mirror of
https://github.com/RfidResearchGroup/proxmark3.git
synced 2026-11-15 02:58:53 +00:00
Christian HerrmannandClaude Opus 5.5
4004a454de
New `hf gp` command family. Every subcommand works without keys and
never sends INITIALIZE UPDATE / EXTERNAL AUTHENTICATE, so no card
retry counter is used. All take -w for the contact interface, -a to
log APDUs and -v for verbose output.
hf gp info
Selects the ISD, or the default applet when A000000151000000 is
absent, and reads:
- Card Recognition Data, decoding the GP version, SCP and Java Card
version from their OIDs
- CPLC, with the fabricator name and BCD dates decoded
- the Key Information Template (KVN, key id, type, length, with
SCP02 / SCP03 key sets marked)
- IIN, CIN and the SCP sequence counter
GET DATA retries with CLA 00 on cards that reject CLA 80.
hf gp crs
GET STATUS on the Contactless Registry Service (GPC_SPE_025 3.11),
following 6310 to fetch more data. Lists each applet's AID,
lifecycle, contactless activation state, display data, URL, group
and CREL members. --aid filters on a full or partial AID.
hf gp aids
Finds applet AIDs by partial SELECT (P2=00, first occurrence):
- finds the shortest prefix the card accepts
- tries aidlist.json prefixes and every registered RID A0 00 00 0x xx
(--quick skips the RID sweep)
- extends each hit one byte at a time to the full AID
- --prefix limits the search to one subtree
Cards whose default applet accepts any SELECT are detected and
refused. The walk is capped at 200000 APDUs and can be stopped with
<Enter>. Without partial selection it falls back to the full
aidlist.json AIDs.
aidlist.json gains the GP ISD, CRS and ARA-M AIDs, plus USIM, ISIM,
CSIM, UnionPay, and ICCOA so found AIDs get named. The CCC digital key entry gets a description.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>