ShadowFire

A Free Fire-optimized MITM proxy, forked from mitmproxy. ShadowFire combines a full-featured HTTPS interception proxy with a dedicated Free Fire bypass pipeline.

Features

Core Proxy (forked from mitmproxy)

• Interactive console UI, headless dump mode, and web UI
• HTTP/1, HTTP/2, HTTP/3, and WebSocket interception
• TLS interception with dynamic certificate generation
• TCP, UDP, and DNS proxy modes
• Scriptable via Python addons
• Full mitmproxy addon ecosystem compatibility

Free Fire Bypass Addon

• Login interception — hooks into Free Fire API domains (loginbp.ggblueshark.com, prod-api.reward.ff.garena.com, etc.)
• UID blocking — inspect raw TCP streams and block connections by UID
• Fingerprint masking — strips proxy-detection headers (Via, X-Forwarded-For, etc.) and rewrites User-Agent
• JWT forwarding — integrates with the access_jwt token mutation service
• Runtime commands — ff.block_uid, ff.unblock_uid, ff.list_blocked

Backend Pipeline

• Raw TCP forwarder on :9999 — bidirectional byte-level proxy with game-layer AES decrypt
• JWT mutation service on :1080 — template-based protobuf payload rewriting
• Admin HTTP API on :5000 — UID management, stats, health checks
• UID sync loop — pulls blocklists from remote API every 120s

Architecture

Emulator → Raw Forwarder (:9999) → ShadowFire Proxy (:8080) → Game Servers
                                         ↕
                              access_jwt Service (:1080)
                                    (JWT mutation)

Quick Start

# Install
pip install shadowfire

# Start the proxy
shadowfire

# Start the web UI
shadowfire web

# Start headless dump mode
shadowfire dump

Free Fire Pipeline

# Terminal 1: Start the backend services
cd new/python
pip install -r requirements.txt
python main.py

# Terminal 2: Start ShadowFire with the bypass addon
shadowfire -s shadowfire/addons/firebypass.py --set ff_bypass=true

Configure your emulator to use the proxy at the host machine's LAN IP on port 8080, and the raw forwarder on port 9999.

Configuration

ShadowFire reads ~/.shadowfire/config.yaml on startup. Key options:

Building

PyInstaller (standalone binary)

pyinstaller release/specs/standalone.spec --clean
# Output: release/dist/shadowfire.exe

MSIX Installer (Windows Store)

pyinstaller release/specs/onedir.spec --clean
python release/build.py msix-installer

InstallBuilder Installer (Windows)

pyinstaller release/specs/onedir.spec --clean
python release/build.py installbuilder-installer

Docker

docker build -t shadowfire release/docker/
docker run -p 8080:8080 -p 8081:8081 shadowfire

Development

# Install with uv
uv sync

# Run tests
uv run pytest

# Run linter
uv run ruff check shadowfire/

# Type check
uv run mypy shadowfire/

Project Structure

shadowfire/                  # Main proxy package
├── addons/                  # Addon modules
│   ├── firebypass.py        # Free Fire bypass addon
│   └── onboardingapp/       # Certificate installation portal
├── proxy/                   # Proxy core
├── tools/                   # CLI entry points
│   ├── main.py              # shadowfire_cli dispatcher
│   ├── console/             # Console UI (curses)
│   ├── dump/                # Headless dump mode
│   └── web/                 # Web UI (React SPA)
├── net/                     # Network protocols
├── io/                      # I/O and serialization
├── contentviews/            # Content decoders
└── utils/                   # Utilities
web/                         # React/TypeScript web UI frontend
release/                     # Build & installer configs
new/python/                  # Free Fire backend pipeline
├── main.py                  # Orchestrator (forwarder, API, UID sync)
└── access_jwt/              # JWT mutation service

License

MIT — see LICENSE.

Credits

ShadowFire is a fork of mitmproxy. The original project is maintained by the mitmproxy contributors and licensed under the MIT license.