Decrypting the smart card minidriver auto-installation process

How to capture Microsoft Update traffic ?

  1. Install fiddler
  2. Enable HTTPS decryption (tools -> fiddler options -> https)
  3. force the WinHttp proxy
    netsh winhttp set proxy 127.0.0.1:8888
    (reverse: netsh winhttp reset proxy)
  4. add the fiddler root CA to the “computer trusted root store”

windows+R -> mmc.exe -> add snap-in -> certificates -> add “personnal” and “computer” locate the “DO NOT TRUST” certificate in personnal -> trusted root and copy it to computer -> trusted root

Protocol overview

  1. call “http://www.microsoft.com/SoftwareDistribution/Server/ClientWebService/SyncUpdates“
  2. call “http://www.microsoft.com/SoftwareDistribution/Server/ClientWebService/GetExtendedUpdateInfo“
  3. download the .cab representing the driver

Reference : MS-WUSP: Windows Update Services: Client-Server Protocol Specification

Matching ATR

The SyncUpdates function send all the informations about the drivers installed. However, a new device is include in the Soap query :

 <Device>
			<HardwareIDs soapenc:arrayType="xsd:string[1]">
			<string>SCFILTER\CID_805100611030</string>
			</HardwareIDs>
			<CompatibleIDs></CompatibleIDs>
			<installedDriver>
			<MatchingID xsi:nil="1"/>
			<DriverVerDate>1950-08-21</DriverVerDate>
			<DriverVerVersion>0</DriverVerVersion>
			<Class xsi:nil="1"/>
			<Manufacturer xsi:nil="1"/>
			<Provider xsi:nil="1"/>
			<Model xsi:nil="1"/>
			</installedDriver>
			</Device>

Please note that the CID_805100611030 match the historical Bytes of the ATR of the smart card (3bd6180081b1807d1f038051006110308f) as described in the Minidriver specifications v7, Appendix D.1