Tempest and HP49

Discussion:

Tempest and HP49

(too old to reply)

Khanh-Dang

2006-02-11 15:57:03 UTC

Hi!

Perhaps some of you already know about Tempest for Eliza. If you don't,
you can gather some informations here:
<http://www.erikyyy.de/tempest/>.

For those who are too lazy to read the page at the adress I've just

What is it ?
------------
Tempest for Eliza is a Program that uses your computer monitor
to send out AM radio signals. You can then hear computer
generated music in your radio.
How does this work ?
--------------------
All electronic devices send out eletromagnetic waves.
so does your monitor. and your monitor does it all the time.
and at very high frequencies. high enough for your short wave
AM radio.
all you have to do is display the "correct" image on your screen
and your monitor will emit the "right" signals.
Tempest for Eliza displays pictures on your screen. one for
each note in the song.

I have successfully done the same kind of thing with my HP49G.

What you need do make your Saturn sing the Song for Elise (by Ludwig van
Beethoven):
- a HP49G (this may work with any saturn-based HP calcs, bu I didn't
try),
- a pocket radio that can receive short wave AM.

Now, you have to download this source code:

---------------------------------------
%%HP: T(3)A(R)F(.);
DIR
Tempest.s
"!RPL
CODE
DC =DispOff 26798
DC =DispOn 2679F

SAVE
GOSBVL =DispOff ; mandatory

SKUB { 'Data.inc }
C=RSTK D0=C ; D0\->data

{
C=DAT0.A C-1.A EXITC
D=C.A ; Da:
D0+5

C=DAT0.A D0+5
R0=C.A ; R0a: nb loops
; R0 gives better quality

{
C=R0.A
{ C-1.A UPNC }
D-1.A
; The 3 lines below produces much
; better quality sound than
; a single UPNC
EXITC
GOSUB Nop
UP
}
UP
}

GOSBVL =DispOn
P=0
LOADRPL

*Nop
RTN
ENDCODE
@"
Data.inc
""
FL2Data
\<< CLLCD "Building Data.inc"
1. DISP
"% DO NOT EDIT THIS
% GENERATED BY FL2Data
% FORMAT IS:
% (5) nb AWait needs to repeat
% 00000 means stop
% (5) nb ticks
$"
1. FL SIZE DUP 4. DISP
FOR K K 3. DISP FL K GET \-> F
\<< .25 F * 0. RND R\->B A\->H +
127640. F / 0. RND R\->B A\->H +
\>>
NEXT "0000000000
@" +
'Data.inc' STO
\>>
PlayFL
\<< 1. FL SIZE
FOR K FL K GET .2 BEEP
NEXT
\>>
FL { 659.3 635. 659.3 635.
659.3 493.9 587.3 523.3 440.
164.8 220. 261.6 329.6 440.
493.9 164.8 210. 329.6 420.
493.9 523.3 164.8 220. 329.6
659.3 635. 659.3 635. 659.3
493.9 587.3 523.3 440. 164.8
210. 261.6 329.6 440. 493.9
164.8 220. 293.7 523.3 493.9
440. }
CST { { "MAKE"
\<< FL2Data Tempest.s ASM
\>> } { "CLEAN"
\<< "" 'Data.inc' STO
\>> } }
END
---------------------------------------

To compile this program, go to the CST menu and press [MAKE]. The
program is pushed on level 1 of the stack. You can run it just by
EVALuating it, but wait, this program would do nothing cool at this
stage.

This source code is also available at:
<http://perso.wanadoo.fr/kdntl/hp49/tempest/tempest.asc>

For those who are too lazy, just download the binary compiled program
there (BYTES gives # 3E97h and 282):
<http://perso.wanadoo.fr/kdntl/hp49/tempest/tempest.49>

* Now, put your AM receiver at around 660 KHz. Put you HP49 near the
radio, then launch the program.

Here are some samples of what you should hear:

- When the calc is not near the radio:
<http://perso.wanadoo.fr/kdntl/hp49/tempest/nothing.mp3> (156KB)

- When the calc is near the radio but switched off:
<http://perso.wanadoo.fr/kdntl/hp49/tempest/calc_off.mp3> (156KB)

- When the calc is then switched on:
<http://perso.wanadoo.fr/kdntl/hp49/tempest/calc_on.mp3> (156KB)

- When the edit line is active:
<http://perso.wanadoo.fr/kdntl/hp49/tempest/calc_editline.mp3> (156KB)

- When you press the [ON] key:
<http://perso.wanadoo.fr/kdntl/hp49/tempest/calc_key_on.mp3> (156KB)

- When my little proof-of-concept-program is running:
<http://perso.wanadoo.fr/kdntl/hp49/tempest/songforelise.mp3> (187KB)

* Some notes:

- I didn't try all frequencies, but 660 KHz seems to be a good choice,
at least for me. Actually, you may have noticed that 660KHz = 4MHz/6,
where 4MHz is the clock frequency of my HP49G. So that you can also
try 4MHz/3, 4MHz/4, etc.

- In the calc_on.mp3 sample, you can hear a click every second. This is
simplye the interrupt handler of the OS.

- In the cal_editline.mp3, the click appear every 1/16e (I didn't count,
but I think so). Again, this is the interrupt handler.

- In order to find a good frequency, you can press the [ON] key and tune
your radio until you can clearly hear the treble note (see file
calc_key_on.mp3).

More information on Tempest ---------------------------
Tempest and electromagnetic radiation is an interesting topic. There
aren't very much public literature on this topic. Luckily, there are a
few technical papers and web sites on the net that are a must read.
o Markus G. Kuhn's and Ross J. Anderson's, "Soft Tempest: Hidden Data
Transmission Using Electromagnetic Emanations"
http://www.cl.cam.ac.uk/~mgk25/ih98-tempest.pdf
o Wim van Eck, "Electromagnetic Radiation from Video Display Units: An
Eavesdropping Risk?"
http://jya.com/emr.pdf
o Christopher Seline, "Eavesdropping On the Electromagnetic Emanations
of Digital Equipment: The Laws of Canada, England and the United
States"
http://www.eff.org/pub/Privacy/Security/tempest_legal.draft

Happy hacking,

Khanh-Dang

P.S.: You may find an up to date copy of this document at
<http://perso.wanadoo.fr/kdntl/hp49/tempest/hp49_tempest.txt>. If you
have any question, please answer to this post on comp.sys.hp48, or send
me an email at kdntl at yahoo. fr.

Heiko Arnemann

2006-02-11 17:55:35 UTC