2021 eChallengeCoin Writeup (SPOILERS)

This writeup about the 2021 eChallengeCoin from Bradán Lane Studios will contain spoilers for all of the puzzles. If you have not solved all of the puzzles yet and do not wish to see any spoilers, do not read further!

My first trip to DEFCON was DC27 in 2019. I really wanted to “experience” it, so I did as little research as possible before hand. One of the things that I really fell in love with was #badgelife - the fantastic works of electronic art produced by makers in the community. Some of them are strictly art, but some of them also have clever puzzles built into them as well. I was fascinated by the official DEFCON badge, but also by the elaborate unofficial badges that I saw people wearing at the conference and being discussed on Twitter. It’s hard to just get into the #badgelife thing if you show up at DEFCON completely unprepared, but when I got home I kept my eyes and ears open.

One of the first things that caught my eye was an article about the eChallengeCoin from Bradán Lane Studios. In 2020, the designer had an idea to try to build a series of puzzles into the form factor of a challenge coin. What a cool idea! Unfortunately I came across the article too late; all of the coins had sold out already. But, knowing where to look, I kept an eye on Bradán Lane Studios’ Tindie Store as well as their Twitter feed, where they shared updates about a new 2021 eChallengeCoin along with some other fascinating projects. As soon as the 2021 coin was available, I hit the Tindie store to order one.

The coin is 44mm in diameter and 6mm thick. There are a 8 LEDs across the obverse (that’s the front side) and 16 pads around the edge. Two of the pads are used to switch it on. Two of the pads are the UART TX/RX necessary to play the text adventure built in to the device which contains 3 puzzles. Two of the pads allow the device to be powered externally instead of using a CR2032 battery. One of the pads is unlabeled. One of the pads has a mysterious squiggle as a label. The Helpful Diagram suggests that it’s probably important… The remaining pads are the user interface for the 4 hardware challenges - touch them to interact with the device. The coin has some other markings on it, some of which may be clues to the puzzles.

The coin comes in a clear acrylic case with a tight-fitting lid. The first challenge is getting that open 🤣 You’ll probably need to pry it open a bit with something skinny. Once you open and close it a few time times, it becomes much easier to open it up just with your hands. You can activate the coin by shorting the two pads whose symbol looks like a switch; simply use a wire to connect the two pads briefly. The LEDs will indicate how many puzzles have been completed. Touch any of the touch pads to begin the next puzzle. I did not learn this until long after I solved all the puzzles, but there is an RFID tag attached to the case, which contains some clues if you scan it.

Coin Puzzles

Since the physical puzzles are the most obvious, I started with those.

Coin Puzzle #1

The LEDs flash one at a time, with longer pauses at times. The pauses seem important. It seems to go like:

Flash. Pause. Flash. Pause. Flash Flash. Pause. Flash Flash. Pause. Flash Flash Flash. Pause. Flash Flash Flash. Pause. Flash Flash Flash

My first instinct is to try to convert these to numbers somehow. Perhaps the LEDs correspond to numbers in some way? Assuming each LED represents a digit and they start from 1 on the left, and that the pauses represent breaks between numbers, the sequence would break out to: 1, 8, 27, 64, 125, 216, 343 . I’m not a big math/numbers guy but at a glance I see that 8, 27 and 64 (and technically 1) are all cubes, and in ascending order of cube roots starting from 1. Seems like 8^3 is the next number in the sequence, so I carefully touch the pads for 5-1-2.

Puzzle solved!

Coin Puzzle #2

When you start the second puzzle it plays a song. There’s no sense trying to describe it, just give it a listen:

For starters, I have to say that this piezo buzzer adaptation of a classic song really slaps. This is a puzzle that could be pretty easy if you know the song, but very very tough if you don’t know the song. As it is, this grizzled old marching band veteran is quite familiar with the song; it’s “25 or 6 to 4” by Chicago. The song played by the coin cuts off right before the title phrase is sung, so it seems like that’s the clue. Assuming the flashing lights are just for fun, then the key is probably related to the song title, which certainly has some numbers in it. 2-5-6-4 doesn’t work, so my next guess is that the “to” becomes a “2”. 2-5-6-2-4 turns out to be the correct response.

Coin Puzzle #3

For puzzle 3, groups of LEDs blink. There are 8 LEDs on the coin, so my first instinct is that these must represent binary numbers. After transcribing the patterns and converting them into decimal numbers, I head on over to that most useful tool, CyberChef for some analysis. After converting binary-encoded text I end up with:

Etps todmowz wpaemd vnhx bsam **** jy ts

I’m not great with ciphers and cryptograms, so I mess around with some online tools to help me crack this. A Vigenere brute forcer shows me that the key BFLAT gives me human readable plaintext - Does anybody really know what **** it is. Also there is a Bb on the coin, lending further credence to the idea that this is the correct key (and musically, a literal key). I think our designer might be a Chicago fan, because this is another of their songs. The missing word is time which is almost certainly the answer. But how to actually enter this into the coin?

After some experimentation I decide that “chording” the answer (that is, pressing all of the necessary pads to form the binary equivalent to each letter) is probably the way forward. So for example if t is 116 in decimal, that is 0111 0100 in binary, so I have to press pads 3,5,6,7 all at once. I just can’t get it to work, though. Before I can touch all of the pads, it just gives me the signal that I’ve done something wrong. I need to find another way.

The Helpful Diagram tells of someone modifying the 2020 eChallengeCoin by attaching a wire from each pad to a set of larger pads made from copper tape. It just so happens that I have some copper tape leftover from another project. I am a bit hesitant to start soldering to the device but I’m pretty confident in my soldering skills these days so I fire up the soldering iron and get to work.

One nice thing is that the pads are duplicated on the reverse of the coin, so I am able to solder to that side and keep the obverse side looking nice. Removing the coin from its 3D printed back cover also reveals the inner workings a bit. After attaching some 30AWG wire-wrapping wire to each pad, I run them out to a series of copper tape pads that I stick onto a sheet of cardboard, spaced out roughly where my fingers naturally fall. I also run one to the GND pad because I am also wondering if grounding issues are also contributing to my troubles here.

With my little breakout board complete, I’m now able to key in the binary equivalent of all the letters in time and solve this puzzle.

Coin Puzzle #4

Basically the piezo buzzer just kind of screeches. An update on the website mentions that the pad with the squiggle is the audio output and is required to solve this puzzle. No problem, I’ll just figure out a way to wire this to the audio jack on my Mac and see what it sounds like.

I happen to have an old pair of headphones with a TRRS tip. So I’ll just cut the end off that and connect the correct the ring to the output and I’m good to go, right? Wrong! The wires in the headphones are so tiny and fine that I cannot figure out which wire is which.

I decide to do this a better way, and order a connector with screw terminals that I can easily attach to. I wire that up and … nothing! Doing some more research, it seems like Macs try to be smart about detecting whether a mic is connected and if it does not detect that a mic is connected (via phantom power maybe?), it will not enable the input. I try a couple of workarounds without success.

Eventually I give up and buy a USB sound card. This puzzle ends up taking me a couple of weeks to complete, but it is all due to sorting out these technical issues.

I end up accidentally solving the puzzle while I’m waiting for the USB device to arrive. While exploring and trying to ascertain whether the solution contained single digits like the first two puzzles, or “chords” of digits like the third puzzle, I happen to try 7 and it likes it. Then I decide to brute force the 2nd digit, thinking maybe I can reverse engineer what the clue would be. The second digit turns out to be 5. This also solves the puzzle for me. The answer is 75.

But what is the question??

When the USB device comes in, I am immediately able to wire the eChallengeCoin output to it and now I can hear what it actually sounds like.

Like puzzle #2, this puzzle might be very hard or very easy depending on your age and life experiences. I happen to be just old enough to have experienced dial-up internet and BBSes, and this sounds an awful lot like the way data “sounds” when being transmitted from a modem.

A bit of Googling quickly reveals that I can use a tool called minimodem to interpret the data from an audio file. So using Quicktime I record the audio from the eChallengeCoin to a file. I’m unsure what baud rate to use, so I end up brute forcing common rates until I find that at 300, I get human-readable output using minimodem -a --rx 300 -f Puzzle4.wav

### CARRIER 300 @ 1300.0 Hz ###
How old was Alexander Graham Bell when he died?
How old was Alexander Graham Bell when he died?
How old was Alexander Graham Bell when he died?
How old was Alexander Graham Bell when he died?
How old was Alexander Graham Bell when he died?
How old was Alexander Graham Bell when he died?
How old was Alexander Graham Bell when he died?
How old was Alexander Graham Bell when he died?
How old was Alexander Graham Bell when he died?
How old was Alexander Graham Bell when he died?

### NOCARRIER ndata=480 confidence=2.736 ampl=0.339 bps=299.77 (0.1% slow) ###

I guess now I know the question. A quick trip to Google tells me that Bell lived from 1847 - 1922 and was 75 years old when he died, which is the answer I stumbled upon earlier.

Story Puzzles

With the Coin Puzzles wrapped up, it’s time to move on to the Story Puzzles! The eChallengeCoin has a little text adventure of sorts built into it. It can be accessed via the UART TX/RX pads on the coin using a USB to Serial adapter. You can use a variety of tools achieve this, from an inexpensive adapter based on a knockoff FTDI chip, to more complicated solutions like Bus Pirate, Shikra or Tigard. They are really overkill for this type of application but as it happens I ordered a Tigard back in December of 2020 and had not actually used it for anything yet, so this is as good of a time as any.

To get everything set up, I cut a couple of pairs of alligator clips in half and strip the wire ends. I clip one to each of the TX, RX and GND pads on the eChallengeCoin and run them to a breadboard. Then I run jumper wires from the breadboard to the appropriate pins on the Tigard. Finally I connect the Tigard to the USB on my computer. Normally I use CoolTerm for this type of thing but the eChallengeCoin only outputs line feed (and not carriage return) so you need software that can add the carriage returns in order to get the text to display correctly. If CoolTerm supports this, I am unable to figure out how to enable it. So in this case, I use miniterm.py which does allow this. miniterm.py /dev/cu.usbserial-TG10003e0 gets me connected with everything working properly and I’m ready to tackle the puzzles.

Story Puzzle #1

The first part of the story tells about someone named Daniel Bussard. A resident of Washington DC in the 19th century, a brewer, civil servant, church leader and businessman who also might have had some shady dealings. I need to figure out where his Family Bible has been stored. The main clue given is My good book is in my Lord's house. My faith has no secrets. My book does. So it sounds like the Bible would be hidden in his church. But there are no clues in the story about where the church would be.

Doing some research it turns out that Daniel Bussard was a real person and not just a character made up for the story. Googling about him reveals (among other things) a historic document (PDF) about the Bussard-Newman house, which happens to have an address adjacent to the house that our protagonist Sara Cladlow is visiting. In this document it is mentioned that Bussard was a trustee of the Georgetown Presbyterian Church. Is this where the Bible was hidden? Typing Georgetown Presbyterian Church into the terminal confirms that it is.

Story Puzzle #2

The story reveals that there is a note in the Bible in which Bussard mentions My most valued asset behind my et ux C … What does the C stand for? The first thing to figure out is what et ux means… some quick research determines that is old-timey legalese for and wife so maybe it’s referring to Bussard’s wife?

Going back to the document that helped me solve the first puzzle, I find a reference to Daniel Bussard et ux Catherine. Catherine is the name of his wife and the solution to this puzzle.

Story Puzzle #3

The story finally reveals that the final goal is to access a safe protected by a combination lock that takes letters instead of numbers. The combination is 5 letters long. The clue mentions Bussard’s most valued asset (behind, of course, his wife per Puzzle #2). Thinking back through the story, I remember a bit in French from part 1 that I had translated. It was about Bussard being asked to brew a beer suitable for French tastes. Immediately the French word for beer - biére jumps right to mind and I guess that. Success! The final solution is biere. Good thing, too, because if that wasn’t correct I would have been totally stumped.

Bonus

There is also a bonus on the eChallengeCoin. I spend some time trying to figure out how it works. There is both an iR emitter and receiver on the coin and the documentation indicates that these are crucial in claiming the bonus. I am unable to determine exactly how to do it. It is finally revealed around the time of DEFCON that the bonus can be claimed by finding someone else who has an eChallengeCoin and holding the coins so that the iR emitters and receivers line up. They then send a signal to each other, which triggers the bonus for both coins. A nice way to get coin holders interacting in meatspace. Unfortunately I did not go to DEFCON in 2021, so I had no way to achieve this, short of ordering another coin. That seemed silly and would also potentially take an opportunity away from someone else to get a coin of their own.

But my little hacker brain can’t help trying… I try several techniques, including mirrors and even some fiber-optic from a novelty lamp (which should have worked but maybe I just needed to use more strands or better fiber). Eventually I come up with a brilliant plan: I de-solder the iR emitter from the coin and put it on long leads so that I can fire it right into the receiver.

It doesn’t work:

I thought I could claim the bonus on the 2021 eChallengeCoin by putting the iR emitter on a long lead and aim into the iR receiver but I guess @bradanlane is craftier than that 🤣 pic.twitter.com/oEqgQ0VEK9

— t.fish (@tdotfish) August 19, 2021

The designer tweets to me I should try doing that with the UART connected. It says: Talking to myself? They’re on to me! It seems unlikely that different coins send out a different code, so my guess is that it assumes that the coins will not be started at the exact same time, and as long as there is some offset between what it’s sending and what it’s receiving, it completes the challenge. I have considered several ways to do this, including recording the iR pattern and playing it back or straight up bitbanging the iR pulses into the wire (I did something similar to the Roku) but ultimately I had to set the project aside to work on other things. When I get back to DEFCON maybe I can meet some other people who brought their coins along and claim the bonus the way the designer intended.

Conclusion

The 2021 eChallengeCoin is a cool little gadget with some fun puzzles and a welcome opportunity to do a little hardware hacking. If you want a crack at these challenges, I’ve got good news for you: Bradán Lane Studios not only still have the 2021 eChallengeCoin available for purchase, but they have also re-released the original 2020 eChallengeCoin AND a new 2022 eChallengeCoin was just released as well. The eChallengeCoins are available (along with some other cool gadgets) from their Tindie Store. I have no affiliation with Bradán Lane Studios, I just think they make cool stuff and maybe you will too.