#!/usr/bin/env python3
import frida, time, subprocess
ADB="/opt/android-sdk/platform-tools/adb"
JS=r"""
function hexb(p,n){try{var u=new Uint8Array(p.readByteArray(n));return Array.prototype.map.call(u,function(x){return ('0'+x.toString(16)).slice(-2);}).join('');}catch(e){return "<e>";}}
function arr(p,mx){try{if(p.isNull())return null;var len=p.add(0xc).readS32();if(len<0||len>4000)return null;return {n:len,h:hexb(p.add(0x10),Math.min(len,mx||300))};}catch(e){return null;}}
function scanKey(obj){ // scan obj fields (ptrs) for a byte[] of len 32 or 16
 var out=[];
 try{for(var o=8;o<0x40;o+=4){var f=obj.add(o).readPointer();if(!f.isNull()){var d=arr(f,64);if(d&&(d.n==32||d.n==16)){out.push("off0x"+o.toString(16)+":["+d.n+"]"+d.h);}}}}catch(e){}
 return out.join(" ");
}
function ins(){var m=Process.findModuleByName("libil2cpp.so");if(!m)return false;var b=m.base;
 function T(f){try{f();}catch(e){send({w:""+e});}}
 T(function(){var a=b.add(0x11f1032);var o=new NativeFunction(a,'int',['pointer','pointer','pointer']);Interceptor.replace(a,new NativeCallback(function(s,p,mi){if(s.isNull())return 0;try{return o(s,p,mi);}catch(e){return 0;}},'int',['pointer','pointer','pointer']));});
 // DiffieHellmanCryptoProvider::Encrypt(this,data,offset,count)->byte[]
 T(function(){Interceptor.attach(b.add(0xb57948),{onEnter:function(a){this.o=a[0];var d=arr(a[1],300);send({g:"DH.Encrypt PLAINTEXT off="+a[2].toInt32()+" cnt="+a[3].toInt32()+" data="+(d?("["+d.n+"] "+d.h):"?")});send({g:"  keys? "+scanKey(a[0])});},onLeave:function(r){var d=arr(r,300);send({g:"DH.Encrypt CIPHER="+(d?("["+d.n+"] "+d.h):"?")});}});});
 T(function(){Interceptor.attach(b.add(0xb57ae8),{onEnter:function(a){var d=arr(a[1],300);send({g:"DH.Decrypt CIPHER="+(d?("["+d.n+"] "+d.h):"?")});},onLeave:function(r){var d=arr(r,300);send({g:"DH.Decrypt PLAIN="+(d?("["+d.n+"] "+d.h):"?")});}});});
 send({g:"__ready"});return true;}
if(!ins()){var iv=setInterval(function(){if(ins())clearInterval(iv);},120);}
"""
subprocess.run([ADB,"shell","am","force-stop","se.foglo.svt"]); time.sleep(3)
subprocess.run([ADB,"shell","monkey","-p","se.foglo.svt","-c","android.intent.category.LAUNCHER","1"],stdout=-3,stderr=-3)
time.sleep(8)
dev=frida.get_usb_device(timeout=10)
pid=int(subprocess.run([ADB,"shell","pidof","se.foglo.svt"],capture_output=True,text=True).stdout.split()[0])
s=dev.attach(pid); sc=s.create_script(JS)
sc.on("message",lambda m,d: print(m.get("payload",m),flush=True)); sc.load(); time.sleep(34)
for c in [("690","730"),("690","730"),("1350","960"),("1350","960")]:
    subprocess.run([ADB,"shell","input","tap",c[0],c[1]]); time.sleep(4)
time.sleep(12); print("=== done ===",flush=True)