import frida, time, subprocess, sys
sys.path.insert(0,"/root/ants"); import emu
JS=r"""
function biToHex(P){ // Mono.Math.BigInteger: data uint[] @+8, length @+0xc
 try{var da=P.add(8).readPointer(); var ln=P.add(0xc).readU32();
   if(da.isNull()||ln>64)return null;
   var alen=da.add(0xc).readS32(); var words=[];
   for(var i=0;i<ln&&i<alen;i++){words.push(da.add(0x10+i*4).readU32());}
   // most-significant word last -> build hex big-endian
   var s="";for(var i=words.length-1;i>=0;i--){var h=words[i].toString(16);while(h.length<8)h="0"+h;s+=h;}
   return s.replace(/^0+/,"")||"0";
 }catch(e){return "ERR"+e;}}
function ins(){var m=Process.findModuleByName("libil2cpp.so");if(!m)return false;var b=m.base;
 Interceptor.attach(b.add(0xb576ca),{onEnter:function(a){var s=a[0];var seen={};
   for(var off=8;off<=0x30;off+=4){try{var fp=s.add(off).readPointer();
     if(!fp.isNull()&&fp.compare(ptr(0x10000))>0){var h=biToHex(fp);
       if(h&&h.length>8&&!seen[h]){seen[h]=1;send({g:"f@0x"+off.toString(16)+" bits="+(h.length*4)+" "+h});}}}catch(e){}}
   send({g:"----"});
 }});
 send({g:"__ready"});return true;}
if(!ins()){var iv=setInterval(function(){if(ins())clearInterval(iv);},120);}
"""
t=emu.launch_to_menu(); print(f"menu {t:.0f}s",flush=True)
emu.tap(700,730); time.sleep(4)
dev=frida.get_usb_device(timeout=10)
pid=int(subprocess.run([emu.ADB,"shell","pidof","se.foglo.svt"],capture_output=True,text=True).stdout.split()[0])
s=dev.attach(pid); sc=s.create_script(JS)
sc.on("message",lambda m,d: print(m.get("payload",{}).get("g",m) if isinstance(m.get("payload"),dict) else m,flush=True))
sc.load(); time.sleep(1)
print("[GO]",flush=True); emu.tap(1355,970); time.sleep(3); emu.tap(1355,970); time.sleep(12)
print("done",flush=True)