proxmark3 — The Cyber Toolchain

proxmark3 v4.23346

Thu, 17 Sep 2026 22:28:27 GMT

Proxmark3 v4.23346 adds full DESFire EV1 simulation, new dump/view/test commands, and unified UL key-check.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `hf mfdes etest` — drives the DESFire simulation over USB without RF, with injectable RndB and random UID.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `hf mfdes sim` — DESFire EV1 simulation now answers authentication, secure messaging, file reads, writes, and transactions from the card image in emulator memory. • Adds `hf mfdes sim` — answers ISO 7816 SELECT by DF name or file ID with real status words, so a reader that opens with a SELECT reaches the simulated card. • Adds `hf mfdes sim` — SetConfiguration is answered, so a reader can disable FormatPICC, switch the card to a random UID, or give it a user-defined ATS. • Adds `hf mfdes sim` — ReadSignature is answered for a card image of a generation that has one, refused the way a genuine EV1 refuses it. • Adds `hf mfdes sim` — GetKeyVersion is answered, so a reader can read the version of any key without knowing the key itself. • Adds `hf mfdes sim` — ChangeKeySettings is answered, enciphered and master key only. • Adds `hf mfdes sim` — ChangeKey is answered (both plain and XORed key frame), so a reader can rekey the simulated card and new keys are reflected in `hf mfdes esave` output. • Adds `hf mfdes sim` — ChangeFileSettings is answered, plain when the change access right is free and enciphered under the named key otherwise. • Adds `hf mfdes sim` — CreateFile (all five EV1 flavours) and DeleteFile are answered, so a reader can lay out an application's file system on the simulated card. • Adds `hf mfdes sim` — CreateApplication and DeleteApplication are answered, so a reader can add and remove applications on the simulated card. • Adds `hf mfdes sim` — FormatPICC is answered, releasing every application and file and returning memory, keeping the PICC master key and settings. • Adds `hf mfdes sim` — answers GetDFNames and GetISOFileIDs, so a reader sees the ISO file IDs and DF names of the simulated card. • Adds `hf mfdes eload/esave/eview` — load, save, and view a DESFire card dump in emulator memory. • Adds `--keep` flag to `hf mfdes esave` — preserves applications and files a reader deleted, which are otherwise omitted so the dump reflects the card as a reader sees it. • Adds `hf mfdes dump` — walks the whole PICC and saves a `hf-mfdes--dump.json` card image, automatically picking up `hf-mfdes--keys.json`. • Adds `hf mfdes view` — prints a DESFire card dump file with no device attached. • Adds `hf 14b view` — MyKey / COGES keys on SRIX4K now decode. • Adds `hf 14b view --selftest` — runs the MyKey parser self-tests. • Adds `vigik_recover_pk.py` — Python script to recover public keys from RSA signatures. • Adds named DESFire status codes for the five codes that indicate a card damaged or disabled itself, replacing the raw `-20` value. • Merges `hf mfu cchk` and `hf mfu aeschk` into a single `hf mfu chk` command that auto-detects UL-C vs UL-AES. • Removes `hf 14b valid` — replaced by the MyKey parser. • Changes `hf mfdes chk` to check every key number the application declares, not only those named in a file's access rights. • Changes `hf mfdes chk` to run with no arguments, falling back to the bundled dictionary the way `hf mfdes detect` does. • Changes `hf mf view` to show which VIGIK fields are RSA signed. • Changes `hf mf view` to decode Urmet Captiv card number fields and data regions. • Changes `hf mf view` to decode Hexact sector 9 and 11 payload, cross-checked against sectors 0 and 15 and UID. • Changes `hf mf view --selftest` to also check the Hexact payload decoder in both directions. • Changes `hw status` to report EMULATOR memory. • Changes `pm3 history` to write after every command, so history survives a kill rather than only a clean exit. • Changes emulator memory size — raised from 4096 to 8192 bytes. • Changes NG reply framing so the payload lands word-aligned, increasing USB transfer speed from 630 to 789 kB/s on RDV4. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/proxmark3

proxmark3 v4.21611

Tue, 14 Apr 2026 08:24:52 GMT

Proxmark3 v4.21611 adds 30+ new commands spanning iClass, DESFire, FeliCa, Aliro, GST, VAS, NFC tearoff attacks, and internet-relayed LF/HF. • Adds `lf relay` command to relay between two Proxmark3 devices over the internet. • Adds `hf mfp acl` command for Mifare Plus ACL inspection. • Adds `hf mfp dump` command to dump Mifare Plus card contents. • Adds `hf mfdes brutedamslot` command for DESFire DAM slot brute-forcing. • Adds `hf mfdes getdelegateappinfo` command for retrieving DESFire delegate application info. • Adds `hf mfdes createdelegateapp` command for creating DESFire delegate applications. • Adds `hf mfdes bruteisofid` and `hf mfdes selectisofid` commands for ISO FID brute-forcing and selection on DESFire. • Adds `dict`, `ascii`, and `mad` presets to `hf mfdes bruteaid` along with tag loss detection and recovery. • Adds `hf secc info` command to retrieve the Card Recognition Template from iClass SE config cards. • Adds `hf secc sim` with wildcard payload support for simulating iClass SE config card functions. • Adds `hf iclass tagsim` command to simulate an iClass card from a facility code and card number. • Adds `hf iclass blacktears` command for automated tearoff of block 1 to set non-secure page mode. • Adds `--live` option to `hf iclass lookup` for live reader-key recovery by simulating a tag and running lookups against standard and elite dictionaries. • Adds `-f` parameter to `hf iclass sam` to parse a card dump using the SAM. • Significantly optimizes `hf iclass legbrute` throughput via iterative cipher loops, 256-entry LUT, in-place state updates, and byte-wise MAC brute-forcing, plus improved multithreaded key-range partitioning with ETA display and keyboard abort. • Adds `hf gst read` and `hf gst info` commands for GST tag interaction. • Adds `hf vas info` command for Value Added Services tag information. • Adds `hf aliro read` and `hf aliro info` commands for Aliro access credential reading. • Adds `hf felica discnodes` command for FeliCa node discovery. • Adds `hf felica seacinfo` command for FeliCa SEAC information retrieval. • Adds `hf 14b tearoff` interactive tear-off attack against ST25TB/SRx monotonic counters. • Adds `-t` / `--timeout` option to `hf 15 sim` for ISO 15693 simulation timeout control. • Adds `--aid` parameter to `hf seos` commands for explicit AID targeting. • Adds Mifare Classic support to `hf gallagher` command. • Extends `wiegand encode` / `wiegand decode` with 96-bit ASN.1 encoded format support, `--bin` encoding, verbose PACS output, and explicit rejection of raw/binary decodes above 96 bits. • Adds `hf mf acl` recognition of more generic ACL configurations. • Updates `data_hex_crc.lua` script with a `-s` parameter and alternating row color output. • Adds DESFire AID values related to LEAF for use in DESFire enumeration commands. • Adds hardening (ASLR/stack-protector/etc.) for all host binaries, with level dependent on OS. • Adds Qt6 support for the Proxmark3 client GUI. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/proxmark3

proxmark3 [BREAKMEIFYOUCAN!.4.21611][2026-04-14]

Tue, 14 Apr 2026 00:00:00 GMT

New LF relay over internet, Mifare DESFire delegate app commands, SECC info command, and Qt6 client support • Adds `lf relay` subcommand to relay between two pm3 devices over the internet • Adds `hf mfp acl` subcommand for ACL configuration on Multi-Frequency Proxmark cards • Adds `--live` option to `hf iclass lookup` command to perform a live recovery of the reader's key • Adds `hf mfdes createdelegateapp`, `hf mfdes getdelegateappinfo`, and `hf mfdes brutedamslot` subcommands for DESFire delegate app manipulation • Adds `--aid` parameter to all `hf seos` commands to specify Application Identifier • Adds `-f` parameter to `hf iclass sam` command to use SAM to parse a card dump • Adds `hf iclass tagsim` subcommand to quickly simulate an iClass card based on facility code and card number Full history on Cyber Toolchain: https://cybertoolchain.io/tools/proxmark3

proxmark3 v4.21128

Wed, 25 Feb 2026 15:19:04 GMT

proxmark3 v4.21128 adds Ultralight AES full-stack support, QR code generation, hf seos write/sim, and a new multi-KDF keygen command. • New standalone mode `HF_DOEGOX_AUTH0` unlocks UL-C / UL-AES tags without a host connection. • Adds `--` argument separator in the pm3 client to pass trailing arguments directly to scripts. • Adds `hf mf keygen` with multiple KDF support (including Snapmaker U1 filament spool and Bambu Lab keys), replacing `hf mf bambukeys`. • Adds `data qrcode` command to generate QR codes from inside the pm3 client. • Adds support for reading Bruce dump files (`.rfid` format). • Adds `hf 14b config` command with polling-loop annotation support and better ECP configuration aliases. • Adds full Ultralight AES support across `hf mfu info/rdbl/wrbl/dump/ndefread/wipe/setkey`, including auth, secure messaging, and basic DataProtKey emulation. • Adds Ultralight AES secure messaging support in `hf 14a raw`. • Adds ATR fingerprinting to `hf 14a info` and `hf 14b info`. • Adds `hf seos write` command for writing SEOS card data. • Adds `hf seos sim` command for simulating SEOS cards. • Adds Verkada 40-bit credential format support. • Adds Kaba evolo AID identification. • Adds identification of NDEF/Open print tag records. • Adds `client/resources/pm3_generic_private_key.pem` to enable self-signing a modified device. • Adds `script read_t-union.py` for reading T-Union transit cards. Breaking changes: • `hf mf bambukeys` has been replaced by `hf mf keygen`; existing scripts or workflows calling `hf mf bambukeys` will break. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/proxmark3

proxmark3 [Permafrost.4.21128][2026-02-25]

Wed, 25 Feb 2026 00:00:00 GMT

New `data qrcode` generation, `--` script arg separator, Ultralight AES auth/messaging support, and SEOS write/sim commands • Adds `data qrcode` command to generate QR codes from inside the pm3 client • Adds `--` argument separator in client to pass following args to scripts • Adds `hf mfu cchk` and `aeschk` commands, plus options to `hf mf cauth/aesauth` • Adds card auth reply injection support in `hf mfu sim` • Adds Ultralight AES secure messaging support in `hf 14a raw` subcommands • Adds Ultralight AES authentication support in `hf mfu info/rdbl/wrbl/dump/ndefread/wipe/setkey` subcommands • Adds Ultralight AES basic DataProtKey emulation support • Adds `hf seos write` command for writing SEOS data • Adds `hf seos sim` command for simulating SEOS cards • Adds ATR fingerprinting to `hf 14a info` and `hf 14b info` commands • Adds `Verkada 40-bit` identification format • Adds Kaba evolo AIDs support • Adds `read_t-union.py` script for tag reading • Adds better ECP configuration aliases in config • Adds `hf 14b config` command with polling loop annotation support • Adds `client/resources/pm3_generic_private_key.pem` for self-signing modded devices Breaking changes: • Replaces the existing `hf mf bambukeys` command with `hf mf keygen`, which now supports multiple KDFs instead of just Bambu-specific keys Full history on Cyber Toolchain: https://cybertoolchain.io/tools/proxmark3

proxmark3 v4.20728

Thu, 11 Sep 2025 18:34:37 GMT

Proxmark3 v4.20728 adds MQTT client, HID Simplex 36-bit, FeliCa auth/dump, saflok commands, and shell execution from the client. • Adds `hf saflok` command suite for Saflok hotel lock interactions. • Adds MQTT support: the pm3 client can now send and receive MQTT messages or JSON files, with preferences stored via `prefs`. • Adds `!` shell escape — run system commands from inside the pm3 client (note: dangerous when running as root/sudo). • Adds `lf t55xx view` — view T55XX dump files directly without a connected card. • Adds `hf felica liteauth` for FeliCa Lite-S authentication. • Adds `hf felica scsvcode` to dump all service and area codes from a FeliCa tag. • Adds partial `hf felica dump` support for dumping all blocks from unauthenticated readable services. • Adds HID Simplex Grinnell 36-bit detection with improved Simplex decoder. • Adds detection of PCF 7961 chipset. • Adds `ntag_clean.lua` script for easy NTAG memory wipe. • Adds `--override` parameter to NDEF read to bypass MAD CRC check. • Extends `data crypto` to handle AES-256 in addition to existing ciphers. • Extends `mem load` to handle UL-C and UL-AES dictionary files. • Extends `hf mfu sim` to support UL-C simulation. • Extends `lf search` to test for chipset even when only signal noise is detected. • Adds Swissbit iShield Key Mifare recognition to `hf mfdes info`. • Extends `hf mf info` to detect unknown backdoor keys and additional backdoor variants. • Extends `reveng -g` to correctly accept 1024-character hex strings as input. Breaking changes: • `lf t55xx restore` now skips writing block 0 if its value is all zeros — cards where a zero block 0 was intentional will no longer have that block written on restore. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/proxmark3

proxmark3 [Phrack.4.20728][2025-09-11]

Thu, 11 Sep 2025 00:00:00 GMT

Proxmark3 adds MQTT messaging, `hf saflok`, FeliCa Lite-S auth, and shell command execution. • Adds `mqtt` commands to send and receive MQTT messages or JSON files • Adds `--override` parameter to NDEF read for overriding MAD CRC check • Adds `hf saflok` commands for SAFLOK card support • Adds `!` shell command to execute system commands from inside the client • Adds `hf felica liteauth` for FeliCa Lite-S authentication • Adds `ntag_clean.lua` script for easier NTAG memory wipe • Adds detection of PCF 7961 chipsets Full history on Cyber Toolchain: https://cybertoolchain.io/tools/proxmark3

proxmark3 v4.20469

Mon, 16 Jun 2025 14:22:55 GMT

proxmark3 v4.20469 adds PM3ULTIMATE platform, iCLASS SAM info, tearoff simulation modes, and major iCLASS legbrute/legrec speed gains. • Adds PM3ULTIMATE platform support in the build system and FPGA compilation. • New `hf iclass sam --info` option returns SAM-specific details. • New `hf iclass sim -t 7` implements simulation that glitches key block responses. • New `hf iclass sim -t 6` implements simulation that glitches SIO block responses. • Adds multithreading support to `hf iclass legbrute` for faster brute-forcing. • Adds `--sl` option to `hf iclass legrec` for speed increase by tweaking communication delays. • Adds `--fast` option to `hf iclass legrec` for further speed increase with automated AA2 block selection. • Achieves ~147% speed increase in `hf iclass legrec` through additional code optimizations. • Adds device-side implementation to `hf iclass tear` (formerly `hf iclass trbl`). • New standalone mode `HF_ST25_TEAROFF` enables store/restore of ST25TB tags with tearoff for counters. • New `hf_mfu_ultra.lua` script enables restoring dumps to ULTRA/UL-5 tags and clearing previously written ULTRA tags. • Updated ATR list with new entries. • `hf iclass dump` now uses the default AA1 key when called without a key or key index. • `hf mf autopwn` now exits when DESFire is detected and limits attacks when MIFARE Plus is detected. • `hf mf rdsc` now includes the used key in the output within the sector trailer. • `hf iclass info` now uses CSN-value-based checks for card identification. Breaking changes: • `--par` has been removed from `lf em 4x70` commands. • `hf iclass trbl` has been renamed to `hf iclass tear`; scripts or workflows using `hf iclass trbl` will break. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/proxmark3

proxmark3 [Daddy Iceman.4.20469][2025-06-16]

Mon, 16 Jun 2025 00:00:00 GMT

Adds PM3ULTIMATE platform build support, `hf iclass sam --info`, and new standalone modes for ST25TB tearoff and ULTRA tag restoration • Added the `PM3ULTIMATE` platform in the build / docs. • Added fpga compilation for PM3ULTIMATE device • Added `hf iclass sam --info` - option that returns sam specific details • Changed `hf iclass legbrute` - implemented multithreading support • Changed `hf iclass legrec` - added a --sl option for further speed increase by tweaking the communication delays • Changed `hf iclass legrec` - added a --fast option for further speed increase and automated AA2 block selection • Added new standalone mode `HF_ST25_TEAROFF` to store/restore ST25TB tags with tearoff for counters • Added `hf_mfu_ultra.lua` script enables restoring dump to ULTRA/UL-5 tags and clearing previously written ULTRA tags Breaking changes: • Renamed `hf iclass trbl` to `hf iclass tear` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/proxmark3

proxmark3 v4.20142

Tue, 25 Mar 2025 15:25:17 GMT

Proxmark3 v4.20142 adds Hitag µ/8265 support, HID SAM SEOS, iClass tear-off attacks, ST25TN, and new UL AES auth. • Adds `des_talk.py` script for easier MIFARE DESFire handling. • Adds `lf em 410x clone --htu` to clone EM410x IDs to Hitag µ/8265 tags. • Adds `lf hitag htu` command for Hitag µ/8265 support. • Adds `hf mfu aesauth` command for MIFARE Ultralight AES authentication. • Adds `hf 15 slixprotectpage` command for HF ISO15693 SLIX page protection. • Adds `hf seos sam` command for HID SAM SEOS communications support. • Adds `hf iclass trbl` command to perform tear-off attacks on iClass. • Adds initial support for ST25TN tags including signature verification. • Adds Be-Tech and Texecom vendor identification. • Adds new Wiegand formats: 56-bit sample format and H800002. • Adds option in `hf mf autopwn` to use SPI flash dictionary for key attacks. • Adds option in `hf mf autopwn` to set a custom output filename suffix. • Adds detection of static encrypted nonces in `hf mf autopwn`. • Adds special iClass legacy config cards support in `hf iclass configcard`. • Adds simulation function to `hf iclass legrec`. • Adds option in `hf_mf_ultimatecard` script to get/set maximum read/write block number. • Adds `make commands` target to regenerate command documentation and autocompletion data independently of `make style`. • Extends SPI flash key dictionary to hold up to 4095 Mifare keys. • Migrates flash-stored key dictionaries (Mifare, iClass, T55XX) and T55XX configs to SPIFFS files. • Adds support for Docker environment connection to host device. • Updates `hf 14a info` to identify MIFARE Duox chips. • Updates `hf mf info` to differentiate between full USCUID and cut-down ZUID chips. • Updates `hf 15 info` to show all type matches and check ST25TVxC signatures. • Adds JEDEC information for SPI flash W25Q64JV IC. • Adds Dutch Statistics Agency default key and Momentum firmware project keys. • Updates `trace list -t seos` to annotate ISO7816 and improve annotation. • Updates `wiegand decode` to accept new padding format and Wiegand formats now include bit count. Breaking changes: • `lf em 410x sim` default gap value changed to 0 — setups relying on the previous default gap may behave differently. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/proxmark3

proxmark3 [Blue Ice.4.20142][2025-03-25]

Tue, 25 Mar 2025 00:00:00 GMT

New RFID commands for Hitag µ/8265, HID SAM SEOS, iClass tear-off, and SPI flash dictionary support in proxmark3 Blue Ice.4.20142 • Added `lf hitag htu` subcommand for Hitag µ/8265 protocol support • Added `lf em 410x clone --htu` to clone EM410x IDs to Hitag µ/8265 devices • Added `hf seos sam` command for HID SAM SEOS communications • Added `hf iclass trbl` command to perform tear-off attacks on iClass • Added `hf mfu aesauth` based on existing UL AES support • Added `hf 15 slixprotectpage` command • Added `des_talk.py` script for easier MIFARE DESFire handling • Added support for connection to host device in all Docker envs • Changed `lf em 4x70` internals on ARM side; Enabling improved debugging and reliability • Changed flash-stored key dictionaries (Mifare, iClass, T55XX) and T55XX configurations to SPIFFS files Full history on Cyber Toolchain: https://cybertoolchain.io/tools/proxmark3

proxmark3 v4.19552

Fri, 22 Nov 2024 11:18:19 GMT

Proxmark3 "Orca" adds HitagS reader, AID simulation, iClass unhash, magic 14b UID writing, and dozens of new detections. • Adds `hf 14b setuid` command to set UID on magic 14b tags. • Adds `hf 14a aidsim` command to simulate a PICC and respond to specific AIDs and getData responses. • Adds `hf iclass unhash` command to reverse an iClass diversified key to hash0 pre-images. • Adds `lf hitag hts reader` command to act as a HitagS / 82xx reader. • Adds support for all Hitag S response protocol modes. • Adds support for 8268/8310 chipsets. • Adds `--gdm` flag to `hf mf c*` commands to write using uscuid/gdm 20/23 alt magic wakeup. • Adds detection for FM11NT021 and magic NTAG 215 cards. • Adds detection of FM1216-137 CPU cards in `hf 14a info` and `hf mf info`. • Adds detection of Tiananxin cards in `hf 14b info`. • Adds option in `hf mf sim` to allow Key B to be used even if readable. • Adds data-first and nested reader attack support to `hf mf sim`. • Adds quick dump via backdoor auth support to `hf mf ecfill`. • Adds option to `hf 14a reader` to wait for a card. • Adds JSON dump option to `pref show`. • Adds `spi_flash_decode.py` helper script to decode JEDEC data. • Shows SPI flash JEDEC Manufacturer ID and Device ID in `hw status` output. • Adds support for a new KDF. • Adds Inner Range AID and MAD entries. • Adds `hf iclass configcard` support for generating config cards using a key other than the default k0. • Expands `hf iclass configcard` list of available options and functionalities. • Improves `hf iclass legrec` algorithm leveraging reduced entropy from hash0 constraints. • Adds iClass custom key to the dictionary; `hf iclass chk` now loads dictionary file by default. • Adds `hf iclass info` silicon version check and default key trial/decode for legacy cards. • Adds `hf 14a raw` crypto support. • Adds recovered maur keys. • Adds MifareClassicTool and Flipper project keys. • Adds keys for Metro Q transit cards in Houston, TX. • Adds `mf_backdoor_dump.py` script for dumping FM11RF08S and similar tags via known backdoor keys. • Updates LUA to v5.4.7, adding UTF-8 support. • Extends scripting string parameters to accept up to 1024 characters. • Adds `hw version` output of LUA and Python versions. • Adds `mem spiffs` usage of all available SPI flash space. • Adds `lf search` attempt to read and decode Paxton IDs. • Adds `lf search` identification of Hitag2/S/82xx in chipset detection. Breaking changes: • `lf hitag sim --hts` is moved to `lf hitag hts sim` — existing scripts or workflows using the old subcommand will break. • `lf hitag read/write --hts` is removed — any use of these flags will fail. • `lf hitag hts write` is renamed to `lf hitag hts wdbl` — scripts using the old name will break. • `lf hitag hts read` is renamed to `lf hitag hts rdbl` — scripts using the old name will break. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/proxmark3

proxmark3 [Orca.4.19552][2024-11-22]

Fri, 22 Nov 2024 00:00:00 GMT

New hf_14a aidsim, hf_14b setuid, mf_backdoor_dump.py, lf hitag hts reader/writer/dump commands and quick dump via backdoor auth • Adds `hf 14a aidsim` command to simulate a PICC and respond to specific AIDs and getData responses • Adds `hf 14b setuid` command to set UID on Magic 14b tags • Adds `mf_backdoor_dump.py` script to dump FM11RF08S and similar tag data using known backdoor keys • Adds `lf hitag hts reader`, `lf hitag hts wdbl`, and `lf hitag hts rdbl` commands for HitagS / 82xx operations (renamed from write/read) • Enables `hf mf ecfill` to perform quick dump via backdoor authentication • Adds option to `pref show` to dump output as JSON using the new flag Breaking changes: • The `lf hitag sim --hts` subcommand is renamed to `lf hitag hts sim` • The `lf hitag read --hts` and `lf hitag write --hts` subcommands are removed (replaced by `lf hitag hts rdbl` and `lf hitag hts wdbl`) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/proxmark3

proxmark3 [Backdoor.4.18994][2024-09-10]

Tue, 10 Sep 2024 00:00:00 GMT

New MF key recovery and Iclass brute-force functions, EM410x cloning support, and native output grabbing. • Added `mfkey32nested` command for recovering partial nested authentication with known nT • Added `lf em 410x clone --hs` subcommand to clone an EM410x ID to Hitag S/8211 • Added new scripts for resetting t55xx chips (`lf_t55xx_reset.lua`) and ISO14443b tear-off (`pm3_tears_for_fears.py`) • Added native output grabbing capability for Python and Lua scripts, replacing the previous `output_grabber.py` dependency • Added `--issue` flag and `--emu`lator support to the `hf iclass encode` command • Added `lf hitag s` submenu for organized Hitag S operations • Added ELECTRA pattern decoding in `lf search` • Added `hf mf isen` command for analyzing static encrypted nonce tags • Added `hf iclass legbrute` function to bruteforce 40/64 K1 bits of an Iclass card • Added `hf iclass legrec` function to recover 24/64 K1 bits from an Iclass card Full history on Cyber Toolchain: https://cybertoolchain.io/tools/proxmark3

proxmark3 [Aurora.4.18589][2024-05-28]

Tue, 28 May 2024 00:00:00 GMT

Adds Hitag2 reader, crypto, dictionary attack capabilities; adds EM4x70 calc and MOBIB/Calypso readers; replaces bin2hex/hex2bin with data num • Adds `lf hitag reader` to act as a Hitag2 reader • Adds `lf em 4x70 calc` to calculate `frn`/`grn` for a given `key` + `rnd` • Adds `hf 14b mobib` to read out all data from a MOBIB card • Adds `hf 14b calyso` to read out all data from a Calypso card • Adds `lf hitag chk` dictionary attack against card • Adds `lf hitag lookup` to verify collected challenges against dictionary • Adds `lf_hitag_crypto.trace` trace file support for Hitag2 crypto mode reads • Adds `lf hitag crack2` second attack vector against Hitag2 • Updates `lf hitag dump --nrar` to support attack 1 from "gone in 360 seconds" paper Breaking changes: • `data bin2hex` and `data hex2bin` have been removed; use `data num` instead Full history on Cyber Toolchain: https://cybertoolchain.io/tools/proxmark3

proxmark3 [Zenith.4.18340][2024-03-20]

Wed, 20 Mar 2024 00:00:00 GMT

New `lf em 4x70 autorecover`, `hf mfu wipe`, `hf 14b restore` commands and `-b` param for `hw standalone` in Zenith.4.18340 • Added `lf em 4x70 autorecover` command to automatically recover keys from writable ID48 tags • Added `hf mfu wipe` command to fill card memory with zeros • Added `lf em 4x70 recover` command to recover the second half of an id48 key • Added `hf 14b restore` command to restore dump files to a SR512/4k card Full history on Cyber Toolchain: https://cybertoolchain.io/tools/proxmark3

proxmark3 [DEFCON is Cancelled.4.18218][2024-02-18]

Sun, 18 Feb 2024 00:00:00 GMT

New `--dumpmem` CLI flag, `data crypto` subcommand, and multiple protocol/view enhancements in proxmark3 • Added `--dumpmem` flag to the proxmark3 client for memory dumping to file • Added `data crypto` command to encrypt and decrypt data using built-in methods • Added `hf mf gdmparsecfg` subcommand to decode GDM/USCUID config blocks • Added `lf em 4x05 view` subcommand to view Em4105 dump files • Added `hf 14b raw --pico` flag for PicoPass anticollision over ISO14443-B Full history on Cyber Toolchain: https://cybertoolchain.io/tools/proxmark3

proxmark3 [Steamboat Willie.4.17768][2024-01-03]

Wed, 03 Jan 2024 00:00:00 GMT

Proxmark3 adds real-time LF sampling, hf_unisniff standalone sniffing, and hw bootloader command • Adds `hw bootloader` subcommand to reboot the device into bootloader mode • Adds `hf unisniff` standalone mode combining 14a/14b/15 sniffing with extra flash save options • Adds real-time LF sampling support • Adds Saflok KDF for generating MIFARE Classic keys via the existing key generation infrastructure Full history on Cyber Toolchain: https://cybertoolchain.io/tools/proxmark3

proxmark3 [Faraday.4.17511][2023-11-13]

Mon, 13 Nov 2023 00:00:00 GMT

New proxmark3 commands for Gen4 GTU, NTAG424, HID credentials; JSON format changes; UDP/IPv6 support • `tools\mfkeys\staticnested` program to recover static nested keys • `pm3_gen_dictionary.py` python script to extract and save all keys from MFC dump files • `data bmap` command to break down a hexvalue to a binary template • `hf mf gchpwd` command for change Gen4 GTU card access password • `hf mf ginfo` command to get info about Gen4 GTU configuration • `hf mf encodehid` writes HID legacy credential to an empty MFC • `hf iclass sam` support for HID SAM Picopass communications • support for loading Flipper PICOPASS dump files • support for loading Flipper MCT/MFU dump files • support for NTAG424 cards • new `--ms` option in `hw status` to specify the timeout of connection speed test • UDP support on Windows • support for quoted arguments in the CLI • client communication timeout configurable in preferences Breaking changes: • Deprecated the EML file format when saving dump files Full history on Cyber Toolchain: https://cybertoolchain.io/tools/proxmark3

proxmark3 [Raccoon.4.17140][2023-09-09]

Sat, 09 Sep 2023 00:00:00 GMT

New hf iclass emetblk command, data atr lookup, and hw timeout configuration • Adds `hf iclass esetblk` subcommand to set iClass emulator memory block data. • Adds `data atr` subcommand to lookup ATR information. • Adds `hw timeout` subcommand to make the connection timeout configurable. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/proxmark3

proxmark3 [Seven.4.16717][2023-06-25]

Sun, 25 Jun 2023 00:00:00 GMT

Proxmark3 Seven.4.16717 adds Gen4 GDM tag support, iOS compilation, TCP on Windows, and multiple new CLI commands. • Added `hf mf gdmsetcfg` to write the configuration block of Gen4 GDM tags • Added `hf mf gdmcfg` to read the configuration block of Gen4 GDM tags • Added `hf mf gdmsetblk` to write a data block on Gen4 GDM tags • Added new standalone mode `LF_MULTIHID` for HID26 multi-simulator functionality • Added support for compiling Proxmark3 client on iOS • Added TCP connection support for the Windows client build • Added `data num` command to easily convert between decimal, hex, and binary • Added `hf topaz dump --ns` subcommand with `no save` parameter • Added `lf paradox sim --fc --cn` to simulate a Paradox fob from facility code and card number • Added `--back` option to the `clear` command to clear the scrollback buffer Breaking changes: • Changed CLI max string argument length limit from 512 to 4096 Full history on Cyber Toolchain: https://cybertoolchain.io/tools/proxmark3

proxmark3 [Nitride.4.16191][2023-01-29]

Sun, 29 Jan 2023 00:00:00 GMT

Adds PIV auth/scan commands, NXP SLIX/Gen4 GTU detection, and `hf 15` controls • Added `piv authsign` to get a buffer signed by the selected key. • Added `piv scan` which tries to read all known containers on PIV. • Added `--shallow` option to `hf iclass` reader commands to do shallow (ASK) reader modulation instead of OOK. • Added `luascript hf_i2c_plus_2k_utils` for dumping/modifying user memory of sectors 0 and 1. • Added detection of magic Gen4 GTU tags. • Added `hf mfu esave` to save emulator memory to mfu dump file. • Added `luascript hf_mfu_ntag` for configuring NTAG216 configuration pages. • Changed `hf mf hardnested` to now detect and use MFC EV1 signature sector key. • Changed `hf mf autopwn` to now detect and use MFC EV1 signature sector key. • Added `lf paradox clone` support for FC/CN parameters. • Added standalone mode for simulating Nedap ID tags. • Added `hf tesla info` command to read initial information from TESLA cards. Breaking changes: • SPI flash overflow fix adds 1 more sector for Mifare; dictionaries must be reloaded because of the changed storage layout. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/proxmark3

proxmark3 [Radium.4.15864][2022-10-29]

Sat, 29 Oct 2022 00:00:00 GMT

Radium.4.15864 adds new subcommands for LF Indala brute-forcing, HF 14A NDEF writing, JSON Topaz support, and standalone mode for ISO15693 simulation. • Added `lf indala brute` command to brute-force 64b Indala IDs • Added `hf 14a ndefwrite` subcommand to write raw NDEF records to TYPE4A tags • Added `json` as a supported output file format for Topaz tag data • Added `hf topaz rdbl, wrbl, view` commands for reading, writing, and viewing Topaz tags • Added `--reboot-to-bootloader` argument to the main `pm3` CLI client • Added `trace extract` command to extract authentication parts from a capture trace Breaking changes: • The `--single` option was removed from `hf mf nested`; users must now use `--tblk` instead. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/proxmark3

proxmark3 [Frostbit.4.14831][2022-01-11]

Tue, 11 Jan 2022 00:00:00 GMT

New hf gallagher commands for DESFire, hf mf acl for access rights, and ATR fingerprinting. • Adds `hf gallagher` subcommand group for reading/writing MIFARE DESFire cards • Adds `--raw` option to `lf gprox demod` to decode raw bytes • Adds `--pwd` option to `hf mf gview` to accept user-supplied passwords • Adds `--force` flag to `hf mfu rdb/wrbl` to bypass address range checks • Adds `-k` option to `lf cmdread` to keep RF field on during operation • Adds `--crc-ht` option to `lf cmdread` to compute and append CRC-8/HITAG • Adds `hf mf acl` subcommand to decode and print MIFARE access rights • Adds support for KS X 6924 (South Korea T-money cards) • Adds ATR fingerprinting capability via `hw version` offline mode enhancements • Adds new standalone mode `dankarmulti` to select and run multiple standalone modes Full history on Cyber Toolchain: https://cybertoolchain.io/tools/proxmark3