RHC Badge

Menu structure:
Main: AI · CTF · LED · IR · Motor · Music
CTF → Register · Challenges
Challenges → Easy (Konami) · Hard (game)
LED → Eye LED · Arm LED
IR → IR Send · IR Recv · IR Interact

A unique 8-byte serial is derived from the STM32U073's 96-bit UID via FNV-1a and embedded in the CTF registration QR code.

The badge is programmed over SWD with an ST-LINK. The SWD pads are on the back of the badge, on the left side of the body, in a single vertical column. From top to bottom:

Wire these to the matching pins on an ST-LINK (V2/V3), then flash with the Arduino IDE, arduino-cli, or STM32CubeProgrammer.

The badge MCU ships with RDP Level 1 enabled and password-protected, so once the ST-LINK is wired up you must unlock it before you can flash. Use STMicroelectronics' STM32CubeProgrammer CLI (STM32_Programmer_CLI) with the RDP password below.

RDP unlock password:

0x52484320 0x56316330 0x6E33204C 0x34385237

Unlock procedure — run the following commands in order (STM32CubeProgrammer over SWD):

# 1. Provide the RDP password on access port 0 (locks/authenticates AP0)
STM32_Programmer_CLI -c port=SWD mode=HOTPLUG ap=0 -lockRDP1 0x52484320 0x56316330 0x6E33204C 0x34385237

# 2. Set RDP to level 1 (0xBB) — regression/handshake step
STM32_Programmer_CLI -c port=SWD mode=HOTPLUG -ob RDP=0xBB

# 3. Provide the password on access port 1 to unlock RDP
STM32_Programmer_CLI -c port=SWD mode=HOTPLUG ap=1 -unlockRDP1 0x52484320 0x56316330 0x6E33204C 0x34385237

# 4. Drop RDP back to level 0 (0xAA) — full read/write access restored
STM32_Programmer_CLI -c port=SWD mode=HOTPLUG -ob RDP=0xAA

⚠️ Warning: Regressing RDP from Level 1 to Level 0 (RDP=0xAA) triggers a full mass erase of the flash. Back up anything you need before unlocking, and re-flash the firmware afterwards.

1. Install the Arduino IDE (or arduino-cli) with the STM32 core (STM32duino).
2. Select the board: Generic STM32U0 series, variant GENERIC_U073CBTX.
3. Install the required libraries:
   — Adafruit NeoPixel — WS2812 eye LEDs
   — Arduino-IRremote (4.x) — NEC send/receive
   — QRCode (ricmoo qrcode.h) — CTF registration / flag QR codes
4. Open rhc_badge/rhc_badge.ino and compile/upload over SWD or the built-in bootloader.

Adafruit NeoPixel needs a one-line patch — see Patching Adafruit NeoPixel below. Without it, the first (left-eye) WS2812B latches a stuck random colour.

The WS2812B-V6 eyes need a small patch to Adafruit NeoPixel 1.15.5's STM32 bit-bang path. Without it, the first LED in the chain (left eye) latches a stuck random colour at power-up (usually green/blue) and can't be turned off, because the first data pulse is emitted slightly distorted and misread as a 1 on the green MSB. (Downstream LEDs re-shape the signal, so only the first is affected.)

Fix: hold the data line low and align to a SysTick reload boundary for ~20 µs before the first bit. Edit the installed library file …/Arduino/libraries/Adafruit_NeoPixel/Adafruit_NeoPixel.cpp, in the STM32 800 kHz section (the ARDUINO_ARCH_STM32 block, ~line 2882) right after SysTick->VAL = 0; and before for (;;) {, insert:

// WS2812B-V6 first-pixel workaround: force data LOW for ~20us (16 bit
// periods) and align the first rising edge to a reload boundary, so the
// first pulse width isn't distorted and the first pixel latches correctly.
LL_GPIO_ResetOutputPin(gpioPort, gpioPin);
for (uint8_t w = 0; w < 16; w++) {
  while (SysTick->VAL > t0) ;
  while (SysTick->VAL <= t0) ;
}

A prebuilt image of the initial release is included as rhc_badge.ino.bin, so you can flash the badge without building from source. Load it at the flash base address (0x08000000) with STM32CubeProgrammer over SWD:

STM32_Programmer_CLI -c port=SWD mode=HOTPLUG -d rhc_badge.ino.bin 0x08000000 -v

If the target still has RDP Level 1 enabled, unlock it first — see Unlocking RDP above. Programming a fresh .bin does not by itself clear readout protection.

Entered from the main menu (or the host holds the link). Commands are plain-text lines over the 115200-baud UART, interpreted only in AI mode. Lines may be prefixed with a numeric request id (echoed back). Responses are single-line JSON. At boot, the badge emits: {"event":"boot","version":"2.0.0"}

The e-paper is bistable, so the image persists without power. After 30s of inactivity the badge enters a standby screen and sleeps the panel; the next button press wakes and redraws it. Eye LEDs stay off in standby to keep coin-cell drain low. IR interaction (on by default) keeps the CPU running so incoming NEC frames can be decoded.