如何在没有卡片的情况下向智能卡读卡器（而不是智能卡）发送命令？

Question

前言：

我有了一些扩展能力（比发送APDU命令到卡和接收APDU响应其他）双界面智能卡读卡器。

例如它的文件中被提到，你可以使用下面的命令你的读者的固件版本：

GET_FIRMWARE_VERSION：FF 69 44 42 05 68 92 00 05 00

在它的工具，有此功能的按钮，它的工作原理精细：

我甚至闻USB端口，看看有什么在我的电脑，我的这个函数读取器之间的连接正好交换：

命令：

响应：

问题：

我想使用其他工具或通过代码来让我的读者版本（也许发送其他扩展命令）但我必须在读卡器中插入一张卡才能发送指令，否则我会收到No Card Present异常，而我不想发送指令给卡！ （读者工具答案成功地GET_FIRMWARE_VERSION没有任何卡在读卡器的插槽，可使用）

我做了什么至今：

1.I尝试了一些工具，包括OpenSCTool，PyAPDUTool和另一位读者的工具。 2.我写了下面的python脚本来发送扩展命令。

#--- Importing required modules. 
import sys 
import time 
sys.path.append("D:\\PythonX\\Lib\\site-packages") 
from smartcard.scard import * 
import smartcard.util 
from smartcard.System import readers 


#---This is the list of commands that we want to send device 
cmds =[[,0xFF,0x69,0x44,0x42,0x05,0x68,0x92,0x00,0x04,0x00],] 


#--- Let's to make a connection to the card reader 
r=readers() 
print "Available Readers :",r 
print 
target_reader = input("--- Select Reader (0, 1 , ...): ") 
print 

while(True): 
    try: 
     print "Using :",r[target_reader] 
     reader = r[target_reader] 
     connection=reader.createConnection() 
     connection.connect() 
     break 
    except: 
     print "--- Exception occured! (Wrong reader or No card present)" 
     ans = raw_input("--- Try again? (0:Exit/1:Again/2:Change Reader)") 
     if int(ans)==0: 
      exit() 
     elif int(ans)==2: 
      target_reader = input("Select Reader (0, 1 , ...): ") 

#--- An struct for APDU responses consist of Data, SW1 and SW2 
class stru: 
    def __init__(self): 
     self.data = list() 
     self.sw1 = 0 
     self.sw2 = 0 

resp = stru() 

def send(cmds): 
    for cmd in cmds: 

     #--- Following 5 line added to have a good format of command in the output. 
     temp = stru() ; 
     temp.data[:]=cmd[:] 
     temp.sw1=12 
     temp.sw2=32 
     modifyFormat(temp) 
     print "req: ", temp.data 

     resp.data,resp.sw1,resp.sw2 = connection.transmit(cmd) 
     modifyFormat(resp) 
     printResponse(resp) 

def modifyFormat(resp): 
    resp.sw1=hex(resp.sw1) 
    resp.sw2=hex(resp.sw2) 
    if (len(resp.sw2)<4): 
     resp.sw2=resp.sw2[0:2]+'0'+resp.sw2[2] 
    for i in range(0,len(resp.data)): 
     resp.data[i]=hex(resp.data[i]) 
     if (len(resp.data[i])<4): 
      resp.data[i]=resp.data[i][0:2]+'0'+resp.data[i][2] 

def printResponse(resp): 
    print "res: ", resp.data,resp.sw1,resp.sw2 


send(cmds) 
connection.disconnect() 

输出：

>>> ================================ RESTART ================================ 
Available Readers : ['CREATOR CRT-603 (CZ1) CCR RF 0', 'CREATOR CRT-603 (CZ1) CCR SAM 0'] 

--- Select Reader (0, 1 , ...): 0 

Using : CREATOR CRT-603 (CZ1) CCR RF 0 
--- Exception occured! (Wrong reader or No card present) 
--- Try again? (0:Exit/1:Again/2:Change Reader) 

>>> ================================ RESTART ================================ 
Available Readers : ['CREATOR CRT-603 (CZ1) CCR RF 0', 'CREATOR CRT-603 (CZ1) CCR SAM 0'] 

--- Select Reader (0, 1 , ...): 1 

Using : CREATOR CRT-603 (CZ1) CCR SAM 0 
--- Exception occured! (Wrong reader or No card present) 
--- Try again? (0:Exit/1:Again/2:Change Reader) 

但两者有提到的问题！

问题：

1如何扩展命令发送给读写器虽然没有卡可用？

2-为什么我在嗅探数据中看不到命令​​头？ （请注意，由于标题是所有扩展命令的预先指定的固定值，因此我认为阅读工具不会使用GET_FIRMWARE_VERSION命令发送标题，并且它只发送数据！但它是如何工作的？）

---

更新：

使用试验和错误，我发现一些有用的东西。

假设：

• 伪APDU的固定报头= FF 69 44 42
• 为GET_READER_FIRMWARE_VERSION = 68 92 00 04 00
• 为CHANGE_SAM_SLOT伪-APDU的数据字段= 68 92 01 00 03 XX 00 00 （我的读取器具有两个伪-APDU的数据字段SAM插槽，所以XX可以是01或02）
• SELECT APDU命令= 00 A4 04 00 00

好吧，我写了下面的Java程序：

import java.util.List; 
import java.util.Scanner; 
import javax.smartcardio.Card; 
import javax.smartcardio.CardChannel; 
import javax.smartcardio.CardException; 
import javax.smartcardio.CardTerminal; 
import javax.smartcardio.CommandAPDU; 
import javax.smartcardio.ResponseAPDU; 
import javax.smartcardio.TerminalFactory; 
import javax.xml.bind.DatatypeConverter; 

public class TestPCSC { 

    public static void main(String[] args) throws CardException { 

     TerminalFactory tf = TerminalFactory.getDefault(); 
     List< CardTerminal> terminals = tf.terminals().list(); 
     System.out.println("Available Readers:"); 
     System.out.println(terminals + "\n"); 

     Scanner scanner = new Scanner(System.in); 
     System.out.print("Which reader do you want to send your commands to? (0 or 1 or ...): "); 
     String input = scanner.nextLine(); 
     int readerNum = Integer.parseInt(input); 
     CardTerminal cardTerminal = (CardTerminal) terminals.get(readerNum); 
     Card connection = cardTerminal.connect("DIRECT"); 
     CardChannel cardChannel = connection.getBasicChannel(); 

     System.out.println("Write your commands in Hex form, without '0x' or Space charaters."); 
     System.out.println("\n---------------------------------------------------"); 
     System.out.println("Pseudo-APDU Mode:"); 
     System.out.println("---------------------------------------------------"); 
     while (true) { 
      System.out.println("Pseudo-APDU command: (Enter 0 to send APDU command)"); 
      String cmd = scanner.nextLine(); 
      if (cmd.equals("0")) { 
       break; 
      } 
      System.out.println("Command : " + cmd); 
      byte[] cmdArray = hexStringToByteArray(cmd); 
      byte[] resp = connection.transmitControlCommand(CONTROL_CODE(), cmdArray); 
      String hex = DatatypeConverter.printHexBinary(resp); 
      System.out.println("Response : " + hex + "\n"); 
     } 

     System.out.println("\n---------------------------------------------------"); 
     System.out.println("APDU Mode:"); 
     System.out.println("---------------------------------------------------"); 

     while (true) { 
      System.out.println("APDU command: (Enter 0 to exit)"); 
      String cmd = scanner.nextLine(); 
      if (cmd.equals("0")) { 
       break; 
      } 
      System.out.println("Command : " + cmd); 
      byte[] cmdArray = hexStringToByteArray(cmd); 
      ResponseAPDU resp = cardChannel.transmit(new CommandAPDU(cmdArray)); 
      byte[] respB = resp.getBytes(); 
      String hex = DatatypeConverter.printHexBinary(respB); 
      System.out.println("Response : " + hex + "\n"); 
     } 

     connection.disconnect(true); 

    } 

    public static int CONTROL_CODE() { 
     String osName = System.getProperty("os.name").toLowerCase(); 
     if (osName.indexOf("windows") > -1) { 
      /* Value used by both MS' CCID driver and SpringCard's CCID driver */ 
      return (0x31 << 16 | 3500 << 2); 
     } else { 
      /* Value used by PCSC-Lite */ 
      return 0x42000000 + 1; 
     } 

    } 

    public static byte[] hexStringToByteArray(String s) { 
     int len = s.length(); 
     byte[] data = new byte[len/2]; 
     for (int i = 0; i < len; i += 2) { 
      data[i/2] = (byte) ((Character.digit(s.charAt(i), 16) << 4) 
        + Character.digit(s.charAt(i + 1), 16)); 
     } 
     return data; 
    } 

} 

在上面的程序，我可以发送命令同时使用connection.transmitControlCommand和cardChannel.transmit()方法我的读者。关键是，所有使用第一种方法发送给阅读器的命令都假定为伪APDU命令，我不应该为它们使用Psedo-APDU标头！所有使用第二种方法发送给阅读器的命令都假定为常规APDU命令，所以如果需要通过第二种方法发送伪APDU命令，我必须将伪APDU头添加到它。

让我们看到输出的接触式读取器：

run: 
Available Readers: 
[PC/SC terminal ACS ACR122 0, 
PC/SC terminal CREATOR CRT-603 (CZ1) CCR RF 0, 
PC/SC terminal CREATOR CRT-603 (CZ1) CCR SAM 0] 

Which reader do you want to send your commands to? (0 or 1 or ...): 1 
Write your commands in Hex form, without '0x' or Space charaters. 

--------------------------------------------------- 
Pseudo-APDU Mode: 
--------------------------------------------------- 
Pseudo-APDU command: (Enter 0 to send APDU command) 
00A4040000 
Command : 00A4040000 
Response : 6800 
//Based on reader's documents, 0x6800 means "Class byte is not correct" 
//As I have a regular java card in the RF field of my reader, I conclude that 
//this response is Reader's response (and not card response) 

Pseudo-APDU command: (Enter 0 to send APDU command) 
6892000400 
Command : 6892000400 
Response : 433630335F435A375F425F31353038323100039000 

Pseudo-APDU command: (Enter 0 to send APDU command) 
FF694442056892000400 
Command : FF694442056892000400 
Response : 6800 
//Pseudo-APDU commands doesn't work in Pseudo-APDU mode if I add the Pseudo-APDU header to them. 

Pseudo-APDU command: (Enter 0 to send APDU command) 
00A4040000 
Command : 00A4040000 
Response : 6800 

Pseudo-APDU command: (Enter 0 to send APDU command) 
0 

--------------------------------------------------- 
APDU Mode: 
--------------------------------------------------- 
APDU command: (Enter 0 to exit) 
00A4040000 
Command : 00A4040000 
Response : 6F198408A000000018434D00A50D9F6E061291921101009F6501FF9000 

APDU command: (Enter 0 to exit) 
6892000400 
Command : 6892000400 
Response : 6E00 
//This is the response of my card. I can't receive Firmware version in APDU mode using this command without Pseudo-APDU header. 

APDU command: (Enter 0 to exit) 
FF694442056892000400 
Command : FF694442056892000400 
Response : 433630335F435A375F425F31353038323100099000 
//I successfully received Firmware version in APDU mode using the fixed Pseudo-APDU header. 

APDU command: (Enter 0 to exit) 
00A4040000 
Command : 00A4040000 
Response : 6F198408A000000018434D00A50D9F6E061291921101009F6501FF9000 

APDU command: (Enter 0 to exit) 
0 
BUILD SUCCESSFUL (total time: 1 minute 36 seconds) 

有什么问题还是？

是的，有两个问题!:

1，上述程序只是为它的第一次运行工作正常。我的意思是，如果我停止运行并重新运行它，第二种方法抛出一个异常：

run: 
Available Readers: 
[PC/SC terminal ACS ACR122 0, PC/SC terminal CREATOR CRT-603 (CZ1) CCR RF 0, PC/SC terminal CREATOR CRT-603 (CZ1) CCR SAM 0] 

Which reader do you want to send your commands to? (0 or 1 or ...): 1 
Write your commands in Hex form, without '0x' or Space charaters. 

--------------------------------------------------- 
Pseudo-APDU Mode: 
--------------------------------------------------- 

Pseudo-APDU command: (Enter 0 to send APDU command) 
00A4040000 
Command : 00A4040000 
Response : 6800 

Pseudo-APDU command: (Enter 0 to send APDU command) 
FF694442056892000400 
Command : FF694442056892000400 
Response : 6800 

Pseudo-APDU command: (Enter 0 to send APDU command) 
6892000400 
Command : 6892000400 
Response : 433630335F435A375F425F31353038323100049000 

Pseudo-APDU command: (Enter 0 to send APDU command) 
00A4040000 
Command : 00A4040000 
Response : 6800 

Pseudo-APDU command: (Enter 0 to send APDU command) 
0 

--------------------------------------------------- 
APDU Mode: 
--------------------------------------------------- 
APDU command: (Enter 0 to exit) 
00A4040000 
Command : 00A4040000 
Exception in thread "main" javax.smartcardio.CardException: sun.security.smartcardio.PCSCException: Unknown error 0x16 
    at sun.security.smartcardio.ChannelImpl.doTransmit(ChannelImpl.java:219) 
    at sun.security.smartcardio.ChannelImpl.transmit(ChannelImpl.java:90) 
    at TestPCSC.main(TestPCSC.java:58) 
Caused by: sun.security.smartcardio.PCSCException: Unknown error 0x16 
    at sun.security.smartcardio.PCSC.SCardTransmit(Native Method) 
    at sun.security.smartcardio.ChannelImpl.doTransmit(ChannelImpl.java:188) 
    ... 2 more 
Java Result: 1 
BUILD SUCCESSFUL (total time: 39 seconds) 

正如你看到的上面，我不能用第二种方法了，我需要断电的读卡器和电源上它再次使它再次正常工作。

2-接触界面（我的意思是SAM阅读器）总是抛出以前的异常！我的意思是第二种方法根本不起作用（不是第一次运行，也不是第二次和第三次......）

请注意，我尝试了不同的读者，似乎这不仅限于此读者。一些ACS阅读器也有类似问题或者重新运行的问题完全相同

有没有人有任何想法？

作为一个侧面的问题，Python是否有任何平等的方法来发送像Java一样的伪APDU？

最后，从Reader的角度来看，connection.transmitControlCommand和cardChannel.transmit()方法有什么区别？

Answer 1

当您停止“智能卡”服务时，该工具是否仍然返回固件版本？如果是，那么该工具可能使用原始IOCTL命令（DeviceIoControl）与驱动程序进行通信。

---

另请参阅this question。作者说，你必须设置SCARD_PROTOCOL_UNDEFINED为协议参数：

SCardConnect(hSC, 
      readerState.szReader, 
      SCARD_SHARE_DIRECT, 
      SCARD_PROTOCOL_UNDEFINED, 
      &hCH, 
      &dwAP 
      ); 

我只是尝试它，它似乎为Windows 10，至少工作。通信是可能的，没有插入卡。虽然我没有为其他Windows版本进行测试。