Off By One 2026 + Badge Hacking

I did some badge hacking

5n4ck3y 2026

tbh it was an RP2040 badge so I dumped the firmware using picotool (hold boot button, reset, picotool). Afterwards, passing it into my Codex 20x got most of the flags

there was a connect multiple badges chall and a sticker remove chall (which i failed)

Quite clankable lost motivation lol

Cool badge though

OB1 2026

Pasted image 20261008201352.png

ok I'm glad I bought my kiisu v4b, i needed it to solve the Off By One Badge 2026

Prerequisite Steps

  1. Dump the firmware using esptool
  2. Pass into codex, get it to use IDA MCP to reverse
  3. You cannot write the firmware directly - it'll reset the state, validation fail
  4. get it to dump the challenges

Buzzer Test

  1. Codex told me its a code, and i have to input the last 8 numbers output on the badge, but i wasn't sure what code it was, i only heard long and short beeps of the same tone
  2. Got told could be morse code, manually input in the morse code into cyberchef and got the numbers (1..4 etc.)
  3. Entered it in the badge and
  4. this unlocks the DINO Game
  5. just play and you win

Sokoban
6. Codex rev revealed a hidden command iddqd, entering that
7. get codex to solve over the serial port, the flag would be unlocked
8. My friend solved manually but idk why that didn't unlock the flag
9. Wifi scan + BLE Scan unlocked

Gallery
10. Codex rev revealed a gallery challenge, there are 6 sponsor images numbered from 0-5 from left to write
11. go in the order 1, 2, 0, 3, 4, waiting 2+ seconds on each image
12. Flag unlocked + TV B GONE

SPEC
13. Codex Rev
14. Using my Kiisu v4b, generated IR codes
15. There's some hidden IR command to send to get the badge to show OB1 Rules!, use that to test
16. get codex to clank out various IR codes until it works
- need codex to grasp the format, it can get rabbit holed in thinking its NEC format when its _slightly different
- key is Sponsored by Espressif Systems!\n lol
- need to generate for each species, and 2 nyms for each species (excluding your own), so 15 total
- sometimes the IR codes fail, just regenerate, align and see until it works