Gearup Promo Gen (Discord stoped providing promos for this app)

Mass-claim Discord Nitro promotional codes through the GearUP Booster iOS app — fully reverse-engineered, zero instrumentation. Discord no longer offers this promotion it ended the 2nd of June 2026

💬 Discord · 📜 ChangeLog · ⚠️ Report Bug · 💡 Request Feature

---

🌐 Need Proxies? Check out my services

Service	Pricing	Features
🔮 VaultProxies	$1.00/GB residential	Residential · IPv6 · Residential Unlimited · Datacenter
🌑 NullProxies	$0.75/GB residential	Residential · Residential Unlimited · DC Unlimited · Mobile Proxies
⚡ StrikeProxy	$0.75/GB residential	Residential · Residential Unlimited · DC Unlimited · Mobile Proxies

---

⚙️ Installation

• Requires: Python 3.11+
• Make a python virtual environment: python -m venv venv
• Source the environment: venv\Scripts\activate (Windows) / source venv/bin/activate (macOS, Linux)
• Install the requirements: pip install wreq pycryptodome

---

🔥 Features

• Fully reverse-engineered GearUP Booster iOS app — Sign header, AES body encryption, Discord OAuth flow (pure static analysis, no Frida)
• Discord iOS TLS fingerprinting via wreq (SafariIos26_2 — JA4 matches the real app)
• Randomized Discord iOS client identity per claim: device model (iPhone 14→17), iOS version, locale, timezone, client build number from a pool of recent releases
• Automatic Discord iOS version detection from Apple App Store + Discord manifest at startup
• Full Discord iOS header set per request: x-super-properties, x-installation-id, x-discord-locale, x-discord-timezone, baggage, sentry-trace, x-debug-options
• Discord OAuth2 PKCE flow with /applications/<id>/disclosures pre-flight (matches real iOS client sequence)
• Anti-replay token serialization — global lock guarantees each worker gets a unique ds_token (GearUP's endpoint returns the same cached value for concurrent requests in the same time window)
• Rotating residential proxy support via wreq native proxies= (not the silent no-op proxy=)
• NSL Solver + rcap.sh Turnstile captcha solver support with cdata passthrough, configurable in config.toml
• Incremental token removal — processed tokens removed from tokens.txt immediately on success/already-claimed/unusable (crash-safe, atomic write)
• Separate output buckets: promos.txt, unusable.txt, already_claimed.txt
• Retry logic for transient network errors: proxy tunnel failures, connection resets, decode errors, Akamai edge errors
• Async pipeline: captcha + Discord OAuth run in parallel with GearUP bootstrap to minimize RTT
• Debug mode with full per-step trace (session IDs, device IDs, oauth codes, grant responses)

---

📝 Usage

1. Tokens — add Discord bearer tokens to input/tokens.txt, one per line. Both formats accepted:

   raw_bearer_token
   email:password:raw_bearer_token
   

2. Proxies (required for scale) — add to input/proxies.txt, one per line:

   http://user:pass@host:port
   user-session-XXXXX:pass@host:port
   

3. Configuration — edit input/config.toml:

   [runner]
   max_concurrency   = 100   # parallel workers
   retries_per_token = 0     # retries on non-fatal failures
   request_timeout_s = 30    # per-request timeout
   debug             = false # verbose per-step logs
   
   [solver]
   provider          = "nsl"                    # nsl | rcap
   api_key           = "nsl_xxxx..."
   turnstile_timeout = 60

4. Run:

   python main.py

5. Output:

   File	Content
   output/promos.txt	Claimed Discord Nitro promo URLs
   output/already_claimed.txt	Tokens whose account already claimed
   output/unusable.txt	Unverified email / revoked tokens (Discord 40098 / 401)
   input/tokens.txt	Updated in-place — processed tokens removed immediately

---

🔬 Reverse Engineering

See GEARUP_ANALYSIS.md for the full technical writeup. Summary below.

Sign Header

Every request to mobile.booster.gearupportal.com requires a Sign header:

Sign = MD5( [qs&]SecTag={sectag}&seed={seed}&key={key1}&key2={key2} ).upper()

Field	Value
qs	Raw query string of the URL (omitted if no params)
seed	Microsecond Unix timestamp — int(time.time() * 1_000_000)
SecTag	MD5(deviceID.encode()) — derived from per-session random UUID
key1	6e5f91860502191b3fa9742729888598
key2	6c09978b6072761849e499d6faf89856

Both keys obfuscated in GUKit.framework __DATA.__data and decoded by a byte-rotation XOR cipher at FUN_000394c0 (key1, 0x10b740) and FUN_0003966c (key2, 0x10b788).

Body Encryption

plaintext JSON → gzip → AES-128-ECB → base64
AES key = first 16 UTF-8 bytes of deviceID (random UUID per session)

From -[NSData(JKEncrypt) encryptedDataWithKeyData:] in GUKit at 0x7efa0 → CCCrypt(kCCAlgorithmAES, ECB, PKCS7).

Discord OAuth Flow

1. GET  /v3/activity/discord/user/history          ← eligibility check

2. GET  discord.com/api/v9/oauth2/authorize        ← PKCE consent
        ?client_id=1451474273486110790&integration_type=0
        Headers: full Discord iOS header set

3. POST discord.com/api/v9/oauth2/authorize        ← approve
        → {"location": "discord-1451474273486110790:/authorize/callback?code=..."}

4. GET  dc-activity.booster.gearupportal.com/common/discord_token/
        → single-use anti-replay ds_token
        ⚠ Must be fetched under a global lock — endpoint caches by time window

5. POST /v3/activity/discord/user/info             ← grant
        Body (AES): { code, code_verifier, callback_url, cf_token, cdata, ds_token }
        → {"cdkey": "https://promos.discord.gg/..."}

Constants

Discord OAuth client_id	1451474273486110790
Cloudflare Turnstile sitekey	0x4AAAAAADCR2bjbjqUIwe22
GearUP API	mobile.booster.gearupportal.com
GearUP activity	activity.booster.gearupportal.com
GearUP Discord token	dc-activity.booster.gearupportal.com

---

❗ Disclaimers

• This project is for educational purposes only
• The author is not responsible for any misuse of this tool
• Use responsibly and in accordance with Discord's and GearUP's terms of service

---

📜 ChangeLog

v1.0.0 ⋮ 05/21/2026
+ Initial release
+ Full GearUP Sign + AES body encryption reverse engineering
+ Discord PKCE OAuth flow with iOS header set
+ NSL + rcap captcha solver support with cdata passthrough
+ Rotating residential proxy support (wreq proxies= fix)
+ Discord iOS TLS fingerprinting (SafariIos26_2)
+ Randomized iOS client identity per claim
+ ds_token global lock (anti-replay uniqueness)
+ Incremental crash-safe token removal
+ Automatic Discord iOS version detection from App Store