From 8bbc5934b5719ff34773c35bc07bd86dd207cbe9 Mon Sep 17 00:00:00 2001
From: mhjack <mj@mjserv.com>
Date: Sun, 1 Jan 2023 00:59:49 -0600
Subject: [PATCH 01/15] Add detection and info command behavior for NTAG 5
 devices, enable EAS status check in info command for SLI, SLIX, SLIX-L, and
 SLIX-S tags which all support EAS mode

(cherry picked from commit a430439f05654fe62c365f4c8f5ee13cb4103dfa)
---
 client/src/cmdhf15.c | 170 ++++++++++++++++++++++++++-----------------
 1 file changed, 102 insertions(+), 68 deletions(-)

diff --git a/client/src/cmdhf15.c b/client/src/cmdhf15.c
index c35df7238..76fc4869a 100644
--- a/client/src/cmdhf15.c
+++ b/client/src/cmdhf15.c
@@ -99,6 +99,7 @@ static const productName_t uidmapping[] = {
     //I-Code SLIX-L        [IC id = 03 + bit36 set to 1]
     { 0xE004000000000000LL, 16, "NXP Semiconductors Germany (Philips)" },
     { 0xE004010000000000LL, 24, "NXP(Philips); IC SL2 ICS20/ICS21(SLI) ICS2002/ICS2102(SLIX) ICS2602(SLIX2)" },
+    { 0xE004011800000000LL, 0xFFFFFF1800000000LL, "NXP(Philips); IC NTP53x2/NTP5210/NTA5332(NTAG 5)" },
     { 0xE004010000000000LL, 0xFFFFFF1800000000LL, "NXP(Philips); IC SL2 ICS20/ICS21(SLI)" },
     { 0xE004011000000000LL, 0xFFFFFF1800000000LL, "NXP(Philips); IC SL2 ICS2002/ICS2102(SLIX)" },
     { 0xE004010800000000LL, 0xFFFFFF1800000000LL, "NXP(Philips); IC SL2 ICS2602(SLIX2)" },
@@ -651,6 +652,95 @@ static int CmdHF15Samples(const char *Cmd) {
     return PM3_SUCCESS;
 }
 
+static int NxpTestEAS(uint8_t *uid) 
+{
+		uint8_t fast = 1;
+    uint8_t reply = 1;
+    PacketResponseNG resp;
+    uint16_t reqlen = 0;
+    uint8_t req[PM3_CMD_DATA_SIZE] = {0};
+    
+    req[reqlen++] |= ISO15_REQ_SUBCARRIER_SINGLE | ISO15_REQ_DATARATE_HIGH | ISO15_REQ_NONINVENTORY | ISO15_REQ_ADDRESS;
+    req[reqlen++] = ISO15693_EAS_ALARM;
+    req[reqlen++] = 0x04; // IC manufacturer code
+    memcpy(req + 3, uid, 8); // add UID
+    reqlen += 8;
+
+    AddCrc15(req,  reqlen);
+    reqlen += 2;
+
+    clearCommandBuffer();
+    SendCommandMIX(CMD_HF_ISO15693_COMMAND, reqlen, fast, reply, req, reqlen);
+
+    if (WaitForResponseTimeout(CMD_HF_ISO15693_COMMAND, &resp, 2000) == false) {
+        PrintAndLogEx(WARNING, "iso15693 timeout");
+    } else {
+        PrintAndLogEx(NORMAL, "");
+
+
+        if (resp.length < 2) {
+            PrintAndLogEx(INFO, "  EAS (Electronic Article Surveillance) is not active");
+        } else {
+            uint8_t * recv = resp.data.asBytes;
+
+            if (!(recv[0] & ISO15_RES_ERROR)) {
+                PrintAndLogEx(INFO, "  EAS (Electronic Article Surveillance) is active.");
+                PrintAndLogEx(INFO, "  EAS sequence: %s", sprint_hex(recv + 1, 32));
+            }
+        }
+    }
+    
+    return PM3_SUCCESS;
+} 
+
+static int NxpCheckSig(uint8_t *uid) {
+		uint8_t fast = 1;
+    uint8_t reply = 1;
+    PacketResponseNG resp;
+    uint16_t reqlen = 0;
+    uint8_t req[PM3_CMD_DATA_SIZE] = {0};
+    
+		// Check if we can also read the signature
+	  req[reqlen++] |= ISO15_REQ_SUBCARRIER_SINGLE | ISO15_REQ_DATARATE_HIGH | ISO15_REQ_NONINVENTORY | ISO15_REQ_ADDRESS;
+	  req[reqlen++] = ISO15693_READ_SIGNATURE;
+	  req[reqlen++] = 0x04; // IC manufacturer code
+	  memcpy(req + 3, uid, 8); // add UID
+	  reqlen += 8;
+
+	  AddCrc15(req,  reqlen);
+	  reqlen += 2;
+
+	  clearCommandBuffer();
+	  SendCommandMIX(CMD_HF_ISO15693_COMMAND, reqlen, fast, reply, req, reqlen);
+
+	  if (WaitForResponseTimeout(CMD_HF_ISO15693_COMMAND, &resp, 2000) == false) {
+	      PrintAndLogEx(WARNING, "iso15693 timeout");
+	      DropField();
+	      return PM3_ETIMEOUT;
+	  }
+
+	  DropField();
+
+	  if (resp.length < 2) {
+	      PrintAndLogEx(WARNING, "iso15693 card doesn't answer to READ SIGNATURE command");
+	      return PM3_EWRONGANSWER;
+	  }
+
+	  uint8_t *recv = resp.data.asBytes;
+
+	  if ((recv[0] & ISO15_RES_ERROR) == ISO15_RES_ERROR) {
+	      PrintAndLogEx(ERR, "iso15693 card returned error %i: %s", recv[0], TagErrorStr(recv[0]));
+	      return PM3_EWRONGANSWER;
+	  }
+
+	  uint8_t signature[32] = {0x00};
+	  memcpy(signature, recv + 1, 32);
+
+	  nxp_15693_print_signature(uid, signature);
+	  
+	  return PM3_SUCCESS;
+}
+
 // Get NXP system information from SLIX2 tag/VICC
 static int NxpSysInfo(uint8_t *uid) {
 
@@ -732,77 +822,11 @@ static int NxpSysInfo(uint8_t *uid) {
     PrintAndLogEx(INFO, "      * Additional 32 bits feature flags are%s transmitted", ((recv[5] & 0x80) ? "" : " not"));
 
     if (support_easmode) {
-        reqlen = 0;
-        req[reqlen++] |= ISO15_REQ_SUBCARRIER_SINGLE | ISO15_REQ_DATARATE_HIGH | ISO15_REQ_NONINVENTORY | ISO15_REQ_ADDRESS;
-        req[reqlen++] = ISO15693_EAS_ALARM;
-        req[reqlen++] = 0x04; // IC manufacturer code
-        memcpy(req + 3, uid, 8); // add UID
-        reqlen += 8;
-
-        AddCrc15(req,  reqlen);
-        reqlen += 2;
-
-        clearCommandBuffer();
-        SendCommandMIX(CMD_HF_ISO15693_COMMAND, reqlen, fast, reply, req, reqlen);
-
-        if (WaitForResponseTimeout(CMD_HF_ISO15693_COMMAND, &resp, 2000) == false) {
-            PrintAndLogEx(WARNING, "iso15693 timeout");
-        } else {
-            PrintAndLogEx(NORMAL, "");
-
-
-            if (resp.length < 2) {
-                PrintAndLogEx(INFO, "  EAS (Electronic Article Surveillance) is not active");
-            } else {
-                recv = resp.data.asBytes;
-
-                if (!(recv[0] & ISO15_RES_ERROR)) {
-                    PrintAndLogEx(INFO, "  EAS (Electronic Article Surveillance) is active.");
-                    PrintAndLogEx(INFO, "  EAS sequence: %s", sprint_hex(recv + 1, 32));
-                }
-            }
-        }
+			NxpTestEAS(uid);
     }
 
     if (support_signature) {
-        // Check if we can also read the signature
-        reqlen = 0;
-        req[reqlen++] |= ISO15_REQ_SUBCARRIER_SINGLE | ISO15_REQ_DATARATE_HIGH | ISO15_REQ_NONINVENTORY | ISO15_REQ_ADDRESS;
-        req[reqlen++] = ISO15693_READ_SIGNATURE;
-        req[reqlen++] = 0x04; // IC manufacturer code
-        memcpy(req + 3, uid, 8); // add UID
-        reqlen += 8;
-
-        AddCrc15(req,  reqlen);
-        reqlen += 2;
-
-        clearCommandBuffer();
-        SendCommandMIX(CMD_HF_ISO15693_COMMAND, reqlen, fast, reply, req, reqlen);
-
-        if (WaitForResponseTimeout(CMD_HF_ISO15693_COMMAND, &resp, 2000) == false) {
-            PrintAndLogEx(WARNING, "iso15693 timeout");
-            DropField();
-            return PM3_ETIMEOUT;
-        }
-
-        DropField();
-
-        if (resp.length < 2) {
-            PrintAndLogEx(WARNING, "iso15693 card doesn't answer to READ SIGNATURE command");
-            return PM3_EWRONGANSWER;
-        }
-
-        recv = resp.data.asBytes;
-
-        if ((recv[0] & ISO15_RES_ERROR) == ISO15_RES_ERROR) {
-            PrintAndLogEx(ERR, "iso15693 card returned error %i: %s", recv[0], TagErrorStr(recv[0]));
-            return PM3_EWRONGANSWER;
-        }
-
-        uint8_t signature[32] = {0x00};
-        memcpy(signature, recv + 1, 32);
-
-        nxp_15693_print_signature(uid, signature);
+      NxpCheckSig(uid);
     }
 
     return PM3_SUCCESS;
@@ -945,6 +969,16 @@ static int CmdHF15Info(const char *Cmd) {
         PrintAndLogEx(DEBUG, "SLIX2 Detected, getting NXP System Info");
         return NxpSysInfo(uid);
     }
+    else if(data[8] == 0x04 && data[7] == 0x01 && nxp_version == 0x18) //If it is an NTAG 5 
+    {
+    		PrintAndLogEx(DEBUG, "NTAG 5 Detected, getting NXP System Info");
+        return NxpSysInfo(uid);
+    }
+    else if(data[8] == 0x04 && (data[7] == 0x01 || data[7] == 0x02 || data[7] == 0x03)) //If SLI, SLIX, SLIX-l, or SLIX-S check EAS status
+    {
+    		PrintAndLogEx(DEBUG, "SLI, SLIX, SLIX-L, or SLIX-S Detected checking EAS status");
+    		return NxpTestEAS(uid);
+    }
 
     PrintAndLogEx(NORMAL, "");
     return PM3_SUCCESS;

From 002d0ac24f245012bfe0835bd1cb44a0a176e353 Mon Sep 17 00:00:00 2001
From: mjacksn <mhjack@me.com>
Date: Mon, 23 Jan 2023 10:57:32 -0600
Subject: [PATCH 02/15] changelog addition

---
 CHANGELOG.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index b4cde2d93..c456ac64d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1367,3 +1367,5 @@ This project uses the changelog in accordance with [keepchangelog](http://keepac
 ### Added
  - iClass functionality: full simulation of iclass tags, so tags can be simulated with data (not only CSN). Not yet support for write/update, but readers do not seem to enforce update. (@holiman).
  - iClass decryption. Proxmark can now decrypt data on an iclass tag, but requires you to have the HID decryption key locally on your computer, as this is not bundled with the sourcecode.
+ - `hf 15 info` can detect NTAG 5 tags
+ - `hf 15 info` include an EAS status check on more of the icode tags which support EAS (SLI, SLIX, SLIX-L, and SLIX-S)
\ No newline at end of file

From 4d2caaebc2a19d048c5fc53d76f1f7d6535aedeb Mon Sep 17 00:00:00 2001
From: Mikhail Elov <m.elov@bftcom.com>
Date: Tue, 24 Jan 2023 11:15:24 +0300
Subject: [PATCH 03/15] add gen4 GTU magic card command 'Set Ultralight and M1
 maximum read/write sectors'

---
 doc/magic_cards_notes.md | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/doc/magic_cards_notes.md b/doc/magic_cards_notes.md
index c8decbfe2..07e6cb5d6 100644
--- a/doc/magic_cards_notes.md
+++ b/doc/magic_cards_notes.md
@@ -1086,6 +1086,7 @@ CF <passwd> 35 <2b ATQA><1b SAK>                 // Configure ATQA/SAK (swap ATQ
 CF <passwd> 68 <00-02>                           // Configure UID length
 CF <passwd> 69 <00-01>                           // (De)Activate Ultralight mode
 CF <passwd> 6A <00-03>                           // Select Ultralight mode
+CF <passwd> 6B <1b>                              // Set Ultralight and M1 maximum read/write sectors
 CF <passwd> C6                                   // Dump configuration
 CF <passwd> CC                                   // Factory test, returns 6666
 CF <passwd> CD <1b block number><16b block data> // Backdoor write 16b block
@@ -1304,6 +1305,19 @@ script run hf_mf_ultimatecard -m 02
 ```
 
 Now the card supports the 3DES UL-C authentication.
+### Set Ultralight and M1 maximum read/write sectors
+^[Top](#top) ^^[Gen4](#g4top)
+
+```
+hf 14a raw -s -c -t 1000 CF<passwd>6B<1b blocks>
+```
+Hexadecimal, maximum sector data, default 0xFF, range 0x00-0xFF
+
+Example: set maximum 63 blocks read/write for Mifare Classic 1K
+
+```
+hf 14a raw -s -c -t 1000 CF000000006B3F
+```
 ### Set shadow mode (GTU)
 ^[Top](#top) ^^[Gen4](#g4top)
 

From e6b7efa9dfd6be76de49f96a0961fd934ce48979 Mon Sep 17 00:00:00 2001
From: Mikhail Elov <m.elov@bftcom.com>
Date: Tue, 24 Jan 2023 12:00:21 +0300
Subject: [PATCH 04/15] changelog

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index c456ac64d..942100d85 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,6 +3,7 @@ All notable changes to this project will be documented in this file.
 This project uses the changelog in accordance with [keepchangelog](http://keepachangelog.com/). Please use this to write notable changes, which is not the same as git commit log...
 
 ## [unreleased][unreleased]
+ - Added new magic gen4 cards command in docs (@McEloff)
  - Added `hf tesla info` - intital information command to read TESLA cards (@iceman1001)
  - Changed `hf emrtd info` - looking for lower case .bin extensions (@iceman1001)
  - Changed `hf emrtd dump` - looking for lower case .bin extensions (@iceman1001)

From 689e9c2179f9565f32acb836ee9504b3b32385bf Mon Sep 17 00:00:00 2001
From: Mikhail Elov <m.elov@bftcom.com>
Date: Tue, 24 Jan 2023 15:44:28 +0300
Subject: [PATCH 05/15] Add new info about configuration dump gen4 GTU and
 description of unknown command

---
 doc/magic_cards_notes.md | 21 +++++++++++++++++++--
 1 file changed, 19 insertions(+), 2 deletions(-)

diff --git a/doc/magic_cards_notes.md b/doc/magic_cards_notes.md
index 07e6cb5d6..db8057e5e 100644
--- a/doc/magic_cards_notes.md
+++ b/doc/magic_cards_notes.md
@@ -1091,6 +1091,7 @@ CF <passwd> C6                                   // Dump configuration
 CF <passwd> CC                                   // Factory test, returns 6666
 CF <passwd> CD <1b block number><16b block data> // Backdoor write 16b block
 CF <passwd> CE <1b block number>                 // Backdoor read 16b block
+CF <passwd> CF <1b param>                        // Unknown
 CF <passwd> F0 <30b configuration data>          // Configure all params in one cmd
 CF <passwd> F1 <30b configuration data>          // Configure all params in one cmd and fuse the configuration permanently
 CF <passwd> FE <4b new_password>                 // change password
@@ -1379,6 +1380,20 @@ Example: write block0 with factory data, default pwd
 hf 14a raw -s -c -t 1000 CF00000000CD00112233441C000011778185BA18000000
 ```
 
+### Unknown command
+^[Top](#top) ^^[Gen4](#g4top)
+
+This command modifies one byte in configuration dump, but purpose one is unknown.
+
+```
+hf 14a raw -s -c -t 1000 CF<passwd>CF<1b param>
+```
+ * `<param>`
+   * `??`: ???
+
+Example:
+hf 14a raw -s -c -t 1000 CF00000000CF02
+
 ### Change backdoor password
 ^[Top](#top) ^^[Gen4](#g4top)
 
@@ -1405,8 +1420,10 @@ hf 14a raw -s -c -t 1000 CF<passwd>C6
 ```
 Default configuration:
 ```
-00000000000002000978009102DABC191010111213141516040008004F6B
-                                                        ^^^^ ??
+00000000000002000978009102DABC191010111213141516040008006B024F6B
+                                                            ^^^^ ??
+                                                          ^^ cf cmd cf: ?? this byte set by cmd cf<pwd>cf<param>, factory value 0x02
+                                                        ^^ cf cmd 6b: maximum read/write sectors, factory value 0x6b
                                                       ^^ cf cmd 6a: UL mode
                                                 ^^^^^^ cf cmd 35: ATQA/SAK
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ cf cmd 34: ATS length & content

From 844e6109b80141fa35d626b25b489ecb003ef8b2 Mon Sep 17 00:00:00 2001
From: Philippe Teuwen <phil@teuwen.org>
Date: Tue, 24 Jan 2023 15:09:23 +0100
Subject: [PATCH 06/15] Add LF_PROX2BRUTE to build_all_firmwares.sh

---
 tools/build_all_firmwares.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/build_all_firmwares.sh b/tools/build_all_firmwares.sh
index c6bb8969d..73e340d70 100755
--- a/tools/build_all_firmwares.sh
+++ b/tools/build_all_firmwares.sh
@@ -30,7 +30,7 @@ mkdir -p "$DEST"
 mv bootrom/obj/bootrom.elf "$DEST/PM3BOOTROM.elf"
 
 # cf armsrc/Standalone/Makefile.hal
-STANDALONE_MODES=(LF_SKELETON LF_EM4100EMUL LF_EM4100RSWB LF_EM4100RSWW LF_EM4100RWC LF_HIDBRUTE LF_HIDFCBRUTE LF_ICEHID LF_PROXBRUTE LF_SAMYRUN LF_THAREXDE LF_NEXID LF_NEDAP_SIM)
+STANDALONE_MODES=(LF_SKELETON LF_EM4100EMUL LF_EM4100RSWB LF_EM4100RSWW LF_EM4100RWC LF_HIDBRUTE LF_HIDFCBRUTE LF_ICEHID LF_PROXBRUTE LF_PROX2BRUTE LF_SAMYRUN LF_THAREXDE LF_NEXID LF_NEDAP_SIM)
 STANDALONE_MODES+=(HF_14ASNIFF HF_14BSNIFF HF_15SNIFF HF_AVEFUL HF_BOG HF_COLIN HF_CRAFTBYTE HF_ICECLASS HF_LEGIC HF_LEGICSIM HF_MATTYRUN HF_MFCSIM HF_MSDSAL HF_TCPRST HF_TMUDFORD HF_YOUNG HF_REBLAY DANKARMULTI)
 STANDALONE_MODES_REQ_BT=(HF_REBLAY)
 STANDALONE_MODES_REQ_SMARTCARD=()

From 248cec793c76824fd55be4383e26a107ca27d9ab Mon Sep 17 00:00:00 2001
From: Philippe Teuwen <phil@teuwen.org>
Date: Tue, 24 Jan 2023 15:21:59 +0100
Subject: [PATCH 07/15] standalone: respect alphabetical order, else it's a
 mess to cross-check

---
 armsrc/Standalone/Makefile.hal                |  12 +-
 armsrc/Standalone/Makefile.inc                | 136 +++++++++---------
 armsrc/Standalone/readme.md                   |  10 +-
 .../4_Advanced-compilation-parameters.md      |   2 +-
 tools/build_all_firmwares.sh                  |   6 +-
 5 files changed, 88 insertions(+), 78 deletions(-)

diff --git a/armsrc/Standalone/Makefile.hal b/armsrc/Standalone/Makefile.hal
index 6b9343683..cb41bc148 100644
--- a/armsrc/Standalone/Makefile.hal
+++ b/armsrc/Standalone/Makefile.hal
@@ -50,12 +50,12 @@ define KNOWN_STANDALONE_DEFINITIONS
 | LF_ICEHID       | LF HID collector to flashmem           |
 | (RDV4 only)     |                                        |
 +----------------------------------------------------------+
-| LF_NEXID        | LF Nexwatch collector to flashmem      |
-| (RDV4 only)     |                                        |
-+----------------------------------------------------------+
 | LF_NEDAP_SIM    | LF Nedap ID simple simulator           |
 |                 |                                        |
 +----------------------------------------------------------+
+| LF_NEXID        | LF Nexwatch collector to flashmem      |
+| (RDV4 only)     |                                        |
++----------------------------------------------------------+
 | LF_PROXBRUTE    | HID ProxII bruteforce                  |
 |                 | - Brad Antoniewicz                     |
 +----------------------------------------------------------+
@@ -125,8 +125,10 @@ define KNOWN_STANDALONE_DEFINITIONS
 endef
 
 
-STANDALONE_MODES := LF_SKELETON LF_EM4100EMUL LF_EM4100RSWB LF_EM4100RSWW LF_EM4100RWC LF_HIDBRUTE LF_HIDFCBRUTE LF_ICEHID LF_PROXBRUTE LF_PROX2BRUTE LF_SAMYRUN LF_THAREXDE LF_NEXID LF_NEDAP_SIM
-STANDALONE_MODES += HF_14ASNIFF HF_14BSNIFF HF_15SNIFF HF_AVEFUL HF_BOG HF_COLIN HF_CRAFTBYTE HF_ICECLASS HF_LEGIC HF_LEGICSIM HF_MATTYRUN HF_MFCSIM HF_MSDSAL HF_TCPRST HF_TMUDFORD HF_YOUNG HF_REBLAY DANKARMULTI
+STANDALONE_MODES := LF_SKELETON
+STANDALONE_MODES += LF_EM4100EMUL LF_EM4100RSWB LF_EM4100RSWW LF_EM4100RWC LF_HIDBRUTE LF_HIDFCBRUTE LF_ICEHID LF_NEDAP_SIM LF_NEXID LF_PROXBRUTE LF_PROX2BRUTE LF_SAMYRUN LF_THAREXDE
+STANDALONE_MODES += HF_14ASNIFF HF_14BSNIFF HF_15SNIFF HF_AVEFUL HF_BOG HF_COLIN HF_CRAFTBYTE HF_ICECLASS HF_LEGIC HF_LEGICSIM HF_MATTYRUN HF_MFCSIM HF_MSDSAL HF_REBLAY HF_TCPRST HF_TMUDFORD HF_YOUNG
+STANDALONE_MODES += DANKARMULTI
 STANDALONE_MODES_REQ_BT := HF_REBLAY
 STANDALONE_MODES_REQ_SMARTCARD :=
 STANDALONE_MODES_REQ_FLASH := LF_HIDFCBRUTE LF_ICEHID LF_NEXID LF_THAREXDE HF_BOG HF_COLIN HF_ICECLASS HF_LEGICSIM HF_MFCSIM
diff --git a/armsrc/Standalone/Makefile.inc b/armsrc/Standalone/Makefile.inc
index d3f88823e..48ac2217f 100644
--- a/armsrc/Standalone/Makefile.inc
+++ b/armsrc/Standalone/Makefile.inc
@@ -21,6 +21,42 @@ SRC_STANDALONE = placeholder.c
 ifneq (,$(findstring WITH_STANDALONE_LF_SKELETON,$(APP_CFLAGS)))
     SRC_STANDALONE = lf_skeleton.c
 endif
+# WITH_STANDALONE_LF_EM4100EMUL
+ifneq (,$(findstring WITH_STANDALONE_LF_EM4100EMUL,$(APP_CFLAGS)))
+    SRC_STANDALONE = lf_em4100emul.c
+endif
+# WITH_STANDALONE_LF_EM4100RSWB
+ifneq (,$(findstring WITH_STANDALONE_LF_EM4100RSWB,$(APP_CFLAGS)))
+    SRC_STANDALONE = lf_em4100rswb.c
+endif
+# WITH_STANDALONE_LF_EM4100RSWW
+ifneq (,$(findstring WITH_STANDALONE_LF_EM4100RSWW,$(APP_CFLAGS)))
+    SRC_STANDALONE = lf_em4100rsww.c
+endif
+# WITH_STANDALONE_LF_EM4100RWC
+ifneq (,$(findstring WITH_STANDALONE_LF_EM4100RWC,$(APP_CFLAGS)))
+    SRC_STANDALONE = lf_em4100rwc.c
+endif
+# WITH_STANDALONE_LF_HIDBRUTE
+ifneq (,$(findstring WITH_STANDALONE_LF_HIDBRUTE,$(APP_CFLAGS)))
+    SRC_STANDALONE = lf_hidbrute.c
+endif
+# WITH_STANDALONE_LF_HIDFCBRUTE
+ifneq (,$(findstring WITH_STANDALONE_LF_HIDFCBRUTE,$(APP_CFLAGS)))
+    SRC_STANDALONE = lf_hidfcbrute.c
+endif
+# WITH_STANDALONE_LF_ICEHID
+ifneq (,$(findstring WITH_STANDALONE_LF_ICEHID,$(APP_CFLAGS)))
+    SRC_STANDALONE = lf_icehid.c
+endif
+# WITH_STANDALONE_LF_NEDAP_SIM
+ifneq (,$(findstring WITH_STANDALONE_LF_NEDAP_SIM,$(APP_CFLAGS)))
+    SRC_STANDALONE = lf_nedap_sim.c
+endif
+# WITH_STANDALONE_LF_NEXID
+ifneq (,$(findstring WITH_STANDALONE_LF_NEXID,$(APP_CFLAGS)))
+    SRC_STANDALONE = lf_nexid.c
+endif
 # WITH_STANDALONE_LF_SAMYRUN
 ifneq (,$(findstring WITH_STANDALONE_LF_SAMYRUN,$(APP_CFLAGS)))
     SRC_STANDALONE = lf_samyrun.c
@@ -33,29 +69,9 @@ endif
 ifneq (,$(findstring WITH_STANDALONE_LF_PROX2BRUTE,$(APP_CFLAGS)))
     SRC_STANDALONE = lf_prox2brute.c
 endif
-# WITH_STANDALONE_LF_HIDBRUTE
-ifneq (,$(findstring WITH_STANDALONE_LF_HIDBRUTE,$(APP_CFLAGS)))
-    SRC_STANDALONE = lf_hidbrute.c
-endif
-# WITH_STANDALONE_LF_HIDFCBRUTE
-ifneq (,$(findstring WITH_STANDALONE_LF_HIDFCBRUTE,$(APP_CFLAGS)))
-    SRC_STANDALONE = lf_hidfcbrute.c
-endif
-# WITH_STANDALONE_HF_YOUNG
-ifneq (,$(findstring WITH_STANDALONE_HF_YOUNG,$(APP_CFLAGS)))
-    SRC_STANDALONE = hf_young.c
-endif
-# WITH_STANDALONE_HF_MATTYRUN
-ifneq (,$(findstring WITH_STANDALONE_HF_MATTYRUN,$(APP_CFLAGS)))
-    SRC_STANDALONE = hf_mattyrun.c
-endif
-# WITH_STANDALONE_HF_COLIN
-ifneq (,$(findstring WITH_STANDALONE_HF_COLIN,$(APP_CFLAGS)))
-    SRC_STANDALONE = vtsend.c hf_colin.c frozen.c nprintf.c
-endif
-# WITH_STANDALONE_HF_BOG
-ifneq (,$(findstring WITH_STANDALONE_HF_BOG,$(APP_CFLAGS)))
-    SRC_STANDALONE = hf_bog.c
+# WITH_STANDALONE_LF_THAREXDE
+ifneq (,$(findstring WITH_STANDALONE_LF_THAREXDE,$(APP_CFLAGS)))
+    SRC_STANDALONE = lf_tharexde.c
 endif
 # WITH_STANDALONE_HF_14ASNIFF
 ifneq (,$(findstring WITH_STANDALONE_HF_14ASNIFF,$(APP_CFLAGS)))
@@ -73,33 +89,21 @@ endif
 ifneq (,$(findstring WITH_STANDALONE_HF_AVEFUL,$(APP_CFLAGS)))
     SRC_STANDALONE = hf_aveful.c
 endif
-# WITH_STANDALONE_HF_TCPRST
-ifneq (,$(findstring WITH_STANDALONE_HF_TCPRST,$(APP_CFLAGS)))
-    SRC_STANDALONE = hf_tcprst.c
+# WITH_STANDALONE_HF_BOG
+ifneq (,$(findstring WITH_STANDALONE_HF_BOG,$(APP_CFLAGS)))
+    SRC_STANDALONE = hf_bog.c
 endif
-# WITH_STANDALONE_LF_ICEHID
-ifneq (,$(findstring WITH_STANDALONE_LF_ICEHID,$(APP_CFLAGS)))
-    SRC_STANDALONE = lf_icehid.c
+# WITH_STANDALONE_HF_COLIN
+ifneq (,$(findstring WITH_STANDALONE_HF_COLIN,$(APP_CFLAGS)))
+    SRC_STANDALONE = vtsend.c hf_colin.c frozen.c nprintf.c
 endif
-# WITH_STANDALONE_LF_NEXID
-ifneq (,$(findstring WITH_STANDALONE_LF_NEXID,$(APP_CFLAGS)))
-    SRC_STANDALONE = lf_nexid.c
+# WITH_STANDALONE_HF_CRAFTBYTE
+ifneq (,$(findstring WITH_STANDALONE_HF_CRAFTBYTE,$(APP_CFLAGS)))
+    SRC_STANDALONE = hf_craftbyte.c
 endif
-# WITH_STANDALONE_LF_EM4100EMUL
-ifneq (,$(findstring WITH_STANDALONE_LF_EM4100EMUL,$(APP_CFLAGS)))
-    SRC_STANDALONE = lf_em4100emul.c
-endif
-# WITH_STANDALONE_LF_EM4100RSWB
-ifneq (,$(findstring WITH_STANDALONE_LF_EM4100RSWB,$(APP_CFLAGS)))
-    SRC_STANDALONE = lf_em4100rswb.c
-endif
-# WITH_STANDALONE_LF_EM4100RSWW
-ifneq (,$(findstring WITH_STANDALONE_LF_EM4100RSWW,$(APP_CFLAGS)))
-    SRC_STANDALONE = lf_em4100rsww.c
-endif
-# WITH_STANDALONE_LF_EM4100RWC
-ifneq (,$(findstring WITH_STANDALONE_LF_EM4100RWC,$(APP_CFLAGS)))
-    SRC_STANDALONE = lf_em4100rwc.c
+# WITH_STANDALONE_HF_ICECLASS
+ifneq (,$(findstring WITH_STANDALONE_HF_ICECLASS,$(APP_CFLAGS)))
+    SRC_STANDALONE = hf_iceclass.c
 endif
 # WITH_STANDALONE_HF_LEGIC
 ifneq (,$(findstring WITH_STANDALONE_HF_LEGIC,$(APP_CFLAGS)))
@@ -109,37 +113,33 @@ endif
 ifneq (,$(findstring WITH_STANDALONE_HF_LEGICSIM,$(APP_CFLAGS)))
    SRC_STANDALONE = hf_legicsim.c
 endif
+# WITH_STANDALONE_HF_MATTYRUN
+ifneq (,$(findstring WITH_STANDALONE_HF_MATTYRUN,$(APP_CFLAGS)))
+    SRC_STANDALONE = hf_mattyrun.c
+endif
+# WITH_STANDALONE_HF_MFCSIM
+ifneq (,$(findstring WITH_STANDALONE_HF_MFCSIM,$(APP_CFLAGS)))
+    SRC_STANDALONE = hf_mfcsim.c
+endif
 # WITH_STANDALONE_HF_MSDSAL
 ifneq (,$(findstring WITH_STANDALONE_HF_MSDSAL,$(APP_CFLAGS)))
     SRC_STANDALONE = hf_msdsal.c
 endif
-# WITH_STANDALONE_HF_ICECLASS
-ifneq (,$(findstring WITH_STANDALONE_HF_ICECLASS,$(APP_CFLAGS)))
-    SRC_STANDALONE = hf_iceclass.c
+# WITH_STANDALONE_HF_REBLAY
+ifneq (,$(findstring WITH_STANDALONE_HF_REBLAY,$(APP_CFLAGS)))
+    SRC_STANDALONE = hf_reblay.c
 endif
-# WITH_STANDALONE_LF_THAREXDE
-ifneq (,$(findstring WITH_STANDALONE_LF_THAREXDE,$(APP_CFLAGS)))
-    SRC_STANDALONE = lf_tharexde.c
-endif
-# WITH_STANDALONE_HF_CRAFTBYTE
-ifneq (,$(findstring WITH_STANDALONE_HF_CRAFTBYTE,$(APP_CFLAGS)))
-    SRC_STANDALONE = hf_craftbyte.c
+# WITH_STANDALONE_HF_TCPRST
+ifneq (,$(findstring WITH_STANDALONE_HF_TCPRST,$(APP_CFLAGS)))
+    SRC_STANDALONE = hf_tcprst.c
 endif
 # WITH_STANDALONE_HF_TMUDFORD
 ifneq (,$(findstring WITH_STANDALONE_HF_TMUDFORD,$(APP_CFLAGS)))
     SRC_STANDALONE = hf_tmudford.c
 endif
- # WITH_STANDALONE_HF_REBLAY
-ifneq (,$(findstring WITH_STANDALONE_HF_REBLAY,$(APP_CFLAGS)))
-    SRC_STANDALONE = hf_reblay.c
-endif
- # WITH_STANDALONE_HF_MFCSIM
-ifneq (,$(findstring WITH_STANDALONE_HF_MFCSIM,$(APP_CFLAGS)))
-    SRC_STANDALONE = hf_mfcsim.c
-endif
-# WITH_STANDALONE_LF_NEDAP_SIM
-ifneq (,$(findstring WITH_STANDALONE_LF_NEDAP_SIM,$(APP_CFLAGS)))
-    SRC_STANDALONE = lf_nedap_sim.c
+# WITH_STANDALONE_HF_YOUNG
+ifneq (,$(findstring WITH_STANDALONE_HF_YOUNG,$(APP_CFLAGS)))
+    SRC_STANDALONE = hf_young.c
 endif
 
 ifneq (,$(findstring WITH_STANDALONE_DANKARMULTI,$(APP_CFLAGS)))
diff --git a/armsrc/Standalone/readme.md b/armsrc/Standalone/readme.md
index 8cca3ce03..fe4bdfe1e 100644
--- a/armsrc/Standalone/readme.md
+++ b/armsrc/Standalone/readme.md
@@ -100,6 +100,8 @@ STANDALONE_MODES_REQ_FLASH :=
 STANDALONE_MODES_REQ_BT :=
 ```
 
+Please respect alphabetic order!
+
 ## Update MAKEFILE.INC
 ^[Top](#top)
 
@@ -117,6 +119,8 @@ ifneq (,$(findstring WITH_STANDALONE_LF_FOO,$(APP_CFLAGS)))
 endif
 ```
 
+Please respect alphabetic order!
+
 ## Adding identification string of your mode
 ^[Top](#top)
 
@@ -174,9 +178,11 @@ Once you're ready to share your mode, please
 
 * add a line in CHANGELOG.md
 * add your mode in the modes table in `doc/md/Use_of_Proxmark/4_Advanced-compilation-parameters.md`
-* add your mode in `tools/build_all_firmwares.sh`
+* add your mode in `tools/build_all_firmwares.sh` such that it reflects `armsrc/Standalone/Makefile.hal` list of firmwares to build.
 
-and submit your PR.
+Please respect alphabetic order of standalone modes everywhere!
+
+Then submit your PR.
 
 Once approved, add also your mode in https://github.com/RfidResearchGroup/proxmark3/wiki/Standalone-mode
 
diff --git a/doc/md/Use_of_Proxmark/4_Advanced-compilation-parameters.md b/doc/md/Use_of_Proxmark/4_Advanced-compilation-parameters.md
index ee8c63465..90af8fd8f 100644
--- a/doc/md/Use_of_Proxmark/4_Advanced-compilation-parameters.md
+++ b/doc/md/Use_of_Proxmark/4_Advanced-compilation-parameters.md
@@ -119,8 +119,8 @@ Here are the supported values you can assign to `STANDALONE` in `Makefile.platfo
 | HF_15SNIFF      | 15693 sniff storing to flashmem - Glaser
 | HF_AVEFUL       | MIFARE Ultralight read/simulation - Ave Ozkal
 | HF_BOG          | 14a sniff with ULC/ULEV1/NTAG auth storing in flashmem - Bogito
-| HF_CRAFTBYTE    | UID stealer - Emulates scanned 14a UID - Anze Jensterle
 | HF_COLIN        | Mifare ultra fast sniff/sim/clone - Colin Brigato
+| HF_CRAFTBYTE    | UID stealer - Emulates scanned 14a UID - Anze Jensterle
 | HF_ICECLASS     | iCLASS 4-1 mode  sim/read & dump/loclass/glitch & config to flashmem - Iceman1001
 | HF_LEGIC        | HF Legic Prime Read/Store/Sim standalone - uhei
 | HF_LEGICSIM     | HF Legic Prime Simulate standalone - uhei
diff --git a/tools/build_all_firmwares.sh b/tools/build_all_firmwares.sh
index 73e340d70..b76f7a45a 100755
--- a/tools/build_all_firmwares.sh
+++ b/tools/build_all_firmwares.sh
@@ -30,8 +30,10 @@ mkdir -p "$DEST"
 mv bootrom/obj/bootrom.elf "$DEST/PM3BOOTROM.elf"
 
 # cf armsrc/Standalone/Makefile.hal
-STANDALONE_MODES=(LF_SKELETON LF_EM4100EMUL LF_EM4100RSWB LF_EM4100RSWW LF_EM4100RWC LF_HIDBRUTE LF_HIDFCBRUTE LF_ICEHID LF_PROXBRUTE LF_PROX2BRUTE LF_SAMYRUN LF_THAREXDE LF_NEXID LF_NEDAP_SIM)
-STANDALONE_MODES+=(HF_14ASNIFF HF_14BSNIFF HF_15SNIFF HF_AVEFUL HF_BOG HF_COLIN HF_CRAFTBYTE HF_ICECLASS HF_LEGIC HF_LEGICSIM HF_MATTYRUN HF_MFCSIM HF_MSDSAL HF_TCPRST HF_TMUDFORD HF_YOUNG HF_REBLAY DANKARMULTI)
+STANDALONE_MODES=(LF_SKELETON)
+STANDALONE_MODES+=(LF_EM4100EMUL LF_EM4100RSWB LF_EM4100RSWW LF_EM4100RWC LF_HIDBRUTE LF_HIDFCBRUTE LF_ICEHID LF_NEDAP_SIM LF_NEXID LF_PROXBRUTE LF_PROX2BRUTE LF_SAMYRUN LF_THAREXDE)
+STANDALONE_MODES+=(HF_14ASNIFF HF_14BSNIFF HF_15SNIFF HF_AVEFUL HF_BOG HF_COLIN HF_CRAFTBYTE HF_ICECLASS HF_LEGIC HF_LEGICSIM HF_MATTYRUN HF_MFCSIM HF_MSDSAL HF_REBLAY HF_TCPRST HF_TMUDFORD HF_YOUNG)
+STANDALONE_MODES+=(DANKARMULTI)
 STANDALONE_MODES_REQ_BT=(HF_REBLAY)
 STANDALONE_MODES_REQ_SMARTCARD=()
 STANDALONE_MODES_REQ_FLASH=(LF_HIDFCBRUTE LF_ICEHID LF_NEXID LF_THAREXDE HF_BOG HF_COLIN HF_ICECLASS HF_LEGICSIM HF_MFCSIM)

From 1a6bb585502eb16c080f7a87f483219068cd8c6c Mon Sep 17 00:00:00 2001
From: Philippe Teuwen <phil@teuwen.org>
Date: Tue, 24 Jan 2023 15:37:36 +0100
Subject: [PATCH 08/15] Add LF_PROX2BRUTE to
 4_Advanced-compilation-parameters.md

---
 armsrc/Standalone/lf_prox2brute.c                           | 2 +-
 doc/md/Use_of_Proxmark/4_Advanced-compilation-parameters.md | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/armsrc/Standalone/lf_prox2brute.c b/armsrc/Standalone/lf_prox2brute.c
index 0117e91e6..4f092007f 100644
--- a/armsrc/Standalone/lf_prox2brute.c
+++ b/armsrc/Standalone/lf_prox2brute.c
@@ -1,5 +1,5 @@
 //-----------------------------------------------------------------------------
-// Copyright (C) Brad Antoniewicz 2011
+// Copyright (C) Yann Gascuel 2023
 // Copyright (C) Proxmark3 contributors. See AUTHORS.md for details.
 //
 // This program is free software: you can redistribute it and/or modify
diff --git a/doc/md/Use_of_Proxmark/4_Advanced-compilation-parameters.md b/doc/md/Use_of_Proxmark/4_Advanced-compilation-parameters.md
index 90af8fd8f..fa1021d0c 100644
--- a/doc/md/Use_of_Proxmark/4_Advanced-compilation-parameters.md
+++ b/doc/md/Use_of_Proxmark/4_Advanced-compilation-parameters.md
@@ -111,6 +111,7 @@ Here are the supported values you can assign to `STANDALONE` in `Makefile.platfo
 | LF_NEDAP_SIM    | LF Nedap ID simulator
 | LF_NEXID        | Nexwatch credentials detection mode - jrjgjk & Zolorah
 | LF_PROXBRUTE    | HID ProxII bruteforce - Brad Antoniewicz
+| LF_PROX2BRUTE   | HID ProxII bruteforce v2 - Yann Gascuel
 | LF_SAMYRUN (def)| HID26 read/clone/sim - Samy Kamkar
 | LF_SKELETON     | standalone mode skeleton - Iceman1001
 | LF_THAREXDE     | LF EM4x50 simulator/read standalone mode - tharexde

From 40f37c2c4236b4586e82e87fab777309f3fa5697 Mon Sep 17 00:00:00 2001
From: Philippe Teuwen <phil@teuwen.org>
Date: Tue, 24 Jan 2023 15:41:40 +0100
Subject: [PATCH 09/15] Missing cmdhftesla.c in
 client/experimental_lib/CMakeLists.txt

---
 client/experimental_lib/CMakeLists.txt | 1 +
 1 file changed, 1 insertion(+)

diff --git a/client/experimental_lib/CMakeLists.txt b/client/experimental_lib/CMakeLists.txt
index 3855d6884..675dda225 100644
--- a/client/experimental_lib/CMakeLists.txt
+++ b/client/experimental_lib/CMakeLists.txt
@@ -294,6 +294,7 @@ set (TARGET_SOURCES
         ${PM3_ROOT}/client/src/cmdhfseos.c
         ${PM3_ROOT}/client/src/cmdhfst.c
         ${PM3_ROOT}/client/src/cmdhfst25ta.c
+        ${PM3_ROOT}/client/src/cmdhftesla.c
         ${PM3_ROOT}/client/src/cmdhftexkom.c
         ${PM3_ROOT}/client/src/cmdhfthinfilm.c
         ${PM3_ROOT}/client/src/cmdhftopaz.c

From 1c3a1a0660974657da46b5f1d075279a52939e39 Mon Sep 17 00:00:00 2001
From: George Talusan <george.talusan@gmail.com>
Date: Wed, 25 Jan 2023 10:50:20 -0500
Subject: [PATCH 10/15] unconditionally recalculate pwd/pack for amiibo
 simulation

---
 client/luascripts/hf_mfu_amiibo_sim.lua | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/client/luascripts/hf_mfu_amiibo_sim.lua b/client/luascripts/hf_mfu_amiibo_sim.lua
index 289e0b465..e00248c90 100644
--- a/client/luascripts/hf_mfu_amiibo_sim.lua
+++ b/client/luascripts/hf_mfu_amiibo_sim.lua
@@ -139,14 +139,10 @@ local function main(args)
     -- force lock bytes, otherwise the Amiibo won't be recognized
     blocks[16] = blocks[16]:sub(1, 4)..'0FE0'
 
-    -- add PWD and PACK if necessary
+    -- add PWD and PACK
     local uid = blocks[14]:sub(1, 6)..blocks[15]:sub(1, 8)
-    if blocks[147] == nil or blocks[147] == '00000000' then
-        blocks[147] = ("%08x"):format(bxor(bxor(tonumber(sub(uid, 2, 10), 16), tonumber(sub(uid, 6, 14), 16)), 0xaa55aa55))
-    end
-    if blocks[148] == nil or blocks[148] == '00000000' then
-        blocks[148] = "80800000"
-    end
+    blocks[147] = ("%08x"):format(bxor(bxor(tonumber(sub(uid, 2, 10), 16), tonumber(sub(uid, 6, 14), 16)), 0xaa55aa55))
+    blocks[148] = "80800000"
 
     err = LoadEmulator(uid, blocks)
     if err then return oops(err) end

From 86d26f9464b9c3301a52f9b297509429aa4866e8 Mon Sep 17 00:00:00 2001
From: Jean-Michel Picod <jmichel@google.com>
Date: Thu, 26 Jan 2023 01:13:27 +0100
Subject: [PATCH 11/15] Fix uninitialised stack-based buffers

---
 client/src/util.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/client/src/util.c b/client/src/util.c
index 63141d01c..b13c5e3a9 100644
--- a/client/src/util.c
+++ b/client/src/util.c
@@ -266,7 +266,7 @@ void print_hex_break(const uint8_t *data, const size_t len, uint8_t breaks) {
     uint8_t mod = len % breaks;
 
     if (mod) {
-        char buf[UTIL_BUFFER_SIZE_SPRINT + 3];
+        char buf[UTIL_BUFFER_SIZE_SPRINT + 3] = {0};
         hex_to_buffer((uint8_t *)buf, data + i, mod, (sizeof(buf) - 1), 0, 1, true);
 
         // add the spaces...
@@ -291,7 +291,7 @@ void print_hex_noascii_break(const uint8_t *data, const size_t len, uint8_t brea
     uint8_t mod = len % breaks;
 
     if (mod) {
-        char buf[UTIL_BUFFER_SIZE_SPRINT + 3];
+        char buf[UTIL_BUFFER_SIZE_SPRINT + 3] = {0};
         hex_to_buffer((uint8_t *)buf, data + i, mod, (sizeof(buf) - 1), 0, 0, true);
 
         // add the spaces...
@@ -307,7 +307,7 @@ static void print_buffer_ex(const uint8_t *data, const size_t len, int level, ui
     if ((data == NULL) || (len < 1))
         return;
 
-    char buf[UTIL_BUFFER_SIZE_SPRINT + 3];
+    char buf[UTIL_BUFFER_SIZE_SPRINT + 3] = {0};
     int i;
     for (i = 0; i < len; i += breaks) {
 
@@ -614,7 +614,7 @@ void bytes_to_bytebits(const void *src, const size_t srclen, void *dest) {
 // hh,gg,ff,ee,dd,cc,bb,aa, pp,oo,nn,mm,ll,kk,jj,ii
 // up to 64 bytes or 512 bits
 uint8_t *SwapEndian64(const uint8_t *src, const size_t len, const uint8_t blockSize) {
-    static uint8_t buf[64];
+    static uint8_t buf[64] = {0};
     memset(buf, 0x00, 64);
     uint8_t *tmp = buf;
     for (uint8_t block = 0; block < (uint8_t)(len / blockSize); block++) {

From da470c928c07b65c9737fe27a6af89357bedd2f1 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Fri, 27 Jan 2023 02:53:54 +0100
Subject: [PATCH 12/15] data raw --fs -i,  fix the accidental reverse of the
 invert param

---
 client/src/cmddata.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/client/src/cmddata.c b/client/src/cmddata.c
index 647c062a4..f9a0036d8 100644
--- a/client/src/cmddata.c
+++ b/client/src/cmddata.c
@@ -1230,7 +1230,7 @@ int FSKrawDemod(uint8_t rfLen, uint8_t invert, uint8_t fchigh, uint8_t fclow, bo
             PrintAndLogEx(NORMAL, "");
             PrintAndLogEx(SUCCESS, _YELLOW_("%s") " decoded bitstream", GetFSKType(fchigh, fclow, invert));
             PrintAndLogEx(INFO, "-----------------------");
-            printDemodBuff(0, false, invert, false);
+            printDemodBuff(0, false, false, false);
         }
         goto out;
     } else {

From 67ef18f4ed00d5aa0b3cddb88c17eac0d46cde96 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Fri, 27 Jan 2023 02:54:30 +0100
Subject: [PATCH 13/15] prepping for more colors in the cli

---
 include/ansi.h | 43 +++++++++++++++++++++++++++++++++++--------
 1 file changed, 35 insertions(+), 8 deletions(-)

diff --git a/include/ansi.h b/include/ansi.h
index c06c06e6b..59f546e39 100644
--- a/include/ansi.h
+++ b/include/ansi.h
@@ -21,18 +21,45 @@
 
 #define AEND  "\x1b[0m"
 
-#define _BLUE_(s) "\x1b[34m" s AEND
-#define _RED_(s) "\x1b[31m" s AEND
-#define _GREEN_(s) "\x1b[32m" s AEND
-#define _YELLOW_(s) "\x1b[33m" s AEND
-#define _MAGENTA_(s) "\x1b[35m" s AEND
-#define _CYAN_(s) "\x1b[36m" s AEND
-#define _WHITE_(s) "\x1b[37m" s AEND
+#define _BLACK_(s)          "\x1b[30m" s AEND
+#define _RED_(s)            "\x1b[31m" s AEND
+#define _GREEN_(s)          "\x1b[32m" s AEND
+#define _YELLOW_(s)         "\x1b[33m" s AEND
+#define _BLUE_(s)           "\x1b[34m" s AEND
+#define _MAGENTA_(s)        "\x1b[35m" s AEND
+#define _CYAN_(s)           "\x1b[36m" s AEND
+#define _WHITE_(s)          "\x1b[37m" s AEND
+
+#define _BRIGHT_BLACK_(s)   "\x1b[30;1m" s AEND
+#define _BRIGHT_RED_(s)     "\x1b[31;1m" s AEND
+#define _BRIGHT_GREEN_(s)   "\x1b[32;1m" s AEND
+#define _BRIGHT_YELLOW_(s)  "\x1b[33;1m" s AEND
+#define _BRIGHT_BLUE_(s)    "\x1b[34;1m" s AEND
+#define _BRIGHT_MAGENTA_(s) "\x1b[35;1m" s AEND
+#define _BRIGHT_CYAN_(s)    "\x1b[36;1m" s AEND
+#define _BRIGHT_WHITE_(s)   "\x1b[37;1m" s AEND
+
+#define _BACK_BLACK_(s)     "\x1b[40m" s AEND
+#define _BACK_RED_(s)       "\x1b[41m" s AEND
+#define _BACK_GREEN_(s)     "\x1b[42m" s AEND
+#define _BACK_YELLOW_(s)    "\x1b[43m" s AEND
+#define _BACK_BLUE_(s)      "\x1b[44m" s AEND
+#define _BACK_MAGENTA_(s)   "\x1b[45m" s AEND
+#define _BACK_CYAN_(s)      "\x1b[46m" s AEND
+#define _BACK_WHITE_(s)     "\x1b[47m" s AEND
+
+#define _BACK_BRIGHT_BLACK_(s)   "\x1b[40;1m" s AEND
+#define _BACK_BRIGHT_RED_(s)     "\x1b[41;1m" s AEND
+#define _BACK_BRIGHT_GREEN_(s)   "\x1b[42;1m" s AEND
+#define _BACK_BRIGHT_YELLOW_(s)  "\x1b[43;1m" s AEND
+#define _BACK_BRIGHT_BLUE_(s)    "\x1b[44;1m" s AEND
+#define _BACK_BRIGHT_MAGENTA_(s) "\x1b[45;1m" s AEND
+#define _BACK_BRIGHT_CYAN_(s)    "\x1b[46;1m" s AEND
+#define _BACK_BRIGHT_WHITE_(s)   "\x1b[47;1m" s AEND
 
 #define _CLEAR_ "\x1b[2J"
 #define _TOP_   "\x1b[1;1f"
 
-
 #if defined(HAVE_READLINE)
 // https://wiki.hackzine.org/development/misc/readline-color-prompt.html
 // Applications may indicate that the prompt contains

From 37d059d56fb0415a8a6daecddea69eb40857306f Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Fri, 27 Jan 2023 03:00:26 +0100
Subject: [PATCH 14/15] style

---
 armsrc/Standalone/lf_prox2brute.c | 14 ++---
 client/src/cmdhf15.c              | 95 +++++++++++++++----------------
 client/src/cmdhflist.c            |  2 +-
 client/src/cmdhftesla.c           | 12 ++--
 client/src/cmdscript.c            |  2 +-
 client/src/pm3line_vocabulory.h   |  9 ++-
 doc/commands.json                 | 55 ++++++++++++++++--
 doc/commands.md                   | 33 +++++++----
 8 files changed, 137 insertions(+), 85 deletions(-)

diff --git a/armsrc/Standalone/lf_prox2brute.c b/armsrc/Standalone/lf_prox2brute.c
index 4f092007f..ecfaac9e3 100644
--- a/armsrc/Standalone/lf_prox2brute.c
+++ b/armsrc/Standalone/lf_prox2brute.c
@@ -57,19 +57,19 @@ void RunMod(void) {
         WDT_HIT();
         // exit from SamyRun,   send a usbcommand.
         if (data_available()) { // early exit
-             DbpString("[=] You can take the shell back :) ...");
+            DbpString("[=] You can take the shell back :) ...");
             LEDsoff();
             return;
         }
     }
-    
+
     LED_C_ON();
     WAIT_BUTTON_RELEASED(); // We are now ready to start brutforcing card numbers
     LEDsoff();
 
     Dbprintf("[=] Starting HID ProxII Bruteforce from card %08x to %08x",
              CARDNUM_START, MIN(CARDNUM_END, 0xFFFF));
-        
+
     for (cardnum = CARDNUM_START ; cardnum <= MIN(CARDNUM_END, 0xFFFF) ; cardnum++) {
         WDT_HIT();
 
@@ -92,14 +92,14 @@ void RunMod(void) {
 
         // switch leds to be able to know (aproximatly) which card number worked (64 tries loop)
         LED_A_INV(); // switch led A every try
-        if ((cardnum-CARDNUM_START) % 8 == 7) // switch led B every 8 tries
+        if ((cardnum - CARDNUM_START) % 8 == 7) // switch led B every 8 tries
             LED_B_INV();
-        if ((cardnum-CARDNUM_START) % 16 == 15) // switch led C every 16 tries
+        if ((cardnum - CARDNUM_START) % 16 == 15) // switch led C every 16 tries
             LED_C_INV();
-        if ((cardnum-CARDNUM_START) % 32 == 31) // switch led D every 32 tries
+        if ((cardnum - CARDNUM_START) % 32 == 31) // switch led D every 32 tries
             LED_D_INV();
     }
-    
+
     SpinErr((LED_A | LED_B | LED_C | LED_D), 250, 5); // Xmax tree
     Dbprintf("[=] Ending HID ProxII Bruteforce from card %08x to %08x",
              CARDNUM_START, cardnum - 1);
diff --git a/client/src/cmdhf15.c b/client/src/cmdhf15.c
index 76fc4869a..035a2218e 100644
--- a/client/src/cmdhf15.c
+++ b/client/src/cmdhf15.c
@@ -652,14 +652,13 @@ static int CmdHF15Samples(const char *Cmd) {
     return PM3_SUCCESS;
 }
 
-static int NxpTestEAS(uint8_t *uid) 
-{
-		uint8_t fast = 1;
+static int NxpTestEAS(uint8_t *uid) {
+    uint8_t fast = 1;
     uint8_t reply = 1;
     PacketResponseNG resp;
     uint16_t reqlen = 0;
     uint8_t req[PM3_CMD_DATA_SIZE] = {0};
-    
+
     req[reqlen++] |= ISO15_REQ_SUBCARRIER_SINGLE | ISO15_REQ_DATARATE_HIGH | ISO15_REQ_NONINVENTORY | ISO15_REQ_ADDRESS;
     req[reqlen++] = ISO15693_EAS_ALARM;
     req[reqlen++] = 0x04; // IC manufacturer code
@@ -681,7 +680,7 @@ static int NxpTestEAS(uint8_t *uid)
         if (resp.length < 2) {
             PrintAndLogEx(INFO, "  EAS (Electronic Article Surveillance) is not active");
         } else {
-            uint8_t * recv = resp.data.asBytes;
+            uint8_t *recv = resp.data.asBytes;
 
             if (!(recv[0] & ISO15_RES_ERROR)) {
                 PrintAndLogEx(INFO, "  EAS (Electronic Article Surveillance) is active.");
@@ -689,56 +688,56 @@ static int NxpTestEAS(uint8_t *uid)
             }
         }
     }
-    
+
     return PM3_SUCCESS;
-} 
+}
 
 static int NxpCheckSig(uint8_t *uid) {
-		uint8_t fast = 1;
+    uint8_t fast = 1;
     uint8_t reply = 1;
     PacketResponseNG resp;
     uint16_t reqlen = 0;
     uint8_t req[PM3_CMD_DATA_SIZE] = {0};
-    
-		// Check if we can also read the signature
-	  req[reqlen++] |= ISO15_REQ_SUBCARRIER_SINGLE | ISO15_REQ_DATARATE_HIGH | ISO15_REQ_NONINVENTORY | ISO15_REQ_ADDRESS;
-	  req[reqlen++] = ISO15693_READ_SIGNATURE;
-	  req[reqlen++] = 0x04; // IC manufacturer code
-	  memcpy(req + 3, uid, 8); // add UID
-	  reqlen += 8;
 
-	  AddCrc15(req,  reqlen);
-	  reqlen += 2;
+    // Check if we can also read the signature
+    req[reqlen++] |= ISO15_REQ_SUBCARRIER_SINGLE | ISO15_REQ_DATARATE_HIGH | ISO15_REQ_NONINVENTORY | ISO15_REQ_ADDRESS;
+    req[reqlen++] = ISO15693_READ_SIGNATURE;
+    req[reqlen++] = 0x04; // IC manufacturer code
+    memcpy(req + 3, uid, 8); // add UID
+    reqlen += 8;
 
-	  clearCommandBuffer();
-	  SendCommandMIX(CMD_HF_ISO15693_COMMAND, reqlen, fast, reply, req, reqlen);
+    AddCrc15(req,  reqlen);
+    reqlen += 2;
 
-	  if (WaitForResponseTimeout(CMD_HF_ISO15693_COMMAND, &resp, 2000) == false) {
-	      PrintAndLogEx(WARNING, "iso15693 timeout");
-	      DropField();
-	      return PM3_ETIMEOUT;
-	  }
+    clearCommandBuffer();
+    SendCommandMIX(CMD_HF_ISO15693_COMMAND, reqlen, fast, reply, req, reqlen);
 
-	  DropField();
+    if (WaitForResponseTimeout(CMD_HF_ISO15693_COMMAND, &resp, 2000) == false) {
+        PrintAndLogEx(WARNING, "iso15693 timeout");
+        DropField();
+        return PM3_ETIMEOUT;
+    }
 
-	  if (resp.length < 2) {
-	      PrintAndLogEx(WARNING, "iso15693 card doesn't answer to READ SIGNATURE command");
-	      return PM3_EWRONGANSWER;
-	  }
+    DropField();
 
-	  uint8_t *recv = resp.data.asBytes;
+    if (resp.length < 2) {
+        PrintAndLogEx(WARNING, "iso15693 card doesn't answer to READ SIGNATURE command");
+        return PM3_EWRONGANSWER;
+    }
 
-	  if ((recv[0] & ISO15_RES_ERROR) == ISO15_RES_ERROR) {
-	      PrintAndLogEx(ERR, "iso15693 card returned error %i: %s", recv[0], TagErrorStr(recv[0]));
-	      return PM3_EWRONGANSWER;
-	  }
+    uint8_t *recv = resp.data.asBytes;
 
-	  uint8_t signature[32] = {0x00};
-	  memcpy(signature, recv + 1, 32);
+    if ((recv[0] & ISO15_RES_ERROR) == ISO15_RES_ERROR) {
+        PrintAndLogEx(ERR, "iso15693 card returned error %i: %s", recv[0], TagErrorStr(recv[0]));
+        return PM3_EWRONGANSWER;
+    }
 
-	  nxp_15693_print_signature(uid, signature);
-	  
-	  return PM3_SUCCESS;
+    uint8_t signature[32] = {0x00};
+    memcpy(signature, recv + 1, 32);
+
+    nxp_15693_print_signature(uid, signature);
+
+    return PM3_SUCCESS;
 }
 
 // Get NXP system information from SLIX2 tag/VICC
@@ -822,11 +821,11 @@ static int NxpSysInfo(uint8_t *uid) {
     PrintAndLogEx(INFO, "      * Additional 32 bits feature flags are%s transmitted", ((recv[5] & 0x80) ? "" : " not"));
 
     if (support_easmode) {
-			NxpTestEAS(uid);
+        NxpTestEAS(uid);
     }
 
     if (support_signature) {
-      NxpCheckSig(uid);
+        NxpCheckSig(uid);
     }
 
     return PM3_SUCCESS;
@@ -968,16 +967,12 @@ static int CmdHF15Info(const char *Cmd) {
     if (data[8] == 0x04 && data[7] == 0x01 && nxp_version == 0x08) {
         PrintAndLogEx(DEBUG, "SLIX2 Detected, getting NXP System Info");
         return NxpSysInfo(uid);
-    }
-    else if(data[8] == 0x04 && data[7] == 0x01 && nxp_version == 0x18) //If it is an NTAG 5 
-    {
-    		PrintAndLogEx(DEBUG, "NTAG 5 Detected, getting NXP System Info");
+    } else if (data[8] == 0x04 && data[7] == 0x01 && nxp_version == 0x18) { //If it is an NTAG 5
+        PrintAndLogEx(DEBUG, "NTAG 5 Detected, getting NXP System Info");
         return NxpSysInfo(uid);
-    }
-    else if(data[8] == 0x04 && (data[7] == 0x01 || data[7] == 0x02 || data[7] == 0x03)) //If SLI, SLIX, SLIX-l, or SLIX-S check EAS status
-    {
-    		PrintAndLogEx(DEBUG, "SLI, SLIX, SLIX-L, or SLIX-S Detected checking EAS status");
-    		return NxpTestEAS(uid);
+    } else if (data[8] == 0x04 && (data[7] == 0x01 || data[7] == 0x02 || data[7] == 0x03)) { //If SLI, SLIX, SLIX-l, or SLIX-S check EAS status
+        PrintAndLogEx(DEBUG, "SLI, SLIX, SLIX-L, or SLIX-S Detected checking EAS status");
+        return NxpTestEAS(uid);
     }
 
     PrintAndLogEx(NORMAL, "");
diff --git a/client/src/cmdhflist.c b/client/src/cmdhflist.c
index a19ecdea9..232d4af19 100644
--- a/client/src/cmdhflist.c
+++ b/client/src/cmdhflist.c
@@ -318,7 +318,7 @@ int applyIso14443a(char *exp, size_t size, uint8_t *cmd, uint8_t cmdsize, bool i
                 snprintf(exp, size, "AUTH-B(%d)", cmd[1]);
                 break;
             }
-            case MIFARE_MAGIC_GDM_AUTH_KEYA:{
+            case MIFARE_MAGIC_GDM_AUTH_KEYA: {
                 if (cmdsize > 3) {
                     snprintf(exp, size, "MAGIC AUTH-A(%d)", cmd[1]);
                     MifareAuthState = masNt;
diff --git a/client/src/cmdhftesla.c b/client/src/cmdhftesla.c
index 2680daa90..58f51f4c5 100644
--- a/client/src/cmdhftesla.c
+++ b/client/src/cmdhftesla.c
@@ -29,7 +29,7 @@
 #include "commonutil.h"        // get_sw
 #include "protocols.h"         // ISO7816 APDU return co-des
 #include "ui.h"
-#include "cmdhf14a.h"          // apdu chaining 
+#include "cmdhf14a.h"          // apdu chaining
 
 #define TIMEOUT 2000
 
@@ -160,10 +160,10 @@ static int info_hf_tesla(void) {
         sw = get_sw(response, resplen);
 
         if (sw == ISO7816_OK) {
-            // save CETT for later    
+            // save CETT for later
             uint8_t cert[515] = {0};
             memcpy(cert, response, resplen - 2);
-        
+
             PrintAndLogEx(INFO, "CERT # %i", i);
             PrintAndLogEx(INFO, "%s", sprint_hex_inrow(cert, resplen - 2));
         }
@@ -198,12 +198,12 @@ static int info_hf_tesla(void) {
     PrintAndLogEx(INFO, "--- " _CYAN_("Tag Information") " ---------------------------");
     PrintAndLogEx(NORMAL, "");
     PrintAndLogEx(INFO, "PUBLIC KEY");
-    for (int i=0; i < 3; i++) {
+    for (int i = 0; i < 3; i++) {
         PrintAndLogEx(INFO, "%d - %s", i, sprint_hex_inrow(pk[i], 65));
     }
     if (form_factor[1] == 1) {
         PrintAndLogEx(INFO, "Form factor... %s (card)", sprint_hex_inrow(form_factor, sizeof(form_factor)));
-    } else if (form_factor[1] == 2){
+    } else if (form_factor[1] == 2) {
         PrintAndLogEx(INFO, "Form factor... %s (phone app)", sprint_hex_inrow(form_factor, sizeof(form_factor)));
     }
 
@@ -217,7 +217,7 @@ static int info_hf_tesla(void) {
     if ((memcmp(pk[0], pk[1], 65) == 0)) {
         PrintAndLogEx(INFO, "  GaussKey detected");
     }
-    // 
+    //
     return PM3_SUCCESS;
 }
 
diff --git a/client/src/cmdscript.c b/client/src/cmdscript.c
index 57cf54084..114205708 100644
--- a/client/src/cmdscript.c
+++ b/client/src/cmdscript.c
@@ -433,7 +433,7 @@ static int CmdScriptRun(const char *Cmd) {
 #else
         // The following line will implicitly pre-initialize Python
         PyConfig_SetBytesArgv(&py_conf, argc + 1, argv);
-        
+
         // We disallowed in py_conf environment variables interfering with python interpreter's behavior.
         // Let's manually enable the ones we truly need.
         // This is required by Proxspace to work with an isolated Python configuration
diff --git a/client/src/pm3line_vocabulory.h b/client/src/pm3line_vocabulory.h
index 5a517c645..4cd9457b5 100644
--- a/client/src/pm3line_vocabulory.h
+++ b/client/src/pm3line_vocabulory.h
@@ -438,6 +438,12 @@ const static vocabulory_t vocabulory[] = {
     { 0, "hf st25ta protect" }, 
     { 0, "hf st25ta pwd" }, 
     { 0, "hf st25ta sim" }, 
+    { 1, "hf tesla help" }, 
+    { 0, "hf tesla info" }, 
+    { 1, "hf tesla list" }, 
+    { 1, "hf texkom help" }, 
+    { 0, "hf texkom reader" }, 
+    { 0, "hf texkom sim" }, 
     { 1, "hf thinfilm help" }, 
     { 0, "hf thinfilm info" }, 
     { 1, "hf thinfilm list" }, 
@@ -453,9 +459,6 @@ const static vocabulory_t vocabulory[] = {
     { 0, "hf topaz rdbl" }, 
     { 1, "hf topaz view" }, 
     { 0, "hf topaz wrbl" }, 
-    { 1, "hf texkom help" }, 
-    { 0, "hf texkom reader" }, 
-    { 0, "hf texkom sim" }, 
     { 1, "hf xerox help" }, 
     { 0, "hf xerox info" }, 
     { 0, "hf xerox reader" }, 
diff --git a/doc/commands.json b/doc/commands.json
index 1c21f81ba..bb781adb7 100644
--- a/doc/commands.json
+++ b/doc/commands.json
@@ -1101,14 +1101,16 @@
             "command": "hf 14a chaining",
             "description": "Enable/Disable ISO14443a input chaining. Maximum input length goes from ATS.",
             "notes": [
-                "hf 14a chaining disable -> disable chaining",
+                "hf 14a chaining --off -> disable chaining",
                 "hf 14a chaining -> show chaining enable/disable state"
             ],
             "offline": false,
             "options": [
-                "-h, --help This help"
+                "-h, --help This help",
+                "-1, --on enabled chaining",
+                "-0, --off disable chaining"
             ],
-            "usage": "hf 14a chaining [-h] [<enable/disable or 0/1>]"
+            "usage": "hf 14a chaining [-h10]"
         },
         "hf 14a config": {
             "command": "hf 14a config",
@@ -2881,7 +2883,7 @@
         },
         "hf help": {
             "command": "hf help",
-            "description": "-------- ----------------------- High Frequency ----------------------- 14a { ISO14443A RFIDs... } 14b { ISO14443B RFIDs... } 15 { ISO15693 RFIDs... } cipurse { Cipurse transport Cards... } epa { German Identification Card... } emrtd { Machine Readable Travel Document... } felica { ISO18092 / FeliCa RFIDs... } fido { FIDO and FIDO2 authenticators... } fudan { Fudan RFIDs... } gallagher { Gallagher DESFire RFIDs... } ksx6924 { KS X 6924 (T-Money, Snapper+) RFIDs } jooki { Jooki RFIDs... } iclass { ICLASS RFIDs... } legic { LEGIC RFIDs... } lto { LTO Cartridge Memory RFIDs... } mf { MIFARE RFIDs... } mfp { MIFARE Plus RFIDs... } mfu { MIFARE Ultralight RFIDs... } mfdes { MIFARE Desfire RFIDs... } ntag424 { NXP NTAG 4242 DNA RFIDs... } seos { SEOS RFIDs... } st25ta { ST25TA RFIDs... } thinfilm { Thinfilm RFIDs... } topaz { TOPAZ (NFC Type 1) RFIDs... } texkom { Texkom RFIDs... } xerox { Fuji/Xerox cartridge RFIDs... } waveshare { Waveshare NFC ePaper... } ----------- --------------------- General --------------------- help This help list List protocol data in trace buffer search Search for known HF tags",
+            "description": "-------- ----------------------- High Frequency ----------------------- 14a { ISO14443A RFIDs... } 14b { ISO14443B RFIDs... } 15 { ISO15693 RFIDs... } cipurse { Cipurse transport Cards... } epa { German Identification Card... } emrtd { Machine Readable Travel Document... } felica { ISO18092 / FeliCa RFIDs... } fido { FIDO and FIDO2 authenticators... } fudan { Fudan RFIDs... } gallagher { Gallagher DESFire RFIDs... } ksx6924 { KS X 6924 (T-Money, Snapper+) RFIDs } jooki { Jooki RFIDs... } iclass { ICLASS RFIDs... } legic { LEGIC RFIDs... } lto { LTO Cartridge Memory RFIDs... } mf { MIFARE RFIDs... } mfp { MIFARE Plus RFIDs... } mfu { MIFARE Ultralight RFIDs... } mfdes { MIFARE Desfire RFIDs... } ntag424 { NXP NTAG 4242 DNA RFIDs... } seos { SEOS RFIDs... } st25ta { ST25TA RFIDs... } tesla { TESLA Cards... } texkom { Texkom RFIDs... } thinfilm { Thinfilm RFIDs... } topaz { TOPAZ (NFC Type 1) RFIDs... } xerox { Fuji/Xerox cartridge RFIDs... } waveshare { Waveshare NFC ePaper... } ----------- --------------------- General --------------------- help This help list List protocol data in trace buffer search Search for known HF tags",
             "notes": [],
             "offline": true,
             "options": [],
@@ -6684,6 +6686,47 @@
             ],
             "usage": "hf st25ta sim [-h] -u <hex>"
         },
+        "hf tesla help": {
+            "command": "hf tesla help",
+            "description": "help This help list List ISO 14443A/7816 history",
+            "notes": [],
+            "offline": true,
+            "options": [],
+            "usage": ""
+        },
+        "hf tesla info": {
+            "command": "hf tesla info",
+            "description": "Get info about TESLA Key tag",
+            "notes": [
+                "hf tesla info"
+            ],
+            "offline": false,
+            "options": [
+                "-h, --help This help"
+            ],
+            "usage": "hf telsa info [-h]"
+        },
+        "hf tesla list": {
+            "command": "hf tesla list",
+            "description": "Alias of `trace list -t 7816` with selected protocol data to annotate trace buffer You can load a trace from file (see `trace load -h`) or it be downloaded from device by default It accepts all other arguments of `trace list`. Note that some might not be relevant for this specific protocol",
+            "notes": [
+                "hf tesla list --frame -> show frame delay times",
+                "hf tesla list -1 -> use trace buffer"
+            ],
+            "offline": true,
+            "options": [
+                "-h, --help This help",
+                "-1, --buffer use data from trace buffer",
+                "--frame show frame delay times",
+                "-c mark CRC bytes",
+                "-r show relative times (gap and duration)",
+                "-u display times in microseconds instead of clock cycles",
+                "-x show hexdump to convert to pcap(ng)",
+                "or to import into Wireshark using encapsulation type \"ISO 14443\"",
+                "-f, --file <fn> filename of dictionary"
+            ],
+            "usage": "hf tesla list [-h1crux] [--frame] [-f <fn>]"
+        },
         "hf texkom help": {
             "command": "hf texkom help",
             "description": "help This help",
@@ -11760,8 +11803,8 @@
         }
     },
     "metadata": {
-        "commands_extracted": 739,
+        "commands_extracted": 742,
         "extracted_by": "PM3Help2JSON v1.00",
-        "extracted_on": "2023-01-15T01:24:39"
+        "extracted_on": "2023-01-27T01:57:37"
     }
 }
\ No newline at end of file
diff --git a/doc/commands.md b/doc/commands.md
index 1c6110cea..79499915b 100644
--- a/doc/commands.md
+++ b/doc/commands.md
@@ -651,6 +651,28 @@ Check column "offline" for their availability.
 |`hf st25ta sim          `|N       |`Fake ISO 14443A/ST tag`
 
 
+### hf tesla
+
+ { TESLA Cards...                      }
+
+|command                  |offline |description
+|-------                  |------- |-----------
+|`hf tesla help          `|Y       |`This help`
+|`hf tesla info          `|N       |`Tag information`
+|`hf tesla list          `|Y       |`List ISO 14443A/7816 history`
+
+
+### hf texkom
+
+ { Texkom RFIDs...                     }
+
+|command                  |offline |description
+|-------                  |------- |-----------
+|`hf texkom help         `|Y       |`This help`
+|`hf texkom reader       `|N       |`Act like a Texkom reader`
+|`hf texkom sim          `|N       |`Simulate a Texkom tag`
+
+
 ### hf thinfilm
 
  { Thinfilm RFIDs...                   }
@@ -682,17 +704,6 @@ Check column "offline" for their availability.
 |`hf topaz wrbl          `|N       |`Write block`
 
 
-### hf texkom
-
- { Texkom RFIDs...                     }
-
-|command                  |offline |description
-|-------                  |------- |-----------
-|`hf texkom help         `|Y       |`This help`
-|`hf texkom reader       `|N       |`Act like a Texkom reader`
-|`hf texkom sim          `|N       |`Simulate a Texkom tag`
-
-
 ### hf xerox
 
  { Fuji/Xerox cartridge RFIDs...       }

From 002823dd9b2009203148cc0b9a826611dceb2242 Mon Sep 17 00:00:00 2001
From: George Talusan <george.talusan@gmail.com>
Date: Wed, 25 Jan 2023 10:24:38 -0500
Subject: [PATCH 15/15] use Amiibo PACK if simulator PWD matches generated
 Amiibo PWD

---
 armsrc/iso14443a.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/armsrc/iso14443a.c b/armsrc/iso14443a.c
index 23b46cf54..f5960626e 100644
--- a/armsrc/iso14443a.c
+++ b/armsrc/iso14443a.c
@@ -1229,6 +1229,17 @@ bool SimulateIso14443aInit(uint8_t tagType, uint16_t flags, uint8_t *data, tag_r
 
     AddCrc14A(rPPS, sizeof(rPPS) - 2);
 
+    if (tagType == 7) {
+        uint8_t pwd[4];
+        uint8_t gen_pwd[4];
+        uint16_t start = (*pages - 1) * 4 + MFU_DUMP_PREFIX_LENGTH;
+        emlGetMemBt(pwd, start, sizeof(pwd));
+        Uint4byteToMemBe(gen_pwd, ul_ev1_pwdgenB(data));
+        if (memcmp(pwd, gen_pwd, sizeof(pwd)) == 0) {
+            rPACK[0] = 0x80;
+            rPACK[1] = 0x80;
+        }
+    }
     AddCrc14A(rPACK, sizeof(rPACK) - 2);
 
     static tag_response_info_t responses_init[] = {