# whoami

I take locked-down things apart, then ship what I learn.

My first DEF CON ended with the badge's master key: four days, one badge, dead ends posted alongside the wins. Here's how it went.

Read the DEF CON 34 story See the builds Get in touch ↗

# about

Independent hacker-developer, wide range

I open hardware, firmware, and software that isn't supposed to be opened, and write up what actually happened, including the parts that didn't work. Rust and embedded systems, browser-to-hardware bridges like WebUSB, privacy-first local AI tooling, Docker-based systems work, games: whatever the problem calls for.

Claude is my regular pair, not to skip the work, but to keep the loop of "try it, read the result, try the next thing" tight enough that four days is enough to get somewhere real.

The catalog runs from privacy-first local tooling (voice cloning, offline coding assistants) to embedded and systems work (badge firmware, LiDAR streaming) to things that are just fun (an ambient screen border tied to your calendar, a LOTR-themed esoteric language, a homebrewing logbook). The throughline: pick something, take it apart, ship what's left standing.

I also run a small consulting shop on the side, Old Forrest Consulting.

# selected-builds

Recent work

Three builds worth a closer look, then the shortlist. The full catalog lives in the catalog.

The Badge Logbook

Four days at DEF CON turning one badge into a workbench. Read the full logbook.

DC34 Badge Platformer

An original side-scroller written natively in Rust for the DEF CON 34 badge. 1-bit screen, no FPU, built in a day.

LiDAR Explorer

Streams 23 million classified LiDAR points in the browser from a single 840MB file, via a viewport-aware octree.

VoiceForgeclone your voice locally; nothing leaves your machine
Team Intelknowledge capture for dev teams, pulled from Claude Code sessions
claude-code-ollama-sandboxClaude Code on local Ollama models, in an isolated Docker environment
Scarab Shuffleslap fast, claim the pile, survive the dynasties

Browse the full catalog

# case-studies

Case studies

# dc34-badge-hacking

Four days, one badge, one flag

First DEF CON. Drove out, badge in hand, no security background. Four days later the badge had given up its master key. Here's how it went.

[ok] Day one: found and reported a bug in the badge's official uploader. Then built my own WebUSB uploader, first as a tablet kiosk, then as a browser page anyone could use.

[ok] Detour to the car-hacking village: cleared the full 11-lesson CAN bus course, including brute-forcing a security key in about nineteen minutes. I'd never worked on a car before.

[wip] Not everything landed. A GPU brute-force rig turned out to be the wrong attack and got retired. An AR-glasses back-channel worked in the lab and never made it onto the floor. Both are in the log.

[flag] The turn: instead of brute force, learn how the badge's signing and trust model actually worked. Built an independent path through it and pulled the master key, verified three different ways before trusting it.

4days

11/11car-hacking course cleared

1bug found & reported

1master key extracted

Read the full logbook

# contact

Building something? Let's talk.

Best way to reach me is GitHub, or through the shop.

GitHub ↗ Old Forrest Consulting ↗ catalog