Using CardGroove.

Read a smart card

Connect a compatible PC/SC reader and insert or present your card, then launch CardGroove for Windows.

1. Choose File → Read Card or press Ctrl+O.
2. Select your reader. Use Refresh if it is not listed.
3. Choose EMV, Auth, Chip, Certificate or DESFire. The group title follows your selection, and the AID field appears only for EMV.
4. Select OK to read the available data. Expand the resulting groups and select a field to inspect its bytes.

EMV is the initial default. Your selected mode is remembered in CardGroove.ini. Each card view can be saved as a snapshot; read again after replacing a card.

Five read modes

These modes inspect data without attempting PIN verification, issuing credentials or changing card files.

Certificate smart cards

Certificate uses the Windows smart-card minidriver to read certificates, public-key details, available key-container metadata, PIN policy/status metadata and accessible logical files. Subject, issuer, validity and fingerprints are shown when a certificate can be decoded. PIN values and private keys are not read.

Inspect an exported X.509 certificate in your browser →

PIV identity cards

Auth reads public PIV discovery, capability, CHUID and key-history objects, plus available certificates in slots 9A, 9C, 9D and 9E. The name identifies the identity-card category; this read mode does not authenticate the cardholder.

The desktop preserves compressed certificates as raw objects. The PIV object decoder can decode uncompressed and GZIP certificate containers locally.

DESFire access badges

DESFire reads version information, visible application IDs, file IDs and accessible file settings. It reports file types, communication options, access-right bytes and supported file sizes or record dimensions.

It does not authenticate with badge keys, read file contents or provision access credentials. The issuing access-control system determines what a badge can open. Decode captured file settings →

EMV payment cards

EMV reads PSE (1PAY.SYS.DDF01), PPSE (2PAY.SYS.DDF01) and available directory records. Review application identifiers, labels and selection priorities with the PSE/PPSE decoder. This directory read does not initiate a payment.

Chip and Java Card

Chip reads available ATR, card-recognition, CPLC manufacturing and application-registry information. What a card exposes depends on its platform and security state. The APDU command decoder explains captured command bytes without transmitting them.

Keycard crypto wallets

Open Tools → Keycard cryptocurrency wallet in the desktop app. This panel is separate from the read-only Ctrl+O modes and requires Java 17 or later and compatible card/reader hardware.

Start with Inspect for version and state information. The implementation also provides version-specific pairing, PIN verification, public-key derivation and Ethereum-address display, plus explicitly confirmed signing of a 32-byte digest.

The setup and installation panels support specific new-wallet and compatible Java Card workflows. They require their respective credentials and confirmations. CardGroove does not construct or broadcast cryptocurrency transactions.

Keycard operations are implemented and tested with software fixtures; end-to-end hardware qualification is still outstanding. See compatibility notes before planning a hardware workflow.

Save and decode

Use File → Save snapshot as (Ctrl+S) to save captured records and APDU logs as .cgs or YAML. Reopen a snapshot with File → Open snapshot (Ctrl+Shift+O) without a reader. Use File → Compare snapshot with to compare captures, or Export bytes for an individual record.

The browser toolbox accepts pasted data and supported local files. Choose the decoder that matches the exported record: a directory response, PIV object, command APDU, X.509 certificate or DESFire file-settings response. Inputs are processed locally.

The bundled command-line probe is available in the same desktop executable:

cardgroove.exe --list-readers
cardgroove.exe --probe "Reader name" snapshot.yaml
cardgroove.exe --probe --public "Reader name" public.yaml

--public inspects public directories, including EF.DIR and PSE/PPSE where accessible. Run cardgroove.exe --probe --help for usage. Scripts should wait for the executable to finish and check its exit code.

What is accessible?

CardGroove can display only the data permitted by the card and its provider. A missing object, a denied read and an unsupported command are different outcomes; inspect the reported status.

Certificate/minidriver inspection has been exercised with cryptoCertum3.6. PIV, DESFire and Keycard support still needs qualification with representative physical cards. Support for a format does not promise compatibility with every product or issuer profile.