import frida, time, subprocess, sys
sys.path.insert(0,"/root/ants"); import emu
JS=r"""
function hx(p,n){var u=new Uint8Array(p.readByteArray(n));var s="";for(var i=0;i<u.length;i++){var h=u[i].toString(16);s+=(h.length<2?"0":"")+h;}return s;}
function bah(p){ if(p.isNull())return "null"; var n=p.add(0xc).readS32(); if(n<0||n>4096)return "len?"+n; return "["+n+"]"+hx(p.add(0x10),n);}
function ins(){var m=Process.findModuleByName("libil2cpp.so");if(!m)return false;var b=m.base;
 function T(f){try{f();}catch(e){send({g:"ERR "+e});}}
 T(function(){Interceptor.attach(b.add(0xb576ca),{  // DeriveSharedKey(this,byte[] otherPub)
   onEnter:function(a){this.self=a[0];send({g:"DSK spub_recv="+bah(a[1])});},
   onLeave:function(){var s=this.self;
     for(var off=8;off<=0x60;off+=4){try{var fp=s.add(off).readPointer();
       if(!fp.isNull()&&!fp.equals(ptr(1))){var n=fp.add(0xc).readS32();
         if(n>0&&n<=96){send({g:"  DSK.f@0x"+off.toString(16)+"="+bah(fp)});}}}catch(e){}}
   }});});
 T(function(){Interceptor.attach(b.add(0xb57948),{  // Encrypt(this,data,off,cnt)
   onEnter:function(a){var s=a[0];send({g:"ENC this scan:"});
     for(var off=8;off<=0x60;off+=4){try{var fp=s.add(off).readPointer();
       if(!fp.isNull()&&!fp.equals(ptr(1))){var n=fp.add(0xc).readS32();
         if(n==32){send({g:"  ENC.KEY@0x"+off.toString(16)+"="+bah(fp)});}}}catch(e){}}
   }});});
 T(function(){Interceptor.attach(b.add(0xb5769b),{onLeave:function(r){send({g:"get_PublicKey="+bah(r)});}});});
 send({g:"__ready"});return true;}
if(!ins()){var iv=setInterval(function(){if(ins())clearInterval(iv);},120);}
"""
t=emu.launch_to_menu(); print(f"menu {t:.0f}s",flush=True)
emu.tap(700,730); time.sleep(4)
dev=frida.get_usb_device(timeout=10)
pid=int(subprocess.run([emu.ADB,"shell","pidof","se.foglo.svt"],capture_output=True,text=True).stdout.split()[0])
s=dev.attach(pid); sc=s.create_script(JS)
sc.on("message",lambda m,d: print(m.get("payload",{}).get("g",m) if isinstance(m.get("payload"),dict) else m,flush=True))
sc.load(); time.sleep(1)
print("[GO]",flush=True); emu.tap(1355,970); time.sleep(3); emu.tap(1355,970); time.sleep(14)
print("done",flush=True)