commands

Proxmark3 command dump

Some commands are available only if a Proxmark is actually connected. Check column "offline" for their availability.

command	offline	description
help	Y	This help. Use ' help' for details of a particular command.
quit	Y	Exit program
exit	Y	Exit program

data

{ Plot window / data buffer manipulation... }

command	offline	description
data help	Y	This help
data amp	Y	Amplify peaks
data askdemod	Y	<0 or 1> -- Attempt to demodulate simple ASK tags
data askmandemod	Y	[clock] [invert<0 or 1>] -- Attempt to demodulate ASK/Manchester tags and output binary (args optional[clock will try Auto-detect])
data askrawdemod	Y	[clock] [invert<0 or 1>] -- Attempt to demodulate ASK tags and output binary (args optional[clock will try Auto-detect])
data autocorr	Y	-- Autocorrelation over window
data biphaserawdecode	Y	[offset] Biphase decode binary stream already in graph buffer (offset = bit to start decode from)
data bitsamples	N	Get raw samples as bitstring
data bitstream	Y	[clock rate] -- Convert waveform into a bitstream
data buffclear	Y	Clear sample buffer and graph window
data dec	Y	Decimate samples
data detectclock	Y	Detect ASK clock rate
data fskdemod	Y	Demodulate graph window as a HID FSK tag
data fskhiddemod	Y	Demodulate graph window as a HID FSK tag using raw
data fskiodemod	Y	Demodulate graph window as an IO Prox FSK tag using raw
data fskparadoxdemod	Y	Demodulate graph window as a Paradox FSK tag using raw
data fskpyramiddemod	Y	Demodulate graph window as a Pyramid FSK tag using raw
data fskrawdemod	Y	[clock rate] [invert] [rchigh] [rclow] Demodulate graph window from FSK to binary (clock = 50)(invert = 1 or 0)(rchigh = 10)(rclow=8)
data grid	Y	-- overlay grid on graph window, use zero value to turn off either
data hexsamples	N	[] -- Dump big buffer as hex bytes
data hide	Y	Hide graph window
data hpf	Y	Remove DC offset from trace
data load	Y	-- Load trace (to graph window
data ltrim	Y	-- Trim samples from left of trace
data rtrim	Y	-- Trim samples from right of trace
data mandemod	Y	[i] [clock rate] -- Manchester demodulate binary stream (option 'i' to invert output)
data manrawdecode	Y	Manchester decode binary stream already in graph buffer
data manmod	Y	[clock rate] -- Manchester modulate a binary stream
data norm	Y	Normalize max/min to +/-500
data plot	Y	Show graph window (hit 'h' in window for keystroke help)
data samples	N	[512 - 40000] -- Get raw samples for graph window
data tune	N	Get hw tune samples for graph window
data save	Y	-- Save trace (from graph window)
data scale	Y	-- Set cursor display scale
data threshold	Y	-- Maximize/minimize every value in the graph window depending on threshold
data zerocrossings	Y	Count time between zero-crossings
data dirthreshold	Y	-- Max rising higher up-thres/ Min falling lower down-thres, keep rest as prev.

hf

{ HF commands... }

command	offline	description
hf help	Y	This help
hf tune	N	Continuously measure HF antenna tuning
hf list	Y	List protocol data in trace buffer

hf 14a

{ ISO14443A RFIDs... }

command	offline	description
hf 14a help	Y	This help
hf 14a list	N	[Deprecated] List ISO 14443a history
hf 14a reader	N	Act like an ISO14443 Type A reader
hf 14a cuids	N	Collect n>0 ISO14443 Type A UIDs in one go
hf 14a sim	N	-- Fake ISO 14443a tag
hf 14a snoop	N	Eavesdrop ISO 14443 Type A
hf 14a raw	N	Send raw hex data to tag

hf 14b

{ ISO14443B RFIDs... }

command	offline	description
hf 14b help	Y	This help
hf 14b demod	Y	Demodulate ISO14443 Type B from tag
hf 14b list	N	List ISO 14443 history
hf 14b read	N	Read HF tag (ISO 14443)
hf 14b sim	N	Fake ISO 14443 tag
hf 14b simlisten	N	Get HF samples as fake tag
hf 14b snoop	N	Eavesdrop ISO 14443
hf 14b sri512read	N	Read contents of a SRI512 tag
hf 14b srix4kread	N	Read contents of a SRIX4K tag
hf 14b raw	N	Send raw hex data to tag

hf 15

{ ISO15693 RFIDs... }

command	offline	description
hf 15 help	Y	This help
hf 15 demod	Y	Demodulate ISO15693 from tag
hf 15 read	N	Read HF tag (ISO 15693)
hf 15 record	N	Record Samples (ISO 15693)
hf 15 reader	N	Act like an ISO15693 reader
hf 15 sim	N	Fake an ISO15693 tag
hf 15 cmd	N	Send direct commands to ISO15693 tag
hf 15 findafi	N	Brute force AFI of an ISO15693 tag
hf 15 dumpmemory	N	Read all memory pages of an ISO15693 tag

hf epa

{ German Identification Card... }

command	offline	description
hf epa help	Y	This help
hf epa cnonces	N	Acquire n>0 encrypted PACE nonces of size m>0 with d sec pauses

hf legic

{ LEGIC RFIDs... }

command	offline	description
hf legic help	Y	This help
hf legic decode	N	Display deobfuscated and decoded LEGIC RF tag data (use after hf legic reader)
hf legic reader	N	[offset [length]] -- read bytes from a LEGIC card
hf legic save	N	[] -- Store samples
hf legic load	N	-- Restore samples
hf legic sim	N	[phase drift [frame drift [req/resp drift]]] Start tag simulator (use after load or read)
hf legic write	N	-- Write sample buffer (user after load or read)
hf legic fill	N	-- Fill/Write tag with constant value

hf iclass

{ ICLASS RFIDs... }

command	offline	description
hf iclass help	Y	This help
hf iclass list	N	[Deprecated] List iClass history
hf iclass snoop	N	Eavesdrop iClass communication
hf iclass sim	N	Simulate iClass tag
hf iclass reader	N	Read an iClass tag
hf iclass replay	N	Read an iClass tag via Reply Attack
hf iclass dump	N	Authenticate and Dump iClass tag
hf iclass write	N	Authenticate and Write iClass block

hf mf

{ MIFARE RFIDs... }

command	offline	description
hf mf help	Y	This help
hf mf dbg	N	Set default debug mode
hf mf rdbl	N	Read MIFARE classic block
hf mf urdbl	N	Read MIFARE Ultralight block
hf mf urdcard	N	Read MIFARE Ultralight Card
hf mf uwrbl	N	Write MIFARE Ultralight block
hf mf rdsc	N	Read MIFARE classic sector
hf mf dump	N	Dump MIFARE classic tag to binary file
hf mf restore	N	Restore MIFARE classic binary file to BLANK tag
hf mf wrbl	N	Write MIFARE classic block
hf mf chk	N	Test block keys
hf mf mifare	N	Read parity error messages.
hf mf nested	N	Test nested authentication
hf mf sniff	N	Sniff card-reader communication
hf mf sim	N	Simulate MIFARE card
hf mf eclr	N	Clear simulator memory block
hf mf eget	N	Get simulator memory block
hf mf eset	N	Set simulator memory block
hf mf eload	N	Load from file emul dump
hf mf esave	N	Save to file emul dump
hf mf ecfill	N	Fill simulator memory with help of keys from simulator
hf mf ekeyprn	N	Print keys from simulator memory
hf mf csetuid	N	Set UID for magic Chinese card
hf mf csetblk	N	Write block into magic Chinese card
hf mf cgetblk	N	Read block from magic Chinese card
hf mf cgetsc	N	Read sector from magic Chinese card
hf mf cload	N	Load dump into magic Chinese card
hf mf csave	N	Save dump from magic Chinese card into file or emulator

hw

{ Hardware commands... }

command	offline	description
hw help	Y	This help
hw detectreader	N	['l'
hw fpgaoff	N	Set FPGA off
hw lcd	N	-- Send command/data to LCD
hw lcdreset	N	Hardware reset LCD
hw readmem	N	[address] -- Read memory at decimal address from flash
hw reset	N	Reset the Proxmark3
hw setlfdivisor	N	<19 - 255> -- Drive LF antenna at 12Mhz/(divisor+1)
hw setmux	N	<loraw
hw tune	N	Measure antenna tuning
hw version	N	Show version inforation about the connected Proxmark

lf

{ LF commands... }

command	offline	description
lf help	Y	This help
lf cmdread	N	<'0' period> <'1' period> ['h'] -- Modulate LF reader field to send command before read (all periods in microseconds) (option 'h' for 134)
lf flexdemod	Y	Demodulate samples for FlexPass
lf indalademod	Y	['224'] -- Demodulate samples for Indala 64 bit UID (option '224' for 224 bit)
lf indalaclone	N	['l']-- Clone Indala to T55x7 (tag must be in antenna)(UID in HEX)(option 'l' for 224 UID
lf read	N	['h' or ] -- Read 125/134 kHz LF ID-only tag (option 'h' for 134, alternatively: f=12MHz/(divisor+1))
lf search	Y	Read and Search for valid known tag (in offline mode it you can load first then search)
lf sim	N	[GAP] -- Simulate LF tag from buffer with optional GAP (in microseconds)
lf simbidir	N	Simulate LF tag (with bidirectional data transmission between reader and tag)
lf simman	N	[GAP] Simulate arbitrary Manchester LF tag
lf snoop	N	['l'
lf vchdemod	Y	['clone'] -- Demodulate samples for VeriChip

lf em4x

{ EM4X RFIDs... }

command	offline	description
lf em4x help	Y	This help
lf em4x em410xdemod	N	[clock rate] -- Extract ID from EM410x tag
lf em4x em410xread	Y	[clock rate] -- Extract ID from EM410x tag
lf em4x em410xsim	N	-- Simulate EM410x tag
lf em4x em410xwatch	N	['h'] -- Watches for EM410x 125/134 kHz tags (option 'h' for 134)
lf em4x em410xwrite	Y	<'0' T5555> <'1' T55x7> [clock rate] -- Write EM410x UID to T5555(Q5) or T55x7 tag, optionally setting clock rate
lf em4x em4x50read	Y	Extract data from EM4x50 tag
lf em4x readword	Y	-- Read EM4xxx word data
lf em4x readwordPWD	Y	-- Read EM4xxx word data in password mode
lf em4x writeword	Y	-- Write EM4xxx word data
lf em4x writewordPWD	Y	-- Write EM4xxx word data in password mode

lf hid

{ HID RFIDs... }

command	offline	description
lf hid help	Y	This help
lf hid demod	Y	Demodulate HID Prox Card II (not optimal)
lf hid fskdemod	N	['1'] Realtime HID FSK demodulator (option '1' for one tag only)
lf hid sim	N	-- HID tag simulator
lf hid clone	N	['l'] -- Clone HID to T55x7 (tag must be in antenna)(option 'l' for 84bit ID)

lf io

{ ioProx tags... }

command	offline	description
lf io help	Y	This help
lf io demod	Y	Demodulate Stream
lf io fskdemod	N	['1'] Realtime IO FSK demodulator (option '1' for one tag only)
lf io clone	N	Clone ioProx Tag

lf ti

{ TI RFIDs... }

command	offline	description
lf ti help	Y	This help
lf ti demod	Y	Demodulate raw bits for TI-type LF tag
lf ti read	N	Read and decode a TI 134 kHz tag
lf ti write	N	Write new data to a r/w TI 134 kHz tag

lf hitag

{ Hitag tags and transponders... }

command	offline	description
lf hitag help	Y	This help
lf hitag list	Y	List Hitag trace history
lf hitag reader	Y	Act like a Hitag Reader
lf hitag sim	Y	Simulate Hitag transponder
lf hitag snoop	Y	Eavesdrop Hitag communication

lf t55xx

{ T55xx RFIDs... }

command	offline	description
lf t55xx help	Y	This help
lf t55xx readblock	Y	-- Read T55xx block data (page 0)
lf t55xx readblockPWD	Y	-- Read T55xx block data in password mode(page 0)
lf t55xx writeblock	Y	-- Write T55xx block data (page 0)
lf t55xx writeblockPWD	Y	-- Write T55xx block data in password mode(page 0)
lf t55xx readtrace	Y	Read T55xx traceability data (page 1)

lf pcf7931

{PCF7931 RFIDs...}

command	offline	description
lf pcf7931 help	Y	This help
lf pcf7931 read	Y	Read content of a PCF7931 transponder

script

{ Scripting commands }

command	offline	description
script help	Y	This help
script list	Y	List available scripts
script run	Y	-- Execute a script