PM3 Commands Reference (Iceman Firmware):

Main Help


Current command:
hf 14a apdufind --help


Enumerate APDU's of ISO7816 protocol to find valid CLS/INS/P1/P2 commands.
It loops all 256 possible values for each byte.
The loop oder is INS -> P1/P2 (alternating) -> CLA.
Tag must be on antenna before running.

usage:
    hf 14a apdufind [-hlv] [-c <hex>] [-i <hex>] [--p1 <hex>] [--p2 <hex>] [-r <number>] [-e <number>] [-s <hex>]...

options:
options:
    -h, --help                     This help
    -c, --cla <hex>                Start value of CLASS (1 hex byte)
    -i, --ins <hex>                Start value of INSTRUCTION (1 hex byte)
    --p1 <hex>                     Start value of P1 (1 hex byte)
    --p2 <hex>                     Start value of P2 (1 hex byte)
    -r, --reset <number>           Minimum secondes before resetting the tag (to prevent timeout issues). Default is 5 minutes
    -e, --error-limit <number>     Maximum times an status word other than 0x9000 or 0x6D00 is shown. Default is 512.
    -s, --skip-ins <hex>           Do not test an instruction (can be specified multiple times)
    -l, --with-le                  Search  for APDUs with Le=0 (case 2S) as well
    -v, --verbose                  Verbose output

examples/notes:
    hf 14a apdufind
    hf 14a apdufind --cla 80
    hf 14a apdufind --cla 80 --error-limit 20 --skip-ins a4 --skip-ins b0 --with-le