2024 def con badge v1

DEF CON Badge (2026) — ESP32-S3

Everything you need to hack on the Retia DEF CON badge: hardware docs, pinouts, flashable firmware (including DOOM, a full NES emulator, Meshtastic, MeshCore, and Reticulum), and example code to get you from "just unboxed" to writing your own firmware.

🚀 Start here: the Badge Launcher v2 "Touch" — the flagship badge experience. One flash + one micro-SD card turns the badge into a pick-what-you-run device: two full-color touch mesh messengers (MeshCore + Meshtastic MUI), classic Meshtastic, a Reticulum RNode, an NES emulator with a 37-game homebrew library, and WLEDkitty — switchable from an on-badge menu in ~10 seconds, no computer needed. Comes with a MESH-101.md that gets two badges messaging over LoRa in minutes. Flash it from your browser at scriptkitty.sh. (Requires a FAT micro-SD card — true of launcher v1 too. Prefer DOOM resident in flash? Launcher v1 "Classic".)

Yes, that's DOOM. Flash it in one command — see below.

What's on the badge

Quick start: flash DOOM

pip install esptool
esptool --chip esp32s3 --port <PORT> write-flash 0x0 firmware/doom/doom-audio.factory.bin

<PORT> is /dev/cu.usbmodem* (macOS), /dev/ttyACM0 (Linux), or COMx (Windows). Full instructions, port-finding, and un-bricking: docs/flashing.md.

Repo map

docs/            pinout.md ← START HERE · hardware.md · flashing.md · sd-card.md
firmware/
  doom/          DOOM shareware, audio + silent builds (flash & play)
  meshtastic/    Meshtastic 2.7.23, standard + low-power builds
  reticulum/     RNode v1.85 — the badge as a Reticulum LoRa transceiver
examples/
  hello-badge/   buttons + LED + buzzer in 100 lines (your first build)
  sd-test/       mount/format/read/write the micro-SD slot
hardware/        KiCad 8 sources + schematic PDF

The three things that bite everyone

1. The touch controller and the display-module SD slot have crossed data lines — hardware SPI can't reach them. The main SD slot and everything else work normally. Details: docs/pinout.md.
2. Native-USB download-mode trap — DTR-toggling serial monitors + reset = badge stuck "waiting for download". Fix: any esptool command ending in hard-reset. Details: docs/flashing.md.
3. Never TX on LoRa without an antenna. Receiving is safe; transmitting into nothing can cook the PA.

Firmware in this repo

• DOOM — the 1993 classic, natively, full speed. D-pad moves, A fires, GPIO0 switches weapons. Audio build plays SFX through the piezo.
• Meshtastic — off-grid LoRa mesh messaging with phone app support; standard, power-optimized, and full color touch UI (MUI) builds. Ready-to-flash touch UI: meshtastic-mui-v2.7.23 release — on-screen keyboard, node map, touch region picker, phone TCP API alongside the home screen.
• MeshCore — the badge as a MeshCore LoRa mesh node, hardware-verified badge-to-badge (messages + ACKs). The flagship build is a full standalone touchscreen mesh communicator — chats, contacts, channels, on-screen keyboard, RF monitor + spectrum analyzer, chimes, D-pad nav — that is simultaneously a BLE companion for the official MeshCore phone app. Plain companion (BLE/USB) builds too. Ready-to-flash images: meshcore-v1.0.0 release. Source: RetiaLLC/MeshCore (board variant) + RetiaLLC/wadamesh (touch messenger), both branch retia-badge.
• Reticulum / RNode — turns the badge into an RNode: a host-controlled 915 MHz LoRa transceiver for the Reticulum network stack (NomadNet, Sideband, MeshChat). The default build shows the live RNode status screen (frequency, airtime, channel load, signal) on the TFT. Flash, provision with rnodeconf, done — hardware-verified against a Nibble Zero RNode. Full toolkit, source, and Nibble Zero builds live in RetiaLLC/NibbleReticulum.
• ESP32 Bus Pirate — a multi-protocol hardware-hacking multitool on the badge TFT (also USB-serial / Wi-Fi web CLI): I²C/SPI/UART/1-Wire/JTAG bus tools with on-screen bus scan + live register monitor and a BME280 dashboard that colours the ears by temperature, plus a full on-screen LoRa/RF suite — heat-map waterfall, packet sniffer, live RSSI meter, band scanner, and a Meshtastic monitor that decodes real mesh packets on-screen (with a MeshCore sniffer preset). Wi-Fi/BLE scanners too. Start with the beginner's guide. ⚠ Transmit- & attack-capable (Wi-Fi deauth, BLE spoof, RF jam) — authorized use only. Ready-to-flash: RetiaLLC/ESP32-Bus-Pirate @ badge-v1.2.1, ported from KonradIT/geo-tp.
• Anemoia NES (standalone repo) — a full NES emulator: put .nes ROMs on the micro-SD card, browse and launch them on the badge, and play with the D-pad + A/B. Save states, chiptune audio through the piezo, and a one-button START/SELECT scheme (tap BOOT = START, hold = pause menu). Ready-to-flash image on the release page (also attached to this repo's anemoia-v1.0.0 release), plus a curated list of legally-free homebrew games tested on the badge. Ported from Shim06/Anemoia-ESP32.

Building your own firmware

Both examples are PlatformIO ESP-IDF projects with the badge board definition included — copy one as a template. The short version:

pip install platformio
cd examples/hello-badge
pio run -t upload --upload-port <PORT>

Then open a serial monitor at 115200 and press buttons.