PM3 Commands Reference (Iceman Firmware):

Main Help


Current command:
hf mf hardnested --help


Nested attack for hardened MIFARE Classic cards.
if card is EV1, command can detect and use known key see example below

`--i`  set type of SIMD instructions. Without this flag programs autodetect it.
 or
    hf mf hardnested -r --tk [known target key]
Add the known target key to check if it is present in the remaining key space
    hf mf hardnested --blk 0 -a -k A0A1A2A3A4A5 --tblk 4 --ta --tk FFFFFFFFFFFF

usage:
    hf mf hardnested [-habrstw] [-k <hex>] [--blk <dec>] [--tblk <dec>] [--ta] [--tb] [--tk <hex>] [-u <hex>] [-f <fn>]

options:
    -h, --help                     This help
    -k, --key <hex>                Key, 12 hex bytes
    --blk <dec>                    Input block number
    -a                             Input key A (def)
    -b                             Input key B
    --tblk <dec>                   Target block number
    --ta                           Target key A
    --tb                           Target key B
    --tk <hex>                     Target key, 12 hex bytes
    -u, --uid <hex>                R/W `hf-mf-<UID>-nonces.bin` instead of default name
    -f, --file <fn>                R/W <name> instead of default name
    -r, --read                     Read `hf-mf-<UID>-nonces.bin` if tag present, otherwise `nonces.bin`, and start attack
    -s, --slow                     Slower acquisition (required by some non standard cards)
    -t, --tests                    Run tests
    -w, --wr                       Acquire nonces and UID, and write them to file `hf-mf-<UID>-nonces.bin`
    --in                           None (use CPU regular instruction set)
    --im                           MMX
    --is                           SSE2
    --ia                           AVX
    --i2                           AVX2
    --i5                           AVX512

examples/notes:
    hf mf hardnested --tblk 4 --ta           -> works for MFC EV1
    hf mf hardnested --blk 0 -a -k FFFFFFFFFFFF --tblk 4 --ta
    hf mf hardnested --blk 0 -a -k FFFFFFFFFFFF --tblk 4 --ta -w
    hf mf hardnested --blk 0 -a -k FFFFFFFFFFFF --tblk 4 --ta -f nonces.bin -w -s
    hf mf hardnested -r
    hf mf hardnested -r --tk a0a1a2a3a4a5
    hf mf hardnested -t --tk a0a1a2a3a4a5
    hf mf hardnested --blk 0 -a -k a0a1a2a3a4a5 --tblk 4 --ta --tk FFFFFFFFFFFF