TL;DR
1. Key Recovery ==> XOR ct, with flag format
2. Reversing Hash()

Long Version:
The [Write-up](https://sayoojsamuel.github.io/2018/10/26/tile-mate/) can be found here.
The must-see 4 line exploit too!