Ludovic Rousseau's blog (Posts about ccid)

Laptops and smart card readers

Ludovic Rousseau — Tue, 03 Mar 2026 20:29:45 GMT

Which smart card reader is present in a particular laptop model? It can be difficult to find out the exact model of smart card reader included in a laptop before buying it.

However, thanks to the Hardware for Linux project, you can submit your own hardware configuration and also consult the configurations of many laptops and desktops to find out what hardware is included.

The website also provides aggregated results for a specific categories such as CPU Vendors.

One interesting result is the Chipcard Vendor aggregation.

Chipard Vendors market shares

The results do not represent exact market shares. They only include systems that:

run GNU/Linux
and that have been submitted to https://linux-hardware.org/ by their owners.

However, they should reflect reality.

Chipcard Vendors
#	Vendor	Percent
1	Broadcom	55.61%
2	Alcor Micro	26.17%
3	O2 Micro	6.53%
4	Upek	4.69%
5	Lenovo	3.45%
6	Yubico.com	0.83%
7	Gemalto (was Gemplus)	0.6%
8	SCM Microsystems	0.51%
9	Advanced Card Systems	0.37%
10	Activ	0.23%

An important point to note is that the first five on the list should be correct, as they correspond to the manufacturers of embedded smart card readers. However, the next five in the list are often (if not always) external smart card readers that are connected via a USB port and not integrated into the laptop. For instance, I am not aware of any Yubico readers that are embedded in laptops. These readers are listed on https://linux-hardware.org/ because they were plugged in when the user ran the hw-probe program to scan and report the hardware configuration.

Which laptop manufacturers use which smart card reader?

You can click on a specific slice of the Chipcard Vendor pie chart to see which laptop manuifacturers uses this smart card reader brand.

Broadcom

All Broadcom readers are used by Dell.

Alcor Micro

#	Vendor	Percent
1	Lenovo	82.4%
2	Hewlett-Packard	8.6%
3	Fujitsu	6.5%
4	Acer	0.7%
5	ASUSTek Computer	0.4%

O2 Micro

#	Vendor	Percent
1	Dell	40.8%
2	Fujitsu	37.3%
3	Toshiba	19.7%
4	Fujitsu Siemens	2.1%

Upek

All of Upek readers are used by Lenovo.

It looks like the Upek devices are "TouchChip Fingerprint Coprocessor" and not an "Integrated Smart Card Reader". I don't know why they are listed as "Chipcard Vendor". Perhaps it is a bug or limitation of https://linux-hardware.org/.

Lenovo

Unsurprisingly, all of Lenovo readers are used by... Lenovo.

Corresponding CCID devices

It is possible to list the CCID devices of each manufacturer that I know of:

Broadcom
Alcor Micro
O2 Micro
Upek (not smart card readers)
Lenovo

Conclusion

Only three main vendors of smart card readers are used in laptops: Broadcom, Alcor Micro and O2 Micro.

Do they produce good products? Are their products supported by my CCID driver? These are both very good questions, but for other blog articles. To be continued...

SCARD_CTL_CODE(3601): USB path of the reader

Ludovic Rousseau — Sun, 08 Feb 2026 12:10:17 GMT

In version 1.7.1 of my CCID driver I added a new service with the Control Code SCARD_CTL_CODE(3601).

Problem

Some people use two (or more) readers. And each reader plays a specific role in their application. It is therefore important to identify each one.

While it is often possible to use the PC/SC reader name (see What is in a PC/SC reader name?), if you have two identical readers with no serial numbers, it becomes impossible to distinguish between them.

Solution

A USB device is connected to a USB bus with a specific topology. The lsusb --tree command, for example, can display the USB bus topology. The output looks like this:

$ lsusb -t
/:  Bus 001.Port 001: Dev 001, Class=root_hub, Driver=xhci_hcd/16p, 480M
    |__ Port 003: Dev 039, If 0, Class=Chip/SmartCard, Driver=usbfs, 12M

The smart card reader is connected to USB Port 003 on Bus 001. These numbers are fixed and linked to the computer's physical USB port. Disconnecting and reconnecting the reader to the same USB port will result in the same topology.

On GNU/Linux, the device number will change. For example, if I disconnect and reconnect the device, the reader's device number (Dev) will change from 039 to 040.

SCARD_CTL_CODE(3601)

This code is specific to my CCID driver. It comes after SCARD_CTL_CODE(3600) that is also specific/proprietary and used for MEP (see CCID driver and Multiple Enabled Profiles (MEP)).

Ideally, we would use a code defined by the PC/SC Workgroup but this group is essentially defunct and Microsoft is no longer a member. Microsoft stopped following the PC/SC Workgroup Specification a long time ago. Therefore, even if a name is defined by the PC/SC Workgroup, it will not be available on Windows.

API documentation

Use SCardControl() to send the control code SCARD_CTL_CODE(3601) to the reader. This code will be intercepted by the CCID driver. On return, you get a NUL-terminated string in the format <bus>-<port[.port[.port]]>:<config>.<interface> (e.g., 1-1.3.2:1.0) as found in /sys/bus/usb/devices/.

Source code

This example code is also included in the CCID driver's source code, in the examples/get_usb_path.py file.

The code also displays the SCARD_ATTR_CHANNEL_ID of the reader (see SCARD_ATTR_CHANNEL_ID and USB devices). This is an official PC/SC feature. It can be used when topology information is obtained from another source.

#! /usr/bin/env python3

"""
get_usb_path.py: get USB path of readers
Copyright (C) 2026  Ludovic Rousseau
"""

#   This program is free software; you can redistribute it and/or modify
#   it under the terms of the GNU General Public License as published by
#   the Free Software Foundation; either version 3 of the License, or
#   (at your option) any later version.
#
#   This program is distributed in the hope that it will be useful,
#   but WITHOUT ANY WARRANTY; without even the implied warranty of
#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#   GNU General Public License for more details.
#
#   You should have received a copy of the GNU General Public License along
#   with this program; if not, see <http://www.gnu.org/licenses/>.

import struct
import smartcard
from smartcard.pcsc.PCSCPart10 import SCARD_CTL_CODE
from smartcard.scard import (
    SCARD_E_NOT_TRANSACTED,
    SCARD_E_INVALID_PARAMETER,
    SCARD_ATTR_CHANNEL_ID,
    SCARD_SHARE_DIRECT,
    SCARD_LEAVE_CARD,
)
from smartcard.util import toASCIIString


def get_usb_path(reader):
    """
    Display USB topology
    """
    print("Using:", reader)
    card_connection = reader.createConnection()
    card_connection.connect(mode=SCARD_SHARE_DIRECT, disposition=SCARD_LEAVE_CARD)

    # special control code
    ioctl_get_usb_path = SCARD_CTL_CODE(3601)
    try:
        res = card_connection.control(ioctl_get_usb_path)
    except smartcard.Exceptions.SmartcardException as ex:
        # SCARD_E_NOT_TRANSACTED returned by pcsc-lite
        # SCARD_E_INVALID_PARAMETER retruned by macOS
        if ex.hresult in [SCARD_E_NOT_TRANSACTED, SCARD_E_INVALID_PARAMETER]:
            print("Your driver does not (yet) support SCARD_CTL_CODE(3601)")
            return
        raise
    print("USB path:", toASCIIString(res))

    # get Channel ID
    attrib = card_connection.getAttrib(SCARD_ATTR_CHANNEL_ID)
    ddddcccc = struct.unpack("i", bytearray(attrib))[0]
    dddd = ddddcccc >> 16
    if dddd == 0x0020:
        bus = (ddddcccc & 0xFF00) >> 8
        addr = ddddcccc & 0xFF
        print(f" USB: bus: {bus}, addr: {addr}")
    print()


def main():
    """
    main
    """
    # for all the available readers
    for reader in smartcard.System.readers():
        get_usb_path(reader)


if __name__ == "__main__":
    main()

Output

The reader is connected directly to the computer

$ ./get_usb_path.py
Using: Gemalto PC Twin Reader (70D7E2EE) 01 00
USB path: 1-3:1.0
 USB: bus: 1, addr: 39

$ lsusb -t
/:  Bus 001.Port 001: Dev 001, Class=root_hub, Driver=xhci_hcd/16p, 480M
    |__ Port 003: Dev 039, If 0, Class=Chip/SmartCard, Driver=usbfs, 12M

The USB path is 1-3:1.0.

This corresponds to bus 1, port 3, configuration 1 and interface 0. You can ignore the configuration and interface details for non-composite USB devices.

Connected to another USB port of the computer

$ ./get_usb_path.py
Using: Gemalto PC Twin Reader (70D7E2EE) 01 00
USB path: 1-6:1.0
 USB: bus: 1, addr: 40

$ lsusb -t
/:  Bus 001.Port 001: Dev 001, Class=root_hub, Driver=xhci_hcd/16p, 480M
    |__ Port 006: Dev 040, If 0, Class=Chip/SmartCard, Driver=usbfs, 12M

Note:

the Port changed from 003 to 006
the Dev changed from 039 to 040

Connected to a hub

$ ./get_usb_path.py
Using: Gemalto PC Twin Reader (70D7E2EE) 01 00
USB path: 1-3.1:1.0
 USB: bus: 1, addr: 42

$ lsusb -t
/:  Bus 001.Port 001: Dev 001, Class=root_hub, Driver=xhci_hcd/16p, 480M
    |__ Port 003: Dev 041, If 0, Class=Hub, Driver=hub/4p, 480M
        |__ Port 001: Dev 042, If 0, Class=Chip/SmartCard, Driver=usbfs, 12M

Note:

Port 003 is now used by the USB hub (Class=Hub)
the reader uses Port 001 of the hub
the USB path has one extra level 1-3.1:1.0

Connected to another port of the hub

$ ./get_usb_path.py
Using: Gemalto PC Twin Reader (70D7E2EE) 01 00
USB path: 1-3.4:1.0
 USB: bus: 1, addr: 43

$ lsusb -t
/:  Bus 001.Port 001: Dev 001, Class=root_hub, Driver=xhci_hcd/16p, 480M
    |__ Port 003: Dev 041, If 0, Class=Hub, Driver=hub/4p, 480M
        |__ Port 004: Dev 043, If 0, Class=Chip/SmartCard, Driver=usbfs, 12M

Note:

the reader is connected to Port 004 of the hub
the hub is still connected to Port 003

Conclusion

Not everyone will need or use this feature. However, it can be very important if you have a large number of readers.

Many Thanks to Diego de los Santos for the idea and implementation.

New version of libccid: 1.7.1

Ludovic Rousseau — Wed, 04 Feb 2026 16:09:03 GMT

I just released version 1.7.1 of libccid the Free Software CCID class smart card reader driver.

Changes:

1.7.1 - 4 February 2026, Ludovic Rousseau

Add support of
- ACS APG8201-B2
- BUDGET E-ID BUD001
- CHERRY Smart Board 1150
- CryptnoxCR CryptnoxCR
- Diebold Nixdorf PN7362au CCID
- FT BioPass FIDO2 Pro
- Nitrokey Nitrokey Passkey
Add SCARD_CTL_CODE(3601): USB path of the reader
Some other minor improvements

New version of libccid: 1.7.0

Ludovic Rousseau — Thu, 02 Oct 2025 13:25:24 GMT

I just released version 1.7.0 of libccid the Free Software CCID class smart card reader driver.

This version includes a udev rules file to modifies the group access rights of the CCID device (i.e. the file /dev/bus/usb/001/xyz) so that the pcscd process has read/write access without having to run as root. The change on pcsc-lite will be included in version 2.4.0 (coming soon).

Changes:

1.7.0 - 2 October 2025, Ludovic Rousseau

Add support of
- GIGA-TMS NFC CCID Reader
- Identiv Identiv SmartOS Reader
- SEC1210URT, single slot variant of SEC1210 serial
- TOKEN2 FIDO2 Security Key(0013),PIN+ Mini with OTP + PGP
- TOKEN2 FIDO2 Security Key(0014),PIN+ Mini with FIDO + PGP
- TOKEN2 FIDO2 Security Key(0015),PIN+ Mini with PGP
- TOKEN2 FIDO2 Security Key(0016),PIN+ Mini with OTP + PGP + FIDO
- TOKEN2 FIDO2 Security Key(0023),PIN+ Series with OTP + PGP
- TOKEN2 FIDO2 Security Key(0024),PIN+ Series with FIDO + PGP
- TOKEN2 FIDO2 Security Key(0025),PIN+ Series with PGP
- TOKEN2 FIDO2 Security Key(0203),Bio3 Dual with OTP + PGP
- TOKEN2 FIDO2 Security Key(0204),Bio3 Dual with FIDO + PGP
- TOKEN2 FIDO2 Security Key(0205),Bio3 Dual with PGP
- TOKEN2 FIDO2 Security Key(0206),Bio3 Dual with OTP + PGP + FIDO
- TOKEN2 Molto2 (older version)
- VIX TECHNOLOGY SECURE READER
Remove support of
- SIMHUB pcsc reader
Give pcscd group permission to CCID devices in udev rule
Avoid a timeout issue with the Thales Fusion NFC reader
Provide the option to synchronize the 2 interfaces of a SEC1210 (see Card state synchronisation on SEC1210 reader 2 interfaces)
Some other minor improvements

Pre-built parse binaries

Ludovic Rousseau — Wed, 25 Jun 2025 13:04:43 GMT

Since October 2023, I've been offering a simple way to check if a reader whether or not a reader complies with the CCID standard. See Check reader's compliance to CCID specification.

Parse tool

As early as the first version of my CCID driver, I provided a tool called parse to analyze the USB descriptor and see if a connected device is declared as a CCID devide (USB interface class = 11).

The parse tool is written in C and you have to build it from source code. This is not an easy task for non-developers.

Non-developers

For non developers, it wasn't easy. Hence the idea of providing pre-built versions of the parse tool.

I can't provide a binary for all possible systems (Unix, not just GNU/Linux).

I provide a binary version for:

Linux x86_64 (GNU/Linux on Intel/AMD 64 bits CPU)
Linux aarch64 (GNU/Linux on ARM 64 bits CPU)
Linux armv7l (GNU/Linux on for example on a Raspberry)
Darwin x86_64 (macOS on Intel 64 bits CPU)
Darwin arm64 (macOS on Apple M1, M2, etc. CPU)

You do not have to know what system or processor you have. Just use, in a terminal:

curl https://ccid.apdu.fr/files/parse.sh | bash -

Statistics

From last month's HTTP server logs, I get:

Architecture	#	%
Linux-x86_64	52	86.67 %
Darwin-x86_64	4	6.67 %
Linux-aarch64	4	6.67 %
Darwin-arm64	0	0 %
Linux-armv7l	0	0 %

Unsurprisingly, the majority of users are on a GNU/Linux system with an Intel/AMD 64-bits processor.

I am pleasantly surprised to see GNU/Linux systems on ARM processors.

Security

I understand that some people prefer to build a program from source code rather than run a binary retrieved from the Internet.

I also do not like using:

curl https://random.web.site/install_script.sh | bash -

This is why is is still possible to rebuild the parse binary from the source code.

Conclusion

It should (now) be easy to check if a USB smart card reader complies with hthe CCID standard.

If you are the product owner of a new smart card reader and don't have a GNU/Linux developer available to help you, this tool will allow you to send me the details as documented at Check reader's compliance to CCID specification.

I can then add your reader in the "Should work but untested by me" list. If you want to have your reader listed in the "Supported CCID readers/ICCD tokens" list, contact me.

In case of smart card issues on macOS

Ludovic Rousseau — Wed, 18 Jun 2025 11:34:25 GMT

If you have a problem with your smart card or smart card reader on macOS, the first step is to disable the CCID provided by Apple and enable my CCID driver.

Enable a good CCID driver

It is very simple. Just do, in a Terminal:

sudo defaults write /Library/Preferences/com.apple.security.smartcard useIFDCCID -bool yes

If the problem is solved then there is no need to report it to me.

You will find more information in Apple's own CCID driver in Sonoma.

Update of my CCID driver

In macOS Sonoma 14.0 Apple provided version 1.5.1 of my CCID driver (macOS Sonoma and smart cards status) whereas the current version was 1.5.2.

In macOS Sequoia 15.0 my CCID driver was still version 1.5.1 whereas the current version was 1.6.1 (macOS Sequoia and smart cards status).

If you want/need a version of my CCID driver newer than 1.5.1, or a custom installer for macOS, you can contact me.

Conclusion

An issue was reported recently (MacOS NFC reader issue for large APDUs) and activating my CCID driver solved the problem.

First step is to use a good CCID driver.

Card state synchronisation on SEC1210 reader 2 interfaces

Ludovic Rousseau — Sun, 04 May 2025 11:07:00 GMT

The next CCID driver (version 1.6.3 not yet released) will contain a custom code to change the behavior of the Microchip SEC1210 reader.

SEC1210 reader

The Microchip SEC1210 smart card reader is a chip that you can integrate in your hardware projects.

A development board is available.

The board has 2 CCID interfaces that are seen as 2 CCID readers at the USB level (it is a composite device). See the USB descriptor:

idVendor: 0x0424
 iManufacturer: SMSC
idProduct: 0x1202
 iProduct: SMSC USX101x Reader
bcdDevice: 2.22 (firmware release?)
bLength: 9
bDescriptorType: 4
bInterfaceNumber: 0
bAlternateSetting: 0
bNumEndpoints: 3
 bulk-IN, bulk-OUT and Interrupt-IN
bInterfaceClass: 0x0B [Chip Card Interface Device Class (CCID)]
[...]

idVendor: 0x0424
 iManufacturer: SMSC
idProduct: 0x1202
 iProduct: SMSC USX101x Reader
bcdDevice: 2.22 (firmware release?)
bLength: 9
bDescriptorType: 4
bInterfaceNumber: 1
bAlternateSetting: 0
bNumEndpoints: 2
 bulk-IN and bulk-OUT
bInterfaceClass: 0x0B [Chip Card Interface Device Class (CCID)]

The 2 interfaces have the same descriptor, except for:

bInterfaceNumber: 0 or 1
bNumEndpoints: 2 or 3

One interface provides the Interrupt-IN endpoint while the other interface does not. This means one interface will provide card movements notification on the interrupt pipe while the other interface will not.

In fact the 2nd interface does not support RDR_to_PC_NotifySlotChange but also does not support card presence using the CCID command PC_to_RDR_GetSlotStatus. The reader will always report a card is inserted even if no card is inserted.

This second interface is, in general, used with a SAM (Secure access module) that is rarely removed from the reader.

New use case

A user of this reader asked me to add the option of duplicating the card presence status of the 1st interface on the 2nd interface. The idea is to be able to insert or remove 2 cards from both interfaces at the same time.

The 2nd interface can then be used as a almost normal reader.

Custom code

The patch is visible at https://salsa.debian.org/rousseau/CCID/-/commit/4842c97561794acb7269dfcba21c877d42895a4e

The code is not active by default. You need to uncomment a line and rebuild the driver:

// Uncomment if you want to synchronize the card movements on the 2
// interfaces of the Microchip SEC 1210 reader
// #define SEC1210_SYNC

The code is a bit complex, as each interface is managed by a different pcsc-lite thread. The 2 threads are synchronized with a pthread_cond and share some states.

Conclusion

The 2 interfaces of the Microchip SEC1210 smart card reader can be used mostly as normal interfaces. The (industrial) user is happy.

If you need custom development of the CCID driver and/or pcsc-lite, please don't hesitate to contact me. See About me.

New version of libccid: 1.6.2

Ludovic Rousseau — Wed, 19 Mar 2025 16:45:24 GMT

I just released version 1.6.2 of libccid the Free Software CCID class smart card reader driver.

Changes:

1.6.2 - 19 March 2025, Ludovic Rousseau

Add support of
- Arculus AuthentiKey
- BHDC Reader-HHD02
- CHERRY Smart Terminal 1150
- HSIC CCID-Reader
- Ledger Flex
- SYC USB CCID Reader
- Thales RF CR2000
- TOKEN2 FIDO2 Security Key(0026)
Give more time to initialize the ACS ACR122U
Do not build examples and contrib by default
meson: add missing check for pthread_condattr_setclock
Don't assume that all notifications are NotifySlotChange
Hide unexported functions and variables
Some other minor improvements

New version of libccid: 1.6.1

Ludovic Rousseau — Fri, 05 Jul 2024 09:08:42 GMT

I just released version 1.6.1 of libccid the Free Software CCID class smart card reader driver.

Changes:

1.6.1 - 5 July 2024, Ludovic Rousseau

fix 'parse' build issues on some systems (pthread & strlcpy)
Some other minor improvements

CCID driver and Multiple Enabled Profiles (MEP)

Ludovic Rousseau — Wed, 05 Jun 2024 12:39:49 GMT

Some smartphones can handle 2 SIM cards. The smartphones now use eSIM (embedded SIM) instead of rSIM (removable SIM). It is still useful to have 2 subscriber configurations so the same eSIM should support two (or more) USIM applications.

Specification

From:

RSP Technical Specification
Version 3.0
19th October 2022
https://www.gsma.com/esim/resources/sgp-22-v3-0/

Chapter 2.12 Multiple Enabled Profiles, page 77:

This specification defines optional support of Multiple Enabled (MEP), where several Profiles can be in Enabled state. This enables a Device with more than one baseband to use more than one Profile at the same time for providing connectivity to different networks.

The multiplexing of the APDU streams to those Profiles on a single physical interface is specified in ETSI TS 102 221 (Smart Cards; UICC-Terminal interface; Release 17). This specification uses the term "eSIM Port" for what ETSI TS 102 221 calls a logical SE interface (LSI).

[...]

Several options for different features are defined for MEP:

APDU multiplexing can use any of the mechanisms defined in ETSI TS 102 221 [6], e.g.:

eSIM Port selection via the APDU MANAGE LSI (select LSI) when the transmission protocol T=0 or T=1 is used.

eSIM Port selection via the NAD byte when the transmission protocol T=1 is used.

Implementation

Reda ZAITI, from Thales, implemented the second mechanism: eSIM Port selection via the NAD byte. The original patch is simple: Add possibility to set/get NAD on T=1 for MEP.

This feature can be used to test eSIM chips using a standard smart card reader. The CCID driver must manage the T=1 protocol so only TPDU readers can be used.

The PC/SC workgroup does not define anything regarding MEP. So it was implemented using SCardControl() and the control code SCARD_CTL_CODE(3600).

Sample code

A sample code GetSetNAD.py is provided:

#! /usr/bin/env python3

"""
#   GetSetNAD.py: get/set NAD value
#   Copyright (C) 2022  Ludovic Rousseau
"""

#   This program is free software; you can redistribute it and/or modify
#   it under the terms of the GNU General Public License as published by
#   the Free Software Foundation; either version 3 of the License, or
#   (at your option) any later version.
#
#   This program is distributed in the hope that it will be useful,
#   but WITHOUT ANY WARRANTY; without even the implied warranty of
#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#   GNU General Public License for more details.
#
#   You should have received a copy of the GNU General Public License along
#   with this program; if not, see <http://www.gnu.org/licenses/>.

from smartcard.System import readers
from smartcard.pcsc.PCSCPart10 import SCARD_LEAVE_CARD, SCARD_CTL_CODE
from smartcard import Exceptions
from smartcard.util import toHexString


def get_nad(cardConnection):
    print("Get NAD")

    get_NAD = [0x3F, 0, 0]
    print(" command:", toHexString(get_NAD))
    res = cardConnection.control(SCARD_CTL_CODE(3600), get_NAD)
    print("  result:", toHexString(res))
    status = res[3]
    if status == 0:
        print("Success")
        nad = res[4]
        print("NAD:", nad)
    else:
        print("Failed!")


def set_nad(cardConnection, nad):
    print("Set NAD")

    set_NAD = [0x3E, 0, 1, nad]
    print(" command:", toHexString(set_NAD))
    res = cardConnection.control(SCARD_CTL_CODE(3600), set_NAD)
    print("  result:", toHexString(res))
    status = res[3]
    if status == 0:
        print("Success")
    else:
        print("Failed!")


if __name__ == "__main__":
    import sys

    reader_idx = 0
    if len(sys.argv) > 1:
        reader_idx = int(sys.argv[1])

    reader = readers()[reader_idx]
    print("Reader:", reader)

    cardConnection = reader.createConnection()
    cardConnection.connect(disposition=SCARD_LEAVE_CARD)

    get_nad(cardConnection)
    set_nad(cardConnection, 42)
    get_nad(cardConnection)

Output

 ./GetSetNAD.py 1
Reader: Gemalto PC Twin Reader 01 00
Get NAD
 command: 3F 00 00
  result: 3F 00 02 00 00
Success
NAD: 0
Set NAD
 command: 3E 00 01 2A
  result: 3E 00 01 00
Success
Get NAD
 command: 3F 00 00
  result: 3F 00 02 00 2A
Success
NAD: 42

Here the NAD is changed from the default value 0 to 42.

To enable the feature in the CCID driver you need to define ENABLE_MULTIPLE_ENABLED_PROFILES in the source code and rebuild + reinstall the driver.

It is NOT enabled by default because:

very few people will need it
it is too easy to create a Denial Of Service using the SCardControl() code and update the NAD value

Example of denial of service

Just after running the GetSetNAD.py program you can try to send an APDU to the smart card:

$ echo "00 00 00 00" | scriptor -r "Gemalto PC Twin Reader 01 00"
Using given card reader: Gemalto PC Twin Reader 01 00
Using T=1 protocol
Reading commands from STDIN
> 00 00 00 00
Can't get info: Transaction failed.

From pcscd logs you get:

00000004 [140363545183936] APDU: 00 00 00 00
00000005 [140363545183936] ../src/ifdhandler.c:1360:IFDHTransmitToICC() usb:08e6/3437:libudev:0:/dev/bus/usb/001/008 (lun: 10000)
00000004 [140363545183936] ../src/commands.c:2289:CmdXfrBlockTPDU_T1() T=1: 4 and 65548 bytes
00000004 [140363545183936] ../src/openct/proto-t1.c:599:t1_build() more bit: 0
00000005 [140363545183936] sending: 2A 40 04 00 00 00 00 6E
00000006 [140363545183936] -> 000001 6F 08 00 00 00 00 20 00 00 00 2A 40 04 00 00 00 00 6E
00002295 [140363545183936] <- 000001 80 04 00 00 00 00 20 00 00 00 00 92 00 92
00000016 [140363545183936] received: 00 92 00 92
00000004 [140363545183936] ../src/openct/proto-t1.c:242:t1_transceive() R-BLOCK required
00000004 [140363545183936] sending: 2A 92 00 B8
00000005 [140363545183936] -> 000001 6F 04 00 00 00 00 21 00 00 00 2A 92 00 B8
00002016 [140363545183936] <- 000001 80 04 00 00 00 00 21 00 00 00 00 92 00 92
00000012 [140363545183936] received: 00 92 00 92
00000004 [140363545183936] ../src/openct/proto-t1.c:242:t1_transceive() R-BLOCK required
00000003 [140363545183936] ../src/openct/proto-t1.c:250:t1_transceive() Rule 7.2
00000002 [140363545183936] sending: 2A 92 00 B8
00000005 [140363545183936] -> 000001 6F 04 00 00 00 00 22 00 00 00 2A 92 00 B8
01555310 [140363545183936] <- 000001 80 00 00 00 00 00 22 40 FE 00
00000020 [140363545183936] ../src/commands.c:1564:CCID_Receive Card absent or mute
00000006 [140363545183936] ../src/openct/proto-t1.c:234:t1_transceive() fatal: transmit/receive failed
00000004 [140363545183936] SW:
00000004 [140363545183936] ../src/ifdwrapper.c:543:IFDTransmit() Card not transacted: 612
00000003 [140363545183936] ../src/winscard.c:1622:SCardTransmit() Card not transacted: rv=SCARD_E_NOT_TRANSACTED
00000003 [140363545183936] ../src/winscard.c:1650:SCardTransmit() UnrefReader() count was: 2
00000005 [140363545183936] ../src/winscard_svc.c:719:ContextThread() TRANSMIT for client 15, rv=SCARD_E_NOT_TRANSACTED

You can see the NAD (node address byte) value (42 or 0x2A) in the first byte of the T=1 block sent by the driver to the reader. My smart card does not like this NAD value (it is not an eSIM with MEP support) and requests an R-Block before becoming mute.

Conclusion

Very few people will use this feature. I guess only developers of eSIM and testers/evaluators of eSIM will need this.

My driver is Free Software and was modified to add the feature. This is the beauty of Free Software.