Using AI to reverse-engineer a gym app's entry QR code
What happened
On November 6, Hacker News' front page featured a developer who reverse-engineered a gym app with DeepSeek v4.1 Flash and built a SvelteKit page that generates entry QR codes locally. The original app refreshes its code every 15 seconds. The author pulled the account key from plaintext logs on a rooted Android phone, reimplemented the encryption with WebCrypto, and checked the output against the app: the URLs matched byte for byte. The prototype lets the author skip the app's social feed, but it has no standalone login, so a key rotation means fetching the key again.
Written by AI from the coverage · updated 5 hours ago
Coverage
Follow the reports to see the story from different sides.
- Hacker News front pageMy gym forced a social media down my throat. So I reverse-engineered its app
原文作者借助 DeepSeek v4.1 Flash 逆向健身房应用，构建本地生成入场二维码的 SvelteKit 网页，并成功完成进出签到。应用每 15 秒更新二维码，作者从已 root 的 Android 手机明文日志中提取账户密钥，用 WebCrypto 实现加密，并与原应用输出核对，得到字节完全一致的 URL。该原型绕开了应用的社交信息流，但尚未实现独立登录，密钥轮换后仍需重新获取。
Heat over time
Heat now 9·Comparable peak 10（Nov 6 03:00）·Comparable change over 24 hours –
The trend only compares accounts observed without gaps, so its range may be smaller than the current heat. Hover or tap the chart for each hour; the left and right arrow keys step through it.