The range
Five practice ranges for the badge's quick glitch layer. Plug the badge in and press anything — the header lights up when the browser sees it. The published site listens to the badge and nothing else; on a local checkout the keyboard stands in: arrows, Z X C V for A B X Y, Q E for the shoulders, Enter for START.
Only the armed range listens. Click a range to arm it. The first level of each is meant for a hand; the last is not, and that is the lesson. New here? The Learn panel walks the whole range, one press at a time.
Elsewhere: the stages · flash the badge · the vault · the level maker.
Themes and looks
What the site is painted in, on every page — the conference's lime on black, the Queen's
court, the tea party in daylight — and how it sits on the screen: the classic page, or a phone look that
shows one panel at a time. The ◐ chip in the header opens the picker; ?theme=queen
and ?look=scope in the address bar pick too, and the choice is remembered on this device.
Down the Rabbit Hole
A guided first visit. Each step watches what you do and ticks itself off; the line at the top of the page says what comes next wherever you are. Chapter one wants only a controller; chapter two wants the badge - skip what you cannot do, it costs nothing.
Range 1 — The Rabbit's Pocket Watch ● armed
how it works
The Rabbit chimes a tune of buttons. Play it back, in order, inside the window — measured from your first press to your last. A wrong button or a slow finish ends the attempt; the next press starts a fresh one. The tune is fixed per level, so a take recorded once on the badge keeps working: record it slowly, then SELECT+UP until it fits.
Range 2 — The Looking-Glass Glitch ● armed
how it works
The Queen's guard runs a routine at the treasure room door, one line per tick. One of those lines is the check that turns Alice away. A pulse on X whose rising edge lands while that line executes skips it — the routine falls through, the door opens, and Alice jumps to the treasure. START is the trigger: the routine starts the instant the browser sees it. Land anywhere else and the log says where you hit and by how much.
A pulse is measured from its rising edge to its falling edge. Every line under it is corrupted, some lines crash the guard, and a pulse wider than the guard survives browns it out. Width is the badge's speed; offset is SELECT+LEFT/RIGHT.
Range 3 — The Caterpillar's Lock ● armed
how it works
The Caterpillar's door wants a password and checks it the lazy way: one symbol per tick, in order, stopping at the first one that is wrong. So the time it takes to say no is the number of symbols you had right, plus one — a side channel. START opens a guess, then one press per symbol; the door checks the moment the last one is in. Read the clock, change one symbol, go again.
On the badge a guess is a take: record the symbols only (no START), then fire — the trigger's START opens the guess and the take types it. Give the take an offset of 40 ms or so (SELECT+RIGHT) so START lands first. Hold the chord and the same guess goes in every ~600 ms, which is how the jittery levels are beaten: the readout keeps the median.
Range 4 — The Dormouse's Watchdog ● armed
how it works
The Dormouse is a window watchdog: it sleeps as long as it is nudged every so often - and not too often. START puts it to sleep and starts the clock; every press of A is a nudge that must land inside the window measured from the nudge before. Too soon and it stirs, too late and it bites, and either way the attempt is over. Enough nudges in a row and Alice tiptoes past.
On the badge the take is the nudges and the speed is the tempo: a tap every 0.8 s at 8× is a tap every 100 ms. The first gap is the fire's offset, so set that inside the window too. Hold each tap a good moment - at 8× a short tap is one the browser never sees.
Range 5 — Humpty Dumpty's Wall ● armed
how it works
Humpty asks Alice her name and reads it into a buffer on his stack with no bound. Behind the buffer sit his saved return address - two symbols - and, on the last level, a canary. A name that fits is politely received. One symbol more and the overflow begins: a wrong canary and he halts, a wrong address and he has a great fall. The one address that opens the wall is in his listing, as it would be in any firmware image.
START is the prompt; then one press per symbol, each within the level's gap of the last. The read ends when nothing more comes, and he answers. On the badge the name is a take fired with an offset of ~40 ms so the prompt lands first; lengthen it a symbol per take.
Bench
how it works
Every edge the browser sees, timed from the last START press, whichever
range is armed. Fire the badge and read the offset and width straight off it. The browser
samples the pad every ~16 ms, so expect that much rounding; for microseconds use
software/tools/hid-trace.py on the raw HID reports.
Using the badge
SELECT is the shift key. While it is held nothing you press reaches the browser, and every other button is a command. A plain SELECT still arrives as a tap when you let go.
| SELECT + SL | record a take; again to stop. Silence before and after is trimmed. |
|---|---|
| SELECT + SR | fire: tap START, wait the offset, replay the take at the speed. Hold the chord to fire again every ~600 ms. |
| SELECT + UP / DOWN | speed ×2 / ÷2, from 1/4× to 32×. Scales gaps and hold times alike. |
| SELECT + LEFT / RIGHT | offset −/+ 1 ms; hold to repeat, and the step grows to 10 ms after twenty. |
| SELECT + B | forget the take, offset 0, speed 1×. |
| SELECT + Y, held | the beacon: the badge spells its vault — serial and stage key — on the stick axes, for browsers without WebHID. The gate on these pages reads it; the vault page shows it. |
| SELECT + START, held 2 s | reboot into the UF2 bootloader (the RPI-RP2 drive) to take a new firmware — the flash page writes one from this browser, software/tools/flash-badge.py from a checkout. |
Range 1: record the tune at a comfortable pace, stop, then fire. Too slow? SELECT+UP and fire again. Too fast and the browser starts dropping presses — it samples the pad every ~16 ms, so a press needs to be held about 20 ms to be seen. The log shows the rate you achieved and the gap between each press.
Range 2: record a single X tap, stop. Read the target's tick off the listing, multiply by the tick length, add half a tick: that is the offset. SELECT+RIGHT until the log's offset readout says so, then fire. Nudge and fire again; or hold the chord and tap RIGHT between shots to sweep. SELECT+UP shortens the pulse if it is crashing on the line after the check.
Range 3: record the guess's symbols only, set an offset of ~40 ms so the trigger's START lands before the first symbol, fire. The log says how many ticks the door took; one more tick than last time means the symbol you changed is right. When the level jitters, hold the chord: every ~600 ms the same guess goes in and the readout keeps the median. One symbol per take, and a level with a secret order gives up which position it checks next the same way.
Range 4: record the nudges at an easy tempo - a tap every 0.8 s, each held a moment - and SELECT+UP until the gap readout sits inside the window. The first gap is the offset: SELECT+RIGHT it into the window too. The log says where every nudge fell, early side or late.
Range 5: record the name's symbols only, offset ~40 ms, fire. Make the take one symbol longer each time until Humpty stops being polite: that is the size. A canary is found the same way, one symbol at a time in its slot; the address is in the listing. Repeated addresses (a sled) work too, when nothing guards the frame.
Firmware, engine tests and the chord table:
software/controller/README.md. Flashing it: flash.html.