From 6af1a8e4325830dfb626a7edfef4b0bdc4f8a513 Mon Sep 17 00:00:00 2001 From: iceman1001 Date: Sat, 11 Apr 2026 09:04:55 +0700 Subject: [PATCH] updated help text for `lf realy --- client/src/cmdlf.c | 25 +++-- client/src/pm3line_vocabulary.h | 6 +- doc/commands.json | 186 +++++++++++++++++++++++++++++--- doc/commands.md | 6 ++ 4 files changed, 194 insertions(+), 29 deletions(-) diff --git a/client/src/cmdlf.c b/client/src/cmdlf.c index c21a56318..5ebdf31d4 100644 --- a/client/src/cmdlf.c +++ b/client/src/cmdlf.c @@ -1824,19 +1824,24 @@ static int lf_relay_rdr(const char *ip, uint16_t port) { int CmdLFRelay(const char *Cmd) { CLIParserContext *ctx; CLIParserInit(&ctx, "lf relay", - "Relay LF signal between two Proxmark3 devices over TCP.\n" - "By default it uses PORT 8000.\n" - "One device acts as a Tag Proxy, the other as a Reader Client.", - "lf relay --tag -s 7000\n" - "lf relay --rdr --ip 192.168.1.141" - ); + "Relay LF signal between two Proxmark3 devices over TCP.\n" + "By default it uses PORT 8000 and uses 40000 samples from Graphbuffer\n" + " --rdr : Reading device, act as IP client and reads LF tag and sends data\n" + " --tag : Simulation device, act as IP server and simulates relayed data\n", + _WHITE_("Device A, reading LF tag, client") "\n" + "lf relay --rdr --ip 192.168.1.141 -> Client, connect to IP 192.168.1.141:8000\n" + "lf relay --rdr --ip 192.168.1.141 -p 18111 -> Client, connect to IP 192.168.1.141:18111 \n\n" + _WHITE_("Device B, simulate LF tag, server") "\n" + "lf relay --tag -p 8111 -> Server listening port 8111, recv 40000 samples\n" + "lf relay --tag -s 10000 -> Server listening port 8000, recv 10000 samples\n" + ); void *argtable[] = { arg_param_begin, - arg_lit0(NULL, "tag", "Act as Tag Proxy (Server)"), - arg_lit0(NULL, "rdr", "Act as Reader Client (Connects to Proxy)"), - arg_str0("i", "ip", "", "Target IP address for Reader mode"), - arg_u64_0("s", "samples", "", "Number of samples to collect (default 40000)"), + arg_lit0(NULL, "tag", "Simulation device, act as Server"), + arg_lit0(NULL, "rdr", "Sniffing device, act as client"), + arg_str0("i", "ip", "", "Target IPv4 address to send data to. Used with `--rdr`"), + arg_u64_0("s", "samples", "", "Number of samples to collect (def: 40000)"), arg_u64_0("p", "port", "", "Port number (def: 8000)"), arg_param_end }; diff --git a/client/src/pm3line_vocabulary.h b/client/src/pm3line_vocabulary.h index 307a65e0d..be7ee4591 100644 --- a/client/src/pm3line_vocabulary.h +++ b/client/src/pm3line_vocabulary.h @@ -293,6 +293,7 @@ const static vocabulary_t vocabulary[] = { { 0, "hf gst info" }, { 0, "hf gst read" }, { 1, "hf secc help" }, + { 0, "hf secc info" }, { 0, "hf secc sim" }, { 0, "hf secc sniff" }, { 1, "hf iclass help" }, @@ -435,6 +436,7 @@ const static vocabulary_t vocabulary[] = { { 0, "hf mf encodehid" }, { 1, "hf mfp help" }, { 1, "hf mfp list" }, + { 1, "hf mfp acl" }, { 0, "hf mfp auth" }, { 0, "hf mfp chk" }, { 0, "hf mfp dump" }, @@ -620,6 +622,7 @@ const static vocabulary_t vocabulary[] = { { 0, "lf config" }, { 0, "lf cmdread" }, { 0, "lf read" }, + { 0, "lf relay" }, { 1, "lf search" }, { 0, "lf sim" }, { 0, "lf simask" }, @@ -1024,10 +1027,10 @@ const static vocabulary_t vocabulary[] = { { 0, "script run hf_ntag_bruteforce.lua" }, { 0, "script run hf_ntag_dt.lua" }, { 0, "script run init_rdv4.lua" }, - { 0, "script run kybercrystals.lua" }, { 0, "script run lf_awid_bulkclone.lua" }, { 0, "script run lf_electra.lua" }, { 0, "script run lf_em4100_bulk.lua" }, + { 0, "script run lf_em4x05_kybercrystals.lua" }, { 0, "script run lf_em_tearoff.lua" }, { 0, "script run lf_em_tearoff_protect.lua" }, { 0, "script run lf_hid_bulkclone.lua" }, @@ -1046,7 +1049,6 @@ const static vocabulary_t vocabulary[] = { { 0, "script run ntag_clean.lua" }, { 0, "script run ntag_getsig.lua" }, { 0, "script run ntag_hammertime.lua" }, - { 0, "script run paxton_clone.lua" }, { 0, "script run data_tracetest.lua" }, { 0, "script run hf_read.lua" }, { 0, "script run lf_t55xx_defaultask.lua" }, diff --git a/doc/commands.json b/doc/commands.json index 111422cb0..1d338755c 100644 --- a/doc/commands.json +++ b/doc/commands.json @@ -3523,7 +3523,7 @@ "--ki Key index to select key from memory 'hf iclass managekeys'", "--credit key is assumed to be the credit key", "-s tearoff delay start (in us) must be between 1 and 43000 (43ms). Precision is about 1/3 us", - "-i tearoff delay increment (in us) - default 10", + "-i tearoff delay increment (in us) - default 5", "-e tearoff delay end (in us) must be a higher value than the start delay", "-o, --otp Custom OTP value as 2 hex bytes", "--dns Do not stabilize the bits, and return the raw dump of the block after tearoff", @@ -3805,7 +3805,7 @@ }, "hf iclass legbrute": { "command": "hf iclass legbrute", - "description": "This command takes sniffed trace data and a partial raw key and bruteforces the remaining 40 bits of the raw key. Complete 40 bit keyspace is 1'099'511'627'776 and command is locked down to max 16 threads currently. A possible worst case scenario on 16 threads estimates XXX days YYY hours MMM minutes.", + "description": "This command takes sniffed trace data and a partial raw key and bruteforces the remaining 40 bits of the raw key. Complete 40 bit keyspace is 1'099'511'627'776.", "notes": [ "hf iclass legbrute --epurse feffffffffffffff --macs1 1306cad9b6c24466 --macs2 f0bf905e35f97923 --pk B4F12AADC5301225" ], @@ -3817,13 +3817,14 @@ "--macs2 MACs captured from the reader, different than the first set (with the same csn and epurse value)", "--pk Partial Key from legrec or starting key of keyblock from legbrute", "--index Where to start from to retrieve the key, default 0 - value in millions e.g. 1 is 1 million", - "--threads Number of threads to use, by default it uses the cpu's max threads (max 16)." + "--threads Number of threads to use, by default it uses the cpu's max threads.", + "--dbg Print first 2 key candidates and midpoint per thread, then exit (use to verify thread partitioning)" ], - "usage": "hf iclass legbrute [-h] --epurse --macs1 --macs2 --pk [--index ] [--threads ]" + "usage": "hf iclass legbrute [-h] --epurse --macs1 --macs2 --pk [--index ] [--threads ] [--dbg]" }, "hf iclass legrec": { "command": "hf iclass legrec", - "description": "Attempts to recover the diversified key of a specific iCLASS card. This may take several days. The card must remain be on the PM3 antenna during the whole process. ! Warning ! This process may brick the card! ! Warning !", + "description": "Attempts to recover the diversified key of a specific iCLASS card. This may take several days. The card must remain on the PM3 antenna during the whole process. ! Warning ! This process may brick the card! ! Warning !", "notes": [ "hf iclass legrec --macs 0000000089cb984b", "hf iclass legrec --macs 0000000089cb984b --index 0 --loop 100 --notest" @@ -3839,10 +3840,9 @@ "--allnight Loops the loop for 10 times, recommended loop value of 5000", "--fast Increases the speed (4.6->7.4 key updates/second), higher risk to brick the card", "--sl Lower card comms delay times, further speeds increases, may cause more errors", - "--est Estimates the key updates based on the card's CSN assuming standard key, can be used with --credit option", - "--credit EXPERIMENTAL : Recover the credit key using KD 0" + "--est Estimates the key updates based on the card's CSN assuming standard key, can be used with --credit option" ], - "usage": "hf iclass legrec [-h] --macs [--index ] [--loop ] [--debug] [--notest] [--allnight] [--fast] [--sl] [--est] [--credit]" + "usage": "hf iclass legrec [-h] [--macs ] [--index ] [--loop ] [--debug] [--notest] [--allnight] [--fast] [--sl] [--est]" }, "hf iclass loclass": { "command": "hf iclass loclass", @@ -6045,6 +6045,35 @@ ], "usage": "hf mfdes bruteaid [-h] [--start ] [--end ] [-i ] [--preset ]" }, + "hf mfdes brutedamslot": { + "command": "hf mfdes brutedamslot", + "description": "Recover DAM slot to delegated AID mappings by bruteforce. WARNING: This command takes a loooong time", + "notes": [ + "hf mfdes brutedamslot -> bruteforce all DAM slots", + "hf mfdes brutedamslot --start 0000 --end 00ff -> bruteforce specific DAM slot range", + "hf mfdes brutedamslot --step 16 -> bruteforce DAM slots with step 16", + "hf mfdes brutedamslot --no-auth -> execute without authentication" + ], + "offline": false, + "options": [ + "-h, --help This help", + "-a, --apdu Show APDU requests and responses", + "-v, --verbose Verbose output", + "-n, --keyno Key number (default: 0 / PICC key)", + "-t, --algo Crypt algo", + "-k, --key Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)", + "--kdf Key Derivation Function (KDF)", + "-i, --kdfi KDF input (1-31 hex bytes)", + "-m, --cmode Communicaton mode", + "-c, --ccset Communicaton command set", + "--schann Secure channel", + "--start Starting DAM slot (2 hex bytes, little endian on card)", + "--end Last DAM slot (2 hex bytes, little endian on card)", + "--step Increment step when bruteforcing DAM slots", + "--no-auth Execute without authentication" + ], + "usage": "hf mfdes brutedamslot [-hav] [-n ] [-t ] [-k ] [--kdf ] [-i ] [-m ] [-c ] [--schann ] [--start ] [--end ] [--step ] [--no-auth]" + }, "hf mfdes bruteisofid": { "command": "hf mfdes bruteisofid", "description": "Recover ISO file IDs by bruteforce. WARNING: This command takes a loooong time", @@ -6281,6 +6310,49 @@ ], "usage": "hf mfdes createapp [-hav] [-n ] [-t ] [-k ] [--kdf ] [-i ] [-m ] [-c ] [--schann ] [--rawdata ] [--aid ] [--fid ] [--dfname ] [--dfhex ] [--ks1 ] [--ks2 ] [--dstalgo ] [--numkeys ] [--no-auth]" }, + "hf mfdes createdelegateapp": { + "command": "hf mfdes createdelegateapp", + "description": "Create delegated application (CreateDelegatedApplication / 0xC9). Master key needs to be provided.", + "notes": [ + "Command is built from fields and sends two frames: C9 + AF continuation.", + "Authentication is always performed with DAM key number 0x10.", + "EncK and DAMMAC are calculated from supplied key material.", + "", + "Structured mode examples:", + "hf mfdes createdelegateapp --aid 123456 --damslot 0001 --damslotver 00 --quota 0010 --ks1 0F --ks2 AE --algo 2TDEA --key 00000000000000000000000000000000 --damenckey 00112233445566778899AABBCCDDEEFF --dammackey 8899AABBCCDDEEFF0011223344556677 --dstkey 00112233445566778899AABBCCDDEEFF --dstkeyver 00", + "hf mfdes createdelegateapp --aid 123456 --damslot 0001 --quota 0010 --ks1 0F --dstalgo aes --numkeys 14 --ks3 01 --fid E110 --dfname D2760000850101 --algo 2TDEA --key 00000000000000000000000000000000 --damenckey 00112233445566778899AABBCCDDEEFF --dammackey 8899AABBCCDDEEFF0011223344556677 --dstkey 00112233445566778899AABBCCDDEEFF --dstkeyver 00" + ], + "offline": false, + "options": [ + "-h, --help This help", + "-a, --apdu Show APDU requests and responses", + "-v, --verbose Verbose output", + "-t, --algo Crypt algo", + "-k, --key Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)", + "--kdf Key Derivation Function (KDF)", + "-i, --kdfi KDF input (1-31 hex bytes)", + "-m, --cmode Communicaton mode", + "-c, --ccset Communicaton command set", + "--schann Secure channel", + "--aid Application ID for create. Mandatory in structured mode. (3 hex bytes, big endian)", + "--damslot DAM slot number (2 hex bytes, little endian on card)", + "--damslotver DAM slot version (1 hex byte, def: 00)", + "--quota Quota in blocks (2 hex bytes, little endian on card, def: 0000)", + "--ks1 Key settings 1 (1 hex byte, def: 0x0F)", + "--ks2 Key settings 2 (1 hex byte, def: 0x0E)", + "--ks3 Key settings 3 (1 hex byte, optional)", + "--fid ISO file ID (2 hex bytes, big endian), optional", + "--dfname ISO DF Name (1..16 bytes, hex), optional", + "--dstalgo Application key crypt algo (used when ks2 omitted, def: DES)", + "--numkeys Number of keys 0x01..0x0e (used when ks2 omitted, def: 0x01)", + "--damenckey DAM ENC key (16 bytes for AES/2TDEA, 24 bytes for 3TDEA)", + "--dammackey DAM MAC key (16 bytes for AES/2TDEA, 24 bytes for 3TDEA)", + "--dstkey Initial delegated-app key (16 bytes for 2TDEA/AES, 24 bytes for 3TDEA)", + "--dstkeyver Initial delegated-app key version (1 hex byte, def: 00)", + "--no-auth Execute without authentication" + ], + "usage": "hf mfdes createdelegateapp [-hav] [-t ] [-k ] [--kdf ] [-i ] [-m ] [-c ] [--schann ] [--aid ] [--damslot ] [--damslotver ] [--quota ] [--ks1 ] [--ks2 ] [--ks3 ] [--fid ] [--dfname ] [--dstalgo ] [--numkeys ] [--damenckey ] [--dammackey ] [--dstkey ] [--dstkeyver ] [--no-auth]" + }, "hf mfdes createfile": { "command": "hf mfdes createfile", "description": "Create Standard/Backup file in the application. Application master key needs to be provided or flag --no-auth set (depend on application settings).", @@ -6664,6 +6736,33 @@ ], "usage": "hf mfdes getappnames [-hav] [-n ] [-t ] [-k ] [--kdf ] [-i ] [-m ] [-c ] [--schann ] [--no-auth]" }, + "hf mfdes getdelegateappinfo": { + "command": "hf mfdes getdelegateappinfo", + "description": "Get delegated application information for DAM slot (GetDelegatedInfo / 0x69).", + "notes": [ + "By default authentication is performed with PICC key number 0x00.", + "Use --keyno to pick another key number, or --no-auth to skip authentication.", + "hf mfdes getdelegateappinfo --damslot 0001 --algo 2TDEA --key 00000000000000000000000000000000", + "hf mfdes getdelegateappinfo --damslot 0001 --no-auth" + ], + "offline": false, + "options": [ + "-h, --help This help", + "-a, --apdu Show APDU requests and responses", + "-v, --verbose Verbose output", + "-n, --keyno Key number (default: 0 / PICC key)", + "-t, --algo Crypt algo", + "-k, --key Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)", + "--kdf Key Derivation Function (KDF)", + "-i, --kdfi KDF input (1-31 hex bytes)", + "-m, --cmode Communicaton mode", + "-c, --ccset Communicaton command set", + "--schann Secure channel", + "--damslot DAM slot number (2 hex bytes, little endian on card)", + "--no-auth Execute without authentication" + ], + "usage": "hf mfdes getdelegateappinfo [-hav] [-n ] [-t ] [-k ] [--kdf ] [-i ] [-m ] [-c ] [--schann ] [--damslot ] [--no-auth]" + }, "hf mfdes getfileids": { "command": "hf mfdes getfileids", "description": "Get File IDs list from card. Master key needs to be provided or flag --no-auth set.", @@ -7185,6 +7284,20 @@ ], "usage": "hf mfdes write [-hav] [-n ] [-t ] [-k ] [--kdf ] [-i ] [-m ] [-c ] [--schann ] [--aid ] [--fid ] [--no-auth] [--type ] [-o ] [-d ] [--debit] [--commit] [--updaterec ] [--isoid ] [--fileisoid ] [--readerid ] [--trkey ]" }, + "hf mfp acl": { + "command": "hf mfp acl", + "description": "Print decoded MIFARE Plus access rights (ACL), A = key A B = key B AB = both key A and B ACCESS = access bytes inside sector trailer block Increment, decrement, transfer, restore is for value blocks", + "notes": [ + "hf mf acl", + "hf mf acl -d FF0780" + ], + "offline": true, + "options": [ + "-h, --help This help", + "-d, --data ACL bytes specified as 4 hex bytes" + ], + "usage": "hf mfp acl [-h] -d " + }, "hf mfp auth": { "command": "hf mfp auth", "description": "Executes AES authentication command for MIFARE Plus card", @@ -7311,7 +7424,7 @@ }, "hf mfp help": { "command": "hf mfp help", - "description": "help This help list List MIFARE Plus history --------------------------------------------------------------------------------------- hf mfp list available offline: yes Alias of `trace list -t mfp -c` with selected protocol data to annotate trace buffer You can load a trace from file (see `trace load -h`) or it be downloaded from device by default It accepts all other arguments of `trace list`. Note that some might not be relevant for this specific protocol", + "description": "help This help list List MIFARE Plus history acl Decode ACL values for Mifare Plus --------------------------------------------------------------------------------------- hf mfp list available offline: yes Alias of `trace list -t mfp -c` with selected protocol data to annotate trace buffer You can load a trace from file (see `trace load -h`) or it be downloaded from device by default It accepts all other arguments of `trace list`. Note that some might not be relevant for this specific protocol", "notes": [ "hf mfp list --frame -> show frame delay times", "hf mfp list -1 -> use trace buffer" @@ -8320,12 +8433,24 @@ }, "hf secc help": { "command": "hf secc help", - "description": "-------- ----------- HID Config Card ----------- help This help --------------------------------------------------------------------------------------- hf secc sim available offline: no Simulate a HID iCLASS SE Config Card (JCOP / GlobalPlatform SCP02). Responds to SELECT AID (0013/0017), A0 D4, INITIALIZE UPDATE, and EXTERNAL AUTH. Load card parameters (UID, AID, SCP02Key) from a JSON file.", + "description": "-------- ----------- HID Config Card ----------- help This help --------------------------------------------------------------------------------------- hf secc info available offline: no Read and decode Card Recognition Data from a GlobalPlatform card. Sends GET DATA (80 CA 00 66 00) and parses the Card Recognition Template (tag 73) to identify platform, SCP type, and chip family.", + "notes": [ + "hf secc info" + ], + "offline": true, + "options": [ + "-h, --help This help" + ], + "usage": "hf secc info [-h]" + }, + "hf secc sim": { + "command": "hf secc sim", + "description": "Simulate a HID iCLASS SE Config Card (JCOP / GlobalPlatform SCP02). APDUs are matched against the JSON APDUResponses table; INITIALIZE UPDATE and EXTERNAL AUTH are handled by the built-in SCP02 crypto. Anything else falls through to the JSON DefaultResponse (or 9000 if none is set).", "notes": [ "hf secc sim -f hidconfig_sample", "hf secc sim -f hidconfig_sample -n 5 -> stop after 5 reader interactions" ], - "offline": true, + "offline": false, "options": [ "-h, --help This help", "-f, --file JSON file with UID, AID, SCP02Key (without .json extension)", @@ -8335,11 +8460,13 @@ }, "hf secc sniff": { "command": "hf secc sniff", - "description": "Sniff the communication between a HID Config Card reader and card. Use `hf 14a list` to view collected data.", + "description": "Sniff the communication between a HID Config Card reader and card. Use `hf seos list` to view collected data. With -j and no -d, jams responses to APDU A0 D4 00 00 00. With -j -d jams responses to the specified APDU. Use -r to override the jam response payload (default: 00009000).", "notes": [ "hf secc sniff", "hf secc sniff -j -> jam A0 D4 00 00 00, respond 00 00 90 00", - "hf secc sniff -c -r -> trigger on card or reader data" + "hf secc sniff -j -d A0D4000000 -> same, APDU specified explicitly", + "hf secc sniff -j -d A0D4000000 -r 9000 -> jam A0D4000000, respond 90 00", + "hf secc sniff -c -i -> trigger on card data, interactive" ], "offline": false, "options": [ @@ -8347,9 +8474,11 @@ "-c, --card triggered by first data from card", "-r, --reader triggered by first 7-bit request from reader (REQ, WUP)", "-i, --interactive console will not be returned until sniff finishes or is aborted", - "-j, --jam jam APDU A0 D4 00 00 00, respond with 00 00 90 00" + "-j, --jam jam responses to a specific APDU (see -d/-a)", + "-d, --apdu APDU bytes to jam (default: A0D4000000)", + "-a, --resp response payload when jamming (default: 00009000)" ], - "usage": "hf secc sniff [-hcrij]" + "usage": "hf secc sniff [-hcrij] [-d ] [-a ]" }, "hf seos adf": { "command": "hf seos adf", @@ -12092,6 +12221,29 @@ ], "usage": "lf read [-hv@] [-s ]" }, + "lf relay": { + "command": "lf relay", + "description": "Relay LF signal between two Proxmark3 devices over TCP. By default it uses PORT 8000 and uses 40000 samples from Graphbuffer --rdr : Reading device, act as IP client and reads LF tag and sends data --tag : Simulation device, act as IP server and simulates relayed data", + "notes": [ + "Device A, reading LF tag, client", + "lf relay --rdr --ip 192.168.1.141 -> Client, connect to IP 192.168.1.141:8000", + "lf relay --rdr --ip 192.168.1.141 -p 18111 -> Client, connect to IP 192.168.1.141:18111", + "", + "Device B, simulate LF tag, server", + "lf relay --tag -p 8111 -> Server listening port 8111, recv 40000 samples", + "lf relay --tag -s 10000 -> Server listening port 8000, recv 10000 samples" + ], + "offline": false, + "options": [ + "-h, --help This help", + "--tag Simulation device, act as Server", + "--rdr Sniffing device, act as client", + "-i, --ip Target IPv4 address to send data to. Used with `--rdr`", + "-s, --samples Number of samples to collect (def: 40000)", + "-p, --port Port number (def: 8000)" + ], + "usage": "lf relay [-h] [--tag] [--rdr] [-i ] [-s ] [-p ]" + }, "lf search": { "command": "lf search", "description": "Read and search for valid known tag. For offline mode, you can `data load` first then search.", @@ -14286,8 +14438,8 @@ } }, "metadata": { - "commands_extracted": 813, + "commands_extracted": 819, "extracted_by": "PM3Help2JSON v1.00", - "extracted_on": "2026-04-02T12:42:42" + "extracted_on": "2026-04-11T02:04:09" } } diff --git a/doc/commands.md b/doc/commands.md index b561d7e1a..cfb47754a 100644 --- a/doc/commands.md +++ b/doc/commands.md @@ -432,6 +432,7 @@ Check column "offline" for their availability. |command |offline |description |------- |------- |----------- |`hf secc help `|Y |`This help` +|`hf secc info `|N |`Read and decode Card Recognition Data (GP tag 0066)` |`hf secc sim `|N |`Simulate HID iCLASS SE Config Card` |`hf secc sniff `|N |`Sniff reader<->card, jam A0 D4 APDU` @@ -638,6 +639,7 @@ Check column "offline" for their availability. |------- |------- |----------- |`hf mfp help `|Y |`This help` |`hf mfp list `|Y |`List MIFARE Plus history` +|`hf mfp acl `|Y |`Decode ACL values for Mifare Plus` |`hf mfp auth `|N |`Authentication` |`hf mfp chk `|N |`Check keys` |`hf mfp dump `|N |`Dump MIFARE Plus tag to file` @@ -713,7 +715,10 @@ Check column "offline" for their availability. |`hf mfdes getaids `|N |`Get Application IDs list` |`hf mfdes getappnames `|N |`Get Applications list` |`hf mfdes bruteaid `|N |`Recover AIDs by bruteforce` +|`hf mfdes brutedamslot `|N |`Recover DAM slots to delegated AIDs by bruteforce` |`hf mfdes createapp `|N |`Create Application` +|`hf mfdes createdelegateapp`|N |`Create Delegated Application` +|`hf mfdes getdelegateappinfo`|N |`Get Delegated Application info by DAM slot` |`hf mfdes deleteapp `|N |`Delete Application` |`hf mfdes selectapp `|N |`Select Application ID` |`hf mfdes selectisofid `|N |`Select file by ISO ID` @@ -940,6 +945,7 @@ Check column "offline" for their availability. |`lf config `|N |`Get/Set config for LF sampling, bit/sample, decimation, frequency` |`lf cmdread `|N |`Modulate LF reader field to send command before read` |`lf read `|N |`Read LF tag` +|`lf relay `|N |`LF relay between two pm3 devices (tag/rdr mode)` |`lf search `|Y |`Read and Search for valid known tag` |`lf sim `|N |`Simulate LF tag from buffer` |`lf simask `|N |`Simulate ASK tag`