So, I just signed up for a new gym and immediately fell into a technical rabbit hole. All I wanted was their app.
- Attempt #1: Aurora Store. The download failed instantly. Curse.
- Attempt #2: APKPure. Same story. Installation failed.
- Attempt #3: Some other random APK mirror. Still no luck.
Alright, final stand. I grabbed my old phone, downloaded the app from the Play Store, and used a sketchy APK Extractor to get the raw file. I juggled some ADB commands, pushed the APK to my new phone, and went to install it.
The result? The exact same soul-crushing error that started this whole mess: “Your device isn’t compatible with this version.”
An hour of my time, completely wasted. This isn’t just an error anymore; it’s a challenge. And I plan on winning. 😡
The brainstorming
Alright, the app is dead to me. So what now? The gym could sell me a keyfob, but there is no way I’m paying them extra because their own tech fails. That’s just a terrible business model. So, my only free option was the PIN code.
My first encounter with the gym door was a disaster. There are two gates, and the first one is just a keypad. I stood there like an idiot, poking at it. What does “ON” do? Why is there an “OFF” button? After about five minutes of looking like I’d never seen technology before, someone on their way out buzzed me in, probably out of pity.
Yeah, that was a low point. But we push through.
I finally got the hang of it at the second gate, but it still felt ancient. Punching in a code while people glide past with a flick of their wrist? No. My inner monologue was screaming, “I will not tolerate this.”
So the next day, the big ideas started flowing.
“Why don’t I just build my own gym app?” A fantastic thought, except I don’t know the first thing about creating Android apps and, let’s be honest, I don’t want to spend the next month finding out.
“Okay, what about a simple website?” Again, too much work. Hosting, security… what if my credentials get leaked? The anxiety is not worth it.
Then, the lightbulb moment, powered by pure spite and my very specific skill set. I’m a Roblox developer. What if I made a Roblox game… for my gym pass?
Is that against the rules? A little bit. Am I going to do it anyway? You bet. It’s a private game, for my eyes only.
So there you have it. My master plan is to use a blocky avatar game as a high-tech key to the gym. What could possibly go wrong? Wahoo!
Ah, but wait, how does my gym app work?
To save us both a bit of time, i’ve structured the following section like a war diary, a battle between myself, stupidity and my gym app!
I first had to figure out how the original worked. Time to go reverse engineering, a field in which I am a complete amateur.
- Objective: See the app’s network requests.
- Weapon of Choice: PCAPdroid, an open-source traffic sniffer. I installed it on my old phone.
- First Contact: Success! I captured traffic. But it was encrypted with TLS. Obviously.
- Counter-Attack: PCAPdroid’s MITM feature to decrypt TLS traffic. This requires installing a new user certificate.
- Enemy Defence: The app immediately threw a fit. Errors flooded the screen. It was using certificate pinning, a security measure specifically designed to stop people like me. I was cooked.
- Escalation: The only way to win is to cheat. I rooted the phone using Magisk. The goal was to install a module that forces the OS to trust my malicious certificate.
- Stalemate: Even with root, it failed. TLS errors galore. The project felt dead in the water. I walked away for a few days, completely stumped.
- A New Battlefield: A fresh idea hit me: maybe my old phone was the problem. Instead of more hardware, I turned to software: the Android Virtual Device (AVD) emulator. I spun up a virtual phone on my PC in minutes. It felt powerful.
- The Final Assault: The fresh start on the emulator hit the same certificate wall. But an emulator is just files on a computer. I found a script called rootAVD, ran it, and in less time than it takes to make a coffee, I had a fully rooted virtual Android device. The ease of this was a massive motivation boost.
- Breaking Through: With the rooted emulator, I could install the “Always Trust User Certs” Magisk module and place the PCAPdroid certificate directly into the system’s trusted certs list. There was no way this app could get around this.
- Victory: I fired everything up one last time. It worked. The traffic flowed, completely decrypted. I could read every single request the app made to its server.
After an hour of watching, I had their secrets. The API was simple: log in, get a token, use the token to generate QR codes. The entire plan was laid bare.
Great, so now the easy(?) part
Right, with the API cracked, it was time to build. The easy part, right?
Wrong. I needed to turn a string of text into a QR code inside Roblox. This presented two problems:
- Generation: There’s no Roblox package to create QR codes. I cheated and used a random third-party API online. Sketchy? Yes. But the codes expire in a minute, so I went for it.
- Rendering: The API gave me a PNG file, but how do I display that in-game? Thankfully, a hero named sircfenner made a png-luau package that decodes PNG data for Roblox’s EditableImage feature. It saved the entire project.
I wired everything together, and it was done. A gym app. In Roblox. What a wild ride through territories I’d never explored, all because of a single installation error.
The real test came that evening. I walked up to the gate, loaded up my creation, and scanned my phone. The gate unlocked.
It actually worked.
This is insane. I must be the only human on Earth who logs into their gym through Roblox. It’s a monument to my habit of overcomplicating everything, and honestly? I love it.
Well, good news, bad news..
Well, there’s some bad news.
First, the good news: My Roblox app worked flawlessly for weeks! I even added new features: a real-time gym population counter, workout timers, and a multi-user login so anyone could theoretically use it. It was awesome.
Now the bad news: As I was writing this very blog, I decided to try installing the official app one last time to find the exact error message. But it downloaded and installed perfectly.
I felt like a complete clown, but a happy one. This project may have been technically pointless in the end, but the experience was everything. It was a blast, and I learned a ton.
So, for your viewing pleasure, I present the source code for the most wonderfully unnecessary project I’ve ever built. I’m proud to show you the gym-app, in Roblox.