PM3 Commands Reference:

Main Help


Current command: lf hitag lookup --help

This command take sniffed trace data and try to recovery a Hitag2 crypto key.
 You can either
 - verify that NR/AR matches a known crypto key
 - verify if NR/AR matches a known 6 byte crypto key in a dictionary

usage:
    lf hitag lookup [-h] [-f <fn>] [-k <hex>] -u <hex> [--nr <hex>] [--ar <hex>] [--nrar <hex>]

options:
    -h, --help                     This help
    -f, --file <fn>                specify dictionary filename
    -k, --key <hex>                specify known cryptokey as 6 bytes
    -u, --uid <hex>                specify UID as 4 hex bytes
    --nr <hex>                     specify nonce as 4 hex bytes
    --ar <hex>                     specify answer as 4 hex bytes
    --nrar <hex>                   specify nonce / answer as 8 hex bytes

examples/notes:
    lf hitag lookup --uid 11223344 --nr 73AA5A62 --ar EAB8529C -k 010203040506      -> check key
    lf hitag lookup --uid 11223344 --nr 73AA5A62 --ar EAB8529C                      -> use def dictionary
    lf hitag lookup --uid 11223344 --nr 73AA5A62 --ar EAB8529C -f my.dic            -> use custom dictionary
    lf hitag lookup --uid 11223344 --nrar 73AA5A62EAB8529C