The DEF CON 34 Badge
Where
Main Stage
DEF CON 34
Duration
23 min
Explains how the DEF CON 34 badge was designed and built, how attendees can attack it, and how its partly open-source Baochip-1x chip can be inspected.
Summary
The talk opens with the badge's conference mode, where attendees swap light patterns through a lightly encrypted exchange. Traits follow simple genetic rules, with some dominant and some recessive. After the event, the core module can be removed and used as a FIDO2 security token that shows the relying party on screen. It also works as a TOTP generator and an offline password store.
The speaker's motivation is that supply chains scale well, so hardware trust needs more than black-box chips. He describes infrared imaging, which can reveal a chip's transistors when the silicon is exposed. The badge's Baochip-1x is a custom chip he designed, and its CPUs, cryptographic accelerators, and the Rust-based boot and operating system are published as open source. He also covers the manufacturing effort: custom two-tone laminate, stainless steel finishes for the advanced badges, and automated test rigs that reached about 7,000 units a week with a yield above 98 percent.
For hackers, the badge includes flags to capture, and early solvers were already named. The BIO coprocessor, an open version of the Raspberry Pi PIO block, can be debugged at the waveform level through open RTL simulation. The speaker expects open hardware to show bugs after release and recommends firmware updates, with bare chips planned for wider distribution later.
Materials
Related talks
Main Stage·49 min
Mickey Shkatov · Jesse Michael
Shows how a roughly $45 FPGA can impersonate a discrete SPI TPM on Windows 11 and sit between a real TPM and the motherboard, challenging hardware trust assumptions.
Radio Frequency Village·37 min
hamspiced
Walks a self-described non-expert through building resonant NFC repeater antennas, from LC tank circuits and VNA tuning to parasitic-capacitance PCB designs.
Main Stage·43 min
Yaniv Balmas · Lior Oppenheim
Yaniv Balmas and Lior Oppenheim demonstrate reverse engineering KVM switch firmware, subverting the 8051 microcontroller to install an undetectable, persistent hardware keylogger.

