-
-
Notifications
You must be signed in to change notification settings - Fork 396
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
thank you @YoshiRulz, well noted about GRUB format
- Loading branch information
1 parent
facc5e0
commit 735a66f
Showing
9 changed files
with
279 additions
and
146 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,57 +1,62 @@ | ||
System Bus Radio | ||
================== | ||
# System Bus Radio | ||
|
||
This program transmits radio on computers / phones without radio transmitting hardware. | ||
|
||
Thank you to our sponsors | ||
------------------ | ||
## Thank you to our sponsors | ||
|
||
<img src="https://radiostay.com/images/logo.svg" width=200> | ||
|
||
Listen to online radio - https://radiostay.com/ | ||
|
||
Listen to online radio - <https://radiostay.com/> | ||
|
||
## Why? | ||
|
||
Why? | ||
------------------ | ||
Some computers are intentionally disconnected from the rest of the world. This includes having their internet, wireless, bluetooth, USB, external file storage and audio capabilities removed. This is called "air gapping". Even in such a situation, this program can transmit radio. | ||
|
||
Publicly available documents already discuss exfiltration from secured systems using various electromagnetic radiations. This is documented in the TEMPEST guidelines published by the US National Security Agency and the US Department of Defense. This project simply adds to that discussion. | ||
|
||
How to use it | ||
------------------ | ||
**NEW:** Try it in your browser, click here: http://fulldecent.github.io/system-bus-radio/ | ||
## How to use it | ||
|
||
Enter the `Using _mm_stream_si128` folder and compile using `make`. (There are also other flavors you can `make` and try in different folders!) | ||
**NEW:** Try it in your browser, click here: <http://fulldecent.github.io/system-bus-radio/> | ||
|
||
make | ||
Enter the implementations folder, select any of them and compile using `make`. | ||
|
||
```sh | ||
make | ||
``` | ||
|
||
Run this using a 2015 model MacBook Air. Then use a Sony STR-K670P radio receiver with the included antenna and tune it to 1580 kHz on AM. | ||
|
||
Run it and reference the a tune file or make your own! | ||
|
||
```sh | ||
./main ../../tunes/mary_had_a_little_lamb.tune | ||
``` | ||
|
||
You should hear the "Mary Had a Little Lamb" tune playing repeatedly. Other equipment and tuning may work as well. On the equipment above, the author has achieved clear transmission over two meters of open air or one meter through drywall. Different results will be achievable with different equipment. | ||
|
||
Are you using an antenna? At the beginning, the author placed the antenna directly on top of the number 4 key and that worked best (on any AM frequency). It was a round antenna. Then once they knew it worked they moved the antenna back. Moving it back reduced the number of frequencies that it worked on, and eventually only that one (1580 kHz) worked. Different hardware will certainly have different frequency response. Here are some results that have been sent in by readers. Please mail [email protected] with your results (including makes and models of all equipment involved) or [edit this file directly](https://github.com/fulldecent/system-bus-radio/edit/master/TEST-DATA.tsv) and create a pull request. | ||
Are you using an antenna? At the beginning, the author placed the antenna directly on top of the number 4 key and that worked best (on any AM frequency). It was a round antenna. Then once they knew it worked they moved the antenna back. Moving it back reduced the number of frequencies that it worked on, and eventually only that one (1580 kHz) worked. Different hardware will certainly have different frequency response. Here are some results that have been sent in by readers. Please mail <[email protected]> with your results (including makes and models of all equipment involved) or [edit this file directly](https://github.com/fulldecent/system-bus-radio/edit/master/TEST-DATA.tsv) and create a pull request. | ||
|
||
**WANTED:** Please post your test results using Raspberry Pi and other embedded systems. This may be particularly good targets because of less shielding/hardening of their hardware. | ||
|
||
**NEW:** See our [basic RTL SDR guide] to receive system bus signals using another computer with RTL SDR hardware. | ||
|
||
Technical explanation | ||
------------------ | ||
## Technical explanation | ||
|
||
This program runs instructions on the computer that cause electromagnetic radiation. The emissions are of a broad frequency range. To be accepted by the radio, those frequencies must: | ||
|
||
* Be emitted by the computer processor and other subsystems | ||
* Escape the computer shielding | ||
* Pass through the air or other obstructions | ||
* Be accepted by the antenna | ||
* Be selected by the receiver | ||
* Be emitted by the computer processor and other subsystems | ||
* Escape the computer shielding | ||
* Pass through the air or other obstructions | ||
* Be accepted by the antenna | ||
* Be selected by the receiver | ||
|
||
By trial and error, the above frequency was found to be ideal for that equipment. | ||
|
||
The actual emissions are caused by the `_mm_stream_si128` instruction that writes through to a memory address. Inspiration for using this instruction was provided in: | ||
|
||
> Guri, M., Kachlon, A., Hasson, O., Kedma, G., Mirsky, Y. and Elovici, Y., 2015. GSMem: data exfiltration from air-gapped computers over GSM frequencies. In 24th USENIX Security Symposium (USENIX Security 15) (pp. 849-864). | ||
> | ||
> https://www.usenix.org/node/190937 | ||
> <https://www.usenix.org/node/190937> | ||
Please note that replacing `_mm_stream_si128` with a simple `x++;` will work too. The author's experience has been that `_mm_stream_si128` produces a stronger signal. There may be other ideas that work even better, and it would be nice to improve this method to be more portable (not require SSE extensions). | ||
|
||
|
@@ -71,39 +76,39 @@ Notes on high precision time APIs: | |
|
||
* Get current time | ||
* mach_absolute_time() gives time in int64_t of nanoseconds | ||
* Converting to nanoseconds https://developer.apple.com/library/mac/qa/qa1398/_index.html | ||
* Declared https://opensource.apple.com/source/xnu/xnu-1456.1.26/osfmk/mach/mach_time.h | ||
* Definition https://opensource.apple.com/source/Libc/Libc-320/i386/mach/mach_absolute_time.c | ||
* Converting to nanoseconds <https://developer.apple.com/library/mac/qa/qa1398/_index.html> | ||
* Declared <https://opensource.apple.com/source/xnu/xnu-1456.1.26/osfmk/mach/mach_time.h> | ||
* Definition <https://opensource.apple.com/source/Libc/Libc-320/i386/mach/mach_absolute_time.c> | ||
* clock_get_time() gives a mach_timespec_t time | ||
* Called from mach_absolute_time() | ||
* mach_timespec_t | ||
* Type documentation https://developer.apple.com/library/mac/documentation/Darwin/Conceptual/KernelProgramming/services/services.html | ||
* Declaration https://opensource.apple.com/source/xnu/xnu-1456.1.26/osfmk/mach/clock_types.h | ||
* http://stackoverflow.com/a/21352348/300224 | ||
* https://stackoverflow.com/questions/5167269/clock-gettime-alternative-in-mac-os-x | ||
* Type documentation <https://developer.apple.com/library/mac/documentation/Darwin/Conceptual/KernelProgramming/services/services.html> | ||
* Declaration <https://opensource.apple.com/source/xnu/xnu-1456.1.26/osfmk/mach/clock_types.h> | ||
* <http://stackoverflow.com/a/21352348/300224> | ||
* <https://stackoverflow.com/questions/5167269/clock-gettime-alternative-in-mac-os-x> | ||
* Sleep | ||
* mach_wait_until() | ||
* Notes https://developer.apple.com/library/ios/technotes/tn2169/_index.html | ||
* Notes <https://developer.apple.com/library/ios/technotes/tn2169/_index.html> | ||
* nanosleep() | ||
* Apple doc https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man2/nanosleep.2.html | ||
* Definition https://opensource.apple.com/source/Libc/Libc-320.1.3/gen/nanosleep.c?txt | ||
* Apple doc <https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man2/nanosleep.2.html> | ||
* Definition <https://opensource.apple.com/source/Libc/Libc-320.1.3/gen/nanosleep.c?txt> | ||
* clock_sleep_trap() | ||
* Used from nanosleep() | ||
* Declared https://opensource.apple.com/source/xnu/xnu-1456.1.26/osfmk/mach/mach_traps.h | ||
* Definition http://unix.superglobalmegacorp.com/xnu/newsrc/osfmk/kern/clock.c.html | ||
* Declared <https://opensource.apple.com/source/xnu/xnu-1456.1.26/osfmk/mach/mach_traps.h> | ||
* Definition <http://unix.superglobalmegacorp.com/xnu/newsrc/osfmk/kern/clock.c.html> | ||
* Uses clock_sleep_internal() | ||
* Uses ADD_MACH_TIMESPEC | ||
* clock type constants https://opensource.apple.com/source/xnu/xnu-1456.1.26/osfmk/mach/clock_types.h?txt | ||
* clock type constants <https://opensource.apple.com/source/xnu/xnu-1456.1.26/osfmk/mach/clock_types.h?txt> | ||
* TIME_ABSOLUTE | ||
* TIME_RELATIVE | ||
* Defines ADD_MACH_TIMESPEC(t1, t2) // t1 += t2 | ||
* Defines CMP_MACH_TIMESPEC(t1, t2) // t1 <=> t2, also (t1 - t2) in nsec with max of +- 1 sec | ||
* msleep() https://developer.apple.com/library/mac/documentation/Darwin/Conceptual/KernelProgramming/services/services.html | ||
* time/timer.c / http://lxr.free-electrons.com/source/kernel/time/timer.c#L1673 | ||
* kern/clock.h https://opensource.apple.com/source/xnu/xnu-1456.1.26/osfmk/kern/clock.h | ||
* msleep() <https://developer.apple.com/library/mac/documentation/Darwin/Conceptual/KernelProgramming/services/services.html> | ||
* time/timer.c / <http://lxr.free-electrons.com/source/kernel/time/timer.c#L1673> | ||
* kern/clock.h <https://opensource.apple.com/source/xnu/xnu-1456.1.26/osfmk/kern/clock.h> | ||
|
||
Press coverage | ||
## Press coverage | ||
|
||
* http://hardware.slashdot.org/story/16/03/01/1727226/microcasting-color-tv-by-abusing-a-wi-fi-chip | ||
* http://news.softpedia.com/news/emitting-radio-waves-from-a-computer-with-no-radio-transmitting-hardware-501260.shtml | ||
* https://tenwatts.blogspot.com/2018/01/system-bus-radio.html | ||
* <https://hardware.slashdot.org/story/16/03/01/1727226/microcasting-color-tv-by-abusing-a-wi-fi-chip> | ||
* <https://news.softpedia.com/news/emitting-radio-waves-from-a-computer-with-no-radio-transmitting-hardware-501260.shtml> | ||
* <https://tenwatts.blogspot.com/2018/01/system-bus-radio.html> |
This file was deleted.
Oops, something went wrong.
File renamed without changes.
File renamed without changes.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,8 @@ | ||
CPPFLAGS=-Wall -O2 | ||
|
||
main: main.c | ||
|
||
.PHONY: clean | ||
|
||
clean: | ||
rm -f main |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,123 @@ | ||
#include <stdio.h> | ||
#include <stdlib.h> | ||
#include <stdint.h> | ||
#include <inttypes.h> | ||
#include <arm_neon.h> | ||
#include <time.h> | ||
#include <string.h> | ||
#include <mach/mach_time.h> | ||
#include <pthread.h> | ||
|
||
#define NUM_THREADS 24 // Number of threads (adjust to your needs) | ||
// Define a large array to perform cache-busting operations | ||
#define ARRAY_SIZE (1024 * 1024 * 16) // 16 MB | ||
|
||
uint8_t data_array[ARRAY_SIZE] __attribute__((aligned(16))); | ||
|
||
// Timebase info for converting between Mach time units and nanoseconds | ||
static mach_timebase_info_data_t timebase_info; | ||
|
||
// Thread function to perform high bus activity with NEON intrinsics | ||
void* thread_high_bus_activity_neon(void* arg) { | ||
size_t start = (size_t)arg; | ||
size_t segment_size = ARRAY_SIZE / NUM_THREADS; | ||
|
||
uint8x16_t vec_zero = vdupq_n_u8(0); // 128-bit register filled with 0x00 | ||
uint8x16_t vec_one = vdupq_n_u8(0xFF); // 128-bit register filled with 0xFF | ||
|
||
for (size_t i = start; i < start + segment_size; i += 16) { | ||
// Introduce a random access pattern to increase cache miss rate | ||
size_t random_offset = (rand() % (segment_size / 16)) * 16; | ||
|
||
// Use NEON stores with random offset within the segment | ||
vst1q_u8(&data_array[random_offset], vec_one); | ||
vst1q_u8(&data_array[random_offset], vec_zero); | ||
} | ||
|
||
return NULL; | ||
} | ||
|
||
// Function to perform high bus activity across multiple threads | ||
void perform_high_bus_activity(void) { | ||
pthread_t threads[NUM_THREADS]; | ||
|
||
// Create NUM_THREADS threads to spread the workload across the memory array | ||
for (int i = 0; i < NUM_THREADS; i++) { | ||
size_t start = i * (ARRAY_SIZE / NUM_THREADS); | ||
pthread_create(&threads[i], NULL, thread_high_bus_activity_neon, (void*)start); | ||
} | ||
|
||
// Wait for all threads to complete | ||
for (int i = 0; i < NUM_THREADS; i++) { | ||
pthread_join(threads[i], NULL); | ||
} | ||
} | ||
|
||
static inline void square_am_signal(uint64_t time_ms, uint64_t freq_hz) { | ||
uint64_t start = mach_absolute_time(); | ||
uint64_t end = start + time_ms * 1000000 * timebase_info.denom / timebase_info.numer; | ||
|
||
if (freq_hz == 0) { | ||
// If frequency is 0, perform silence by sleeping for the entire duration | ||
mach_wait_until(end); | ||
return; | ||
} | ||
|
||
// Calculate the period for non-zero frequency | ||
uint64_t period = 1000000000 / freq_hz * timebase_info.denom / timebase_info.numer; | ||
|
||
while (mach_absolute_time() < end) { | ||
uint64_t mid = start + period / 2; | ||
uint64_t next_period = start + period; | ||
|
||
// High activity phase | ||
while (mach_absolute_time() < mid) { | ||
perform_high_bus_activity(); | ||
} | ||
|
||
// Sleep until the next period to modulate the signal | ||
mach_wait_until(next_period); | ||
start = next_period; | ||
} | ||
} | ||
|
||
int main(int argc, char* argv[]) { | ||
// Initialize the timebase info | ||
mach_timebase_info(&timebase_info); | ||
|
||
// Seed the random number generator | ||
srand(time(NULL)); | ||
|
||
if (argc != 2) { | ||
fprintf(stderr, "No song file given!\nUsage: %s file.song\n", argv[0]); | ||
return(1); | ||
} | ||
|
||
FILE* fp = fopen(argv[1], "r"); | ||
if (!fp) { | ||
perror("fopen"); | ||
return(EXIT_FAILURE); | ||
} | ||
|
||
char buffer[64]; | ||
int time_ms, freq_hz; | ||
|
||
while (1) { | ||
if (!fgets(buffer, sizeof(buffer), fp)) { | ||
if (feof(fp)) { | ||
rewind(fp); | ||
continue; | ||
} else { | ||
perror("fgets"); | ||
break; | ||
} | ||
} | ||
|
||
if (sscanf(buffer, "%d %d", &time_ms, &freq_hz) == 2) { | ||
square_am_signal(time_ms, freq_hz); | ||
} | ||
} | ||
|
||
fclose(fp); | ||
return 0; | ||
} |
File renamed without changes.
Oops, something went wrong.