commands

help

• help This help. Use ' help' for details of the following commands:

• data { Plot window / data buffer manipulation... }

• exit Exit program

• hf { HF commands... }

• hw { Hardware commands... }

• lf { LF commands... }

• quit Quit program

• script Run script

data help

• help This help
• amp Amplify peaks
• askdemod <0|1> -- Attempt to demodulate simple ASK tags
• autocorr -- Autocorrelation over window
• bitsamples @ Get raw samples as bitstring
• bitstream [clock rate] -- Convert waveform into a bitstream
• buffclear Clear sample buffer and graph window
• dec Decimate samples
• detectclock Detect clock rate
• fskdemod Demodulate graph window as a HID FSK
• grid -- overlay grid on graph window, use zero value to turn off either
• hexsamples @ [] -- Dump big buffer as hex bytes
• hide Hide graph window
• hpf Remove DC offset from trace
• load -- Load trace (to graph window
• ltrim -- Trim samples from left of trace
• mandemod [i] [clock rate] -- Manchester demodulate binary stream (option 'i' to invert output)
• manmod [clock rate] -- Manchester modulate a binary stream
• norm Normalize max/min to +/-500
• plot Show graph window (hit 'h' in window for keystroke help)
• samples @ [512 - 40000] -- Get raw samples for graph window
• save -- Save trace (from graph window)
• scale -- Set cursor display scale
• threshold -- Maximize/minimize every value in the graph window depending on threshold
• zerocrossings Count time between zero-crossings

hf help

• help This help
• 14a { ISO14443A RFIDs... }
• 14b { ISO14443B RFIDs... }
• 15 { ISO15693 RFIDs... }
• epa { German Identification Card... }
• legic @ { LEGIC RFIDs... }
• iclass { ICLASS RFIDs... }
• mf { MIFARE RFIDs... }
• tune @ Continuously measure HF antenna tuning

hf 14a help

• help This help
• list @ List ISO 14443a history
• reader @ Act like an ISO14443 Type A reader
• cuids @ Collect n>0 ISO14443 Type A UIDs in one go
• sim @ -- Fake ISO 14443a tag
• snoop @ Eavesdrop ISO 14443 Type A
• raw @ Send raw hex data to tag

hf 14b help

• help This help
• demod Demodulate ISO14443 Type B from tag
• list @ List ISO 14443 history
• read @ Read HF tag (ISO 14443)
• sim @ Fake ISO 14443 tag
• simlisten @ Get HF samples as fake tag
• snoop @ Eavesdrop ISO 14443
• sri512read @ Read contents of a SRI512 tag
• srix4kread @ Read contents of a SRIX4K tag
• raw @ Send raw hex data to tag

hf 15 help

• help This help
• demod Demodulate ISO15693 from tag
• read @ Read HF tag (ISO 15693)
• record @ Record Samples (ISO 15693)
• reader @ Act like an ISO15693 reader
• sim @ Fake an ISO15693 tag
• cmd @ Send direct commands to ISO15693 tag
• findafi @ Brute force AFI of an ISO15693 tag
• dumpmemory @ Read all memory pages of an ISO15693 tag

hf epa help

• help This help
• cnonces @ Acquire n>0 encrypted PACE nonces of size m>0 with d sec pauses

hf legic help

• help This help
• decode @ Display deobfuscated and decoded LEGIC RF tag data (use after hf legic reader)
• reader @ [offset [length]] -- read bytes from a LEGIC card
• save @ [] -- Store samples
• load @ -- Restore samples
• sim @ [phase drift [frame drift [req/resp drift]]] Start tag simulator (use after load or read)
• write @ -- Write sample buffer (user after load or read)
• fill @ -- Fill/Write tag with constant value

hf iclass help

• help This help
• list @ List iClass history
• snoop @ Eavesdrop iClass communication
• sim @ Simulate iClass tag
• reader @ Read an iClass tag

hf mf help

• help This help
• dbg @ Set default debug mode
• rdbl @ Read MIFARE classic block
• urdbl @ Read MIFARE Ultralight block
• urdcard @ Read MIFARE Ultralight Card
• uwrbl @ Write MIFARE Ultralight block
• rdsc @ Read MIFARE classic sector
• dump @ Dump MIFARE classic tag to binary file
• restore @ Restore MIFARE classic binary file to BLANK tag
• wrbl @ Write MIFARE classic block
• chk @ Test block keys
• mifare @ Read parity error messages.
• nested @ Test nested authentication
• sniff @ Sniff card-reader communication
• sim @ Simulate MIFARE card
• eclr @ Clear simulator memory block
• eget @ Get simulator memory block
• eset @ Set simulator memory block
• eload @ Load from file emul dump
• esave @ Save to file emul dump
• ecfill @ Fill simulator memory with help of keys from simulator
• ekeyprn @ Print keys from simulator memory
• csetuid @ Set UID for magic Chinese card
• csetblk @ Write block into magic Chinese card
• cgetblk @ Read block from magic Chinese card
• cgetsc @ Read sector from magic Chinese card
• cload @ Load dump into magic Chinese card
• csave @ Save dump from magic Chinese card into file or emulator

hw help

• help This help
• detectreader @ ['l'|'h'] -- Detect external reader field (option 'l' or 'h' to limit to LF or HF)
• fpgaoff @ Set FPGA off
• lcd @ -- Send command/data to LCD
• lcdreset @ Hardware reset LCD
• readmem @ [address] -- Read memory at decimal address from flash
• reset @ Reset the Proxmark3
• setlfdivisor @ <19 - 255> -- Drive LF antenna at 12Mhz/(divisor+1)
• setmux @ <loraw|hiraw|lopkd|hipkd> -- Set the ADC mux to a specific value
• tune @ Measure antenna tuning
• version @ Show version inforation about the connected Proxmark

lf help

• help This help
• cmdread @ <'0' period> <'1' period> ['h'] -- Modulate LF reader field to send command before read (all periods in microseconds) (option 'h' for 134)
• em4x { EM4X RFIDs... }
• flexdemod Demodulate samples for FlexPass
• hid { HID RFIDs... }
• io { ioProx tags... }
• indalademod ['224'] -- Demodulate samples for Indala 64 bit UID (option '224' for 224 bit)
• indalaclone ['l']-- Clone Indala to T55x7 (tag must be in antenna)(UID in HEX)(option 'l' for 224 UID
• read @ ['h'|] -- Read 125/134 kHz LF ID-only tag (option 'h' for 134, alternatively: f=12MHz/(divisor+1))
• sim @ [GAP] -- Simulate LF tag from buffer with optional GAP (in microseconds)
• simbidir @ Simulate LF tag (with bidirectional data transmission between reader and tag)
• simman @ [GAP] Simulate arbitrary Manchester LF tag
• ti { TI RFIDs... }
• hitag { Hitag tags and transponders... }
• vchdemod ['clone'] -- Demodulate samples for VeriChip
• t55xx { T55xx RFIDs... }
• pcf7931 {PCF7931 RFIDs...}

lf em4x help

• help This help
• em410xread [clock rate] -- Extract ID from EM410x tag
• em410xsim @ -- Simulate EM410x tag
• em410xwatch @ ['h'] -- Watches for EM410x 125/134 kHz tags (option 'h' for 134)
• em410xwrite <'0' T5555> <'1' T55x7> [clock rate] -- Write EM410x UID to T5555(Q5) or T55x7 tag, optionally setting clock rate
• em4x50read Extract data from EM4x50 tag
• readword -- Read EM4xxx word data
• readwordPWD -- Read EM4xxx word data in password mode
• writeword -- Write EM4xxx word data
• writewordPWD -- Write EM4xxx word data in password mode

lf hid help

• help This help
• demod Demodulate HID Prox Card II (not optimal)
• fskdemod Realtime HID FSK demodulator
• sim -- HID tag simulator
• clone ['l'] -- Clone HID to T55x7 (tag must be in antenna)(option 'l' for 84bit ID)

lf ti help

• help This help
• demod Demodulate raw bits for TI-type LF tag
• read @ Read and decode a TI 134 kHz tag
• write @ Write new data to a r/w TI 134 kHz tag

lf hitag help

• help This help
• list List Hitag trace history
• reader Act like a Hitag Reader
• sim Simulate Hitag transponder
• snoop Eavesdrop Hitag communication

lf pcf7931 help

• help This help
• read Read content of a PCF7931 transponder

lf t55xx help

• help This help
• readblock -- Read T55xx block data (page 0)
• readblockPWD -- Read T55xx block data in password mode(page 0)
• writeblock -- Write T55xx block data (page 0)
• writeblockPWD -- Write T55xx block data in password mode(page 0)
• readtrace Read T55xx traceability data (page 1)