B@dg3_2_B@dg3 // distributed share pool

The B2B flags are split with XOR k-of-k secret sharing: flag N needs every share index 0..N, one per badge. Nobody solves flag 9 alone — it needs ten distinct badges. Upload your badge's provisioning page and we pool the shares.

38badges pooled
10/10flags cracked

→ Upload your dump

Flags are locked until you contribute. Upload a valid provisioning page and you get a session token that unlocks /flags. No freebies — this only works if everyone puts in.

We only read the 4 KB provisioning page (your UID + share table). Nothing else is stored. Full 16 MB dumps are fine — we extract the page server-side.

1 Activate your badge

A fresh badge is in shareware mode and has no B2B content. Connect over USB serial — 115200 8N1, and note the terminator is a bare CR, not CRLF.

screen /dev/tty.usbmodem* 115200      # macOS / Linux
# Windows: PuTTY, serial, 115200

1a. Unlock the full version

hack 5n4ck3y        # 'hack' alone fails -- it needs the noun
0                   # menu: Hack Full Version DLC Upgrayedd
gr1md@rk5n@ck3yv3r53

The badge AES-256-CBC decrypts the DLCs and reboots into Zone 1. Its USB serial port re-enumerates — reconnect.

1b. Cross the fog maze to Zone 2

From the start (LVCC Contest Area) walk to the Off-Ramp:

east east east east east east east east east
south

You are at the Off-Ramp into Fog. The maze is 15 moves; every room looks identical, and a wrong turn ejects you to the Vacationland Border (walk back to the off-ramp and restart the sequence):

north
north east north west north east east south east north west north east north east

You arrive at Definitely Not Maine. Then:

hack 5n4ck3y
0                   # Hack Time
Y                   # confirm temporal displacement

The badge warps to Zone 2: The Grimdark Snackeyverse and reboots. Confirm with version.

2 Dump the provisioning page

Install picotool (brew install picotool, or build from source). No BOOTSEL needed — picotool reboots the badge itself.

Small dump — 4 KB, recommended

picotool save -r 0x101ef000 0x101f0000 badge_page.bin -f

That is exactly the provisioning page. It is a read; nothing on your badge is modified, and your game progress is untouched.

Or the full flash — 16 MB

picotool save -a badge_flash.bin -f

Also fine to upload; we locate the page at offset 0x1ef000.

Verify before uploading: the file should start with the bytes c0 de.

xxd -l 16 badge_page.bin
# 00000000: c0de e462 0864 172a 2735 ...
#           ^^^^ magic  ^^^^^^^^^^^^^^^^ your badge UID

3 Current pool

Flag N has threshold N+1. Flag values: /flags (requires a session). Public: /api/progress and /api/needed.

flagneedhavestatus
#0 1 1/1 CRACKED — upload to reveal
#1 2 2/2 CRACKED — upload to reveal
#2 3 3/3 CRACKED — upload to reveal
#3 4 4/4 CRACKED — upload to reveal
#4 5 5/5 CRACKED — upload to reveal
#5 6 6/6 CRACKED — upload to reveal
#6 7 7/7 CRACKED — upload to reveal
#7 8 8/8 CRACKED — upload to reveal
#8 9 9/9 CRACKED — upload to reveal
#9 10 10/10 CRACKED — upload to reveal