Table of Contents
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
Introduction
Commands related to generic ISO 15693 cards can be invoked from the "hf 15" and "hf 15 cmd" command subtree.
proxmark3> hf 15
help This help
demod Demodulate ISO15693 from tag
read Read HF tag (ISO 15693)
record Record Samples (ISO 15693)
reader Act like an ISO15693 reader
sim Fake an ISO15693 tag
cmd Send direct commands to ISO15693 tag
findafi Brute force AFI of an ISO15693 tag
dumpmemory Read all memory pages of an ISO15693 tag
proxmark3> hf 15 cmd
help This Help
inquiry Search for tags in range
read Read a block
write Write a block
readmulti Reads multiple Blocks
sysinfo Get Card Information
raw Send raw hex data to tag
debug Turn debugging on/off
usage examples:
Send an INQUIRY Command to tags in range:
proxmark3> hf 15 cmd inquiry
UID=E00700001A0xxxxxx
Tag Info: Texas Instrument; Tag-it HF-I Plus Inlay; 64x32bit
Read page 2 from a specific tag:
proxmark3> hf 15 cmd read E0054000076xxxxx 2
Using UID E0054000076xxxxx
2E 80 53 42 ..SB
Read page 2 from a tag in range (automatically find tag via INQUIRY first)
proxmark3> hf 15 cmd read * 2
Using UID E0054000076xxxxx
2E 80 53 42 ..SB
Read page 2 from any tag in range - using unaddressed commands (not supported by all tags)
proxmark3> hf 15 cmd read u 2
2E 80 53 42 ..SB
Write data to page 20 on a tag:
proxmark3> hf 15 cmd read u 20
00 00 00 00
proxmark3> hf 15 cmd write -o u 20 1234ABCD
no answer
proxmark3> hf 15 cmd read u 20
12 34 AB CD
Note: the OPTION-Flag (-o) is mandatory on all TI Hi-Tags HF-I.
Note: As writing takes longer then usual operations, we run into a timeout -
but the data is still written.
Send raw data to a tag:
proxmark3> hf 15 cmd raw -2 -c 26 01 00
received 12 octets
where
-2 turnes of 1 of 256 longrange/lowspeed mode
-c calculates the correct CRC and adds it.
To view the received data, you have to turn of debug mode, which will also give
you other info as well:
proxmark3> hf 15 cmd debug 1
#db# Iso15693 Debug is now on
Read all the memory from a tag (shown as HEX and ASCII):
proxmark3> hf 15 dumpmemory
Reading memory from tag UID=E00700001A0xxxxx
Tag Info: Texas Instrument; Tag-it HF-I Plus Inlay; 64x32bit
Block 0 00 00 FC 2A ...*
Block 1 00 00 00 00 ....
Block 2 0B B8 67 94 ..g.
Block 3 57 A8 2D A6 W.-.
...
Find the AFI of an Tag:
proxmark3> hf 15 findafi
#db# NoAFI UID=E00700001A0xxxxx
#db# AFI=0 UID=E00700001A0xxxxx
#db# AFI=20 UID=E00700001A0xxxxx
#db# AFI Bruteforcing done.
multi page read command
proxmark3> hf 15 cmd readmulti u 2 3
00 00 00 00 BA 14 1B DB 06 60 19 00 ........`..
Tag-"system information" command:
proxmark3> hf 15 cmd sysinfo u
0E xx xx 18 0E 02 94 16 E0 00 32 08 94
UID = E01694020E18xxxx
EM-Marin SA (Skidata)
DSFID not supported
AFI supported, set to 000
Tag provides info on memory layout (vendor dependent)
9 (or 8) bytes/page x 51 pages
IC reference given: 94
Some vendors haven’t read the specification carefully enough, so there are
off-by-one errors possible in the memory layout information. (EM-Marin is doing
it wrong, TI values the ISO standard)
Proxmark Wiki
Hardware
Firmware Upgrade
Client Software
Usage
Low Frequency (125-134kHz)
High Frequency (13.56MHz)
Struggling with this manual? Do you miss some explanation or found something wrong or ambigious? Then please post in the Manual Feedback section of the forum. Any feedback is appreciated.