Reverse-engineering Hitster: 18 hours to crack encryption that guarded a publicly accessible file
I reverse engineered a board game
A Hitster board game gift led to reverse-engineering its Android app after discovering the app requires a Spotify or Apple Music subscription. Decompiling the APK revealed AES-GCM encryption for a card-to-track mapping, with the key derived from XORing two byte arrays. After 18 hours, the decrypted file was found—but the same data was also available unencrypted at a predictable URL.
We spent around 18 hours chasing a file that, in the end, wasn’t even a real secret.