import frida, time, subprocess, sys
ADB="/opt/android-sdk/platform-tools/adb"
JS=r"""
var B=null, frames=0, done=false;
var onew,oinit,cfn,cgt,tgo,gmn,rinv,unbox,dga,dg,ai,getClass,clsName;
function setup(m){function E(n){var p=m.findExportByName(n);if(!p)throw new Error("no "+n);return p;}
 onew=new NativeFunction(E("il2cpp_object_new"),'pointer',['pointer']);
 oinit=new NativeFunction(E("il2cpp_runtime_object_init"),'void',['pointer']);
 cfn=new NativeFunction(E("il2cpp_class_from_name"),'pointer',['pointer','pointer','pointer']);
 cgt=new NativeFunction(E("il2cpp_class_get_type"),'pointer',['pointer']);
 tgo=new NativeFunction(E("il2cpp_type_get_object"),'pointer',['pointer']);
 gmn=new NativeFunction(E("il2cpp_class_get_method_from_name"),'pointer',['pointer','pointer','int']);
 rinv=new NativeFunction(E("il2cpp_runtime_invoke"),'pointer',['pointer','pointer','pointer','pointer']);
 unbox=new NativeFunction(E("il2cpp_object_unbox"),'pointer',['pointer']);
 dg=new NativeFunction(E("il2cpp_domain_get"),'pointer',[]);
 dga=new NativeFunction(E("il2cpp_domain_get_assemblies"),'pointer',['pointer','pointer']);
 ai=new NativeFunction(E("il2cpp_assembly_get_image"),'pointer',['pointer']);
 getClass=new NativeFunction(E("il2cpp_object_get_class"),'pointer',['pointer']);
 clsName=new NativeFunction(E("il2cpp_class_get_name"),'pointer',['pointer']);
}
function cname(o){try{return o.isNull()?"NULL":clsName(getClass(o)).readUtf8String();}catch(e){return "?";}}
function cstr(s){return Memory.allocUtf8String(s);}
function findClass(ns,nm){var d=dg();var c=Memory.alloc(8);var a=dga(d,c);var n=c.readU32();var np=cstr(ns),mp=cstr(nm);
 for(var i=0;i<n;i++){var as=a.add(i*4).readPointer();if(as.isNull())continue;var im=ai(as);if(im.isNull())continue;var k=cfn(im,np,mp);if(!k.isNull())return k;}return ptr(0);}
function doWork(){
 try{
  var PIERole=findClass("","PIERole"), GO=findClass("UnityEngine","GameObject"), MP=findClass("","MatchPersona");
  send({g:"PIERole="+PIERole+" GO="+GO+" MatchPersona="+MP});
  if(PIERole.isNull()||GO.isNull()||MP.isNull()){send({g:"MISSING CLASS"});return;}
  // enumerate method APIs
  var gms=new NativeFunction(B.add(0).isNull()?ptr(0):Process.findModuleByName("libil2cpp.so").findExportByName("il2cpp_class_get_methods"),'pointer',['pointer','pointer']);
  var mn=new NativeFunction(Process.findModuleByName("libil2cpp.so").findExportByName("il2cpp_method_get_name"),'pointer',['pointer']);
  var mpc=new NativeFunction(Process.findModuleByName("libil2cpp.so").findExportByName("il2cpp_method_get_param_count"),'uint32',['pointer']);
  function enumC(cls,tag){var it=Memory.alloc(4);it.writePointer(ptr(0));var mm,o="";while(!(mm=gms(cls,it)).isNull()){try{o+=mn(mm).readUtf8String()+"/"+mpc(mm)+" ";}catch(e){}}send({g:tag+": "+o});}
  enumC(PIERole,"PIERole"); enumC(MP,"MatchPersona");
  var exc=Memory.alloc(4);
  var ptype=tgo(cgt(PIERole));
  // Prefer a LIVE PIERole from the scene (active GameObject -> coroutines work)
  var Obj=findClass("UnityEngine","Object");
  var fotM=gmn(Obj,cstr("FindObjectOfType"),1);
  var tp=Memory.alloc(4); tp.writePointer(ptype); exc.writePointer(ptr(0));
  var comp=fotM.isNull()?ptr(0):rinv(fotM,ptr(0),tp,exc);
  send({g:"FindObjectOfType(PIERole)="+comp});
  if(comp.isNull()){
   // grab a LIVE, active GameObject from the scene (Camera) so coroutines run
   var Camera=findClass("UnityEngine","Camera"); var Comp=findClass("UnityEngine","Component");
   var ct=Memory.alloc(4); ct.writePointer(tgo(cgt(Camera))); exc.writePointer(ptr(0));
   var cam=rinv(fotM,ptr(0),ct,exc);
   send({g:"Camera="+cam});
   var ggoM=gmn(Comp,cstr("get_gameObject"),0); exc.writePointer(ptr(0));
   var go=cam.isNull()?ptr(0):rinv(ggoM,cam,ptr(0),exc);
   send({g:"camera.gameObject="+go});
   if(go.isNull()){ go=onew(GO); oinit(go); }
   var addM=gmn(GO,cstr("AddComponent"),1);
   var pp=Memory.alloc(4); pp.writePointer(ptype); exc.writePointer(ptr(0));
   comp=rinv(addM,go,pp,exc); if(comp.isNull())comp=go;
   send({g:"PIERole on live GO comp="+comp+" addExc="+exc.readPointer()});
  }
  // 1) persona via GetLocalPersona/2  (try 0,0 args)
  var glpM=gmn(MP,cstr("GetLocalPersona"),2);
  var a0=Memory.alloc(4);a0.writeS32(0);var a1=Memory.alloc(4);a1.writeS32(0);
  var gp=Memory.alloc(8);gp.writePointer(a0);gp.add(4).writePointer(a1);
  exc.writePointer(ptr(0));
  var boxed=rinv(glpM,ptr(0),gp,exc);
  send({g:"GetLocalPersona boxed="+boxed+" exc="+exc.readPointer()});
  var persona=boxed.isNull()?ptr(0):unbox(boxed);
  // 2) CreateMatch(comp, persona) -> IEnumerator
  var cmM=gmn(PIERole,cstr("CreateMatch"),1);
  var cp=Memory.alloc(4);cp.writePointer(persona);exc.writePointer(ptr(0));
  var enumr=rinv(cmM,comp,cp,exc);
  send({g:"CreateMatch enumerator="+enumr+" exc="+exc.readPointer()});
  // force comp enabled + GO active (PIERole may disable itself at runtime)
  var Beh=findClass("UnityEngine","Behaviour");
  var seM=gmn(Beh,cstr("set_enabled"),1);
  var bt=Memory.alloc(4);bt.writeS32(1);var bp=Memory.alloc(4);bp.writePointer(bt);exc.writePointer(ptr(0));
  rinv(seM,comp,bp,exc);
  var geM=gmn(Beh,cstr("get_isActiveAndEnabled"),0);exc.writePointer(ptr(0));
  var iae=rinv(geM,comp,ptr(0),exc);
  send({g:"comp isActiveAndEnabled="+iae});
  // capture any further NRE walls
  try{Interceptor.attach(B.add(0xbd06f4),{onEnter:function(){var ra=this.returnAddress;var mm=Process.findModuleByAddress(ra);if(mm&&mm.name=="libil2cpp.so"){send({g:"NRE_SITE 0x"+ra.sub(mm.base).toString(16)});}}});}catch(e){}
  send({g:"iterator class="+cname(enumr)+" initState@0x100="+enumr.add(0x100).readS32()});
  // Drive via StartCoroutine so async yields (scene load) pump across frames
  var Beh=findClass("UnityEngine","Behaviour");
  var seM=gmn(Beh,cstr("set_enabled"),1);
  var bt=Memory.alloc(4);bt.writeS32(1);var bpp=Memory.alloc(4);bpp.writePointer(bt);exc.writePointer(ptr(0));
  rinv(seM,comp,bpp,exc);
  var MB=findClass("UnityEngine","MonoBehaviour");
  var scM=gmn(MB,cstr("StartCoroutine"),1);
  var sp=Memory.alloc(4);sp.writePointer(enumr);exc.writePointer(ptr(0));
  var coro=rinv(scM,comp,sp,exc);
  send({g:"StartCoroutine ret="+coro+" exc="+exc.readPointer()});
 }catch(e){send({g:"doWork err "+e});}
}
function main(){var m=Process.findModuleByName("libil2cpp.so");if(!m){setTimeout(main,150);return;}B=m.base;
 try{setup(m);}catch(e){send({g:"setup err "+e});return;}
 // stubs: analytics + LootSafe + StartThiefIntro + PIERole::EnableControls (0xd85f5b, pure-UI NRE wall)
 [[0xd53c49],[0xd3ce0b],[0xd494ee],[0xd4dcda],[0xd29beb],[0xd299a4],[0xd2a24a],[0xd29aea],[0xe4a362],[0xd85f5b]].forEach(function(x){try{var p=B.add(x[0]);Memory.protect(p,16,'rwx');p.writeU8(0xc3);}catch(e){}});
 function H(a,nm){try{Interceptor.attach(B.add(a),{onEnter:function(){send({g:"HIT "+nm});}});}catch(e){}}
 H(0xd34da2,"CreateBotMatch");H(0xdfc918,"AddController");H(0x103094a,"SetThiefBotDef");H(0xdf9152,"Thief.Awake");H(0xe47cab,"GameController.Awake");H(0xe4bd6a,"SpawnPlayers");
 try{Interceptor.attach(B.add(0x100382f),{onEnter:function(){frames++; if(frames==300&&!done){done=true;send({g:"=== doWork ==="});doWork();}}});}catch(e){}
 Process.setExceptionHandler(function(d){send({g:"NATIVE_CRASH"});return false;});
 send({g:"__ready"});
}
main();
"""
def sh(*a): return subprocess.run([ADB]+list(a),capture_output=True,text=True)
def cap(): return subprocess.run([ADB,"exec-out","screencap","-p"],capture_output=True).stdout
def shot(n):
    d=cap(); open("/root/ants/shots/"+n,"wb").write(d); print("  shot",n,len(d),flush=True)
sh("shell","am","force-stop","se.foglo.svt"); time.sleep(1)
sh("shell","input","keyevent","3"); time.sleep(1)
sh("shell","monkey","-p","se.foglo.svt","-c","android.intent.category.LAUNCHER","1")
print("waiting 32s for app",flush=True); time.sleep(32)
dev=frida.get_usb_device(timeout=10)
pid=int(sh("shell","pidof","se.foglo.svt").stdout.split()[0]); print("pid",pid,flush=True)
s=dev.attach(pid); sc=s.create_script(JS)
sc.on("message",lambda mm,d: print(mm.get("payload",{}).get("g",""),flush=True) if isinstance(mm.get("payload"),dict) else print("MSG",mm,flush=True))
sc.load()
for k in range(14):
    time.sleep(8); shot("cm_%02d.png"%k)
print("done",flush=True)