import frida, time, subprocess
ADB="/opt/android-sdk/platform-tools/adb"
JS=r"""
function rd(p){try{if(p.isNull())return null;var l=p.add(8).readS32();if(l<0||l>200)return null;return p.add(0xc).readUtf16String(l);}catch(e){return "<node>";}}
function dumpL(L){try{if(L.isNull())return "NULL";var n=L.add(0xc).readS32();var it=L.add(8).readPointer();var o=[];for(var i=0;i<n&&i<30;i++){var e=it.add(0x10+i*4).readPointer();o.push(i+":"+(e.isNull()?"0":(rd(e)||"N")));}return "n="+n+" ["+o.join(",")+"]";}catch(e){return "err "+e;}}
function ins(){var m=Process.findModuleByName("libil2cpp.so");if(!m)return false;var b=m.base;
 function T(f){try{f();}catch(e){}}
 T(function(){Interceptor.attach(b.add(0xd34fb9),{onEnter:function(a){send({info:"DecodeResp this="+a[1]+" recv(a2)="+dumpL(a[2])});},onLeave:function(){send({info:"DecodeResp RETURNED-ok"});}});});
 // what happens after
 var seen={};
 [[0xd3f6bb,"MatchPersona.Write/parse"],[0xd415f7,"MatchPersona.Read"],[0xd4164b,"SetBot"],[0xd410d6,"Thief.GetBotDef"],[0xd3d4a4,"OnResp_m__0"],[0xe5a928,"AssemblePlayerList"],[0xd3cb37,"LoadLevel"],[0xd34da2,"CreateBotMatch"],[0x1003caf,"NetworkController.Connect(Photon)"],[0xe484bd,"GameController.Start"],[0xe4bd6a,"SpawnPlayers"]].forEach(function(x){T(function(){Interceptor.attach(b.add(x[0]),{onEnter:function(){if(!seen[x[1]]){seen[x[1]]=1;send({info:"AFTER "+x[1]});}}});});});
 T(function(){var ab=Process.findModuleByName("libc.so").findExportByName("abort");Interceptor.attach(ab,{onEnter:function(){var bt=Thread.backtrace(this.context,Backtracer.ACCURATE).slice(0,10).map(function(a){var mm=Process.findModuleByAddress(a);return mm?mm.name+"+0x"+a.sub(mm.base).toString(16):""+a;}).join(",");send({info:"ABORT "+bt});}});});
 send({info:"__ready"});return true;}
if(!ins()){var iv=setInterval(function(){if(ins())clearInterval(iv);},120);}
"""
dev=frida.get_usb_device(timeout=10)
pid=int(subprocess.run([ADB,"shell","pidof","se.foglo.svt"],capture_output=True,text=True).stdout.split()[0])
s=dev.attach(pid); sc=s.create_script(JS); t0=time.time()
sc.on("message",lambda mm,d: print("[%5.1f] %s"%(time.time()-t0,mm.get("payload",mm)),flush=True))
sc.load(); time.sleep(1)
subprocess.run([ADB,"shell","input","tap","690","730"]); time.sleep(4)
subprocess.run([ADB,"shell","input","tap","1350","960"]); time.sleep(14)