Skip to content

How Windows Update installs a smart card minidriver

When an unknown smart card is inserted, Windows asks Windows Update for a minidriver. The request is SOAP over HTTPS, so a local proxy that decrypts HTTPS shows all of it.

Capture the Windows Update traffic
  1. Install Fiddler
  2. Enable HTTPS decryption: Tools → Fiddler Options → HTTPS
  3. Point the WinHTTP proxy to Fiddler: 
    netsh winhttp set proxy 127.0.0.1:8888
(to undo: netsh winhttp reset proxy)
  4. Add the Fiddler root CA to the computer's Trusted Root store
Win+R → mmc.exe → Add snap-in → Certificates → add "Personal" and "Computer"
Find the "DO NOT TRUST" certificate under Personal → Trusted Root and copy it to Computer → Trusted Root.
Protocol overview

Reference: MS-WUSP: Windows Update Services: Client-Server Protocol Specification

  1. Call SyncUpdates.
  2. Call GetExtendedUpdateInfo.
  3. Download the driver .cab.
Matching ATR

SyncUpdates sends the list of installed drivers. An unknown smart card adds a <Device> element to the SOAP request:

<Device>
    <HardwareIDs soapenc:arrayType="xsd:string[1]">
        <string>SCFILTER\CID_805100611030</string>
    </HardwareIDs>
    <CompatibleIDs></CompatibleIDs>
    <installedDriver>
        <MatchingID xsi:nil="1"/>
        <DriverVerDate>1950-08-21</DriverVerDate>
        <DriverVerVersion>0</DriverVerVersion>
        <Class xsi:nil="1"/>
        <Manufacturer xsi:nil="1"/>
        <Provider xsi:nil="1"/>
        <Model xsi:nil="1"/>
    </installedDriver>
</Device>

The hardware ID CID_805100611030 comes from the historical bytes of the ATR (3bd6180081b1807d1f038051006110308f), as described in Appendix D.1 of the smart card minidriver specification v7.

Security Expertise articles

← Back to Security Expertise