Qr Codes Mcdonalds
Fairy Dawdy
Just like any other student in a dorm, I often go out to eat because I'm too lazy to cook something and do the dishes after. The only thing that sucks about this is the price. So.. what if I could use my skills once more to take advantage of the McDonalds Mobile Application to reduce the costs of my food?
McDonald's has a mobile application for both Android and ios phones. It turns out that there are multiple versions of the application, and it's based on your country. Since I am from Belgium, I will be looking into both the Android and iOS version of the application. The Android one is made with Java. I am not a javatar but it is way easier to reverse engineer Java compared to C/C++ (swift) based application.
My goal here is to share my QR code with my friends, they think the loyalty points system is stupid so they don't use it at all. It sounds like free points to me if I can hand out my QR code to them, so I get the reward.After using the app I noticed that the QR code changes every time you open it, and then after X time, the QR code changes again.This makes it pretty hard to share the QR code with my friends when they need it. Oh, and it also seems like the app is blocking screen recording and screenshots, which makes it almost impossible to share QR codes. My idea was to find out how the QR code gets generated and then reproduce this process.
Before we do anything at all, let me scan the QR code to see what data is held. After doing this it turns out to be a number with 4 to 6 digits, meaning it's a value from 1000 - 999999.We now know that we are looking for this value. Its time to fire up mitmproxy and configure my iPhone to use the Proxy IP of my laptop.
While my phone is starting the McDonald app, I can see my laptop screen getting filled with requests. Surprisingly there is nothing useful at a first glance. None of the HTTP/HTTPS URLs look like they came from the McDonalds app.
Some of the URLs should come from the McDonald app since the only thing I did on my phone was open the app. After having a look at each URL, I figured out that the "dif.gmal.app" is the DNS used by the app. Let's highlight those URLs to have a better look at them.
Have a look at that, you can now guess that it registers my device with the URL containing device:register and that it's then getting some configuration and account info (consumers info). I took a look at the URLs, what they request, and what they get. There is not much useful information in there, but I'm still gonna show you whats in the v1/con/v3/consumers/me/tagvalues request & response.
Having a laugh? Well, at least I am. It seems like some 'developer' forgot to remove the example parameters from a tutorial he copies & pasted. Kind of funny, isn't it?
Alright, let us take a look at the POST request:
Those two values are sent to the server.. right after we received a list of values that also contained these two values. Do you see what's going on here? Maybe we could also add "Test_Group_B" and "Test_Group_B" to the JSON array and send it with a POST? Let's try it out! Who knows what kind of weird debugging stuff we will see in our app.
Uh, oh! Looks like we are unauthorized to do so? The message says that 'Digest verification' has failed. Seems like there is some kind of signature located in the header with the name x-dif-authorization. The signature for the successful call looks like this MEQCIGCUUK19BieShlyezunZ.., it might look a bit like Base64 but it isn't... Good job McDonald's, I will have to stop my curiosity here and continue with my main goal.
Alright, back on track, heading for the QR code!
While I'm watching the mitmproxy screen, I use my phone to navigate to the section where the QR code is visible inside the app. After I opened the app, I see my screen filling up with requests, and they look promising!
The following three highlighted URLs are what I'm digging for. The first two v1/off/v3/offers?.. and v1/off/v3/loyaltycards?.. contains all the information about the current offers. Offers can be coupons, so it's a good thing to have a URL to get all the information of them (such as ID, expire date, price, etc..).
Now, remember that we couldn't send the tag POST stuff? that was only because we edited the JSON body content, resulting in having an invalid signature in our headers. For this URL we don't need to change anything at all to make it work, we can keep our current headers and request as many codes as we want!
The last thing we gotta do is put this all together in a nice C# application, host it somewhere on my website (www.mcdo.ferib.dev) and share the website with my friends so I can get their loyalty points!
At this point, I have everything I need to achieve my goal. But oh boy, my curiosity is out there, wondering what the Android application looks like. Since the Android application is way easier to reverse engineer compared to ios, I will take a quick look at it. We might be able to find out how the Signature in the headers is calculated, this means we would be capable of sending custom-crafted HTTP(s) request to the server.
But it turns out that some of the Java code is obfuscated. I used an online Java decompiling tool to convert the APK into code, after having a quick look I already notice most of the code looks like garbage to me. I'm not a javatar and won't spend time restoring the code. Some packages aren't affected by the obfuscation, I found a package called "mcdonalds". The package mainly contains view models, no actual programming logic to see here. Let's look at a few view models then.
At the screenshot above we see that there are two card types defined, STAMP_CARRD and POINT_CARD, good to know that there are multiple versions of the card, but I don't see any use for that, those loyalty cards are based on what country you are in, the type won't change anytime soon.
This 'rootchecker' grabbed my attention. It's known that the application won't function on a rooted phone. According to McDonald's its for 'safety' reasons that they don't want their application to run on rooted phones. For those who have a rooted phone and want to run the application, just patch the above function and you should be good to go.
I have a jailbroken iPhone XS, so I'm not even gonna bother patching stuff in an APK. Once again, Good job McDonald's, I'm gonna stop looking at the APK and just finish writing my C# application. At the moment I have everything I need to achieve my goal.
The result is my QR code (which is plain text ;_;) hosted on my website, the QR code will get refreshed every minute. That's it for now, I thought about adding Discords Oauth API to the webpage so I can keep track who got which code. It is possible to get the history of the points gained, but it's not possible to find out from which QR code it is. Disappointing, otherwise I'd be able to reward my friends somehow, or at least keep track of who sent how many points.
The next thing I did was finding out how to buy a coupon, after fiddling with that I was able to automatically buy coupons without activating them, so I could stack them as much as I want. My app looks like this now:
The code is a 15 digit code, and when you go to redeem codes there all 15 digit codes. these are the star tags, and on neo they do have a star tag redeem, but full sized plushies have the star tag too.
Wow, whats freaky is last night in a boredom attack, I went snooping my room and found- A green wocky toy from miccy-dees, a dead cat, and a couple of old tissues...x3Not reallyxD But I did find the Green Wocky x3 I was wondering if I could redeem it, too, but I doubt I could:P
The Mc'donalds codes however did not work, it brought me to a page with an error, though it said they have been notified of this page and are working to fix the issue. I submitted an error report for pluhies/rare item codes because in the faq's it said nothing about the codes not working, but mcdonalds codes ARE listed under code redemption still (except for new zealand or australia). and if you cant redeem the code send them a report giving the code. So I sent a report stating the codes according to their faq's should be redeemable. So I typed all my codes in microsoft office word, attached it to my complaint, and hopefully they will give me prizes for everything.
TNT contacted me after I sent them a request, and they said they cannot send me replaceable codes for Mc'donalds. Now I understand they removed the link to it, but why? All the other code items (including burger king) still work! And in their faq's it has Mc'donalds under code redemption. It's messed up they havent removed it, false advertising, at least say in the faq's Mc'donalds wont work anymore! After all the work typong all my codes I dont see why they couldnt have just generated new codes for me to redeem?
This is also a big problem, because on Ebay people are still selling these plushies with unused codes, and people are actually buying them for the codes, which dont work now, so their wasting real money without even knowing! I would be really angry if that happened with me!
McDonald's may occasionally offer discount codes, but currently, there are none available. However, customers can still save money by taking advantage of other promotional offers or sales available on the website, or by using credit card points to make purchases.
On average, McDonald's provides 0.1 discount coupons each month. Based on historical data, the average time between McDonald's coupon releases is approximately 300 days. However, this is subject to change and may depend on various factors such as seasonal promotions, product launches, or other marketing initiatives. To stay informed about upcoming discounts and promotions, we recommend checking McDonald's's website regularly, subscribing to their email newsletter, and following them on social media.
SimplyCodes is the #1 provider of discount codes for your favorite retailers, such as McDonald's. As the only crowdsourced platform for coupon codes, we have all the latest and accurate codes for over 200,000 stores. Save time and avoid expired codes by checking SimplyCodes for the latest McDonald's discount codes.
64591212e2