Seeing Screens Through the Air: Reconstructing Video From EMF

Image 1: CRT Monitor

Have you ever imagined that you were sitting alone in a corner of your room, opening a secret image or typing something that should be your secret, only to have it exposed by a hacker? In this article, we discuss how an attacker can see your screen without you even knowing it (in practice, this technique reveals structure and edges rather than fully readable content).

In this modern world, almost all people already have their Portable PC, which is called a laptop. This is to ensure portability and the ability to work anywhere and quickly. Still, even though we already have a portable one, we also have a maybe (more) powerful machine that we use as HomeLab, Office PC, or perhaps just as simple as a Gaming PC.

Image 2: Electron Gun

Another component that is tightly coupled to a PC is the monitor. This becomes particularly interesting when we examine older display technologies. In the past, people commonly used CRT (Cathode Ray Tube) monitors. A CRT works by using an electron gun that fires a beam of electrons toward the screen. The beam scans from left to right across the screen, then returns to the left and moves down to the following line. This process repeats from the top of the screen to the bottom. One complete scan from top to bottom is called a frame, and this process is repeated many times per second to refresh the image. Because CRTs operate using high voltages and rapidly moving electrons, they naturally emit electromagnetic radiation (EMF) as a byproduct of their operation.

Any fast-changing current produces electromagnetic radiation; long story short, Wim Van Eck noticed this phenomenon and took advantage of it to catch the signal with a radio and then reproduce the image with it. To this day, this thing is called Van Eck Radiation.

HDMI EavesDropping

We have already discussed the background and history of this technique; let us now examine it in greater technical detail. HDMI uses high-speed data pairs and a TMDS clock pair, where the signal changes rapidly depending on the state sent by the PC.

Image 3: HDMI Pinout

Note that every fast-changing current will emit RF as a side-channel effect. We can observe this effect using a tool named SDR or Software Defined Radio. In this article, I will be using LibreSDR; it's overkill if you buy this for only this purpose, because you can buy any cheap SDR that has a range from 45 MHz to 1 GHz.

Image 4: GQRX Interface

After connecting the SDR to our device, we will use GQRX to examine the spectrum to verify that the SDR is functioning as expected. First, find the local radio, set the frequency, and ensure you hear the radio stream; if not, adjust the SDR gain in the input content tab.

And if you already make sure the sdr work properly, we can go to the next step, find the harmonic frequency of the hdmi, i use a few image with various strip black and white with multiple space between the color, if you use AM demodulation, it will play sound every time you change the image, since black and white is the most drastically different bit when they emit the RF.

Image 5: HDMI EMF

As shown in the image above, this frequency is an observed leakage harmonic and may vary across setups; however, in my tests, it is approximately 197-198 MHz for standard screen sizes. The harmonic sound that you will expect when the white area and black area change is like “piiiip, puuup”.

Decoder Concept

To decode the image, we must know the screen resolution and the clock frequency. We know that HDMI uses the raster scan technique, which displays pixels from left to right and advances to the following line in the same order. Before the image can be decoded, the leaked RF signal is analog and must be digitized by an ADC within the SDR for processing.

Image 6: HDMI Vsync & Hsync

After we know parameter like screen resolution and hdmi clock frequency, we need to understand what is Horizontal Sync (Hsync), Vertical Sync (Vsync), back porch (BP, and front porch(FP), those four parameter responsible for determining when is active video area start (Back Porch / BP), when is Active video Area stop (Front Porch), when is the end of horzontal line(Hsync). In contrast, the pixel clock determines pixel timing within a line and when to reset to the home position (top-left corner of the screen) and change to the next frame (Vsync). If you want to find more about this, you can read this https://docs.amd.com/r/en-US/pg236-v-hdmi-rx-ss/Native-Video-Output-Interface

At this point, an important question appears: if the EMF signal has a different amplitude, can we translate this value into pixel intensity, like 0 to 255 grayscale? The short answer is yes, but not in the way people usually imagine. In HDMI, electromagnetic emissions are not directly related to whether a pixel is black or white, but rather to how often the digital signal changes state. When the screen displays a flat color, either black or white, the data bits remain essentially constant, resulting in low switching activity and low EMF emission. However, when the image contains edges, text, or high-contrast patterns such as black-and-white stripes, the bits toggle rapidly, producing higher current changes and stronger EMF radiation. Because of this, mapping EMF amplitude to a 0–255 value does not represent absolute brightness, but rather the density of bit transitions. This is why reconstructed images typically emphasize borders, text, and sharp edges, whereas smooth regions appear dark or noisy. In other words, what we reconstruct from EMF is closer to an edge-detected image instead of the original visual content.

Image 7: Result 1

From the image above, we can conclude that this attack is highly effective: the text content and the image with sharp edges indicate numerous transitions that generate EMF with low or high amplitude, depending on the content of the screen itself.

Image 8: Result 2

From the image above, we can see that this attack is less effective for small text, but it is effective for large text. This resolution can be improved by using a directional antenna, which can provide greater gain than the omnidirectional antenna used with my LibreSDR.

Image 9: LibreSDR

I have made comparisons to show how text size affects the image resolution results.

Image 10: Result Comparison

From this discussion, we can see that electromagnetic signals, which are often treated as mere "noise," can actually carry meaningful information. Although EMF-based video reconstruction cannot perfectly reproduce an image as seen on the screen, the leakage is sufficient to reveal visual structures and patterns.

This type of attack primarily highlights edges, text, and high-contrast regions, making it effective for detecting large text or strong shapes, whereas fine details remain difficult to recover. This demonstrates that security is not only about protecting data at the software or protocol level, but also about understanding the physical and electromagnetic behavior of the hardware itself.

Image 11: effective mitigations

The most effective mitigations against EMF-based video eavesdropping are proper shielding, high-quality or optical display cables, good grounding practices, and physical distance. While software-based mitigations can reduce information leakage, proper prevention requires addressing the hardware's electromagnetic behavior.

Ultimately, experiments like this are not intended to create fear, but to raise awareness of side-channel attacks that extend beyond traditional network-based threats. With a better understanding, systems can be designed more securely through improved shielding, signal integrity, and hardware-aware mitigation techniques.