Issue dossier

The community analysis says the firmware image carries no hash or signature block, any re-flashed image boots over BOOTSEL, and stations trust the badge's self-reported identity, achievements, and flight logs, whose 4-character tag is keyed on the badge ID that the badge sends in clear text. The analyst wrote a defensive note for the organizers and says patched bot play was disclosed and approved.

A linkable camp-impact record with badge context, severity, evidence confidence, and source notes.

Back to issues index

unsigned boot and client-trusted station data · community firmware analysis · reported to organizers by the analyst

Badge owners can freely reflash and modify their badges, which the design appears to invite. Any shared leaderboard that uses station uploads as-is would trust client data. badge.gallery does not reproduce the flags, codes, or patch details.

Badge
SAINTCON 2026 Planned Electronic Badge
Category
unsigned boot and client-trusted station data
Severity
note
Confidence
community firmware analysis
Status
reported to organizers by the analyst
Timeframe
SAINTCON 2026, from 2026-10-28
Source note
r3tr0hck342/2026-SaintCon-Badge-Hack SUBMISSION.md and SECURITY_NOTES.md, checked 2026-10-29.

Evidence

Related Resources

community alternative firmware

im-redactd/saintcon26-gif-player

Unofficial MIT-licensed Pico SDK firmware for the SC26 badge by redactd, created October 28, 2026. It plays GIFs on the round display, matches the nine RGB LEDs to the picture, exposes a 15 MB GIF drive over USB mass storage, and has a USB serial console. Not a SAINTCON release.

Badge: SAINTCON 2026 Planned Electronic Badge

community firmware analysis

REABadge badge-talk write-up

Write-up prepared for the SAINTCON badge talk. It maps the original firmware's space cargo-trading game, the USB serial console, the station dock protocol, the I2C EEPROM save format, and the boot-image posture, and documents firmware patches that the author says the organizers approved for automated play.

Badge: SAINTCON 2026 Planned Electronic Badge

community firmware reverse engineering

r3tr0hck342/2026-SaintCon-Badge-Hack

Unlicensed attendee repository created October 28, 2026, described as attempts to reverse-engineer the badge with AI. It holds a dump of the original firmware, Ghidra-based findings, patch and bot scripts, and a station-protocol note written for the organizers. Not a SAINTCON release; badge.gallery does not copy its contents.

Badge: SAINTCON 2026 Planned Electronic Badge

community hardware notes

SC26 badge hardware notes

Community hardware document with a GPIO map recovered from the badge's original firmware: RP2350A with 16 MB flash, Sitronix ST77916 360x360 round LCD over 4-bit QSPI, nine WS2812 LEDs, a single LED, five-way D-pad plus A and B, a 1 KB I2C EEPROM, and a dock-connector UART. It lists what was confirmed on real hardware and what is still unknown.

Badge: SAINTCON 2026 Planned Electronic Badge

official MiniBadge build guide

SAINTCON 2026 MiniBadge Assembly Guide

Official 285-page PDF, v1.0 dated October 22, 2026 and announced in the comms log on October 23. It gives difficulty, rarity, parts, board house, and how-to-get notes for every MiniBadge known for 2026: 4 official, 21 sponsor, 18 community, 6 event, 14 contest, 2 award, 208 personal, 3 badge-accessory, and 4 other entries. Several entries say they plug into your SAINTCON badge. It does not describe the main badge itself.

Badge: SAINTCON 2026 Planned Electronic Badge

official event page

SAINTCON 2026 official event page

Official current source for the October 27-30, 2026 Utah Valley Convention Center event, current production phase, and broader attendee context. The September 28, 2026 recheck found main registration sold out since its July 15 opening with a standby waitlist, and the site's phase tracker listing badges and swag in production under pre-launch operations alongside a badge-fabrication-bay teaser.

Badge: SAINTCON 2026 Planned Electronic Badge

official teaser log

SAINTCON 26 Comms Log

Official in-universe comms log reviewed on September 29, 2026. Four badge-fabrication-bay intercepts (June 13, July 10, July 27, and August 23, 2026) tease a close-up component photo, a badge proof showing wings and a rocket passing a ringed planet, and a twelve-image transmission; a September 8 entry rumours a MiniBadge bingo game, and a September 22 A-Maze-ing Phase 2 entry offers the Jupigotchi MiniBadge to the top 50 solvers. The October 15, 2026 recheck found an October 2 store-catalogue notice listing shirts, badges, lock tools, and more for in-person purchase only at the convention-center café, an October 2 Intercept 007 saying whatever they are building is made to connect to something (the first intercept with motion and audio), an October 11 Intercept 008 crane-assembly construction test, and an October 14 Octopus Game recruitment dispatch. The October 24, 2026 recheck adds an October 22 scoreboards notice, the October 23 MiniBadge Assembly Guide notice, and October 24 floor maps. The teasers publish no MCU, schematic, firmware, or image licence.

Badge: SAINTCON 2026 Planned Electronic Badge

Source trail

Evidence Sources

UtahSAINT / SAINTCON · retrieved 2026-10-15

Comms Log · SAINTCON 26

Primary official teaser source for the badge-fabrication-bay intercepts through Intercept 008 (October 11, 2026), the October 2 in-person store notice that lists badges among purchasable items without saying which, including the July 27, 2026 badge proof described as wings and a rocket climbing past a ringed planet and stars, and for the Jupigotchi MiniBadge puzzle prize. It is narrative teaser evidence for artwork direction and a prize MiniBadge only, not a final hardware specification, production count, or image-reuse grant.

Badge: SAINTCON 2026 Planned Electronic Badge

UtahSAINT / SAINTCON · retrieved 2026-09-28

SAINTCON 2026 official event page

Primary source for the October 27-30, 2026 Utah Valley Convention Center event, current badge-production phase, and attendee context. The September 28, 2026 recheck found registration sold out since July 15 and the phase tracker placing badges and swag in production, with trainings and family-night registration still open.

Badge: SAINTCON 2026 Planned Electronic Badge

UtahSAINT / SAINTCON MiniBadge community · retrieved 2026-10-24

SAINTCON 2026 MiniBadge Assembly Guide v1.0

Primary official source for the 2026 MiniBadge set, retrieved as a 21,175,129-byte PDF (SHA-256 62027f7418282e1b16cf4b137bc186a91cdbb51864d6a1d39b0f8125b26386c4). It credits Jup1t3r with the SAINTCON 2026 Official, Family Night Official, and OFFICIAL H.A.C.K MiniBadges. The SAINTCON 2026 Official MiniBadge is a beginner 1206 LED and resistor kit included with the registration packet. The H.A.C.K set is v-cut into letters and comes in the registration packet or is found around the con. The Jupigotchi is a fully assembled ATtiny MiniBadge with very limited supply. Rarity bands are self-reported estimates, and the guide says nothing about the main badge's electronics.

Badge: SAINTCON 2026 Planned Electronic Badge

r3tr0hck342 / GitHub · retrieved 2026-10-29

REABadge: Reverse-Engineering a Conference CTF Badge with an AI Agent

Secondary first-hand community source from static analysis of a dumped original firmware image (SHA-256 37ee8a7e3f256ff92f115e830acb147439ed3cca07f37f0b0e82160069b298fd), cross-checked on one badge over USB. It supports the stock game, console, station protocol, EEPROM save, and unsigned-boot claims in this record. The dump's UF2 info file reports an RP2350 boot ROM. The write-up gives 4 MB flash, while redactd's notes give 16 MB, so flash size stays unresolved. It also publishes CTF flags and unlock codes, which this record leaves out.

Badge: SAINTCON 2026 Planned Electronic Badge

redactd / GitHub · retrieved 2026-10-28

SC26 badge hardware

Secondary first-hand community source for the main-badge hardware: RP2350A (QFN-60) with 16 MB flash, a Sitronix ST77916 360x360 round LCD, nine WS2812 LEDs, a single LED, a five-way D-pad with A and B buttons, a 1 KB I2C EEPROM, and a dock-connector UART. It says the GPIO map was recovered from the badge's original firmware because no schematics are published, and that the display, LEDs, and four D-pad directions were confirmed on real hardware. The repository is named saintcon26-gif-player and calls the board the SC26 badge; it is not an organizer document.

Badge: SAINTCON 2026 Planned Electronic Badge