Tempest and HP49

134 views
Skip to first unread message

Khanh-Dang

unread,
Feb 11, 2006, 10:57:03 AM2/11/06
to
Hi!

Perhaps some of you already know about Tempest for Eliza. If you don't,
you can gather some informations here:
<http://www.erikyyy.de/tempest/>.

For those who are too lazy to read the page at the adress I've just
give, here is a quick overview:

> What is it ?
> ------------
>
> Tempest for Eliza is a Program that uses your computer monitor
> to send out AM radio signals. You can then hear computer
> generated music in your radio.
>
> How does this work ?
> --------------------
>
> All electronic devices send out eletromagnetic waves.
> so does your monitor. and your monitor does it all the time.
> and at very high frequencies. high enough for your short wave
> AM radio.
> all you have to do is display the "correct" image on your screen
> and your monitor will emit the "right" signals.
> Tempest for Eliza displays pictures on your screen. one for
> each note in the song.


I have successfully done the same kind of thing with my HP49G.

What you need do make your Saturn sing the Song for Elise (by Ludwig van
Beethoven):
- a HP49G (this may work with any saturn-based HP calcs, bu I didn't
try),
- a pocket radio that can receive short wave AM.

Now, you have to download this source code:

---------------------------------------
%%HP: T(3)A(R)F(.);
DIR
Tempest.s
"!RPL
CODE
DC =DispOff 26798
DC =DispOn 2679F

SAVE
GOSBVL =DispOff ; mandatory

SKUB { 'Data.inc }
C=RSTK D0=C ; D0\->data

{
C=DAT0.A C-1.A EXITC
D=C.A ; Da:
D0+5

C=DAT0.A D0+5
R0=C.A ; R0a: nb loops
; R0 gives better quality

{
C=R0.A
{ C-1.A UPNC }
D-1.A
; The 3 lines below produces much
; better quality sound than
; a single UPNC
EXITC
GOSUB Nop
UP
}
UP
}

GOSBVL =DispOn
P=0
LOADRPL

*Nop
RTN
ENDCODE
@"
Data.inc
""
FL2Data
\<< CLLCD "Building Data.inc "
1. DISP
"% DO NOT EDIT THIS
% GENERATED BY FL2Data
% FORMAT IS:
% (5) nb AWait needs to repeat
% 00000 means stop
% (5) nb ticks
$"
1. FL SIZE DUP 4. DISP
FOR K K 3. DISP FL K GET \-> F
\<< .25 F * 0. RND R\->B A\->H +
127640. F / 0. RND R\->B A\->H +
\>>
NEXT "0000000000
@" +
'Data.inc' STO
\>>
PlayFL
\<< 1. FL SIZE
FOR K FL K GET .2 BEEP
NEXT
\>>
FL { 659.3 635. 659.3 635.
659.3 493.9 587.3 523.3 440.
164.8 220. 261.6 329.6 440.
493.9 164.8 210. 329.6 420.
493.9 523.3 164.8 220. 329.6
659.3 635. 659.3 635. 659.3
493.9 587.3 523.3 440. 164.8
210. 261.6 329.6 440. 493.9
164.8 220. 293.7 523.3 493.9
440. }
CST { { "MAKE"
\<< FL2Data Tempest.s ASM
\>> } { "CLEAN"
\<< "" 'Data.inc' STO
\>> } }
END
---------------------------------------

To compile this program, go to the CST menu and press [MAKE]. The
program is pushed on level 1 of the stack. You can run it just by
EVALuating it, but wait, this program would do nothing cool at this
stage.

This source code is also available at:
<http://perso.wanadoo.fr/kdntl/hp49/tempest/tempest.asc>

For those who are too lazy, just download the binary compiled program
there (BYTES gives # 3E97h and 282):
<http://perso.wanadoo.fr/kdntl/hp49/tempest/tempest.49>


* Now, put your AM receiver at around 660 KHz. Put you HP49 near the
radio, then launch the program.

Here are some samples of what you should hear:

- When the calc is not near the radio:
<http://perso.wanadoo.fr/kdntl/hp49/tempest/nothing.mp3> (156KB)

- When the calc is near the radio but switched off:
<http://perso.wanadoo.fr/kdntl/hp49/tempest/calc_off.mp3> (156KB)

- When the calc is then switched on:
<http://perso.wanadoo.fr/kdntl/hp49/tempest/calc_on.mp3> (156KB)

- When the edit line is active:
<http://perso.wanadoo.fr/kdntl/hp49/tempest/calc_editline.mp3> (156KB)

- When you press the [ON] key:
<http://perso.wanadoo.fr/kdntl/hp49/tempest/calc_key_on.mp3> (156KB)

- When my little proof-of-concept-program is running:
<http://perso.wanadoo.fr/kdntl/hp49/tempest/songforelise.mp3> (187KB)


* Some notes:

- I didn't try all frequencies, but 660 KHz seems to be a good choice,
at least for me. Actually, you may have noticed that 660KHz = 4MHz/6,
where 4MHz is the clock frequency of my HP49G. So that you can also
try 4MHz/3, 4MHz/4, etc.

- In the calc_on.mp3 sample, you can hear a click every second. This is
simplye the interrupt handler of the OS.

- In the cal_editline.mp3, the click appear every 1/16e (I didn't count,
but I think so). Again, this is the interrupt handler.

- In order to find a good frequency, you can press the [ON] key and tune
your radio until you can clearly hear the treble note (see file
calc_key_on.mp3).

* For further information, you can check the links given by Erik Thiele:
>
> More information on Tempest ---------------------------
>
> Tempest and electromagnetic radiation is an interesting topic. There
> aren't very much public literature on this topic. Luckily, there are a
> few technical papers and web sites on the net that are a must read.
>
> Papers to read:
>
> o Markus G. Kuhn's and Ross J. Anderson's, "Soft Tempest: Hidden Data
> Transmission Using Electromagnetic Emanations"
>
> http://www.cl.cam.ac.uk/~mgk25/ih98-tempest.pdf
>
> o Wim van Eck, "Electromagnetic Radiation from Video Display Units: An
> Eavesdropping Risk?"
>
> http://jya.com/emr.pdf
>
> o Christopher Seline, "Eavesdropping On the Electromagnetic Emanations
> of Digital Equipment: The Laws of Canada, England and the United
> States"
>
> http://www.eff.org/pub/Privacy/Security/tempest_legal.draft
>


Happy hacking,

Khanh-Dang

P.S.: You may find an up to date copy of this document at
<http://perso.wanadoo.fr/kdntl/hp49/tempest/hp49_tempest.txt>. If you
have any question, please answer to this post on comp.sys.hp48, or send
me an email at kdntl at yahoo. fr.

Heiko Arnemann

unread,
Feb 11, 2006, 12:55:35 PM2/11/06
to
"Khanh-Dang" <k...@fr.invalid> wrote

> This source code is also available at:
> <http://perso.wanadoo.fr/kdntl/hp49/tempest/tempest.asc>

Attenttion
Your source and the source you have linked to (above),
seem not to generate the required code.
I have tried it and get a wrong result-code.
The code (evaluated) lead to unexpected and non-reproduceable
results and the code can lead to a crash (memory lost).
Bytes and CRC are not equivalent with the required (s.b.)
I got Bytes 287 Crc #C5A4h

> For those who are too lazy, just download the binary compiled program
> there (BYTES gives # 3E97h and 282):
> <http://perso.wanadoo.fr/kdntl/hp49/tempest/tempest.49>

This one I have tested as well.
"wonderfull" this one works.

It took a minute, to find the right placing of radio and calc, but
then I got Beethoven alive :-)
I got the impression, the music comes from, where Beethoven is...
from far away ;-)
The calc should face the radio, because the back of the calc is
nearly not radiating. There seem to be a little leak
between display and keyboard.

regards
Heiko

Khanh-Dang

unread,
Feb 11, 2006, 1:50:29 PM2/11/06
to
Heiko Arnemann a écrit :

>> <http://perso.wanadoo.fr/kdntl/hp49/tempest/tempest.asc>
>
> Attenttion
> Your source and the source you have linked to (above),
> seem not to generate the required code.

Weird, I've just downloaded these sources and it gave me the right
program, with the right checksum.

> It took a minute, to find the right placing of radio and calc, but
> then I got Beethoven alive :-)
> I got the impression, the music comes from, where Beethoven is...
> from far away ;-)

You are right, the music seems to come from another world. I think it's
because the poor quality (the music is noisy), and espspecially because
the music sounds wrong. Indeed, I didn't take time to enter the right
frequencies. Moreover, the program add some distorsions, etc.

> The calc should face the radio, because the back of the calc is
> nearly not radiating. There seem to be a little leak
> between display and keyboard.

I haven't found out what element is radiating, but a good hypothesis is
that the electromagnetic waves come from the memory chip (the one in
which is your HOME), or maybe the bus that links this chip to the
processor.

Samuel Thibault

unread,
Feb 11, 2006, 6:31:18 PM2/11/06
to
Hi,

Khanh-Dang, le Sat 11 Feb 2006 16:57:03 +0100, a écrit :
> What you need do make your Saturn sing the Song for Elise (by Ludwig van
> Beethoven):
> - a HP49G (this may work with any saturn-based HP calcs, bu I didn't
> try),
> - a pocket radio that can receive short wave AM.

Mwahaha :)

Tried it successfully too, quite funny :D

Regards,
Samuel

Stefano Priore

unread,
Feb 12, 2006, 1:16:21 PM2/12/06
to
Khanh-Dang wrote:

> P.S.: You may find an up to date copy of this document at
> <http://perso.wanadoo.fr/kdntl/hp49/tempest/hp49_tempest.txt>. If you
> have any question, please answer to this post on comp.sys.hp48, or send
> me an email at kdntl at yahoo. fr.

Anybody tested it with the 49G+?

--
Stefano Priore | Debian Sarge 3.1r0
--------------------------------+--------------------------------
"Video meliora proboque, | Linux Registered User #210152
autem deteriora sequor..." | Linux Registered Machine #97752

Heiko Arnemann

unread,
Feb 12, 2006, 7:11:48 AM2/12/06
to

"Khanh-Dang" <k...@fr.invalid>

> >> <http://perso.wanadoo.fr/kdntl/hp49/tempest/tempest.asc>
> >
> > Attenttion
> > Your source and the source you have linked to (above),
> > seem not to generate the required code.
>
> Weird, I've just downloaded these sources and it gave me the right
> program, with the right checksum.

I am using ROM 1.19-6.
Would you please sent me "your" directory as a file?
Arnemann at belgacom . net
Thank you in advance.

> You are right, the music seems to come from another world. I think
it's
> because the poor quality (the music is noisy), and espspecially
because
> the music sounds wrong. Indeed, I didn't take time to enter the right
> frequencies. Moreover, the program add some distorsions, etc.

Today I took a newer radio and had some better "sound" arround
1230 kHz. The music *is* wrong :-), but the idea of the
program is great.

Best regards
Heiko


Heiko Arnemann

unread,
Feb 12, 2006, 1:33:18 PM2/12/06
to

"Stefano Priore" <stefano...@inwind.it> wrote

> Khanh-Dang wrote:
>
> > P.S.: You may find an up to date copy of this document at
> > <http://perso.wanadoo.fr/kdntl/hp49/tempest/hp49_tempest.txt>. If
you
> > have any question, please answer to this post on comp.sys.hp48, or
send
> > me an email at kdntl at yahoo. fr.
>
> Anybody tested it with the 49G+?

Yes and no, 49g+ has not a Saturn, so I expect it would not easily work?

I have used EMU48 for 49g+, but "MAKE"ing the
code was interupted (using ROM 2.01-1).
So, the code might be generated by the HP 49G...

I will take the radio again, and listen what the g+ is telling
me, when turning ON, Edit-Line, pressing keys or playing Tetris.
It should give some noise ;-)

Best regards
Heiko


Khanh-Dang

unread,
Feb 13, 2006, 5:22:11 AM2/13/06
to
Heiko Arnemann a écrit :

> Attenttion
> Your source and the source you have linked to (above),
> seem not to generate the required code.

> Bytes and CRC are not equivalent with the required (s.b.)


> I got Bytes 287 Crc #C5A4h

I found out the reason. It's because I am lways working with flag -92
on, and I forgot to add "!NO CODE" at the beginning of the source code.
So, there are two workarounds:
- Switch flag -92 on withe -92 SF
- Add "!NO CODE" at the beginning of Tempest.s

You can also the updated versions at:
- binary version:
<http://perso.wanadoo.fr/kdntl/hp49/tempest/tempest.bin>
- ASCII version:
<http://perso.wanadoo.fr/kdntl/hp49/tempest/tempest.asc>


Khanh-Dang

unread,
Feb 13, 2006, 5:25:23 AM2/13/06
to
Heiko Arnemann a écrit :

>> Weird, I've just downloaded these sources and it gave me the right
>> program, with the right checksum.
>
> I am using ROM 1.19-6.
> Would you please sent me "your" directory as a file?

I gave the link (and the explanation of the issue) in another post in
the same thread.

> Today I took a newer radio and had some better "sound" arround
> 1230 kHz.

I even found some frequencies at which the music sounds as if it were
played by a bagpipes :) But I din't manage to reproduce it.

Khanh-Dang

unread,
Feb 13, 2006, 5:29:53 AM2/13/06
to
Heiko Arnemann a écrit :

>> Anybody tested it with the 49G+?
>
> Yes and no, 49g+ has not a Saturn, so I expect it would not easily work?

My program would certainly not work, but one could write another that
could work with ARM-based calcs. Actually, you can generate sounds with
any calculator. Which is not that easy is to find how.

> I have used EMU48 for 49g+, but "MAKE"ing the
> code was interupted (using ROM 2.01-1).

Weird. This should work on a 49G+ too, even if I didn't try. I think the
library 256 is not attached on your emulator. Just try a \<< 256. ATTACH
\>> before MAKing.

Frère-Pierre

unread,
Feb 13, 2006, 5:42:10 AM2/13/06
to

"Khanh-Dang" <k...@fr.invalid> wrote in message
news:43f05fa1$0$18338$8fcf...@news.wanadoo.fr...

> Heiko Arnemann a écrit :
>>> Anybody tested it with the 49G+?
>>
>> Yes and no, 49g+ has not a Saturn, so I expect it would not easily work?

What do you mean has no Saturn?
The 49g+ is working because of faithful Saturn emulation
It's a very simple CPU to emulate

Khanh-Dang

unread,
Feb 13, 2006, 6:06:14 AM2/13/06
to
Frere-Pierre wrote:
>>> Yes and no, 49g+ has not a Saturn, so I expect it would not easily work?
>
> What do you mean has no Saturn?
> The 49g+ is working because of faithful Saturn emulation

Beware, you are answering to the wrong post. What Heiko means is there
is no Saturn *hardware* in the 49G+.

> It's a very simple CPU to emulate

And some say the ARM is a processor that can easily emulate others.

Heiko Arnemann

unread,
Feb 13, 2006, 2:27:57 PM2/13/06
to

"Khanh-Dang" <k...@fr.invalid> answered to

> > Bytes and CRC are not equivalent with the required (s.b.)
> > I got Bytes 287 Crc #C5A4h
>
> I found out the reason. It's because I am lways working with flag -92
> on, and I forgot to add "!NO CODE" at the beginning of the source
code.
> So, there are two workarounds:
> - Switch flag -92 on withe -92 SF
> - Add "!NO CODE" at the beginning of Tempest.s

Oh, yes, I can confirm.
Thanks!

Best regards
Heiko


Heiko Arnemann

unread,
Feb 13, 2006, 2:47:36 PM2/13/06
to
"Khanh-Dang" <k...@fr.invalid> answered to

> > Today I took a newer radio and had some better "sound" arround
> > 1230 kHz.
>
> I even found some frequencies at which the music sounds as if it were
> played by a bagpipes :) ...

ROTFLL.
I think I have heard something simillar, when the radio
is a bit out of tune, but I am also not able to reproduce it.

"unfortunately" the radiation is very small.
Do you thought about an application for your finding?

You may remove the cover of the HP 49G and perform
a "very local broadcasting station" for Scottland ;)

Seriously:
Thanks for your contribution, I was/am
highly amused about this "new application".

For music, the best is realy the mig-player. I like it.

Best regards
Heiko


Heiko Arnemann

unread,
Feb 13, 2006, 3:08:47 PM2/13/06
to
Thanks Khang-Dang,

...


> > I have used EMU48 for 49g+, but "MAKE"ing the
> > code was interupted (using ROM 2.01-1).
>
> Weird. This should work on a 49G+ too, even if I didn't try. I think
the
> library 256 is not attached on your emulator. Just try a \<< 256.
ATTACH
> \>> before MAKing.

No, it starts building the data and stops with

asm Error
Invalid File

with string in stack level 2:


"!RPL
CODE
DC =DispOff 26798
DC =DispOn 2679F

... snipped
*Nop
RTN
ENDCODE
@"

which is the content of Tempest.s

and

:1: { { ¤ 10110h ¤ 0h ¤ 1BBh } { ¤ 10110h ¤ 0h ¤ 3Eh } }

My flags: { # 8000020401CFF0h # 0h # 801001000A100000h # 0h }

You might be ambigious to follow up this issue, but I would
suggest, it is a bit OT, because the program would
produce a code, which is not usefull for the HP 49G.

It looks like MAKing is not working on 49g+,
but 49g+ definitly give some dirty noise on AM-radio ;-)
Nevertheless, radiation of the 49g+ and its use is a different topic.

Best regards
Heiko


Frère-Pierre

unread,
Feb 13, 2006, 5:19:06 PM2/13/06
to
"Heiko Arnemann" <Heiko.A...@gmx.de> wrote in message
news:43f0e9ee$0$29462$ba62...@news.skynet.be...

> "Khanh-Dang" <k...@fr.invalid> answered to
>> > Today I took a newer radio and had some better "sound" arround
>> > 1230 kHz.
>>
>> I even found some frequencies at which the music sounds as if it were
>> played by a bagpipes :) ...
>
> ROTFLL.
> I think I have heard something simillar, when the radio
> is a bit out of tune, but I am also not able to reproduce it.
>
> "unfortunately" the radiation is very small.
> Do you thought about an application for your finding?
>
> You may remove the cover of the HP 49G and perform
> a "very local broadcasting station" for Scottland ;)
>
> Seriously:
> Thanks for your contribution, I was/am
> highly amused about this "new application".

I used to listen the "hearth-beat" of my HP-41CV from a radio


John H Meyers

unread,
Feb 13, 2006, 5:50:05 PM2/13/06
to
On Mon, 13 Feb 2006 04:42:10 -0600, VPN:

> What do you mean has no Saturn?
> The 49g+ is working because of faithful Saturn emulation

> It's a very simple CPU to emulate.

This thread is not about emulation of computational results,
but about the emanation of radio signals to generate
"music" on AM radios (or to attract idle NSA employees :)

The difference in underlying chip (and product) architecture
might possibly alter the RF emissions produced by running
a given program. But if the ARM-emulated Saturn still
carries the tune, then Eureka, the 49G+ might still
play music through a radio, though it reportedly
still may not make an ideal keyboard instrument :)

[r->] [OFF]

Jean-Yves Avenard

unread,
Feb 14, 2006, 1:43:25 AM2/14/06
to
Heiko Arnemann wrote:
> with string in stack level 2:
> "!RPL
> CODE
> DC =DispOff 26798
> DC =DispOn 2679F
> ... snipped
> *Nop
> RTN
> ENDCODE
> @"

Add, !NO CODE before !RPL, or remove CODE and ENDCODE lines

JY

Heiko Arnemann

unread,
Feb 14, 2006, 1:59:35 PM2/14/06
to
"Jean-Yves Avenard" <m...@privacy.net> schrieb

Thanks, JY.

I have tried both,
with and w/o sysFlag -92 set.
No, success.
It must be something else, with the content (string)
of Tempest.s or the level one object, I have
posted before.

By the way, MAKing gives the same error, when
trying to do with ROM 1.24 for emu48 and
it is running fine with ROM 1.19-6, flag -92 cleared.

Best regards
Heiko


heavens above

unread,
Aug 1, 2020, 12:30:40 PM8/1/20
to

I don't know where the problem lies. The code file cannot work on 50g. I tried to edit the asc file, but it could not be saved due to an error.Flag 92 has been set, can anyone tell me how to compile this kind of program?
good luck

heavens above

unread,
Aug 1, 2020, 12:52:03 PM8/1/20
to
在 2020年8月2日星期日 UTC+8上午12:30:40,heavens above写道:
> I don't know where the problem lies. The code file cannot work on 50g. I tried to edit the asc file, but it could not be saved due to an error.Flag 92 has been set, can anyone tell me how to compile this kind of program?
> good luck

By the way, these files can be found in hpcalc

heavens above

unread,
Aug 1, 2020, 12:55:16 PM8/1/20
to
在 2006年2月11日星期六 UTC+8下午11:57:03,Khanh-Dang写道:

Zooe

unread,
Apr 13, 2021, 3:38:20 AM4/13/21
to
The tempest effect relies on the specificities of the electromagnetic
emission of the CPU and memory bus in HP48 and HP49 calculators.

HP50g calculators have a totally different architecture (emulated-Saturn
on ARM based hardware, instead of Saturn based) so that, even if you
managed to assemble the code and run the program on 50g, you would not
get the tempest effect.
Reply all
Reply to author
Forward
0 new messages