Linux Multimedia Hacks

Broadcast Sound to AM with a Monitor

Use the TEMPEST surveillance technology to broadcast sound from your monitor to an AM radio.

If you hang around tinfoil hat–wearing paranoid types much, you might have heard about van Eck scanning or TEMPEST. TEMPEST (an acronym for Transient Electromagnetic Pulse Emanation Standard) is a term used to describe techniques used to prevent sensitive information from being leaked from computer equipment via electromagnetic emanation. In general, electronic equipment sends out electromagnetic waves when it’s powered on. A common illustration of this fact is the interference you might get on your television when various electronic devices are turned on around it. Your computer monitor (CRTs especially, but also LCDs to a lesser degree) also sends out electromagnetic waves when it is powered on. Methods exist to pick up these signals from a distance and, using special equipment, reconstruct what is displayed on the monitor without actually seeing it.

While there are a number of practical uses for this type of technology, especially for surveillance, for this hack, I cover one of the less practical and more fun applications. Since you can control what signals emanate from your screen, you can conceivably send out messages using just your computer monitor. A special piece of Linux software, tempest_for_eliza, uses this principle to actually broadcast sound from a monitor that can be picked up with an AM radio.

The first step is to download and build the tempest_for_eliza software. Download the latest version from the official page at http://www.erikyyy.de/tempest. This software requires that SDL libraries be installed to compile, but most distributions package this for you; just use your package manager and install the SDL (or possibly libSDL) and SDL-devel (or possibly libSDL-dev) packages. Then extract the source from the tarball, configure, and compile tempest_for_eliza:

	greenfly@moses:~$ tar xfvz tempest_for_eliza-1.0.5.tar.gz
	greenfly@moses:~$ cd tempest_for_eliza
	greenfly@moses:~/tempest_for_eliza$ ./configure
	greenfly@moses:~/tempest_for_eliza$ ./make

Now that the program is compiled, you need to make sure that X is set up appropriately. This method works best if X11 is at a low color depth, so use your X configuration tool to change the default color depth to 8 bits per pixel (bpp). Alternatively, edit /etc/X11/XF86Config-4 or /etc/X11/xorg.conf, find the Screen section in the file, and change DefaultDepth to 8. Also make sure that there is a Display subsection there for the 8 bpp color depth. Once X is configured, restart X so you go into the new color depth.

Now that X has restarted, open a terminal and type xvidtune to start the xvidtune program. Write down the HDisplay, VDisplay, HTotal, VTotal, and Pixel Clock values. Now go get an AM radio and find a frequency where there isn’t much noise. For this example I will use 750 kHz. Change to your tempest_for_eliza directory and execute the tempest_for_eliza program inside with the pixel-clock (multiplied by one million), HDisplay, VDisplay, HTotal, and radio frequency values, followed by the file to play. To play the sample “Fur Elise” by Beethoven that is included with the program, type:

	greenfly@moses:~/tempest_for_eliza$ ./tempest_for_eliza 56300000 800 600 \
	1046 750000 songs/forelise

In this example my pixel clock was 56.3 (56.3 * 1,000,000 = 56,300,000), my resolution was 800 x 600, my HTotal value was 1,046, and I wanted to broadcast on 750 kHz (750,000). You probably will need to change most if not all of these variables to suit the values xvidtune displays on your monitor.

Once you start the program, your monitor will display lots of what appears to be random static. Get your AM radio and slowly tune it to the broadcast frequency search around that frequency until you find the (possibly faint) tune. It is easier to sync it up, I’ve found, if you search for the periods where the monitor turns black (for silence) and listen for that bit of silence on the radio. It might take some experimenting with different frequencies before you find one that comes through clearly.

Of course, this program doesn’t actually play sound files. The file it plays is a text file that lists particular notes to play in order. Check out the different files in the songs directory to see how to construct a sound file of your own.

Also included with this software is the tempest_for_mp3 program, which will let you broadcast MP3 files using the same method. I’ve noticed this method is trickier to get working, so you will probably have to experiment a bit before you find the right combination of frequencies that work for you. The first step is to run the tempest_for_mp3 program and point it at a nonexistent file. The tempest_for_mp3 program has a few extra options, and again order matters, so pass the following settings in order: pixel clock, HDisplay, VDisplay, HTotal, VTotal, radio frequency, play mode (use 0), amplification (use 20), and the filename. Here’s an example:

	greenfly@moses:~/tempest_for_eliza$ ./tempest_for_mp3 56300000 800 600 1046\ 
	631 750000 0 20 foo.raw

Notice that most of these options are the same as before, only I added the VTotal setting (631), the play mode (0) and the amplification (20). Run this with a nonexistent file so that tempest_for_mp3 will pass the audio file frequency to use with those settings in its output so you can create a special raw audio file with that frequency. Look for a line in the output that says something like:

	audio file frequency should be 13519.890261 Hz

Then run the included mksong.sh script to convert your MP3 to the raw audio file tempest_for_mp3 needs:

	greenfly@moses:~/tempest_for_eliza$ ./mksong.sh 13519 example.mp3 output.raw

Notice that I listed the audio frequency in Hz. This script requires that both sox and amp be installed, but if you want, you can replace amp with another program that can convert MP3s to WAV files provided you change the mksong.sh script as well. Now that you have the output.raw file, run tempest_for_mp3 again, specifying the new file:

	greenfly@moses:~/tempest_for_eliza$ ./tempest_for_mp3 56300000 800 600 1046 
	631 750000 0 20 output.raw

You will notice that the monitor displays even more interesting static this time around. Slowly tune into the appropriate frequency until you hear the audio. Again, experiment with different frequencies until you find one that works for you.