proxmark3

No entries match these filters. Clear filters

1. [Frosty Lemon.4.23346][2026-09-18] Sep 18, 2026 · release notes

   New DESFire simulation engine (hf mfdes sim) and etest subcommand with expanded API support

   • Adds hf mfdes sim to simulate a DESFire EV1DESFire EV1A contactless smart card IC from NXP Semiconductors implementing ISO 14443-A, offering AES and 3DES encryption; cyber tools target it for RFID cloning, key extraction, and access-control research. card over USB using an image in emulator memory, supporting authentication, secure messaging, file reads/writes/transactions, and key management commands like ChangeKey and CreateApplication.
   • Adds hf mfdes etest to drive the DESFire simulation over USB without RF, with support for injectable RndB values and random UIDs for testing readers in a lab environment.
   • Changes hf mfu cchk and hf mfu aeschk into a unified hf mfu chk command that automatically detects and handles both UL-C and UL-AES cards.

   3 details in Everything

2. v4.23346 Sep 17, 2026 · issue 078

   Proxmark3 v4.23346 adds full DESFire EV1DESFire EV1A contactless smart card IC from NXP Semiconductors implementing ISO 14443-A, offering AES and 3DES encryption; cyber tools target it for RFID cloning, key extraction, and access-control research. simulation, new dump/view/test commands, and unified UL key-check.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v4.23346 https://github.com/RfidResearchGroup/proxmark3.git
   # already have the repo? check out this version:
   $ git checkout v4.23346

   └──▷ TRY IT
   Dump a full DESFire PICC to a JSON image, auto-loading any previously recovered keys, for offline analysis.
   copy

   $ hf mfdes dump

   View a saved DESFire dump file without needing the device present — useful for reviewing card structure at a desk.
   copy

   $ hf mfdes view

   Save a DESFire emulator image while retaining applications and files a reader deleted during the session.
   copy

   $ hf mfdes esave --keep

   • Adds hf mfdes etest — drives the DESFire simulation over USB without RF, with injectable RndB and random UID.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds hf mfdes sim — DESFire EV1 simulation now answers authentication, secure messaging, file reads, writes, and transactions from the card image in emulator memory.
   • Adds hf mfdes sim — answers ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 7816 SELECT by DF name or file ID with real status words, so a reader that opens with a SELECT reaches the simulated card.
   • Adds hf mfdes sim — SetConfiguration is answered, so a reader can disable FormatPICC, switch the card to a random UID, or give it a user-defined ATS.
   • Adds hf mfdes sim — ReadSignature is answered for a card image of a generation that has one, refused the way a genuine EV1 refuses it.

   +28 more show less

   • Adds hf mfdes sim — GetKeyVersion is answered, so a reader can read the version of any key without knowing the key itself.
   • Adds hf mfdes sim — ChangeKeySettings is answered, enciphered and master key only.
   • Adds hf mfdes sim — ChangeKey is answered (both plain and XORed key frame), so a reader can rekey the simulated card and new keys are reflected in hf mfdes esave output.
   • Adds hf mfdes sim — ChangeFileSettings is answered, plain when the change access right is free and enciphered under the named key otherwise.
   • Adds hf mfdes sim — CreateFile (all five EV1 flavours) and DeleteFile are answered, so a reader can lay out an application's file system on the simulated card.
   • Adds hf mfdes sim — CreateApplication and DeleteApplication are answered, so a reader can add and remove applications on the simulated card.
   • Adds hf mfdes sim — FormatPICC is answered, releasing every application and file and returning memory, keeping the PICC master key and settings.
   • Adds hf mfdes sim — answers GetDFNames and GetISOFileIDs, so a reader sees the ISO file IDs and DF names of the simulated card.
   • Adds hf mfdes eload/esave/eview — load, save, and view a DESFire card dump in emulator memory.
   • Adds --keep flag to hf mfdes esave — preserves applications and files a reader deleted, which are otherwise omitted so the dump reflects the card as a reader sees it.
   • Adds hf mfdes dump — walks the whole PICC and saves a hf-mfdes-<UID>-dump.json card image, automatically picking up hf-mfdes-<UID>-keys.json.
   • Adds hf mfdes view — prints a DESFire card dump file with no device attached.
   • Adds hf 14b view — MyKey / COGES keys on SRIX4K now decode.
   • Adds hf 14b view --selftest — runs the MyKey parser self-tests.
   • Adds vigik_recover_pk.py — Python script to recover public keys from RSARSAThe oldest widely used public-key algorithm, for both encryption and signatures, with security resting on factoring large numbers. A large quantum computer would break it. signatures.
   • Adds named DESFire status codes for the five codes that indicate a card damaged or disabled itself, replacing the raw -20 value.
   • Merges hf mfu cchk and hf mfu aeschk into a single hf mfu chk command that auto-detects UL-C vs UL-AES.
   • Removes hf 14b valid — replaced by the MyKey parser.
   • Changes hf mfdes chk to check every key number the application declares, not only those named in a file's access rights.
   • Changes hf mfdes chk to run with no arguments, falling back to the bundled dictionary the way hf mfdes detect does.
   • Changes hf mf view to show which VIGIKVIGIKA French contactless access-control standard, managed by La Poste, used for building-entry badges; cyber tools target it because its weak cryptography makes credential cloning practical. fields are RSA signed.
   • Changes hf mf view to decode Urmet Captiv card number fields and data regions.
   • Changes hf mf view to decode Hexact sector 9 and 11 payload, cross-checked against sectors 0 and 15 and UID.
   • Changes hf mf view --selftest to also check the Hexact payload decoder in both directions.
   • Changes hw status to report EMULATOR memory.
   • Changes pm3 history to write after every command, so history survives a kill rather than only a clean exit.
   • Changes emulator memory size — raised from 4096 to 8192 bytes.
   • Changes NG reply framing so the payload lands word-aligned, increasing USB transfer speed from 630 to 789 kB/s on RDV4.
   • Adds hf mfdes etest — drives the DESFire simulation over USB without RF, with injectable RndB and random UID.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds hf mfdes sim — DESFire EV1 simulation now answers authentication, secure messaging, file reads, writes, and transactions from the card image in emulator memory.
   • Adds hf mfdes eload/esave/eview — load, save, and view a DESFire card dump in emulator memory.
   • Adds hf mfdes dump — walks the whole PICC and saves a hf-mfdes-<UID>-dump.json card image, automatically picking up hf-mfdes-<UID>-keys.json.
   • Adds hf mfdes view — prints a DESFire card dump file with no device attached.

   +3 more show less

   • Adds hf 14b view --selftest — runs the MyKey parser self-tests.
   • Adds vigik_recover_pk.py — Python script to recover public keys from RSARSAThe oldest widely used public-key algorithm, for both encryption and signatures, with security resting on factoring large numbers. A large quantum computer would break it. signatures.
   • Removes hf 14b valid — replaced by the MyKey parser.

   25 more in Everything

3. v4.21611 Apr 14, 2026 · release notes

   Proxmark3 v4.21611 adds 30+ new commands spanning iClass, DESFire, FeliCaFeliCaA contactless smart card standard developed by Sony, widely used in Japanese transit and payment systems, operating at 13.56 MHz with its own proprietary protocol distinct from ISO 14443., Aliro, GST, VAS, NFCNFCNear Field Communication, a short-range (≤4 cm) wireless standard maintained by the NFC Forum, enabling data exchange between devices; cyber tools use it to probe, emulate, or intercept contactless card and tag transactions. tearoff attacks, and internet-relayed LF/HF.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v4.21611 https://github.com/RfidResearchGroup/proxmark3.git
   # already have the repo? check out this version:
   $ git checkout v4.21611

   └──▷ TRY IT
   Relay an LF or HF card read between two Proxmark3 devices over the internet for remote card emulation or sniffing.
   copy

   $ pm3 -- lf relay

   Live-recover a reader's iClass key by simulating a tag and attacking both standard and elite dictionaries in real time.
   copy

   $ pm3 -- hf iclass lookup --live

   Simulate an iClass card instantly from a known facility code and card number for access-control testing.
   copy

   $ pm3 -- hf iclass tagsim

   • Adds lf relay command to relay between two Proxmark3 devices over the internet.
   • Adds hf mfp acl command for Mifare Plus ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. inspection.
   • Adds hf mfp dump command to dump Mifare Plus card contents.
   • Adds hf mfdes brutedamslot command for DESFire DAMDAMDatabase Activity Monitoring — a category of tooling that intercepts and logs database queries and transactions in real time, letting cyber tools detect unauthorized access or anomalous behavior without modifying the database itself. slot brute-forcing.
   • Adds hf mfdes getdelegateappinfo command for retrieving DESFire delegate application info.

   +25 more show less

   • Adds hf mfdes createdelegateapp command for creating DESFire delegate applications.
   • Adds hf mfdes bruteisofid and hf mfdes selectisofid commands for ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. FID brute-forcing and selection on DESFire.
   • Adds dict, ascii, and mad presets to hf mfdes bruteaid along with tag loss detection and recovery.
   • Adds hf secc info command to retrieve the Card Recognition Template from iClass SE config cards.
   • Adds hf secc sim with wildcard payload support for simulating iClass SE config card functions.
   • Adds hf iclass tagsim command to simulate an iClass card from a facility code and card number.
   • Adds hf iclass blacktears command for automated tearoff of block 1 to set non-secure page mode.
   • Adds --live option to hf iclass lookup for live reader-key recovery by simulating a tag and running lookups against standard and elite dictionaries.
   • Adds -f parameter to hf iclass sam to parse a card dump using the SAM.
   • Significantly optimizes hf iclass legbrute throughput via iterative cipher loops, 256-entry LUT, in-place state updates, and byte-wise MAC brute-forcing, plus improved multithreaded key-range partitioning with ETA display and keyboard abort.
   • Adds hf gst read and hf gst info commands for GST tag interaction.
   • Adds hf vas info command for Value Added Services tag information.
   • Adds hf aliro read and hf aliro info commands for Aliro access credential reading.
   • Adds hf felica discnodes command for FeliCa node discovery.
   • Adds hf felica seacinfo command for FeliCa SEAC information retrieval.
   • Adds hf 14b tearoff interactive tear-off attack against ST25TB/SRx monotonic counters.
   • Adds -t / --timeout option to hf 15 sim for ISO 15693 simulation timeout control.
   • Adds --aid parameter to hf seos commands for explicit AID targeting.
   • Adds Mifare Classic support to hf gallagher command.
   • Extends wiegand encode / wiegand decode with 96-bit ASNASNAutonomous System Number — a globally unique identifier assigned by regional internet registries to a network operator, letting routing protocols distinguish which organization controls a block of IP addresses..1 encoded format support, --bin encoding, verbose PACS output, and explicit rejection of raw/binary decodes above 96 bits.
   • Adds hf mf acl recognition of more generic ACL configurations.
   • Updates data_hex_crc.lua script with a -s parameter and alternating row color output.
   • Adds DESFire AID values related to LEAF for use in DESFire enumeration commands.
   • Adds hardening (ASLR/stack-protector/etc.) for all host binaries, with level dependent on OS.
   • Adds Qt6 support for the Proxmark3 client GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands..

   30 details in Everything

4. [BREAKMEIFYOUCAN!.4.21611][2026-04-14] Apr 14, 2026 · release notes

   New LF relay over internet, Mifare DESFire delegate app commands, SECC info command, and Qt6 client support

   • Adds lf relay subcommand to relay between two pm3 devices over the internet
   • Adds hf mfp acl subcommand for ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. configuration on Multi-Frequency Proxmark cards
   • Adds --live option to hf iclass lookup command to perform a live recovery of the reader's key
   • Adds hf mfdes createdelegateapp, hf mfdes getdelegateappinfo, and hf mfdes brutedamslot subcommands for DESFire delegate app manipulation
   • Adds --aid parameter to all hf seos commands to specify Application Identifier

   +2 more show less

   • Adds -f parameter to hf iclass sam command to use SAM to parse a card dump
   • Adds hf iclass tagsim subcommand to quickly simulate an iClass card based on facility code and card number

   7 details in Everything

5. v4.21128 Feb 25, 2026 · release notes

   proxmark3 v4.21128 adds Ultralight AES full-stack support, QR code generation, hf seos write/sim, and a new multi-KDF keygen command.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v4.21128 https://github.com/RfidResearchGroup/proxmark3.git
   # already have the repo? check out this version:
   $ git checkout v4.21128

   └──▷ TRY IT
   Generate Bambu Lab (or Snapmaker U1) MIFARE keys by KDF without the removed bambukeys command.
   copy

   $ hf mf keygen

   Generate a QR code from arbitrary data (e.g. a card UID or URL) directly inside the pm3 client session.
   copy

   $ data qrcode

   • New standalone mode HF_DOEGOX_AUTH0 unlocks UL-C / UL-AES tags without a host connection.
   • Adds -- argument separator in the pm3 client to pass trailing arguments directly to scripts.
   • Adds hf mf keygen with multiple KDF support (including Snapmaker U1 filament spool and Bambu Lab keys), replacing hf mf bambukeys.
   • Adds data qrcode command to generate QR codes from inside the pm3 client.
   • Adds support for reading Bruce dump files (.rfid format).

   +11 more show less

   • Adds hf 14b config command with polling-loop annotation support and better ECP configuration aliases.
   • Adds full Ultralight AES support across hf mfu info/rdbl/wrbl/dump/ndefread/wipe/setkey, including auth, secure messaging, and basic DataProtKey emulation.
   • Adds Ultralight AES secure messaging support in hf 14a raw.
   • Adds ATR fingerprinting to hf 14a info and hf 14b info.
   • Adds hf seos write command for writing SEOS card data.
   • Adds hf seos sim command for simulating SEOS cards.
   • Adds Verkada 40-bit credential format support.
   • Adds Kaba evolo AID identification.
   • Adds identification of NDEF/Open print tag records.
   • Adds client/resources/pm3_generic_private_key.pem to enable self-signing a modified device.
   • Adds script read_t-union.py for reading T-Union transit cards.

   16 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !hf mf bambukeys has been replaced by hf mf keygen; existing scripts or workflows calling hf mf bambukeys will break.
6. [Permafrost.4.21128][2026-02-25] Feb 25, 2026 · release notes

   New data qrcode generation, -- script arg separator, Ultralight AES auth/messaging support, and SEOS write/sim commands

   └──▷ TRY IT
   Generate a QR code containing a URL for quick transfer to a device via the proxmark's screen.
   copy

   $ data qrcode -d "https://example.com" > output.png

   Simulate an NXP MIFUL AES card and inject specific authentication replies for testing.
   copy

   $ hf mfu sim inject_auth < reply.bin

   • Adds data qrcode command to generate QR codes from inside the pm3 client
   • Adds -- argument separator in client to pass following args to scripts
   • Adds hf mfu cchk and aeschk commands, plus options to hf mf cauth/aesauth
   • Adds card auth reply injection support in hf mfu sim
   • Adds Ultralight AES secure messaging support in hf 14a raw subcommands

   +11 more show less

   • Adds Ultralight AES authentication support in hf mfu info/rdbl/wrbl/dump/ndefread/wipe/setkey subcommands
   • Adds Ultralight AES basic DataProtKey emulation support
   • Adds hf seos write command for writing SEOS data
   • Adds hf seos sim command for simulating SEOS cards
   • Adds ATR fingerprinting to hf 14a info and hf 14b info commands
   • Adds Verkada 40-bit identification format
   • Adds Kaba evolo AIDs support
   • Adds read_t-union.py script for tag reading
   • Adds better ECP configuration aliases in config
   • Adds hf 14b config command with polling loop annotation support
   • Adds client/resources/pm3_generic_private_key.pem for self-signing modded devices

   16 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Replaces the existing hf mf bambukeys command with hf mf keygen, which now supports multiple KDFs instead of just Bambu-specific keys
7. v4.20728 Sep 11, 2025 · release notes

   Proxmark3 v4.20728 adds MQTT client, HIDHIDHuman Interface Device — a USB (and Bluetooth) device class standardized by the USB Implementers Forum covering keyboards, mice, and gamepads; cyber tools use it to make a rogue device enumerate as a trusted input peripheral. Simplex 36-bit, FeliCaFeliCaA contactless smart card standard developed by Sony, widely used in Japanese transit and payment systems, operating at 13.56 MHz with its own proprietary protocol distinct from ISO 14443. auth/dump, saflok commands, and shell execution from the client.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v4.20728 https://github.com/RfidResearchGroup/proxmark3.git
   # already have the repo? check out this version:
   $ git checkout v4.20728

   • Adds hf saflok command suite for Saflok hotel lock interactions.
   • Adds MQTT support: the pm3 client can now send and receive MQTT messages or JSON files, with preferences stored via prefs.
   • Adds ! shell escape — run system commands from inside the pm3 client (note: dangerous when running as root/sudo).
   • Adds lf t55xx view — view T55XX dump files directly without a connected card.
   • Adds hf felica liteauth for FeliCa Lite-S authentication.

   +13 more show less

   • Adds hf felica scsvcode to dump all service and area codes from a FeliCa tag.
   • Adds partial hf felica dump support for dumping all blocks from unauthenticated readable services.
   • Adds HID Simplex Grinnell 36-bit detection with improved Simplex decoder.
   • Adds detection of PCF 7961 chipset.
   • Adds ntag_clean.lua script for easy NTAG memory wipe.
   • Adds --override parameter to NDEF read to bypass MAD CRC check.
   • Extends data crypto to handle AES-256 in addition to existing ciphers.
   • Extends mem load to handle UL-C and UL-AES dictionary files.
   • Extends hf mfu sim to support UL-C simulation.
   • Extends lf search to test for chipset even when only signal noise is detected.
   • Adds Swissbit iShield Key Mifare recognition to hf mfdes info.
   • Extends hf mf info to detect unknown backdoor keys and additional backdoor variants.
   • Extends reveng -g to correctly accept 1024-character hex strings as input.

   18 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !lf t55xx restore now skips writing block 0 if its value is all zeros — cards where a zero block 0 was intentional will no longer have that block written on restore.
8. [Phrack.4.20728][2025-09-11] Sep 11, 2025 · release notes

   Proxmark3 adds MQTT messaging, hf saflok, FeliCaFeliCaA contactless smart card standard developed by Sony, widely used in Japanese transit and payment systems, operating at 13.56 MHz with its own proprietary protocol distinct from ISO 14443. Lite-S auth, and shell command execution.

   • Adds mqtt commands to send and receive MQTT messages or JSON files
   • Adds --override parameter to NDEF read for overriding MAD CRC check
   • Adds hf saflok commands for SAFLOK card support
   • Adds ! shell command to execute system commands from inside the client
   • Adds hf felica liteauth for FeliCa Lite-S authentication

   +2 more show less

   • Adds ntag_clean.lua script for easier NTAG memory wipe
   • Adds detection of PCF 7961 chipsets

   7 details in Everything

9. v4.20469 Jun 16, 2025 · release notes

   proxmark3 v4.20469 adds PM3ULTIMATE platform, iCLASS SAM info, tearoff simulation modes, and major iCLASS legbrute/legrec speed gains.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v4.20469 https://github.com/RfidResearchGroup/proxmark3.git
   # already have the repo? check out this version:
   $ git checkout v4.20469

   └──▷ TRY IT
   Retrieve SAM-specific details when working with an iCLASS SAM-based reader setup.
   copy

   $ hf iclass sam --info

   Speed up legacy iCLASS key recovery with fast mode and automated AA2 block selection.
   copy

   $ hf iclass legrec --fast

   Simulate an iCLASS card that glitches key block responses to test tearoff attack resilience.
   copy

   $ hf iclass sim -t 7

   • Adds PM3ULTIMATE platform support in the build system and FPGA compilation.
   • New hf iclass sam --info option returns SAM-specific details.
   • New hf iclass sim -t 7 implements simulation that glitches key block responses.
   • New hf iclass sim -t 6 implements simulation that glitches SIO block responses.
   • Adds multithreading support to hf iclass legbrute for faster brute-forcing.

   +11 more show less

   • Adds --sl option to hf iclass legrec for speed increase by tweaking communication delays.
   • Adds --fast option to hf iclass legrec for further speed increase with automated AA2 block selection.
   • Achieves ~147% speed increase in hf iclass legrec through additional code optimizations.
   • Adds device-side implementation to hf iclass tear (formerly hf iclass trbl).
   • New standalone mode HF_ST25_TEAROFF enables store/restore of ST25TB tags with tearoff for counters.
   • New hf_mfu_ultra.lua script enables restoring dumps to ULTRA/UL-5 tags and clearing previously written ULTRA tags.
   • Updated ATR list with new entries.
   • hf iclass dump now uses the default AA1 key when called without a key or key index.
   • hf mf autopwn now exits when DESFire is detected and limits attacks when MIFARE Plus is detected.
   • hf mf rdsc now includes the used key in the output within the sector trailer.
   • hf iclass info now uses CSN-value-based checks for card identification.

   16 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !--par has been removed from lf em 4x70 commands.
   • !hf iclass trbl has been renamed to hf iclass tear; scripts or workflows using hf iclass trbl will break.
10. [Daddy Iceman.4.20469][2025-06-16] Jun 16, 2025 · release notes

    Adds PM3ULTIMATE platform build support, hf iclass sam --info, and new standalone modes for ST25TB tearoff and ULTRA tag restoration

    └──▷ TRY IT
    Retrieve SAM-specific details for an ICLASS card during interaction.
    copy

    $ proxmark3> hf iclass sam --info

    Execute a standalone tearoff operation on ST25TB tags without host connection.
    copy

    $ standalone run HF_ST25_TEAROFF

    Restore a previously dumped ULTRA tag state using the new Lua script capability.
    copy

    $ proxmark3> lua hf_mfu_ultra.lua restore <dump_file>

    • Added the PM3ULTIMATE platform in the build / docs.
    • Added fpga compilation for PM3ULTIMATE device
    • Added hf iclass sam --info - option that returns sam specific details
    • Changed hf iclass legbrute - implemented multithreading support
    • Changed hf iclass legrec - added a --sl option for further speed increase by tweaking the communication delays

    +3 more show less

    • Changed hf iclass legrec - added a --fast option for further speed increase and automated AA2 block selection
    • Added new standalone mode HF_ST25_TEAROFF to store/restore ST25TB tags with tearoff for counters
    • Added hf_mfu_ultra.lua script enables restoring dump to ULTRA/UL-5 tags and clearing previously written ULTRA tags

    8 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Renamed hf iclass trbl to hf iclass tear
11. v4.20142 Mar 25, 2025 · release notes

    Proxmark3 v4.20142 adds Hitag µ/8265 support, HIDHIDHuman Interface Device — a USB (and Bluetooth) device class standardized by the USB Implementers Forum covering keyboards, mice, and gamepads; cyber tools use it to make a rogue device enumerate as a trusted input peripheral. SAM SEOS, iClass tear-off attacks, ST25TN, and new UL AES auth.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.20142 https://github.com/RfidResearchGroup/proxmark3.git
    # already have the repo? check out this version:
    $ git checkout v4.20142

    └──▷ TRY IT
    Perform a tear-off attack on an iClass tag to probe write-protection behavior.
    copy

    $ pm3 -- hf iclass trbl

    • Adds des_talk.py script for easier MIFARE DESFire handling.
    • Adds lf em 410x clone --htu to clone EM410x IDs to Hitag µ/8265 tags.
    • Adds lf hitag htu command for Hitag µ/8265 support.
    • Adds hf mfu aesauth command for MIFARE Ultralight AES authentication.
    • Adds hf 15 slixprotectpage command for HF ISO15693 SLIX page protection.

    +22 more show less

    • Adds hf seos sam command for HID SAM SEOS communications support.
    • Adds hf iclass trbl command to perform tear-off attacks on iClass.
    • Adds initial support for ST25TN tags including signature verification.
    • Adds Be-Tech and Texecom vendor identification.
    • Adds new Wiegand formats: 56-bit sample format and H800002.
    • Adds option in hf mf autopwn to use SPISPISerial Peripheral Interface, a synchronous communication bus standard used to connect microcontrollers to sensors, flash memory, and other peripherals at short range; cyber tools use it to read or write firmware on embedded devices. flash dictionary for key attacks.
    • Adds option in hf mf autopwn to set a custom output filename suffix.
    • Adds detection of static encrypted nonces in hf mf autopwn.
    • Adds special iClass legacy config cards support in hf iclass configcard.
    • Adds simulation function to hf iclass legrec.
    • Adds option in hf_mf_ultimatecard script to get/set maximum read/write block number.
    • Adds make commands target to regenerate command documentation and autocompletion data independently of make style.
    • Extends SPI flash key dictionary to hold up to 4095 Mifare keys.
    • Migrates flash-stored key dictionaries (Mifare, iClass, T55XX) and T55XX configs to SPIFFS files.
    • Adds support for Docker environment connection to host device.
    • Updates hf 14a info to identify MIFARE Duox chips.
    • Updates hf mf info to differentiate between full USCUID and cut-down ZUID chips.
    • Updates hf 15 info to show all type matches and check ST25TVxC signatures.
    • Adds JEDEC information for SPI flash W25Q64JV IC.
    • Adds Dutch Statistics Agency default key and Momentum firmware project keys.
    • Updates trace list -t seos to annotate ISO7816 and improve annotation.
    • Updates wiegand decode to accept new padding format and Wiegand formats now include bit count.

    27 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !lf em 410x sim default gap value changed to 0 — setups relying on the previous default gap may behave differently.
12. [Blue Ice.4.20142][2025-03-25] Mar 25, 2025 · release notes

    New RFID commands for Hitag µ/8265, HIDHIDHuman Interface Device — a USB (and Bluetooth) device class standardized by the USB Implementers Forum covering keyboards, mice, and gamepads; cyber tools use it to make a rogue device enumerate as a trusted input peripheral. SAM SEOS, iClass tear-off, and SPISPISerial Peripheral Interface, a synchronous communication bus standard used to connect microcontrollers to sensors, flash memory, and other peripherals at short range; cyber tools use it to read or write firmware on embedded devices. flash dictionary support in proxmark3 Blue Ice.4.20142

    └──▷ USE IT
    Clone an EM410x card ID onto a Hitag µ/8265 device for testing or cloning purposes.
    shell copy

    lf em 410x clone --htu <id>

    Initiate communication with a HID SAM (Secure Access Module) using SEOS protocol for secure access scenarios.
    shell copy

    hf seos sam

    Perform a tear-off attack on an iClass card to extract data or simulate the card.
    shell copy

    hf iclass trbl

    • Added lf hitag htu subcommand for Hitag µ/8265 protocol support
    • Added lf em 410x clone --htu to clone EM410x IDs to Hitag µ/8265 devices
    • Added hf seos sam command for HID SAM SEOS communications
    • Added hf iclass trbl command to perform tear-off attacks on iClass
    • Added hf mfu aesauth based on existing UL AES support

    +5 more show less

    • Added hf 15 slixprotectpage command
    • Added des_talk.py script for easier MIFARE DESFire handling
    • Added support for connection to host device in all Docker envs
    • Changed lf em 4x70 internals on ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. side; Enabling improved debugging and reliability
    • Changed flash-stored key dictionaries (Mifare, iClass, T55XX) and T55XX configurations to SPIFFS files

    10 details in Everything

13. v4.19552 Nov 22, 2024 · release notes

    Proxmark3 Orca adds HitagS reader, AID simulation, iClass unhash, magic 14b UID writing, and dozens of new detections.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.19552 https://github.com/RfidResearchGroup/proxmark3.git
    # already have the repo? check out this version:
    $ git checkout v4.19552

    └──▷ TRY IT
    Simulate a PICC that responds to specific AIDs — useful for testing AID-based reader behavior or card emulation research.
    copy

    $ hf 14a aidsim

    Reverse an iClass diversified key back to its hash0 pre-images for key analysis or legacy reader research.
    copy

    $ hf iclass unhash

    • Adds hf 14b setuid command to set UID on magic 14b tags.
    • Adds hf 14a aidsim command to simulate a PICC and respond to specific AIDs and getData responses.
    • Adds hf iclass unhash command to reverse an iClass diversified key to hash0 pre-images.
    • Adds lf hitag hts reader command to act as a HitagS / 82xx reader.
    • Adds support for all Hitag S response protocol modes.

    +30 more show less

    • Adds support for 8268/8310 chipsets.
    • Adds --gdm flag to hf mf c* commands to write using uscuid/gdm 20/23 alt magic wakeup.
    • Adds detection for FM11NT021 and magic NTAG 215 cards.
    • Adds detection of FM1216-137 CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. cards in hf 14a info and hf mf info.
    • Adds detection of Tiananxin cards in hf 14b info.
    • Adds option in hf mf sim to allow Key B to be used even if readable.
    • Adds data-first and nested reader attack support to hf mf sim.
    • Adds quick dump via backdoor auth support to hf mf ecfill.
    • Adds option to hf 14a reader to wait for a card.
    • Adds JSON dump option to pref show.
    • Adds spi_flash_decode.py helper script to decode JEDEC data.
    • Shows SPISPISerial Peripheral Interface, a synchronous communication bus standard used to connect microcontrollers to sensors, flash memory, and other peripherals at short range; cyber tools use it to read or write firmware on embedded devices. flash JEDEC Manufacturer ID and Device ID in hw status output.
    • Adds support for a new KDF.
    • Adds Inner Range AID and MAD entries.
    • Adds hf iclass configcard support for generating config cards using a key other than the default k0.
    • Expands hf iclass configcard list of available options and functionalities.
    • Improves hf iclass legrec algorithm leveraging reduced entropy from hash0 constraints.
    • Adds iClass custom key to the dictionary; hf iclass chk now loads dictionary file by default.
    • Adds hf iclass info silicon version check and default key trial/decode for legacy cards.
    • Adds hf 14a raw crypto support.
    • Adds recovered maur keys.
    • Adds MifareClassicTool and Flipper project keys.
    • Adds keys for Metro Q transit cards in Houston, TX.
    • Adds mf_backdoor_dump.py script for dumping FM11RF08S and similar tags via known backdoor keys.
    • Updates LUA to v5.4.7, adding UTF-8 support.
    • Extends scripting string parameters to accept up to 1024 characters.
    • Adds hw version output of LUA and Python versions.
    • Adds mem spiffs usage of all available SPI flash space.
    • Adds lf search attempt to read and decode Paxton IDs.
    • Adds lf search identification of Hitag2/S/82xx in chipset detection.

    35 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !lf hitag sim --hts is moved to lf hitag hts sim — existing scripts or workflows using the old subcommand will break.
    • !lf hitag read/write --hts is removed — any use of these flags will fail.
    • !lf hitag hts write is renamed to lf hitag hts wdbl — scripts using the old name will break.
    • !lf hitag hts read is renamed to lf hitag hts rdbl — scripts using the old name will break.
14. [Orca.4.19552][2024-11-22] Nov 22, 2024 · release notes

    New hf_14a aidsim, hf_14b setuid, mf_backdoor_dump.py, lf hitag hts reader/writer/dump commands and quick dump via backdoor auth

    └──▷ USE IT
    Simulate a specific AID response for testing RFID readers
    shell copy

    pm3-hf -c "hf 14a aidsim"

    Dump tag memory using known backdoor keys on FM11RF08S tags
    shell copy

    python3 mf_backdoor_dump.py <tag_data_file>

    Read a HitagS or 82xx tag using the new dedicated reader command
    shell copy

    pm3-hf -c "lf hitag hts reader"

    • Adds hf 14a aidsim command to simulate a PICC and respond to specific AIDs and getData responses
    • Adds hf 14b setuid command to set UID on Magic 14b tags
    • Adds mf_backdoor_dump.py script to dump FM11RF08S and similar tag data using known backdoor keys
    • Adds lf hitag hts reader, lf hitag hts wdbl, and lf hitag hts rdbl commands for HitagS / 82xx operations (renamed from write/read)
    • Enables hf mf ecfill to perform quick dump via backdoor authentication

    +1 more show less

    • Adds option to pref show to dump output as JSON using the new flag

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The lf hitag sim --hts subcommand is renamed to lf hitag hts sim
    • !The lf hitag read --hts and lf hitag write --hts subcommands are removed (replaced by lf hitag hts rdbl and lf hitag hts wdbl)
15. [Backdoor.4.18994][2024-09-10] Sep 10, 2024 · release notes

    New MF key recovery and Iclass brute-force functions, EM410x cloning support, and native output grabbing.

    • Added mfkey32nested command for recovering partial nested authentication with known nT
    • Added lf em 410x clone --hs subcommand to clone an EM410x ID to Hitag S/8211
    • Added new scripts for resetting t55xx chips (lf_t55xx_reset.lua) and ISO14443b tear-off (pm3_tears_for_fears.py)
    • Added native output grabbing capability for Python and Lua scripts, replacing the previous output_grabber.py dependency
    • Added --issue flag and --emulator support to the hf iclass encode command

    +5 more show less

    • Added lf hitag s submenu for organized Hitag S operations
    • Added ELECTRA pattern decoding in lf search
    • Added hf mf isen command for analyzing static encrypted nonce tags
    • Added hf iclass legbrute function to bruteforce 40/64 K1 bits of an Iclass card
    • Added hf iclass legrec function to recover 24/64 K1 bits from an Iclass card

    10 details in Everything

16. [Aurora.4.18589][2024-05-28] May 28, 2024 · release notes

    Adds Hitag2 reader, crypto, dictionary attack capabilities; adds EM4x70 calc and MOBIB/Calypso readers; replaces bin2hex/hex2bin with data num

    └──▷ TRY IT
    Act as a Hitag2 reader to interact with cards
    copy

    $ lf hitag reader

    Calculate FRN/GRN for EM4x70 keys using raw input key and random nonce
    copy

    $ lf em 4x70 calc -k <key> -r <rnd>

    Read all data from a MOBIB card
    copy

    $ hf 14b mobib

    • Adds lf hitag reader to act as a Hitag2 reader
    • Adds lf em 4x70 calc to calculate frn/grn for a given key + rnd
    • Adds hf 14b mobib to read out all data from a MOBIB card
    • Adds hf 14b calyso to read out all data from a Calypso card
    • Adds lf hitag chk dictionary attack against card

    +4 more show less

    • Adds lf hitag lookup to verify collected challenges against dictionary
    • Adds lf_hitag_crypto.trace trace file support for Hitag2 crypto mode reads
    • Adds lf hitag crack2 second attack vector against Hitag2
    • Updates lf hitag dump --nrar to support attack 1 from "gone in 360 seconds" paper

    9 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !data bin2hex and data hex2bin have been removed; use data num instead
17. [Zenith.4.18340][2024-03-20] Mar 20, 2024 · release notes

    New lf em 4x70 autorecover, hf mfu wipe, hf 14b restore commands and -b param for hw standalone in Zenith.4.18340

    • Added lf em 4x70 autorecover command to automatically recover keys from writable ID48 tags
    • Added hf mfu wipe command to fill card memory with zeros
    • Added lf em 4x70 recover command to recover the second half of an id48 key
    • Added hf 14b restore command to restore dump files to a SR512/4k card

    4 details in Everything

18. [DEFCON is Cancelled.4.18218][2024-02-18] Feb 18, 2024 · release notes

    New --dumpmem CLI flag, data crypto subcommand, and multiple protocol/view enhancements in proxmark3

    • Added --dumpmem flag to the proxmark3 client for memory dumping to file
    • Added data crypto command to encrypt and decrypt data using built-in methods
    • Added hf mf gdmparsecfg subcommand to decode GDM/USCUID config blocks
    • Added lf em 4x05 view subcommand to view Em4105 dump files
    • Added hf 14b raw --pico flag for PicoPass anticollision over ISO14443-B

    5 details in Everything

19. [Steamboat Willie.4.17768][2024-01-03] Jan 3, 2024 · release notes

    Proxmark3 adds real-time LF sampling, hf_unisniff standalone sniffing, and hw bootloader command

    • Adds hw bootloader subcommand to reboot the device into bootloader mode
    • Adds hf unisniff standalone mode combining 14a/14b/15 sniffing with extra flash save options
    • Adds real-time LF sampling support
    • Adds Saflok KDF for generating MIFARE ClassicMIFARE ClassicA family of contactless smart card chips made by NXP, widely used in access control and transit systems, whose weak proprietary encryption makes it a frequent target for RFID analysis and cloning tools. keys via the existing key generation infrastructure

    4 details in Everything

20. [Faraday.4.17511][2023-11-13] Nov 13, 2023 · release notes

    New proxmark3 commands for Gen4 GTU, NTAG424, HIDHIDHuman Interface Device — a USB (and Bluetooth) device class standardized by the USB Implementers Forum covering keyboards, mice, and gamepads; cyber tools use it to make a rogue device enumerate as a trusted input peripheral. credentials; JSON format changes; UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery./IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. support

    • tools\mfkeys\staticnested program to recover static nested keys
    • pm3_gen_dictionary.py python script to extract and save all keys from MFC dump files
    • data bmap command to break down a hexvalue to a binary template
    • hf mf gchpwd command for change Gen4 GTU card access password
    • hf mf ginfo command to get info about Gen4 GTU configuration

    +9 more show less

    • hf mf encodehid writes HID legacy credential to an empty MFC
    • hf iclass sam support for HID SAM Picopass communications
    • support for loading Flipper PICOPASS dump files
    • support for loading Flipper MCT/MFU dump files
    • support for NTAG424 cards
    • new --ms option in hw status to specify the timeout of connection speed test
    • UDP support on Windows
    • support for quoted arguments in the CLI
    • client communication timeout configurable in preferences

    14 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Deprecated the EML file format when saving dump files
21. [Raccoon.4.17140][2023-09-09] Sep 9, 2023 · release notes

    New hf iclass emetblk command, data atr lookup, and hw timeout configuration

    └──▷ USE IT
    Set the emulator memory block data for an iClass card emulation session
    shell copy

    pm3> hf iclass esetblk <block_index> <data>

    Lookup ATR information for a detected card
    shell copy

    pm3> data atr

    Configure the connection timeout duration to prevent hanging on slow devices
    shell copy

    pm3> hw timeout <milliseconds>

    • Adds hf iclass esetblk subcommand to set iClass emulator memory block data.
    • Adds data atr subcommand to lookup ATR information.
    • Adds hw timeout subcommand to make the connection timeout configurable.

    3 details in Everything

22. [Seven.4.16717][2023-06-25] Jun 25, 2023 · release notes

    Proxmark3 Seven.4.16717 adds Gen4 GDM tag support, iOS compilation, TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. on Windows, and multiple new CLI commands.

    └──▷ USE IT
    Read the configuration block from a Gen4 GDM tag to inspect its settings.
    shell copy

    hf mf gdmcfg

    Convert a decimal value to hexadecimal using the new utility command.
    shell copy

    data num 255

    • Added hf mf gdmsetcfg to write the configuration block of Gen4 GDM tags
    • Added hf mf gdmcfg to read the configuration block of Gen4 GDM tags
    • Added hf mf gdmsetblk to write a data block on Gen4 GDM tags
    • Added new standalone mode LF_MULTIHID for HID26 multi-simulator functionality
    • Added support for compiling Proxmark3 client on iOS

    +5 more show less

    • Added TCP connection support for the Windows client build
    • Added data num command to easily convert between decimal, hex, and binary
    • Added hf topaz dump --ns subcommand with no save parameter
    • Added lf paradox sim --fc --cn to simulate a Paradox fob from facility code and card number
    • Added --back option to the clear command to clear the scrollback buffer

    10 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Changed CLI max string argument length limit from 512 to 4096
23. [Nitride.4.16191][2023-01-29] Jan 29, 2023 · release notes

    Adds PIV auth/scan commands, NXP SLIX/Gen4 GTU detection, and hf 15 controls

    • Added piv authsign to get a buffer signed by the selected key.
    • Added piv scan which tries to read all known containers on PIV.
    • Added --shallow option to hf iclass reader commands to do shallow (ASK) reader modulation instead of OOK.
    • Added luascript hf_i2c_plus_2k_utils for dumping/modifying user memory of sectors 0 and 1.
    • Added detection of magic Gen4 GTU tags.

    +7 more show less

    • Added hf mfu esave to save emulator memory to mfu dump file.
    • Added luascript hf_mfu_ntag for configuring NTAG216 configuration pages.
    • Changed hf mf hardnested to now detect and use MFC EV1 signature sector key.
    • Changed hf mf autopwn to now detect and use MFC EV1 signature sector key.
    • Added lf paradox clone support for FC/CN parameters.
    • Added standalone mode for simulating Nedap ID tags.
    • Added hf tesla info command to read initial information from TESLA cards.

    12 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !SPISPISerial Peripheral Interface, a synchronous communication bus standard used to connect microcontrollers to sensors, flash memory, and other peripherals at short range; cyber tools use it to read or write firmware on embedded devices. flash overflow fix adds 1 more sector for Mifare; dictionaries must be reloaded because of the changed storage layout.
24. [Radium.4.15864][2022-10-29] Oct 29, 2022 · release notes

    Radium.4.15864 adds new subcommands for LF Indala brute-forcing, HF 14A NDEF writing, JSON Topaz support, and standalone mode for ISO15693 simulation.

    • Added lf indala brute command to brute-force 64b Indala IDs
    • Added hf 14a ndefwrite subcommand to write raw NDEF records to TYPE4A tags
    • Added json as a supported output file format for Topaz tag data
    • Added hf topaz rdbl, wrbl, view commands for reading, writing, and viewing Topaz tags
    • Added --reboot-to-bootloader argument to the main pm3 CLI client

    +1 more show less

    • Added trace extract command to extract authentication parts from a capture trace

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The --single option was removed from hf mf nested; users must now use --tblk instead.
25. [Frostbit.4.14831][2022-01-11] Jan 11, 2022 · release notes

    New hf gallagher commands for DESFire, hf mf acl for access rights, and ATR fingerprinting.

    └──▷ TRY IT
    Read data from a Gallagher DESFire card using the new dedicated command group.
    copy

    $ pm3> hf gallagher help

    Decode MIFARE Access Rights for a specific block to audit permissions.
    copy

    $ pm3> hf mf acl bl 10

    Use a custom password to view MIFARE ClassicMIFARE ClassicA family of contactless smart card chips made by NXP, widely used in access control and transit systems, whose weak proprietary encryption makes it a frequent target for RFID analysis and cloning tools. key data without guessing.
    copy

    $ pm3> hf mf gview --pwd <key_hex>

    • Adds hf gallagher subcommand group for reading/writing MIFARE DESFire cards
    • Adds --raw option to lf gprox demod to decode raw bytes
    • Adds --pwd option to hf mf gview to accept user-supplied passwords
    • Adds --force flag to hf mfu rdb/wrbl to bypass address range checks
    • Adds -k option to lf cmdread to keep RF field on during operation

    +5 more show less

    • Adds --crc-ht option to lf cmdread to compute and append CRC-8/HITAG
    • Adds hf mf acl subcommand to decode and print MIFARE access rights
    • Adds support for KS X 6924 (South Korea T-money cards)
    • Adds ATR fingerprinting capability via hw version offline mode enhancements
    • Adds new standalone mode dankarmulti to select and run multiple standalone modes

    10 details in Everything

26. [crimson.4.14434][2021-09-18] Sep 18, 2021 · release notes

    New standalone modes hf_mfcsim, lf_hidfcbrute, hf_reblay; MIFARE Plus SL3 traces; Electra tag demod; python scripts support

    • Added new standalone mode hf_mfcsim which can load dump from flash and simulate Mifare Classic 1K card
    • Added new standalone mode lf_hidfcbrute - bruteforce facility code
    • Added new standalone mode hf_reblay - relay 14a over bt
    • Added MIFARE Plus SL3 mode traces
    • Added support to demodulate Electra tags and column parity check for EM410x

    +4 more show less

    • Added support python scripts
    • Added -4041x option to lf indala clone for the Indala 4041X format
    • Added a new client preference, delay of execution, a delay in ms before a cmd is sent. Good for implants
    • Added pm3_online_check.py - a script to verify and initialize a Proxmark3 RDV4 device

    9 details in Everything

27. [midsummer.4.13441][2021-06-25] Jun 25, 2021 · release notes

    Adds hf cipurse, mem spiffs view, and standalone mode support for nexwatch and HF CraftByte cards.

    • Adds hf cipurse commands to work with cipurse transport cards
    • Added mem spiffs view command to view external flash memory
    • Added Standalone mode for nexwatch ID credentials
    • Added HF_TMUDFORD standalone mode that reads and emulates ISO15693 UID
    • Added data asn1 command to decode ASN1 byte arrays

    +3 more show less

    • Added LF_CRAFTBYTE standalone mode that reads and emulates 14a UID
    • Added hf mf wipe command taking a keyfile to wipe a MFC to default values
    • Added --gap option to lf em 410x sim for more control over sim data

    8 details in Everything

28. [ice coffee.4.9237][2020-05-21] May 21, 2020 · release notes

    Adds pref command with JSON user preferences, new standalone modes for EM4100 and Mifare Desfire, and native Linux Bluetooth support.

    • Adds pref command to save PM3 client user preferences to a JSON file
    • Adds lf fdx demod subcommand for decoding Bio-Thermo LF tags
    • Adds LF_EM4100RSWB standalone mode to read, simulate, clone, or brute EM4100 cards
    • Adds HF_MSDSAL standalone mode for reading and emulating Visa EMV cards

    4 details in Everything

29. [ice.3.1.0][2017-09-26] Sep 26, 2017 · release notes

    ice.3.1.0 adds device reconnection without restart and improves hf mf decrypt parameters

    • proxmark3 client can reconnect to the connected device without requiring a full process restart.
    • hf mf decrypt now accepts longer input data and displays extended help text via its parameter interface.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !hf mf csave parameter i was renamed to o for output.
30. 3.0.0 Aug 29, 2017 · release notes

    Proxmark3 3.0.0 adds support for NFCNFCNear Field Communication, a short-range (≤4 cm) wireless standard maintained by the NFC Forum, enabling data exchange between devices; cyber tools use it to probe, emulate, or intercept contactless card and tag transactions. Forum Type 5 (T55xx), HIDHIDHuman Interface Device — a USB (and Bluetooth) device class standardized by the USB Implementers Forum covering keyboards, mice, and gamepads; cyber tools use it to make a rogue device enumerate as a trusted input peripheral. ICLASS (CSNS), and low-frequency protocols including Noralsy, Jablotron, FDX-B, GproxII, and Visa2000.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.0.0 https://github.com/RfidResearchGroup/proxmark3.git
    # already have the repo? check out this version:
    $ git checkout 3.0.0

    └──▷ TRY IT
    Perform an attack on hardened Mifare EV1 or Plus SL1 cards using the new command.
    copy

    $ hf mf hardnested

    Write a block to a Hitag2 tag in crypto mode.
    copy

    $ lf hitag write 24

    Read an FDX-B animal tag from the antenna to prepare for cloning.
    copy

    $ lf fdx read

    • Adds hf mf hardnested command, a new attack working for hardened Mifare cards (EV1, Mifare Plus SL1)
    • Adds lf hitag write 24, the command writes a block to hitag2 tags in crypto mode
    • Adds hf mf setmod to set Mifare Classic EV1 load modulation strength to card
    • Adds hf mf nonces to collect Mifare Classic nonces for analysing of PRNG
    • Adds script run ul_uid to try to change UID on a magic UL-card

    +11 more show less

    • Adds new CSNS in hf iclass sim 2 attack
    • Adds lf pac demod, lf pac read commands to extract raw blocks from a PACPACA Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration./Stanley tag
    • Adds lf em 410xbrute for LF EM410x reader bruteforce attack by simulating UIDs from a file
    • Adds data fsktonrz routine for weak fsk signal cleaning/demodulation, followed by data rawdemod nr to finish demoding your signal
    • Adds lf noralsy demod, read, clone, sim commands
    • Adds lf jablotron demod, read, clone, sim commands
    • Adds nexwatch read to read a nexwatch tag from the antenna
    • Adds paradox read to read a paradox tag from the antenna
    • Adds lf fdx sim, lf fdx clone, and lf fdx read commands for FDX-B animal tags
    • Adds gproxii read to read a gproxii tag from the antenna
    • Adds indala read to read an indala tag from the antenna

    16 details in Everything

31. 1.7.0 Mar 7, 2017 · release notes

    New EM4x05/4x69 detection and dump commands, Lua JSON support, LF config-driven timeouts

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.7.0 https://github.com/RfidResearchGroup/proxmark3.git
    # already have the repo? check out this version:
    $ git checkout 1.7.0

    └──▷ TRY IT
    Dump all data blocks from an EM4x05 tag using the new dedicated command
    copy

    $ lf em 4x05dump

    Trim specific signal samples for analysis using the new mtrim utility
    copy

    $ data mtrim 100 500

    • lf em 4x05dump command to read and output all blocks of EM4x05/4x69 chips
    • lf em 4x05info command to read and display chip information
    • lf search now detects EM4x05/EM4x69 chips
    • data setgraphmarkers command to add custom markers on the graph
    • JSON support in Lua scripts

    +1 more show less

    • lf read timeouts now depend on lf config threshold level

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !All lf em4x em* commands renamed to simpler lf em * syntax (e.g., lf em4x em410xdemod becomes lf em 410xdemod)
    • !lf em readword and readwordpwd renamed to lf em 4x05read
    • !lf em writeword and writewordpwd renamed to lf em 4x05write
32. 1.6.9 Feb 6, 2017 · release notes

    Adds hardnested attack script, Aztek tag support, EMV branch compilation, and Hitag2 UID-only read to proxmark3 1.6.9

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.6.9 https://github.com/RfidResearchGroup/proxmark3.git
    # already have the repo? check out this version:
    $ git checkout 1.6.9

    └──▷ TRY IT
    Execute the hardnested brute-force attack against all sectors of a MIFARE ClassicMIFARE ClassicA family of contactless smart card chips made by NXP, widely used in access control and transit systems, whose weak proprietary encryption makes it a frequent target for RFID analysis and cloning tools. tag in one step.
    copy

    $ proxmark3> script run hard_autopwn

    Dumps the full data of an Aztek 2D barcode tag for analysis.
    copy

    $ proxmark3> script run ufodump

    • Adds script run hard_autopwn to run hardnested attacks against all sectors on a tag
    • Adds hf emv command with Peter Fillmore EMV branch support for iceman fork
    • Adds Aztek tag detection and dump capability via hf 14a reader and script run ufodump
    • Adds Hitag2 UID-only read functionality integrated into lf search

    4 details in Everything

33. 1.6.7 Jan 5, 2017 · release notes

    Proxmark3 1.6.7 adds Topaz protocol support, new LF tags, iClass management commands, and Legic raw write capabilities.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.6.7 https://github.com/RfidResearchGroup/proxmark3.git
    # already have the repo? check out this version:
    $ git checkout 1.6.7

    └──▷ USE IT
    Interrogate and snoop NFCNFCNear Field Communication, a short-range (≤4 cm) wireless standard maintained by the NFC Forum, enabling data exchange between devices; cyber tools use it to probe, emulate, or intercept contactless card and tag transactions. Type 1 tags using the new Topaz protocol support
    shell copy

    hf topaz reader
    hf list topaz
    hf 14a raw -T
    hf topaz snoop

    Manage iClass keys in memory and perform full block-level read/write/cloning operations
    shell copy

    hf iclass managekeys
    hf iclass readblk
    hf iclass writeblk
    hf iclass clone
    hf iclass calcnewkey
    hf iclass encryptblk

    • Adds hf topaz reader, hf list topaz, hf 14a raw -T, and hf topaz snoop for NFC Type 1 protocol support
    • Adds hf iclass managekeys to save, load and manage iClass keys in memory
    • Adds hf iclass readblk, hf iclass writeblk, hf iclass clone, hf iclass calcnewkey, and hf iclass encryptblk for full block-level iClass/Picopass operations
    • Adds hf legic writeRaw <addr> <value> to write directly to Legic Prime Tag addresses without using the BigBuffer
    • Adds hf legic load with ability to decrease DCF values at address 0x05 & 0x06

    +28 more show less

    • Adds legic.lua script for displaying and editing data of Legic-Prime Tags
    • Adds lf animal commands for FDX-B animal tag support
    • Adds lf noralsy demod/clone/sim capabilities for Noralsy LF tags
    • Adds lf visa2000 demod/clone/sim capabilities for Visa2000 LF tags
    • Adds hf mf key_brute command implementing J-Runs 2nd phase brute force logic
    • Adds lf jablotron demod/clone/sim capabilities for Jablotron LF tags
    • Adds lf t55xx recoverpw for password recovery using bitflips and partial flips
    • Adds analyse lrc command group to analyze bytes, bits, and nibbles
    • Adds lf guard clone/sim and lf pyramd clone/sim capabilities
    • Adds hf 14a sim and hf mf sim emulation of Mifare cards with 10-byte UID length
    • Adds lf presco commands for Presco tag support
    • Adds lf hid wiegand method to calculate WIEGAND in different formats
    • Adds hw status command to print ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. runtime information
    • Adds hw ping command to send USB packets and check device responsiveness
    • Adds data hex2bin and data bin2hex for binary/hexadecimal conversion
    • Adds hf snoop command to take digitalized signal from FPGA and put in BigBuffer
    • Adds option c to hf list to mark CRC bytes
    • Adds lf awid bruteforce <facilitycode> for AWID reader brute force attacks
    • Adds lf t55xx bruteforce <start password> <end password> [i <*.dic>] for T55xx password finding
    • Adds lf viking clone, lf viking sim, and lf viking read commands for Viking tag operations
    • Adds data askvikingdemod to demodulate Viking ID tags from graph buffer
    • Adds lf t55xx resetread for reset then read command on T55xx tags
    • Adds lf t55xx wakeup with password (AOR) for LF search or standard LF read after wake up
    • Adds hf mf eload u ultralight/ntag option
    • Added experimental HITAG_S support
    • Added Topaz detection to hf search
    • Updated Crapto1 implementation to v3.3
    • Started integration of Peter Fillmore EMV fork

    33 details in Everything

34. 2.2.0 Jul 12, 2015 · release notes

    Adds hf 14b reader, hf 14b info, hf 14b raw -s options and PACE replay to Proxmark3 v2.2.0.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.2.0 https://github.com/RfidResearchGroup/proxmark3.git
    # already have the repo? check out this version:
    $ git checkout 2.2.0

    └──▷ USE IT
    Auto-select a standard tag and inspect its detailed properties using raw commands.
    shell copy

    hf 14b raw -s

    • hf 14b reader finds and prints general information about known 14b tags
    • hf 14b info retrieves detailed information for standard 14b tags and sri tags by utilizing the underlying 14b raw commands
    • Adds -s flag to hf 14b raw to auto-select a 14b std tag before executing raw commands
    • Implements PACE replay functionality

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The hf 14b write subcommand has been renamed to hf 14b sriwrite; the previous name will no longer work.
35. 2.1.0 Jun 23, 2015 · release notes

    Adds hf search for multi-protocol tag discovery and data fdxbdemod for FDX-B animal tags in v2.1.0.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.1.0 https://github.com/RfidResearchGroup/proxmark3.git
    # already have the repo? check out this version:
    $ git checkout 2.1.0

    • Adds hf search command to detect ISO14443A, iCLASS, and ISO15693 tags
    • Adds data fdxbdemod subcommand to demodulate FDX-B (ISO11784/85) animal tags from the GraphBuffer

    2 details in Everything