import frida, time
dev = frida.get_usb_device(timeout=10)
pid = dev.get_process("SvT").pid if False else None
import subprocess
out = subprocess.run(["/opt/android-sdk/platform-tools/adb","shell","pidof","se.foglo.svt"],capture_output=True,text=True).stdout.strip()
pid = int(out.split()[0])
print("pid",pid)
s = dev.attach(pid)
js = r"""
var B=null;
var cfn,gmn,rinv,unbox,dg,dga,aimg,cffn,fsgv;
function E(m,n){var p=m.findExportByName(n);if(!p)throw new Error("no "+n);return p;}
function cstr(s){return Memory.allocUtf8String(s);}
function findClass(ns,nm){var d=dg();var c=Memory.alloc(8);var a=dga(d,c);var n=c.readU32();var np=cstr(ns),mp=cstr(nm);
 for(var i=0;i<n;i++){var as=a.add(i*4).readPointer();if(as.isNull())continue;var im=aimg(as);if(im.isNull())continue;var k=cfn(im,np,mp);if(!k.isNull())return k;}return ptr(0);}
function main(){
 var m=Process.findModuleByName("libil2cpp.so");if(!m){send({err:"no module"});return;}
 B=m.base;
 cfn=new NativeFunction(E(m,"il2cpp_class_from_name"),'pointer',['pointer','pointer','pointer']);
 dg=new NativeFunction(E(m,"il2cpp_domain_get"),'pointer',[]);
 dga=new NativeFunction(E(m,"il2cpp_domain_get_assemblies"),'pointer',['pointer','pointer']);
 aimg=new NativeFunction(E(m,"il2cpp_assembly_get_image"),'pointer',['pointer']);
 cffn=new NativeFunction(E(m,"il2cpp_class_get_field_from_name"),'pointer',['pointer','pointer']);
 fsgv=new NativeFunction(E(m,"il2cpp_field_static_get_value"),'void',['pointer','pointer']);
 var DirClass=findClass("FE","Director");
 send({dirclass: DirClass.toString()});
 if(DirClass.isNull())return;
 var dirInstFld=cffn(DirClass,cstr("instance"));
 send({dirInstFld: dirInstFld.toString()});
 if(dirInstFld.isNull())return;
 var o=Memory.alloc(4);o.writePointer(ptr(0));fsgv(dirInstFld,o);var d=o.readPointer();
 send({dirInst: d.toString()});
 if(d.isNull())return;
 var cs=d.add(0x38).readPointer();
 send({currentScreen: cs.toString()});
 if(cs.isNull())return;
 var isInv = cs.add(0x34).readU8();
 send({isInvoking: isInv});
}
main();
"""
sc = s.create_script(js)
def on_msg(mm,d):
    print(mm)
sc.on("message", on_msg)
sc.load()
time.sleep(3)
s.detach()