#!/usr/bin/env python3
import frida, time, subprocess
ADB="/opt/android-sdk/platform-tools/adb"
JS=r"""
function ins(){var m=Process.findModuleByName("libil2cpp.so");if(!m)return false;var b=m.base;
 function T(f){try{f();}catch(e){send({w:""+e});}}
 // Guard Enumerable.Count(source,pred,mi): return 0 if source null
 T(function(){
   var addr=b.add(0x11f1032);
   var orig=new NativeFunction(addr,'int',['pointer','pointer','pointer']);
   Interceptor.replace(addr,new NativeCallback(function(src,pred,mi){
     if(src.isNull()){send({g:"Count(null)->0 guarded"});return 0;}
     try{return orig(src,pred,mi);}catch(e){return 0;}
   },'int',['pointer','pointer','pointer']));
 });
 [[0xd3c44a,"OnResponse"],[0xe5a928,"AssemblePlayerList"],[0xd3c818,"SetPlayerCustomProperties"],[0xd3c903,"NetworkController.Connect"],[0xd6c1e0,"PingRegionsConnectBest"],[0x1009bc0,"ConnectToNameServer"],[0xd8685b,"CreateRoom"],[0xd34da2,"CreateBotMatch"],[0xe484bd,"GameController.Start"],[0xe4bd6a,"SpawnPlayers"]].forEach(function(x){
   T(function(){Interceptor.attach(b.add(x[0]),{onEnter:function(){send({g:"CHAIN "+x[1]});}});});});

 function hexb(p,n){try{var u=new Uint8Array(p.readByteArray(n));return Array.prototype.map.call(u,function(x){return ('0'+x.toString(16)).slice(-2);}).join('');}catch(e){return "<e>";}}
 function darr(p){try{if(p.isNull())return null;var len=p.add(0xc).readS32();if(len<0||len>3000)return {n:len};return {n:len,h:hexb(p.add(0x10),Math.min(len,140))};}catch(e){return {n:-2};}}
 T(function(){Interceptor.attach(b.add(0x612750),{onLeave:function(r){var d=darr(r);if(d&&d.n>0)send({g:"PhotonMsg ["+d.n+"] "+d.h});}});});
 T(function(){Interceptor.attach(b.add(0x611b94),{onEnter:function(a){var d=darr(a[1]);if(d)send({g:"TPeer.SendData ["+d.n+"] "+d.h});}});});
 T(function(){Interceptor.attach(b.add(0x60b4fa),{onEnter:function(a){var d=darr(a[1]);if(d)send({g:"SocketTcp.Send ["+d.n+"] "+d.h});}});});
 T(function(){Interceptor.attach(b.add(0x604264),{onEnter:function(a){try{send({g:"SerOpReq opCode="+a[2].toInt32()});}catch(e){}}});});
 T(function(){var ab=Process.findModuleByName("libc.so").findExportByName("abort");Interceptor.attach(ab,{onEnter:function(){var bt=Thread.backtrace(this.context,Backtracer.ACCURATE).slice(0,9).map(function(a){var mm=Process.findModuleByAddress(a);return mm&&mm.name=="libil2cpp.so"?"il+0x"+a.sub(mm.base).toString(16):(mm?mm.name:""+a);}).join(" ");send({g:"*** ABORT "+bt});}});});

 T(function(){Interceptor.attach(b.add(0x5fcd0c),{onLeave:function(r){try{var l=r.add(8).readS32();send({g:"PhotonWSurl="+r.add(0xc).readUtf16String(l)});}catch(e){}}});});
 var lc=Process.findModuleByName("libc.so");
 T(function(){Interceptor.attach(lc.findExportByName("connect"),{onEnter:function(a){try{var sa=a[1];if(sa.readU16()==2){var port=(sa.add(2).readU8()<<8)|sa.add(3).readU8();var ip=sa.add(4).readU8()+"."+sa.add(5).readU8()+"."+sa.add(6).readU8()+"."+sa.add(7).readU8();if(port!=39100)send({g:"CONNECT "+ip+":"+port});}}catch(e){}},onLeave:function(r){}});});
 send({g:"__ready"});return true;}
if(!ins()){var iv=setInterval(function(){if(ins())clearInterval(iv);},120);}
"""
subprocess.run([ADB,"shell","am","force-stop","se.foglo.svt"]); time.sleep(3)
subprocess.run([ADB,"shell","monkey","-p","se.foglo.svt","-c","android.intent.category.LAUNCHER","1"],stdout=-3,stderr=-3)
time.sleep(8)
dev=frida.get_usb_device(timeout=10)
pid=int(subprocess.run([ADB,"shell","pidof","se.foglo.svt"],capture_output=True,text=True).stdout.split()[0])
s=dev.attach(pid); sc=s.create_script(JS)
sc.on("message",lambda m,d: print(m.get("payload",m),flush=True)); sc.load(); time.sleep(34)
for c in [("690","730"),("690","730"),("1350","960"),("1350","960")]:
    subprocess.run([ADB,"shell","input","tap",c[0],c[1]]); time.sleep(4)
time.sleep(20); print("=== done ===",flush=True)