Generic ISO15693 Ops

Introduction

Commands related to generic ISO 15693 cards can be invoked from the "hf 15" and "hf 15 cmd" command subtree.

proxmark3> hf 15
help             This help          
demod            Demodulate ISO15693 from tag          
read             Read HF tag (ISO 15693)          
record           Record Samples (ISO 15693)          
reader           Act like an ISO15693 reader          
sim              Fake an ISO15693 tag          
cmd              Send direct commands to ISO15693 tag          
findafi          Brute force AFI of an ISO15693 tag          
dumpmemory       Read all memory pages of an ISO15693 tag          

proxmark3> hf 15 cmd
help             This Help          
inquiry          Search for tags in range          
read             Read a block          
write            Write a block          
readmulti        Reads multiple Blocks          
sysinfo          Get Card Information          
raw              Send raw hex data to tag          
debug            Turn debugging on/off       

usage examples:

Send an INQUIRY Command to tags in range:

proxmark3> hf 15 cmd inquiry
UID=E00700001A0xxxxxx
Tag Info: Texas Instrument; Tag-it HF-I Plus Inlay; 64x32bit

Read page 2 from a specific tag:

proxmark3> hf 15 cmd read E0054000076xxxxx 2
Using UID E0054000076xxxxx
2E 80 53 42   ..SB

Read page 2 from a tag in range (automatically find tag via INQUIRY first)

proxmark3> hf 15 cmd read * 2
Using UID E0054000076xxxxx
2E 80 53 42   ..SB

Read page 2 from any tag in range - using unaddressed commands (not supported by all tags)

proxmark3> hf 15 cmd read u 2
2E 80 53 42   ..SB

Write data to page 20 on a tag:

proxmark3> hf 15 cmd read u 20
 00 00 00 00 

proxmark3> hf 15 cmd write -o u 20 1234ABCD
 no answer

proxmark3> hf 15 cmd read u 20
 12 34 AB CD    

Note: the OPTION-Flag (-o) is mandatory on all TI Hi-Tags HF-I.
Note: As writing takes longer then usual operations, we run into a timeout - 
but the data is still written.

Send raw data to a tag:

proxmark3> hf 15 cmd raw -2 -c 26 01 00
received 12 octets

where 
  -2 turnes of 1 of 256 longrange/lowspeed mode 
  -c calculates the correct CRC and adds it.

To view the received data, you have to turn of debug mode, which will also give 
you other info as well:

proxmark3> hf 15 cmd debug 1
#db# Iso15693 Debug is now on

Read all the memory from a tag (shown as HEX and ASCII):

proxmark3> hf 15 dumpmemory
Reading memory from tag UID=E00700001A0xxxxx
Tag Info: Texas Instrument; Tag-it HF-I Plus Inlay; 64x32bit
Block  0   00 00 FC 2A    ...*
Block  1   00 00 00 00    ....
Block  2   0B B8 67 94    ..g.
Block  3   57 A8 2D A6    W.-.
...

Find the AFI of an Tag:

proxmark3> hf 15 findafi
#db# NoAFI UID=E00700001A0xxxxx
#db# AFI=0 UID=E00700001A0xxxxx
#db# AFI=20 UID=E00700001A0xxxxx
#db# AFI Bruteforcing done.

multi page read command

proxmark3> hf 15 cmd readmulti u 2 3
00 00 00 00 BA 14 1B DB 06 60 19 00    ........`..

Tag-"system information" command:

proxmark3> hf 15 cmd sysinfo u
0E xx xx 18 0E 02 94 16 E0 00 32 08 94 
UID = E01694020E18xxxx
EM-Marin SA (Skidata)
DSFID not supported
AFI supported, set to 000
Tag provides info on memory layout (vendor dependent)
 9 (or 8) bytes/page x 51 pages 
IC reference given: 94

Some vendors haven’t read the specification carefully enough, so there are 
off-by-one errors possible in the memory layout information. (EM-Marin is doing 
it wrong, TI values the ISO standard)