Proxmark3
What it does
The Proxmark3 is a purpose-built RFID/NFC transceiver with separate low-frequency (125 kHz) and high-frequency (13.56 MHz) antennas, so it covers both worlds a single cheap reader cannot. Beyond reading, it emulates a card back at a reader, brute-forces and cracks MIFARE Classic keys, and writes recovered dumps onto blank cards - the one box that takes a badge or a transit card from unknown to cloned.
Use cases
Read an EM4100/HID Prox door badge and write its ID straight onto a T5577 blank.
Run the nested/darkside chain automatically and dump every sector once a key falls.
Load a dump into the Proxmark3's own emulator memory and present it to a reader without a physical clone.
How you use it
Identify the band first (LF or HF never both), then work the matching command tree:
pm3 --> lf search # identify an LF tag
pm3 --> hf search # identify an HF/ISO 14443 tag
pm3 --> hf mf autopwn # recover MIFARE Classic keys, dump all sectors
pm3 --> lf em 410x clone --id 1234567890 # write an EM4100 ID to a T5577 blankLF and HF are separate antennas. An LF-only tag never answers `hf search` and vice versa. Pick the band before you assume the tag is dead.
Firmware and client must match. A client built against a different firmware version throws odd errors or hangs mid-command; flash and update together.