TL;DR1. Key Recovery ==> XOR ct, with flag format2. Reversing Hash() 
Long Version:The [Write-up](https://sayoojsamuel.github.io/2018/10/26/tile-mate/) can be found here. The must-see 4 line exploit too!