This was implemented with a new pair of RPCs CMD_HF_MIFARE_READBL_EX and CMD_HF_MIFARE_WRITEBL_EX these RPCs support all combinations of read/write commands, wakeup, and auth options so in time can replace the other MFC read/write commands too reduce armsrc code size and complexity. Also added config parsing for the gdm cfg block when reading with hf mf gdmcfg and explicitly with hf mf gdmparsecfg.
66 KiB
Proxmark3 command dump
Some commands are available only if a Proxmark3 is actually connected.
Check column "offline" for their availability.
| command | offline | description |
|---|---|---|
help |
Y | Use help for details of a command |
auto |
N | Automated detection process for unknown tags |
clear |
Y | Clear screen |
hints |
Y | Turn hints on / off |
msleep |
Y | Add a pause in milliseconds |
rem |
Y | Add a text line in log file |
quit |
Y | `` |
exit |
Y | Exit program |
prefs
{ Edit client/device preferences... }
| command | offline | description |
|---|---|---|
prefs help |
Y | This help |
prefs show |
Y | Show all preferences |
prefs get
{ Get a preference }
| command | offline | description |
|---|---|---|
prefs get barmode |
Y | Get bar mode preference |
prefs get client.debug |
Y | Get client debug level preference |
prefs get client.delay |
Y | Get client execution delay preference |
prefs get client.timeout |
Y | Get client execution delay preference |
prefs get color |
Y | Get color support preference |
prefs get savepaths |
Y | Get file folder |
prefs get emoji |
Y | Get emoji display preference |
prefs get hints |
Y | Get hint display preference |
prefs get output |
Y | Get dump output style preference |
prefs get plotsliders |
Y | Get plot slider display preference |
prefs set
{ Set a preference }
| command | offline | description |
|---|---|---|
prefs set help |
Y | This help |
prefs set barmode |
Y | Set bar mode |
prefs set client.debug |
Y | Set client debug level |
prefs set client.delay |
Y | Set client execution delay |
prefs set client.timeout |
Y | Set client communication timeout |
prefs set color |
Y | Set color support |
prefs set emoji |
Y | Set emoji display |
prefs set hints |
Y | Set hint display |
prefs set savepaths |
Y | ... to be adjusted next ... |
prefs set output |
Y | Set dump output style |
prefs set plotsliders |
Y | Set plot slider display |
analyse
{ Analyse utils... }
| command | offline | description |
|---|---|---|
analyse help |
Y | This help |
analyse lcr |
Y | Generate final byte for XOR LRC |
analyse crc |
Y | Stub method for CRC evaluations |
analyse chksum |
Y | Checksum with adding, masking and one's complement |
analyse dates |
Y | Look for datestamps in a given array of bytes |
analyse lfsr |
Y | LFSR tests |
analyse a |
Y | num bits test |
analyse nuid |
Y | create NUID from 7byte UID |
analyse demodbuff |
Y | Load binary string to DemodBuffer |
analyse freq |
Y | Calc wave lengths |
analyse foo |
Y | muxer |
analyse units |
Y | convert ETU <> US <> SSP_CLK (3.39MHz) |
data
{ Plot window / data buffer manipulation... }
| command | offline | description |
|---|---|---|
data help |
Y | This help |
data biphaserawdecode |
Y | Biphase decode bin stream in DemodBuffer |
data detectclock |
Y | Detect ASK, FSK, NRZ, PSK clock rate of wave in GraphBuffer |
data fsktonrz |
Y | Convert fsk2 to nrz wave for alternate fsk demodulating (for weak fsk) |
data manrawdecode |
Y | Manchester decode binary stream in DemodBuffer |
data modulation |
Y | Identify LF signal for clock and modulation |
data rawdemod |
Y | Demodulate the data in the GraphBuffer and output binary |
data askedgedetect |
Y | Adjust Graph for manual ASK demod |
data autocorr |
Y | Autocorrelation over window |
data dirthreshold |
Y | Max rising higher up-thres/ Min falling lower down-thres |
data decimate |
Y | Decimate samples |
data envelope |
Y | Generate square envelope of samples |
data undecimate |
Y | Un-decimate samples |
data hide |
Y | Hide graph window |
data hpf |
Y | Remove DC offset from trace |
data iir |
Y | Apply IIR buttersworth filter on plot data |
data grid |
Y | overlay grid on graph window |
data ltrim |
Y | Trim samples from left of trace |
data mtrim |
Y | Trim out samples from the specified start to the specified stop |
data norm |
Y | Normalize max/min to +/-128 |
data plot |
Y | Show graph window |
data cthreshold |
Y | Average out all values between |
data rtrim |
Y | Trim samples from right of trace |
data setgraphmarkers |
Y | Set blue and orange marker in graph window |
data shiftgraphzero |
Y | Shift 0 for Graphed wave + or - shift value |
data timescale |
Y | Set cursor display timescale |
data zerocrossings |
Y | Count time between zero-crossings |
data convertbitstream |
Y | Convert GraphBuffer's 0/1 values to 127 / -127 |
data getbitstream |
Y | Convert GraphBuffer's >=1 values to 1 and <1 to 0 |
data asn1 |
Y | ASN1 decoder |
data atr |
Y | ATR lookup |
data bin2hex |
Y | Converts binary to hexadecimal |
data bitsamples |
N | Get raw samples as bitstring |
data bmap |
Y | Convert hex value according a binary template |
data clear |
Y | Clears bigbuf on deviceside and graph window |
data crypto |
Y | Encrypt and decrypt data |
data diff |
Y | Diff of input files |
data hexsamples |
N | Dump big buffer as hex bytes |
data hex2bin |
Y | Converts hexadecimal to binary |
data load |
Y | Load contents of file into graph window |
data num |
Y | Converts dec/hex/bin |
data print |
Y | Print the data in the DemodBuffer |
data samples |
N | Get raw samples for graph window (GraphBuffer) |
data save |
Y | Save signal trace data (from graph window) |
data setdebugmode |
Y | Set Debugging Level on client side |
data tune |
N | Measure tuning of device antenna. Results shown in graph window |
emv
{ EMV ISO-14443 / ISO-7816... }
| command | offline | description |
|---|---|---|
emv help |
Y | This help |
emv list |
Y | List ISO7816 history |
emv test |
Y | Crypto logic test |
emv challenge |
N | Generate challenge |
emv exec |
N | Executes EMV contactless transaction |
emv genac |
N | Generate ApplicationCryptogram |
emv gpo |
N | Execute GetProcessingOptions |
emv intauth |
N | Internal authentication |
emv pse |
N | Execute PPSE. It selects 2PAY.SYS.DDF01 or 1PAY.SYS.DDF01 directory |
emv reader |
N | Act like an EMV reader |
emv readrec |
N | Read files from card |
emv roca |
N | Extract public keys and run ROCA test |
emv scan |
N | Scan EMV card and save it contents to json file for emulator |
emv search |
N | Try to select all applets from applets list and print installed applets |
emv select |
N | Select applet |
hf
{ High frequency commands... }
| command | offline | description |
|---|---|---|
hf help |
Y | This help |
hf list |
Y | List protocol data in trace buffer |
hf plot |
N | Plot signal |
hf tune |
N | Continuously measure HF antenna tuning |
hf search |
Y | Search for known HF tags |
hf sniff |
N | Generic HF Sniff |
hf 14a
{ ISO14443A RFIDs... }
| command | offline | description |
|---|---|---|
hf 14a help |
Y | This help |
hf 14a list |
Y | List ISO 14443-a history |
hf 14a antifuzz |
N | Fuzzing the anticollision phase. Warning! Readers may react strange |
hf 14a config |
N | Configure 14a settings (use with caution) |
hf 14a cuids |
N | Collect n>0 ISO14443-a UIDs in one go |
hf 14a info |
N | Tag information |
hf 14a sim |
N | Simulate ISO 14443-a tag |
hf 14a sniff |
N | sniff ISO 14443-a traffic |
hf 14a raw |
N | Send raw hex data to tag |
hf 14a reader |
N | Act like an ISO14443-a reader |
hf 14a apdu |
N | Send ISO 14443-4 APDU to tag |
hf 14a apdufind |
N | Enumerate APDUs - CLA/INS/P1P2 |
hf 14a chaining |
N | Control ISO 14443-4 input chaining |
hf 14a ndefformat |
N | Format ISO 14443-A as NFC Type 4 tag |
hf 14a ndefread |
N | Read an NDEF file from ISO 14443-A Type 4 tag |
hf 14a ndefwrite |
N | Write NDEF records to ISO 14443-A tag |
hf 14b
{ ISO14443B RFIDs... }
| command | offline | description |
|---|---|---|
hf 14b help |
Y | This help |
hf 14b list |
Y | List ISO-14443-B history |
hf 14b apdu |
N | Send ISO 14443-4 APDU to tag |
hf 14b dump |
N | Read all memory pages of an ISO-14443-B tag, save to file |
hf 14b info |
N | Tag information |
hf 14b ndefread |
N | Read NDEF file on tag |
hf 14b raw |
N | Send raw hex data to tag |
hf 14b rdbl |
N | Read SRI512/SRIX4 block |
hf 14b reader |
N | Act as a ISO-14443-B reader to identify a tag |
hf 14b sim |
N | Fake ISO ISO-14443-B tag |
hf 14b sniff |
N | Eavesdrop ISO-14443-B |
hf 14b wrbl |
N | Write data to a SRI512/SRIX4 tag |
hf 14b view |
Y | Display content from tag dump file |
hf 14b valid |
Y | SRIX4 checksum test |
hf 15
{ ISO15693 RFIDs... }
| command | offline | description |
|---|---|---|
hf 15 help |
Y | This help |
hf 15 list |
Y | List ISO-15693 history |
hf 15 demod |
Y | Demodulate ISO-15693 from tag |
hf 15 dump |
N | Read all memory pages of an ISO-15693 tag, save to file |
hf 15 info |
N | Tag information |
hf 15 sniff |
N | Sniff ISO-15693 traffic |
hf 15 raw |
N | Send raw hex data to tag |
hf 15 rdbl |
N | Read a block |
hf 15 rdmulti |
N | Reads multiple blocks |
hf 15 reader |
N | Act like an ISO-15693 reader |
hf 15 restore |
N | Restore from file to all memory pages of an ISO-15693 tag |
hf 15 samples |
N | Acquire samples as reader (enables carrier, sends inquiry) |
hf 15 view |
Y | Display content from tag dump file |
hf 15 wipe |
N | Wipe card to zeros |
hf 15 wrbl |
N | Write a block |
hf 15 sim |
N | Fake an ISO-15693 tag |
hf 15 eload |
N | Load image file into emulator to be used by 'sim' command |
hf 15 esave |
N | Save emulator memory into image file |
hf 15 eview |
N | View emulator memory |
hf 15 slixwritepwd |
N | Writes a password on a SLIX ISO-15693 tag |
hf 15 slixeasdisable |
N | Disable EAS mode on SLIX ISO-15693 tag |
hf 15 slixeasenable |
N | Enable EAS mode on SLIX ISO-15693 tag |
hf 15 slixprivacydisable |
N | Disable privacy mode on SLIX ISO-15693 tag |
hf 15 slixprivacyenable |
N | Enable privacy mode on SLIX ISO-15693 tag |
hf 15 passprotectafi |
N | Password protect AFI - Cannot be undone |
hf 15 passprotecteas |
N | Password protect EAS - Cannot be undone |
hf 15 findafi |
N | Brute force AFI of an ISO-15693 tag |
hf 15 writeafi |
N | Writes the AFI on an ISO-15693 tag |
hf 15 writedsfid |
N | Writes the DSFID on an ISO-15693 tag |
hf 15 csetuid |
N | Set UID for magic card |
hf cipurse
{ Cipurse transport Cards... }
| command | offline | description |
|---|---|---|
hf cipurse help |
Y | This help. |
hf cipurse info |
N | Get info about CIPURSE tag |
hf cipurse select |
N | Select CIPURSE application or file |
hf cipurse auth |
N | Authenticate CIPURSE tag |
hf cipurse read |
N | Read binary file |
hf cipurse write |
N | Write binary file |
hf cipurse aread |
N | Read file attributes |
hf cipurse awrite |
N | Write file attributes |
hf cipurse formatall |
N | Erase all the data from chip |
hf cipurse create |
N | Create file, application, key via DGI record |
hf cipurse delete |
N | Delete file |
hf cipurse updkey |
N | Update key |
hf cipurse updakey |
N | Update key attributes |
hf cipurse default |
N | Set default key and file id for all the other commands |
hf cipurse test |
Y | Regression tests |
hf epa
{ German Identification Card... }
| command | offline | description |
|---|---|---|
hf epa help |
Y | This help |
hf epa cnonces |
N | Acquire encrypted PACE nonces of specific size |
hf epa replay |
N | Perform PACE protocol by replaying given APDUs |
hf epa sim |
N | Simulate PACE protocol |
hf emrtd
{ Machine Readable Travel Document... }
| command | offline | description |
|---|---|---|
hf emrtd help |
Y | This help |
hf emrtd dump |
N | Dump eMRTD files to binary files |
hf emrtd info |
Y | Display info about an eMRTD |
hf emrtd list |
Y | List ISO 14443A/7816 history |
hf felica
{ ISO18092 / FeliCa RFIDs... }
| command | offline | description |
|---|---|---|
hf felica help |
Y | This help |
hf felica list |
Y | List ISO 18092/FeliCa history |
hf felica info |
N | Tag information |
hf felica raw |
N | Send raw hex data to tag |
hf felica rdbl |
N | read block data from authentication-not-required Service. |
hf felica reader |
N | Act like an ISO18092/FeliCa reader |
hf felica sniff |
N | Sniff ISO 18092/FeliCa traffic |
hf felica wrbl |
N | write block data to an authentication-not-required Service. |
hf felica rqservice |
N | verify the existence of Area and Service, and to acquire Key Version. |
hf felica rqresponse |
N | verify the existence of a card and its Mode. |
hf felica scsvcode |
N | acquire Area Code and Service Code. |
hf felica rqsyscode |
N | acquire System Code registered to the card. |
hf felica auth1 |
N | authenticate a card. Start mutual authentication with Auth1 |
hf felica auth2 |
N | allow a card to authenticate a Reader/Writer. Complete mutual authentication |
hf felica rqspecver |
N | acquire the version of card OS. |
hf felica resetmode |
N | reset Mode to Mode 0. |
hf felica litesim |
N | Emulating ISO/18092 FeliCa Lite tag |
hf felica litedump |
N | Wait for and try dumping FelicaLite |
hf fido
{ FIDO and FIDO2 authenticators... }
| command | offline | description |
|---|---|---|
hf fido help |
Y | This help. |
hf fido list |
Y | List ISO 14443A history |
hf fido info |
N | Info about FIDO tag. |
hf fido reg |
N | FIDO U2F Registration Message. |
hf fido auth |
N | FIDO U2F Authentication Message. |
hf fido make |
N | FIDO2 MakeCredential command. |
hf fido assert |
N | FIDO2 GetAssertion command. |
hf fudan
{ Fudan RFIDs... }
| command | offline | description |
|---|---|---|
hf fudan help |
Y | This help |
hf fudan reader |
N | Act like a fudan reader |
hf fudan dump |
N | Dump FUDAN tag to binary file |
hf fudan rdbl |
N | Read a fudan tag |
hf fudan view |
Y | Display content from tag dump file |
hf fudan wrbl |
N | Write a fudan tag |
hf gallagher
{ Gallagher DESFire RFIDs... }
| command | offline | description |
|---|---|---|
hf gallagher help |
Y | This help |
hf gallagher reader |
N | Read & decode all Gallagher credentials on a DESFire card |
hf gallagher clone |
N | Add Gallagher credentials to a DESFire card |
hf gallagher delete |
N | Delete Gallagher credentials from a DESFire card |
hf gallagher diversifykey |
Y | Diversify Gallagher key |
hf gallagher decode |
Y | Decode Gallagher credential block |
hf ksx6924
{ KS X 6924 (T-Money, Snapper+) RFIDs }
| command | offline | description |
|---|---|---|
hf ksx6924 help |
Y | This help |
hf ksx6924 select |
N | Select application, and leave field up |
hf ksx6924 info |
N | Get info about a KS X 6924 (T-Money, Snapper+) transit card |
hf ksx6924 balance |
N | Get current purse balance |
hf ksx6924 init |
N | Perform transaction initialization with Mpda |
hf ksx6924 prec |
N | Send proprietary get record command (CLA=90, INS=4C) |
hf jooki
{ Jooki RFIDs... }
| command | offline | description |
|---|---|---|
hf jooki help |
Y | This help |
hf jooki clone |
N | Write a Jooki token |
hf jooki decode |
Y | Decode Jooki token |
hf jooki encode |
Y | Encode Jooki token |
hf jooki sim |
N | Simulate Jooki token |
hf iclass
{ ICLASS RFIDs... }
| command | offline | description |
|---|---|---|
hf iclass help |
Y | This help |
hf iclass list |
Y | List iclass history |
hf iclass dump |
N | Dump Picopass / iCLASS tag to file |
hf iclass info |
N | Tag information |
hf iclass rdbl |
N | Read Picopass / iCLASS block |
hf iclass reader |
N | Act like a Picopass / iCLASS reader |
hf iclass restore |
N | Restore a dump file onto a Picopass / iCLASS tag |
hf iclass sniff |
N | Eavesdrop Picopass / iCLASS communication |
hf iclass view |
Y | Display content from tag dump file |
hf iclass wrbl |
N | Write Picopass / iCLASS block |
hf iclass creditepurse |
N | Credit epurse value |
hf iclass chk |
N | Check keys |
hf iclass loclass |
Y | Use loclass to perform bruteforce reader attack |
hf iclass lookup |
Y | Uses authentication trace to check for key in dictionary file |
hf iclass sim |
N | Simulate iCLASS tag |
hf iclass eload |
N | Load Picopass / iCLASS dump file into emulator memory |
hf iclass esave |
N | Save emulator memory to file |
hf iclass esetblk |
N | Set emulator memory block data |
hf iclass eview |
N | View emulator memory |
hf iclass configcard |
N | Reader configuration card |
hf iclass calcnewkey |
Y | Calc diversified keys (blocks 3 & 4) to write new keys |
hf iclass encode |
Y | Encode binary wiegand to block 7 |
hf iclass encrypt |
Y | Encrypt given block data |
hf iclass decrypt |
Y | Decrypt given block data or tag dump file |
hf iclass managekeys |
Y | Manage keys to use with iclass commands |
hf iclass permutekey |
Y | Permute function from 'heart of darkness' paper |
hf iclass sam |
N | SAM tests |
hf legic
{ LEGIC RFIDs... }
| command | offline | description |
|---|---|---|
hf legic help |
Y | This help |
hf legic dump |
N | Dump LEGIC Prime tag to binary file |
hf legic info |
N | Display deobfuscated and decoded LEGIC Prime tag data |
hf legic list |
Y | List LEGIC history |
hf legic rdbl |
N | Read bytes from a LEGIC Prime tag |
hf legic reader |
N | LEGIC Prime Reader UID and tag info |
hf legic restore |
N | Restore a dump file onto a LEGIC Prime tag |
hf legic wipe |
N | Wipe a LEGIC Prime tag |
hf legic wrbl |
N | Write data to a LEGIC Prime tag |
hf legic sim |
N | Start tag simulator |
hf legic eload |
N | Load binary dump to emulator memory |
hf legic esave |
N | Save emulator memory to binary file |
hf legic eview |
N | View emulator memory |
hf legic einfo |
N | Display deobfuscated and decoded emulator memory |
hf legic crc |
Y | Calculate Legic CRC over given bytes |
hf legic view |
Y | Display deobfuscated and decoded content from tag dump file |
hf lto
{ LTO Cartridge Memory RFIDs... }
| command | offline | description |
|---|---|---|
hf lto help |
Y | This help |
hf lto dump |
N | Dump LTO-CM tag to file |
hf lto info |
N | Tag information |
hf lto list |
Y | List LTO-CM history |
hf lto rdbl |
N | Read block |
hf lto reader |
N | Act like a LTO-CM reader |
hf lto restore |
N | Restore dump file to LTO-CM tag |
hf lto wrbl |
N | Write block |
hf mf
{ MIFARE RFIDs... }
| command | offline | description |
|---|---|---|
hf mf help |
Y | This help |
hf mf list |
Y | List MIFARE history |
hf mf info |
N | mfc card Info |
hf mf darkside |
N | Darkside attack |
hf mf nested |
N | Nested attack |
hf mf hardnested |
Y | Nested attack for hardened MIFARE Classic cards |
hf mf staticnested |
N | Nested attack against static nonce MIFARE Classic cards |
hf mf brute |
N | Smart bruteforce to exploit weak key generators |
hf mf autopwn |
N | Automatic key recovery tool for MIFARE Classic |
hf mf nack |
N | Test for MIFARE NACK bug |
hf mf chk |
N | Check keys |
hf mf fchk |
N | Check keys fast, targets all keys on card |
hf mf decrypt |
Y | Decrypt Crypto1 data from sniff or trace |
hf mf supercard |
N | Extract info from a super card`` |
hf mf auth4 |
N | ISO14443-4 AES authentication |
hf mf acl |
Y | Decode and print MIFARE Classic access rights bytes |
hf mf dump |
N | Dump MIFARE Classic tag to binary file |
hf mf mad |
Y | Checks and prints MAD |
hf mf personalize |
N | Personalize UID (MIFARE Classic EV1 only) |
hf mf rdbl |
N | Read MIFARE Classic block |
hf mf rdsc |
N | Read MIFARE Classic sector |
hf mf restore |
N | Restore MIFARE Classic binary file to tag |
hf mf setmod |
N | Set MIFARE Classic EV1 load modulation strength |
hf mf value |
Y | Value blocks |
hf mf view |
Y | Display content from tag dump file |
hf mf wipe |
N | Wipe card to zeros and default keys/acc |
hf mf wrbl |
N | Write MIFARE Classic block |
hf mf sim |
N | Simulate MIFARE card |
hf mf ecfill |
N | Fill emulator memory with help of keys from emulator |
hf mf eclr |
N | Clear emulator memory |
hf mf egetblk |
N | Get emulator memory block |
hf mf egetsc |
N | Get emulator memory sector |
hf mf ekeyprn |
N | Print keys from emulator memory |
hf mf eload |
N | Load from file emul dump |
hf mf esave |
N | Save to file emul dump |
hf mf esetblk |
N | Set emulator memory block |
hf mf eview |
N | View emulator memory |
hf mf cgetblk |
N | Read block from card |
hf mf cgetsc |
N | Read sector from card |
hf mf cload |
N | Load dump to card |
hf mf csave |
N | Save dump from card into file or emulator |
hf mf csetblk |
N | Write block to card |
hf mf csetuid |
N | Set UID on card |
hf mf cview |
N | View card |
hf mf cwipe |
N | Wipe card to default UID/Sectors/Keys |
hf mf gen3uid |
N | Set UID without changing manufacturer block |
hf mf gen3blk |
N | Overwrite manufacturer block |
hf mf gen3freeze |
N | Perma lock UID changes. irreversible |
hf mf ginfo |
N | Info about configuration of the card |
hf mf ggetblk |
N | Read block from card |
hf mf gload |
N | Load dump to card |
hf mf gsave |
N | Save dump from card into file or emulator |
hf mf gsetblk |
N | Write block to card |
hf mf gview |
N | View card |
hf mf gchpwd |
N | Change card access password. Warning! |
hf mf gdmcfg |
N | Read config block from card |
hf mf gdmsetcfg |
N | Write config block to card |
hf mf gdmparsecfg |
Y | Parse config block to card |
hf mf gdmsetblk |
N | Write block to card |
hf mf ndefformat |
N | Format MIFARE Classic Tag as NFC Tag |
hf mf ndefread |
N | Read and print NDEF records from card |
hf mf ndefwrite |
N | Write NDEF records to card |
hf mf encodehid |
N | Encode a HID Credential / NDEF record to card |
hf mfp
{ MIFARE Plus RFIDs... }
| command | offline | description |
|---|---|---|
hf mfp help |
Y | This help |
hf mfp list |
Y | List MIFARE Plus history |
hf mfp auth |
N | Authentication |
hf mfp chk |
N | Check keys |
hf mfp dump |
N | Dump MIFARE Plus tag to binary file |
hf mfp info |
N | Info about MIFARE Plus tag |
hf mfp mad |
N | Check and print MAD |
hf mfp rdbl |
N | Read blocks from card |
hf mfp rdsc |
N | Read sectors from card |
hf mfp wrbl |
N | Write block to card |
hf mfp chkey |
N | Change key on card |
hf mfp chconf |
N | Change config on card |
hf mfp commitp |
N | Configure security layer (SL1/SL3 mode) |
hf mfp initp |
N | Fill all the card's keys in SL0 mode |
hf mfp wrp |
N | Write Perso command |
hf mfp ndefformat |
N | Format MIFARE Plus Tag as NFC Tag |
hf mfp ndefread |
N | Read and print NDEF records from card |
hf mfp ndefwrite |
N | Write NDEF records to card |
hf mfu
{ MIFARE Ultralight RFIDs... }
| command | offline | description |
|---|---|---|
hf mfu help |
Y | This help |
hf mfu list |
Y | List MIFARE Ultralight / NTAG history |
hf mfu keygen |
Y | Generate 3DES MIFARE diversified keys |
hf mfu pwdgen |
Y | Generate pwd from known algos |
hf mfu otptear |
N | Tear-off test on OTP bits |
hf mfu cauth |
N | Authentication - Ultralight-C |
hf mfu dump |
N | Dump MIFARE Ultralight family tag to binary file |
hf mfu info |
N | Tag information |
hf mfu ndefread |
N | Prints NDEF records from card |
hf mfu rdbl |
N | Read block |
hf mfu restore |
N | Restore a dump onto a MFU MAGIC tag |
hf mfu view |
Y | Display content from tag dump file |
hf mfu wrbl |
N | Write block |
hf mfu tamper |
N | Configure the tamper feature on an NTAG 213TT |
hf mfu eload |
N | Load Ultralight dump file into emulator memory |
hf mfu esave |
N | Save Ultralight dump file from emulator memory |
hf mfu eview |
N | View emulator memory |
hf mfu sim |
N | Simulate MIFARE Ultralight from emulator memory |
hf mfu setpwd |
N | Set 3DES key - Ultralight-C |
hf mfu setuid |
N | Set UID - MAGIC tags only |
hf mfu amiibo |
N | Amiibo tag operations |
hf mfdes
{ MIFARE Desfire RFIDs... }
| command | offline | description |
|---|---|---|
hf mfdes help |
Y | This help |
hf mfdes info |
N | Tag information |
hf mfdes getuid |
N | Get uid from card |
hf mfdes default |
N | Set defaults for all the commands |
hf mfdes auth |
N | MIFARE DesFire Authentication |
hf mfdes chk |
N | Check keys |
hf mfdes detect |
N | Detect key type and tries to find one from the list |
hf mfdes freemem |
N | Get free memory size |
hf mfdes setconfig |
N | Set card configuration |
hf mfdes formatpicc |
N | Format PICC |
hf mfdes list |
Y | List DESFire (ISO 14443A) history |
hf mfdes mad |
N | Prints MAD records / files from the card |
hf mfdes lsapp |
N | Show all applications with files list |
hf mfdes getaids |
N | Get Application IDs list |
hf mfdes getappnames |
N | Get Applications list |
hf mfdes bruteaid |
N | Recover AIDs by bruteforce |
hf mfdes createapp |
N | Create Application |
hf mfdes deleteapp |
N | Delete Application |
hf mfdes selectapp |
N | Select Application ID |
hf mfdes changekey |
N | Change Key |
hf mfdes chkeysettings |
N | Change Key Settings |
hf mfdes getkeysettings |
N | Get Key Settings |
hf mfdes getkeyversions |
N | Get Key Versions |
hf mfdes getfileids |
N | Get File IDs list |
hf mfdes getfileisoids |
N | Get File ISO IDs list |
hf mfdes lsfiles |
N | Show all files list |
hf mfdes dump |
N | Dump all files |
hf mfdes createfile |
N | Create Standard/Backup File |
hf mfdes createvaluefile |
N | Create Value File |
hf mfdes createrecordfile |
N | Create Linear/Cyclic Record File |
hf mfdes createmacfile |
N | Create Transaction MAC File |
hf mfdes deletefile |
N | Delete File |
hf mfdes getfilesettings |
N | Get file settings |
hf mfdes chfilesettings |
N | Change file settings |
hf mfdes read |
N | Read data from standard/backup/record/value/mac file |
hf mfdes write |
N | Write data to standard/backup/record/value file |
hf mfdes value |
N | Operations with value file (get/credit/limited credit/debit/clear) |
hf mfdes clearrecfile |
N | Clear record File |
hf mfdes test |
Y | Regression crypto tests |
hf ntag424
{ NXP NTAG 4242 DNA RFIDs... }
| command | offline | description |
|---|---|---|
hf ntag424 help |
Y | This help |
hf ntag424 info |
N | Tag information |
hf ntag424 view |
Y | Display content from tag dump file |
hf ntag424 auth |
N | Test authentication with key |
hf ntag424 read |
N | Read file |
hf ntag424 write |
N | Write file |
hf ntag424 getfs |
N | Get file settings |
hf ntag424 changefs |
N | Change file settings |
hf ntag424 changekey |
N | Change key |
hf seos
{ SEOS RFIDs... }
| command | offline | description |
|---|---|---|
hf seos help |
Y | This help |
hf seos info |
N | Tag information |
hf seos list |
Y | List SEOS history |
hf st25ta
{ ST25TA RFIDs... }
| command | offline | description |
|---|---|---|
hf st25ta help |
Y | This help |
hf st25ta info |
N | Tag information |
hf st25ta list |
Y | List ISO 14443A/7816 history |
hf st25ta ndefread |
Y | read NDEF file on tag |
hf st25ta protect |
N | change protection on tag |
hf st25ta pwd |
N | change password on tag |
hf st25ta sim |
N | Fake ISO 14443A/ST tag |
hf tesla
{ TESLA Cards... }
| command | offline | description |
|---|---|---|
hf tesla help |
Y | This help |
hf tesla info |
N | Tag information |
hf tesla list |
Y | List ISO 14443A/7816 history |
hf texkom
{ Texkom RFIDs... }
| command | offline | description |
|---|---|---|
hf texkom help |
Y | This help |
hf texkom reader |
N | Act like a Texkom reader |
hf texkom sim |
N | Simulate a Texkom tag |
hf thinfilm
{ Thinfilm RFIDs... }
| command | offline | description |
|---|---|---|
hf thinfilm help |
Y | This help |
hf thinfilm info |
N | Tag information |
hf thinfilm list |
Y | List NFC Barcode / Thinfilm history - not correct |
hf thinfilm sim |
N | Fake Thinfilm tag |
hf topaz
{ TOPAZ (NFC Type 1) RFIDs... }
| command | offline | description |
|---|---|---|
hf topaz help |
Y | This help |
hf topaz list |
Y | List Topaz history |
hf topaz dump |
N | Dump TOPAZ family tag to file |
hf topaz info |
N | Tag information |
hf topaz raw |
N | Send raw hex data to tag |
hf topaz rdbl |
N | Read block |
hf topaz reader |
N | Act like a Topaz reader |
hf topaz sim |
N | Simulate Topaz tag |
hf topaz sniff |
N | Sniff Topaz reader-tag communication |
hf topaz view |
Y | Display content from tag dump file |
hf topaz wrbl |
N | Write block |
hf vas
{ Apple Value Added Service }
| command | offline | description |
|---|---|---|
hf vas help |
Y | This help |
hf vas reader |
N | Read and decrypt VAS message |
hf vas decrypt |
Y | Decrypt a previously captured VAS cryptogram |
hf waveshare
{ Waveshare NFC ePaper... }
| command | offline | description |
|---|---|---|
hf waveshare help |
Y | This help |
hf waveshare load |
Y | Load image file to Waveshare NFC ePaper |
hf xerox
{ Fuji/Xerox cartridge RFIDs... }
| command | offline | description |
|---|---|---|
hf xerox help |
Y | This help |
hf xerox list |
Y | List ISO-14443B history |
hf xerox info |
N | Short info on Fuji/Xerox tag |
hf xerox dump |
N | Read all memory pages of an Fuji/Xerox tag, save to file |
hf xerox reader |
N | Act like a Fuji/Xerox reader |
hf xerox view |
Y | Display content from tag dump file |
hw
{ Hardware commands... }
| command | offline | description |
|---|---|---|
hw help |
Y | This help |
hw break |
N | Send break loop usb command |
hw bootloader |
N | Reboot Proxmark3 into bootloader mode |
hw connect |
Y | Connect Proxmark3 to serial port |
hw dbg |
N | Set Proxmark3 debug level |
hw detectreader |
N | Detect external reader field |
hw fpgaoff |
N | Set FPGA off |
hw lcd |
N | Send command/data to LCD |
hw lcdreset |
N | Hardware reset LCD |
hw ping |
N | Test if the Proxmark3 is responsive |
hw readmem |
N | Read from processor flash |
hw reset |
N | Reset the Proxmark3 |
hw setlfdivisor |
N | Drive LF antenna at 12MHz / (divisor + 1) |
hw setmux |
N | Set the ADC mux to a specific value |
hw standalone |
N | Jump to the standalone mode |
hw status |
N | Show runtime status information about the connected Proxmark3 |
hw tearoff |
N | Program a tearoff hook for the next command supporting tearoff |
hw tia |
N | Trigger a Timing Interval Acquisition to re-adjust the RealTimeCounter divider |
hw timeout |
Y | Set the communication timeout on the client side |
hw tune |
N | Measure antenna tuning |
hw version |
Y | Show version information about the client and the connected Proxmark3, if any |
lf
{ Low frequency commands... }
| command | offline | description |
|---|---|---|
lf help |
Y | This help |
lf config |
N | Get/Set config for LF sampling, bit/sample, decimation, frequency |
lf cmdread |
N | Modulate LF reader field to send command before read |
lf read |
N | Read LF tag |
lf search |
Y | Read and Search for valid known tag |
lf sim |
N | Simulate LF tag from buffer |
lf simask |
N | Simulate ASK tag |
lf simfsk |
N | Simulate FSK tag |
lf simpsk |
N | Simulate PSK tag |
lf simbidir |
N | Simulate LF tag (with bidirectional data transmission between reader and tag) |
lf sniff |
N | Sniff LF traffic between reader and tag |
lf tune |
N | Continuously measure LF antenna tuning |
lf awid
{ AWID RFIDs... }
| command | offline | description |
|---|---|---|
lf awid help |
Y | this help |
lf awid demod |
Y | demodulate an AWID FSK tag from the GraphBuffer |
lf awid reader |
N | attempt to read and extract tag data |
lf awid clone |
N | clone AWID tag to T55x7 or Q5/T5555 |
lf awid sim |
N | simulate AWID tag |
lf awid brute |
N | bruteforce card number against reader |
lf awid watch |
N | continuously watch for cards. Reader mode |
lf cotag
{ COTAG CHIPs... }
| command | offline | description |
|---|---|---|
lf cotag help |
Y | This help |
lf cotag demod |
Y | demodulate an COTAG tag |
lf cotag reader |
N | attempt to read and extract tag data |
lf destron
{ FDX-A Destron RFIDs... }
| command | offline | description |
|---|---|---|
lf destron help |
Y | This help |
lf destron demod |
Y | demodulate an Destron tag from the GraphBuffer |
lf destron reader |
N | attempt to read and extract tag data |
lf destron clone |
N | clone Destron tag to T55x7 |
lf destron sim |
N | simulate Destron tag |
lf em
{ EM CHIPs & RFIDs... }
| command | offline | description |
|---|---|---|
lf em help |
Y | This help |
lf em 410x
{ EM 4102 commands... }
| command | offline | description |
|---|---|---|
lf em 410x help |
Y | This help |
lf em 410x demod |
Y | demodulate a EM410x tag from the GraphBuffer |
lf em 410x reader |
N | attempt to read and extract tag data |
lf em 410x sim |
N | simulate EM410x tag |
lf em 410x brute |
N | reader bruteforce attack by simulating EM410x tags |
lf em 410x watch |
N | watches for EM410x 125/134 kHz tags |
lf em 410x spoof |
N | watches for EM410x 125/134 kHz tags, and replays them |
lf em 410x clone |
N | write EM410x Tag ID to T55x7 or Q5/T5555 tag |
lf em 4x05
{ EM 4205 / 4305 / 4369 / 4469 commands... }
| command | offline | description |
|---|---|---|
lf em 4x05 help |
Y | This help |
lf em 4x05 brute |
N | Bruteforce password |
lf em 4x05 chk |
N | Check passwords from dictionary |
lf em 4x05 config |
Y | Create common configuration words |
lf em 4x05 demod |
Y | Demodulate a EM4x05/EM4x69 tag from the GraphBuffer |
lf em 4x05 dump |
N | Dump EM4x05/EM4x69 tag |
lf em 4x05 info |
N | Tag information |
lf em 4x05 read |
N | Read word data from EM4x05/EM4x69 |
lf em 4x05 sniff |
Y | Attempt to recover em4x05 commands from sample buffer |
lf em 4x05 unlock |
N | Execute tear off against EM4x05/EM4x69 |
lf em 4x05 view |
Y | Display content from tag dump file |
lf em 4x05 wipe |
N | Wipe EM4x05/EM4x69 tag |
lf em 4x05 write |
N | Write word data to EM4x05/EM4x69 |
lf em 4x50
{ EM 4350 / 4450 commands... }
| command | offline | description |
|---|---|---|
lf em 4x50 help |
Y | This help |
lf em 4x50 brute |
N | Bruteforce attack to find password |
lf em 4x50 chk |
N | Check passwords from dictionary |
lf em 4x50 dump |
N | Dump EM4x50 tag |
lf em 4x50 info |
N | Tag information |
lf em 4x50 login |
N | Login into EM4x50 tag |
lf em 4x50 rdbl |
N | Read EM4x50 word data |
lf em 4x50 reader |
N | Show standard read mode data |
lf em 4x50 restore |
N | Restore EM4x50 dump to tag |
lf em 4x50 wrbl |
N | Write EM4x50 word data |
lf em 4x50 wrpwd |
N | Change EM4x50 password |
lf em 4x50 wipe |
N | Wipe EM4x50 tag |
lf em 4x50 eload |
N | Upload EM4x50 dump to emulator memory |
lf em 4x50 esave |
N | Save emulator memory to file |
lf em 4x50 eview |
N | View EM4x50 content in emulator memory |
lf em 4x50 sim |
N | Simulate EM4x50 tag |
lf em 4x70
{ EM 4070 / 4170 commands... }
| command | offline | description |
|---|---|---|
lf em 4x70 help |
Y | This help |
lf em 4x70 brute |
N | Bruteforce EM4X70 to find partial Crypt Key |
lf em 4x70 info |
N | Tag information EM4x70 |
lf em 4x70 write |
N | Write EM4x70 |
lf em 4x70 unlock |
N | Unlock EM4x70 for writing |
lf em 4x70 auth |
N | Authenticate EM4x70 |
lf em 4x70 writepin |
N | Write PIN |
lf em 4x70 writekey |
N | Write Crypt Key |
lf fdxb
{ FDX-B RFIDs... }
| command | offline | description |
|---|---|---|
lf fdxb help |
Y | this help |
lf fdxb demod |
Y | demodulate a FDX-B ISO11784/85 tag from the GraphBuffer |
lf fdxb reader |
N | attempt to read at 134kHz and extract tag data |
lf fdxb clone |
N | clone animal ID tag to T55x7 or Q5/T5555 |
lf fdxb sim |
N | simulate Animal ID tag |
lf gallagher
{ GALLAGHER RFIDs... }
| command | offline | description |
|---|---|---|
lf gallagher help |
Y | This help |
lf gallagher demod |
Y | demodulate an GALLAGHER tag from the GraphBuffer |
lf gallagher reader |
N | attempt to read and extract tag data |
lf gallagher clone |
N | clone GALLAGHER tag to T55x7 |
lf gallagher sim |
N | simulate GALLAGHER tag |
lf gproxii
{ Guardall Prox II RFIDs... }
| command | offline | description |
|---|---|---|
lf gproxii help |
Y | this help |
lf gproxii demod |
Y | demodulate a G Prox II tag from the GraphBuffer |
lf gproxii reader |
N | attempt to read and extract tag data |
lf gproxii clone |
N | clone Guardall tag to T55x7 or Q5/T5555 |
lf gproxii sim |
N | simulate Guardall tag |
lf hid
{ HID Prox RFIDs... }
| command | offline | description |
|---|---|---|
lf hid help |
Y | this help |
lf hid demod |
Y | demodulate HID Prox tag from the GraphBuffer |
lf hid reader |
N | attempt to read and extract tag data |
lf hid clone |
N | clone HID tag to T55x7 |
lf hid sim |
N | simulate HID tag |
lf hid brute |
N | bruteforce facility code or card number against reader |
lf hid watch |
N | continuously watch for cards. Reader mode |
lf hitag
{ Hitag CHIPs... }
| command | offline | description |
|---|---|---|
lf hitag help |
Y | This help |
lf hitag list |
Y | List Hitag trace history |
lf hitag info |
N | Hitag 2 tag information |
lf hitag dump |
N | Dump Hitag 2 tag |
lf hitag read |
N | Read Hitag memory |
lf hitag wrbl |
N | Write a block (page) in Hitag memory |
lf hitag sniff |
N | Eavesdrop Hitag communication |
lf hitag cc |
N | Hitag S: test all provided challenges |
lf hitag ta |
N | Hitag 2: test all recorded authentications |
lf hitag eload |
N | Load Hitag dump file into emulator memory |
lf hitag sim |
N | Simulate Hitag transponder |
lf idteck
{ Idteck RFIDs... }
| command | offline | description |
|---|---|---|
lf idteck help |
Y | This help |
lf idteck demod |
Y | demodulate an Idteck tag from the GraphBuffer |
lf idteck reader |
N | attempt to read and extract tag data |
lf idteck clone |
N | clone Idteck tag to T55x7 or Q5/T5555 |
lf idteck sim |
N | simulate Idteck tag |
lf indala
{ Indala RFIDs... }
| command | offline | description |
|---|---|---|
lf indala help |
Y | This help |
lf indala brute |
N | Demodulate an Indala tag (PSK1) from the GraphBuffer |
lf indala demod |
Y | Demodulate an Indala tag (PSK1) from the GraphBuffer |
lf indala altdemod |
Y | Alternative method to demodulate samples for Indala 64 bit UID (option '224' for 224 bit) |
lf indala reader |
N | Read an Indala tag from the antenna |
lf indala clone |
N | Clone Indala tag to T55x7 or Q5/T5555 |
lf indala sim |
N | Simulate Indala tag |
lf io
{ ioProx RFIDs... }
| command | offline | description |
|---|---|---|
lf io help |
Y | this help |
lf io demod |
Y | demodulate an ioProx tag from the GraphBuffer |
lf io reader |
N | attempt to read and extract tag data |
lf io clone |
N | clone ioProx tag to T55x7 or Q5/T5555 |
lf io sim |
N | simulate ioProx tag |
lf io watch |
N | continuously watch for cards. Reader mode |
lf jablotron
{ Jablotron RFIDs... }
| command | offline | description |
|---|---|---|
lf jablotron help |
Y | This help |
lf jablotron demod |
Y | demodulate an Jablotron tag from the GraphBuffer |
lf jablotron reader |
N | attempt to read and extract tag data |
lf jablotron clone |
N | clone jablotron tag to T55x7 or Q5/T5555 |
lf jablotron sim |
N | simulate jablotron tag |
lf keri
{ KERI RFIDs... }
| command | offline | description |
|---|---|---|
lf keri help |
Y | This help |
lf keri demod |
Y | demodulate an KERI tag from the GraphBuffer |
lf keri reader |
N | attempt to read and extract tag data |
lf keri clone |
N | clone KERI tag to T55x7 or Q5/T5555 |
lf keri sim |
N | simulate KERI tag |
lf motorola
{ Motorola Flexpass RFIDs... }
| command | offline | description |
|---|---|---|
lf motorola help |
Y | This help |
lf motorola demod |
Y | demodulate an MOTOROLA tag from the GraphBuffer |
lf motorola reader |
N | attempt to read and extract tag data |
lf motorola clone |
N | clone MOTOROLA tag to T55x7 |
lf motorola sim |
N | simulate MOTOROLA tag |
lf nedap
{ Nedap RFIDs... }
| command | offline | description |
|---|---|---|
lf nedap help |
Y | This help |
lf nedap demod |
Y | demodulate Nedap tag from the GraphBuffer |
lf nedap reader |
N | attempt to read and extract tag data |
lf nedap clone |
N | clone Nedap tag to T55x7 or Q5/T5555 |
lf nedap sim |
N | simulate Nedap tag |
lf nexwatch
{ NexWatch RFIDs... }
| command | offline | description |
|---|---|---|
lf nexwatch help |
Y | This help |
lf nexwatch demod |
Y | demodulate a NexWatch tag (nexkey, quadrakey) from the GraphBuffer |
lf nexwatch reader |
N | attempt to read and extract tag data |
lf nexwatch clone |
N | clone NexWatch tag to T55x7 |
lf nexwatch sim |
N | simulate NexWatch tag |
lf noralsy
{ Noralsy RFIDs... }
| command | offline | description |
|---|---|---|
lf noralsy help |
Y | This help |
lf noralsy demod |
Y | demodulate an Noralsy tag from the GraphBuffer |
lf noralsy reader |
N | attempt to read and extract tag data |
lf noralsy clone |
N | clone Noralsy tag to T55x7 or Q5/T5555 |
lf noralsy sim |
N | simulate Noralsy tag |
lf pac
{ PAC/Stanley RFIDs... }
| command | offline | description |
|---|---|---|
lf pac help |
Y | This help |
lf pac demod |
Y | demodulate a PAC tag from the GraphBuffer |
lf pac reader |
N | attempt to read and extract tag data |
lf pac clone |
N | clone PAC tag to T55x7 |
lf pac sim |
N | simulate PAC tag |
lf paradox
{ Paradox RFIDs... }
| command | offline | description |
|---|---|---|
lf paradox help |
Y | This help |
lf paradox demod |
Y | demodulate a Paradox FSK tag from the GraphBuffer |
lf paradox reader |
N | attempt to read and extract tag data |
lf paradox clone |
N | clone paradox tag |
lf paradox sim |
N | simulate paradox tag |
lf pcf7931
{ PCF7931 CHIPs... }
| command | offline | description |
|---|---|---|
lf pcf7931 help |
Y | This help |
lf pcf7931 reader |
N | Read content of a PCF7931 transponder |
lf pcf7931 write |
N | Write data on a PCF7931 transponder. |
lf pcf7931 config |
Y | Configure the password, the tags initialization delay and time offsets (optional) |
lf presco
{ Presco RFIDs... }
| command | offline | description |
|---|---|---|
lf presco help |
Y | This help |
lf presco demod |
Y | demodulate Presco tag from the GraphBuffer |
lf presco reader |
N | attempt to read and extract tag data |
lf presco clone |
N | clone presco tag to T55x7 or Q5/T5555 |
lf presco sim |
N | simulate presco tag |
lf pyramid
{ Farpointe/Pyramid RFIDs... }
| command | offline | description |
|---|---|---|
lf pyramid help |
Y | this help |
lf pyramid demod |
Y | demodulate a Pyramid FSK tag from the GraphBuffer |
lf pyramid reader |
N | attempt to read and extract tag data |
lf pyramid clone |
N | clone pyramid tag to T55x7 or Q5/T5555 |
lf pyramid sim |
N | simulate pyramid tag |
lf securakey
{ Securakey RFIDs... }
| command | offline | description |
|---|---|---|
lf securakey help |
Y | This help |
lf securakey demod |
Y | demodulate an Securakey tag from the GraphBuffer |
lf securakey reader |
N | attempt to read and extract tag data |
lf securakey clone |
N | clone Securakey tag to T55x7 |
lf securakey sim |
N | simulate Securakey tag |
lf ti
{ TI CHIPs... }
| command | offline | description |
|---|---|---|
lf ti help |
Y | This help |
lf ti demod |
Y | Demodulate raw bits for TI LF tag from the GraphBuffer |
lf ti reader |
N | Read and decode a TI 134 kHz tag |
lf ti write |
N | Write new data to a r/w TI 134 kHz tag |
lf t55xx
{ T55xx CHIPs... }
| command | offline | description |
|---|---|---|
lf t55xx help |
Y | This help |
lf t55xx clonehelp |
N | Shows the available clone commands |
lf t55xx config |
Y | Set/Get T55XX configuration (modulation, inverted, offset, rate) |
lf t55xx dangerraw |
N | Sends raw bitstream. Dangerous, do not use!! |
lf t55xx detect |
Y | Try detecting the tag modulation from reading the configuration block |
lf t55xx deviceconfig |
N | Set/Get T55XX device configuration |
lf t55xx dump |
N | Dump T55xx card Page 0 block 0-7 |
lf t55xx info |
Y | Show T55x7 configuration data (page 0/ blk 0) |
lf t55xx p1detect |
N | Try detecting if this is a t55xx tag by reading page 1 |
lf t55xx read |
N | Read T55xx block data |
lf t55xx resetread |
N | Send Reset Cmd then lf read the stream to attempt to identify the start of it |
lf t55xx restore |
N | Restore T55xx card Page 0 / Page 1 blocks |
lf t55xx trace |
Y | Show T55x7 traceability data (page 1/ blk 0-1) |
lf t55xx wakeup |
N | Send AOR wakeup command |
lf t55xx write |
N | Write T55xx block data |
lf t55xx bruteforce |
N | Simple bruteforce attack to find password |
lf t55xx chk |
N | Check passwords from dictionary/flash |
lf t55xx protect |
N | Password protect tag |
lf t55xx recoverpw |
N | Try to recover from bad password write from a cloner |
lf t55xx sniff |
Y | Attempt to recover T55xx commands from sample buffer |
lf t55xx special |
N | Show block changes with 64 different offsets |
lf t55xx wipe |
N | Wipe a T55xx tag and set defaults (will destroy any data on tag) |
lf viking
{ Viking RFIDs... }
| command | offline | description |
|---|---|---|
lf viking help |
Y | This help |
lf viking demod |
Y | demodulate a Viking tag from the GraphBuffer |
lf viking reader |
N | attempt to read and extract tag data |
lf viking clone |
N | clone Viking tag to T55x7 or Q5/T5555 |
lf viking sim |
N | simulate Viking tag |
lf visa2000
{ Visa2000 RFIDs... }
| command | offline | description |
|---|---|---|
lf visa2000 help |
Y | This help |
lf visa2000 demod |
Y | demodulate an VISA2000 tag from the GraphBuffer |
lf visa2000 reader |
N | attempt to read and extract tag data |
lf visa2000 clone |
N | clone Visa2000 tag to T55x7 or Q5/T5555 |
lf visa2000 sim |
N | simulate Visa2000 tag |
mem
{ Flash memory manipulation... }
| command | offline | description |
|---|---|---|
mem help |
Y | This help |
mem baudrate |
N | Set Flash memory Spi baudrate |
mem dump |
N | Dump data from flash memory |
mem info |
N | Flash memory information |
mem load |
N | Load data to flash memory |
mem wipe |
N | Wipe data from flash memory |
mem spiffs
{ SPI File system }
| command | offline | description |
|---|---|---|
mem spiffs help |
Y | This help |
mem spiffs copy |
N | Copy a file to another (destructively) in SPIFFS file system |
mem spiffs check |
N | Check/try to defrag faulty/fragmented file system |
mem spiffs dump |
N | Dump a file from SPIFFS file system |
mem spiffs info |
N | Print file system info and usage statistics |
mem spiffs mount |
N | Mount the SPIFFS file system if not already mounted |
mem spiffs remove |
N | Remove a file from SPIFFS file system |
mem spiffs rename |
N | Rename/move a file in SPIFFS file system |
mem spiffs test |
N | Test SPIFFS Operations |
mem spiffs tree |
N | Print the Flash memory file system tree |
mem spiffs unmount |
N | Un-mount the SPIFFS file system |
mem spiffs upload |
N | Upload file into SPIFFS file system |
mem spiffs view |
N | View file on SPIFFS file system |
mem spiffs wipe |
N | Wipe all files from SPIFFS file system * dangerous * |
nfc
{ NFC commands... }
| command | offline | description |
|---|---|---|
nfc help |
Y | This help |
nfc decode |
Y | Decode NDEF records |
nfc type1
{ NFC Forum Tag Type 1... }
| command | offline | description |
|---|---|---|
nfc type1 read |
N | read NFC Forum Tag Type 1 |
nfc type1 help |
Y | This help |
nfc type2
{ NFC Forum Tag Type 2... }
| command | offline | description |
|---|---|---|
nfc type2 read |
N | read NFC Forum Tag Type 2 |
nfc type2 help |
Y | This help |
nfc type4a
{ NFC Forum Tag Type 4 ISO14443A... }
| command | offline | description |
|---|---|---|
nfc type4a format |
N | format ISO-14443-a tag as NFC Tag |
nfc type4a read |
N | read NFC Forum Tag Type 4 A |
nfc type4a write |
N | write NFC Forum Tag Type 4 A |
nfc type4a st25taread |
N | read ST25TA as NFC Forum Tag Type 4 |
nfc type4a help |
Y | This help |
nfc type4b
{ NFC Forum Tag Type 4 ISO14443B... }
| command | offline | description |
|---|---|---|
nfc type4b read |
N | read NFC Forum Tag Type 4 B |
nfc type4b help |
Y | This help |
nfc mf
{ NFC Type MIFARE Classic/Plus Tag... }
| command | offline | description |
|---|---|---|
nfc mf cformat |
N | format MIFARE Classic Tag as NFC Tag |
nfc mf cread |
N | read NFC Type MIFARE Classic Tag |
nfc mf cwrite |
N | write NFC Type MIFARE Classic Tag |
nfc mf pread |
N | read NFC Type MIFARE Plus Tag |
nfc mf help |
Y | This help |
nfc barcode
{ NFC Barcode Tag... }
| command | offline | description |
|---|---|---|
nfc barcode read |
N | read NFC Barcode |
nfc barcode sim |
N | simulate NFC Barcode |
nfc barcode help |
Y | This help |
piv
{ PIV commands... }
| command | offline | description |
|---|---|---|
piv help |
Y | This help |
piv select |
N | Select the PIV applet |
piv getdata |
N | Gets a container on a PIV card |
piv authsign |
N | Authenticate with the card |
piv scan |
N | Scan PIV card for known containers |
piv list |
Y | List ISO7816 history |
reveng
{ CRC calculations from RevEng software... }
[=] reveng: no mode switch specified. Use reveng -h for help.
smart
{ Smart card ISO-7816 commands... }
| command | offline | description |
|---|---|---|
smart help |
Y | This help |
smart list |
Y | List ISO 7816 history |
smart info |
N | Tag information |
smart relay |
N | Turn pm3 into pcsc reader and relay to host OS via vpcd |
smart reader |
N | Act like an IS07816 reader |
smart raw |
N | Send raw hex data to tag |
smart upgrade |
Y | Upgrade sim module firmware |
smart setclock |
N | Set clock speed |
smart brute |
N | Bruteforce SFI |
script
{ Scripting commands... }
| command | offline | description |
|---|---|---|
script help |
Y | This help |
script list |
Y | List available scripts |
script run |
Y | <name> - execute a script |
trace
{ Trace manipulation... }
| command | offline | description |
|---|---|---|
trace help |
Y | This help |
trace extract |
Y | Extract authentication challenges found in trace |
trace list |
Y | List protocol data in trace buffer |
trace load |
Y | Load trace from file |
trace save |
Y | Save trace buffer to file |
usart
{ USART commands... }
| command | offline | description |
|---|---|---|
usart help |
Y | This help |
usart btpin |
N | Change BT add-on PIN |
usart btfactory |
N | Reset BT add-on to factory settings |
usart tx |
N | Send string over USART |
usart rx |
N | Receive string over USART |
usart txrx |
N | Send string over USART and wait for response |
usart txhex |
N | Send bytes over USART |
usart rxhex |
N | Receive bytes over USART |
usart config |
N | Configure USART |
wiegand
{ Wiegand format manipulation... }
| command | offline | description |
|---|---|---|
wiegand help |
Y | This help |
wiegand list |
Y | List available wiegand formats |
wiegand encode |
Y | Encode to wiegand raw hex (currently for HID Prox) |
wiegand decode |
Y | Convert raw hex to decoded wiegand format (currently for HID Prox) |
Full help dump done.