PM3 Commands Reference (Iceman Firmware):

Main Help


Current command:
lf t55xx chk --help


This command uses a dictionary attack.
For some cloners, try '--em' for known pwdgen algo.
Try to reading Page 0 block 7 before.
WARNING: this may brick non-password protected chips!

usage:
    lf t55xx chk [-hm] [-f <fn>] [--em <hex>] [--r0] [--r1] [--r2] [--r3] [--all]

options:
    -h, --help                     This help
    -m, --fm                       use dictionary from flash memory (RDV4)
    -f, --file <fn>                file name
    --em <hex>                     EM4100 ID (5 hex bytes)
    --r0                           downlink - fixed bit length
    --r1                           downlink - long leading reference
    --r2                           downlink - leading zero
    --r3                           downlink - 1 of 4 coding reference
    --all                          try all downlink modes (def)

examples/notes:
    lf t55xx chk -m                          -> use dictionary from flash memory (RDV4)
    lf t55xx chk -f my_dictionary_pwds       -> loads a default keys dictionary file
    lf t55xx chk --em aa11223344             -> try known pwdgen algo from some cloners based on EM4100 ID