I took some time tonight with a multimeter to map out what pins on the microcontroller connect to everything on the badge. Here is what I found:
### Badge Pinout ### chip | Arduino | Connection / Function 20 0 nc (Serial1 RXD1) 21 1 nc (Serial1 TXD1) 19 2 nc 18 3 nc 25 4 neopixel data 31 5 nc 27 6 nc 1 7 nc 28 8 nc 29 9 nc 30 10 Data Out to IR emitter 12 11 nc 26 12 nc 32 13 nc 41 A5 nc 40 A4 nc 39 A3 nc 38 A2 nc 37 A1 nc 36 A0 Data in from IR Reciever
I found this awesome graphic that maps out all the Arduino compatible pin mappings for the Atmega32u4 microprocessor. This helped a lot in tracing out the above pins.
I ran a basic IR hex dump sketch with pin A0 configured as my IR receive pin, pointed a random IR remote at the badge, and it spit out numbers!
I then loaded up another sketch I've used in the past with an IR LED that triggers the shutter on my Nikon DSLR, set it to blast out on pin 10 and [click!], it took some pictures of itself!
The IR receiver is a Vishay TSOP36236TT (36khz Carrier frequency) and the IR emitter is a Vishay TSML1020.
And with that, I consider this badge fully hacked (well, hardware wise, anyway. I'm sure there are still more goodies to find in the stock badge firmware).
Let me know if you build anything cool with this information. Happy Hacking!