diff --git a/doc/commands.json b/doc/commands.json index fef451727..b6d53affc 100644 --- a/doc/commands.json +++ b/doc/commands.json @@ -1400,12 +1400,13 @@ "hf 14a sim -t 11 -> Javacard (JCOP)", "hf 14a sim -t 12 -> 4K Seos card", "hf 14a sim -t 13 -> MIFARE Ultralight C", - "hf 14a sim -t 14 -> MIFARE Ultralight AES" + "hf 14a sim -t 14 -> MIFARE Ultralight AES", + "hf 14a sim -t 15 -> MIFARE Plus" ], "offline": false, "options": [ "-h, --help This help", - "-t, --type <1-14> Simulation type to use", + "-t, --type <1-15> Simulation type to use", "-u, --uid <4|7|10> hex bytes UID", "-n, --num Exit simulation after blocks have been read by reader. 0 = infinite", "-x Performs the 'reader attack', nr/ar attack against a reader", @@ -1414,7 +1415,7 @@ "--1a1 <8|16> hex bytes ULC/ULAES Auth reply step1: ek(RndB)", "--1a2 <8|16> hex bytes ULC/ULAES Auth reply step2: ek(RndA')" ], - "usage": "hf 14a sim [-hxv] -t <1-14> [-u ] [-n ] [--sk] [--1a1 ] [--1a2 ]" + "usage": "hf 14a sim [-hxv] -t <1-15> [-u ] [-n ] [--sk] [--1a1 ] [--1a2 ]" }, "hf 14a simaid": { "command": "hf 14a simaid", @@ -2273,7 +2274,7 @@ "notes": [ "hf aliro read --reader-group-id 00112233445566778899AABBCCDDEEFF --reader-sub-group-id 00112233445566778899AABBCCDDEEFF --reader-private-key 00112233445566778899AABBCCDDEEFF00112233445566778899AABBCCDDEEFF", "hf aliro read --reader-group-id 00112233445566778899AABBCCDDEEFF --reader-private-key 00112233445566778899AABBCCDDEEFF00112233445566778899AABBCCDDEEFF --transaction-id 00112233445566778899AABBCCDDEEFF --k-persistent 00112233445566778899AABBCCDDEEFF00112233445566778899AABBCCDDEEFF --endpoint-public-key 04AABBCCDDEEFF00112233445566778899AABBCCDDEEFF00112233445566778899AABBCCDDEEFF00112233445566778899AABBCCDDEEFF00112233445566778899AABBCCDDEEFF --flow fast -a", - "hf aliro read --reader-group-id 00112233445566778899AABBCCDDEEFF --reader-private-key 00112233445566778899AABBCCDDEEFF00112233445566778899AABBCCDDEEFF --step-up-scopes matter1,non_access_extensions" + "hf aliro read --reader-group-id 00112233445566778899AABBCCDDEEFF --reader-private-key ./reader-private-key.pem --step-up-scopes matter1,non_access_extensions" ], "offline": false, "options": [ @@ -2281,14 +2282,14 @@ "-k, --k-persistent, --key-persistent, --kpersistent, --keypersistent, --kp Kpersistent (32 bytes, optional; used for fast cryptogram verification)", "-g, --reader-group-id, --readergroupid, --rgi Reader group identifier (16 bytes)", "-s, --reader-sub-group-id, --readersubid, --rsi Reader subgroup identifier (16 bytes, default: all zeroes)", - "-p, --reader-private-key, --readerprivkey, --rpk Reader private key (32 bytes, P-256)", + "-p, --reader-private-key, --readerprivkey, --rpk Reader private key (P-256): PEM, DER hex, scalar hex/base64, or file path", "-t, --transaction-id, --ti Transaction identifier (16 bytes, optional; random if omitted)", "-e, --endpoint-public-key, --endpointpublickey, --epk Endpoint public key for AUTH0 fast verification (32-byte X or 65-byte uncompressed)", "-f, --flow Transaction flow (default: step-up)", "--step-up-scopes Comma-separated step-up scopes (default: matter1)", "-a, --apdu Show APDU requests and responses" ], - "usage": "hf aliro read [-ha] [-k ] -g [-s ] -p [-t ] [-e ] [-f ] [--step-up-scopes ]" + "usage": "hf aliro read [-ha] [-k ] -g [-s ] -p [-t ] [-e ] [-f ] [--step-up-scopes ]" }, "hf cipurse aread": { "command": "hf cipurse aread", @@ -2724,52 +2725,72 @@ "notes": [ "hf felica auth1 --an 01 --acl 0000 --sn 01 --scl 8B00 --key AAAAAAAAAAAAAAAABBBBBBBBBBBBBBBB", "hf felica auth1 --an 01 --acl 0000 --sn 01 --scl 8B00 --key AAAAAAAAAAAAAAAABBBBBBBBBBBBBBBBAAAAAAAAAAAAAAAA", - "hf felica auth1 -i 11100910C11BC407 --an 01 --acl 0000 --sn 01 ..scl 8B00 --key AAAAAAAAAAAAAAAABBBBBBBBBBBBBBBB" + "hf felica auth1 --idm 11100910C11BC407 --an 01 --acl 0000 --sn 01 ..scl 8B00 --key AAAAAAAAAAAAAAAABBBBBBBBBBBBBBBB" ], "offline": false, "options": [ "-h, --help This help", "--an number of areas, 1 byte", "--acl area code list, 2 bytes", - "-i set custom IDm", + "--idm set custom IDm", "--sn number of service, 1 byte", "--scl service code list, 2 bytes", "-k, --key 3des key, 16 bytes", "-v, --verbose verbose output" ], - "usage": "hf felica auth1 [-hv] [--an ] [--acl ] [-i ] [--sn ] [--scl ] [-k ]" + "usage": "hf felica auth1 [-hv] [--an ] [--acl ] [--idm ] [--sn ] [--scl ] [-k ]" }, "hf felica auth2": { "command": "hf felica auth2", "description": "Complete mutual authentication. This command can only be executed subsquent to Auth1 INCOMPLETE / EXPERIMENTAL COMMAND!!! EXPERIMENTAL COMMAND - M2c/P2c will be not checked", "notes": [ "hf felica auth2 --cc 0102030405060708 --key AAAAAAAAAAAAAAAABBBBBBBBBBBBBBBB", - "hf felica auth2 -i 11100910C11BC407 --cc 0102030405060708 --key AAAAAAAAAAAAAAAABBBBBBBBBBBBBBBB" + "hf felica auth2 --idm 11100910C11BC407 --cc 0102030405060708 --key AAAAAAAAAAAAAAAABBBBBBBBBBBBBBBB" ], "offline": false, "options": [ "-h, --help This help", - "-i set custom IDm", + "--idm set custom IDm", "-c, --cc M3c card challenge, 8 bytes", "-k, --key 3des M3c decryption key, 16 bytes", "-v, --verbose verbose output" ], - "usage": "hf felica auth2 [-hv] [-i ] [-c ] [-k ]" + "usage": "hf felica auth2 [-hv] [--idm ] [-c ] [-k ]" + }, + "hf felica discnodes": { + "command": "hf felica discnodes", + "description": "Dump all existing Area Code and Service Code. Method: auto | request_code_list | search_service_code | request_service | read_without_encryption", + "notes": [ + "hf felica discnodes", + "hf felica discnodes --retry 5", + "hf felica discnodes --method request_service", + "hf felica discnodes --idm 11100910C11BC407" + ], + "offline": false, + "options": [ + "-h, --help This help", + "-r, --retry number of retries", + "-m, --method node discovery method", + "--idm use custom IDm" + ], + "usage": "hf felica discnodes [-h] [-r ] [-m ] [--idm ]" }, "hf felica dump": { "command": "hf felica dump", "description": "Dump all existing Area Code and Service Code. Only works on services that do not require authentication yet.", "notes": [ "hf felica dump", - "hf felica dump --retry 5" + "hf felica dump --retry 5", + "hf felica dump --idm 11100910C11BC407" ], "offline": false, "options": [ "-h, --help This help", "--no-auth read public services", - "-r, --retry number of retries" + "-r, --retry number of retries", + "--idm use custom IDm" ], - "usage": "hf felica dump [-h] [--no-auth] [-r ]" + "usage": "hf felica dump [-h] [--no-auth] [-r ] [--idm ]" }, "hf felica help": { "command": "hf felica help", @@ -2808,7 +2829,7 @@ "command": "hf felica liteauth", "description": "Authenticate", "notes": [ - "hf felica liteauth -i 11100910C11BC407", + "hf felica liteauth --idm 11100910C11BC407", "hf felica liteauth --key 46656c69436130313233343536616263", "hf felica liteauth --key 46656c69436130313233343536616263 -k", "hf felica liteauth -c 701185c59f8d30afeab8e4b3a61f5cc4 --key 46656c69436130313233343536616263" @@ -2818,10 +2839,10 @@ "-h, --help This help", "--key set card key, 16 bytes", "-c, set random challenge, 16 bytes", - "-i, set custom IDm", + "--idm set custom IDm", "-k, keep signal field ON after receive" ], - "usage": "hf felica liteauth [-hk] [--key ] [-c ] [-i ]" + "usage": "hf felica liteauth [-hk] [--key ] [-c ] [--idm ]" }, "hf felica litedump": { "command": "hf felica litedump", @@ -2832,10 +2853,10 @@ "offline": false, "options": [ "-h, --help This help", - "-i, set custom IDm", + "--idm set custom IDm", "--key set card key, 16 bytes" ], - "usage": "hf felica litedump [-h] [-i ] [--key ]" + "usage": "hf felica litedump [-h] [--idm ] [--key ]" }, "hf felica litesim": { "command": "hf felica litesim", @@ -2876,13 +2897,13 @@ "notes": [ "hf felica rdbl --sn 01 --scl 8B00 --bn 01 --ble 8000", "hf felica rdbl --sn 01 --scl 4B18 --bn 01 --ble 8000 -b", - "hf felica rdbl -i 01100910c11bc407 --sn 01 --scl 8B00 --bn 01 --ble 8000" + "hf felica rdbl --idm 01100910c11bc407 --sn 01 --scl 8B00 --bn 01 --ble 8000" ], "offline": false, "options": [ "-h, --help This help", "-b get all block list elements 00 -> FF", - "-i set custom IDm", + "--idm set custom IDm", "-l, --long use 3 byte block list element block number", "--sn number of service", "--scl service code list", @@ -2890,7 +2911,7 @@ "--ble block list element (def 2|3 bytes)", "-v, --verbose verbose output" ], - "usage": "hf felica rdbl [-hblv] [-i ] [--sn ] [--scl ] [--bn ] [--ble ]" + "usage": "hf felica rdbl [-hblv] [--idm ] [--sn ] [--scl ] [--bn ] [--ble ]" }, "hf felica reader": { "command": "hf felica reader", @@ -2912,29 +2933,29 @@ "notes": [ "hf felica resetmode", "hf felica resetmode -r 0001", - "hf felica resetmode -i 11100910C11BC407" + "hf felica resetmode --idm 11100910C11BC407" ], "offline": false, "options": [ "-h, --help This help", - "-i set custom IDm", + "--idm set custom IDm", "-r set custom reserve", "-v, --verbose verbose output" ], - "usage": "hf felica resetmode [-hv] [-i ] [-r ]" + "usage": "hf felica resetmode [-hv] [--idm ] [-r ]" }, "hf felica rqresponse": { "command": "hf felica rqresponse", "description": "Use this command to verify the existence of a card and its Mode. - current mode of the card is returned", "notes": [ - "hf felica rqresponse -i 11100910C11BC407" + "hf felica rqresponse --idm 11100910C11BC407" ], "offline": false, "options": [ "-h, --help This help", - "-i set custom IDm" + "--idm set custom IDm" ], - "usage": "hf felica rqresponse [-h] [-i ]" + "usage": "hf felica rqresponse [-h] [--idm ]" }, "hf felica rqservice": { "command": "hf felica rqservice", @@ -2942,7 +2963,7 @@ "notes": [ "hf felcia rqservice --node 01 --code FFFF", "hf felcia rqservice -a --code FFFF", - "hf felica rqservice -i 011204126417E405 --node 01 --code FFFF" + "hf felica rqservice --idm 011204126417E405 --node 01 --code FFFF" ], "offline": false, "options": [ @@ -2950,9 +2971,9 @@ "-a, --all auto node number mode, iterates through all nodes 1 < n < 32", "-n, --node Number of Node", "-c, --code Node Code List (little endian)", - "-i, --idm use custom IDm" + "--idm use custom IDm" ], - "usage": "hf felica rqservice [-ha] [-n ] [-c ] [-i ]" + "usage": "hf felica rqservice [-ha] [-n ] [-c ] [--idm ]" }, "hf felica rqspecver": { "command": "hf felica rqspecver", @@ -2960,44 +2981,46 @@ "notes": [ "hf felica rqspecver", "hf felica rqspecver -r 0001", - "hf felica rqspecver -i 11100910C11BC407" + "hf felica rqspecver --idm 11100910C11BC407" ], "offline": false, "options": [ "-h, --help This help", - "-i set custom IDm", + "--idm set custom IDm", "-r set custom reserve", "-v, --verbose verbose output" ], - "usage": "hf felica rqspecver [-hv] [-i ] [-r ]" + "usage": "hf felica rqspecver [-hv] [--idm ] [-r ]" }, "hf felica rqsyscode": { "command": "hf felica rqsyscode", "description": "Use this command to acquire System Code registered to the card. - if a card is divided into more than one System, this command acquires System Code of each System existing in the card.", "notes": [ "hf felica rqsyscode", - "hf felica rqsyscode -i 11100910C11BC407" + "hf felica rqsyscode --idm 11100910C11BC407" ], "offline": false, "options": [ "-h, --help This help", - "-i set custom IDm" + "--idm set custom IDm" ], - "usage": "hf felica rqsyscode [-h] [-i ]" + "usage": "hf felica rqsyscode [-h] [--idm ]" }, "hf felica scsvcode": { "command": "hf felica scsvcode", "description": "Dump all existing Area Code and Service Code.", "notes": [ "hf felica scsvcode", - "hf felica scsvcode --retry 5" + "hf felica scsvcode --retry 5", + "hf felica scsvcode --idm 11100910C11BC407" ], "offline": false, "options": [ "-h, --help This help", - "-r, --retry number of retries" + "-r, --retry number of retries", + "--idm use custom IDm" ], - "usage": "hf felica scsvcode [-h] [-r ]" + "usage": "hf felica scsvcode [-h] [-r ] [--idm ]" }, "hf felica seacinfo": { "command": "hf felica seacinfo", @@ -3031,20 +3054,20 @@ "description": "Use this command to write block data to authentication-not-required Service. - Mode shall be Mode0. - Un-/Ssuccessful == Status Flag1 and Flag2", "notes": [ "hf felica wrbl --sn 01 --scl CB10 --bn 01 --ble 8001 -d 0102030405060708090A0B0C0D0E0F10", - "hf felica wrbl -i 01100910c11bc407 --sn 01 --scl CB10 --bn 01 --ble 8001 -d 0102030405060708090A0B0C0D0E0F10" + "hf felica wrbl --idm 01100910c11bc407 --sn 01 --scl CB10 --bn 01 --ble 8001 -d 0102030405060708090A0B0C0D0E0F10" ], "offline": false, "options": [ "-h, --help This help", "-d, --data data, 16 hex bytes", - "-i set custom IDm", + "--idm set custom IDm", "--sn number of service", "--scl service code list", "--bn number of block", "--ble block list element (def 2|3 bytes)", "-v, --verbose verbose output" ], - "usage": "hf felica wrbl [-hv] [-d ] [-i ] [--sn ] [--scl ] [--bn ] [--ble ]" + "usage": "hf felica wrbl [-hv] [-d ] [--idm ] [--sn ] [--scl ] [--bn ] [--ble ]" }, "hf fido assert": { "command": "hf fido assert", @@ -3241,29 +3264,37 @@ }, "hf gallagher clone": { "command": "hf gallagher clone", - "description": "Clone Gallagher credentials to a writable DESFire card Specify site key is required if using non-default key Key, lengths for the different crypto: DES 8 bytes 2TDEA or AES 16 bytes 3TDEA 24 bytes AID, default finds lowest available in range 0x??81F4, where ?? >= 0x20.", + "description": "Clone Gallagher credentials to a writable DESFire or MIFARE Classic card Use -c for MIFARE Classic cards Specify site key is required if using non-default key DESFire key lengths for the different crypto: DES 8 bytes 2TDEA or AES 16 bytes 3TDEA 24 bytes AID, default finds lowest available in range 0x??81F4, where ?? >= 0x20.", "notes": [ - "hf gallagher clone --rc 1 --fc 22 --cn 3333 --il 4 --sitekey 00112233445566778899aabbccddeeff" + "hf gallagher clone --rc 1 --fc 22 --cn 3333 --il 4 --sitekey 00112233445566778899aabbccddeeff", + "hf gallagher clone -c --rc 1 --fc 22 --cn 3333 --il 4", + "hf gallagher clone -c --rc 12 --fc 4919 --cn 61453 --il 1 --sector 15 --nomes", + "hf gallagher clone -c --rc 1 --fc 22 --cn 3333 --il 4 --nomad" ], "offline": false, "options": [ "-h, --help This help", - "-n, --keynum PICC key number [default = 0]", - "-t, --algo PICC crypt algo: DES, 2TDEA, 3TDEA, AES", - "-k, --key Key for authentication to the PICC to create applications", + "-c, --classic Write to MIFARE Classic card instead of DESFire", + "-n, --keynum DESFire: PICC key number [default = 0]", + "-t, --algo DESFire: PICC crypt algo", + "-k, --key DESFire: Key for authentication to the PICC", "--rc Region code. 4 bits max", "--fc Facility code. 2 bytes max", "--cn Card number. 3 bytes max", "--il Issue level. 4 bits max", - "--aid Application ID to write (3 bytes) [default automatically chooses]", + "--aid DESFire: Application ID to write (3 bytes) [default auto]", "--sitekey Site key to compute diversified keys (16 bytes)", - "--cadkey Custom AES key 0 to modify the Card Application Directory (16 bytes)", - "--nocadupdate Don't modify the Card Application Directory (only creates the app)", - "--noappcreate Don't create the application (only modifies the CAD)", + "--cadkey DESFire: Custom AES key 0 for CAD (16 bytes)", + "--nocadupdate DESFire: Don't modify the CAD (only creates the app)", + "--noappcreate DESFire: Don't create the app (only modifies the CAD)", "--apdu Show APDU requests and responses", - "-v, --verbose Verbose output" + "-v, --verbose Verbose output", + "--sector Classic: Sector number [default = 15]", + "--cadsector Classic: CAD sector number [default = 0, skip]", + "--nomes Classic: Don't include MIFARE Enhanced Security block", + "--nomad Classic: Don't update the MAD" ], - "usage": "hf gallagher clone [-hv] [-n ] [-t ] [-k ] --rc --fc --cn --il [--aid ] [--sitekey ] [--cadkey ] [--nocadupdate] [--noappcreate] [--apdu]" + "usage": "hf gallagher clone [-hcv] [-n ] [-t ] [-k ] --rc --fc --cn --il [--aid ] [--sitekey ] [--cadkey ] [--nocadupdate] [--noappcreate] [--apdu] [--sector ] [--cadsector ] [--nomes] [--nomad]" }, "hf gallagher decode": { "command": "hf gallagher decode", @@ -3332,10 +3363,11 @@ }, "hf gallagher help": { "command": "hf gallagher help", - "description": "help This help diversifykey Diversify Gallagher key decode Decode Gallagher credential block encode Encode Gallagher credential block --------------------------------------------------------------------------------------- hf gallagher reader available offline: no Read a Gallagher DESFire tag from the Card Application Directory, CAD Specify site key is required if using non-default key", + "description": "help This help diversifykey Diversify Gallagher key decode Decode Gallagher credential block encode Encode Gallagher credential block test Test the function of Gallagher Mifare Core --------------------------------------------------------------------------------------- hf gallagher reader available offline: no Read a Gallagher tag from the Card Application Directory, CAD Specify site key is required if using non-default key", "notes": [ - "hf gallagher reader -@ -> continuous reader mode", - "hf gallagher reader --aid 2081f4 --sitekey 00112233445566778899aabbccddeeff -> skip CAD" + "hf gallagher reader -@ -> DESFIRE(default): continuous reader mode", + "hf gallagher reader -c -@ -> CLASSIC: continuous reader mode", + "hf gallagher reader --aid 2081f4 --sitekey 00112233445566778899aabbccddeeff -> DESFIRE: skip CAD" ], "offline": true, "options": [ @@ -3344,13 +3376,99 @@ "--sitekey Site key to compute diversified keys (16 bytes)", "-@, --continuous Continuous reader mode", "--apdu Show APDU requests and responses", + "-v, --verbose Verbose output", + "-c, --classic Read Gallagher mifare Classic card" + ], + "usage": "hf gallagher reader [-h@vc] [--aid ] [--sitekey ] [--apdu]" + }, + "hf gallagher test": { + "command": "hf gallagher test", + "description": "Test the function of Gallagher Mifare Core", + "notes": [ + "hf gallagher test" + ], + "offline": true, + "options": [ + "-h, --help This help" + ], + "usage": "hf gallagher test [-h]" + }, + "hf gst help": { + "command": "hf gst help", + "description": "----------- ----------------------- General ----------------------- help This help list List ISO 14443A/7816 history test Perform self tests --------------------------------------------------------------------------------------- hf gst list available offline: yes Alias of `trace list -t 7816` with selected protocol data to annotate trace buffer You can load a trace from file (see `trace load -h`) or it be downloaded from device by default It accepts all other arguments of `trace list`. Note that some might not be relevant for this specific protocol", + "notes": [ + "hf gst list --frame -> show frame delay times", + "hf gst list -1 -> use trace buffer" + ], + "offline": true, + "options": [ + "-h, --help This help", + "-1, --buffer use data from trace buffer", + "--frame show frame delay times", + "-c mark CRC bytes", + "-r show relative times (gap and duration)", + "-u display times in microseconds instead of clock cycles", + "-x show hexdump to convert to pcap(ng)", + "or to import into Wireshark using encapsulation type \"ISO 14443\"", + "-f, --file filename of dictionary" + ], + "usage": "hf gst list [-h1crux] [--frame] [-f ]" + }, + "hf gst info": { + "command": "hf gst info", + "description": "Select OSE / Smart Tap applet and print capabilities.", + "notes": [ + "hf gst info", + "hf gst info --select-smarttap2 yes -a" + ], + "offline": false, + "options": [ + "-h, --help This help", + "--select-smarttap2 Whether to perform Smart Tap applet select (default: auto)", + "-a, --apdu Show APDU requests and responses" + ], + "usage": "hf gst info [-ha] [--select-smarttap2 ]" + }, + "hf gst read": { + "command": "hf gst read", + "description": "Execute Google Smart Tap read flow and print parsed pass objects.", + "notes": [ + "hf gst read --cid 20180608 --rpk gst.google.der", + "hf gst read --cid 13380028 --rpk gst.passkit.der", + "hf gst read --cid 20180608 --rpk \"" + ], + "offline": false, + "options": [ + "-h, --help This help", + "-c, --collector-id, --collectorid, --cid Collector identifier (32-bit value)", + "-p, --reader-private-key, --readerprivkey, --rpk Reader private key: PEM, DER hex, scalar hex/base64, or file path", + "--key-version, --keyversion, --kv Long-term key version (default: 1)", + "--session-id, --sid Session id (8 bytes, random if omitted)", + "--reader-nonce, --nonce Reader nonce (32 bytes, random if omitted)", + "--reader-ephemeral-private-key, --ephemeral-privkey, --epk Reader ephemeral private key (32 bytes, random if omitted)", + "--mode Reader mode (default: pass-over-payment)", + "--select-smarttap2 Whether to perform Smart Tap applet select (default: auto)", + "--no-live-auth Use zeroed handset nonce for reader signature", + "-a, --apdu Show APDU requests and responses", "-v, --verbose Verbose output" ], - "usage": "hf gallagher reader [-h@v] [--aid ] [--sitekey ] [--apdu]" + "usage": "hf gst read [-hav] -c -p [--key-version ] [--session-id ] [--reader-nonce ] [--reader-ephemeral-private-key ] [--mode ] [--select-smarttap2 ] [--no-live-auth]" + }, + "hf gst test": { + "command": "hf gst test", + "description": "Perform self tests", + "notes": [ + "hf gst test" + ], + "offline": true, + "options": [ + "-h, --help This help" + ], + "usage": "hf gst test [-h]" }, "hf help": { "command": "hf help", - "description": "-------- ----------------------- High Frequency ----------------------- 14a { ISO14443A RFIDs... } 14b { ISO14443B RFIDs... } 15 { ISO15693 RFIDs... } aliro { ALIRO digital access credentials... } cipurse { Cipurse transport Cards... } epa { German Identification Card... } emrtd { Machine Readable Travel Document... } felica { ISO18092 / FeliCa RFIDs... } fido { FIDO and FIDO2 authenticators... } fudan { Fudan RFIDs... } gallagher { Gallagher DESFire RFIDs... } iclass { ICLASS RFIDs... } ict { ICT MFC/DESfire RFIDs... } jooki { Jooki RFIDs... } ksx6924 { KS X 6924 (T-Money, Snapper+) RFIDs } legic { LEGIC RFIDs... } lto { LTO Cartridge Memory RFIDs... } mf { MIFARE RFIDs... } mfp { MIFARE Plus RFIDs... } mfu { MIFARE Ultralight RFIDs... } mfdes { MIFARE Desfire RFIDs... } ntag424 { NXP NTAG 4242 DNA RFIDs... } saflok { Saflok MFC RFIDs... } seos { SEOS RFIDs... } st25ta { ST25TA RFIDs... } tesla { TESLA Cards... } texkom { Texkom RFIDs... } thinfilm { Thinfilm RFIDs... } topaz { TOPAZ (NFC Type 1) RFIDs... } vas { Apple Value Added Service... } waveshare { Waveshare NFC ePaper... } xerox { Fuji/Xerox cartridge RFIDs... } ----------- --------------------- General --------------------- help This help list List protocol data in trace buffer search Search for known HF tags --------------------------------------------------------------------------------------- hf list available offline: yes Alias of `trace list -t raw` with selected protocol data to annotate trace buffer You can load a trace from file (see `trace load -h`) or it be downloaded from device by default It accepts all other arguments of `trace list`. Note that some might not be relevant for this specific protocol", + "description": "-------- ----------------------- High Frequency ----------------------- 14a { ISO14443A RFIDs... } 14b { ISO14443B RFIDs... } 15 { ISO15693 RFIDs... } aliro { ALIRO digital access credentials... } cipurse { Cipurse transport Cards... } epa { German Identification Card... } emrtd { Machine Readable Travel Document... } felica { ISO18092 / FeliCa RFIDs... } fido { FIDO and FIDO2 authenticators... } fudan { Fudan RFIDs... } gallagher { Gallagher DESFire RFIDs... } gst { Google Smart Tap passes... } iclass { ICLASS RFIDs... } ict { ICT MFC/DESfire RFIDs... } jooki { Jooki RFIDs... } ksx6924 { KS X 6924 (T-Money, Snapper+) RFIDs } legic { LEGIC RFIDs... } lto { LTO Cartridge Memory RFIDs... } mf { MIFARE RFIDs... } mfp { MIFARE Plus RFIDs... } mfu { MIFARE Ultralight RFIDs... } mfdes { MIFARE Desfire RFIDs... } ntag424 { NXP NTAG 4242 DNA RFIDs... } saflok { Saflok MFC RFIDs... } seos { SEOS RFIDs... } st25ta { ST25TA RFIDs... } tesla { TESLA Cards... } texkom { Texkom RFIDs... } thinfilm { Thinfilm RFIDs... } topaz { TOPAZ (NFC Type 1) RFIDs... } vas { Apple Value Added Service... } waveshare { Waveshare NFC ePaper... } xerox { Fuji/Xerox cartridge RFIDs... } ----------- --------------------- General --------------------- help This help list List protocol data in trace buffer search Search for known HF tags --------------------------------------------------------------------------------------- hf list available offline: yes Alias of `trace list -t raw` with selected protocol data to annotate trace buffer You can load a trace from file (see `trace load -h`) or it be downloaded from device by default It accepts all other arguments of `trace list`. Note that some might not be relevant for this specific protocol", "notes": [ "hf list --frame -> show frame delay times", "hf list -1 -> use trace buffer" @@ -3369,6 +3487,29 @@ ], "usage": "hf list [-h1crux] [--frame] [-f ]" }, + "hf iclass blacktears": { + "command": "hf iclass blacktears", + "description": "Tear off the iCLASS (new-silicon only) configuration block to set non-secure page mode. Make sure you know the target card credit key. Typical `--ki 1` or `--ki 3`", + "notes": [ + "hf iclass blacktears -k 001122334455667B", + "hf iclass blacktears --ki 1" + ], + "offline": false, + "options": [ + "-h, --help This help", + "-k, --key Access key as 8 hex bytes", + "--ki Key index to select key from memory 'hf iclass managekeys'", + "--credit key is assumed to be the credit key", + "-s tearoff delay start (in us) must be between 1 and 43000 (43ms). Precision is about 1/3 us", + "-i tearoff delay increment (in us) - default 10", + "-e tearoff delay end (in us) must be a higher value than the start delay", + "-o, --otp Custom OTP value as 2 hex bytes", + "--raw no computations applied to key", + "-v, --verbose verbose output", + "--shallow use shallow (ASK) reader modulation instead of OOK" + ], + "usage": "hf iclass blacktears [-hv] [-k ] [--ki ] [--credit] [-s ] [-i ] [-e ] [-o ] [--raw] [--shallow]" + }, "hf iclass calcnewkey": { "command": "hf iclass calcnewkey", "description": "Calculate new keys for updating (blocks 3 & 4)", @@ -4928,21 +5069,25 @@ }, "hf mf encodehid": { "command": "hf mf encodehid", - "description": "Encode binary wiegand to card Use either --bin or --wiegand/--fc/--cn", + "description": "Encode HID/Wiegand data to a MIFARE Classic card Use one of --bin, --raw, --new, or --wiegand/--fc/--cn", "notes": [ "hf mf encodehid --bin 10001111100000001010100011 -> FC 31 CN 337 (H10301)", + "hf mf encodehid --raw 063E02A3", + "hf mf encodehid --new 068F80A8C0", "hf mf encodehid -w H10301 --fc 31 --cn 337" ], "offline": false, "options": [ "-h, --help This help", "--bin Binary string i.e 0001001001", + "--raw HID raw hex with sentinel bit already present", + "--new new ASN.1 PACS hex from `wiegand encode --new`", "--fc facility code", "--cn card number", "-w, --wiegand see `wiegand list` for available formats", "-v, --verbose verbose output" ], - "usage": "hf mf encodehid [-hv] [--bin ] [--fc ] [--cn ] [-w ]" + "usage": "hf mf encodehid [-hv] [--bin ] [--raw ] [--new ] [--fc ] [--cn ] [-w ]" }, "hf mf esave": { "command": "hf mf esave", @@ -5383,7 +5528,7 @@ }, "hf mf keygen": { "command": "hf mf keygen", - "description": "Generate key table for some known KDFs Available KDFs: 0 - Saflok / Maid 1 - MIZIP 2 - Disney Infinity 3 - Skylanders 4 - Bambu Lab Filament Spool 5 - Snapmaker Filament Spool", + "description": "Generate key table for some known KDFs Available KDFs: 0 - Saflok / Maid 1 - MIZIP 2 - Disney Infinity 3 - Skylanders 4 - Bambu Lab Filament Spool 5 - Snapmaker Filament Spool 6 - Vanderbilt ACT 7 - Kale", "notes": [ "hf mf keygen -r -k 0", "hf mf keygen -r -d -k 0", @@ -8660,30 +8805,47 @@ "options": [ "-h, --help This help", "--pid PID, pass type id", - "-k, --key path to terminal private key file", + "-k, --key, --file, --reader-private-key, --readerprivkey, --rpk Terminal private key: PEM, DER hex, scalar hex/base64, or file path", "-d, --data cryptogram to decrypt" ], - "usage": "hf vas decrypt [-h] [--pid ] [-k ] [-d ]" + "usage": "hf vas decrypt [-h] [--pid ] [-k ] [-d ]" }, "hf vas help": { "command": "hf vas help", - "description": "-------- ----------- Value Added Service ----------- help This help -------- ----------------- General ----------------- decrypt Decrypt a previously captured VAS cryptogram --------------------------------------------------------------------------------------- hf vas reader available offline: no Read and decrypt Value Added Services (VAS) message", + "description": "-------- ----------- Value Added Service ----------- help This help -------- ----------------- General ----------------- decrypt Decrypt a previously captured VAS cryptogram --------------------------------------------------------------------------------------- hf vas info available offline: no Select VAS applet and print capabilities.", "notes": [ - "hf vas reader --url https://example.com -> URL Only mode", - "hf vas reader --pid pass.com.passkit.pksamples.nfcdemo -k vas.passkit.der -@", - "hf vas reader --pid pass.com.pronto.zebra-wallet-pass.demo -k vas.zebra.der -@", - "hf vas reader --pid pass.com.springcard.springblue.generic -k vas.springcard.der -@" + "hf vas info", + "hf vas info -a" ], "offline": true, "options": [ "-h, --help This help", - "--pid PID, pass type id", - "-k, --key path to terminal private key file", + "-a, --apdu Show APDU requests and responses" + ], + "usage": "hf vas info [-ha]" + }, + "hf vas reader": { + "command": "hf vas reader", + "description": "Read and decrypt Value Added Services (VAS) message", + "notes": [ + "hf vas reader --url https://example.com -> URL Only mode", + "hf vas reader --pid pass.com.passkit.pksamples.nfcdemo -k vas.passkit.der -@", + "hf vas reader --pid pass.com.pronto.zebra-wallet-pass.demo -k vas.zebra.der -@", + "hf vas reader --pid pass.com.springcard.springblue.generic -k vas.springcard.der -@", + "hf vas reader --pid pass.id.one --pid pass.id.two -k key.one.der -k key.two.der", + "hf vas reader --mode vasandpay --pid pass.id -k key.der" + ], + "offline": false, + "options": [ + "-h, --help This help", + "--pid PID, pass type id (repeat --pid for multiple values)", + "-k, --key, --file, --reader-private-key, --readerprivkey, --rpk Terminal private key (repeat --key for multiple values)", "--url a URL to provide to the mobile device", + "--mode VAS mode used in ECP and GET DATA capabilities", "-@ continuous mode", "-v, --verbose Verbose output" ], - "usage": "hf vas reader [-h@v] [--pid ] [-k ] [--url ]" + "usage": "hf vas reader [-h@v] [--pid ]... [-k ]... [--url ] [--mode ]" }, "hf waveshare help": { "command": "hf waveshare help", @@ -10317,6 +10479,8 @@ "description": "clone a HID Prox tag to a T55x7, Q5/T5555 or EM4305/4469 tag. Tag must be on the antenna when issuing this command.", "notes": [ "lf hid clone -r 2006ec0c86 -> write raw value for T55x7 tag (HID 10301 26 bit)", + "lf hid clone --bin 10001111100000001010100011 -> write binary HID payload for T55x7 tag", + "lf hid clone --new 068F80A8C0 -> write PACS-encoded HID payload for T55x7 tag", "lf hid clone -r 2e0ec00c87 -> write raw value for T55x7 tag (HID Corporate 35 bit)", "lf hid clone -r 01f0760643c3 -> write raw value for T55x7 tag (HID P10001 40 bit)", "lf hid clone -r 01400076000c86 -> write raw value for T55x7 tag (HID Corporate 48 bit)", @@ -10335,9 +10499,10 @@ "-r, --raw raw bytes", "--q5 optional - specify writing to Q5/T5555 tag", "--em optional - specify writing to EM4305/4469 tag", - "--bin Binary string i.e 0001001001" + "--bin Binary string i.e 0001001001", + "--new new ASN.1 PACS hex from `wiegand encode --new`" ], - "usage": "lf hid clone [-h] [-w ] [--fc ] [--cn ] [-i ] [-o ] [-r ] [--q5] [--em] [--bin ]" + "usage": "lf hid clone [-h] [-w ] [--fc ] [--cn ] [-i ] [-o ] [-r ] [--q5] [--em] [--bin ] [--new ]" }, "lf hid help": { "command": "lf hid help", @@ -10369,9 +10534,9 @@ "description": "Enables simulation of HID card with card number. Simulation runs until the button is pressed or another USB command is issued.", "notes": [ "lf hid sim -r 2006ec0c86 -> HID 10301 26 bit", + "lf hid sim --bin 10001111100000001010100011", + "lf hid sim --new 068F80A8C0", "lf hid sim -r 2e0ec00c87 -> HID Corporate 35 bit", - "lf hid sim -r 01f0760643c3 -> HID P10001 40 bit", - "lf hid sim -r 01400076000c86 -> HID Corporate 48 bit", "lf hid sim -w H10301 --fc 118 --cn 1603 -> HID 10301 26 bit" ], "offline": false, @@ -10382,9 +10547,11 @@ "--cn card number", "-i issue level", "-o, --oem OEM code", - "-r, --raw raw bytes" + "-r, --raw raw bytes", + "--bin Binary string i.e 0001001001", + "--new new ASN.1 PACS hex from `wiegand encode --new`" ], - "usage": "lf hid sim [-h] [-w ] [--fc ] [--cn ] [-i ] [-o ] [-r ]" + "usage": "lf hid sim [-h] [-w ] [--fc ] [--cn ] [-i ] [-o ] [-r ] [--bin ] [--new ]" }, "lf hid watch": { "command": "lf hid watch", @@ -13917,14 +14084,14 @@ "description": "Decode raw hex or binary to wiegand format", "notes": [ "wiegand decode --raw 2006F623AE", - "wiegand decode --new 06BD88EB80 -> 4..8 bytes, new padded format" + "wiegand decode --new 06BD88EB80 -> 4..13 bytes, new ASN.1 encoded format" ], "offline": true, "options": [ "-h, --help This help", "-r, --raw raw hex to be decoded", "-b, --bin binary string to be decoded", - "-n, --new new padded pacs as raw hex to be decoded", + "-n, --new new ASN.1 encoded data as raw hex to be decoded", "-f, --force skip preabmle checking, brute force all possible lengths for raw hex input" ], "usage": "wiegand decode [-hf] [-r ] [-b ] [-n ]" @@ -13934,19 +14101,24 @@ "description": "Encode wiegand formatted number to raw hex", "notes": [ "wiegand encode --fc 101 --cn 1337 -> show all formats", - "wiegand encode -w H10301 --fc 101 --cn 1337 -> H10301 format" + "wiegand encode -w H10301 --fc 101 --cn 1337 -> H10301 format", + "wiegand encode --bin 1 -> raw wiegand hex with sentinel", + "wiegand encode -w H10301 --fc 123 --cn 4567 --new -> new ASN.1 encoded format" ], "offline": true, "options": [ "-h, --help This help", + "-b, --bin binary string to be encoded", "--fc facility number", "--cn card number", "--issue issue level", "--oem OEM code", "-w, --wiegand see `wiegand list` for available formats", - "--pre add HID ProxII preamble to wiegand output" + "-n, --new encode to new ASN.1 encoded format", + "--pre add HID ProxII preamble to wiegand output", + "-v, --verbose verbose output" ], - "usage": "wiegand encode [-h] [--fc ] --cn [--issue ] [--oem ] [-w ] [--pre]" + "usage": "wiegand encode [-hnv] [-b ] [--fc ] [--cn ] [--issue ] [--oem ] [-w ] [--pre]" }, "wiegand help": { "command": "wiegand help", @@ -13962,8 +14134,8 @@ } }, "metadata": { - "commands_extracted": 798, + "commands_extracted": 806, "extracted_by": "PM3Help2JSON v1.00", - "extracted_on": "2026-03-11T21:39:07" + "extracted_on": "2026-03-20T02:30:24" } } diff --git a/doc/commands.md b/doc/commands.md index fd30f27f2..f6cff970e 100644 --- a/doc/commands.md +++ b/doc/commands.md @@ -350,6 +350,7 @@ Check column "offline" for their availability. |`hf felica sniff `|N |`Sniff ISO 18092/FeliCa traffic` |`hf felica wrbl `|N |`write block data to an authentication-not-required Service.` |`hf felica dump `|N |`Wait for and try dumping FeliCa` +|`hf felica discnodes `|N |`discover Area Code and Service Code nodes.` |`hf felica rqservice `|N |`verify the existence of Area and Service, and to acquire Key Version.` |`hf felica rqresponse `|N |`verify the existence of a card and its Mode.` |`hf felica scsvcode `|N |`acquire Area Code and Service Code.` @@ -399,12 +400,26 @@ Check column "offline" for their availability. |command |offline |description |------- |------- |----------- |`hf gallagher help `|Y |`This help` -|`hf gallagher reader `|N |`Read & decode all Gallagher credentials on a DESFire card` -|`hf gallagher clone `|N |`Add Gallagher credentials to a DESFire card` +|`hf gallagher reader `|N |`Read & decode all Gallagher credentials on a DESFire or Classic card` +|`hf gallagher clone `|N |`Clone Gallagher credentials to a DESFire or Classic card` |`hf gallagher delete `|N |`Delete Gallagher credentials from a DESFire card` |`hf gallagher diversifykey`|Y |`Diversify Gallagher key` |`hf gallagher decode `|Y |`Decode Gallagher credential block` |`hf gallagher encode `|Y |`Encode Gallagher credential block` +|`hf gallagher test `|Y |`Test the function of Gallagher Mifare Core` + + +### hf gst + + { Google Smart Tap passes... } + +|command |offline |description +|------- |------- |----------- +|`hf gst help `|Y |`This help` +|`hf gst list `|Y |`List ISO 14443A/7816 history` +|`hf gst test `|Y |`Perform self tests` +|`hf gst info `|N |`Get Google Smart Tap applet information` +|`hf gst read `|N |`Read and decode Google Smart Tap pass objects` ### hf iclass @@ -431,6 +446,7 @@ Check column "offline" for their availability. |`hf iclass legrec `|N |`Recovers 24 bits of the diversified key of a legacy card provided a valid nr-mac combination` |`hf iclass legbrute `|Y |`Bruteforces 40 bits of a partial diversified key, provided 24 bits of the key and two valid nr-macs` |`hf iclass unhash `|Y |`Reverses a diversified key to retrieve hash0 pre-images after DES encryption` +|`hf iclass blacktears `|N |`Automated tearoff attack on new silicon cards to enable non-secure page mode` |`hf iclass sim `|N |`Simulate iCLASS tag` |`hf iclass eload `|N |`Upload file into emulator memory` |`hf iclass esave `|N |`Save emulator memory to file` @@ -837,6 +853,7 @@ Check column "offline" for their availability. |command |offline |description |------- |------- |----------- |`hf vas help `|Y |`This help` +|`hf vas info `|N |`Get VAS applet information` |`hf vas reader `|N |`Read and decrypt VAS message` |`hf vas decrypt `|Y |`Decrypt a previously captured VAS cryptogram`