Proxmark3 Commands

Low Frequency (LF)

125 KHz or 134.2 KHz
Protocol: ISO 11784 / 11785
Short reading range, around 1-5 cm

lf search

T55xx

lf t55xx config
lf t55xx dump
lf t55xx wipe

# unbrick T5577
lf t55xx write -b 0 -d 000880E8 -p 00000000

# Password set...... Yes
lf t55xx chk
lf t55xx info -p <pwd>
lf t55xx dump -p <pwd> -o

lf t55xx restore -f <fn>

EM 410x / T55xx

Old cards (H,T)
Old tags (DW)

lf em 410x reader
lf em 410x clone --id <card_id>

lf t5 detect

EM4x05 / EM4x69 / Indala ID

Old card (D)

lf em 4x05 info
lf em 4x05 chk
lf em 4x05 dump

lf indala reader
lf indala clone -r <raw>

---

High Frequency (HF)

13.56 MHz
Protocol: ISO 14443A / 14443B / 15693
Short reading range, around 2-10 cm
(ISO 15693 RFID cards & tags could reach up to around 1 meter)

hf search

ISO 14443-A / Mifare Classic

Type	Gen
UID	Magic Gen 1 (backdoor command 20:23 auth)
CUID	Magic Gen 2 (Mifare Classic Tool compatible direct write)
GDM / USCUID	Magic Gen 4

Old card (SL)
Old debit card (M,S) Old gym card (247, P&T)

hf mf info
hf mf chk
hf mf autopwn
hf mf cview
hf mf view -f hf-mf-12345678-dump-001.bin

hf mf csetuid -u <UID>
hf mf wipe
hf mf restore
hf mf dump --ns

hf mf csetblk -b 063 -d 53617350657320546573742045563121
hf mf cwipe

hf mf nested --4k --blk <Blk> -a -k <key A>

NFC / MIFARE Ultralight / NTAG / C

imagotag G1 retail 2.6 red NFC

hf mfu info

hf mfu keygen -r
hf mfu pwdgen -r

hf mfu dump
hf mfu dump --ns

hf mfu ndefread

hf mfu wipe -k FFFFFFFF

emv list
emv test
emv gpo

MIFARE DESFire EV1

Old card (T)

hf mfdes info
hf mfdes default

hf mfdes freemem

hf mfdes lsapp
hf mfdes lsfiles --aid <AID> --no-auth

hf mfdes createapp --aid <AID> --fid 2345 --dfname aid<AID>

hf mfdes createfile --aid <AID> --fid 01 --isofid 0001 --size 000010
hf mfdes getfileids --aid <AID>

hf mfdes write --aid <AID> --fid 01 -d 53617350657320546573742045563121
hf mfdes read --aid <AID>

hf mfdes deletefile --aid <AID> --fid 01
hf mfdes deleteapp --aid <AID>

hf mfdes formatpicc

eMRTD

Passport Old card (MC, ID)

hf em info -n <DOC_NR> -d <birthday YYMMDD> -e <expiry date YYMMDD>
hf emrtd info -n <DOC_NR> -d <birthday YYMMDD> -e <expiry date YYMMDD> -i

HID SEOS

Old card (D,ID)

hf seos info
hf seos managekeys -p

MIM256 / LEGIC Prime tag

Old bracelet (Blue)

hf legic info
hf legic list
hf legic dump

Links

1. Getting started with the proxmark3 easy
2. Windows binaries for the Proxmark3
3. Proxmark Wiki
4. Proxmark 3 CheatSheet
5. MIFARE Classic: exposing the static encrypted nonce variant
6. Mifare HowTo
7. Study of vulnerabilities in MIFARE Classic cards
8. RFID / NFC Card
9. Awesome RFID Talks
10. Backing Up Your Amiibo With A Proxmark3
11. MIFARE DESFire
12. Electronic Machine Readable Travel Document - eMRTD