PM3 Commands Reference (Iceman Firmware):

Updated: January 2025

Main Help

Up One Level

---

Current command:
hf 14a sim --help

---

Simulate ISO/IEC 14443 type A tag with 4,7 or 10 byte UID
Use type 7 for Mifare Ultralight EV1, Amiibo (NTAG215 pack 0x8080)

usage:
    hf 14a sim [--sk]

options:
    -h, --help                     This help
    -t, --type <1-12>              Simulation type to use
    -u, --uid <hex>                <4|7|10> hex bytes UID
    -n, --num <dec>                Exit simulation after <numreads> blocks have been read by reader. 0 = infinite
    -x                             Performs the 'reader attack', nr/ar attack against a reader
    --sk                           Fill simulator keys from found keys
    -v, --verbose                  verbose output

examples/notes:
    hf 14a sim -t 1 --uid 11223344      -> MIFARE Classic 1k
    hf 14a sim -t 2                     -> MIFARE Ultralight
    hf 14a sim -t 3                     -> MIFARE Desfire
    hf 14a sim -t 4                     -> ISO/IEC 14443-4
    hf 14a sim -t 5                     -> MIFARE Tnp3xxx
    hf 14a sim -t 6                     -> MIFARE Mini
    hf 14a sim -t 7                     -> MFU EV1 / NTAG 215 Amiibo
    hf 14a sim -t 8                     -> MIFARE Classic 4k
    hf 14a sim -t 9                     -> FM11RF005SH Shanghai Metro
    hf 14a sim -t 10                    -> ST25TA IKEA Rothult
    hf 14a sim -t 11                    -> Javacard (JCOP)
    hf 14a sim -t 12                    -> 4K Seos card