How to get new password from change password scenario in custom credential provider

Question

I am doing a custom wrapped credential provider. In that i need to get the 'new password' field string from change password scenario. As far as I learnt, after user submits from the change password scenario, GetSerialization function in my credential provider is called and there i should be able to get values of the fields that the user has submitted. But I dont know exactly how to get it. I went through all over google and stack overflow but not able to get exactly what i need. Any help would be greatly appreciated.

HRESULT CSampleCredential::GetSerialization(
    CREDENTIAL_PROVIDER_GET_SERIALIZATION_RESPONSE* pcpgsr,
    CREDENTIAL_PROVIDER_CREDENTIAL_SERIALIZATION* pcpcs, 
    PWSTR* ppwszOptionalStatusText, 
    CREDENTIAL_PROVIDER_STATUS_ICON* pcpsiOptionalStatusIcon
    )
 {
HRESULT hr = E_UNEXPECTED;


if (_pWrappedCredential != NULL)
{
    hr = _pWrappedCredential->GetSerialization(pcpgsr, pcpcs,         ppwszOptionalStatusText, pcpsiOptionalStatusIcon);
}

logger->log(NORMAL,L"****************GetSerialisation**************\n");

 return hr;
}

I'm getting the log "*******Get Serialization******" whenever user submits the logon/unlock form or change password form. There should be some way with that I can get the values of the fields(I'm interested in new password field). Either there should be some field id (so far i could not find one) with which i can access those values, or those values should be stored in some buffer which i should access and get the values or some other thing like that.

Answer 1

The wrapped Credential serializes the new password into the CREDENTIAL_PROVIDER_CREDENTIAL_SERIALIZATION structure ready to be returned to Winlogon to present to the LSA. You can deserialize this structure using the CredUnPackAuthenticationBuffer function - and this will reveal what the new password is.