import frida, time, subprocess, sys
sys.path.insert(0,"/root/ants"); import emu
JS=r"""
function biToHex(P){try{var da=P.add(8).readPointer(); var ln=P.add(0xc).readU32();
   if(da.isNull()||ln>64)return null; var alen=da.add(0xc).readS32();
   if(alen<0||alen>64)return null;
   var s="";for(var i=(ln<alen?ln:alen)-1;i>=0;i--){var h=da.add(0x10+i*4).readU32().toString(16);while(h.length<8)h="0"+h;s+=h;}
   return s.replace(/^0+/,"")||"0";}catch(e){return null;}}
function ins(){var m=Process.findModuleByName("libil2cpp.so");if(!m)return false;var b=m.base;
 var done=false;
 Interceptor.attach(b.add(0xb576ca),{onEnter:function(a){if(done)return;done=true;var s=a[0];
   for(var off=8;off<=0x44;off+=4){try{var fp=s.add(off).readPointer();
     if(!fp.isNull()&&fp.compare(ptr(0x10000))>0){var h=biToHex(fp);
       if(h){send({g:"f@0x"+off.toString(16)+" bits="+(h.length*4)+" "+h});}
       else{var n=fp.add(0xc).readS32(); if(n>0&&n<=64)send({g:"f@0x"+off.toString(16)+" byte["+n+"]"});}}
   }catch(e){}}
   send({g:"----"});}});
 send({g:"__ready"});return true;}
if(!ins()){var iv=setInterval(function(){if(ins())clearInterval(iv);},120);}
"""
t=emu.launch_to_menu(); print(f"menu {t:.0f}s",flush=True)
emu.tap(700,730); time.sleep(4)
dev=frida.get_usb_device(timeout=10)
pid=int(subprocess.run([emu.ADB,"shell","pidof","se.foglo.svt"],capture_output=True,text=True).stdout.split()[0])
s=dev.attach(pid); sc=s.create_script(JS)
sc.on("message",lambda m,d: print(m.get("payload",{}).get("g",m) if isinstance(m.get("payload"),dict) else m,flush=True))
sc.load(); time.sleep(1)
print("[GO]",flush=True); emu.tap(1355,970); time.sleep(3); emu.tap(1355,970); time.sleep(10)
print("done",flush=True)