DEF CON 29 Badge Hacking

[Spliff]

Just got my badge the other day .. issue, my wife threw the packaging away that had the code. Is there a way to reset it? Or are the codes all the same?

https://plus.defcon.org/recover.html -- That should help

[_Giglio]

I was able to exchange codes with a creator badge owner and received credit for a new badge type

woo hoo! thanks! Badge Menu:
[1]: Change LED Colors
[2]: Change Keymap
[3]: Reset EEPROM
[4]: Generate Virtual Badge Connection Request
[5]: Enter Virtual Badge Connection Request or Reply
Choose an option:
Enter the request or reply string (snipped)
Badge successfully connected!
New badge type collected!!
Press ENTER to continue...

[JRWR]

You can Interface with my badge at http://129.21.246.193:13409/ you can get my code and input yours -- here is my code that does this https://hastebin.com/ixiduboboj.php -- Use Serial on your badge USB for its menu to get your code!

[dmr]

We have a discord server up for those hacking on the badge. https://discord.gg/9DdhhPrV

Same here and the help screen is about as useful as the reproductive organs of celibate clergy!

[dmr]

While I'm here, I find that when on battery, the keycaps do not stay lit. They do on USB. Is that a bug or a feature? (Save the battery, mayybe?)

[moldavia]

Seems to be normal.

[stanto]

- Connect to badge via serial
- Get 1 of every badge type's code
- Get new web page link
- Share the code 20 times
- Get new web page link
- Do something physical to the badge ;)
- Get new web page link

[Duck Duck]

Exactly. And then make sure you remember the way things used to be.

[stanto]

Ooooh oooh you cryptic person

[slash128]

Tried joining the Discord channel https://discord.gg/9DdhhPrV but it says invalid invite?

[zevlag]

https://discord.gg/Zvd9cebRMM Try that.

[0xRoM]

I Modified JRWR's code.

https://rossmarks.uk/git/0xRM/DC29BadgeBot

it's now automated. The bot joins an IRC channel, all the bots in the channel all share each others codes.
the longer you wait the more bots their are the more codes get shared around :D

[StackingAces]

Has anyone tried anything with the Independence Day image on the back? when the lights are on it's red and the centre of the UFO?

[BannanaJoe]

Does anyone have a link to the updated firmware? I blew mine away and all I have is the original crippled release.

[qumqats]

https://defcon.org/signal/

[zevlag]

Tried joining the Discord channel https://discord.gg/9DdhhPrV but it says invalid invite?

Try this one, it should work.:
https://discord.gg/Zvd9cebRMM

[compukidmike]

Here's the new firmware that fixes the 31-character issue. I've asked the defcon webmaster to upload it to the signal site. I'll post an update here when that's done.
This forum won't let me upload .uf2 files, so change the file extension to .uf2 after downloading.
NOTE: Uploading new firmware will NOT reset your challenge/game stats.

[compukidmike]

It works here (Win 10). I did a binary comparison and the files are identical.

[number6]

Thanks!
For anyone else downloading this firmware image, here is the sha256 checksum hash of 113664 byte long file named "DC29Human2.txt" which you should expect:

aeb728d194e66a404f9245cb30bf223395577aacbffc01a080631e045387ac14

If the sha256 hash for this file does not match the above, consider downloading from the main website.

To download direct from the main website, check out:
https://defcon.org/signal/

Which has a link to:
https://defcon.org/signal/DC29Human2.uf2

For firmware updates, it is a good idea to make sure the file you download is identical to the one on the server and not damaged, truncated or corrupt before you try to install it!
I computed the sha256 hash of "DC29Human2.uf2" on the main web server ( https://defcon.org/signal/DC29Human2.uf2 )
(Ideally, it would be great to use a cryptographic signature for a file, shipped with a file, which would confirm a private key from a developer signed the firmware as officially being from the vendor/provider, but without such a check, at least being able to verify you have the same thing as the server is a minimal precaution before installing.)

If the sha256sum does not match, for this file named "DC29Human2.uf2" length 113664 bytes, it is probably a *bad* idea to try to flash the firmware you have downloaded to your badge.

How to compute an sha256 hash for files on various OS or systems:


MS Windows 10, in cmd.exe try:

certutil -hashfile FILENAME sha256

Linux in sh, bash, csh, tcsh, etc. try:

sha256sum FILENAME

BSD variants in sh, bash, csh, tcsh, etc. try:

sha256 FILENAME

Using openssl on other:

openssl dgst -macopt sha:256 FILENAME

[c0decaps]

This unfortunately didn't solve it for me. Also, I can only generate codes of 30 characters

[stanto]

Here's the new firmware that fixes the 31-character issue. I've asked the defcon webmaster to upload it to the signal site. I'll post an update here when that's done.
This forum won't let me upload .uf2 files, so change the file extension to .uf2 after downloading.
NOTE: Uploading new firmware will NOT reset your challenge/game stats.

I've been trying to exchange codes with someone who's using this new firmware.

They can generate a 32 char code and send it to me, which works and they can accept my reply (I'm signal level at this point).

But they can't generate a 32 character reply code to requests I give them.

Also some people report they can change the LED colours of two extra buttons, which are apparently the volume control.

[compukidmike]

I can't see any way that there would be an option to change extra LED colors.

When you say the can't generate a reply code, is it that their badge rejects the request or your badge rejects the reply?

[stanto]

> When you say the can't generate a reply code, is it that their badge rejects the request or your badge rejects the reply?

I make a request
They generate a reply
reply is invalid. 31 characters

They make a request, it's 32 characters
I make a reply
the reply is accepted on their badge.

[attak]

Can confirm that I can now generate a 32 character code!! Also confirm that when I enter someone else's reply I generate a 31 character reply.