PM3 Commands Reference (Iceman Firmware):

Main Help


Current command:
hf mfp chconf --help


Change the configuration on a Mifare Plus tag. DANGER!

usage:
    hf mfp chconf [-hv] [--nmr] -c <hex> [-k <hex>] [--cck] -d <hex>

options:
    -h, --help                     This help
    -v, --verbose                  Verbose output
    --nmr                          Do not expect MAC in response
    -c, --conf <hex>               Config block number, 0-3
    -k, --key <hex>                Card key, 16 hex bytes
    --cck                          Auth as Card Configuration key instead of Card Master Key
    -d, --data <hex>               New configuration data, 16 hex bytes

examples/notes:
    This requires Card Master Key (9000) or Card Configuration Key (9001).
    Configuration block info can be found below.
    * Block B000 (00; CMK): Max amount of commands without MAC (byte 0), as well as plain mode access (unknown).
    * Block B001 (01; CCK): Installation identifier for Virtual Card. Please consult NXP for data.
    * Block B002 (02; CCK): ATS data.
    * Block B003 (03; CCK): Use Random ID in SL3, decide whether proximity check is mandatory.
      * DO NOT WRITE THIS BLOCK UNDER ANY CIRCUMSTANCES! Risk of bricking.
    More configuration tips to follow. Check JMY600 Series IC Card Module.
    hf mfp chconf -c 00 -d 10ffffffffffffffffffffffffffffff --key A0A1A2A3A4A5A6A7A0A1A2A3A4A5A6A7      -> Allow 16 commands without MAC in a single transaction.