Skip to content

VMware Virtual CCID reader optimization problem

Problem description

A smart card works correctly when attached directly to a virtual machine, but fails when using the VMware Virtual USB CCID shared smart card reader.

VMware Virtual CCID reader
VMware Virtual USB CCID reader device
Root cause analysis

An APDU trace with rohitab API Monitor shows that the card does not receive the same APDU from the host and from the VM.

SCardDemo on host computer
SCardDemo output: host computer (direct reader)
SCardDemo on virtual machine
SCardDemo output: VM (VMware Virtual CCID)

The raw APDUs in API Monitor show the difference:

APDU on host computer
APDU captured on host (complete)
APDU on VM (captured from vmware-vmx.exe)
APDU captured from vmware-vmx.exe: last byte stripped
The last byte is stripped by VMware. VMware allocates a 258-byte buffer for APDU responses (256 bytes of data plus SW1/SW2) and drops the last byte of the command. Sending the same APDU from the host without its last byte gives the same wrong result as the VM.

Security Expertise articles

← Back to Security Expertise