Skip to content

Commit

Permalink
use standard tune format, fixes #28
Browse files Browse the repository at this point in the history
thank you @YoshiRulz, well noted about GRUB format
  • Loading branch information
fulldecent committed Sep 24, 2024
1 parent facc5e0 commit 735a66f
Show file tree
Hide file tree
Showing 9 changed files with 279 additions and 146 deletions.
89 changes: 47 additions & 42 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,57 +1,62 @@
System Bus Radio
==================
# System Bus Radio

This program transmits radio on computers / phones without radio transmitting hardware.

Thank you to our sponsors
------------------
## Thank you to our sponsors

<img src="https://radiostay.com/images/logo.svg" width=200>

Listen to online radio - https://radiostay.com/

Listen to online radio - <https://radiostay.com/>

## Why?

Why?
------------------
Some computers are intentionally disconnected from the rest of the world. This includes having their internet, wireless, bluetooth, USB, external file storage and audio capabilities removed. This is called "air gapping". Even in such a situation, this program can transmit radio.

Publicly available documents already discuss exfiltration from secured systems using various electromagnetic radiations. This is documented in the TEMPEST guidelines published by the US National Security Agency and the US Department of Defense. This project simply adds to that discussion.

How to use it
------------------
**NEW:** Try it in your browser, click here: http://fulldecent.github.io/system-bus-radio/
## How to use it

Enter the `Using _mm_stream_si128` folder and compile using `make`. (There are also other flavors you can `make` and try in different folders!)
**NEW:** Try it in your browser, click here: <http://fulldecent.github.io/system-bus-radio/>

make
Enter the implementations folder, select any of them and compile using `make`.

```sh
make
```

Run this using a 2015 model MacBook Air. Then use a Sony STR-K670P radio receiver with the included antenna and tune it to 1580 kHz on AM.

Run it and reference the a tune file or make your own!

```sh
./main ../../tunes/mary_had_a_little_lamb.tune
```

You should hear the "Mary Had a Little Lamb" tune playing repeatedly. Other equipment and tuning may work as well. On the equipment above, the author has achieved clear transmission over two meters of open air or one meter through drywall. Different results will be achievable with different equipment.

Are you using an antenna? At the beginning, the author placed the antenna directly on top of the number 4 key and that worked best (on any AM frequency). It was a round antenna. Then once they knew it worked they moved the antenna back. Moving it back reduced the number of frequencies that it worked on, and eventually only that one (1580 kHz) worked. Different hardware will certainly have different frequency response. Here are some results that have been sent in by readers. Please mail [email protected] with your results (including makes and models of all equipment involved) or [edit this file directly](https://github.com/fulldecent/system-bus-radio/edit/master/TEST-DATA.tsv) and create a pull request.
Are you using an antenna? At the beginning, the author placed the antenna directly on top of the number 4 key and that worked best (on any AM frequency). It was a round antenna. Then once they knew it worked they moved the antenna back. Moving it back reduced the number of frequencies that it worked on, and eventually only that one (1580 kHz) worked. Different hardware will certainly have different frequency response. Here are some results that have been sent in by readers. Please mail <[email protected]> with your results (including makes and models of all equipment involved) or [edit this file directly](https://github.com/fulldecent/system-bus-radio/edit/master/TEST-DATA.tsv) and create a pull request.

**WANTED:** Please post your test results using Raspberry Pi and other embedded systems. This may be particularly good targets because of less shielding/hardening of their hardware.

**NEW:** See our [basic RTL SDR guide] to receive system bus signals using another computer with RTL SDR hardware.

Technical explanation
------------------
## Technical explanation

This program runs instructions on the computer that cause electromagnetic radiation. The emissions are of a broad frequency range. To be accepted by the radio, those frequencies must:

* Be emitted by the computer processor and other subsystems
* Escape the computer shielding
* Pass through the air or other obstructions
* Be accepted by the antenna
* Be selected by the receiver
* Be emitted by the computer processor and other subsystems
* Escape the computer shielding
* Pass through the air or other obstructions
* Be accepted by the antenna
* Be selected by the receiver

By trial and error, the above frequency was found to be ideal for that equipment.

The actual emissions are caused by the `_mm_stream_si128` instruction that writes through to a memory address. Inspiration for using this instruction was provided in:

> Guri, M., Kachlon, A., Hasson, O., Kedma, G., Mirsky, Y. and Elovici, Y., 2015. GSMem: data exfiltration from air-gapped computers over GSM frequencies. In 24th USENIX Security Symposium (USENIX Security 15) (pp. 849-864).
>
> https://www.usenix.org/node/190937
> <https://www.usenix.org/node/190937>
Please note that replacing `_mm_stream_si128` with a simple `x++;` will work too. The author's experience has been that `_mm_stream_si128` produces a stronger signal. There may be other ideas that work even better, and it would be nice to improve this method to be more portable (not require SSE extensions).

Expand All @@ -71,39 +76,39 @@ Notes on high precision time APIs:

* Get current time
* mach_absolute_time() gives time in int64_t of nanoseconds
* Converting to nanoseconds https://developer.apple.com/library/mac/qa/qa1398/_index.html
* Declared https://opensource.apple.com/source/xnu/xnu-1456.1.26/osfmk/mach/mach_time.h
* Definition https://opensource.apple.com/source/Libc/Libc-320/i386/mach/mach_absolute_time.c
* Converting to nanoseconds <https://developer.apple.com/library/mac/qa/qa1398/_index.html>
* Declared <https://opensource.apple.com/source/xnu/xnu-1456.1.26/osfmk/mach/mach_time.h>
* Definition <https://opensource.apple.com/source/Libc/Libc-320/i386/mach/mach_absolute_time.c>
* clock_get_time() gives a mach_timespec_t time
* Called from mach_absolute_time()
* mach_timespec_t
* Type documentation https://developer.apple.com/library/mac/documentation/Darwin/Conceptual/KernelProgramming/services/services.html
* Declaration https://opensource.apple.com/source/xnu/xnu-1456.1.26/osfmk/mach/clock_types.h
* http://stackoverflow.com/a/21352348/300224
* https://stackoverflow.com/questions/5167269/clock-gettime-alternative-in-mac-os-x
* Type documentation <https://developer.apple.com/library/mac/documentation/Darwin/Conceptual/KernelProgramming/services/services.html>
* Declaration <https://opensource.apple.com/source/xnu/xnu-1456.1.26/osfmk/mach/clock_types.h>
* <http://stackoverflow.com/a/21352348/300224>
* <https://stackoverflow.com/questions/5167269/clock-gettime-alternative-in-mac-os-x>
* Sleep
* mach_wait_until()
* Notes https://developer.apple.com/library/ios/technotes/tn2169/_index.html
* Notes <https://developer.apple.com/library/ios/technotes/tn2169/_index.html>
* nanosleep()
* Apple doc https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man2/nanosleep.2.html
* Definition https://opensource.apple.com/source/Libc/Libc-320.1.3/gen/nanosleep.c?txt
* Apple doc <https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man2/nanosleep.2.html>
* Definition <https://opensource.apple.com/source/Libc/Libc-320.1.3/gen/nanosleep.c?txt>
* clock_sleep_trap()
* Used from nanosleep()
* Declared https://opensource.apple.com/source/xnu/xnu-1456.1.26/osfmk/mach/mach_traps.h
* Definition http://unix.superglobalmegacorp.com/xnu/newsrc/osfmk/kern/clock.c.html
* Declared <https://opensource.apple.com/source/xnu/xnu-1456.1.26/osfmk/mach/mach_traps.h>
* Definition <http://unix.superglobalmegacorp.com/xnu/newsrc/osfmk/kern/clock.c.html>
* Uses clock_sleep_internal()
* Uses ADD_MACH_TIMESPEC
* clock type constants https://opensource.apple.com/source/xnu/xnu-1456.1.26/osfmk/mach/clock_types.h?txt
* clock type constants <https://opensource.apple.com/source/xnu/xnu-1456.1.26/osfmk/mach/clock_types.h?txt>
* TIME_ABSOLUTE
* TIME_RELATIVE
* Defines ADD_MACH_TIMESPEC(t1, t2) // t1 += t2
* Defines CMP_MACH_TIMESPEC(t1, t2) // t1 <=> t2, also (t1 - t2) in nsec with max of +- 1 sec
* msleep() https://developer.apple.com/library/mac/documentation/Darwin/Conceptual/KernelProgramming/services/services.html
* time/timer.c / http://lxr.free-electrons.com/source/kernel/time/timer.c#L1673
* kern/clock.h https://opensource.apple.com/source/xnu/xnu-1456.1.26/osfmk/kern/clock.h
* msleep() <https://developer.apple.com/library/mac/documentation/Darwin/Conceptual/KernelProgramming/services/services.html>
* time/timer.c / <http://lxr.free-electrons.com/source/kernel/time/timer.c#L1673>
* kern/clock.h <https://opensource.apple.com/source/xnu/xnu-1456.1.26/osfmk/kern/clock.h>

Press coverage
## Press coverage

* http://hardware.slashdot.org/story/16/03/01/1727226/microcasting-color-tv-by-abusing-a-wi-fi-chip
* http://news.softpedia.com/news/emitting-radio-waves-from-a-computer-with-no-radio-transmitting-hardware-501260.shtml
* https://tenwatts.blogspot.com/2018/01/system-bus-radio.html
* <https://hardware.slashdot.org/story/16/03/01/1727226/microcasting-color-tv-by-abusing-a-wi-fi-chip>
* <https://news.softpedia.com/news/emitting-radio-waves-from-a-computer-with-no-radio-transmitting-hardware-501260.shtml>
* <https://tenwatts.blogspot.com/2018/01/system-bus-radio.html>
103 changes: 0 additions & 103 deletions Using counter and threads/main.cpp

This file was deleted.

File renamed without changes.
File renamed without changes.
8 changes: 8 additions & 0 deletions implementations/c-neon-threads/Makefile
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
CPPFLAGS=-Wall -O2

main: main.c

.PHONY: clean

clean:
rm -f main
123 changes: 123 additions & 0 deletions implementations/c-neon-threads/main.c
Original file line number Diff line number Diff line change
@@ -0,0 +1,123 @@
#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
#include <inttypes.h>
#include <arm_neon.h>
#include <time.h>
#include <string.h>
#include <mach/mach_time.h>
#include <pthread.h>

#define NUM_THREADS 24 // Number of threads (adjust to your needs)
// Define a large array to perform cache-busting operations
#define ARRAY_SIZE (1024 * 1024 * 16) // 16 MB

uint8_t data_array[ARRAY_SIZE] __attribute__((aligned(16)));

// Timebase info for converting between Mach time units and nanoseconds
static mach_timebase_info_data_t timebase_info;

// Thread function to perform high bus activity with NEON intrinsics
void* thread_high_bus_activity_neon(void* arg) {
size_t start = (size_t)arg;
size_t segment_size = ARRAY_SIZE / NUM_THREADS;

uint8x16_t vec_zero = vdupq_n_u8(0); // 128-bit register filled with 0x00
uint8x16_t vec_one = vdupq_n_u8(0xFF); // 128-bit register filled with 0xFF

for (size_t i = start; i < start + segment_size; i += 16) {
// Introduce a random access pattern to increase cache miss rate
size_t random_offset = (rand() % (segment_size / 16)) * 16;

// Use NEON stores with random offset within the segment
vst1q_u8(&data_array[random_offset], vec_one);
vst1q_u8(&data_array[random_offset], vec_zero);
}

return NULL;
}

// Function to perform high bus activity across multiple threads
void perform_high_bus_activity(void) {
pthread_t threads[NUM_THREADS];

// Create NUM_THREADS threads to spread the workload across the memory array
for (int i = 0; i < NUM_THREADS; i++) {
size_t start = i * (ARRAY_SIZE / NUM_THREADS);
pthread_create(&threads[i], NULL, thread_high_bus_activity_neon, (void*)start);
}

// Wait for all threads to complete
for (int i = 0; i < NUM_THREADS; i++) {
pthread_join(threads[i], NULL);
}
}

static inline void square_am_signal(uint64_t time_ms, uint64_t freq_hz) {
uint64_t start = mach_absolute_time();
uint64_t end = start + time_ms * 1000000 * timebase_info.denom / timebase_info.numer;

if (freq_hz == 0) {
// If frequency is 0, perform silence by sleeping for the entire duration
mach_wait_until(end);
return;
}

// Calculate the period for non-zero frequency
uint64_t period = 1000000000 / freq_hz * timebase_info.denom / timebase_info.numer;

while (mach_absolute_time() < end) {
uint64_t mid = start + period / 2;
uint64_t next_period = start + period;

// High activity phase
while (mach_absolute_time() < mid) {
perform_high_bus_activity();
}

// Sleep until the next period to modulate the signal
mach_wait_until(next_period);
start = next_period;
}
}

int main(int argc, char* argv[]) {
// Initialize the timebase info
mach_timebase_info(&timebase_info);

// Seed the random number generator
srand(time(NULL));

if (argc != 2) {
fprintf(stderr, "No song file given!\nUsage: %s file.song\n", argv[0]);
return(1);
}

FILE* fp = fopen(argv[1], "r");
if (!fp) {
perror("fopen");
return(EXIT_FAILURE);
}

char buffer[64];
int time_ms, freq_hz;

while (1) {
if (!fgets(buffer, sizeof(buffer), fp)) {
if (feof(fp)) {
rewind(fp);
continue;
} else {
perror("fgets");
break;
}
}

if (sscanf(buffer, "%d %d", &time_ms, &freq_hz) == 2) {
square_am_signal(time_ms, freq_hz);
}
}

fclose(fp);
return 0;
}
File renamed without changes.
Loading

0 comments on commit 735a66f

Please sign in to comment.