Sniffer overview

PN532Killer provides MIFARE Classic capture modes for authorized research. The PN532 CLI beta can prepare the target identity, select the capture mode, retrieve the records, and run the bundled MFKey helper.

Choose a workflow

Workflow	Original tag present	CLI mode
MFKey32v2	No	hw mode s -t 0
MFKey64	Yes	hw mode s -t 1

CLI setup

Return to Reader modePN532Killer

pn532> hw mode r

Set the capture identityPN532Killer · beta

pn532> hf mf sniffer setuid -u 11223344

Start capture without the original tagPN532Killer

pn532> hw mode s -t 0

Selects the MFKey32v2-oriented capture mode.

hf mf sniffer setuid also accepts a complete MIFARE Classic block 0 through --blk0.

After the authorized interaction, return to Reader mode:

Exit Sniffer modePN532Killer

pn532> hw mode r

Run the helper that matches the selected capture mode:

hf mf mfkey32v2 --show-raw
hf mf mfkey64 --show-raw

Packaged beta.* releases include the native helpers. A source checkout must run ./script/build_helpers.sh first. The command retrieves the PN532Killer Sniffer records and passes them to the matching helper.

Clearing old captures

The current dev interactive command tree does not register the repository README's hf sniff clear command, even though a low-level clear operation exists. Do not assume that command is available; verify the record set before interpreting a result.

Capture records can contain access credentials. Treat them as secrets and delete them when the authorized assessment is complete.