import sys,time,frida
ADDR=0xffe7ba
JS="""
function ins(){var m=Process.findModuleByName("libil2cpp.so");if(!m)return false;var b=m.base;
send({t:"info",m:"base "+b});
Interceptor.attach(b.add(""" + str(ADDR) + """),{
  onEnter:function(a){this.self=a[0];},
  onLeave:function(rv){var s=this.self;var v=[];
    for(var o=0x08;o<=0x60;o+=4){try{v.push(s.add(o).readS32());}catch(e){v.push(0);}}
    send({t:"mv",ret:rv.toInt32(),st:v});}
});return true;}
if(!ins()){var iv=setInterval(function(){if(ins())clearInterval(iv);},200);}
"""
dev=frida.get_device_manager().add_remote_device("127.0.0.1:27042")
pid=dev.spawn(["se.foglo.svt"]);s=dev.attach(pid);sc=s.create_script(JS);t0=time.time()
last=[None];cnt=[0]
def om(m,d):
    if m["type"]!="send":print("!!",m);return
    p=m["payload"]
    if p["t"]=="mv":
        cnt[0]+=1
        cur=(p["ret"],tuple(p["st"]))
        if cur!=last[0]:
            print("[%6.2fs] #%d ret=%d  state(0x08..0x60)= %s"%(time.time()-t0,cnt[0],p["ret"],
                  ' '.join('%d'%x for x in p["st"])))
            last[0]=cur
    else:print("[%s]%s"%(p["t"],p.get("m")))
sc.on("message",om);sc.load();dev.resume(pid)
time.sleep(int(sys.argv[1]) if len(sys.argv)>1 else 30)
print("total MoveNext:",cnt[0])