import frida, time, subprocess
ADB="/opt/android-sdk/platform-tools/adb"
JS=r"""
var m=Process.findModuleByName("libil2cpp.so");
function rdstr(p){try{if(p.isNull())return "NULL";if(p.compare(ptr(0x10000))<0)return "<sm"+p+">";var n=p.add(8).readS32();if(n<0||n>200)return "<obj"+p+">";return "'"+p.add(0xc).readUtf16String(n)+"'";}catch(e){return "err";}}
function go(){
 var B=Process.findModuleByName("libil2cpp.so").base;
 var seen={};
 Interceptor.attach(B.add(0x2351f7),{
   onEnter:function(){var sp=this.context.esp; this.a0=sp.add(4).readPointer(); this.a1=sp.add(8).readPointer(); this.a2=sp.add(0xc).readPointer();},
   onLeave:function(r){ var k="k="+rdstr(this.a1); if(!seen[k]){seen[k]=1; send({g:"FindAvatar a0="+rdstr(this.a0)+" "+k+" a2="+this.a2+" -> "+(r.isNull()?"NULL":r)});} }
 });
 send({g:"capturing FindAvatar keys"});
}
go();
"""
def sh(*a): return subprocess.run([ADB]+list(a),capture_output=True,text=True)
def cap(): return subprocess.run([ADB,"exec-out","screencap","-p"],capture_output=True).stdout
sh("shell","am","force-stop","se.foglo.svt"); time.sleep(1)
sh("shell","monkey","-p","se.foglo.svt","-c","android.intent.category.LAUNCHER","1")
print("polling menu",flush=True); t0=time.time()
while time.time()-t0<120:
    time.sleep(4)
    if len(cap())>600000: break
print("menu",int(time.time()-t0),flush=True); time.sleep(2)
dev=frida.get_usb_device(timeout=10)
pid=int(sh("shell","pidof","se.foglo.svt").stdout.split()[0]); print("pid",pid,flush=True)
s=dev.attach(pid); sc=s.create_script(JS)
sc.on("message",lambda mm,d: print(mm.get("payload",{}).get("g",""),flush=True) if isinstance(mm.get("payload"),dict) else None)
sc.load()
# tap into avatar-related menus to trigger FindAvatar with real keys
time.sleep(3); sh("shell","input","tap","700","730"); time.sleep(5)   # sniper loadout
sh("shell","input","tap","1250","470"); time.sleep(4)                 # try tapping avatar area
time.sleep(8)
print("done",flush=True)