I took some time tonight with a multimeter to map out what pins on the microcontroller connect to everything on the badge. Here is what I found:

### Badge Pinout ###
chip | Arduino | Connection / Function

20     0         nc (Serial1 RXD1)
21     1         nc (Serial1 TXD1)
19     2         nc
18     3         nc
25     4         neopixel data
31     5         nc
27     6         nc
1      7         nc
28     8         nc
29     9         nc
30     10        Data Out to IR emitter
12     11        nc
26     12        nc
32     13        nc
41     A5        nc
40     A4        nc
39     A3        nc
38     A2        nc
37     A1        nc
36     A0        Data in from IR Reciever

I found this awesome graphic that maps out all the Arduino compatible pin mappings for the Atmega32u4 microprocessor. This helped a lot in tracing out the above pins.

I ran a basic IR hex dump sketch with pin A0 configured as my IR receive pin, pointed a random IR remote at the badge, and it spit out numbers!

I then loaded up another sketch I've used in the past with an IR LED that triggers the shutter on my Nikon DSLR, set it to blast out on pin 10 and [click!], it took some pictures of itself!

The IR receiver is a Vishay TSOP36236TT (36khz Carrier frequency) and the IR emitter is a Vishay TSML1020.

And with that, I consider this badge fully hacked (well, hardware wise, anyway. I'm sure there are still more goodies to find in the stock badge firmware).

Let me know if you build anything cool with this information. Happy Hacking!