I received a board game called “Hitster” as a gift. It’s a game where you identify songs and guess release years, artists, etc. Each card has a QR code that you scan using the Hitster app, which then plays the music through Spotify or Apple Music. Sadly, the app requires an Apple Music or Spotify subscription. In this blog post, I’ll go down the rabbit hole of reverse engineering the Android app and bypassing their very, very sloppy attempt at hiding the data.
On the front of each card, you’ll find the artist or band name, the year the song came out, and the song title. On the back, there’s a QR code. Scanning it takes you to a URL with two things in its path: the game’s region (DE in my case) and the card ID. The music then starts playing in the app or through Spotify. This means there’s a mapping from Card ID ⇒ Spotify Track. There are also multiple card versions per region, so the card ID alone isn’t enough to identify a song.
After getting the app’s APK from some sketchy Android APK download website, I used jadx to get the decompiled Java code. After digging around for a bit, I found a few JSON files under res/raw. One of them was named gameset_database_4.json, and it seemed to be encrypted. I ran a tool to identify the format, and it came back as Base64. That’s an encoding, so I decoded it first. The result still wasn’t readable, and I guessed it was encrypted with AES or something similar. I’d never reverse engineered an Android app before, so I just searched globally for AES. And guess what? There was a file called k43.java with the entire decryption process laid out in front of me.
Source: Hacker News · Summarized by HeadlinesBriefing