The board game "Hitster" functions by providing players with physical cards containing QR codes. When scanned via the Hitster mobile app, these codes trigger playback of specific songs through Spotify or Apple Music subscriptions. Because the app requires an active subscription to function properly, one researcher set out to investigate how the mapping between card IDs and musical tracks is stored and protected within the software.
The researcher investigated how the app maps these scanned QR codes to specific musical tracks.
The game functions by providing players with physical cards containing QR codes.
By decompiling the Android APK using `jadx`, the researcher identified several JSON files in the app's resources, including one named `gameset_database_4.json`. This file appeared to be encrypted using Base64 encoding followed by AES (Advanced Encryption Standard) encryption. By analyzing the Java source code—specifically a file labeled `k43.java`—the researcher mapped out the decryption logic. The process revealed that the app uses AES-GCM mode, where it derives a secret key from a hardcoded string combined with a hash of the remaining data length. Through collaboration with others in a developer community, the researcher eventually recovered this hidden string by XORing two byte arrays found in the codebase, allowing them to write a custom Rust script to decrypt the database locally.
This effort yielded a file containing approximately 31,000 mappings of card IDs to music tracks across multiple regions. However, the investigation ultimately revealed a simpler path: while the local application attempted to hide these assets via complex encryption, the same information was accessible without any security measures on a public server. By navigating to a specific asset URL (`hitster.jumboplay.com/hitster-assets/`), the researcher discovered the entire `gameset_database.json` file in an unencrypted state. This highlights a common discrepancy between client-side obfuscation and server-side exposure, where developers may focus on hiding data within the app's binary while leaving it publicly available on their web infrastructure.