PM3 Commands Reference (Iceman Firmware):

Updated: January 2025

Main Help


Up One Level


Current command:
hf 14a raw --help


Sends raw bytes over ISO14443a. With option to use TOPAZ 14a mode.

usage:
    hf 14a raw [<hex>]...

options:
    -h, --help                     This help
    -a                             Active signal field ON without select
    -c                             Calculate and append CRC
    -k                             Keep signal field ON after receive
    -3                             ISO14443-3 select only (skip RATS)
    -r                             Do not read response
    -s                             Active signal field ON with select
    -t, --timeout <ms>             Timeout in milliseconds
    -b <dec>                       Number of bits to send. Useful for send partial byte
    -v, --verbose                  Verbose output
    --ecp                          Use enhanced contactless polling
    --mag                          Use Apple magsafe polling
    --topaz                        Use Topaz protocol to send command
    --crypto1                      Use crypto1 session
    <hex>                          Raw bytes to send

examples/notes:
    hf 14a raw -sc 3000           -> select, crc, where 3000 == 'read block 00'
    hf 14a raw -ak -b 7 40        -> send 7 bit byte 0x40
    hf 14a raw --ecp -s           -> send ECP before select
    Crypto1 session example, with special auth shortcut 6xxx<key>:
    hf 14a raw --crypto1 -skc 6000FFFFFFFFFFFF
    hf 14a raw --crypto1 -kc 3000
    hf 14a raw --crypto1 -kc 6007FFFFFFFFFFFF
    hf 14a raw --crypto1 -c 3007