As an avid board gamer myself, I was wondering how you reverse engineer a board game, and I was slightly disappointed to find out that it was the board game's companion app that was reverse engineered. (Well, "companion" might be a misnomer here since a game about identifying songs isn't really playable without the ability to play the songs...)
Perhaps the title could be updated to mention that it was the app that was reverse engineered? If the title had been "I reverse engineered a board game's app", that would have saved me from getting the wrong impression about the article.
"Reverse engineering" is also a misnomer here. Surely - this guy doesn't even know what it means? It means working out how to get to the end result when you only have that end result to look at, you don't have full access to the methods that get you there. All he's done here is read the code!
So, what I don't like about this game is... it depends on both a companion app and a Spotify or Apple Music subscription? It doesn't even contain the music you have to hear?
I guess it's a cheap way of doing a game (so you don't need to license the music), but that game will stop working soon as some API changes and the companion app is updated, or as licensing in some songs change and stop working in the game.
But I guess that, now you have the URL, you could make an Open Source app that mimics the Hitster app, and even download a package with all the songs on MP3 to have offline. Don't know it that was @wuemeli idea...
At first I was like "why do you need to reverse engineer a game like Catan?"
And then, I realized you're talking about this abortion of a board game + android/iOS app garbage being sold as a 'board game'. Its not.
These games, +3 years, will be uninstallable, unplayable, and delisted off app stores. It makes all these styles of games effectively playable today, but no guarantee of tomorrow.
ANY board game that purports some "app" is an instant-ignore on my behalf. I have board games that go back to the 1970s (King Maker!), and the first printng of Illuminati. They all work and still work for another 100 years.
So I guess that now you can make PiHole map hitster.jumboplay.com to a local address, print your own game cards and continue playing the game with the official app?
Did the same thing last year for christmas for my in-laws without Spotify or Aple Music, created a small webapp that allows them to scan the cards and then plays the track from youtube. Works really well to this day, it's a fun game!
I don't get it. How is this reverse engineered? Have you found out how the game works? Have you find ways to exploit it? How about redirecting a QR code?
Seems you just discovered the association between QR code and Spotify ID which you could have done by, you know, looking at the QR code or just proxying requests.
Like.. without any tools I can tell you that this game scans a QR code and sends you to a Spotify page. You discovered the same thing by decompiling and decrypting...? What has been discovered here
That's what I'm saying... nothing was figured out other than it scans a QR code and gets a spotify link, which I can do if you tell me one sentence about the game.
I can also tell you cards are made of plastic without needing extensive scientific analysis? Did I just reverse-engineer matter?
But the QR code in the card doesn't contain the Spotify link. The mapping between the QR code and the Spotify link is done by the companion app, pulling a database from another URL that was found by the poster on the RE process.
$ claude
⟩ I need to know how the Hitster app maps QR codes to Spotify or Apple Music tracks.
⋆ Obliterating...
Now I have the whole picture. The QR code takes you to a URL with a track ID
and a region. The track ID/region pair carry the mapping to the song—not the
QR code. These mappings are in a file called `gameset_database_4.json`, which
is an AES-encrypted, base64-encoded JSON file. The load-bearing seam is the
derivation of the key from an XOR'd pair of strings concatenated to the length
of the base64-decoded data, minus 12 bytes for the nonce and 16 bytes for the
authentication tag...
OP could have had this answer in 5 minutes and spent the remaining 17h 55m playing with their kids or hugging their dog or something.
One of my idiot friends ran a marathon yesterday - in the twenty first century, covering that kind of distance is just a matter of calling an Uber. All that time he wasted when he could have been hugging a dog
Perhaps the title could be updated to mention that it was the app that was reverse engineered? If the title had been "I reverse engineered a board game's app", that would have saved me from getting the wrong impression about the article.
It begs the question, at which point a board game that relies on an app becomes a video game with physical components?
I guess it's a cheap way of doing a game (so you don't need to license the music), but that game will stop working soon as some API changes and the companion app is updated, or as licensing in some songs change and stop working in the game.
But I guess that, now you have the URL, you could make an Open Source app that mimics the Hitster app, and even download a package with all the songs on MP3 to have offline. Don't know it that was @wuemeli idea...
And then, I realized you're talking about this abortion of a board game + android/iOS app garbage being sold as a 'board game'. Its not.
These games, +3 years, will be uninstallable, unplayable, and delisted off app stores. It makes all these styles of games effectively playable today, but no guarantee of tomorrow.
ANY board game that purports some "app" is an instant-ignore on my behalf. I have board games that go back to the 1970s (King Maker!), and the first printng of Illuminati. They all work and still work for another 100 years.
Suitable for all ages... and if you're an expert, it's still tough
Which came first?:
Supertramp - Give A Little Bit
.
The Trammps - Disco Inferno
Seems you just discovered the association between QR code and Spotify ID which you could have done by, you know, looking at the QR code or just proxying requests.
Like.. without any tools I can tell you that this game scans a QR code and sends you to a Spotify page. You discovered the same thing by decompiling and decrypting...? What has been discovered here
You mean other than decompiling the app and reading the code to figure out how it works?
I can also tell you cards are made of plastic without needing extensive scientific analysis? Did I just reverse-engineer matter?
I once reverse engineered an Android app to figure out how the API works. The website had a legitimate API, free to sign up for, and well documented.
I still reverse engineered the Android app, even if the information was more readily available elsewhere.
Today, it's a matter of:
OP could have had this answer in 5 minutes and spent the remaining 17h 55m playing with their kids or hugging their dog or something.