amateur radio android open source Technology , , , , , , , , , , , , , , , , , , ,

ClassD VHF Transmitter: Turn Any Android Phone into a 2M OOK Morse Beacon via Class-D TEMPEST Harmonics

TL;DR: ClassD VHF Transmitter by Efe Isik TA1EEI is a free open source Android app that transmits inaudible 21 kHz ultrasonic OOK Morse pulses through the phone speaker path, forcing the internal Class-D audio amplifier H-bridge to radiate PWM harmonics receivable around 144.000 MHz AM on any 2M handheld or SDR. Zero permissions, zero root, MIT licensed, with Zenodo DOI and ORCID citation.

Your Android phone already contains a VHF transmitter. It was never meant to be one. It has no RF power amplifier, no antenna tuner, and no permission to transmit. Yet under the right conditions, the tiny Class-D audio amplifier chip driving your bottom speaker can leak enough switching energy to be heard on a 2 meter handheld standing centimeters away.

That is exactly what ClassD-VHF-Transmitter by Turkish radio amateur and researcher Efe Isik TA1EEI demonstrates. It’s an experimental Android proof-of-concept for an electromagnetic side-channel, in the classic TEMPEST sense. It synthesizes an inaudible 21 kHz ultrasonic tone at 100 percent media volume using the standard Android AudioTrack API, keys it on and off as OOK Morse code, and lets the high-current PWM switching harmonics of the internal Class-D H-bridge do the rest. Park a receiver on 144.000 MHz in AM mode, open the squelch, touch the HT antenna tip to the speaker grill, and you’ll hear the Morse come through the static.

In this guide we break down how the app works, the physics of Class-D harmonic leakage, the exact receiver and phone setup for reliable copy, how to build it from source, where it fits in TEMPEST history, and the legal and practical limits you must respect.

What Is ClassD VHF Transmitter?

ClassD VHF Transmitter is an experimental open source Android app that sends OOK Morse code over a VHF covert channel generated by smartphone Class-D audio amplifier PWM switching harmonics, centered near 144.000 MHz and receivable in AM mode at very short range.

+----------------------------------------------------------------------------------+
|                    CLASSD VHF TRANSMITTER SIGNAL CHAIN                           |
+----------------------------------------------------------------------------------+
|                                                                                  |
|  [ App UI: Morse text entry ]                                                    |
|       |                                                                          |
|  [ AudioTrack 48 kHz PCM: 21 kHz sine, OOK keyed ]                               |
|       |                                                                          |
|  [ SoC DAC + Class-D modulator: PWM hundreds of kHz to MHz ]                    |
|       |                                                                          |
|  [ H-bridge FETs: high peak current switching ]                                  |
|       |                                                                          |
|  [ Speaker coil + PCB traces: unshielded loop antenna ]                          |
|       |  RF comb harmonics leak into VHF                                          |
|  [ Air gap: centimeters, near field ]                                            |
|       |                                                                          |
|  [ HT / SDR on 144.000 MHz AM, squelch 0, WIDE 25 kHz ]                          |
|       |                                                                          |
|  [ Operator hears OOK Morse envelope in static ]                                 |
|                                                                                  |
+----------------------------------------------------------------------------------+

The project is small and focused. The repository contains a standard Gradle Android app, an MIT license, a Zenodo DOI (10.5281/zenodo.22903894) for academic citation, and author identification via ORCID 0009-0001-1628-2183. At the time of writing it holds 5 stars and 0 forks, with 7 commits on main. Author contact is Efe Isik TA1EEI.

Key facts at a glance:

  • Mechanism: high-current PWM switching modulation via standard AudioTrack, no hidden APIs
  • Audio signal: 21 kHz sine at 48 kHz sampling rate, inaudible to almost all adults
  • Modulation: OOK (On-Off Keying), used as CW Morse
  • RF target: comb spectrum across VHF, centering near 144.000 MHz depending on phone PWM clock
  • Permissions: zero. No root, no camera, no storage, no microphone
  • License: MIT
  • Range: near field, antenna touching or within a few centimeters of the speaker grill

Why a Phone Speaker Leaks VHF: Class-D Amplifiers Explained

To understand why this works, you need to know how modern phones drive speakers.

Linear vs Class-D audio amplifiers

Old linear amplifiers (Class-A, Class-AB) work like variable resistors. They burn excess voltage as heat. They are quiet in RF terms but inefficient, which is unacceptable in a thin phone running on a 5,000 mAh battery.

Almost every modern smartphone uses a Class-D amplifier instead. A Class-D stage doesn’t amplify the analog waveform directly. It converts audio into a high-frequency pulse-width modulated (PWM) square wave, typically switching at 250 kHz to over 2 MHz, drives a pair of FETs in an H-bridge hard on and hard off, then reconstructs audio through a small LC low-pass filter and the inductance of the speaker coil itself. Efficiency exceeds 90 percent because the FETs spend almost no time in the linear region.

The tradeoff is noise. Every sharp switching edge contains energy at the switching frequency plus a long ladder of odd and even harmonics stretching far into VHF and UHF. Phone designers suppress this with layout, filtering, and shielding, but a speaker coil next to a USB-C port is by nature an unshielded loop connected to long PCB traces.

Why 21 kHz at full volume matters

Three details in the TA1EEI design force maximum leakage:

  1. 21 kHz tone near Nyquist. At a 48 kHz sample rate, 21 kHz is close to the 24 kHz Nyquist limit. The DAC output slews near its maximum rate, which keeps the PWM modulator at high modulation depth with dense, steep edges.
  2. 100 percent media volume. Class-D chips enter low-power or pulse-skipping sleep modes at low volume. Full volume pins the H-bridge at maximum rail current, which maximizes magnetic field strength around the coil and traces.
  3. OOK keying. Turning the 21 kHz tone fully on and off at Morse timing amplitude-modulates the entire harmonic comb. That’s why an AM receiver hears clean dits and dahs riding on static, while an FM receiver hears almost nothing because its limiter strips the amplitude envelope.

The exact VHF peak moves between phone models because each vendor uses a different Class-D chip and switching clock. TA1EEI documents 144.000 MHz as the starting point and advises searching 144.000 to 146.000 MHz in 12.5 or 25 kHz steps until the tone pops out of the noise.

TEMPEST in 60 Seconds: From World War II to Your Pocket

This app belongs to a serious research lineage called TEMPEST, the study of compromising emanations from electronic equipment.

  • 1940s to 1960s: Bell Labs, NSA, and NATO discover that encrypted teletype and display equipment radiates readable signals. Shielded rooms and RED/BLACK separation rules are born.
  • 1985: Wim van Eck demonstrates van Eck phreaking, reconstructing CRT monitor images from radiated harmonics at tens of meters with a TV receiver and modified antenna.
  • 2000s: Researchers extend this to LCDs, keyboards, smart cards, and AES cryptographic operations via power and EM analysis.
  • 2014 to 2020: Ben-Gurion University (Guri et al.) publishes the modern covert-channel series relevant here: AirHopper (GPU to FM radio), GSMem (memory bus to GSM bands), Funtenna (GPIO pins as intentional radiators), PowerHammer (power lines), and speaker-based ultrasonic exfiltration.
  • 2026: TA1EEI applies the same thinking to the one high-current switcher every phone carries but nobody audits: the Class-D audio H-bridge, aimed at the 2 meter amateur band where every ham already owns a receiver.

For hams, the value is educational. You can demonstrate a real TEMPEST channel on a club table with hardware you already own, then discuss shielding, filtering, and why secure facilities ban phones.

What You Need

  • An Android phone running a recent Android version with a bottom-firing speaker (any vendor, results vary by Class-D chip)
  • The ClassD VHF Transmitter APK or source build (Gradle, Android Studio)
  • A 2M receiver: any analog FM handheld with AM aircraft-style receive or dedicated AM mode (Yaesu FT-65, FT-70D, Baofeng with AM, Quansheng UV-K5 with AM firmware, or any RTL-SDR / Airspy / HackRF)
  • Open squelch and patience: this is a centimeters-range near-field signal, not a DX transmitter

Remove thick conductive or magnetic phone cases before testing. They attenuate the magnetic near field significantly.

Step-by-Step: Receiving Phone Morse on 144.000 MHz AM

1. Install and prepare the app

Clone or download the GitHub repository, open it in Android Studio, and install the debug APK on your phone, or install a prebuilt APK release if provided. The app requests zero permissions, so Android should install it without any permission prompts. Open the app and type a short Morse test string such as VVV or your callsign.

2. Configure the phone for maximum leakage

  • Set Media volume to 100 percent. This is mandatory. Lower volume lets the amplifier sleep or reduces rail current.
  • Disable Dolby, equalizer, and speaker-protection DSP if your ROM exposes those toggles. They can compress or filter ultrasonics.
  • Remove the case.
  • Lay the phone speaker-grill up. On most phones this is the bottom edge next to the USB-C port.

3. Configure the receiver

  • Frequency: 144.000 MHz first, then sweep 144.000 to 146.000 MHz in 12.5 or 25 kHz steps
  • Mode: AM. This is the most common failure point. FM won’t work.
  • Squelch: 0 (fully open) or hold MONI. You need to hear band noise.
  • Bandwidth: WIDE / 25 kHz to tolerate clock jitter and spectral spreading
  • If using an SDR (SDR++, GQRX, SDR#): center on 144 MHz, AM demodulator, 20 to 30 kHz filter, AGC off or slow, gain moderate

4. Couple the antenna to the speaker

Physically touch the HT antenna tip to the bottom speaker grill, exactly as shown in the featured photo. Start transmission in the app. You should hear short bursts of tone-like energy or clear dits and dahs punching through the hiss. Move the antenna a few millimeters along the grill to find the hot spot. Maximum is usually directly over the speaker port, not the USB shell.

5. Optimize for copy

  • Slow the Morse speed down (5 to 12 WPM) until characters are solid
  • Keep the room quiet electrically: laptop chargers and LED drivers raise the VHF noise floor
  • Try both horizontal and vertical antenna orientation; near-field magnetic coupling is polarization sensitive
  • If 144.000 MHz is dead, sweep slowly. Some phones peak at 144.600 or 145.200 MHz depending on their PWM clock

Practical Limits: What This Can and Cannot Do

Be realistic. This is a laboratory demonstration, not a covert superpower.

  • Range is centimeters. Antenna touching the phone works. A few centimeters works weakly. Across a room doesn’t work. Across the street is fantasy.
  • Throughput is Morse-rate. Expect 5 to 15 WPM equivalent OOK. No audio, no data modes, no FM voice.
  • Phone dependent. Speaker position, Class-D vendor, PCB layout, and DSP all shift the peak frequency and amplitude. Two identical-looking phones can behave differently.
  • AM only. FM limiters erase the envelope. SSB can work in a pinch with careful tuning but AM is far easier.
  • Battery drain. Continuous full-scale 21 kHz at 100 percent volume heats the amplifier and drains the battery fast. Keep transmissions short.
  • Hearing safety. 21 kHz is inaudible to almost all adults but young children and pets may perceive it. Avoid holding the speaker to ears during tests.

Build It From Source

The project uses a standard Gradle Kotlin setup:

git clone https://github.com/TA1EEI/ClassD-VHF-Transmitter.git
cd ClassD-VHF-Transmitter
./gradlew assembleDebug
adb install -r app/build/outputs/apk/debug/app-debug.apk

What to inspect in the code if you want to learn:

  • Audio generation: look for AudioTrack, 48000 Hz sample rate, 21 kHz sine synthesis, and OOK envelope gating
  • UI layer: text-to-Morse mapping and timing loop for dits, dahs, and gaps
  • Manifest: confirm the zero-permission claim (no RECORD_AUDIO, no STORAGE, no CAMERA entries)
  • Gradle files: minimum SDK, target SDK, and Kotlin version for compatibility with your handset

Because it uses only public audio APIs, it runs on stock unrooted phones and survives Play Protect-style permission audits trivially.

Comparison: ClassD VHF Transmitter vs Other Phone Covert Channels

System Source Receiver Band Range Permissions Throughput
ClassD VHF Transmitter (TA1EEI) Phone Class-D speaker amp harmonics HT or SDR in AM ~144 MHz VHF Centimeters Zero Morse-rate OOK
AirHopper (Guri et al.) GPU/display cable emissions FM radio / phone ~80-110 MHz FM Meters Sender agent Low bitrate data
GSMem (Guri et al.) Memory bus clock harmonics Phone baseband ~900/1800 MHz Meters Sender agent Low bitrate data
Funtenna (Guri et al.) GPIO toggling as antenna SDR HF to VHF Meters Root / GPIO Low bitrate data
Ultrasonic speaker-to-mic Speaker to nearby microphone Another phone mic 18-22 kHz audio Meters Mic + audio Modem-rate data
Real 2M HT (Yaesu, Icom, Quansheng) Purpose-built PA + antenna Any 2M receiver 144-146 MHz FM Kilometers None (license) Voice + data

The TA1EEI approach is unique in two ways: it needs zero permissions because playing audio requires no dangerous permission, and it lands directly in the 2 meter amateur band where hams already have sensitive AM-capable receivers. The cost is extremely short range and Morse-only speed.

Legal and Band-Plan Notes for Hams

Treat this as an unintentional radiator experiment, not a transmitter project:

  • In most countries, the 144 to 146 MHz segment is allocated to the amateur service on a primary basis. Intentional transmission there generally requires an amateur license and compliance with spurious emission limits.
  • This app doesn’t use the phone radio hardware. Its VHF energy is incidental harmonic leakage at microwatt-or-less levels with centimeter-range fields. That still counts as an emission worth keeping minimal and brief.
  • Keep tests short, on a clear frequency, at the lowest effective volume that still decodes, with the antenna directly coupled. Don’t attempt to amplify, relay, or radiate the signal further.
  • If your national regulator (MCMC, FCC, Ofcom, or equivalent) sets field-strength limits for unintentional radiators, your duty is to stay well under them. Lab-table coupling already does that.
  • For club demos, announce the test frequency, keep power minimal, and log it as an EMC/TEMPEST demonstration rather than a QSO.

When in doubt, receive and study. The educational value is in the receive chain and shielding discussion, not in pushing range.

Why This Matters for Amateur Radio and Security

  1. A living TEMPEST demo for club nights. No expensive lab gear needed. One phone plus one HT demonstrates van Eck style leakage in under five minutes.
  2. EMC intuition. Builders learn why layout, filtering, grounding, and shielding matter by hearing what happens without them.
  3. Receiver skills. Finding a weak drifting AM harmonic trains the same skills as fox hunting and satellite Doppler tuning: open squelch, wide filter, slow sweep, antenna probing.
  4. Threat modeling. Secure-site staff, EmComm teams, and field operators see firsthand why sensitive meetings restrict phones even in airplane mode with WiFi and Bluetooth off.
  5. Open science done right. MIT license, Zenodo DOI, ORCID identity, and a named amateur callsign make the work citable and reproducible instead of a viral mystery video.

Frequently Asked Questions

What frequency do I tune to hear the phone signal?

Start at 144.000 MHz in AM mode with squelch open, then sweep 144 to 146 MHz slowly. The exact peak depends on your phone Class-D switching clock and layout.

Why must I use AM instead of FM mode?

The Morse is amplitude modulation of the harmonic comb. FM limiters strip amplitude changes, so FM receivers erase the signal. AM preserves the on-off envelope.

Does the app need root or special permissions?

No. It uses the standard Android AudioTrack API to play keyed 21 kHz audio. It needs zero permissions, no root, and no radio hardware access.

How far away can I receive the signal?

Only centimeters in practice. Touch the HT antenna tip to the bottom speaker grill. Range beyond a few centimeters drops rapidly because this is near-field magnetic leakage.

Is it safe and legal to experiment with this?

Keep tests brief, low level, and antenna-coupled on a clear frequency. It’s an unintentional radiator demo for education and EMC study, not a communications transmitter. Follow your national band plan and license rules.

Sources and Further Reading

73 de 9M2PJU

If you replicate this on your phone model, note the phone model, Android version, peak frequency, and best antenna spot, then share it with your club. Short-range physics varies by hardware, and every data point helps.

Tag

Related Posts

Post Comment

You May Have Missed