epic-games: claim mobile games

[vogler]

Epic-games now also has weekly mobile games that can be claimed.
However, these are only shown in the Android/iOS app which can be installed from https://store.epicgames.com/en-US/mobile/.

If you know the link, you can claim it in the browser too. Problem is that these games can't be found on the website. Searching for Android games shows no results besides Add-ons: https://store.epicgames.com/en-US/browse?sortBy=relevancy&sortDir=DESC&tag=Android&count=40&start=0

Current game for Android: https://store.epicgames.com/en-US/p/gigapocalypse-android-e56f84
And current game for iOS: https://store.epicgames.com/de/p/gigapocalypse-ios-e9799b

There are several places that list them:

• https://www.reddit.com/r/FreeGameFindings/search/?q=title%3Aepic+games+mobile&type=posts&sort=new
• https://www.mydealz.de/deals/epic-games-store-android-ios-kostenlos-gigapocalypse-2205-29052025-2575369

There's this json with the offers, but it doesn't include the mobile versions: https://store-site-backend-static.ak.epicgames.com/freeGamesPromotions
Maybe the purchase URL can still be constructed from it, but that has its own problems - see #127, #130.

Probably just need some URL that the app uses. So could try to decompile the .apk (apk2url) or probably easier use some mitm proxy:

• https://docs.mitmproxy.org/stable/
• https://httptoolkit.com/android/ (even has certificate unpinning via Frida)

[vogler]

HTTP Toolkit has the following options:

Tried option 2 on my Android phone, installed CA, but seems with API level >=24 that doesn't work anymore due to pinning:

Option 1 is just automated option 2.

Tried PCAPdroid, but unsurprisingly same issue.

Tried option 3 following https://httptoolkit.com/blog/frida-certificate-pinning/
Set up virtual device ('Services: Google Play Store' does not work!) via Android Studio:

Followed https://proandroiddev.com/root-an-android-emulator-avd-9f912328ca08 to root the device with rootAVD (uses Magisk).
Download frida-server-17.0.7-android-arm64.xz, unzip and push to device.
However, starting the Frida server on device failed and made the emulator reboot:

$ adb push ~/Downloads/frida-server-17.0.7-android-arm64 /data/local/tmp/frida-server
/Users/voglerr/Downloads/frida-server-17.0.7-androi...d, 0 skipped. 179.5 MB/s (52018912 bytes in 0.276s)
$ adb root
restarting adbd as root
$ adb shell "chmod 755 /data/local/tmp/frida-server"
$ adb shell "/data/local/tmp/frida-server &"
Unexpectedly timed out while waiting for syscall on android.anim thread; please file a bug!
Unexpectedly timed out while waiting for syscall on ActivityManager thread; please file a bug!
Unexpectedly timed out while waiting for syscall on ActivityManager thread; please file a bug!
Unexpectedly timed out while waiting for syscall on ActivityManager thread; please file a bug!
Unexpectedly timed out while waiting for syscall on ActivityManager thread; please file a bug!

Open issue: frida/frida#2851
Tried the same with Android 14 (API 34):

Seems to work with that version...
Download and install EpicGamesStore.apk (10.33MB).
Couldn't login in the Epic Games app though with adb open, after ctrl-c it worked (server still running in background).

$ uv tool install frida-tools

Check out https://github.com/httptoolkit/frida-interception-and-unpinning and follow its instructions, i.e., copy http-toolkit-ca-certificate.crt into config.js.

$ cd frida-interception-and-unpinning
$ frida -U \
    -l ./config.js \
    -l ./native-tls-hook.js \
    -l ./android/android-proxy-override.js \
    -l ./android/android-system-certificate-injection.js \
    -l ./android/android-certificate-unpinning.js \
    -l ./android/android-certificate-unpinning-fallback.js \
    -f com.epicgames.portal
     ____
    / _  |   Frida 17.0.7 - A world-class dynamic instrumentation toolkit
   | (_| |
    > _  |   Commands:
   /_/ |_|       help      -> Displays the help system
   . . . .       object?   -> Display information about 'object'
   . . . .       exit/quit -> Exit
   . . . .
   . . . .   More info at https://frida.re/docs/home/
   . . . .
   . . . .   Connected to Android Emulator 5554 (id=emulator-5554)
Spawning `com.epicgames.portal`...

Spawned `com.epicgames.portal`. Resuming main thread!
[Android Emulator 5554::com.epicgames.portal ]-> == Proxy system configuration overridden to 127.0.0.1:8000 ==
== Proxy configuration overridden to 127.0.0.1:8000 ==
== System certificate trust injected ==
== Certificate unpinning completed ==
== Unpinning fallback auto-patcher installed ==

Open option 1 in HTTP Toolkit to see the unencrypted traffic:


The bearer token is not needed, you can just see the json with the current free mobile games here:
https://egs-platform-service.store.epicgames.com/api/v2/public/discover/home?count=10&country=DE&locale=en&platform=android&start=0&store=EGS

-> Current free game: https://store.epicgames.com/de/p/limbo-mobile-android-300111 - can be claimed in the browser :)