CHCon 2025 Badge Challenge

The rest of this article contains hints and spoilers, hover over an individual spoiler for a few seconds to reveal it, or press the nearby button to reveal all nearby spoilers.

Stage 1: Initial access

We start by connecting the badge to a computer via USB cable. Be aware of the risks of plugging in USB devices you are given; especially computer security conferences. The device exposes an emulated serial port; on my Macbook it showed up as /dev/tty.usbmodem101, which I could connect to using screen:

$ screen /dev/tty.usbmodem101 Enter passwordle: 

The badge illuminates various LEDs in response to failed login attempts, using a Wordle pattern. Through the LEDs you can work out how many characters the password is, and the position of each letter. The password is made up of characters from the ASCII printable characters set.

Stage 2: Superuser access

After logging in to the badge, we have options for choosing an LED pattern or defining a new one, as well as activating a Minecraft server (which requires WIFI and superuser access).

The superuser login provides no useful feedback, but there's a hint hidden inside the LED pattern help docs, suggesting that the password can be discovered by navigating the initial stack of a new pattern. Fortunately there's an example of how to take advantage of this, by taking an ASCII character and representing it in binary using the first eight LEDs.

Here's the code that I was able to use to retrieve the first letter:

            # The initial stack includes the password [.., '?', '?']
LED_INDEX   # [.., '?', '?', led]
SHR         # [.., '?', shifted]
PUSH 1      # [.., '?', shifted, 1]
AND         # [.., '?', 0or1]
PUSH 255    # [.., '?', 0or1, 255]
MUL         # [.., '?', 0or255]
SET_PIXEL   # Pixels illuminate to 0or255 based on character's binary code
    

Then using a short terminal command to convertthe binary back to ASCII:

$ echo 00100001 | perl -lpe '$_=pack"B*",$_' ! 

...and then, prefacing the code with POP lines to retrieve additional letters until reaching the head of the stack.

Stage 3: Minecraft

This is where Jeremy's work really shines; the badge even supports a novelty Minecraft server, with a series of puzzles that integrate into the LEDs to follow your progress.

Activate Wifi and the Minecraft server, then run a Minecraft Java Edition client loaded with version 1.21.4 (I used sklauncher). The server is fragile and sometimes causes the ESP32 to panic and restart, so this stage can take time. Use a "direct connection" to connect directly to the server, instead of searching for network hosts.

Once loaded, you appear near the top of a puzzle tower, and your goal is to activate the switch (or switches) on each level and find the hidden path to the level below. Start by heading up the steps to the top.

Congratulations!

Once you've finished descending the tower, a final message awaits before you drop down into the void.

My congratulations to Jeremy and his collaborators, this was an accessible, engaging and multi-faceted challenge!