Add-on dossier

BOOTSEL bootloader backdoor

A linkable lifecycle record for hardware expansions, app ecosystems, firmware upgrades, cases, radio parts, and post-event badge experiments.

Back to add-ons index

BSides Des Moines 2026 Badge officially documented

badge programming path

Sending BOOTSEL over the USB-CDC serial console jumps into the WCH ISP bootloader for reflashing, complementing the flash station bulk-provisioning tooling.

Badge
BSides Des Moines 2026 Badge
Type
badge programming path
Status
officially documented
Compatibility
BSides Des Moines 2026 Badge
Source
https://github.com/iot-pwn/bsidesdsm26

Badge context

Related Resources

source repository

bsidesdsm26 repository

iot-pwn repository for the BSides Des Moines 2026 badge firmware, published under GPL-2.0, documenting the CH585 RISC-V NFC badge, the flash station provisioning tooling, and the three-layer CTF.

Badge: BSides Des Moines 2026 Badge

Source trail

Evidence Sources

GitHub / iot-pwn · retrieved 2026-05-15

bsidesdsm26

Primary repository source for the WCH CH585 RISC-V microcontroller with integrated ISO 14443A NFC reader, four SK6812 RGBW LEDs, main and boot buttons, audio tone generator, USB-CDC console, the eight-tag village-collection CTF, two static flags, the hash unlock, and the BOOTSEL bootloader backdoor, published under GPL-2.0.

Badge: BSides Des Moines 2026 Badge