Proxmark 3 Cheatsheet

# install prerequisites
sudo apt-get install p7zip git build-essential libreadline5 libreadline-dev libusb-0.1-4 libusb-dev libqt4-dev perl pkg-config wget libncurses5-dev gcc-arm-none-eabi

# check out the latest revision of the official project:
git clone https://github.com/Proxmark/proxmark3.git

# Change directory to the recently cloned Proxmark3 repository
cd proxmark3

# compile the bootrom, OS and software.
make clean && make all

./client/flasher /dev/ttyACM0 -b bootrom/obj/bootrom.elf

./client/flasher /dev/ttyACM0 armsrc/obj/fullimage.elf

./client/proxmark3 /dev/ttyACM0

hf search

lf search

hw tune

hw version

# r          reverse permuted key 

Example:
hf iclass permute r 3F90EBF0910F7B6F

hf iclass reader

# k <Key>      : *Access Key as 16 hex symbols or 1 hex to select key from memory

Example:
hf iclass dump k AFA785A7DAB33378

# b <Block> : The block number as 2 hex symbols
# k <Key>   : Access Key as 16 hex symbols or 1 hex to select key from memory

hf iclass readblk b 7 k AFA785A7DAB33378

# b <Block> : The block number as 2 hex symbols          
# d <data>  : Set the Data to write as 16 hex symbols          
# k <Key>   : Access Key as 16 hex symbols or 1 hex to select key from memory 

hf iclass writeblk b 07 d 6ce099fe7e614fd0 k AFA785A7DAB33378

# p           : print keys loaded into memory

hf iclass managekeys p

# n <keynbr>  : specify the keyNbr to set in memory          
# k <key>     : set a key in memory  

hf iclass managekeys n 0 k AFA785A7DAB33378

echo <auth_key> > key_dump
xxd -r -p key_dump > iclass_decryptionkey.bin
Encrypt Block

hf iclass encryptblk 0000000f2aa3dba8

# f <filename>     : load iclass tag-dump filename

hf iclass eload f iclass_tagdump-db883702f8ff12e0.bin

# 0 <CSN> simulate the given CSN          
# 1       simulate default CSN          
# 2       Reader-attack, gather reader responses to extract elite key          
# 3       Full simulation using emulator memory (see 'hf iclass eload')  

hf iclass sim 3

hf iclass managekeys n 0 k AFA785A7DAB33378
hf iclass dump k 0
hf iclass eload f iclass_tagdump-db883702f8ff12e0.bin
hf iclass sim 3

# <block number>|<*card memory> <key type (A/B/?)> [t|d|s|ss] [<key (12 hex symbols)>] [<dic (*.dic)>] 
# * - all sectors          
# card memory - 0 - MINI(320 bytes), 1 - 1K, 2 - 2K, 4 - 4K, <other> - 1K          
# d - write keys to binary file           

hf mf chk *1 ? d default_keys.dic

# [card memory]: 0 = 320 bytes (Mifare Mini), 1 = 1K (default), 2 = 2K, 4 = 4K

hf mf dump 1
Convert .bin to .eml

script run dumptoemul -i dumpdata.bin

# b <no>  : block to read          
# k <key> : (optional) key for authentication

hf mf rdbl b 3 k FFFFFFFF

# <block number> <key A/B> <key (12 hex symbols)> <block data (32 hex symbols)>

hf mf wrbl 0 A FFFFFFFFFFFF d3a2859f6b880400c801002000000016

# <block number> <key A|B> <key (12 hex symbols)>
# <target block number> <target key A|B> [known target key (12 hex symbols)] [w] [s]
# w: Acquire nonces and write them to binary file nonces.bin

hf mf hardnested 0 A 8829da9daf76 4 A w

hf mf eload 353C2AA6
Mifare Simulate [0-3]

# u    (Optional) UID 4,7 or 10 bytes. If not specified, the UID 4B from emulator memory will be used

hf mf sim u 353c2aa6

hf mf chk *1 ? d default_keys.dic
hf mf dump 1
script run dumptoemul -i dumpdata.bin
hf mf eload 353C2AA6
hf mf sim u 353c2aa6

lf indala read

lf indala demod

# <uid> :  64/224 UID

lf indala sim a0000000c2c436c1

# <uid> :  64/224 UID

lf indala clone a0000000c2c436c1

lf hid read

lf hid demod

# [OEM] [FC] [CN] 
# OEM           - OEM number / site code          
# FC            - facility code          
# CN            - card number  

lf hid wiegand 0 56 150

# <ID>

lf hid sim 200670012d

# <ID>

lf hid clone 200670012d

lf t55xx detect

# d <FSK|FSK1|FSK1a|FSK2|FSK2a|ASK|PSK1|PSK2|NRZ|BI|BIa>  Set demodulation FSK / ASK / PSK / NRZ / Biphase / Biphase A
# EM is ASK
# HID Prox is FSK
# Indala is PSK

lf t55xx config FSK

# b <block>    - block number to write. Between 0-7          
# d <data>     - 4 bytes of data to write (8 hex characters) 

lf t55xx wr b 0 d 00081040

lf t55xx wipe

data samples <size>

data save <filename>

data load <filename>

script list

# i <file>		Specifies the dump-file (input). If omitted, 'dumpdata.bin' is used

script run dumptoemul -i xxxxxxxxxxxxxx.bin

# k <key>       - the current six byte key with write access
# n <key>       - the new key that will be written to the card
# a <access>    - the new access bytes that will be written to the card
# x             - execute the commands aswell.

script run formatMifare -k FFFFFFFFFFFF -n FFFFFFFFFFFF -x