MFKey32v2 — without tag

This PN532Killer workflow collects multiple MIFARE Classic authentication records without presenting the original tag.

Configure with the PN532 CLI

Set the authorized target UID, then enter Sniffer type 0:

Connect to PN532Killer

pn532> hw connect

Return to Reader modePN532Killer

pn532> hw mode r

Set the authorized target UIDPN532Killer · beta

pn532> hf mf sniffer setuid -u 11223344

Start MFKey32v2-oriented capturePN532Killer

pn532> hw mode s -t 0

For a special block 0 layout, use hf mf sniffer setuid --blk0 HEX instead of -u.

Present PN532Killer to the reader and trigger only the permitted authentication attempts. When finished, leave Sniffer mode:

Exit Sniffer modePN532Killer

pn532> hw mode r

Retrieve and analyze

Run the beta command after returning to Reader mode:

Analyze MFKey32v2 recordsPN532Killer · beta

pn532> hf mf mfkey32v2 --show-raw

Downloads the Sniffer records and runs the bundled mfkey32v2 helper.

Packaged beta releases include the helper. For a source checkout, run ./script/build_helpers.sh before analysis.

If analysis fails, collect more distinct permitted attempts, verify that the protocol is MIFARE Classic, check that the native helper exists, separate records from previous sessions, and improve antenna alignment. The current interactive tree does not expose a supported capture-clear command.