I reverse engineered a board game | Hacker News Reader

I reverse engineered a board game

wuemeli.com

81 pointswuemeli34 comments

As an avid board gamer myself, I was wondering how you reverse engineer a board game, and I was slightly disappointed to find out that it was the board game's companion app that was reverse engineered. (Well, "companion" might be a misnomer here since a game about identifying songs isn't really playable without the ability to play the songs...)

Perhaps the title could be updated to mention that it was the app that was reverse engineered? If the title had been "I reverse engineered a board game's app", that would have saved me from getting the wrong impression about the article.

"Reverse engineering" is also a misnomer here. Surely - this guy doesn't even know what it means? It means working out how to get to the end result when you only have that end result to look at, you don't have full access to the methods that get you there. All he's done here is read the code!

well, the author got the apk and decompiled it. Then searched where things were happening in the code by grep and then reading it.

> Well, "companion" might be a misnomer here since a game about identifying songs isn't really playable without the ability to play the songs...

It begs the question, at which point a board game that relies on an app becomes a video game with physical components?

It's a blurry line. When you replace the deck of "bad stuff happens" cards in a solo game with an app that reads them out to you, but the app could have been a deck of cards, which side of the line does that land? What about if the app starts tracking game state for you as well? Game state that could have been tracked with moving tokens around the board, or using dice as counters, but is simpler in the app. Does that cross the line into video-game territory? What if the app tracks hidden game state, doing the job a human GM would need to do. Does that cross the line?

It's very, very fuzzy. Which may be part of why some board game designers chose not to create companion apps. For example, Arydia (designed by Cody Miller and Ira Fay) tracks game state with three large boxes of playing cards, some of which have "B" and "C" versions; the game will routinely tell you that after you defeat such-and-such an enemy, switch NPC-32 into the "B" state. So you take the NPC-32A card out of the active section of the box and put it in the inactive section, and take the NPC-32B card out of the inactive section and put it in the active section. That could have been done with an app, but every time the question of a companion app gets raised on the Arydia forums at BoardGameGeek, the game designers say "We thought about doing an app, but decided it didn't fit with our vision for the game; we wanted it to be purely a board game with physical components." (I'm paraphrasing rather than quoting).

By the way, I highly recommend Arydia if you're into board games with an exploration, adventuring experience. It's the game that has come closest of all the ones I've played to "RPG campaign in board game form". It's got a steep price because of all the physical components included in the game. But my word, is it worth the price if that kind of gameplay is up your alley (and it is very much up mine). You'll get hours and hours of gameplay out of it, and when you're done, you can reset the campaign and play again. You might think "Oh, I'll remember everything from my first playthrough" but the game is long enough that you probably won't remember most of it.

Anyway, enough rambling about one of only 3-4 games I ever rated 10/10 on BGG. We were discussing board game "companion apps", and there are definitely some that I would say "Yeah, that's a video game in board game shape". But I don't buy those, they don't appeal to me, so I really don't remember their names. They definitely exist, though.

As a board game designer, I was even more curious what this could mean. Also disappointed that it was just about a game with a digital oracle and hacking their app.

That being said, you can reverse engineer a board game and that partially happens a lot in normal design. You have to understand the systems if you want to build on a concept or riff on it. It would be interesting for someone to do a full write-up of the whole process to do so and turn it into a new game that fixes a game's issues but is based on the reverse engineering. Comment if that sounds interesting and with a game to do it on (not something 6 hours long like TI4!) and maybe I'll carve some time away from design and do one. :)

For a second I thought they were going to do a formalization of the rules to find weak points or optimal plays.

So, what I don't like about this game is... it depends on both a companion app and a Spotify or Apple Music subscription? It doesn't even contain the music you have to hear?

I guess it's a cheap way of doing a game (so you don't need to license the music), but that game will stop working soon as some API changes and the companion app is updated, or as licensing in some songs change and stop working in the game.

But I guess that, now you have the URL, you could make an Open Source app that mimics the Hitster app, and even download a package with all the songs on MP3 to have offline. Don't know it that was @wuemeli idea...

Shoddy design. If you use only uppercase letters and a limited set of characters in a URL you can pack in 38 or 47 characters with medium or low error correction in the smallest standard-sized QR code (there is one smaller size, but it is missing the lower-right tracking dot and I wouldn't count it to scan as reliably.)

There is enough room in there for a moderately short URL and a randomly generated string which can be used like a type 4 UUID to coin a reasonable (or even unreasonable) number of ids which can't be guessed or forged. I print flyers and business cards on inkjet or laser that are all unique and trackable. If their printing process allowed it they could put a unique code on every card in every deck.

There's no excuse for the crazy-large QR codes you see on a lot of signs since you can store a long URL a database and have a redirect script look it up.

I don't have a huge amount of modelling or testing to back it up but it seems common sense people are going to have an easier time scanning codes that with bigger pixels than large pixels whatever kind of device they are using.

Great find, pretty cool adventure on the decryption. (The "with a little imagination" is doing a bit of work at the end.)

Hitser is an awesome game... cannot recommend it highly enough.

Suitable for all ages... and if you're an expert, it's still tough

Which came first?:

Supertramp - Give A Little Bit

The Trammps - Disco Inferno

are Spotify id static?

I have a few theories, if the ids change, then downloadable data lets them maintain it. if the downloadable data is abandoned...then maybe the game fallback to the embedded data and perhaps the game will work for a little longer - the embedded is the last known version at build time. and hacking games like this is cheating that doesn't help anyone enjoy the game.( I could get a streak of in 1s in Wordle....but why? )

Did the same thing last year for christmas for my in-laws without Spotify or Aple Music, created a small webapp that allows them to scan the cards and then plays the track from youtube. Works really well to this day, it's a fun game!

I hope they do https://moneymaker.games next. Would be amusing, since the model behind it is literally the fractional reserve banking principles.

This looks relatively simple to play, and pretty interesting. Good reviews on Board Game Geek. I'll have to add this to my shopping list.

FWIW, the original Hitster game is really fun, highly recommended.

At first I was like "why do you need to reverse engineer a game like Catan?"

And then, I realized you're talking about this abortion of a board game + android/iOS app garbage being sold as a 'board game'. Its not.

These games, +3 years, will be uninstallable, unplayable, and delisted off app stores. It makes all these styles of games effectively playable today, but no guarantee of tomorrow.

ANY board game that purports some "app" is an instant-ignore on my behalf. I have board games that go back to the 1970s (King Maker!), and the first printng of Illuminati. They all work and still work for another 100 years.

So I guess that now you can make PiHole map hitster.jumboplay.com to a local address, print your own game cards and continue playing the game with the official app?

The file is served over HTTPS. Maybe on a device where eMudhra is still trusted :-)

Or with self-signed cert

This is cool I love a good bit of cryptography but i think this post isn't quite what the title suggests.

Next time you need to unpack an APK you can just adb pull it off a phone, no need to hit a dodgy website!

Interesting, I like playing (probably because I am good at it). Why did you choose Hitster? And sounds to me like there’s many such examples.

I don't get it. How is this reverse engineered? Have you found out how the game works? Have you find ways to exploit it? How about redirecting a QR code?

Seems you just discovered the association between QR code and Spotify ID which you could have done by, you know, looking at the QR code or just proxying requests.

Like.. without any tools I can tell you that this game scans a QR code and sends you to a Spotify page. You discovered the same thing by decompiling and decrypting...? What has been discovered here

> How is this reverse engineered?

You mean other than decompiling the app and reading the code to figure out how it works?

That's what I'm saying... nothing was figured out other than it scans a QR code and gets a spotify link, which I can do if you tell me one sentence about the game.

I can also tell you cards are made of plastic without needing extensive scientific analysis? Did I just reverse-engineer matter?

"other than" is doing a lot of lifting.

I once reverse engineered an Android app to figure out how the API works. The website had a legitimate API, free to sign up for, and well documented.

I still reverse engineered the Android app, even if the information was more readily available elsewhere.

But the QR code in the card doesn't contain the Spotify link. The mapping between the QR code and the Spotify link is done by the companion app, pulling a database from another URL that was found by the poster on the RE process.

Ah see that's the part that was missing. Thanks for clarifying

This would have been a neat story... in 2024.

Today, it's a matter of:

  $ claude
  
  ⟩ I need to know how the Hitster app maps QR codes to Spotify or Apple Music tracks.

  ⋆ Obliterating...

  Now I have the whole picture. The QR code takes you to a URL with a track ID
  and a region. The track ID/region pair carry the mapping to the song—not the
  QR code. These mappings are in a file called `gameset_database_4.json`, which
  is an AES-encrypted, base64-encoded JSON file. The load-bearing seam is the
  derivation of the key from an XOR'd pair of strings concatenated to the length
  of the base64-decoded data, minus 12 bytes for the nonce and 16 bytes for the
  authentication tag...

OP could have had this answer in 5 minutes and spent the remaining 17h 55m playing with their kids or hugging their dog or something.

One of my idiot friends ran a marathon yesterday - in the twenty first century, covering that kind of distance is just a matter of calling an Uber. All that time he wasted when he could have been hugging a dog

Why even live when you can just go into a medically induced coma and have nutrients pumped into your body?

where is the fun in that :D?

All humans did this? Just for sport? Good on you if you didn't use any AI to figure this out.

Reply on news.ycombinator.com