The Badge Logbook

# it's a tiny risc-v computer you wear. a 128x128 screen,

# one bit per pixel, pure black and white. six buttons,

# ten rgb leds, and its own little operating system. most

# people clip it on and move on. i wanted to open it up.

# the whole badge is open, so i started reading. learned it

# can display images. tried the official uploader, hit a

# bug, chased it down (it was the keyboard path, not the

# screen) and filed it. by evening my first custom code of

# the week was running on the badge's i/o coprocessor.

[ok] first bug found and reported

# getting art onto a badge meant hand-rolling files. so i

# built a kiosk on a spare tablet: pick an image, tap a

# button, it pushes to the badge over usb. presets, a

# touch ui, nothing to install. point and shoot.

# a kiosk only helps the person standing at it. so i rebuilt

# the same tool as a plain web page. plug your badge into

# your own laptop, open the browser, upload. it talks to

# the hardware directly, no app, no cable-juggling.

-> try it: the badge uploader

# word got around and it turned into a little table. people

# brought their badges, we put their art on them, they

# walked off grinning. i came to take a badge apart and

# ended up running a tiny print shop. best part of the con.

# the car hacking village sells its own badge: a little

# board that plays the part of a car's computer and dares

# you to break in over the same bus real cars use. eleven

# locked lessons. my laptop talked through every one, the

# last by brute-forcing a security key in about nineteen

# minutes. i have never once worked on a car.

[ok] 11 / 11 cleared

# def con runs its own long-range radio mesh, a web of tiny

# nodes relaying messages across the whole con with no wifi

# and no cell. i flashed a keyboard-sized computer to speak

# the same protocol, and it slipped onto the mesh and

# introduced itself as TG7. legal band, just listening in

# and saying hello.

# your phone quietly shouts the names of every wifi network

# it remembers, all day, to anyone bothering to listen. i

# built a small passive tool that only listens and shows

# people their own trail. no transmitting, no attacking.

# the point was to make something invisible visible, not to

# poke at the crowd.

# a companion to the mirror: a passive little tool that

# turned a walk across the con into a map, every wifi and

# bluetooth beacon in the air pinned as i went. no probing,

# no connecting, just logging what was already shouting.

# mostly i ran it to feel how much is broadcasting around

# you at all times. spoiler: a lot.

# the ham radio folks hide a little transmitter somewhere on

# the grounds and you find it by signal alone. i turned a

# pocket hacking toy into a direction-finder: it maps radio

# strength onto a pitch, so you hunt the fox by ear, hotter

# and hotter until you're on top of it. receive only. it was

# built and listening... i just never got to prove it against

# a real hidden fox. ready for next year.

[wip] built, never tested on a live fox

# the badge holds a secret key that doubles as the contest

# flag. my first instinct was the dumb one: brute force it.

# i stood up a real gpu cracking rig on rented cloud

# machines and pointed it at the problem... then worked out

# it was the wrong attack for this badge entirely, and

# retired the whole thing. figuring out why it was wrong

# taught me more than cracking it would have.

# so i went and learned the design instead. where the key

# lives, why loading your own code onto the badge destroys

# it before you can read it, why the obvious software routes

# are sealed shut. it's a genuinely clever piece of work.

# that's bunnie's work, and it shows. real respect.

# the brute force was a dead end, so we went the other way.

# the scene had been circling this for days; we sat down and

# built our own path through it, learning exactly how the

# badge decides to trust its own firmware and where that

# trust has a seam. i picked up a whole category of bug i'd

# never seen, one careful stage at a time. (no method here,

# the contest is still live.)

# flashing one of these badges normally burns its unique

# identity for good, so nobody experiments on the nice ones.

# i wasn't willing to sacrifice a rare badge, so we worked

# out how to run our own code on one without killing it.

# most of that dance is still on paper, waiting to run for

# real. but the principle is the point: don't cook the

# hardware just to prove you can.

# somewhere in there i built an original side-scroller that

# runs natively on the badge. the mario idea that died to a

# 1-bit screen, four coins nobody could reach, and the time

# it booted to a black screen and played dead. it has its

# own write-up.

-> more builds at thegian7.cloud

# then i flashed a spare with our own firmware, just to show

# off: our mark and a morse ticker on the screen, a full led

# light show, and a stretch of "impossible colors" the stock

# badge is capped from ever displaying.

[led] green alive · blue display · gold win

# four days after unboxing a badge i'd never seen, our own

# extraction ran end to end and the key came out. we checked

# it three different ways before we let ourselves believe it.

# i'm not publishing how while the contest is running, that

# isn't the point. the point: a first-year with a consulting

# firm and an AI read a real key off real hardware, by

# building the tool that does it, not by luck and not by

# borrowing someone else's.

[flag] captured