PM3 Commands Reference (Iceman Firmware):

Updated: January 2025

Main Help


Up One Level


Current command:
hf mfdes write --help


Write data from file. Key needs to be provided or flag --no-auth set (depend on file settings).

usage:
    hf mfdes write [--kdf <none|AN10922|gallagher>]

options:
    -h, --help                     This help
    -a, --apdu                     Show APDU requests and responses
    -v, --verbose                  Verbose output
    -n, --keyno <dec>              Key number
    -t, --algo <DES|2TDEA|3TDEA|AES> Crypt algo
    -k, --key <hex>                Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)
    --kdf <none|AN10922|gallagher> Key Derivation Function (KDF)
    -i, --kdfi <hex>               KDF input (1-31 hex bytes)
    -m, --cmode <plain|mac|encrypt> Communicaton mode
    -c, --ccset <native|niso|iso>  Communicaton command set
    --schann <d40|ev1|ev2|lrp>     Secure channel
    --aid <hex>                    Application ID (3 hex bytes, big endian)
    --fid <hex>                    File ID (1 hex byte)
    --no-auth                      Execute without authentication
    --type <auto|data|value|record|mac> File Type, Auto - check file settings and then write. (def: auto)
    -o, --offset <hex>             File Offset (3 hex bytes, big endian). For records - record number (0 - lastest record). (def: 0)
    -d, --data <hex>               data for write (data/record file), credit/debit(value file)
    --debit                        use for value file debit operation instead of credit
    --commit                       commit needs for backup file only. For the other file types and in the `auto` mode - command set it automatically
    --updaterec <dec>              Record number for update record command. Updates record instead of write. Lastest record - 0
    --isoid <hex>                  Application ISO ID (ISO DF ID) (2 hex bytes, big endian)
    --fileisoid <hex>              File ISO ID (ISO DF ID) (2 hex bytes, big endian). Works only for ISO write commands
    --readerid <hex>               reader id for CommitReaderID command. If present - the command issued before write command
    --trkey <hex>                  key for decode previous reader id

examples/notes:
    In the mode with CommitReaderID to decode previous reader id command needs to read transaction counter via dump/read command and specify --trkey
    
    hf mfdes write --aid 123456 --fid 01 -d 01020304     -> AID 123456, file=01, offset=0, get file type from card. use default channel settings from `default` command
    hf mfdes write --aid 123456 --fid 01 --type data -d 01020304 --0ffset 000100     -> write data to std file with offset 0x100
    hf mfdes write --aid 123456 --fid 01 --type data -d 01020304 --commit     -> write data to backup file with commit
    hf mfdes write --aid 123456 --fid 01 --type value -d 00000001     -> increment value file
    hf mfdes write --aid 123456 --fid 01 --type value -d 00000001 --debit     -> decrement value file
    hf mfdes write --aid 123456 --fid 01 -d 01020304     -> write data to file with `auto` type
    hf mfdes write --aid 123456 --fid 01 --type record -d 01020304     -> write data to record file
    hf mfdes write --aid 123456 --fid 01 --type record -d 01020304 --updaterec 0     -> update record in the record file. record 0 - lastest record.
    hf mfdes write --aid 123456 --fid 01 --type record --offset 000000 -d 11223344     -> write record to record file. use default channel settings from `default` command
    hf mfdes write --isoid 1234 --fileisoid 1000 --type data -c iso -d 01020304     -> write data to std/backup file via iso commandset
    hf mfdes write --isoid 1234 --fileisoid 2000 --type record -c iso -d 01020304     -> send record to record file via iso commandset
    hf mfdes write --aid 123456 --fid 01 -d 01020304 --readerid 010203     -> write data to file with CommitReaderID command before write and CommitTransaction after write
    hf mfdes write --isoid df01 --fid 04 -d 01020304 --trkey 00112233445566778899aabbccddeeff --readerid 5532 -t aes --schann lrp     -> advanced CommitReaderID via lrp channel sample