Author: Ave Ozkal Frequency: HF (13.56 MHz) Hardware: Generic Proxmark3
Back to Standalone Modes Index | Source Code | Development Guide
Reads MIFARE Ultralight family cards (UL, ULEV1, UL Nano, My-d Move) and then emulates the captured card. Auto-detects the card type and block count.
MIFARE Ultralight is widely used in transit systems, event tickets, and small-value tokens. This mode enables standalone read-and-replay for:
- Transit fare evasion testing: Capture a valid ticket and present it at a gate
- Ticket cloning assessment: Demonstrate that UL tickets can be replayed
- NFC application testing: Verify that applications properly validate UL tags
- SEARCH: Scans for MIFARE Ultralight cards using anticollision
- READ: Upon finding a card, detects its type via the VERSION command and reads all accessible blocks
- EMULATE: Loads the captured data into the emulator and broadcasts it as a MIFARE Ultralight tag
Supports auto-detection of: MIFARE Ultralight, Ultralight EV1, Ultralight Nano, and My-d Move.
| LED | Meaning |
|---|---|
| D (off during idle) | Blinks during tag search |
| LED patterns | Success/failure indication |
| Action | Effect |
|---|---|
| Hold 1000ms | Cycle states or exit: SEARCH → READ → EMULATE → exit |
| USB command | Exit standalone mode |
stateDiagram-v2
[*] --> SEARCH : Startup
SEARCH --> READ : UL card found
SEARCH --> SEARCH : No card / incompatible
READ --> EMULATE : All blocks read
READ --> SEARCH : Read failed
EMULATE --> SEARCH : Button hold\n(cycle back)
EMULATE --> [*] : Button hold\n(exit)
SEARCH --> [*] : Button hold (exit)
| Card Type | Detection |
|---|---|
| MIFARE Ultralight | VERSION command response |
| MIFARE Ultralight EV1 | VERSION command response |
| MIFARE Ultralight Nano | VERSION command response |
| My-d Move | VERSION command response |
make clean
make STANDALONE=HF_AVEFUL -j
./pm3-flash-fullimage
- UL-C/UL-AES Unlocker — Unlock password-protected UL cards
- BogitoRun Auth Sniffer — Capture UL authentication passwords
- CraftByte UID Stealer — Generic 14A UID emulator