": {
"command": "lf hitag read",
"description": "Read Hitag memory. It support Hitag 2 Password mode: - default key 4D494B52 (MIKR) Crypto mode: - key format ISK high + ISK low - default key 4F4E4D494B52 (ONMIKR)",
"notes": [
"lf hitag read --ht2 --pwd -> Hitag 2, pwd mode, def key",
"lf hitag read --ht2 -k 4D494B52 -> Hitag 2, pwd mode",
"lf hitag read --ht2 --nrar 0102030411223344 -> Hitag 2, challenge mode",
"lf hitag read --ht2 --crypto -> Hitag 2, crypto mode, def key",
"lf hitag read --ht2 -k 4F4E4D494B52 -> Hitag 2, crypto mode"
],
"offline": false,
"options": [
"-h, --help This help",
"-2, --ht2 Hitag 2",
"--pwd password mode",
"--nrar <hex> nonce / answer writer, 8 hex bytes",
"--crypto crypto mode",
"-k, --key <hex> key, 4 or 6 hex bytes"
],
"usage": "lf hitag read [-h2] [--pwd] [--nrar <hex>] [--crypto] [-k <hex>]"
},
"lf hitag reader": {
"command": "lf hitag reader",
"description": "Act as a Hitag 2 reader. Look for Hitag 2 tags until Enter or the pm3 button is pressed",
"notes": [
"lf hitag reader",
"lf hitag reader -@ -> Continuous mode"
],
"offline": false,
"options": [
"-h, --help This help",
"-@ continuous reader mode"
],
"usage": "lf hitag reader [-h@]"
},
"lf hitag sim": {
"command": "lf hitag sim",
"description": "Simulate Hitag transponder You need to `lf hitag eload` first",
"notes": [
"lf hitag sim -2"
],
"offline": false,
"options": [
"-h, --help This help",
"-1, --ht1 simulate Hitag 1",
"-2, --ht2 simulate Hitag 2"
],
"usage": "lf hitag sim [-h12]"
},
"lf hitag sniff": {
"command": "lf hitag sniff",
"description": "Sniff the communication between reader and tag Use `lf hitag list` to view collected data.",
"notes": [
"lf hitag sniff"
],
"offline": false,
"options": [
"-h, --help This help"
],
"usage": "lf hitag sniff [-h]"
},
"lf hitag test": {
"command": "lf hitag test",
"description": "Perform self tests of Hitag crypto engine",
"notes": [
"lf hitag test"
],
"offline": true,
"options": [
"-h, --help This help"
],
"usage": "lf hitag test [-h]"
},
"lf hitag view": {
"command": "lf hitag view",
"description": "Print a HITAG dump file (bin/eml/json)",
"notes": [
"lf hitag view -f lf-hitag-01020304-dump.bin"
],
"offline": true,
"options": [
"-h, --help This help",
"-f, --file <fn> Specify a filename for dump file",
"-v, --verbose Verbose output"
],
"usage": "lf hitag view [-hv] -f <fn>"
},
"lf hitag wrbl": {
"command": "lf hitag wrbl",
"description": "Write a page in Hitag memory. It support Hitag 2 Password mode: - default key 4D494B52 (MIKR) Crypto mode: - key format ISK high + ISK low - default key 4F4E4D494B52 (ONMIKR)",
"notes": [
"lf hitag wrbl --ht2 -p 6 -d 01020304 --pwd -> Hitag 2, pwd mode, def key",
"lf hitag wrbl --ht2 -p 6 -d 01020304 -k 4D494B52 -> Hitag 2, pwd mode",
"lf hitag wrbl --ht2 -p 6 -d 01020304 --nrar 0102030411223344 -> Hitag 2, challenge mode",
"lf hitag wrbl --ht2 -p 6 -d 01020304 --crypto -> Hitag 2, crypto mode, def key",
"lf hitag wrbl --ht2 -p 6 -d 01020304 -k 4F4E4D494B52 -> Hitag 2, crypto mode"
],
"offline": false,
"options": [
"-h, --help This help",
"-2, --ht2 Hitag 2",
"--pwd password mode",
"--nrar <hex> nonce / answer writer, 8 hex bytes",
"--crypto crypto mode",
"-k, --key <hex> key, 4 or 6 hex bytes",
"-p, --page <dec> page address to write to",
"-d, --data <hex> data, 4 hex bytes"
],
"usage": "lf hitag wrbl [-h2] [--pwd] [--nrar <hex>] [--crypto] [-k <hex>] -p <dec> -d <hex>"
},
"lf idteck clone": {
"command": "lf idteck clone",
"description": "clone a Idteck tag to T55x7 or Q5/T5555 tag Tag must be on the antenna when issuing this command.",
"notes": [
"lf idteck clone --raw 4944544B351FBE4B"
],
"offline": false,
"options": [
"-h, --help This help",
"-r, --raw <hex> raw bytes",
"--q5 optional - specify writing to Q5/T5555 tag",
"--em optional - specify writing to EM4305/4469 tag"
],
"usage": "lf idteck clone [-h] -r <hex> [--q5] [--em]"
},
"lf idteck help": {
"command": "lf idteck help",
"description": "help This help demod demodulate an Idteck tag from the GraphBuffer --------------------------------------------------------------------------------------- lf idteck demod available offline: yes Try to find Idteck preamble, if found decode / descramble data",
"notes": [
"lf idteck demod",
"lf idteck demod --raw 4944544B351FBE4B"
],
"offline": true,
"options": [
"-h, --help This help",
"-r, --raw <hex> raw bytes"
],
"usage": "lf idteck demod [-h] [-r <hex>]"
},
"lf idteck reader": {
"command": "lf idteck reader",
"description": "read a Idteck tag",
"notes": [
"lf idteck reader -@ -> continuous reader mode"
],
"offline": false,
"options": [
"-h, --help This help",
"-@ optional - continuous reader mode"
],
"usage": "lf idteck reader [-h@]"
},
"lf idteck sim": {
"command": "lf idteck sim",
"description": "Enables simulation of Idteck card. Simulation runs until the button is pressed or another USB command is issued.",
"notes": [
"lf idteck sim --raw 4944544B351FBE4B"
],
"offline": false,
"options": [
"-h, --help This help",
"-r, --raw <hex> raw bytes"
],
"usage": "lf idteck sim [-h] -r <hex>"
},
"lf indala altdemod": {
"command": "lf indala altdemod",
"description": "Tries to PSK demodulate the graphbuffer as Indala This is uses a alternative way to demodulate and was used from the beginning in the Pm3 client. It's now considered obsolete but remains because it has sometimes its advantages.",
"notes": [
"lf indala altdemod",
"lf indala altdemod --long -> demod a Indala tag from the GraphBuffer as 224 bit long format"
],
"offline": true,
"options": [
"-h, --help This help",
"-l, --long optional - demod as 224b long format"
],
"usage": "lf indala altdemod [-hl]"
},
"lf indala clone": {
"command": "lf indala clone",
"description": "clone Indala UID to T55x7 or Q5/T5555 tag using different known formats Warning, encoding with FC/CN doesn't always work",
"notes": [
"lf indala clone --heden 888",
"lf indala clone --fc 123 --cn 1337",
"lf indala clone --fc 123 --cn 1337 --4041x",
"lf indala clone -r a0000000a0002021",
"lf indala clone -r 80000001b23523a6c2e31eba3cbee4afb3c6ad1fcf649393928c14e5"
],
"offline": false,
"options": [
"-h, --help This help",
"-r, --raw <hex> raw bytes",
"--heden <decimal> Card number for Heden 2L format",
"--fc <decimal> Facility code (26 bit H10301 format)",
"--cn <decimal> Card number (26 bit H10301 format)",
"--q5 Optional - specify writing to Q5/T5555 tag",
"--em Optional - specify writing to EM4305/4469 tag",
"--4041x Optional - specify Indala 4041X format, must use with fc and cn"
],
"usage": "lf indala clone [-h] [-r <hex>] [--heden <decimal>] [--fc <decimal>] [--cn <decimal>] [--q5] [--em] [--4041x]"
},
"lf indala demod": {
"command": "lf indala demod",
"description": "Tries to PSK demodulate the graphbuffer as Indala",
"notes": [
"lf indala demod",
"lf indala demod --clock 32 -> demod a Indala tag from the GraphBuffer using a clock of RF/32",
"lf indala demod --clock 32 -i -> demod a Indala tag from the GraphBuffer using a clock of RF/32 and inverting data",
"lf indala demod --clock 64 -i --maxerror 0 -> demod a Indala tag from the GraphBuffer using a clock of RF/64, inverting data and allowing 0 demod errors"
],
"offline": true,
"options": [
"-h, --help This help",
"--clock <dec> optional - set clock (as integer), if not set, autodetect.",
"--maxerr <dec> optional - set maximum allowed errors, default = 100",
"-i, --invert optional - invert output"
],
"usage": "lf indala demod [-hi] [--clock <dec>] [--maxerr <dec>]"
},
"lf indala help": {
"command": "lf indala help",
"description": "help This help demod Demodulate an Indala tag (PSK1) from the GraphBuffer altdemod Alternative method to demodulate samples for Indala 64 bit UID (option '224' for 224 bit) --------------------------------------------------------------------------------------- lf indala brute available offline: no Enables bruteforce of INDALA readers with specified facility code. This is a attack against reader. if cardnumber is given, it starts with it and goes up / down one step if cardnumber is not given, it starts with 1 and goes up to 65535",
"notes": [
"lf indala brute --fc 224",
"lf indala brute --fc 21 -d 2000",
"lf indala brute -v --fc 21 --cn 200 -d 2000",
"lf indala brute -v --fc 21 --cn 200 -d 2000 --up"
],
"offline": true,
"options": [
"-h, --help This help",
"-v, --verbose verbose output",
"--fc <dec> facility code",
"--cn <dec> card number to start with",
"-d, --delay <dec> delay betweens attempts in ms. Default 1000ms",
"--up direction to increment card number. (default is both directions)",
"--down direction to decrement card number. (default is both directions)",
"--4041x specify Indala 4041X format"
],
"usage": "lf indala brute [-hv] [--fc <dec>] [--cn <dec>] [-d <dec>] [--up] [--down] [--4041x]"
},
"lf indala reader": {
"command": "lf indala reader",
"description": "read a Indala tag",
"notes": [
"lf indala reader -@ -> continuous reader mode"
],
"offline": false,
"options": [
"-h, --help This help",
"--clock <dec> optional - set clock (as integer), if not set, autodetect.",
"--maxerr <dec> optional - set maximum allowed errors, default = 100",
"-i, --invert optional - invert output",
"-@ optional - continuous reader mode"
],
"usage": "lf indala reader [-hi@] [--clock <dec>] [--maxerr <dec>]"
},
"lf indala sim": {
"command": "lf indala sim",
"description": "Enables simulation of Indala card with specified facility code and card number. Simulation runs until the button is pressed or another USB command is issued.",
"notes": [
"lf indala sim --heden 888",
"lf indala sim --fc 123 --cn 1337",
"lf indala sim --fc 123 --cn 1337 --4041x",
"lf indala sim --raw a0000000a0002021",
"lf indala sim --raw 80000001b23523a6c2e31eba3cbee4afb3c6ad1fcf649393928c14e5"
],
"offline": false,
"options": [
"-h, --help This help",
"-r, --raw <hex> raw bytes",
"--heden <decimal> Cardnumber for Heden 2L format",
"--fc <decimal> Facility code (26 bit H10301 format)",
"--cn <decimal> Card number (26 bit H10301 format)",
"--4041x Optional - specify Indala 4041X format, must use with fc and cn"
],
"usage": "lf indala sim [-h] [-r <hex>] [--heden <decimal>] [--fc <decimal>] [--cn <decimal>] [--4041x]"
},
"lf io clone": {
"command": "lf io clone",
"description": "clone a ioProx card with specified facility-code and card number to a T55x7, Q5/T5555 or EM4305/4469 tag. Tag must be on the antenna when issuing this command.",
"notes": [
"lf io clone --vn 1 --fc 101 --cn 1337"
],
"offline": false,
"options": [
"-h, --help This help",
"--vn <dec> 8bit version",
"--fc <dec> 8bit facility code",
"--cn <dec> 16bit card number",
"--q5 optional - specify writing to Q5/T5555 tag",
"--em optional - specify writing to EM4305/4469 tag"
],
"usage": "lf io clone [-h] --vn <dec> --fc <dec> --cn <dec> [--q5] [--em]"
},
"lf io help": {
"command": "lf io help",
"description": "help this help demod demodulate an ioProx tag from the GraphBuffer --------------------------------------------------------------------------------------- lf io demod available offline: yes Try to find ioProx preamble, if found decode / descramble data",
"notes": [
"lf io demod"
],
"offline": true,
"options": [
"-h, --help This help"
],
"usage": "lf io demod [-h]"
},
"lf io reader": {
"command": "lf io reader",
"description": "read a ioProx tag",
"notes": [
"lf io reader -@ -> continuous reader mode"
],
"offline": false,
"options": [
"-h, --help This help",
"-@ optional - continuous reader mode"
],
"usage": "lf io reader [-h@]"
},
"lf io sim": {
"command": "lf io sim",
"description": "Enables simulation of ioProx card with specified facility-code and card number. Simulation runs until the button is pressed or another USB command is issued.",
"notes": [
"lf io sim --vn 1 --fc 101 --cn 1337"
],
"offline": false,
"options": [
"-h, --help This help",
"--vn <dec> 8bit version",
"--fc <dec> 8bit facility code",
"--cn <dec> 16bit card number"
],
"usage": "lf io sim [-h] --vn <dec> --fc <dec> --cn <dec>"
},
"lf io watch": {
"command": "lf io watch",
"description": "Enables ioProx compatible reader mode printing details. By default, values are printed and logged until the button is pressed or another USB command is issued.",
"notes": [
"lf io watch"
],
"offline": false,
"options": [
"-h, --help This help"
],
"usage": "lf io watch [-h]"
},
"lf jablotron clone": {
"command": "lf jablotron clone",
"description": "clone a Jablotron tag to a T55x7, Q5/T5555 or EM4305/4469 tag. Tag must be on the antenna when issuing this command.",
"notes": [
"lf jablotron clone --cn 01b669 -> encode for T55x7 tag",
"lf jablotron clone --cn 01b669 --q5 -> encode for Q5/T5555 tag",
"lf jablotron clone --cn 01b669 --em -> encode for EM4305/4469"
],
"offline": false,
"options": [
"-h, --help This help",
"--cn <hex> Jablotron card ID - 5 bytes max",
"--q5 optional - specify writing to Q5/T5555 tag",
"--em optional - specify writing to EM4305/4469 tag"
],
"usage": "lf jablotron clone [-h] --cn <hex> [--q5] [--em]"
},
"lf jablotron help": {
"command": "lf jablotron help",
"description": "help This help demod demodulate an Jablotron tag from the GraphBuffer --------------------------------------------------------------------------------------- lf jablotron demod available offline: yes Try to find Jablotron preamble, if found decode / descramble data",
"notes": [
"lf jablotron demod"
],
"offline": true,
"options": [
"-h, --help This help"
],
"usage": "lf jablotron demod [-h]"
},
"lf jablotron reader": {
"command": "lf jablotron reader",
"description": "read a jablotron tag",
"notes": [
"lf jablotron reader -@ -> continuous reader mode"
],
"offline": false,
"options": [
"-h, --help This help",
"-@ optional - continuous reader mode"
],
"usage": "lf jablotron reader [-h@]"
},
"lf jablotron sim": {
"command": "lf jablotron sim",
"description": "Enables simulation of jablotron card with specified card number. Simulation runs until the button is pressed or another USB command is issued.",
"notes": [
"lf jablotron sim --cn 01b669"
],
"offline": false,
"options": [
"-h, --help This help",
"--cn <hex> Jablotron card ID - 5 bytes max"
],
"usage": "lf jablotron sim [-h] --cn <hex>"
},
"lf keri clone": {
"command": "lf keri clone",
"description": "clone a KERI tag to a T55x7, Q5/T5555 or EM4305/4469 tag",
"notes": [
"lf keri clone -t i --cn 12345 -> Internal ID",
"lf keri clone -t m --fc 6 --cn 12345 -> MS ID"
],
"offline": false,
"options": [
"-h, --help This help",
"-t, --type <m|i> Type m - MS, i - Internal ID",
"--fc <dec> Facility Code",
"--cn <dec> KERI card ID",
"--q5 specify writing to Q5/T5555 tag",
"--em specify writing to EM4305/4469 tag"
],
"usage": "lf keri clone [-h] [-t <m|i>] [--fc <dec>] --cn <dec> [--q5] [--em]"
},
"lf keri help": {
"command": "lf keri help",
"description": "help This help demod demodulate an KERI tag from the GraphBuffer --------------------------------------------------------------------------------------- lf keri demod available offline: yes Try to find KERI preamble, if found decode / descramble data",
"notes": [
"lf keri demod"
],
"offline": true,
"options": [
"-h, --help This help"
],
"usage": "lf keri demod [-h]"
},
"lf keri reader": {
"command": "lf keri reader",
"description": "read a keri tag",
"notes": [
"lf keri reader -@ -> continuous reader mode"
],
"offline": false,
"options": [
"-h, --help This help",
"-@ optional - continuous reader mode"
],
"usage": "lf keri reader [-h@]"
},
"lf keri sim": {
"command": "lf keri sim",
"description": "Enables simulation of KERI card with internal ID. You supply a KERI card id and it will converted to a KERI internal ID.",
"notes": [
"lf keri sim --cn 112233"
],
"offline": false,
"options": [
"-h, --help This help",
"--id <dec> KERI card ID"
],
"usage": "lf keri sim [-h] --id <dec>"
},
"lf motorola clone": {
"command": "lf motorola clone",
"description": "clone Motorola UID to a T55x7, Q5/T5555 or EM4305/4469 tag. defaults to 64 bit format",
"notes": [
"lf motorola clone --raw a0000000a0002021 -> encode for T55x7 tag",
"lf motorola clone --raw a0000000a0002021 --q5 -> encode for Q5/T5555 tag",
"lf motorola clone --raw a0000000a0002021 --em -> encode for EM4305/4469"
],
"offline": false,
"options": [
"-h, --help This help",
"-r, --raw <hex> raw hex bytes. 8 bytes",
"--q5 optional - specify writing to Q5/T5555 tag",
"--em optional - specify writing to EM4305/4469 tag"
],
"usage": "lf motorola clone [-h] -r <hex> [--q5] [--em]"
},
"lf motorola help": {
"command": "lf motorola help",
"description": "help This help demod demodulate an MOTOROLA tag from the GraphBuffer --------------------------------------------------------------------------------------- lf motorola demod available offline: yes Try to find Motorola Flexpass preamble, if found decode / descramble data",
"notes": [
"lf motorola demod"
],
"offline": true,
"options": [
"-h, --help This help"
],
"usage": "lf motorola demod [-h]"
},
"lf motorola reader": {
"command": "lf motorola reader",
"description": "read a Motorola Flexpass tag",
"notes": [
"lf motorola reader -@ -> continuous reader mode"
],
"offline": false,
"options": [
"-h, --help This help",
"-@ optional - continuous reader mode"
],
"usage": "lf motorola reader [-h@]"
},
"lf motorola sim": {
"command": "lf motorola sim",
"description": "Enables simulation of Motorola card with specified card number. Simulation runs until the button is pressed or another USB command is issued.",
"notes": [
"lf motorola sim"
],
"offline": false,
"options": [
"-h, --help This help"
],
"usage": "lf motorola sim [-h]"
},
"lf nedap clone": {
"command": "lf nedap clone",
"description": "clone a Nedap tag to a T55x7, Q5/T5555 or EM4305/4469 tag.",
"notes": [
"lf nedap clone --st 1 --cc 101 --id 1337"
],
"offline": false,
"options": [
"-h, --help This help",
"--st <dec> optional - sub type (default 5)",
"--cc <dec> customer code (0-4095)",
"--id <dec> ID (0-99999)",
"-l, --long optional - long (128), default to short (64)",
"--q5 optional - specify writing to Q5/T5555 tag",
"--em optional - specify writing to EM4305/4469 tag"
],
"usage": "lf nedap clone [-hl] [--st <dec>] --cc <dec> --id <dec> [--q5] [--em]"
},
"lf nedap help": {
"command": "lf nedap help",
"description": "help This help demod demodulate Nedap tag from the GraphBuffer --------------------------------------------------------------------------------------- lf nedap demod available offline: yes Try to find Nedap preamble, if found decode / descramble data",
"notes": [
"lf nedap demod"
],
"offline": true,
"options": [
"-h, --help This help"
],
"usage": "lf nedap demod [-h]"
},
"lf nedap reader": {
"command": "lf nedap reader",
"description": "read a Nedap tag",
"notes": [
"lf nedap reader -@ -> continuous reader mode"
],
"offline": false,
"options": [
"-h, --help This help",
"-@ optional - continuous reader mode"
],
"usage": "lf nedap reader [-h@]"
},
"lf nedap sim": {
"command": "lf nedap sim",
"description": "Enables simulation of NEDAP card with specified card number. Simulation runs until the button is pressed or another USB command is issued.",
"notes": [
"lf nedap sim --st 1 --cc 101 --id 1337"
],
"offline": false,
"options": [
"-h, --help This help",
"--st <dec> optional - sub type (default 5)",
"--cc <dec> customer code (0-4095)",
"--id <dec> ID (0-99999)",
"-l, --long optional - long (128), default to short (64)"
],
"usage": "lf nedap sim [-hl] [--st <dec>] --cc <dec> --id <dec>"
},
"lf nexwatch clone": {
"command": "lf nexwatch clone",
"description": "clone a Nexwatch tag to a T55x7, Q5/T5555 or EM4305/4469 tag. You can use raw hex values or create a credential based on id, mode and type of credential (Nexkey / Quadrakey / Russian)",
"notes": [
"lf nexwatch clone --raw 5600000000213C9F8F150C00",
"lf nexwatch clone --cn 521512301 -m 1 --nc -> Nexkey credential",
"lf nexwatch clone --cn 521512301 -m 1 --qc -> Quadrakey credential",
"lf nexwatch clone --cn 521512301 -m 1 --hc -> Honeywell credential"
],
"offline": false,
"options": [
"-h, --help This help",
"-r, --raw <hex> raw hex data. 12 bytes",
"--cn <dec> card id",
"-m, --mode <dec> mode (decimal) (0-15, defaults to 1)",
"--nc Nexkey credential",
"--qc Quadrakey credential",
"--hc Honeywell credential",
"--q5 optional - specify writing to Q5/T5555 tag",
"--em optional - specify writing to EM4305/4469 tag",
"--magic <hex> optional - magic hex data. 1 byte",
"--psk2 optional - specify writing a tag in psk2 modulation"
],
"usage": "lf nexwatch clone [-h] [-r <hex>] [--cn <dec>] [-m <dec>] [--nc] [--qc] [--hc] [--q5] [--em] [--magic <hex>] [--psk2]"
},
"lf nexwatch help": {
"command": "lf nexwatch help",
"description": "help This help demod demodulate a NexWatch tag (nexkey, quadrakey) from the GraphBuffer --------------------------------------------------------------------------------------- lf nexwatch demod available offline: yes Try to find Nexwatch preamble, if found decode / descramble data",
"notes": [
"lf nexwatch demod"
],
"offline": true,
"options": [
"-h, --help This help"
],
"usage": "lf nexwatch demod [-h]"
},
"lf nexwatch reader": {
"command": "lf nexwatch reader",
"description": "read a Nexwatch tag",
"notes": [
"lf nexwatch reader -@ -> continuous reader mode"
],
"offline": false,
"options": [
"-h, --help This help",
"-@ optional - continuous reader mode"
],
"usage": "lf nexwatch reader [-h@]"
},
"lf nexwatch sim": {
"command": "lf nexwatch sim",
"description": "Enables simulation of secura card with specified card number. Simulation runs until the button is pressed or another USB command is issued. You can use raw hex values or create a credential based on id, mode and type of credential (Nexkey/Quadrakey)",
"notes": [
"lf nexwatch sim --raw 5600000000213C9F8F150C00",
"lf nexwatch sim --cn 521512301 -m 1 --nc -> Nexkey credential",
"lf nexwatch sim --cn 521512301 -m 1 --qc -> Quadrakey credential",
"lf nexwatch sim --cn 521512301 -m 1 --hc -> Honeywell credential"
],
"offline": false,
"options": [
"-h, --help This help",
"-r, --raw <hex> raw hex data. 12 bytes",
"--cn <dec> card id",
"-m, --mode <dec> mode (decimal) (0-15, defaults to 1)",
"--nc Nexkey credential",
"--qc Quadrakey credential",
"--hc Honeywell credential",
"--magic <hex> optional - magic hex data. 1 byte",
"--psk2 optional - specify writing a tag in psk2 modulation"
],
"usage": "lf nexwatch sim [-h] [-r <hex>] [--cn <dec>] [-m <dec>] [--nc] [--qc] [--hc] [--magic <hex>] [--psk2]"
},
"lf noralsy clone": {
"command": "lf noralsy clone",
"description": "clone a Noralsy tag to a T55x7, Q5/T5555 or EM4305/4469 tag.",
"notes": [
"lf noralsy clone --cn 112233 -> encode for T55x7 tag",
"lf noralsy clone --cn 112233 --q5 -> encode for Q5/T5555 tag",
"lf noralsy clone --cn 112233 --em -> encode for EM4305/4469"
],
"offline": false,
"options": [
"-h, --help This help",
"--cn <dec> Noralsy card ID",
"-y, --year <dec> tag allocation year",
"--q5 optional - specify writing to Q5/T5555 tag",
"--em optional - specify writing to EM4305/4469 tag"
],
"usage": "lf noralsy clone [-h] --cn <dec> [-y <dec>] [--q5] [--em]"
},
"lf noralsy help": {
"command": "lf noralsy help",
"description": "help This help demod demodulate an Noralsy tag from the GraphBuffer --------------------------------------------------------------------------------------- lf noralsy demod available offline: yes Try to find Noralsy preamble, if found decode / descramble data",
"notes": [
"lf noralsy demod"
],
"offline": true,
"options": [
"-h, --help This help"
],
"usage": "lf noralsy demod [-h]"
},
"lf noralsy reader": {
"command": "lf noralsy reader",
"description": "read a Noralsy tag",
"notes": [
"lf noralsy reader -@ -> continuous reader mode"
],
"offline": false,
"options": [
"-h, --help This help",
"-@ optional - continuous reader mode"
],
"usage": "lf noralsy reader [-h@]"
},
"lf noralsy sim": {
"command": "lf noralsy sim",
"description": "Enables simulation of Noralsy card with specified card number. Simulation runs until the button is pressed or another USB command is issued.",
"notes": [
"lf noralsy sim --cn 1337",
"lf noralsy sim --cn 1337 --year 2010"
],
"offline": false,
"options": [
"-h, --help This help",
"--cn <dec> Noralsy card ID",
"-y, --year <dec> tag allocation year"
],
"usage": "lf noralsy sim [-h] --cn <dec> [-y <dec>]"
},
"lf pac clone": {
"command": "lf pac clone",
"description": "clone a PAC/Stanley tag to a T55x7, Q5/T5555 or EM4305/4469 tag.",
"notes": [
"lf pac clone --cn CD4F5552 -> encode for T55x7 tag",
"lf pac clone --cn CD4F5552 --q5 -> encode for Q5/T5555 tag",
"lf pac clone --cn CD4F5552 --em -> encode for EM4305/4469",
"lf pac clone --raw FF2049906D8511C593155B56D5B2649F -> encode for T55x7 tag, raw mode"
],
"offline": false,
"options": [
"-h, --help This help",
"--cn <dec> 8 byte PAC/Stanley card ID",
"-r, --raw <hex> raw hex data. 16 bytes max",
"--q5 optional - specify writing to Q5/T5555 tag",
"--em optional - specify writing to EM4305/4469 tag"
],
"usage": "lf pac clone [-h] [--cn <dec>] [-r <hex>] [--q5] [--em]"
},
"lf pac help": {
"command": "lf pac help",
"description": "help This help demod demodulate a PAC tag from the GraphBuffer --------------------------------------------------------------------------------------- lf pac demod available offline: yes Try to find PAC/Stanley preamble, if found decode / descramble data",
"notes": [
"lf pac demod"
],
"offline": true,
"options": [
"-h, --help This help"
],
"usage": "lf pac demod [-h]"
},
"lf pac reader": {
"command": "lf pac reader",
"description": "read a PAC/Stanley tag",
"notes": [
"lf pac reader -@ -> continuous reader mode"
],
"offline": false,
"options": [
"-h, --help This help",
"-@ optional - continuous reader mode"
],
"usage": "lf pac reader [-h@]"
},
"lf pac sim": {
"command": "lf pac sim",
"description": "Enables simulation of PAC/Stanley card with specified card number. Simulation runs until the button is pressed or another USB command is issued. The card ID is 8 byte number. Larger values are truncated.",
"notes": [
"lf pac sim --cn CD4F5552",
"lf pac sim --raw FF2049906D8511C593155B56D5B2649F"
],
"offline": false,
"options": [
"-h, --help This help",
"--cn <dec> 8 byte PAC/Stanley card ID",
"-r, --raw <hex> raw hex data. 16 bytes max"
],
"usage": "lf pac sim [-h] [--cn <dec>] [-r <hex>]"
},
"lf paradox clone": {
"command": "lf paradox clone",
"description": "clone a paradox tag to a T55x7, Q5/T5555 or EM4305/4469 tag.",
"notes": [
"lf paradox clone --fc 96 --cn 40426 -> encode for T55x7 tag with fc and cn",
"lf paradox clone --raw 0f55555695596a6a9999a59a -> encode for T55x7 tag",
"lf paradox clone --raw 0f55555695596a6a9999a59a --q5 -> encode for Q5/T5555 tag",
"lf paradox clone --raw 0f55555695596a6a9999a59a --em -> encode for EM4305/4469"
],
"offline": false,
"options": [
"-h, --help This help",
"-r, --raw <hex> raw hex data. 12 bytes max",
"--fc <dec> facility code",
"--cn <dec> card number",
"--q5 optional - specify writing to Q5/T5555 tag",
"--em optional - specify writing to EM4305/4469 tag"
],
"usage": "lf paradox clone [-h] [-r <hex>] [--fc <dec>] [--cn <dec>] [--q5] [--em]"
},
"lf paradox help": {
"command": "lf paradox help",
"description": "help This help demod demodulate a Paradox FSK tag from the GraphBuffer --------------------------------------------------------------------------------------- lf paradox demod available offline: yes Try to find Paradox preamble, if found decode / descramble data",
"notes": [
"lf paradox demod --old -> Display previous checksum version"
],
"offline": true,
"options": [
"-h, --help This help",
"--old optional - Display previous checksum version"
],
"usage": "lf paradox demod [-h] [--old]"
},
"lf paradox reader": {
"command": "lf paradox reader",
"description": "read a Paradox tag",
"notes": [
"lf paradox reader -@ -> continuous reader mode",
"lf paradox reader --old -> Display previous checksum version"
],
"offline": false,
"options": [
"-h, --help This help",
"-@ optional - continuous reader mode",
"--old optional - Display previous checksum version"
],
"usage": "lf paradox reader [-h@] [--old]"
},
"lf paradox sim": {
"command": "lf paradox sim",
"description": "Enables simulation of paradox card with specified card number. Simulation runs until the button is pressed or another USB command is issued.",
"notes": [
"lf paradox sim --raw 0f55555695596a6a9999a59a -> simulate tag",
"lf paradox sim --fc 96 --cn 40426 -> simulate tag with fc and cn"
],
"offline": false,
"options": [
"-h, --help This help",
"-r, --raw <hex> raw hex data. 12 bytes",
"--fc <dec> facility code",
"--cn <dec> card number"
],
"usage": "lf paradox sim [-h] [-r <hex>] [--fc <dec>] [--cn <dec>]"
},
"lf pcf7931 config": {
"command": "lf pcf7931 config",
"description": "This command tries to set the configuration used with PCF7931 commands The time offsets could be useful to correct slew rate generated by the antenna Caling without some parameter will print the current configuration.",
"notes": [
"lf pcf7931 config --reset",
"lf pcf7931 config --pwd 11223344556677 -d 20000",
"lf pcf7931 config --pwd 11223344556677 -d 17500 --lw -10 --lp 30"
],
"offline": true,
"options": [
"-h, --help This help",
"-r, --reset Reset configuration to default values",
"-p, --pwd <hex> Password, 7bytes, LSB-order",
"-d, --delay <dec> Tag initialization delay (in us)",
"--lw <dec> offset, low pulses width (in us)",
"--lp <dec> offset, low pulses position (in us)"
],
"usage": "lf pcf7931 config [-hr] [-p <hex>] [-d <dec>] [--lw <dec>] [--lp <dec>]"
},
"lf pcf7931 help": {
"command": "lf pcf7931 help",
"description": "help This help config Configure the password, the tags initialization delay and time offsets (optional) --------------------------------------------------------------------------------------- lf pcf7931 reader available offline: no read a PCF7931 tag",
"notes": [
"lf pcf7931 reader -@ -> continuous reader mode"
],
"offline": true,
"options": [
"-h, --help This help",
"-@ optional - continuous reader mode"
],
"usage": "lf pcf7931 reader [-h@]"
},
"lf pcf7931 write": {
"command": "lf pcf7931 write",
"description": "This command tries to write a PCF7931 tag.",
"notes": [
"lf pcf7931 write --blk 2 --idx 1 -d FF -> Write 0xFF to block 2, index 1"
],
"offline": false,
"options": [
"-h, --help This help",
"-b, --blk <dec> [0-7] block number",
"-i, --idx <dec> [0-15] index of byte inside block",
"-d, --data <hex> one byte to be written"
],
"usage": "lf pcf7931 write [-h] -b <dec> -i <dec> -d <hex>"
},
"lf presco clone": {
"command": "lf presco clone",
"description": "clone a presco tag to a T55x7, Q5/T5555 or EM4305/4469 tag.",
"notes": [
"lf presco clone -d 018363467 -> encode for T55x7 tag",
"lf presco clone -d 018363467 --q5 -> encode for Q5/T5555 tag",
"lf presco clone -d 018363467 --em -> encode for EM4305/4469"
],
"offline": false,
"options": [
"-h, --help This help",
"-c <hex> 8 digit hex card number",
"-d <digits> 9 digit presco card ID",
"--q5 optional - specify writing to Q5/T5555 tag",
"--em optional - specify writing to EM4305/4469 tag"
],
"usage": "lf presco clone [-h] [-c <hex>] [-d <digits>] [--q5] [--em]"
},
"lf presco help": {
"command": "lf presco help",
"description": "help This help demod demodulate Presco tag from the GraphBuffer --------------------------------------------------------------------------------------- lf presco demod available offline: yes Try to find presco preamble, if found decode / descramble data",
"notes": [
"lf presco demod"
],
"offline": true,
"options": [
"-h, --help This help"
],
"usage": "lf presco demod [-h]"
},
"lf presco reader": {
"command": "lf presco reader",
"description": "read a presco tag",
"notes": [
"lf presco reader -@ -> continuous reader mode"
],
"offline": false,
"options": [
"-h, --help This help",
"-@ optional - continuous reader mode"
],
"usage": "lf presco reader [-h@]"
},
"lf presco sim": {
"command": "lf presco sim",
"description": "Enables simulation of presco card with specified card number. Simulation runs until the button is pressed or another USB command is issued. Per presco format, the card number is 9 digit number and can contain *# chars. Larger values are truncated.",
"notes": [
"lf presco sim -d 018363467"
],
"offline": false,
"options": [
"-h, --help This help",
"-c <hex> 8 digit hex card number",
"-d <digits> 9 digit presco card ID"
],
"usage": "lf presco sim [-h] [-c <hex>] [-d <digits>]"
},
"lf pyramid clone": {
"command": "lf pyramid clone",
"description": "clone a Farpointe/Pyramid tag to a T55x7, Q5/T5555 or EM4305/4469 tag. The facility-code is 8-bit and the card number is 16-bit. Larger values are truncated. Currently only works on 26bit",
"notes": [
"lf pyramid clone --fc 123 --cn 11223 -> encode for T55x7 tag",
"lf pyramid clone --raw 0001010101010101010440013223921c -> idem, raw mode",
"lf pyramid clone --fc 123 --cn 11223 --q5 -> encode for Q5/T5555 tag",
"lf pyramid clone --fc 123 --cn 11223 --em -> encode for EM4305/4469"
],
"offline": false,
"options": [
"-h, --help This help",
"--fc <dec> 8-bit value facility code",
"--cn <dec> 16-bit value card number",
"--q5 optional - specify writing to Q5/T5555 tag",
"--em optional - specify writing to EM4305/4469 tag",
"-r, --raw <hex> raw hex data. 16 bytes"
],
"usage": "lf pyramid clone [-h] [--fc <dec>] [--cn <dec>] [--q5] [--em] [-r <hex>]"
},
"lf pyramid help": {
"command": "lf pyramid help",
"description": "help this help demod demodulate a Pyramid FSK tag from the GraphBuffer --------------------------------------------------------------------------------------- lf pyramid demod available offline: yes Try to find Farpoint/Pyramid preamble, if found decode / descramble data",
"notes": [
"lf pyramid demod"
],
"offline": true,
"options": [
"-h, --help This help"
],
"usage": "lf pyramid demod [-h]"
},
"lf pyramid reader": {
"command": "lf pyramid reader",
"description": "read a Farpointe/Pyramid tag",
"notes": [
"lf pyramid reader -@ -> continuous reader mode"
],
"offline": false,
"options": [
"-h, --help This help",
"-@ optional - continuous reader mode"
],
"usage": "lf pyramid reader [-h@]"
},
"lf pyramid sim": {
"command": "lf pyramid sim",
"description": "Enables simulation of Farpointe/Pyramid card with specified card number. Simulation runs until the button is pressed or another USB command is issued. The facility-code is 8-bit and the card number is 16-bit. Larger values are truncated. Currently work only on 26bit",
"notes": [
"lf pyramid sim --fc 123 --cn 1337",
"lf pyramid sim --raw 0001010101010101010440013223921c"
],
"offline": false,
"options": [
"-h, --help This help",
"--fc <dec> 8-bit value facility code",
"--cn <dec> 16-bit value card number",
"-r, --raw <hex> raw hex data. 16 bytes"
],
"usage": "lf pyramid sim [-h] [--fc <dec>] [--cn <dec>] [-r <hex>]"
},
"lf read": {
"command": "lf read",
"description": "Sniff low frequency signal. - use `lf config` to set parameters. - use `data plot` to look at it. If the number of samples is more than the device memory limit (40000 now), it will try to use the real-time sampling mode.",
"notes": [
"lf read -v -s 12000 -> collect 12000 samples",
"lf read -s 3000 -@ -> oscilloscope style"
],
"offline": false,
"options": [
"-h, --help This help",
"-s, --samples <dec> number of samples to collect",
"-v, --verbose verbose output",
"-@ continuous reading mode"
],
"usage": "lf read [-hv@] [-s <dec>]"
},
"lf search": {
"command": "lf search",
"description": "Read and search for valid known tag. For offline mode, you can `data load` first then search.",
"notes": [
"lf search -> try reading data from tag & search for known tag",
"lf search -u -> try reading data from tag & search for known and unknown tag",
"lf search -1 -> use data from the GraphBuffer & search for known tag",
"lf search -1uc -> use data from the GraphBuffer & search for known and unknown tag"
],
"offline": true,
"options": [
"-h, --help This help",
"-1 Use data from Graphbuffer to search (offline mode)",
"-c Continue searching after successful match",
"-u Search for unknown tags"
],
"usage": "lf search [-h1cu]"
},
"lf securakey clone": {
"command": "lf securakey clone",
"description": "clone a Securakey tag to a T55x7, Q5/T5555 or EM4305/4469 tag.",
"notes": [
"lf securakey clone --raw 7FCB400001ADEA5344300000 -> encode for T55x7 tag",
"lf securakey clone --raw 7FCB400001ADEA5344300000 --q5 -> encode for Q5/T5555 tag",
"lf securakey clone --raw 7FCB400001ADEA5344300000 --em -> encode for EM4305/4469"
],
"offline": false,
"options": [
"-h, --help This help",
"-r, --raw <hex> raw hex data. 12 bytes",
"--q5 optional - specify writing to Q5/T5555 tag",
"--em optional - specify writing to EM4305/4469 tag"
],
"usage": "lf securakey clone [-h] -r <hex> [--q5] [--em]"
},
"lf securakey help": {
"command": "lf securakey help",
"description": "help This help demod demodulate an Securakey tag from the GraphBuffer --------------------------------------------------------------------------------------- lf securakey demod available offline: yes Try to find Securakey preamble, if found decode / descramble data",
"notes": [
"lf securakey demod"
],
"offline": true,
"options": [
"-h, --help This help"
],
"usage": "lf securakey demod [-h]"
},
"lf securakey reader": {
"command": "lf securakey reader",
"description": "read a Securakey tag",
"notes": [
"lf securakey reader -@ -> continuous reader mode"
],
"offline": false,
"options": [
"-h, --help This help",
"-@ optional - continuous reader mode"
],
"usage": "lf securakey reader [-h@]"
},
"lf securakey sim": {
"command": "lf securakey sim",
"description": "Enables simulation of secura card with specified card number. Simulation runs until the button is pressed or another USB command is issued.",
"notes": [
"lf securakey sim --raw 7FCB400001ADEA5344300000"
],
"offline": false,
"options": [
"-h, --help This help",
"-r, --raw <hex> raw hex data. 12 bytes"
],
"usage": "lf securakey sim [-h] [-r <hex>]"
},
"lf sim": {
"command": "lf sim",
"description": "Simulate low frequency tag from graphbuffer Use `lf config` to set parameters",
"notes": [
"lf sim",
"lf sim --gap 240 -> start simulating with 240ms gap"
],
"offline": false,
"options": [
"-h, --help This help",
"-g, --gap <ms> start gap in microseconds"
],
"usage": "lf sim [-h] [-g <ms>]"
},
"lf simask": {
"command": "lf simask",
"description": "Simulate ASK tag from DemodBuffer or input",
"notes": [
"lf simask --clk 32 --am -d 0102030405 -> simulate ASK/MAN rf/32",
"lf simask --clk 32 --bi -d 0102030405 -> simulate ASK/BIPHASE rf/32",
"",
"lf simask --clk 64 --am -d ffbd8001686f1924 -> simulate a EM410x tag",
"lf simask --clk 64 --am --stt -d 5649533200003F340000001B -> simulate a VISA2K tag"
],
"offline": false,
"options": [
"-h, --help This help",
"-i, --inv invert data",
"-c, --clk <dec> manually set clock - can autodetect if using DemodBuffer (default 64)",
"--bi ask/biphase encoding",
"--am ask/manchester encoding (default)",
"--ar ask/raw encoding",
"--stt add t55xx Sequence Terminator gap - default: no gaps (only manchester)",
"-d, --data <hex> data to sim - omit to use DemodBuffer",
"-v, --verbose verbose output"
],
"usage": "lf simask [-hiv] [-c <dec>] [--bi] [--am] [--ar] [--stt] [-d <hex>]"
},
"lf simbidir": {
"command": "lf simbidir",
"description": "Simulate LF tag with bidirectional data transmission between reader and tag",
"notes": [
"lf simbidir"
],
"offline": false,
"options": [
"-h, --help This help"
],
"usage": "lf simbidir [-h]"
},
"lf simfsk": {
"command": "lf simfsk",
"description": "Simulate FSK tag from DemodBuffer or input. There are about four FSK modulations to know of. FSK1 - where fc/8 = high and fc/5 = low FSK1a - is inverted FSK1, ie: fc/5 = high and fc/8 = low FSK2 - where fc/10 = high and fc/8 = low FSK2a - is inverted FSK2, ie: fc/10 = high and fc/8 = low NOTE: if you set one clock manually set them all manually",
"notes": [
"lf simfsk -c 40 --high 8 --low 5 -d 010203 -> FSK1 rf/40 data 010203",
"lf simfsk -c 40 --high 5 --low 8 -d 010203 -> FSK1a rf/40 data 010203",
"lf simfsk -c 64 --high 10 --low 8 -d 010203 -> FSK2 rf/64 data 010203",
"lf simfsk -c 64 --high 8 --low 10 -d 010203 -> FSK2a rf/64 data 010203",
"",
"lf simfsk -c 50 --high 10 --low 8 -d 1D5559555569A9A555A59569 -> simulate HID Prox tag manually",
"lf simfsk -c 50 --high 10 --low 8 --stt -d 011DB2487E8D811111111111 -> simulate AWID tag manually"
],
"offline": false,
"options": [
"-h, --help This help",
"-c, --clk <dec> manually set clock - can autodetect if using DemodBuffer (default 64)",
"--low <dec> manually set larger Field Clock",
"--high <dec> manually set smaller Field Clock",
"--stt TBD! - STT to enable a gap between playback repetitions (default: no gap)",
"-d, --data <hex> data to sim - omit to use DemodBuffer",
"-v, --verbose verbose output"
],
"usage": "lf simfsk [-hv] [-c <dec>] [--low <dec>] [--high <dec>] [--stt] [-d <hex>]"
},
"lf simpsk": {
"command": "lf simpsk",
"description": "Simulate PSK tag from DemodBuffer or input",
"notes": [
"lf simpsk -1 --clk 40 --fc 4 -d 01020304 -> simulate PSK1 rf/40 psksub fc/4, data 01020304",
"",
"lf simpsk -1 --clk 32 --fc 2 -d a0000000bd989a11 -> simulate a indala tag manually"
],
"offline": false,
"options": [
"-h, --help This help",
"-1, --psk1 set PSK1 (default)",
"-2, --psk2 set PSK2",
"-3, --psk3 set PSK3",
"-i, --inv invert data",
"-c, --clk <dec> manually set clock - can autodetect if using DemodBuffer (default 32)",
"--fc <dec> 2|4|8 are valid carriers (default 2)",
"-d, --data <hex> data to sim - omit to use DemodBuffer",
"-v, --verbose verbose output"
],
"usage": "lf simpsk [-h123iv] [-c <dec>] [--fc <dec>] [-d <hex>]"
},
"lf sniff": {
"command": "lf sniff",
"description": "Sniff low frequency signal. You need to configure the LF part on the Proxmark3 device manually. Usually a trigger and skip samples is a good thing to set before doing a low frequency sniff. - use `lf config` to set parameters. - use `data plot` to look at sniff signal. - use `lf search -1` to see if signal can be automatic decoded. If the number of samples is more than the device memory limit (40000 now), it will try to use the real-time sampling mode.",
"notes": [
"lf sniff -v",
"lf sniff -s 3000 -@ -> oscilloscope style"
],
"offline": false,
"options": [
"-h, --help This help",
"-s, --samples <dec> number of samples to collect",
"-v, --verbose verbose output",
"-@ continuous sniffing mode"
],
"usage": "lf sniff [-hv@] [-s <dec>]"
},
"lf t55xx bruteforce": {
"command": "lf t55xx bruteforce",
"description": "This command uses bruteforce to scan a number range. Try reading Page 0, block 7 before. WARNING this may brick non-password protected chips!",
"notes": [
"lf t55xx bruteforce --r2 -s aaaaaa77 -e aaaaaa99"
],
"offline": false,
"options": [
"-h, --help This help",
"-s, --start <hex> search start password (4 hex bytes)",
"-e, --end <hex> search end password (4 hex bytes)",
"--r0 downlink - fixed bit length",
"--r1 downlink - long leading reference",
"--r2 downlink - leading zero",
"--r3 downlink - 1 of 4 coding reference",
"--all try all downlink modes (def)"
],
"usage": "lf t55xx bruteforce [-h] -s <hex> -e <hex> [--r0] [--r1] [--r2] [--r3] [--all]"
},
"lf t55xx chk": {
"command": "lf t55xx chk",
"description": "This command uses a dictionary attack. For some cloners, try '--em' for known pwdgen algo. Try to reading Page 0 block 7 before. WARNING: this may brick non-password protected chips!",
"notes": [
"lf t55xx chk -m -> use dictionary from flash memory (RDV4)",
"lf t55xx chk -f my_dictionary_pwds -> loads a default keys dictionary file",
"lf t55xx chk --em aa11223344 -> try known pwdgen algo from some cloners based on EM4100 ID"
],
"offline": false,
"options": [
"-h, --help This help",
"-m, --fm use dictionary from flash memory (RDV4)",
"-f, --file <fn> file name",
"--em <hex> EM4100 ID (5 hex bytes)",
"--r0 downlink - fixed bit length",
"--r1 downlink - long leading reference",
"--r2 downlink - leading zero",
"--r3 downlink - 1 of 4 coding reference",
"--all try all downlink modes (def)"
],
"usage": "lf t55xx chk [-hm] [-f <fn>] [--em <hex>] [--r0] [--r1] [--r2] [--r3] [--all]"
},
"lf t55xx config": {
"command": "lf t55xx config",
"description": "Set/Get T55XX configuration of the pm3 client. Like modulation, inverted, offset, rate etc. Offset is start position to decode data.",
"notes": [
"lf t55xx config --FSK -> FSK demodulation",
"lf t55xx config --FSK -i -> FSK demodulation, inverse data",
"lf t55xx config --FSK -i -o 3 -> FSK demodulation, inverse data, offset 3"
],
"offline": true,
"options": [
"-h, --help This help",
"--FSK set demodulation FSK",
"--FSK1 set demodulation FSK 1",
"--FSK1A set demodulation FSK 1a (inv)",
"--FSK2 set demodulation FSK 2",
"--FSK2A set demodulation FSK 2a (inv)",
"--ASK set demodulation ASK",
"--PSK1 set demodulation PSK 1",
"--PSK2 set demodulation PSK 2",
"--PSK3 set demodulation PSK 3",
"--NRZ set demodulation NRZ",
"--BI set demodulation Biphase",
"--BIA set demodulation Diphase (inverted biphase)",
"-i, --inv set/reset data signal inversion",
"--q5 set/reset as Q5/T5555 chip instead of T55x7",
"--st set/reset Sequence Terminator on",
"--rate <dec> set bitrate <8|16|32|40|50|64|100|128>",
"-c, --blk0 <hex> set configuration from a block0 (4 hex bytes)",
"-o, --offset <0-255> set offset, where data should start decode in bitstream",
"--r0 downlink - fixed bit length (detected def)",
"--r1 downlink - long leading reference",
"--r2 downlink - leading zero",
"--r3 downlink - 1 of 4 coding reference"
],
"usage": "lf t55xx config [-hi] [--FSK] [--FSK1] [--FSK1A] [--FSK2] [--FSK2A] [--ASK] [--PSK1] [--PSK2] [--PSK3] [--NRZ] [--BI] [--BIA] [--q5] [--st] [--rate <dec>] [-c <hex>] [-o <0-255>] [--r0] [--r1] [--r2] [--r3]"
},
"lf t55xx dangerraw": {
"command": "lf t55xx dangerraw",
"description": "This command allows to emit arbitrary raw commands on T5577 and cut the field after arbitrary duration. Uncontrolled usage can easily write an invalid configuration, activate lock bits, OTP bit, password protection bit, deactivate test-mode, lock your card forever. WARNING: this may lock definitively the tag in an unusable state!",
"notes": [
"lf t55xx dangerraw -d 01000000000000010000100000000100000000 -t 3200"
],
"offline": false,
"options": [
"-h, --help This help",
"-d, --data <string> raw bit string",
"-t, --time <us> <0 - 200000> time in microseconds before dropping the field"
],
"usage": "lf t55xx dangerraw [-h] -d <string> -t <us>"
},
"lf t55xx detect": {
"command": "lf t55xx detect",
"description": "Try detecting the tag modulation from reading the configuration block",
"notes": [
"lf t55xx detect",
"lf t55xx detect -1",
"lf t55xx detect -p 11223344"
],
"offline": true,
"options": [
"-h, --help This help",
"-1 extract using data from graphbuffer",
"-p, --pwd <hex> password (4 hex bytes)",
"--r0 downlink - fixed bit length (detected def)",
"--r1 downlink - long leading reference",
"--r2 downlink - leading zero",
"--r3 downlink - 1 of 4 coding reference",
"--all try all downlink modes"
],
"usage": "lf t55xx detect [-h1] [-p <hex>] [--r0] [--r1] [--r2] [--r3] [--all]"
},
"lf t55xx deviceconfig": {
"command": "lf t55xx deviceconfig",
"description": "Sets t55x7 timings for direct commands. The timings are set here in Field Clocks (FC) which is converted to (US) on device.",
"notes": [
"lf t55xx deviceconfig -a 29 -b 17 -c 15 -d 47 -e 15 -> default T55XX",
"lf t55xx deviceconfig -a 55 -b 14 -c 21 -d 30 -> default EM4305"
],
"offline": false,
"options": [
"-h, --help This help",
"-a <8..255> Set start gap",
"-b <8..255> Set write gap",
"-c <8..255> Set write ZERO gap",
"-d <8..255> Set write ONE gap",
"-e <8..255> Set read gap",
"-f <8..255> Set write TWO gap (1 of 4 only)",
"-g <8..255> Set write THREE gap (1 of 4 only)",
"-p, --persist persist to flash memory (RDV4)",
"-z Set default t55x7 timings (use `-p` to save if required)",
"--r0 downlink - fixed bit length (detected def)",
"--r1 downlink - long leading reference",
"--r2 downlink - leading zero",
"--r3 downlink - 1 of 4 coding reference"
],
"usage": "lf t55xx deviceconfig [-hpz] [-a <8..255>] [-b <8..255>] [-c <8..255>] [-d <8..255>] [-e <8..255>] [-f <8..255>] [-g <8..255>] [--r0] [--r1] [--r2] [--r3]"
},
"lf t55xx dump": {
"command": "lf t55xx dump",
"description": "This command dumps a T55xx card Page 0 block 0-7. It will create two files (bin/json)",
"notes": [
"lf t55xx dump",
"lf t55xx dump -p aabbccdd --override",
"lf t55xx dump -f my_lf_dump"
],
"offline": false,
"options": [
"-h, --help This help",
"-f, --file <fn> filename (default is generated on blk 0)",
"-o, --override override, force pwd read despite danger to card",
"-p, --pwd <hex> password (4 hex bytes)",
"--ns no save to file",
"--r0 downlink - fixed bit length",
"--r1 downlink - long leading reference",
"--r2 downlink - leading zero",
"--r3 downlink - 1 of 4 coding reference"
],
"usage": "lf t55xx dump [-ho] [-f <fn>] [-p <hex>] [--ns] [--r0] [--r1] [--r2] [--r3]"
},
"lf t55xx help": {
"command": "lf t55xx help",
"description": "----------- ---------------------------- notice ----------------------------- Remember to run `lf t55xx detect` first whenever a new card is placed on the Proxmark3 or the config block changed. help This help ----------- --------------------- operations --------------------- config Set/Get T55XX configuration (modulation, inverted, offset, rate) detect Try detecting the tag modulation from reading the configuration block info Show T55x7 configuration data (page 0/ blk 0) trace Show T55x7 traceability data (page 1/ blk 0-1) ----------- --------------------- recovery --------------------- sniff Attempt to recover T55xx commands from sample buffer --------------------------------------------------------------------------------------- lf t55xx clonehelp available offline: no Display a list of available commands for cloning specific techs on T5xx tags",
"notes": [
"lf t55xx clonehelp"
],
"offline": true,
"options": [
"-h, --help This help"
],
"usage": "lf t55xx clonehelp [-h]"
},
"lf t55xx info": {
"command": "lf t55xx info",
"description": "Show T55x7 configuration data (page 0/ blk 0) from reading the configuration block from tag. Use `-c` to specify a config block data to be used instead of reading tag.",
"notes": [
"lf t55xx info",
"lf t55xx info -1",
"lf t55xx info -p 11223344",
"lf t55xx info -c 00083040",
"lf t55xx info -c 6001805A --q5"
],
"offline": true,
"options": [
"-h, --help This help",
"-1 extract using data from graphbuffer",
"-p, --pwd <hex> password (4 hex bytes)",
"-c, --blk0 <hex> use these data instead (4 hex bytes)",
"--q5 interprete provided data as T5555/Q5 config",
"--r0 downlink - fixed bit length (detected def)",
"--r1 downlink - long leading reference",
"--r2 downlink - leading zero",
"--r3 downlink - 1 of 4 coding reference"
],
"usage": "lf t55xx info [-h1] [-p <hex>] [-c <hex>] [--q5] [--r0] [--r1] [--r2] [--r3]"
},
"lf t55xx p1detect": {
"command": "lf t55xx p1detect",
"description": "Detect Page 1 of a T55xx chip",
"notes": [
"lf t55xx p1detect",
"lf t55xx p1detect -1",
"lf t55xx p1detect -p 11223344 --r3"
],
"offline": false,
"options": [
"-h, --help This help",
"-1 extract using data from graphbuffer",
"-p, --pwd <hex> password (4 hex bytes)",
"--r0 downlink - fixed bit length (detected def)",
"--r1 downlink - long leading reference",
"--r2 downlink - leading zero",
"--r3 downlink - 1 of 4 coding reference"
],
"usage": "lf t55xx p1detect [-h1] [-p <hex>] [--r0] [--r1] [--r2] [--r3]"
},
"lf t55xx protect": {
"command": "lf t55xx protect",
"description": "This command sets the pwd bit on T5577. WARNING this locks the tag!",
"notes": [
"lf t55xx protect -n 01020304 -> sets new pwd 01020304",
"lf t55xx protect -p 11223344 -n 00000000 -> use pwd 11223344, sets new pwd 00000000"
],
"offline": false,
"options": [
"-h, --help This help",
"-o, --override override safety check",
"-p, --pwd <hex> password (4 hex bytes)",
"-n, --new <hex> new password (4 hex bytes)",
"--r0 downlink - fixed bit length (detected def)",
"--r1 downlink - long leading reference",
"--r2 downlink - leading zero",
"--r3 downlink - 1 of 4 coding reference"
],
"usage": "lf t55xx protect [-ho] [-p <hex>] -n <hex> [--r0] [--r1] [--r2] [--r3]"
},
"lf t55xx read": {
"command": "lf t55xx read",
"description": "Read T55xx block data. This commands defaults to page 0. * * * WARNING * * * Use of read with password on a tag not configured for a password can damage the tag * * * * * * * * * *",
"notes": [
"lf t55xx read -b 0 -> read data from block 0",
"lf t55xx read -b 0 --pwd 01020304 -> read data from block 0, pwd 01020304",
"lf t55xx read -b 0 --pwd 01020304 -o -> read data from block 0, pwd 01020304, override"
],
"offline": false,
"options": [
"-h, --help This help",
"-b, --blk <0-7> block number to read",
"-p, --pwd <hex> password (4 hex bytes)",
"-o, --override override safety check",
"--pg1 read page 1",
"--r0 downlink - fixed bit length (detected def)",
"--r1 downlink - long leading reference",
"--r2 downlink - leading zero",
"--r3 downlink - 1 of 4 coding reference"
],
"usage": "lf t55xx read [-ho] -b <0-7> [-p <hex>] [--pg1] [--r0] [--r1] [--r2] [--r3]"
},
"lf t55xx recoverpw": {
"command": "lf t55xx recoverpw",
"description": "This command uses a few tricks to try to recover mangled password. Try reading Page 0, block 7 before. WARNING this may brick non-password protected chips!",
"notes": [
"lf t55xx recoverpw",
"lf t55xx recoverpw -p 11223344",
"lf t55xx recoverpw -p 11223344 --r3"
],
"offline": false,
"options": [
"-h, --help This help",
"-p, --pwd <hex> password (4 hex bytes)",
"--r0 downlink - fixed bit length",
"--r1 downlink - long leading reference",
"--r2 downlink - leading zero",
"--r3 downlink - 1 of 4 coding reference",
"--all try all downlink modes (def)"
],
"usage": "lf t55xx recoverpw [-h] [-p <hex>] [--r0] [--r1] [--r2] [--r3] [--all]"
},
"lf t55xx resetread": {
"command": "lf t55xx resetread",
"description": "Send Reset Cmd then `lf read` the stream to attempt to identify the start of it (needs a demod and/or plot after)",
"notes": [
"lf t55xx resetread"
],
"offline": false,
"options": [
"-h, --help This help",
"-1 extract using data from graphbuffer",
"--r0 downlink - fixed bit length (detected def)",
"--r1 downlink - long leading reference",
"--r2 downlink - leading zero",
"--r3 downlink - 1 of 4 coding reference"
],
"usage": "lf t55xx resetread [-h1] [--r0] [--r1] [--r2] [--r3]"
},
"lf t55xx restore": {
"command": "lf t55xx restore",
"description": "Restore T55xx card page 0/1 n blocks from (bin/eml/json) dump file",
"notes": [
"lf t55xx restore -f lf-t55xx-00148040-dump.bin"
],
"offline": false,
"options": [
"-h, --help This help",
"-f, --file <fn> Specify a filename for dump file",
"-p, --pwd <hex> password if target card has password set (4 hex bytes)"
],
"usage": "lf t55xx restore [-h] [-f <fn>] [-p <hex>]"
},
"lf t55xx sniff": {
"command": "lf t55xx sniff",
"description": "Sniff LF t55xx based trafic and decode possible cmd / blocks. Lower tolerance means tighter pulses.",
"notes": [
"lf t55xx sniff",
"lf t55xx sniff -1 -t 2 -> use buffer with tolerance of 2",
"lf t55xx sniff -1 --zero 7 --one 14 -> use buffer, zero pulse width 7, one pulse width 15"
],
"offline": true,
"options": [
"-h, --help This help",
"-1 extract using data from graphbuffer",
"-t, --tol <dec> set tolerance level (default 5)",
"-o, --one <dec> set samples width for ONE pulse (default auto)",
"-z, --zero <dec> set samples width for ZERO pulse (default auto)"
],
"usage": "lf t55xx sniff [-h1] [-t <dec>] [-o <dec>] [-z <dec>]"
},
"lf t55xx special": {
"command": "lf t55xx special",
"description": "Show block changes with 64 different offsets, data taken from DemodBuffer.",
"notes": [
"lf t55xx special"
],
"offline": false,
"options": [
"-h, --help This help"
],
"usage": "lf t55xx special [-h]"
},
"lf t55xx trace": {
"command": "lf t55xx trace",
"description": "Show T55x7 configuration data (page 0/ blk 0) from reading the configuration block",
"notes": [
"lf t55xx trace",
"lf t55xx trace -1"
],
"offline": true,
"options": [
"-h, --help This help",
"-1 extract using data from graphbuffer",
"--r0 downlink - fixed bit length (detected def)",
"--r1 downlink - long leading reference",
"--r2 downlink - leading zero",
"--r3 downlink - 1 of 4 coding reference"
],
"usage": "lf t55xx trace [-h1] [--r0] [--r1] [--r2] [--r3]"
},
"lf t55xx wakeup": {
"command": "lf t55xx wakeup",
"description": "This commands sends the Answer-On-Request command and leaves the readerfield ON afterwards",
"notes": [
"lf t55xx wakeup -p 11223344 -> send wakeup with password"
],
"offline": false,
"options": [
"-h, --help This help",
"-p, --pwd <hex> password (4 hex bytes)",
"-v, --verbose verbose output",
"--r0 downlink - fixed bit length (detected def)",
"--r1 downlink - long leading reference",
"--r2 downlink - leading zero",
"--r3 downlink - 1 of 4 coding reference"
],
"usage": "lf t55xx wakeup [-hv] [-p <hex>] [--r0] [--r1] [--r2] [--r3]"
},
"lf t55xx wipe": {
"command": "lf t55xx wipe",
"description": "This commands wipes a tag, fills blocks 1-7 with zeros and a default configuration block",
"notes": [
"lf t55xx wipe -> wipes a T55x7 tag, config block 0x000880E0",
"lf t55xx wipe --q5 -> wipes a Q5/T5555 tag, config block 0x6001F004",
"lf t55xx wipe -p 11223344 -> wipes a T55x7 tag, config block 0x000880E0, using pwd"
],
"offline": false,
"options": [
"-h, --help This help",
"-c, --cfg <hex> configuration block0 (4 hex bytes)",
"-p, --pwd <hex> password (4 hex bytes)",
"--q5 specify writing to Q5/T5555 tag using dedicated config block",
"--r0 downlink - fixed bit length (detected def)",
"--r1 downlink - long leading reference",
"--r2 downlink - leading zero",
"--r3 downlink - 1 of 4 coding reference"
],
"usage": "lf t55xx wipe [-h] [-c <hex>] [-p <hex>] [--q5] [--r0] [--r1] [--r2] [--r3]"
},
"lf t55xx write": {
"command": "lf t55xx write",
"description": "Write T55xx block data",
"notes": [
"lf t55xx write -b 3 -d 11223344 -> write 11223344 to block 3",
"lf t55xx write -b 3 -d 11223344 --pwd 01020304 -> write 11223344 to block 3, pwd 01020304",
"lf t55xx write -b 3 -d 11223344 --pwd 01020304 --verify -> write 11223344 to block 3 and try validating write"
],
"offline": false,
"options": [
"-h, --help This help",
"-b, --blk <0-7> block number to write",
"-d, --data <hex> data to write (4 hex bytes)",
"-p, --pwd <hex> password (4 hex bytes)",
"-t, --tm test mode write ( danger )",
"--pg1 write page 1",
"--verify try validate data afterward",
"--r0 downlink - fixed bit length (detected def)",
"--r1 downlink - long leading reference",
"--r2 downlink - leading zero",
"--r3 downlink - 1 of 4 coding reference"
],
"usage": "lf t55xx write [-ht] -b <0-7> [-d <hex>] [-p <hex>] [--pg1] [--verify] [--r0] [--r1] [--r2] [--r3]"
},
"lf ti help": {
"command": "lf ti help",
"description": "help This help demod Demodulate raw bits for TI LF tag from the GraphBuffer --------------------------------------------------------------------------------------- lf ti demod available offline: yes Try to find TI preamble, if found decode / descramble data",
"notes": [
"lf ti demod"
],
"offline": true,
"options": [
"-h, --help This help"
],
"usage": "lf ti demod [-h]"
},
"lf ti reader": {
"command": "lf ti reader",
"description": "read a TI tag",
"notes": [
"lf ti reader -@ -> continuous reader mode"
],
"offline": false,
"options": [
"-h, --help This help",
"-@ optional - continuous reader mode"
],
"usage": "lf ti reader [-h@]"
},
"lf ti write": {
"command": "lf ti write",
"description": "write to a r/w TI tag.",
"notes": [
"lf ti write --raw 1122334455667788",
"lf ti write --raw 1122334455667788 --crc 1122"
],
"offline": false,
"options": [
"-h, --help This help",
"-r, --raw <hex> raw hex data. 8 bytes max",
"--crc <hex> optional - crc"
],
"usage": "lf ti write [-h] -r <hex> [--crc <hex>]"
},
"lf tune": {
"command": "lf tune",
"description": "Continuously measure LF antenna tuning. Press button or <Enter> to interrupt.",
"notes": [
"lf tune",
"lf tune --mix"
],
"offline": false,
"options": [
"-h, --help This help",
"-n, --iter <dec> number of iterations (default: 0=infinite)",
"-q, --divisor <dec> Frequency divisor. 88 -> 134 kHz, 95 -> 125 kHz",
"-f, --freq <float> Frequency in kHz",
"--bar bar style",
"--mix mixed style",
"--value values style",
"-v, --verbose verbose output"
],
"usage": "lf tune [-hv] [-n <dec>] [-q <dec>] [-f <float>] [--bar] [--mix] [--value]"
},
"lf viking clone": {
"command": "lf viking clone",
"description": "clone a Viking AM tag to a T55x7, Q5/T5555 or EM4305/4469 tag.",
"notes": [
"lf viking clone --cn 01A337 -> encode for T55x7 tag",
"lf viking clone --cn 01A337 --q5 -> encode for Q5/T5555 tag",
"lf viking clone --cn 112233 --em -> encode for EM4305/4469"
],
"offline": false,
"options": [
"-h, --help This help",
"--cn <hex> 8 digit hex viking card number",
"--q5 optional - specify writing to Q5/T5555 tag",
"--em optional - specify writing to EM4305/4469 tag"
],
"usage": "lf viking clone [-h] --cn <hex> [--q5] [--em]"
},
"lf viking help": {
"command": "lf viking help",
"description": "help This help demod demodulate a Viking tag from the GraphBuffer --------------------------------------------------------------------------------------- lf viking demod available offline: yes Try to find Viking AM preamble, if found decode / descramble data",
"notes": [
"lf viking demod"
],
"offline": true,
"options": [
"-h, --help This help"
],
"usage": "lf viking demod [-h]"
},
"lf viking reader": {
"command": "lf viking reader",
"description": "read a Viking AM tag",
"notes": [
"lf viking reader -@ -> continuous reader mode"
],
"offline": false,
"options": [
"-h, --help This help",
"-@ optional - continuous reader mode"
],
"usage": "lf viking reader [-h@]"
},
"lf viking sim": {
"command": "lf viking sim",
"description": "Enables simulation of viking card with specified card number. Simulation runs until the button is pressed or another USB command is issued. Per viking format, the card number is 8 digit hex number. Larger values are truncated.",
"notes": [
"lf viking sim --cn 01A337"
],
"offline": false,
"options": [
"-h, --help This help",
"--cn <hex> 8 digit hex viking card number"
],
"usage": "lf viking sim [-h] --cn <hex>"
},
"lf visa2000 clone": {
"command": "lf visa2000 clone",
"description": "clone a Visa2000 tag to a T55x7, Q5/T5555 or EM4305/4469 tag.",
"notes": [
"lf visa2000 clone --cn 112233 -> encode for T55x7 tag",
"lf visa2000 clone --cn 112233 --q5 -> encode for Q5/T5555 tag",
"lf visa2000 clone --cn 112233 --em -> encode for EM4305/4469"
],
"offline": false,
"options": [
"-h, --help This help",
"--cn <dec> Visa2k card ID",
"--q5 optional - specify writing to Q5/T5555 tag",
"--em optional - specify writing to EM4305/4469 tag"
],
"usage": "lf visa2000 clone [-h] --cn <dec> [--q5] [--em]"
},
"lf visa2000 help": {
"command": "lf visa2000 help",
"description": "help This help demod demodulate an VISA2000 tag from the GraphBuffer --------------------------------------------------------------------------------------- lf visa2000 demod available offline: yes Try to find visa2000 preamble, if found decode / descramble data",
"notes": [
"lf visa2000 demod"
],
"offline": true,
"options": [
"-h, --help This help"
],
"usage": "lf visa2000 demod [-h]"
},
"lf visa2000 reader": {
"command": "lf visa2000 reader",
"description": "read a visa2000 tag",
"notes": [
"lf visa2000 reader -@ -> continuous reader mode"
],
"offline": false,
"options": [
"-h, --help This help",
"-@ optional - continuous reader mode"
],
"usage": "lf visa2000 reader [-h@]"
},
"lf visa2000 sim": {
"command": "lf visa2000 sim",
"description": "Enables simulation of visa2k card with specified card number. Simulation runs until the button is pressed or another USB command is issued.",
"notes": [
"lf visa2000 sim --cn 1337"
],
"offline": false,
"options": [
"-h, --help This help",
"--cn <dec> Visa2k card ID"
],
"usage": "lf visa2000 sim [-h] --cn <dec>"
},
"mem dump": {
"command": "mem dump",
"description": "Dumps flash memory on device into a file or view in console",
"notes": [
"mem dump -f myfile -> download all flashmem to file",
"mem dump --view -o 262015 --len 128 -> display 128 bytes from offset 262015 (RSA sig)",
"mem dump --view -f myfile -o 241664 --len 58 -> display 58 bytes from offset 241664 and save to file"
],
"offline": false,
"options": [
"-h, --help This help",
"-o, --offset <dec> offset in memory",
"-l, --len <dec> length",
"-v, --view view dump",
"-f, --file <fn> save filename",
"-c, --cols <dec> column breaks (def 32)"
],
"usage": "mem dump [-hv] [-o <dec>] [-l <dec>] [-f <fn>] [-c <dec>]"
},
"mem help": {
"command": "mem help",
"description": "help This help --------------------------------------------------------------------------------------- mem baudrate available offline: no Set the baudrate for the SPI flash memory communications. Reading Flash ID will virtually always fail under 48MHz setting. Unless you know what you are doing, please stay at 24MHz. If >= 24MHz, FASTREADS instead of READS instruction will be used.",
"notes": [
"mem baudrate --mhz 48"
],
"offline": true,
"options": [
"-h, --help This help",
"--mhz <24|48> SPI baudrate in MHz"
],
"usage": "mem baudrate [-h] --mhz <24|48>"
},
"mem info": {
"command": "mem info",
"description": "Collect signature and verify it from flash memory",
"notes": [
"mem info"
],
"offline": false,
"options": [
"-h, --help This help",
"-s, --sign create a signature",
"-d <hex> flash memory id, 8 hex bytes",
"-p, --pem <fn> key in PEM format",
"-v, --verbose verbose output"
],
"usage": "mem info [-hsv] [-d <hex>] [-p <fn>]"
},
"mem load": {
"command": "mem load",
"description": "Loads binary file into flash memory on device Warning: mem area to be written must have been wiped first ( this is already taken care when loading dictionaries )",
"notes": [
"mem load -f myfile -> upload file myfile values at default offset 0",
"mem load -f myfile -o 1024 -> upload file myfile values at offset 1024",
"mem load -f mfc_default_keys -m -> upload MFC keys",
"mem load -f t55xx_default_pwds -t -> upload T55XX passwords",
"mem load -f iclass_default_keys -i -> upload iCLASS keys"
],
"offline": false,
"options": [
"-h, --help This help",
"-o, --offset <dec> offset in memory",
"-m, --mifare, --mfc upload 6 bytes keys (mifare key dictionary)",
"-i, --iclass upload 8 bytes keys (iClass key dictionary)",
"-t, --t55xx upload 4 bytes keys (password dictionary)",
"-f, --file <fn> file name"
],
"usage": "mem load [-hmit] [-o <dec>] -f <fn>"
},
"mem spiffs check": {
"command": "mem spiffs check",
"description": "Check/try to defrag faulty/fragmented SPIFFS file system",
"notes": [
"mem spiffs check"
],
"offline": false,
"options": [
"-h, --help This help"
],
"usage": "mem spiffs check [-h]"
},
"mem spiffs dump": {
"command": "mem spiffs dump",
"description": "Dumps device SPIFFS file to a local file Size is handled by first sending a STAT command against file to verify existence",
"notes": [
"mem spiffs dump -s tag.bin -> download binary file from device, saved as `tag.bin`",
"mem spiffs dump -s tag.bin -d a001 -> download tag.bin, save as `a001.bin`",
"mem spiffs dump -s tag.bin -t -> download tag.bin into trace buffer"
],
"offline": false,
"options": [
"-h, --help This help",
"-s, --src <fn> SPIFFS file to save",
"-d, --dest <fn> file name to save to <w/o .bin>",
"-t, --trace download into trace buffer"
],
"usage": "mem spiffs dump [-ht] -s <fn> [-d <fn>]"
},
"mem spiffs help": {
"command": "mem spiffs help",
"description": "help This help --------------------------------------------------------------------------------------- mem spiffs copy available offline: no Copy a file to another (destructively) in SPIFFS file system",
"notes": [
"mem spiffs copy -s aaa.bin -d aaa_cpy.bin"
],
"offline": true,
"options": [
"-h, --help This help",
"-s, --src <fn> source file name",
"-d, --dest <fn> destination file name"
],
"usage": "mem spiffs copy [-h] -s <fn> -d <fn>"
},
"mem spiffs info": {
"command": "mem spiffs info",
"description": "Print file system info and usage statistics",
"notes": [
"mem spiffs info"
],
"offline": false,
"options": [
"-h, --help This help"
],
"usage": "mem spiffs info [-h]"
},
"mem spiffs mount": {
"command": "mem spiffs mount",
"description": "Mount the SPIFFS file system if not already mounted",
"notes": [
"mem spiffs mount"
],
"offline": false,
"options": [
"-h, --help This help"
],
"usage": "mem spiffs mount [-h]"
},
"mem spiffs remove": {
"command": "mem spiffs remove",
"description": "Remove a file from SPIFFS filesystem",
"notes": [
"mem spiffs remove -f lasttag.bin"
],
"offline": false,
"options": [
"-h, --help This help",
"-f, --file <fn> file to remove"
],
"usage": "mem spiffs remove [-h] -f <fn>"
},
"mem spiffs rename": {
"command": "mem spiffs rename",
"description": "Rename/move a file from SPIFFS filesystem.",
"notes": [
"mem spiffs rename -s aaa.bin -d bbb.bin"
],
"offline": false,
"options": [
"-h, --help This help",
"-s, --src <fn> source file name",
"-d, --dest <fn> destination file name"
],
"usage": "mem spiffs rename [-h] -s <fn> -d <fn>"
},
"mem spiffs test": {
"command": "mem spiffs test",
"description": "Test SPIFFS Operations, require wiping pages 0 and 1",
"notes": [
"mem spiffs test"
],
"offline": false,
"options": [
"-h, --help This help"
],
"usage": "mem spiffs test [-h]"
},
"mem spiffs tree": {
"command": "mem spiffs tree",
"description": "Print the Flash memory file system tree",
"notes": [
"mem spiffs tree"
],
"offline": false,
"options": [
"-h, --help This help"
],
"usage": "mem spiffs tree [-h]"
},
"mem spiffs unmount": {
"command": "mem spiffs unmount",
"description": "Un-mount the SPIFFS file system",
"notes": [
"mem spiffs unmount"
],
"offline": false,
"options": [
"-h, --help This help"
],
"usage": "mem spiffs unmount [-h]"
},
"mem spiffs upload": {
"command": "mem spiffs upload",
"description": "Uploads binary-wise file into device file system Warning: mem area to be written must have been wiped first. This is already taken care when loading dictionaries. File names can only be 32 bytes long on device SPIFFS",
"notes": [
"mem spiffs upload -s local.bin -d dest.bin"
],
"offline": false,
"options": [
"-h, --help This help",
"-s, --src <fn> source file name",
"-d, --dest <fn> destination file name"
],
"usage": "mem spiffs upload [-h] -s <fn> -d <fn>"
},
"mem spiffs view": {
"command": "mem spiffs view",
"description": "View a file on flash memory on device in console",
"notes": [
"mem spiffs view -f tag.bin"
],
"offline": false,
"options": [
"-h, --help This help",
"-f, --file <fn> SPIFFS file to view",
"-c, --cols <dec> column breaks (def 16)"
],
"usage": "mem spiffs view [-h] -f <fn> [-c <dec>]"
},
"mem spiffs wipe": {
"command": "mem spiffs wipe",
"description": "* * * Warning * * * This command wipes all files on the device SPIFFS file system",
"notes": [
"mem spiffs wipe"
],
"offline": false,
"options": [
"-h, --help This help"
],
"usage": "mem spiffs wipe [-h]"
},
"mem wipe": {
"command": "mem wipe",
"description": "Wipe flash memory on device, which fills it with 0xFF [ !!! OBS ] use with caution",
"notes": [
"mem wipe -p 0 -> wipes first page"
],
"offline": false,
"options": [
"-h, --help This help",
"-p <dec> 0,1,2 page memory"
],
"usage": "mem wipe [-h] [-p <dec>]"
},
"msleep": {
"command": "msleep",
"description": "Sleep for given amount of milliseconds",
"notes": [
"msleep -t 100"
],
"offline": true,
"options": [
"-h, --help This help",
"-t, --ms <ms> time in milliseconds"
],
"usage": "msleep [-h] [-t <ms>]"
},
"nfc barcode help": {
"command": "nfc barcode help",
"description": "-------- ------------------ NFC Barcode -------------------- -------- --------------------- General --------------------- help This help ======================================================================================= piv { PIV commands... } --------------------------------------------------------------------------------------- piv help available offline: yes help This help list List ISO7816 history --------------------------------------------------------------------------------------- piv select available offline: no Executes select applet command",
"notes": [
"piv select -s -> select card, select applet",
"piv select -st --aid a00000030800001000 -> select card, select applet a00000030800001000, show result in TLV"
],
"offline": true,
"options": [
"-h, --help This help",
"-s, -S, --select Activate field and select applet",
"-k, -K, --keep Keep field for next command",
"-a, -A, --apdu Show APDU requests and responses",
"-t, -T, --tlv TLV decode results",
"-w, -W, --wired Send data via contact (iso7816) interface. (def: Contactless interface)",
"--aid <hex> Applet ID to select. By default A0000003080000100 will be used"
],
"usage": "piv select [-hskatw] [--aid <hex>]"
},
"nfc barcode sim": {
"command": "nfc barcode sim",
"description": "Simulate Thinfilm tag",
"notes": [
"hf thinfilm sim -d B70470726f786d61726b2e636f6d"
],
"offline": false,
"options": [
"-h, --help This help",
"-d, --data <hex> bytes to send",
"--raw raw, provided bytes should include CRC"
],
"usage": "hf thinfilm sim [-h] -d <hex> [--raw]"
},
"nfc help": {
"command": "nfc help",
"description": "-------- --------------------- NFC Tags -------------------- type1 { NFC Forum Tag Type 1... } type2 { NFC Forum Tag Type 2... } type4a { NFC Forum Tag Type 4 ISO14443A... } type4b { NFC Forum Tag Type 4 ISO14443B... } mf { NFC Type MIFARE Classic/Plus Tag... } barcode { NFC Barcode Tag... } -------- --------------------- General --------------------- help This help decode Decode NDEF records --------------------------------------------------------------------------------------- nfc decode available offline: yes Decode and print NFC Data Exchange Format (NDEF) You must provide either data in hex or a filename, but not both",
"notes": [
"nfc decode -d 9101085402656e48656c6c6f5101085402656e576f726c64",
"nfc decode -d 0103d020240203e02c040300fe",
"nfc decode -f myfilename"
],
"offline": true,
"options": [
"-h, --help This help",
"-d, --data <hex> NDEF data to decode",
"-f, --file <fn> file to load",
"-v, --verbose verbose output"
],
"usage": "nfc decode [-hv] [-d <hex>] [-f <fn>]"
},
"nfc mf cread": {
"command": "nfc mf cread",
"description": "Prints NFC Data Exchange Format (NDEF)",
"notes": [
"hf mf ndefread -> shows NDEF parsed data",
"hf mf ndefread -vv -> shows NDEF parsed and raw data",
"hf mf ndefread --aid e103 -k ffffffffffff -b -> shows NDEF data with custom AID, key and with key B",
"hf mf ndefread -f myfilename -> save raw NDEF to file"
],
"offline": false,
"options": [
"-h, --help This help",
"-v, --verbose Verbose output",
"--aid <aid> replace default aid for NDEF",
"-k, --key <key> replace default key for NDEF",
"-b, --keyb use key B for access sectors (by default: key A)",
"-f, --file <fn> save raw NDEF to file"
],
"usage": "hf mf ndefread [-hvb] [--aid <aid>] [-k <key>] [-f <fn>]"
},
"nfc mf cwrite": {
"command": "nfc mf cwrite",
"description": "Write raw NDEF hex bytes to tag. This commands assumes tag already been NFC/NDEF formatted.",
"notes": [
"hf mf ndefwrite -d 0300FE -> write empty record to tag",
"hf mf ndefwrite -f myfilename",
"hf mf ndefwrite -d 033fd1023a53709101195405656e2d55534963656d616e2054776974746572206c696e6b5101195502747769747465722e636f6d2f686572726d616e6e31303031"
],
"offline": false,
"options": [
"-h, --help This help",
"-d <hex> raw NDEF hex bytes",
"-f, --file <fn> write raw NDEF file to tag",
"-p fix NDEF record headers / terminator block if missing",
"--mini MIFARE Classic Mini / S20",
"--1k MIFARE Classic 1k / S50 (def)",
"--2k MIFARE Classic/Plus 2k",
"--4k MIFARE Classic 4k / S70",
"-v, --verbose verbose output"
],
"usage": "hf mf ndefwrite [-hpv] [-d <hex>] [-f <fn>] [--mini] [--1k] [--2k] [--4k]"
},
"nfc mf help": {
"command": "nfc mf help",
"description": "-------- --------- NFC Type MIFARE Classic/Plus Tag -------- -------- --------------------- General --------------------- help This help ======================================================================================= nfc barcode { NFC Barcode Tag... } --------------------------------------------------------------------------------------- nfc barcode read available offline: no Get info from Thinfilm tags",
"notes": [
"hf thinfilm info"
],
"offline": true,
"options": [
"-h, --help This help"
],
"usage": "hf thinfilm info [-h]"
},
"nfc mf pread": {
"command": "nfc mf pread",
"description": "Prints NFC Data Exchange Format (NDEF)",
"notes": [
"hf mfp ndefread",
"hf mfp ndefread -vv -> shows NDEF parsed and raw data",
"hf mfp ndefread --aid e103 -k d3f7d3f7d3f7d3f7d3f7d3f7d3f7d3f7 -> shows NDEF data with custom AID and key",
"hf mfp ndefread -f myfilename -> save raw NDEF to file"
],
"offline": false,
"options": [
"-h, --help This help",
"-v, --verbose verbose output",
"--aid <aid> replace default aid for NDEF",
"-k, --key <key> replace default key for NDEF",
"-b, --keyb use key B for access sectors (by default: key A)",
"-f, --file <fn> save raw NDEF to file"
],
"usage": "hf mfp ndefread [-hvb] [--aid <aid>] [-k <key>] [-f <fn>]"
},
"nfc type1 help": {
"command": "nfc type1 help",
"description": "-------- -------------- NFC Forum Tag Type 1 --------------- -------- --------------------- General --------------------- help This help ======================================================================================= nfc type2 { NFC Forum Tag Type 2... } --------------------------------------------------------------------------------------- nfc type2 read available offline: no Prints NFC Data Exchange Format (NDEF)",
"notes": [
"hf mfu ndefread -> shows NDEF data",
"hf mfu ndefread -k ffffffff -> shows NDEF data with key",
"hf mfu ndefread -f myfilename -> save raw NDEF to file"
],
"offline": true,
"options": [
"-h, --help This help",
"-l Swap entered key's endianness",
"-f, --file <fn> Save raw NDEF to file",
"-v, --verbose Verbose output"
],
"usage": "hf mfu ndefread [-hlv] [-k Replace default key for NDEF] [-f <fn>]"
},
"nfc type1 read": {
"command": "nfc type1 read",
"description": "Get info from Topaz tags",
"notes": [
"hf topaz info",
"hf topaz info -f myfilename -> save raw NDEF to file"
],
"offline": false,
"options": [
"-h, --help This help",
"-f, --file <fn> save raw NDEF to file",
"-v, --verbose verbose output"
],
"usage": "hf topaz info [-hv] [-f <fn>]"
},
"nfc type2 help": {
"command": "nfc type2 help",
"description": "-------- -------------- NFC Forum Tag Type 2 --------------- -------- --------------------- General --------------------- help This help ======================================================================================= nfc type4a { NFC Forum Tag Type 4 ISO14443A... } --------------------------------------------------------------------------------------- nfc type4a format available offline: no Format ISO14443-a Tag as a NFC tag with Data Exchange Format (NDEF)",
"notes": [
"hf 14a ndefformat"
],
"offline": true,
"options": [
"-h, --help This help",
"-v, --verbose verbose output"
],
"usage": "hf 14a ndefformat [-hv]"
},
"nfc type4a help": {
"command": "nfc type4a help",
"description": "-------- --------- NFC Forum Tag Type 4 ISO14443A ---------- -------- --------------------- General --------------------- help This help ======================================================================================= nfc type4b { NFC Forum Tag Type 4 ISO14443B... } --------------------------------------------------------------------------------------- nfc type4b read available offline: no Print NFC Data Exchange Format (NDEF)",
"notes": [
"hf 14b ndefread",
"hf 14b ndefread -f myfilename -> save raw NDEF to file"
],
"offline": true,
"options": [
"-h, --help This help",
"-f, --file <fn> Save raw NDEF to file",
"-v, --verbose Verbose output"
],
"usage": "hf 14b ndefread [-hv] [-f <fn>]"
},
"nfc type4a read": {
"command": "nfc type4a read",
"description": "Read NFC Data Exchange Format (NDEF) file on Type 4 NDEF tag",
"notes": [
"hf 14a ndefread",
"hf 14a ndefread -f myfilename -> save raw NDEF to file"
],
"offline": false,
"options": [
"-h, --help This help",
"-f, --file <fn> save raw NDEF to file",
"-v, --verbose verbose output"
],
"usage": "hf 14a ndefread [-hv] [-f <fn>]"
},
"nfc type4a st25taread": {
"command": "nfc type4a st25taread",
"description": "Read NFC Data Exchange Format (NDEF) file on ST25TA",
"notes": [
"hf st25ta ndefread -p 82E80053D4CA5C0B656D852CC696C8A1",
"hf st25ta ndefread -f myfilename -> save raw NDEF to file"
],
"offline": false,
"options": [
"-h, --help This help",
"-p, --pwd <hex> 16 byte read password",
"-f, --file <fn> save raw NDEF to file",
"-v, --verbose verbose output"
],
"usage": "hf st25ta ndefread [-hv] [-p <hex>] [-f <fn>]"
},
"nfc type4a write": {
"command": "nfc type4a write",
"description": "Write raw NDEF hex bytes to tag. This commands assumes tag already been NFC/NDEF formatted.",
"notes": [
"hf 14a ndefwrite -d 0300FE -> write empty record to tag",
"hf 14a ndefwrite -f myfilename",
"hf 14a ndefwrite -d 003fd1023a53709101195405656e2d55534963656d616e2054776974746572206c696e6b5101195502747769747465722e636f6d2f686572726d616e6e31303031"
],
"offline": false,
"options": [
"-h, --help This help",
"-d <hex> raw NDEF hex bytes",
"-f, --file <fn> write raw NDEF file to tag",
"-p fix NDEF record headers / terminator block if missing",
"-v, --verbose verbose output"
],
"usage": "hf 14a ndefwrite [-hpv] [-d <hex>] [-f <fn>]"
},
"nfc type4b help": {
"command": "nfc type4b help",
"description": "-------- --------- NFC Forum Tag Type 4 ISO14443B ------------- -------- --------------------- General --------------------- help This help ======================================================================================= nfc mf { NFC Type MIFARE Classic/Plus Tag... } --------------------------------------------------------------------------------------- nfc mf cformat available offline: no format MIFARE Classic Tag as a NFC tag with Data Exchange Format (NDEF) If no <name> given, UID will be used as filename. It will try default keys and MAD keys to detect if tag is already formatted in order to write. If not, it will try finding a key file based on your UID. ie, if you ran autopwn before",
"notes": [
"hf mf ndefformat",
"hf mf ndefformat --1k -> MIFARE Classic 1k",
"hf mf ndefformat --keys hf-mf-01020304-key.bin -> MIFARE 1k with keys from specified file"
],
"offline": true,
"options": [
"-h, --help This help",
"-k, --keys <fn> filename of keys",
"--mini MIFARE Classic Mini / S20",
"--1k MIFARE Classic 1k / S50 (def)",
"--2k MIFARE Classic/Plus 2k",
"--4k MIFARE Classic 4k / S70"
],
"usage": "hf mf ndefformat [-h] [-k <fn>] [--mini] [--1k] [--2k] [--4k]"
},
"piv authsign": {
"command": "piv authsign",
"description": "Send a nonce and ask the PIV card to sign it",
"notes": [
"piv sign -sk -> select card, select applet, sign a NULL nonce"
],
"offline": false,
"options": [
"-h, --help This help",
"-s, -S, --select Activate field and select applet",
"-k, -K, --keep Keep field for next command",
"-a, -A, --apdu Show APDU requests and responses",
"-t, -T, --tlv TLV decode results",
"-w, -W, --wired Send data via contact (iso7816) interface. (def: Contactless interface)",
"--aid <hex> Applet ID to select. By default A0000003080000100 will be used",
"--nonce <hex> Nonce to sign.",
"--slot <dec id> Slot number. Default will be 0x9E (card auth cert).",
"--alg <dec> Algorithm to use to sign. Example values: 06=RSA-1024, 07=RSA-2048, 11=ECC-P256 (default), 14=ECC-P384"
],
"usage": "piv sign [-hskatw] [--aid <hex>] --nonce <hex> [--slot <dec id>] [--alg <dec>]"
},
"piv getdata": {
"command": "piv getdata",
"description": "Get a data container of a given tag",
"notes": [
"piv getdata -s 5fc102 -> select card, select applet, get card holder unique identifer",
"piv getdata -st 5fc102 -> select card, select applet, get card holder unique identifer, show result in TLV"
],
"offline": false,
"options": [
"-h, --help This help",
"-s, -S, --select Activate field and select applet",
"-k, -K, --keep Keep field for next command",
"-a, -A, --apdu Show APDU requests and responses",
"-t, -T, --tlv TLV decode results",
"-w, -W, --wired Send data via contact (iso7816) interface. (def: Contactless interface)",
"--aid <hex> Applet ID to select. By default A0000003080000100 will be used",
"<hex> Tag ID to read, between 1 and 3 bytes."
],
"usage": "piv getdata [-hskatw] [--aid <hex>] <hex>"
},
"piv list": {
"command": "piv list",
"description": "Alias of `trace list -t 7816` with selected protocol data to annotate trace buffer You can load a trace from file (see `trace load -h`) or it be downloaded from device by default It accepts all other arguments of `trace list`. Note that some might not be relevant for this specific protocol",
"notes": [
"piv list --frame -> show frame delay times",
"piv list -1 -> use trace buffer"
],
"offline": true,
"options": [
"-h, --help This help",
"-1, --buffer use data from trace buffer",
"--frame show frame delay times",
"-c mark CRC bytes",
"-r show relative times (gap and duration)",
"-u display times in microseconds instead of clock cycles",
"-x show hexdump to convert to pcap(ng)",
"or to import into Wireshark using encapsulation type \"ISO 14443\"",
"-f, --file <fn> filename of dictionary"
],
"usage": "piv list [-h1crux] [--frame] [-f <fn>]"
},
"piv scan": {
"command": "piv scan",
"description": "Scan a PIV card for known containers",
"notes": [
"piv scan -s -> select card, select applet and run scan",
"piv scan -st --aid a00000030800001000 -> select card, select applet a00000030800001000, show result of the scan in TLV"
],
"offline": false,
"options": [
"-h, --help This help",
"-s, -S, --select Activate field and select applet",
"-k, -K, --keep Keep field for next command",
"-a, -A, --apdu Show APDU requests and responses",
"-t, -T, --tlv TLV decode results",
"-w, -W, --wired Send data via contact (iso7816) interface. (def: Contactless interface)",
"--aid <hex> Applet ID to select. By default A0000003080000100 will be used"
],
"usage": "piv scan [-hskatw] [--aid <hex>]"
},
"prefs get barmode": {
"command": "prefs get barmode",
"description": "Get preference of HF/LF tune command styled output in the client",
"notes": [
"prefs get barmode"
],
"offline": true,
"options": [
"-h, --help This help"
],
"usage": "prefs get barmode [-h]"
},
"prefs get client.debug": {
"command": "prefs get client.debug",
"description": "Get preference of using clientside debug level",
"notes": [
"prefs get client.debug"
],
"offline": true,
"options": [
"-h, --help This help"
],
"usage": "prefs get client.debug [-h]"
},
"prefs get client.delay": {
"command": "prefs get client.delay",
"description": "Get preference of delay time before execution of a command in the client",
"notes": [
"prefs get client.delay"
],
"offline": true,
"options": [
"-h, --help This help"
],
"usage": "prefs get client.delay [-h]"
},
"prefs get client.timeout": {
"command": "prefs get client.timeout",
"description": "Get preference of delay time before execution of a command in the client",
"notes": [
"prefs get client.timeout"
],
"offline": true,
"options": [
"-h, --help This help"
],
"usage": "prefs get client.timeout [-h]"
},
"prefs get color": {
"command": "prefs get color",
"description": "Get preference of using colors in the client",
"notes": [
"prefs get color"
],
"offline": true,
"options": [
"-h, --help This help"
],
"usage": "prefs get color [-h]"
},
"prefs get emoji": {
"command": "prefs get emoji",
"description": "Get preference of using emojis in the client",
"notes": [
"prefs get emoji"
],
"offline": true,
"options": [
"-h, --help This help"
],
"usage": "prefs get emoji [-h]"
},
"prefs get hints": {
"command": "prefs get hints",
"description": "Get preference of showing hint messages in the client",
"notes": [
"prefs get hints"
],
"offline": true,
"options": [
"-h, --help This help"
],
"usage": "prefs get hints [-h]"
},
"prefs get output": {
"command": "prefs get output",
"description": "Get preference of dump output style",
"notes": [
"prefs get output"
],
"offline": true,
"options": [
"-h, --help This help"
],
"usage": "prefs get output [-h]"
},
"prefs get plotsliders": {
"command": "prefs get plotsliders",
"description": "Get preference of showing the plotslider control in the client",
"notes": [
"prefs get plotsliders"
],
"offline": true,
"options": [
"-h, --help This help"
],
"usage": "prefs get plotsliders [-h]"
},
"prefs get savepaths": {
"command": "prefs get savepaths",
"description": "Get preference of file paths in the client",
"notes": [
"prefs get savepaths"
],
"offline": true,
"options": [
"-h, --help This help"
],
"usage": "prefs get savepaths [-h]"
},
"prefs help": {
"command": "prefs help",
"description": "help This help get { Get a preference } set { Set a preference } show Show all preferences --------------------------------------------------------------------------------------- prefs show available offline: yes Show all persistent preferences",
"notes": [
"prefs show"
],
"offline": true,
"options": [
"-h, --help This help",
"-j, --json Dump prefs as JSON"
],
"usage": "prefs show [-hj]"
},
"prefs set client.debug": {
"command": "prefs set client.debug",
"description": "Set persistent preference of using clientside debug level",
"notes": [
"prefs set client.debug --simple"
],
"offline": true,
"options": [
"-h, --help This help",
"--off no debug messages",
"--simple simple debug messages",
"--full full debug messages"
],
"usage": "prefs set client.debug [-h] [--off] [--simple] [--full]"
},
"prefs set client.delay": {
"command": "prefs set client.delay",
"description": "Set persistent preference of delay before executing a command in the client",
"notes": [
"prefs set client.delay --ms 0 -> unsets any delay",
"prefs set client.delay --ms 1000 -> sets 1000ms delay"
],
"offline": true,
"options": [
"-h, --help This help",
"--ms <ms> delay in micro seconds"
],
"usage": "prefs set client.delay [-h] [--ms <ms>]"
},
"prefs set client.timeout": {
"command": "prefs set client.timeout",
"description": "Set persistent preference of client communication timeout",
"notes": [
"prefs set client.timeout --ms 0 -> unsets any timeout",
"prefs set client.timeout -m 20 -> Set the timeout to 20ms",
"prefs set client.timeout --ms 500 -> Set the timeout to 500ms"
],
"offline": true,
"options": [
"-h, --help This help",
"-m, --ms <ms> timeout in micro seconds"
],
"usage": "prefs set client.timeout [-h] [-m <ms>]"
},
"prefs set color": {
"command": "prefs set color",
"description": "Set persistent preference of using colors in the client",
"notes": [
"prefs set color --ansi"
],
"offline": true,
"options": [
"-h, --help This help",
"--ansi use ANSI colors",
"--off don't use colors"
],
"usage": "prefs set color [-h] [--ansi] [--off]"
},
"prefs set emoji": {
"command": "prefs set emoji",
"description": "Set persistent preference of using emojis in the client",
"notes": [
"prefs set emoji --alias"
],
"offline": true,
"options": [
"-h, --help This help",
"--alias show alias for emoji",
"--emoji show emoji",
"--alttext show alt text for emoji",
"--none don't show emoji or text"
],
"usage": "prefs set emoji [-h] [--alias] [--emoji] [--alttext] [--none]"
},
"prefs set help": {
"command": "prefs set help",
"description": "help This help barmode Set bar mode client.debug Set client debug level client.delay Set client execution delay client.timeout Set client communication timeout color Set color support emoji Set emoji display hints Set hint display savepaths ... to be adjusted next ... output Set dump output style plotsliders Set plot slider display --------------------------------------------------------------------------------------- prefs set barmode available offline: yes Set persistent preference of HF/LF tune command styled output in the client",
"notes": [
"prefs set barmode --mix"
],
"offline": true,
"options": [
"-h, --help This help",
"--bar measured values as bar only",
"--mix measured values as numbers and bar",
"--val measured values only"
],
"usage": "prefs set barmode [-h] [--bar] [--mix] [--val]"
},
"prefs set hints": {
"command": "prefs set hints",
"description": "Set persistent preference of showing hint messages in the client",
"notes": [
"prefs set hints --on"
],
"offline": true,
"options": [
"-h, --help This help",
"--off hide hints",
"--on show hints"
],
"usage": "prefs set hints [-h] [--off] [--on]"
},
"prefs set output": {
"command": "prefs set output",
"description": "Set dump output style to condense consecutive repeated data",
"notes": [
"prefs set output --normal -> sets the output style to normal",
"prefs set output --dense -> sets the output style to dense"
],
"offline": true,
"options": [
"-h, --help This help",
"--normal normal output",
"--dense dense output"
],
"usage": "prefs set output [-h] [--normal] [--dense]"
},
"prefs set plotsliders": {
"command": "prefs set plotsliders",
"description": "Set persistent preference of showing the plotslider control in the client",
"notes": [
"prefs set plotsliders --on"
],
"offline": true,
"options": [
"-h, --help This help",
"--off hide plot slider controls",
"--on show plot slider controls"
],
"usage": "prefs set plotsliders [-h] [--off] [--on]"
},
"prefs set savepaths": {
"command": "prefs set savepaths",
"description": "Set persistent preference of file paths in the client",
"notes": [
"prefs set savepaths --dump /home/mydumpfolder -> all dump files will be saved into this folder",
"prefs set savepaths --def /home/myfolder -c -> create if needed, all files will be saved into this folder"
],
"offline": true,
"options": [
"-h, --help This help",
"-c, --create create directory if it does not exist",
"--def <path> default path",
"--dump <path> dump file path",
"--trace <path> trace path"
],
"usage": "prefs set savepaths [-hc] [--def <path>] [--dump <path>] [--trace <path>]"
},
"quit": {
"command": "quit",
"description": "Quit the Proxmark3 client terminal",
"notes": [
"quit"
],
"offline": true,
"options": [
"-h, --help This help"
],
"usage": "quit [-h]"
},
"rem": {
"command": "rem",
"description": "Add a text line in log file",
"notes": [
"rem my message -> adds a timestamp with `my message`"
],
"offline": true,
"options": [
"-h, --help This help",
"<string> message line you want inserted"
],
"usage": "rem [-h] <string> [<string>]..."
},
"script list": {
"command": "script list",
"description": "List available Lua, Cmd and Python scripts",
"notes": [
"script list"
],
"offline": true,
"options": [
"-h, --help This help"
],
"usage": "script list [-h]"
},
"script run": {
"command": "script run",
"description": "Run a Lua, Cmd or Python script. If no extension it will search for lua/cmd/py extensions Use `script list` to see available scripts",
"notes": [
"script run my_script -h"
],
"offline": true,
"options": [
"-h, --help This help",
"<filename> name of script to run",
"<params> script parameters"
],
"usage": "script run [-h] <filename> [<params>]..."
},
"smart brute": {
"command": "smart brute",
"description": "Tries to bruteforce SFI, using a known list of AID's",
"notes": [
"smart brute -t"
],
"offline": false,
"options": [
"-h, --help This help",
"-t, --tlv executes TLV decoder if it possible"
],
"usage": "smart brute [-ht]"
},
"smart help": {
"command": "smart help",
"description": "help This help list List ISO 7816 history pcsc Turn pm3 into pcsc reader and relay to host OS via vpcd upgrade Upgrade sim module firmware --------------------------------------------------------------------------------------- smart list available offline: yes Alias of `trace list -t 7816` with selected protocol data to annotate trace buffer You can load a trace from file (see `trace load -h`) or it be downloaded from device by default It accepts all other arguments of `trace list`. Note that some might not be relevant for this specific protocol",
"notes": [
"smart list --frame -> show frame delay times",
"smart list -1 -> use trace buffer"
],
"offline": true,
"options": [
"-h, --help This help",
"-1, --buffer use data from trace buffer",
"--frame show frame delay times",
"-c mark CRC bytes",
"-r show relative times (gap and duration)",
"-u display times in microseconds instead of clock cycles",
"-x show hexdump to convert to pcap(ng)",
"or to import into Wireshark using encapsulation type \"ISO 14443\"",
"-f, --file <fn> filename of dictionary"
],
"usage": "smart list [-h1crux] [--frame] [-f <fn>]"
},
"smart info": {
"command": "smart info",
"description": "Extract more detailed information from smart card.",
"notes": [
"smart info -v"
],
"offline": false,
"options": [
"-h, --help This help",
"-v, --verbose verbose output"
],
"usage": "smart info [-hv]"
},
"smart pcsc": {
"command": "smart pcsc",
"description": "Make pm3 available to host OS smartcard driver via vpcd to enable use with other software such as GlobalPlatform Pro",
"notes": [
"Requires the virtual smartcard daemon to be installed and running",
"see https://frankmorgner.github.io/vsmartcard/virtualsmartcard/README.html",
"note:",
"`-v` shows APDU transactions between OS and card"
],
"offline": true,
"options": [
"-h, --help This help",
"--host <str> vpcd socket host (default: localhost)",
"-p, --port <int> vpcd socket port (default: 35963)",
"-v, --verbose display APDU transactions between OS and card",
"-a use ISO 14443A contactless interface",
"-b use ISO 14443B contactless interface",
"-c use ISO 7816 contact interface"
],
"usage": "smart pcsc [-hvabc] [--host <str>] [-p <int>]"
},
"smart raw": {
"command": "smart raw",
"description": "Sends raw bytes to card",
"notes": [
"smart raw -s -0 -d 00a404000e315041592e5359532e4444463031 -> `1PAY.SYS.DDF01` PPSE directory with get ATR",
"smart raw -0 -d 00a404000e325041592e5359532e4444463031 -> `2PAY.SYS.DDF01` PPSE directory",
"smart raw -0 -t -d 00a4040007a0000000041010 -> Mastercard",
"smart raw -0 -t -d 00a4040007a0000000031010 -> Visa"
],
"offline": false,
"options": [
"-h, --help This help",
"-r do not read response",
"-a active smartcard without select (reset sc module)",
"-s active smartcard with select (get ATR)",
"-t, --tlv executes TLV decoder if it possible",
"-0 use protocol T=0",
"--timeout <ms> Timeout in MS waiting for SIM to respond. (def 337ms)",
"-d, --data <hex> bytes to send"
],
"usage": "smart raw [-hrast0] [--timeout <ms>] -d <hex>"
},
"smart reader": {
"command": "smart reader",
"description": "Act as a smart card reader.",
"notes": [
"smart reader"
],
"offline": false,
"options": [
"-h, --help This help",
"-v, --verbose verbose output"
],
"usage": "smart reader [-hv]"
},
"smart setclock": {
"command": "smart setclock",
"description": "Set clock speed for smart card interface.",
"notes": [
"smart setclock --4mhz",
"smart setclock --16mhz"
],
"offline": false,
"options": [
"-h, --help This help",
"--16mhz 16 MHz clock speed",
"--8mhz 8 MHz clock speed",
"--4mhz 4 MHz clock speed"
],
"usage": "smart setclock [-h] [--16mhz] [--8mhz] [--4mhz]"
},
"trace help": {
"command": "trace help",
"description": "help This help extract Extract authentication challenges found in trace list List protocol data in trace buffer load Load trace from file save Save trace buffer to file --------------------------------------------------------------------------------------- trace extract available offline: yes Extracts protocol authentication challenges from trace buffer",
"notes": [
"trace extract",
"trace extract -1"
],
"offline": true,
"options": [
"-h, --help This help",
"-1, --buffer use data from trace buffer"
],
"usage": "trace extract [-h1]"
},
"trace list": {
"command": "trace list",
"description": "Annotate trace buffer with selected protocol data You can load a trace from file (see `trace load -h`) or it be downloaded from device by default",
"notes": [
"trace list -t raw -> just show raw data without annotations",
"",
"trace list -t 14a -> interpret as ISO14443-A",
"trace list -t 14b -> interpret as ISO14443-B",
"trace list -t 15 -> interpret as ISO15693",
"trace list -t 7816 -> interpret as ISO7816-4",
"trace list -t cryptorf -> interpret as CryptoRF",
"",
"trace list -t des -> interpret as MIFARE DESFire",
"trace list -t felica -> interpret as ISO18092 / FeliCa",
"trace list -t hitag1 -> interpret as Hitag 1",
"trace list -t hitag2 -> interpret as Hitag 2",
"trace list -t hitags -> interpret as Hitag S",
"trace list -t iclass -> interpret as iCLASS",
"trace list -t legic -> interpret as LEGIC",
"trace list -t lto -> interpret as LTO-CM",
"trace list -t mf -> interpret as MIFARE Classic and decrypt crypto1 stream",
"trace list -t seos -> interpret as SEOS",
"trace list -t thinfilm -> interpret as Thinfilm",
"trace list -t topaz -> interpret as Topaz",
"trace list -t mfp -> interpret as MIFARE Plus",
"",
"trace list -t mf -f mfc_default_keys.dic -> use default dictionary file",
"trace list -t 14a --frame -> show frame delay times",
"trace list -t 14a -1 -> use trace buffer"
],
"offline": true,
"options": [
"-h, --help This help",
"-1, --buffer use data from trace buffer",
"--frame show frame delay times",
"-c mark CRC bytes",
"-r show relative times (gap and duration)",
"-u display times in microseconds instead of clock cycles",
"-x show hexdump to convert to pcap(ng)",
"or to import into Wireshark using encapsulation type \"ISO 14443\"",
"-t, --type <string> protocol to annotate the trace",
"-f, --file <fn> filename of dictionary"
],
"usage": "trace list [-h1crux] [--frame] [-t <string>] [-f <fn>]"
},
"trace load": {
"command": "trace load",
"description": "Load protocol data from binary file to trace buffer File extension is <.trace>",
"notes": [
"trace load -f mytracefile -> w/o file extension"
],
"offline": true,
"options": [
"-h, --help This help",
"-f, --file <fn> Specify trace file to load"
],
"usage": "trace load [-h] -f <fn>"
},
"trace save": {
"command": "trace save",
"description": "Save protocol data from trace buffer to binary file File extension is <.trace>",
"notes": [
"trace save -f mytracefile -> w/o file extension"
],
"offline": true,
"options": [
"-h, --help This help",
"-f, --file <fn> Specify trace file to save"
],
"usage": "trace save [-h] -f <fn>"
},
"usart btfactory": {
"command": "usart btfactory",
"description": "Reset BT add-on to factory settings This requires 1) BTpower to be turned ON 2) BT add-on to NOT be connected => the add-on blue LED must blink WARNING: process only if strictly needed!",
"notes": [
"usart btfactory"
],
"offline": false,
"options": [
"-h, --help This help"
],
"usage": "usart btfactory [-h]"
},
"usart config": {
"command": "usart config",
"description": "Configure USART. WARNING: it will have side-effects if used in USART HOST mode! The changes are not permanent, restart Proxmark3 to get default settings back.",
"notes": [
"usart config -b 9600",
"usart config -b 9600 --none",
"usart config -E"
],
"offline": false,
"options": [
"-h, --help This help",
"-b, --baud <dec> baudrate",
"-N, --none mone parity",
"-E, --even even parity",
"-O, --odd odd parity"
],
"usage": "usart config [-hNEO] [-b <dec>]"
},
"usart help": {
"command": "usart help",
"description": "help This help --------------------------------------------------------------------------------------- usart btpin available offline: no Change BT add-on PIN. WARNING: this requires 1) BTpower to be turned ON 2) BT add-on to NOT be connected => the add-on blue LED must blink",
"notes": [
"usart btpin -p 1234"
],
"offline": true,
"options": [
"-h, --help This help",
"-p, --pin <dec> Desired PIN number (4 digits)"
],
"usage": "usart btpin [-h] -p <dec>"
},
"usart rx": {
"command": "usart rx",
"description": "Receive string over USART. WARNING: it will have side-effects if used in USART HOST mode!",
"notes": [
"usart rx -t 2000 -> 2 second timeout"
],
"offline": false,
"options": [
"-h, --help This help",
"-t, --timeout <dec> timeout in ms, default is 0ms"
],
"usage": "usart rx [-h] [-t <dec>]"
},
"usart rxhex": {
"command": "usart rxhex",
"description": "Receive bytes over USART. WARNING: it will have side-effects if used in USART HOST mode!",
"notes": [
"usart rxhex -t 2000 -> 2 second timeout"
],
"offline": false,
"options": [
"-h, --help This help",
"-t, --timeout <dec> timeout in ms, default is 0ms"
],
"usage": "usart rxhex [-h] [-t <dec>]"
},
"usart tx": {
"command": "usart tx",
"description": "Send string over USART. WARNING: it will have side-effects if used in USART HOST mode!",
"notes": [
"usart tx -d \"AT+VERSION\"",
"usart tx -d \"AT+VERSION\\r\\n\""
],
"offline": false,
"options": [
"-h, --help This help",
"-d, --data <string> string to send"
],
"usage": "usart tx [-h] -d <string>"
},
"usart txhex": {
"command": "usart txhex",
"description": "Send bytes over USART. WARNING: it will have side-effects if used in USART HOST mode!",
"notes": [
"usart txhex -d 504d33620a80000000010100f09f988ef09fa5b36233"
],
"offline": false,
"options": [
"-h, --help This help",
"-d, --data <hex> bytes to send"
],
"usage": "usart txhex [-h] -d <hex>"
},
"usart txrx": {
"command": "usart txrx",
"description": "Send string over USART and wait for response. WARNING: if used in USART HOST mode, you can only send AT commands to add-on when BT connection is not established (LED needs to be blinking) Any other usage in USART HOST mode will have side-effects!",
"notes": [
"usart txrx -d \"AT+VERSION\" -> Talking to BT add-on (when no connection)",
"usart txrx -t 2000 -d \"AT+SOMESTUFF\\r\\n\" -> Talking to a target requiring longer time and end-of-line chars"
],
"offline": false,
"options": [
"-h, --help This help",
"-t, --timeout <dec> timeout in ms, default is 1000 ms",
"-d, --data <string> string to send"
],
"usage": "usart txrx [-h] [-t <dec>] -d <string>"
},
"wiegand decode": {
"command": "wiegand decode",
"description": "Decode raw hex or binary to wiegand format",
"notes": [
"wiegand decode --raw 2006f623ae"
],
"offline": true,
"options": [
"-h, --help This help",
"-r, --raw <hex> raw hex to be decoded",
"-b, --bin <bin> binary string to be decoded"
],
"usage": "wiegand decode [-h] [-r <hex>] [-b <bin>]"
},
"wiegand encode": {
"command": "wiegand encode",
"description": "Encode wiegand formatted number to raw hex",
"notes": [
"wiegand encode --fc 101 --cn 1337 -> show all formats",
"wiegand encode -w H10301 --fc 101 --cn 1337 -> H10301 format"
],
"offline": true,
"options": [
"-h, --help This help",
"--fc <dec> facility number",
"--cn <dec> card number",
"--issue <dec> issue level",
"--oem <dec> OEM code",
"-w, --wiegand <format> see `wiegand list` for available formats",
"--pre add HID ProxII preamble to wiegand output"
],
"usage": "wiegand encode [-h] [--fc <dec>] --cn <dec> [--issue <dec>] [--oem <dec>] [-w <format>] [--pre]"
},
"wiegand help": {
"command": "wiegand help",
"description": "help This help list List available wiegand formats encode Encode to wiegand raw hex (currently for HID Prox) decode Convert raw hex to decoded wiegand format (currently for HID Prox) --------------------------------------------------------------------------------------- wiegand list available offline: yes List available wiegand formats",
"notes": [
"wiegand list"
],
"offline": true,
"options": [
"-h, --help This help"
],
"usage": "wiegand info [-h]"
}
},
"metadata": {
"commands_extracted": 749,
"extracted_by": "PM3Help2JSON v1.00",
"extracted_on": "2024-11-02T14:09:48"
}
}
Reference in a new issue View git blame Copy permalink