Smartcard APDU sniffer for windows
Branch: master
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
SmartcardSniffer
README.md
SmartcardSniffer.sln

README.md

Smartcard Sniffer

Wrote this as I was using APDUView utility quite a lot, but it's sometimes complicated to set up. This tool uses AppInit_Dlls functionality to achieve the same with more ease. It hooks winscard!SCardTransmit and logs both sent and received data to a log file. Log file is located in the same directory as the SmartcardSniffer.dll, and has a name of the application that is talking to the smart card.

Precompiled binaries (current version) for x86 and x86_64 available here.

It's using MHook lib to do it's hooking business.

To install the dll, just add it's path to:

  • for 32 bit DLL on 32 bit systems:
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs]
  • for 64 bit DLL on 64 bit system:
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs]
  • for 32 bit DLL on 64 bit system (for hooking 32 bit applications on 64 bit systems):
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs]

Multiple entries are separated by space and/or ,. Make sure you path to the DLL doesn't have any spaces in it.

Note that on Windows Vista and later, you'd also need to set RequireSignedAppInit_DLLs key to 0 to be able to load unsigned DLLs and make sure LoadAppInit_DLLs is set to 1.

To uninstall it, simply remove the DLL entry from AppInit_DLLs list.

In the log file >>> specifies the data to be sent, and <<< received data. Here's the example of the logged data:

        >>> 00:A4:04:00:0B:A0:00:00:03:97:43:49:44:5F:01:00
        <<< 6A:82
        Winscard!SCardTransmit:
        >>> 00:CA:7F:68:00
        <<< 7F:60:1F:83:A1:21:06:06:60:81:4B:01:65:03:A1:14:81:01:08:82:11:08:87:02:00:1A:88:02:08:04:B1:04:B1:02:14:3C:90:00
        Winscard!SCardTransmit:
        >>> 00:A4:04:00:09:A0:00:00:03:08:00:00:10:00
        <<< 6A:82
  • ea