PM3 Commands Reference (Iceman Firmware):

Updated: January 2025

Main Help


Up One Level


Current command:
hf mfdes mad --help


Reads and prints MIFARE Application directory (MAD).

usage:
    hf mfdes mad [--kdf <none|AN10922|gallagher>]

options:
    -h, --help                     This help
    -a, --apdu                     Show APDU requests and responses
    -v, --verbose                  Verbose output
    -n, --keyno <dec>              Key number
    -t, --algo <DES|2TDEA|3TDEA|AES> Crypt algo
    -k, --key <hex>                Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)
    --kdf <none|AN10922|gallagher> Key Derivation Function (KDF)
    -i, --kdfi <hex>               KDF input (1-31 hex bytes)
    -m, --cmode <plain|mac|encrypt> Communicaton mode
    -c, --ccset <native|niso|iso>  Communicaton command set
    --schann <d40|ev1|ev2|lrp>     Secure channel
    --aid <hex>                    Application ID of issuer info file, (3 hex bytes, big endian),  (non-standard feature!)
    --auth                         Authenticate to get info from GetApplicationIDs command (non-standard feature!)

examples/notes:
    MAD consists of one file with issuer info (AID ffffff) and several files with AID in the special format `faaaav` (a - MAD ID, v - multiple AID over one MAD ID)
    The MIFARE DESFire Card Master Key settings have to allow the MIFARE DESFire command GetApplicationIDs without authentication (from datasheet)
    
    hf mfdes mad                  -> shows MAD data
    hf mfdes mad -v               -> shows MAD parsed and raw data
    hf mfdes mad -a e103 -k d3f7d3f7d3f7d3f7d3f7d3f7d3f7d3f7     -> shows MAD data with custom AID and key