dandri/proxmark3
1
0
Fork 0
mirror of https://github.com/RfidResearchGroup/proxmark3.git synced 2026-08-27 22:34:58 +00:00
Code Issues Packages Projects Releases Wiki Activity

added PACE (--can) support to emrtd commands.

Browse Source
This commit is contained in:
iceman1001
2026-08-21 22:32:06 +02:00
parent 122637f26f
commit f6e0119f5f
10 changed files with 1308 additions and 450 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CHANGELOG.md
+5 -1
View File
@@ -3,7 +3,11 @@ All notable changes to this project will be documented in this file.
This project uses the changelog in accordance with [keepchangelog](http://keepachangelog.com/). Please use this to write notable changes, which is not the same as git commit log...
## [unreleased][unreleased]
- Added `nfc encode` and `hf mfu ndefwrite` - build NDEF URI/Text/AAR records and write them to MIFARE Ultralight / NTAG tags, plus a reusable NDEF encoder in `nfc/ndef.c` (@0x6r1an0y)
- Added `nfc encode` and `hf mfu ndefwrite` - build NDEF URI/Text/AAR records and write them to Ultralight tags (@0x6r1an0y)
- Fixed `hf emrtd info` - the picture viewer now scales images to the window instead of pinning them at native size (@iceman1001)
- Added `hf emrtd` - PACE-CAM (Chip Authentication Mapping) session support. The anti-clone proof itself is not yet verified (@iceman1001)
- Added `hf emrtd test` - offline regression tests for the PACE / secure messaging primitives (@iceman1001)
- Added `hf emrtd info/dump --can/--pace/--bac` - PACE-ECDH-GM support with MRZ or CAN passwords, AES-CMAC-128/192/256 and 3DES-CBC-CBC secure messaging (@iceman1001)
- Changed `hf emrtd info` - now shows EF_DG2 portraits for JPREG2000 via new dependecy lib (@iceman1001)
- Changed `hf emrtd info`- now shows portrait, signature and other biometrics at the same time (@iceman1001)
- Fixed `pm3_grabbed_output_get` - heap overflow (@jonyen)
client/CMakeLists.txt
+2
View File
@@ -358,6 +358,8 @@ set (TARGET_SOURCES
${PM3_ROOT}/client/src/cipurse/cipursecrypto.c
${PM3_ROOT}/client/src/cipurse/cipursecore.c
${PM3_ROOT}/client/src/cipurse/cipursetest.c
${PM3_ROOT}/client/src/emrtd/emrtd_pace.c
${PM3_ROOT}/client/src/emrtd/emrtd_pacetest.c
${PM3_ROOT}/client/src/loclass/cipher.c
${PM3_ROOT}/client/src/loclass/cipher_bs.c
${PM3_ROOT}/client/src/loclass/cipher_bs_avx2.c
client/Makefile
+2
View File
@@ -860,6 +860,8 @@ SRCS = mifare/aiddesfire.c \
cipurse/cipursecore.c \
cipurse/cipursecrypto.c \
cipurse/cipursetest.c \
emrtd/emrtd_pace.c \
emrtd/emrtd_pacetest.c \
fileutils.c \
flash.c \
frame_progress.c \
client/src/cmdhfemrtd.c
+1066 -390
View File
File diff suppressed because it is too large Load Diff
client/src/cmdhfemrtd.h
+13 -14
View File
@@ -47,23 +47,22 @@ typedef struct emrtd_hashalg_s {
const uint8_t descriptor[15];
} emrtd_hashalg_t;
typedef struct emrtd_pacealg_s {
const char *name;
int (*keygenerator)(uint8_t *datain, int datainlen, uint8_t *dataout);
const uint8_t descriptor[10];
} emrtd_pacealg_t;
// Standardized Domain Parameters
typedef struct emrtd_pacesdp_s {
uint8_t id;
const char *name;
size_t size;
} emrtd_pacesdp_t;
// Everything needed to authenticate to a document, either with BAC or with PACE
typedef struct emrtd_auth_s {
char documentnumber[10];
char dob[7];
char expiry[7];
char can[15];
bool mrz_available;
bool can_available;
bool force_pace; // fail rather than falling back to BAC
bool force_bac; // skip PACE even when EF_CardAccess is present
} emrtd_auth_t;
int CmdHFeMRTD(const char *Cmd);
int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_available, const char *path);
int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_available, bool only_fast);
int dumpHF_EMRTD(const emrtd_auth_t *auth, const char *path);
int infoHF_EMRTD(const emrtd_auth_t *auth, bool only_fast);
int infoHF_EMRTD_offline(const char *path);
#ifdef __cplusplus
client/src/pm3line_vocabulary.h
+8 -1
View File
@@ -222,6 +222,7 @@ const static vocabulary_t vocabulary[] = {
{ 0, "hf 15 writeafi" },
{ 0, "hf 15 writedsfid" },
{ 0, "hf 15 csetuid" },
{ 0, "hf 15 cfinalize" },
{ 1, "hf aliro help" },
{ 1, "hf aliro list" },
{ 0, "hf aliro info" },
@@ -254,15 +255,16 @@ const static vocabulary_t vocabulary[] = {
{ 0, "hf emrtd dump" },
{ 1, "hf emrtd info" },
{ 1, "hf emrtd list" },
{ 1, "hf emrtd test" },
{ 1, "hf felica help" },
{ 1, "hf felica list" },
{ 0, "hf felica info" },
{ 0, "hf felica seacauth1" },
{ 0, "hf felica raw" },
{ 0, "hf felica rdbl" },
{ 0, "hf felica reader" },
{ 0, "hf felica sniff" },
{ 0, "hf felica wrbl" },
{ 0, "hf felica seacauth1" },
{ 0, "hf felica dump" },
{ 0, "hf felica discnodes" },
{ 0, "hf felica sim" },
@@ -676,7 +678,11 @@ const static vocabulary_t vocabulary[] = {
{ 0, "hw bootloader" },
{ 1, "hw connect" },
{ 0, "hw dbg" },
{ 0, "hw fpga" },
{ 0, "hw fpgaoff" },
{ 0, "hw ant_pm5" },
{ 0, "hw qc_pm5" },
{ 0, "hw factorydata" },
{ 0, "hw lcd" },
{ 0, "hw lcdreset" },
{ 0, "hw ping" },
@@ -1117,6 +1123,7 @@ const static vocabulary_t vocabulary[] = {
{ 0, "script run lf_em_tearoff_protect.lua" },
{ 0, "script run lf_hid_bulkclone.lua" },
{ 0, "script run lf_hid_bulkclone_v2.lua" },
{ 0, "script run lf_ht2_paxton.lua" },
{ 0, "script run lf_ident_json.lua" },
{ 0, "script run lf_ioprox_bulkclone.lua" },
{ 0, "script run lf_t55xx_chk.lua" },
client/src/proxguiqt.cpp
+36 -11
View File
@@ -270,6 +270,40 @@ const PictureItem *PictureWidget::pictureAt(int i) const {
return &m_images.at(i);
}
ScaledPictureLabel::ScaledPictureLabel(const QImage &img, QWidget *parent)
: QLabel(parent), m_image(img) {
setAlignment(Qt::AlignCenter);
setMinimumSize(1, 1);
// let the layout hand us whatever is going, we adapt to it
setSizePolicy(QSizePolicy::Ignored, QSizePolicy::Ignored);
rescale();
}
QSize ScaledPictureLabel::sizeHint(void) const {
return m_image.size();
}
void ScaledPictureLabel::resizeEvent(QResizeEvent *event) {
QLabel::resizeEvent(event);
rescale();
}
void ScaledPictureLabel::rescale(void) {
if (m_image.isNull())
return;
QSize room = size();
if (room.width() < 1 || room.height() < 1)
return;
// Qt::KeepAspectRatio fits the image inside the box without distorting it.
// Scaling up is wanted here, a 240x320 portrait in a 400x400 window should
// fill the window rather than sit in the middle of it.
setPixmap(QPixmap::fromImage(m_image.scaled(room, Qt::KeepAspectRatio, Qt::SmoothTransformation)));
}
// Append one image to the array and give it its own tab
void PictureWidget::addPicture(const QString &title, const QImage &img) {
@@ -281,17 +315,8 @@ void PictureWidget::addPicture(const QString &title, const QImage &img) {
QWidget *page = new QWidget();
QVBoxLayout *layout = new QVBoxLayout(page);
QLabel *lbl_pm = new QLabel();
lbl_pm->setPixmap(QPixmap::fromImage(img));
lbl_pm->setScaledContents(false);
lbl_pm->setAlignment(Qt::AlignCenter);
// large images (fingerprints, high res portraits) shouldn't blow up the window
QScrollArea *scroll = new QScrollArea(page);
scroll->setWidget(lbl_pm);
scroll->setWidgetResizable(true);
scroll->setAlignment(Qt::AlignCenter);
layout->addWidget(scroll);
ScaledPictureLabel *lbl_pm = new ScaledPictureLabel(img, page);
layout->addWidget(lbl_pm, 1);
QLabel *lbl_sz = new QLabel(page);
lbl_sz->setText(QString("w: %1 h: %2")
client/src/proxguiqt.h
+22
View File
@@ -27,6 +27,7 @@
#include <QObject>
#include <QWidget>
#include <QPainter>
#include <QLabel>
#include <QtGui>
#include "proxgui.h"
@@ -101,6 +102,27 @@ class PictureItem {
QImage image;
};
/**
* @brief A label that keeps its image scaled to whatever room it is given
*
* Portraits in EF_DG2 are small (often 240x320) and signatures in EF_DG7 are
* wide and short. Painting either one at native size in a fixed window leaves
* it stranded in a corner, so the pixmap is rebuilt from the original image on
* every resize, fitted to the widget and keeping the aspect ratio.
*/
class ScaledPictureLabel : public QLabel {
public:
explicit ScaledPictureLabel(const QImage &img, QWidget *parent = nullptr);
QSize sizeHint(void) const override;
protected:
void resizeEvent(QResizeEvent *event) override;
private:
void rescale(void);
QImage m_image;
};
// Picture viewer window. Holds an array of images, one tab per image, so that
// several pictures of the same document (portrait, signature, other biometrics)
// can be shown side by side
doc/commands.json
+146 -31
View File
@@ -1891,20 +1891,35 @@
],
"usage": "hf 14b wrbl [-h] [-b <dec>] -d <hex> [--512] [--4k] [--sb] [--force]"
},
"hf 15 cfinalize": {
"command": "hf 15 cfinalize",
"description": "Finalize a magic ISO15693 'V3' tag. This operation is irreversible. After finalize the configuration area is erased and the UID can no longer be changed. Set the UID with `hf 15 csetuid --v3` first, then lock it in with this command.",
"notes": [
"hf 15 cfinalize -y"
],
"offline": false,
"options": [
"-h, --help This help",
"-y, --yes Confirm the irreversible finalize operation"
],
"usage": "hf 15 cfinalize [-hy]"
},
"hf 15 csetuid": {
"command": "hf 15 csetuid",
"description": "Set UID for magic Chinese card (only works with such cards)",
"description": "Set UID for magic Chinese card (only works with such cards) For magic 'V3' tags this writes the UID configuration only and is repeatable; run `hf 15 cfinalize` afterwards to lock the UID permanently.",
"notes": [
"hf 15 csetuid -u E011223344556677 -> use gen1 command",
"hf 15 csetuid -u E011223344556677 --v2 -> use gen2 command"
"hf 15 csetuid -u E011223344556677 --v2 -> use gen2 command",
"hf 15 csetuid -u E011223344556677 --v3 -> use gen3 (V3) magic tag"
],
"offline": false,
"options": [
"-h, --help This help",
"-u, --uid <hex> UID, 8 hex bytes",
"-2, --v2 Use gen2 magic command"
"-2, --v2 Use gen2 magic command",
"-3, --v3 Use gen3 (V3) magic tag (repeatable, needs cfinalize)"
],
"usage": "hf 15 csetuid [-h2] -u <hex>"
"usage": "hf 15 csetuid [-h23] -u <hex>"
},
"hf 15 demod": {
"command": "hf 15 demod",
@@ -2836,11 +2851,14 @@
},
"hf emrtd help": {
"command": "hf emrtd help",
"description": "help This help info Tag information list List ISO 14443A/7816 history --------------------------------------------------------------------------------------- hf emrtd dump available offline: no Dump all files on an eMRTD",
"description": "help This help info Tag information list List ISO 14443A/7816 history test Regression tests --------------------------------------------------------------------------------------- hf emrtd dump available offline: no Dump all files on an eMRTD",
"notes": [
"hf emrtd dump",
"hf emrtd dump --dir ../dump",
"hf emrtd dump -n 123456789 -d 890101 -e 250401"
"hf emrtd dump -n 123456789 -d 890101 -e 250401",
"hf emrtd dump --can 123456 -> PACE with the Card Access Number",
"hf emrtd dump --can 123456 --pace -> PACE only, no BAC fallback",
"hf emrtd dump -n 123456789 -d 890101 -e 250401 --bac -> force BAC"
],
"offline": true,
"options": [
@@ -2849,9 +2867,12 @@
"-d, --date <YYMMDD> date of birth in YYMMDD format",
"-e, --expiry <YYMMDD> expiry in YYMMDD format",
"-m, --mrz <[0-9A-Z<]> 2nd line of MRZ, 44 chars",
"--can <digits> Card Access Number, PACE password instead of the MRZ",
"--pace force PACE, fail instead of falling back to BAC",
"--bac force BAC, skip PACE",
"--dir <str> save dump to the given dirpath"
],
"usage": "hf emrtd dump [-h] [-n <alphanum>] [-d <YYMMDD>] [-e <YYMMDD>] [-m <[0-9A-Z<]>] [--dir <str>]"
"usage": "hf emrtd dump [-h] [-n <alphanum>] [-d <YYMMDD>] [-e <YYMMDD>] [-m <[0-9A-Z<]>] [--can <digits>] [--pace] [--bac] [--dir <str>]"
},
"hf emrtd info": {
"command": "hf emrtd info",
@@ -2860,7 +2881,9 @@
"hf emrtd info",
"hf emrtd info --dir ../dumps",
"hf emrtd info -n 123456789 -d 890101 -e 250401",
"hf emrtd info -n 123456789 -d 890101 -e 250401 -i"
"hf emrtd info -n 123456789 -d 890101 -e 250401 -i",
"hf emrtd info --can 123456 -> PACE with the Card Access Number",
"hf emrtd info --can 123456 --pace -> PACE only, no BAC fallback"
],
"offline": true,
"options": [
@@ -2869,10 +2892,13 @@
"-d, --date <YYMMDD> date of birth in YYMMDD format",
"-e, --expiry <YYMMDD> expiry in YYMMDD format",
"-m, --mrz <[0-9A-Z<]> 2nd line of MRZ, 44 chars (passports only)",
"--can <digits> Card Access Number, PACE password instead of the MRZ",
"--pace force PACE, fail instead of falling back to BAC",
"--bac force BAC, skip PACE",
"--dir <str> display info from offline dump stored in dirpath",
"-i, --images show images"
],
"usage": "hf emrtd info [-hi] [-n <alphanum>] [-d <YYMMDD>] [-e <YYMMDD>] [-m <[0-9A-Z<]>] [--dir <str>]"
"usage": "hf emrtd info [-hi] [-n <alphanum>] [-d <YYMMDD>] [-e <YYMMDD>] [-m <[0-9A-Z<]>] [--can <digits>] [--pace] [--bac] [--dir <str>]"
},
"hf emrtd list": {
"command": "hf emrtd list",
@@ -2895,6 +2921,18 @@
],
"usage": "hf emrtd list [-h1crux] [--frame] [-f <fn>]"
},
"hf emrtd test": {
"command": "hf emrtd test",
"description": "Regression tests for the PACE and secure messaging primitives",
"notes": [
"hf emrtd test"
],
"offline": true,
"options": [
"-h, --help This help"
],
"usage": "hf emrtd test [-h]"
},
"hf epa help": {
"command": "hf epa help",
"description": "help This help --------------------------------------------------------------------------------------- hf epa cnonces available offline: no Tries to collect nonces when doing part of PACE protocol.",
@@ -3020,7 +3058,7 @@
},
"hf felica help": {
"command": "hf felica help",
"description": "----------- ----------------------- General ----------------------- help This help list List ISO 18092/FeliCa history ----------- ----------------------- Operations ----------------------- ----------- ----------------------- FeliCa Standard ----------------------- ----------- ----------------------- FeliCa Light ----------------------- --------------------------------------------------------------------------------------- hf felica list available offline: yes Alias of `trace list -t felica` with selected protocol data to annotate trace buffer You can load a trace from file (see `trace load -h`) or it be downloaded from device by default It accepts all other arguments of `trace list`. Note that some might not be relevant for this specific protocol",
"description": "----------- ----------------------- General ----------------------- help This help list List ISO 18092/FeliCa history ----------- ----------------------- Operations ----------------------- ----------- ----------------------- FeliCa SEAC ----------------------- ----------- ----------------------- FeliCa Standard ----------------------- ----------- ----------------------- FeliCa Light ----------------------- --------------------------------------------------------------------------------------- hf felica list available offline: yes Alias of `trace list -t felica` with selected protocol data to annotate trace buffer You can load a trace from file (see `trace load -h`) or it be downloaded from device by default It accepts all other arguments of `trace list`. Note that some might not be relevant for this specific protocol",
"notes": [
"hf felica list --frame -> show frame delay times",
"hf felica list -1 -> use trace buffer"
@@ -3248,17 +3286,22 @@
],
"usage": "hf felica scsvcode [-h] [-r <dec>] [--idm <hex>]"
},
"hf felica seacinfo": {
"command": "hf felica seacinfo",
"description": "Get info about FeliCa SEAC cards",
"hf felica seacauth1": {
"command": "hf felica seacauth1",
"description": "Send FeliCa SEAC Authentication1",
"notes": [
"hf felica seacinfo"
"hf felica seacauth1",
"hf felica seacauth1 --selector 0F",
"hf felica seacauth1 --challenge 0001020304050607",
"hf felica seacauth1 -s 0F -c FFFFFFFFFFFFFFFF"
],
"offline": false,
"options": [
"-h, --help This help"
"-h, --help This help",
"-s, --selector <hex> selector, 1 byte (default 01)",
"-c, --challenge <hex> Challenge1a, 8 bytes (default all zero)"
],
"usage": "hf felica seacinfo [-h]"
"usage": "hf felica seacauth1 [-h] [-s <hex>] [-c <hex>]"
},
"hf felica sim": {
"command": "hf felica sim",
@@ -4835,16 +4878,30 @@
},
"hf iclass sam": {
"command": "hf iclass sam",
"description": "hf iclass sam - HID SAM operations Secure-channel subcommands: Legacy PACS-extraction flags (no subcommand, applied to hf iclass sam directly): --info get SAM version + serial number (also warms up the SAM) -d, --data <hex> DER-encoded SAMCommand to send (raw, no SC) -s, --snmp --data is in SNMP format without the A0/94 headers -p, --prevent fake the e-purse update during PACS extraction --break stop tag interaction at nr-mac (for SIO extract) -f, --file <fn> emulate from a dump file instead of a real card -n, --nodetect skip card detect + SetDetectedCardInfo -k, --keep keep the field active after the command -t, --tlv decode the response as TLV --shallow shallow modulation -v, --verbose verbose output Examples: hf iclass sam extract PACS via SAM (defaults) hf iclass sam --info get SAM version + serial (warmup ping) hf iclass sam scopen open Artemis secure channel hf iclass sam scsend --payload 8200 send wrapped SAMCommand hf iclass sam scclose terminate the SC session ======================================================================================= hf ict { ICT MFC/DESfire RFIDs... } --------------------------------------------------------------------------------------- hf ict help available offline: yes help This help list List ICT history reader Act like an IS14443-a reader --------------------------------------------------------------------------------------- hf ict credential available offline: no Read ICT sector from tag and decode",
"description": "Extract PACS via a HID SAM",
"notes": [
"hf ict credential"
"hf iclass sam",
"hf iclass sam -p -d a005a103800104 -> get PACS data, prevent epurse update",
"hf iclass sam --break -> get Nr-MAC for extracting encrypted SIO",
"hf iclass sam -f hf-iclass-dump.bin -> emulate card from dump file to SAM",
"hf iclass sam --info -> get SAM version + serial (also warms up the SAM)"
],
"offline": false,
"options": [
"-h, --help This help",
"-v, --verbose verbose output"
"-v, --verbose verbose output",
"-k, --keep keep the field active after command executed",
"-n, --nodetect skip selecting the card and sending card details to SAM",
"-t, --tlv decode TLV",
"--break stop tag interaction on nr-mac",
"-p, --prevent fake epurse update",
"--shallow shallow mod",
"-d, --data <hex> DER encoded command to send to SAM",
"-s, --snmp data is in snmp format without headers",
"--info get SAM infos (version, serial number)",
"-f, --file <fn> dump file to emulate to SAM instead of a real card"
],
"usage": "hf ict credential [-hv]"
"usage": "hf iclass sam [-hvkntps] [--break] [--shallow] [-d <hex>]... [--info] [-f <fn>]"
},
"hf iclass sim": {
"command": "hf iclass sim",
@@ -5003,6 +5060,19 @@
],
"usage": "hf iclass wrbl [-hv@] [-k <hex>] [--ki <dec>] --blk <dec> -d <hex> [-m <hex>] [--credit] [--elite] [--raw] [--nr] [--shallow]"
},
"hf ict help": {
"command": "hf ict help",
"description": "help This help list List ICT history reader Act like an IS14443-a reader --------------------------------------------------------------------------------------- hf ict credential available offline: no Read ICT sector from tag and decode",
"notes": [
"hf ict credential"
],
"offline": true,
"options": [
"-h, --help This help",
"-v, --verbose verbose output"
],
"usage": "hf ict credential [-hv]"
},
"hf ict info": {
"command": "hf ict info",
"description": "Get info from ICT encoded credential tags (MIFARE Classic / DESfire)",
@@ -8252,6 +8322,7 @@
"notes": [
"hf mfdes pc --key 00000000000000000000000000000000",
"hf mfdes pc --key 00112233445566778899aabbccddeeff --rounds 4",
"hf mfdes pc --aid 123456 --key 00112233445566778899aabbccddeeff",
"hf mfdes pc --key 00112233445566778899aabbccddeeff -c native -a"
],
"offline": false,
@@ -8261,9 +8332,10 @@
"-v, --verbose Verbose output",
"-k, --key <hex> Key (AES-128, exactly 16 bytes)",
"-r, --rounds <dec> Number of rounds (1..8), default 8",
"-c, --ccset <native|niso> Communication command set (default from `hf mfdes default`)"
"-c, --ccset <native|niso> Communication command set (default from `hf mfdes default`)",
"--aid <hex> Application ID (3 hex bytes, big endian)"
],
"usage": "hf mfdes pc [-hav] -k <hex> [-r <dec>] [-c <native|niso>]"
"usage": "hf mfdes pc [-hav] -k <hex> [-r <dec>] [-c <native|niso>] [--aid <hex>]"
},
"hf mfdes read": {
"command": "hf mfdes read",
@@ -10465,9 +10537,10 @@
"--bar bar style",
"--mix mixed style",
"--value values style",
"-v, --verbose verbose output"
"-v, --verbose verbose output",
"--rgb (PM5) mirror the tuning level on the antenna RGB LED"
],
"usage": "hf tune [-hv] [-n <dec>] [--bar] [--mix] [--value]"
"usage": "hf tune [-hv] [-n <dec>] [--bar] [--mix] [--value] [--rgb]"
},
"hf vas decrypt": {
"command": "hf vas decrypt",
@@ -10652,6 +10725,21 @@
],
"usage": "hints [-h10]"
},
"hw ant_pm5": {
"command": "hw ant_pm5",
"description": "Control the antennal of pm5",
"notes": [
"hw ant_pm5 --set <u8_data> -> Write the data of IO data register",
"hw ant_pm5 -m --set <u8_data> -> Write the data of IO map register"
],
"offline": false,
"options": [
"-h, --help This help",
"-m, --map Write the IO map register",
"-s, --set <u8_data> Set PM5 antenna"
],
"usage": "hw ant_pm5 [-hm] [-s <u8_data>]"
},
"hw bootloader": {
"command": "hw bootloader",
"description": "Reboot Proxmark3 into bootloader mode",
@@ -10725,9 +10813,23 @@
],
"usage": "hw decay [-h] [--ms <dec>] [--us <dec>]"
},
"hw fpgaoff": {
"command": "hw fpgaoff",
"description": "Turn of fpga and antenna field",
"hw factorydata": {
"command": "hw factorydata",
"description": "Get/Set the factory data for Device",
"notes": [
"hw factorydata --load <file> -> Write the factory data to device from file",
"hw factorydata -> Read and parse the factory data from device"
],
"offline": false,
"options": [
"-h, --help This help",
"--load <fn> Load factory data from file to device"
],
"usage": "hw factorydata [-h] [--load <fn>]"
},
"hw fpga": {
"command": "hw fpga",
"description": "help This help ------------- ----------------------- Operation ----------------------- --------------------------------------------------------------------------------------- hw fpgaoff available offline: no Turn of fpga and antenna field",
"notes": [
"hw fpgaoff"
],
@@ -10792,6 +10894,18 @@
],
"usage": "hw ping [-h] [-l <dec>]"
},
"hw qc_pm5": {
"command": "hw qc_pm5",
"description": "QC Test for the PM5",
"notes": [
"hf qcpm5"
],
"offline": false,
"options": [
"-h, --help This help"
],
"usage": "hw qcpm5 [-h]"
},
"hw readmem": {
"command": "hw readmem",
"description": "Reads processor flash memory into a file or views on console",
@@ -14388,9 +14502,10 @@
"--bar bar style",
"--mix mixed style",
"--value values style",
"-v, --verbose verbose output"
"-v, --verbose verbose output",
"--rgb (PM5) mirror the tuning level on the antenna RGB LED"
],
"usage": "lf tune [-hv] [-n <dec>] [-q <dec>] [-f <float>] [--bar] [--mix] [--value]"
"usage": "lf tune [-hv] [-n <dec>] [-q <dec>] [-f <float>] [--bar] [--mix] [--value] [--rgb]"
},
"lf viking clone": {
"command": "lf viking clone",
@@ -16023,8 +16138,8 @@
}
},
"metadata": {
"commands_extracted": 896,
"commands_extracted": 902,
"extracted_by": "PM3Help2JSON v1.00",
"extracted_on": "2026-07-30T14:44:57+00:00"
"extracted_on": "2026-08-21T18:43:14+00:00"
}
}
doc/commands.md
+8 -2
View File
@@ -281,6 +281,7 @@ Check column "offline" for their availability.
|`hf 15 writeafi `|N |`Writes the AFI on an ISO-15693 tag`
|`hf 15 writedsfid `|N |`Writes the DSFID on an ISO-15693 tag`
|`hf 15 csetuid `|N |`Set UID for magic card`
|`hf 15 cfinalize `|N |`Finalize a magic V3 tag (irreversible)`
### hf aliro
@@ -353,6 +354,7 @@ Check column "offline" for their availability.
|`hf emrtd dump `|N |`Dump eMRTD files to binary files`
|`hf emrtd info `|Y |`Tag information`
|`hf emrtd list `|Y |`List ISO 14443A/7816 history`
|`hf emrtd test `|Y |`Regression tests`
### hf felica
@@ -364,12 +366,12 @@ Check column "offline" for their availability.
|`hf felica help `|Y |`This help`
|`hf felica list `|Y |`List ISO 18092/FeliCa history`
|`hf felica info `|N |`Tag information`
|`hf felica seacinfo `|N |`FeliCa SEAC tag information`
|`hf felica raw `|N |`Send raw hex data to tag`
|`hf felica rdbl `|N |`read block data from authentication-not-required Service.`
|`hf felica reader `|N |`Act like an ISO18092/FeliCa reader`
|`hf felica sniff `|N |`Sniff ISO 18092/FeliCa traffic`
|`hf felica wrbl `|N |`write block data to an authentication-not-required Service.`
|`hf felica seacauth1 `|N |`FeliCa SEAC Authentication1`
|`hf felica dump `|N |`Wait for and try dumping FeliCa`
|`hf felica discnodes `|N |`discover Area Code and Service Code nodes.`
|`hf felica sim `|N |`Emulate FeliCa Standard from dump file`
@@ -537,7 +539,7 @@ Check column "offline" for their availability.
|`hf iclass decrypt `|Y |`Decrypt given block data or tag dump file`
|`hf iclass managekeys `|Y |`Manage keys to use with iclass commands`
|`hf iclass permutekey `|Y |`Permute function from 'heart of darkness' paper`
|`hf iclass sam `|N |`SAM ops: PACS extract + secure channel (scopen/scsend/scclose)`
|`hf iclass sam `|N |`Extract PACS from a HID SAM`
### hf ict
@@ -1007,7 +1009,11 @@ Check column "offline" for their availability.
|`hw bootloader `|N |`Reboot into bootloader mode`
|`hw connect `|Y |`Connect to the device via serial port`
|`hw dbg `|N |`Set device side debug level`
|`hw fpga `|N |`Fpga commands`
|`hw fpgaoff `|N |`Turn off FPGA on device`
|`hw ant_pm5 `|N |`Control the antennal of pm5`
|`hw qc_pm5 `|N |`Perform QC test for the PM5`
|`hw factorydata `|N |`Get/Set the factory data for Device`
|`hw lcd `|N |`Send command/data to LCD`
|`hw lcdreset `|N |`Hardware reset LCD`
|`hw ping `|N |`Test if the Proxmark3 is responsive`