Hardware training badge

CompatrIoT

An ESP32-C6 badge with a second STM32 target chip, a real Ethernet-bridged CAN/UDS bus, and exposed peripherals (UART, I2C, SPI, SWD, BLE, WiFi) built to be sniffed, dumped and poked at. Seventeen challenges, three categories, each solved by actually driving the hardware.

How to use this guide. Each category lists its challenges easiest to hardest. You'll get what a challenge is testing, the tool it needs, and the pins/bus to connect to. Getting the actual flag is still up to you on the badge. This guide just gets you to where you can see the data.

New to all this? Start with the glossary below before diving into a category.

Automotive	Live CAN bus + UDS diagnostics over Ethernet. Inject frames, bypass a speed limiter, and hold a real ISO-TP conversation with an ECU. 6 challenges · 1450 pts · CAN / UDS	→
Embedded	Serial shells, bus sniffing over UART/I2C/SPI, an optical side-channel, and physical chip-off dumps over SPI/I2C, up to live SWD debugging. 6 challenges · 750 pts · UART / SPI / SWD	→
Wireless	BLE GATT exploration (PIN gates, notifications, encoded clues), plus WiFi recon and a monitor-mode packet capture. 5 challenges · 800 pts · BLE / WiFi	→

What you'll see on every category page

Easy Medium Hard

Difficulty, in the order challenges are listed. Start at the top of each page.

+ Hint

A short nudge, click to open. Won't give the exact steps away.

+ Full guide

The exact steps, commands included, click to open when you're stuck or want to check your work.

Install the tools

Collapsed setup instructions with real terminal commands. Already on the Arsenal Labs kit? You can skip these.

Glossary

Terms used across all three categories. Each category page also explains its own jargon inline, this is just a quick reference.

Terminal: A text window where you type a command and press Enter to run it. On Linux, search your applications menu for "Terminal". It's the primary tool for almost everything in this guide.
Bash command: A single line typed into a terminal. Every grey code block in this guide can be copy-pasted straight into one.
CAN bus: The wiring standard real cars use to let their computers talk to each other. Compatriot exposes a real one over Ethernet.
UDS: Unified Diagnostic Services, the standard protocol a mechanic's scan tool uses to talk to a car's computer. Compatriot runs a small real implementation of it.
GPIO: General Purpose Input/Output. A pin on the board that software can read or write, like a doorbell button or light switch controlled by code.
Logic analyzer: A small USB device that records whether a wire is electrically high or low over time, many times a second. It's how you read a digital signal without the target knowing you're watching.
Flash / EEPROM: Memory chips that keep their contents without power. A phone's storage and a USB stick are both this kind of memory, just in different packages.
SWD / JTAG: Debug protocols that let an external probe pause a chip, read its memory, and single-step its code, the same way a programmer debugs software, but for the hardware itself.
BLE / GATT: Bluetooth Low Energy, and the data structure (GATT) it uses: a device exposes named values called characteristics that a phone app can read, write, or subscribe to.
Monitor mode: A mode some WiFi adapters support that lets them capture all nearby WiFi traffic, not just traffic addressed to them. Needed for Packet Ghost.