#Hacktivity2020 // Hacking the Hacktivity 2019 badge by Valerio Di Giampetro

### Overview In this talk, Valerio Di Giampietro details his journey of accidentally bricking the Hacktivity 2019 conference badge and subsequently reverse engineering and reprogramming its hardware. The badge, initially configured to run MicroPython, features an ESP32-WROOM-32 module as its main dual-core processor and an Atmel ATSAMD21G16B ARM Cortex-M0 microcontroller as a co-processor. When Di Giampietro tried flashing an Arduino blink sketch, the IDE misidentified the badge as an Adafruit Circuit Playground Express (which uses a SAMD21 chip with four times more flash and RAM), wiping out the bootloader and rendering the badge unresponsive.

### Key Topics - **Hardware Architecture**: The badge integrates an ESP32 (4 MB flash, 520 KB SRAM, Wi-Fi/Bluetooth) and an ATSAMD21G16B co-processor (64 KB flash, 8 KB SRAM). The SAMD21 handles USB connectivity, touch buttons, and RGB LEDs, and communicates with the ESP32 via UART and I2C. - **PCB Reverse Engineering**: Lacking official schematics, Di Giampietro soldered pin headers, traced board layers using GIMP and a multimeter, and leveraged schematics and repository code from the Disobey 2018 badge designed by the same team. - **Bypassing the Co-Processor**: Because the bricked co-processor left all its I/O pins floating as inputs by default, Di Giampietro bypassed it entirely to flash the ESP32 directly through exposed serial header pins using a TTL serial adapter. - **Reflashing ATSAMD21**: Flashing firmware back onto the ARM co-processor required connecting to its Serial Wire Debug (SWD) pins using a Segger J-Link EDU Mini probe. - **Arduino Integration & Optimization**: Transitioning away from bloated Atmel Studio tooling to an Arduino-based workflow, Di Giampietro resolved serial buffer overruns during flashing by implementing non-blocking serial communication and expanding buffer sizes.

### Technical Details 1. **Board Layout & Pin Discovery**: Tracing revealed crucial headers, including J9 (I2C bus connecting ESP32, SAMD21, and the 128x64 LCD), J10 and J12 (ESP32 GPIOs and bootloader pin), J11 (SAMD21 SWD pins: SWDIO, SWDCLK, RESET, VCC, GND), and J13 (ESP32 UART TX/RX). 2. **Direct ESP32 Flashing**: Di Giampietro pulled the bootloader pin low via jumper during power-up, validated the bootloader prompt via PuTTY, and flashed sketches from the Arduino IDE over TTL serial. This worked only because the unprogrammed SAMD21 did not drive the shared UART lines. 3. **Firmware on the SAMD21**: Attempting to develop a USB-to-UART bridge in Atmel Studio proved cumbersome due to multi-gigabyte installations, hundreds of boilerplate files, and complex clock tree configurations. Finding existing Arduino port code from the Disobey 2018 repository allowed Di Giampietro to flash an open-source bootloader using SWD/dfu-util. 4. **Bridge Performance Tuning**: The initial Arduino-based serial bridge dropped bytes during sketch upload. Di Giampietro resolved this by increasing the RX/TX serial buffer size from 64 bytes to 512 bytes and rewriting the bridge logic to be completely non-blocking, checking buffer readiness before read/write calls.

### Takeaways Through hardware reverse engineering, SWD reflashing, and firmware optimizations, the bricked Hacktivity 2019 badge was transformed into a fully operational, versatile Arduino development board. Di Giampietro highlights two core engineering lessons: never remain stuck forcing an intractable path (such as struggling through Atmel Studio when simpler frameworks can be ported), and always utilize partial artifacts or documentation from related open-source hardware to accelerate debugging.