Skip to content

Discovery

The Discovery screen is your card reconnaissance tool. It has three tabs: Detect, Collect, and Sniff.


Quickly identify what type of card is on the reader.

ButtonDescription
LFScan for 125kHz low-frequency cards
HFScan for 13.56MHz high-frequency cards
AllScan both LF then HF
  1. Place a card on the Proxmark3 antenna
  2. Tap LF, HF, or All
  3. View the detected card type and data
  4. Tap the terminal icon to view raw PM3 output

Note: Detect is for identification only. To save cards, use the Collect tab or Targeted Read.

  • HID Prox (all Wiegand formats)
  • AWID
  • Indala
  • EM4100
  • Pyramid
  • IO Prox
  • Gallagher
  • Securakey
  • PAC/Stanley
  • Nedap
  • Nexwatch/Quadrakey
  • G-Prox II
  • Paradox
  • Viking
  • Keri
  • Motorola
  • COTAG
  • IDTECK
  • Jablotron
  • Noralsy
  • Presco
  • Visa2000
  • FDX-B (animal tags)
  • Destron (animal tags)
  • iCLASS (Legacy, SE, SEOS)
  • MIFARE Classic (1K, 4K, Mini)
  • MIFARE Ultralight (C, EV1)
  • MIFARE DESFire (EV1, EV2, EV3)
  • EMV (payment cards)
  • PIV (government ID)

For iCLASS Legacy cards with standard keys, ATLAS automatically attempts credential extraction to get FC/CN.

Note: iCLASS SE cards cannot be decrypted without keys. Card details can be extracted with Doppelgänger Core (R90SE) and Stealth devices if standard keys are used.


Continuous card collection for passive reconnaissance.

ModePM3 CommandDescription
HID Prox (LF)lf hid watchContinuous read for HID cards
AWID (LF)lf awid watchContinuous read for AWID cards
EM4100 (LF)lf em 410x watchEM tag continuous read
Net2 (Paxton) (LF)lf em 410x watchPaxton Net2 with card number calculation
  1. Select a watch mode from the dropdown
  2. Tap Start
  3. Cards appear as they’re detected
  4. Duplicates are automatically filtered
  5. Tap Stop or press the PM3 button to end

Note: Watch mode runs continuously until stopped. If the stop signal doesn’t work immediately, remove the card from the reader.

Enable Auto-save to current project to automatically save detected cards. Cards are tagged with:

  • Detection timestamp
  • GPS coordinates (if enabled)
  • Active project association

Auto-save only works when a project is active. The toggle is disabled by default.

For specific card protocols, use Targeted Read:

  1. Select card type from the dropdown
  2. Tap Read
  3. Place card on reader
  4. Card data appears and can be saved

Supported targeted read types:

TypeDescription
iCLASSiCLASS Legacy with credential extraction
SEOSHID SEOS cards
MIFARE ClassicMIFARE Classic 1K/4K
MIFARE UltralightMIFARE Ultralight variants
MIFARE DESFireDESFire EV1/EV2/EV3
EMVPayment cards
PIVGovernment ID cards
HID ProxLF HID Prox cards
AWIDLF AWID cards
IndalaLF Indala cards
EM4100LF EM4100 tags
Net2 (Paxton)Paxton Net2 cards

Capture RF communication between a card and reader.

Note: Sniffing can be temperamental and may produce inconclusive results. Position the device carefully between the card and reader. Multiple attempts and adjustments are often needed.

ProtocolCommand
iCLASShf iclass sniff
MIFAREhf 14a sniff
MIFARE DESFirehf 14a sniff
EMVhf 14a sniff
SEOShf 14a sniff
Topazhf topaz sniff
ISO14443-Bhf 14b sniff
ISO15693hf 15 sniff
FeliCahf felica sniff

All LF card types use lf sniff -v:

  • LF Generic
  • HID Prox
  • AWID
  • Indala
  • EM4100
  • Net2 (Paxton)
  • Pyramid/Farpointe
  • IO Prox
  • Gallagher
  • Securakey
  • PAC/Stanley
  • Nedap
  • NexWatch
  • G-Prox-II
  • Paradox
  • Viking
  • Keri
  • Motorola Flexpass
  • COTAG
  • Idteck
  • Jablotron
  • Noralsy
  • Presco
  • Visa2000
  • FDX-B Animal Tag
  • Destron FDX-A

Trigger options are available for ISO 14443-A cards only (MIFARE, DESFire, EMV, SEOS):

TriggerFlagDescription
Card Trigger-cCapture when card approaches reader
Reader Trigger-rCapture reader-initiated communication

Both triggers are enabled by default. The sniff runs in interactive mode (-i) and blocks until you press the PM3 button.

  1. Select an HF card type
  2. Configure trigger options (if available)
  3. Tap START SNIFF
  4. Position Proxmark3 between the card and reader
  5. Badge normally
  6. Press the PM3 button to stop capture
  7. Tap VIEW RESULTS to decode the captured trace
  1. Select an LF card type
  2. (Optional) Tap LF SETTINGS to configure trigger threshold
  3. Tap START SNIFF
  4. Position Proxmark3 near the reader
  5. Badge the card
  6. Sniff completes automatically when buffer is full
  7. Results are auto-decoded with lf search -1

After sniffing, enter a filename and tap SAVE TRACE:

FrequencyCommandExtension
HFtrace save -f filename.trace
LFdata save -f filename.pm3.pm3

Saved files can be accessed via SettingsFile ManagerTraces.

LF .pm3 files can be opened in the Waveform Viewer for manual signal analysis (File Manager → long-press file → View).


Cards are saved from the Collect tab:

  1. Use Watch Mode or Targeted Read to detect cards
  2. Tap a detected card tile to open the save dialog
  3. Select a project and add optional notes
  4. Card is saved with GPS coordinates (if enabled)

Alternatively, enable Auto-save before starting Watch Mode to save cards automatically.

After targeted read completes, a save dialog appears automatically. From there you can:

ActionDescription
SaveAdd to database with project and GPS
CancelDismiss without saving