diff --git a/armsrc/appmain.c b/armsrc/appmain.c index 43c3e68ea..0f9832fb5 100644 --- a/armsrc/appmain.c +++ b/armsrc/appmain.c @@ -101,19 +101,19 @@ uint8_t g_tearoff_skip = 0; int tearoff_hook(void) { if (g_tearoff_enabled) { if (g_tearoff_delay_us == 0) { - Dbprintf(_RED_("No tear-off delay configured!")); + if (g_dbglevel >= DBG_ERROR) Dbprintf(_RED_("No tear-off delay configured!")); g_tearoff_enabled = false; return PM3_SUCCESS; // SUCCESS = the hook didn't do anything } if (g_tearoff_skip > 0) { - Dbprintf(_GREEN_("Tear-off skipped!")); + if (g_dbglevel >= DBG_INFO) Dbprintf(_GREEN_("Tear-off skipped!")); g_tearoff_skip--; return PM3_SUCCESS; // SUCCESS = the hook didn't do anything } SpinDelayUsPrecision(g_tearoff_delay_us); FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); g_tearoff_enabled = false; - if (g_dbglevel >= DBG_ERROR) Dbprintf(_YELLOW_("Tear-off triggered!")); + if (g_dbglevel >= DBG_INFO) Dbprintf(_YELLOW_("Tear-off triggered!")); return PM3_ETEAROFF; } else { return PM3_SUCCESS; // SUCCESS = the hook didn't do anything diff --git a/armsrc/iclass.c b/armsrc/iclass.c index 32f05791c..423742e70 100644 --- a/armsrc/iclass.c +++ b/armsrc/iclass.c @@ -2746,7 +2746,7 @@ void iClass_Recover(iclass_recover_req_t *msg) { uint32_t start_time = 0; uint8_t read_check_cc[] = { 0x10 | ICLASS_CMD_READCHECK, 0x18 }; //block 24 with credit key uint8_t read_check_cc2[] = { 0x80 | ICLASS_CMD_READCHECK, 0x02 }; //block 2 -> to check Kd macs - if (msg->credit_recovery == true){ + if (msg->credit_recovery == true) { read_check_cc[0] = 0x80 | ICLASS_CMD_READCHECK; //still block 24 but with debit key } @@ -2799,7 +2799,7 @@ void iClass_Recover(iclass_recover_req_t *msg) { //Step 0A - The read_check_cc block has to be in AA2, set it by checking the card configuration read_check_cc[1] = hdr.conf.app_limit + 1; //first block of AA2 - if (msg->credit_recovery == true){ + if (msg->credit_recovery == true) { read_check_cc[1] = hdr.conf.app_limit - 1; //last block of AA1 } //Step1 Authenticate with AA1 using trace @@ -2928,7 +2928,7 @@ void iClass_Recover(iclass_recover_req_t *msg) { uint8_t wb[9] = {0}; uint8_t blockno = 3; - if (msg->credit_recovery == true){ + if (msg->credit_recovery == true) { blockno = 4; } wb[0] = blockno; @@ -3080,8 +3080,8 @@ fast_restore: uint8_t mac2[4] = {0}; uint8_t wb[9] = {0}; uint8_t blockno = 3; - if (msg->credit_recovery == true){ - blockno = 4; + if (msg->credit_recovery == true) { + blockno = 4; } wb[0] = blockno; bool reverted = false; diff --git a/client/src/cmdhfaliro.c b/client/src/cmdhfaliro.c index b00a9f350..ca779fce7 100644 --- a/client/src/cmdhfaliro.c +++ b/client/src/cmdhfaliro.c @@ -1577,11 +1577,11 @@ static int aliro_read_do_auth0(aliro_read_state_t *state, uint8_t auth0_data[ALIRO_MAX_BUFFER] = {0}; size_t auth0_data_len = 0; if (aliro_append_tlv(0x41, &state->auth0_command_parameters, 1, auth0_data, sizeof(auth0_data), &auth0_data_len) != PM3_SUCCESS || - aliro_append_tlv(0x42, (const uint8_t[]){ALIRO_AUTH0_DEFAULT_POLICY}, 1, auth0_data, sizeof(auth0_data), &auth0_data_len) != PM3_SUCCESS || - aliro_append_tlv(0x5C, state->protocol_version, 2, auth0_data, sizeof(auth0_data), &auth0_data_len) != PM3_SUCCESS || - aliro_append_tlv(0x87, state->reader_ephemeral_public_key, 65, auth0_data, sizeof(auth0_data), &auth0_data_len) != PM3_SUCCESS || - aliro_append_tlv(0x4C, state->transaction_identifier, 16, auth0_data, sizeof(auth0_data), &auth0_data_len) != PM3_SUCCESS || - aliro_append_tlv(0x4D, state->reader_identifier, 32, auth0_data, sizeof(auth0_data), &auth0_data_len) != PM3_SUCCESS) { + aliro_append_tlv(0x42, (const uint8_t[]) {ALIRO_AUTH0_DEFAULT_POLICY}, 1, auth0_data, sizeof(auth0_data), &auth0_data_len) != PM3_SUCCESS || +aliro_append_tlv(0x5C, state->protocol_version, 2, auth0_data, sizeof(auth0_data), &auth0_data_len) != PM3_SUCCESS || +aliro_append_tlv(0x87, state->reader_ephemeral_public_key, 65, auth0_data, sizeof(auth0_data), &auth0_data_len) != PM3_SUCCESS || +aliro_append_tlv(0x4C, state->transaction_identifier, 16, auth0_data, sizeof(auth0_data), &auth0_data_len) != PM3_SUCCESS || +aliro_append_tlv(0x4D, state->reader_identifier, 32, auth0_data, sizeof(auth0_data), &auth0_data_len) != PM3_SUCCESS) { PrintAndLogEx(ERR, "Failed to encode AUTH0 command"); return PM3_ESOFT; } @@ -1787,10 +1787,10 @@ static int aliro_read_do_auth1(aliro_read_state_t *state, uint8_t auth1_data[ALIRO_MAX_BUFFER] = {0}; size_t auth1_data_len = 0; - if (aliro_append_tlv(0x41, (const uint8_t[]){ALIRO_AUTH1_REQUEST_PUBLIC_KEY}, 1, - auth1_data, sizeof(auth1_data), &auth1_data_len) != PM3_SUCCESS || - aliro_append_tlv(0x9E, auth1_signature, 64, - auth1_data, sizeof(auth1_data), &auth1_data_len) != PM3_SUCCESS) { + if (aliro_append_tlv(0x41, (const uint8_t[]) {ALIRO_AUTH1_REQUEST_PUBLIC_KEY}, 1, +auth1_data, sizeof(auth1_data), &auth1_data_len) != PM3_SUCCESS || +aliro_append_tlv(0x9E, auth1_signature, 64, + auth1_data, sizeof(auth1_data), &auth1_data_len) != PM3_SUCCESS) { PrintAndLogEx(ERR, "Failed to encode AUTH1 command"); return PM3_ESOFT; } @@ -2041,7 +2041,7 @@ static int aliro_parse_step_up_scopes(struct arg_str *scope_arg, aliro_step_up_s char *saveptr = NULL; char *token = strtok_r(scope_str, ",", &saveptr); while (token != NULL) { - while (isspace((unsigned char)*token)) { + while (isspace((unsigned char) * token)) { token++; } @@ -3539,11 +3539,11 @@ static int aliro_read_auth_flow(const uint8_t *kpersistent, size_t kpersistent_l aliro_read_print_auth1_report(&state); have_fast_suggestion_cmd = aliro_read_build_fast_suggestion_command(&state, - reader_group_identifier, - reader_group_sub_identifier, - reader_private_key_raw, - fast_suggestion_cmd, - sizeof(fast_suggestion_cmd)); + reader_group_identifier, + reader_group_sub_identifier, + reader_private_key_raw, + fast_suggestion_cmd, + sizeof(fast_suggestion_cmd)); if (flow == ALIRO_FLOW_STEP_UP) { res = aliro_read_do_step_up(&state, step_up_scopes); diff --git a/client/src/cmdhffelica.c b/client/src/cmdhffelica.c index aca155b2a..31db2668e 100644 --- a/client/src/cmdhffelica.c +++ b/client/src/cmdhffelica.c @@ -69,8 +69,8 @@ static int CmdHelp(const char *Cmd); static void clear_and_send_command(uint8_t flags, uint16_t datalen, uint8_t *data, bool verbose); static int send_felica_payload_with_retries(uint8_t flags, uint16_t datalen, uint8_t *data, bool verbose, - int expected_response_cmd, uint32_t timeout_ms, uint32_t retries, bool logging, - PacketResponseNG *resp, const char *request_name); + int expected_response_cmd, uint32_t timeout_ms, uint32_t retries, bool logging, + PacketResponseNG *resp, const char *request_name); static felica_card_select_t last_known_card; static void set_last_known_card(felica_card_select_t card) { @@ -312,8 +312,8 @@ static const char *felica_specification_option_name(size_t option_index) { } static void print_specification_versions(int level, - const felica_request_specification_version_info_t *specification_version_info, - bool include_hex) { + const felica_request_specification_version_info_t *specification_version_info, + bool include_hex) { if (specification_version_info == NULL || specification_version_info->has_specification_version == false) { return; } @@ -687,7 +687,7 @@ static int send_get_container_property(uint8_t flags, uint16_t datalen, uint8_t } static int send_get_container_issue_information(uint8_t flags, uint16_t datalen, uint8_t *data, bool verbose, - felica_get_container_issue_info_response_t *container_issue_info_response) { + felica_get_container_issue_info_response_t *container_issue_info_response) { (void)verbose; PacketResponseNG resp; if (send_felica_payload_with_retries(flags, datalen, data, false, @@ -706,8 +706,8 @@ static int send_get_container_issue_information(uint8_t flags, uint16_t datalen, } static int send_get_platform_information(uint8_t flags, uint16_t datalen, uint8_t *data, bool verbose, - felica_status_flags_t *status_flags, uint8_t *platform_information_data, - size_t platform_information_data_capacity, size_t *platform_information_data_len) { + felica_status_flags_t *status_flags, uint8_t *platform_information_data, + size_t platform_information_data_capacity, size_t *platform_information_data_len) { (void)verbose; if (status_flags == NULL || platform_information_data == NULL || platform_information_data_len == NULL) { return PM3_EINVARG; @@ -759,8 +759,8 @@ static int send_get_platform_information(uint8_t flags, uint16_t datalen, uint8_ } static int send_request_specification_version(uint8_t flags, uint16_t datalen, uint8_t *data, bool verbose, - bool logging, uint32_t timeout_ms, uint32_t retries, - felica_request_specification_version_info_t *specification_version_info) { + bool logging, uint32_t timeout_ms, uint32_t retries, + felica_request_specification_version_info_t *specification_version_info) { if (specification_version_info == NULL) { return PM3_EINVARG; } @@ -932,8 +932,8 @@ static int info_felica(bool verbose) { felica_get_container_issue_info_response_t container_issue_info_response; if (send_get_container_issue_information(optional_flags, - sizeof(container_issue_info_request), (uint8_t *)&container_issue_info_request, false, - &container_issue_info_response) == PM3_SUCCESS) { + sizeof(container_issue_info_request), (uint8_t *)&container_issue_info_request, false, + &container_issue_info_response) == PM3_SUCCESS) { char model_ascii[sizeof(container_issue_info_response.mobile_phone_model_information) + 1] = {0}; bool model_is_ascii = decode_zero_padded_ascii( container_issue_info_response.mobile_phone_model_information, @@ -1116,8 +1116,8 @@ static void log_felica_retry_attempt(const char *request_name, uint32_t attempt, * @return PM3_SUCCESS on success */ static int send_felica_payload_with_retries(uint8_t flags, uint16_t datalen, uint8_t *data, bool verbose, - int expected_response_cmd, uint32_t timeout_ms, uint32_t retries, bool logging, - PacketResponseNG *resp, const char *request_name) { + int expected_response_cmd, uint32_t timeout_ms, uint32_t retries, bool logging, + PacketResponseNG *resp, const char *request_name) { for (uint32_t attempt = 0; attempt <= retries; attempt++) { clear_and_send_command(flags, datalen, data, verbose); if (waitCmdFelicaEx(false, resp, verbose, logging, timeout_ms) == false) { @@ -1162,10 +1162,10 @@ int send_request_service(uint8_t flags, uint16_t datalen, uint8_t *data, bool ve } PacketResponseNG resp; if (send_felica_payload_with_retries(flags, datalen, data, verbose, - 0x03, - FELICA_DEFAULT_TIMEOUT_MS, 0, - true, - &resp, "request service") != PM3_SUCCESS) { + 0x03, + FELICA_DEFAULT_TIMEOUT_MS, 0, + true, + &resp, "request service") != PM3_SUCCESS) { PrintAndLogEx(ERR, "\nGot no response from card"); return PM3_ERFTRANS; } @@ -2139,10 +2139,10 @@ static int CmdHFFelicaRequestSpecificationVersion(const char *Cmd) { sprint_hex(request_specification_version_request.IDm, sizeof(request_specification_version_request.IDm))); PrintAndLogEx(SUCCESS, "Status Flag1... %s", sprint_hex(specification_version_info.status_flags.status_flag1, - sizeof(specification_version_info.status_flags.status_flag1))); + sizeof(specification_version_info.status_flags.status_flag1))); PrintAndLogEx(SUCCESS, "Status Flag2... %s", sprint_hex(specification_version_info.status_flags.status_flag2, - sizeof(specification_version_info.status_flags.status_flag2))); + sizeof(specification_version_info.status_flags.status_flag2))); if (specification_version_info.has_specification_version) { print_specification_versions(SUCCESS, &specification_version_info, true); diff --git a/client/src/cmdhficlass.c b/client/src/cmdhficlass.c index 9506ce788..472046c09 100644 --- a/client/src/cmdhficlass.c +++ b/client/src/cmdhficlass.c @@ -4933,9 +4933,9 @@ static int CmdHFiClassLegacyRecSim(bool credit) { } uint8_t new_div_key[8] = {0}; - if (credit == true){ + if (credit == true) { HFiClassCalcDivKey(csn, iClass_Key_Table[1], new_div_key, false); - }else{ + } else { HFiClassCalcDivKey(csn, iClass_Key_Table[0], new_div_key, false); } @@ -5050,8 +5050,8 @@ static int CmdHFiClassLegacyRecover(const char *Cmd) { } else if (test) { loop = 1; fast = false; - }else if (debug) { - if (loop > 10){ + } else if (debug) { + if (loop > 10) { loop = 10; } fast = false; @@ -5065,10 +5065,10 @@ static int CmdHFiClassLegacyRecover(const char *Cmd) { return PM3_ESOFT; } - if(credit == true){ + if (credit == true) { diversifyKey(csn, iClass_Key_Table[0], new_div_key); fast = false; - }else{ + } else { diversifyKey(csn, iClass_Key_Table[1], new_div_key); } diff --git a/client/src/pm3line_vocabulary.h b/client/src/pm3line_vocabulary.h index 788eefe16..a52b9da5a 100644 --- a/client/src/pm3line_vocabulary.h +++ b/client/src/pm3line_vocabulary.h @@ -214,6 +214,10 @@ const static vocabulary_t vocabulary[] = { { 0, "hf 15 writeafi" }, { 0, "hf 15 writedsfid" }, { 0, "hf 15 csetuid" }, + { 1, "hf aliro help" }, + { 1, "hf aliro list" }, + { 0, "hf aliro info" }, + { 0, "hf aliro read" }, { 1, "hf cipurse help" }, { 0, "hf cipurse info" }, { 0, "hf cipurse select" }, @@ -240,6 +244,7 @@ const static vocabulary_t vocabulary[] = { { 1, "hf felica help" }, { 1, "hf felica list" }, { 0, "hf felica info" }, + { 0, "hf felica seacinfo" }, { 0, "hf felica raw" }, { 0, "hf felica rdbl" }, { 0, "hf felica reader" }, @@ -473,7 +478,6 @@ const static vocabulary_t vocabulary[] = { { 0, "hf mfdes getaids" }, { 0, "hf mfdes getappnames" }, { 0, "hf mfdes bruteaid" }, - { 0, "hf mfdes bruteisofid" }, { 0, "hf mfdes createapp" }, { 0, "hf mfdes deleteapp" }, { 0, "hf mfdes selectapp" }, @@ -482,6 +486,7 @@ const static vocabulary_t vocabulary[] = { { 0, "hf mfdes chkeysettings" }, { 0, "hf mfdes getkeysettings" }, { 0, "hf mfdes getkeyversions" }, + { 0, "hf mfdes bruteisofid" }, { 0, "hf mfdes getfileids" }, { 0, "hf mfdes getfileisoids" }, { 0, "hf mfdes lsfiles" }, diff --git a/doc/commands.json b/doc/commands.json index 8447d899b..06288c322 100644 --- a/doc/commands.json +++ b/doc/commands.json @@ -2232,6 +2232,64 @@ ], "usage": "hf 15 writedsfid [-h*2ov] [-u ] [--ua] --dsfid " }, + "hf aliro help": { + "command": "hf aliro help", + "description": "----------- ----------------------- General ----------------------- help This help list List ISO 14443A/7816 history --------------------------------------------------------------------------------------- hf aliro list available offline: yes Alias of `trace list -t 7816` with selected protocol data to annotate trace buffer You can load a trace from file (see `trace load -h`) or it be downloaded from device by default It accepts all other arguments of `trace list`. Note that some might not be relevant for this specific protocol", + "notes": [ + "hf aliro list --frame -> show frame delay times", + "hf aliro list -1 -> use trace buffer" + ], + "offline": true, + "options": [ + "-h, --help This help", + "-1, --buffer use data from trace buffer", + "--frame show frame delay times", + "-c mark CRC bytes", + "-r show relative times (gap and duration)", + "-u display times in microseconds instead of clock cycles", + "-x show hexdump to convert to pcap(ng)", + "or to import into Wireshark using encapsulation type \"ISO 14443\"", + "-f, --file filename of dictionary" + ], + "usage": "hf aliro list [-h1crux] [--frame] [-f ]" + }, + "hf aliro info": { + "command": "hf aliro info", + "description": "Select ALIRO applet and print capabilities.", + "notes": [ + "hf aliro info", + "hf aliro info -a" + ], + "offline": false, + "options": [ + "-h, --help This help", + "-a, --apdu Show APDU requests and responses" + ], + "usage": "hf aliro info [-ha]" + }, + "hf aliro read": { + "command": "hf aliro read", + "description": "Execute ALIRO expedited flow and optional step-up document retrieval.", + "notes": [ + "hf aliro read --reader-group-id 00112233445566778899AABBCCDDEEFF --reader-sub-group-id 00112233445566778899AABBCCDDEEFF --reader-private-key 00112233445566778899AABBCCDDEEFF00112233445566778899AABBCCDDEEFF", + "hf aliro read --reader-group-id 00112233445566778899AABBCCDDEEFF --reader-private-key 00112233445566778899AABBCCDDEEFF00112233445566778899AABBCCDDEEFF --transaction-id 00112233445566778899AABBCCDDEEFF --k-persistent 00112233445566778899AABBCCDDEEFF00112233445566778899AABBCCDDEEFF --endpoint-public-key 04AABBCCDDEEFF00112233445566778899AABBCCDDEEFF00112233445566778899AABBCCDDEEFF00112233445566778899AABBCCDDEEFF00112233445566778899AABBCCDDEEFF --flow fast -a", + "hf aliro read --reader-group-id 00112233445566778899AABBCCDDEEFF --reader-private-key 00112233445566778899AABBCCDDEEFF00112233445566778899AABBCCDDEEFF --step-up-scopes matter1,non_access_extensions" + ], + "offline": false, + "options": [ + "-h, --help This help", + "-k, --k-persistent, --key-persistent, --kpersistent, --keypersistent, --kp Kpersistent (32 bytes, optional; used for fast cryptogram verification)", + "-g, --reader-group-id, --readergroupid, --rgi Reader group identifier (16 bytes)", + "-s, --reader-sub-group-id, --readersubid, --rsi Reader subgroup identifier (16 bytes, default: all zeroes)", + "-p, --reader-private-key, --readerprivkey, --rpk Reader private key (32 bytes, P-256)", + "-t, --transaction-id, --ti Transaction identifier (16 bytes, optional; random if omitted)", + "-e, --endpoint-public-key, --endpointpublickey, --epk Endpoint public key for AUTH0 fast verification (32-byte X or 65-byte uncompressed)", + "-f, --flow Transaction flow (default: step-up)", + "--step-up-scopes Comma-separated step-up scopes (default: matter1)", + "-a, --apdu Show APDU requests and responses" + ], + "usage": "hf aliro read [-ha] [-k ] -g [-s ] -p [-t ] [-e ] [-f ] [--step-up-scopes ]" + }, "hf cipurse aread": { "command": "hf cipurse aread", "description": "Read file attributes by file ID with key ID and key. If no key is supplied, default key of 737373...7373 will be used", @@ -2702,14 +2760,16 @@ "command": "hf felica dump", "description": "Dump all existing Area Code and Service Code. Only works on services that do not require authentication yet.", "notes": [ - "hf felica dump" + "hf felica dump", + "hf felica dump --retry 5" ], "offline": false, "options": [ "-h, --help This help", - "--no-auth read public services" + "--no-auth read public services", + "-r, --retry number of retries" ], - "usage": "hf felica dump [-h] [--no-auth]" + "usage": "hf felica dump [-h] [--no-auth] [-r ]" }, "hf felica help": { "command": "hf felica help", @@ -2896,7 +2956,7 @@ }, "hf felica rqspecver": { "command": "hf felica rqspecver", - "description": "Use this command to acquire the version of card OS. Response: - Format version: Fixed value 00h. Provided only if Status Flag1 = 00h - Basic version: Each value of version is expressed in BCD notation. Provided only if Status Flag1 = 00h - Number of Option: value = 0: AES card, value = 1: AES/DES card. Provided only if Status Flag1 = 00h - Option version list: Provided only if Status Flag1 = 00h - AES card: not added - AES/DES card: DES option version is added - BCD notation", + "description": "Use this command to acquire the version of card OS. Response: - Format version: Fixed value 00h. Provided only if Status Flag1 = 00h - Basic version: Each value of version is expressed in BCD notation. Provided only if Status Flag1 = 00h - Number of Option: number of entries in Option Version List. - Option version list: BCD notation (major.minor.patch), little-endian, provided only if Status Flag1 = 00h", "notes": [ "hf felica rqspecver", "hf felica rqspecver -r 0001", @@ -2929,13 +2989,27 @@ "command": "hf felica scsvcode", "description": "Dump all existing Area Code and Service Code.", "notes": [ - "hf felica scsvcode" + "hf felica scsvcode", + "hf felica scsvcode --retry 5" + ], + "offline": false, + "options": [ + "-h, --help This help", + "-r, --retry number of retries" + ], + "usage": "hf felica scsvcode [-h] [-r ]" + }, + "hf felica seacinfo": { + "command": "hf felica seacinfo", + "description": "Get info about FeliCa SEAC cards", + "notes": [ + "hf felica seacinfo" ], "offline": false, "options": [ "-h, --help This help" ], - "usage": "hf felica scsvcode [-h]" + "usage": "hf felica seacinfo [-h]" }, "hf felica sniff": { "command": "hf felica sniff", @@ -3276,7 +3350,7 @@ }, "hf help": { "command": "hf help", - "description": "-------- ----------------------- High Frequency ----------------------- 14a { ISO14443A RFIDs... } 14b { ISO14443B RFIDs... } 15 { ISO15693 RFIDs... } cipurse { Cipurse transport Cards... } epa { German Identification Card... } emrtd { Machine Readable Travel Document... } felica { ISO18092 / FeliCa RFIDs... } fido { FIDO and FIDO2 authenticators... } fudan { Fudan RFIDs... } gallagher { Gallagher DESFire RFIDs... } iclass { ICLASS RFIDs... } ict { ICT MFC/DESfire RFIDs... } jooki { Jooki RFIDs... } ksx6924 { KS X 6924 (T-Money, Snapper+) RFIDs } legic { LEGIC RFIDs... } lto { LTO Cartridge Memory RFIDs... } mf { MIFARE RFIDs... } mfp { MIFARE Plus RFIDs... } mfu { MIFARE Ultralight RFIDs... } mfdes { MIFARE Desfire RFIDs... } ntag424 { NXP NTAG 4242 DNA RFIDs... } saflok { Saflok MFC RFIDs... } seos { SEOS RFIDs... } st25ta { ST25TA RFIDs... } tesla { TESLA Cards... } texkom { Texkom RFIDs... } thinfilm { Thinfilm RFIDs... } topaz { TOPAZ (NFC Type 1) RFIDs... } vas { Apple Value Added Service... } waveshare { Waveshare NFC ePaper... } xerox { Fuji/Xerox cartridge RFIDs... } ----------- --------------------- General --------------------- help This help list List protocol data in trace buffer search Search for known HF tags --------------------------------------------------------------------------------------- hf list available offline: yes Alias of `trace list -t raw` with selected protocol data to annotate trace buffer You can load a trace from file (see `trace load -h`) or it be downloaded from device by default It accepts all other arguments of `trace list`. Note that some might not be relevant for this specific protocol", + "description": "-------- ----------------------- High Frequency ----------------------- 14a { ISO14443A RFIDs... } 14b { ISO14443B RFIDs... } 15 { ISO15693 RFIDs... } aliro { ALIRO digital access credentials... } cipurse { Cipurse transport Cards... } epa { German Identification Card... } emrtd { Machine Readable Travel Document... } felica { ISO18092 / FeliCa RFIDs... } fido { FIDO and FIDO2 authenticators... } fudan { Fudan RFIDs... } gallagher { Gallagher DESFire RFIDs... } iclass { ICLASS RFIDs... } ict { ICT MFC/DESfire RFIDs... } jooki { Jooki RFIDs... } ksx6924 { KS X 6924 (T-Money, Snapper+) RFIDs } legic { LEGIC RFIDs... } lto { LTO Cartridge Memory RFIDs... } mf { MIFARE RFIDs... } mfp { MIFARE Plus RFIDs... } mfu { MIFARE Ultralight RFIDs... } mfdes { MIFARE Desfire RFIDs... } ntag424 { NXP NTAG 4242 DNA RFIDs... } saflok { Saflok MFC RFIDs... } seos { SEOS RFIDs... } st25ta { ST25TA RFIDs... } tesla { TESLA Cards... } texkom { Texkom RFIDs... } thinfilm { Thinfilm RFIDs... } topaz { TOPAZ (NFC Type 1) RFIDs... } vas { Apple Value Added Service... } waveshare { Waveshare NFC ePaper... } xerox { Fuji/Xerox cartridge RFIDs... } ----------- --------------------- General --------------------- help This help list List protocol data in trace buffer search Search for known HF tags --------------------------------------------------------------------------------------- hf list available offline: yes Alias of `trace list -t raw` with selected protocol data to annotate trace buffer You can load a trace from file (see `trace load -h`) or it be downloaded from device by default It accepts all other arguments of `trace list`. Note that some might not be relevant for this specific protocol", "notes": [ "hf list --frame -> show frame delay times", "hf list -1 -> use trace buffer" @@ -3601,9 +3675,10 @@ "--allnight Loops the loop for 10 times, recommended loop value of 5000", "--fast Increases the speed (4.6->7.4 key updates/second), higher risk to brick the card", "--sl Lower card comms delay times, further speeds increases, may cause more errors", - "--est Estimates the key updates based on the card's CSN assuming standard key" + "--est Estimates the key updates based on the card's CSN assuming standard key, can be used with --credit option", + "--credit EXPERIMENTAL : Recover the credit key using KD 0" ], - "usage": "hf iclass legrec [-h] --macs [--index ] [--loop ] [--debug] [--notest] [--allnight] [--fast] [--sl] [--est]" + "usage": "hf iclass legrec [-h] --macs [--index ] [--loop ] [--debug] [--notest] [--allnight] [--fast] [--sl] [--est] [--credit]" }, "hf iclass loclass": { "command": "hf iclass loclass", @@ -5750,7 +5825,11 @@ "description": "Recover AIDs by bruteforce. WARNING: This command takes a loooong time", "notes": [ "hf mfdes bruteaid -> Search all apps", - "hf mfdes bruteaid --start F0000F -i 16 -> Search MAD range manually" + "hf mfdes bruteaid --preset mad -> Search MAD range preset (default start F0000F, step 16; can override start)", + "hf mfdes bruteaid --preset ascii -> Search with ASCII printable + whitespace bytes only", + "hf mfdes bruteaid --preset numbers -> Search with numeric bytes ('0'..'9') only", + "hf mfdes bruteaid --preset letters -> Search with letter bytes ('A'..'Z','a'..'z') only", + "hf mfdes bruteaid --preset dictionary -> Search AIDs from `aid_desfire` dictionary (direct + inverted byte order)" ], "offline": false, "options": [ @@ -5758,9 +5837,30 @@ "--start Starting App ID as hex bytes (3 bytes, big endian)", "--end Last App ID as hex bytes (3 bytes, big endian)", "-i, --step Increment step when bruteforcing", - "-m, --mad Only bruteforce the MAD range" + "--preset Bruteforce candidate preset (`full` default, `ascii` printable + whitespace, `numbers` = '0'..'9', `letters` = 'A'..'Z'+'a'..'z', `dictionary` = aid_desfire list with direct + inverted byte order, `mad` = step 16 with default start F0000F unless --start is provided)" ], - "usage": "hf mfdes bruteaid [-hm] [--start ] [--end ] [-i ]" + "usage": "hf mfdes bruteaid [-h] [--start ] [--end ] [-i ] [--preset ]" + }, + "hf mfdes bruteisofid": { + "command": "hf mfdes bruteisofid", + "description": "Recover ISO file IDs by bruteforce. WARNING: This command takes a loooong time", + "notes": [ + "hf mfdes bruteisofid --aid 123456 -> bruteforce ISO file IDs for application 123456", + "hf mfdes bruteisofid --start 0000 --end 0fff -> bruteforce specific file ISO ID range" + ], + "offline": false, + "options": [ + "-h, --help This help", + "-a, --apdu Show APDU requests and responses", + "-v, --verbose Verbose output", + "--aid Application ID (3 hex bytes, big endian)", + "--isoid Application ISO ID (ISO DF ID) (2 hex bytes, big endian)", + "--dfname Application ISO DF Name (5-16 hex bytes, big endian)", + "--start Starting File ISO ID (2 hex bytes, big endian)", + "--end Last File ISO ID (2 hex bytes, big endian)", + "--step Increment step when bruteforcing" + ], + "usage": "hf mfdes bruteisofid [-hav] [--aid ] [--isoid ] [--dfname ] [--start ] [--end ] [--step ]" }, "hf mfdes changekey": { "command": "hf mfdes changekey", @@ -6726,6 +6826,25 @@ ], "usage": "hf mfdes selectapp [-hav] [-n ] [-t ] [-k ] [--kdf ] [-i ] [-m ] [-c ] [--schann ] [--aid ] [--dfname ] [--mf] [--isoid ] [--fileisoid ]" }, + "hf mfdes selectisofid": { + "command": "hf mfdes selectisofid", + "description": "Select file via ISO Select command by 2-byte ISO file identifier. Optionally preselect an application by AID or DF name before selecting the file.", + "notes": [ + "hf mfdes selectisofid --isofid e104 -> select file 0xE104", + "hf mfdes selectisofid --aid 123456 --isofid 00ef -> select file 0x00EF in app 0x123456", + "hf mfdes selectisofid --dfname D2760000850100 --isofid 00ef --apdu -> select file 0x00EF after DF name selection and show APDU logs" + ], + "offline": false, + "options": [ + "-h, --help This help", + "-a, --apdu Show APDU requests and responses", + "-v, --verbose Verbose output", + "--aid Application ID (3 hex bytes, big endian)", + "--dfname Application ISO DF Name (1-16 hex bytes, big endian)", + "--isofid File ISO ID (ISO EF ID) (2 hex bytes, big endian)" + ], + "usage": "hf mfdes selectisofid [-hav] [--aid ] [--dfname ] [--isofid ]" + }, "hf mfdes setconfig": { "command": "hf mfdes setconfig", "description": "Set card configuration. WARNING! Danger zone! Needs to provide card's master key and works if not blocked by config.", @@ -6967,18 +7086,24 @@ }, "hf mfp dump": { "command": "hf mfp dump", - "description": "Dump MIFARE Plus tag to file (bin/json) If no given, UID will be used as filename", + "description": "Dump MIFARE Plus tag to file (bin/json) Reads sectors using keys from `hf mfp chk --dump` (AES/SL3) and/or `hf mf chk` key file (CRYPTO1/SL1) for mixed-mode cards. Key files are auto-detected by UID if not specified. If no given, UID will be used as filename", "notes": [ "hf mfp dump", - "hf mfp dump --keys hf-mf-066C8B78-key.bin -> MIFARE Plus with keys from specified file" + "hf mfp dump --keys hf-mfp-01020304-key.json", + "hf mfp dump --keys hf-mfp-01020304-key.json --mfc-keys hf-mf-01020304-key.bin", + "hf mfp dump -k ffffffffffffffffffffffffffffffff" ], "offline": false, "options": [ "-h, --help This help", "-f, --file Specify a filename for dump file", - "-k, --keys Specify a filename for keys file" + "--keys AES key file from `hf mfp chk --dump` (JSON)", + "-k, --key AES key for all sectors (16 hex bytes)", + "--mfc-keys MFC key file for SL1 sectors (.bin from `hf mf chk`)", + "--ns No save to file", + "-v, --verbose Verbose output" ], - "usage": "hf mfp dump [-h] [-f ] [-k ]" + "usage": "hf mfp dump [-hv] [-f ] [--keys ] [-k ] [--mfc-keys ] [--ns]" }, "hf mfp help": { "command": "hf mfp help", @@ -13835,8 +13960,8 @@ } }, "metadata": { - "commands_extracted": 791, + "commands_extracted": 798, "extracted_by": "PM3Help2JSON v1.00", - "extracted_on": "2026-02-24T15:41:26" + "extracted_on": "2026-03-11T21:39:07" } } diff --git a/doc/commands.md b/doc/commands.md index 58e8ecf03..fd30f27f2 100644 --- a/doc/commands.md +++ b/doc/commands.md @@ -275,6 +275,18 @@ Check column "offline" for their availability. |`hf 15 csetuid `|N |`Set UID for magic card` +### hf aliro + + { ALIRO digital access credentials... } + +|command |offline |description +|------- |------- |----------- +|`hf aliro help `|Y |`This help` +|`hf aliro list `|Y |`List ISO 14443A/7816 history` +|`hf aliro info `|N |`Get Aliro applet information` +|`hf aliro read `|N |`Run SELECT-AUTH0-AUTH1 and optional step-up document retrieval` + + ### hf cipurse { Cipurse transport Cards... } @@ -331,6 +343,7 @@ Check column "offline" for their availability. |`hf felica help `|Y |`This help` |`hf felica list `|Y |`List ISO 18092/FeliCa history` |`hf felica info `|N |`Tag information` +|`hf felica seacinfo `|N |`FeliCa SEAC tag information` |`hf felica raw `|N |`Send raw hex data to tag` |`hf felica rdbl `|N |`read block data from authentication-not-required Service.` |`hf felica reader `|N |`Act like an ISO18092/FeliCa reader` @@ -596,7 +609,7 @@ Check column "offline" for their availability. |`hf mfp list `|Y |`List MIFARE Plus history` |`hf mfp auth `|N |`Authentication` |`hf mfp chk `|N |`Check keys` -|`hf mfp dump `|N |`Dump MIFARE Plus tag to binary file` +|`hf mfp dump `|N |`Dump MIFARE Plus tag to file` |`hf mfp info `|N |`Tag information` |`hf mfp mad `|N |`Check and print MAD` |`hf mfp rdbl `|N |`Read blocks from card` @@ -671,10 +684,12 @@ Check column "offline" for their availability. |`hf mfdes createapp `|N |`Create Application` |`hf mfdes deleteapp `|N |`Delete Application` |`hf mfdes selectapp `|N |`Select Application ID` +|`hf mfdes selectisofid `|N |`Select file by ISO ID` |`hf mfdes changekey `|N |`Change Key` |`hf mfdes chkeysettings `|N |`Change Key Settings` |`hf mfdes getkeysettings`|N |`Get Key Settings` |`hf mfdes getkeyversions`|N |`Get Key Versions` +|`hf mfdes bruteisofid `|N |`Recover file ISO IDs by bruteforce` |`hf mfdes getfileids `|N |`Get File IDs list` |`hf mfdes getfileisoids `|N |`Get File ISO IDs list` |`hf mfdes lsfiles `|N |`Show all files list`