Shoddy design. If you use only uppercase letters and a limited set of characters in a URL you can pack in 38 or 47 characters with medium or low error correction in the smallest standard-sized QR code (there is one smaller size, but it is missing the lower-right tracking dot and I wouldn't count it to scan as reliably.)
There is enough room in there for a moderately short URL and a randomly generated string which can be used like a type 4 UUID to coin a reasonable (or even unreasonable) number of ids which can't be guessed or forged. I print flyers and business cards on inkjet or laser that are all unique and trackable. If their printing process allowed it they could put a unique code on every card in every deck.
There's no excuse for the crazy-large QR codes you see on a lot of signs since you can store a long URL a database and have a redirect script look it up.
I don't have a huge amount of modelling or testing to back it up but it seems common sense people are going to have an easier time scanning codes that with bigger pixels than large pixels whatever kind of device they are using.
rmunn 4 hours ago [-]
As an avid board gamer myself, I was wondering how you reverse engineer a board game, and I was slightly disappointed to find out that it was the board game's companion app that was reverse engineered. (Well, "companion" might be a misnomer here since a game about identifying songs isn't really playable without the ability to play the songs...)
Perhaps the title could be updated to mention that it was the app that was reverse engineered? If the title had been "I reverse engineered a board game's app", that would have saved me from getting the wrong impression about the article.
GuB-42 1 hours ago [-]
> Well, "companion" might be a misnomer here since a game about identifying songs isn't really playable without the ability to play the songs...
It begs the question, at which point a board game that relies on an app becomes a video game with physical components?
snarf21 23 minutes ago [-]
As a board game designer, I was even more curious what this could mean. Also disappointed that it was just about a game with a digital oracle and hacking their app.
That being said, you can reverse engineer a board game and that partially happens a lot in normal design. You have to understand the systems if you want to build on a concept or riff on it. It would be interesting for someone to do a full write-up of the whole process to do so and turn it into a new game that fixes a game's issues but is based on the reverse engineering. Comment if that sounds interesting and with a game to do it on (not something 6 hours long like TI4!) and maybe I'll carve some time away from design and do one. :)
abanana 3 hours ago [-]
"Reverse engineering" is also a misnomer here. Surely - this guy doesn't even know what it means? It means working out how to get to the end result when you only have that end result to look at, you don't have full access to the methods that get you there. All he's done here is read the code!
homarp 34 minutes ago [-]
well, the author got the apk and decompiled it. Then searched where things were happening in the code by grep and then reading it.
tecleandor 3 hours ago [-]
So, what I don't like about this game is... it depends on both a companion app and a Spotify or Apple Music subscription? It doesn't even contain the music you have to hear?
I guess it's a cheap way of doing a game (so you don't need to license the music), but that game will stop working soon as some API changes and the companion app is updated, or as licensing in some songs change and stop working in the game.
But I guess that, now you have the URL, you could make an Open Source app that mimics the Hitster app, and even download a package with all the songs on MP3 to have offline. Don't know it that was @wuemeli idea...
carlosfaham 1 days ago [-]
Great find, pretty cool adventure on the decryption. (The "with a little imagination" is doing a bit of work at the end.)
Zookaz 42 minutes ago [-]
This is cool I love a good bit of cryptography but i think this post isn't quite what the title suggests.
entropy47 2 hours ago [-]
Next time you need to unpack an APK you can just adb pull it off a phone, no need to hit a dodgy website!
m000 3 hours ago [-]
So I guess that now you can make PiHole map hitster.jumboplay.com to a local address, print your own game cards and continue playing the game with the official app?
malmeloo 2 hours ago [-]
The file is served over HTTPS. Maybe on a device where eMudhra is still trusted :-)
jbaiter 4 hours ago [-]
Did the same thing last year for christmas for my in-laws without Spotify or Aple Music, created a small webapp that allows them to scan the cards and then plays the track from youtube. Works really well to this day, it's a fun game!
metaketa 1 days ago [-]
I hope they do https://moneymaker.games next. Would be amusing, since the model behind it is literally the fractional reserve banking principles.
rithdmc 4 hours ago [-]
This looks relatively simple to play, and pretty interesting. Good reviews on Board Game Geek. I'll have to add this to my shopping list.
tezza 4 hours ago [-]
Hitser is an awesome game... cannot recommend it highly enough.
Suitable for all ages... and if you're an expert, it's still tough
Which came first?:
Supertramp - Give A Little Bit
.
The Trammps - Disco Inferno
pluc 4 hours ago [-]
I don't get it. How is this reverse engineered? Have you found out how the game works? Have you find ways to exploit it? How about redirecting a QR code?
Seems you just discovered the association between QR code and Spotify ID which you could have done by, you know, looking at the QR code or just proxying requests.
Like.. without any tools I can tell you that this game scans a QR code and sends you to a Spotify page. You discovered the same thing by decompiling and decrypting...? What has been discovered here
rithdmc 4 hours ago [-]
> How is this reverse engineered?
You mean other than decompiling the app and reading the code to figure out how it works?
pluc 4 hours ago [-]
That's what I'm saying... nothing was figured out other than it scans a QR code and gets a spotify link, which I can do if you tell me one sentence about the game.
I can also tell you cards are made of plastic without needing extensive scientific analysis? Did I just reverse-engineer matter?
rithdmc 3 hours ago [-]
"other than" is doing a lot of lifting.
I once reverse engineered an Android app to figure out how the API works. The website had a legitimate API, free to sign up for, and well documented.
I still reverse engineered the Android app, even if the information was more readily available elsewhere.
tecleandor 3 hours ago [-]
But the QR code in the card doesn't contain the Spotify link. The mapping between the QR code and the Spotify link is done by the companion app, pulling a database from another URL that was found by the poster on the RE process.
pluc 3 hours ago [-]
Ah see that's the part that was missing. Thanks for clarifying
RaffaelKuhn 1 days ago [-]
Interesting, I like playing (probably because I am good at it). Why did you choose Hitster? And sounds to me like there’s many such examples.
nekusar 1 hours ago [-]
At first I was like "why do you need to reverse engineer a game like Catan?"
And then, I realized you're talking about this abortion of a board game + android/iOS app garbage being sold as a 'board game'. Its not.
These games, +3 years, will be uninstallable, unplayable, and delisted off app stores. It makes all these styles of games effectively playable today, but no guarantee of tomorrow.
ANY board game that purports some "app" is an instant-ignore on my behalf. I have board games that go back to the 1970s (King Maker!), and the first printng of Illuminati. They all work and still work for another 100 years.
bitwize 2 hours ago [-]
This would have been a neat story... in 2024.
Today, it's a matter of:
$ claude
⟩ I need to know how the Hitster app maps QR codes to Spotify or Apple Music tracks.
⋆ Obliterating...
Now I have the whole picture. The QR code takes you to a URL with a track ID
and a region. The track ID/region pair carry the mapping to the song—not the
QR code. These mappings are in a file called `gameset_database_4.json`, which
is an AES-encrypted, base64-encoded JSON file. The load-bearing seam is the
derivation of the key from an XOR'd pair of strings concatenated to the length
of the base64-decoded data, minus 12 bytes for the nonce and 16 bytes for the
authentication tag...
OP could have had this answer in 5 minutes and spent the remaining 17h 55m playing with their kids or hugging their dog or something.
entropy47 2 hours ago [-]
One of my idiot friends ran a marathon yesterday - in the twenty first century, covering that kind of distance is just a matter of calling an Uber. All that time he wasted when he could have been hugging a dog
nkrisc 1 hours ago [-]
Why even live when you can just go into a medically induced coma and have nutrients pumped into your body?
wuemeli 46 minutes ago [-]
where is the fun in that :D?
billboardweb 1 days ago [-]
[flagged]
hdjrudni 1 days ago [-]
All humans did this? Just for sport? Good on you if you didn't use any AI to figure this out.
Rendered at 13:51:59 GMT+0000 (UTC) with Wasmer Edge.
There is enough room in there for a moderately short URL and a randomly generated string which can be used like a type 4 UUID to coin a reasonable (or even unreasonable) number of ids which can't be guessed or forged. I print flyers and business cards on inkjet or laser that are all unique and trackable. If their printing process allowed it they could put a unique code on every card in every deck.
There's no excuse for the crazy-large QR codes you see on a lot of signs since you can store a long URL a database and have a redirect script look it up.
I don't have a huge amount of modelling or testing to back it up but it seems common sense people are going to have an easier time scanning codes that with bigger pixels than large pixels whatever kind of device they are using.
Perhaps the title could be updated to mention that it was the app that was reverse engineered? If the title had been "I reverse engineered a board game's app", that would have saved me from getting the wrong impression about the article.
It begs the question, at which point a board game that relies on an app becomes a video game with physical components?
That being said, you can reverse engineer a board game and that partially happens a lot in normal design. You have to understand the systems if you want to build on a concept or riff on it. It would be interesting for someone to do a full write-up of the whole process to do so and turn it into a new game that fixes a game's issues but is based on the reverse engineering. Comment if that sounds interesting and with a game to do it on (not something 6 hours long like TI4!) and maybe I'll carve some time away from design and do one. :)
I guess it's a cheap way of doing a game (so you don't need to license the music), but that game will stop working soon as some API changes and the companion app is updated, or as licensing in some songs change and stop working in the game.
But I guess that, now you have the URL, you could make an Open Source app that mimics the Hitster app, and even download a package with all the songs on MP3 to have offline. Don't know it that was @wuemeli idea...
Suitable for all ages... and if you're an expert, it's still tough
Which came first?:
Supertramp - Give A Little Bit
.
The Trammps - Disco Inferno
Seems you just discovered the association between QR code and Spotify ID which you could have done by, you know, looking at the QR code or just proxying requests.
Like.. without any tools I can tell you that this game scans a QR code and sends you to a Spotify page. You discovered the same thing by decompiling and decrypting...? What has been discovered here
You mean other than decompiling the app and reading the code to figure out how it works?
I can also tell you cards are made of plastic without needing extensive scientific analysis? Did I just reverse-engineer matter?
I once reverse engineered an Android app to figure out how the API works. The website had a legitimate API, free to sign up for, and well documented.
I still reverse engineered the Android app, even if the information was more readily available elsewhere.
And then, I realized you're talking about this abortion of a board game + android/iOS app garbage being sold as a 'board game'. Its not.
These games, +3 years, will be uninstallable, unplayable, and delisted off app stores. It makes all these styles of games effectively playable today, but no guarantee of tomorrow.
ANY board game that purports some "app" is an instant-ignore on my behalf. I have board games that go back to the 1970s (King Maker!), and the first printng of Illuminati. They all work and still work for another 100 years.
Today, it's a matter of:
OP could have had this answer in 5 minutes and spent the remaining 17h 55m playing with their kids or hugging their dog or something.