PM3 Commands Reference (Iceman Firmware):

Main Help


Current command:
hf mfdes chk --help


Checks keys with MIFARE DESFire card.

usage:
    hf mfdes chk [-hva] [--aid <hex>] [-k <hex>] [-d <fn>] [--pattern1b] [--pattern2b] [--startp2b <pattern>]

options:
    -h, --help                     This help
    --aid <hex>                    Use specific AID (3 hex bytes, big endian)
    -k, --key <hex>                Key for checking (HEX 16 bytes)
    -d, --dict <fn>                Dictionary file with keys
    --pattern1b                    Check all 1-byte combinations of key (0000...0000, 0101...0101, 0202...0202, ...)
    --pattern2b                    Check all 2-byte combinations of key (0000...0000, 0001...0001, 0002...0002, ...)
    --startp2b <pattern>           Start key (2-byte HEX) for 2-byte search (use with `--pattern2b`)
    -j, --json <fn>                Json file name to save keys
    -v, --verbose                  Verbose output
    --kdf <0|1|2>                  Key Derivation Function (KDF) (0=None, 1=AN10922, 2=Gallagher)
    -i, --kdfi <hex>               KDF input (1-31 hex bytes)
    -a, --apdu                     Show APDU requests and responses

examples/notes:
    hf mfdes chk --aid 123456 -k 000102030405060708090a0b0c0d0e0f       -> check key on aid 0x123456
    hf mfdes chk -d mfdes_default_keys                          -> check keys against all existing aid on card
    hf mfdes chk -d mfdes_default_keys --aid 123456             -> check keys against aid 0x123456
    hf mfdes chk --aid 123456 --pattern1b -j keys               -> check all 1-byte keys pattern on aid 0x123456 and save found keys to `keys.json`
    hf mfdes chk --aid 123456 --pattern2b --startp2b FA00       -> check all 2-byte keys pattern on aid 0x123456. Start from key FA00FA00...FA00