PM3 Commands Reference (Iceman Firmware):

Main Help


Current command:
lf em 4x70 recover --help


After obtaining key bits 95..48 (such as via 'lf em 4x70 brute'), this command will recover
key bits 47..00.  By default, this process does NOT require a tag to be present.

By default, the potential keys are shown (typically 1-6) along with a corresponding
'lf em 4x70 auth' command that will authenticate, if that potential key is correct.
The user can copy/paste these commands when the tag is present to manually check
which of the potential keys is correct.

usage:
    lf em 4x70 recover [-h] [--par] -k <hex> --rnd <hex> --frn <hex> --grn <hex>

options:
    -h, --help                     This help
    --par                          Add parity bit when sending commands
    -k, --key <hex>                Key as 6 hex bytes
    --rnd <hex>                    Random 56-bit
    --frn <hex>                    F(RN) 28-bit as 4 hex bytes
    --grn <hex>                    G(RN) 20-bit as 3 hex bytes

examples/notes:
    lf em 4x70 recover --key F32AA98CF5BE --rnd 45F54ADA252AAC --frn 4866BB70 --grn 9BD180   (pm3 test key)
    lf em 4x70 recover --key A090A0A02080 --rnd 3FFE1FB6CC513F --frn F355F1A0 --grn 609D60   (research paper key)