import frida, time, subprocess
ADB="/opt/android-sdk/platform-tools/adb"
JS=r"""
function rd(p){try{if(p.isNull())return null;var l=p.add(8).readS32();if(l<0||l>300)return null;return p.add(0xc).readUtf16String(l);}catch(e){return "<obj>";}}
function ins(){var m=Process.findModuleByName("libil2cpp.so");if(!m)return false;var b=m.base;
 function T(f){try{f();}catch(e){send({warn:""+e});}}
 var DEC_LO=b.add(0xd34fb9), DEC_HI=b.add(0xd358f2);
 var inDec=false;
 T(function(){Interceptor.attach(b.add(0xd34fb9),{onEnter:function(){inDec=true;send({info:"== DecodeResponse ENTER =="});},onLeave:function(){inDec=false;send({info:"== DecodeResponse OK =="});}});});
 // the typed extractor 0x13a1ff6(out, recv, index, type) — log index + result when called inside DecodeResponse
 T(function(){Interceptor.attach(b.add(0x13a1ff6),{onEnter:function(a){var ra=this.returnAddress; if(ra.compare(DEC_LO)>=0 && ra.compare(DEC_HI)<0){ this.log=true; this.out=a[0]; this.idx=a[2].toInt32(); } },onLeave:function(){ if(this.log){ try{var res=this.out.readPointer(); var res2=this.out.add(4).readPointer(); send({info:"  get["+this.idx+"] -> "+(res.isNull()?"null":(rd(res)||"<obj "+res+">"))+" | +4="+(res2.isNull()?"null":(rd(res2)||"<obj>"))});}catch(e){send({info:"geterr "+e});} } }});});
 // also the string extractor 0x13e2820
 T(function(){Interceptor.attach(b.add(0x13e2820),{onEnter:function(a){var ra=this.returnAddress; if(ra.compare(DEC_LO)>=0 && ra.compare(DEC_HI)<0){ send({info:"  str-extract arg="+(a[0].isNull()?"null":(rd(a[0])||"<obj>"))});} }});});
 T(function(){var ab=Process.findModuleByName("libc.so").findExportByName("abort");Interceptor.attach(ab,{onEnter:function(){send({info:"ABORT"});}});});
 send({info:"__ready"});return true;}
if(!ins()){var iv=setInterval(function(){if(ins())clearInterval(iv);},120);}
"""
dev=frida.get_usb_device(timeout=10)
pid=int(subprocess.run([ADB,"shell","pidof","se.foglo.svt"],capture_output=True,text=True).stdout.split()[0])
s=dev.attach(pid); sc=s.create_script(JS); t0=time.time()
sc.on("message",lambda mm,d: print("[%5.1f] %s"%(time.time()-t0,mm.get("payload",mm)),flush=True))
sc.load(); time.sleep(1)
subprocess.run([ADB,"shell","input","tap","690","730"]); time.sleep(4)
subprocess.run([ADB,"shell","input","tap","1350","960"]); time.sleep(12)