Video eavesdropping data set
----------------------------

Markus Kuhn -- 2019-12-13

This dataset contains IQ-downconverted recordings of the 205-495 MHz
radio spectrum near a computer with HDMI display, for experiments
aimed at reconstructing the displayed video image from the
electromagnetic emissions of the computer's HDMI cable.

The scene3-640x480-60-*M-64M-40M.dat files contain recordings
featuring the following target device:

Computer with HDMI video output:

  Raspberry Pi Model B+ Rev 1.2
  ("rubus", MAC b8:27:eb:ed:79:c1, /proc/cpuinfo SN: aeed79c1)

Display:

  Dell 1704FPT (native panel mode: 1280x1024@60Hz)
  1.8 m HDMI->DVI cable

Video output:

  640x480@60 Hz VESA DMT

  displayed resolution: 640 x 480 pixel
  total resolution (including blanking intervals): 800 x 525 pixel
  pixel clock: nominally 25.175 MHz +/- 0.5%
  HDMI bitrate: 10x pixel clock, i.e. 251.75 MHz +/- 0.5%
  HDMI line encoding: "transition minimized differential signalling" (TMDS)

  displayed content: scene3-640x480.png

  Raspian 10 video configuration:
  $ cat /boot/config.txt
  config_hdmi_boost=8
  hdmi_group=2
  hdmi_mode=4

The noise-640x480-60-*M-64M-40M.dat recordings were captured a couple
of minutes later under practically identical conditions, but with the
target device powered off. They are intended to characterize the
approximate background noise environment at the time of the
recordings.

All recordings took place during 2019-12-13 14:39-14:52 UTC in a
normal, unshielded office room (room GE16, William Gates Building,
Cambridge CB3 0FD). They will, therefore, include a realistic
background of other radio sources, including computer displays and
broadcast transmitters. For example, the ~216–226.5 MHz frequency
range appears to be occupied by three Digital Audio Broadcast (DAB)
ensembles, and the ~470–478 MHz range possibly by a DVB-T2 multiplex.
https://www.cl.cam.ac.uk/~mgk25/local-rf-spectrum.html

Receiving system:

- Rohde & Schwarz FSV7 signal analyzer

- Schwarzbeck VUSLP 9111B-039 log-periodic antenna (200-3000 MHz)

- 5 m RG213U 50-ohm coaxial antenna cable

Distance between receiving antenna and HDMI cable: about 1 metre

Photo of antenna and target device: scene3-antenna-setup.jpg

Data format:

32-bit IEEE float litteendian format, sequence of IQ pairs

Sampling frequency: 64 MHz
Flat bandwidth: 40 MHz
Centre frequency: 225 MHz, 250 MHz, ..., 475 MHz

FSV7 SCPI settings: trace:iq on; format real,32; input:gain:state on;
                    calc:unit:pow volt; trace:iq:data:format iqpair;

Example code for reading the files:

  MATLAB:

  fid = fopen('scene3-640x480-60-425M-64M-40M.dat', 'r', 'ieee-le');
  iq = fread(fid, [2, inf], 'single=>single');  fclose(fid);
  iq = complex(iq(1,:), iq(2,:));

  Julia:

  fn="scene3-640x480-60-425M-64M-40M.dat";
  len = div(filesize(fn), sizeof(ComplexF32));
  z = Vector{ComplexF32}(undef,len);
  read!(fn, z);

Each of the files

  noise-640x480-60-225M-64M-40M.dat  scene3-640x480-60-225M-64M-40M.dat
  noise-640x480-60-250M-64M-40M.dat  scene3-640x480-60-250M-64M-40M.dat
  noise-640x480-60-275M-64M-40M.dat  scene3-640x480-60-275M-64M-40M.dat
  noise-640x480-60-300M-64M-40M.dat  scene3-640x480-60-300M-64M-40M.dat
  noise-640x480-60-325M-64M-40M.dat  scene3-640x480-60-325M-64M-40M.dat
  noise-640x480-60-350M-64M-40M.dat  scene3-640x480-60-350M-64M-40M.dat
  noise-640x480-60-375M-64M-40M.dat  scene3-640x480-60-375M-64M-40M.dat
  noise-640x480-60-400M-64M-40M.dat  scene3-640x480-60-400M-64M-40M.dat
  noise-640x480-60-425M-64M-40M.dat  scene3-640x480-60-425M-64M-40M.dat
  noise-640x480-60-450M-64M-40M.dat  scene3-640x480-60-450M-64M-40M.dat
  noise-640x480-60-475M-64M-40M.dat  scene3-640x480-60-475M-64M-40M.dat

contains a one-second long recording at the indicated centre
frequency. 1 second = 64e6 samples = 512e6 bytes

These recording were taken sequentially, with typically 14 seconds
passing between consecutive recordings (for setup, processing and
download). Each recording was triggered by software, starting at some
arbitrary point in time and local-oscillator phase.

The float32 values should represent RMS volts, with typical antenna
voltages in the order of 1 mV.