#!/usr/bin/env python3
import frida, time, subprocess
ADB="/opt/android-sdk/platform-tools/adb"
JS=r"""
function ins(){var m=Process.findModuleByName("libil2cpp.so");if(!m)return false;var b=m.base;
 function T(f){try{f();}catch(e){send({w:""+e});}}
 function rs(p){try{if(p.isNull())return "null";var l=p.add(8).readS32();if(l<0||l>300)return "<l>";return p.add(0xc).readUtf16String(l);}catch(e){return "<e>";}}
 // read the literal slot [ebx+0x67a20], ebx=0x1df6b7c -> module VA 0x1e5e59c
 T(function(){Interceptor.attach(b.add(0xd34fb9),{onEnter:function(){
   try{var lit=b.add(0x1e5e59c).readPointer();send({g:"BOTFLAG-literal @0x67a20 = "+JSON.stringify(rs(lit))});}catch(e){send({g:"literr "+e});}
 }});});
 // op_Equality right before bot flag set
 T(function(){Interceptor.attach(b.add(0xd3557f),{onEnter:function(a){send({g:"botEq a0="+JSON.stringify(rs(a[0]))+" a1="+JSON.stringify(rs(a[1]))+" a2="+JSON.stringify(rs(a[2]))+" a3="+JSON.stringify(rs(a[3]))});}});});
 // did bot flag get set? hook 0xd3558b via the byte -> just log reaching 0xd3558b
 T(function(){Interceptor.attach(b.add(0xd3558b),{onEnter:function(){send({g:"*** BOT FLAG SET (reached 0xd3558b)"});}});});
 T(function(){Interceptor.attach(b.add(0xd3c5a8),{onEnter:function(a){/*after copy*/}});});
 // OnResponse routing: log if it takes bot branch (0xd3c732) vs photon
 T(function(){Interceptor.attach(b.add(0xd3c732),{onEnter:function(){send({g:">>> OnResponse BOT/exit branch (skip Photon), state=2"});}});});
 T(function(){Interceptor.attach(b.add(0xd3c903),{onEnter:function(){send({g:"!!! NetworkController.Connect (PHOTON dead)"});}});});
 T(function(){var ab=Process.findModuleByName("libc.so").findExportByName("abort");Interceptor.attach(ab,{onEnter:function(){send({g:"*** ABORT"});}});});
 send({g:"__ready"});return true;}
if(!ins()){var iv=setInterval(function(){if(ins())clearInterval(iv);},120);}
"""
subprocess.run([ADB,"shell","am","force-stop","se.foglo.svt"]); time.sleep(3)
subprocess.run([ADB,"shell","monkey","-p","se.foglo.svt","-c","android.intent.category.LAUNCHER","1"],stdout=-3,stderr=-3)
time.sleep(44)
dev=frida.get_usb_device(timeout=10)
pid=int(subprocess.run([ADB,"shell","pidof","se.foglo.svt"],capture_output=True,text=True).stdout.split()[0])
s=dev.attach(pid); sc=s.create_script(JS)
sc.on("message",lambda m,d: print(m.get("payload",m),flush=True)); sc.load(); time.sleep(1)
for c in [("690","730"),("690","730"),("1350","960"),("1350","960")]:
    subprocess.run([ADB,"shell","input","tap",c[0],c[1]]); time.sleep(4)
time.sleep(8); print("=== done ===",flush=True)