#!/usr/bin/env python3
import frida, time, subprocess, sys
ADB="/opt/android-sdk/platform-tools/adb"
JS=r"""
function rs(p){try{if(p.isNull())return null;var l=p.add(8).readS32();if(l<0||l>200)return "<len"+l+">";return p.add(0xc).readUtf16String(l);}catch(e){return "<e>";}}
function ins(){var m=Process.findModuleByName("libil2cpp.so");if(!m)return false;var b=m.base;
 function T(f){try{f();}catch(e){send({w:""+e});}}
 // 0x13a1ff6(out,node,index,ctxStr)  0x13a1fee(node,ctxStr)->int
 T(function(){Interceptor.attach(b.add(0x13a1ff6),{onEnter:function(a){this.o=a[0];send({g:"GET6 idx="+a[2].toInt32()+" ctx="+rs(a[3])});},onLeave:function(r){try{var t=this.o.readU8();send({g:"   ->node.t0="+t});}catch(e){}}});});
 T(function(){Interceptor.attach(b.add(0x13a1fee),{onEnter:function(a){send({g:"CNT_e node="+a[0]+" ctx="+rs(a[1])});},onLeave:function(r){send({g:"   ->ret="+r.toInt32()});}});});
 T(function(){Interceptor.attach(b.add(0xd34fb9),{onEnter:function(a){send({g:"== DecodeResponse ENTER recv="+a[2]});},onLeave:function(r){send({g:"== DecodeResponse LEAVE"});}});});
 T(function(){Interceptor.attach(b.add(0xd36166),{onEnter:function(){send({g:"  call 0xd36166 (per-persona?)"});}});});
 T(function(){var ab=Process.findModuleByName("libc.so").findExportByName("abort");Interceptor.attach(ab,{onEnter:function(){var bt=Thread.backtrace(this.context,Backtracer.ACCURATE).slice(0,6).map(function(a){var mm=Process.findModuleByAddress(a);return mm?"+0x"+a.sub(mm.base).toString(16):""+a;}).join(",");send({g:"*** ABORT "+bt});}});});
 send({g:"__ready"});return true;}
if(!ins()){var iv=setInterval(function(){if(ins())clearInterval(iv);},120);}
"""
subprocess.run([ADB,"shell","am","force-stop","se.foglo.svt"]); time.sleep(3)
subprocess.run([ADB,"shell","monkey","-p","se.foglo.svt","-c","android.intent.category.LAUNCHER","1"],stdout=-3,stderr=-3)
time.sleep(44)
dev=frida.get_usb_device(timeout=10)
pid=int(subprocess.run([ADB,"shell","pidof","se.foglo.svt"],capture_output=True,text=True).stdout.split()[0])
s=dev.attach(pid); sc=s.create_script(JS)
sc.on("message",lambda m,d: print(m.get("payload",m),flush=True)); sc.load(); time.sleep(1)
subprocess.run([ADB,"shell","input","tap","690","730"]); time.sleep(4)
subprocess.run([ADB,"shell","input","tap","690","730"]); time.sleep(3)
subprocess.run([ADB,"shell","input","tap","1350","960"]); time.sleep(3)
subprocess.run([ADB,"shell","input","tap","1350","960"]); time.sleep(8)
print("=== done ===",flush=True)