\documentclass[10pt,a4paper]{article} % Packages \usepackage{fancyhdr} % For header and footer \usepackage{multicol} % Allows multicols in tables \usepackage{tabularx} % Intelligent column widths \usepackage{tabulary} % Used in header and footer \usepackage{hhline} % Border under tables \usepackage{graphicx} % For images \usepackage{xcolor} % For hex colours %\usepackage[utf8x]{inputenc} % For unicode character support \usepackage[T1]{fontenc} % Without this we get weird character replacements \usepackage{colortbl} % For coloured tables \usepackage{setspace} % For line height \usepackage{lastpage} % Needed for total page number \usepackage{seqsplit} % Splits long words. %\usepackage{opensans} % Can't make this work so far. Shame. Would be lovely. \usepackage[normalem]{ulem} % For underlining links % Most of the following are not required for the majority % of cheat sheets but are needed for some symbol support. \usepackage{amsmath} % Symbols \usepackage{MnSymbol} % Symbols \usepackage{wasysym} % Symbols %\usepackage[english,german,french,spanish,italian]{babel} % Languages % Document Info \author{Lewys Martin (CountParadox)} \pdfinfo{ /Title (proxmark3.pdf) /Creator (Cheatography) /Author (Lewys Martin (CountParadox)) /Subject (Proxmark3 Cheat Sheet) } % Lengths and widths \addtolength{\textwidth}{6cm} \addtolength{\textheight}{-1cm} \addtolength{\hoffset}{-3cm} \addtolength{\voffset}{-2cm} \setlength{\tabcolsep}{0.2cm} % Space between columns \setlength{\headsep}{-12pt} % Reduce space between header and content \setlength{\headheight}{85pt} % If less, LaTeX automatically increases it \renewcommand{\footrulewidth}{0pt} % Remove footer line \renewcommand{\headrulewidth}{0pt} % Remove header line \renewcommand{\seqinsert}{\ifmmode\allowbreak\else\-\fi} % Hyphens in seqsplit % This two commands together give roughly % the right line height in the tables \renewcommand{\arraystretch}{1.3} \onehalfspacing % Commands \newcommand{\SetRowColor}[1]{\noalign{\gdef\RowColorName{#1}}\rowcolor{\RowColorName}} % Shortcut for row colour \newcommand{\mymulticolumn}[3]{\multicolumn{#1}{>{\columncolor{\RowColorName}}#2}{#3}} % For coloured multi-cols \newcolumntype{x}[1]{>{\raggedright}p{#1}} % New column types for ragged-right paragraph columns \newcommand{\tn}{\tabularnewline} % Required as custom column type in use % Font and Colours \definecolor{HeadBackground}{HTML}{333333} \definecolor{FootBackground}{HTML}{666666} \definecolor{TextColor}{HTML}{333333} \definecolor{DarkBackground}{HTML}{A6A6A6} \definecolor{LightBackground}{HTML}{F3F3F3} \renewcommand{\familydefault}{\sfdefault} \color{TextColor} % Header and Footer \pagestyle{fancy} \fancyhead{} % Set header to blank \fancyfoot{} % Set footer to blank \fancyhead[L]{ \noindent \begin{multicols}{3} \begin{tabulary}{5.8cm}{C} \SetRowColor{DarkBackground} \vspace{-7pt} {\parbox{\dimexpr\textwidth-2\fboxsep\relax}{\noindent \hspace*{-6pt}\includegraphics[width=5.8cm]{/web/www.cheatography.com/public/images/cheatography_logo.pdf}} } \end{tabulary} \columnbreak \begin{tabulary}{11cm}{L} \vspace{-2pt}\large{\bf{\textcolor{DarkBackground}{\textrm{Proxmark3 Cheat Sheet}}}} \\ \normalsize{by \textcolor{DarkBackground}{Lewys Martin (CountParadox)} via \textcolor{DarkBackground}{\uline{cheatography.com/88350/cs/20277/}}} \end{tabulary} \end{multicols}} \fancyfoot[L]{ \footnotesize \noindent \begin{multicols}{3} \begin{tabulary}{5.8cm}{LL} \SetRowColor{FootBackground} \mymulticolumn{2}{p{5.377cm}}{\bf\textcolor{white}{Cheatographer}} \\ \vspace{-2pt}Lewys Martin (CountParadox) \\ \uline{cheatography.com/countparadox} \\ \uline{\seqsplit{lewys}.eu} \end{tabulary} \vfill \columnbreak \begin{tabulary}{5.8cm}{L} \SetRowColor{FootBackground} \mymulticolumn{1}{p{5.377cm}}{\bf\textcolor{white}{Cheat Sheet}} \\ \vspace{-2pt}Published 15th August, 2019.\\ Updated 30th September, 2019.\\ Page {\thepage} of \pageref{LastPage}. \end{tabulary} \vfill \columnbreak \begin{tabulary}{5.8cm}{L} \SetRowColor{FootBackground} \mymulticolumn{1}{p{5.377cm}}{\bf\textcolor{white}{Sponsor}} \\ \SetRowColor{white} \vspace{-5pt} %\includegraphics[width=48px,height=48px]{dave.jpeg} Measure your website readability!\\ www.readability-score.com \end{tabulary} \end{multicols}} \begin{document} \raggedright \raggedcolumns % Set font size to small. Switch to any value % from this page to resize cheat sheet text: % www.emerson.emory.edu/services/latex/latex_169.html \footnotesize % Small font. \begin{multicols*}{3} \begin{tabularx}{5.377cm}{X} \SetRowColor{DarkBackground} \mymulticolumn{1}{x{5.377cm}}{\bf\textcolor{white}{Proxmark3 Cheat Sheet}} \tn \SetRowColor{white} \mymulticolumn{1}{x{5.377cm}}{This cheat sheet contains many useful commands to help you get started with Proxmark3. \newline % Row Count 2 (+ 2) Big thanks to \{\{link="https://github.com/scund00r"\}\}Alex Dib\{\{/link\}\}, \{\{link="https://github.com/doegox"\}\}Philippe Teuwen\{\{/link\}\} and \{\{link="https://github.com/iceman1001"\}\}Iceman\{\{/link\}\} over on the \{\{link="https://git.io/fjdue"\}\}RfidResearchGroup GitHub\{\{/link\}\} for their cheat sheet!% Row Count 8 (+ 6) } \tn \hhline{>{\arrayrulecolor{DarkBackground}}-} \end{tabularx} \par\addvspace{1.3em} \begin{tabularx}{5.377cm}{x{1.94103 cm} x{3.03597 cm} } \SetRowColor{DarkBackground} \mymulticolumn{2}{x{5.377cm}}{\bf\textcolor{white}{iClass}} \tn % Row 0 \SetRowColor{LightBackground} Reverse Permute Master Key & `hf iclass permute r 3F90EBF0910F7B6F` \tn % Row Count 2 (+ 2) % Row 1 \SetRowColor{white} Simulate Reader & `hf iclass reader` \tn % Row Count 3 (+ 1) % Row 2 \SetRowColor{LightBackground} Dump & `hf iclass dump k AFA785A7DAB33378` \tn % Row Count 5 (+ 2) % Row 3 \SetRowColor{white} Read Block & `hf iclass readblk b 7 k AFA785A7DAB33378` \tn % Row Count 7 (+ 2) % Row 4 \SetRowColor{LightBackground} Write to Block & `hf iclass writeblk b 07 d 6ce099fe7e614fd0 k AFA785A7DAB33378` \tn % Row Count 10 (+ 3) % Row 5 \SetRowColor{white} Print Keystore & `hf iclass managekeys p` \tn % Row Count 11 (+ 1) % Row 6 \SetRowColor{LightBackground} Add Key to Keystore {[}0-7{]} & `hf iclass managekeys n 0 k AFA785A7DAB33378` \tn % Row Count 13 (+ 2) % Row 7 \SetRowColor{white} Encrypt Block & `hf iclass encryptblk 0000000f2aa3dba8` \tn % Row Count 15 (+ 2) % Row 8 \SetRowColor{LightBackground} Load Dump & `hf iclass eload f \seqsplit{iclass\_tagdump-filename}.bin` \tn % Row Count 17 (+ 2) % Row 9 \SetRowColor{white} Simulate & `hf iclass sim 3` \tn % Row Count 18 (+ 1) \hhline{>{\arrayrulecolor{DarkBackground}}--} \SetRowColor{LightBackground} \mymulticolumn{2}{x{5.377cm}}{{\bf{Simulation notes: }} \newline \textasciicircum{}0 \textless{}CSN\textgreater{} simulate the given CSN\textasciicircum{} \newline \textasciicircum{}1 simulate default CSN\textasciicircum{} \newline \textasciicircum{}3 Full simulation using emulator memory\textasciicircum{} \newline {\bf{Simulate iClass Sequence}} \newline `pm3 \textgreater{} hf iclass dump k AFA785A7DAB33378` \newline `pm3 \textgreater{} hf iclass eload f \seqsplit{iclass\_tagdump-db883702f8ff12e0}.bin` \newline `pm3 \textgreater{} hf iclass sim 3` \newline {\bf{Clone iClass Legacy Sequence}} \newline `pm3 \textgreater{} hf iclass readblk b 7 k AFA785A7DAB33378` \newline `pm3 \textgreater{} hf iclass writeblk b 07 d 6ce099fe7e614fd0 k AFA785A7DAB33378`} \tn \hhline{>{\arrayrulecolor{DarkBackground}}--} \end{tabularx} \par\addvspace{1.3em} \begin{tabularx}{5.377cm}{X} \SetRowColor{DarkBackground} \mymulticolumn{1}{x{5.377cm}}{\bf\textcolor{white}{iClass loclass attack}} \tn \SetRowColor{white} \mymulticolumn{1}{x{5.377cm}}{{\bf{Extract custom iClass key (loclass attack)}} \newline % Row Count 1 (+ 1) `pm3 \textgreater{} hf iclass sim 2` \newline % Row Count 2 (+ 1) `pm3 \textgreater{} hf iclass loclass f iclass\_mac\_attack.bin` \newline % Row Count 3 (+ 1) `pm3 \textgreater{} hf iclass dump k \textless{}Kcus\textgreater{} e` \newline % Row Count 4 (+ 1) {\bf{Verify custom iClass key}} \newline % Row Count 5 (+ 1) `pm3 \textgreater{} hf iclass lookup u 010a0ffff7ff12e0 p feffffffffffffff m 66348979153c41b9 f \seqsplit{default\_iclass\_keys.dic} e`% Row Count 8 (+ 3) } \tn \hhline{>{\arrayrulecolor{DarkBackground}}-} \end{tabularx} \par\addvspace{1.3em} \begin{tabularx}{5.377cm}{x{3.58344 cm} x{1.39356 cm} } \SetRowColor{DarkBackground} \mymulticolumn{2}{x{5.377cm}}{\bf\textcolor{white}{Generic Commands}} \tn % Row 0 \SetRowColor{LightBackground} High Frequency Search & `hf search` \tn % Row Count 1 (+ 1) % Row 1 \SetRowColor{white} Low Frequency Search & `lf search` \tn % Row Count 2 (+ 1) % Row 2 \SetRowColor{LightBackground} Measure Antenna Characteristics & `hw tune` \tn % Row Count 4 (+ 2) % Row 3 \SetRowColor{white} Check Version & `hw version` \tn % Row Count 6 (+ 2) % Row 4 \SetRowColor{LightBackground} Check overall status & `hw status` \tn % Row Count 7 (+ 1) \hhline{>{\arrayrulecolor{DarkBackground}}--} \end{tabularx} \par\addvspace{1.3em} \begin{tabularx}{5.377cm}{x{2.18988 cm} x{2.78712 cm} } \SetRowColor{DarkBackground} \mymulticolumn{2}{x{5.377cm}}{\bf\textcolor{white}{Mifare}} \tn % Row 0 \SetRowColor{LightBackground} Check for Default Keys & `hf mf chk *1 ? d default\_keys.dic` \tn % Row Count 2 (+ 2) % Row 1 \SetRowColor{white} Dump (0=Mini, 1=1k, 2=2k, 4=4k) & `hf mf dump 1` \tn % Row Count 4 (+ 2) % Row 2 \SetRowColor{LightBackground} Write to Block & `hf mf wrbl 0 A FFFFFFFFFFFF \seqsplit{d3a2859f6b880400c801002000000016`} \tn % Row Count 7 (+ 3) % Row 3 \SetRowColor{white} Hardnested Attack & `hf mf hardnested 0 A FFFFFFFFFFFF 0 A w` \tn % Row Count 9 (+ 2) % Row 4 \SetRowColor{LightBackground} Load Dump & `hf mf eload 353C2AA6` \tn % Row Count 10 (+ 1) % Row 5 \SetRowColor{white} Simulate & `hf mf sim u 353c2aa6` \tn % Row Count 11 (+ 1) % Row 6 \SetRowColor{LightBackground} Run autopwn & `hf mf autopwn` \tn % Row Count 12 (+ 1) \hhline{>{\arrayrulecolor{DarkBackground}}--} \SetRowColor{LightBackground} \mymulticolumn{2}{x{5.377cm}}{{\bf{Simulate Mifare Sequence}} \newline `pm3 \textgreater{} hf mf chk {\emph{1 ? d default\_keys.dic` \newline `pm3 \textgreater{} hf mf dump 1` \newline `pm3 \textgreater{} script run dumptoemul -i dump.bin` \newline `pm3 \textgreater{} hf mf eload 353C2AA6` \newline `pm3 \textgreater{} hf mf sim u 353c2aa6` \newline {\bf{Clone Mifare 1K Sequence}} \newline `pm3 \textgreater{} hf mf chk }}1 ? d default\_keys.dic` \newline `pm3 \textgreater{} hf mf dump` \newline `pm3 \textgreater{} hf mf restore 1 u 4A6CE843 k hf-mf-A29558E4-key.bin f hf-mf-A29558E4-data.bin`} \tn \hhline{>{\arrayrulecolor{DarkBackground}}--} \end{tabularx} \par\addvspace{1.3em} \begin{tabularx}{5.377cm}{x{1.44333 cm} x{3.53367 cm} } \SetRowColor{DarkBackground} \mymulticolumn{2}{x{5.377cm}}{\bf\textcolor{white}{Indala}} \tn % Row 0 \SetRowColor{LightBackground} Read & `lf indala read` \tn % Row Count 1 (+ 1) % Row 1 \SetRowColor{white} Demodulate & `lf indala demod` \tn % Row Count 2 (+ 1) % Row 2 \SetRowColor{LightBackground} Simulate & `lf indala sim a0000000c2c436c1` \tn % Row Count 4 (+ 2) % Row 3 \SetRowColor{white} Clone to T55x7 & `lf indala clone a0000000c2c436c1` \tn % Row Count 6 (+ 2) \hhline{>{\arrayrulecolor{DarkBackground}}--} \end{tabularx} \par\addvspace{1.3em} \begin{tabularx}{5.377cm}{x{1.64241 cm} x{3.33459 cm} } \SetRowColor{DarkBackground} \mymulticolumn{2}{x{5.377cm}}{\bf\textcolor{white}{Lua Scripts}} \tn % Row 0 \SetRowColor{LightBackground} List Scripts & `script list` \tn % Row Count 1 (+ 1) % Row 1 \SetRowColor{white} Convert .bin to .eml & `script run dumptoemul -i filename.bin` \tn % Row Count 3 (+ 2) % Row 2 \SetRowColor{LightBackground} Format Mifare card & `script run formatMifare -k FFFFFFFFFFFF -n FFFFFFFFFFFF -x` \tn % Row Count 6 (+ 3) \hhline{>{\arrayrulecolor{DarkBackground}}--} \SetRowColor{LightBackground} \mymulticolumn{2}{x{5.377cm}}{`Options` \newline -{}-{}- \newline `k \textless{}key\textgreater{} : the current six byte key` \newline `n \textless{}key\textgreater{} : the new key` \newline `a \textless{}access\textgreater{} : the new access bytes` \newline `x : execute the commands`} \tn \hhline{>{\arrayrulecolor{DarkBackground}}--} \end{tabularx} \par\addvspace{1.3em} \begin{tabularx}{5.377cm}{x{3.03597 cm} x{1.94103 cm} } \SetRowColor{DarkBackground} \mymulticolumn{2}{x{5.377cm}}{\bf\textcolor{white}{HID Prox}} \tn % Row 0 \SetRowColor{LightBackground} Read & `lf hid read` \tn % Row Count 1 (+ 1) % Row 1 \SetRowColor{white} Demodulate & `lf hid demod` \tn % Row Count 2 (+ 1) % Row 2 \SetRowColor{LightBackground} Simulate & `lf hid sim 200670012d` \tn % Row Count 4 (+ 2) % Row 3 \SetRowColor{white} Clone to T5577 & `lf hid clone 200670012d` \tn % Row Count 6 (+ 2) % Row 4 \SetRowColor{LightBackground} Convert Site \& Facility code to Wiegand & `lf hid wiegand 0 56 150` \tn % Row Count 8 (+ 2) \hhline{>{\arrayrulecolor{DarkBackground}}--} \SetRowColor{LightBackground} \mymulticolumn{2}{x{5.377cm}}{{\bf{Brute force HID reader}} \newline Options \newline -{}-{}- \newline `a \textless{}format\textgreater{} : \seqsplit{26|33|34|35|37|40|44|84"`} \newline `f \textless{}FC\textgreater{} : 8-bit value, facility code"` \newline `c \textless{}CN\textgreater{} : (optional) Starting Number, max 65535"` \newline `d \textless{}delay\textgreater{} : delay in ms. Default 1000ms"` \newline `v : verbose logging, show all tries"` \newline -{}-{}- \newline `pm3 \textgreater{} lf hid brute a 26 f 224` \newline `pm3 \textgreater{} lf hid brute v a 26 f 21 c 200 d 2000`} \tn \hhline{>{\arrayrulecolor{DarkBackground}}--} \end{tabularx} \par\addvspace{1.3em} \begin{tabularx}{5.377cm}{x{1.74195 cm} x{3.23505 cm} } \SetRowColor{DarkBackground} \mymulticolumn{2}{x{5.377cm}}{\bf\textcolor{white}{Raw Data}} \tn % Row 0 \SetRowColor{LightBackground} Get samples & `data samples \textless{}size\textgreater{}` \tn % Row Count 1 (+ 1) % Row 1 \SetRowColor{white} Save samples & `data save \textless{}filename\textgreater{}` \tn % Row Count 2 (+ 1) % Row 2 \SetRowColor{LightBackground} Load samples & `data load \textless{}filename\textgreater{}` \tn % Row Count 3 (+ 1) \hhline{>{\arrayrulecolor{DarkBackground}}--} \SetRowColor{LightBackground} \mymulticolumn{2}{x{5.377cm}}{`raw samples {[}512-40000{]}`} \tn \hhline{>{\arrayrulecolor{DarkBackground}}--} \end{tabularx} \par\addvspace{1.3em} \begin{tabularx}{5.377cm}{x{1.74195 cm} x{3.23505 cm} } \SetRowColor{DarkBackground} \mymulticolumn{2}{x{5.377cm}}{\bf\textcolor{white}{Hitag}} \tn % Row 0 \SetRowColor{LightBackground} Read Hitag information & `lf hitag info` \tn % Row Count 2 (+ 2) % Row 1 \SetRowColor{white} Act as Hitag reader & `lf hitag 26` \tn % Row Count 4 (+ 2) % Row 2 \SetRowColor{LightBackground} Sniff Hitag traffic & `lf hitag sniff` \tn % Row Count 6 (+ 2) % Row 3 \SetRowColor{white} Simulate & `lf hitag sim c378181c\_a8f7.ht2` \tn % Row Count 8 (+ 2) % Row 4 \SetRowColor{LightBackground} Write to Block & `lf hitag writer 24 499602D2 1 00000000` \tn % Row Count 10 (+ 2) \hhline{>{\arrayrulecolor{DarkBackground}}--} \SetRowColor{LightBackground} \mymulticolumn{2}{x{5.377cm}}{{\bf{Simulate Hitag2 sequence}} \newline `pm3 \textgreater{} lf hitag reader 21 56713368` \newline `pm3 \textgreater{} lf hitag sim c378181c\_a8f7.ht2`} \tn \hhline{>{\arrayrulecolor{DarkBackground}}--} \end{tabularx} \par\addvspace{1.3em} \begin{tabularx}{5.377cm}{x{1.9908 cm} x{2.9862 cm} } \SetRowColor{DarkBackground} \mymulticolumn{2}{x{5.377cm}}{\bf\textcolor{white}{T55XX}} \tn % Row 0 \SetRowColor{LightBackground} Detect T55XX & `lf t55xx detect` \tn % Row Count 1 (+ 1) % Row 1 \SetRowColor{white} Demodulation Config & `lf t55xx config FSK` \tn % Row Count 3 (+ 2) % Row 2 \SetRowColor{LightBackground} Write to Block & `lf t55xx wr b 0 d 00081040` \tn % Row Count 5 (+ 2) % Row 3 \SetRowColor{white} Factory Reset Tag & `lf t55xx wipe` \tn % Row Count 7 (+ 2) \hhline{>{\arrayrulecolor{DarkBackground}}--} \SetRowColor{LightBackground} \mymulticolumn{2}{x{5.377cm}}{{\bf{Modulation Types}} \newline `\textless{}FSK|FSK1|FSK1a|FSK2|FSK2a|ASK|PSK1|PSK2|NRZ|BI|BIa\textgreater{} ` \newline `EM is ASK` \newline `HID Prox is FSK` \newline `Indala is PSK`} \tn \hhline{>{\arrayrulecolor{DarkBackground}}--} \end{tabularx} \par\addvspace{1.3em} % That's all folks \end{multicols*} \end{document}