RfidResearchGroup/proxmark3
1
1
Fork 0
mirror of https://github.com/RfidResearchGroup/proxmark3.git synced 2024-11-11 01:55:38 +08:00
Code Issues Projects Releases Packages Wiki Activity
proxmark3/doc/commands.json
merlokk 3ae9070dd8 make style
2022-02-05 13:32:50 +02:00

10350 lines
No EOL
526 KiB
JSON
Raw Blame History

{
"commands": {
"analyse a": {
"command": "analyse a",
"description": "iceman's personal garbage test command",
"notes": [
"analyse a -d 137af00a0a0d"
],
"offline": true,
"options": [
"-h, --help this help",
"-d, --data <hex> bytes to manipulate"
],
"usage": "analyse a [-h] -d <hex>"
},
"analyse chksum": {
"command": "analyse chksum",
"description": "the bytes will be added with eachother and than limited with the applied mask finally compute ones' complement of the least significant bytes.",
"notes": [
"analyse chksum -d 137af00a0a0d -> expected output: 0x61",
"analyse chksum -d 137af00a0a0d -m ff"
],
"offline": true,
"options": [
"-h, --help this help",
"-d, --data <hex> bytes to calc checksum",
"-m, --mask <hex> bit mask to limit the output (4 hex bytes max)",
"-v, --verbose verbose"
],
"usage": "analyse chksum [-hv] -d <hex> [-m <hex>]"
},
"analyse crc": {
"command": "analyse crc",
"description": "a stub method to test different crc implementations inside the pm3 sourcecode. just because you figured out the poly, doesn't mean you get the desired output",
"notes": [
"analyse crc -d 137af00a0a0d"
],
"offline": true,
"options": [
"-h, --help this help",
"-d, --data <hex> bytes to calc crc"
],
"usage": "analyse crc [-h] -d <hex>"
},
"analyse dates": {
"command": "analyse dates",
"description": "tool to look for date/time stamps in a given array of bytes",
"notes": [
"analyse dates"
],
"offline": true,
"options": [
"-h, --help this help"
],
"usage": "analyse dates [-h]"
},
"analyse demodbuff": {
"command": "analyse demodbuff",
"description": "loads a binary string into demodbuffer",
"notes": [
"analyse demodbuff -d 0011101001001011"
],
"offline": true,
"options": [
"-h, --help this help",
"-d, --data <bin> binary string to load"
],
"usage": "analyse demodbuff [-h] -d <bin>"
},
"analyse foo": {
"command": "analyse foo",
"description": "experiments of cliparse",
"notes": [
"analyse foo -r a0000000a0002021"
],
"offline": true,
"options": [
"-h, --help this help",
"-r, --raw <hex> raw bytes"
],
"usage": "analyse foo [-h] -r <hex>"
},
"analyse freq": {
"command": "analyse freq",
"description": "calc wave lengths",
"notes": [
"analyse freq"
],
"offline": true,
"options": [
"-h, --help this help",
"-f, --freq <int> resonating frequency f in hertz (hz)",
"-l, --cap <int> capacitance c in micro farads (f)",
"-c, --ind <int> inductance in micro henries (h)"
],
"usage": "analyse freq [-h] [-f <int>] [-l <int>] [-c <int>]"
},
"analyse help": {
"command": "analyse help",
"description": "help this help lcr generate final byte for xor lrc crc stub method for crc evaluations chksum checksum with adding, masking and one's complement dates look for datestamps in a given array of bytes lfsr lfsr tests a num bits test nuid create nuid from 7byte uid demodbuff load binary string to demodbuffer freq calc wave lengths foo muxer units convert etu <> us <> ssp_clk (3.39mhz) --------------------------------------------------------------------------------------- analyse lcr available offline: yes specifying the bytes of a uid with a known lrc will find the last byte value needed to generate that lrc with a rolling xor. all bytes should be specified in hex.",
"notes": [
"analyse lcr -d 04008064ba -> target (ba) requires final lrc xor byte value: 5a"
],
"offline": true,
"options": [
"-h, --help this help",
"-d, --data <hex> bytes to calc missing xor in a lcr"
],
"usage": "analyse lcr [-h] -d <hex>"
},
"analyse lfsr": {
"command": "analyse lfsr",
"description": "looks at legic prime's lfsr, iterates the first 48 values",
"notes": [
"analyse lfsr --iv 55"
],
"offline": true,
"options": [
"-h, --help this help",
"--iv <hex> init vector data (1 hex byte)",
"--find <hex> lfsr data to find (1 hex byte)"
],
"usage": "analyse lfsr [-h] --iv <hex> [--find <hex>]"
},
"analyse nuid": {
"command": "analyse nuid",
"description": "generate 4byte nuid from 7byte uid",
"notes": [
"analyse nuid -d 11223344556677"
],
"offline": true,
"options": [
"-h, --help this help",
"-d, --data <hex> bytes to send",
"-t, --test self test"
],
"usage": "analyse nuid [-ht] [-d <hex>]"
},
"analyse units": {
"command": "analyse units",
"description": "experiments of unit conversions found in hf. etu (1/13.56mhz), us or ssp_clk (1/3.39mhz)",
"notes": [
"analyse uints --etu 10analyse uints --us 100"
],
"offline": true,
"options": [
"-h, --help this help",
"--etu <dec> number in etu",
"--us <dec> number in micro seconds (us)"
],
"usage": "analyse units [-h] [--etu <dec>] [--us <dec>]"
},
"clear": {
"command": "clear",
"description": "clear the proxmark3 client terminal screen",
"notes": [
"clear"
],
"offline": true,
"options": [
"-h, --help this help"
],
"usage": "clear [-h]"
},
"data askedgedetect": {
"command": "data askedgedetect",
"description": "adjust graph for manual ask demod using the length of sample differences to detect the edge of a wave",
"notes": [
"data askedgedetect -t 20"
],
"offline": true,
"options": [
"-h, --help this help",
"-t, --thres <dec> threshold, use 20 - 45 (def 25)"
],
"usage": "data askedgedetect [-h] [-t <dec>]"
},
"data asn1": {
"command": "data asn1",
"description": "decode asn1 bytearray",
"notes": [
"data asn1 -d 303381050186922305a5020500a6088101010403030008a7188516eeee4facacf4fbde5e5c49d95e55bfbca74267b02407a9020500"
],
"offline": true,
"options": [
"-h, --help this help",
"-d <hex> asn1 encoded byte array"
],
"usage": "data asn1 [-h] -d <hex>"
},
"data autocorr": {
"command": "data autocorr",
"description": "autocorrelate over window is used to detect repeating sequences. we use it as detection of how long in bits a message inside the signal is",
"notes": [
"data autocorr -w 4000",
"data autocorr -w 4000 -g"
],
"offline": true,
"options": [
"-h, --help this help",
"-g save back to graphbuffer (overwrite)",
"-w, --win <dec> window length for correlation. def 4000"
],
"usage": "data autocorr [-hg] [-w <dec>]"
},
"data bin2hex": {
"command": "data bin2hex",
"description": "this function converts binary to hexadecimal. it will ignore all characters not 1 or 0 but stop reading on whitespace",
"notes": [
"data bin2hex -d 0101111001010"
],
"offline": true,
"options": [
"-h, --help this help",
"-d, --data <bin> binary string to convert"
],
"usage": "data bin2hex [-h] -d <bin>"
},
"data bitsamples": {
"command": "data bitsamples",
"description": "get raw samples from device as bitstring",
"notes": [
"data bitsamples"
],
"offline": false,
"options": [
"-h, --help this help"
],
"usage": "data bitsamples [-h]"
},
"data clear": {
"command": "data clear",
"description": "this function clears the bigbuff on deviceside and graph window",
"notes": [
"data clear"
],
"offline": true,
"options": [
"-h, --help this help"
],
"usage": "data clear [-h]"
},
"data convertbitstream": {
"command": "data convertbitstream",
"description": "convert graphbuffer's 0|1 values to 127|-127",
"notes": [
"data convertbitstream"
],
"offline": true,
"options": [
"-h, --help this help"
],
"usage": "data convertbitstream [-h]"
},
"data decimate": {
"command": "data decimate",
"description": "performs decimation, by reducing samples n times in the grapbuf. good for psk",
"notes": [
"data decimate",
"data decimate -n 4"
],
"offline": true,
"options": [
"-h, --help this help",
"-n <dec> factor to reduce sample set (default 2)"
],
"usage": "data decimate [-h] [-n <dec>]"
},
"data detectclock": {
"command": "data detectclock",
"description": "detect ask, fsk, nrz, psk clock rate of wave in graphbuffer",
"notes": [
"data detectclock -a -> detect clock of an ask wave in graphbuffer",
"data detectclock -f -> detect clock of an fsk wave in graphbuffer",
"data detectclock -n -> detect clock of an psk wave in graphbuffer",
"data detectclock -p -> detect clock of an nrz/direct wave in graphbuffer"
],
"offline": true,
"options": [
"-h, --help this help",
"-a, --ask specify ask modulation clock detection",
"-f, --fsk specify fsk modulation clock detection",
"-n, --nzr specify nzr/direct modulation clock detection",
"-p, --psk specify psk modulation clock detection"
],
"usage": "data detectclock [-hafnp]"
},
"data dirthreshold": {
"command": "data dirthreshold",
"description": "max rising higher up-thres/ min falling lower down-thres, keep rest as prev.",
"notes": [
"data dirthreshold -u 10 -d -10"
],
"offline": true,
"options": [
"-h, --help this help",
"-d, --down <dec> threshold down",
"-u, --up <dec> threshold up"
],
"usage": "data dirthreshold [-h] -d <dec> -u <dec>"
},
"data fsktonrz": {
"command": "data fsktonrz",
"description": "convert fsk2 to nrz wave for alternate fsk demodulating (for weak fsk) omitted values are autodetect instead",
"notes": [
"data fsktonrz",
"data fsktonrz -c 32 --low 8 --hi 10"
],
"offline": true,
"options": [
"-h, --help this help",
"-c, --clk <dec> clock",
"--low <dec> low field clock",
"--hi <dec> high field clock"
],
"usage": "data fsktonrz [-h] [-c <dec>] [--low <dec>] [--hi <dec>]"
},
"data getbitstream": {
"command": "data getbitstream",
"description": "convert graphbuffer's value accordingly - larger or equal to one becomes one - less than one becomes zero",
"notes": [
"data getbitstream"
],
"offline": true,
"options": [
"-h, --help this help"
],
"usage": "data getbitstream [-h]"
},
"data grid": {
"command": "data grid",
"description": "this function overlay grid on graph plot window. use zero value to turn off either",
"notes": [
"data grid -> turn off",
"data grid -x 64 -y 50"
],
"offline": true,
"options": [
"-h, --help this help",
"-x <dec> plot grid x coord",
"-y <dec> plot grid y coord"
],
"usage": "data grid [-h] [-x <dec>] [-y <dec>]"
},
"data help": {
"command": "data help",
"description": "help this help ----------- ------------------------- modulation------------------------- biphaserawdecode biphase decode bin stream in demodbuffer detectclock detect ask, fsk, nrz, psk clock rate of wave in graphbuffer fsktonrz convert fsk2 to nrz wave for alternate fsk demodulating (for weak fsk) manrawdecode manchester decode binary stream in demodbuffer modulation identify lf signal for clock and modulation rawdemod demodulate the data in the graphbuffer and output binary ----------- ------------------------- graph------------------------- askedgedetect adjust graph for manual ask demod using the length of sample differences to detect the edge of a wave autocorr autocorrelation over window dirthreshold max rising higher up-thres/ min falling lower down-thres, keep rest as prev. decimate decimate samples undecimate un-decimate samples hide hide graph window hpf remove dc offset from trace iir apply iir buttersworth filter on plot data grid overlay grid on graph window ltrim trim samples from left of trace mtrim trim out samples from the specified start to the specified stop norm normalize max/min to +/-128 plot show graph window rtrim trim samples from right of trace setgraphmarkers set blue and orange marker in graph window shiftgraphzero shift 0 for graphed wave + or - shift value timescale set a timescale to get a differential reading between the yellow and purple markers as time duration zerocrossings count time between zero-crossings convertbitstream convert graphbuffer's 0/1 values to 127 / -127 getbitstream convert graphbuffer's >=1 values to 1 and <1 to 0 ----------- ------------------------- general------------------------- asn1 asn1 decoder bin2hex converts binary to hexadecimal clear clears bigbuf on deviceside and graph window hex2bin converts hexadecimal to binary load load contents of file into graph window print print the data in the demodbuffer save save signal trace data (from graph window) setdebugmode set debugging level on client side --------------------------------------------------------------------------------------- data biphaserawdecode available offline: yes biphase decode binary stream in demodbuffer converts 10 or 01 -> 1 and 11 or 00 -> 0 - must have binary sequence in demodbuffer (run `data rawdemod --ar` before) - invert for conditional dephase encoding (cdp) aka differential manchester",
"notes": [
"data biphaserawdecode -> decode biphase bitstream from the demodbuffer",
"data biphaserawdecode -oi -> decode biphase bitstream from the demodbuffer, adjust offset, and invert output"
],
"offline": true,
"options": [
"-h, --help this help",
"-o, --offset set to adjust decode start position",
"-i, --inv invert output",
"--err <dec> set max errors tolerated (def 20)"
],
"usage": "data biphaserawdecode [-hoi] [--err <dec>]"
},
"data hex2bin": {
"command": "data hex2bin",
"description": "this function converts hexadecimal to binary. it will ignore all non-hexadecimal characters but stop reading on whitespace",
"notes": [
"data hex2bin -d 01020304"
],
"offline": true,
"options": [
"-h, --help this help",
"-d, --data <hex> bytes to convert"
],
"usage": "data hex2bin [-h] [-d <hex>]"
},
"data hexsamples": {
"command": "data hexsamples",
"description": "dump big buffer as hex bytes",
"notes": [
"data hexsamples -n 128 -> dumps 128 bytes from offset 0"
],
"offline": false,
"options": [
"-h, --help this help",
"-b, --breaks <dec> row break, def 16",
"-n <dec> num of bytes to download",
"-o, --offset <hex> offset in big buffer"
],
"usage": "data hexsamples [-h] [-b <dec>] [-n <dec>] [-o <hex>]"
},
"data hide": {
"command": "data hide",
"description": "show graph window",
"notes": [
"data hide"
],
"offline": true,
"options": [
"-h, --help this help"
],
"usage": "data hide [-h]"
},
"data hpf": {
"command": "data hpf",
"description": "remove dc offset from trace. it should centralize around 0",
"notes": [
"data hpf"
],
"offline": true,
"options": [
"-h, --help this help"
],
"usage": "data hpf [-h]"
},
"data iir": {
"command": "data iir",
"description": "apply iir buttersworth filter on plot data",
"notes": [
"data iir -n 2"
],
"offline": true,
"options": [
"-h, --help this help",
"-n <dec> factor n"
],
"usage": "data iir [-h] -n <dec>"
},
"data load": {
"command": "data load",
"description": "this command loads the contents of a pm3 file into graph window",
"notes": [
"data load -f myfilename"
],
"offline": true,
"options": [
"-h, --help this help",
"-f, --file <fn> file to load"
],
"usage": "data load [-h] -f <fn>"
},
"data ltrim": {
"command": "data ltrim",
"description": "trim samples from left of trace",
"notes": [
"data ltrim -i 300 -> keep 300 - end"
],
"offline": true,
"options": [
"-h, --help this help",
"-i, --idx <dec> from index to beginning trace"
],
"usage": "data ltrim [-h] -i <dec>"
},
"data manrawdecode": {
"command": "data manrawdecode",
"description": "manchester decode binary stream in demodbuffer converts 10 and 01 and converts to 0 and 1 respectively - must have binary sequence in demodbuffer (run `data rawdemod --ar` before)",
"notes": [
"data manrawdecode"
],
"offline": true,
"options": [
"-h, --help this help",
"-i, --inv invert output",
"--err <dec> set max errors tolerated (def 20)"
],
"usage": "data manrawdecode [-hi] [--err <dec>]"
},
"data modulation": {
"command": "data modulation",
"description": "search lf signal after clock and modulation",
"notes": [
"data modulation"
],
"offline": true,
"options": [
"-h, --help this help"
],
"usage": "data modulation [-h]"
},
"data mtrim": {
"command": "data mtrim",
"description": "trim out samples from the specified start to the specified end point",
"notes": [
"data mtrim -s 1000 -e 2000 -> keep between 1000 and 2000"
],
"offline": true,
"options": [
"-h, --help this help",
"-s, --start <dec> start point",
"-e, --end <dec> end point"
],
"usage": "data mtrim [-h] -s <dec> -e <dec>"
},
"data norm": {
"command": "data norm",
"description": "normalize max/min to +/-128",
"notes": [
"data norm"
],
"offline": true,
"options": [
"-h, --help this help"
],
"usage": "data norm [-h]"
},
"data plot": {
"command": "data plot",
"description": "show graph window hit 'h' in window for detail keystroke help available",
"notes": [
"data plot"
],
"offline": true,
"options": [
"-h, --help this help"
],
"usage": "data plot [-h]"
},
"data print": {
"command": "data print",
"description": "print the data in the demodbuffer as hex or binary. defaults to binary output",
"notes": [
"data print"
],
"offline": true,
"options": [
"-h, --help this help",
"-i, --inv invert demodbuffer before printing",
"-o, --offset <dec> offset in # of bits",
"-s, --strip strip leading zeroes, i.e. set offset to first bit equal to one",
"-x, --hex output in hex (omit for binary output)"
],
"usage": "data print [-hisx] [-o <dec>]"
},
"data rawdemod": {
"command": "data rawdemod",
"description": "demodulate the data in the graphbuffer and output binary",
"notes": [
"data rawdemod --fs -> demod fsk - autodetect",
"data rawdemod --ab -> demod ask/biphase - autodetect",
"data rawdemod --am -> demod ask/manchester - autodetect",
"data rawdemod --ar -> demod ask/raw - autodetect",
"data rawdemod --nr -> demod nrz/direct - autodetect",
"data rawdemod --p1 -> demod psk1 - autodetect",
"data rawdemod --p2 -> demod psk2 - autodetect"
],
"offline": true,
"options": [
"-h, --help this help",
"--ab ask/biphase demodulation",
"--am ask/manchester demodulation",
"--ar ask/raw demodulation",
"--fs fsk demodulation",
"--nr nrz/direct demodulation",
"--p1 psk 1 demodulation",
"--p2 psk 2 demodulation",
"<params> params for sub command"
],
"usage": "data rawdemod [-h] [--ab] [--am] [--ar] [--fs] [--nr] [--p1] [--p2] [<params>]..."
},
"data rtrim": {
"command": "data rtrim",
"description": "trim samples from right of trace",
"notes": [
"data rtrim -i 4000 -> keep 0 - 4000"
],
"offline": true,
"options": [
"-h, --help this help",
"-i, --idx <dec> from index to end trace"
],
"usage": "data rtrim [-h] -i <dec>"
},
"data samples": {
"command": "data samples",
"description": "get raw samples for graph window (graphbuffer) from device. if 0, then get whole big buffer from device.",
"notes": [
"data samples",
"data samples -n 10000"
],
"offline": false,
"options": [
"-h, --help this help",
"-n <dec> num of samples (512 - 40000)",
"-v, --verbose verbose"
],
"usage": "data samples [-hv] [-n <dec>]"
},
"data save": {
"command": "data save",
"description": "save trace from graph window , i.e. the graphbuffer this is a text file with number -127 to 127. with the option `w` you can save it as wave file filename should be without file extension",
"notes": [
"data save -f myfilename -> save graph buffer to file",
"data save --wave -f myfilename -> save graph buffer to wave file"
],
"offline": true,
"options": [
"-h, --help this help",
"-w, --wave save as wave format (.wav)",
"-f, --file <fn w/o ext> save file name"
],
"usage": "data save [-hw] -f <fn w/o ext>"
},
"data setdebugmode": {
"command": "data setdebugmode",
"description": "set debugging level on client side",
"notes": [
"data setdebugmode"
],
"offline": true,
"options": [
"-h, --help this help",
"-0 no debug messages",
"-1 debug",
"-2 verbose debugging"
],
"usage": "data setdebugmode [-h012]"
},
"data setgraphmarkers": {
"command": "data setgraphmarkers",
"description": "set blue and orange marker in graph window",
"notes": [
"data setgraphmarkers -> turn off",
"data setgraphmarkers -a 64 -b 50"
],
"offline": true,
"options": [
"-h, --help this help",
"-a <dec> orange marker",
"-b <dec> blue marker"
],
"usage": "data setgraphmarkers [-h] [-a <dec>] [-b <dec>]"
},
"data shiftgraphzero": {
"command": "data shiftgraphzero",
"description": "shift 0 for graphed wave + or - shift value",
"notes": [
"data shiftgraphzero -n 10 -> shift 10 points",
"data shiftgraphzero -n -22 -> shift negative 22 points"
],
"offline": true,
"options": [
"-h, --help this help",
"-n <dec> shift + or -"
],
"usage": "data shiftgraphzero [-h] -n <dec>"
},
"data timescale": {
"command": "data timescale",
"description": "set cursor display timescale. setting the timescale makes the differential `dt` reading between the yellow and purple markers meaningful. once the timescale is set, the differential reading between brackets can become a time duration.",
"notes": [
"data timescale --sr 125 -u ms -> for lf sampled at 125 khz. reading will be in milliseconds",
"data timescale --sr 1.695 -u us -> for hf sampled at 16 * fc/128. reading will be in microseconds",
"data timescale --sr 16 -u etu -> for hf with 16 samples per etu (fc/128). reading will be in etus"
],
"offline": true,
"options": [
"-h, --help this help",
"--sr <float> sets timescale factor according to sampling rate",
"-u, --unit <string> time unit to display (max 10 chars)"
],
"usage": "data timescale [-h] --sr <float> [-u <string>]"
},
"data tune": {
"command": "data tune",
"description": "measure tuning of device antenna. results shown in graph window. this command doesn't actively tune your antennas, it's only informative by measuring voltage that the antennas will generate",
"notes": [
"data tune"
],
"offline": false,
"options": [
"-h, --help this help"
],
"usage": "data tune [-h]"
},
"data undecimate": {
"command": "data undecimate",
"description": "performs un-decimation, by repeating each sample n times in the graphbuf",
"notes": [
"data undecimate",
"data undecimate -n 4"
],
"offline": true,
"options": [
"-h, --help this help",
"-n <dec> factor to repeat each sample (default 2)"
],
"usage": "data undecimate [-h] [-n <dec>]"
},
"data zerocrossings": {
"command": "data zerocrossings",
"description": "count time between zero-crossings",
"notes": [
"data zerocrossings"
],
"offline": true,
"options": [
"-h, --help this help"
],
"usage": "data zerocrossings [-h]"
},
"emv challenge": {
"command": "emv challenge",
"description": "executes generate challenge command. it returns 4 or 8-byte random number from card. needs a emv applet to be selected and gpo to be executed.",
"notes": [
"emv challenge -> get challenge",
"emv challenge -k -> get challenge, keep filled on"
],
"offline": false,
"options": [
"-h, --help this help",
"-k, -k, --keep keep field on for next command",
"-a, -a, --apdu show apdu reqests and responses",
"-w, -w, --wired send data via contact (iso7816) interface. contactless interface set by default."
],
"usage": "emv challenge [-hkaw]"
},
"emv genac": {
"command": "emv genac",
"description": "generate application cryptogram command. it returns data in tlv format. needs a emv applet to be selected and gpo to be executed.",
"notes": [
"emv genac -k 0102 -> generate ac with 2-byte cdoldata and keep field on after command",
"emv genac -t 01020304 -> generate ac with 4-byte cdol data, show result in tlv",
"emv genac -daac 01020304 -> generate ac with 4-byte cdol data and terminal decision 'declined'",
"emv genac -pmt 9f 37 04 -> load params from file, make cdol data from cdol, generate ac with cdol, show result in tlv"
],
"offline": false,
"options": [
"-h, --help this help",
"-k, -k, --keep keep field on for next command",
"-c, -c, --cda executes cda transaction. needs to get sdad in results.",
"-d, -d, --decision <aac|tc|arqc> terminal decision. aac - declined, tc - approved, arqc - online authorisation requested",
"-p, -p, --params load parameters from `emv_defparams.json` file for cdoldata making from cdol and parameters",
"-m, -m, --make make cdoldata from cdol (tag 8c and 8d) and parameters (by default uses default parameters)",
"-a, -a, --apdu show apdu reqests and responses",
"-t, -t, --tlv tlv decode results of selected applets",
"-w, -w, --wired send data via contact (iso7816) interface. contactless interface set by default.",
"<hex> cdoldata/cdol"
],
"usage": "emv genac [-hkcpmatw] [-d <aac|tc|arqc>] <hex> [<hex>]..."
},
"emv gpo": {
"command": "emv gpo",
"description": "executes get processing options command. it returns data in tlv format (0x77 - format2) or plain format (0x80 - format1). needs a emv applet to be selected.",
"notes": [
"emv gpo -k -> execute gpo",
"emv gpo -t 01020304 -> execute gpo with 4-byte pdol data, show result in tlv",
"emv gpo -pmt 9f 37 04 -> load params from file, make pdol data from pdol, execute gpo with pdol, show result in tlv"
],
"offline": false,
"options": [
"-h, --help this help",
"-k, -k, --keep keep field on for next command",
"-p, -p, --params load parameters from `emv_defparams.json` file for pdoldata making from pdol and parameters",
"-m, -m, --make make pdoldata from pdol (tag 9f38) and parameters (by default uses default parameters)",
"-a, -a, --apdu show apdu reqests and responses",
"-t, -t, --tlv tlv decode results of selected applets",
"-w, -w, --wired send data via contact (iso7816) interface. contactless interface set by default.",
"<hex> pdoldata/pdol"
],
"usage": "emv gpo [-hkpmatw] [<hex>]..."
},
"emv help": {
"command": "emv help",
"description": "help this help test crypto logic test. list list iso7816 history --------------------------------------------------------------------------------------- emv exec available offline: no executes emv contactless transaction",
"notes": [
"emv exec -sat -> select card, execute msd transaction, show apdu and tlv",
"emv exec -satc -> select card, execute cda transaction, show apdu and tlv"
],
"offline": true,
"options": [
"-h, --help this help",
"-s, -s, --select activate field and select card.",
"-a, -a, --apdu show apdu reqests and responses.",
"-t, -t, --tlv tlv decode results.",
"-j, -j, --jload load transaction parameters from `emv_defparams.json` file.",
"-f, -f, --forceaid force search aid. search aid instead of execute ppse.",
"by default: transaction type - msd",
"-v, -v, --qvsdc transaction type - qvsdc or m/chip.",
"-c, -c, --qvsdccda transaction type - qvsdc or m/chip plus cda (sdad generation).",
"-x, -x, --vsdc transaction type - vsdc. for test only. not a standard behavior.",
"-g, -g, --acgpo visa. generate ac from gpo.",
"-w, -w, --wired send data via contact (iso7816) interface. contactless interface set by default."
],
"usage": "emv exec [-hsatjfvcxgw] by default:"
},
"emv intauth": {
"command": "emv intauth",
"description": "generate internal authenticate command. usually needs 4-byte random number. it returns data in tlv format . needs a emv applet to be selected and gpo to be executed.",
"notes": [
"emv intauth -k 01020304 -> execute internal authenticate with 4-byte ddoldata and keep field on after command",
"emv intauth -t 01020304 -> execute internal authenticate with 4-byte ddol data, show result in tlv",
"emv intauth -pmt 9f 37 04 -> load params from file, make ddol data from ddol, internal authenticate with ddol, show result in tlv"
],
"offline": false,
"options": [
"-h, --help this help",
"-k, -k, --keep keep field on for next command",
"-p, -p, --params load parameters from `emv_defparams.json` file for ddoldata making from ddol and parameters",
"-m, -m, --make make ddoldata from ddol (tag 9f49) and parameters (by default uses default parameters)",
"-a, -a, --apdu show apdu reqests and responses",
"-t, -t, --tlv tlv decode results of selected applets",
"-w, -w, --wired send data via contact (iso7816) interface. contactless interface set by default.",
"<hex> ddoldata/ddol"
],
"usage": "emv intauth [-hkpmatw] <hex> [<hex>]..."
},
"emv list": {
"command": "emv list",
"description": "alias of `trace list -t 7816` with selected protocol data to annotate trace buffer you can load a trace from file (see `trace load -h`) or it be downloaded from device by default it accepts all other arguments of `trace list`. note that some might not be relevant for this specific protocol",
"notes": [
"emv list -f -> show frame delay times",
"emv list -1 -> use trace buffer"
],
"offline": true,
"options": [
"-h, --help this help",
"-1, --buffer use data from trace buffer",
"-f show frame delay times",
"-c mark crc bytes",
"-r show relative times (gap and duration)",
"-u display times in microseconds instead of clock cycles",
"-x show hexdump to convert to pcap(ng)",
"or to import into wireshark using encapsulation type \"iso 14443\"",
"--dict <file> use dictionary keys file"
],
"usage": "emv list [-h1fcrux] [--dict <file>]"
},
"emv pse": {
"command": "emv pse",
"description": "executes pse/ppse select command. it returns list of applet on the card:",
"notes": [
"emv pse -s1 -> select, get pse",
"emv pse -st2 -> select, get ppse, show result in tlv"
],
"offline": false,
"options": [
"-h, --help this help",
"-s, -s, --select activate field and select card",
"-k, -k, --keep keep field on for next command",
"-1, --pse pse (1pay.sys.ddf01) mode",
"-2, --ppse ppse (2pay.sys.ddf01) mode (default mode)",
"-a, -a, --apdu show apdu reqests and responses",
"-t, -t, --tlv tlv decode results of selected applets",
"-w, -w, --wired send data via contact (iso7816) interface. contactless interface set by default."
],
"usage": "emv pse [-hsk12atw]"
},
"emv readrec": {
"command": "emv readrec",
"description": "executes read record command. it returns data in tlv format. needs a bank applet to be selected and sometimes needs gpo to be executed.",
"notes": [
"emv readrec -k 0101 -> read file sfi=01, sfirec=01",
"emv readrec -kt 0201 -> read file 0201 and show result in tlv"
],
"offline": false,
"options": [
"-h, --help this help",
"-k, -k, --keep keep field on for next command",
"-a, -a, --apdu show apdu reqests and responses",
"-t, -t, --tlv tlv decode results of selected applets",
"-w, -w, --wired send data via contact (iso7816) interface. contactless interface set by default.",
"<hex> <sfi 1 byte><sfirecord 1 byte"
],
"usage": "emv readrec [-hkatw] <hex> [<hex>]..."
},
"emv roca": {
"command": "emv roca",
"description": "tries to extract public keys and run the roca test against them.",
"notes": [
"emv roca -w -> select --contact-- card and run test",
"emv roca -> select --contactless-- card and run test"
],
"offline": false,
"options": [
"-h, --help this help",
"-t, -t, --selftest self test",
"-a, -a, --apdu show apdu reqests and responses",
"-w, -w, --wired send data via contact (iso7816) interface. contactless interface set by default"
],
"usage": "emv roca [-htaw]"
},
"emv scan": {
"command": "emv scan",
"description": "scan emv card and save it contents to a file. it executes emv contactless transaction and saves result to a file which can be used for emulation",
"notes": [
"emv scan -at -> scan msd transaction mode and show apdu and tlv",
"emv scan -c -> scan cda transaction mode"
],
"offline": false,
"options": [
"-h, --help this help",
"-a, -a, --apdu show apdu reqests and responses.",
"-t, -t, --tlv tlv decode results.",
"-e, -e, --extract extract tlv elements and fill application data",
"-j, -j, --jload load transaction parameters from `emv_defparams.json` file.",
"by default: transaction type - msd",
"-v, -v, --qvsdc transaction type - qvsdc or m/chip.",
"-c, -c, --qvsdccda transaction type - qvsdc or m/chip plus cda (sdad generation).",
"-x, -x, --vsdc transaction type - vsdc. for test only. not a standard behavior.",
"-g, -g, --acgpo visa. generate ac from gpo.",
"-m, -m, --merge merge output file with card's data. (warning: the file may be corrupted!)",
"-w, -w, --wired send data via contact (iso7816) interface. contactless interface set by default.",
"<fn> json output filename"
],
"usage": "emv scan [-hatejvcxgmw] by default: <fn>"
},
"emv search": {
"command": "emv search",
"description": "tries to select all applets from applet list",
"notes": [
"emv search -s -> select card and search",
"emv search -st -> select card, search and show result in tlv"
],
"offline": false,
"options": [
"-h, --help this help",
"-s, -s, --select activate field and select card",
"-k, -k, --keep keep field on for next command",
"-a, -a, --apdu show apdu reqests and responses",
"-t, -t, --tlv tlv decode results of selected applets",
"-w, -w, --wired send data via contact (iso7816) interface. contactless interface set by default."
],
"usage": "emv search [-hskatw]"
},
"emv select": {
"command": "emv select",
"description": "executes select applet command",
"notes": [
"emv select -s a00000000101 -> select card, select applet",
"emv select -st a00000000101 -> select card, select applet, show result in tlv"
],
"offline": false,
"options": [
"-h, --help this help",
"-s, -s, --select activate field and select card",
"-k, -k, --keep keep field for next command",
"-a, -a, --apdu show apdu requests and responses",
"-t, -t, --tlv tlv decode results",
"-w, -w, --wired send data via contact (iso7816) interface. contactless interface set by default.",
"<hex> applet aid"
],
"usage": "emv select [-hskatw] <hex>"
},
"emv test": {
"command": "emv test",
"description": "executes tests",
"notes": [
"emv test -i",
"emv test --long"
],
"offline": true,
"options": [
"-h, --help this help",
"-i, --ignore ignore timing tests for vm",
"-l, --long run long tests too"
],
"usage": "emv test [-hil]"
},
"exit": {
"command": "exit",
"description": "quit the proxmark3 client terminal",
"notes": [
"quit"
],
"offline": true,
"options": [
"-h, --help this help"
],
"usage": "quit [-h]"
},
"help": {
"command": "help",
"description": "help use `<command> help` for details of a command prefs { edit client/device preferences... } -------- ----------------------- technology ----------------------- analyse { analyse utils... } data { plot window / data buffer manipulation... } emv { emv iso-14443 / iso-7816... } hf { high frequency commands... } hw { hardware commands... } lf { low frequency commands... } nfc { nfc commands... } reveng { crc calculations from reveng software... } smart { smart card iso-7816 commands... } script { scripting commands... } trace { trace manipulation... } wiegand { wiegand format manipulation... } -------- ----------------------- general ----------------------- clear clear screen hints turn hints on / off msleep add a pause in milliseconds rem add a text line in log file quit exit exit program --------------------------------------------------------------------------------------- auto available offline: no run lf search / hf search / data plot / data save",
"notes": [
"auto"
],
"offline": true,
"options": [
"-h, --help this help",
"-c continue searching even after a first hit"
],
"usage": "auto [-hc]"
},
"hf 14a antifuzz": {
"command": "hf 14a antifuzz",
"description": "tries to fuzz the iso14443a anticollision phase",
"notes": [
"hf 14a antifuzz -4"
],
"offline": false,
"options": [
"-h, --help this help",
"-4 4 byte uid",
"-7 7 byte uid",
"--10 10 byte uid"
],
"usage": "hf 14a antifuzz [-h47] [--10]"
},
"hf 14a apdu": {
"command": "hf 14a apdu",
"description": "sends an iso 7816-4 apdu via iso 14443-4 block transmission protocol (t=cl). works with all apdu types from iso 7816-4:2013",
"notes": [
"hf 14a apdu -st 00a404000e325041592e5359532e444446303100",
"hf 14a apdu -sd 00a404000e325041592e5359532e444446303100 -> decode apdu",
"hf 14a apdu -sm 00a40400 325041592e5359532e4444463031 -l 256 -> encode standard apdu",
"hf 14a apdu -sm 00a40400 325041592e5359532e4444463031 -el 65536 -> encode extended apdu"
],
"offline": false,
"options": [
"-h, --help this help",
"-s, --select activate field and select card",
"-k, --keep keep signal field on after receive",
"-t, --tlv executes tlv decoder if it possible",
"-d, --decapdu decode apdu request if it possible",
"-m, --make <head (cla ins p1 p2) hex> make apdu with head from this field and data from data field. must be 4 bytes length: <cla ins p1 p2>",
"-e, --extended make extended length apdu if `m` parameter included",
"-l, --le <le (int)> le apdu parameter if `m` parameter included",
"<apdu (hex) | data (hex)> data if `m` parameter included"
],
"usage": "hf 14a apdu [-hsktde] [-m <head (cla ins p1 p2) hex>] [-l <le (int)>] <apdu (hex) | data (hex)> [<apdu (hex) | data (hex)>]..."
},
"hf 14a chaining": {
"command": "hf 14a chaining",
"description": "enable/disable iso14443a input chaining. maximum input length goes from ats.",
"notes": [
"hf 14a chaining disable -> disable chaining",
"hf 14a chaining -> show chaining enable/disable state"
],
"offline": false,
"options": [
"-h, --help this help"
],
"usage": "hf 14a chaining [-h] [<enable/disable or 0/1>]"
},
"hf 14a config": {
"command": "hf 14a config",
"description": "--------------------------------------------------------------------------------------- hf 14a apdufind available offline: no enumerate apdu's of iso7816 protocol to find valid cls/ins/p1/p2 commands. it loops all 256 possible values for each byte. the loop oder is ins -> p1/p2 (alternating) -> cla. tag must be on antenna before running.",
"notes": [
"hf 14a apdufind",
"hf 14a apdufind --cla 80",
"hf 14a apdufind --cla 80 --error-limit 20 --skip-ins a4 --skip-ins b0 --with-le"
],
"offline": false,
"options": [
"-h, --help this help",
"-c, --cla <hex> start value of class (1 hex byte)",
"-i, --ins <hex> start value of instruction (1 hex byte)",
"--p1 <hex> start value of p1 (1 hex byte)",
"--p2 <hex> start value of p2 (1 hex byte)",
"-r, --reset <number> minimum secondes before resetting the tag (to prevent timeout issues). default is 5 minutes",
"-e, --error-limit <number> maximum times an status word other than 0x9000 or 0x6d00 is shown. default is 512.",
"-s, --skip-ins <hex> do not test an instruction (can be specified multiple times)",
"-l, --with-le search for apdus with le=0 (case 2s) as well",
"-v, --verbose verbose output"
],
"usage": "hf 14a apdufind [-hlv] [-c <hex>] [-i <hex>] [--p1 <hex>] [--p2 <hex>] [-r <number>] [-e <number>] [-s <hex>]..."
},
"hf 14a cuids": {
"command": "hf 14a cuids",
"description": "collect n>0 iso14443-a uids in one go",
"notes": [
"hf 14a cuids -n 5 -> collect 5 uids"
],
"offline": false,
"options": [
"-h, --help this help",
"-n, --num <dec> number of uids to collect"
],
"usage": "hf 14a cuids [-h] [-n <dec>]"
},
"hf 14a help": {
"command": "hf 14a help",
"description": "help this help list list iso 14443-a history --------------------------------------------------------------------------------------- hf 14a list available offline: yes alias of `trace list -t 14a` with selected protocol data to annotate trace buffer you can load a trace from file (see `trace load -h`) or it be downloaded from device by default it accepts all other arguments of `trace list`. note that some might not be relevant for this specific protocol",
"notes": [
"hf 14a list -f -> show frame delay times",
"hf 14a list -1 -> use trace buffer"
],
"offline": true,
"options": [
"-h, --help this help",
"-1, --buffer use data from trace buffer",
"-f show frame delay times",
"-c mark crc bytes",
"-r show relative times (gap and duration)",
"-u display times in microseconds instead of clock cycles",
"-x show hexdump to convert to pcap(ng)",
"or to import into wireshark using encapsulation type \"iso 14443\"",
"--dict <file> use dictionary keys file"
],
"usage": "hf 14a list [-h1fcrux] [--dict <file>]"
},
"hf 14a info": {
"command": "hf 14a info",
"description": "this command makes more extensive tests against a iso14443a tag in order to collect information",
"notes": [
"hf 14a info -nsv -> shows full information about the card"
],
"offline": false,
"options": [
"-h, --help this help",
"-v, --verbose adds some information to results",
"-n, --nacktest test for nack bug",
"-s, --aidsearch checks if aids from aidlist.json is present on the card and prints information about found aids"
],
"usage": "hf 14a info [-hvns]"
},
"hf 14a ndefread": {
"command": "hf 14a ndefread",
"description": "read nfc data exchange format (ndef) file on type 4 ndef tag",
"notes": [
"hf 14a ndefread",
"hf 14a ndefread -f myfilename -> save raw ndef to file"
],
"offline": false,
"options": [
"-h, --help this help",
"-f, --file <fn> save raw ndef to file"
],
"usage": "hf 14a ndefread [-h] [-f <fn>]"
},
"hf 14a raw": {
"command": "hf 14a raw",
"description": "sends raw bytes over iso14443a. with option to use topaz 14a mode.",
"notes": [
"hf 14a raw -sc 3000 -> select, crc, where 3000 == 'read block 00'",
"hf 14a raw -ak -b 7 40 -> send 7 bit byte 0x40",
"hf 14a raw --ecp -s -> send ecp before select"
],
"offline": false,
"options": [
"-h, --help this help",
"-a active signal field on without select",
"-b <dec> number of bits to send. useful for send partial byte",
"-c calculate and append crc",
"-k keep signal field on after receive",
"-3 iso14443-3 select only (skip rats)",
"-r do not read response",
"-s active signal field on with select",
"-t, --timeout <ms> timeout in milliseconds",
"-v, --verbose verbose output",
"--topaz use topaz protocol to send command",
"--ecp use enhanced contactless polling",
"--mag use apple magsafe polling",
"<hex> raw bytes to send"
],
"usage": "hf 14a raw [-hack3rsv] [-b <dec>] [-t <ms>] [--topaz] [--ecp] [--mag] <hex> [<hex>]..."
},
"hf 14a reader": {
"command": "hf 14a reader",
"description": "act as a iso-14443a reader to identify tag. look for iso-14443a tags until enter or the pm3 button is pressed",
"notes": [
"hf 14a reader",
"hf 14a reader -@ -> continuous mode",
"hf 14a reader --ecp -> trigger apple enhanced contactless polling",
"hf 14a reader --mag -> trigger apple magsafe polling"
],
"offline": false,
"options": [
"-h, --help this help",
"-k, --keep keep the field active after command executed",
"-s, --silent silent (no messages)",
"--drop just drop the signal field",
"--skip iso14443-3 select only (skip rats)",
"--ecp use enhanced contactless polling",
"--mag use apple magsafe polling",
"-@ continuous reader mode"
],
"usage": "hf 14a reader [-hks@] [--drop] [--skip] [--ecp] [--mag]"
},
"hf 14a sim": {
"command": "hf 14a sim",
"description": "simulate iso/iec 14443 type a tag with 4,7 or 10 byte uid",
"notes": [
"hf 14a sim -t 1 --uid 11223344 -> mifare classic 1k",
"hf 14a sim -t 2 -> mifare ultralight",
"hf 14a sim -t 3 -> mifare desfire",
"hf 14a sim -t 4 -> iso/iec 14443-4",
"hf 14a sim -t 5 -> mifare tnp3xxx",
"hf 14a sim -t 6 -> mifare mini",
"hf 14a sim -t 7 -> amiibo (ntag 215), pack 0x8080",
"hf 14a sim -t 8 -> mifare classic 4k",
"hf 14a sim -t 9 -> fm11rf005sh shanghai metro",
"hf 14a sim -t 10 -> st25ta ikea rothult"
],
"offline": false,
"options": [
"-h, --help this help",
"-t, --type <1-10> simulation type to use",
"-u, --uid <hex> 4, 7 or 10 byte uid",
"-n, --num <dec> exit simulation after <numreads> blocks have been read by reader. 0 = infinite",
"-x performs the 'reader attack', nr/ar attack against a reader",
"--sk fill simulator keys from found keys",
"-v, --verbose verbose output"
],
"usage": "hf 14a sim [-hxv] -t <1-10> [-u <hex>] [-n <dec>] [--sk]"
},
"hf 14a sniff": {
"command": "hf 14a sniff",
"description": "collect data from the field and save into command buffer. buffer accessible from command 'hf 14a list'",
"notes": [
"hf 14a sniff -c -r"
],
"offline": false,
"options": [
"-h, --help this help",
"-c, --card triggered by first data from card",
"-r, --reader triggered by first 7-bit request from reader (req,wup,...)"
],
"usage": "hf 14a sniff [-hcr]"
},
"hf 14b dump": {
"command": "hf 14b dump",
"description": "this command dumps the contents of a iso-14443-b tag and save it to file tries to autodetect cardtype, memory size defaults to sri4k",
"notes": [
"hf 14b dump",
"hf 14b dump -f myfilename"
],
"offline": false,
"options": [
"-h, --help this help",
"-f, --file <fn> (optional) filename, if no <name> uid will be used as filename"
],
"usage": "hf 14b dump [-h] [-f <fn>]"
},
"hf 14b help": {
"command": "hf 14b help",
"description": "help this help list list iso-14443-b history --------------------------------------------------------------------------------------- hf 14b apdu available offline: no sends an iso 7816-4 apdu via iso 14443-4 block transmission protocol (t=cl). works with all apdu types from iso 7816-4:2013",
"notes": [
"hf 14b apdu -s -d 94a40800043f000002",
"hf 14b apdu -s --decode -d 00a404000e325041592e5359532e444446303100 -> decode apdu",
"hf 14b apdu -sm 00a40400 -l 256 -d 325041592e5359532e4444463031 -> encode standard apdu",
"hf 14b apdu -sm 00a40400 -el 65536 -d 325041592e5359532e4444463031 -> encode extended apdu"
],
"offline": true,
"options": [
"-h, --help this help",
"-s, --select activate field and select card",
"-k, --keep leave the signal field on after receive response",
"-t, --tlv executes tlv decoder if it possible",
"--decode decode apdu request if it possible",
"-m, --make <hex> make apdu with head from this field and data from data field.",
"must be 4 bytes: <cla ins p1 p2>",
"-e, --extended make extended length apdu if `m` parameter included",
"-l, --le <int> le apdu parameter if `m` parameter included",
"-d, --data <hex> <apdu | data> if `m` parameter included",
"--timeout <dec> timeout in ms"
],
"usage": "hf 14b apdu [-hskte] [--decode] [-m <hex>] [-l <int>] -d <hex> [--timeout <dec>]"
},
"hf 14b info": {
"command": "hf 14b info",
"description": "tag information for iso/iec 14443 type b based tags",
"notes": [
"hf 14b info"
],
"offline": false,
"options": [
"-h, --help this help",
"-s, --aidsearch checks if aids from aidlist.json is present on the card and prints information about found aids",
"-v, --verbose verbose"
],
"usage": "hf 14b info [-hsv]"
},
"hf 14b list": {
"command": "hf 14b list",
"description": "alias of `trace list -t 14b` with selected protocol data to annotate trace buffer you can load a trace from file (see `trace load -h`) or it be downloaded from device by default it accepts all other arguments of `trace list`. note that some might not be relevant for this specific protocol",
"notes": [
"hf 14b list -f -> show frame delay times",
"hf 14b list -1 -> use trace buffer"
],
"offline": true,
"options": [
"-h, --help this help",
"-1, --buffer use data from trace buffer",
"-f show frame delay times",
"-c mark crc bytes",
"-r show relative times (gap and duration)",
"-u display times in microseconds instead of clock cycles",
"-x show hexdump to convert to pcap(ng)",
"or to import into wireshark using encapsulation type \"iso 14443\"",
"--dict <file> use dictionary keys file"
],
"usage": "hf 14b list [-h1fcrux] [--dict <file>]"
},
"hf 14b ndefread": {
"command": "hf 14b ndefread",
"description": "print nfc data exchange format (ndef)",
"notes": [
"hf 14b ndefread",
"hf 14b ndefread -f myfilename -> save raw ndef to file"
],
"offline": false,
"options": [
"-h, --help this help",
"-f, --file <fn> save raw ndef to file"
],
"usage": "hf 14b ndefread [-h] [-f <fn>]"
},
"hf 14b raw": {
"command": "hf 14b raw",
"description": "sends raw bytes to card",
"notes": [
"hf 14b raw -cks --data 0200a40400 -> standard select, apdu 0200a4000 (7816)",
"hf 14b raw -ck --sr --data 0200a40400 -> srx select",
"hf 14b raw -ck --cts --data 0200a40400 -> c-ticket select"
],
"offline": false,
"options": [
"-h, --help this help",
"-k, --keep leave the signal field on after receive response",
"-s, --std activate field, use iso14b select",
"--sr activate field, use srx st select",
"--cts activate field, use ask c-ticket select",
"-c, --crc calculate and append crc",
"-r do not read response from card",
"-t, --timeout <dec> timeout in ms",
"-v, --verbose verbose",
"-d, --data <hex> data, bytes to send"
],
"usage": "hf 14b raw [-hkscrv] [--sr] [--cts] [-t <dec>] [-d <hex>]"
},
"hf 14b rdbl": {
"command": "hf 14b rdbl",
"description": "read sri512 | srix4k block",
"notes": [
"hf 14b rdbl -b 06"
],
"offline": false,
"options": [
"-h, --help this help",
"-b, --block <dec> block number"
],
"usage": "hf 14b rdbl [-h] [-b <dec>]"
},
"hf 14b reader": {
"command": "hf 14b reader",
"description": "act as a 14443b reader to identify a tag",
"notes": [
"hf 14b reader"
],
"offline": false,
"options": [
"-h, --help this help",
"-s, --silent silent (no messages)",
"-@ optional - continuous reader mode"
],
"usage": "hf 14b reader [-hs@]"
},
"hf 14b sim": {
"command": "hf 14b sim",
"description": "simulate a iso/iec 14443 type b tag with 4 byte uid / pupi",
"notes": [
"hf 14b sim -u 11aa33bb"
],
"offline": false,
"options": [
"-h, --help this help",
"-u, --uid hex 4byte uid/pupi"
],
"usage": "hf 14b sim [-h] -u hex"
},
"hf 14b sniff": {
"command": "hf 14b sniff",
"description": "sniff the communication reader and tag",
"notes": [
"hf 14b sniff"
],
"offline": false,
"options": [
"-h, --help this help"
],
"usage": "hf 14b sniff [-h]"
},
"hf 14b sriwrite": {
"command": "hf 14b sriwrite",
"description": "write data to a sri512 or srix4k block",
"notes": [
"hf 14b sriwrite --4k -b 100 -d 11223344",
"hf 14b sriwrite --4k --sb -d 11223344 -> special block write",
"hf 14b sriwrite --512 -b 15 -d 11223344",
"hf 14b sriwrite --512 --sb -d 11223344 -> special block write"
],
"offline": false,
"options": [
"-h, --help this help",
"-b, --block <dec> block number",
"-d, --data <hex> 4 hex bytes",
"--512 target sri 512 tag",
"--4k target srix 4k tag",
"--sb special block write at end of memory (0xff)"
],
"usage": "hf 14b sriwrite [-h] [-b <dec>] -d <hex> [--512] [--4k] [--sb]"
},
"hf 15 csetuid": {
"command": "hf 15 csetuid",
"description": "set uid for magic chinese card (only works with such cards)",
"notes": [
"hf 15 csetuid -u e011223344556677"
],
"offline": false,
"options": [
"-h, --help this help",
"-u, --uid <8b hex> uid eg e011223344556677"
],
"usage": "hf 15 csetuid [-h] -u <8b hex>"
},
"hf 15 demod": {
"command": "hf 15 demod",
"description": "tries to demodulate / decode iso-15693, from downloaded samples. gather samples with 'hf 15 samples' / 'hf 15 sniff'",
"notes": [
"hf 15 demod"
],
"offline": true,
"options": [
"-h, --help this help"
],
"usage": "hf 15 demod [-h]"
},
"hf 15 dump": {
"command": "hf 15 dump",
"description": "this command dumps the contents of a iso-15693 tag and save it to file",
"notes": [
"hf 15 dump",
"hf 15 dump -*",
"hf 15 dump -u e011223344556677 -f hf-15-my-dump.bin"
],
"offline": false,
"options": [
"-h, --help this help",
"-u, --uid <hex> full uid, 8 bytes",
"--ua unaddressed mode",
"-* scan for tag",
"-2 use slower '1 out of 256' mode",
"-o, --opt set option flag (needed for ti)",
"-f, --file <fn> filename of dump"
],
"usage": "hf 15 dump [-h*2o] [-u <hex>] [--ua] [-f <fn>]"
},
"hf 15 findafi": {
"command": "hf 15 findafi",
"description": "this command attempts to brute force afi of an iso-15693 tag estimated execution time is around 2 minutes",
"notes": [
"hf 15 findafi"
],
"offline": false,
"options": [
"-h, --help this help"
],
"usage": "hf 15 findafi [-h]"
},
"hf 15 help": {
"command": "hf 15 help",
"description": "----------- --------------------- general --------------------- help this help list list iso-15693 history demod demodulate iso-15693 from tag --------------------------------------------------------------------------------------- hf 15 list available offline: yes alias of `trace list -t 15` with selected protocol data to annotate trace buffer you can load a trace from file (see `trace load -h`) or it be downloaded from device by default it accepts all other arguments of `trace list`. note that some might not be relevant for this specific protocol",
"notes": [
"hf 15 list -f -> show frame delay times",
"hf 15 list -1 -> use trace buffer"
],
"offline": true,
"options": [
"-h, --help this help",
"-1, --buffer use data from trace buffer",
"-f show frame delay times",
"-c mark crc bytes",
"-r show relative times (gap and duration)",
"-u display times in microseconds instead of clock cycles",
"-x show hexdump to convert to pcap(ng)",
"or to import into wireshark using encapsulation type \"iso 14443\"",
"--dict <file> use dictionary keys file"
],
"usage": "hf 15 list [-h1fcrux] [--dict <file>]"
},
"hf 15 info": {
"command": "hf 15 info",
"description": "uses the optional command `get_systeminfo` 0x2b to try and extract information",
"notes": [
"hf 15 info",
"hf 15 info -*",
"hf 15 info -u e011223344556677"
],
"offline": false,
"options": [
"-h, --help this help",
"-u, --uid <hex> full uid, 8 bytes",
"--ua unaddressed mode",
"-* scan for tag",
"-2 use slower '1 out of 256' mode",
"-o, --opt set option flag (needed for ti)"
],
"usage": "hf 15 info [-h*2o] [-u <hex>] [--ua]"
},
"hf 15 raw": {
"command": "hf 15 raw",
"description": "sends raw bytes over iso-15693 to card",
"notes": [
"hf 15 raw -c -d 260100 -> add crc",
"hf 15 raw -krc -d 260100 -> add crc, keep field on, skip response"
],
"offline": false,
"options": [
"-h, --help this help",
"-2 use slower '1 out of 256' mode",
"-c, --crc calculate and append crc",
"-k keep signal field on after receive",
"-r do not read response",
"-d, --data <hex> raw bytes to send"
],
"usage": "hf 15 raw [-h2ckr] -d <hex>"
},
"hf 15 rdbl": {
"command": "hf 15 rdbl",
"description": "read page on iso-15693 tag",
"notes": [
"hf 15 rdbl -* -b 12",
"hf 15 rdbl -u e011223344556677 -b 12"
],
"offline": false,
"options": [
"-h, --help this help",
"-u, --uid <hex> full uid, 8 bytes",
"--ua unaddressed mode",
"-* scan for tag",
"-2 use slower '1 out of 256' mode",
"-o, --opt set option flag (needed for ti)",
"-b, --blk <dec> page number (0-255)"
],
"usage": "hf 15 rdbl [-h*2o] [-u <hex>] [--ua] -b <dec>"
},
"hf 15 rdmulti": {
"command": "hf 15 rdmulti",
"description": "read multiple pages on a iso-15693 tag",
"notes": [
"hf 15 rdmulti -* -b 1 --cnt 6 -> read 6 blocks",
"hf 15 rdmulti -u e011223344556677 -b 12 --cnt 3 -> read three blocks"
],
"offline": false,
"options": [
"-h, --help this help",
"-u, --uid <hex> full uid, 8 bytes",
"--ua unaddressed mode",
"-* scan for tag",
"-2 use slower '1 out of 256' mode",
"-o, --opt set option flag (needed for ti)",
"-b <dec> first page number (0-255)",
"--cnt <dec> number of pages (1-6)"
],
"usage": "hf 15 rdmulti [-h*2o] [-u <hex>] [--ua] -b <dec> --cnt <dec>"
},
"hf 15 reader": {
"command": "hf 15 reader",
"description": "act as a iso-15693 reader. look for iso-15693 tags until enter or the pm3 button is pressed",
"notes": [
"hf 15 reader",
"hf 15 reader -@ -> continuous mode"
],
"offline": false,
"options": [
"-h, --help this help",
"-@ continuous reader mode"
],
"usage": "hf 15 reader [-h@]"
},
"hf 15 restore": {
"command": "hf 15 restore",
"description": "this command restore the contents of a dump file onto a iso-15693 tag",
"notes": [
"hf 15 restore",
"hf 15 restore -*",
"hf 15 restore -u e011223344556677 -f hf-15-my-dump.bin"
],
"offline": false,
"options": [
"-h, --help this help",
"-u, --uid <hex> full uid, 8 bytes",
"--ua unaddressed mode",
"-* scan for tag",
"-2 use slower '1 out of 256' mode",
"-o, --opt set option flag (needed for ti)",
"-f, --file <fn> filename of dump",
"-r, --retry <dec> number of retries (def 3)",
"--bs <dec> block size (def 4)",
"-v, --verbose verbose output"
],
"usage": "hf 15 restore [-h*2ov] [-u <hex>] [--ua] [-f <fn>] [-r <dec>] [--bs <dec>]"
},
"hf 15 samples": {
"command": "hf 15 samples",
"description": "acquire samples as reader (enables carrier, send inquiry and download it to graphbuffer. try 'hf 15 demod' to try to demodulate/decode signal",
"notes": [
"hf 15 samples"
],
"offline": false,
"options": [
"-h, --help this help"
],
"usage": "hf 15 samples [-h]"
},
"hf 15 sim": {
"command": "hf 15 sim",
"description": "simulate a iso-15693 tag",
"notes": [
"hf 15 sim -u e011223344556677"
],
"offline": false,
"options": [
"-h, --help this help",
"-u, --uid <8b hex> uid eg e011223344556677"
],
"usage": "hf 15 sim [-h] -u <8b hex>"
},
"hf 15 slixdisable": {
"command": "hf 15 slixdisable",
"description": "disable privacy mode on slix iso-15693 tag",
"notes": [
"hf 15 slixdisable -p 0f0f0f0f"
],
"offline": false,
"options": [
"-h, --help this help",
"-p, --pwd <hex> password, 8 hex bytes"
],
"usage": "hf 15 slixdisable [-h] -p <hex>"
},
"hf 15 sniff": {
"command": "hf 15 sniff",
"description": "sniff activity without enabling carrier",
"notes": [
"hf 15 sniff"
],
"offline": false,
"options": [
"-h, --help this help"
],
"usage": "hf 15 sniff [-h]"
},
"hf 15 wrbl": {
"command": "hf 15 wrbl",
"description": "write block on iso-15693 tag",
"notes": [
"hf 15 wrbl -* -b 12 -d aabbccdd",
"hf 15 wrbl -u e011223344556677 -b 12 -d aabbccdd"
],
"offline": false,
"options": [
"-h, --help this help",
"-u, --uid <hex> full uid, 8 bytes",
"--ua unaddressed mode",
"-* scan for tag",
"-2 use slower '1 out of 256' mode",
"-o, --opt set option flag (needed for ti)",
"-b, --blk <dec> page number (0-255)",
"-d, --data <hex> data, 4 bytes",
"-v, --verbose verbose output"
],
"usage": "hf 15 wrbl [-h*2ov] [-u <hex>] [--ua] -b <dec> -d <hex>"
},
"hf 15 writeafi": {
"command": "hf 15 writeafi",
"description": "write afi on card",
"notes": [
"hf 15 writeafi -* --afi 12",
"hf 15 writeafi -u e011223344556677 --afi 12"
],
"offline": false,
"options": [
"-h, --help this help",
"-u, --uid <hex> full uid, 8 bytes",
"--ua unaddressed mode",
"-* scan for tag",
"-2 use slower '1 out of 256' mode",
"-o, --opt set option flag (needed for ti)",
"--afi <dec> afi number (0-255)"
],
"usage": "hf 15 writeafi [-h*2o] [-u <hex>] [--ua] --afi <dec>"
},
"hf 15 writedsfid": {
"command": "hf 15 writedsfid",
"description": "write dsfid on card",
"notes": [
"hf 15 writedsfid -* --dsfid 12",
"hf 15 writedsfid -u e011223344556677 --dsfid 12"
],
"offline": false,
"options": [
"-h, --help this help",
"-u, --uid <hex> full uid, 8 bytes",
"--ua unaddressed mode",
"-* scan for tag",
"-2 use slower '1 out of 256' mode",
"-o, --opt set option flag (needed for ti)",
"--dsfid <dec> dsfid number (0-255)"
],
"usage": "hf 15 writedsfid [-h*2o] [-u <hex>] [--ua] --dsfid <dec>"
},
"hf cipurse aread": {
"command": "hf cipurse aread",
"description": "read file attributes by file id with key id and key. if no key is supplied, default key of 737373...7373 will be used",
"notes": [
"hf cipurse aread --fid 2ff7 -> select mf, authenticate with keyid 1, read file attributes with id 2ff7",
"hf cipurse aread --mfd -> read file attributes for master file (mf)",
"hf cipurse aread --chfid 0102 -> read file 0102 attributes in the default application",
"hf cipurse aread --aid 4144204632 --chfid 0102 -> read file 0102 attributes in the 4144204632 application",
"hf cipurse aread -n 2 -k 65656565656565656565656565656565 --fid 2ff7 -> authenticate keyid 2, read file attributes"
],
"offline": false,
"options": [
"-h, --help this help",
"-a, --apdu show apdu requests and responses",
"-v, --verbose show technical data",
"-n <dec> key id",
"-k, --key <hex> auth key",
"--mfd show info about master file",
"--aid <hex 1..16 bytes> select application id (aid)",
"--fid <hex> file id",
"--chfid <hex 2 bytes> child file id (ef under application/master file)",
"--noauth read file attributes without authentication",
"--sreq <plain|mac(default)|encode> communication reader-picc security level",
"--sresp <plain|mac(default)|encode> communication picc-reader security level"
],
"usage": "hf cipurse aread [-hav] [-n <dec>] [-k <hex>] [--mfd] [--aid <hex 1..16 bytes>] [--fid <hex>] [--chfid <hex 2 bytes>] [--noauth] [--sreq <plain|mac(default)|encode>] [--sresp <plain|mac(default)|encode>]"
},
"hf cipurse auth": {
"command": "hf cipurse auth",
"description": "authenticate with key id and key. if no key is supplied, default key of 737373...7373 will be used",
"notes": [
"hf cipurse auth -> authenticate with keyid 1, default key",
"hf cipurse auth -n 2 -k 65656565656565656565656565656565 -> authenticate keyid 2 with key"
],
"offline": false,
"options": [
"-h, --help this help",
"-a, --apdu show apdu requests and responses",
"-v, --verbose show technical data",
"--aid <hex 1..16 bytes> application id (aid)",
"--fid <hex 2 bytes> top file/application id (fid)",
"--mfd select masterfile by empty id",
"-n <dec> key id",
"-k, --key <hex> auth key"
],
"usage": "hf cipurse auth [-hav] [--aid <hex 1..16 bytes>] [--fid <hex 2 bytes>] [--mfd] [-n <dec>] [-k <hex>]"
},
"hf cipurse awrite": {
"command": "hf cipurse awrite",
"description": "write file attributes by file id with key id and key. if no key is supplied, default key of 737373...7373 will be used",
"notes": [
"hf cipurse awrite --fid 2ff7 -d 080000c1c1c1c1c1c1c1c1c1 -> write default file attributes with id 2ff7",
"hf cipurse awrite --mfd -d 080000ffffffffffffffffff86023232 --commit -> write file attributes for master file (mf)",
"hf cipurse awrite --chfid 0102 -d 020000ffffff -> write file 0102 attributes in the default application to full access",
"hf cipurse awrite --chfid 0102 -d 02000040ffff -> write file 0102 attributes in the default application to full access with keys 1 and 2"
],
"offline": false,
"options": [
"-h, --help this help",
"-a, --apdu show apdu requests and responses",
"-v, --verbose show technical data",
"-n <dec> key id",
"-k, --key <hex> auth key",
"--mfd show info about master file",
"--aid <hex 1..16 bytes> select application id (aid)",
"--fid <hex> file id",
"--chfid <hex 2 bytes> child file id (ef under application/master file)",
"--noauth read file attributes without authentication",
"--sreq <plain|mac(default)|encode> communication reader-picc security level",
"--sresp <plain|mac(default)|encode> communication picc-reader security level",
"-d, --data <hex> file attributes",
"--commit need commit after write"
],
"usage": "hf cipurse awrite [-hav] [-n <dec>] [-k <hex>] [--mfd] [--aid <hex 1..16 bytes>] [--fid <hex>] [--chfid <hex 2 bytes>] [--noauth] [--sreq <plain|mac(default)|encode>] [--sresp <plain|mac(default)|encode>] [-d <hex>] [--commit]"
},
"hf cipurse create": {
"command": "hf cipurse create",
"description": "create application/file/key by provide appropriate dgi. if no key is supplied, default key of 737373...7373 will be used",
"notes": [
"hf cipurse create -d 9200123f00200008000062098407a0000005070100 -> create ptse file with fid 0x2000 and space for 8 aids",
"hf cipurse create -d 92002438613f010a050200004040ff021009021009621084054144204631d407a0000005070100a00f2873737373737373737373737373737373015fd67b000102030405060708090a0b0c0d0e0f01c6a13b -> create default file with fid 3f01 and 2 keys",
"hf cipurse create --aid 4144204631 -d 92010c010001020030020000ffffff -> create 0x0102 binary data ef under application 4144204631"
],
"offline": false,
"options": [
"-h, --help this help",
"-a, --apdu show apdu requests and responses",
"-v, --verbose show technical data",
"-n <dec> key id",
"-k, --key <hex> auth key",
"--aid <hex 1..16 bytes> application id (aid)",
"--fid <hex 2 bytes> file id (fid)",
"--mfd select masterfile by empty id",
"-d, --data <hex> data with dgi for create",
"--sreq <plain|mac(default)|encode> communication reader-picc security level",
"--sresp <plain|mac(default)|encode> communication picc-reader security level",
"--no-auth execute without authentication",
"--commit need commit after create"
],
"usage": "hf cipurse create [-hav] [-n <dec>] [-k <hex>] [--aid <hex 1..16 bytes>] [--fid <hex 2 bytes>] [--mfd] [-d <hex>] [--sreq <plain|mac(default)|encode>] [--sresp <plain|mac(default)|encode>] [--no-auth] [--commit]"
},
"hf cipurse default": {
"command": "hf cipurse default",
"description": "set default parameters for access to cipurse card",
"notes": [
"hf cipurse default --reset -> reset parameters to default",
"hf cipurse default -n 1 -k 65656565656565656565656565656565 --fid 2ff7 -> set key, key id and file id",
"hf cipurse default --aid 4144204632 -> set default application id"
],
"offline": false,
"options": [
"-h, --help this help",
"--clear resets to defaults",
"-n <dec> key id",
"-k, --key <hex> authentication key",
"--aid <hex 1..16 bytes> application id (aid)",
"--fid <hex 2 bytes> file id"
],
"usage": "hf cipurse default [-h] [--clear] [-n <dec>] [-k <hex>] [--aid <hex 1..16 bytes>] [--fid <hex 2 bytes>]"
},
"hf cipurse delete": {
"command": "hf cipurse delete",
"description": "delete file by file id with key id and key. if no key is supplied, default key of 737373...7373 will be used",
"notes": [
"hf cipurse delete --fid 2ff7 -> authenticate with keyid 1, delete file with id 2ff7 at top level",
"hf cipurse delete -n 2 -k 65656565656565656565656565656565 --fid 2ff7 -> authenticate keyid 2 and delete file",
"hf cipurse delete --aid a0000005070100 --no-auth -> delete ptse file with aid a0000005070100 without authentication",
"hf cipurse delete --aid 4144204631 --chfid 0102 -> delete ef with fid 0x0102 under default application"
],
"offline": false,
"options": [
"-h, --help this help",
"-a, --apdu show apdu requests and responses",
"-v, --verbose show technical data",
"-n <dec> key id",
"-k, --key <hex> auth key",
"--fid <hex> file/application id under mf for delete",
"--aid <hex 1..16 bytes> application id (aid) for delete",
"--chfid <hex 2 bytes> child file id (ef under application/master file)",
"--sreq <plain|mac(default)|encode> communication reader-picc security level",
"--sresp <plain|mac(default)|encode> communication picc-reader security level",
"--no-auth execute without authentication",
"--commit commit"
],
"usage": "hf cipurse delete [-hav] [-n <dec>] [-k <hex>] [--fid <hex>] [--aid <hex 1..16 bytes>] [--chfid <hex 2 bytes>] [--sreq <plain|mac(default)|encode>] [--sresp <plain|mac(default)|encode>] [--no-auth] [--commit]"
},
"hf cipurse formatall": {
"command": "hf cipurse formatall",
"description": "format card. erases all the data at the card level!",
"notes": [
"hf cipurse formatall -> format card with default key",
"hf cipurse formatall -n 2 -k 65656565656565656565656565656565 -> format card with keyid 2",
"hf cipurse formatall --no-auth -> format card without authentication. works for card in perso state"
],
"offline": false,
"options": [
"-h, --help this help",
"-a, --apdu show apdu requests and responses",
"-v, --verbose show technical data",
"-n <dec> key id",
"-k, --key <hex> auth key",
"--sreq <plain|mac(default)|encode> communication reader-picc security level",
"--sresp <plain|mac(default)|encode> communication picc-reader security level",
"--no-auth execute without authentication"
],
"usage": "hf cipurse formatall [-hav] [-n <dec>] [-k <hex>] [--sreq <plain|mac(default)|encode>] [--sresp <plain|mac(default)|encode>] [--no-auth]"
},
"hf cipurse help": {
"command": "hf cipurse help",
"description": "help this help. test tests --------------------------------------------------------------------------------------- hf cipurse info available offline: no get info from cipurse tags",
"notes": [
"hf cipurse info"
],
"offline": true,
"options": [
"-h, --help this help"
],
"usage": "hf cipurse info [-h]"
},
"hf cipurse read": {
"command": "hf cipurse read",
"description": "read file in the application by file id with key id and key. if no key is supplied, default key of 737373...7373 will be used",
"notes": [
"hf cipurse read --fid 2ff7 -> authenticate with keyid 1, read file with id 2ff7",
"hf cipurse read -n 2 -k 65656565656565656565656565656565 --fid 2ff7 -> authenticate keyid 2 and read file",
"hf cipurse read --aid 4144204631 --fid 0102 -> read file with id 0102 from application 4144204631"
],
"offline": false,
"options": [
"-h, --help this help",
"-a, --apdu show apdu requests and responses",
"-v, --verbose show technical data",
"-n <dec> key id",
"-k, --key <hex> auth key",
"--aid <hex 1..16 bytes> application id (aid)",
"--fid <hex> file id",
"-o, --offset <dec> offset for reading data from file",
"--noauth read file without authentication",
"--sreq <plain|mac(default)|encode> communication reader-picc security level",
"--sresp <plain|mac(default)|encode> communication picc-reader security level"
],
"usage": "hf cipurse read [-hav] [-n <dec>] [-k <hex>] [--aid <hex 1..16 bytes>] [--fid <hex>] [-o <dec>] [--noauth] [--sreq <plain|mac(default)|encode>] [--sresp <plain|mac(default)|encode>]"
},
"hf cipurse select": {
"command": "hf cipurse select",
"description": "select application or file",
"notes": [
"hf cipurse select --aid a0000005070100 -> select ptse application by aid",
"hf cipurse select --fid 3f00 -> select master file by fid 3f00",
"hf cipurse select --fid 2ff7 -> select attribute file by fid 2ff7",
"hf cipurse select --mfd -vt -> select default file by empty fid and show response data in plain and tlv decoded format"
],
"offline": false,
"options": [
"-h, --help this help",
"-a, --apdu show apdu requests and responses",
"-v, --verbose show technical data",
"-t, --tlv tlv decode returned data",
"--aid <hex 1..16 bytes> application id (aid)",
"--fid <hex 2 bytes> top level file (or application) id (fid)",
"--mfd select masterfile by empty id",
"--chfid <hex 2 bytes> child file id (ef under application/master file)"
],
"usage": "hf cipurse select [-havt] [--aid <hex 1..16 bytes>] [--fid <hex 2 bytes>] [--mfd] [--chfid <hex 2 bytes>]"
},
"hf cipurse test": {
"command": "hf cipurse test",
"description": "[=] ------ cipurse tests ------ [=] kvv.............. passed [=] iso9797m2........ passed [=] smi.............. passed [=] mic.............. passed [=] auth............. passed [=] channel mac...... passed [=] channel encdec... passed [=] apdu............. passed [=] --------------------------- [+] tests [ ok ] ======================================================================================= hf epa { german identification card... } --------------------------------------------------------------------------------------- hf epa help available offline: yes help this help --------------------------------------------------------------------------------------- hf epa cnonces available offline: no tries to collect nonces when doing part of pace protocol.",
"notes": [
"hf epa cnonces --size 4 --num 4 --delay 1"
],
"offline": true,
"options": [
"-h, --help this help",
"--size <dec> nonce size",
"--num <dec> number of nonces to collect",
"-d, --delay <dec> delay between attempts"
],
"usage": "hf epa cnonces [-h] --size <dec> --num <dec> -d <dec>"
},
"hf cipurse write": {
"command": "hf cipurse write",
"description": "write file in the application by file id with key id and key. if no key is supplied, default key of 737373...7373 will be used",
"notes": [
"hf cipurse write --fid 2ff7 -d aabb -> authenticate with keyid 1, write file with id 2ff7",
"hf cipurse write -n 2 -k 65656565656565656565656565656565 --fid 2ff7 -d aabb -> authenticate keyid 2 and write file",
"hf cipurse write --aid 4144204631 --fid 0102 -d aabb -> write file with id 0102 in the 4144204631 application",
"hf cipurse write --fid 0102 -d aabb --commit -> write file with id 0102 and perform commit after write"
],
"offline": false,
"options": [
"-h, --help this help",
"-a, --apdu show apdu requests and responses",
"-v, --verbose show technical data",
"-n <dec> key id",
"-k, --key <hex> auth key",
"--aid <hex 1..16 bytes> application id (aid)",
"--fid <hex> file id",
"-o, --offset <dec> offset for reading data from file",
"--noauth read file without authentication",
"--sreq <plain|mac(default)|encode> communication reader-picc security level",
"--sresp <plain|mac(default)|encode> communication picc-reader security level",
"-d, --data <hex> hex data to write to new file",
"--commit need commit after write"
],
"usage": "hf cipurse write [-hav] [-n <dec>] [-k <hex>] [--aid <hex 1..16 bytes>] [--fid <hex>] [-o <dec>] [--noauth] [--sreq <plain|mac(default)|encode>] [--sresp <plain|mac(default)|encode>] [-d <hex>] [--commit]"
},
"hf emrtd help": {
"command": "hf emrtd help",
"description": "help this help info display info about an emrtd list list iso 14443a/7816 history --------------------------------------------------------------------------------------- hf emrtd dump available offline: no dump all files on an emrtd",
"notes": [
"hf emrtd dump"
],
"offline": true,
"options": [
"-h, --help this help",
"-n, --documentnumber <alphanum> document number, up to 9 chars",
"-d, --dateofbirth <yymmdd> date of birth in yymmdd format",
"-e, --expiry <yymmdd> expiry in yymmdd format",
"-m, --mrz <[0-9a-z<]> 2nd line of mrz, 44 chars",
"--path <dirpath> save dump to the given dirpath"
],
"usage": "hf emrtd dump [-h] [-n <alphanum>] [-d <yymmdd>] [-e <yymmdd>] [-m <[0-9a-z<]>] [--path <dirpath>]"
},
"hf emrtd info": {
"command": "hf emrtd info",
"description": "display info about an emrtd",
"notes": [
"hf emrtd info"
],
"offline": true,
"options": [
"-h, --help this help",
"-n, --documentnumber <alphanum> document number, up to 9 chars",
"-d, --dateofbirth <yymmdd> date of birth in yymmdd format",
"-e, --expiry <yymmdd> expiry in yymmdd format",
"-m, --mrz <[0-9a-z<]> 2nd line of mrz, 44 chars (passports only)",
"--path <dirpath> display info from offline dump stored in dirpath"
],
"usage": "hf emrtd info [-h] [-n <alphanum>] [-d <yymmdd>] [-e <yymmdd>] [-m <[0-9a-z<]>] [--path <dirpath>]"
},
"hf emrtd list": {
"command": "hf emrtd list",
"description": "alias of `trace list -t 7816` with selected protocol data to annotate trace buffer you can load a trace from file (see `trace load -h`) or it be downloaded from device by default it accepts all other arguments of `trace list`. note that some might not be relevant for this specific protocol",
"notes": [
"hf emrtd list -f -> show frame delay times",
"hf emrtd list -1 -> use trace buffer"
],
"offline": true,
"options": [
"-h, --help this help",
"-1, --buffer use data from trace buffer",
"-f show frame delay times",
"-c mark crc bytes",
"-r show relative times (gap and duration)",
"-u display times in microseconds instead of clock cycles",
"-x show hexdump to convert to pcap(ng)",
"or to import into wireshark using encapsulation type \"iso 14443\"",
"--dict <file> use dictionary keys file"
],
"usage": "hf emrtd list [-h1fcrux] [--dict <file>]"
},
"hf epa preplay": {
"command": "hf epa preplay",
"description": "perform pace protocol by replaying given apdus",
"notes": [
"hf epa preplay --mse 0022c1a4 --get 1068000000 --map 1086000002 --pka 1234abcdef --ma 1a2b3c4d"
],
"offline": false,
"options": [
"-h, --help this help",
"--mse <hex> msesa apdu",
"--get <hex> gn apdu",
"--map <hex> map apdu",
"--pka <hex> pka apdu",
"--ma <hex> ma apdu"
],
"usage": "hf epa preplay [-h] --mse <hex> --get <hex> --map <hex> --pka <hex> --ma <hex>"
},
"hf felica auth1": {
"command": "hf felica auth1",
"description": "initiate mutual authentication. this command must always be executed before auth2 command and mutual authentication is achieve only after auth2 command has succeeded. incomplete / experimental command!!!",
"notes": [
"hf felica auth1 --an 01 --acl 0000 --sn 01 --scl 8b00 --key aaaaaaaaaaaaaaaabbbbbbbbbbbbbbbb",
"hf felica auth1 --an 01 --acl 0000 --sn 01 --scl 8b00 --key aaaaaaaaaaaaaaaabbbbbbbbbbbbbbbbaaaaaaaaaaaaaaaa",
"hf felica auth1 -i 11100910c11bc407 --an 01 --acl 0000 --sn 01 ..scl 8b00 --key aaaaaaaaaaaaaaaabbbbbbbbbbbbbbbb"
],
"offline": false,
"options": [
"-h, --help this help",
"--an <hex> number of areas, 1 byte",
"--acl <hex> area code list, 2 bytes",
"-i <hex> set custom idm",
"--sn <hex> number of service, 1 byte",
"--scl <hex> service code list, 2 bytes",
"-k, --key <hex> 3des key, 16 bytes",
"-v, --verbose verbose helptext"
],
"usage": "hf felica auth1 [-hv] [--an <hex>] [--acl <hex>] [-i <hex>] [--sn <hex>] [--scl <hex>] [-k <hex>]"
},
"hf felica auth2": {
"command": "hf felica auth2",
"description": "complete mutual authentication. this command can only be executed subsquent to auth1 incomplete / experimental command!!! experimental command - m2c/p2c will be not checked",
"notes": [
"hf felica auth2 --cc 0102030405060708 --key aaaaaaaaaaaaaaaabbbbbbbbbbbbbbbb",
"hf felica auth2 -i 11100910c11bc407 --cc 0102030405060708 --key aaaaaaaaaaaaaaaabbbbbbbbbbbbbbbb"
],
"offline": false,
"options": [
"-h, --help this help",
"-i <hex> set custom idm",
"-c, --cc <hex> m3c card challenge, 8 bytes",
"-k, --key <hex> 3des m3c decryption key, 16 bytes",
"-v, --verbose verbose helptext"
],
"usage": "hf felica auth2 [-hv] [-i <hex>] [-c <hex>] [-k <hex>]"
},
"hf felica help": {
"command": "hf felica help",
"description": "help this help ----------- ----------------------- general ----------------------- list list iso 18092/felica history ----------- ----------------------- felica standard ----------------------- ----------- ----------------------- felica light ----------------------- --------------------------------------------------------------------------------------- hf felica list available offline: yes alias of `trace list -t felica` with selected protocol data to annotate trace buffer you can load a trace from file (see `trace load -h`) or it be downloaded from device by default it accepts all other arguments of `trace list`. note that some might not be relevant for this specific protocol",
"notes": [
"hf felica list -f -> show frame delay times",
"hf felica list -1 -> use trace buffer"
],
"offline": true,
"options": [
"-h, --help this help",
"-1, --buffer use data from trace buffer",
"-f show frame delay times",
"-c mark crc bytes",
"-r show relative times (gap and duration)",
"-u display times in microseconds instead of clock cycles",
"-x show hexdump to convert to pcap(ng)",
"or to import into wireshark using encapsulation type \"iso 14443\"",
"--dict <file> use dictionary keys file"
],
"usage": "hf felica list [-h1fcrux] [--dict <file>]"
},
"hf felica info": {
"command": "hf felica info",
"description": "reader for felica based tags",
"notes": [
"hf felica info"
],
"offline": false,
"options": [
"-h, --help this help"
],
"usage": "hf felica info [-h]"
},
"hf felica litedump": {
"command": "hf felica litedump",
"description": "dump iso/18092 felica lite tag. it will timeout after 200sec",
"notes": [
"hf felica litedump"
],
"offline": false,
"options": [
"-h, --help this help"
],
"usage": "hf felica litedump [-h]"
},
"hf felica litesim": {
"command": "hf felica litesim",
"description": "emulating iso/18092 felica lite tag",
"notes": [
"hf felica litesim -u 1122334455667788"
],
"offline": false,
"options": [
"-h, --help this help",
"-u, --uid <hex> uid/ndef2 8 hex bytes"
],
"usage": "hf felica litesim [-h] -u <hex>"
},
"hf felica raw": {
"command": "hf felica raw",
"description": "send raw hex data to tag",
"notes": [
"hf felica raw -cs 20",
"hf felica raw -cs 2008"
],
"offline": false,
"options": [
"-h, --help this help",
"-a active signal field on without select",
"-c calculate and append crc",
"-k keep signal field on after receive",
"-n <dec> number of bits",
"-r do not read response",
"-s active signal field on with select",
"<hex> raw bytes to send"
],
"usage": "hf felica raw [-hackrs] [-n <dec>] <hex>"
},
"hf felica rdbl": {
"command": "hf felica rdbl",
"description": "use this command to read block data from authentication-not-required service. - mode shall be mode0. - successful == block data - unsuccessful == status flag1 and flag2",
"notes": [
"hf felica rdbl --sn 01 --scl 8b00 --bn 01 --ble 8000",
"hf felica rdbl --sn 01 --scl 4b18 --bn 01 --ble 8000 -b",
"hf felica rdbl -i 01100910c11bc407 --sn 01 --scl 8b00 --bn 01 --ble 8000"
],
"offline": false,
"options": [
"-h, --help this help",
"-b get all block list elements 00 -> ff",
"-i <hex> set custom idm",
"-l, --long use 3 byte block list element block number",
"--sn <hex> number of service",
"--scl <hex> service code list",
"--bn <hex> number of block",
"--ble <hex> block list element (def 2|3 bytes)",
"-v, --verbose verbose helptext"
],
"usage": "hf felica rdbl [-hblv] [-i <hex>] [--sn <hex>] [--scl <hex>] [--bn <hex>] [--ble <hex>]"
},
"hf felica reader": {
"command": "hf felica reader",
"description": "act as a iso 18092 / felica reader. look for felica tags until enter or the pm3 button is pressed",
"notes": [
"hf felica reader -@ -> continuous mode"
],
"offline": false,
"options": [
"-h, --help this help",
"-s, --silent silent (no messages)",
"-@ optional - continuous reader mode"
],
"usage": "hf felica reader [-hs@]"
},
"hf felica resetmode": {
"command": "hf felica resetmode",
"description": "use this command to reset mode to mode 0.",
"notes": [
"hf felica resetmode",
"hf felica resetmode -r 0001",
"hf felica resetmode -i 11100910c11bc407"
],
"offline": false,
"options": [
"-h, --help this help",
"-i <hex> set custom idm",
"-r <hex> set custom reserve",
"-v, --verbose verbose helptext"
],
"usage": "hf felica resetmode [-hv] [-i <hex>] [-r <hex>]"
},
"hf felica rqresponse": {
"command": "hf felica rqresponse",
"description": "use this command to verify the existence of a card and its mode. - current mode of the card is returned",
"notes": [
"hf felica rqresponse -i 11100910c11bc407"
],
"offline": false,
"options": [
"-h, --help this help",
"-i <hex> set custom idm"
],
"usage": "hf felica rqresponse [-h] [-i <hex>]"
},
"hf felica rqservice": {
"command": "hf felica rqservice",
"description": "use this command to verify the existence of area and service, and to acquire key version: - when the specified area or service exists, the card returns key version. - when the specified area or service does not exist, the card returns ffffh as key version. for node code list of a command packet, area code or service code of the target of acquisition of key version shall be enumerated in little endian format. if key version of system is the target of acquisition, ffffh shall be specified in the command packet.",
"notes": [
"hf felcia rqservice --node 01 --code ffff",
"hf felcia rqservice -a --code ffff",
"hf felica rqservice -i 011204126417e405 --node 01 --code ffff"
],
"offline": false,
"options": [
"-h, --help this help",
"-a, --all auto node number mode, iterates through all nodes 1 < n < 32",
"-n, --node <hex> number of node",
"-c, --code <hex> node code list (little endian)",
"-i, --idm <hex> use custom idm"
],
"usage": "hf felica rqservice [-ha] [-n <hex>] [-c <hex>] [-i <hex>]"
},
"hf felica rqspecver": {
"command": "hf felica rqspecver",
"description": "use this command to acquire the version of card os. response: - format version: fixed value 00h. provided only if status flag1 = 00h - basic version: each value of version is expressed in bcd notation. provided only if status flag1 = 00h - number of option: value = 0: aes card, value = 1: aes/des card. provided only if status flag1 = 00h - option version list: provided only if status flag1 = 00h - aes card: not added - aes/des card: des option version is added - bcd notation",
"notes": [
"hf felica rqspecver",
"hf felica rqspecver -r 0001",
"hf felica rqspecver -i 11100910c11bc407"
],
"offline": false,
"options": [
"-h, --help this help",
"-i <hex> set custom idm",
"-r <hex> set custom reserve",
"-v, --verbose verbose helptext"
],
"usage": "hf felica rqspecver [-hv] [-i <hex>] [-r <hex>]"
},
"hf felica rqsyscode": {
"command": "hf felica rqsyscode",
"description": "use this command to acquire system code registered to the card. - if a card is divided into more than one system, this command acquires system code of each system existing in the card.",
"notes": [
"hf felica rqsyscode",
"hf felica rqsyscode -i 11100910c11bc407"
],
"offline": false,
"options": [
"-h, --help this help",
"-i <hex> set custom idm"
],
"usage": "hf felica rqsyscode [-h] [-i <hex>]"
},
"hf felica scsvcode": {
"command": "hf felica scsvcode",
"description": "feature not implemented yet. feel free to contribute!",
"notes": [
"hf felica scsvcode"
],
"offline": false,
"options": [
"-h, --help this help"
],
"usage": "hf felica scsvcode [-h]"
},
"hf felica sniff": {
"command": "hf felica sniff",
"description": "collect data from the field and save into command buffer. buffer accessible from `hf felica list`",
"notes": [
"hf felica sniff",
"hf felica sniff -s 10 -t 19"
],
"offline": false,
"options": [
"-h, --help this help",
"-s, --samples <dec> samples to skip",
"-t, --trig <dec> triggers to skip"
],
"usage": "hf felica sniff [-h] [-s <dec>] [-t <dec>]"
},
"hf felica wrbl": {
"command": "hf felica wrbl",
"description": "use this command to write block data to authentication-not-required service. - mode shall be mode0. - un-/ssuccessful == status flag1 and flag2",
"notes": [
"hf felica wrbl --sn 01 --scl cb10 --bn 01 --ble 8001 -d 0102030405060708090a0b0c0d0e0f10",
"hf felica wrbl -i 01100910c11bc407 --sn 01 --scl cb10 --bn 01 --ble 8001 -d 0102030405060708090a0b0c0d0e0f10"
],
"offline": false,
"options": [
"-h, --help this help",
"-d, --data <hex> data, 16 hex bytes",
"-i <hex> set custom idm",
"--sn <hex> number of service",
"--scl <hex> service code list",
"--bn <hex> number of block",
"--ble <hex> block list element (def 2|3 bytes)",
"-v, --verbose verbose helptext"
],
"usage": "hf felica wrbl [-hv] [-d <hex>] [-i <hex>] [--sn <hex>] [--scl <hex>] [--bn <hex>] [--ble <hex>]"
},
"hf fido assert": {
"command": "hf fido assert",
"description": "execute a fido2 get assertion command. needs json file with parameters. sample file `fido2_defparams.json` in `client/resources/`. - needs if `rk` option is `false` (authenticator doesn't store credential to its memory) - for yubikey there must be only one option `\"up\": true` or false",
"notes": [
"hf fido assert -> default parameters file `fido2_defparams.json`",
"hf fido assert -f test.json -l -> use parameters file `text.json` and add to request credentialid"
],
"offline": false,
"options": [
"-h, --help this help",
"-a, --apdu show apdu reqests and responses",
"-v, --verbose show technical data. vv - show full certificates data",
"-c, --cbor show cbor decoded data",
"-l, --list add credentialid from json to allowlist",
"-f, --file <fn> parameter json file name"
],
"usage": "hf fido assert [-havcl] [-f <fn>]"
},
"hf fido auth": {
"command": "hf fido auth",
"description": "initiate a u2f token authentication. needs key handle and two 32-byte hash numbers. key handle(var 0..255), challenge parameter (32b) and application parameter (32b) the default config filename is `fido2_defparams.json`",
"notes": [
"hf fido auth --kh 000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f -> execute command with 2 parameters, filled 0x00 and key handle",
"hf fido auth",
"--kh 000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f",
"--cp 000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f",
"--ap 000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f -> execute command with parameters"
],
"offline": false,
"options": [
"-h, --help this help",
"-a, --apdu show apdu reqests and responses",
"-v, --verbose show technical data",
"default mode: dont-enforce-user-presence-and-sign",
"-u, --user mode: enforce-user-presence-and-sign",
"-c, --check mode: check-only",
"-f, --file <fn> json input file name for parameters",
"-k, --key <hex> public key to verify signature",
"--kh <hex> key handle (var 0..255b)",
"--cp <ascii> challenge parameter (1..16 chars)",
"--ap <ascii> application parameter (1..16 chars)",
"--cpx <hex> challenge parameter (32 bytes hex)",
"--apx <hex> application parameter (32 bytes hex)"
],
"usage": "hf fido auth [-havuc] default mode: [-f <fn>] [-k <hex>] [--kh <hex>] [--cp <ascii>] [--ap <ascii>] [--cpx <hex>] [--apx <hex>]"
},
"hf fido help": {
"command": "hf fido help",
"description": "help this help. list list iso 14443a history --------------------------------------------------------------------------------------- hf fido list available offline: yes alias of `trace list -t 14a` with selected protocol data to annotate trace buffer you can load a trace from file (see `trace load -h`) or it be downloaded from device by default it accepts all other arguments of `trace list`. note that some might not be relevant for this specific protocol",
"notes": [
"hf fido list -f -> show frame delay times",
"hf fido list -1 -> use trace buffer"
],
"offline": true,
"options": [
"-h, --help this help",
"-1, --buffer use data from trace buffer",
"-f show frame delay times",
"-c mark crc bytes",
"-r show relative times (gap and duration)",
"-u display times in microseconds instead of clock cycles",
"-x show hexdump to convert to pcap(ng)",
"or to import into wireshark using encapsulation type \"iso 14443\"",
"--dict <file> use dictionary keys file"
],
"usage": "hf fido list [-h1fcrux] [--dict <file>]"
},
"hf fido info": {
"command": "hf fido info",
"description": "get info from fido tags",
"notes": [
"hf fido info"
],
"offline": false,
"options": [
"-h, --help this help"
],
"usage": "hf fido info [-h]"
},
"hf fido make": {
"command": "hf fido make",
"description": "execute a fido2 make credential command. needs json file with parameters. sample file `fido2_defparams.json` in `client/resources/`. - for yubikey there must be only one option `\"rk\": true` or false",
"notes": [
"hf fido make -> use default parameters file `fido2_defparams.json`",
"hf fido make -f test.json -> use parameters file `text.json`"
],
"offline": false,
"options": [
"-h, --help this help",
"-a, --apdu show apdu reqests and responses",
"-v, --verbose show technical data. vv - show full certificates data",
"-t, --tlv show der certificate contents in tlv representation",
"-c, --cbor show cbor decoded data",
"-f, --file <fn> parameter json file name"
],
"usage": "hf fido make [-havtc] [-f <fn>]"
},
"hf fido reg": {
"command": "hf fido reg",
"description": "initiate a u2f token registration. needs two 32-byte hash numbers. challenge parameter (32b) and application parameter (32b). the default config filename is `fido2_defparams.json`",
"notes": [
"hf fido reg -> execute command with 2 parameters, filled 0x00",
"hf fido reg --cp s0 --ap s1 -> execute command with plain parameters",
"hf fido reg --cpx 000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f --apx 000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f",
"hf fido reg -f fido2-params -> execute command with custom config file"
],
"offline": false,
"options": [
"-h, --help this help",
"-a, --apdu show apdu requests and responses",
"-v, --verbose show technical data. vv - show full certificates data",
"-t, --tlv show der certificate contents in tlv representation",
"-f, --file <fn> json input file name for parameters",
"--cp <ascii> challenge parameter (1..16 chars)",
"--ap <ascii> application parameter (1..16 chars)",
"--cpx <hex> challenge parameter (32 bytes hex)",
"--apx <hex> application parameter (32 bytes hex)"
],
"usage": "hf fido reg [-havt] [-f <fn>] [--cp <ascii>] [--ap <ascii>] [--cpx <hex>] [--apx <hex>]"
},
"hf gallagher clone": {
"command": "hf gallagher clone",
"description": "clone gallagher credentials to a writable desfire card specify site key is required if using non-default key key, lengths for the different crypto: des 8 bytes 2tdea or aes 16 bytes 3tdea 24 bytes aid, default finds lowest available in range 0x??81f4, where ?? >= 0x20.",
"notes": [
"hf gallagher clone --rc 1 --fc 22 --cn 3333 --il 4 --sitekey 00112233445566778899aabbccddeeff"
],
"offline": false,
"options": [
"-h, --help this help",
"-n, --keynum <dec> picc key number [default = 0]",
"-t, --algo <des|2tdea|3tdea|aes> picc crypt algo: des, 2tdea, 3tdea, aes",
"-k, --key <hex> key for authentication to the picc to create applications",
"--rc <dec> region code. 4 bits max",
"--fc <dec> facility code. 2 bytes max",
"--cn <dec> card number. 3 bytes max",
"--il <dec> issue level. 4 bits max",
"--aid <hex> application id to write (3 bytes) [default automatically chooses]",
"--sitekey <hex> site key to compute diversified keys (16 bytes)",
"--cadkey <hex> custom aes key 0 to modify the card application directory (16 bytes)",
"--nocadupdate don't modify the card application directory (only creates the app)",
"--noappcreate don't create the application (only modifies the cad)",
"--apdu show apdu requests and responses",
"-v, --verbose verbose mode"
],
"usage": "hf gallagher clone [-hv] [-n <dec>] [-t <des|2tdea|3tdea|aes>] [-k <hex>] --rc <dec> --fc <dec> --cn <dec> --il <dec> [--aid <hex>] [--sitekey <hex>] [--cadkey <hex>] [--nocadupdate] [--noappcreate] [--apdu]"
},
"hf gallagher delete": {
"command": "hf gallagher delete",
"description": "delete gallagher application from a desfire card specify site key is required if using non-default key",
"notes": [
"hf gallagher delete --aid 2081f4 --sitekey 00112233445566778899aabbccddeeff"
],
"offline": false,
"options": [
"-h, --help this help",
"--aid <hex> application id to delete (3 bytes)",
"--sitekey <hex> site key to compute diversified keys (16 bytes)",
"--cadkey <hex> custom aes key 0 to modify the card application directory (16 bytes)",
"--nocadupdate don't modify the card application directory (only deletes the app)",
"--noappdelete don't delete the application (only modifies the cad)",
"--apdu show apdu requests and responses",
"-v, --verbose verbose mode"
],
"usage": "hf gallagher delete [-hv] --aid <hex> [--sitekey <hex>] [--cadkey <hex>] [--nocadupdate] [--noappdelete] [--apdu]"
},
"hf gallagher diversifykey": {
"command": "hf gallagher diversifykey",
"description": "diversify gallagher key specify site key is required if using non-default key",
"notes": [
"hf gallagher diversify --uid 11223344556677 --aid 2081f4"
],
"offline": true,
"options": [
"-h, --help this help",
"--aid <hex> application id for diversification (3 bytes)",
"--keynum <dec> key number [default = 0]",
"--uid <hex> card uid to delete (4 or 7 bytes)",
"--sitekey <hex> site key to compute diversified keys (16 bytes)",
"--apdu show apdu requests and responses"
],
"usage": "hf gallagher diversify [-h] --aid <hex> [--keynum <dec>] [--uid <hex>] [--sitekey <hex>] [--apdu]"
},
"hf gallagher help": {
"command": "hf gallagher help",
"description": "help this help diversifykey diversify gallagher key --------------------------------------------------------------------------------------- hf gallagher reader available offline: no read a gallagher desfire tag from the card application directory, cad specify site key is required if using non-default key",
"notes": [
"hf gallagher reader -@ -> continuous reader mode",
"hf gallagher reader --aid 2081f4 --sitekey 00112233445566778899aabbccddeeff -> skip cad"
],
"offline": true,
"options": [
"-h, --help this help",
"--aid <hex> application id to read (3 bytes). if specified, the cad is not used",
"--sitekey <hex> site key to compute diversified keys (16 bytes)",
"-@, --continuous continuous reader mode",
"--apdu show apdu requests and responses",
"-v, --verbose verbose mode"
],
"usage": "hf gallagher reader [-h@v] [--aid <hex>] [--sitekey <hex>] [--apdu]"
},
"hf help": {
"command": "hf help",
"description": "-------- ----------------------- high frequency ----------------------- 14a { iso14443a rfids... } 14b { iso14443b rfids... } 15 { iso15693 rfids... } cipurse { cipurse transport cards... } epa { german identification card... } emrtd { machine readable travel document... } felica { iso18092 / felica rfids... } fido { fido and fido2 authenticators... } gallagher { gallagher desfire rfids... } ksx6924 { ks x 6924 (t-money, snapper+) rfids } jooki { jooki rfids... } iclass { iclass rfids... } legic { legic rfids... } lto { lto cartridge memory rfids... } mf { mifare rfids... } mfp { mifare plus rfids... } mfu { mifare ultralight rfids... } mfdes { mifare desfire rfids... } seos { seos rfids... } st25ta { st25ta rfids... } thinfilm { thinfilm rfids... } topaz { topaz (nfc type 1) rfids... } waveshare { waveshare nfc epaper... } ----------- --------------------- general --------------------- help this help list list protocol data in trace buffer search search for known hf tags --------------------------------------------------------------------------------------- hf list available offline: yes alias of `trace list -t raw` with selected protocol data to annotate trace buffer you can load a trace from file (see `trace load -h`) or it be downloaded from device by default it accepts all other arguments of `trace list`. note that some might not be relevant for this specific protocol",
"notes": [
"hf list -f -> show frame delay times",
"hf list -1 -> use trace buffer"
],
"offline": true,
"options": [
"-h, --help this help",
"-1, --buffer use data from trace buffer",
"-f show frame delay times",
"-c mark crc bytes",
"-r show relative times (gap and duration)",
"-u display times in microseconds instead of clock cycles",
"-x show hexdump to convert to pcap(ng)",
"or to import into wireshark using encapsulation type \"iso 14443\"",
"--dict <file> use dictionary keys file"
],
"usage": "hf list [-h1fcrux] [--dict <file>]"
},
"hf iclass calcnewkey": {
"command": "hf iclass calcnewkey",
"description": "calculate new keys for updating (blocks 3 & 4)",
"notes": [
"hf iclass calcnewkey --old 1122334455667788 --new 2233445566778899 --csn deadbeafdeadbeaf --elite2 -> e key to e key given csn",
"hf iclass calcnewkey --old 1122334455667788 --new 2233445566778899 --elite -> std key to e key read csn",
"hf iclass calcnewkey --old 1122334455667788 --new 2233445566778899 -> std to std read csn"
],
"offline": true,
"options": [
"-h, --help this help",
"--old <hex> specify key as 8 hex bytes",
"--oki <dec> old key index to select key from memory 'hf iclass managekeys'",
"--new <hex> specify key as 8 hex bytes",
"--nki <dec> new key index to select key from memory 'hf iclass managekeys'",
"--csn <hex> specify a card serial number (csn) to diversify the key (if omitted will attempt to read a csn)",
"--elite elite computations applied to new key",
"--elite2 elite computations applied to both old and new key"
],
"usage": "hf iclass calcnewkey [-h] [--old <hex>] [--oki <dec>] [--new <hex>] [--nki <dec>] [--csn <hex>] [--elite] [--elite2]"
},
"hf iclass chk": {
"command": "hf iclass chk",
"description": "checkkeys loads a dictionary text file with 8byte hex keys to test authenticating against a iclass tag",
"notes": [
"hf iclass chk -f iclass_default_keys.dic",
"hf iclass chk -f iclass_default_keys.dic --elite"
],
"offline": false,
"options": [
"-h, --help this help",
"-f, --file <fn> dictionary file with default iclass keys",
"--credit key is assumed to be the credit key",
"--elite elite computations applied to key",
"--raw no computations applied to key (raw)"
],
"usage": "hf iclass chk [-h] -f <fn> [--credit] [--elite] [--raw]"
},
"hf iclass configcard": {
"command": "hf iclass configcard",
"description": "manage reader configuration card via cardhelper, the generated config card will be uploaded to device emulator memory. you can start simulating `hf iclass sim -t 3` or use the emul commands",
"notes": [
"hf iclass configcard -l -> download config card settings",
"hf iclass configcard -p -> print all config cards",
"hf iclass configcard --ci 1 -> view config card setting in slot 1",
"hf iclass configcard -g --ci 0 -> generate config file from slot 0"
],
"offline": true,
"options": [
"-h, --help this help",
"--ci <dec> use config slot at index",
"--ki <dec> key index to select key from memory 'hf iclass managekeys'",
"-g generate card dump file",
"-l load available cards",
"-p print available cards"
],
"usage": "hf iclass configcard [-hglp] [--ci <dec>] [--ki <dec>]"
},
"hf iclass decrypt": {
"command": "hf iclass decrypt",
"description": "3des decrypt data this is a naive implementation, it tries to decrypt every block after block 6. correct behaviour would be to decrypt only the application areas where the key is valid, which is defined by the configuration block. obs! in order to use this function, the file `iclass_decryptionkey.bin` must reside in the resources directory. the file should be 16 bytes binary data or... make sure your cardhelper is placed in the sim module",
"notes": [
"hf iclass decrypt -f hf-iclass-aa162d30f8ff12f1-dump.bin",
"hf iclass decrypt -f hf-iclass-aa162d30f8ff12f1-dump.bin -k 000102030405060708090a0b0c0d0e0f",
"hf iclass decrypt -d 1122334455667788 -k 000102030405060708090a0b0c0d0e0f"
],
"offline": true,
"options": [
"-h, --help this help",
"-f, --file <fn> filename of dump file (bin/eml/json)",
"-d, --data <hex> 3des encrypted data",
"-k, --key <hex> 3des transport key",
"-v, --verbose verbose output",
"--d6 decode as block 6"
],
"usage": "hf iclass decrypt [-hv] [-f <fn>] [-d <hex>] [-k <hex>] [--d6]"
},
"hf iclass eload": {
"command": "hf iclass eload",
"description": "load emulator memory with data from (bin/eml/json) iclass dump file",
"notes": [
"hf iclass eload -f hf-iclass-aa162d30f8ff12f1-dump.bin",
"hf iclass eload -f hf-iclass-aa162d30f8ff12f1-dump.eml"
],
"offline": false,
"options": [
"-h, --help this help",
"-f, --file <fn> filename of dump (bin/eml/json)"
],
"usage": "hf iclass eload [-h] -f <fn>"
},
"hf iclass encode": {
"command": "hf iclass encode",
"description": "encode binary wiegand to block 7 use either --bin or --wiegand/--fc/--cn",
"notes": [
"hf iclass encode --bin 10001111100000001010100011 --ki 0 -> fc 31 cn 337",
"hf iclass encode --fc 31 --cn 337 --ki 0 -> fc 31 cn 337",
"hf iclass encode --bin 10001111100000001010100011 --ki 0 --elite -> fc 31 cn 337, writing w elite key"
],
"offline": true,
"options": [
"-h, --help this help",
"--bin <bin> binary string i.e 0001001001",
"--ki <dec> key index to select key from memory 'hf iclass managekeys'",
"--credit key is assumed to be the credit key",
"--elite elite computations applied to key",
"--raw no computations applied to key",
"--enckey <hex> 3des transport key, 16 hex bytes",
"--fc <dec> facility code",
"--cn <dec> card number",
"-w, --wiegand <format> see `wiegand list` for available formats"
],
"usage": "hf iclass encode [-h] [--bin <bin>] --ki <dec> [--credit] [--elite] [--raw] [--enckey <hex>] [--fc <dec>] [--cn <dec>] [-w <format>]"
},
"hf iclass encrypt": {
"command": "hf iclass encrypt",
"description": "3des encrypt data obs! in order to use this function, the file 'iclass_decryptionkey.bin' must reside in the resources directory. the file should be 16 hex bytes of binary data",
"notes": [
"hf iclass encrypt -d 0102030405060708",
"hf iclass encrypt -d 0102030405060708 -k 00112233445566778899aabbccddeeff"
],
"offline": true,
"options": [
"-h, --help this help",
"-d, --data <hex> data to encrypt",
"-k, --key <hex> 3des transport key",
"-v, --verbose verbose output"
],
"usage": "hf iclass encrypt [-hv] -d <hex> [-k <hex>]"
},
"hf iclass esave": {
"command": "hf iclass esave",
"description": "save emulator memory to file. if filename is not supplied, csn will be used.",
"notes": [
"hf iclass esave",
"hf iclass esave -f hf-iclass-dump",
"hf iclass esave -s 2048 -f hf-iclass-dump"
],
"offline": false,
"options": [
"-h, --help this help",
"-f, --file <fn> filename of dump file",
"-s, --size <256|2048> number of bytes to save (default 256)"
],
"usage": "hf iclass esave [-h] [-f <fn>] [-s <256|2048>]"
},
"hf iclass eview": {
"command": "hf iclass eview",
"description": "display emulator memory. number of bytes to download defaults to 256. other value is 2048.",
"notes": [
"hf iclass eview",
"hf iclass eview -s 2048",
"hf iclass eview -s 2048 -v"
],
"offline": false,
"options": [
"-h, --help this help",
"-s, --size <256|2048> number of bytes to save (default 256)",
"-v, --verbose verbose output"
],
"usage": "hf iclass eview [-hv] [-s <256|2048>]"
},
"hf iclass help": {
"command": "hf iclass help",
"description": "----------- --------------------- operations --------------------- help this help info tag information list list iclass history ----------- --------------------- recovery --------------------- loclass use loclass to perform bruteforce reader attack lookup uses authentication trace to check for key in dictionary file ----------- --------------------- simulation --------------------- ----------- --------------------- utils --------------------- configcard reader configuration card calcnewkey calc diversified keys (blocks 3 & 4) to write new keys encode encode binary wiegand to block 7 encrypt encrypt given block data decrypt decrypt given block data or tag dump file managekeys manage keys to use with iclass commands permutekey permute function from 'heart of darkness' paper view display content from tag dump file --------------------------------------------------------------------------------------- hf iclass dump available offline: no dump all memory from a iclass tag",
"notes": [
"hf iclass dump -k 001122334455667b",
"hf iclass dump -k aaaaaaaaaaaaaaaa --credit 001122334455667b",
"hf iclass dump -k aaaaaaaaaaaaaaaa --elite",
"hf iclass dump --ki 0",
"hf iclass dump --ki 0 --ci 2"
],
"offline": true,
"options": [
"-h, --help this help",
"-f, --file <fn> save filename",
"-k, --key <hex> debit key or nr/mac for replay as 8 hex bytes",
"--ki <dec> debit key index to select key from memory 'hf iclass managekeys'",
"--credit <hex> credit key as 8 hex bytes",
"--ci <dec> credit key index to select key from memory 'hf iclass managekeys'",
"--elite elite computations applied to key",
"--raw raw, the key is interpreted as raw block 3/4",
"--nr replay of nr/mac"
],
"usage": "hf iclass dump [-h] [-f <fn>] [-k <hex>] [--ki <dec>] [--credit <hex>] [--ci <dec>] [--elite] [--raw] [--nr]"
},
"hf iclass info": {
"command": "hf iclass info",
"description": "act as a iclass reader. reads / fingerprints a iclass tag.",
"notes": [
"hf iclass info"
],
"offline": true,
"options": [
"-h, --help this help"
],
"usage": "hf iclass info [-h]"
},
"hf iclass list": {
"command": "hf iclass list",
"description": "alias of `trace list -t iclass` with selected protocol data to annotate trace buffer you can load a trace from file (see `trace load -h`) or it be downloaded from device by default it accepts all other arguments of `trace list`. note that some might not be relevant for this specific protocol",
"notes": [
"hf iclass list -f -> show frame delay times",
"hf iclass list -1 -> use trace buffer"
],
"offline": true,
"options": [
"-h, --help this help",
"-1, --buffer use data from trace buffer",
"-f show frame delay times",
"-c mark crc bytes",
"-r show relative times (gap and duration)",
"-u display times in microseconds instead of clock cycles",
"-x show hexdump to convert to pcap(ng)",
"or to import into wireshark using encapsulation type \"iso 14443\"",
"--dict <file> use dictionary keys file"
],
"usage": "hf iclass list [-h1fcrux] [--dict <file>]"
},
"hf iclass loclass": {
"command": "hf iclass loclass",
"description": "execute the offline part of loclass attack an iclass dumpfile is assumed to consist of an arbitrary number of malicious csns, and their protocol responses the binary format of the file is expected to be as follows: <8 byte csn><8 byte cc><4 byte nr><4 byte mac> <8 byte csn><8 byte cc><4 byte nr><4 byte mac> <8 byte csn><8 byte cc><4 byte nr><4 byte mac> ... totalling n*24 bytes",
"notes": [
"hf iclass loclass -f iclass_dump.bin",
"hf iclass loclass --test"
],
"offline": true,
"options": [
"-h, --help this help",
"-f, --file <fn> filename with nr/mac data from `hf iclass sim -t 2`",
"--test perform self-test",
"--long perform self-test, including long ones"
],
"usage": "hf iclass loclass [-h] [-f <fn>] [--test] [--long]"
},
"hf iclass lookup": {
"command": "hf iclass lookup",
"description": "lookup keys takes some sniffed trace data and tries to verify what key was used against a dictionary file",
"notes": [
"hf iclass lookup --csn 9655a400f8ff12e0 --epurse f0ffffffffffffff --macs 0000000089cb984b -f iclass_default_keys.dic",
"hf iclass lookup --csn 9655a400f8ff12e0 --epurse f0ffffffffffffff --macs 0000000089cb984b -f iclass_default_keys.dic --elite"
],
"offline": true,
"options": [
"-h, --help this help",
"-f, --file <fn> dictionary file with default iclass keys",
"--csn <hex> specify csn as 8 hex bytes",
"--epurse <hex> specify epurse as 8 hex bytes",
"--macs <hex> macs",
"--elite elite computations applied to key",
"--raw no computations applied to key"
],
"usage": "hf iclass lookup [-h] -f <fn> --csn <hex> --epurse <hex> --macs <hex> [--elite] [--raw]"
},
"hf iclass managekeys": {
"command": "hf iclass managekeys",
"description": "manage iclass keys in client memory",
"notes": [
"hf iclass managekeys --ki 0 -k 1122334455667788 -> set key 1122334455667788 at index 0",
"hf iclass managekeys -f mykeys.bin --save -> save key file",
"hf iclass managekeys -f mykeys.bin --load -> load key file",
"hf iclass managekeys -p -> print keys"
],
"offline": true,
"options": [
"-h, --help this help",
"-f, --file <fn> specify a filename for load / save operations",
"-k, --key <hex> access key as 8 hex bytes",
"--ki <dec> specify key index to set key in memory",
"--save save keys in memory to file specified by filename",
"--load load keys to memory from file specified by filename",
"-p, --print print keys loaded into memory"
],
"usage": "hf iclass managekeys [-hp] [-f <fn>] [-k <hex>] [--ki <dec>] [--save] [--load]"
},
"hf iclass permutekey": {
"command": "hf iclass permutekey",
"description": "permute function from 'heart of darkness' paper.",
"notes": [
"hf iclass permutekey --reverse --key 0123456789abcdef",
"hf iclass permutekey --key ff55330f0055330f"
],
"offline": true,
"options": [
"-h, --help this help",
"-r, --reverse reverse permuted key",
"--key <hex> input key, 8 hex bytes"
],
"usage": "hf iclass permutekey [-hr] --key <hex>"
},
"hf iclass rdbl": {
"command": "hf iclass rdbl",
"description": "read a iclass block from tag",
"notes": [
"hf iclass rdbl -b 6 -k 0011223344556677",
"hf iclass rdbl -b 27 -k 0011223344556677 --credit",
"hf iclass rdbl -b 10 --ki 0"
],
"offline": false,
"options": [
"-h, --help this help",
"-k, --key <hex> access key as 8 hex bytes",
"--ki <dec> key index to select key from memory 'hf iclass managekeys'",
"-b, --block <dec> the block number to read",
"--credit key is assumed to be the credit key",
"--elite elite computations applied to key",
"--raw no computations applied to key",
"--nr replay of nr/mac",
"-v, --verbose verbose output"
],
"usage": "hf iclass rdbl [-hv] [-k <hex>] [--ki <dec>] -b <dec> [--credit] [--elite] [--raw] [--nr]"
},
"hf iclass reader": {
"command": "hf iclass reader",
"description": "act as a iclass reader. look for iclass tags until enter or the pm3 button is pressed",
"notes": [
"hf iclass reader -@ -> continuous reader mode"
],
"offline": false,
"options": [
"-h, --help this help",
"-@ optional - continuous reader mode"
],
"usage": "hf iclass reader [-h@]"
},
"hf iclass restore": {
"command": "hf iclass restore",
"description": "restore data from dumpfile onto a iclass tag",
"notes": [
"hf iclass restore -f hf-iclass-aa162d30f8ff12f1-dump.bin --first 6 --last 18 --ki 0",
"hf iclass restore -f hf-iclass-aa162d30f8ff12f1-dump.bin --first 6 --last 18 --ki 0 --elite",
"hf iclass restore -f hf-iclass-aa162d30f8ff12f1-dump.bin --first 6 --last 18 -k 1122334455667788 --elite"
],
"offline": false,
"options": [
"-h, --help this help",
"-f, --file <fn> specify a filename to restore (bin/eml/json)",
"-k, --key <hex> access key as 8 hex bytes",
"--ki <dec> key index to select key from memory 'hf iclass managekeys'",
"--first <dec> the first block number to restore",
"--last <dec> the last block number to restore",
"--credit key is assumed to be the credit key",
"--elite elite computations applied to key",
"--raw no computations applied to key",
"-v, --verbose verbose output"
],
"usage": "hf iclass restore [-hv] -f <fn> [-k <hex>] [--ki <dec>] --first <dec> --last <dec> [--credit] [--elite] [--raw]"
},
"hf iclass sim": {
"command": "hf iclass sim",
"description": "simulate a iclass legacy/standard tag",
"notes": [
"hf iclass sim -t 0 --csn 031fec8af7ff12e0 -> simulate with specified csn",
"hf iclass sim -t 1 -> simulate with default csn",
"hf iclass sim -t 2 -> execute loclass attack online part",
"hf iclass sim -t 3 -> simulate full iclass 2k tag",
"hf iclass sim -t 4 -> reader-attack, adapted for keyroll mode, gather reader responses to extract elite key"
],
"offline": false,
"options": [
"-h, --help this help",
"-t, --type <0-4> simulation type to use",
"--csn <hex> specify csn as 8 hex bytes to use with sim type 0"
],
"usage": "hf iclass sim [-h] -t <0-4> [--csn <hex>]"
},
"hf iclass sniff": {
"command": "hf iclass sniff",
"description": "sniff the communication reader and tag",
"notes": [
"hf iclass sniff",
"hf iclass sniff -j -> jam e-purse updates"
],
"offline": false,
"options": [
"-h, --help this help",
"-j, --jam jam (prevent) e-purse updates"
],
"usage": "hf iclass sniff [-hj]"
},
"hf iclass view": {
"command": "hf iclass view",
"description": "print a iclass tag dump file (bin/eml/json)",
"notes": [
"hf iclass view -f hf-iclass-aa162d30f8ff12f1-dump.bin",
"hf iclass view --first 1 -f hf-iclass-aa162d30f8ff12f1-dump.bin"
],
"offline": true,
"options": [
"-h, --help this help",
"-f, --file <fn> filename of dump (bin/eml/json)",
"--first <dec> begin printing from this block (default block 6)",
"--last <dec> end printing at this block (default 0, all)",
"-v, --verbose verbose output"
],
"usage": "hf iclass view [-hv] -f <fn> [--first <dec>] [--last <dec>]"
},
"hf iclass wrbl": {
"command": "hf iclass wrbl",
"description": "write data to an iclass tag",
"notes": [
"hf iclass wrbl -b 10 -d aaaaaaaaaaaaaaaa -k 001122334455667b",
"hf iclass wrbl -b 10 -d aaaaaaaaaaaaaaaa -k 001122334455667b --credit",
"hf iclass wrbl -b 10 -d aaaaaaaaaaaaaaaa --ki 0"
],
"offline": false,
"options": [
"-h, --help this help",
"-k, --key <hex> access key as 8 hex bytes",
"--ki <dec> key index to select key from memory 'hf iclass managekeys'",
"-b, --block <dec> the block number to read",
"-d, --data <hex> data to write as 8 hex bytes",
"--credit key is assumed to be the credit key",
"--elite elite computations applied to key",
"--raw no computations applied to key",
"--nr replay of nr/mac",
"-v, --verbose verbose output"
],
"usage": "hf iclass wrbl [-hv] [-k <hex>] [--ki <dec>] -b <dec> -d <hex> [--credit] [--elite] [--raw] [--nr]"
},
"hf jooki decode": {
"command": "hf jooki decode",
"description": "decode a base64-encode jooki token in ndef uri format",
"notes": [
"hf jooki decode -d 7wzlgezqlgwtnwny"
],
"offline": true,
"options": [
"-h, --help this help",
"-d, --data <base64> base64 url parameter",
"-v, --verbose verbose output"
],
"usage": "hf jooki decode [-hv] -d <base64>"
},
"hf jooki encode": {
"command": "hf jooki encode",
"description": "encode a jooki token to base64 ndef uri format",
"notes": [
"hf jooki encode -t -> selftest",
"hf jooki encode -r --dragon -> read uid from tag and use for encoding",
"hf jooki encode --uid 04010203040506 --dragon",
"hf jooki encode --uid 04010203040506 --tid 1 --fid 1"
],
"offline": true,
"options": [
"-h, --help this help",
"-u, --uid <hex> uid bytes",
"-r read uid from tag instead",
"-t selftest",
"-v, --verbose verbose output",
"--dragon figurine type",
"--fox figurine type",
"--ghost figurine type",
"--knight figurine type",
"--whale figurine type",
"--blackdragon figurine type",
"--blackfox figurine type",
"--blackknight figurine type",
"--blackwhale figurine type",
"--whitedragon figurine type",
"--whitefox figurine type",
"--whiteknight figurine type",
"--whitewhale figurine type",
"--tid <dec> figurine type id",
"--fid <dec> figurine id"
],
"usage": "hf jooki encode [-hrtv] [-u <hex>] [--dragon] [--fox] [--ghost] [--knight] [--whale] [--blackdragon] [--blackfox] [--blackknight] [--blackwhale] [--whitedragon] [--whitefox] [--whiteknight] [--whitewhale] [--tid <dec>] [--fid <dec>]"
},
"hf jooki help": {
"command": "hf jooki help",
"description": "help this help decode decode jooki token encode encode jooki token --------------------------------------------------------------------------------------- hf jooki clone available offline: no write a jooki token to a ultralight or ntag tag",
"notes": [
"hf jooki clone -d <hex bytes> -> where hex is raw ndef",
"hf jooki clone --b64 7wzlgezqlgwtnwny -> using base64 url parameter"
],
"offline": true,
"options": [
"-h, --help this help",
"-b, --b64 <base64> base64 url parameter",
"-d, --data <hex> raw ndef bytes",
"-p, --pwd <hex> password for authentication (ev1/ntag 4 bytes)"
],
"usage": "hf jooki clone [-h] [-b <base64>] [-d <hex>] [-p <hex>]"
},
"hf jooki sim": {
"command": "hf jooki sim",
"description": "simulate a jooki token. either `hf mfu eload` before or use `-d` param",
"notes": [
"hf jooki sim -> use token in emulator memory",
"hf jooki sim -b 7wzlgezqlgwtnwny -> using base64 url parameter"
],
"offline": false,
"options": [
"-h, --help this help",
"-b, --b64 <base64> base64 url parameter"
],
"usage": "hf jooki sim [-h] [-b <base64>]"
},
"hf ksx6924 help": {
"command": "hf ksx6924 help",
"description": "help this help --------------------------------------------------------------------------------------- hf ksx6924 balance available offline: no gets the current purse balance",
"notes": [
"hf ksx6924 balance"
],
"offline": true,
"options": [
"-h, --help this help",
"-k, --keep keep field on for next command",
"-a, --apdu show apdu reqests and responses"
],
"usage": "hf ksx6924 balance [-hka]"
},
"hf ksx6924 info": {
"command": "hf ksx6924 info",
"description": "get info about a ks x 6924 transit card. this application is used by t-money (south korea) and snapper+ (wellington, new zealand).",
"notes": [
"hf ksx6924 info"
],
"offline": false,
"options": [
"-h, --help this help",
"-k, --keep keep field on for next command",
"-a, --apdu show apdu reqests and responses"
],
"usage": "hf ksx6924 info [-hka]"
},
"hf ksx6924 initialize": {
"command": "hf ksx6924 initialize",
"description": "perform transaction initialization (mpda)",
"notes": [
"hf ksx6924 initialize 000003e8 -> mpda"
],
"offline": false,
"options": [
"-h, --help this help",
"-k, --keep keep field on for next command",
"-a, --apdu show apdu reqests and responses"
],
"usage": "hf ksx6924 initialize [-hka] <mpda 4byte hex>"
},
"hf ksx6924 prec": {
"command": "hf ksx6924 prec",
"description": "executes proprietary read record command. data format is unknown. other records are available with 'emv getrec'.",
"notes": [
"hf ksx6924 prec 0b -> read proprietary record 0x0b"
],
"offline": false,
"options": [
"-h, --help this help",
"-k, --keep keep field on for next command",
"-a, --apdu show apdu reqests and responses"
],
"usage": "hf ksx6924 prec [-hka] <record 1byte hex>"
},
"hf ksx6924 select": {
"command": "hf ksx6924 select",
"description": "selects ks x 6924 application, and leaves field up",
"notes": [
"hf ksx6924 select"
],
"offline": false,
"options": [
"-h, --help this help",
"-a, --apdu show apdu reqests and responses"
],
"usage": "hf ksx6924 select [-ha]"
},
"hf legic crc": {
"command": "hf legic crc",
"description": "calculates the legic crc8/crc16 on the given data",
"notes": [
"hf legic crc -d deadbeef1122",
"hf legic crc -d deadbeef1122 --mcc 9a -t 16 -> crc type 16"
],
"offline": true,
"options": [
"-h, --help this help",
"-d, --data <hex> bytes to calculate crc over",
"--mcc <hex> mcc hex byte (uid crc)",
"-t, --type <dec> crc type (default: 8)"
],
"usage": "hf legic crc [-h] -d <hex> [--mcc <hex>] [-t <dec>]"
},
"hf legic dump": {
"command": "hf legic dump",
"description": "read all memory from legic prime mim22, mim256, mim1024 and saves bin/eml/json dump file it autodetects card type.",
"notes": [
"hf legic dump -> use uid as filename",
"hf legic dump -f myfile -> use user specified filename",
"hf legic dump --de -> use uid as filename and deobfuscate data"
],
"offline": false,
"options": [
"-h, --help this help",
"-f, --file <fn> dump filename",
"--de deobfuscate dump data (xor with mcc)"
],
"usage": "hf legic dump [-h] [-f <fn>] [--de]"
},
"hf legic eload": {
"command": "hf legic eload",
"description": "loads a legic binary dump into emulator memory",
"notes": [
"hf legic eload -f myfile -t 0 -> simulate type mim22",
"hf legic eload -f myfile -t 1 -> simulate type mim256 (default)",
"hf legic eload -f myfile -t 2 -> simulate type mim1024"
],
"offline": true,
"options": [
"-h, --help this help",
"-f, --file <fn> filename to restore",
"-t, --type <dec> tag type to simulate.",
"--obfuscate obfuscate dump data (xor with mcc)"
],
"usage": "hf legic eload [-h] -f <fn> [-t <dec>] [--obfuscate]"
},
"hf legic esave": {
"command": "hf legic esave",
"description": "saves bin/eml/json dump file of emulator memory",
"notes": [
"hf legic esave -> uses uid as filename",
"hf legic esave -f myfile -t 0 -> type mim22",
"hf legic esave -f myfile -t 1 -> type mim256 (default)",
"hf legic esave -f myfile -t 2 -> type mim1024"
],
"offline": true,
"options": [
"-h, --help this help",
"-f, --file <fn> filename to save",
"-t, --type <dec> tag type",
"--deobfuscate de-obfuscate dump data (xor with mcc)"
],
"usage": "hf legic esave [-h] [-f <fn>] [-t <dec>] [--deobfuscate]"
},
"hf legic help": {
"command": "hf legic help",
"description": "help this help list list legic history crc calculate legic crc over given bytes eload load binary dump to emulator memory esave save emulator memory to binary file --------------------------------------------------------------------------------------- hf legic list available offline: yes alias of `trace list -t legic` with selected protocol data to annotate trace buffer you can load a trace from file (see `trace load -h`) or it be downloaded from device by default it accepts all other arguments of `trace list`. note that some might not be relevant for this specific protocol",
"notes": [
"hf legic list -f -> show frame delay times",
"hf legic list -1 -> use trace buffer"
],
"offline": true,
"options": [
"-h, --help this help",
"-1, --buffer use data from trace buffer",
"-f show frame delay times",
"-c mark crc bytes",
"-r show relative times (gap and duration)",
"-u display times in microseconds instead of clock cycles",
"-x show hexdump to convert to pcap(ng)",
"or to import into wireshark using encapsulation type \"iso 14443\"",
"--dict <file> use dictionary keys file"
],
"usage": "hf legic list [-h1fcrux] [--dict <file>]"
},
"hf legic info": {
"command": "hf legic info",
"description": "gets information from a legic prime tag like systemarea, user areas, etc",
"notes": [
"hf legic info"
],
"offline": false,
"options": [
"-h, --help this help"
],
"usage": "hf legic info [-h]"
},
"hf legic rdbl": {
"command": "hf legic rdbl",
"description": "read data from a legic prime tag",
"notes": [
"hf legic rdbl -o 0 -l 16 -> reads from byte[0] 16 bytes(system header)",
"hf legic rdbl -o 0 -l 4 --iv 55 -> reads from byte[0] 4 bytes with iv 0x55",
"hf legic rdbl -o 0 -l 256 --iv 55 -> reads from byte[0] 256 bytes with iv 0x55"
],
"offline": false,
"options": [
"-h, --help this help",
"-o, --offset <dec> offset in data array to start download from",
"-l, --length <dec> number of bytes to read",
"--iv <hex> initialization vector to use. must be odd and 7bits max"
],
"usage": "hf legic rdbl [-h] -o <dec> -l <dec> [--iv <hex>]"
},
"hf legic reader": {
"command": "hf legic reader",
"description": "read uid and type information from a legic prime tag",
"notes": [
"hf legic reader"
],
"offline": false,
"options": [
"-h, --help this help",
"-@ optional - continuous reader mode"
],
"usage": "hf legic reader [-h@]"
},
"hf legic restore": {
"command": "hf legic restore",
"description": "reads binary file and it autodetects card type and verifies that the file has the same size then write the data back to card. all bytes except the first 7bytes [uid(4) mcc(1) dcf(2)]",
"notes": [
"hf legic restore -f myfile -> use user specified filename",
"hf legic restore -f myfile --ob -> use uid as filename and obfuscate data"
],
"offline": false,
"options": [
"-h, --help this help",
"-f, --file <fn> filename to restore",
"--ob obfuscate dump data (xor with mcc)"
],
"usage": "hf legic restore [-h] -f <fn> [--ob]"
},
"hf legic sim": {
"command": "hf legic sim",
"description": "simulates a legic prime tag. mim22, mim256, mim1024 types can be emulated",
"notes": [
"hf legic sim -t 0 -> simulate type mim22",
"hf legic sim -t 1 -> simulate type mim256 (default)",
"hf legic sim -t 2 -> simulate type mim1024"
],
"offline": false,
"options": [
"-h, --help this help",
"-t, --type <dec> tag type to simulate."
],
"usage": "hf legic sim [-h] [-t <dec>]"
},
"hf legic wipe": {
"command": "hf legic wipe",
"description": "fills a legic prime tags memory with zeros. from byte7 and to the end it autodetects card type",
"notes": [
"hf legic wipe"
],
"offline": false,
"options": [
"-h, --help this help"
],
"usage": "hf legic wipe [-h]"
},
"hf legic wrbl": {
"command": "hf legic wrbl",
"description": "write data to a legic prime tag. it autodetects tagsize to ensure proper write",
"notes": [
"hf legic wrbl -o 0 -d 11223344 -> write 0x11223344 starting from offset 0)",
"hf legic wrbl -o 10 -d deadbeef -> write 0xdeadbeef starting from offset 10"
],
"offline": false,
"options": [
"-h, --help this help",
"-o, --offset <dec> offset in data array to start writing",
"-d, --data <hex> data to write",
"--danger auto-confirm dangerous operations"
],
"usage": "hf legic wrbl [-h] -o <dec> -d <hex> [--danger]"
},
"hf lto help": {
"command": "hf lto help",
"description": "help this help list list lto-cm history --------------------------------------------------------------------------------------- hf lto dump available offline: no dump data from lto tag",
"notes": [
"hf lto dump -f myfile"
],
"offline": true,
"options": [
"-h, --help this help",
"-f, --file <fn> specify a filename for dumpfile"
],
"usage": "hf lto dump [-h] [-f <fn>]"
},
"hf lto info": {
"command": "hf lto info",
"description": "get info from lto tags",
"notes": [
"hf lto info"
],
"offline": false,
"options": [
"-h, --help this help"
],
"usage": "hf lto info [-h]"
},
"hf lto list": {
"command": "hf lto list",
"description": "alias of `trace list -t lto` with selected protocol data to annotate trace buffer you can load a trace from file (see `trace load -h`) or it be downloaded from device by default it accepts all other arguments of `trace list`. note that some might not be relevant for this specific protocol",
"notes": [
"hf lto list -f -> show frame delay times",
"hf lto list -1 -> use trace buffer"
],
"offline": true,
"options": [
"-h, --help this help",
"-1, --buffer use data from trace buffer",
"-f show frame delay times",
"-c mark crc bytes",
"-r show relative times (gap and duration)",
"-u display times in microseconds instead of clock cycles",
"-x show hexdump to convert to pcap(ng)",
"or to import into wireshark using encapsulation type \"iso 14443\"",
"--dict <file> use dictionary keys file"
],
"usage": "hf lto list [-h1fcrux] [--dict <file>]"
},
"hf lto rdbl": {
"command": "hf lto rdbl",
"description": "reead blocks from lto tag",
"notes": [
"hf lto rdbl --first 0 --last 254"
],
"offline": false,
"options": [
"-h, --help this help",
"--first <dec> the first block number to read as an integer",
"--last <dec> the last block number to read as an integer"
],
"usage": "hf lto rdbl [-h] [--first <dec>] [--last <dec>]"
},
"hf lto restore": {
"command": "hf lto restore",
"description": "restore data from dumpfile to lto tag",
"notes": [
"hf lto restore -f hf-lto-92c7842cff.bin|.eml"
],
"offline": false,
"options": [
"-h, --help this help",
"-f, --file <fn> specify a filename for dumpfile"
],
"usage": "hf lto restore [-h] -f <fn>"
},
"hf lto wrbl": {
"command": "hf lto wrbl",
"description": "write data to block on lto tag",
"notes": [
"hf lto wrbl --block 128 -d 0001020304050607080910111213141516171819202122232425262728293031"
],
"offline": false,
"options": [
"-h, --help this help",
"-d, --data <hex> 32 bytes of data to write (64 hex symbols, no spaces)",
"--block <dec> the block number to write to as an integer"
],
"usage": "hf lto wrbl [-h] -d <hex> --block <dec>"
},
"hf mf acl": {
"command": "hf mf acl",
"description": "print decoded mifare access rights (acl), a = key a b = key b ab = both key a and b access = access bytes inside sector trailer block increment, decrement, transfer, restore is for value blocks",
"notes": [
"hf mf acl",
"hf mf acl -d ff0780"
],
"offline": true,
"options": [
"-h, --help this help",
"-d, --data <hex> acl bytes specified as 3 hex bytes"
],
"usage": "hf mf acl [-h] -d <hex>"
},
"hf mf auth4": {
"command": "hf mf auth4",
"description": "executes aes authentication command in iso14443-4",
"notes": [
"hf mf auth4 4000 000102030405060708090a0b0c0d0e0f -> executes authentication",
"hf mf auth4 9003 ffffffffffffffffffffffffffffffff -> executes authentication"
],
"offline": false,
"options": [
"-h, --help this help"
],
"usage": "hf mf auth4 [-h] <key num (hex 2 bytes)> <key value (hex 16 bytes)>"
},
"hf mf autopwn": {
"command": "hf mf autopwn",
"description": "this command automates the key recovery process on mifare classic cards. it uses the fchk, chk, darkside, nested, hardnested and staticnested to recover keys. if all keys are found, it try dumping card content both to file and emulator memory.",
"notes": [
"hf mf autopwn",
"hf mf autopwn -s 0 -a -k ffffffffffff -> target mfc 1k card, sector 0 with known key a 'ffffffffffff'",
"hf mf autopwn --1k -f mfc_default_keys -> target mfc 1k card, default dictionary",
"hf mf autopwn --1k -s 0 -a -k ffffffffffff -f mfc_default_keys -> combo of the two above samples"
],
"offline": false,
"options": [
"-h, --help this help",
"-k, --key <hex> known key, 12 hex bytes",
"-s, --sector <dec> input sector number",
"-a input key a (def)",
"-b input key b",
"-f, --file <fn> filename of dictionary",
"-s, --slow slower acquisition (required by some non standard cards)",
"-l, --legacy legacy mode (use the slow `hf mf chk`)",
"-v, --verbose verbose output (statistics)",
"--mini mifare classic mini / s20",
"--1k mifare classic 1k / s50 (default)",
"--2k mifare classic/plus 2k",
"--4k mifare classic 4k / s70",
"--in none (use cpu regular instruction set)",
"--im mmx",
"--is sse2",
"--ia avx",
"--i2 avx2",
"--i5 avx512"
],
"usage": "hf mf autopwn [-habslv] [-k <hex>] [-s <dec>] [-f <fn>] [--mini] [--1k] [--2k] [--4k] [--in] [--im] [--is] [--ia] [--i2] [--i5]"
},
"hf mf cgetblk": {
"command": "hf mf cgetblk",
"description": "get block data from magic chinese card. only works with magic gen1a cards",
"notes": [
"hf mf cgetblk --blk 0 -> get block 0 (manufacturer)",
"hf mf cgetblk --blk 3 -v -> get block 3, decode sector trailer"
],
"offline": false,
"options": [
"-h, --help this help",
"-b, --blk <dec> block number",
"-v, --verbose verbose output"
],
"usage": "hf mf cgetblk [-hv] -b <dec>"
},
"hf mf cgetsc": {
"command": "hf mf cgetsc",
"description": "get sector data from magic chinese card. only works with magic gen1a cards",
"notes": [
"hf mf cgetsc -s 0"
],
"offline": false,
"options": [
"-h, --help this help",
"-s, --sec <dec> sector number",
"-v, --verbose verbose output"
],
"usage": "hf mf cgetsc [-hv] -s <dec>"
},
"hf mf chk": {
"command": "hf mf chk",
"description": "check keys on mifare classic card",
"notes": [
"hf mf chk --mini -k ffffffffffff -> check all sectors, all keys against mifare mini",
"hf mf chk --1k -k ffffffffffff -> check all sectors, all keys against mifare classic 1k",
"hf mf chk --2k -k ffffffffffff -> check all sectors, all keys against mifare 2k",
"hf mf chk --4k -k ffffffffffff -> check all sectors, all keys against mifare 4k",
"hf mf chk --1k --emu -> check all sectors, all keys, 1k, and write to emulator memory",
"hf mf chk --1k --dump -> check all sectors, all keys, 1k, and write to file",
"hf mf chk -a --blk 0 -f mfc_default_keys.dic -> check dictionary against block 0, key a"
],
"offline": false,
"options": [
"-h, --help this help",
"-k, --key <hex> key specified as 12 hex symbols",
"--blk <dec> input block number",
"-a target key a, if found also check key b for duplicate",
"-b target key b",
"-*, --all target both key a & b (default)",
"--mini mifare classic mini / s20",
"--1k mifare classic 1k / s50 (default)",
"--2k mifare classic/plus 2k",
"--4k mifare classic 4k / s70",
"--emu fill simulator keys from found keys",
"--dump dump found keys to binary file",
"-f, --file <fn> filename of dictionary"
],
"usage": "hf mf chk [-hab*] [-k <hex>]... [--blk <dec>] [--mini] [--1k] [--2k] [--4k] [--emu] [--dump] [-f <fn>]"
},
"hf mf cload": {
"command": "hf mf cload",
"description": "load magic gen1a card with data from (bin/eml/json) dump file or from emulator memory.",
"notes": [
"hf mf cload --emu",
"hf mf cload -f hf-mf-01020304.eml"
],
"offline": false,
"options": [
"-h, --help this help",
"-f, --file <fn> filename of dump",
"--emu from emulator memory"
],
"usage": "hf mf cload [-h] [-f <fn>] [--emu]"
},
"hf mf csave": {
"command": "hf mf csave",
"description": "save magic gen1a card memory into three files (bin/eml/json)or into emulator memory",
"notes": [
"hf mf csave",
"hf mf csave --4k"
],
"offline": false,
"options": [
"-h, --help this help",
"-f, --file <fn> filename of dump",
"--mini mifare classic mini / s20",
"--1k mifare classic 1k / s50 (def)",
"--2k mifare classic/plus 2k",
"--4k mifare classic 4k / s70",
"--emu from emulator memory"
],
"usage": "hf mf csave [-h] [-f <fn>] [--mini] [--1k] [--2k] [--4k] [--emu]"
},
"hf mf csetblk": {
"command": "hf mf csetblk",
"description": "set block data on a magic gen1a card",
"notes": [
"hf mf csetblk --blk 1 -d 000102030405060708090a0b0c0d0e0f"
],
"offline": false,
"options": [
"-h, --help this help",
"-b, --blk <dec> block number",
"-d, --data <hex> bytes to write, 16 hex bytes",
"-w, --wipe wipes card with backdoor cmd before writing"
],
"usage": "hf mf csetblk [-hw] -b <dec> [-d <hex>]"
},
"hf mf csetuid": {
"command": "hf mf csetuid",
"description": "set uid, atqa, and sak for magic gen1a card",
"notes": [
"hf mf csetuid -u 01020304",
"hf mf csetuid -w -u 01020304 --atqa 0004 --sak 08"
],
"offline": false,
"options": [
"-h, --help this help",
"-w, --wipe wipes card with backdoor cmd`",
"-u, --uid <hex> uid, 4/7 hex bytes",
"-a, --atqa <hex> atqa, 2 hex bytes",
"-s, --sak <hex> sak, 1 hex byte"
],
"usage": "hf mf csetuid [-hw] [-u <hex>] [-a <hex>] [-s <hex>]"
},
"hf mf cview": {
"command": "hf mf cview",
"description": "view `magic gen1a` card memory",
"notes": [
"hf mf cview",
"hf mf cview --4k"
],
"offline": false,
"options": [
"-h, --help this help",
"--mini mifare classic mini / s20",
"--1k mifare classic 1k / s50 (def)",
"--2k mifare classic/plus 2k",
"--4k mifare classic 4k / s70"
],
"usage": "hf mf cview [-h] [--mini] [--1k] [--2k] [--4k]"
},
"hf mf cwipe": {
"command": "hf mf cwipe",
"description": "wipe gen1 magic chinese card. set uid / atqa / sak / data / keys / access to default values",
"notes": [
"hf mf cwipe",
"hf mf cwipe -u 09080706 -a 0004 -s 18 -> set uid, atqa and sak and wipe card"
],
"offline": false,
"options": [
"-h, --help this help",
"-u, --uid <hex> uid, 4 hex bytes",
"-a, --atqa <hex> atqa, 2 hex bytes",
"-s, --sak <hex> sak, 1 hex byte"
],
"usage": "hf mf cwipe [-h] [-u <hex>] [-a <hex>] [-s <hex>]"
},
"hf mf darkside": {
"command": "hf mf darkside",
"description": "darkside attack",
"notes": [
"hf mf darkside",
"hf mf darkside --blk 16",
"hf mf darkside --blk 16 -b"
],
"offline": false,
"options": [
"-h, --help this help",
"--blk <dec> target block",
"-b target key b instead of default key a"
],
"usage": "hf mf darkside [-hb] [--blk <dec> ]"
},
"hf mf decrypt": {
"command": "hf mf decrypt",
"description": "decrypt crypto-1 encrypted bytes given some known state of crypto. see tracelog to gather needed values",
"notes": [
"hf mf decrypt --nt b830049b --ar 9248314a --at 9280e203 -d 41e586f9",
"-> 41e586f9 becomes 3003999a",
"-> which annotates 30 03 [99 9a] read block 3 [crc]"
],
"offline": true,
"options": [
"-h, --help this help",
"--nt <hex> tag nonce",
"--ar <hex> ar_enc, encrypted reader response",
"--at <hex> at_enc, encrypted tag response",
"-d, --data <hex> encrypted data, taken directly after at_enc and forward"
],
"usage": "hf mf decrypt [-h] --nt <hex> --ar <hex> --at <hex> -d <hex>"
},
"hf mf dump": {
"command": "hf mf dump",
"description": "dump mifare classic tag to binary file if no <name> given, uid will be used as filename",
"notes": [
"hf mf dump --mini -> mifare mini",
"hf mf dump --1k -> mifare classic 1k",
"hf mf dump --2k -> mifare 2k",
"hf mf dump --4k -> mifare 4k",
"hf mf dump --keys hf-mf-066c8b78-key.bin -> mifare 1k with keys from specified file"
],
"offline": false,
"options": [
"-h, --help this help",
"-f, --file <fn> filename of dump",
"-k, --keys <fn> filename of keys",
"--mini mifare classic mini / s20",
"--1k mifare classic 1k / s50 (def)",
"--2k mifare classic/plus 2k",
"--4k mifare classic 4k / s70"
],
"usage": "hf mf dump [-h] [-f <fn>] [-k <fn>] [--mini] [--1k] [--2k] [--4k]"
},
"hf mf ecfill": {
"command": "hf mf ecfill",
"description": "dump card and transfer the data to emulator memory. keys must be laid in the emulator memory",
"notes": [
"hf mf ecfill -> use key type a",
"hf mf ecfill --4k -b -> target 4k card with key type b"
],
"offline": false,
"options": [
"-h, --help this help",
"-a input key type is key a(def)",
"-b input key type is key b",
"--mini mifare classic mini / s20",
"--1k mifare classic 1k / s50 (def)",
"--2k mifare classic/plus 2k",
"--4k mifare classic 4k / s70"
],
"usage": "hf mf ecfill [-hab] [--mini] [--1k] [--2k] [--4k]"
},
"hf mf eclr": {
"command": "hf mf eclr",
"description": "it set card emulator memory to empty data blocks and key a/b ffffffffffff",
"notes": [
"hf mf eclr"
],
"offline": false,
"options": [
"-h, --help this help"
],
"usage": "hf mf eclr [-h]"
},
"hf mf egetblk": {
"command": "hf mf egetblk",
"description": "get emulator memory block",
"notes": [
"hf mf egetblk --blk 0 -> get block 0 (manufacturer)",
"hf mf egetblk --blk 3 -v -> get block 3, decode sector trailer"
],
"offline": false,
"options": [
"-h, --help this help",
"-b, --blk <dec> block number",
"-v, --verbose verbose output"
],
"usage": "hf mf egetblk [-hv] -b <dec>"
},
"hf mf egetsc": {
"command": "hf mf egetsc",
"description": "get emulator memory sector",
"notes": [
"hf mf egetsc -s 0"
],
"offline": false,
"options": [
"-h, --help this help",
"-s, --sec <dec> sector number",
"-v, --verbose verbose output"
],
"usage": "hf mf egetsc [-hv] -s <dec>"
},
"hf mf ekeyprn": {
"command": "hf mf ekeyprn",
"description": "download and print the keys from emulator memory",
"notes": [
"hf mf ekeyprn --1k -> print mfc 1k keyset",
"hf mf ekeyprn -w -> write keys to binary file"
],
"offline": false,
"options": [
"-h, --help this help",
"-w, --write write keys to binary file `hf-mf-<uid>-key.bin`",
"--mini mifare classic mini / s20",
"--1k mifare classic 1k / s50 (def)",
"--2k mifare classic/plus 2k",
"--4k mifare classic 4k / s70"
],
"usage": "hf mf ekeyprn [-hw] [--mini] [--1k] [--2k] [--4k]"
},
"hf mf eload": {
"command": "hf mf eload",
"description": "load emulator memory with data from (bin/eml/json) dump file",
"notes": [
"hf mf eload -f hf-mf-01020304.bin",
"hf mf eload --4k -f hf-mf-01020304.eml"
],
"offline": false,
"options": [
"-h, --help this help",
"-f, --file <fn> filename of dump",
"--mini mifare classic mini / s20",
"--1k mifare classic 1k / s50 (def)",
"--2k mifare classic/plus 2k",
"--4k mifare classic 4k / s70",
"--ul mifare ultralight family",
"-q, --qty <dec> manually set number of blocks (overrides)"
],
"usage": "hf mf eload [-h] -f <fn> [--mini] [--1k] [--2k] [--4k] [--ul] [-q <dec>]"
},
"hf mf esave": {
"command": "hf mf esave",
"description": "save emulator memory into three files (bin/eml/json)",
"notes": [
"hf mf esave",
"hf mf esave --4k",
"hf mf esave --4k -f hf-mf-01020304.eml"
],
"offline": false,
"options": [
"-h, --help this help",
"-f, --file <fn> filename of dump",
"--mini mifare classic mini / s20",
"--1k mifare classic 1k / s50 (def)",
"--2k mifare classic/plus 2k",
"--4k mifare classic 4k / s70"
],
"usage": "hf mf esave [-h] [-f <fn>] [--mini] [--1k] [--2k] [--4k]"
},
"hf mf esetblk": {
"command": "hf mf esetblk",
"description": "set emulator memory block",
"notes": [
"hf mf esetblk --blk 1 -d 000102030405060708090a0b0c0d0e0f"
],
"offline": false,
"options": [
"-h, --help this help",
"-b, --blk <dec> block number",
"-d, --data <hex> bytes to write, 16 hex bytes"
],
"usage": "hf mf esetblk [-h] -b <dec> [-d <hex>]"
},
"hf mf eview": {
"command": "hf mf eview",
"description": "it displays emulator memory",
"notes": [
"hf mf eview",
"hf mf eview --4k"
],
"offline": false,
"options": [
"-h, --help this help",
"--mini mifare classic mini / s20",
"--1k mifare classic 1k / s50 (def)",
"--2k mifare classic/plus 2k",
"--4k mifare classic 4k / s70"
],
"usage": "hf mf eview [-h] [--mini] [--1k] [--2k] [--4k]"
},
"hf mf fchk": {
"command": "hf mf fchk",
"description": "this is a improved checkkeys method speedwise. it checks mifare classic tags sector keys against a dictionary file with keys",
"notes": [
"hf mf fchk --mini -k ffffffffffff -> key recovery against mifare mini",
"hf mf fchk --1k -k ffffffffffff -> key recovery against mifare classic 1k",
"hf mf fchk --2k -k ffffffffffff -> key recovery against mifare 2k",
"hf mf fchk --4k -k ffffffffffff -> key recovery against mifare 4k",
"hf mf fchk --1k -f mfc_default_keys.dic -> target 1k using default dictionary file",
"hf mf fchk --1k --emu -> target 1k, write keys to emulator memory",
"hf mf fchk --1k --dump -> target 1k, write keys to file",
"hf mf fchk --1k --mem -> target 1k, use dictionary from flash memory"
],
"offline": false,
"options": [
"-h, --help this help",
"-k, --key <hex> key specified as 12 hex symbols",
"--mini mifare classic mini / s20",
"--1k mifare classic 1k / s50 (default)",
"--2k mifare classic/plus 2k",
"--4k mifare classic 4k / s70",
"--emu fill simulator keys from found keys",
"--dump dump found keys to binary file",
"--mem use dictionary from flashmemory",
"-f, --file <fn> filename of dictionary"
],
"usage": "hf mf fchk [-h] [-k <hex>]... [--mini] [--1k] [--2k] [--4k] [--emu] [--dump] [--mem] [-f <fn>]"
},
"hf mf gen3blk": {
"command": "hf mf gen3blk",
"description": "overwrite full manufacturer block for magic gen3 card - you can specify part of manufacturer block as 4/7-bytes for uid change only note: bcc, sak, atqa will be calculated automatically",
"notes": [
"hf mf gen3blk -> print current data",
"hf mf gen3blk -d 01020304 -> set 4 byte uid",
"hf mf gen3blk -d 01020304050607 -> set 7 byte uid",
"hf mf gen3blk -d 01020304ffffffff0102030405060708"
],
"offline": false,
"options": [
"-h, --help this help",
"-d, --data <hex> manufacturer block data up to 16 hex bytes"
],
"usage": "hf mf gen3blk [-h] [-d <hex>]"
},
"hf mf gen3freeze": {
"command": "hf mf gen3freeze",
"description": "perma lock further uid changes. no more uid changes available after operation completed note: operation is ! irreversible !",
"notes": [
"hf mf gen3freeze -y"
],
"offline": false,
"options": [
"-h, --help this help",
"-y, --yes confirm uid lock operation"
],
"usage": "hf mf gen3freeze -y[h]"
},
"hf mf gen3uid": {
"command": "hf mf gen3uid",
"description": "set uid for magic gen3 card _without_ changes to manufacturer block 0",
"notes": [
"hf mf gen3uid --uid 01020304 -> set 4 byte uid",
"hf mf gen3uid --uid 01020304050607 -> set 7 byte uid"
],
"offline": false,
"options": [
"-h, --help this help",
"-u, --uid <hex> uid 4/7 hex bytes"
],
"usage": "hf mf gen3uid [-h] [-u <hex>]"
},
"hf mf gview": {
"command": "hf mf gview",
"description": "view `magic gen4 gtu` card memory",
"notes": [
"hf mf gview",
"hf mf gview --4k"
],
"offline": false,
"options": [
"-h, --help this help",
"--mini mifare classic mini / s20",
"--1k mifare classic 1k / s50 (def)",
"--2k mifare classic/plus 2k",
"--4k mifare classic 4k / s70",
"-p, --pwd <hex> password 4bytes"
],
"usage": "hf mf gview [-h] [--mini] [--1k] [--2k] [--4k] [-p <hex>]"
},
"hf mf hardnested": {
"command": "hf mf hardnested",
"description": "nested attack for hardened mifare classic cards. `--i<x>` set type of simd instructions. without this flag programs autodetect it. or hf mf hardnested -r --tk [known target key] add the known target key to check if it is present in the remaining key space hf mf hardnested --blk 0 -a -k a0a1a2a3a4a5 --tblk 4 --ta --tk ffffffffffff",
"notes": [
"hf mf hardnested --blk 0 -a -k ffffffffffff --tblk 4 --ta",
"hf mf hardnested --blk 0 -a -k ffffffffffff --tblk 4 --ta -w",
"hf mf hardnested --blk 0 -a -k ffffffffffff --tblk 4 --ta -f nonces.bin -w -s",
"hf mf hardnested -r",
"hf mf hardnested -r --tk a0a1a2a3a4a5",
"hf mf hardnested -t --tk a0a1a2a3a4a5",
"hf mf hardnested --blk 0 -a -k a0a1a2a3a4a5 --tblk 4 --ta --tk ffffffffffff"
],
"offline": true,
"options": [
"-h, --help this help",
"-k, --key <hex> key, 12 hex bytes",
"--blk <dec> input block number",
"-a input key a (def)",
"-b input key b",
"--tblk <dec> target block number",
"--ta target key a",
"--tb target key b",
"--tk <hex> target key, 12 hex bytes",
"-u, --uid <hex> r/w `hf-mf-<uid>-nonces.bin` instead of default name",
"-f, --file <fn> r/w <name> instead of default name",
"-r, --read read `hf-mf-<uid>-nonces.bin` if tag present, otherwise `nonces.bin`, and start attack",
"-s, --slow slower acquisition (required by some non standard cards)",
"-t, --tests run tests",
"-w, --wr acquire nonces and uid, and write them to file `hf-mf-<uid>-nonces.bin`",
"--in none (use cpu regular instruction set)",
"--im mmx",
"--is sse2",
"--ia avx",
"--i2 avx2",
"--i5 avx512"
],
"usage": "hf mf hardnested [-habrstw] [-k <hex>] [--blk <dec>] [--tblk <dec>] [--ta] [--tb] [--tk <hex>] [-u <hex>] [-f <fn>] [--in] [--im] [--is] [--ia] [--i2] [--i5]"
},
"hf mf help": {
"command": "hf mf help",
"description": "help this help list list mifare history hardnested nested attack for hardened mifare classic cards decrypt [nt] [ar_enc] [at_enc] [data] - to decrypt sniff or trace acl decode and print mifare classic access rights bytes view display content from tag dump file --------------------------------------------------------------------------------------- hf mf list available offline: yes alias of `trace list -t mf` with selected protocol data to annotate trace buffer you can load a trace from file (see `trace load -h`) or it be downloaded from device by default it accepts all other arguments of `trace list`. note that some might not be relevant for this specific protocol",
"notes": [
"hf mf list -f -> show frame delay times",
"hf mf list -1 -> use trace buffer"
],
"offline": true,
"options": [
"-h, --help this help",
"-1, --buffer use data from trace buffer",
"-f show frame delay times",
"-c mark crc bytes",
"-r show relative times (gap and duration)",
"-u display times in microseconds instead of clock cycles",
"-x show hexdump to convert to pcap(ng)",
"or to import into wireshark using encapsulation type \"iso 14443\"",
"--dict <file> use dictionary keys file"
],
"usage": "hf mf list [-h1fcrux] [--dict <file>]"
},
"hf mf mad": {
"command": "hf mf mad",
"description": "checks and prints mifare application directory (mad)",
"notes": [
"hf mf mad -> shows mad if exists",
"hf mf mad --aid e103 -k ffffffffffff -b -> shows ndef data if exists. read card with custom key and key b",
"hf mf mad --dch -k ffffffffffff -> decode cardholder information"
],
"offline": false,
"options": [
"-h, --help this help",
"-v, --verbose show technical data",
"--aid <aid> print all sectors with specified aid",
"-k, --key <key> key for printing sectors",
"-b, --keyb use key b for access printing sectors (by default: key a)",
"--be (optional, bigendian)",
"--dch decode card holder information"
],
"usage": "hf mf mad [-hvb] [--aid <aid>] [-k <key>] [--be] [--dch]"
},
"hf mf nack": {
"command": "hf mf nack",
"description": "test a mifare classic based card for the nack bug",
"notes": [
"hf mf nack"
],
"offline": false,
"options": [
"-h, --help this help",
"-v, --verbose verbose output`"
],
"usage": "hf mf nack [-hv]"
},
"hf mf ndefread": {
"command": "hf mf ndefread",
"description": "prints nfc data exchange format (ndef)",
"notes": [
"hf mf ndefread -> shows ndef parsed data",
"hf mf ndefread -vv -> shows ndef parsed and raw data",
"hf mf ndefread --aid e103 -k ffffffffffff -b -> shows ndef data with custom aid, key and with key b",
"hf mf ndefread -f myfilename -> save raw ndef to file"
],
"offline": false,
"options": [
"-h, --help this help",
"-v, --verbose show technical data",
"--aid <aid> replace default aid for ndef",
"-k, --key <key> replace default key for ndef",
"-b, --keyb use key b for access sectors (by default: key a)",
"-f, --file <fn> save raw ndef to file"
],
"usage": "hf mf ndefread [-hvb] [--aid <aid>] [-k <key>] [-f <fn>]"
},
"hf mf nested": {
"command": "hf mf nested",
"description": "execute nested attack against mifare classic card for key recovery",
"notes": [
"hf mf nested --single --blk 0 -a ffffffffffff --tblk 4 --ta -> single sector key recovery. use block 0 key a to find block 4 key a",
"hf mf nested --mini --blk 0 -a -k ffffffffffff -> key recovery against mifare mini",
"hf mf nested --1k --blk 0 -a -k ffffffffffff -> key recovery against mifare classic 1k",
"hf mf nested --2k --blk 0 -a -k ffffffffffff -> key recovery against mifare 2k",
"hf mf nested --4k --blk 0 -a -k ffffffffffff -> key recovery against mifare 4k"
],
"offline": false,
"options": [
"-h, --help this help",
"-k, --key <hex> key specified as 12 hex symbols",
"--mini mifare classic mini / s20",
"--1k mifare classic 1k / s50",
"--2k mifare classic/plus 2k",
"--4k mifare classic 4k / s70",
"--blk <dec> input block number",
"-a input key specified is a key (default)",
"-b input key specified is b key",
"--tblk <dec> target block number",
"--ta target a key (default)",
"--tb target b key",
"--emu fill simulator keys from found keys",
"--dump dump found keys to file",
"--single single sector (defaults to all)",
"--mem use dictionary from flashmemory"
],
"usage": "hf mf nested [-hab] [-k <hex>] [--mini] [--1k] [--2k] [--4k] [--blk <dec>] [--tblk <dec>] [--ta] [--tb] [--emu] [--dump] [--single] [--mem]"
},
"hf mf personalize": {
"command": "hf mf personalize",
"description": "personalize the uid of a mifare classic ev1 card. this is only possible if it is a 7byte uid card and if it is not already personalized.",
"notes": [
"hf mf personalize --f0 -> double size uid",
"hf mf personalize --f1 -> double size uid, optional usage of selection process shortcut",
"hf mf personalize --f2 -> single size random id",
"hf mf personalize --f3 -> single size nuid",
"hf mf personalize -b -k b0b1b2b3b4b5 --f3 -> use key b = 0xb0b1b2b3b4b5"
],
"offline": false,
"options": [
"-h, --help this help",
"-a use key a to authenticate sector 0 (def)",
"-b use key b to authenticate sector 0",
"-k, --key <hex> key (def ffffffffffff)",
"--f0 uidfo, double size uid",
"--f1 uidf1, double size uid, optional usage of selection process shortcut",
"--f2 uidf2, single size random id",
"--f3 uidf3, single size nuid"
],
"usage": "hf mf personalize [-hab] [-k <hex>] [--f0] [--f1] [--f2] [--f3]"
},
"hf mf rdbl": {
"command": "hf mf rdbl",
"description": "read mifare classic block",
"notes": [
"hf mf rdbl --blk 0 -k ffffffffffff",
"hf mf rdbl --blk 3 -v -> get block 3, decode sector trailer"
],
"offline": false,
"options": [
"-h, --help this help",
"--blk <dec> block number",
"-a input key type is key a (def)",
"-b input key type is key b",
"-k, --key <hex> key, 6 hex bytes",
"-v, --verbose verbose output"
],
"usage": "hf mf rdbl [-habv] --blk <dec> [-k <hex>]"
},
"hf mf rdsc": {
"command": "hf mf rdsc",
"description": "read mifare classic sector",
"notes": [
"hf mf rdsc -s 0 -k ffffffffffff"
],
"offline": false,
"options": [
"-h, --help this help",
"-a input key specified is a key (def)",
"-b input key specified is b key",
"-k, --key <hex> key specified as 6 hex bytes",
"-s, --sec <dec> sector number",
"-v, --verbose verbose output"
],
"usage": "hf mf rdsc [-habv] [-k <hex>] -s <dec>"
},
"hf mf restore": {
"command": "hf mf restore",
"description": "restore mifare classic dump file to tag. the key file and dump file will program the card sector trailers. by default we authenticate to card with key b 0xffffffffffff. if access rights in dump file is all zeros, it will be replaced with default values `--uid` param is used for filename templates `hf-mf-<uid>-dump.bin` and `hf-mf-<uid>-key.bin. if not specified, it will read the card uid instead. `--ka` param you can indicate that the key file should be used for authentication instead. if so we also try both b/a keys",
"notes": [
"hf mf restore",
"hf mf restore --1k --uid 04010203",
"hf mf restore --1k --uid 04010203 -k hf-mf-aabbccdd-key.bin",
"hf mf restore --4k"
],
"offline": false,
"options": [
"-h, --help this help",
"--mini mifare classic mini / s20",
"--1k mifare classic 1k / s50 (def)",
"--2k mifare classic/plus 2k",
"--4k mifare classic 4k / s70",
"-u, --uid <hex> uid, 6 hex bytes",
"-f, --file <fn> specify dump filename (bin/eml/json)",
"-k, --kfn <fn> key filename",
"--ka use specified keyfile to authenticate"
],
"usage": "hf mf restore [-h] [--mini] [--1k] [--2k] [--4k] [-u <hex>] [-f <fn>] [-k <fn>] [--ka]"
},
"hf mf setmod": {
"command": "hf mf setmod",
"description": "sets the load modulation strength of a mifare classic ev1 card",
"notes": [
"hf mf setmod -k ffffffffffff -0"
],
"offline": false,
"options": [
"-h, --help this help",
"-0 normal modulation",
"-1 strong modulation (def)",
"-k, --key <hex> key a, sector 0, 6 hex bytes"
],
"usage": "hf mf setmod [-h01] [-k <hex>]"
},
"hf mf sim": {
"command": "hf mf sim",
"description": "simulate mifare classic card",
"notes": [
"hf mf sim --mini -> mifare mini",
"hf mf sim --1k -> mifare classic 1k (default)",
"hf mf sim --1k -u 0a0a0a0a -> mifare classic 1k with 4b uid",
"hf mf sim --1k -u 11223344556677 -> mifare classic 1k with 7b uid",
"hf mf sim --1k -u 11223344 -i -x -> perform reader attack in interactive mode",
"hf mf sim --2k -> mifare 2k",
"hf mf sim --4k -> mifare 4k"
],
"offline": false,
"options": [
"-h, --help this help",
"-u, --uid <hex> uid 4,7 or 10bytes. if not specified, the uid 4b/7b from emulator memory will be used",
"--mini mifare classic mini / s20",
"--1k mifare classic 1k / s50",
"--2k mifare classic/plus 2k",
"--4k mifare classic 4k / s70",
"--atqa <hex> provide explicit atqa (2 bytes, overrides option t)",
"--sak <hex> provide explicit sak (1 bytes, overrides option t)",
"-n, --num <dec> automatically exit simulation after <numreads> blocks have been read by reader. 0 = infinite",
"-i, --interactive console will not be returned until simulation finishes or is aborted",
"-x performs the 'reader attack', nr/ar attack against a reader",
"-e, --emukeys fill simulator keys from found keys",
"-v, --verbose verbose output",
"--cve trigger cve 2021_0430"
],
"usage": "hf mf sim [-hixev] [-u <hex>] [--mini] [--1k] [--2k] [--4k] [--atqa <hex>] [--sak <hex>] [-n <dec> ] [--cve]"
},
"hf mf staticnested": {
"command": "hf mf staticnested",
"description": "execute nested attack against mifare classic card with static nonce for key recovery. supply a known key from one block to recover all keys",
"notes": [
"hf mf staticnested --mini --blk 0 -a -k ffffffffffff",
"hf mf staticnested --1k --blk 0 -a -k ffffffffffff",
"hf mf staticnested --2k --blk 0 -a -k ffffffffffff",
"hf mf staticnested --4k --blk 0 -a -k ffffffffffff"
],
"offline": false,
"options": [
"-h, --help this help",
"-k, --key <hex> known key (12 hex symbols)",
"--mini mifare classic mini / s20",
"--1k mifare classic 1k / s50",
"--2k mifare classic/plus 2k",
"--4k mifare classic 4k / s70",
"--blk <dec> input block number",
"-a input key specified is keya (def)",
"-b input key specified is keyb",
"-e, --emukeys fill simulator keys from found keys",
"--dumpkeys dump found keys to file"
],
"usage": "hf mf staticnested [-habe] [-k <hex>] [--mini] [--1k] [--2k] [--4k] [--blk <dec>] [--dumpkeys]"
},
"hf mf supercard": {
"command": "hf mf supercard",
"description": "extract info from a `super card`",
"notes": [
"hf mf supercard"
],
"offline": false,
"options": [
"-h, --help this help",
"-r, --reset reset card"
],
"usage": "hf mf supercard [-hr]"
},
"hf mf view": {
"command": "hf mf view",
"description": "print a mifare classic dump file (bin/eml/json)",
"notes": [
"hf mf view -f hf-mf-01020304-dump.bin"
],
"offline": true,
"options": [
"-h, --help this help",
"-f, --file <fn> filename of dump",
"-v, --verbose verbose output"
],
"usage": "hf mf view [-hv] -f <fn>"
},
"hf mf wipe": {
"command": "hf mf wipe",
"description": "wipe card to zeros and default keys/acc. this command takes a key file to wipe card will use uid from card to generate keyfile name if not specified. new a/b keys..... ff ff ff ff ff ff new acc rights... ff 07 80 new gpb.......... 69",
"notes": [
"hf mf wipe -> reads card uid to generate file name",
"hf mf wipe --gen2 -> force write to s0, b0 manufacture block",
"hf mf wipe -f mykey.bin -> use mykey.bin"
],
"offline": false,
"options": [
"-h, --help this help",
"-f, --file <fn> key filename",
"--gen2 force write to sector 0, block 0 (gen2)"
],
"usage": "hf mf wipe [-h] [-f <fn>] [--gen2]"
},
"hf mf wrbl": {
"command": "hf mf wrbl",
"description": "write mifare classic block",
"notes": [
"hf mf wrbl --blk 1 -k ffffffffffff -d 000102030405060708090a0b0c0d0e0f"
],
"offline": false,
"options": [
"-h, --help this help",
"--blk <dec> block number",
"-a input key type is key a (def)",
"-b input key type is key b",
"-k, --key <hex> key, 6 hex bytes",
"-d, --data <hex> bytes to write, 16 hex bytes"
],
"usage": "hf mf wrbl [-hab] --blk <dec> [-k <hex>] [-d <hex>]"
},
"hf mfdes auth": {
"command": "hf mfdes auth",
"description": "select application on the card. it selects app if it is a valid one or returns an error.",
"notes": [
"hf mfdes auth -n 0 -t des -k 0000000000000000 -f none -> select picc level and authenticate with key num=0, key type=des, key=00..00 and key derivation = none",
"hf mfdes auth -n 0 -t aes -k 00000000000000000000000000000000 -> select picc level and authenticate with key num=0, key type=aes, key=00..00 and key derivation = none",
"hf mfdes auth -n 0 -t des -k 0000000000000000 --save -> select picc level and authenticate and in case of successful authentication - save channel parameters to defaults",
"hf mfdes auth --aid 123456 -> select application 123456 and authenticate via parameters from `default` command"
],
"offline": false,
"options": [
"-h, --help this help",
"-a, --apdu show apdu requests and responses",
"-v, --verbose show technical data",
"-n, --keyno <dec> key number",
"-t, --algo <des|2tdea|3tdea|aes> crypt algo: des, 2tdea, 3tdea, aes",
"-k, --key <hex> key for authenticate (hex 8(des), 16(2tdea or aes) or 24(3tdea) bytes)",
"-f, --kdf <none|an10922|gallagher> key derivation function (kdf): none, an10922, gallagher",
"-i, --kdfi <hex> kdf input (hex 1-31 bytes)",
"-m, --cmode <plain|mac|encrypt> communicaton mode: plain/mac/encrypt",
"-c, --ccset <native|niso|iso> communicaton command set: native/niso/iso",
"-s, --schann <d40|ev1|ev2|lrp> secure channel: d40/ev1/ev2/lrp",
"--aid <hex> application id of application for some parameters (3 hex bytes, big endian)",
"--appisoid <hex> application iso id (iso df id) (2 hex bytes, big endian).",
"--save saves channels parameters to defaults if authentication succeeds"
],
"usage": "hf mfdes auth [-hav] [-n <dec>] [-t <des|2tdea|3tdea|aes>] [-k <hex>] [-f <none|an10922|gallagher>] [-i <hex>] [-m <plain|mac|encrypt>] [-c <native|niso|iso>] [-s <d40|ev1|ev2|lrp>] [--aid <hex>] [--appisoid <hex>] [--save]"
},
"hf mfdes bruteaid": {
"command": "hf mfdes bruteaid",
"description": "recover aids by bruteforce. warning: this command takes a loooong time",
"notes": [
"hf mfdes bruteaid -> search all apps",
"hf mfdes bruteaid -s f0000f -i 16 -> search mad range manually"
],
"offline": false,
"options": [
"-h, --help this help",
"-s, --start <hex> starting app id as hex bytes (3 bytes, big endian)",
"-e, --end <hex> last app id as hex bytes (3 bytes, big endian)",
"-i, --step <dec> increment step when bruteforcing",
"-m, --mad only bruteforce the mad range"
],
"usage": "hf mfdes bruteaid [-hm] [-s <hex>] [-e <hex>] [-i <dec>]"
},
"hf mfdes changekey": {
"command": "hf mfdes changekey",
"description": "change picc/application key. needs to provide keynum/key for a valid authentication (may get from default parameters).",
"notes": [
"change crypto algorithm for picc key is possible, but for app keys crypto algorithm is set by createapp command and can't be changed wo application delete",
"",
"hf mfdes changekey --aid 123456 -> execute with default factory setup. change des key 0 in the app 123456 from 00..00 to 00..00",
"hf mfdes changekey --appisoid df01 -t aes -s lrp --newkeyno 01 -> change key 01 via lrp channelhf mfdes changekey -t des --newalgo aes --newkey 11223344556677889900112233445566 --newver a5 -> change card master key to aes one",
"hf mfdes changekey --aid 123456 -t aes --key 00000000000000000000000000000000 --newkey 11223344556677889900112233445566 -> change app master key",
"hf mfdes changekey --aid 123456 -t des -n 0 --newkeyno 1 --oldkey 5555555555555555 --newkey 1122334455667788 -> change key 1 with auth from key 0",
"hf mfdes changekey --aid 123456 -t 3tdea --newkey 11223344556677889900112233445566778899001122334 -> change 3tdea key 0 from default 00..00 to provided"
],
"offline": false,
"options": [
"-h, --help this help",
"-a, --apdu show apdu requests and responses",
"-v, --verbose show technical data",
"-n, --keyno <keyno> key number",
"-t, --algo <des/2tdea/3tdea/aes> crypt algo: des, 2tdea, 3tdea, aes",
"-k, --key <key> key for authenticate (hex 8(des), 16(2tdea or aes) or 24(3tdea) bytes)",
"-f, --kdf <none/an10922/gallagher> key derivation function (kdf): none, an10922, gallagher",
"-i, --kdfi <kdfi> kdf input (hex 1-31 bytes)",
"-m, --cmode <plain/mac/encrypt> communicaton mode: plain/mac/encrypt",
"-c, --ccset <native/niso/iso> communicaton command set: native/niso/iso",
"-s, --schann <d40/ev1/ev2/lrp> secure channel: d40/ev1/ev2/lrp",
"--aid <app id hex> application id of application (3 hex bytes, big endian)",
"--appisoid <isoid hex> application iso id (iso df id) (2 hex bytes, big endian).",
"--oldalgo <des/2tdea/3tdea/aes> old key crypto algorithm: des, 2tdea, 3tdea, aes",
"--oldkey <old key> old key (hex 8(des), 16(2tdea or aes) or 24(3tdea) bytes)",
"--newkeyno <keyno> key number for change",
"--newalgo <des/2tdea/3tdea/aes> new key crypto algorithm: des, 2tdea, 3tdea, aes",
"--newkey <new key> new key (hex 8(des), 16(2tdea or aes) or 24(3tdea) bytes)",
"--newver <version hex> new key's version (1 hex byte)"
],
"usage": "hf mfdes changekey [-hav] [-n <keyno>] [-t <des/2tdea/3tdea/aes>] [-k <key>] [-f <none/an10922/gallagher>] [-i <kdfi>] [-m <plain/mac/encrypt>] [-c <native/niso/iso>] [-s <d40/ev1/ev2/lrp>] [--aid <app id hex>] [--appisoid <isoid hex>] [--oldalgo <des/2tdea/3tdea/aes>] [--oldkey <old key>] [--newkeyno <keyno>] [--newalgo <des/2tdea/3tdea/aes>] [--newkey <new key>] [--newver <version hex>]"
},
"hf mfdes chfilesettings": {
"command": "hf mfdes chfilesettings",
"description": "get file settings from file from application. master key needs to be provided or flag --no-auth set (depend on cards settings).",
"notes": [
"hf mfdes chfilesettings --aid 123456 --fid 01 --amode plain --rrights free --wrights free --rwrights free --chrights key0 -> change file settings app=123456, file=01 with defaults from `default` command",
"hf mfdes chfilesettings -n 0 -t des -k 0000000000000000 -f none --aid 123456 --fid 01 --rawdata 00eeee -> execute with default factory setup",
"hf mfdes chfilesettings --aid 123456 --fid 01 --rawdata 810000021f112f22 -> change file settings with additional rights for keys 1 and 2",
"hf mfdes chfilesettings --appisoid df01 --fid 00 --amode plain --rawrights eee0 -s lrp -t aes -> change file settings via lrp channel"
],
"offline": false,
"options": [
"-h, --help this help",
"-a, --apdu show apdu requests and responses",
"-v, --verbose show technical data",
"-n, --keyno <keyno> key number",
"-t, --algo <des/2tdea/3tdea/aes> crypt algo: des, 2tdea, 3tdea, aes",
"-k, --key <key> key for authenticate (hex 8(des), 16(2tdea or aes) or 24(3tdea) bytes)",
"-f, --kdf <none/an10922/gallagher> key derivation function (kdf): none, an10922, gallagher",
"-i, --kdfi <kdfi> kdf input (hex 1-31 bytes)",
"-m, --cmode <plain/mac/encrypt> communicaton mode: plain/mac/encrypt",
"-c, --ccset <native/niso/iso> communicaton command set: native/niso/iso",
"-s, --schann <d40/ev1/ev2/lrp> secure channel: d40/ev1/ev2/lrp",
"--aid <app id hex> application id (3 hex bytes, big endian)",
"--appisoid <isoid hex> application iso id (iso df id) (2 hex bytes, big endian).",
"--fid <file id hex> file id (1 hex byte)",
"--rawdata <file settings hex> file settings (hex > 5 bytes). have priority over the other settings.",
"--amode <plain/mac/encrypt> file access mode: plain/mac/encrypt",
"--rawrights <access rights hex> access rights for file (hex 2 byte) r/w/rw/chg, 0x0 - 0xd key, 0xe free, 0xf denied",
"--rrights <key0/../key13/free/deny> read file access mode: the specified key, free, deny",
"--wrights <key0/../key13/free/deny> write file access mode: the specified key, free, deny",
"--rwrights <key0/../key13/free/deny> read/write file access mode: the specified key, free, deny",
"--chrights <key0/../key13/free/deny> change file settings access mode: the specified key, free, deny",
"--no-auth execute without authentication"
],
"usage": "hf mfdes chfilesettings [-hav] [-n <keyno>] [-t <des/2tdea/3tdea/aes>] [-k <key>] [-f <none/an10922/gallagher>] [-i <kdfi>] [-m <plain/mac/encrypt>] [-c <native/niso/iso>] [-s <d40/ev1/ev2/lrp>] [--aid <app id hex>] [--appisoid <isoid hex>] [--fid <file id hex>] [--rawdata <file settings hex>] [--amode <plain/mac/encrypt>] [--rawrights <access rights hex>] [--rrights <key0/../key13/free/deny>] [--wrights <key0/../key13/free/deny>] [--rwrights <key0/../key13/free/deny>] [--chrights <key0/../key13/free/deny>] [--no-auth]"
},
"hf mfdes chk": {
"command": "hf mfdes chk",
"description": "checks keys with mifare desfire card.",
"notes": [
"hf mfdes chk -a 123456 -k 000102030405060708090a0b0c0d0e0f -> check key on aid 0x123456",
"hf mfdes chk -d mfdes_default_keys -> check keys from dictionary against all existing aid on card",
"hf mfdes chk -d mfdes_default_keys -a 123456 -> check keys from dictionary against aid 0x123456",
"hf mfdes chk -a 123456 --pattern1b -j keys -> check all 1-byte keys pattern on aid 0x123456 and save found keys to json",
"hf mfdes chk -a 123456 --pattern2b --startp2b fa00 -> check all 2-byte keys pattern on aid 0x123456. start from key fa00fa00...fa00"
],
"offline": false,
"options": [
"-h, --help this help",
"--aid <aid> use specific aid (3 hex bytes, big endian)",
"-k, --key <key> key for checking (hex 16 bytes)",
"-d, --dict <file> file with keys dictionary",
"--pattern1b check all 1-byte combinations of key (0000...0000, 0101...0101, 0202...0202, ...)",
"--pattern2b check all 2-byte combinations of key (0000...0000, 0001...0001, 0002...0002, ...)",
"--startp2b <pattern> start key (2-byte hex) for 2-byte search (use with `--pattern2b`)",
"-j, --json <file> json file to save keys",
"-v, --verbose verbose mode.",
"-f, --kdf <kdf> key derivation function (kdf) (0=none, 1=an10922, 2=gallagher)",
"-i, --kdfi <kdfi> kdf input (hex 1-31 bytes)",
"-a, --apdu show apdu requests and responses"
],
"usage": "hf mfdes chk [-hva] [--aid <aid>] [-k <key>] [-d <file>] [--pattern1b] [--pattern2b] [--startp2b <pattern>] [-j <file>] [-f <kdf>] [-i <kdfi>]"
},
"hf mfdes chkeysettings": {
"command": "hf mfdes chkeysettings",
"description": "change key settings for card level or application level. warning: card level changes may block the card!",
"notes": [
"hf mfdes chkeysettings -d 0f -> set picc key settings with default key/channel setup",
"hf mfdes chkeysettings --aid 123456 -d 0f -> set app 123456 key settings with default key/channel setup"
],
"offline": false,
"options": [
"-h, --help this help",
"-a, --apdu show apdu requests and responses",
"-v, --verbose show technical data",
"-n, --keyno <keyno> key number",
"-t, --algo <des/2tdea/3tdea/aes> crypt algo: des, 2tdea, 3tdea, aes",
"-k, --key <key> key for authenticate (hex 8(des), 16(2tdea or aes) or 24(3tdea) bytes)",
"-f, --kdf <none/an10922/gallagher> key derivation function (kdf): none, an10922, gallagher",
"-i, --kdfi <kdfi> kdf input (hex 1-31 bytes)",
"-m, --cmode <plain/mac/encrypt> communicaton mode: plain/mac/encrypt",
"-c, --ccset <native/niso/iso> communicaton command set: native/niso/iso",
"-s, --schann <d40/ev1/ev2/lrp> secure channel: d40/ev1/ev2/lrp",
"--aid <app id hex> application id (3 hex bytes, big endian)",
"-d, --data <key settings hex> key settings (hex 1 byte)"
],
"usage": "hf mfdes chkeysettings [-hav] [-n <keyno>] [-t <des/2tdea/3tdea/aes>] [-k <key>] [-f <none/an10922/gallagher>] [-i <kdfi>] [-m <plain/mac/encrypt>] [-c <native/niso/iso>] [-s <d40/ev1/ev2/lrp>] [--aid <app id hex>] [-d <key settings hex>]"
},
"hf mfdes clearrecfile": {
"command": "hf mfdes clearrecfile",
"description": "clear record file. master key needs to be provided or flag --no-auth set (depend on cards settings).",
"notes": [
"hf mfdes clearrecfile --aid 123456 --fid 01 -> clear record file for: app=123456, file=01 with defaults from `default` command",
"hf mfdes clearrecfile --appisoid df01 --fid 01 -s lrp -t aes -n 3 -> clear record file for lrp channel with key number 3"
],
"offline": false,
"options": [
"-h, --help this help",
"-a, --apdu show apdu requests and responses",
"-v, --verbose show technical data",
"-n, --keyno <keyno> key number",
"-t, --algo <des/2tdea/3tdea/aes> crypt algo: des, 2tdea, 3tdea, aes",
"-k, --key <key> key for authenticate (hex 8(des), 16(2tdea or aes) or 24(3tdea) bytes)",
"-f, --kdf <none/an10922/gallagher> key derivation function (kdf): none, an10922, gallagher",
"-i, --kdfi <kdfi> kdf input (hex 1-31 bytes)",
"-m, --cmode <plain/mac/encrypt> communicaton mode: plain/mac/encrypt",
"-c, --ccset <native/niso/iso> communicaton command set: native/niso/iso",
"-s, --schann <d40/ev1/ev2/lrp> secure channel: d40/ev1/ev2/lrp",
"--aid <app id hex> application id (3 hex bytes, big endian)",
"--appisoid <isoid hex> application iso id (iso df id) (2 hex bytes, big endian).",
"--fid <file id hex> file id for clearing (1 hex byte)",
"--no-auth execute without authentication"
],
"usage": "hf mfdes clearrecfile [-hav] [-n <keyno>] [-t <des/2tdea/3tdea/aes>] [-k <key>] [-f <none/an10922/gallagher>] [-i <kdfi>] [-m <plain/mac/encrypt>] [-c <native/niso/iso>] [-s <d40/ev1/ev2/lrp>] [--aid <app id hex>] [--appisoid <isoid hex>] [--fid <file id hex>] [--no-auth]"
},
"hf mfdes createapp": {
"command": "hf mfdes createapp",
"description": "create application. master key needs to be provided.",
"notes": [
"option rawdata have priority over the rest settings, and options ks1 and ks2 have priority over corresponded key settings",
"",
"keysetting 1 (amk setting, ks1):",
"0: allow change master key. 1 - allow, 0 - frozen",
"1: free directory list access without master key",
"0: amk auth needed for getfilesettings and getkeysettings",
"1: no amk auth needed for getfileids, getisofileids, getfilesettings, getkeysettings",
"2: free create/delete without master key",
"0: createfile/deletefile only with amk auth",
"1: createfile/deletefile always",
"3: configuration changeable",
"0: configuration frozen",
"1: configuration changeable if authenticated with amk (default)",
"4-7: changekey access rights",
"0: application master key needed (default)",
"0x1..0xd: auth with specific key needed to change any key",
"0xe: auth with the key to be changed (same keyno) is necessary to change a key",
"0xf: all keys within this application are frozen",
"",
"keysetting 2 (ks2):",
"0..3: number of keys stored within the application (max. 14 keys)",
"4: ks3 is present",
"5: use of 2 byte iso fid, 0: no, 1: yes",
"6..7: crypto method 00: des|2tdea, 01: 3tdea, 10: aes, 11: rfu",
"example:",
"2e = with fid, des|2tdea, 14 keys",
"6e = with fid, 3tdea, 14 keys",
"ae = with fid, aes, 14 keys",
"",
"hf mfdes createapp --rawdata 5634122f2e4523616964313233343536 -> execute create by rawdata",
"hf mfdes createapp --aid 123456 --fid 2345 --dfname aid123456 -> app aid, iso file id, and iso df name is specified",
"hf mfdes createapp --aid 123456 --fid 2345 --dfname aid123456 --dstalgo aes -> with algorithm for key aes"
],
"offline": false,
"options": [
"-h, --help this help",
"-a, --apdu show apdu requests and responses",
"-v, --verbose show technical data",
"-n, --keyno <dec> key number",
"-t, --algo <des|2tdea|3tdea|aes> crypt algo: des, 2tdea, 3tdea, aes",
"-k, --key <hex> key for authenticate (hex 8(des), 16(2tdea or aes) or 24(3tdea) bytes)",
"-f, --kdf <none|an10922|gallagher> key derivation function (kdf): none, an10922, gallagher",
"-i, --kdfi <kdfi> kdf input (hex 1-31 bytes)",
"-m, --cmode <plain|mac|encrypt> communicaton mode: plain/mac/encrypt",
"-c, --ccset <native|niso|iso> communicaton command set: native/niso/iso",
"-s, --schann <d40|ev1|ev2|lrp> secure channel: d40/ev1/ev2/lrp",
"--rawdata <hex> raw data that sends to command",
"--aid <hex> application id for create. mandatory. (3 hex bytes, big endian)",
"--fid <hex> iso file id. forbidden values: 0000 3f00, 3fff, ffff. (2 hex bytes, big endian). if specified - enable iso file id over all the files in the app.",
"--dfname <string> iso df name 1..16 chars string",
"--ks1 <hex> key settings 1 (hex 1 byte). application master key settings. default 0x0f",
"--ks2 <hex> key settings 2 (hex 1 byte). default 0x0e",
"--dstalgo <des|2tdea|3tdea|aes> application key crypt algo: des, 2tdea, 3tdea, aes. default des",
"--numkeys <dec> number of keys 0x00..0x0e. default 0x0e",
"--no-auth execute without authentication"
],
"usage": "hf mfdes createapp [-hav] [-n <dec>] [-t <des|2tdea|3tdea|aes>] [-k <hex>] [-f <none|an10922|gallagher>] [-i <kdfi>] [-m <plain|mac|encrypt>] [-c <native|niso|iso>] [-s <d40|ev1|ev2|lrp>] [--rawdata <hex>] [--aid <hex>] [--fid <hex>] [--dfname <string>] [--ks1 <hex>] [--ks2 <hex>] [--dstalgo <des|2tdea|3tdea|aes>] [--numkeys <dec>] [--no-auth]"
},
"hf mfdes createfile": {
"command": "hf mfdes createfile",
"description": "create standard/backup file in the application. application master key needs to be provided or flag --no-auth set (depend on application settings).",
"notes": [
"--rawtype/--rawdata have priority over the other settings. and with these parameters you can create any file. file id comes from parameters, all the rest data must be in the --rawdata parameter",
"--rawrights have priority over the separate rights settings.",
"key/mode/etc of the authentication depends on application settings",
"hf mfdes createfile --aid 123456 --fid 01 --isofid 0001 --size 000010 -> create file with iso id. authentication with defaults from `default` command",
"hf mfdes createfile --aid 123456 --fid 01 --rawtype 01 --rawdata 000100eeee000100 -> create file via sending rawdata to the card. can be used to create any type of file. authentication with defaults from `default` command",
"hf mfdes createfile --aid 123456 --fid 01 --amode plain --rrights free --wrights free --rwrights free --chrights key0 -> create file app=123456, file=01 and mentioned rights with defaults from `default` command",
"hf mfdes createfile -n 0 -t des -k 0000000000000000 -f none --aid 123456 --fid 01 --rawtype 00 --rawdata 00eeee000100 -> execute with default factory setup"
],
"offline": false,
"options": [
"-h, --help this help",
"-a, --apdu show apdu requests and responses",
"-v, --verbose show technical data",
"-n, --keyno <keyno> key number",
"-t, --algo <des/2tdea/3tdea/aes> crypt algo: des, 2tdea, 3tdea, aes",
"-k, --key <key> key for authenticate (hex 8(des), 16(2tdea or aes) or 24(3tdea) bytes)",
"-f, --kdf <none/an10922/gallagher> key derivation function (kdf): none, an10922, gallagher",
"-i, --kdfi <kdfi> kdf input (hex 1-31 bytes)",
"-m, --cmode <plain/mac/encrypt> communicaton mode: plain/mac/encrypt",
"-c, --ccset <native/niso/iso> communicaton command set: native/niso/iso",
"-s, --schann <d40/ev1/ev2/lrp> secure channel: d40/ev1/ev2/lrp",
"--aid <app id hex> application id (3 hex bytes, big endian)",
"--fid <file id hex> file id (1 hex byte)",
"--isofid <iso file id hex> iso file id (2 hex bytes)",
"--rawtype <file type hex 1b> raw file type (hex 1 byte)",
"--rawdata <file settings hex> raw file settings (hex > 5 bytes)",
"--amode <plain/mac/encrypt> file access mode: plain/mac/encrypt",
"--rawrights <access rights hex> access rights for file (hex 2 byte) r/w/rw/chg, 0x0 - 0xd key, 0xe free, 0xf denied",
"--rrights <key0/../key13/free/deny> read file access mode: the specified key, free, deny",
"--wrights <key0/../key13/free/deny> write file access mode: the specified key, free, deny",
"--rwrights <key0/../key13/free/deny> read/write file access mode: the specified key, free, deny",
"--chrights <key0/../key13/free/deny> change file settings access mode: the specified key, free, deny",
"--no-auth execute without authentication",
"--size <hex> file size (3 hex bytes, big endian)",
"--backup create backupfile instead of standard file"
],
"usage": "hf mfdes createfile [-hav] [-n <keyno>] [-t <des/2tdea/3tdea/aes>] [-k <key>] [-f <none/an10922/gallagher>] [-i <kdfi>] [-m <plain/mac/encrypt>] [-c <native/niso/iso>] [-s <d40/ev1/ev2/lrp>] [--aid <app id hex>] [--fid <file id hex>] [--isofid <iso file id hex>] [--rawtype <file type hex 1b>] [--rawdata <file settings hex>] [--amode <plain/mac/encrypt>] [--rawrights <access rights hex>] [--rrights <key0/../key13/free/deny>] [--wrights <key0/../key13/free/deny>] [--rwrights <key0/../key13/free/deny>] [--chrights <key0/../key13/free/deny>] [--no-auth] [--size <hex>] [--backup]"
},
"hf mfdes createmacfile": {
"command": "hf mfdes createmacfile",
"description": "create transaction mac file in the application. application master key needs to be provided or flag --no-auth set (depend on application settings).",
"notes": [
"--rawrights have priority over the separate rights settings.",
"key/mode/etc of the authentication depends on application settings",
"write right should be always 0xf. read-write right should be 0xf if you not need to submit commitreaderid command each time transaction starts",
"",
"hf mfdes createmacfile --aid 123456 --fid 01 --rawrights 0ff0 --mackey 00112233445566778899aabbccddeeff --mackeyver 01 -> create transaction mac file with parameters. rights from default. authentication with defaults from `default` command",
"hf mfdes createmacfile --aid 123456 --fid 01 --amode plain --rrights free --wrights deny --rwrights free --chrights key0 --mackey 00112233445566778899aabbccddeeff -> create file app=123456, file=01, with key, and mentioned rights with defaults from `default` command",
"hf mfdes createmacfile -n 0 -t des -k 0000000000000000 -f none --aid 123456 --fid 01 -> execute with default factory setup. key and keyver == 0x00..00",
"hf mfdes createmacfile --appisoid df01 --fid 0f -s lrp -t aes --rawrights 0ff0 --mackey 00112233445566778899aabbccddeeff --mackeyver 01 -> create transaction mac file via lrp channel",
"hf mfdes createmacfile --appisoid df01 --fid 0f -s lrp -t aes --rawrights 0f10 --mackey 00112233445566778899aabbccddeeff --mackeyver 01 -> create transaction mac file via lrp channel with commitreaderid command enable"
],
"offline": false,
"options": [
"-h, --help this help",
"-a, --apdu show apdu requests and responses",
"-v, --verbose show technical data",
"-n, --keyno <keyno> key number",
"-t, --algo <des/2tdea/3tdea/aes> crypt algo: des, 2tdea, 3tdea, aes",
"-k, --key <key> key for authenticate (hex 8(des), 16(2tdea or aes) or 24(3tdea) bytes)",
"-f, --kdf <none/an10922/gallagher> key derivation function (kdf): none, an10922, gallagher",
"-i, --kdfi <kdfi> kdf input (hex 1-31 bytes)",
"-m, --cmode <plain/mac/encrypt> communicaton mode: plain/mac/encrypt",
"-c, --ccset <native/niso/iso> communicaton command set: native/niso/iso",
"-s, --schann <d40/ev1/ev2/lrp> secure channel: d40/ev1/ev2/lrp",
"--aid <app id hex> application id (3 hex bytes, big endian)",
"--appisoid <isoid hex> application iso id (iso df id) (2 hex bytes, big endian).",
"--fid <file id hex> file id (1 hex byte)",
"--amode <plain/mac/encrypt> file access mode: plain/mac/encrypt",
"--rawrights <access rights hex> access rights for file (hex 2 byte) r/w/rw/chg, 0x0 - 0xd key, 0xe free, 0xf denied",
"--rrights <key0/../key13/free/deny> read file access mode: the specified key, free, deny",
"--wrights <key0/../key13/free/deny> write file access mode: the specified key, free, deny",
"--rwrights <key0/../key13/free/deny> read/write file access mode: the specified key, free, deny",
"--chrights <key0/../key13/free/deny> change file settings access mode: the specified key, free, deny",
"--no-auth execute without authentication",
"--mackey <hex> aes-128 key for mac (16 hex bytes, big endian). default 0x00..00",
"--mackeyver <ver hex 1b> aes key version for mac (1 hex byte). default 0x00"
],
"usage": "hf mfdes createmacfile [-hav] [-n <keyno>] [-t <des/2tdea/3tdea/aes>] [-k <key>] [-f <none/an10922/gallagher>] [-i <kdfi>] [-m <plain/mac/encrypt>] [-c <native/niso/iso>] [-s <d40/ev1/ev2/lrp>] [--aid <app id hex>] [--appisoid <isoid hex>] [--fid <file id hex>] [--amode <plain/mac/encrypt>] [--rawrights <access rights hex>] [--rrights <key0/../key13/free/deny>] [--wrights <key0/../key13/free/deny>] [--rwrights <key0/../key13/free/deny>] [--chrights <key0/../key13/free/deny>] [--no-auth] [--mackey <hex>] [--mackeyver <ver hex 1b>]"
},
"hf mfdes createrecordfile": {
"command": "hf mfdes createrecordfile",
"description": "create linear/cyclic record file in the application. application master key needs to be provided or flag --no-auth set (depend on application settings).",
"notes": [
"--rawrights have priority over the separate rights settings.",
"key/mode/etc of the authentication depends on application settings",
"hf mfdes createrecordfile --aid 123456 --fid 01 --size 000010 --maxrecord 000010 --cyclic -> create cyclic record file with parameters. rights from default. authentication with defaults from `default` command",
"hf mfdes createrecordfile --aid 123456 --fid 01 --amode plain --rrights free --wrights free --rwrights free --chrights key0 --size 000010 --maxrecord 000010 -> create linear record file app=123456, file=01 and mentioned rights with defaults from `default` command",
"hf mfdes createrecordfile -n 0 -t des -k 0000000000000000 -f none --aid 123456 --fid 01 --size 000010 --maxrecord 000010 -> execute with default factory setup"
],
"offline": false,
"options": [
"-h, --help this help",
"-a, --apdu show apdu requests and responses",
"-v, --verbose show technical data",
"-n, --keyno <keyno> key number",
"-t, --algo <des/2tdea/3tdea/aes> crypt algo: des, 2tdea, 3tdea, aes",
"-k, --key <key> key for authenticate (hex 8(des), 16(2tdea or aes) or 24(3tdea) bytes)",
"-f, --kdf <none/an10922/gallagher> key derivation function (kdf): none, an10922, gallagher",
"-i, --kdfi <kdfi> kdf input (hex 1-31 bytes)",
"-m, --cmode <plain/mac/encrypt> communicaton mode: plain/mac/encrypt",
"-c, --ccset <native/niso/iso> communicaton command set: native/niso/iso",
"-s, --schann <d40/ev1/ev2/lrp> secure channel: d40/ev1/ev2/lrp",
"--aid <app id hex> application id (3 hex bytes, big endian)",
"--fid <file id hex> file id (1 hex byte)",
"--isofid <iso file id hex> iso file id (2 hex bytes)",
"--amode <plain/mac/encrypt> file access mode: plain/mac/encrypt",
"--rawrights <access rights hex> access rights for file (hex 2 byte) r/w/rw/chg, 0x0 - 0xd key, 0xe free, 0xf denied",
"--rrights <key0/../key13/free/deny> read file access mode: the specified key, free, deny",
"--wrights <key0/../key13/free/deny> write file access mode: the specified key, free, deny",
"--rwrights <key0/../key13/free/deny> read/write file access mode: the specified key, free, deny",
"--chrights <key0/../key13/free/deny> change file settings access mode: the specified key, free, deny",
"--no-auth execute without authentication",
"--size <hex> record size (3 hex bytes, big endian, 000001 to ffffff)",
"--maxrecord <hex> max. number of records (3 hex bytes, big endian)",
"--cyclic create cyclic record file instead of linear record file"
],
"usage": "hf mfdes createrecordfile [-hav] [-n <keyno>] [-t <des/2tdea/3tdea/aes>] [-k <key>] [-f <none/an10922/gallagher>] [-i <kdfi>] [-m <plain/mac/encrypt>] [-c <native/niso/iso>] [-s <d40/ev1/ev2/lrp>] [--aid <app id hex>] [--fid <file id hex>] [--isofid <iso file id hex>] [--amode <plain/mac/encrypt>] [--rawrights <access rights hex>] [--rrights <key0/../key13/free/deny>] [--wrights <key0/../key13/free/deny>] [--rwrights <key0/../key13/free/deny>] [--chrights <key0/../key13/free/deny>] [--no-auth] [--size <hex>] [--maxrecord <hex>] [--cyclic]"
},
"hf mfdes createvaluefile": {
"command": "hf mfdes createvaluefile",
"description": "create value file in the application. application master key needs to be provided or flag --no-auth set (depend on application settings).",
"notes": [
"--rawrights have priority over the separate rights settings.",
"key/mode/etc of the authentication depends on application settings",
"hf mfdes createvaluefile --aid 123456 --fid 01 --lower 00000010 --upper 00010000 --value 00000100 -> create file with parameters. rights from default. authentication with defaults from `default` command",
"hf mfdes createvaluefile --aid 123456 --fid 01 --amode plain --rrights free --wrights free --rwrights free --chrights key0 -> create file app=123456, file=01 and mentioned rights with defaults from `default` command",
"hf mfdes createvaluefile -n 0 -t des -k 0000000000000000 -f none --aid 123456 --fid 01 -> execute with default factory setup"
],
"offline": false,
"options": [
"-h, --help this help",
"-a, --apdu show apdu requests and responses",
"-v, --verbose show technical data",
"-n, --keyno <keyno> key number",
"-t, --algo <des/2tdea/3tdea/aes> crypt algo: des, 2tdea, 3tdea, aes",
"-k, --key <key> key for authenticate (hex 8(des), 16(2tdea or aes) or 24(3tdea) bytes)",
"-f, --kdf <none/an10922/gallagher> key derivation function (kdf): none, an10922, gallagher",
"-i, --kdfi <kdfi> kdf input (hex 1-31 bytes)",
"-m, --cmode <plain/mac/encrypt> communicaton mode: plain/mac/encrypt",
"-c, --ccset <native/niso/iso> communicaton command set: native/niso/iso",
"-s, --schann <d40/ev1/ev2/lrp> secure channel: d40/ev1/ev2/lrp",
"--aid <app id hex> application id (3 hex bytes, big endian)",
"--fid <file id hex> file id (1 hex byte)",
"--amode <plain/mac/encrypt> file access mode: plain/mac/encrypt",
"--rawrights <access rights hex> access rights for file (hex 2 byte) r/w/rw/chg, 0x0 - 0xd key, 0xe free, 0xf denied",
"--rrights <key0/../key13/free/deny> read file access mode: the specified key, free, deny",
"--wrights <key0/../key13/free/deny> write file access mode: the specified key, free, deny",
"--rwrights <key0/../key13/free/deny> read/write file access mode: the specified key, free, deny",
"--chrights <key0/../key13/free/deny> change file settings access mode: the specified key, free, deny",
"--no-auth execute without authentication",
"--lower <hex> lower limit (4 hex bytes, big endian)",
"--upper <hex> upper limit (4 hex bytes, big endian)",
"--value <hex> value (4 hex bytes, big endian)",
"--lcredit <dec> limited credit enabled (bit 0 = limited credit, 1 = freevalue)"
],
"usage": "hf mfdes createvaluefile [-hav] [-n <keyno>] [-t <des/2tdea/3tdea/aes>] [-k <key>] [-f <none/an10922/gallagher>] [-i <kdfi>] [-m <plain/mac/encrypt>] [-c <native/niso/iso>] [-s <d40/ev1/ev2/lrp>] [--aid <app id hex>] [--fid <file id hex>] [--amode <plain/mac/encrypt>] [--rawrights <access rights hex>] [--rrights <key0/../key13/free/deny>] [--wrights <key0/../key13/free/deny>] [--rwrights <key0/../key13/free/deny>] [--chrights <key0/../key13/free/deny>] [--no-auth] [--lower <hex>] [--upper <hex>] [--value <hex>] [--lcredit <dec>]"
},
"hf mfdes default": {
"command": "hf mfdes default",
"description": "set default parameters for access to desfire card.",
"notes": [
"hf mfdes default -n 0 -t des -k 0000000000000000 -f none -> save to the default parameters"
],
"offline": false,
"options": [
"-h, --help this help",
"-n, --keyno <keyno> key number",
"-t, --algo <des/2tdea/3tdea/aes> crypt algo: des, 2tdea, 3tdea, aes",
"-k, --key <key> key for authenticate (hex 8(des), 16(2tdea or aes) or 24(3tdea) bytes)",
"-f, --kdf <none/an10922/gallagher> key derivation function (kdf): none, an10922, gallagher",
"-i, --kdfi <kdfi> kdf input (hex 1-31 bytes)",
"-m, --cmode <plain/mac/encrypt> communicaton mode: plain/mac/encrypt",
"-c, --ccset <native/niso/iso> communicaton command set: native/niso/iso",
"-s, --schann <d40/ev1/ev2/lrp> secure channel: d40/ev1/ev2/lrp"
],
"usage": "hf mfdes default [-h] [-n <keyno>] [-t <des/2tdea/3tdea/aes>] [-k <key>] [-f <none/an10922/gallagher>] [-i <kdfi>] [-m <plain/mac/encrypt>] [-c <native/niso/iso>] [-s <d40/ev1/ev2/lrp>]"
},
"hf mfdes deleteapp": {
"command": "hf mfdes deleteapp",
"description": "delete application by its 3-byte aid. master key needs to be provided.",
"notes": [
"hf mfdes deleteapp --aid 123456 -> execute with default factory setup"
],
"offline": false,
"options": [
"-h, --help this help",
"-a, --apdu show apdu requests and responses",
"-v, --verbose show technical data",
"-n, --keyno <keyno> key number",
"-t, --algo <des/2tdea/3tdea/aes> crypt algo: des, 2tdea, 3tdea, aes",
"-k, --key <key> key for authenticate (hex 8(des), 16(2tdea or aes) or 24(3tdea) bytes)",
"-f, --kdf <none/an10922/gallagher> key derivation function (kdf): none, an10922, gallagher",
"-i, --kdfi <kdfi> kdf input (hex 1-31 bytes)",
"-m, --cmode <plain/mac/encrypt> communicaton mode: plain/mac/encrypt",
"-c, --ccset <native/niso/iso> communicaton command set: native/niso/iso",
"-s, --schann <d40/ev1/ev2/lrp> secure channel: d40/ev1/ev2/lrp",
"--aid <app id hex> application id of delegated application (3 hex bytes, big endian)"
],
"usage": "hf mfdes deleteapp [-hav] [-n <keyno>] [-t <des/2tdea/3tdea/aes>] [-k <key>] [-f <none/an10922/gallagher>] [-i <kdfi>] [-m <plain/mac/encrypt>] [-c <native/niso/iso>] [-s <d40/ev1/ev2/lrp>] [--aid <app id hex>]"
},
"hf mfdes deletefile": {
"command": "hf mfdes deletefile",
"description": "delete file from application. master key needs to be provided or flag --no-auth set (depend on cards settings).",
"notes": [
"hf mfdes deletefile --aid 123456 --fid 01 -> delete file for: app=123456, file=01 with defaults from `default` command",
"hf mfdes deletefile --appisoid df01 --fid 0f -s lrp -t aes -> delete file for lrp channel"
],
"offline": false,
"options": [
"-h, --help this help",
"-a, --apdu show apdu requests and responses",
"-v, --verbose show technical data",
"-n, --keyno <keyno> key number",
"-t, --algo <des/2tdea/3tdea/aes> crypt algo: des, 2tdea, 3tdea, aes",
"-k, --key <key> key for authenticate (hex 8(des), 16(2tdea or aes) or 24(3tdea) bytes)",
"-f, --kdf <none/an10922/gallagher> key derivation function (kdf): none, an10922, gallagher",
"-i, --kdfi <kdfi> kdf input (hex 1-31 bytes)",
"-m, --cmode <plain/mac/encrypt> communicaton mode: plain/mac/encrypt",
"-c, --ccset <native/niso/iso> communicaton command set: native/niso/iso",
"-s, --schann <d40/ev1/ev2/lrp> secure channel: d40/ev1/ev2/lrp",
"--aid <app id hex> application id (3 hex bytes, big endian)",
"--appisoid <isoid hex> application iso id (iso df id) (2 hex bytes, big endian).",
"--fid <file id hex> file id (1 hex byte)",
"--no-auth execute without authentication"
],
"usage": "hf mfdes deletefile [-hav] [-n <keyno>] [-t <des/2tdea/3tdea/aes>] [-k <key>] [-f <none/an10922/gallagher>] [-i <kdfi>] [-m <plain/mac/encrypt>] [-c <native/niso/iso>] [-s <d40/ev1/ev2/lrp>] [--aid <app id hex>] [--appisoid <isoid hex>] [--fid <file id hex>] [--no-auth]"
},
"hf mfdes detect": {
"command": "hf mfdes detect",
"description": "detect key type and tries to find one from the list.",
"notes": [
"hf mfdes detect -> detect key 0 from picc level",
"hf mfdes detect -s d40 -> detect key 0 from picc level via secure channel d40",
"hf mfdes detect --dict mfdes_default_keys -> detect key 0 from picc level with help of the standard dictionary",
"hf mfdes detect --aid 123456 -n 2 --save -> detect key 2 from app 123456 and if succeed - save params to defaults (`default` command)",
"hf mfdes detect --appisoid df01 --save -> detect key 0 and save to defaults with card in the lrp mode"
],
"offline": false,
"options": [
"-h, --help this help",
"-a, --apdu show apdu requests and responses",
"-v, --verbose show technical data",
"-n, --keyno <keyno> key number",
"-t, --algo <des/2tdea/3tdea/aes> crypt algo: des, 2tdea, 3tdea, aes",
"-k, --key <key> key for authenticate (hex 8(des), 16(2tdea or aes) or 24(3tdea) bytes)",
"-f, --kdf <none/an10922/gallagher> key derivation function (kdf): none, an10922, gallagher",
"-i, --kdfi <kdfi> kdf input (hex 1-31 bytes)",
"-m, --cmode <plain/mac/encrypt> communicaton mode: plain/mac/encrypt",
"-c, --ccset <native/niso/iso> communicaton command set: native/niso/iso",
"-s, --schann <d40/ev1/ev2/lrp> secure channel: d40/ev1/ev2/lrp",
"--aid <app id hex> application id (3 hex bytes, big endian)",
"--appisoid <isoid hex> application iso id (iso df id) (2 hex bytes, big endian).",
"--dict <file> file with keys dictionary",
"--save save found key and parameters to defaults"
],
"usage": "hf mfdes detect [-hav] [-n <keyno>] [-t <des/2tdea/3tdea/aes>] [-k <key>] [-f <none/an10922/gallagher>] [-i <kdfi>] [-m <plain/mac/encrypt>] [-c <native/niso/iso>] [-s <d40/ev1/ev2/lrp>] [--aid <app id hex>] [--appisoid <isoid hex>] [--dict <file>] [--save]"
},
"hf mfdes dump": {
"command": "hf mfdes dump",
"description": "for each application show fil list and then file content. key needs to be provided for authentication or flag --no-auth set (depend on cards settings).",
"notes": [
"hf mfdes dump --aid 123456 -> show file dump for: app=123456 with channel defaults from `default` command/nhf mfdes dump --appisoid df01 -s lrp -t aes --length 000090 -> lrp default settings with length limit"
],
"offline": false,
"options": [
"-h, --help this help",
"-a, --apdu show apdu requests and responses",
"-v, --verbose show technical data",
"-n, --keyno <keyno> key number",
"-t, --algo <des/2tdea/3tdea/aes> crypt algo: des, 2tdea, 3tdea, aes",
"-k, --key <key> key for authenticate (hex 8(des), 16(2tdea or aes) or 24(3tdea) bytes)",
"-f, --kdf <none/an10922/gallagher> key derivation function (kdf): none, an10922, gallagher",
"-i, --kdfi <kdfi> kdf input (hex 1-31 bytes)",
"-m, --cmode <plain/mac/encrypt> communicaton mode: plain/mac/encrypt",
"-c, --ccset <native/niso/iso> communicaton command set: native/niso/iso",
"-s, --schann <d40/ev1/ev2/lrp> secure channel: d40/ev1/ev2/lrp",
"--aid <app id hex> application id (3 hex bytes, big endian)",
"--appisoid <isoid hex> application iso id (iso df id) (2 hex bytes, big endian).",
"-l, --length <hex> maximum length for read data files (3 hex bytes, big endian).",
"--no-auth execute without authentication"
],
"usage": "hf mfdes dump [-hav] [-n <keyno>] [-t <des/2tdea/3tdea/aes>] [-k <key>] [-f <none/an10922/gallagher>] [-i <kdfi>] [-m <plain/mac/encrypt>] [-c <native/niso/iso>] [-s <d40/ev1/ev2/lrp>] [--aid <app id hex>] [--appisoid <isoid hex>] [-l <hex>] [--no-auth]"
},
"hf mfdes formatpicc": {
"command": "hf mfdes formatpicc",
"description": "format card. can be done only if enabled in the configuration. master key needs to be provided.",
"notes": [
"hf mfdes formatpicc -> execute with default factory setup"
],
"offline": false,
"options": [
"-h, --help this help",
"-a, --apdu show apdu requests and responses",
"-v, --verbose show technical data",
"-n, --keyno <keyno> key number",
"-t, --algo <des/2tdea/3tdea/aes> crypt algo: des, 2tdea, 3tdea, aes",
"-k, --key <key> key for authenticate (hex 8(des), 16(2tdea or aes) or 24(3tdea) bytes)",
"-f, --kdf <none/an10922/gallagher> key derivation function (kdf): none, an10922, gallagher",
"-i, --kdfi <kdfi> kdf input (hex 1-31 bytes)",
"-m, --cmode <plain/mac/encrypt> communicaton mode: plain/mac/encrypt",
"-c, --ccset <native/niso/iso> communicaton command set: native/niso/iso",
"-s, --schann <d40/ev1/ev2/lrp> secure channel: d40/ev1/ev2/lrp",
"--aid <app id hex> application id of delegated application (3 hex bytes, big endian)"
],
"usage": "hf mfdes formatpicc [-hav] [-n <keyno>] [-t <des/2tdea/3tdea/aes>] [-k <key>] [-f <none/an10922/gallagher>] [-i <kdfi>] [-m <plain/mac/encrypt>] [-c <native/niso/iso>] [-s <d40/ev1/ev2/lrp>] [--aid <app id hex>]"
},
"hf mfdes freemem": {
"command": "hf mfdes freemem",
"description": "get card's free memory. can be done with or without authentication. master key may be provided.",
"notes": [
"hf mfdes getfreemem -> execute with default factory setup"
],
"offline": false,
"options": [
"-h, --help this help",
"-a, --apdu show apdu requests and responses",
"-v, --verbose show technical data",
"-n, --keyno <keyno> key number",
"-t, --algo <des/2tdea/3tdea/aes> crypt algo: des, 2tdea, 3tdea, aes",
"-k, --key <key> key for authenticate (hex 8(des), 16(2tdea or aes) or 24(3tdea) bytes)",
"-f, --kdf <none/an10922/gallagher> key derivation function (kdf): none, an10922, gallagher",
"-i, --kdfi <kdfi> kdf input (hex 1-31 bytes)",
"-m, --cmode <plain/mac/encrypt> communicaton mode: plain/mac/encrypt",
"-c, --ccset <native/niso/iso> communicaton command set: native/niso/iso",
"-s, --schann <d40/ev1/ev2/lrp> secure channel: d40/ev1/ev2/lrp",
"--no-auth execute without authentication"
],
"usage": "hf mfdes getfreemem [-hav] [-n <keyno>] [-t <des/2tdea/3tdea/aes>] [-k <key>] [-f <none/an10922/gallagher>] [-i <kdfi>] [-m <plain/mac/encrypt>] [-c <native/niso/iso>] [-s <d40/ev1/ev2/lrp>] [--no-auth]"
},
"hf mfdes getaids": {
"command": "hf mfdes getaids",
"description": "get application ids list from card. master key needs to be provided or flag --no-auth set.",
"notes": [
"hf mfdes getaids -n 0 -t des -k 0000000000000000 -f none -> execute with default factory setup"
],
"offline": false,
"options": [
"-h, --help this help",
"-a, --apdu show apdu requests and responses",
"-v, --verbose show technical data",
"-n, --keyno <keyno> key number",
"-t, --algo <des/2tdea/3tdea/aes> crypt algo: des, 2tdea, 3tdea, aes",
"-k, --key <key> key for authenticate (hex 8(des), 16(2tdea or aes) or 24(3tdea) bytes)",
"-f, --kdf <none/an10922/gallagher> key derivation function (kdf): none, an10922, gallagher",
"-i, --kdfi <kdfi> kdf input (hex 1-31 bytes)",
"-m, --cmode <plain/mac/encrypt> communicaton mode: plain/mac/encrypt",
"-c, --ccset <native/niso/iso> communicaton command set: native/niso/iso",
"-s, --schann <d40/ev1/ev2/lrp> secure channel: d40/ev1/ev2/lrp",
"--no-auth execute without authentication"
],
"usage": "hf mfdes getaids [-hav] [-n <keyno>] [-t <des/2tdea/3tdea/aes>] [-k <key>] [-f <none/an10922/gallagher>] [-i <kdfi>] [-m <plain/mac/encrypt>] [-c <native/niso/iso>] [-s <d40/ev1/ev2/lrp>] [--no-auth]"
},
"hf mfdes getappnames": {
"command": "hf mfdes getappnames",
"description": "get application ids, iso ids and df names from card. master key needs to be provided or flag --no-auth set.",
"notes": [
"hf mfdes getappnames -n 0 -t des -k 0000000000000000 -f none -> execute with default factory setup"
],
"offline": false,
"options": [
"-h, --help this help",
"-a, --apdu show apdu requests and responses",
"-v, --verbose show technical data",
"-n, --keyno <keyno> key number",
"-t, --algo <des/2tdea/3tdea/aes> crypt algo: des, 2tdea, 3tdea, aes",
"-k, --key <key> key for authenticate (hex 8(des), 16(2tdea or aes) or 24(3tdea) bytes)",
"-f, --kdf <none/an10922/gallagher> key derivation function (kdf): none, an10922, gallagher",
"-i, --kdfi <kdfi> kdf input (hex 1-31 bytes)",
"-m, --cmode <plain/mac/encrypt> communicaton mode: plain/mac/encrypt",
"-c, --ccset <native/niso/iso> communicaton command set: native/niso/iso",
"-s, --schann <d40/ev1/ev2/lrp> secure channel: d40/ev1/ev2/lrp",
"--no-auth execute without authentication"
],
"usage": "hf mfdes getappnames [-hav] [-n <keyno>] [-t <des/2tdea/3tdea/aes>] [-k <key>] [-f <none/an10922/gallagher>] [-i <kdfi>] [-m <plain/mac/encrypt>] [-c <native/niso/iso>] [-s <d40/ev1/ev2/lrp>] [--no-auth]"
},
"hf mfdes getfileids": {
"command": "hf mfdes getfileids",
"description": "get file ids list from card. master key needs to be provided or flag --no-auth set.",
"notes": [
"hf mfdes getfileids --aid 123456 -> execute with defaults from `default` command",
"hf mfdes getfileids -n 0 -t des -k 0000000000000000 -f none --aid 123456 -> execute with default factory setup"
],
"offline": false,
"options": [
"-h, --help this help",
"-a, --apdu show apdu requests and responses",
"-v, --verbose show technical data",
"-n, --keyno <keyno> key number",
"-t, --algo <des/2tdea/3tdea/aes> crypt algo: des, 2tdea, 3tdea, aes",
"-k, --key <key> key for authenticate (hex 8(des), 16(2tdea or aes) or 24(3tdea) bytes)",
"-f, --kdf <none/an10922/gallagher> key derivation function (kdf): none, an10922, gallagher",
"-i, --kdfi <kdfi> kdf input (hex 1-31 bytes)",
"-m, --cmode <plain/mac/encrypt> communicaton mode: plain/mac/encrypt",
"-c, --ccset <native/niso/iso> communicaton command set: native/niso/iso",
"-s, --schann <d40/ev1/ev2/lrp> secure channel: d40/ev1/ev2/lrp",
"--aid <app id hex> application id (3 hex bytes, big endian)",
"--appisoid <isoid hex> application iso id (iso df id) (2 hex bytes, big endian).",
"--no-auth execute without authentication"
],
"usage": "hf mfdes getfileids [-hav] [-n <keyno>] [-t <des/2tdea/3tdea/aes>] [-k <key>] [-f <none/an10922/gallagher>] [-i <kdfi>] [-m <plain/mac/encrypt>] [-c <native/niso/iso>] [-s <d40/ev1/ev2/lrp>] [--aid <app id hex>] [--appisoid <isoid hex>] [--no-auth]"
},
"hf mfdes getfileisoids": {
"command": "hf mfdes getfileisoids",
"description": "get file ids list from card. master key needs to be provided or flag --no-auth set.",
"notes": [
"hf mfdes getfileisoids --aid 123456 -> execute with defaults from `default` command",
"hf mfdes getfileisoids -n 0 -t des -k 0000000000000000 -f none --aid 123456 -> execute with default factory setup",
"hf mfdes getfileisoids --appisoid df01 -> get iso file ids from desfire light with factory card settings",
"hf mfdes getfileisoids --appisoid df01 -s lrp -t aes -> get iso file ids from desfire light via lrp channel with default key authentication"
],
"offline": false,
"options": [
"-h, --help this help",
"-a, --apdu show apdu requests and responses",
"-v, --verbose show technical data",
"-n, --keyno <keyno> key number",
"-t, --algo <des/2tdea/3tdea/aes> crypt algo: des, 2tdea, 3tdea, aes",
"-k, --key <key> key for authenticate (hex 8(des), 16(2tdea or aes) or 24(3tdea) bytes)",
"-f, --kdf <none/an10922/gallagher> key derivation function (kdf): none, an10922, gallagher",
"-i, --kdfi <kdfi> kdf input (hex 1-31 bytes)",
"-m, --cmode <plain/mac/encrypt> communicaton mode: plain/mac/encrypt",
"-c, --ccset <native/niso/iso> communicaton command set: native/niso/iso",
"-s, --schann <d40/ev1/ev2/lrp> secure channel: d40/ev1/ev2/lrp",
"--aid <app id hex> application id (3 hex bytes, big endian)",
"--appisoid <isoid hex> application iso id (iso df id) (2 hex bytes, big endian).",
"--no-auth execute without authentication"
],
"usage": "hf mfdes getfileisoids [-hav] [-n <keyno>] [-t <des/2tdea/3tdea/aes>] [-k <key>] [-f <none/an10922/gallagher>] [-i <kdfi>] [-m <plain/mac/encrypt>] [-c <native/niso/iso>] [-s <d40/ev1/ev2/lrp>] [--aid <app id hex>] [--appisoid <isoid hex>] [--no-auth]"
},
"hf mfdes getfilesettings": {
"command": "hf mfdes getfilesettings",
"description": "get file settings from file from application. master key needs to be provided or flag --no-auth set (depend on cards settings).",
"notes": [
"hf mfdes getfilesettings --aid 123456 --fid 01 -> execute with defaults from `default` command",
"hf mfdes getfilesettings --appisoid df01 --fid 00 --no-auth -> get file settings with select by iso id",
"hf mfdes getfilesettings -n 0 -t des -k 0000000000000000 -f none --aid 123456 --fid 01 -> execute with default factory setup"
],
"offline": false,
"options": [
"-h, --help this help",
"-a, --apdu show apdu requests and responses",
"-v, --verbose show technical data",
"-n, --keyno <keyno> key number",
"-t, --algo <des/2tdea/3tdea/aes> crypt algo: des, 2tdea, 3tdea, aes",
"-k, --key <key> key for authenticate (hex 8(des), 16(2tdea or aes) or 24(3tdea) bytes)",
"-f, --kdf <none/an10922/gallagher> key derivation function (kdf): none, an10922, gallagher",
"-i, --kdfi <kdfi> kdf input (hex 1-31 bytes)",
"-m, --cmode <plain/mac/encrypt> communicaton mode: plain/mac/encrypt",
"-c, --ccset <native/niso/iso> communicaton command set: native/niso/iso",
"-s, --schann <d40/ev1/ev2/lrp> secure channel: d40/ev1/ev2/lrp",
"--aid <app id hex> application id (3 hex bytes, big endian)",
"--appisoid <isoid hex> application iso id (iso df id) (2 hex bytes, big endian).",
"--fid <file id hex> file id (1 hex byte). default: 1",
"--no-auth execute without authentication"
],
"usage": "hf mfdes getfilesettings [-hav] [-n <keyno>] [-t <des/2tdea/3tdea/aes>] [-k <key>] [-f <none/an10922/gallagher>] [-i <kdfi>] [-m <plain/mac/encrypt>] [-c <native/niso/iso>] [-s <d40/ev1/ev2/lrp>] [--aid <app id hex>] [--appisoid <isoid hex>] [--fid <file id hex>] [--no-auth]"
},
"hf mfdes getkeysettings": {
"command": "hf mfdes getkeysettings",
"description": "get key settings for card level or application level.",
"notes": [
"hf mfdes getkeysettings -> get picc key settings with default key/channel setup",
"hf mfdes getkeysettings --aid 123456 -> get app 123456 key settings with default key/channel setup"
],
"offline": false,
"options": [
"-h, --help this help",
"-a, --apdu show apdu requests and responses",
"-v, --verbose show technical data",
"-n, --keyno <keyno> key number",
"-t, --algo <des/2tdea/3tdea/aes> crypt algo: des, 2tdea, 3tdea, aes",
"-k, --key <key> key for authenticate (hex 8(des), 16(2tdea or aes) or 24(3tdea) bytes)",
"-f, --kdf <none/an10922/gallagher> key derivation function (kdf): none, an10922, gallagher",
"-i, --kdfi <kdfi> kdf input (hex 1-31 bytes)",
"-m, --cmode <plain/mac/encrypt> communicaton mode: plain/mac/encrypt",
"-c, --ccset <native/niso/iso> communicaton command set: native/niso/iso",
"-s, --schann <d40/ev1/ev2/lrp> secure channel: d40/ev1/ev2/lrp",
"--aid <app id hex> application id (3 hex bytes, big endian)"
],
"usage": "hf mfdes getkeysettings [-hav] [-n <keyno>] [-t <des/2tdea/3tdea/aes>] [-k <key>] [-f <none/an10922/gallagher>] [-i <kdfi>] [-m <plain/mac/encrypt>] [-c <native/niso/iso>] [-s <d40/ev1/ev2/lrp>] [--aid <app id hex>]"
},
"hf mfdes getkeyversions": {
"command": "hf mfdes getkeyversions",
"description": "get key versions for card level or application level.",
"notes": [
"--keynum parameter: app level: key number. picc level: 00..0d - keys count, 21..23 vc keys, default 0x00.",
"hf mfdes getkeyversions --keynum 00 -> get picc master key version with default key/channel setup",
"hf mfdes getkeyversions --aid 123456 --keynum 0d -> get app 123456 all key versions with default key/channel setup",
"hf mfdes getkeyversions --aid 123456 --keynum 0d --no-auth -> get key version without authentication"
],
"offline": false,
"options": [
"-h, --help this help",
"-a, --apdu show apdu requests and responses",
"-v, --verbose show technical data",
"-n, --keyno <keyno> key number for authentication",
"-t, --algo <des/2tdea/3tdea/aes> crypt algo: des, 2tdea, 3tdea, aes",
"-k, --key <key> key for authenticate (hex 8(des), 16(2tdea or aes) or 24(3tdea) bytes)",
"-f, --kdf <none/an10922/gallagher> key derivation function (kdf): none, an10922, gallagher",
"-i, --kdfi <kdfi> kdf input (hex 1-31 bytes)",
"-m, --cmode <plain/mac/encrypt> communicaton mode: plain/mac/encrypt",
"-c, --ccset <native/niso/iso> communicaton command set: native/niso/iso",
"-s, --schann <d40/ev1/ev2/lrp> secure channel: d40/ev1/ev2/lrp",
"--aid <app id hex> application id (3 hex bytes, big endian)",
"--appisoid <isoid hex> application iso id (iso df id) (2 hex bytes, big endian).",
"--keynum <key number hex> key number/count (hex 1 byte). default 0x00.",
"--keyset <keyset num hex> keyset number (hex 1 byte)",
"--no-auth execute without authentication"
],
"usage": "hf mfdes getkeyversions [-hav] [-n <keyno>] [-t <des/2tdea/3tdea/aes>] [-k <key>] [-f <none/an10922/gallagher>] [-i <kdfi>] [-m <plain/mac/encrypt>] [-c <native/niso/iso>] [-s <d40/ev1/ev2/lrp>] [--aid <app id hex>] [--appisoid <isoid hex>] [--keynum <key number hex>] [--keyset <keyset num hex>] [--no-auth]"
},
"hf mfdes getuid": {
"command": "hf mfdes getuid",
"description": "get uid from card. get the real uid if the random uid bit is on and get the same uid as in anticollision if not. any card's key needs to be provided.",
"notes": [
"hf mfdes getuid -> execute with default factory setup",
"hf mfdes getuid --appisoid df01 -t aes -s lrp -> for desfire lights default settings"
],
"offline": false,
"options": [
"-h, --help this help",
"-a, --apdu show apdu requests and responses",
"-v, --verbose show technical data",
"-n, --keyno <keyno> key number",
"-t, --algo <des/2tdea/3tdea/aes> crypt algo: des, 2tdea, 3tdea, aes",
"-k, --key <key> key for authenticate (hex 8(des), 16(2tdea or aes) or 24(3tdea) bytes)",
"-f, --kdf <none/an10922/gallagher> key derivation function (kdf): none, an10922, gallagher",
"-i, --kdfi <kdfi> kdf input (hex 1-31 bytes)",
"-m, --cmode <plain/mac/encrypt> communicaton mode: plain/mac/encrypt",
"-c, --ccset <native/niso/iso> communicaton command set: native/niso/iso",
"-s, --schann <d40/ev1/ev2/lrp> secure channel: d40/ev1/ev2/lrp",
"--aid <app id hex> application id (3 hex bytes, big endian)",
"--appisoid <isoid hex> application iso id (iso df id) (2 hex bytes, big endian)."
],
"usage": "hf mfdes getuid [-hav] [-n <keyno>] [-t <des/2tdea/3tdea/aes>] [-k <key>] [-f <none/an10922/gallagher>] [-i <kdfi>] [-m <plain/mac/encrypt>] [-c <native/niso/iso>] [-s <d40/ev1/ev2/lrp>] [--aid <app id hex>] [--appisoid <isoid hex>]"
},
"hf mfdes help": {
"command": "hf mfdes help",
"description": "help this help list list desfire (iso 14443a) history test test crypto --------------------------------------------------------------------------------------- hf mfdes info available offline: no get info from mifare desfire tags",
"notes": [
"hf mfdes info"
],
"offline": true,
"options": [
"-h, --help this help"
],
"usage": "hf mfdes info [-h]"
},
"hf mfdes list": {
"command": "hf mfdes list",
"description": "alias of `trace list -t des` with selected protocol data to annotate trace buffer you can load a trace from file (see `trace load -h`) or it be downloaded from device by default it accepts all other arguments of `trace list`. note that some might not be relevant for this specific protocol",
"notes": [
"hf mfdes list -f -> show frame delay times",
"hf mfdes list -1 -> use trace buffer"
],
"offline": true,
"options": [
"-h, --help this help",
"-1, --buffer use data from trace buffer",
"-f show frame delay times",
"-c mark crc bytes",
"-r show relative times (gap and duration)",
"-u display times in microseconds instead of clock cycles",
"-x show hexdump to convert to pcap(ng)",
"or to import into wireshark using encapsulation type \"iso 14443\"",
"--dict <file> use dictionary keys file"
],
"usage": "hf mfdes list [-h1fcrux] [--dict <file>]"
},
"hf mfdes lsapp": {
"command": "hf mfdes lsapp",
"description": "show application list. master key needs to be provided or flag --no-auth set (depend on cards settings).",
"notes": [
"hf mfdes lsapp -> show application list with defaults from `default` command",
"hf mfdes lsapp --files -> show application list and show each file type/settings/etc for each application"
],
"offline": false,
"options": [
"-h, --help this help",
"-a, --apdu show apdu requests and responses",
"-v, --verbose show technical data",
"-n, --keyno <keyno> key number",
"-t, --algo <des/2tdea/3tdea/aes> crypt algo: des, 2tdea, 3tdea, aes",
"-k, --key <key> key for authenticate (hex 8(des), 16(2tdea or aes) or 24(3tdea) bytes)",
"-f, --kdf <none/an10922/gallagher> key derivation function (kdf): none, an10922, gallagher",
"-i, --kdfi <kdfi> kdf input (hex 1-31 bytes)",
"-m, --cmode <plain/mac/encrypt> communicaton mode: plain/mac/encrypt",
"-c, --ccset <native/niso/iso> communicaton command set: native/niso/iso",
"-s, --schann <d40/ev1/ev2/lrp> secure channel: d40/ev1/ev2/lrp",
"--no-auth execute without authentication",
"--no-deep not to check authentication commands that avail for any application",
"--files scan files and print file settings for each application"
],
"usage": "hf mfdes lsapp [-hav] [-n <keyno>] [-t <des/2tdea/3tdea/aes>] [-k <key>] [-f <none/an10922/gallagher>] [-i <kdfi>] [-m <plain/mac/encrypt>] [-c <native/niso/iso>] [-s <d40/ev1/ev2/lrp>] [--no-auth] [--no-deep] [--files]"
},
"hf mfdes lsfiles": {
"command": "hf mfdes lsfiles",
"description": "show file list. master key needs to be provided or flag --no-auth set (depend on cards settings).",
"notes": [
"hf mfdes lsfiles --aid 123456 -> show file list for: app=123456 with defaults from `default` commandhf mfdes lsfiles --appisoid df01 --no-auth -> show files from desfire light"
],
"offline": false,
"options": [
"-h, --help this help",
"-a, --apdu show apdu requests and responses",
"-v, --verbose show technical data",
"-n, --keyno <keyno> key number",
"-t, --algo <des/2tdea/3tdea/aes> crypt algo: des, 2tdea, 3tdea, aes",
"-k, --key <key> key for authenticate (hex 8(des), 16(2tdea or aes) or 24(3tdea) bytes)",
"-f, --kdf <none/an10922/gallagher> key derivation function (kdf): none, an10922, gallagher",
"-i, --kdfi <kdfi> kdf input (hex 1-31 bytes)",
"-m, --cmode <plain/mac/encrypt> communicaton mode: plain/mac/encrypt",
"-c, --ccset <native/niso/iso> communicaton command set: native/niso/iso",
"-s, --schann <d40/ev1/ev2/lrp> secure channel: d40/ev1/ev2/lrp",
"--aid <app id hex> application id (3 hex bytes, big endian)",
"--appisoid <isoid hex> application iso id (iso df id) (2 hex bytes, big endian).",
"--no-auth execute without authentication"
],
"usage": "hf mfdes lsfiles [-hav] [-n <keyno>] [-t <des/2tdea/3tdea/aes>] [-k <key>] [-f <none/an10922/gallagher>] [-i <kdfi>] [-m <plain/mac/encrypt>] [-c <native/niso/iso>] [-s <d40/ev1/ev2/lrp>] [--aid <app id hex>] [--appisoid <isoid hex>] [--no-auth]"
},
"hf mfdes mad": {
"command": "hf mfdes mad",
"description": "reads and prints mifare application directory (mad).",
"notes": [
"mad consists of one file with issuer info (aid ffffff) and several files with aid in the special format `faaaav` (a - mad id, v - multiple aid over one mad id)",
"the mifare desfire card master key settings have to allow the mifare desfire command getapplicationids without authentication (from datasheet)",
"",
"hf mfdes mad -> shows mad data",
"hf mfdes mad -v -> shows mad parsed and raw data",
"hf mfdes mad -a e103 -k d3f7d3f7d3f7d3f7d3f7d3f7d3f7d3f7 -> shows mad data with custom aid and key"
],
"offline": false,
"options": [
"-h, --help this help",
"-a, --apdu show apdu requests and responses",
"-v, --verbose show technical data",
"-n, --keyno <keyno> key number",
"-t, --algo <des/2tdea/3tdea/aes> crypt algo: des, 2tdea, 3tdea, aes",
"-k, --key <key> key for authenticate (hex 8(des), 16(2tdea or aes) or 24(3tdea) bytes)",
"-f, --kdf <none/an10922/gallagher> key derivation function (kdf): none, an10922, gallagher",
"-i, --kdfi <kdfi> kdf input (hex 1-31 bytes)",
"-m, --cmode <plain/mac/encrypt> communicaton mode: plain/mac/encrypt",
"-c, --ccset <native/niso/iso> communicaton command set: native/niso/iso",
"-s, --schann <d40/ev1/ev2/lrp> secure channel: d40/ev1/ev2/lrp",
"--aid <app id hex> application id of issuer info file, (non-standard feature!) (3 hex bytes, big endian)",
"--auth authenticate to get info from getapplicationids command (non-standard feature!)"
],
"usage": "hf mfdes mad [-hav] [-n <keyno>] [-t <des/2tdea/3tdea/aes>] [-k <key>] [-f <none/an10922/gallagher>] [-i <kdfi>] [-m <plain/mac/encrypt>] [-c <native/niso/iso>] [-s <d40/ev1/ev2/lrp>] [--aid <app id hex>] [--auth]"
},
"hf mfdes read": {
"command": "hf mfdes read",
"description": "read data from file. key needs to be provided or flag --no-auth set (depend on file settings).",
"notes": [
"it reads file via all command sets.",
"for iso command set it can be read by specifying full 2-byte iso id or 1-byte short iso id (first byte of the full iso id). iso id lays in the data in big endian format.",
"iso record commands: offset - record number (0-current, 1..ff-number, 1-lastest), length - if 0 - all records, if 1 - one",
"",
"hf mfdes read --aid 123456 --fid 01 -> read file: app=123456, file=01, offset=0, all the data. use default channel settings from `default` command",
"hf mfdes read --aid 123456 --fid 01 --type record --offset 000000 --length 000001 -> read one last record from record file. use default channel settings from `default` command",
"hf mfdes read --aid 123456 --fid 10 --type data -c iso -> read file via iso channel: app=123456, short iso id=10, offset=0.",
"hf mfdes read --aid 123456 --fileisoid 1000 --type data -c iso -> read file via iso channel: app=123456, iso id=1000, offset=0. select via native iso wrapper",
"hf mfdes read --appisoid 0102 --fileisoid 1000 --type data -c iso -> read file via iso channel: app iso id=0102, iso id=1000, offset=0. select via iso commands",
"hf mfdes read --appisoid 0102 --fileisoid 1100 --type record -c iso --offset 000005 --length 000001 -> get one record (number 5) from file 1100 via iso commands",
"hf mfdes read --appisoid 0102 --fileisoid 1100 --type record -c iso --offset 000005 --length 000000 -> get all record (from 5 to 1) from file 1100 via iso commands",
"hf mfdes read --appisoid df01 --fid 00 -s lrp -t aes --length 000010 -> read via lrp channel",
"hf mfdes read --appisoid df01 --fid 00 -s ev2 -t aes --length 000010 --isochain -> read desfire light via ev2 channel"
],
"offline": false,
"options": [
"-h, --help this help",
"-a, --apdu show apdu requests and responses",
"-v, --verbose show technical data",
"-n, --keyno <keyno> key number",
"-t, --algo <des/2tdea/3tdea/aes> crypt algo: des, 2tdea, 3tdea, aes",
"-k, --key <key> key for authenticate (hex 8(des), 16(2tdea or aes) or 24(3tdea) bytes)",
"-f, --kdf <none/an10922/gallagher> key derivation function (kdf): none, an10922, gallagher",
"-i, --kdfi <kdfi> kdf input (hex 1-31 bytes)",
"-m, --cmode <plain/mac/encrypt> communicaton mode: plain/mac/encrypt",
"-c, --ccset <native/niso/iso> communicaton command set: native/niso/iso",
"-s, --schann <d40/ev1/ev2/lrp> secure channel: d40/ev1/ev2/lrp",
"--aid <app id hex> application id (3 hex bytes, big endian)",
"--fid <file id hex> file id (1 hex byte)",
"--no-auth execute without authentication",
"--type <auto/data/value/record/mac> file type auto/data(standard/backup)/value/record(linear/cyclic)/mac). auto - check file settings and then read. default: auto",
"-o, --offset <hex> file offset (3 hex bytes, big endian). for records - record number (0 - lastest record). default 0",
"-l, --length <hex> length to read (3 hex bytes, big endian -> 000000 = read all data). for records - records count (0 - all). default 0.",
"--appisoid <isoid hex> application iso id (iso df id) (2 hex bytes, big endian).",
"--fileisoid <isoid hex> file iso id (iso df id) (2 hex bytes, big endian). works only for iso read commands.",
"--isochain use iso chaining commands. switched on by default if secure channel = lrp"
],
"usage": "hf mfdes read [-hav] [-n <keyno>] [-t <des/2tdea/3tdea/aes>] [-k <key>] [-f <none/an10922/gallagher>] [-i <kdfi>] [-m <plain/mac/encrypt>] [-c <native/niso/iso>] [-s <d40/ev1/ev2/lrp>] [--aid <app id hex>] [--fid <file id hex>] [--no-auth] [--type <auto/data/value/record/mac>] [-o <hex>] [-l <hex>] [--appisoid <isoid hex>] [--fileisoid <isoid hex>] [--isochain]"
},
"hf mfdes selectapp": {
"command": "hf mfdes selectapp",
"description": "select application on the card. it selects app if it is a valid one or returns an error.",
"notes": [
"hf mfdes selectapp --aid 123456 -> select application 123456",
"hf mfdes selectapp --mf -> select master file (picc level)",
"hf mfdes selectapp --dfname aid123456 -> select application aid123456 by df name",
"hf mfdes selectapp --isoid 1111 -> select application 1111 by iso id",
"hf mfdes selectapp --isoid 1111 --fileisoid 2222 -> select application 1111 file 2222 by iso id",
"hf mfdes selectapp --isoid 01df --fileisoid 00ef -> select file 00 on the desfire light"
],
"offline": false,
"options": [
"-h, --help this help",
"-a, --apdu show apdu requests and responses",
"-v, --verbose show technical data",
"-n, --keyno <keyno> key number",
"-t, --algo <des/2tdea/3tdea/aes> crypt algo: des, 2tdea, 3tdea, aes",
"-k, --key <key> key for authenticate (hex 8(des), 16(2tdea or aes) or 24(3tdea) bytes)",
"-f, --kdf <none/an10922/gallagher> key derivation function (kdf): none, an10922, gallagher",
"-i, --kdfi <kdfi> kdf input (hex 1-31 bytes)",
"-m, --cmode <plain/mac/encrypt> communicaton mode: plain/mac/encrypt",
"-c, --ccset <native/niso/iso> communicaton command set: native/niso/iso",
"-s, --schann <d40/ev1/ev2/lrp> secure channel: d40/ev1/ev2/lrp",
"--aid <app id hex> application id of application for some parameters (3 hex bytes, big endian)",
"--dfname <df name str> application df name (string, max 16 chars). selects application via iso select command",
"--mf select mf (master file) via iso channel",
"--isoid <isoid hex> application iso id (iso df id) (2 hex bytes, big endian)",
"--fileisoid <isoid hex> select file inside application by iso id (iso df id) (2 hex bytes, big endian)."
],
"usage": "hf mfdes selectapp [-hav] [-n <keyno>] [-t <des/2tdea/3tdea/aes>] [-k <key>] [-f <none/an10922/gallagher>] [-i <kdfi>] [-m <plain/mac/encrypt>] [-c <native/niso/iso>] [-s <d40/ev1/ev2/lrp>] [--aid <app id hex>] [--dfname <df name str>] [--mf] [--isoid <isoid hex>] [--fileisoid <isoid hex>]"
},
"hf mfdes setconfig": {
"command": "hf mfdes setconfig",
"description": "set card configuration. warning! danger zone! needs to provide card's master key and works if not blocked by config.",
"notes": [
"more about options mf2dlhx0.pdf. options list:",
"00h picc configuration.",
"02h ats update.",
"03h sak update",
"04h secure messaging configuration.",
"05h capability data. (here change for lrp in the desfire light [enable 00000000010000000000])",
"06h df name renaming (one-time)",
"08h file renaming (one-time)",
"09h value file configuration (one-time)",
"0ah failed authentication counter setting [disable 00ffffffff]",
"0bh hw configuration",
"",
"hf mfdes setconfig --param 03 --data 0428 -> set sak",
"hf mfdes setconfig --param 02 --data 0875778102637264 -> set ats (first byte - length)",
"hf mfdes setconfig --appisoid df01 -t aes -s ev2 --param 05 --data 00000000020000000000 -> set lrp mode enable for desfire light",
"hf mfdes setconfig --appisoid df01 -t aes -s ev2 --param 0a --data 00ffffffff -> disable failed auth counters for desfire light",
"hf mfdes setconfig --appisoid df01 -t aes -s lrp --param 0a --data 00ffffffff -> disable failed auth counters for desfire light via lrp channel"
],
"offline": false,
"options": [
"-h, --help this help",
"-a, --apdu show apdu requests and responses",
"-v, --verbose show technical data",
"-n, --keyno <keyno> key number",
"-t, --algo <des/2tdea/3tdea/aes> crypt algo: des, 2tdea, 3tdea, aes",
"-k, --key <key> key for authenticate (hex 8(des), 16(2tdea or aes) or 24(3tdea) bytes)",
"-f, --kdf <none/an10922/gallagher> key derivation function (kdf): none, an10922, gallagher",
"-i, --kdfi <kdfi> kdf input (hex 1-31 bytes)",
"-m, --cmode <plain/mac/encrypt> communicaton mode: plain/mac/encrypt",
"-c, --ccset <native/niso/iso> communicaton command set: native/niso/iso",
"-s, --schann <d40/ev1/ev2/lrp> secure channel: d40/ev1/ev2/lrp",
"--aid <app id hex> application id of application for some parameters (3 hex bytes, big endian)",
"--appisoid <isoid hex> application iso id (iso df id) (2 hex bytes, big endian).",
"-p, --param <hex 1 byte> parameter id (hex 1 byte)",
"-d, --data <data hex> data for parameter (hex 1..30 bytes)"
],
"usage": "hf mfdes setconfig [-hav] [-n <keyno>] [-t <des/2tdea/3tdea/aes>] [-k <key>] [-f <none/an10922/gallagher>] [-i <kdfi>] [-m <plain/mac/encrypt>] [-c <native/niso/iso>] [-s <d40/ev1/ev2/lrp>] [--aid <app id hex>] [--appisoid <isoid hex>] [-p <hex 1 byte>] [-d <data hex>]"
},
"hf mfdes test": {
"command": "hf mfdes test",
"description": "[=] ------ desfire tests ------ [!] no space for crc. pos: 1 [=] crc16............. passed [!] no space for crc. pos: 2 [=] crc32............. passed [=] cmac subkeys...... passed [=] an10922 aes....... passed [=] an10922 2tdea..... passed [=] an10922 3tdea..... passed [=] cmac 3tdea........ passed [=] cmac 2tdea........ passed [=] cmac des.......... passed [=] ev2 session keys.. passed [=] ev2 iv calc....... passed [=] ev2 mac calc...... passed [=] trans session key. passed [=] lrp plaintexts.... passed [=] lrp updated keys.. passed [=] lrp eval.......... passed [=] lrp inc counter... passed [=] lrp encode........ passed [=] lrp decode........ passed [=] lrp subkeys....... passed [=] lrp cmac.......... passed [=] lrp session keys.. passed [=] --------------------------- [+] tests [ ok ] ======================================================================================= hf seos { seos rfids... } --------------------------------------------------------------------------------------- hf seos help available offline: yes help this help list list seos history --------------------------------------------------------------------------------------- hf seos info available offline: no get info from seos tags",
"notes": [
"hf seos info"
],
"offline": true,
"options": [
"-h, --help this help"
],
"usage": "hf seos info [-h]"
},
"hf mfdes value": {
"command": "hf mfdes value",
"description": "get file settings from file from application. master key needs to be provided or flag --no-auth set (depend on cards settings).",
"notes": [
"hf mfdes value --aid 123456 --fid 01 -> get value app=123456, file=01 with defaults from `default` command",
"hf mfdes value --aid 123456 --fid 01 --op credit -d 00000001 -> credit value app=123456, file=01 with defaults from `default` command",
"hf mfdes value -n 0 -t des -k 0000000000000000 -f none --aid 123456 --fid 01 -> get value with default factory setup",
"hf mfdes val --appisoid df01 --fid 03 -s lrp -t aes -n 1 --op credit --d 00000001 -m encrypt -> credit value in the lrp encrypted mode",
"hf mfdes val --appisoid df01 --fid 03 -s lrp -t aes -n 1 --op get -m plain -> get value in plain (nevertheless of mode) works for desfire light (look setconfiguration option 0x09)"
],
"offline": false,
"options": [
"-h, --help this help",
"-a, --apdu show apdu requests and responses",
"-v, --verbose show technical data",
"-n, --keyno <keyno> key number",
"-t, --algo <des/2tdea/3tdea/aes> crypt algo: des, 2tdea, 3tdea, aes",
"-k, --key <key> key for authenticate (hex 8(des), 16(2tdea or aes) or 24(3tdea) bytes)",
"-f, --kdf <none/an10922/gallagher> key derivation function (kdf): none, an10922, gallagher",
"-i, --kdfi <kdfi> kdf input (hex 1-31 bytes)",
"-m, --cmode <plain/mac/encrypt> communicaton mode: plain/mac/encrypt",
"-c, --ccset <native/niso/iso> communicaton command set: native/niso/iso",
"-s, --schann <d40/ev1/ev2/lrp> secure channel: d40/ev1/ev2/lrp",
"--aid <app id hex> application id (3 hex bytes, big endian)",
"--appisoid <isoid hex> application iso id (iso df id) (2 hex bytes, big endian).",
"--fid <file id hex> file id (1 hex byte)",
"-o, --op <get/credit/limcredit/debit/clear> operation: get(default)/credit/limcredit(limited credit)/debit/clear. operation clear: get-getopt-debit to min value",
"-d, --data <value hex> value for operation (hex 4 bytes)",
"--no-auth execute without authentication"
],
"usage": "hf mfdes value [-hav] [-n <keyno>] [-t <des/2tdea/3tdea/aes>] [-k <key>] [-f <none/an10922/gallagher>] [-i <kdfi>] [-m <plain/mac/encrypt>] [-c <native/niso/iso>] [-s <d40/ev1/ev2/lrp>] [--aid <app id hex>] [--appisoid <isoid hex>] [--fid <file id hex>] [-o <get/credit/limcredit/debit/clear>] [-d <value hex>] [--no-auth]"
},
"hf mfdes write": {
"command": "hf mfdes write",
"description": "write data from file. key needs to be provided or flag --no-auth set (depend on file settings).",
"notes": [
"in the mode with commitreaderid to decode previous reader id command needs to read transaction counter via dump/read command and specify --trkey",
"",
"hf mfdes write --aid 123456 --fid 01 -d 01020304 -> write file: app=123456, file=01, offset=0, get file type from card. use default channel settings from `default` command",
"hf mfdes write --aid 123456 --fid 01 --type data -d 01020304 --0ffset 000100 -> write data to std file with offset 0x100",
"hf mfdes write --aid 123456 --fid 01 --type data -d 01020304 --commit -> write data to backup file with commit",
"hf mfdes write --aid 123456 --fid 01 --type value -d 00000001 -> increment value file",
"hf mfdes write --aid 123456 --fid 01 --type value -d 00000001 --debit -> decrement value file",
"hf mfdes write --aid 123456 --fid 01 -d 01020304 -> write data to file with `auto` type",
"hf mfdes write --aid 123456 --fid 01 --type record -d 01020304 -> write data to record file",
"hf mfdes write --aid 123456 --fid 01 --type record -d 01020304 --updaterec 0 -> update record in the record file. record 0 - lastest record.",
"hf mfdes write --aid 123456 --fid 01 --type record --offset 000000 -d 11223344 -> write record to record file. use default channel settings from `default` command",
"hf mfdes write --appisoid 1234 --fileisoid 1000 --type data -c iso -d 01020304 -> write data to std/backup file via iso commandset",
"hf mfdes write --appisoid 1234 --fileisoid 2000 --type record -c iso -d 01020304 -> send record to record file via iso commandset",
"hf mfdes write --aid 123456 --fid 01 -d 01020304 --readerid 010203 -> write data to file with commitreaderid command before write and committransaction after write",
"hf mfdes write --appisoid df01 --fid 04 -d 01020304 --trkey 00112233445566778899aabbccddeeff --readerid 5532 -t aes -s lrp -> advanced commitreaderid via lrp channel sample"
],
"offline": false,
"options": [
"-h, --help this help",
"-a, --apdu show apdu requests and responses",
"-v, --verbose show technical data",
"-n, --keyno <keyno> key number",
"-t, --algo <des/2tdea/3tdea/aes> crypt algo: des, 2tdea, 3tdea, aes",
"-k, --key <key> key for authenticate (hex 8(des), 16(2tdea or aes) or 24(3tdea) bytes)",
"-f, --kdf <none/an10922/gallagher> key derivation function (kdf): none, an10922, gallagher",
"-i, --kdfi <kdfi> kdf input (hex 1-31 bytes)",
"-m, --cmode <plain/mac/encrypt> communicaton mode: plain/mac/encrypt",
"-c, --ccset <native/niso/iso> communicaton command set: native/niso/iso",
"-s, --schann <d40/ev1/ev2/lrp> secure channel: d40/ev1/ev2/lrp",
"--aid <app id hex> application id (3 hex bytes, big endian)",
"--fid <file id hex> file id (1 hex byte)",
"--no-auth execute without authentication",
"--type <auto/data/value/record/mac> file type auto/data(standard/backup)/value/record(linear/cyclic)/mac). auto - check file settings and then write. default: auto",
"-o, --offset <hex> file offset (3 hex bytes, big endian). for records - record number (0 - lastest record). default 0",
"-d, --data <hex> data for write (data/record file), credit/debit(value file)",
"--debit use for value file debit operation instead of credit",
"--commit commit needs for backup file only. for the other file types and in the `auto` mode - command set it automatically.",
"--updaterec <record number dec> record number for update record command. updates record instead of write. lastest record - 0",
"--appisoid <isoid hex> application iso id (iso df id) (2 hex bytes, big endian).",
"--fileisoid <isoid hex> file iso id (iso df id) (2 hex bytes, big endian). works only for iso write commands.",
"--readerid <hex> reader id for commitreaderid command. if present - the command issued before write command.",
"--trkey <hex> key for decode previous reader id."
],
"usage": "hf mfdes write [-hav] [-n <keyno>] [-t <des/2tdea/3tdea/aes>] [-k <key>] [-f <none/an10922/gallagher>] [-i <kdfi>] [-m <plain/mac/encrypt>] [-c <native/niso/iso>] [-s <d40/ev1/ev2/lrp>] [--aid <app id hex>] [--fid <file id hex>] [--no-auth] [--type <auto/data/value/record/mac>] [-o <hex>] [-d <hex>] [--debit] [--commit] [--updaterec <record number dec>] [--appisoid <isoid hex>] [--fileisoid <isoid hex>] [--readerid <hex>] [--trkey <hex>]"
},
"hf mfp auth": {
"command": "hf mfp auth",
"description": "executes aes authentication command for mifare plus card",
"notes": [
"hf mfp auth --ki 4000 --key 000102030405060708090a0b0c0d0e0f -> executes authentication",
"hf mfp auth --ki 9003 --key ffffffffffffffffffffffffffffffff -v -> executes authentication and shows all the system data"
],
"offline": false,
"options": [
"-h, --help this help",
"-v, --verbose show internal data.",
"--ki <hex> key number, 2 hex bytes",
"--key <hex> key, 16 hex bytes"
],
"usage": "hf mfp auth [-hv] --ki <hex> --key <hex>"
},
"hf mfp chk": {
"command": "hf mfp chk",
"description": "checks keys with mifare plus card.",
"notes": [
"hf mfp chk -k 000102030405060708090a0b0c0d0e0f -> check key on sector 0 as key a and b",
"hf mfp chk -s 2 -a -> check default key list on sector 2, key a",
"hf mfp chk -d mfp_default_keys -s0 -e6 -> check keys from dictionary against sectors 0-6",
"hf mfp chk --pattern1b -j keys -> check all 1-byte keys pattern and save found keys to json",
"hf mfp chk --pattern2b --startp2b fa00 -> check all 2-byte keys pattern. start from key fa00fa00...fa00"
],
"offline": false,
"options": [
"-h, --help this help",
"-a, --keya check only key a (by default check all keys).",
"-b, --keyb check only key b (by default check all keys).",
"-k, --key <key> key for checking (hex 16 bytes)",
"-d, --dict <file> file with keys dictionary",
"--pattern1b check all 1-byte combinations of key (0000...0000, 0101...0101, 0202...0202, ...)",
"--pattern2b check all 2-byte combinations of key (0000...0000, 0001...0001, 0002...0002, ...)",
"--startp2b <pattern> start key (2-byte hex) for 2-byte search (use with `--pattern2b`)",
"-j, --json <file> json file to save keys",
"-v, --verbose verbose mode."
],
"usage": "hf mfp chk [-habv] [-s start sector num (0..255)] [-e end sector num (0..255)] [-k <key>] [-d <file>] [--pattern1b] [--pattern2b] [--startp2b <pattern>] [-j <file>]"
},
"hf mfp commitp": {
"command": "hf mfp commitp",
"description": "executes commit perso command. can be used in sl0 mode only.",
"notes": [
"hf mfp commitp"
],
"offline": false,
"options": [
"-h, --help this help",
"-v, --verbose show internal data."
],
"usage": "hf mfp commitp [-hv]"
},
"hf mfp help": {
"command": "hf mfp help",
"description": "help this help --------------------------------------------------------------------------------------- hf mfp info available offline: no get info from mifare plus tags",
"notes": [
"hf mfp info"
],
"offline": true,
"options": [
"-h, --help this help"
],
"usage": "hf mfp info [-h]"
},
"hf mfp initp": {
"command": "hf mfp initp",
"description": "executes write perso command for all card's keys. can be used in sl0 mode only.",
"notes": [
"hf mfp initp --key 000102030405060708090a0b0c0d0e0f -> fill all the keys with key (00..0f)",
"hf mfp initp -vv -> fill all the keys with default key(0xff..0xff) and show all the data exchange"
],
"offline": false,
"options": [
"-h, --help this help",
"-v, --verbose show internal data.",
"-k, --key <hex> key, 16 hex bytes"
],
"usage": "hf mfp initp [-hv] [-k <hex>]"
},
"hf mfp mad": {
"command": "hf mfp mad",
"description": "checks and prints mifare application directory (mad)",
"notes": [
"hf mfp mad",
"hf mfp mad --aid e103 -k d3f7d3f7d3f7d3f7d3f7d3f7d3f7d3f7 -> read and print ndef data from mad aid"
],
"offline": false,
"options": [
"-h, --help this help",
"-v, --verbose show technical data",
"--aid <aid> print all sectors with aid",
"-k, --key <key> key for printing sectors",
"-b, --keyb use key b for access printing sectors (by default: key a)",
"--be (optional, bigendian)",
"--dch decode card holder information"
],
"usage": "hf mfp mad [-hvb] [--aid <aid>] [-k <key>] [--be] [--dch]"
},
"hf mfp ndefread": {
"command": "hf mfp ndefread",
"description": "prints nfc data exchange format (ndef)",
"notes": [
"hf mfp ndefread",
"hf mfp ndefread -vv -> shows ndef parsed and raw data",
"hf mfp ndefread --aid e103 -k d3f7d3f7d3f7d3f7d3f7d3f7d3f7d3f7 -> shows ndef data with custom aid and key",
"hf mfp ndefread -f myfilename -> save raw ndef to file"
],
"offline": false,
"options": [
"-h, --help this help",
"-v, --verbose show technical data",
"--aid <aid> replace default aid for ndef",
"-k, --key <key> replace default key for ndef",
"-b, --keyb use key b for access sectors (by default: key a)",
"-f, --file <fn> save raw ndef to file"
],
"usage": "hf mfp ndefread [-hvb] [--aid <aid>] [-k <key>] [-f <fn>]"
},
"hf mfp rdbl": {
"command": "hf mfp rdbl",
"description": "reads several blocks from mifare plus card",
"notes": [
"hf mfp rdbl --blk 0 --key 000102030405060708090a0b0c0d0e0f -> executes authentication and read block 0 data",
"hf mfp rdbl --blk 1 -v -> executes authentication and shows sector 1 data with default key 0xff..0xff"
],
"offline": false,
"options": [
"-h, --help this help",
"-v, --verbose show internal data",
"-n, --count <dec> blocks count (by default 1)",
"-b, --keyb use key b (by default keya)",
"-p, --plain plain communication mode between reader and card",
"--blk <dec> block number (0..255)",
"--key <hex> key, 16 hex bytes"
],
"usage": "hf mfp rdbl [-hvbp] [-n <dec>] --blk <dec> [--key <hex>]"
},
"hf mfp rdsc": {
"command": "hf mfp rdsc",
"description": "reads one sector from mifare plus card",
"notes": [
"hf mfp rdsc -s 0 --key 000102030405060708090a0b0c0d0e0f -> executes authentication and read sector 0 data",
"hf mfp rdsc -s 1 -v -> executes authentication and shows sector 1 data with default key"
],
"offline": false,
"options": [
"-h, --help this help",
"-v, --verbose show internal data.",
"-b, --keyb use key b (by default keya).",
"-p, --plain plain communication mode between reader and card.",
"-s, --sn <dec> sector number (0..255)",
"-k, --key <hex> key, 16 hex bytes"
],
"usage": "hf mfp rdsc [-hvbp] -s <dec> [-k <hex>]"
},
"hf mfp wrbl": {
"command": "hf mfp wrbl",
"description": "writes one block to mifare plus card",
"notes": [
"hf mfp wrbl --blk 1 -d ff0000000000000000000000000000ff --key 000102030405060708090a0b0c0d0e0f -> write block 1 data",
"hf mfp wrbl --blk 2 -d ff0000000000000000000000000000ff -v -> write block 2 data with default key 0xff..0xff"
],
"offline": false,
"options": [
"-h, --help this help",
"-v, --verbose show internal data.",
"-b, --keyb use key b (by default keya).",
"--blk <dec> block number (0..255)",
"-d, --data <hex> data, 16 hex bytes",
"-k, --key <hex> key, 16 hex bytes"
],
"usage": "hf mfp wrbl [-hvb] --blk <dec> -d <hex> [-k <hex>]"
},
"hf mfp wrp": {
"command": "hf mfp wrp",
"description": "executes write perso command. can be used in sl0 mode only.",
"notes": [
"hf mfp wrp --ki 4000 --key 000102030405060708090a0b0c0d0e0f -> write key (00..0f) to key number 4000",
"hf mfp wrp --ki 4000 -> write default key(0xff..0xff) to key number 4000"
],
"offline": false,
"options": [
"-h, --help this help",
"-v, --verbose show internal data.",
"--ki <hex> key number, 2 hex bytes",
"--key <hex> key, 16 hex bytes"
],
"usage": "hf mfp wrp [-hv] --ki <hex> [--key <hex>]"
},
"hf mfu cauth": {
"command": "hf mfu cauth",
"description": "tests 3des password on mifare ultralight-c tag. if password is not specified, a set of known defaults will be tested.",
"notes": [
"hf mfu cauth",
"hf mfu cauth --key 000102030405060708090a0b0c0d0e0f"
],
"offline": false,
"options": [
"-h, --help this help",
"--key <hex> key for authentication (ul-c 16 bytes)",
"-l swap entered key's endianness",
"-k keep field on (only if a password is provided too)"
],
"usage": "hf mfu cauth [-hlk] [--key <hex>]"
},
"hf mfu dump": {
"command": "hf mfu dump",
"description": "reads all pages from ultralight, ultralight-c, ultralight ev1 ntag 203, ntag 210, ntag 212, ntag 213, ntag 215, ntag 216 and saves data into binary/json files. it autodetects card type.",
"notes": [
"hf mfu dump -f myfile -> dump whole tag, save to `myfile.bin`",
"hf mfu dump -k aabbccdd -> dump whole tag using pwd aabbccdd",
"hf mfu dump -p 10 -> start at page 10 and dump rest of blocks",
"hf mfu dump -p 10 -q 2 -> start at page 10 and dump two blocks",
"hf mfu dump --key 00112233445566778899aabbccddeeff"
],
"offline": false,
"options": [
"-h, --help this help",
"-f, --file <fn> specify a filename for dump file",
"-k, --key <hex> key for authentication (ul-c 16 bytes, ev1/ntag 4 bytes)",
"-l swap entered key's endianness",
"-p, --page <dec> manually set start page number to start from",
"-q, --qty <dec> manually set number of pages to dump"
],
"usage": "hf mfu dump [-hl] [-f <fn>] [-k <hex>] [-p <dec>] [-q <dec>]"
},
"hf mfu eload": {
"command": "hf mfu eload",
"description": "load emulator memory with data from `filename.eml` dump file see `script run data_mfu_bin2eml` to convert the .bin to .eml",
"notes": [
"hf mfu eload --ul -f hf-mfu-04010203040506.eml",
"hf mfu eload --ul -f hf-mfu-04010203040506.eml -q 57 -> load 57 blocks from myfile"
],
"offline": false,
"options": [
"-h, --help this help",
"-f, --file <fn> filename of dump",
"--ul mifare ultralight family",
"-q, --qty <dec> number of blocks to load from eml file"
],
"usage": "hf mfu eload [-h] -f <fn> --ul [-q <dec>]"
},
"hf mfu eview": {
"command": "hf mfu eview",
"description": "it displays emulator memory",
"notes": [
"hf mfu eview"
],
"offline": false,
"options": [
"-h, --help this help"
],
"usage": "hf mfu eview [-h]"
},
"hf mfu help": {
"command": "hf mfu help",
"description": "help this help keygen generate 3des mifare diversified keys pwdgen generate pwd from known algos --------------------------------------------------------------------------------------- hf mfu keygen available offline: yes set the 3des key on mifare ultralight-c tag.",
"notes": [
"hf mfu keygen -r",
"hf mfu keygen --uid 11223344556677"
],
"offline": true,
"options": [
"-h, --help this help",
"-u, --uid <hex> <4|7> hex byte uid",
"-r read uid from tag"
],
"usage": "hf mfu keygen [-hr] [-u <hex>]"
},
"hf mfu info": {
"command": "hf mfu info",
"description": "get info about mifare ultralight family styled tag. sometimes the tags are locked down, and you may need a key to be able to read the information",
"notes": [
"hf mfu info",
"hf mfu info -k aabbccdd",
"hf mfu info --key 00112233445566778899aabbccddeeff"
],
"offline": false,
"options": [
"-h, --help this help",
"-k, --key <hex> key for authentication (ul-c 16 bytes, ev1/ntag 4 bytes)",
"-l swap entered key's endianness"
],
"usage": "hf mfu info [-hl] [-k <hex>]"
},
"hf mfu ndefread": {
"command": "hf mfu ndefread",
"description": "prints nfc data exchange format (ndef)",
"notes": [
"hf mfu ndefread -> shows ndef data",
"hf mfu ndefread -k ffffffff -> shows ndef data with key",
"hf mfu ndefread -f myfilename -> save raw ndef to file"
],
"offline": false,
"options": [
"-h, --help this help",
"-l swap entered key's endianness",
"-f, --file <fn> save raw ndef to file"
],
"usage": "hf mfu ndefread [-hl] [-k replace default key for ndef] [-f <fn>]"
},
"hf mfu otptear": {
"command": "hf mfu otptear",
"description": "tear-off test against otp block",
"notes": [
"hf mfu otptear -b 3",
"hf mfu otptear -b 3 -i 100 -s 1000",
"hf mfu otptear -b 3 -i 1 -e 200",
"hf mfu otptear -b 3 -i 100 -s 200 -e 2500 -d ffffffff -t eeeeeeee",
"hf mfu otptear -b 3 -i 100 -s 200 -e 2500 -d ffffffff -t eeeeeeee -m 00000000 -> quit when otp is reset"
],
"offline": false,
"options": [
"-h, --help this help",
"-b, --blk <dec> target block (def 8)",
"-i, --inc <dec> increase time steps (def 500 us)",
"-e, --end <dec> end time (def 3000 us)",
"-s, --start <dec> start time (def 0 us)",
"-d, --data <hex> initialise data before run (4 bytes)",
"-t, --test <hex> test write data (4 bytes, 00000000 by default)",
"-m, --match <hex> exit criteria, if block matches this value (4 bytes)"
],
"usage": "hf mfu otptear [-h] [-b <dec>] [-i <dec>] [-e <dec>] [-s <dec>] [-d <hex>] [-t <hex>] [-m <hex>]"
},
"hf mfu pwdgen": {
"command": "hf mfu pwdgen",
"description": "generate different passwords from known pwdgen algos",
"notes": [
"hf mfu pwdgen -r",
"hf mfu pwdgen -t",
"hf mfu pwdgen --uid 11223344556677"
],
"offline": true,
"options": [
"-h, --help this help",
"-u, --uid <hex> uid (7 bytes)",
"-r read uid from tag",
"-t selftest"
],
"usage": "hf mfu pwdgen [-hrt] [-u <hex>]"
},
"hf mfu rdbl": {
"command": "hf mfu rdbl",
"description": "read a block and print. it autodetects card type.",
"notes": [
"hf mfu rdbl -b 0",
"hf mfu rdbl -b 0 -k aabbccdd",
"hf mfu rdbl -b 0 --key 00112233445566778899aabbccddeeff"
],
"offline": false,
"options": [
"-h, --help this help",
"-k, --key <hex> key for authentication (ul-c 16 bytes, ev1/ntag 4 bytes)",
"-l swap entered key's endianness",
"-b, --block <dec> block number to read",
"--force force operation even if address is out of range"
],
"usage": "hf mfu rdbl [-hl] [-k <hex>] -b <dec> [--force]"
},
"hf mfu restore": {
"command": "hf mfu restore",
"description": "restore dumpfile onto card.",
"notes": [
"hf mfu restore -f myfile -s -> user specified filename and special write",
"hf mfu restore -f myfile -k aabbccdd -s -> user specified filename, special write and use key",
"hf mfu restore -f myfile -k aabbccdd -ser -> user specified filename, special write, use key, ..."
],
"offline": false,
"options": [
"-h, --help this help",
"-f, --file <fn> specify a filename to restore",
"-k, --key <hex> key for authentication (ul-c 16 bytes, ev1/ntag 4 bytes)",
"-l swap entered key's endianness",
"-s enable special write uid -magic tag only-",
"-e enable special write version/signature -magic ntag 21* only-",
"-r use the password found in dumpfile to configure tag. requires '-e' parameter to work",
"-v, --verbose verbose"
],
"usage": "hf mfu restore [-hlserv] -f <fn> [-k <hex>]"
},
"hf mfu setpwd": {
"command": "hf mfu setpwd",
"description": "set the 3des key on mifare ultralight-c tag.",
"notes": [
"hf mfu setpwd --key 000102030405060708090a0b0c0d0e0f"
],
"offline": false,
"options": [
"-h, --help this help",
"-k, --key <hex> new key (16 bytes)"
],
"usage": "hf mfu setpwd [-h] [-k <hex>]"
},
"hf mfu setuid": {
"command": "hf mfu setuid",
"description": "set uid on mifare ultralight tag. this only works for `magic ultralight` tags.",
"notes": [
"hf mfu setuid --uid 11223344556677"
],
"offline": false,
"options": [
"-h, --help this help",
"-u, --uid <hex> new uid (7 bytes)"
],
"usage": "hf mfu setuid [-h] [-u <hex>]"
},
"hf mfu sim": {
"command": "hf mfu sim",
"description": "simulate mifare ultralight family type based upon iso/iec 14443 type a tag with 4,7 or 10 byte uid from emulator memory. see `hf mfu eload` first. see `hf 14a sim -h` to see available types. you want 2 or 7 usually.",
"notes": [
"hf mfu sim -t 2 --uid 11223344556677 -> mifare ultralight",
"hf mfu sim -t 7 --uid 11223344556677 -n 5 -> amiibo (ntag 215), pack 0x8080"
],
"offline": false,
"options": [
"-h, --help this help",
"-t, --type <1-10> simulation type to use",
"-u, --uid <hex> 4, 7 or 10 byte uid",
"-n, --num <dec> exit simulation after <numreads> blocks have been read by reader. 0 = infinite",
"-v, --verbose verbose output"
],
"usage": "hf mfu sim [-hv] -t <1-10> [-u <hex>] [-n <dec>]"
},
"hf mfu wrbl": {
"command": "hf mfu wrbl",
"description": "write a block. it autodetects card type.",
"notes": [
"hf mfu wrbl -b 0 -d 01234567",
"hf mfu wrbl -b 0 -d 01234567 -k aabbccdd",
"hf mfu wrbl -b 0 -d 01234567 -k 00112233445566778899aabbccddeeff"
],
"offline": false,
"options": [
"-h, --help this help",
"-k, --key <hex> key for authentication (ul-c 16 bytes, ev1/ntag 4 bytes)",
"-l swap entered key's endianness",
"-b, --block <dec> block number to write",
"-d, --data <hex> block data (4 or 16 hex bytes, 16 hex bytes will do a compatibility write)",
"--force force operation even if address is out of range"
],
"usage": "hf mfu wrbl [-hl] [-k <hex>] -b <dec> -d <hex> [--force]"
},
"hf plot": {
"command": "hf plot",
"description": "plots hf signal after rf signal path and a/d conversion.",
"notes": [
"this can be used after any hf command and will show the last few milliseconds of the hf signal.",
"note: if the last hf command terminated because of a timeout you will most probably see nothing."
],
"offline": false,
"options": [
"-h, --help this help"
],
"usage": "hf plot [-h]"
},
"hf search": {
"command": "hf search",
"description": "will try to find a hf read out of the unknown tag. continues to search for all different hf protocols.",
"notes": [
"hf search"
],
"offline": true,
"options": [
"-h, --help this help",
"-v, --verbose verbose output"
],
"usage": "hf search [-hv]"
},
"hf seos list": {
"command": "hf seos list",
"description": "alias of `trace list -t 7816` with selected protocol data to annotate trace buffer you can load a trace from file (see `trace load -h`) or it be downloaded from device by default it accepts all other arguments of `trace list`. note that some might not be relevant for this specific protocol",
"notes": [
"hf seos list -f -> show frame delay times",
"hf seos list -1 -> use trace buffer"
],
"offline": true,
"options": [
"-h, --help this help",
"-1, --buffer use data from trace buffer",
"-f show frame delay times",
"-c mark crc bytes",
"-r show relative times (gap and duration)",
"-u display times in microseconds instead of clock cycles",
"-x show hexdump to convert to pcap(ng)",
"or to import into wireshark using encapsulation type \"iso 14443\"",
"--dict <file> use dictionary keys file"
],
"usage": "hf seos list [-h1fcrux] [--dict <file>]"
},
"hf sniff": {
"command": "hf sniff",
"description": "the high frequency sniffer will assign all available memory on device for sniffed data. use `data samples` to download from device and `data plot` to visualize it. press button to quit the sniffing.",
"notes": [
"hf sniff",
"hf sniff --sp 1000 --st 0 -> skip 1000 pairs, skip 0 triggers"
],
"offline": false,
"options": [
"-h, --help this help",
"--sp <dec> skip sample pairs",
"--st <dec> skip number of triggers"
],
"usage": "hf sniff [-h] [--sp <dec>] [--st <dec>]"
},
"hf st25ta help": {
"command": "hf st25ta help",
"description": "help this help list list iso 14443a/7816 history ndefread read ndef file on tag --------------------------------------------------------------------------------------- hf st25ta info available offline: no get info about st25ta tag",
"notes": [
"hf st25ta info"
],
"offline": true,
"options": [
"-h, --help this help"
],
"usage": "hf st25ta info [-h]"
},
"hf st25ta list": {
"command": "hf st25ta list",
"description": "alias of `trace list -t 7816` with selected protocol data to annotate trace buffer you can load a trace from file (see `trace load -h`) or it be downloaded from device by default it accepts all other arguments of `trace list`. note that some might not be relevant for this specific protocol",
"notes": [
"hf st25ta list -f -> show frame delay times",
"hf st25ta list -1 -> use trace buffer"
],
"offline": true,
"options": [
"-h, --help this help",
"-1, --buffer use data from trace buffer",
"-f show frame delay times",
"-c mark crc bytes",
"-r show relative times (gap and duration)",
"-u display times in microseconds instead of clock cycles",
"-x show hexdump to convert to pcap(ng)",
"or to import into wireshark using encapsulation type \"iso 14443\"",
"--dict <file> use dictionary keys file"
],
"usage": "hf st25ta list [-h1fcrux] [--dict <file>]"
},
"hf st25ta ndefread": {
"command": "hf st25ta ndefread",
"description": "read nfc data exchange format (ndef) file on st25ta",
"notes": [
"hf st25ta ndefread -p 82e80053d4ca5c0b656d852cc696c8a1",
"hf st25ta ndefread -f myfilename -> save raw ndef to file"
],
"offline": true,
"options": [
"-h, --help this help",
"-p, --pwd <hex> 16 byte read password",
"-f, --file <fn> save raw ndef to file"
],
"usage": "hf st25ta ndefread [-h] [-p <hex>] [-f <fn>]"
},
"hf st25ta protect": {
"command": "hf st25ta protect",
"description": "change read or write protection for nfc data exchange format (ndef) file on st25ta",
"notes": [
"hf st25ta protect -p 82e80053d4ca5c0b656d852cc696c8a1 -r -e -> enable read protection",
"hf st25ta protect -p 82e80053d4ca5c0b656d852cc696c8a1 -w -d -> disable write protection"
],
"offline": false,
"options": [
"-h, --help this help",
"-e, --enable enable protection",
"-d, --disable disable protection (default)",
"-r, --read change read protection",
"-w, --write change write protection (default)",
"-p, --password <hex> 16 byte write password"
],
"usage": "hf st25ta protect [-hedrw] -p <hex>"
},
"hf st25ta pwd": {
"command": "hf st25ta pwd",
"description": "change read or write password for nfc data exchange format (ndef) file on st25ta",
"notes": [
"hf st25ta pwd -p 82e80053d4ca5c0b656d852cc696c8a1 -r -n 00000000000000000000000000000000 -> change read password",
"hf st25ta pwd -p 82e80053d4ca5c0b656d852cc696c8a1 -w -n 00000000000000000000000000000000 -> change write password"
],
"offline": false,
"options": [
"-h, --help this help",
"-r, --read change the read password (default)",
"-w, --write change the write password",
"-p, --password <hex> current 16 byte write password",
"-n, --new <hex> new 16 byte password"
],
"usage": "hf st25ta pwd [-hrw] -p <hex> -n <hex>"
},
"hf st25ta sim": {
"command": "hf st25ta sim",
"description": "emulating st25ta512b tag with 7 byte uid",
"notes": [
"hf st25ta sim -u 02e2007d0fca4c"
],
"offline": false,
"options": [
"-h, --help this help",
"-u, --uid <hex> 7 byte uid"
],
"usage": "hf st25ta sim [-h] -u <hex>"
},
"hf thinfilm help": {
"command": "hf thinfilm help",
"description": "help this help list list nfc barcode / thinfilm history - not correct --------------------------------------------------------------------------------------- hf thinfilm info available offline: no get info from thinfilm tags",
"notes": [
"hf thinfilm info"
],
"offline": true,
"options": [
"-h, --help this help"
],
"usage": "hf thinfilm info [-h]"
},
"hf thinfilm list": {
"command": "hf thinfilm list",
"description": "alias of `trace list -t thinfilm` with selected protocol data to annotate trace buffer you can load a trace from file (see `trace load -h`) or it be downloaded from device by default it accepts all other arguments of `trace list`. note that some might not be relevant for this specific protocol",
"notes": [
"hf thinfilm list -f -> show frame delay times",
"hf thinfilm list -1 -> use trace buffer"
],
"offline": true,
"options": [
"-h, --help this help",
"-1, --buffer use data from trace buffer",
"-f show frame delay times",
"-c mark crc bytes",
"-r show relative times (gap and duration)",
"-u display times in microseconds instead of clock cycles",
"-x show hexdump to convert to pcap(ng)",
"or to import into wireshark using encapsulation type \"iso 14443\"",
"--dict <file> use dictionary keys file"
],
"usage": "hf thinfilm list [-h1fcrux] [--dict <file>]"
},
"hf thinfilm sim": {
"command": "hf thinfilm sim",
"description": "simulate thinfilm tag",
"notes": [
"hf thinfilm sim -d b70470726f786d61726b2e636f6d"
],
"offline": false,
"options": [
"-h, --help this help",
"-d, --data <hex> bytes to send",
"--raw raw, provided bytes should include crc"
],
"usage": "hf thinfilm sim [-h] -d <hex> [--raw]"
},
"hf topaz help": {
"command": "hf topaz help",
"description": "help this help list list topaz history --------------------------------------------------------------------------------------- hf topaz list available offline: yes alias of `trace list -t topaz` with selected protocol data to annotate trace buffer you can load a trace from file (see `trace load -h`) or it be downloaded from device by default it accepts all other arguments of `trace list`. note that some might not be relevant for this specific protocol",
"notes": [
"hf topaz list -f -> show frame delay times",
"hf topaz list -1 -> use trace buffer"
],
"offline": true,
"options": [
"-h, --help this help",
"-1, --buffer use data from trace buffer",
"-f show frame delay times",
"-c mark crc bytes",
"-r show relative times (gap and duration)",
"-u display times in microseconds instead of clock cycles",
"-x show hexdump to convert to pcap(ng)",
"or to import into wireshark using encapsulation type \"iso 14443\"",
"--dict <file> use dictionary keys file"
],
"usage": "hf topaz list [-h1fcrux] [--dict <file>]"
},
"hf topaz info": {
"command": "hf topaz info",
"description": "get info from topaz tags",
"notes": [
"hf topaz info",
"hf topaz info -f myfilename -> save raw ndef to file"
],
"offline": false,
"options": [
"-h, --help this help",
"-f, --file <fn> save raw ndef to file",
"-v, --verbose verbose output"
],
"usage": "hf topaz info [-hv] [-f <fn>]"
},
"hf topaz raw": {
"command": "hf topaz raw",
"description": "send raw hex data to topaz tags",
"notes": [
"hf topaz raw -> not yet implemented"
],
"offline": false,
"options": [
"-h, --help this help"
],
"usage": "hf topaz raw [-h]"
},
"hf topaz reader": {
"command": "hf topaz reader",
"description": "read uid from topaz tags",
"notes": [
"hf topaz reader"
],
"offline": false,
"options": [
"-h, --help this help",
"-v, --verbose verbose output"
],
"usage": "hf topaz reader [-hv]"
},
"hf topaz sim": {
"command": "hf topaz sim",
"description": "simulate a topaz tag",
"notes": [
"hf topaz sim -> not yet implemented"
],
"offline": false,
"options": [
"-h, --help this help"
],
"usage": "hf topaz sim [-h]"
},
"hf topaz sniff": {
"command": "hf topaz sniff",
"description": "sniff topaz reader-tag communication",
"notes": [
"hf topaz sniff"
],
"offline": false,
"options": [
"-h, --help this help"
],
"usage": "hf topaz sniff [-h]"
},
"hf tune": {
"command": "hf tune",
"description": "continuously measure hf antenna tuning. press button or <enter> to interrupt.",
"notes": [
"hf tune",
"hf tune --mix"
],
"offline": false,
"options": [
"-h, --help this help",
"-n, --iter <dec> number of iterations (default: 0=infinite)",
"--bar bar style",
"--mix mixed style",
"--value values style"
],
"usage": "hf tune [-h] [-n <dec>] [--bar] [--mix] [--value]"
},
"hf waveshare help": {
"command": "hf waveshare help",
"description": "help this help --------------------------------------------------------------------------------------- hf waveshare loadbmp available offline: no load bmp file to waveshare nfc epaper.",
"notes": [
"hf waveshare loadbmp -f myfile -m 0 -> 2.13 inch e-paper ( 122, 250 )",
"hf waveshare loadbmp -f myfile -m 1 -> 2.9 inch e-paper ( 296, 128 )",
"hf waveshare loadbmp -f myfile -m 2 -> 4.2 inch e-paper ( 400, 300 )",
"hf waveshare loadbmp -f myfile -m 3 -> 7.5 inch e-paper ( 800, 480 )",
"hf waveshare loadbmp -f myfile -m 4 -> 2.7 inch e-paper ( 176, 276 )",
"hf waveshare loadbmp -f myfile -m 5 -> 2.13 inch e-paper b (with red) ( 104, 212 )",
"hf waveshare loadbmp -f myfile -m 6 -> 1.54 inch e-paper b (with red) ( 200, 200 )",
"hf waveshare loadbmp -f myfile -m 7 -> 7.5 inch e-paper hd ( 880, 528 )"
],
"offline": true,
"options": [
"-h, --help this help",
"-m <nr> model number [0 - 7] of your tag",
"-s, --save save dithered version in filename-[n].bmp, only for rgb bmp",
"-f, --file <fn> specify filename[.bmp] to upload to tag"
],
"usage": "hf waveshare loadbmp [-hs] -m <nr> -f <fn>"
},
"hints": {
"command": "hints",
"description": "turn on/off hints",
"notes": [
"hints --on",
"hints -1"
],
"offline": true,
"options": [
"-h, --help this help",
"-1, --on turn on hints",
"-0, --off turn off hints"
],
"usage": "hints [-h10]"
},
"hw connect": {
"command": "hw connect",
"description": "connects to a proxmark3 device via specified serial port. baudrate here is only for physical uart or uart-bt, not for usb-cdc or blue shark add-on",
"notes": [
"hw connect -p /dev/ttyacm0",
"hw connect -p /dev/ttyacm0 -b 115200"
],
"offline": true,
"options": [
"-h, --help this help",
"-p, --port <string> serial port to connect to, else retry the last used one",
"-b, --baud <dec> baudrate"
],
"usage": "hw connect [-h] [-p <string>] [-b <dec>]"
},
"hw dbg": {
"command": "hw dbg",
"description": "set device side debug level output. note: option -4, this option may cause malfunction itself",
"notes": [
"hw dbg -1"
],
"offline": false,
"options": [
"-h, --help this help",
"-0 no debug messages",
"-1 error messages",
"-2 plus information messages",
"-3 plus debug messages",
"-4 print even debug messages in timing critical functions"
],
"usage": "hw dbg [-h01234]"
},
"hw detectreader": {
"command": "hw detectreader",
"description": "start to detect presences of reader field",
"notes": [
"hw detectreader -l"
],
"offline": false,
"options": [
"-h, --help this help",
"-l, --lf detect low frequence 125/134 khz",
"-h, --hf detect high frequence 13.56 mhz"
],
"usage": "hw detectreader [-hlh]"
},
"hw fpgaoff": {
"command": "hw fpgaoff",
"description": "turn of fpga and antenna field",
"notes": [
"hw fpgaoff"
],
"offline": false,
"options": [
"-h, --help this help"
],
"usage": "hw fpgaoff [-h]"
},
"hw help": {
"command": "hw help",
"description": "------------- ----------------------- hardware ----------------------- help this help connect connect proxmark3 to serial port version show version information about the client and the connected proxmark3, if any --------------------------------------------------------------------------------------- hw break available offline: no send break loop package",
"notes": [
"hw break"
],
"offline": true,
"options": [
"-h, --help this help"
],
"usage": "hw break [-h]"
},
"hw lcd": {
"command": "hw lcd",
"description": "send command/data to lcd",
"notes": [
"hw lcd -r aa -c 03 -> sends 0xaa three times"
],
"offline": false,
"options": [
"-h, --help this help",
"-r, --raw <hex> data",
"-c, --cnt <dec> number of times to send"
],
"usage": "hw lcd [-h] -r <hex> -c <dec>"
},
"hw lcdreset": {
"command": "hw lcdreset",
"description": "hardware reset lcd",
"notes": [
"hw lcdreset"
],
"offline": false,
"options": [
"-h, --help this help"
],
"usage": "hw lcdreset [-h]"
},
"hw ping": {
"command": "hw ping",
"description": "test if the proxmark3 is responsive",
"notes": [
"hw ping",
"hw ping --len 32"
],
"offline": false,
"options": [
"-h, --help this help",
"-l, --len <dec> length of payload to send"
],
"usage": "hw ping [-h] [-l <dec>]"
},
"hw readmem": {
"command": "hw readmem",
"description": "read memory at decimal address from arm chip flash.",
"notes": [
"hw readmem -a 10000"
],
"offline": false,
"options": [
"-h, --help this help",
"-a, --adr <dec> address to read"
],
"usage": "hw readmem [-h] -a <dec>"
},
"hw reset": {
"command": "hw reset",
"description": "reset the proxmark3 device.",
"notes": [
"hw reset"
],
"offline": false,
"options": [
"-h, --help this help"
],
"usage": "hw reset [-h]"
},
"hw setlfdivisor": {
"command": "hw setlfdivisor",
"description": "drive lf antenna at 12 mhz / (divisor + 1).",
"notes": [
"hw setlfdivisor -d 88"
],
"offline": false,
"options": [
"-h, --help this help",
"-d, --div <dec> 19 - 255 divisor value (def 95)"
],
"usage": "hw setlfdivisor [-h] -d <dec>"
},
"hw setmux": {
"command": "hw setmux",
"description": "set the adc mux to a specific value",
"notes": [
"hw setmux --hipkd -> set high peak"
],
"offline": false,
"options": [
"-h, --help this help",
"--lopkd low peak",
"--loraw low raw",
"--hipkd high peak",
"--hiraw high raw"
],
"usage": "hw setmux [-h] [--lopkd] [--loraw] [--hipkd] [--hiraw]"
},
"hw standalone": {
"command": "hw standalone",
"description": "start standalone mode",
"notes": [
"hw standalone -> start",
"hw standalone -a 1 -> start and send arg 1"
],
"offline": false,
"options": [
"-h, --help this help",
"-a, --arg <dec> argument byte"
],
"usage": "hw standalone [-h] [-a <dec>]"
},
"hw status": {
"command": "hw status",
"description": "show runtime status information about the connected proxmark3",
"notes": [
"hw status"
],
"offline": false,
"options": [
"-h, --help this help"
],
"usage": "hw status [-h]"
},
"hw tearoff": {
"command": "hw tearoff",
"description": "configure a tear-off hook for the next write command supporting tear-off after having been triggered by a write command, the tear-off hook is deactivated delay (in us) must be between 1 and 43000 (43ms). precision is about 1/3us.",
"notes": [
"hw tearoff --delay 1200 -> define delay of 1200us",
"hw tearoff --on -> (re)activate a previously defined delay",
"hw tearoff --off -> deactivate a previously activated but not yet triggered hook"
],
"offline": false,
"options": [
"-h, --help this help",
"--delay <dec> delay in us before triggering tear-off, must be between 1 and 43000",
"--on activate tear-off hook",
"--off deactivate tear-off hook",
"-s, --silent less verbose output"
],
"usage": "hw tearoff [-hs] [--delay <dec>] [--on] [--off]"
},
"hw tia": {
"command": "hw tia",
"description": "trigger a timing interval acquisition to re-adjust the realtimecounter divider",
"notes": [
"hw tia"
],
"offline": false,
"options": [
"-h, --help this help"
],
"usage": "hw tia [-h]"
},
"hw tune": {
"command": "hw tune",
"description": "measure antenna tuning",
"notes": [
"hw tune"
],
"offline": false,
"options": [
"-h, --help this help"
],
"usage": "hw tune [-h]"
},
"hw version": {
"command": "hw version",
"description": "show version information about the client and the connected proxmark3",
"notes": [
"hw version"
],
"offline": true,
"options": [
"-h, --help this help"
],
"usage": "hw version [-h]"
},
"lf awid brute": {
"command": "lf awid brute",
"description": "enables bruteforce of awid reader with specified facility-code. this is a attack against reader. if cardnumber is given, it starts with it and goes up / down one step if cardnumber is not given, it starts with 1 and goes up to 65535",
"notes": [
"lf awid brute --fmt 26 --fc 224",
"lf awid brute --fmt 50 --fc 2001 --delay 2000",
"lf awid brute --fmt 50 --fc 2001 --cn 200 --delay 2000 -v"
],
"offline": false,
"options": [
"-h, --help this help",
"--fmt <dec> format length 26|50",
"--fc <dec> 8|16bit value facility code",
"--cn <dec> optional - card number to start with, max 65535",
"--delay <dec> optional - delay betweens attempts in ms. default 1000ms",
"-v, --verbose verbose logging, show all tries"
],
"usage": "lf awid brute [-hv] --fmt <dec> --fc <dec> [--cn <dec>] [--delay <dec>]"
},
"lf awid clone": {
"command": "lf awid clone",
"description": "clone a awid prox tag to a t55x7, q5/t5555 or em4305/4469 tag",
"notes": [
"lf awid clone --fmt 26 --fc 123 --cn 1337",
"lf awid clone --fmt 50 --fc 2001 --cn 13371337",
"lf awid clone --q5 --fmt 26 --fc 123 --cn 1337 -> encode for q5/t5555 tag",
"lf awid clone --em --fmt 26 --fc 123 --cn 1337 -> encode for em4305/4469"
],
"offline": false,
"options": [
"-h, --help this help",
"--fmt <dec> format length 26|34|37|50",
"--fc <dec> 8|16bit value facility code",
"--cn <dec> 16|32-bit value card number",
"--q5 optional - specify writing to q5/t5555 tag",
"--em optional - specify writing to em4305/4469 tag"
],
"usage": "lf awid clone [-h] --fmt <dec> --fc <dec> --cn <dec> [--q5] [--em]"
},
"lf awid help": {
"command": "lf awid help",
"description": "help this help demod demodulate an awid fsk tag from the graphbuffer --------------------------------------------------------------------------------------- lf awid demod available offline: yes try to find awid prox preamble, if found decode / descramble data",
"notes": [
"lf awid demod"
],
"offline": true,
"options": [
"-h, --help this help"
],
"usage": "lf awid demod [-h]"
},
"lf awid reader": {
"command": "lf awid reader",
"description": "read a awid prox tag",
"notes": [
"lf awid reader -@ -> continuous reader mode"
],
"offline": false,
"options": [
"-h, --help this help",
"-@ optional - continuous reader mode"
],
"usage": "lf awid reader [-h@]"
},
"lf awid sim": {
"command": "lf awid sim",
"description": "enables simulation of awid card with specified facility-code and card number. simulation runs until the button is pressed or another usb command is issued.",
"notes": [
"lf awid sim --fmt 26 --fc 123 --cn 1337",
"lf awid sim --fmt 50 --fc 2001 --cn 13371337"
],
"offline": false,
"options": [
"-h, --help this help",
"--fmt <dec> format length 26|32|36|40",
"--fc <dec> 8-bit value facility code",
"--cn <dec> 16-bit value card number"
],
"usage": "lf awid sim [-h] --fmt <dec> --fc <dec> --cn <dec>"
},
"lf awid watch": {
"command": "lf awid watch",
"description": "enables awid compatible reader mode printing details of scanned awid26 or awid50 tags. run until the button is pressed or another usb command is issued.",
"notes": [
"lf awid watch"
],
"offline": false,
"options": [
"-h, --help this help"
],
"usage": "lf awid watch [-h]"
},
"lf cmdread": {
"command": "lf cmdread",
"description": "modulate lf reader field to send command before read. all periods in microseconds. - use `lf config` to set parameters",
"notes": [
"lf cmdread -d 50 -z 116 -o 166 -e w3000 -c w00110 -> probing for hitag 1/s",
"lf cmdread -d 50 -z 116 -o 166 -e w3000 -c w11000 -> probing for hitag 2",
"lf cmdread -d 50 -z 116 -o 166 -e w3000 -c w11000 -q -s 2000 -@ -> probing for hitag 2, oscilloscope style",
"lf cmdread -d 48 -z 112 -o 176 -e w3000 -e s240 -e e336 -c w0s00000010000e -> probing for hitag (us)"
],
"offline": false,
"options": [
"-h, --help this help",
"-d, --duration <us> delay off period, (0 for bitbang mode)",
"-c, --cmd <0|1|...> command symbols",
"-e, --extra <us> extra symbol definition and duration (up to 4)",
"-o, --one <us> one time period",
"-z, --zero <us> zero time period",
"-s, --samples <dec> number of samples to collect",
"-v, --verbose verbose output",
"-k, --keep keep signal field on after receive",
"--crc-ht calculate and append crc-8/hitag (also for zx8211)",
"-@ continuous mode"
],
"usage": "lf cmdread [-hvk@] [-d <us>] [-c <0|1|...>] [-e <us>]... [-o <us>] [-z <us>] [-s <dec>] [--crc-ht]"
},
"lf cotag help": {
"command": "lf cotag help",
"description": "help this help demod demodulate an cotag tag --------------------------------------------------------------------------------------- lf cotag demod available offline: yes try to find cotag preamble, if found decode / descramble data",
"notes": [
"lf cotag demod"
],
"offline": true,
"options": [
"-h, --help this help"
],
"usage": "lf cotag demod [-h]"
},
"lf cotag reader": {
"command": "lf cotag reader",
"description": "read a cotag tag, the current support for cotag is limited.",
"notes": [
"lf cotag reader -2"
],
"offline": false,
"options": [
"-h, --help this help",
"-1 high/low signal; maxlength bigbuff",
"-2 translation of high/low into bytes with manchester 0,1",
"-3 raw signal; maxlength bigbuff"
],
"usage": "lf cotag reader [-h123]"
},
"lf destron clone": {
"command": "lf destron clone",
"description": "clone a destron tag to a t55x7, q5/t5555 or em4305/4469 tag.",
"notes": [
"lf destron clone --uid 1a2b3c4d5e",
"lf destron clone --q5 --uid 1a2b3c4d5e -> encode for q5/t5555 tag",
"lf destron clone --em --uid 1a2b3c4d5e -> encode for em4305/4469"
],
"offline": false,
"options": [
"-h, --help this help",
"-u, --uid <hex> 5 bytes max",
"--q5 optional - specify writing to q5/t5555 tag",
"--em optional - specify writing to em4305/4469 tag"
],
"usage": "lf destron clone [-h] -u <hex> [--q5] [--em]"
},
"lf destron help": {
"command": "lf destron help",
"description": "help this help demod demodulate an destron tag from the graphbuffer --------------------------------------------------------------------------------------- lf destron demod available offline: yes try to find destron preamble, if found decode / descramble data",
"notes": [
"lf destron demod"
],
"offline": true,
"options": [
"-h, --help this help"
],
"usage": "lf destron demod [-h]"
},
"lf destron reader": {
"command": "lf destron reader",
"description": "read a destron tag",
"notes": [
"lf destron reader -@ -> continuous reader mode"
],
"offline": false,
"options": [
"-h, --help this help",
"-@ optional - continuous reader mode"
],
"usage": "lf destron reader [-h@]"
},
"lf destron sim": {
"command": "lf destron sim",
"description": "try to find destron preamble, if found decode / descramble data",
"notes": [
"lf destron sim"
],
"offline": false,
"options": [
"-h, --help this help"
],
"usage": "lf destron sim [-h]"
},
"lf em 410x brute": {
"command": "lf em 410x brute",
"description": "bruteforcing by emulating em 410x tag",
"notes": [
"lf em 410x brute -f ids.txt",
"lf em 410x brute -f ids.txt --clk 32",
"lf em 410x brute -f ids.txt --delay 3000",
"lf em 410x brute -f ids.txt --delay 3000 --clk 32"
],
"offline": false,
"options": [
"-h, --help this help",
"--clk <dec> <32|64> clock (default 64)",
"--delay <dec> pause delay in milliseconds between uids simulation (default 1000ms)",
"-f, --file <hex> file with em tag ids, one id per line",
"--gap <dec> gap (0's) between id repeats (default 20)"
],
"usage": "lf em 410x brute [-h] [--clk <dec>] [--delay <dec>] -f <hex> [--gap <dec>]"
},
"lf em 410x clone": {
"command": "lf em 410x clone",
"description": "writes em410x id to a t55x7 or q5/t5555 tag",
"notes": [
"lf em 410x clone --id 0f0368568b -> write t55x7 tag",
"lf em 410x clone --id 0f0368568b --q5 -> write q5/t5555 tag"
],
"offline": false,
"options": [
"-h, --help this help",
"--clk <dec> <16|32|40|64> clock (default 64)",
"--id <hex> em tag id number (5 hex bytes)",
"--q5 specify writing to q5/t5555 tag"
],
"usage": "lf em 410x clone [-h] [--clk <dec>] --id <hex> [--q5]"
},
"lf em 410x reader": {
"command": "lf em 410x reader",
"description": "read em 410x tag",
"notes": [
"lf em 410x reader",
"lf em 410x reader -@ -> continuous reader mode",
"lf em 410x reader --clk 32 -> using a clock of rf/32",
"lf em 410x reader --clk 32 -i -> using a clock of rf/32 and inverting data",
"lf em 410x reader -i -> inverting data",
"lf em 410x reader --clk 64 -i --err 0 -> using a clock of rf/64 and inverting data and allowing 0 demod errors"
],
"offline": false,
"options": [
"-h, --help this help",
"--clk <dec> clock (default autodetect)",
"--err <dec> maximum allowed errors (default 100)",
"--len <dec> maximum length",
"-i, --invert invert output",
"-a, --amp amplify signal",
"-b break on first found",
"-@ continuous reader mode",
"-v, --verbose verbose output"
],
"usage": "lf em 410x reader [-hiab@v] [--clk <dec>] [--err <dec>] [--len <dec>]"
},
"lf em 410x sim": {
"command": "lf em 410x sim",
"description": "enables simulation of em 410x card. simulation runs until the button is pressed or another usb command is issued.",
"notes": [
"lf em 410x sim --id 0f0368568b",
"lf em 410x sim --id 0f0368568b --clk 32",
"lf em 410x sim --id 0f0368568b --gap 0"
],
"offline": false,
"options": [
"-h, --help this help",
"--clk <dec> <32|64> clock (default 64)",
"--id <hex> em tag id number (5 hex bytes)",
"--gap <dec> gap (0's) between id repeats (default 20)"
],
"usage": "lf em 410x sim [-h] [--clk <dec>] --id <hex> [--gap <dec>]"
},
"lf em 410x spoof": {
"command": "lf em 410x spoof",
"description": "watch 'nd spoof, activates reader waits until a em 410x tag gets presented then proxmark3 starts simulating the found em tag id",
"notes": [
"lf em 410x spoof"
],
"offline": false,
"options": [
"-h, --help this help"
],
"usage": "lf em 410x spoof [-h]"
},
"lf em 410x watch": {
"command": "lf em 410x watch",
"description": "enables electro marine (em) compatible reader mode printing details of scanned tags. run until the button is pressed or another usb command is issued.",
"notes": [
"lf em 410x watch"
],
"offline": false,
"options": [
"-h, --help this help"
],
"usage": "lf em 410x watch [-h]"
},
"lf em 4x05 chk": {
"command": "lf em 4x05 chk",
"description": "this command uses a dictionary attack against em4205/4305/4469/4569",
"notes": [
"lf em 4x05 chk",
"lf em 4x05 chk -e 000022b8 -> check password 000022b8",
"lf em 4x05 chk -f t55xx_default_pwds -> use t55xx default dictionary"
],
"offline": false,
"options": [
"-h, --help this help",
"-f, --file <fn> loads a default keys dictionary file <*.dic>",
"-e, --em <em4100> try the calculated password from some cloners based on em4100 id"
],
"usage": "lf em 4x05 chk [-h] [-f <fn>] [-e <em4100>]"
},
"lf em 4x05 demod": {
"command": "lf em 4x05 demod",
"description": "try to find em 4x05 preamble, if found decode / descramble data",
"notes": [
"lf em 4x05 demod"
],
"offline": true,
"options": [
"-h, --help this help"
],
"usage": "lf em 4x05 demod [-h]"
},
"lf em 4x05 dump": {
"command": "lf em 4x05 dump",
"description": "dump em4x05/em4x69. tag must be on antenna.",
"notes": [
"lf em 4x05 dump",
"lf em 4x05 dump -p 11223344",
"lf em 4x05 dump -f myfile -p 11223344"
],
"offline": false,
"options": [
"-h, --help this help",
"-p, --pwd <hex> password (00000000)",
"-f, --file <fn> override filename prefix (optional). default is based on uid"
],
"usage": "lf em 4x05 dump [-h] [-p <hex>] [-f <fn>]"
},
"lf em 4x05 help": {
"command": "lf em 4x05 help",
"description": "help this help demod demodulate a em4x05/em4x69 tag from the graphbuffer sniff attempt to recover em4x05 commands from sample buffer --------------------------------------------------------------------------------------- lf em 4x05 brute available offline: no this command tries to bruteforce the password of a em4205/4305/4469/4569 the loop is running on device side, press proxmark3 button to abort",
"notes": [
"note: if you get many false positives, change position on the antennalf em 4x05 brute",
"lf em 4x05 brute -n 1 -> stop after first candidate found",
"lf em 4x05 brute -s 000022aa -> start at 000022aa"
],
"offline": true,
"options": [
"-h, --help this help",
"-s, --start <hex> start bruteforce enumeration from this password value",
"-n <dec> stop after having found n candidates. default: 0 (infinite)"
],
"usage": "lf em 4x05 brute [-h] [-s <hex>] [-n <dec>]"
},
"lf em 4x05 info": {
"command": "lf em 4x05 info",
"description": "tag information em4205/4305/4469//4569 tags. tag must be on antenna.",
"notes": [
"lf em 4x05 info",
"lf em 4x05 info -p 11223344"
],
"offline": false,
"options": [
"-h, --help this help",
"-p, --pwd <hex> optional - password, 4 hex bytes"
],
"usage": "lf em 4x05 info [-h] [-p <hex>]"
},
"lf em 4x05 read": {
"command": "lf em 4x05 read",
"description": "read em4x05/em4x69. tag must be on antenna.",
"notes": [
"lf em 4x05 read -a 1",
"lf em 4x05 read --addr 1 --pwd 11223344"
],
"offline": false,
"options": [
"-h, --help this help",
"-a, --addr <dec> memory address to read. (0-15)",
"-p, --pwd <hex> optional - password, 4 bytes hex"
],
"usage": "lf em 4x05 read [-h] -a <dec> [-p <hex>]"
},
"lf em 4x05 sniff": {
"command": "lf em 4x05 sniff",
"description": "sniff em4x05 commands sent from a programmer",
"notes": [
"lf em 4x05 sniff -> sniff via lf sniff",
"lf em 4x05 sniff -1 -> sniff from data loaded into the buffer",
"lf em 4x05 sniff -r -> reverse the bit order when showing block data"
],
"offline": true,
"options": [
"-h, --help this help",
"-1, --buf use the data in the buffer",
"-r, --rev reverse the bit order for data blocks"
],
"usage": "lf em 4x05 sniff [-h1r]"
},
"lf em 4x05 unlock": {
"command": "lf em 4x05 unlock",
"description": "execute tear off against em4205/4305/4469/4569",
"notes": [
"lf em 4x05 unlock",
"lf em 4x05 unlock -s 4100 -e 4100 -> lock on and autotune at 4100us",
"lf em 4x05 unlock -n 10 -s 3000 -e 4400 -> scan delays 3000us -> 4400us"
],
"offline": false,
"options": [
"-h, --help this help",
"-n <int> steps to skip",
"-s, --start <us> start scan from delay (us)",
"-e, --end <us> end scan at delay (us)",
"-p, --pwd <hex> password (def 00000000)",
"-v, --verbose verbose output"
],
"usage": "lf em 4x05 unlock [-hv] [-n <int>] [-s <us>] [-e <us>] [-p <hex>]"
},
"lf em 4x05 wipe": {
"command": "lf em 4x05 wipe",
"description": "wipe em4x05/em4x69. tag must be on antenna.",
"notes": [
"lf em 4x05 wipe --4305 -p 11223344 -> wipe em 4305 w pwd",
"lf em 4x05 wipe --4205 -> wipe em 4205",
"lf em 4x05 wipe --4369 -> wipe em 4369"
],
"offline": false,
"options": [
"-h, --help this help",
"--4205 target chip type em 4205",
"--4305 target chip type em 4305 (default)",
"--4369 target chip type em 4369",
"--4369 target chip type em 4469",
"-p, --pwd <hex> optional - password, 4 bytes hex"
],
"usage": "lf em 4x05 wipe [-h] [--4205] [--4305] [--4369] [--4369] [-p <hex>]"
},
"lf em 4x05 write": {
"command": "lf em 4x05 write",
"description": "write em4x05/em4x69. tag must be on antenna.",
"notes": [
"lf em 4x05 write -a 1 -d deadc0de",
"lf em 4x05 write --addr 1 --pwd 11223344 --data deadc0de",
"lf em 4x05 write --po --pwd 11223344 --data deadc0de"
],
"offline": false,
"options": [
"-h, --help this help",
"-a, --addr <dec> memory address to write to. (0-13)",
"-d, --data <hex> data to write (4 hex bytes)",
"-p, --pwd <hex> password (4 hex bytes)",
"--po protect operation"
],
"usage": "lf em 4x05 write [-h] [-a <dec>] -d <hex> [-p <hex>] [--po]"
},
"lf em 4x50 chk": {
"command": "lf em 4x50 chk",
"description": "run dictionary key recovery against em4x50 card.",
"notes": [
"lf em 4x50 chk -> uses t55xx default dictionary",
"lf em 4x50 chk -f my.dic"
],
"offline": false,
"options": [
"-h, --help this help",
"-f, --file <fn> specify dictionary filename"
],
"usage": "lf em 4x50 chk [-h] [-f <fn>]"
},
"lf em 4x50 dump": {
"command": "lf em 4x50 dump",
"description": "reads all blocks/words from em4x50 tag and saves dump in bin/eml/json format",
"notes": [
"lf em 4x50 dump",
"lf em 4x50 dump -f mydump",
"lf em 4x50 dump -p 12345678",
"lf em 4x50 dump -f mydump -p 12345678"
],
"offline": false,
"options": [
"-h, --help this help",
"-f, --file <fn> specify dump filename (bin/eml/json)",
"-p, --pwd <hex> password, 4 hex bytes, lsb"
],
"usage": "lf em 4x50 dump [-h] [-f <fn>] [-p <hex>]"
},
"lf em 4x50 eload": {
"command": "lf em 4x50 eload",
"description": "loads em4x50 tag dump (bin/eml/json) into emulator memory on device",
"notes": [
"lf em 4x50 eload -f mydump.bin"
],
"offline": false,
"options": [
"-h, --help this help",
"-f, --file <fn> dump filename (bin/eml/json)"
],
"usage": "lf em 4x50 eload [-h] -f <fn>"
},
"lf em 4x50 esave": {
"command": "lf em 4x50 esave",
"description": "saves bin/eml/json dump file of emulator memory.",
"notes": [
"lf em 4x50 esave -> use uid as filename",
"lf em 4x50 esave -f mydump"
],
"offline": false,
"options": [
"-h, --help this help",
"-f, --file <fn> specifiy filename"
],
"usage": "lf em 4x50 esave [-h] [-f <fn>]"
},
"lf em 4x50 eview": {
"command": "lf em 4x50 eview",
"description": "displays em4x50 content of emulator memory.",
"notes": [
"lf em 4x50 eview"
],
"offline": false,
"options": [
"-h, --help this help"
],
"usage": "lf em 4x50 eview [-h]"
},
"lf em 4x50 help": {
"command": "lf em 4x50 help",
"description": "help this help ----------- --------------------- operations --------------------- ----------- --------------------- simulation --------------------- --------------------------------------------------------------------------------------- lf em 4x50 brute available offline: no tries to bruteforce the password of a em4x50 card. function can be stopped by pressing pm3 button.",
"notes": [
"lf em 4x50 brute --first 12330000 --last 12340000 -> tries pwds from 0x12330000 to 0x1234000000"
],
"offline": true,
"options": [
"-h, --help this help",
"--first <hex> first password (start), 4 bytes, lsb",
"--last <hex> last password (stop), 4 bytes, lsb"
],
"usage": "lf em 4x50 brute [-h] --first <hex> --last <hex>"
},
"lf em 4x50 info": {
"command": "lf em 4x50 info",
"description": "tag information em4x50.",
"notes": [
"lf em 4x50 info",
"lf em 4x50 info -v -> show data section",
"lf em 4x50 info -p 12345678 -> uses pwd 0x12345678"
],
"offline": false,
"options": [
"-h, --help this help",
"-p, --pwd <hex> password, 4 hex bytes, lsb",
"-v, --verbose additional output of data section"
],
"usage": "lf em 4x50 info [-hv] [-p <hex>]"
},
"lf em 4x50 login": {
"command": "lf em 4x50 login",
"description": "login into em4x50 tag.",
"notes": [
"lf em 4x50 login -p 12345678 -> login with password 12345678"
],
"offline": false,
"options": [
"-h, --help this help",
"-p, --passsword <hex> password, 4 bytes, lsb"
],
"usage": "lf em 4x50 login [-h] -p <hex>"
},
"lf em 4x50 rdbl": {
"command": "lf em 4x50 rdbl",
"description": "reads single em4x50 block/word.",
"notes": [
"lf em 4x50 rdbl -b 3",
"lf em 4x50 rdbl -b 32 -p 12345678 -> reads block 32 with pwd 0x12345678"
],
"offline": false,
"options": [
"-h, --help this help",
"-b, --block <dec> block/word address",
"-p, --pwd <hex> password, 4 hex bytes, lsb"
],
"usage": "lf em 4x50 rdbl [-h] -b <dec> [-p <hex>]"
},
"lf em 4x50 reader": {
"command": "lf em 4x50 reader",
"description": "shows standard read data of em4x50 tag.",
"notes": [
"lf em 4x50 reader",
"lf em 4x50 reader -@ -> continuous reader mode"
],
"offline": false,
"options": [
"-h, --help this help",
"-@ optional - continuous reader mode"
],
"usage": "lf em 4x50 reader [-h@]"
},
"lf em 4x50 restore": {
"command": "lf em 4x50 restore",
"description": "restores data from dumpfile (bin/eml/json) onto a em4x50 tag. if used with -u, the filetemplate `lf-4x50-uid-dump.bin` is used as filename",
"notes": [
"lf em 4x50 restore -u 1b5aff5c -> uses lf-4x50-1b5aff5c-dump.bin",
"lf em 4x50 restore -f mydump.eml",
"lf em 4x50 restore -u 1b5aff5c -p 12345678",
"lf em 4x50 restore -f mydump.eml -p 12345678"
],
"offline": false,
"options": [
"-h, --help this help",
"-u, --uid <hex> uid, 4 hex bytes, msb",
"-f, --file <fn> specify dump filename (bin/eml/json)",
"-p, --pwd <hex> password, 4 hex bytes, lsb"
],
"usage": "lf em 4x50 restore [-h] [-u <hex>] [-f <fn>] [-p <hex>]"
},
"lf em 4x50 sim": {
"command": "lf em 4x50 sim",
"description": "simulates a em4x50 tag first upload to device using `lf em 4x50 eload`",
"notes": [
"lf em 4x50 sim",
"lf em 4x50 sim -p 27182818 -> uses password for eload data"
],
"offline": false,
"options": [
"-h, --help this help",
"-p, --passsword <hex> password, 4 bytes, lsb"
],
"usage": "lf em 4x50 sim [-h] [-p <hex>]"
},
"lf em 4x50 wipe": {
"command": "lf em 4x50 wipe",
"description": "wipes em4x50 tag by filling it with zeros, including the new password must give a password.",
"notes": [
"lf em 4x50 wipe -p 12345678"
],
"offline": false,
"options": [
"-h, --help this help",
"-p, --passsword <hex> password, 4 bytes, lsb"
],
"usage": "lf em 4x50 wipe [-h] -p <hex>"
},
"lf em 4x50 wrbl": {
"command": "lf em 4x50 wrbl",
"description": "writes single block/word to em4x50 tag.",
"notes": [
"lf em 4x50 wrbl -b 3 -d 4f22e7ff",
"lf em 4x50 wrbl -b 3 -d 4f22e7ff -p 12345678"
],
"offline": false,
"options": [
"-h, --help this help",
"-b, --block <dec> block/word address, dec",
"-d, --data <hex> data, 4 bytes, lsb",
"-p, --pwd <hex> password, 4 bytes, lsb"
],
"usage": "lf em 4x50 wrbl [-h] -b <dec> -d <hex> [-p <hex>]"
},
"lf em 4x50 wrpwd": {
"command": "lf em 4x50 wrpwd",
"description": "writes em4x50 password.",
"notes": [
"lf em 4x50 wrpwd -p 4f22e7ff -n 12345678"
],
"offline": false,
"options": [
"-h, --help this help",
"-p, --pwd <hex> password, 4 hex bytes, lsb",
"-n, --new <hex> new password, 4 hex bytes, lsb"
],
"usage": "lf em 4x50 wrpwd [-h] -p <hex> -n <hex>"
},
"lf em 4x70 auth": {
"command": "lf em 4x70 auth",
"description": "authenticate against an em4x70 by sending random number (rn) and f(rn) if f(rn) is incorrect based on the tag crypt key, the tag will not respond",
"notes": [
"lf em 4x70 auth --rnd 45f54ada252aac --frn 4866bb70 -> test authentication, tag will respond if successful"
],
"offline": false,
"options": [
"-h, --help this help",
"--par add parity bit when sending commands",
"--rnd <hex> random 56-bit",
"--frn <hex> f(rn) 28-bit as 4 hex bytes"
],
"usage": "lf em 4x70 auth [-h] [--par] --rnd <hex> --frn <hex>"
},
"lf em 4x70 help": {
"command": "lf em 4x70 help",
"description": "help this help --------------------------------------------------------------------------------------- lf em 4x70 info available offline: no tag information em4x70 tag variants include id48 automotive transponder. id48 does not use command parity (default). v4070 and em4170 do require parity bit.",
"notes": [
"lf em 4x70 info",
"lf em 4x70 info --par -> adds parity bit to command"
],
"offline": true,
"options": [
"-h, --help this help",
"--par add parity bit when sending commands"
],
"usage": "lf em 4x70 info [-h] [--par]"
},
"lf em 4x70 unlock": {
"command": "lf em 4x70 unlock",
"description": "unlock em4x70 by sending pin default pin may be: aaaaaaaa 00000000",
"notes": [
"lf em 4x70 unlock -p 11223344 -> unlock with pin",
"lf em 4x70 unlock -p 11223344 --par -> unlock with pin using parity commands"
],
"offline": false,
"options": [
"-h, --help this help",
"--par add parity bit when sending commands",
"-p, --pin <hex> pin, 4 bytes"
],
"usage": "lf em 4x70 unlock [-h] [--par] -p <hex>"
},
"lf em 4x70 write": {
"command": "lf em 4x70 write",
"description": "write em4x70",
"notes": [
"lf em 4x70 write -b 15 -d c0de -> write 'c0de' to block 15",
"lf em 4x70 write -b 15 -d c0de --par -> adds parity bit to commands"
],
"offline": false,
"options": [
"-h, --help this help",
"--par add parity bit when sending commands",
"-b, --block <dec> block/word address, dec",
"-d, --data <hex> data, 2 bytes"
],
"usage": "lf em 4x70 write [-h] [--par] -b <dec> -d <hex>"
},
"lf em 4x70 writekey": {
"command": "lf em 4x70 writekey",
"description": "write new 96-bit key to tag",
"notes": [
"lf em 4x70 writekey -k f32aa98cf5be4adfa6d3480b"
],
"offline": false,
"options": [
"-h, --help this help",
"--par add parity bit when sending commands",
"-k, --key <hex> crypt key as 12 hex bytes"
],
"usage": "lf em 4x70 writekey [-h] [--par] -k <hex>"
},
"lf em 4x70 writepin": {
"command": "lf em 4x70 writepin",
"description": "write pin",
"notes": [
"lf em 4x70 writepin -p 11223344 -> write pin",
"lf em 4x70 writepin -p 11223344 --par -> write pin using parity commands"
],
"offline": false,
"options": [
"-h, --help this help",
"--par add parity bit when sending commands",
"-p, --pin <hex> pin, 4 bytes"
],
"usage": "lf em 4x70 writepin [-h] [--par] -p <hex>"
},
"lf em help": {
"command": "lf em help",
"description": "help this help 410x { em 4102 commands... } 4x05 { em 4205 / 4305 / 4369 / 4469 commands... } 4x50 { em 4350 / 4450 commands... } 4x70 { em 4070 / 4170 commands... } ======================================================================================= lf em 410x { em 4102 commands... } --------------------------------------------------------------------------------------- lf em 410x help available offline: yes help this help demod demodulate a em410x tag from the graphbuffer --------------------------------------------------------------------------------------- lf em 410x demod available offline: yes try to find em 410x preamble, if found decode / descramble data",
"notes": [
"lf em 410x demod -> demod an em410x tag id from graphbuffer",
"lf em 410x demod --clk 32 -> demod an em410x tag id from graphbuffer using a clock of rf/32",
"lf em 410x demod --clk 32 -i -> demod an em410x tag id from graphbuffer using a clock of rf/32 and inverting data",
"lf em 410x demod -i -> demod an em410x tag id from graphbuffer while inverting data",
"lf em 410x demod --clk 64 -i --err 0 -> demod an em410x tag id from graphbuffer using a clock of rf/64 and inverting data and allowing 0 demod errors"
],
"offline": true,
"options": [
"-h, --help this help",
"--clk <dec> clock (default autodetect)",
"--err <dec> maximum allowed errors (default 100)",
"--len <dec> maximum length",
"-i, --invert invert output",
"-a, --amp amplify signal"
],
"usage": "lf em 410x demod [-hia] [--clk <dec>] [--err <dec>] [--len <dec>]"
},
"lf fdxb clone": {
"command": "lf fdxb clone",
"description": "clone a fdx-b tag to a t55x7, q5/t5555 or em4305/4469 tag.",
"notes": [
"lf fdxb clone --country 999 --national 1337 --animal",
"lf fdxb clone --country 999 --national 1337 --extended 016a",
"lf fdxb clone --q5 --country 999 --national 1337 -> encode for q5/t5555 tag",
"lf fdxb clone --em --country 999 --national 1337 -> encode for em4305/4469"
],
"offline": false,
"options": [
"-h, --help this help",
"-c, --country <dec> country code",
"-n, --national <dec> national code",
"--extended <hex> extended data",
"-a, --animal optional - set animal bit",
"--q5 optional - specify writing to q5/t5555 tag",
"--em optional - specify writing to em4305/4469 tag"
],
"usage": "lf fdxb clone [-ha] -c <dec> -n <dec> [--extended <hex>] [--q5] [--em]"
},
"lf fdxb help": {
"command": "lf fdxb help",
"description": "help this help demod demodulate a fdx-b iso11784/85 tag from the graphbuffer --------------------------------------------------------------------------------------- lf fdxb demod available offline: yes try to find fdx-b preamble, if found decode / descramble data",
"notes": [
"lf fdxb demod"
],
"offline": true,
"options": [
"-h, --help this help"
],
"usage": "lf fdxb demod [-h]"
},
"lf fdxb reader": {
"command": "lf fdxb reader",
"description": "read a fdx-b animal tag note that the continuous mode is less verbose",
"notes": [
"lf fdxb reader -@ -> continuous reader mode"
],
"offline": false,
"options": [
"-h, --help this help",
"-@ optional - continuous reader mode"
],
"usage": "lf fdxb reader [-h@]"
},
"lf fdxb sim": {
"command": "lf fdxb sim",
"description": "enables simulation of fdx-b animal tag. simulation runs until the button is pressed or another usb command is issued.",
"notes": [
"lf fdxb sim --country 999 --national 1337 --animal",
"lf fdxb sim --country 999 --national 1337 --extended 016a"
],
"offline": false,
"options": [
"-h, --help this help",
"-c, --country <dec> country code",
"-n, --national <dec> national code",
"--extended <hex> extended data",
"-a, --animal optional - set animal bit"
],
"usage": "lf fdxb sim [-ha] -c <dec> -n <dec> [--extended <hex>]"
},
"lf gallagher clone": {
"command": "lf gallagher clone",
"description": "clone a gallagher tag to a t55x7, q5/t5555 or em4305/4469 tag.",
"notes": [
"lf gallagher clone --raw 0ffd5461a9da1346b2d1ac32",
"lf gallagher clone --q5 --raw 0ffd5461a9da1346b2d1ac32 -> encode for q5/t5555 tag",
"lf gallagher clone --em --raw 0ffd5461a9da1346b2d1ac32 -> encode for em4305/4469",
"lf gallagher clone --rc 0 --fc 9876 --cn 1234 --il 1"
],
"offline": false,
"options": [
"-h, --help this help",
"-r, --raw <hex> raw hex data. 12 bytes max",
"--q5 optional - specify writing to q5/t5555 tag",
"--em optional - specify writing to em4305/4469 tag",
"--rc <decimal> region code. 4 bits max",
"--fc <decimal> facility code. 2 bytes max",
"--cn <decimal> card number. 3 bytes max",
"--il <decimal> issue level. 4 bits max"
],
"usage": "lf gallagher clone [-h] [-r <hex>] [--q5] [--em] [--rc <decimal>] [--fc <decimal>] [--cn <decimal>] [--il <decimal>]"
},
"lf gallagher help": {
"command": "lf gallagher help",
"description": "help this help demod demodulate an gallagher tag from the graphbuffer --------------------------------------------------------------------------------------- lf gallagher demod available offline: yes try to find gallagher preamble, if found decode / descramble data",
"notes": [
"lf gallagher demod"
],
"offline": true,
"options": [
"-h, --help this help"
],
"usage": "lf gallagher demod [-h]"
},
"lf gallagher reader": {
"command": "lf gallagher reader",
"description": "read a gallagher tag",
"notes": [
"lf gallagher reader -@ -> continuous reader mode"
],
"offline": false,
"options": [
"-h, --help this help",
"-@ optional - continuous reader mode"
],
"usage": "lf gallagher reader [-h@]"
},
"lf gallagher sim": {
"command": "lf gallagher sim",
"description": "enables simulation of gallagher card with specified card number. simulation runs until the button is pressed or another usb command is issued.",
"notes": [
"lf gallagher sim --raw 0ffd5461a9da1346b2d1ac32",
"lf gallagher sim --rc 0 --fc 9876 --cn 1234 --il 1"
],
"offline": false,
"options": [
"-h, --help this help",
"-r, --raw <hex> raw hex data. 12 bytes max",
"--rc <decimal> region code. 4 bits max",
"--fc <decimal> facility code. 2 bytes max",
"--cn <decimal> card number. 3 bytes max",
"--il <decimal> issue level. 4 bits max"
],
"usage": "lf gallagher sim [-h] [-r <hex>] [--rc <decimal>] [--fc <decimal>] [--cn <decimal>] [--il <decimal>]"
},
"lf gproxii clone": {
"command": "lf gproxii clone",
"description": "clone a guardall tag to a t55x7, q5/t5555 or em4305/4469 tag. the facility-code is 8-bit and the card number is 20-bit. larger values are truncated. currently work only on 26 | 36 bit format",
"notes": [
"lf gproxii clone --fmt 26 --fc 123 --cn 1337",
"lf gproxii clone --q5 --fmt 26 --fc 123 --cn 1337 -> encode for q5/t5555 tag",
"lf gproxii clone --em --fmt 26 --fc 123 --cn 1337 -> encode for em4305/4469"
],
"offline": false,
"options": [
"-h, --help this help",
"--fmt <dec> format length 26|32|36|40",
"--fc <dec> 8-bit value facility code",
"--cn <dec> 16-bit value card number",
"--q5 optional - specify writing to q5/t5555 tag",
"--em optional - specify writing to em4305/4469 tag"
],
"usage": "lf gproxii clone [-h] --fmt <dec> --fc <dec> --cn <dec> [--q5] [--em]"
},
"lf gproxii help": {
"command": "lf gproxii help",
"description": "help this help demod demodulate a g prox ii tag from the graphbuffer --------------------------------------------------------------------------------------- lf gproxii demod available offline: yes try to find guardall prox-ii preamble, if found decode / descramble data",
"notes": [
"lf gproxii demod -> use graphbuffer to decode",
"lf gproxii demod --raw fb8ee718ee3b8cc785c11b92 ->"
],
"offline": true,
"options": [
"-h, --help this help",
"-r, --raw <hex> raw bytes"
],
"usage": "lf gproxii demod [-h] [-r <hex>]"
},
"lf gproxii reader": {
"command": "lf gproxii reader",
"description": "read a guardall tag",
"notes": [
"lf gproxii reader -@ -> continuous reader mode"
],
"offline": false,
"options": [
"-h, --help this help",
"-@ optional - continuous reader mode"
],
"usage": "lf gproxii reader [-h@]"
},
"lf gproxii sim": {
"command": "lf gproxii sim",
"description": "enables simulation of guardall card with specified card number. simulation runs until the button is pressed or another usb command is issued. the facility-code is 8-bit and the card number is 16-bit. larger values are truncated. currently work only on 26 | 36 bit format",
"notes": [
"lf gproxii sim --fmt 26 --fc 123 --cn 1337"
],
"offline": false,
"options": [
"-h, --help this help",
"--fmt <dec> format length 26|32|36|40",
"--fc <dec> 8-bit value facility code",
"--cn <dec> 16-bit value card number"
],
"usage": "lf gproxii sim [-h] --fmt <dec> --fc <dec> --cn <dec>"
},
"lf help": {
"command": "lf help",
"description": "help this help ----------- -------------- low frequency -------------- awid { awid rfids... } cotag { cotag chips... } destron { fdx-a destron rfids... } em { em chips & rfids... } fdxb { fdx-b rfids... } gallagher { gallagher rfids... } gproxii { guardall prox ii rfids... } hid { hid prox rfids... } hitag { hitag chips... } idteck { idteck rfids... } indala { indala rfids... } io { ioprox rfids... } jablotron { jablotron rfids... } keri { keri rfids... } motorola { motorola rfids... } nedap { nedap rfids... } nexwatch { nexwatch rfids... } noralsy { noralsy rfids... } pac { pac/stanley rfids... } paradox { paradox rfids... } pcf7931 { pcf7931 chips... } presco { presco rfids... } pyramid { farpointe/pyramid rfids... } securakey { securakey rfids... } ti { ti chips... } t55xx { t55xx chips... } viking { viking rfids... } visa2000 { visa2000 rfids... } ----------- --------------------- general --------------------- search read and search for valid known tag --------------------------------------------------------------------------------------- lf config available offline: no get/set config for lf sampling, bit/sample, decimation, frequency these changes are temporary, will be reset after a power cycle. - use `lf read` performs a read (active field) - use `lf sniff` performs a sniff (no active field)",
"notes": [
"lf config -> shows current config",
"lf config -b 8 --125 -> samples at 125 khz, 8 bps",
"lf config -b 4 --134 --dec 3 -> samples at 134 khz, averages three samples into one, stored with a resolution of 4 bits per sample",
"lf config --trig 20 -s 10000 -> trigger sampling when above 20, skip 10 000 first samples after triggered",
"lf config --reset -> reset back to default values"
],
"offline": true,
"options": [
"-h, --help this help",
"--125 125 khz frequency",
"--134 134 khz frequency",
"-a, --avg <0|1> averaging - if set, will average the stored sample value when decimating (default 1)",
"-b, --bps <1-8> sets resolution of bits per sample (default 8)",
"--dec <1-8> sets decimation. a value of n saves only 1 in n samples (default 1)",
"--divisor <19-255> manually set freq divisor. 88 -> 134 khz, 95 -> 125 khz",
"-f, --freq <47-600> manually set frequency in khz",
"-r, --reset reset values to defaults",
"-s, --skip <dec> sets a number of samples to skip before capture (default 0)",
"-t, --trig <0-128> sets trigger threshold. 0 means no threshold"
],
"usage": "lf config [-hr] [--125] [--134] [-a <0|1>] [-b <1-8>] [--dec <1-8>] [--divisor <19-255>] [-f <47-600>] [-s <dec>] [-t <0-128>]"
},
"lf hid brute": {
"command": "lf hid brute",
"description": "enables bruteforce of hid readers with specified facility code. this is a attack against reader. if cardnumber is given, it starts with it and goes up / down one step if cardnumber is not given, it starts with 1 and goes up to 65535",
"notes": [
"lf hid brute -w h10301 --fc 224",
"lf hid brute -w h10301 --fc 21 -d 2000",
"lf hid brute -v -w h10301 --fc 21 --cn 200 -d 2000",
"lf hid brute -v -w h10301 --fc 21 --cn 200 -d 2000 --up"
],
"offline": false,
"options": [
"-h, --help this help",
"-v, --verbose verbose logging, show all tries",
"-w, --wiegand <format> see `wiegand list` for available formats",
"--fc <dec> facility code",
"--cn <dec> card number to start with",
"-i, --issue <dec> issue level",
"-o, --oem <dec> oem code",
"-d, --delay <dec> delay betweens attempts in ms. default 1000ms",
"--up direction to increment card number. (default is both directions)",
"--down direction to decrement card number. (default is both directions)"
],
"usage": "lf hid brute [-hv] -w <format> [--fc <dec>] [--cn <dec>] [-i <dec>] [-o <dec>] [-d <dec>] [--up] [--down]"
},
"lf hid clone": {
"command": "lf hid clone",
"description": "clone a hid prox tag to a t55x7, q5/t5555 or em4305/4469 tag. tag must be on the antenna when issuing this command.",
"notes": [
"lf hid clone -r 2006ec0c86 -> write raw value (hid 10301 26 bit)",
"lf hid clone -r 2e0ec00c87 -> write raw value (hid corporate 35 bit)",
"lf hid clone -r 01f0760643c3 -> write raw value (hid p10001 40 bit)",
"lf hid clone -r 01400076000c86 -> write raw value (hid corporate 48 bit)",
"lf hid clone -w h10301 --fc 118 --cn 1603 -> write raw value (hid 10301 26 bit)",
"lf hid clone -w h10301 --fc 118 --cn 1603 --q5 -> hid 10301 26 bit, encode for q5/t5555 tag",
"lf hid clone -w h10301 --fc 118 --cn 1603 --em -> hid 10301 26 bit, encode for em4305/4469"
],
"offline": false,
"options": [
"-h, --help this help",
"-w, --wiegand <format> see `wiegand list` for available formats",
"--fc <dec> facility code",
"--cn <dec> card number",
"-i <dec> issue level",
"-o, --oem <dec> oem code",
"-r, --raw <hex> raw bytes",
"--q5 optional - specify writing to q5/t5555 tag",
"--em optional - specify writing to em4305/4469 tag",
"--bin <bin> binary string i.e 0001001001"
],
"usage": "lf hid clone [-h] [-w <format>] [--fc <dec>] [--cn <dec>] [-i <dec>] [-o <dec>] [-r <hex>] [--q5] [--em] [--bin <bin>]"
},
"lf hid help": {
"command": "lf hid help",
"description": "help this help demod demodulate hid prox tag from the graphbuffer --------------------------------------------------------------------------------------- lf hid demod available offline: yes try to find hid prox preamble, if found decode / descramble data",
"notes": [
"lf hid demod"
],
"offline": true,
"options": [
"-h, --help this help"
],
"usage": "lf hid demod [-h]"
},
"lf hid reader": {
"command": "lf hid reader",
"description": "read a hid prox tag",
"notes": [
"lf hid reader -@ -> continuous reader mode"
],
"offline": false,
"options": [
"-h, --help this help",
"-@ optional - continuous reader mode"
],
"usage": "lf hid reader [-h@]"
},
"lf hid sim": {
"command": "lf hid sim",
"description": "enables simulation of hid card with card number. simulation runs until the button is pressed or another usb command is issued.",
"notes": [
"lf hid sim -r 2006ec0c86 -> hid 10301 26 bit",
"lf hid sim -r 2e0ec00c87 -> hid corporate 35 bit",
"lf hid sim -r 01f0760643c3 -> hid p10001 40 bit",
"lf hid sim -r 01400076000c86 -> hid corporate 48 bit",
"lf hid sim -w h10301 --fc 118 --cn 1603 -> hid 10301 26 bit"
],
"offline": false,
"options": [
"-h, --help this help",
"-w, --wiegand <format> see `wiegand list` for available formats",
"--fc <dec> facility code",
"--cn <dec> card number",
"-i <dec> issue level",
"-o, --oem <dec> oem code",
"-r, --raw <hex> raw bytes"
],
"usage": "lf hid sim [-h] [-w <format>] [--fc <dec>] [--cn <dec>] [-i <dec>] [-o <dec>] [-r <hex>]"
},
"lf hid watch": {
"command": "lf hid watch",
"description": "enables hid compatible reader mode printing details. by default, values are printed and logged until the button is pressed or another usb command is issued.",
"notes": [
"lf hid watch"
],
"offline": false,
"options": [
"-h, --help this help"
],
"usage": "lf hid watch [-h]"
},
"lf hitag cc": {
"command": "lf hitag cc",
"description": "check challenges, load a file with saved hitag crypto challenges and test them all. the file should be 8 * 60 bytes long, the file extension defaults to `.cc`",
"notes": [
"lf hitag cc -f my_hitag_challenges"
],
"offline": false,
"options": [
"-h, --help this help",
"-f, --file <fn> filename to load ( w/o ext )"
],
"usage": "lf hitag cc [-h] -f <fn>"
},
"lf hitag dump": {
"command": "lf hitag dump",
"description": "read all card memory and save to filein password mode the default key is 4d494b52 (mikr) in crypto mode the default key is 4f4e4d494b52 (onmikr) format: isk high + isk low.",
"notes": [
"lf hitag dump -k 4f4e4d494b52",
"lf hitag dump -k 4d494b52"
],
"offline": false,
"options": [
"-h, --help this help",
"-f, --file <fn> specify file name",
"-k, --key <hex> key, 4 or 6 hex bytes",
"--nrar <hex> nonce / answer reader, 8 hex bytes"
],
"usage": "lf hitag dump [-h] [-f <fn>] [-k <hex>] [--nrar <hex>]"
},
"lf hitag help": {
"command": "lf hitag help",
"description": "help this help list list hitag trace history --------------------------------------------------------------------------------------- lf hitag eload available offline: no loads hitag tag dump into emulator memory on device",
"notes": [
"lf hitag eload -2 -f lf-hitag-11223344-dump.bin"
],
"offline": true,
"options": [
"-h, --help this help",
"-f, --file <fn> specfiy dump filename",
"-1 card type hitag1",
"-2 card type hitag2",
"-s card type hitags",
"-m card type hitagm"
],
"usage": "lf hitag eload [-h12sm] -f <fn>"
},
"lf hitag info": {
"command": "lf hitag info",
"description": "hitag2 tag information",
"notes": [
"lf hitag info"
],
"offline": false,
"options": [
"-h, --help this help"
],
"usage": "lf hitag info [-h]"
},
"lf hitag list": {
"command": "lf hitag list",
"description": "alias of `trace list -t hitag2` with selected protocol data to annotate trace buffer you can load a trace from file (see `trace load -h`) or it be downloaded from device by default it accepts all other arguments of `trace list`. note that some might not be relevant for this specific protocol",
"notes": [
"lf hitag list -f -> show frame delay times",
"lf hitag list -1 -> use trace buffer"
],
"offline": true,
"options": [
"-h, --help this help",
"-1, --buffer use data from trace buffer",
"-f show frame delay times",
"-c mark crc bytes",
"-r show relative times (gap and duration)",
"-u display times in microseconds instead of clock cycles",
"-x show hexdump to convert to pcap(ng)",
"or to import into wireshark using encapsulation type \"iso 14443\"",
"--dict <file> use dictionary keys file"
],
"usage": "lf hitag list [-h1fcrux] [--dict <file>]"
},
"lf hitag reader": {
"command": "lf hitag reader",
"description": "act like a hitag reader",
"notes": [
"hitag s",
"lf hitag reader --01 --nrar 0102030411223344",
"lf hitag reader --02 -k 4f4e4d494b52",
"hitag 2",
"lf hitag reader --21 -k 4d494b52",
"lf hitag reader --22 --nrar 0102030411223344",
"lf hitag reader --23 -k 4f4e4d494b52",
"lf hitag reader --26"
],
"offline": false,
"options": [
"-h, --help this help",
"--01 hitags, read all pages, challenge mode",
"--02 hitags, read all pages, crypto mode. set key=0 for no auth",
"--21 hitag2, read all pages, password mode. def 4d494b52 (mikr)",
"--22 hitag2, read all pages, challenge mode",
"--23 hitag2, read all pages, crypto mode. key isk high + isk low. def 4f4e4d494b52 (onmikr)",
"--25 hitag2, test recorded authentications (replay?)",
"--26 hitag2, read uid",
"-k, --key <hex> key, 4 or 6 hex bytes",
"--nrar <hex> nonce / answer reader, 8 hex bytes"
],
"usage": "lf hitag reader [-h] [--01] [--02] [--21] [--22] [--23] [--25] [--26] [-k <hex>] [--nrar <hex>]"
},
"lf hitag sim": {
"command": "lf hitag sim",
"description": "simulate hitag2 / hitags transponder you need to `lf hitag eload` first",
"notes": [
"lf hitag sim -2"
],
"offline": false,
"options": [
"-h, --help this help",
"-1 simulate hitag1",
"-2 simulate hitag2",
"-s simulate hitags"
],
"usage": "lf hitag sim [-h12s]"
},
"lf hitag sniff": {
"command": "lf hitag sniff",
"description": "sniff traffic between hitag reader and tag. use `lf hitag list` to view collected data.",
"notes": [
"lf hitag sniff"
],
"offline": false,
"options": [
"-h, --help this help"
],
"usage": "lf hitag sniff [-h]"
},
"lf hitag writer": {
"command": "lf hitag writer",
"description": "act like a hitag writerin password mode the default key is 4d494b52 (mikr) in crypto mode the default key is 4f4e4d494b52 (onmikr) format: isk high + isk low.",
"notes": [
"hitag s",
"lf hitag writer --03 --nrar 0102030411223344 -p 3 -d 01020304",
"lf hitag writer --04 -k 4f4e4d494b52 -p 3 -d 01020304",
"hitag 2",
"lf hitag writer --24 -k 4f4e4d494b52 -p 3 -d 01020304",
"lf hitag writer --27 -k 4d494b52 -p 3 -d 01020304"
],
"offline": false,
"options": [
"-h, --help this help",
"--03 hitags, write page, challenge mode",
"--04 hitags, write page, crypto mode. set key=0 for no auth",
"--24 hitag2, write page, crypto mode.",
"--27 hitag2, write page, password mode",
"-p, --page <dec> page address to write to",
"-d, --data <hex> data, 4 hex bytes",
"-k, --key <hex> key, 4 or 6 hex bytes",
"--nrar <hex> nonce / answer writer, 8 hex bytes"
],
"usage": "lf hitag writer [-h] [--03] [--04] [--24] [--27] -p <dec> [-d <hex>] [-k <hex>] [--nrar <hex>]"
},
"lf idteck clone": {
"command": "lf idteck clone",
"description": "clone a idteck tag to t55x7 or q5/t5555 tag tag must be on the antenna when issuing this command.",
"notes": [
"lf idteck clone --raw 4944544b351fbe4b"
],
"offline": false,
"options": [
"-h, --help this help",
"-r, --raw <hex> raw bytes",
"--q5 optional - specify writing to q5/t5555 tag",
"--em optional - specify writing to em4305/4469 tag"
],
"usage": "lf idteck clone [-h] -r <hex> [--q5] [--em]"
},
"lf idteck help": {
"command": "lf idteck help",
"description": "help this help demod demodulate an idteck tag from the graphbuffer --------------------------------------------------------------------------------------- lf idteck demod available offline: yes try to find idteck preamble, if found decode / descramble data",
"notes": [
"lf idteck demod"
],
"offline": true,
"options": [
"-h, --help this help"
],
"usage": "lf idteck demod [-h]"
},
"lf idteck reader": {
"command": "lf idteck reader",
"description": "read a idteck tag",
"notes": [
"lf idteck reader -@ -> continuous reader mode"
],
"offline": false,
"options": [
"-h, --help this help",
"-@ optional - continuous reader mode"
],
"usage": "lf idteck reader [-h@]"
},
"lf idteck sim": {
"command": "lf idteck sim",
"description": "enables simulation of idteck card. simulation runs until the button is pressed or another usb command is issued.",
"notes": [
"lf idteck sim --raw 4944544b351fbe4b"
],
"offline": false,
"options": [
"-h, --help this help",
"-r, --raw <hex> raw bytes"
],
"usage": "lf idteck sim [-h] -r <hex>"
},
"lf indala altdemod": {
"command": "lf indala altdemod",
"description": "tries to psk demodulate the graphbuffer as indala this is uses a alternative way to demodulate and was used from the beginning in the pm3 client. it's now considered obsolete but remains because it has sometimes its advantages.",
"notes": [
"lf indala altdemod",
"lf indala altdemod --long -> demod a indala tag from the graphbuffer as 224 bit long format"
],
"offline": true,
"options": [
"-h, --help this help",
"-l, --long optional - demod as 224b long format"
],
"usage": "lf indala altdemod [-hl]"
},
"lf indala clone": {
"command": "lf indala clone",
"description": "clone indala uid to t55x7 or q5/t5555 tag using different known formats warning, encoding with fc/cn doesn't always work",
"notes": [
"lf indala clone --heden 888 -> use heden 2l format",
"lf indala clone --fc 123 --cn 1337 -> use standard 26b format",
"lf indala clone --fc 123 --cn 1337 --4041x -> use 4041x format",
"lf indala clone -r a0000000a0002021",
"lf indala clone -r 80000001b23523a6c2e31eba3cbee4afb3c6ad1fcf649393928c14e5"
],
"offline": false,
"options": [
"-h, --help this help",
"-r, --raw <hex> raw bytes",
"--heden <decimal> card number for heden 2l format",
"--fc <decimal> facility code (26 bit h10301 format)",
"--cn <decimal> card number (26 bit h10301 format)",
"--q5 optional - specify writing to q5/t5555 tag",
"--em optional - specify writing to em4305/4469 tag",
"--4041x optional - specify indala 4041x format, must use with fc and cn"
],
"usage": "lf indala clone [-h] [-r <hex>] [--heden <decimal>] [--fc <decimal>] [--cn <decimal>] [--q5] [--em] [--4041x]"
},
"lf indala help": {
"command": "lf indala help",
"description": "help this help demod demodulate an indala tag (psk1) from the graphbuffer altdemod alternative method to demodulate samples for indala 64 bit uid (option '224' for 224 bit) --------------------------------------------------------------------------------------- lf indala demod available offline: yes tries to psk demodulate the graphbuffer as indala",
"notes": [
"lf indala demod",
"lf indala demod --clock 32 -> demod a indala tag from the graphbuffer using a clock of rf/32",
"lf indala demod --clock 32 -i -> demod a indala tag from the graphbuffer using a clock of rf/32 and inverting data",
"lf indala demod --clock 64 -i --maxerror 0 -> demod a indala tag from the graphbuffer using a clock of rf/64, inverting data and allowing 0 demod errors"
],
"offline": true,
"options": [
"-h, --help this help",
"--clock <dec> optional - set clock (as integer), if not set, autodetect.",
"--maxerr <dec> optional - set maximum allowed errors, default = 100",
"-i, --invert optional - invert output"
],
"usage": "lf indala demod [-hi] [--clock <dec>] [--maxerr <dec>]"
},
"lf indala reader": {
"command": "lf indala reader",
"description": "read a indala tag",
"notes": [
"lf indala reader -@ -> continuous reader mode"
],
"offline": false,
"options": [
"-h, --help this help",
"--clock <dec> optional - set clock (as integer), if not set, autodetect.",
"--maxerr <dec> optional - set maximum allowed errors, default = 100",
"-i, --invert optional - invert output",
"-@ optional - continuous reader mode"
],
"usage": "lf indala reader [-hi@] [--clock <dec>] [--maxerr <dec>]"
},
"lf indala sim": {
"command": "lf indala sim",
"description": "enables simulation of indala card with specified facility code and card number. simulation runs until the button is pressed or another usb command is issued.",
"notes": [
"lf indala sim --heden 888",
"lf indala sim --raw a0000000a0002021",
"lf indala sim --raw 80000001b23523a6c2e31eba3cbee4afb3c6ad1fcf649393928c14e5"
],
"offline": false,
"options": [
"-h, --help this help",
"-r, --raw <hex> raw bytes",
"--heden <decimal> cardnumber for heden 2l format"
],
"usage": "lf indala sim [-h] [-r <hex>] [--heden <decimal>]"
},
"lf io clone": {
"command": "lf io clone",
"description": "clone a ioprox card with specified facility-code and card number to a t55x7, q5/t5555 or em4305/4469 tag. tag must be on the antenna when issuing this command.",
"notes": [
"lf io clone --vn 1 --fc 101 --cn 1337"
],
"offline": false,
"options": [
"-h, --help this help",
"--vn <dec> 8bit version",
"--fc <dec> 8bit facility code",
"--cn <dec> 16bit card number",
"--q5 optional - specify writing to q5/t5555 tag",
"--em optional - specify writing to em4305/4469 tag"
],
"usage": "lf io clone [-h] --vn <dec> --fc <dec> --cn <dec> [--q5] [--em]"
},
"lf io help": {
"command": "lf io help",
"description": "help this help demod demodulate an ioprox tag from the graphbuffer --------------------------------------------------------------------------------------- lf io demod available offline: yes try to find ioprox preamble, if found decode / descramble data",
"notes": [
"lf io demod"
],
"offline": true,
"options": [
"-h, --help this help"
],
"usage": "lf io demod [-h]"
},
"lf io reader": {
"command": "lf io reader",
"description": "read a ioprox tag",
"notes": [
"lf io reader -@ -> continuous reader mode"
],
"offline": false,
"options": [
"-h, --help this help",
"-@ optional - continuous reader mode"
],
"usage": "lf io reader [-h@]"
},
"lf io sim": {
"command": "lf io sim",
"description": "enables simulation of ioprox card with specified facility-code and card number. simulation runs until the button is pressed or another usb command is issued.",
"notes": [
"lf io sim --vn 1 --fc 101 --cn 1337"
],
"offline": false,
"options": [
"-h, --help this help",
"--vn <dec> 8bit version",
"--fc <dec> 8bit facility code",
"--cn <dec> 16bit card number"
],
"usage": "lf io sim [-h] --vn <dec> --fc <dec> --cn <dec>"
},
"lf io watch": {
"command": "lf io watch",
"description": "enables ioprox compatible reader mode printing details. by default, values are printed and logged until the button is pressed or another usb command is issued.",
"notes": [
"lf io watch"
],
"offline": false,
"options": [
"-h, --help this help"
],
"usage": "lf io watch [-h]"
},
"lf jablotron clone": {
"command": "lf jablotron clone",
"description": "clone a jablotron tag to a t55x7, q5/t5555 or em4305/4469 tag. tag must be on the antenna when issuing this command.",
"notes": [
"lf jablotron clone --cn 01b669",
"lf jablotron clone --q5 --cn 01b669 -> encode for q5/t5555 tag",
"lf jablotron clone --em --cn 01b669 -> encode for em4305/4469"
],
"offline": false,
"options": [
"-h, --help this help",
"--cn <hex> jablotron card id - 5 bytes max",
"--q5 optional - specify writing to q5/t5555 tag",
"--em optional - specify writing to em4305/4469 tag"
],
"usage": "lf jablotron clone [-h] --cn <hex> [--q5] [--em]"
},
"lf jablotron help": {
"command": "lf jablotron help",
"description": "help this help demod demodulate an jablotron tag from the graphbuffer --------------------------------------------------------------------------------------- lf jablotron demod available offline: yes try to find jablotron preamble, if found decode / descramble data",
"notes": [
"lf jablotron demod"
],
"offline": true,
"options": [
"-h, --help this help"
],
"usage": "lf jablotron demod [-h]"
},
"lf jablotron reader": {
"command": "lf jablotron reader",
"description": "read a jablotron tag",
"notes": [
"lf jablotron reader -@ -> continuous reader mode"
],
"offline": false,
"options": [
"-h, --help this help",
"-@ optional - continuous reader mode"
],
"usage": "lf jablotron reader [-h@]"
},
"lf jablotron sim": {
"command": "lf jablotron sim",
"description": "enables simulation of jablotron card with specified card number. simulation runs until the button is pressed or another usb command is issued.",
"notes": [
"lf jablotron sim --cn 01b669"
],
"offline": false,
"options": [
"-h, --help this help",
"--cn <hex> jablotron card id - 5 bytes max"
],
"usage": "lf jablotron sim [-h] --cn <hex>"
},
"lf keri clone": {
"command": "lf keri clone",
"description": "clone a keri tag to a t55x7, q5/t5555 or em4305/4469 tag",
"notes": [
"lf keri clone -t i --cn 12345 -> internal id",
"lf keri clone -t m --fc 6 --cn 12345 -> ms id"
],
"offline": false,
"options": [
"-h, --help this help",
"-t, --type <m|i> type m - ms, i - internal id",
"--fc <dec> facility code",
"--cn <dec> keri card id",
"--q5 specify writing to q5/t5555 tag",
"--em specify writing to em4305/4469 tag"
],
"usage": "lf keri clone [-h] [-t <m|i>] [--fc <dec>] --cn <dec> [--q5] [--em]"
},
"lf keri help": {
"command": "lf keri help",
"description": "help this help demod demodulate an keri tag from the graphbuffer --------------------------------------------------------------------------------------- lf keri demod available offline: yes try to find keri preamble, if found decode / descramble data",
"notes": [
"lf keri demod"
],
"offline": true,
"options": [
"-h, --help this help"
],
"usage": "lf keri demod [-h]"
},
"lf keri reader": {
"command": "lf keri reader",
"description": "read a keri tag",
"notes": [
"lf keri reader -@ -> continuous reader mode"
],
"offline": false,
"options": [
"-h, --help this help",
"-@ optional - continuous reader mode"
],
"usage": "lf keri reader [-h@]"
},
"lf keri sim": {
"command": "lf keri sim",
"description": "enables simulation of keri card with internal id. you supply a keri card id and it will converted to a keri internal id.",
"notes": [
"lf keri sim --cn 112233"
],
"offline": false,
"options": [
"-h, --help this help",
"--id <dec> keri card id"
],
"usage": "lf keri sim [-h] --id <dec>"
},
"lf motorola clone": {
"command": "lf motorola clone",
"description": "clone motorola uid to a t55x7, q5/t5555 or em4305/4469 tag. defaults to 64 bit format",
"notes": [
"lf motorola clone --raw a0000000a0002021",
"lf motorola clone --q5 --raw a0000000a0002021 -> encode for q5/t5555 tag",
"lf motorola clone --em --raw a0000000a0002021 -> encode for em4305/4469"
],
"offline": false,
"options": [
"-h, --help this help",
"-r, --raw <hex> raw hex bytes. 8 bytes",
"--q5 optional - specify writing to q5/t5555 tag",
"--em optional - specify writing to em4305/4469 tag"
],
"usage": "lf motorola clone [-h] -r <hex> [--q5] [--em]"
},
"lf motorola help": {
"command": "lf motorola help",
"description": "help this help demod demodulate an motorola tag from the graphbuffer --------------------------------------------------------------------------------------- lf motorola demod available offline: yes try to find motorola preamble, if found decode / descramble data",
"notes": [
"lf motorola demod"
],
"offline": true,
"options": [
"-h, --help this help"
],
"usage": "lf motorola demod [-h]"
},
"lf motorola reader": {
"command": "lf motorola reader",
"description": "read a motorola tag",
"notes": [
"lf motorola reader -@ -> continuous reader mode"
],
"offline": false,
"options": [
"-h, --help this help",
"-@ optional - continuous reader mode"
],
"usage": "lf motorola reader [-h@]"
},
"lf motorola sim": {
"command": "lf motorola sim",
"description": "enables simulation of motorola card with specified card number. simulation runs until the button is pressed or another usb command is issued.",
"notes": [
"lf motorola sim"
],
"offline": false,
"options": [
"-h, --help this help"
],
"usage": "lf motorola sim [-h]"
},
"lf nedap clone": {
"command": "lf nedap clone",
"description": "clone a nedap tag to a t55x7, q5/t5555 or em4305/4469 tag.",
"notes": [
"lf nedap clone --st 1 --cc 101 --id 1337"
],
"offline": false,
"options": [
"-h, --help this help",
"--st <dec> optional - sub type (default 5)",
"--cc <dec> customer code (0-4095)",
"--id <dec> id (0-99999)",
"-l, --long optional - long (128), default to short (64)",
"--q5 optional - specify writing to q5/t5555 tag",
"--em optional - specify writing to em4305/4469 tag"
],
"usage": "lf nedap clone [-hl] [--st <dec>] --cc <dec> --id <dec> [--q5] [--em]"
},
"lf nedap help": {
"command": "lf nedap help",
"description": "help this help demod demodulate nedap tag from the graphbuffer --------------------------------------------------------------------------------------- lf nedap demod available offline: yes try to find nedap preamble, if found decode / descramble data",
"notes": [
"lf nedap demod"
],
"offline": true,
"options": [
"-h, --help this help"
],
"usage": "lf nedap demod [-h]"
},
"lf nedap reader": {
"command": "lf nedap reader",
"description": "read a nedap tag",
"notes": [
"lf nedap reader -@ -> continuous reader mode"
],
"offline": false,
"options": [
"-h, --help this help",
"-@ optional - continuous reader mode"
],
"usage": "lf nedap reader [-h@]"
},
"lf nedap sim": {
"command": "lf nedap sim",
"description": "enables simulation of nedap card with specified card number. simulation runs until the button is pressed or another usb command is issued.",
"notes": [
"lf nedap sim --st 1 --cc 101 --id 1337"
],
"offline": false,
"options": [
"-h, --help this help",
"--st <dec> optional - sub type (default 5)",
"--cc <dec> customer code (0-4095)",
"--id <dec> id (0-99999)",
"-l, --long optional - long (128), default to short (64)"
],
"usage": "lf nedap sim [-hl] [--st <dec>] --cc <dec> --id <dec>"
},
"lf nexwatch clone": {
"command": "lf nexwatch clone",
"description": "clone a nexwatch tag to a t55x7, q5/t5555 or em4305/4469 tag. you can use raw hex values or create a credential based on id, mode and type of credential (nexkey / quadrakey / russian)",
"notes": [
"lf nexwatch clone --raw 5600000000213c9f8f150c00",
"lf nexwatch clone --cn 521512301 -m 1 --nc -> nexkey credential",
"lf nexwatch clone --cn 521512301 -m 1 --qc -> quadrakey credential",
"lf nexwatch clone --cn 521512301 -m 1 --hc -> honeywell credential"
],
"offline": false,
"options": [
"-h, --help this help",
"-r, --raw <hex> raw hex data. 12 bytes",
"--cn <dec> card id",
"-m, --mode <dec> mode (decimal) (0-15, defaults to 1)",
"--nc nexkey credential",
"--qc quadrakey credential",
"--hc honeywell credential",
"--q5 optional - specify writing to q5/t5555 tag",
"--em optional - specify writing to em4305/4469 tag",
"--magic <hex> optional - magic hex data. 1 byte",
"--psk2 optional - specify writing a tag in psk2 modulation"
],
"usage": "lf nexwatch clone [-h] [-r <hex>] [--cn <dec>] [-m <dec>] [--nc] [--qc] [--hc] [--q5] [--em] [--magic <hex>] [--psk2]"
},
"lf nexwatch help": {
"command": "lf nexwatch help",
"description": "help this help demod demodulate a nexwatch tag (nexkey, quadrakey) from the graphbuffer --------------------------------------------------------------------------------------- lf nexwatch demod available offline: yes try to find nexwatch preamble, if found decode / descramble data",
"notes": [
"lf nexwatch demod"
],
"offline": true,
"options": [
"-h, --help this help"
],
"usage": "lf nexwatch demod [-h]"
},
"lf nexwatch reader": {
"command": "lf nexwatch reader",
"description": "read a nexwatch tag",
"notes": [
"lf nexwatch reader -@ -> continuous reader mode"
],
"offline": false,
"options": [
"-h, --help this help",
"-@ optional - continuous reader mode"
],
"usage": "lf nexwatch reader [-h@]"
},
"lf nexwatch sim": {
"command": "lf nexwatch sim",
"description": "enables simulation of secura card with specified card number. simulation runs until the button is pressed or another usb command is issued. you can use raw hex values or create a credential based on id, mode and type of credential (nexkey/quadrakey)",
"notes": [
"lf nexwatch sim --raw 5600000000213c9f8f150c00",
"lf nexwatch sim --cn 521512301 -m 1 --nc -> nexkey credential",
"lf nexwatch sim --cn 521512301 -m 1 --qc -> quadrakey credential",
"lf nexwatch sim --cn 521512301 -m 1 --hc -> honeywell credential"
],
"offline": false,
"options": [
"-h, --help this help",
"-r, --raw <hex> raw hex data. 12 bytes",
"--cn <dec> card id",
"-m, --mode <dec> mode (decimal) (0-15, defaults to 1)",
"--nc nexkey credential",
"--qc quadrakey credential",
"--hc honeywell credential",
"--magic <hex> optional - magic hex data. 1 byte",
"--psk2 optional - specify writing a tag in psk2 modulation"
],
"usage": "lf nexwatch sim [-h] [-r <hex>] [--cn <dec>] [-m <dec>] [--nc] [--qc] [--hc] [--magic <hex>] [--psk2]"
},
"lf noralsy clone": {
"command": "lf noralsy clone",
"description": "clone a noralsy tag to a t55x7, q5/t5555 or em4305/4469 tag.",
"notes": [
"lf noralsy clone --cn 112233",
"lf noralsy clone --cn 112233 --q5 -> encode for q5/t5555 tag",
"lf noralsy clone --cn 112233 --em -> encode for em4305/4469"
],
"offline": false,
"options": [
"-h, --help this help",
"--cn <dec> noralsy card id",
"-y, --year <dec> tag allocation year",
"--q5 optional - specify writing to q5/t5555 tag",
"--em optional - specify writing to em4305/4469 tag"
],
"usage": "lf noralsy clone [-h] --cn <dec> [-y <dec>] [--q5] [--em]"
},
"lf noralsy help": {
"command": "lf noralsy help",
"description": "help this help demod demodulate an noralsy tag from the graphbuffer --------------------------------------------------------------------------------------- lf noralsy demod available offline: yes try to find noralsy preamble, if found decode / descramble data",
"notes": [
"lf noralsy demod"
],
"offline": true,
"options": [
"-h, --help this help"
],
"usage": "lf noralsy demod [-h]"
},
"lf noralsy reader": {
"command": "lf noralsy reader",
"description": "read a noralsy tag",
"notes": [
"lf noralsy reader -@ -> continuous reader mode"
],
"offline": false,
"options": [
"-h, --help this help",
"-@ optional - continuous reader mode"
],
"usage": "lf noralsy reader [-h@]"
},
"lf noralsy sim": {
"command": "lf noralsy sim",
"description": "enables simulation of noralsy card with specified card number. simulation runs until the button is pressed or another usb command is issued.",
"notes": [
"lf noralsy sim --cn 1337",
"lf noralsy sim --cn 1337 --year 2010"
],
"offline": false,
"options": [
"-h, --help this help",
"--cn <dec> noralsy card id",
"-y, --year <dec> tag allocation year"
],
"usage": "lf noralsy sim [-h] --cn <dec> [-y <dec>]"
},
"lf pac clone": {
"command": "lf pac clone",
"description": "clone a pac/stanley tag to a t55x7, q5/t5555 or em4305/4469 tag.",
"notes": [
"lf pac clone --cn cd4f5552",
"lf pac clone --cn cd4f5552 --q5 -> encode for q5/t5555 tag",
"lf pac clone --cn cd4f5552 --em -> encode for em4305/4469",
"lf pac clone --raw ff2049906d8511c593155b56d5b2649f"
],
"offline": false,
"options": [
"-h, --help this help",
"--cn <dec> 8 byte pac/stanley card id",
"-r, --raw <hex> raw hex data. 16 bytes max",
"--q5 optional - specify writing to q5/t5555 tag",
"--em optional - specify writing to em4305/4469 tag"
],
"usage": "lf pac clone [-h] [--cn <dec>] [-r <hex>] [--q5] [--em]"
},
"lf pac help": {
"command": "lf pac help",
"description": "help this help demod demodulate a pac tag from the graphbuffer --------------------------------------------------------------------------------------- lf pac demod available offline: yes try to find pac/stanley preamble, if found decode / descramble data",
"notes": [
"lf pac demod"
],
"offline": true,
"options": [
"-h, --help this help"
],
"usage": "lf pac demod [-h]"
},
"lf pac reader": {
"command": "lf pac reader",
"description": "read a pac/stanley tag",
"notes": [
"lf pac reader -@ -> continuous reader mode"
],
"offline": false,
"options": [
"-h, --help this help",
"-@ optional - continuous reader mode"
],
"usage": "lf pac reader [-h@]"
},
"lf pac sim": {
"command": "lf pac sim",
"description": "enables simulation of pac/stanley card with specified card number. simulation runs until the button is pressed or another usb command is issued. the card id is 8 byte number. larger values are truncated.",
"notes": [
"lf pac sim --cn cd4f5552",
"lf pac sim --raw ff2049906d8511c593155b56d5b2649f"
],
"offline": false,
"options": [
"-h, --help this help",
"--cn <dec> 8 byte pac/stanley card id",
"-r, --raw <hex> raw hex data. 16 bytes max"
],
"usage": "lf pac sim [-h] [--cn <dec>] [-r <hex>]"
},
"lf paradox clone": {
"command": "lf paradox clone",
"description": "clone a paradox tag to a t55x7, q5/t5555 or em4305/4469 tag.",
"notes": [
"lf paradox clone --raw 0f55555695596a6a9999a59a",
"lf paradox clone -r 0f55555695596a6a9999a59a --q5 -> encode for q5/t5555 tag",
"lf paradox clone -r 0f55555695596a6a9999a59a --em -> encode for em4305/4469"
],
"offline": false,
"options": [
"-h, --help this help",
"-r, --raw <hex> raw hex data. 12 bytes max",
"--q5 optional - specify writing to q5/t5555 tag",
"--em optional - specify writing to em4305/4469 tag"
],
"usage": "lf paradox clone [-h] [-r <hex>] [--q5] [--em]"
},
"lf paradox help": {
"command": "lf paradox help",
"description": "help this help demod demodulate a paradox fsk tag from the graphbuffer --------------------------------------------------------------------------------------- lf paradox demod available offline: yes try to find paradox preamble, if found decode / descramble data",
"notes": [
"lf paradox demod"
],
"offline": true,
"options": [
"-h, --help this help"
],
"usage": "lf paradox demod [-h]"
},
"lf paradox reader": {
"command": "lf paradox reader",
"description": "read a paradox tag",
"notes": [
"lf paradox reader -@ -> continuous reader mode"
],
"offline": false,
"options": [
"-h, --help this help",
"-@ optional - continuous reader mode"
],
"usage": "lf paradox reader [-h@]"
},
"lf paradox sim": {
"command": "lf paradox sim",
"description": "enables simulation of paradox card with specified card number. simulation runs until the button is pressed or another usb command is issued.",
"notes": [
"lf paradox sim --raw 0f55555695596a6a9999a59a"
],
"offline": false,
"options": [
"-h, --help this help",
"-r, --raw <hex> raw hex data. 12 bytes"
],
"usage": "lf paradox sim [-h] [-r <hex>]"
},
"lf pcf7931 config": {
"command": "lf pcf7931 config",
"description": "this command tries to set the configuration used with pcf7931 commands the time offsets could be useful to correct slew rate generated by the antenna caling without some parameter will print the current configuration.",
"notes": [
"lf pcf7931 config --reset",
"lf pcf7931 config --pwd 11223344556677 -d 20000",
"lf pcf7931 config --pwd 11223344556677 -d 17500 --lw -10 --lp 30"
],
"offline": true,
"options": [
"-h, --help this help",
"-r, --reset reset configuration to default values",
"-p, --pwd <hex> password, 7bytes, lsb-order",
"-d, --delay <dec> tag initialization delay (in us)",
"--lw <dec> offset, low pulses width (in us)",
"--lp <dec> offset, low pulses position (in us)"
],
"usage": "lf pcf7931 config [-hr] [-p <hex>] [-d <dec>] [--lw <dec>] [--lp <dec>]"
},
"lf pcf7931 help": {
"command": "lf pcf7931 help",
"description": "help this help config configure the password, the tags initialization delay and time offsets (optional) --------------------------------------------------------------------------------------- lf pcf7931 reader available offline: no read a pcf7931 tag",
"notes": [
"lf pcf7931 reader -@ -> continuous reader mode"
],
"offline": true,
"options": [
"-h, --help this help",
"-@ optional - continuous reader mode"
],
"usage": "lf pcf7931 reader [-h@]"
},
"lf pcf7931 write": {
"command": "lf pcf7931 write",
"description": "this command tries to write a pcf7931 tag.",
"notes": [
"lf pcf7931 write --blk 2 --idx 1 -d ff -> write 0xff to block 2, index 1"
],
"offline": false,
"options": [
"-h, --help this help",
"-b, --blk <dec> [0-7] block number",
"-i, --idx <dec> [0-15] index of byte inside block",
"-d, --data <hex> one byte to be written"
],
"usage": "lf pcf7931 write [-h] -b <dec> -i <dec> -d <hex>"
},
"lf presco clone": {
"command": "lf presco clone",
"description": "clone a presco tag to a t55x7, q5/t5555 or em4305/4469 tag.",
"notes": [
"lf presco clone -d 018363467",
"lf presco clone -d 018363467 --q5 -> encode for q5/t5555 tag",
"lf presco clone -d 018363467 --em -> encode for em4305/4469"
],
"offline": false,
"options": [
"-h, --help this help",
"-c <hex> 8 digit hex card number",
"-d <digits> 9 digit presco card id",
"--q5 optional - specify writing to q5/t5555 tag",
"--em optional - specify writing to em4305/4469 tag"
],
"usage": "lf presco clone [-h] [-c <hex>] [-d <digits>] [--q5] [--em]"
},
"lf presco help": {
"command": "lf presco help",
"description": "help this help demod demodulate presco tag from the graphbuffer --------------------------------------------------------------------------------------- lf presco demod available offline: yes try to find presco preamble, if found decode / descramble data",
"notes": [
"lf presco demod"
],
"offline": true,
"options": [
"-h, --help this help"
],
"usage": "lf presco demod [-h]"
},
"lf presco reader": {
"command": "lf presco reader",
"description": "read a presco tag",
"notes": [
"lf presco reader -@ -> continuous reader mode"
],
"offline": false,
"options": [
"-h, --help this help",
"-@ optional - continuous reader mode"
],
"usage": "lf presco reader [-h@]"
},
"lf presco sim": {
"command": "lf presco sim",
"description": "enables simulation of presco card with specified card number. simulation runs until the button is pressed or another usb command is issued. per presco format, the card number is 9 digit number and can contain *# chars. larger values are truncated.",
"notes": [
"lf presco sim -d 018363467"
],
"offline": false,
"options": [
"-h, --help this help",
"-c <hex> 8 digit hex card number",
"-d <digits> 9 digit presco card id"
],
"usage": "lf presco sim [-h] [-c <hex>] [-d <digits>]"
},
"lf pyramid clone": {
"command": "lf pyramid clone",
"description": "clone a farpointe/pyramid tag to a t55x7, q5/t5555 or em4305/4469 tag. the facility-code is 8-bit and the card number is 16-bit. larger values are truncated. currently only works on 26bit",
"notes": [
"lf pyramid clone --fc 123 --cn 11223",
"lf pyramid clone --raw 0001010101010101010440013223921c",
"lf pyramid clone --fc 123 --cn 11223 --q5 -> encode for q5/t5555 tag",
"lf pyramid clone --fc 123 --cn 11223 --em -> encode for em4305/4469"
],
"offline": false,
"options": [
"-h, --help this help",
"--fc <dec> 8-bit value facility code",
"--cn <dec> 16-bit value card number",
"--q5 optional - specify writing to q5/t5555 tag",
"--em optional - specify writing to em4305/4469 tag",
"-r, --raw <hex> raw hex data. 16 bytes"
],
"usage": "lf pyramid clone [-h] [--fc <dec>] [--cn <dec>] [--q5] [--em] [-r <hex>]"
},
"lf pyramid help": {
"command": "lf pyramid help",
"description": "help this help demod demodulate a pyramid fsk tag from the graphbuffer --------------------------------------------------------------------------------------- lf pyramid demod available offline: yes try to find farpoint/pyramid preamble, if found decode / descramble data",
"notes": [
"lf pyramid demod"
],
"offline": true,
"options": [
"-h, --help this help"
],
"usage": "lf pyramid demod [-h]"
},
"lf pyramid reader": {
"command": "lf pyramid reader",
"description": "read a farpointe/pyramid tag",
"notes": [
"lf pyramid reader -@ -> continuous reader mode"
],
"offline": false,
"options": [
"-h, --help this help",
"-@ optional - continuous reader mode"
],
"usage": "lf pyramid reader [-h@]"
},
"lf pyramid sim": {
"command": "lf pyramid sim",
"description": "enables simulation of farpointe/pyramid card with specified card number. simulation runs until the button is pressed or another usb command is issued. the facility-code is 8-bit and the card number is 16-bit. larger values are truncated. currently work only on 26bit",
"notes": [
"lf pyramid sim --fc 123 --cn 1337",
"lf pyramid clone --raw 0001010101010101010440013223921c"
],
"offline": false,
"options": [
"-h, --help this help",
"--fc <dec> 8-bit value facility code",
"--cn <dec> 16-bit value card number",
"-r, --raw <hex> raw hex data. 16 bytes"
],
"usage": "lf pyramid sim [-h] [--fc <dec>] [--cn <dec>] [-r <hex>]"
},
"lf read": {
"command": "lf read",
"description": "sniff low frequency signal. - use `lf config` to set parameters. - use `data plot` to look at it",
"notes": [
"lf read -v -s 12000 -> collect 12000 samples",
"lf read -s 3000 -@ -> oscilloscope style"
],
"offline": false,
"options": [
"-h, --help this help",
"-s, --samples <dec> number of samples to collect",
"-v, --verbose verbose output",
"-@ continuous reading mode"
],
"usage": "lf read [-hv@] [-s <dec>]"
},
"lf search": {
"command": "lf search",
"description": "read and search for valid known tag. for offline mode, you can `data load` first then search.",
"notes": [
"lf search -> try reading data from tag & search for known tag",
"lf search -1 -> use data from the graphbuffer & search for known tag",
"lf search -u -> try reading data from tag & search for known and unknown tag",
"lf search -1u -> use data from the graphbuffer & search for known and unknown tag"
],
"offline": true,
"options": [
"-h, --help this help",
"-1 use data from graphbuffer to search",
"-c continue searching even after a first hit",
"-u search for unknown tags. if not set, reads only known tags"
],
"usage": "lf search [-h1cu]"
},
"lf securakey clone": {
"command": "lf securakey clone",
"description": "clone a securakey tag to a t55x7, q5/t5555 or em4305/4469 tag.",
"notes": [
"lf securakey clone --raw 7fcb400001adea5344300000",
"lf securakey clone --q5 --raw 7fcb400001adea5344300000 -> encode for q5/t5555 tag",
"lf securakey clone --em --raw 7fcb400001adea5344300000 -> encode for em4305/4469"
],
"offline": false,
"options": [
"-h, --help this help",
"-r, --raw <hex> raw hex data. 12 bytes",
"--q5 optional - specify writing to q5/t5555 tag",
"--em optional - specify writing to em4305/4469 tag"
],
"usage": "lf securakey clone [-h] -r <hex> [--q5] [--em]"
},
"lf securakey help": {
"command": "lf securakey help",
"description": "help this help demod demodulate an securakey tag from the graphbuffer --------------------------------------------------------------------------------------- lf securakey demod available offline: yes try to find securakey preamble, if found decode / descramble data",
"notes": [
"lf securakey demod"
],
"offline": true,
"options": [
"-h, --help this help"
],
"usage": "lf securakey demod [-h]"
},
"lf securakey reader": {
"command": "lf securakey reader",
"description": "read a securakey tag",
"notes": [
"lf securakey reader -@ -> continuous reader mode"
],
"offline": false,
"options": [
"-h, --help this help",
"-@ optional - continuous reader mode"
],
"usage": "lf securakey reader [-h@]"
},
"lf securakey sim": {
"command": "lf securakey sim",
"description": "enables simulation of secura card with specified card number. simulation runs until the button is pressed or another usb command is issued.",
"notes": [
"lf securakey sim --raw 7fcb400001adea5344300000"
],
"offline": false,
"options": [
"-h, --help this help",
"-r, --raw <hex> raw hex data. 12 bytes"
],
"usage": "lf securakey sim [-h] [-r <hex>]"
},
"lf sim": {
"command": "lf sim",
"description": "simulate low frequency tag from graphbuffer use `lf config` to set parameters",
"notes": [
"lf sim",
"lf sim --gap 240 -> start simulating with 240ms gap"
],
"offline": false,
"options": [
"-h, --help this help",
"-g, --gap <ms> start gap in microseconds"
],
"usage": "lf sim [-h] [-g <ms>]"
},
"lf simask": {
"command": "lf simask",
"description": "simulate ask tag from demodbuffer or input",
"notes": [
"lf simask --clk 32 --am -d 0102030405 -> simulate ask/man rf/32",
"lf simask --clk 32 --bi -d 0102030405 -> simulate ask/biphase rf/32",
"",
"lf simask --clk 64 --am -d ffbd8001686f1924 -> simulate a em410x tag",
"lf simask --clk 64 --am --stt -d 5649533200003f340000001b -> simulate a visa2k tag"
],
"offline": false,
"options": [
"-h, --help this help",
"-i, --inv invert data",
"-c, --clk <dec> manually set clock - can autodetect if using demodbuffer (default 64)",
"--bi ask/biphase encoding",
"--am ask/manchester encoding (default)",
"--ar ask/raw encoding",
"--stt add t55xx sequence terminator gap - default: no gaps (only manchester)",
"-d, --data <hex> data to sim - omit to use demodbuffer",
"-v, --verbose verbose output"
],
"usage": "lf simask [-hiv] [-c <dec>] [--bi] [--am] [--ar] [--stt] [-d <hex>]"
},
"lf simbidir": {
"command": "lf simbidir",
"description": "simulate lf tag with bidirectional data transmission between reader and tag",
"notes": [
"lf simbidir"
],
"offline": false,
"options": [
"-h, --help this help"
],
"usage": "lf simbidir [-h]"
},
"lf simfsk": {
"command": "lf simfsk",
"description": "simulate fsk tag from demodbuffer or input. there are about four fsk modulations to know of. fsk1 - where fc/8 = high and fc/5 = low fsk1a - is inverted fsk1, ie: fc/5 = high and fc/8 = low fsk2 - where fc/10 = high and fc/8 = low fsk2a - is inverted fsk2, ie: fc/10 = high and fc/8 = low note: if you set one clock manually set them all manually",
"notes": [
"lf simfsk -c 40 --high 8 --low 5 -d 010203 -> fsk1 rf/40 data 010203",
"lf simfsk -c 40 --high 5 --low 8 -d 010203 -> fsk1a rf/40 data 010203",
"lf simfsk -c 64 --high 10 --low 8 -d 010203 -> fsk2 rf/64 data 010203",
"lf simfsk -c 64 --high 8 --low 10 -d 010203 -> fsk2a rf/64 data 010203",
"",
"lf simfsk -c 50 --high 10 --low 8 -d 1d5559555569a9a555a59569 -> simulate hid prox tag manually",
"lf simfsk -c 50 --high 10 --low 8 --stt -d 011db2487e8d811111111111 -> simulate awid tag manually"
],
"offline": false,
"options": [
"-h, --help this help",
"-c, --clk <dec> manually set clock - can autodetect if using demodbuffer (default 64)",
"--low <dec> manually set larger field clock",
"--high <dec> manually set smaller field clock",
"--stt tbd! - stt to enable a gap between playback repetitions (default: no gap)",
"-d, --data <hex> data to sim - omit to use demodbuffer",
"-v, --verbose verbose output"
],
"usage": "lf simfsk [-hv] [-c <dec>] [--low <dec>] [--high <dec>] [--stt] [-d <hex>]"
},
"lf simpsk": {
"command": "lf simpsk",
"description": "simulate psk tag from demodbuffer or input",
"notes": [
"lf simpsk -1 --clk 40 --fc 4 -d 01020304 -> simulate psk1 rf/40 psksub fc/4, data 01020304",
"",
"lf simpsk -1 --clk 32 --fc 2 -d a0000000bd989a11 -> simulate a indala tag manually"
],
"offline": false,
"options": [
"-h, --help this help",
"-1, --psk1 set psk1 (default)",
"-2, --psk2 set psk2",
"-3, --psk3 set psk3",
"-i, --inv invert data",
"-c, --clk <dec> manually set clock - can autodetect if using demodbuffer (default 32)",
"--fc <dec> 2|4|8 are valid carriers (default 2)",
"-d, --data <hex> data to sim - omit to use demodbuffer",
"-v, --verbose verbose output"
],
"usage": "lf simpsk [-h123iv] [-c <dec>] [--fc <dec>] [-d <hex>]"
},
"lf sniff": {
"command": "lf sniff",
"description": "sniff low frequency signal. you need to configure the lf part on the proxmark3 device manually. usually a trigger and skip samples is a good thing to set before doing a low frequency sniff. - use `lf config` to set parameters. - use `data plot` to look at sniff signal. - use `lf search -1` to see if signal can be automatic decoded",
"notes": [
"lf sniff -v",
"lf sniff -s 3000 -@ -> oscilloscope style"
],
"offline": false,
"options": [
"-h, --help this help",
"-s, --samples <dec> number of samples to collect",
"-v, --verbose verbose output",
"-@ continuous sniffing mode"
],
"usage": "lf sniff [-hv@] [-s <dec>]"
},
"lf t55xx bruteforce": {
"command": "lf t55xx bruteforce",
"description": "this command uses bruteforce to scan a number range. try reading page 0, block 7 before. warning this may brick non-password protected chips!",
"notes": [
"lf t55xx bruteforce --r2 -s aaaaaa77 -e aaaaaa99"
],
"offline": false,
"options": [
"-h, --help this help",
"-s, --start <hex> search start password (4 hex bytes)",
"-e, --end <hex> search end password (4 hex bytes)",
"--r0 downlink - fixed bit length",
"--r1 downlink - long leading reference",
"--r2 downlink - leading zero",
"--r3 downlink - 1 of 4 coding reference",
"--all try all downlink modes (def)"
],
"usage": "lf t55xx bruteforce [-h] -s <hex> -e <hex> [--r0] [--r1] [--r2] [--r3] [--all]"
},
"lf t55xx chk": {
"command": "lf t55xx chk",
"description": "this command uses a dictionary attack. for some cloners, try '--em' for known pwdgen algo. try to reading page 0 block 7 before. warning: this may brick non-password protected chips!",
"notes": [
"lf t55xx chk -m -> use dictionary from flash memory (rdv4)",
"lf t55xx chk -f my_dictionary_pwds -> loads a default keys dictionary file",
"lf t55xx chk --em aa11223344 -> try known pwdgen algo from some cloners based on em4100 id"
],
"offline": false,
"options": [
"-h, --help this help",
"-m, --fm use dictionary from flash memory (rdv4)",
"-f, --file <fn> file name",
"--em <hex> em4100 id (5 hex bytes)",
"--r0 downlink - fixed bit length",
"--r1 downlink - long leading reference",
"--r2 downlink - leading zero",
"--r3 downlink - 1 of 4 coding reference",
"--all try all downlink modes (def)"
],
"usage": "lf t55xx chk [-hm] [-f <fn>] [--em <hex>] [--r0] [--r1] [--r2] [--r3] [--all]"
},
"lf t55xx config": {
"command": "lf t55xx config",
"description": "set/get t55xx configuration of the pm3 client. like modulation, inverted, offset, rate etc. offset is start position to decode data.",
"notes": [
"lf t55xx config --fsk -> fsk demodulation",
"lf t55xx config --fsk -i -> fsk demodulation, inverse data",
"lf t55xx config --fsk -i -o 3 -> fsk demodulation, inverse data, offset 3"
],
"offline": true,
"options": [
"-h, --help this help",
"--fsk set demodulation fsk",
"--fsk1 set demodulation fsk 1",
"--fsk1a set demodulation fsk 1a (inv)",
"--fsk2 set demodulation fsk 2",
"--fsk2a set demodulation fsk 2a (inv)",
"--ask set demodulation ask",
"--psk1 set demodulation psk 1",
"--psk2 set demodulation psk 2",
"--psk3 set demodulation psk 3",
"--nrz set demodulation nrz",
"--bi set demodulation biphase",
"--bia set demodulation diphase (inverted biphase)",
"-i, --inv set/reset data signal inversion",
"--q5 set/reset as q5/t5555 chip instead of t55x7",
"--st set/reset sequence terminator on",
"--rate <dec> set bitrate <8|16|32|40|50|64|100|128>",
"-c, --blk0 <hex> set configuration from a block0 (4 hex bytes)",
"-o, --offset <0-255> set offset, where data should start decode in bitstream",
"--r0 downlink - fixed bit length (detected def)",
"--r1 downlink - long leading reference",
"--r2 downlink - leading zero",
"--r3 downlink - 1 of 4 coding reference"
],
"usage": "lf t55xx config [-hi] [--fsk] [--fsk1] [--fsk1a] [--fsk2] [--fsk2a] [--ask] [--psk1] [--psk2] [--psk3] [--nrz] [--bi] [--bia] [--q5] [--st] [--rate <dec>] [-c <hex>] [-o <0-255>] [--r0] [--r1] [--r2] [--r3]"
},
"lf t55xx dangerraw": {
"command": "lf t55xx dangerraw",
"description": "this command allows to emit arbitrary raw commands on t5577 and cut the field after arbitrary duration. uncontrolled usage can easily write an invalid configuration, activate lock bits, otp bit, password protection bit, deactivate test-mode, lock your card forever. warning: this may lock definitively the tag in an unusable state!",
"notes": [
"lf t55xx dangerraw -d 01000000000000010000100000000100000000 -t 3200"
],
"offline": false,
"options": [
"-h, --help this help",
"-d, --data <string> raw bit string",
"-t, --time <us> <0 - 200000> time in microseconds before dropping the field"
],
"usage": "lf t55xx dangerraw [-h] -d <string> -t <us>"
},
"lf t55xx detect": {
"command": "lf t55xx detect",
"description": "try detecting the tag modulation from reading the configuration block",
"notes": [
"lf t55xx detect",
"lf t55xx detect -1",
"lf t55xx detect -p 11223344"
],
"offline": true,
"options": [
"-h, --help this help",
"-1 extract using data from graphbuffer",
"-p, --pwd <hex> password (4 hex bytes)",
"--r0 downlink - fixed bit length (detected def)",
"--r1 downlink - long leading reference",
"--r2 downlink - leading zero",
"--r3 downlink - 1 of 4 coding reference",
"--all try all downlink modes"
],
"usage": "lf t55xx detect [-h1] [-p <hex>] [--r0] [--r1] [--r2] [--r3] [--all]"
},
"lf t55xx deviceconfig": {
"command": "lf t55xx deviceconfig",
"description": "sets t55x7 timings for direct commands. the timings are set here in field clocks (fc) which is converted to (us) on device.",
"notes": [
"lf t55xx deviceconfig -a 29 -b 17 -c 15 -d 47 -e 15 -> default t55xx",
"lf t55xx deviceconfig -a 55 -b 14 -c 21 -d 30 -> default em4305"
],
"offline": false,
"options": [
"-h, --help this help",
"-a <8..255> set start gap",
"-b <8..255> set write gap",
"-c <8..255> set write zero gap",
"-d <8..255> set write one gap",
"-e <8..255> set read gap",
"-f <8..255> set write two gap (1 of 4 only)",
"-g <8..255> set write three gap (1 of 4 only)",
"-p, --persist persist to flash memory (rdv4)",
"-z set default t55x7 timings (use `-p` to save if required)",
"--r0 downlink - fixed bit length (detected def)",
"--r1 downlink - long leading reference",
"--r2 downlink - leading zero",
"--r3 downlink - 1 of 4 coding reference"
],
"usage": "lf t55xx deviceconfig [-hpz] [-a <8..255>] [-b <8..255>] [-c <8..255>] [-d <8..255>] [-e <8..255>] [-f <8..255>] [-g <8..255>] [--r0] [--r1] [--r2] [--r3]"
},
"lf t55xx dump": {
"command": "lf t55xx dump",
"description": "this command dumps a t55xx card page 0 block 0-7. it will create three files (bin/eml/json)",
"notes": [
"lf t55xx dump",
"lf t55xx dump -p aabbccdd --override",
"lf t55xx dump -f my_lf_dump"
],
"offline": false,
"options": [
"-h, --help this help",
"-f, --file <fn> filename (default is generated on blk 0)",
"-o, --override override, force pwd read despite danger to card",
"-p, --pwd <hex> password (4 hex bytes)",
"--r0 downlink - fixed bit length",
"--r1 downlink - long leading reference",
"--r2 downlink - leading zero",
"--r3 downlink - 1 of 4 coding reference"
],
"usage": "lf t55xx dump [-ho] [-f <fn>] [-p <hex>] [--r0] [--r1] [--r2] [--r3]"
},
"lf t55xx help": {
"command": "lf t55xx help",
"description": "----------- ---------------------------- notice ----------------------------- remember to run `lf t55xx detect` first whenever a new card is placed on the proxmark3 or the config block changed. help this help ----------- --------------------- operations --------------------- config set/get t55xx configuration (modulation, inverted, offset, rate) detect try detecting the tag modulation from reading the configuration block info show t55x7 configuration data (page 0/ blk 0) trace show t55x7 traceability data (page 1/ blk 0-1) ----------- --------------------- recovery --------------------- sniff attempt to recover t55xx commands from sample buffer --------------------------------------------------------------------------------------- lf t55xx clonehelp available offline: no display a list of available commands for cloning specific techs on t5xx tags",
"notes": [
"lf t55xx clonehelp"
],
"offline": true,
"options": [
"-h, --help this help"
],
"usage": "lf t55xx clonehelp [-h]"
},
"lf t55xx info": {
"command": "lf t55xx info",
"description": "show t55x7 configuration data (page 0/ blk 0) from reading the configuration block from tag. use `-c` to specify a config block data to be used instead of reading tag.",
"notes": [
"lf t55xx info",
"lf t55xx info -1",
"lf t55xx info -p 11223344",
"lf t55xx info -c 00083040",
"lf t55xx info -c 6001805a --q5"
],
"offline": true,
"options": [
"-h, --help this help",
"-1 extract using data from graphbuffer",
"-p, --pwd <hex> password (4 hex bytes)",
"-c, --blk0 <hex> use these data instead (4 hex bytes)",
"--q5 interprete provided data as t5555/q5 config",
"--r0 downlink - fixed bit length (detected def)",
"--r1 downlink - long leading reference",
"--r2 downlink - leading zero",
"--r3 downlink - 1 of 4 coding reference"
],
"usage": "lf t55xx info [-h1] [-p <hex>] [-c <hex>] [--q5] [--r0] [--r1] [--r2] [--r3]"
},
"lf t55xx p1detect": {
"command": "lf t55xx p1detect",
"description": "detect page 1 of a t55xx chip",
"notes": [
"lf t55xx p1detect",
"lf t55xx p1detect -1",
"lf t55xx p1detect -p 11223344 --r3"
],
"offline": false,
"options": [
"-h, --help this help",
"-1 extract using data from graphbuffer",
"-p, --pwd <hex> password (4 hex bytes)",
"--r0 downlink - fixed bit length (detected def)",
"--r1 downlink - long leading reference",
"--r2 downlink - leading zero",
"--r3 downlink - 1 of 4 coding reference"
],
"usage": "lf t55xx p1detect [-h1] [-p <hex>] [--r0] [--r1] [--r2] [--r3]"
},
"lf t55xx protect": {
"command": "lf t55xx protect",
"description": "this command sets the pwd bit on t5577. warning this locks the tag!",
"notes": [
"lf t55xx protect -n 01020304 -> sets new pwd 01020304",
"lf t55xx protect -p 11223344 -n 00000000 -> use pwd 11223344, sets new pwd 00000000"
],
"offline": false,
"options": [
"-h, --help this help",
"-o, --override override safety check",
"-p, --pwd <hex> password (4 hex bytes)",
"-n, --new <hex> new password (4 hex bytes)",
"--r0 downlink - fixed bit length (detected def)",
"--r1 downlink - long leading reference",
"--r2 downlink - leading zero",
"--r3 downlink - 1 of 4 coding reference"
],
"usage": "lf t55xx protect [-ho] [-p <hex>] -n <hex> [--r0] [--r1] [--r2] [--r3]"
},
"lf t55xx read": {
"command": "lf t55xx read",
"description": "read t55xx block data. this commands defaults to page 0. * * * warning * * * use of read with password on a tag not configured for a password can damage the tag * * * * * * * * * *",
"notes": [
"lf t55xx read -b 0 -> read data from block 0",
"lf t55xx read -b 0 --pwd 01020304 -> read data from block 0, pwd 01020304",
"lf t55xx read -b 0 --pwd 01020304 -o -> read data from block 0, pwd 01020304, override"
],
"offline": false,
"options": [
"-h, --help this help",
"-b, --blk <0-7> block number to read",
"-p, --pwd <hex> password (4 hex bytes)",
"-o, --override override safety check",
"--pg1 read page 1",
"--r0 downlink - fixed bit length (detected def)",
"--r1 downlink - long leading reference",
"--r2 downlink - leading zero",
"--r3 downlink - 1 of 4 coding reference"
],
"usage": "lf t55xx read [-ho] -b <0-7> [-p <hex>] [--pg1] [--r0] [--r1] [--r2] [--r3]"
},
"lf t55xx recoverpw": {
"command": "lf t55xx recoverpw",
"description": "this command uses a few tricks to try to recover mangled password. try reading page 0, block 7 before. warning this may brick non-password protected chips!",
"notes": [
"lf t55xx recoverpw",
"lf t55xx recoverpw -p 11223344",
"lf t55xx recoverpw -p 11223344 --r3"
],
"offline": false,
"options": [
"-h, --help this help",
"-p, --pwd <hex> password (4 hex bytes)",
"--r0 downlink - fixed bit length",
"--r1 downlink - long leading reference",
"--r2 downlink - leading zero",
"--r3 downlink - 1 of 4 coding reference",
"--all try all downlink modes (def)"
],
"usage": "lf t55xx recoverpw [-h] [-p <hex>] [--r0] [--r1] [--r2] [--r3] [--all]"
},
"lf t55xx resetread": {
"command": "lf t55xx resetread",
"description": "send reset cmd then `lf read` the stream to attempt to identify the start of it (needs a demod and/or plot after)",
"notes": [
"lf t55xx resetread"
],
"offline": false,
"options": [
"-h, --help this help",
"-1 extract using data from graphbuffer",
"--r0 downlink - fixed bit length (detected def)",
"--r1 downlink - long leading reference",
"--r2 downlink - leading zero",
"--r3 downlink - 1 of 4 coding reference"
],
"usage": "lf t55xx resetread [-h1] [--r0] [--r1] [--r2] [--r3]"
},
"lf t55xx restore": {
"command": "lf t55xx restore",
"description": "restore t55xx card page 0/1 n blocks from (bin/eml/json) dump file",
"notes": [
"lf t55xx restore -f lf-t55xx-00148040-dump.bin"
],
"offline": false,
"options": [
"-h, --help this help",
"-f, --file <fn> filename of dump file",
"-p, --pwd <hex> password if target card has password set (4 hex bytes)"
],
"usage": "lf t55xx restore [-h] [-f <fn>] [-p <hex>]"
},
"lf t55xx sniff": {
"command": "lf t55xx sniff",
"description": "sniff lf t55xx based trafic and decode possible cmd / blocks. lower tolerance means tighter pulses.",
"notes": [
"lf t55xx sniff",
"lf t55xx sniff -1 -t 2 -> use buffer with tolerance of 2",
"lf t55xx sniff -1 --zero 7 --one 14 -> use buffer, zero pulse width 7, one pulse width 15"
],
"offline": true,
"options": [
"-h, --help this help",
"-1 extract using data from graphbuffer",
"-t, --tol <dec> set tolerance level (default 5)",
"-o, --one <dec> set samples width for one pulse (default auto)",
"-z, --zero <dec> set samples width for zero pulse (default auto)"
],
"usage": "lf t55xx sniff [-h1] [-t <dec>] [-o <dec>] [-z <dec>]"
},
"lf t55xx special": {
"command": "lf t55xx special",
"description": "show block changes with 64 different offsets, data taken from demodbuffer.",
"notes": [
"lf t55xx special"
],
"offline": false,
"options": [
"-h, --help this help"
],
"usage": "lf t55xx special [-h]"
},
"lf t55xx trace": {
"command": "lf t55xx trace",
"description": "show t55x7 configuration data (page 0/ blk 0) from reading the configuration block",
"notes": [
"lf t55xx trace",
"lf t55xx trace -1"
],
"offline": true,
"options": [
"-h, --help this help",
"-1 extract using data from graphbuffer",
"--r0 downlink - fixed bit length (detected def)",
"--r1 downlink - long leading reference",
"--r2 downlink - leading zero",
"--r3 downlink - 1 of 4 coding reference"
],
"usage": "lf t55xx trace [-h1] [--r0] [--r1] [--r2] [--r3]"
},
"lf t55xx wakeup": {
"command": "lf t55xx wakeup",
"description": "this commands sends the answer-on-request command and leaves the readerfield on afterwards",
"notes": [
"lf t55xx wakeup -p 11223344 -> send wakeup with password"
],
"offline": false,
"options": [
"-h, --help this help",
"-p, --pwd <hex> password (4 hex bytes)",
"-v, --verbose verbose output",
"--r0 downlink - fixed bit length (detected def)",
"--r1 downlink - long leading reference",
"--r2 downlink - leading zero",
"--r3 downlink - 1 of 4 coding reference"
],
"usage": "lf t55xx wakeup [-hv] [-p <hex>] [--r0] [--r1] [--r2] [--r3]"
},
"lf t55xx wipe": {
"command": "lf t55xx wipe",
"description": "this commands wipes a tag, fills blocks 1-7 with zeros and a default configuration block",
"notes": [
"lf t55xx wipe -> wipes a t55x7 tag, config block 0x000880e0",
"lf t55xx wipe --q5 -> wipes a q5/t5555 tag, config block 0x6001f004",
"lf t55xx wipe -p 11223344 -> wipes a t55x7 tag, config block 0x000880e0, using pwd"
],
"offline": false,
"options": [
"-h, --help this help",
"-c, --cfg <hex> configuration block0 (4 hex bytes)",
"-p, --pwd <hex> password (4 hex bytes)",
"--q5 specify writing to q5/t5555 tag using dedicated config block",
"--r0 downlink - fixed bit length (detected def)",
"--r1 downlink - long leading reference",
"--r2 downlink - leading zero",
"--r3 downlink - 1 of 4 coding reference"
],
"usage": "lf t55xx wipe [-h] [-c <hex>] [-p <hex>] [--q5] [--r0] [--r1] [--r2] [--r3]"
},
"lf t55xx write": {
"command": "lf t55xx write",
"description": "write t55xx block data",
"notes": [
"lf t55xx write -b 3 -d 11223344 -> write 11223344 to block 3",
"lf t55xx write -b 3 -d 11223344 --pwd 01020304 -> write 11223344 to block 3, pwd 01020304",
"lf t55xx write -b 3 -d 11223344 --pwd 01020304 --verify -> write 11223344 to block 3 and try validating write"
],
"offline": false,
"options": [
"-h, --help this help",
"-b, --blk <0-7> block number to write",
"-d, --data <hex> data to write (4 hex bytes)",
"-p, --pwd <hex> password (4 hex bytes)",
"-t, --tm test mode write ( danger )",
"--pg1 write page 1",
"--verify try validate data afterward",
"--r0 downlink - fixed bit length (detected def)",
"--r1 downlink - long leading reference",
"--r2 downlink - leading zero",
"--r3 downlink - 1 of 4 coding reference"
],
"usage": "lf t55xx write [-ht] -b <0-7> [-d <hex>] [-p <hex>] [--pg1] [--verify] [--r0] [--r1] [--r2] [--r3]"
},
"lf ti help": {
"command": "lf ti help",
"description": "help this help demod demodulate raw bits for ti lf tag from the graphbuffer --------------------------------------------------------------------------------------- lf ti demod available offline: yes try to find ti preamble, if found decode / descramble data",
"notes": [
"lf ti demod"
],
"offline": true,
"options": [
"-h, --help this help"
],
"usage": "lf ti demod [-h]"
},
"lf ti reader": {
"command": "lf ti reader",
"description": "read a ti tag",
"notes": [
"lf ti reader -@ -> continuous reader mode"
],
"offline": false,
"options": [
"-h, --help this help",
"-@ optional - continuous reader mode"
],
"usage": "lf ti reader [-h@]"
},
"lf ti write": {
"command": "lf ti write",
"description": "write to a r/w ti tag.",
"notes": [
"lf ti write --raw 1122334455667788",
"lf ti write --raw 1122334455667788 --crc 1122"
],
"offline": false,
"options": [
"-h, --help this help",
"-r, --raw <hex> raw hex data. 8 bytes max",
"--crc <hex> optional - crc"
],
"usage": "lf ti write [-h] -r <hex> [--crc <hex>]"
},
"lf tune": {
"command": "lf tune",
"description": "continuously measure lf antenna tuning. press button or <enter> to interrupt.",
"notes": [
"lf tune",
"lf tune --mix"
],
"offline": false,
"options": [
"-h, --help this help",
"-n, --iter <dec> number of iterations (default: 0=infinite)",
"-q, --divisor <dec> frequency divisor. 88 -> 134 khz, 95 -> 125 khz",
"-f, --freq <float> frequency in khz",
"--bar bar style",
"--mix mixed style",
"--value values style"
],
"usage": "lf tune [-h] [-n <dec>] [-q <dec>] [-f <float>] [--bar] [--mix] [--value]"
},
"lf viking clone": {
"command": "lf viking clone",
"description": "clone a viking am tag to a t55x7, q5/t5555 or em4305/4469 tag.",
"notes": [
"lf viking clone --cn 01a337",
"lf viking clone --cn 01a337 --q5 -> encode for q5/t5555 tag",
"lf viking clone --cn 112233 --em -> encode for em4305/4469"
],
"offline": false,
"options": [
"-h, --help this help",
"--cn <hex> 8 digit hex viking card number",
"--q5 optional - specify writing to q5/t5555 tag",
"--em optional - specify writing to em4305/4469 tag"
],
"usage": "lf viking clone [-h] --cn <hex> [--q5] [--em]"
},
"lf viking help": {
"command": "lf viking help",
"description": "help this help demod demodulate a viking tag from the graphbuffer --------------------------------------------------------------------------------------- lf viking demod available offline: yes try to find viking am preamble, if found decode / descramble data",
"notes": [
"lf viking demod"
],
"offline": true,
"options": [
"-h, --help this help"
],
"usage": "lf viking demod [-h]"
},
"lf viking reader": {
"command": "lf viking reader",
"description": "read a viking am tag",
"notes": [
"lf viking reader -@ -> continuous reader mode"
],
"offline": false,
"options": [
"-h, --help this help",
"-@ optional - continuous reader mode"
],
"usage": "lf viking reader [-h@]"
},
"lf viking sim": {
"command": "lf viking sim",
"description": "enables simulation of viking card with specified card number. simulation runs until the button is pressed or another usb command is issued. per viking format, the card number is 8 digit hex number. larger values are truncated.",
"notes": [
"lf viking sim --cn 01a337"
],
"offline": false,
"options": [
"-h, --help this help",
"--cn <hex> 8 digit hex viking card number"
],
"usage": "lf viking sim [-h] --cn <hex>"
},
"lf visa2000 clone": {
"command": "lf visa2000 clone",
"description": "clone a visa2000 tag to a t55x7, q5/t5555 or em4305/4469 tag.",
"notes": [
"lf visa2000 clone --cn 112233",
"lf visa2000 clone --cn 112233 --q5 -> encode for q5/t5555 tag",
"lf visa2000 clone --cn 112233 --em -> encode for em4305/4469"
],
"offline": false,
"options": [
"-h, --help this help",
"--cn <dec> visa2k card id",
"--q5 optional - specify writing to q5/t5555 tag",
"--em optional - specify writing to em4305/4469 tag"
],
"usage": "lf visa2000 clone [-h] --cn <dec> [--q5] [--em]"
},
"lf visa2000 help": {
"command": "lf visa2000 help",
"description": "help this help demod demodulate an visa2000 tag from the graphbuffer --------------------------------------------------------------------------------------- lf visa2000 demod available offline: yes try to find visa2000 preamble, if found decode / descramble data",
"notes": [
"lf visa2000 demod"
],
"offline": true,
"options": [
"-h, --help this help"
],
"usage": "lf visa2000 demod [-h]"
},
"lf visa2000 reader": {
"command": "lf visa2000 reader",
"description": "read a visa2000 tag",
"notes": [
"lf visa2000 reader -@ -> continuous reader mode"
],
"offline": false,
"options": [
"-h, --help this help",
"-@ optional - continuous reader mode"
],
"usage": "lf visa2000 reader [-h@]"
},
"lf visa2000 sim": {
"command": "lf visa2000 sim",
"description": "enables simulation of visa2k card with specified card number. simulation runs until the button is pressed or another usb command is issued.",
"notes": [
"lf visa2000 sim --cn 1337"
],
"offline": false,
"options": [
"-h, --help this help",
"--cn <dec> visa2k card id"
],
"usage": "lf visa2000 sim [-h] --cn <dec>"
},
"mem dump": {
"command": "mem dump",
"description": "dumps flash memory on device into a file or view in console",
"notes": [
"mem dump -f myfile -> download all flashmem to file",
"mem dump --view -o 262015 --len 128 -> display 128 bytes from offset 262015 (rsa sig)",
"mem dump --view -f myfile -o 241664 --len 58 -> display 58 bytes from offset 241664 and save to file"
],
"offline": false,
"options": [
"-h, --help this help",
"-o, --offset <dec> offset in memory",
"-l, --len <dec> length",
"-v, --view view dump",
"-f, --file <fn> save filename",
"-c, --cols <dec> column breaks (def 32)"
],
"usage": "mem dump [-hv] [-o <dec>] [-l <dec>] [-f <fn>] [-c <dec>]"
},
"mem help": {
"command": "mem help",
"description": "help this help --------------------------------------------------------------------------------------- mem baudrate available offline: no set the baudrate for the spi flash memory communications. reading flash id will virtually always fail under 48mhz setting. unless you know what you are doing, please stay at 24mhz. if >= 24mhz, fastreads instead of reads instruction will be used.",
"notes": [
"mem baudrate --mhz 48"
],
"offline": true,
"options": [
"-h, --help this help",
"--mhz <24|48> spi baudrate in mhz"
],
"usage": "mem baudrate [-h] --mhz <24|48>"
},
"mem info": {
"command": "mem info",
"description": "collect signature and verify it from flash memory",
"notes": [
"mem info"
],
"offline": false,
"options": [
"-h, --help this help",
"-s, --sign create a signature",
"-d <hex> flash memory id, 8 hex bytes",
"-p, --pem <fn> key in pem format",
"-v, --verbose verbose output"
],
"usage": "mem info [-hsv] [-d <hex>] [-p <fn>]"
},
"mem load": {
"command": "mem load",
"description": "loads binary file into flash memory on device warning: mem area to be written must have been wiped first ( this is already taken care when loading dictionaries )",
"notes": [
"mem load -f myfile -> upload file myfile values at default offset 0",
"mem load -f myfile -o 1024 -> upload file myfile values at offset 1024",
"mem load -f mfc_default_keys -m -> upload mfc keys",
"mem load -f t55xx_default_pwds -t -> upload t55xx passwords",
"mem load -f iclass_default_keys -i -> upload iclass keys"
],
"offline": false,
"options": [
"-h, --help this help",
"-o, --offset <dec> offset in memory",
"-m, --mifare, --mfc upload 6 bytes keys (mifare key dictionary)",
"-i, --iclass upload 8 bytes keys (iclass key dictionary)",
"-t, --t55xx upload 4 bytes keys (password dictionary)",
"-f, --file <fn> file name"
],
"usage": "mem load [-hmit] [-o <dec>] -f <fn>"
},
"mem spiffs check": {
"command": "mem spiffs check",
"description": "check/try to defrag faulty/fragmented spiffs file system",
"notes": [
"mem spiffs check"
],
"offline": false,
"options": [
"-h, --help this help"
],
"usage": "mem spiffs check [-h]"
},
"mem spiffs dump": {
"command": "mem spiffs dump",
"description": "dumps device spiffs file to a local file size is handled by first sending a stat command against file to verify existence",
"notes": [
"mem spiffs dump -s tag.bin -> download binary file from device",
"mem spiffs dump -s tag.bin -d aaa -e -> download tag.bin, save as aaa.eml format"
],
"offline": false,
"options": [
"-h, --help this help",
"-s, --src <fn> spiffs file to save",
"-d, --dest <fn> file name to save to <w/o .bin>",
"-e, --eml also save in eml format"
],
"usage": "mem spiffs dump [-he] -s <fn> [-d <fn>]"
},
"mem spiffs help": {
"command": "mem spiffs help",
"description": "help this help --------------------------------------------------------------------------------------- mem spiffs copy available offline: no copy a file to another (destructively) in spiffs file system",
"notes": [
"mem spiffs copy -s aaa.bin -d aaa_cpy.bin"
],
"offline": true,
"options": [
"-h, --help this help",
"-s, --src <fn> source file name",
"-d, --dest <fn> destination file name"
],
"usage": "mem spiffs copy [-h] -s <fn> -d <fn>"
},
"mem spiffs info": {
"command": "mem spiffs info",
"description": "print file system info and usage statistics",
"notes": [
"mem spiffs info"
],
"offline": false,
"options": [
"-h, --help this help"
],
"usage": "mem spiffs info [-h]"
},
"mem spiffs mount": {
"command": "mem spiffs mount",
"description": "mount the spiffs file system if not already mounted",
"notes": [
"mem spiffs mount"
],
"offline": false,
"options": [
"-h, --help this help"
],
"usage": "mem spiffs mount [-h]"
},
"mem spiffs remove": {
"command": "mem spiffs remove",
"description": "remove a file from spiffs filesystem",
"notes": [
"mem spiffs remove -f lasttag.bin"
],
"offline": false,
"options": [
"-h, --help this help",
"-f, --file <fn> file to remove"
],
"usage": "mem spiffs remove [-h] -f <fn>"
},
"mem spiffs rename": {
"command": "mem spiffs rename",
"description": "rename/move a file from spiffs filesystem.",
"notes": [
"mem spiffs rename -s aaa.bin -d bbb.bin"
],
"offline": false,
"options": [
"-h, --help this help",
"-s, --src <fn> source file name",
"-d, --dest <fn> destination file name"
],
"usage": "mem spiffs rename [-h] -s <fn> -d <fn>"
},
"mem spiffs test": {
"command": "mem spiffs test",
"description": "test spiffs operations, require wiping pages 0 and 1",
"notes": [
"mem spiffs test"
],
"offline": false,
"options": [
"-h, --help this help"
],
"usage": "mem spiffs test [-h]"
},
"mem spiffs tree": {
"command": "mem spiffs tree",
"description": "print the flash memory file system tree",
"notes": [
"mem spiffs tree"
],
"offline": false,
"options": [
"-h, --help this help"
],
"usage": "mem spiffs tree [-h]"
},
"mem spiffs unmount": {
"command": "mem spiffs unmount",
"description": "un-mount the spiffs file system",
"notes": [
"mem spiffs unmount"
],
"offline": false,
"options": [
"-h, --help this help"
],
"usage": "mem spiffs unmount [-h]"
},
"mem spiffs upload": {
"command": "mem spiffs upload",
"description": "uploads binary-wise file into device file system warning: mem area to be written must have been wiped first. this is already taken care when loading dictionaries. file names can only be 32 bytes long on device spiffs",
"notes": [
"mem spiffs upload -s local.bin -d dest.bin"
],
"offline": false,
"options": [
"-h, --help this help",
"-s, --src <fn> source file name",
"-d, --dest <fn> destination file name"
],
"usage": "mem spiffs upload [-h] -s <fn> -d <fn>"
},
"mem spiffs view": {
"command": "mem spiffs view",
"description": "view a file on flash memory on devicer in console",
"notes": [
"mem spiffs view -f tag.bin"
],
"offline": false,
"options": [
"-h, --help this help",
"-f, --file <fn> spiffs file to view",
"-c, --cols <dec> column breaks (def 32)"
],
"usage": "mem spiffs view [-h] -f <fn> [-c <dec>]"
},
"mem spiffs wipe": {
"command": "mem spiffs wipe",
"description": "* * * warning * * * this command wipes all files on the device spiffs file system",
"notes": [
"mem spiffs wipe"
],
"offline": false,
"options": [
"-h, --help this help"
],
"usage": "mem spiffs wipe [-h]"
},
"mem wipe": {
"command": "mem wipe",
"description": "wipe flash memory on device, which fills it with 0xff [ !!! obs ] use with caution",
"notes": [
"mem wipe -p 0 -> wipes first page"
],
"offline": false,
"options": [
"-h, --help this help",
"-p <dec> 0,1,2 page memory"
],
"usage": "mem wipe [-h] [-p <dec>]"
},
"msleep": {
"command": "msleep",
"description": "sleep for given amount of milliseconds",
"notes": [
"msleep 100"
],
"offline": true,
"options": [
"-h, --help this help",
"-t, --ms <ms> time in milliseconds"
],
"usage": "msleep [-h] [-t <ms>]"
},
"nfc barcode help": {
"command": "nfc barcode help",
"description": "-------- ------------------ nfc barcode -------------------- -------- --------------------- general --------------------- help this help ======================================================================================= reveng { crc calculations from reveng software... } [=] reveng: no mode switch specified. use reveng -h for help. ======================================================================================= smart { smart card iso-7816 commands... } --------------------------------------------------------------------------------------- smart help available offline: yes help this help list list iso 7816 history upgrade upgrade sim module firmware --------------------------------------------------------------------------------------- smart list available offline: yes alias of `trace list -t 7816` with selected protocol data to annotate trace buffer you can load a trace from file (see `trace load -h`) or it be downloaded from device by default it accepts all other arguments of `trace list`. note that some might not be relevant for this specific protocol",
"notes": [
"smart list -f -> show frame delay times",
"smart list -1 -> use trace buffer"
],
"offline": true,
"options": [
"-h, --help this help",
"-1, --buffer use data from trace buffer",
"-f show frame delay times",
"-c mark crc bytes",
"-r show relative times (gap and duration)",
"-u display times in microseconds instead of clock cycles",
"-x show hexdump to convert to pcap(ng)",
"or to import into wireshark using encapsulation type \"iso 14443\"",
"--dict <file> use dictionary keys file"
],
"usage": "smart list [-h1fcrux] [--dict <file>]"
},
"nfc barcode sim": {
"command": "nfc barcode sim",
"description": "simulate thinfilm tag",
"notes": [
"hf thinfilm sim -d b70470726f786d61726b2e636f6d"
],
"offline": false,
"options": [
"-h, --help this help",
"-d, --data <hex> bytes to send",
"--raw raw, provided bytes should include crc"
],
"usage": "hf thinfilm sim [-h] -d <hex> [--raw]"
},
"nfc help": {
"command": "nfc help",
"description": "-------- --------------------- nfc tags -------------------- type1 { nfc forum tag type 1... } type2 { nfc forum tag type 2... } type4a { nfc forum tag type 4 iso14443a... } type4b { nfc forum tag type 4 iso14443b... } mf { nfc type mifare classic/plus tag... } barcode { nfc barcode tag... } -------- --------------------- general --------------------- help this help decode decode ndef records --------------------------------------------------------------------------------------- nfc decode available offline: yes decode and print nfc data exchange format (ndef) you must provide either data in hex or a filename, but not both",
"notes": [
"nfc decode -d 9101085402656e48656c6c6f5101085402656e576f726c64",
"nfc decode -d 0103d020240203e02c040300fe",
"nfc decode -f myfilename"
],
"offline": true,
"options": [
"-h, --help this help",
"-d, --data <hex> ndef data to decode",
"-f, --file <fn> file to load",
"-v, --verbose verbose mode"
],
"usage": "nfc decode [-hv] [-d <hex>] [-f <fn>]"
},
"nfc mf help": {
"command": "nfc mf help",
"description": "-------- --------- nfc type mifare classic/plus tag -------- -------- --------------------- general --------------------- help this help ======================================================================================= nfc barcode { nfc barcode tag... } --------------------------------------------------------------------------------------- nfc barcode read available offline: no get info from thinfilm tags",
"notes": [
"hf thinfilm info"
],
"offline": true,
"options": [
"-h, --help this help"
],
"usage": "hf thinfilm info [-h]"
},
"nfc mf pread": {
"command": "nfc mf pread",
"description": "prints nfc data exchange format (ndef)",
"notes": [
"hf mfp ndefread",
"hf mfp ndefread -vv -> shows ndef parsed and raw data",
"hf mfp ndefread --aid e103 -k d3f7d3f7d3f7d3f7d3f7d3f7d3f7d3f7 -> shows ndef data with custom aid and key",
"hf mfp ndefread -f myfilename -> save raw ndef to file"
],
"offline": false,
"options": [
"-h, --help this help",
"-v, --verbose show technical data",
"--aid <aid> replace default aid for ndef",
"-k, --key <key> replace default key for ndef",
"-b, --keyb use key b for access sectors (by default: key a)",
"-f, --file <fn> save raw ndef to file"
],
"usage": "hf mfp ndefread [-hvb] [--aid <aid>] [-k <key>] [-f <fn>]"
},
"nfc type1 help": {
"command": "nfc type1 help",
"description": "-------- -------------- nfc forum tag type 1 --------------- -------- --------------------- general --------------------- help this help ======================================================================================= nfc type2 { nfc forum tag type 2... } --------------------------------------------------------------------------------------- nfc type2 read available offline: no prints nfc data exchange format (ndef)",
"notes": [
"hf mfu ndefread -> shows ndef data",
"hf mfu ndefread -k ffffffff -> shows ndef data with key",
"hf mfu ndefread -f myfilename -> save raw ndef to file"
],
"offline": true,
"options": [
"-h, --help this help",
"-l swap entered key's endianness",
"-f, --file <fn> save raw ndef to file"
],
"usage": "hf mfu ndefread [-hl] [-k replace default key for ndef] [-f <fn>]"
},
"nfc type1 read": {
"command": "nfc type1 read",
"description": "get info from topaz tags",
"notes": [
"hf topaz info",
"hf topaz info -f myfilename -> save raw ndef to file"
],
"offline": false,
"options": [
"-h, --help this help",
"-f, --file <fn> save raw ndef to file",
"-v, --verbose verbose output"
],
"usage": "hf topaz info [-hv] [-f <fn>]"
},
"nfc type2 help": {
"command": "nfc type2 help",
"description": "-------- -------------- nfc forum tag type 2 --------------- -------- --------------------- general --------------------- help this help ======================================================================================= nfc type4a { nfc forum tag type 4 iso14443a... } --------------------------------------------------------------------------------------- nfc type4a read available offline: no read nfc data exchange format (ndef) file on type 4 ndef tag",
"notes": [
"hf 14a ndefread",
"hf 14a ndefread -f myfilename -> save raw ndef to file"
],
"offline": true,
"options": [
"-h, --help this help",
"-f, --file <fn> save raw ndef to file"
],
"usage": "hf 14a ndefread [-h] [-f <fn>]"
},
"nfc type4a help": {
"command": "nfc type4a help",
"description": "-------- --------- nfc forum tag type 4 iso14443a ---------- -------- --------------------- general --------------------- help this help ======================================================================================= nfc type4b { nfc forum tag type 4 iso14443b... } --------------------------------------------------------------------------------------- nfc type4b read available offline: no print nfc data exchange format (ndef)",
"notes": [
"hf 14b ndefread",
"hf 14b ndefread -f myfilename -> save raw ndef to file"
],
"offline": true,
"options": [
"-h, --help this help",
"-f, --file <fn> save raw ndef to file"
],
"usage": "hf 14b ndefread [-h] [-f <fn>]"
},
"nfc type4a st25taread": {
"command": "nfc type4a st25taread",
"description": "read nfc data exchange format (ndef) file on st25ta",
"notes": [
"hf st25ta ndefread -p 82e80053d4ca5c0b656d852cc696c8a1",
"hf st25ta ndefread -f myfilename -> save raw ndef to file"
],
"offline": false,
"options": [
"-h, --help this help",
"-p, --pwd <hex> 16 byte read password",
"-f, --file <fn> save raw ndef to file"
],
"usage": "hf st25ta ndefread [-h] [-p <hex>] [-f <fn>]"
},
"nfc type4b help": {
"command": "nfc type4b help",
"description": "-------- --------- nfc forum tag type 4 iso14443b ------------- -------- --------------------- general --------------------- help this help ======================================================================================= nfc mf { nfc type mifare classic/plus tag... } --------------------------------------------------------------------------------------- nfc mf cread available offline: no prints nfc data exchange format (ndef)",
"notes": [
"hf mf ndefread -> shows ndef parsed data",
"hf mf ndefread -vv -> shows ndef parsed and raw data",
"hf mf ndefread --aid e103 -k ffffffffffff -b -> shows ndef data with custom aid, key and with key b",
"hf mf ndefread -f myfilename -> save raw ndef to file"
],
"offline": true,
"options": [
"-h, --help this help",
"-v, --verbose show technical data",
"--aid <aid> replace default aid for ndef",
"-k, --key <key> replace default key for ndef",
"-b, --keyb use key b for access sectors (by default: key a)",
"-f, --file <fn> save raw ndef to file"
],
"usage": "hf mf ndefread [-hvb] [--aid <aid>] [-k <key>] [-f <fn>]"
},
"prefs get barmode": {
"command": "prefs get barmode",
"description": "get preference of hf/lf tune command styled output in the client",
"notes": [
"prefs get barmode"
],
"offline": true,
"options": [
"-h, --help this help"
],
"usage": "prefs get barmode [-h]"
},
"prefs get clientdebug": {
"command": "prefs get clientdebug",
"description": "get preference of using clientside debug level",
"notes": [
"prefs get clientdebug"
],
"offline": true,
"options": [
"-h, --help this help"
],
"usage": "prefs get clientdebug [-h]"
},
"prefs get clientdelay": {
"command": "prefs get clientdelay",
"description": "get preference of delay time before execution of a command in the client",
"notes": [
"prefs get clientdelay"
],
"offline": true,
"options": [
"-h, --help this help"
],
"usage": "prefs get clientdelay [-h]"
},
"prefs get color": {
"command": "prefs get color",
"description": "get preference of using colors in the client",
"notes": [
"prefs get color"
],
"offline": true,
"options": [
"-h, --help this help"
],
"usage": "prefs get color [-h]"
},
"prefs get emoji": {
"command": "prefs get emoji",
"description": "get preference of using emojis in the client",
"notes": [
"prefs get emoji"
],
"offline": true,
"options": [
"-h, --help this help"
],
"usage": "prefs get emoji [-h]"
},
"prefs get hints": {
"command": "prefs get hints",
"description": "get preference of showing hint messages in the client",
"notes": [
"prefs get hints"
],
"offline": true,
"options": [
"-h, --help this help"
],
"usage": "prefs get hints [-h]"
},
"prefs get plotsliders": {
"command": "prefs get plotsliders",
"description": "get preference of showing the plotslider control in the client",
"notes": [
"prefs get plotsliders"
],
"offline": true,
"options": [
"-h, --help this help"
],
"usage": "prefs get plotsliders [-h]"
},
"prefs get savepaths": {
"command": "prefs get savepaths",
"description": "get preference of file paths in the client",
"notes": [
"prefs get savepaths"
],
"offline": true,
"options": [
"-h, --help this help"
],
"usage": "prefs get savepaths [-h]"
},
"prefs help": {
"command": "prefs help",
"description": "help this help get { get a preference } set { set a preference } show show all preferences --------------------------------------------------------------------------------------- prefs show available offline: yes show all persistent preferences",
"notes": [
"prefs show"
],
"offline": true,
"options": [
"-h, --help this help"
],
"usage": "prefs show [-h]"
},
"prefs set clientdebug": {
"command": "prefs set clientdebug",
"description": "set persistent preference of using clientside debug level",
"notes": [
"prefs set clientdebug --simple"
],
"offline": true,
"options": [
"-h, --help this help",
"--off no debug messages",
"--simple simple debug messages",
"--full full debug messages"
],
"usage": "prefs set clientdebug [-h] [--off] [--simple] [--full]"
},
"prefs set clientdelay": {
"command": "prefs set clientdelay",
"description": "set persistent preference of delay before executing a command in the client",
"notes": [
"prefs set clientdelay --ms 0 -> unsets any delay",
"prefs set clientdelay --ms 1000 -> sets 1000ms delay"
],
"offline": true,
"options": [
"-h, --help this help",
"--ms <ms> delay in micro seconds"
],
"usage": "prefs set clientdelay [-h] [--ms <ms>]"
},
"prefs set color": {
"command": "prefs set color",
"description": "set persistent preference of using colors in the client",
"notes": [
"prefs set color --ansi"
],
"offline": true,
"options": [
"-h, --help this help",
"--ansi use ansi colors",
"--off don't use colors"
],
"usage": "prefs set color [-h] [--ansi] [--off]"
},
"prefs set emoji": {
"command": "prefs set emoji",
"description": "set persistent preference of using emojis in the client",
"notes": [
"prefs set emoji --alias"
],
"offline": true,
"options": [
"-h, --help this help",
"--alias show alias for emoji",
"--emoji show emoji",
"--alttext show alt text for emoji",
"--none don't show emoji or text"
],
"usage": "prefs set emoji [-h] [--alias] [--emoji] [--alttext] [--none]"
},
"prefs set help": {
"command": "prefs set help",
"description": "help this help barmode set bar mode clientdebug set client debug level clientdelay set client execution delay color set color support emoji set emoji display hints set hint display savepaths ... to be adjusted next ... plotsliders set plot slider display --------------------------------------------------------------------------------------- prefs set barmode available offline: yes set persistent preference of hf/lf tune command styled output in the client",
"notes": [
"prefs set barmode --mix"
],
"offline": true,
"options": [
"-h, --help this help",
"--bar measured values as bar only",
"--mix measured values as numbers and bar",
"--val measured values only"
],
"usage": "prefs set barmode [-h] [--bar] [--mix] [--val]"
},
"prefs set hints": {
"command": "prefs set hints",
"description": "set persistent preference of showing hint messages in the client",
"notes": [
"prefs set hints --on"
],
"offline": true,
"options": [
"-h, --help this help",
"--off hide hints",
"--on show hints"
],
"usage": "prefs set hints [-h] [--off] [--on]"
},
"prefs set plotsliders": {
"command": "prefs set plotsliders",
"description": "set persistent preference of showing the plotslider control in the client",
"notes": [
"prefs set plotsliders --on"
],
"offline": true,
"options": [
"-h, --help this help",
"--off hide plot slider controls",
"--on show plot slider controls"
],
"usage": "prefs set plotsliders [-h] [--off] [--on]"
},
"prefs set savepaths": {
"command": "prefs set savepaths",
"description": "set persistent preference of file paths in the client",
"notes": [
"prefs set savepaths --dump /home/mydumpfolder -> all dump files will be saved into this folder",
"prefs set savepaths --def /home/myfolder -c -> create if needed, all files will be saved into this folder"
],
"offline": true,
"options": [
"-h, --help this help",
"-c, --create create directory if it does not exist",
"--def <path> default path",
"--dump <path> dump file path",
"--trace <path> trace path"
],
"usage": "prefs set savepaths [-hc] [--def <path>] [--dump <path>] [--trace <path>]"
},
"quit": {
"command": "quit",
"description": "quit the proxmark3 client terminal",
"notes": [
"quit"
],
"offline": true,
"options": [
"-h, --help this help"
],
"usage": "quit [-h]"
},
"rem": {
"command": "rem",
"description": "add a text line in log file",
"notes": [
"rem my message -> adds a timestamp with `my message`"
],
"offline": true,
"options": [
"-h, --help this help",
"<string> message line you want inserted"
],
"usage": "rem [-h] <string> [<string>]..."
},
"script help": {
"command": "script help",
"description": "this is a feature to run lua/cmd/python scripts. you can place scripts within the luascripts/cmdscripts/pyscripts folders. --------------------------------------------------------------------------------------- script list available offline: yes list available lua, cmd and python scripts",
"notes": [
"script list"
],
"offline": true,
"options": [
"-h, --help this help"
],
"usage": "script list [-h]"
},
"script run": {
"command": "script run",
"description": "run a lua, cmd or python script. if no extension it will search for lua/cmd/py extensions use `script list` to see available scripts",
"notes": [
"script run my_script -h"
],
"offline": true,
"options": [
"-h, --help this help",
"<filename> name of script to run",
"<params> script parameters"
],
"usage": "script run [-h] <filename> [<params>]..."
},
"smart brute": {
"command": "smart brute",
"description": "tries to bruteforce sfi, using a known list of aid's",
"notes": [
"smart brute -t"
],
"offline": false,
"options": [
"-h, --help this help",
"-t, --tlv executes tlv decoder if it possible"
],
"usage": "smart brute [-ht]"
},
"smart info": {
"command": "smart info",
"description": "extract more detailed information from smart card.",
"notes": [
"smart info -v"
],
"offline": false,
"options": [
"-h, --help this help",
"-v, --verbose verbose"
],
"usage": "smart info [-hv]"
},
"smart raw": {
"command": "smart raw",
"description": "sends raw bytes to card",
"notes": [
"smart raw -s -0 -d 00a404000e315041592e5359532e4444463031 -> `1pay.sys.ddf01` ppse directory with get atr",
"smart raw -0 -d 00a404000e325041592e5359532e4444463031 -> `2pay.sys.ddf01` ppse directory",
"smart raw -0 -t -d 00a4040007a0000000041010 -> mastercard",
"smart raw -0 -t -d 00a4040007a0000000031010 -> visa"
],
"offline": false,
"options": [
"-h, --help this help",
"-r do not read response",
"-a active smartcard without select (reset sc module)",
"-s active smartcard with select (get atr)",
"-t, --tlv executes tlv decoder if it possible",
"-0 use protocol t=0",
"-d, --data <hex> bytes to send"
],
"usage": "smart raw [-hrast0] -d <hex>"
},
"smart reader": {
"command": "smart reader",
"description": "act as a smart card reader.",
"notes": [
"smart reader"
],
"offline": false,
"options": [
"-h, --help this help",
"-v, --verbose verbose"
],
"usage": "smart reader [-hv]"
},
"smart setclock": {
"command": "smart setclock",
"description": "set clock speed for smart card interface.",
"notes": [
"smart setclock --4mhz",
"smart setclock --16mhz"
],
"offline": false,
"options": [
"-h, --help this help",
"--16mhz 16 mhz clock speed",
"--8mhz 8 mhz clock speed",
"--4mhz 4 mhz clock speed"
],
"usage": "smart setclock [-h] [--16mhz] [--8mhz] [--4mhz]"
},
"smart upgrade": {
"command": "smart upgrade",
"description": "[=] ------------------------------------------------------------------- [!] warning - sim module firmware upgrade [!] a dangerous command, do wrong and you could brick the sim module [=] ------------------------------------------------------------------- upgrade rdv4.0 sim module firmware",
"notes": [
"smart upgrade -f sim011.bin"
],
"offline": true,
"options": [
"-h, --help this help",
"-f, --file <fn> specify firmware file name"
],
"usage": "smart upgrade [-h] -f <fn>"
},
"trace help": {
"command": "trace help",
"description": "help this help extract extract authentication challenges found in trace list list protocol data in trace buffer load load trace from file save save trace buffer to file --------------------------------------------------------------------------------------- trace extract available offline: yes extracts protocol authentication challenges from trace buffer",
"notes": [
"trace extract",
"trace extract -1"
],
"offline": true,
"options": [
"-h, --help this help",
"-1, --buffer use data from trace buffer"
],
"usage": "trace extract [-h1]"
},
"trace list": {
"command": "trace list",
"description": "annotate trace buffer with selected protocol data you can load a trace from file (see `trace load -h`) or it be downloaded from device by default",
"notes": [
"trace list -t raw -> just show raw data without annotations",
"",
"trace list -t 14a -> interpret as iso14443-a",
"trace list -t 14b -> interpret as iso14443-b",
"trace list -t 15 -> interpret as iso15693",
"trace list -t 7816 -> interpret as iso7816-4",
"trace list -t cryptorf -> interpret as cryptorf",
"",
"trace list -t des -> interpret as mifare desfire",
"trace list -t felica -> interpret as iso18092 / felica",
"trace list -t hitag1 -> interpret as hitag1",
"trace list -t hitag2 -> interpret as hitag2",
"trace list -t hitags -> interpret as hitags",
"trace list -t iclass -> interpret as iclass",
"trace list -t legic -> interpret as legic",
"trace list -t lto -> interpret as lto-cm",
"trace list -t mf -> interpret as mifare classic and decrypt crypto1 stream",
"trace list -t seos -> interpret as seos",
"trace list -t thinfilm -> interpret as thinfilm",
"trace list -t topaz -> interpret as topaz",
"",
"trace list -t mf --dict <mfc_default_keys> -> use dictionary keys file",
"trace list -t 14a -f -> show frame delay times",
"trace list -t 14a -1 -> use trace buffer"
],
"offline": true,
"options": [
"-h, --help this help",
"-1, --buffer use data from trace buffer",
"-f show frame delay times",
"-c mark crc bytes",
"-r show relative times (gap and duration)",
"-u display times in microseconds instead of clock cycles",
"-x show hexdump to convert to pcap(ng)",
"or to import into wireshark using encapsulation type \"iso 14443\"",
"-t, --type <string> protocol to annotate the trace",
"--dict <fn> use dictionary keys file"
],
"usage": "trace list [-h1fcrux] [-t <string>] [--dict <fn>]"
},
"trace load": {
"command": "trace load",
"description": "load protocol data from binary file to trace buffer file extension is <.trace>",
"notes": [
"trace load -f mytracefile -> w/o file extension"
],
"offline": true,
"options": [
"-h, --help this help",
"-f, --file <fn> specify trace file to load"
],
"usage": "trace load [-h] -f <fn>"
},
"trace save": {
"command": "trace save",
"description": "save protocol data from trace buffer to binary file file extension is <.trace>",
"notes": [
"trace save -f mytracefile -> w/o file extension"
],
"offline": true,
"options": [
"-h, --help this help",
"-f, --file <fn> specify trace file to save"
],
"usage": "trace save [-h] -f <fn>"
},
"usart btfactory": {
"command": "usart btfactory",
"description": "reset bt add-on to factory settings this requires 1) btpower to be turned on 2) bt add-on to not be connected => the add-on blue led must blink warning: process only if strictly needed!",
"notes": [
"usart btfactory"
],
"offline": false,
"options": [
"-h, --help this help"
],
"usage": "usart btfactory [-h]"
},
"usart config": {
"command": "usart config",
"description": "configure usart. warning: it will have side-effects if used in usart host mode! the changes are not permanent, restart proxmark3 to get default settings back.",
"notes": [
"usart config -b 9600",
"usart config -b 9600 --none",
"usart config -e"
],
"offline": false,
"options": [
"-h, --help this help",
"-b, --baud <dec> baudrate",
"-n, --none mone parity",
"-e, --even even parity",
"-o, --odd odd parity"
],
"usage": "usart config [-hneo] [-b <dec>]"
},
"usart help": {
"command": "usart help",
"description": "help this help --------------------------------------------------------------------------------------- usart btpin available offline: no change bt add-on pin. warning: this requires 1) btpower to be turned on 2) bt add-on to not be connected => the add-on blue led must blink",
"notes": [
"usart btpin -p 1234"
],
"offline": true,
"options": [
"-h, --help this help",
"-p, --pin <dec> desired pin number (4 digits)"
],
"usage": "usart btpin [-h] -p <dec>"
},
"usart rx": {
"command": "usart rx",
"description": "receive string over usart. warning: it will have side-effects if used in usart host mode!",
"notes": [
"usart rx -t 2000 -> 2 second timeout"
],
"offline": false,
"options": [
"-h, --help this help",
"-t, --timeout <dec> timeout in ms, default is 0ms"
],
"usage": "usart rx [-h] [-t <dec>]"
},
"usart rxhex": {
"command": "usart rxhex",
"description": "receive bytes over usart. warning: it will have side-effects if used in usart host mode!",
"notes": [
"usart rxhex -t 2000 -> 2 second timeout"
],
"offline": false,
"options": [
"-h, --help this help",
"-t, --timeout <dec> timeout in ms, default is 0ms"
],
"usage": "usart rxhex [-h] [-t <dec>]"
},
"usart tx": {
"command": "usart tx",
"description": "send string over usart. warning: it will have side-effects if used in usart host mode!",
"notes": [
"usart tx -d \"at+version\"",
"usart tx -d \"at+version\\r\\n\""
],
"offline": false,
"options": [
"-h, --help this help",
"-d, --data <string> string to send"
],
"usage": "usart tx [-h] -d <string>"
},
"usart txhex": {
"command": "usart txhex",
"description": "send bytes over usart. warning: it will have side-effects if used in usart host mode!",
"notes": [
"usart txhex -d 504d33620a80000000010100f09f988ef09fa5b36233"
],
"offline": false,
"options": [
"-h, --help this help",
"-d, --data <hex> bytes to send"
],
"usage": "usart txhex [-h] -d <hex>"
},
"usart txrx": {
"command": "usart txrx",
"description": "send string over usart and wait for response. warning: if used in usart host mode, you can only send at commands to add-on when bt connection is not established (led needs to be blinking) any other usage in usart host mode will have side-effects!",
"notes": [
"usart txrx -d \"at+version\" -> talking to bt add-on (when no connection)",
"usart txrx -t 2000 -d \"at+somestuff\\r\\n\" -> talking to a target requiring longer time and end-of-line chars"
],
"offline": false,
"options": [
"-h, --help this help",
"-t, --timeout <dec> timeout in ms, default is 1000 ms",
"-d, --data <string> string to send"
],
"usage": "usart txrx [-h] [-t <dec>] -d <string>"
},
"wiegand decode": {
"command": "wiegand decode",
"description": "decode raw hex or binary to wiegand format",
"notes": [
"wiegand decode --raw 2006f623ae"
],
"offline": true,
"options": [
"-h, --help this help",
"-r, --raw <hex> raw hex to be decoded",
"-b, --bin <bin> binary string to be decoded"
],
"usage": "wiegand decode [-h] [-r <hex>] [-b <bin>]"
},
"wiegand encode": {
"command": "wiegand encode",
"description": "encode wiegand formatted number to raw hex",
"notes": [
"wiegand encode --fc 101 --cn 1337 -> show all formats",
"wiegand encode -w h10301 --fc 101 --cn 1337 -> h10301 format"
],
"offline": true,
"options": [
"-h, --help this help",
"--fc <dec> facility number",
"--cn <dec> card number",
"--issue <dec> issue level",
"--oem <dec> oem code",
"-w, --wiegand <format> see `wiegand list` for available formats",
"--pre add hid proxii preamble to wiegand output"
],
"usage": "wiegand encode [-h] [--fc <dec>] --cn <dec> [--issue <dec>] [--oem <dec>] [-w <format>] [--pre]"
},
"wiegand help": {
"command": "wiegand help",
"description": "help this help list list available wiegand formats encode encode to wiegand raw hex (currently for hid prox) decode convert raw hex to decoded wiegand format (currently for hid prox) --------------------------------------------------------------------------------------- wiegand list available offline: yes list available wiegand formats",
"notes": [
"wiegand list"
],
"offline": true,
"options": [
"-h, --help this help"
],
"usage": "wiegand info [-h]"
}
},
"metadata": {
"commands_extracted": 603,
"extracted_by": "PM3Help2JSON v1.00",
"extracted_on": "2022-02-05T11:30:03"
}
}
Reference in a new issue View git blame Copy permalink