TL;DR
Play games on Amazon Luna for your game nights, included with Prime
- A rotating selection of games, no download needed
- Play on TV, laptop or phone
- Fast, free delivery for your gear, too
A developer’s blog post describes examining the Hitster Android app and finding an encrypted JSON file, its AES-GCM decryption routine and two 32-byte arrays that may be relevant to the key. The supplied report cuts off while showing those arrays, so it does not establish whether the author recovered the song database or what data they ultimately accessed.
A developer has published a technical account of reverse engineering the Hitster Android app, reporting that they located an encrypted JSON game database and reconstructed the code used to decrypt it. The supplied account stops as the author presents two candidate 32-byte arrays, so it does not show whether they recovered the song mappings or accessed the complete database.
Hitster is a music-guessing board game whose cards display a song’s title, artist or band, and release year. A QR code on each card points to a URL containing a regional identifier and card ID; scanning it starts playback through the app or a linked music service. The author says that card IDs are not globally unique: a card with ID 1 may correspond to different tracks in different regional editions.
To investigate the app, the author obtained an Android application package (APK) from an unspecified third-party download site and examined decompiled Java code using jadx. They found a raw resource file called gameset_database_4.json, which appeared to contain encoded and encrypted data. The post says Base64 decoding made the data readable only as bytes, not as JSON.
The author then traced a decryption function in the decompiled code. According to their analysis, it Base64-decodes the input, uses the first 12 bytes as an AES-GCM nonce, and derives an AES key by hashing a string made from the encrypted data’s length and a second input. The post explains that the second input was still unknown at that stage. A search for 32-byte byte arrays led to two arrays in another decompiled file, but the available source ends before describing whether either array supplied the missing value or enabled successful decryption.
What the App’s Database Reveals
The account matters because it describes a possible way to inspect the regional song-card mapping behind a physical game, rather than identifying tracks one at a time by scanning cards. If the database can be decrypted and its contents correspond to the cards, that could help explain how the app connects card IDs to songs across regional editions.
But the technical findings reported so far do not establish that the author extracted a usable database, made it public, or changed how the game works. The source also says the app’s music playback requires a Spotify or Apple Music subscription; it does not document a way around those service requirements. The distinction matters: finding the decryption routine is a reported reverse-engineering step, not proof that all data or app functions were accessed.
As an affiliate, we earn on qualifying purchases.
From QR Codes to Encrypted Data
The author begins with the game’s card format. Each card pairs printed song details with a QR code, and the scanned URL includes a region code and card ID. Because regional editions can assign different songs to the same ID, a card number alone cannot identify a track without its region.
The post then follows the data path inside the Android app: a JSON resource appears to be Base64-encoded and encrypted, while decompiled code reveals an AES-GCM operation. The author says the key is generated by hashing a value based on the encrypted payload’s length and another string. That leaves the central investigative question—where the second string comes from—and the post’s final supplied passage begins exploring byte arrays that might help answer it.
““There’s a mapping from Card ID ⇒ Spotify Track.””
— The author of the wუemeli.com report
Hitster music card game expansion pack
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
The Missing Key and Results
The supplied source ends during the presentation of the two 32-byte arrays. It does not show whether the author identified the required secret string, decrypted the JSON successfully, or verified that its contents map card IDs to tracks. The arrays’ role is therefore unconfirmed in the available account.
The source also does not provide the full database, a complete list of cards or regions, independent verification of the author’s findings, or details about any public release. It does not establish whether the reported data is current or whether the same app structure applies to other platforms or versions. No conclusion about the legality of the methods or any terms-of-service breach can be drawn from the supplied material alone.
portable Bluetooth speaker for board game night
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
What the Account Leaves Open
The next technical step described by the post is testing whether the two arrays found in the decompiled app relate to the unresolved input used in key derivation. The available source does not report the outcome. Readers would need a complete continuation from the author to know whether the database was decrypted and what it contained.
Further reporting could also establish whether the findings were independently reproduced, which app version was examined, and whether the author shared any extracted data. Until those details are available, the documented development is the reported discovery of the decryption routine and candidate arrays—not a confirmed release of Hitster’s song database.
As an affiliate, we earn on qualifying purchases.
Key Questions
What did the developer reverse engineer?
The author examined the Hitster Android app and reported finding an encrypted JSON resource and the AES-GCM code used to decrypt it.
Did the report confirm that the song database was decrypted?
No. The supplied source ends while the author is discussing two candidate byte arrays. It does not give the decryption result or confirm that the database was recovered.
Why does Hitster use regional card identifiers?
The author says the same card ID can refer to different songs in different regional editions, so a region code is also needed to identify the track.
Does reverse engineering remove the music subscription requirement?
The source does not say that it does. It describes investigating the app’s data and decryption code, while reporting that playback uses Spotify or Apple Music and requires a subscription.
Source: hn
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
