Smartcard APDU sniffer for windows
C C++ Objective-C
Latest commit 43b9a7b Sep 14, 2013 @ea Update
Failed to load latest commit information.
SmartcardSniffer moved from google code Sep 14, 2013 Update Sep 14, 2013
SmartcardSniffer.sln moved from google code Sep 14, 2013

Smartcard Sniffer

Wrote this as I was using APDUView utility quite a lot, but it's sometimes complicated to set up. This tool uses AppInit_Dlls functionality to achieve the same with more ease. It hooks winscard!SCardTransmit and logs both sent and received data to a log file. Log file is located in the same directory as the SmartcardSniffer.dll, and has a name of the application that is talking to the smart card.

Precompiled binaries (current version) for x86 and x86_64 available here.

It's using MHook lib to do it's hooking business.

To install the dll, just add it's path to:

  • for 32 bit DLL on 32 bit systems:
    • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs]
  • for 64 bit DLL on 64 bit system:
    • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs]
  • for 32 bit DLL on 64 bit system (for hooking 32 bit applications on 64 bit systems):
    • [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs]

Multiple entries are separated by space and/or ,. Make sure you path to the DLL doesn't have any spaces in it.

Note that on Windows Vista and later, you'd also need to set RequireSignedAppInit_DLLs key to 0 to be able to load unsigned DLLs and make sure LoadAppInit_DLLs is set to 1.

To uninstall it, simply remove the DLL entry from AppInit_DLLs list.

In the log file >>> specifies the data to be sent, and <<< received data. Here's the example of the logged data:

        >>> 00:A4:04:00:0B:A0:00:00:03:97:43:49:44:5F:01:00
        <<< 6A:82
        >>> 00:CA:7F:68:00
        <<< 7F:60:1F:83:A1:21:06:06:60:81:4B:01:65:03:A1:14:81:01:08:82:11:08:87:02:00:1A:88:02:08:04:B1:04:B1:02:14:3C:90:00
        >>> 00:A4:04:00:09:A0:00:00:03:08:00:00:10:00
        <<< 6A:82
  • ea