Trace APDU on Windows
1) Using APDUTrace
This program developed internally insert a kernel filter driver in the smart card reader driver stack. It can start a live tracing session or a permanent logging solution (including boot time tracing). Both x86 and x64 are handled in a single program and the operating systems compatible are Windows XP to Windows 10. It can capture the shared VMWare smart card reader.
Because it captures APDU at the lowest level possible, processus names are not included. The traffic captured is the traffic are the reader see it.
2) Using API Monitor
As an alternative, API Monitor can be used to trace the calls and display the APDU and its result, even on a running lsass.exe ! It is working on x64 and x86.
Note: lsass.exe crashes when API Monitor is disconnected.
For that, the API definition needs to changed.
In scard.h.xml, add the following variable:
<!- [SCARD_DISPOSITION] -> <Variable Name="[SCARD_DISPOSITION]" Type="Alias" Base="LONG"> <Display Name="LONG" /> <Enum> <Set Name="SCARD_LEAVE_CARD" Value="0" /> <Set Name="SCARD_RESET_CARD" Value="1" /> <Set Name="SCARD_UNPOWER_CARD" Value="2" /> <Set Name="SCARD_EJECT_CARD" Value="3" /> </Enum> </Variable>
In winscard.xml, transform the 3 functions:
<Api Name="SCardDisconnect"> <Param Type="SCARDHANDLE" Name="hCard" /> <Param Type="[SCARD_DISPOSITION]" Name="dwDisposition" /> <Return Type="[SCARD_ERROR]" /> </Api> <Api Name="SCardEndTransaction"> <Param Type="SCARDHANDLE" Name="hCard" /> <Param Type="[SCARD_DISPOSITION]" Name="dwDisposition" /> <Return Type="[SCARD_ERROR]" /> </Api> <Api Name="SCardTransmit"> <Param Type="SCARDHANDLE" Name="hCard" /> <Param Type="LPCSCARD_IO_REQUEST" Name="pioSendPci" /> <Param Type="LPCBYTE" Name="pbSendBuffer" Count="cbSendLength" /> <Param Type="DWORD" Name="cbSendLength" /> <Param Type="LPSCARD_IO_REQUEST" Name="pioRecvPci" /> <Param Type="LPBYTE" Name="pbRecvBuffer" PostCount="pcbRecvLength" /> <Param Type="LPDWORD" Name="pcbRecvLength" /> <Return Type="[SCARD_ERROR]" /> </Api>
=> you will be able to track card reset & command sent and received