Smart Card Troubleshooting - Decode ETL trace

Question

Hello,

I am having a problem with my smartcard and my smartcard reader driver development. I own both code (smartcard and reader driver). So I can see what happen there.

My problem is when I want to login to Windows with my smartcard, I have the error message "Provider could not perform the action since the context was acquired as silent".

From my reader and card, it does not seem to be any suspicious thing.

My card passes the test "certutil.exe -scinfo" without any error. The only suspicious thing is my smartcard PIN is asked many times (5 or 6 times) while my card as only two certificates.

I did follow the section "Debugging and tracing using WPP" from https://learn.microsoft.com/en-us/windows/security/identity-protection/smart-cards/smart-card-debugging-information#debugging-and-tracing-using-wpp

I managed to get my ETL trace file. I retrieved the PDB files from Microsoft server.

I tried to extract TMF from Windows PDB files:

"C:\Program Files (x86)\Windows Kits\10\bin\10.0.16299.0\x64\tracepdb.exe" -f "C:\tracing\basecsp.pdb\5298B9A5DD28F2B73F9A2F1B06F9C4E31\basecsp.pdb" -p C:\tracing
Microsoft (R) TracePDB.Exe (10.0.16299.15)
® Microsoft Corporation. All rights reserved.
tracepdb : info BNP0000: WPPFMT No Trace entries found in C:\tracing\basecsp.pdb\5298B9A5DD28F2B73F9A2F1B06F9C4E31\basecsp.pdb

And obviously when trying to decode trace from ETL, I got the message "No Format Information found"...

"C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64\tracefmt.exe" c:\scardsvr.etl -p C:\tracing
Setting log file to: c:\scardsvr.etl
Examining C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64\default.tmf for message formats,  3 found.
Searching for TMF files on path: C:\tracing
Logfile c:\scardsvr.etl:
        OS version              10.0.19045  (Currently running on 10.0.19045)
        Start Time              2024-08-05-10:50:42.261
        End Time                2024-08-05-10:57:16.501
        Timezone is             @tzres.dll,-322 (Bias is -60mins)
        BufferSize              65536 B
        Maximum File Size       0 MB
        Buffers  Written        171
        Logger Mode Settings    (80000) ()
        ProcessorCount          8
Processing completed   Buffers: 171, Events: 9118, EventsLost: 0 :: Format Errors: 0, Unknowns: 9114
Event traces dumped to FmtFile.txt
Event Summary dumped to FmtSum.txt

But 'FmtFile.txt' contains:

Unknown( 11): GUID=8a7e721a-78d2-3c98-95a2-50a251c6a58b (No Format Information found).
Unknown( 12): GUID=6cb68c40-6058-3735-bafc-290ec605627b (No Format Information found).
Unknown( 13): GUID=6cb68c40-6058-3735-bafc-290ec605627b (No Format Information found).
Unknown( 22): GUID=90949ff9-544f-38c0-c646-09e2af45a07d (No Format Information found).
(...)

So where can I get the TMF files of the Windows smartcard subsystem mentioned in this page https://learn.microsoft.com/en-us/windows/security/identity-protection/smart-cards/smart-card-debugging-information#debugging-and-tracing-using-wpp