PM3 Commands Reference (Iceman Firmware):

Updated: January 2025

Main Help

Up One Level

---

Current command:
hf iclass lookup --help

---

This command take sniffed trace data and try to recovery a iCLASS Standard or iCLASS Elite key.

usage:
    hf iclass lookup [--vb6rng]

options:
    -h, --help                     This help
    -f, --file <fn>                Dictionary file with default iclass keys
    --csn <hex>                    Specify CSN as 8 hex bytes
    --epurse <hex>                 Specify ePurse as 8 hex bytes
    --macs <hex>                   MACs
    --elite                        Elite computations applied to key
    --raw                          no computations applied to key
    --vb6rng                       use the VB6 rng for elite keys instead of a dictionary file

examples/notes:
    hf iclass lookup --csn 9655a400f8ff12e0 --epurse f0ffffffffffffff --macs 0000000089cb984b -f iclass_default_keys.dic
    hf iclass lookup --csn 9655a400f8ff12e0 --epurse f0ffffffffffffff --macs 0000000089cb984b -f iclass_default_keys.dic --elite
    hf iclass lookup --csn 9655a400f8ff12e0 --epurse f0ffffffffffffff --macs 0000000089cb984b --vb6rng