HF_UNISNIFF — Multi-Protocol HF Sniffer

Author: Equip Frequency: HF (13.56 MHz) Hardware: RDV4 recommended (flash for config persistence)

Back to Standalone Modes Index | Source Code | Development Guide

What

A universal HF sniffer that supports multiple protocols — ISO 14443A, ISO 14443B, ISO 15693, and iCLASS — selectable at runtime via button press before sniffing begins.

Why

Rather than flashing different standalone firmware for each protocol you want to sniff, this mode combines all four HF sniffing protocols into a single firmware. You select the protocol at startup using the button, then sniff. This is especially useful when you don't know which protocol a target system uses.

How

1. Protocol Selection: On startup, the LEDs indicate the currently selected protocol. Press the button to cycle through protocols.
2. Sniff: Hold the button to start sniffing the selected protocol. The Proxmark3 passively captures RF traffic between a reader and tag.
3. Data Storage: If flash is available, captured trace data is saved to hf_unisniff.trace. Otherwise data is held in BigBuf (volatile — lost on power cycle).
4. Retrieval: Connect to the client and download the trace data for analysis.

LED Indicators — Protocol Selection

LED Indicators — Operation

Button Controls

Configuration File

If flash is available, the mode reads hf_unisniff.conf to remember the last-used protocol. Format is a single byte:

State Machine

stateDiagram-v2
    [*] --> SelectProtocol : Startup

    state SelectProtocol {
        [*] --> ISO14443A
        ISO14443A --> ISO14443B : Button click
        ISO14443B --> ISO15693 : Button click
        ISO15693 --> iCLASS : Button click
        iCLASS --> ISO14443A : Button click
    }

    SelectProtocol --> Sniffing : Long hold

    state Sniffing {
        [*] --> Capture
        Capture --> Capture : Logging packets
    }

    Sniffing --> SaveTrace : Button press / buffer full
    SaveTrace --> SelectProtocol : Trace saved to flash
    SaveTrace --> [*] : No flash (data in BigBuf)

    SelectProtocol --> [*] : USB connection

Flash Files

Compilation

make clean
make STANDALONE=HF_UNISNIFF -j
./pm3-flash-fullimage

Related

• ISO 14443A Sniffer — Dedicated 14443A sniffer
• ISO 14443B Sniffer — Dedicated 14443B sniffer
• ISO 15693 Sniffer — Dedicated 15693 sniffer
• iCLASS — iCLASS multi-mode (includes sniffing)