Hacker Con Badges

Not just specs

Issues & Camp Impact

Safety warnings, delivery problems, app-store gaps, team-process history, and first-hand reports are tracked as sourced records.

Reset
2204 matching issue record(s)
FightDystopia 2025 Badge (DEF CON 33) note

firmware, CTF, party-support, and source-license gap · high-level maker feature and party wording · features and purpose named; implementation and accounting context unpublished

The listing says the ESP32-S3 badge is fully programmable, has a CTF/puzzles, unlocks GIFs/bling, and helps support the FD party, but no reviewed source provides firmware, binary, code, repository, license, build/flash instructions, game rules, solution/reset path, score service, content rights, data handling, party recipient, donation amount, accounting, affiliation, update policy, or security testing.

The catalogue records the advertised activity and party-support framing without assuming open source, an ongoing service, rights-cleared content, a particular beneficiary, or a verified fulfillment of support.

Source note: FightDystopia 2025 Badge product listing.

H4irl1n3 M0gg3r5 Zombie Badge (DEF CON 34) note

firmware, CTF, protocol, backend, and licensing gap · team-announced software claim · no public technical release identified

The source says the CTF lives in firmware and invokes real protocols plus a gated backend, but no reviewed material publishes firmware, source code, binary, challenge inventory, protocol description, backend service, build/flash path, update/recovery path, account-data policy, score validation, software license, or terms for player content.

The record does not convert a game announcement into a reproducible software release, operational service, security claim, data-handling guarantee, or solution guide.

Source note: Zombie Badge Info Dump.

Agency Wand (DEF CON 34) note

firmware, UART/XMODEM bootloader, release, source-license, and support boundary · public README and repository-tree review · current public branch and documentation visible; formal release/license/support terms unrecovered

The README describes exposed UART/XMODEM bootloader context and a rapidly developed codebase, while the public repository has firmware material and a latest-branch commit labelled as a final combined DEF CON 34 binary. The reviewed repository presents no tags and no explicit root license. These sources do not establish a versioned/reproducible release, source-to-unit mapping, build/dependency record, release integrity, safe adapter/terminal procedure, update success, rollback/recovery guarantee, security review, vulnerability process, support channel, or warranty.

The catalogue links a substantive public development trail without treating a branch label or bootloader documentation as a complete supported release, a safe flashing guide, a legal reuse grant, or proof of every event unit's firmware.

Source note: trueControl/hsc25-dc34-wand README, repository root, current commit/tag surface, and badge.gallery source-use policy.

Breadbadge (DEF CON 34) note

firmware, UPDI operations, source-license, and support boundary · live maker firmware-feature listing · feature list published; release and target-operation assurance unrecovered

The listing advertises UI/LED animations, UPDI ping/erase/flash, raw-HEX loading, I2C tools, and power sensing, but does not publish a source repository, binary, version, build/toolchain/dependency record, supported targets, erase/flash safeguards, input validation, storage integrity, recovery/rollback path, security review, license, vulnerability policy, support channel, or warranty. Marketplace images also lack a selected reusable-license or explicit-permission basis.

The catalogue records the published high-level feature surface without supplying programming steps, treating it as an audited firmware release, promising safe behavior on attached devices, or reusing marketplace media.

Source note: Tw0nkus Breadbadge Uberflux listing and badge.gallery image policy.

Volatile Organic Canary SAO (DEF CON 34) note

firmware, VOC algorithm, release, and licensing boundary · maker product description, maker-owned source archive, and public release page · source tree public; no release, license, or event-unit mapping recovered

The maker-owned 5-dc34-canary-badge repository contains a PlatformIO Arduino source tree matching the Canary's components and public behavior outline, but reviewed product material does not directly link a commit or branch to the sold SAO. Its public release page reports no releases, and no root license file was recovered. The sources do not establish a final installed firmware, source-to-unit mapping, pinned dependency state, algorithm/library version, calibration state, binary provenance, update/recovery policy, safe operating procedure, or support commitment.

The catalogue can cite the public source archive without presenting it as a finalized event release, validated VOC algorithm, supported update path, secure deployment, operating instruction, or a code/artwork/media reuse grant.

Source note: Volatile Organic Canary SAO product page; lepi-labs/5-dc34-canary-badge source tree and public releases page.

BSides San Diego 2024 ESP32-C3 Badge note

firmware, allocation, and archive-revision boundary · badge-team README and public archive · documented caveat

The README says conference badges were flashed with earlier firmware than later `latest` source behavior. Public sources do not provide an immutable event-day firmware image, build record, configuration, recipient ledger, ticket relationship, production QA record, or evidence that every delivered unit matched the archive.

The catalogue preserves the source-backed 400-distributed claim and technical tree without turning either into a universal allocation or event-day firmware assertion.

Source note: Somerset Recon BSides Badge 2024 README and commit-pinned source archive.

Monorail Con Badge (DEF CON 34) note

firmware, audio, media, and license gap · official product description and source review · no public implementation archive identified

The speaker/mini-SD statement does not link a firmware repository, binary, controller/platform, source audio, media license, MP3 handling details, file workflow, update/recovery instructions, software license, hardware license, or a final-feature verification source.

The record describes the maker-published audio/storage intent without asserting reproducible firmware, media-reuse rights, final playback behavior, or user-operation instructions.

Source note: Zach's Hacks product page and public storefront payload.

Whose Slide Is It Anyway? 10 Year Anniversary Badge note

firmware, audio, source, and intellectual-property scope gap · official product description and source review · no public technical release identified

The maker describes pre-programmed sound/light behavior and physical gong/rear artwork but links no firmware, binary, source repository, build/flash workflow, audio asset/source list, software/art license, art provenance chain, update/recovery path, or hardware-license grant.

The record describes the stated audiovisual/art surface without asserting reproducibility, software availability, audio/art reuse rights, final content, or support scope.

Source note: Whose Slide maker product page and storefront payload.

HackGDL 2026 Camera Badge note

firmware, camera, and deployment boundary · public project and product documentation · not fully documented

The project and product pages support a Linux/Luckfox camera-badge platform, but this pass did not establish a signed release, final deployed image, post-event firmware parity, camera-use workflow, operating-state defaults, or a data-handling statement for any distributed units.

The record avoids setup, login, and interface-command instructions and does not infer security, privacy, operational, or final firmware properties beyond the documented high-level platform.

Source note: Electronic Cats Camera Badge HackGDL 2026 product page and ElectronicCats/badge_hackgdl_2026 repository.

Ouroboros Badge (DEF CON 34) note

firmware, cryptography, performance, and source-license boundary · maker-described product claims and adjacent repository review · claims are not independently validated; matching release and clear license absent

The source describes RISC-V assembly, UART puzzles, named cryptographic primitives, constant-time behavior, and low-power/performance characteristics, while the linked GitHub repository describes a separate AVR/ATmega328P framework with an Other license field. No matching CH32V003 source, binary, build/flash path, test vector, benchmark method, hardware package, recovery process, security review, or clear applicable license was reviewed.

The catalogue does not characterize the badge as secure, audited, reproducible, open source, performant, or suitable for a security-sensitive purpose solely from maker marketing or an adjacent framework.

Source note: Ouroboros Badge #BadgeLife product page, How It Works PDF, and mytechnotalent/ouroboros repository.

HRV SSTV Badge (DEF CON 34) note

firmware, data, license, and source-scope boundary · commit-pinned firmware material, project status, and root license text · source files published; final software and rights scope unverified

The repository contains CMake material, firmware documentation, and a C source file, while the dated status document still marks firmware work as unfinished. No reviewed source establishes a tagged firmware release, reproducible build, final binary, source-to-device mapping, update/recovery outcome, data-retention or privacy practice, security review, support policy, or warranty. The root MIT text uses a generic copyright placeholder and refers to software and associated documentation, so it does not resolve rights for all hardware files, media, third-party material, or a badge image.

The catalogue links the public source archive without treating it as an audited or finished firmware release, authorizing users to follow its procedures, or treating the root license as broad hardware/media/image permission.

Source note: HRV SSTV Badge firmware material, project status, and root MIT license text.

Wordweaving Badge (DEF CON 34) note

firmware, documentation, and licensing gap · primary maker product statement · maker promises post-con material; no current release identified

The listing promises post-con hardware documentation and a stub firmware but no reviewed source currently provides a repository, binary, source tree, game data, build/flash instructions, update/recovery path, release version, firmware hash, hardware license, software license, or documentation/media license.

The dossier records the promise as a future source lead without asserting software availability, reproducible builds, final feature behavior, or reuse rights.

Source note: Wordweaving Badge Uberflux listing and BigTaro project page.

Sneakreaper Limited-Edition Badge (DEF CON 34) note

firmware, feature-readiness, and security-behavior boundary · author's explicit day-one qualifier · only source-starred features described as available day 1

The author expressly says most listed capability categories are not ready out of the box and marks only LED adjustment, a hidden CTF/scavenger hunt, and NFC read/write as day-one functions. No firmware, binary, source tree, build/flash guide, challenge rules, feature matrix, configuration, protocol, update/recovery path, security review, test result, privacy policy, or software license is public.

The record does not represent deferred or merely hardware-capable categories as shipped functions, supported workflows, secure behavior, or final user experience.

Source note: Sneakreaper limited edition defcon badge!

DC34 CompuNet Badge — Malware Scan Tool 3000 note

firmware, installer, dependency, data, and license-scope boundary · public software tree, README, and root MIT license · public source/documentation trail; final firmware and third-party provenance unverified

The project exposes an Arduino sketch and SD-card assets, and its README refers to an ESP32 driver installer plus external Arduino core/library dependencies. The root MIT license covers repository software and associated documentation under the stated copyright, but does not audit, license, or validate installer binaries, external libraries, hardware files, images, RFID assets/data, any security claims, a reproducible build, a final flashed image, a source-to-device hash, update/recovery process, support policy, or event-unit parity.

The catalogue records public code and documentation without asking readers to run installers, treating the project title as a security claim, or representing the repository as a complete/audited/reproducible event-firmware release.

Source note: DC34 CompuNet Badge README, Software tree, and root MIT LICENSE.

Cult of Cthulhu Indie DEF CON 34 Badge note

firmware, interaction-protocol, and licensing gap · primary maker storefront source · needs public archive or terms

The product copy narrates game modes and badge-to-badge beacon behavior but does not link firmware source or binary, a flashing/update path, a wireless protocol, message format, source/build instructions, or a software/documentation/hardware license.

The catalogue does not infer radio technology, cryptographic behavior, exploit mechanics, interoperable networking, source availability, or redistribution rights from promotional game language.

Source note: Pfarrside Creations badge-only product listing.

Station 562 Badge (DEF CON 34) note

firmware, key-pair, signing, and protocol gap · maker claim · high-level signed-firmware claim only

The author says firmware is signed and each badge has its own key pair, but no implementation, algorithm, keys/certificates, trust model, verification user interface, secure-boot chain, source, binary, software license, build/release provenance, key-recovery/revocation process, or audit is public.

The catalogue does not translate a security-oriented maker claim into a cryptographic assurance, vulnerability claim, identity guarantee, or implementation recommendation.

Source note: Station 562 maker announcement comments.

iFixit SAO (DEF CON 34) note

firmware, license, artwork, and image-provenance boundary · repository metadata and commit-pinned README review · source tree public; license, production release, and reusable-image permission unrecovered

The repository publishes PlatformIO/Arduino code, SVG artwork, photographs, and KiCad files, but GitHub reports no detected repository license and the reviewed root has no license file. The README's statement that SVG layers can be inspected, modified, or reused is not treated as a visible legal license or image permission. No tagged production firmware, release manifest, source-to-unit mapping, dependency lock, support policy, image-specific license, photographer attribution, or image-processing provenance is published.

Code and design material remain linked as evidence, while the record stays image-free and does not present the repository as an open-hardware, software, artwork, or media-reuse grant.

Source note: NerdFlare/iFixit-SAO-2026 repository metadata, root tree, and commit-pinned README.

NilbinSec Power Glove Re-release SAO (DEF CON 34) note

firmware, programmable behavior, current GitHub, and licence gap · current roster plan and historical repository review · Day-1 GitHub plan stated; 2026 technical archive absent before event

The roster says a GitHub post is planned for DEF CON Day 1, but the event had not yet begun. The older repository exposes only a README and Gerber directory; it does not identify a microcontroller, firmware source/binary, build toolchain, flashing/update path, behavior specification, 2026 release, source/hardware/documentation licence, support policy, or warranty.

The catalogue does not turn a future publication promise, flashing LED component labels, or an old Gerber archive into a claim of programmable behavior, open source, reproducible current firmware, or licensed reuse.

Source note: DEFCON 34 Badgelife Form response and NilbinSec DC32 repository.

Beelzebub Minibadge Holder (DEF CON 34) note

firmware, programming, release, and source-license gap · public repository and source review · development source visible; final release and explicit license unconfirmed

The maker describes open-source hardware/software and the public tree exposes KiCad and AVR source, but the reviewed repository root did not visibly expose a LICENSE/COPYING file, release, tagged build, flashing guide, programmer settings, fuse map, recovery path, version-to-product mapping, security review, or support policy. The README's programming-connector wording does not supply a safe or endorsed modification procedure.

The catalogue links a public implementation trail without converting marketing language into a legal reuse grant, reproducible build, supported reflashing path, final firmware release, or warranty.

Source note: Beelzebub product page, repository README/root, firmware source, and hardware tree.

Krampus Minibadge Holder (DEF CON 34) note

firmware, programming, release, and source-license gap · public repository and source review · development source visible; final release and explicit license unconfirmed

The maker describes open-source hardware/software and the public tree exposes KiCad and AVR source, but the reviewed repository root did not visibly expose a LICENSE/COPYING file, release, tagged build, flashing guide, programmer settings, fuse map, recovery path, version-to-product mapping, security review, or support policy. The README's development/programming connector wording does not supply a safe or endorsed modification procedure.

The catalogue links a public implementation trail without converting marketing language into a legal reuse grant, reproducible build, supported reflashing path, final firmware release, or warranty.

Source note: Krampus product page, repository README/root, firmware source, and hardware tree.

Submarine Badge & Pirate SAO (DEF CON 33) note

firmware, puzzle, CTF, and source-license gap · high-level programmable and challenge wording · features named; implementation and release context unpublished

The source names fully-programmable behavior, hardware/software puzzles, soldering challenges, CTF deliveries, and narrative/game elements but does not publish firmware, a binary, code, repository, license, build/flash instructions, rules, reset path, solutions, scoring, networking, data handling, update policy, or security testing.

Readers can understand the advertised interaction surface without assuming open source, completed service availability, reproducible behavior, or a verified security model.

Source note: Submarine Badge & Pirate SAO product listing.

Masonic33 Indie Puzzle Badge (DEF CON 33) note

firmware, puzzle, and source-license gap · high-level maker puzzle wording · gameplay behavior named; implementation and source context unpublished

The listing says analog tuning and four puzzles unlock LED patterns, but no reviewed source provides firmware, binary, code, repository, license, build toolchain, fuse map, calibration values, puzzle solutions, score/reset path, update policy, accessibility information, security review, or test results.

The catalogue preserves the advertised interactive surface without assuming it is open source, reproducible, stable, fully documented, supported, or uniformly present in every unit.

Source note: Masonic33 Tindie listing and Hacker Couture DEFCON 33 Product List.

CPEC DC34 MechBattle Badge note

firmware, radio, privacy, and license boundary · public repository review · in-progress source and Arduino file with no reviewed final release or root license

The game source contains BLE-related code, QR support, display/sound modules, and game data, and the companion tree contains an Arduino source file, but no reviewed repository supplies a tagged release, final binary, reproducible build statement, hardware-matched configuration, stable radio or add-on protocol, player-data/privacy statement, consent model, security review, update/recovery policy, or explicit root license. The sources cannot establish final wireless behavior, data handling, or a working host/add-on firmware result.

The record does not offer configuration or operating instructions, claim secure or private interaction, assert a released firmware, or treat public code as a license grant.

Source note: CPEC DC34 Mech Badge Game and DC-34-Mech-SAO repositories and metadata review.

BSides Orlando 2026 Electronic Badge note

firmware, release, and license gap · public repository tree and GitHub metadata · firmware and release published; no repository license; SAOv3 library pending

The republished repository now carries firmware source, a v1.0.0 release with binaries, and build and flashing documentation, but still has no LICENSE file or detected licence, and its saov3-lib submodule pointed at a library the README says was not yet public, so a clean source build is not yet reproducible from public material alone.

The dossier documents published firmware behaviour and hashes without implying open-source terms, redistribution permission, or a reproducible build.

Source note: 2026-badge README, firmware README, .gitmodules, release v1.0.0, and GitHub metadata on the 2026-10-01 pass.

Cyb3rBytes404 Cyber-Cat Badge (DEF CON 34) note

firmware, release, and licensing boundary · public repository and release page · educational source is public; final release and reuse terms unrecovered

The repository exposes MicroPython teaching material, while its public GitHub release page reports no releases. No reviewed source establishes a tagged final firmware, binary, source-to-unit mapping, build/dependency state, firmware image on a giveaway PCB, update/recovery policy, security review, support commitment, data practice, code license, artwork license, or media reuse permission.

Public source visibility is recorded without treating it as a finished event release, reliable operating path, security assurance, or permission to copy code, artwork, project branding, photographs, or screenshots.

Source note: Cyb3rBytes404 repository, immutable README, and public release page.

Carolina Code Conference 2026 Circuit Board Badge note

firmware, release, and support boundary · commit-pinned MIT partner source archive · source and examples public; deployed-image/support scope unrecovered

The archive publishes CircuitPython 10.2.1 documentation, a launcher, examples, libraries, and a final event-day Weather-sample fix. It does not provide a signed/tagged release, immutable factory image, serial-number-to-build mapping, recovery image, release process, vulnerability policy, support owner, service terms, or evidence that every unit carried the same files.

The catalogue can describe a public editable software path without claiming a production-certified firmware release, uniform field deployment, long-term maintenance, or safe configuration.

Source note: Circuit Board Medics commit-pinned Carolina Code Conference 2026 Badge README and August 15, 2026 commit history.

DFIU SAO (DEF CON 34) note

firmware, release, flashing, and source-license gap · public repository and current root review · development source visible; release and license unconfirmed

The public code repository has a PlatformIO environment and source, but reviewed roots did not visibly expose a README, release, or explicit LICENSE/COPYING file. Sources do not establish a final firmware binary, tag, release notes, version-to-production mapping, reproducible build, programmer/toolchain setup, supported flashing path, rollback/recovery, signed update, security assessment, vulnerability process, warranty, support policy, or a license grant for code/hardware/media.

The catalogue links the source trail without representing the artifact as fully open source, reproducibly buildable, safe to reflash, support-guaranteed, security-reviewed, or licensed for redistribution.

Source note: dfiu-ch32v003-code and dfiu-ch32v003-pcb public repository roots plus DFIU PlatformIO configuration.

IFLFU SAO (DEF CON 34) note

firmware, release, flashing, and source-license gap · public repository and current root review · development source visible; release and license unconfirmed

The public code repository includes a Makefile, Easy PDK material, and C source, but reviewed roots did not visibly expose a README, release, or explicit LICENSE/COPYING file. Sources do not establish a final firmware binary, tag, release notes, version-to-production mapping, reproducible build, programmer/toolchain setup, supported flashing path, rollback/recovery, signed update, security assessment, vulnerability process, warranty, support policy, or a license grant for code/hardware/media.

The catalogue links the source trail without representing the artifact as fully open source, reproducibly buildable, safe to reflash, support-guaranteed, security-reviewed, or licensed for redistribution.

Source note: iflfu-v2-pfc161 and iflfu-hardware public repository roots plus IFLFU main.c.

Portal Gun SAO (DEF CON 34) note

firmware, release, flashing, and source-license gap · public repository and current root review · development source visible; release and license unconfirmed

The public code repository includes a PFC161 directory with Makefile, Easy PDK material, and C source, but reviewed roots did not visibly expose a README, release, or explicit LICENSE/COPYING file. Sources do not establish a final firmware binary, tag, release notes, version-to-production mapping, reproducible build, programmer/toolchain setup, supported flashing path, rollback/recovery, signed update, security assessment, vulnerability process, warranty, support policy, or a license grant for code/hardware/media.

The catalogue links the source trail without representing the artifact as fully open source, reproducibly buildable, safe to reflash, support-guaranteed, security-reviewed, or licensed for redistribution.

Source note: portal-gun-sao-dc33-code and portal-gun-sao-dc33 public repository roots plus Portal Gun PFC161 main.c.

Helgatchi Badge (DEF CON 34) note

firmware, release, source-license, and support gap · public repository and current metadata review · public development tree; final release and license unconfirmed

The public repository includes firmware and UI material, and its Software README labels the documented build path as old code while leaving the LVGL section TODO. A current repository/API review found no explicit root LICENSE/COPYING file and GitHub license metadata is null. Sources do not establish a final production binary, release notes, version mapping, signed update, backup/recovery process, reproducible toolchain, security review, support policy, warranty, or license grant.

The catalogue can link the public engineering trail without representing the badge as fully open source, reproducibly buildable, support-guaranteed, secure, licensed for reuse, or equivalent to every shipped unit.

Source note: Pips801/Helgatchi repository, Software tree/README, and current GitHub repository metadata review.

Clip-Boy: The Unofficial DEF CON 34 Electronic Badge note

firmware, research-build, and source-release scope · official seller statement and public repositories · final Clip-Boy release not identified

The seller distinguishes passive shipped behavior from an optional research build, and identifies ESP32 Marauder as a tooling base, but no public source reviewed here is a final Clip-Boy firmware repository or release. The shop repository is frontend/store code and GitHub reports no detected license for it or the named fork; no final binary, source revision, flash process, dependency list, update/recovery plan, compatibility matrix, support policy, or license grant is identified.

The dossier links relevant public context without representing it as an available, reproducible, supported, or authorized Clip-Boy firmware package.

Source note: Clip-Boy official shop, `tropicsquirrel/shop`, and `tropicsquirrel/ESP32Marauder`.

Luna SAO (DEF CON 34) note

firmware, security, source, and licensing gap · reviewed first-party listing only · no technical archive identified

The listing's playful claims about immediate boot, no crashes, and zero CVEs do not identify firmware or a security model. No controller, source repository, binary, design archive, build/flash guide, software or hardware license, test suite, update policy, or support policy was found.

The catalogue does not treat marketing jokes as a reliability, security, firmware, or open-hardware claim.

Source note: Luna SAO product page.

MF Doom SAO v2 (DEF CON 34) note

firmware, software, source, and license gap · no implementation source recovered · no software or source documentation located

No reviewed source identifies a controller, firmware, binary, source repository, license, game, animation, operating behavior, update/recovery path, security model, user-data handling, accessibility guidance, or support policy. The MF Doom name does not establish that v2 runs the Doom video game or any software.

Readers are not led to assume electronic behavior, firmware availability, open-source status, video-game functionality, or a supported modification path from the artifact name alone.

Source note: u/Truth-Miserable MF Doom SAO v2 Reddit post and DEFCON 34 Badgelife Form response.

Dante's Inferno Badge (DEF CON 32) note

firmware, source, and licensing gap · public repository and release inspection · binary update path published; readable software and hardware source absent

The public repository says it will contain information and software updates, and its release/README document a UF2 update path, but the reviewed tree does not provide readable firmware source, build tooling, hardware design, a license file, source history, change log, game/application documentation, security analysis, or an image-use license.

Readers can follow the documented update surface without assuming the badge is open source, reproducible, auditable, redistributable, or supported beyond the published high-level instructions.

Source note: im-redactd/dantes_inferno repository and Initial Release - v1.1.

DEF CON 34 Badge note

firmware, source, and security-state boundary · official support page and creator-published repositories · public update and source paths available; unit-by-unit state unrecovered

The official help page links a firmware-update archive and `dc34-vault`, `dc34-console`, `dc34-api`, Xous, and core-hardware sources; `dc34-vault` warns that custom firmware erases provisioned secrets and changes the badge to developer mode. The reviewed sources do not publish a signed unit-by-unit firmware manifest, a source-to-issued-device mapping, complete update/recovery validation, a full vulnerability/remediation history, a security audit, long-term support terms, or proof that every badge retains the same conference-token state.

The catalogue links the public archive and records the documented state transition without recommending installation, claiming that a later source tree exactly matches every badge, or presenting the token and QR features as independently validated or permanently supported.

Source note: DEF CON 34 Badge Help Page, bunnie/dc34-vault, bunnie/dc34-console, bunnie/dc34-api, bunnie/dc34-core-hw, and current firmware archive, reviewed 2026-08-24.

Day of the Dead Turkey v1 (DEF CON 34) note

firmware, source, authorship, and license gap · public product and roster sources · no implementation or rights archive recovered

No reviewed source identifies a controller, firmware, source repository, binary, flashing path, software behavior, BOM, schematic, PCB/Gerber, hardware/license grant, art/character authorship chain, or permission to reuse any product or roster media. The Day of the Dead theme/title does not itself establish creator, cultural, organizational, or rights-holder affiliation or approval.

The catalogue retains first-party product wording without turning it into a programmable-badge, open-source, reproducible-design, authorship, cultural-affiliation, endorsement, or reusable-media claim.

Source note: Day of the Dead Turkey v1 product page and DEFCON 34 Badgelife Form response.

Day of the Dead Turkey v2 (DEF CON 34) note

firmware, source, authorship, and license gap · public product and roster sources · no implementation or rights archive recovered

No reviewed source identifies a controller, firmware, source repository, binary, flashing path, software behavior, BOM, schematic, PCB/Gerber, hardware/license grant, art/character authorship chain, or permission to reuse any product or roster media. The Day of the Dead theme/title does not itself establish creator, cultural, organizational, or rights-holder affiliation or approval.

The catalogue retains first-party product wording without turning it into a programmable-badge, open-source, reproducible-design, authorship, cultural-affiliation, endorsement, or reusable-media claim.

Source note: Day of the Dead Turkey v2 product page and DEFCON 34 Badgelife Form response.

#NOICE SAO (DEF CON 34) note

firmware, source, behavior, and licensing gap · reviewed first-party listing only · no technical archive identified

The source says effects persist but does not identify firmware or a control implementation. No source repository, binary, build/flash path, effect specification, update/recovery policy, hardware design archive, test suite, code license, documentation license, or support policy was recovered.

The entry does not turn simple listed behavior into an open-source, programmable, or security-verified badge claim.

Source note: #NOICE SAO product page.

Star Trek SAO Phaser v2.2 (DEF CON 34) note

firmware, source, release, and licence gap · public maker source review · no public implementation/archive identified

The reviewed public roster, video, and product listing do not provide a microcontroller identification, firmware/binary, source repository, schematic/PCB archive, build or flashing instructions, update/recovery path, release/tag, license, security review, vulnerability policy, support policy, or warranty.

The record does not turn a documented blinky add-on into a programmable badge, released source project, reproducible build, or legal reuse grant.

Source note: Hak4Kidz DEF CON 34 roster response, H4K-Dave video, and Hak4Kidz Lab Tindie listing.

Original Series Tricorder Badge (DEF CON 34) note

firmware, source, release, privacy, and licence gap · current public-source review · no current implementation or policy archive identified

No reviewed public source provides firmware, binary, source repository, build/flashing path, update/recovery instructions, release/tag, sensor data interface, calibration/configuration, app, protocol, collection/storage/transmission behavior, security review, privacy policy, vulnerability policy, support policy, or licence for the Original Series Tricorder badge. The historical tricorderSAO repository exposes documentation and media without an explicit root licence or a current-badge mapping.

The catalogue does not present a proposed sensor badge as a released software project, a programmable device, a privacy-reviewed tracker, a reproducible build, or a legal reuse grant.

Source note: MakeItHackin DEF CON 34 roster response and public tricorderSAO repository root.

BadgeLife Village Badge (DEF CON 34) note

firmware, source-code, challenge, and recovery boundary · official BadgeLife guide · high-level recovery documentation published; firmware release and support unrecovered

The guide names USB CDC, DFU/BOOTSEL, and firmware.uf2 recovery, and labels firmware source as after-con material while intentionally withholding challenge answers. The reviewed source does not publish a firmware file, source repository, versioned release, build/dependency record, source-to-device mapping, signature/integrity mechanism, challenge solution, complete recovery image, security review, privacy/data policy, support channel, warranty, or proof of successful field updates.

The record makes the public documentation discoverable without turning it into an invitation to bypass challenges, a verified update path, a final firmware archive, or a supported modification procedure.

Source note: Badge.Life DC34 Village Badge guide.

INSPECTRON 34 SAO (DEF CON 34) note

firmware, support, third-party-media, and image-rights boundary · maker README, handoff, and repository license · V5 source history public; third-party-media and gallery-image rights unresolved

The handoff says most event boards had V4 and V5 was released later. The repository supplies code/design-file MIT terms but expressly excludes GIF files, the DEF CON name, and DC34 logo artwork. It does not establish an installed version for every board, signed/reproducible event firmware, support or warranty, security review, safe update/recovery result, or a selected badge photo/render with a complete image-specific reuse basis.

The catalogue links a substantive source and firmware trail but publishes no repository image or artwork and does not present a later source revision as a supported update or all-unit state.

Source note: INSPECTRON 34 README, HANDOFF.md, and LICENSE.

UPDeeDeeI SAO (DEF CON 34) note

firmware, toolchain, programming workflow, and licensing gap · official product description and cited basis · no public technical release identified

The source names an ATtiny814 and says the device is based on Stefan Wagner's UPDI programmer, but it does not publish onboard firmware, host utility versions, driver/install requirements, toolchain, source repository, target examples, flashing settings, recovery instructions, license, dependency inventory, or a support policy.

The catalogue credits the public source basis without supplying unverified programming steps, device-specific firmware claims, a reproducible build, or reuse terms.

Source note: UPDeeDeeI SAO product page.

Hacker Pager (DEF CON 34 Revision) note

firmware, update, radio/data, and software-license scope boundary · official project/update pages and public firmware fork · active project/update surface published; deployed configuration and assurance unrecovered

The maker page describes Meshtastic software and optional application pairing, the updater labels 2.7.26.pager for DEF CON 34, and a public Meshtastic fork exists. The reviewed sources do not establish a complete release manifest or integrity proof, source-to-device build mapping, all inherited/dependency licenses, default or event-specific radio settings, channel/key policy, data retention, privacy/security review, vulnerability handling, legal use guidance, update success, rollback/recovery guarantee, or support/warranty terms.

The catalogue links a real public project without implying that a labelled firmware build is complete, audited, installed on every unit, safe for a particular radio/data context, or accompanied by a support guarantee.

Source note: Hacker Pager project site, firmware update page, and Exploitee.rs Meshtastic fork.

Firefly Jar SAO (DEF CON 34) note

firmware, vendor-command, secret-content, and licensing gap · official product-level behavior description · no public technical release identified

The source mentions lighting modes, generic LED control, vendor commands, reprogramming, and an undisclosed possible secret, but no reviewed material publishes firmware, source tree, binary, command definitions, IDs, secret content, build/flash instructions, update/recovery path, software license, dependency inventory, or terms for user content.

The catalogue records public behavior claims without exposing or inventing challenge content, protocol messages, source availability, update steps, or reuse rights.

Source note: Firefly Jar SAO product page and Lepi Labs DC34 announcement.

TROPICON 2026 Electronic Badge note

firmware, wireless, data, and operational-policy gap · public companion firmware archive · source archive public; final deployment and policy evidence unrecovered

The public firmware archive documents a TROPICON badge software project, but reviewed sources do not establish a final distributed build, release-to-unit parity, firmware update or support policy, final radio configuration, field or compliance evaluation, security review, data-handling terms, privacy notice, retention policy, or event-use policy.

The catalogue links public source material at a high level without treating it as a final deployment, safety/compliance result, operating policy, privacy practice, or authorization to use any communications capability.

Source note: ElectronicCats/Tropicon-2026_Firmware repository and commit-pinned README.

DEF CON 32 Badge note

firmware-and-controversy caveat · source-backed but incomplete · needs deeper artifact inventory

Public sources document the save issue, firmware archives, GB Studio game source, and DEF CON's response to contractor-credit and firmware claims, but this pass does not adjudicate every dispute, audit every firmware build, or mirror every hardware/game asset.

The catalogue records the verified public badge surfaces and flags that the production and firmware story needs a deeper artifact-level chronology.

Source note: DEF CON news and response post, media-server badge archive, badge-game repository, Raspberry Pi RP2350 sources, and community ROM writeup.

DEF CON 30 Badge note

firmware-and-final-state caveat · source-backed but incomplete · needs deeper artifact inventory

Public sources document firmware dumping/modification, key combos, badge variants, and challenge flow, but this pass does not mirror every firmware image, media artifact, phone recording, badge variant, or post-win state.

The catalogue records verified hardware and challenge structure while leaving full artifact preservation and firmware archaeology for a later pass.

Source note: DEF CON forum thread, FaultPoint firmware extraction, Red Balloon Security OFRAK writeup, and Kybr challenge writeup.

HOPE XV Electronic Badge note

firmware-artifact caveat · source-backed but incomplete · needs deeper artifact inventory

The wiki references firmware, ESPHome, user manuals, and MicroPython workflows, but this pass does not mirror or audit every firmware image, manual PDF, pro-model component variant, or Badge Clinic artifact.

The catalogue records verified hardware and hacking surfaces while leaving complete firmware and variant preservation for a later artifact-level pass.

Source note: HOPE XV Electronic Badge wiki, HOPE schedule, and linked open-hardware repository.