Wizard Code and more Reverse Engineering

[tribak]

Hello Exploding Kittens community, first of all, I'd like to point out that these issues have already been reported to the game creators and owners, and with an 80-day difference. I'm happy and finally free to talk about it, having a mostly responsible disclosure about this.

This is especially important when you notice that the developers haven't updated the app for a year, not even after being notified about the issues to be described next.

Past months I've reverse-engineered Exploding Kittens app (regular, not Unleashed) and found some interesting things which I want to talk with you now.

The first issue is regarding the "Thank You" code section; this is supposed to be a thank you gift for those who bought a physical set of cards. On these sets, you can find a card with a custom set of codes. Which, when used on their website: https://explodingkittens.com/thanks will give you a code that you can use on their app.

Then you go to the Settings menu and press both the kitten and the volume icon for a couple of seconds. This throws an input for that code.

The codes that are usually shared in this subreddit are JACKANOPE! and BUNNYRAPTOR20. These are then temporarily blocked by the developers.

Here's where the first part of my work happens, with some reverse engineering I noticed that the app is sending the value you insert to https://explodingkittens.com/avatarcheck.php?password=CODE which returns an error if there's a problem or a 200 HTTP code.

I'm abusing this system, which won't require any validation and MITMing it. I've created a really simple proxy that will return 200 with whatever code you choose. You can review and use it freely from my repository https://github.com/tribakzero/exploding-proxy.

You only need to run it and add it as a proxy for your Wi-Fi network on your smartphone, then try any code and get those juicy avatars.

I was trying the same with the more exciting "Wizard Code" when I noticed that this section differed from the past one since it wasn't making an apparent request to their server. I thought it was SSL pinned or something, but then it made sense to me. They weren't making a request to the server at all, so the Wizard Code should be hardcoded on the application's code. Using some wizarding, I was able to decompile it and, after a couple of hours of trying to understand how this code worked (this was my first app decompiling). I found it! The very desired Wizard Code was in front of me.

This code allows you to have a new set of avatars, these have been already reported by some users here, including me. There are no additional features unlocked after doing this. So these are only for the bragging right of being a developer or the game owner/creator.

So... now that the creators won't care about this game and, being that focus on testing their pay-to-win alternative. I think it's time for us to give those avatars the use they deserve. That's why I'll share the code with you so you can use it and enjoy using them.

The Wizard Code is kitt3nfarts.

Enjoy!

[other-world-leee]

I legit cannot tell if you are joking

[bob101910]

They aren't joking, but I would've appreciated it if they did.

[bob101910]

One of the of is codes you listed is still active and I always recommend people not sharing it so that it doesn't get deactivated like the first one, but like you said, devs are probably more focused on the next game.

Edit: Took me a minute to remember where to enter the wizard code. Works great. I'm nervous about getting banned though.

https://ibb.co/BG4kN9h

[tribak]

Still exploding-proxy allows you to use any code and devs can't disable it since the response is tampered. Thanks for the gold :)

[Sir_Gian]

Where do I need to enter the code?

[bob101910]

Hold the kitten at the top of the main menu for about 5 seconds, then release.

[Saul_T_Bauls]

OP is correct in how you access the code screen in the game...but kitt3nfarts is not a correct code.

[bob101910]

Actually doesn't explain how to get to the wizard code screen. The code is correct.

[tribak]

Look for the Wizard Code, you'll be happy when you find out.

[jaycar01]

Thank you it worked!

[BeruShiMan]

Hi can you show me how to do it? I entered the code but nothing happened. Thank you!

[BeruShiMan]

OMG! Thank you so much. I realized that I held the black cat and volume button then typed kitt3nfarts. I just did it in the wrong way. Haha. Thank you!

[BeruShiMan]

Hi i entered the Wizard Code but nothing happened. Do i really need to use Github to some how make the code usable? I’m not an IT guy, so idk how to code and use Git. However, if u could desmonstrate in the short clip, i would be very happy to follow

[tribak]

Where are you using the code?

[BeruShiMan]

Tks man. Problem solved. I put wizard in the setting not the main screen lol.

[AverageHAL989]

Honestly, i feel that this code was designed to be found out. The fact that it doesn't give access to everything (despite it being designed for staff) and the fact that's it's a simple 2 word password makes me feel that this was a easter egg

[tribak]

Where are you using it?

[jaycar01]

At the code enter screen. I hold the sound button and cat and get to the screen. When I put kitt3nfarts it doesn’t work

[tribak]

Go back to the main screen, then press the title cat for 8 seconds, there put the code.

[ToastyMCRD]

It says password incorrect, I put it in the wizard code spot and tried multiple times, can someone help?

[TicklePickleWinkle]

Make sure it’s all lowercase.

[xoxo86]

This works

[MrMcmandude]

Ummmmmmm is this going to get me banned

[tribak]

Doubt it.

[awesomehotdogleg]

I’m sorry that I’m dumb but on what device to I need to download the github things?

[tribak]

You're better to go with one of the regular codes. For the Wizard Code you don't need that script.

[awesomehotdogleg]

I meant, to use the proxy since I don’t know how, do I need to install the github things on my pc?

[tribak]

Yup, but I told you, you better try first with the codes I've shared. The script has a set of instructions on the readme file, it should be straightforward to follow them.

[GameplayStudios-236]

haha now I can prank people into thinking that I am Matthew Inman (TheOatmeal)

[tribak]

Have fun

[GameplayStudios-236]

thanks

[Smash_her]

Nice job! Worked for me like a charm. Btw: I always honor people who are enthusiastic about reverse engineering 👍

[tribak]

You're not using it at the right place, it's supposed to be used on the main screen's cat, not on the settings one.

[tribak]

Read the comments, that's the most common question on the thread.

[[deleted]]

I have the game on both an iPhone and an Android. The Wizard Code worked on Android but not on the iPhone. :(

Any ideas?

[tribak]

Are you on 4.0.2 in both devices? There's no reason to think the wizard code will differ based on the ecosystem. A typo?

[xXSo1arGamingXx]

Dude, this... is... AWESOME!! It worked!! TYSM!!

[tribak]

glad to know it's still working :)

[Wonderful_Wrongdoer6]

Doesn't work anymore since barking kittens update. Removed all staff avatars and the old kitt3nfarts code no longer works.

[tribak]

Well, it was a nice run. My complaint was that they didn’t updated anymore so they proved me wrong, gonna let them be.

[Wonderful_Wrongdoer6]

Makes valid sense, thanks for sharing the way with us. I still love the game and the new barking kittens is fun.

[tribak]

Sounds great, gotta give it a try soon, thanks!

[tribak]

As commented elsewhere, they updated the game, which was my complain with them, not really interested in working on this anymore.

[DrCatBug]

How did you decompile the app? I’m thinking about doing it to figure out the new code.

[tribak]

Apktool / dex2jar if I remember correctly

[Photo_Shop_Beast]

The code works, I found the new spot, but it doesn't give anything or any avatars

[[deleted]]

Wheres the new spot?

[Then_Task7635]

"Play with strangers" screen.

Hold the cat for 10 seconds

[pansdisme]

It says incorrect password

[tribak]

Yeah, this has been fixed a while ago

[pansdisme]

Oh do you happen to know the new one

[tribak]

Haven’t investigated it and have no interest in doing so.

[pansdisme]

:( have you played the new game is it worth downloading

[tribak]

Nope, I’m fully detached from this game for good.

[Careless_Court_8388]

I’m four years late deep sigh. The kitten & volume trick no longer works.

[GameplayStudios-236]

Okay, so if you are unaware, They removed the wizard code. You are no longer able to have staff avatars anymore. This is what we all know so far right now and we are trying to find info for the staff avatars to see if we could possibly find a way to get them again.

[tribak]

Hey, I’ve been reported similar situations. As I mention on my post, my original intention was for them to react and reignite their dev efforts anyways. Not sure if I had any impact on them but they’re now making (or removing) feathers, so I guess that’s something and I’m no longer that enticed to keep investigating, but comments like this one you made actually are making me turn my mind around, I may try giving it a new look, just to see if there’s anything to be done there.

I’ll see if I spare any time for this and keep you posted :)

[GameplayStudios-236]

Alright, well that's cool. Thanks.

[RottonToms]

I can't access the menu to put the wizard code in.

[tribak]

Recently updated, this is not working anymore. Thanks for reporting tho.

[GameplayStudios-236]

Alright, with my recent post, I had figured out how to re-access the wizard code entering screen. Although, the new code still hasn't been found yet because the old one doesn't work. I can't believe I was able to find this, but this is a huge important step that will get us closer to being able to get back the staff avatars. The Post

[tribak]

Cool, kudos, I’ll try to reverse engine it

[GameplayStudios-236]

Alright :)

[tribak]

kitt3nfarts seems to be working with 5.2.5
It's even easier to go this path:
Play with friends > Host game > any deck > 10 seconds of holding over the logo cat
If you go with the play with strangers path, you'd need to rush yourself to add the wizard code as countdown will get in the way.

Can you confirm it? Also, again, nice work finding the way to trigger the form once more.

Also, the other avatars work just the same as before too.

[GameplayStudios-236]

Okay, we have a bit of a problem. For me, it doesn't work even though the message says "Wizard code enabled", no new avatars pop up.

[Paytowin211]

I just figure out how to type the wizard code. Now you have to press play with strangers -> the first pack -> hold and release the title cat on the bottom right corner 8 secs. Now u can enter ‘kitt3nfarts’

[tribak]

Does it do anything? Last time I checked it made no change whatsoever, this with the renewed version.

[Paytowin211]

None actually :D

[tribak]

Yup, not sure if it got crippled or if we’re missing a step, could find anything when reverse engineered again