commands

marshmellow42 edited this page Jul 27, 2016 · 17 revisions

Proxmark3 command dump

Some commands are available only if a Proxmark is actually connected. Check column "offline" for their availability.

command offline description
help Y This help. Use ' help' for details of a particular command.
quit Y Exit program
exit Y Exit program

data

{ Plot window / data buffer manipulation... }

command offline description
data help Y This help
data askedgedetect Y [threshold] Adjust Graph for manual ask demod using the length of sample differences to detect the edge of a wave (use 20-45, def:25)
data askem410xdemod Y [clock] [invert<0 or 1>] [maxErr] -- Demodulate an EM410x tag from GraphBuffer (args optional)
data askgproxiidemod Y Demodulate a G Prox II tag from GraphBuffer
data autocorr Y [window length] [g] -- Autocorrelation over window - g to save back to GraphBuffer (overwrite)
data biphaserawdecode Y [offset] [invert<0 or 1>] [maxErr] -- Biphase decode bin stream in DemodBuffer (offset = 0 or 1 bits to shift the decode start) (when inverted it is Diphase decode)
data bitsamples N Get raw samples as bitstring
data buffclear Y Clear sample buffer and graph window
data dec Y Decimate samples
data detectclock Y [modulation] Detect clock rate of wave in GraphBuffer (options: 'a','f','n','p' for ask, fsk, nrz, psk respectively)
data fdxbdemod Y Demodulate a FDX-B ISO11784/85 Diphase tag from GraphBuffer
data fskawiddemod Y Demodulate an AWID FSK tag from GraphBuffer
data fskhiddemod Y Demodulate a HID FSK tag from GraphBuffer
data fskiodemod Y Demodulate an IO Prox FSK tag from GraphBuffer
data fskpyramiddemod Y Demodulate a Pyramid FSK tag from GraphBuffer
data fskparadoxdemod Y Demodulate a Paradox FSK tag from GraphBuffer
data getbitstream Y Convert GraphBuffer's >=1 values to 1 and <1 to 0
data grid Y -- overlay grid on graph window, use zero value to turn off either
data hexsamples N [] -- Dump big buffer as hex bytes
data hide Y Hide graph window
data hpf Y Remove DC offset from trace
data load Y -- Load trace (to graph window
data ltrim Y -- Trim samples from left of trace
data rtrim Y -- Trim samples from right of trace
data manrawdecode Y [invert] [maxErr] -- Manchester decode binary stream in DemodBuffer
data norm Y Normalize max/min to +/-128
data plot Y Show graph window (hit 'h' in window for keystroke help)
data printdemodbuffer Y [x] [o ] -- print the data in the DemodBuffer - 'x' for hex output 'o' to shift binary by offset amount
data pskindalademod Y [clock] [invert<0 or 1>] -- Demodulate an indala tag (PSK1) from GraphBuffer (args optional)
data psknexwatchdemod Y Demodulate a NexWatch tag (nexkey, quadrakey) (PSK1) from GraphBuffer
data rawdemod Y [modulation] ... -see help (h option) -- Demodulate the data in the GraphBuffer and output binary
data samples N [512 - 40000] -- Get raw samples for graph window (GraphBuffer)
data save Y -- Save trace (from graph window)
data scale Y -- Set cursor display scale
data setdebugmode Y <0 or 1> -- Turn on or off Debugging Mode for demods
data shiftgraphzero Y -- Shift 0 for Graphed wave + or - shift value
data dirthreshold Y -- Max rising higher up-thres/ Min falling lower down-thres, keep rest as prev.
data tune N Get hw tune samples for graph window
data undec Y Un-decimate samples by 2
data zerocrossings Y Count time between zero-crossings

hf

{ HF commands... }

command offline description
hf help Y This help
hf tune N Continuously measure HF antenna tuning
hf list Y List protocol data in trace buffer
hf search Y Search for known HF tags (identifies 14443a, 14443b, 15693, iClass)

hf 14a

{ ISO14443A RFIDs... }

command offline description
hf 14a help Y This help
hf 14a list N [Deprecated] List ISO 14443a history
hf 14a reader N Act like an ISO14443 Type A reader
hf 14a cuids N Collect n>0 ISO14443 Type A UIDs in one go
hf 14a sim N -- Fake ISO 14443a tag
hf 14a snoop N Eavesdrop ISO 14443 Type A
hf 14a raw N Send raw hex data to tag

hf 14b

{ ISO14443B RFIDs... }

command offline description
hf 14b help Y This help
hf 14b list N depreciated - use hf list 14b
hf 14b info N Identify HF tag (ISO 14443B)
hf 14b reader N Read HF tag (ISO 14443B)
hf 14b sim N Fake ISO 14443B tag
hf 14b snoop N Eavesdrop ISO 14443B
hf 14b sri512read N Read contents of a SRI512 tag
hf 14b srix4kread N Read contents of a SRIX4K tag
hf 14b raw N Send raw hex data to tag
hf 14b sriwrite N Write data to a SRI512 or SRIX4K tag

hf 15

{ ISO15693 RFIDs... }

command offline description
hf 15 help Y This help
hf 15 demod Y Demodulate ISO15693 from tag
hf 15 read N Read HF tag (ISO 15693)
hf 15 record N Record Samples (ISO 15693)
hf 15 reader N Act like an ISO15693 reader
hf 15 sim N Fake an ISO15693 tag
hf 15 cmd N Send direct commands to ISO15693 tag
hf 15 findafi N Brute force AFI of an ISO15693 tag
hf 15 dumpmemory N Read all memory pages of an ISO15693 tag

hf epa

{ German Identification Card... }

command offline description
hf epa help Y This help
hf epa cnonces N Acquire n>0 encrypted PACE nonces of size m>0 with d sec pauses

hf legic

{ LEGIC RFIDs... }

command offline description
hf legic help Y This help
hf legic decode N Display deobfuscated and decoded LEGIC RF tag data (use after hf legic reader)
hf legic reader N [offset [length]] -- read bytes from a LEGIC card
hf legic save N [] -- Store samples
hf legic load N -- Restore samples
hf legic sim N [phase drift [frame drift [req/resp drift]]] Start tag simulator (use after load or read)
hf legic write N -- Write sample buffer (user after load or read)
hf legic fill N -- Fill/Write tag with constant value

hf iclass

{ ICLASS RFIDs... }

command offline description
hf iclass help Y This help
hf iclass calcnewkey Y Calc Diversified keys (blocks 3 & 4) to write new keys
hf iclass clone N Authenticate and Clone from iClass bin file
hf iclass decrypt Y Decrypt tagdump
hf iclass dump N Authenticate and Dump iClass tag
hf iclass eload N Load data into iclass emulator memory
hf iclass encryptblk Y Encrypt given block data
hf iclass list N [Deprecated] List iClass history
hf iclass loclass Y Use loclass to perform bruteforce of reader attack dump
hf iclass managekeys Y Manage the keys to use with iClass
hf iclass readblk N Authenticate and Read iClass block
hf iclass reader N Read an iClass tag
hf iclass readtagfile Y Display Content from tagfile
hf iclass replay N Read an iClass tag via Reply Attack
hf iclass sim N Simulate iClass tag
hf iclass snoop N Eavesdrop iClass communication
hf iclass writeblk N Authenticate and Write iClass block

hf mf

{ MIFARE RFIDs... }

command offline description
hf mf dbg N Set default debug mode
hf mf rdbl N Read MIFARE classic block
hf mf rdsc N Read MIFARE classic sector
hf mf dump N Dump MIFARE classic tag to binary file
hf mf restore N Restore MIFARE classic binary file to BLANK tag
hf mf wrbl N Write MIFARE classic block
hf mf chk N Test block keys
hf mf mifare N Read parity error messages.
hf mf nested N Test nested authentication
hf mf sniff N Sniff card-reader communication
hf mf sim N Simulate MIFARE card
hf mf eclr N Clear simulator memory block
hf mf eget N Get simulator memory block
hf mf eset N Set simulator memory block
hf mf eload N Load from file emul dump
hf mf esave N Save to file emul dump
hf mf ecfill N Fill simulator memory with help of keys from simulator
hf mf ekeyprn N Print keys from simulator memory
hf mf csetuid N Set UID for magic Chinese card
hf mf csetblk N Write block - Magic Chinese card
hf mf cgetblk N Read block - Magic Chinese card
hf mf cgetsc N Read sector - Magic Chinese card
hf mf cload N Load dump into magic Chinese card
hf mf csave N Save dump from magic Chinese card into file or emulator

hf mfu

{ MIFARE Ultralight/NTAG + More RFIDs... }

command offline description
hf mfu help Y This help
hf mfu dbg N Set default debug mode
hf mfu info N Tag information
hf mfu dump N Dump Ultralight / Ultralight-C / NTAG tag to binary file
hf mfu rdbl N Read block
hf mfu wrbl N Write block
hf mfu cauth N Authentication - Ultralight C
hf mfu setpwd Y Set 3des password - Ultralight-C
hf mfu setuid Y Set UID - MAGIC tags only
hf mfu gen Y Generate 3des mifare diversified keys

hw

{ Hardware commands... }

command offline description
hw help Y This help
hw detectreader N ['l' or 'h'] -- Detect external reader field (option 'l' or 'h' to limit to LF or HF)
hw fpgaoff N Set FPGA off
hw lcd N -- Send command/data to LCD
hw lcdreset N Hardware reset LCD
hw readmem N [address] -- Read memory at decimal address from flash
hw reset N Reset the Proxmark3
hw setlfdivisor N <19 - 255> -- Drive LF antenna at 12Mhz/(divisor+1)
hw setmux N -- Set the ADC mux to a specific value
hw tune N Measure antenna tuning
hw version N Show version information about the connected Proxmark

lf

{ LF commands... }

command offline description
lf help Y This help
lf cmdread N <'0' period> <'1' period> ['h'] -- Modulate LF reader field to send command before read (all periods in microseconds) (option 'h' for 134)
lf config N Set config for LF sampling, bit/sample, decimation, frequency
lf flexdemod Y Demodulate samples for FlexPass
lf indalademod Y ['224'] -- Demodulate samples for Indala 64 bit UID (option '224' for 224 bit)
lf indalaclone N ['l']-- Clone Indala to T55x7 (tag must be in antenna)(UID in HEX)(option 'l' for 224 UID
lf read N ['s' silent] Read 125/134 kHz LF ID-only tag. Do 'lf read h' for help
lf search Y [offline 1 or 0] ['u'] Read and Search for valid known tag (in offline mode it you can load first then search) - 'u' to search for unknown tags
lf sim N [GAP] -- Simulate LF tag from buffer with optional GAP (in microseconds)
lf simask N [clock] [invert <1 or 0>] [manchester/raw <'m' or 'r'>] [msg separator 's'] [d ] -- Simulate LF ASK tag from demodbuffer or input
lf simfsk N [c ] [i] [H ] [L ] [d ] -- Simulate LF FSK tag from demodbuffer or input
lf simpsk N [1 or 2 or 3] [c ] [i] [r ] [d ] -- Simulate LF PSK tag from demodbuffer or input
lf simbidir N Simulate LF tag (with bidirectional data transmission between reader and tag)
lf snoop N Snoop LF (use lf config to set parameters) (needs a demod and/or plot after)
lf vchdemod Y ['clone'] -- Demodulate samples for VeriChip (decimate first)

lf em4x

{ EM4X RFIDs... }

command offline description
lf em4x help Y This help
lf em4x em410xdemod N [findone] -- Extract ID from EM410x tag (option 0 for continuous loop, 1 for only 1 tag)
lf em4x em410xread Y [clock rate] -- Extract ID from EM410x tag in GraphBuffer
lf em4x em410xsim N -- Simulate EM410x tag
lf em4x em410xwatch N ['h'] -- Watches for EM410x 125/134 kHz tags (option 'h' for 134)
lf em4x em410xspoof N ['h'] --- Watches for EM410x 125/134 kHz tags, and replays them. (option 'h' for 134)
lf em4x em410xwrite N <'0' T5555> <'1' T55x7> [clock rate] -- Write EM410x UID to T5555(Q5) or T55x7 tag, optionally setting clock rate
lf em4x em4x50read Y Extract data from EM4x50 tag
lf em4x readword Y -- Read EM4xxx word data
lf em4x readwordPWD Y -- Read EM4xxx word data in password mode
lf em4x writeword Y -- Write EM4xxx word data
lf em4x writewordPWD Y -- Write EM4xxx word data in password mode

lf hid

{ HID RFIDs... }

command offline description
lf hid help Y This help
lf hid fskdemod N ['1'] Realtime HID FSK demodulator (option '1' for one tag only)
lf hid sim N -- HID tag simulator
lf hid clone N ['l'] -- Clone HID to T55x7 (tag must be in antenna)(option 'l' for 84bit ID)

lf io

{ ioProx tags... }

command offline description
lf io help Y This help
lf io fskdemod N ['1'] Realtime IO FSK demodulator (option '1' for one tag only)
lf io clone N Clone ioProx Tag

lf ti

{ TI RFIDs... }

command offline description
lf ti help Y This help
lf ti demod Y Demodulate raw bits for TI-type LF tag
lf ti read N Read and decode a TI 134 kHz tag
lf ti write N Write new data to a r/w TI 134 kHz tag

lf hitag

{ Hitag tags and transponders... }

command offline description
lf hitag help Y This help
lf hitag list Y List Hitag trace history
lf hitag reader Y Act like a Hitag Reader
lf hitag sim Y Simulate Hitag transponder
lf hitag snoop Y Eavesdrop Hitag communication

lf t55xx

{ T55xx RFIDs... }

command offline description
lf t55xx help Y This help
lf t55xx config Y Set/Get T55XX configuration (modulation, inverted, offset, rate)
lf t55xx detect N [1] Try detecting the tag modulation from reading the configuration block.
lf t55xx read N [password] -- Read T55xx block data (page 0) [optional password]
lf t55xx resetread N Send Reset chip Cmd then lf read the stream to attempt to identify the start of it (needs a demod and/or plot after)
lf t55xx write N [password] -- Write T55xx block data (page 0) [optional password]
lf t55xx trace N [1] Show T55xx traceability data (page 1/ blk 0-1)
lf t55xx info N [1] Show T55xx configuration data (page 0/ blk 0)
lf t55xx dump N [password] Dump T55xx card block 0-7. [optional password]
lf t55xx special N Show block changes with 64 different offsets
lf t55xx wakeup N Send AOR wakeup command
lf t55xx wipe N [q] Wipe a T55xx tag and set defaults (will destroy any data on tag)

lf pcf7931

{PCF7931 RFIDs...}

command offline description
lf pcf7931 help Y This help
lf pcf7931 read Y Read content of a PCF7931 transponder

script

{ Scripting commands }

command offline description
script help Y This help
script list Y List available scripts
script run Y -- Execute a script