Here is the update from me.
For the free upgrades, the number of every free upgrade is encrypted. I can't find their ID. You know it's also hard to track the encrypted value. I would never try this when I have only a few free upgrades.
The easiest way to hack free upgrades (include others except token) is to modify the mastery reward. Mastery rewards are not encrypted. They are easy to find. For example, challenge 1 rewards 1000 credits, 2 rewards 2000 credits, 3 rewards 3000 credits, and 4 rewards 1 free upgrade and 4000 credits. You can just simply search for "1000;2000;3000;4000::1500" (The distance between two rewards is about 500). And from 4000, go to check the nearby values, and the right "1" should be in between the values which are similar to those the 4000 is in between.