import frida, time, subprocess
out = subprocess.run(["/opt/android-sdk/platform-tools/adb","shell","pidof","se.foglo.svt"],capture_output=True,text=True).stdout.strip()
pid = int(out.split()[0])
print("pid",pid)
dev = frida.get_usb_device(timeout=10)
s = dev.attach(pid)
js = r"""
try{
var B=null;
var cfn,gmn,rinv,unbox,dg,dga,aimg,cffn,fsgv;
function E(m,n){var p=m.findExportByName(n);if(!p)throw new Error("no "+n);return p;}
function cstr(s){return Memory.allocUtf8String(s);}
function findClass(ns,nm){var d=dg();var c=Memory.alloc(8);var a=dga(d,c);var n=c.readU32();var np=cstr(ns),mp=cstr(nm);
 for(var i=0;i<n;i++){var as=a.add(i*4).readPointer();if(as.isNull())continue;var im=aimg(as);if(im.isNull())continue;var k=cfn(im,np,mp);if(!k.isNull())return k;}return ptr(0);}
var m=Process.findModuleByName("libil2cpp.so");
if(!m){send({err:"no module"});}
else{
 B=m.base;
 cfn=new NativeFunction(E(m,"il2cpp_class_from_name"),'pointer',['pointer','pointer','pointer']);
 dg=new NativeFunction(E(m,"il2cpp_domain_get"),'pointer',[]);
 dga=new NativeFunction(E(m,"il2cpp_domain_get_assemblies"),'pointer',['pointer','pointer']);
 aimg=new NativeFunction(E(m,"il2cpp_assembly_get_image"),'pointer',['pointer']);
 cffn=new NativeFunction(E(m,"il2cpp_class_get_field_from_name"),'pointer',['pointer','pointer']);
 fsgv=new NativeFunction(E(m,"il2cpp_field_static_get_value"),'void',['pointer','pointer']);
 var DirClass=findClass("FE","Director");
 send({dirclass: DirClass.toString()});
 if(!DirClass.isNull()){
   var dirInstFld=cffn(DirClass,cstr("instance"));
   send({dirInstFld: dirInstFld.toString()});
   if(!dirInstFld.isNull()){
     var o=Memory.alloc(4);o.writePointer(ptr(0));fsgv(dirInstFld,o);var d=o.readPointer();
     send({dirInst: d.toString()});
     if(!d.isNull()){
       var cs=d.add(0x38).readPointer();
       send({currentScreen: cs.toString()});
       if(!cs.isNull()){
         var isInv = cs.add(0x34).readU8();
         send({isInvoking: isInv});
       }
     }
   }
 }
}
}catch(e){send({exc: ""+e, stack: e.stack});}
"""
sc = s.create_script(js)
def on_msg(mm,d):
    print(mm)
sc.on("message", on_msg)
sc.load()
time.sleep(2)
try:
    sc.unload()
except Exception as e:
    print("unload err", e)
try:
    s.detach()
except Exception as e:
    print("detach err", e)