> For the complete documentation index, see [llms.txt](https://docs.mtoolstec.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.mtoolstec.com/hardware/rfid-nfc-and-uhf-hardware/pn532killer/reader-and-emulator.md).

# Reader and Emulator Operations

The commands below use the PN532 CLI development channel. Keep one host connected at a time and confirm the selected mode before transferring data.

## Reader Mode

```
hw mode r
hf 14a scan
```

Read a MIFARE Classic application block with its known Key A:

```
hf mf rdbl --blk 4 -a -k FFFFFFFFFFFF
```

For ISO15693 inventory and tag information:

```
hf 15 scan
hf 15 info
```

## Emulator Profile Types

| CLI type | Profile                            |
| -------- | ---------------------------------- |
| `1`      | MIFARE Classic                     |
| `2`      | MIFARE Ultralight / NTAG           |
| `3`      | ISO15693                           |
| `4`      | EM4100 with supported LF extension |

The CLI presents slots as 1–8. Match the image layout, UID length, and tag family to the selected profile.

## Load a MIFARE Classic Slot

With a compatible local binary image:

```
hw mode r
hf mf eLoad -s 1 --bin classic.bin
hw mode e -t 1 -s 1
```

Test the selected slot with a compatible reader. To leave emulation:

```
hw mode r
```

## Export Existing Data

Back up the selected slot before overwriting it:

```
hf mf eRead -s 1 --json --bin
```

For supported Ultralight and ISO15693 profiles:

```
hf mfu eRead -s 1 --json --bin
hf 15 eread -s 1 -c 32 --json --bin
```

The ISO15693 block count must match the profile. The CLI generates output filenames; verify the files before editing or replacing a slot.

## Capture Mode

`hw mode s` selects the supported capture workflow. Capture settings, recording completion, and analysis depend on firmware and CLI version. Use the [dedicated Sniffer guide](https://mtools.gitbook.io/pn532killer/sniffer) for the full workflow.

## Troubleshooting

| Symptom                                     | Action                                                                                                                  |
| ------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------- |
| Reader command fails after emulation        | Return to `hw mode r`                                                                                                   |
| Reader sees the wrong emulated tag          | Check slot number and profile type                                                                                      |
| Image import fails                          | Check image size, format, and selected tag family                                                                       |
| BLE transfer stalls                         | Close competing connections and retry over USB                                                                          |
| Emulated behavior differs from the original | Check protocol, timing, and application requirements; selecting a profile does not reproduce every proprietary behavior |