PM3 Commands Reference (Iceman Firmware):

Updated: January 2025

Main Help

Up One Level

---

Current command:
lf hitag lookup --help

---

This command take sniffed trace data and try to recovery a Hitag 2 crypto key.
 You can either
 - verify that NR/AR matches a known crypto key
 - verify if NR/AR matches a known 6 byte crypto key in a dictionary

usage:
    lf hitag lookup [--nrar <hex>]

options:
    -h, --help                     This help
    -f, --file <fn>                specify dictionary filename
    -k, --key <hex>                specify known cryptokey as 6 bytes
    -u, --uid <hex>                specify UID as 4 hex bytes
    --nr <hex>                     specify nonce as 4 hex bytes
    --ar <hex>                     specify answer as 4 hex bytes
    --nrar <hex>                   specify nonce / answer as 8 hex bytes

examples/notes:
    lf hitag lookup --uid 11223344 --nr 73AA5A62 --ar EAB8529C -k 010203040506     -> check key
    lf hitag lookup --uid 11223344 --nr 73AA5A62 --ar EAB8529C                     -> use def dictionary
    lf hitag lookup --uid 11223344 --nr 73AA5A62 --ar EAB8529C -f my.dic           -> use custom dictionary
    lf hitag lookup --uid 11223344 --nrar 73AA5A62EAB8529C