Covert bidirectional data channel over remote desktop audio and keyboard

---

Transfers files, clipboard content, and arbitrary data between a remote desktop session and the host machine using audio encoding and keyboard injection. Bypasses clipboard restrictions, file transfer policies, and DLP controls.

Built for Citrix VDI (also works on any remote desktop environment that passes audio output to the host: VMware Horizon, RDP with audio redirection, Amazon WorkSpaces, etc.)

Architecture

 ┌─────────────────────────────┐                        ┌─────────────────────────────┐
 │     Remote Desktop (VDI)    │                        │        Host Machine         │
 │                             │                        │                             │
 │  ┌───────────────────────┐  │    ♫ audio output      │  ┌───────────────────────┐  │
 │  │  vdi.ps1              │  │ ════════════════════►  │  │  host.ps1             │  │
 │  │                       │  │   multi-carrier OFDM   │  │                       │  │
 │  │  AudioEngine encodes  │  │   80 carriers, stereo  │  │  WASAPI loopback      │  │
 │  │  data as sound        │  │                        │  │  FFT demodulation     │  │
 │  │                       │  │                        │  │                       │  │
 │  │  stdin reads injected │  │    ⌨ keyboard input   │  │  SendInput injects    │  │
 │  │  keystrokes           │  │ ◄════════════════════  │  │  into remote window   │  │
 │  └───────────────────────┘  │   base64 over keybd    │  └───────────────────────┘  │
 └─────────────────────────────┘                        └─────────────────────────────┘

Remote desktop environments block direct file transfer and clipboard sharing as a security control. But two channels are always open:

Channel	Direction	Method	Speed
Audio output	VDI → HOST	Sound plays on host speakers/loopback	~1-4 KB/s
Keyboard input	HOST → VDI	Keystrokes reach the remote session	~200-400 B/s

VDI Bridge encodes data into these channels. No microphone, no network, no additional software.

Signal Processing Pipeline

                          ┌─────────────────────────────────────────────────┐
                          │              TRANSMIT (VDI side)                │
                          │                                                 │
  raw data ──► GZip ──► RS(255,191) ──► Interleave ──► OFDM Modulate ──► WAV
                          │          (16-deep)        (80 carriers)         │
                          └─────────────────────────────────────────────────┘
                                              │
                                    ♫ Citrix audio codec ♫
                                              │
                          ┌─────────────────────────────────────────────────┐
                          │              RECEIVE (HOST side)                │
                          │                                                 │
  WAV ──► WASAPI ──► FFT ──► Demodulate ──► Deinterleave ──► RS Decode ──► GZip ──► data
                          │   (per symbol)                                  │
                          └─────────────────────────────────────────────────┘

Audio Protocol

Carrier Layout

  250 Hz          600   700   800   900  ...  8400  8500 Hz
    │               │     │     │     │         │     │
    ▼               ▼     ▼     ▼     ▼         ▼     ▼
  ┌────┐          ┌───┐ ┌───┐ ┌───┐ ┌───┐    ┌───┐ ┌───┐
  │SYNC│          │ C0│ │ C1│ │ C2│ │ C3│ ...│C79│ │C80│      350 Hz
  │tone│          │   │ │   │ │   │ │   │    │   │ │   │      ┌────┐
  │40ms│          └───┘ └───┘ └───┘ └───┘    └───┘ └───┘      │END │
  └────┘          ◄────── 100 Hz spacing ──────►              │tone│
                  ◄──── 80 data carriers ─────►               └────┘

Parameter	Value
Sample rate	48,000 Hz
Data carriers	80 (stereo bulk) / 16 (mono control)
Carrier range	600 - 8,500 Hz
Carrier spacing	100 Hz
Symbol duration	10 ms (480 samples)
Sync tone	250 Hz, 40 ms
End marker	350 Hz, 20 ms

The 600-8500 Hz range sits inside the speech band that remote desktop audio codecs preserve. Below 600 Hz most codecs apply high-pass filtering. The 100 Hz spacing provides enough spectral separation for reliable FFT bin extraction through lossy compression.

Frame Structure

  ┌──────┐ ┌───┐ ┌─────┐ ┌─────┐ ┌──────┬──────┬──────┬─ ─ ─┬──────┐ ┌─────┐
  │ SYNC │ │gap│ │ REF │ │ REF │ │ SYM  │ SYM  │ SYM  │     │ SYM  │ │ END │
  │250 Hz│ │   │ │  1  │ │  2  │ │  0   │  1   │  2   │ ... │  N   │ │350Hz│
  │ 40ms │ │   │ │10ms │ │10ms │ │ 10ms │ 10ms │ 10ms │     │ 10ms │ │20ms │
  └──────┘ └───┘ └─────┘ └─────┘ └──────┴──────┴──────┴─ ─ ─┴──────┘ └─────┘
                  ▲               ▲                                    ▲
                  │               │                                    │
           phase/amplitude   data payload                        transmission
            reference        (all carriers                         complete
                              in parallel)

Sync detection: Sliding-window Goertzel filter on 250 Hz. Fires when energy crosses the threshold.

Reference symbols: Two known-phase symbols establish baselines for coherent demodulation. Initial phase per carrier: (index % 4) * π/2.

Pilot insertion: Every 200 data symbols, a pilot recalibrates phase drift from the codec's adaptive processing.

Modulation Schemes

  ┌─────────────────────────────────────────────────────────────────────┐
  │                    bits per carrier per symbol                      │
  │                                                                     │
  │  OOK      ■ □        1 bit     ~1.0 KB/s    most reliable           │
  │  DQPSK    ■ ■ □ □    2 bits    ~2.0 KB/s    good conditions         │
  │  4-ASK    ■ ■ □ □    2 bits    ~2.0 KB/s    amplitude keying        │
  │  D8PSK    ■ ■ ■ □    3 bits    ~3.0 KB/s    high quality path       │
  │  16-QAM   ■ ■ ■ ■    4 bits    ~4.0 KB/s    near-lossless only      │
  │                                                                     │
  │  ◄── reliable ──────────────────────────── fast ──►                 │
  └─────────────────────────────────────────────────────────────────────┘

OOK (On-Off Keying) is the default. Carrier present = 1, absent = 0. Survives amplitude distortion and spectral reshaping from lossy codecs.

DQPSK (Differential QPSK) encodes 2 bits in the phase delta between symbols. Differential encoding avoids needing absolute phase reference, which the audio path destroys.

D8PSK / 16-QAM pack 3-4 bits per carrier. Use .\vdi.ps1 test to find the ceiling for your environment.

Stereo Encoding

File transfers use stereo audio. Left and right channels carry independent data streams, doubling throughput. The WASAPI loopback on the host captures and demodulates both channels separately.

Control messages (ping, clipboard commands) use mono with 16 carriers for maximum reliability per carrier.

Error Correction

  ┌──────────────────────────────────────────┐
  │         Reed-Solomon RS(255, 191)        │
  │                                          │
  │   ┌────────────────────┬──────────────┐  │
  │   │    191 data bytes  │ 64 parity    │  │
  │   │                    │   bytes      │  │
  │   └────────────────────┴──────────────┘  │
  │                                          │
  │   Corrects up to 32 byte errors/block    │
  │   16-deep interleaving across blocks     │
  │   ~33% overhead                          │
  │   GF(2^8) with polynomial 0x11D          │
  └──────────────────────────────────────────┘

The interleaver spreads consecutive bytes across 16 RS blocks. A burst error (dropped audio packet, codec glitch across several symbols) becomes scattered single-byte errors across multiple blocks. RS handles those easily.

SHA-256 checksum (first 4 bytes) is transmitted in the header before bulk data. The receiver verifies after FEC decoding.

Operations

Ping

Verifies the full bidirectional channel.

  VDI                          HOST
   │                            │
   │──── PING (16-carrier) ────►│
   │                            │ decode audio
   │◄──── PONG (keyboard) ──────│
   │                            │
   ✓ channel OK

.\vdi.ps1 ping

Clipboard Transfer

  clip-out: VDI clipboard ──♫──► HOST clipboard
  clip-in:  VDI clipboard ◄──⌨── HOST clipboard

Small text (<44 chars) goes over mono control. Larger payloads and files use stereo bulk with FEC.

.\vdi.ps1 clip-out          # VDI clipboard → HOST
.\vdi.ps1 clip-in           # HOST clipboard → VDI

File Transfer

  file-out: VDI file ──[compress]──[FEC]──[modulate]──♫──► HOST saves file
  file-in:  VDI file ◄──[decode]──[base64]──⌨── HOST reads file

.\vdi.ps1 file-out C:\path\to\file.pdf                    # default OOK
.\vdi.ps1 file-out report.docx -Modulation DQPSK          # 2x speed
.\vdi.ps1 file-out data.xlsx -Modulation 16QAM            # 4x speed (clean audio only)
.\vdi.ps1 file-in C:\hostpath\tool.exe C:\local\tool.exe  # HOST → VDI

Audio Diagnostics

Frequency sweep, amplitude sweep, phase sweep, carrier count, symbol rate, and modulation tests. Characterizes the actual audio path to determine max reliable modulation.

.\vdi.ps1 test

Throughput

Operation	Direction	Channel	Typical Speed
File out	VDI → HOST	80-carrier stereo audio	~600-900 B/s (OOK)
File out	VDI → HOST	80-carrier stereo audio	~2.4-3.6 KB/s (16QAM)
File in	HOST → VDI	Keyboard injection	~200-400 B/s
Clipboard	Either	Auto	Near-instant (small text)

  100 KB file transfer time:
  
  OOK   ■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■  ~2 min
  DQPSK ■■■■■■■■■■■■■■■■■■■■                      ~1 min
  D8PSK ■■■■■■■■■■■■■                             ~40 sec
  16QAM ■■■■■■■■■■                                ~30 sec

Setup

Requirements

• Windows (both host and remote session)
• PowerShell 5.1+ (built into Windows)
• Remote desktop client with audio redirection enabled
• Zero external dependencies

Running

Host machine (where the remote desktop client runs):

.\host.ps1                        # start listening
.\host.ps1 -Local                 # local test mode (no remote desktop)
.\host.ps1 -Modulation DQPSK     # match VDI modulation

Inside the remote session:

.\vdi.ps1 ping                    # verify channel
.\vdi.ps1 clip-out                # send clipboard to host
.\vdi.ps1 file-out secret.pdf     # send file to host

Start host.ps1 first. It is passive and responds to commands from the VDI side.

Detection Surface

  ┌──────────────────────────────────────────────────────────────┐
  │                     What's detectable                        │
  ├──────────────────────────────────────────────────────────────┤
  │  Audible signal      Mute speakers / use headphones to       │
  │                      eliminate. WASAPI loopback still works. │
  │                                                              │
  │  Session recording   Citrix/RDP recordings capture the       │
  │                      audio if session recording is enabled.  │
  │                                                              │
  │  Endpoint telemetry  PowerShell + WASAPI COM calls on host.  │
  │                      Pure PowerShell on VDI, no binaries.    │
  ├──────────────────────────────────────────────────────────────┤
  │                     What's NOT detectable                    │
  ├──────────────────────────────────────────────────────────────┤
  │  Network traffic     None. Data moves over audio + keyboard. │
  │  Clipboard logs      Clipboard API is local on each side.    │
  │  File transfer logs  No shared drives or mapped paths used.  │
  │  Process injection   No DLL injection, hollowing, or hooks.  │
  └──────────────────────────────────────────────────────────────┘

Limitations

• Throughput is bounded by what the remote desktop audio codec preserves. Aggressive low-bandwidth audio policies reduce the usable frequency range.
• Keyboard injection needs the remote desktop window focused. If another window steals focus during HOST→VDI transfer, injection goes to the wrong target.
• Files >1 MB work but take time. This tool targets specific file exfiltration, not bulk transfer.
• The test diagnostic suite helps find the performance ceiling for a given environment.