Skip to content

Commit 735a66f

Browse files
committed
use standard tune format, fixes #28
thank you @YoshiRulz, well noted about GRUB format
1 parent facc5e0 commit 735a66f

File tree

9 files changed

+279
-146
lines changed

9 files changed

+279
-146
lines changed

README.md

+47-42
Original file line numberDiff line numberDiff line change
@@ -1,57 +1,62 @@
1-
System Bus Radio
2-
==================
1+
# System Bus Radio
2+
33
This program transmits radio on computers / phones without radio transmitting hardware.
44

5-
Thank you to our sponsors
6-
------------------
5+
## Thank you to our sponsors
76

87
<img src="https://radiostay.com/images/logo.svg" width=200>
98

10-
Listen to online radio - https://radiostay.com/
11-
9+
Listen to online radio - <https://radiostay.com/>
1210

11+
## Why?
1312

14-
Why?
15-
------------------
1613
Some computers are intentionally disconnected from the rest of the world. This includes having their internet, wireless, bluetooth, USB, external file storage and audio capabilities removed. This is called "air gapping". Even in such a situation, this program can transmit radio.
1714

1815
Publicly available documents already discuss exfiltration from secured systems using various electromagnetic radiations. This is documented in the TEMPEST guidelines published by the US National Security Agency and the US Department of Defense. This project simply adds to that discussion.
1916

20-
How to use it
21-
------------------
22-
**NEW:** Try it in your browser, click here: http://fulldecent.github.io/system-bus-radio/
17+
## How to use it
2318

24-
Enter the `Using _mm_stream_si128` folder and compile using `make`. (There are also other flavors you can `make` and try in different folders!)
19+
**NEW:** Try it in your browser, click here: <http://fulldecent.github.io/system-bus-radio/>
2520

26-
make
21+
Enter the implementations folder, select any of them and compile using `make`.
22+
23+
```sh
24+
make
25+
```
2726

2827
Run this using a 2015 model MacBook Air. Then use a Sony STR-K670P radio receiver with the included antenna and tune it to 1580 kHz on AM.
2928

29+
Run it and reference the a tune file or make your own!
30+
31+
```sh
32+
./main ../../tunes/mary_had_a_little_lamb.tune
33+
```
34+
3035
You should hear the "Mary Had a Little Lamb" tune playing repeatedly. Other equipment and tuning may work as well. On the equipment above, the author has achieved clear transmission over two meters of open air or one meter through drywall. Different results will be achievable with different equipment.
3136

32-
Are you using an antenna? At the beginning, the author placed the antenna directly on top of the number 4 key and that worked best (on any AM frequency). It was a round antenna. Then once they knew it worked they moved the antenna back. Moving it back reduced the number of frequencies that it worked on, and eventually only that one (1580 kHz) worked. Different hardware will certainly have different frequency response. Here are some results that have been sent in by readers. Please mail [email protected] with your results (including makes and models of all equipment involved) or [edit this file directly](https://github.com/fulldecent/system-bus-radio/edit/master/TEST-DATA.tsv) and create a pull request.
37+
Are you using an antenna? At the beginning, the author placed the antenna directly on top of the number 4 key and that worked best (on any AM frequency). It was a round antenna. Then once they knew it worked they moved the antenna back. Moving it back reduced the number of frequencies that it worked on, and eventually only that one (1580 kHz) worked. Different hardware will certainly have different frequency response. Here are some results that have been sent in by readers. Please mail <[email protected]> with your results (including makes and models of all equipment involved) or [edit this file directly](https://github.com/fulldecent/system-bus-radio/edit/master/TEST-DATA.tsv) and create a pull request.
3338

3439
**WANTED:** Please post your test results using Raspberry Pi and other embedded systems. This may be particularly good targets because of less shielding/hardening of their hardware.
3540

3641
**NEW:** See our [basic RTL SDR guide] to receive system bus signals using another computer with RTL SDR hardware.
3742

38-
Technical explanation
39-
------------------
43+
## Technical explanation
44+
4045
This program runs instructions on the computer that cause electromagnetic radiation. The emissions are of a broad frequency range. To be accepted by the radio, those frequencies must:
4146

42-
* Be emitted by the computer processor and other subsystems
43-
* Escape the computer shielding
44-
* Pass through the air or other obstructions
45-
* Be accepted by the antenna
46-
* Be selected by the receiver
47+
* Be emitted by the computer processor and other subsystems
48+
* Escape the computer shielding
49+
* Pass through the air or other obstructions
50+
* Be accepted by the antenna
51+
* Be selected by the receiver
4752

4853
By trial and error, the above frequency was found to be ideal for that equipment.
4954

5055
The actual emissions are caused by the `_mm_stream_si128` instruction that writes through to a memory address. Inspiration for using this instruction was provided in:
5156

5257
> Guri, M., Kachlon, A., Hasson, O., Kedma, G., Mirsky, Y. and Elovici, Y., 2015. GSMem: data exfiltration from air-gapped computers over GSM frequencies. In 24th USENIX Security Symposium (USENIX Security 15) (pp. 849-864).
5358
>
54-
> https://www.usenix.org/node/190937
59+
> <https://www.usenix.org/node/190937>
5560
5661
Please note that replacing `_mm_stream_si128` with a simple `x++;` will work too. The author's experience has been that `_mm_stream_si128` produces a stronger signal. There may be other ideas that work even better, and it would be nice to improve this method to be more portable (not require SSE extensions).
5762

@@ -71,39 +76,39 @@ Notes on high precision time APIs:
7176

7277
* Get current time
7378
* mach_absolute_time() gives time in int64_t of nanoseconds
74-
* Converting to nanoseconds https://developer.apple.com/library/mac/qa/qa1398/_index.html
75-
* Declared https://opensource.apple.com/source/xnu/xnu-1456.1.26/osfmk/mach/mach_time.h
76-
* Definition https://opensource.apple.com/source/Libc/Libc-320/i386/mach/mach_absolute_time.c
79+
* Converting to nanoseconds <https://developer.apple.com/library/mac/qa/qa1398/_index.html>
80+
* Declared <https://opensource.apple.com/source/xnu/xnu-1456.1.26/osfmk/mach/mach_time.h>
81+
* Definition <https://opensource.apple.com/source/Libc/Libc-320/i386/mach/mach_absolute_time.c>
7782
* clock_get_time() gives a mach_timespec_t time
7883
* Called from mach_absolute_time()
7984
* mach_timespec_t
80-
* Type documentation https://developer.apple.com/library/mac/documentation/Darwin/Conceptual/KernelProgramming/services/services.html
81-
* Declaration https://opensource.apple.com/source/xnu/xnu-1456.1.26/osfmk/mach/clock_types.h
82-
* http://stackoverflow.com/a/21352348/300224
83-
* https://stackoverflow.com/questions/5167269/clock-gettime-alternative-in-mac-os-x
85+
* Type documentation <https://developer.apple.com/library/mac/documentation/Darwin/Conceptual/KernelProgramming/services/services.html>
86+
* Declaration <https://opensource.apple.com/source/xnu/xnu-1456.1.26/osfmk/mach/clock_types.h>
87+
* <http://stackoverflow.com/a/21352348/300224>
88+
* <https://stackoverflow.com/questions/5167269/clock-gettime-alternative-in-mac-os-x>
8489
* Sleep
8590
* mach_wait_until()
86-
* Notes https://developer.apple.com/library/ios/technotes/tn2169/_index.html
91+
* Notes <https://developer.apple.com/library/ios/technotes/tn2169/_index.html>
8792
* nanosleep()
88-
* Apple doc https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man2/nanosleep.2.html
89-
* Definition https://opensource.apple.com/source/Libc/Libc-320.1.3/gen/nanosleep.c?txt
93+
* Apple doc <https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man2/nanosleep.2.html>
94+
* Definition <https://opensource.apple.com/source/Libc/Libc-320.1.3/gen/nanosleep.c?txt>
9095
* clock_sleep_trap()
9196
* Used from nanosleep()
92-
* Declared https://opensource.apple.com/source/xnu/xnu-1456.1.26/osfmk/mach/mach_traps.h
93-
* Definition http://unix.superglobalmegacorp.com/xnu/newsrc/osfmk/kern/clock.c.html
97+
* Declared <https://opensource.apple.com/source/xnu/xnu-1456.1.26/osfmk/mach/mach_traps.h>
98+
* Definition <http://unix.superglobalmegacorp.com/xnu/newsrc/osfmk/kern/clock.c.html>
9499
* Uses clock_sleep_internal()
95100
* Uses ADD_MACH_TIMESPEC
96-
* clock type constants https://opensource.apple.com/source/xnu/xnu-1456.1.26/osfmk/mach/clock_types.h?txt
101+
* clock type constants <https://opensource.apple.com/source/xnu/xnu-1456.1.26/osfmk/mach/clock_types.h?txt>
97102
* TIME_ABSOLUTE
98103
* TIME_RELATIVE
99104
* Defines ADD_MACH_TIMESPEC(t1, t2) // t1 += t2
100105
* Defines CMP_MACH_TIMESPEC(t1, t2) // t1 <=> t2, also (t1 - t2) in nsec with max of +- 1 sec
101-
* msleep() https://developer.apple.com/library/mac/documentation/Darwin/Conceptual/KernelProgramming/services/services.html
102-
* time/timer.c / http://lxr.free-electrons.com/source/kernel/time/timer.c#L1673
103-
* kern/clock.h https://opensource.apple.com/source/xnu/xnu-1456.1.26/osfmk/kern/clock.h
106+
* msleep() <https://developer.apple.com/library/mac/documentation/Darwin/Conceptual/KernelProgramming/services/services.html>
107+
* time/timer.c / <http://lxr.free-electrons.com/source/kernel/time/timer.c#L1673>
108+
* kern/clock.h <https://opensource.apple.com/source/xnu/xnu-1456.1.26/osfmk/kern/clock.h>
104109

105-
Press coverage
110+
## Press coverage
106111

107-
* http://hardware.slashdot.org/story/16/03/01/1727226/microcasting-color-tv-by-abusing-a-wi-fi-chip
108-
* http://news.softpedia.com/news/emitting-radio-waves-from-a-computer-with-no-radio-transmitting-hardware-501260.shtml
109-
* https://tenwatts.blogspot.com/2018/01/system-bus-radio.html
112+
* <https://hardware.slashdot.org/story/16/03/01/1727226/microcasting-color-tv-by-abusing-a-wi-fi-chip>
113+
* <https://news.softpedia.com/news/emitting-radio-waves-from-a-computer-with-no-radio-transmitting-hardware-501260.shtml>
114+
* <https://tenwatts.blogspot.com/2018/01/system-bus-radio.html>

Using counter and threads/main.cpp

-103
This file was deleted.
+8
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
CPPFLAGS=-Wall -O2
2+
3+
main: main.c
4+
5+
.PHONY: clean
6+
7+
clean:
8+
rm -f main

implementations/c-neon-threads/main.c

+123
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,123 @@
1+
#include <stdio.h>
2+
#include <stdlib.h>
3+
#include <stdint.h>
4+
#include <inttypes.h>
5+
#include <arm_neon.h>
6+
#include <time.h>
7+
#include <string.h>
8+
#include <mach/mach_time.h>
9+
#include <pthread.h>
10+
11+
#define NUM_THREADS 24 // Number of threads (adjust to your needs)
12+
// Define a large array to perform cache-busting operations
13+
#define ARRAY_SIZE (1024 * 1024 * 16) // 16 MB
14+
15+
uint8_t data_array[ARRAY_SIZE] __attribute__((aligned(16)));
16+
17+
// Timebase info for converting between Mach time units and nanoseconds
18+
static mach_timebase_info_data_t timebase_info;
19+
20+
// Thread function to perform high bus activity with NEON intrinsics
21+
void* thread_high_bus_activity_neon(void* arg) {
22+
size_t start = (size_t)arg;
23+
size_t segment_size = ARRAY_SIZE / NUM_THREADS;
24+
25+
uint8x16_t vec_zero = vdupq_n_u8(0); // 128-bit register filled with 0x00
26+
uint8x16_t vec_one = vdupq_n_u8(0xFF); // 128-bit register filled with 0xFF
27+
28+
for (size_t i = start; i < start + segment_size; i += 16) {
29+
// Introduce a random access pattern to increase cache miss rate
30+
size_t random_offset = (rand() % (segment_size / 16)) * 16;
31+
32+
// Use NEON stores with random offset within the segment
33+
vst1q_u8(&data_array[random_offset], vec_one);
34+
vst1q_u8(&data_array[random_offset], vec_zero);
35+
}
36+
37+
return NULL;
38+
}
39+
40+
// Function to perform high bus activity across multiple threads
41+
void perform_high_bus_activity(void) {
42+
pthread_t threads[NUM_THREADS];
43+
44+
// Create NUM_THREADS threads to spread the workload across the memory array
45+
for (int i = 0; i < NUM_THREADS; i++) {
46+
size_t start = i * (ARRAY_SIZE / NUM_THREADS);
47+
pthread_create(&threads[i], NULL, thread_high_bus_activity_neon, (void*)start);
48+
}
49+
50+
// Wait for all threads to complete
51+
for (int i = 0; i < NUM_THREADS; i++) {
52+
pthread_join(threads[i], NULL);
53+
}
54+
}
55+
56+
static inline void square_am_signal(uint64_t time_ms, uint64_t freq_hz) {
57+
uint64_t start = mach_absolute_time();
58+
uint64_t end = start + time_ms * 1000000 * timebase_info.denom / timebase_info.numer;
59+
60+
if (freq_hz == 0) {
61+
// If frequency is 0, perform silence by sleeping for the entire duration
62+
mach_wait_until(end);
63+
return;
64+
}
65+
66+
// Calculate the period for non-zero frequency
67+
uint64_t period = 1000000000 / freq_hz * timebase_info.denom / timebase_info.numer;
68+
69+
while (mach_absolute_time() < end) {
70+
uint64_t mid = start + period / 2;
71+
uint64_t next_period = start + period;
72+
73+
// High activity phase
74+
while (mach_absolute_time() < mid) {
75+
perform_high_bus_activity();
76+
}
77+
78+
// Sleep until the next period to modulate the signal
79+
mach_wait_until(next_period);
80+
start = next_period;
81+
}
82+
}
83+
84+
int main(int argc, char* argv[]) {
85+
// Initialize the timebase info
86+
mach_timebase_info(&timebase_info);
87+
88+
// Seed the random number generator
89+
srand(time(NULL));
90+
91+
if (argc != 2) {
92+
fprintf(stderr, "No song file given!\nUsage: %s file.song\n", argv[0]);
93+
return(1);
94+
}
95+
96+
FILE* fp = fopen(argv[1], "r");
97+
if (!fp) {
98+
perror("fopen");
99+
return(EXIT_FAILURE);
100+
}
101+
102+
char buffer[64];
103+
int time_ms, freq_hz;
104+
105+
while (1) {
106+
if (!fgets(buffer, sizeof(buffer), fp)) {
107+
if (feof(fp)) {
108+
rewind(fp);
109+
continue;
110+
} else {
111+
perror("fgets");
112+
break;
113+
}
114+
}
115+
116+
if (sscanf(buffer, "%d %d", &time_ms, &freq_hz) == 2) {
117+
square_am_signal(time_ms, freq_hz);
118+
}
119+
}
120+
121+
fclose(fp);
122+
return 0;
123+
}

0 commit comments

Comments
 (0)