import frida, time, subprocess
ADB="/opt/android-sdk/platform-tools/adb"
JS=r"""
var B=null;
function rdstr(p){try{if(p.isNull()||p.compare(ptr(0x10000))<0)return null;var n=p.add(8).readS32();if(n<0||n>200)return null;return p.add(0xc).readUtf16String(n);}catch(e){return null;}}
var seenN={}, seenP={};
function main(){
 var m=Process.findModuleByName("libil2cpp.so");if(!m){setTimeout(main,150);return;}
 B=m.base;
 try{Interceptor.attach(B.add(0x2350be),{onEnter:function(){send({g:"LoadAvatars called"});}});}catch(e){}
 try{Interceptor.attach(B.add(0xfe0171),{onLeave:function(r){var s=rdstr(r); if(s&&!seenN[s]){seenN[s]=1; send({g:"avatar name: '"+s+"'"});}}});}catch(e){}
 try{Interceptor.attach(B.add(0xfe0160),{onLeave:function(r){var s=rdstr(r); if(s&&!seenP[s]){seenP[s]=1; send({g:"avatar productID: '"+s+"'"});}}});}catch(e){}
 // also hook ThiefAvatar.Load which likely sets the name from data
 send({g:"__ready"});
}
main();
"""
def sh(*a): return subprocess.run([ADB]+list(a),capture_output=True,text=True)
def cap(): return subprocess.run([ADB,"exec-out","screencap","-p"],capture_output=True).stdout
sh("shell","am","force-stop","se.foglo.svt"); time.sleep(1)
sh("shell","monkey","-p","se.foglo.svt","-c","android.intent.category.LAUNCHER","1")
# attach ASAP (LoadAvatars runs early), spawn+attach won't work reliably so attach after short wait
time.sleep(12)
dev=frida.get_usb_device(timeout=10)
try:
    pid=int(sh("shell","pidof","se.foglo.svt").stdout.split()[0])
except Exception:
    time.sleep(5); pid=int(sh("shell","pidof","se.foglo.svt").stdout.split()[0])
print("pid",pid,flush=True)
s=dev.attach(pid); sc=s.create_script(JS)
sc.on("message",lambda mm,d: print(mm.get("payload",{}).get("g",""),flush=True) if isinstance(mm.get("payload"),dict) else None)
sc.load()
# wait through loading + menu; also tap into avatar/store menus to force name access
time.sleep(40)
print("done",flush=True)