PM3 Commands Reference (Iceman Firmware):

Main Help


Current command:
hf mf nested --help


Execute Nested attack against MIFARE Classic card for key recovery

usage:
    hf mf nested [-hab] [-k <hex>] [--mini] [--1k] [--2k] [--4k] [--blk <dec>] [--tblk <dec>] [--ta] [--tb] [--emu]

options:
    -h, --help                     This help
    -k, --key <hex>                Key specified as 12 hex symbols
    --mini                         MIFARE Classic Mini / S20
    --1k                           MIFARE Classic 1k / S50
    --2k                           MIFARE Classic/Plus 2k
    --4k                           MIFARE Classic 4k / S70
    --blk <dec>                    Input block number
    -a                             Input key specified is A key (default)
    -b                             Input key specified is B key
    --tblk <dec>                   Target block number
    --ta                           Target A key (default)
    --tb                           Target B key
    --emu                          Fill simulator keys from found keys
    --dump                         Dump found keys to file
    --mem                          Use dictionary from flashmemory

examples/notes:
    hf mf nested --blk 0 -a -k FFFFFFFFFFFF --tblk 4 --ta                 -> Use block 0 Key A to find block 4 Key A (single sector key recovery)
    hf mf nested --mini --blk 0 -a -k FFFFFFFFFFFF                        -> Key recovery against MIFARE Mini
    hf mf nested --1k --blk 0 -a -k FFFFFFFFFFFF                          -> Key recovery against MIFARE Classic 1k
    hf mf nested --2k --blk 0 -a -k FFFFFFFFFFFF                          -> Key recovery against MIFARE 2k
    hf mf nested --4k --blk 0 -a -k FFFFFFFFFFFF                          -> Key recovery against MIFARE 4k