How we built our REDACTED THING this year, 5n4ck3y, && AMA Badge Panel

How we built our REDACTED THING this year, 5n4ck3y, && AMA Badge Panel

Speakers: AND!XOR

Conference: DEF CON 32

YouTube: https://www.youtube.com/watch?v=OkVNbL7gysI

Overview

The DEF CON 32 talk by the AND!XOR team, titled "How we built our REDACTED THING this year, 5n4ck3y, && AMA Badge Panel," offered an insightful, community-driven discussion into the intricate process of developing their latest conference badge. Far from a conventional presentation, the session was framed as a "town hall," encouraging audience interaction and deep dives into the challenges and triumphs of hardware hacking and interactive experience design. The core of their endeavor revolved around creating a custom badge that not only ran the classic video game Doom but also integrated with an actual vending machine, affectionately dubbed "Snacky," as part of a larger Capture The Flag (CTF) challenge.

This talk illuminates the passion and technical prowess required to craft a unique DEF CON badge, blending nostalgia with cutting-edge custom hardware and software development. AND!XOR’s work stands out by pushing the boundaries of what a conference badge can be, transforming it from a mere identifier into a sophisticated, hackable, and entertaining platform. The project serves as a prime example of how the security community leverages diverse skill sets—from firmware engineering and reverse engineering to physical hardware design and game modification—to foster learning and engagement.

The significance of AND!XOR's badge lies in its multi-faceted approach to education and entertainment. By intertwining a beloved classic game with custom hardware and a physical vending machine, they created an ecosystem ripe for exploration and exploitation. This initiative not only provided attendees with a highly interactive CTF experience but also shared valuable lessons in resilient hardware design, complex system integration, and the iterative nature of development within the demanding context of a major security conference.

Background

▶ Watch: Introduction and "town hall" discussion approach (0:00)

AND!XOR has established itself as a prominent badge-making collective within the DEF CON community, boasting a nine-year history of crafting innovative and challenging hardware. Their motivation extends beyond simply providing a conference identifier; it's rooted in a genuine desire to learn new things, push technical boundaries, and foster a collaborative learning environment. As they humorously put it, they "make stuff, drink beer, no particular order," reflecting a diverse team with a wide array of backgrounds united by a shared passion for infosec and hardware.

The genesis of their projects often involves selecting technologies or challenges they haven't tackled before, providing an "excuse to learn it." This year's badge embodied this philosophy, adopting a form factor reminiscent of a recognizable handheld video game device from 30 years ago—a clear nod to the Game Boy era. This nostalgic design choice immediately captivated attendees, setting the stage for a unique interactive experience. Beyond the aesthetic, AND!XOR's badges are renowned for their integrated CTFs, which typically blend various security domains including hardware hacking, reverse engineering, lock picking, side channel attacks, RF analysis, and cryptography. This eclectic mix ensures that their CTFs appeal to a broad spectrum of hackers, preventing an over-reliance on a single domain of expertise.

The specific challenge for DEF CON 32 was to port Doom—a notoriously resource-intensive game—onto their custom badge hardware. This decision was not merely for entertainment; it served as a complex technical foundation for their CTF. The speakers highlighted the inherent difficulty of developing hardware that can withstand the rigors of DEF CON, jokingly suggesting that a "three-year-old" test is a good proxy for durability against "drunk hackers." This speaks to the practical, robust design philosophy AND!XOR employs. Furthermore, the integration of "Snacky," a physical vending machine, introduced an entirely new dimension of hardware interaction and real-world system compromise, distinguishing this year's badge from previous iterations and elevating the complexity of the accompanying CTF.

Key Findings

▶ Watch: The 2024 badge reveal: it plays Doom! (3:38)

The AND!XOR team's DEF CON 32 badge project yielded several significant findings and contributions, demonstrating advanced hardware and software engineering capabilities within a highly constrained environment.

Firstly, the successful porting of Doom onto custom, resource-limited badge hardware stands as a monumental achievement. This was not a simple emulation but a deep integration, requiring the entire firmware to be written in C. The team revealed they were "16 forks deep" on the version of Doom they utilized, indicating extensive modification and optimization of existing open-source Doom engine code to suit their specific hardware and performance requirements. This deep customization is a testament to their proficiency in low-level programming and embedded systems.

Secondly, a critical innovation was the development of a custom control API that interfaced directly with Doom's game state to provide haptic and visual feedback via LEDs. Specifically, when the player takes damage, the badge's LEDs glow red, mimicking "blood," and when ammunition is expended, white LEDs animate to show the status of decreasing ammo. This creative re-imagining of the game's user interface, adapting it to the physical constraints and capabilities of the badge, represents a novel approach to embedded game development and user interaction. It transforms static LEDs into dynamic indicators, enhancing the immersive experience without relying on a traditional on-screen status bar, which would be challenging to implement effectively on a small badge display.

Thirdly, AND!XOR developed a custom, free, open-source IWAD (Internal WAD) for their Doom port. An IWAD contains the core game data—levels, sprites, sounds, textures, and more. By making their custom IWAD open-source, they provided a valuable resource for the community, enabling others to explore, modify, and learn from their work. This contribution aligns with the open-source ethos of the hacking community and encourages further experimentation and development.

Finally, the project's most ambitious contribution was the seamless integration of the Doom-running badge into a multi-faceted Capture The Flag (CTF) experience that included a physical vending machine, "Snacky." While the exact mechanisms of interaction were kept somewhat opaque during the discussion, the mere presence and operational role of a real-world vending machine within the CTF framework represents a significant logistical and technical achievement. This blend of virtual game challenges with tangible, real-world hardware interaction created an unparalleled interactive security challenge, pushing participants to engage with multiple layers of complexity—from software exploits within Doom to potential physical or protocol-level interactions with Snacky. This holistic approach to CTF design is a hallmark of AND!XOR's commitment to providing diverse and engaging learning opportunities.

Technical Deep Dive

▶ Watch: Custom Doom drivers and LED integration for in-game status (4:00)

The AND!XOR DEF CON 32 badge is a masterclass in custom hardware and firmware development, centered around the ambitious goal of running Doom on a pocket-sized device. The core of the badge's design deliberately evokes nostalgia, resembling a classic handheld video game console from the 1990s, likely the original Nintendo Game Boy. This aesthetic choice was backed by a sophisticated internal architecture tailored for the task.

At a hardware level, the badge incorporates a complex array of components. While specific chip models were not detailed, the speakers mentioned the use of "custom ASICs and a microcontroller and a bunch of logic glue." This suggests a highly optimized design where specific functions are offloaded to application-specific integrated circuits for efficiency, coordinated by a central microcontroller that handles the main processing and I/O. The "logic glue" refers to discrete logic gates or small programmable logic devices (PLDs) used to connect and interface various components, ensuring they communicate correctly. The badge also features a speaker, providing essential audio feedback for the Doom experience.

The entire firmware for the badge was meticulously developed in C, a low-level language critical for embedded systems where direct memory access and fine-grained hardware control are paramount. Porting Doom, originally designed for more powerful desktop PCs, to this constrained environment required significant engineering effort. The team indicated they were "16 forks deep" on the version of Doom they used, implying they started with an existing open-source Doom source port (like PrBoom, Chocolate Doom, or similar embedded ports) and heavily customized it. This customization likely involved:

1. Optimized Graphics Rendering: Adapting Doom's rendering engine to the badge's display resolution and color depth, potentially implementing software-based rendering techniques or leveraging any minimal hardware acceleration available on the microcontroller. This would involve significant pixel manipulation and frame buffer management.
2. Input Handling: Creating custom drivers to map the physical buttons on the badge (D-pad, action buttons) to Doom's internal input system. This requires reading GPIO (General Purpose Input/Output) states and translating them into game commands.
3. Memory Management: Doom, even in its original form, required substantial memory. The team would have had to aggressively optimize memory usage, potentially by reducing texture sizes, level complexity, or using clever memory paging schemes to fit the game within the badge's limited RAM and flash storage.
4. Custom Control API for LED Feedback: This was a standout technical feature. The team "rewriting on the entire control API" of Doom indicates a deep understanding of the game's internal data structures and logic. They likely hooked into specific game variables, such as player health, ammunition count, or event triggers (e.g., getting shot, firing a weapon). When these variables changed, their custom API would then translate these changes into commands for the badge's LEDs. For instance:

• Health Status: When the player's health drops below a certain threshold or takes damage, the API triggers a sequence of red LEDs, visually representing "blood." This could involve pulse-width modulation (PWM) for smooth fading effects or simple on/off states.
• Ammunition Status: As the player fires weapons and consumes ammo, the API would update white LEDs, potentially in a progressive bar-like fashion or by flashing to indicate low ammo. This requires precise mapping of ammo counts to LED segments.

The creation of a custom, free, open-source IWAD further demonstrates the technical depth. An IWAD is essentially a bundle of game assets. For the AND!XOR badge, this custom IWAD likely contained unique levels specifically designed for the CTF, custom textures or sprites that might hide clues, or even modified game logic that triggers specific badge behaviors or CTF challenges. Making it open-source empowers the community to dissect and learn from its structure.

The integration with "Snacky," the vending machine, represents a distinct technical challenge. While the transcript is light on specific details of this interaction, a vending machine typically communicates using standard protocols like the Multi-Drop Bus (MDB) or custom serial interfaces. For the badge to interact with Snacky, the AND!XOR team would have needed to:

1. Reverse Engineer the Vending Machine Protocol: If Snacky used a proprietary protocol, this would involve sniffing communication lines, analyzing electrical signals, and decoding commands. If MDB, they would need to implement an MDB master or slave interface.
2. Develop a Communication Interface: The badge would require a physical interface (e.g., UART, I2C, SPI, or custom GPIO lines) and corresponding firmware to send commands to and receive status from Snacky. This could involve triggering specific item dispense mechanisms or reading inventory levels.
3. CTF Logic Integration: The interaction between the badge and Snacky would be programmed into the CTF. For example, completing a specific challenge in Doom on the badge might unlock a code or signal that, when transmitted to Snacky, dispenses a reward or reveals a clue. Conversely, hacking Snacky directly could provide information needed for the badge-based challenges. The mention of "eating the candy from the head shop in the old vending machine" likely refers to initial reconnaissance, testing, and perhaps even internal content analysis of Snacky before it was fully integrated into the CTF.

This intricate web of custom hardware, low-level firmware, game engine modification, and real-world system integration underscores the profound technical expertise and innovative spirit behind the AND!XOR DEF CON 32 badge.

Demo / Proof of Concept

▶ Watch: Unique badge durability testing: give it to a three-year-old (6:07)

While the AND!XOR talk adopted a "town hall" format rather than a formal demonstration, the essence of their proof of concept was the badge itself, fully operational and distributed to DEF CON attendees. The live "demo" was implicitly happening throughout the conference, with hundreds of participants engaging with the device and its integrated CTF.

The most tangible demonstration of their technical achievements was the badge running Doom with its custom features. Attendees could physically interact with the device, playing the classic game and experiencing the unique LED feedback system. Observing the LEDs turn red upon taking damage and animate white to reflect decreasing ammunition served as a direct, real-time proof of their successful custom API integration and the badge's ability to interpret and visually represent game state. This innovative use of LEDs, transforming them from simple indicators into an extension of the game's UI, was a powerful testament to their hardware and software ingenuity.

Furthermore, the entire Capture The Flag (CTF) experience, which prominently featured the Doom-running badge and the "Snacky" vending machine, acted as a grand, distributed proof of concept. The CTF challenged participants to explore the badge's hardware and software, reverse engineer its components, and interact with the vending machine. The fact that the CTF was "running our contest with six, seven, 800 people running around and things breaking" implies a successful, large-scale deployment of their interactive system. The collective engagement of hundreds of hackers attempting to solve the challenges inherently validated the functionality and design of the badge and its integration with Snacky.

Although the speakers did not present a step-by-step live demo of the vending machine interaction during their talk, the continuous mention of "Snacky" and its role in the broader challenge confirmed its operational status as a critical component of the overall experience. The logistical feat of transporting and integrating a physical vending machine into a conference CTF, ensuring its reliability and hackability for potentially hundreds of participants, served as its own large-scale proof of concept. In essence, the entire DEF CON 32 event became the stage for AND!XOR's ambitious, interactive demonstration.

Defensive Implications

▶ Watch: Details on creating custom free open-source Iwad for Doom (7:08)

While the AND!XOR badge project is primarily focused on offensive security, hardware hacking, and CTF design, it offers several valuable defensive implications and lessons for practitioners across various domains. These lessons are less about traditional network defense and more about robust system design, security education, and understanding the attacker's mindset.

1. Robust Hardware Design for Adversarial Environments: The AND!XOR team explicitly mentioned designing hardware "to survive Defcon," including the humorous "three-year-old test." This highlights the importance of physical security and durability in hardware. In industrial control systems (ICS), IoT devices, or critical infrastructure, hardware must withstand not just environmental stresses but also potential tampering or physical attacks. Lessons from badge design—such as choosing resilient components, robust enclosures, and considering failure modes—are directly applicable to securing physical devices against both accidental damage and malicious physical access.

1. Deep System Understanding through Reverse Engineering: The project involved deeply modifying the Doom engine ("16 forks deep") and integrating it with custom hardware and a vending machine. This process inherently requires extensive reverse engineering of existing systems and protocols. Defenders can learn from this by understanding that adversaries will similarly dissect and understand systems to find vulnerabilities. Embracing a "red team" mindset, where one understands how components interact at a low level (firmware, drivers, APIs), is crucial for identifying subtle weaknesses that might be missed by high-level analysis.

1. Importance of Custom Firmware and Driver Security: The badge's firmware was entirely written in C, and custom drivers were developed. This emphasizes the critical need for secure coding practices in embedded systems. Vulnerabilities in custom drivers or low-level firmware can provide deep access to hardware, bypassing higher-level security controls. Defenders should focus on secure development lifecycles (SDLs) for embedded code, including robust testing, static and dynamic analysis, and peer review, especially for proprietary hardware.

1. Interactive Security Training and Education: The multi-domain CTF (hardware hacking, RE, RF, crypto, lock picking) demonstrates an effective approach to security education. By creating engaging, hands-on challenges, AND!XOR teaches complex concepts in an accessible way. Organizations can adopt similar strategies to train their security teams, moving beyond theoretical exercises to practical, interactive scenarios that simulate real-world threats and require diverse skill sets.

1. Physical-Digital Convergence Security: The integration of the badge with "Snacky," a physical vending machine, underscores the growing importance of securing systems that bridge the physical and digital worlds. Vending machines, like many other IoT or industrial devices, often have insecure or easily exploitable interfaces. Defenders need to consider the attack surface created when physical devices are connected to digital systems, including:

• Vending Machine Protocol Security: If standard protocols like MDB are used, understanding their vulnerabilities and how to secure them is critical.
• Physical Access Controls: Ensuring that physical access to critical components (e.g., control boards, communication ports) is restricted.
• Supply Chain Security: The "head shop in the old vending machine" anecdote, while humorous, could imply acquiring devices with unknown provenance. This highlights the importance of vetting hardware and software in the supply chain to ensure components are genuine and free from malicious modifications.

1. Open Source for Transparency and Community Improvement: By releasing a custom, free, open-source IWAD, AND!XOR demonstrates the power of transparency. While not directly a defensive measure, open-sourcing components allows for broader community review and improvement, which can indirectly lead to more secure and robust systems as more eyes scrutinize the code for vulnerabilities.

In summary, the AND!XOR badge project, while a celebration of hacking, provides a microcosm of challenges and solutions relevant to real-world security. It reinforces the idea that true defense requires a holistic understanding of systems from the ground up, embracing both hardware and software, and recognizing the interconnectedness of physical and digital security.

Key Takeaways

• Custom Hardware & Doom Porting: The AND!XOR DEF CON 32 badge successfully runs a heavily modified version of Doom on custom, resource-constrained hardware, demonstrating advanced embedded system development and game engine optimization in C.
• Innovative LED Feedback: A rewritten control API for Doom enables dynamic LED feedback, using red LEDs for damage indication and white LEDs for ammunition status, transforming static indicators into an immersive game interface.
• Open Source Contribution: The team developed and released a custom, free, open-source IWAD (Internal WAD) for their Doom port, fostering community engagement and providing a valuable resource for learning and modification.
• Multi-Domain CTF Integration: The badge is a central component of a sophisticated Capture The Flag (CTF) that blends hardware hacking, reverse engineering, and unique physical interaction with "Snacky," a custom-integrated vending machine.
• Robustness & Learning: AND!XOR emphasizes building durable hardware that can withstand the rigors of DEF CON and using badge projects as opportunities for team members to learn new skills and teach the wider community through challenging CTF experiences.
• Physical-Digital Security Challenges: The integration of a physical vending machine into the CTF highlights the complexities and security implications of merging digital systems with real-world hardware, requiring deep technical understanding and creative problem-solving.

About the Speaker(s)

The talk was presented by members of AND!XOR, a well-known collective within the DEF CON community specializing in the creation of highly interactive and challenging conference badges. AND!XOR has a rich history spanning approximately nine years, during which they have consistently pushed the boundaries of badge design and functionality.

The team is characterized by its diverse members, who come from a wide variety of backgrounds within the information security field. Their primary motivation for engaging in badge creation is a shared passion for learning new things, often tackling projects that force them to acquire novel skills. They view the process of building hardware as a fun challenge, particularly in designing devices robust enough to "survive Defcon"—a humorous testament to the demanding environment of the conference.

AND!XOR is also deeply committed to teaching others, primarily through the intricate Capture The Flag (CTF) challenges embedded within their badges. These CTFs are designed to be multi-faceted, incorporating elements of hardware hacking, reverse engineering, lock picking, side channel attacks, RF (radio frequency) analysis, and cryptography, ensuring a comprehensive and engaging learning experience for participants.

During this specific talk, Hyron was one of the presenters, providing insights into the development process. Another key member, Zap, was mentioned as being actively involved in managing and maintaining the "Snacky" vending machine, which played a crucial role in the DEF CON 32 badge experience. As a collective, AND!XOR embodies the spirit of curiosity, collaboration, and open learning that defines the hacker community.