import frida, time, subprocess, sys
ADB="/opt/android-sdk/platform-tools/adb"
JS=r"""
var B=null, seq=0;
function main(){
 var m=Process.findModuleByName("libil2cpp.so");if(!m){setTimeout(main,150);return;}
 B=m.base;
 [[0xd53c49],[0xd3ce0b],[0xd494ee],[0xd4dcda]].forEach(function(x){try{var p=B.add(x[0]);Memory.protect(p,16,'rwx');p.writeU8(0xc3);}catch(e){}});
 send({g:"analytics stubbed"});
 try{Interceptor.attach(B.add(0xd6fede),{onLeave:function(r){r.replace(ptr(1));}});}catch(e){}
 // persona role dispatch: set role from rank sign so AssemblePlayerList builds a COMPLETE player
 try{Interceptor.attach(B.add(0xe5b13b),{onEnter:function(){
   var p=this.context.ecx; try{var rank=p.add(0xe0).readS32(); p.add(0xd0).writeU8(rank>=0?1:2);}catch(e){}
 }});}catch(e){send({g:"e5b13b err "+e});}
 // GamePlayer spawn-check: also set role from rank sign (belt-and-suspenders)
 try{Interceptor.attach(B.add(0xe4be5a),{onEnter:function(){
   var it=this.context.esi; try{var rank=it.add(0xe0).readS32(); it.add(0xd0).writeU8(rank>=0?1:2);}catch(e){}
 }});}catch(e){}
 function H(a,nm){try{Interceptor.attach(B.add(a),{onEnter:function(){seq++;send({g:"["+seq+"] "+nm});}});}catch(e){}}
 H(0xe4bfd8,"SpawnSniper");H(0xe4c511,"SpawnThief");H(0xdf9152,"Thief.Awake");
 Process.setExceptionHandler(function(d){var a=d.address;var mm=Process.findModuleByAddress(a);var loc=mm?mm.name+"+0x"+a.sub(mm.base).toString(16):""+a;
   var bt="";try{bt=Thread.backtrace(d.context,Backtracer.ACCURATE).slice(0,10).map(function(x){var m2=Process.findModuleByAddress(x);return m2&&m2.name=="libil2cpp.so"?"il+0x"+x.sub(m2.base).toString(16):(m2?m2.name:""+x);}).join(" ");}catch(e){}
   send({g:"*** CRASH @"+loc+" bt="+bt});return false;});
 send({g:"__ready"});
}
main();
"""
def sh(*a): return subprocess.run([ADB]+list(a),capture_output=True,text=True)
def tap(x,y): subprocess.run([ADB,"shell","input","tap",str(x),str(y)],capture_output=True)
def cap(): return subprocess.run([ADB,"exec-out","screencap","-p"],capture_output=True).stdout
def shot(name):
    d=cap(); open("/root/ants/shots/"+name,"wb").write(d); print("  shot",name,len(d),flush=True)
sh("shell","am","force-stop","se.foglo.svt"); time.sleep(1)
sh("shell","input","keyevent","3"); time.sleep(1)
sh("shell","monkey","-p","se.foglo.svt","-c","android.intent.category.LAUNCHER","1")
print("polling menu",flush=True); t0=time.time()
while time.time()-t0<120:
    time.sleep(4)
    if len(cap())>600000: break
print("menu",int(time.time()-t0),flush=True); time.sleep(3)
dev=frida.get_usb_device(timeout=10)
pid=int(sh("shell","pidof","se.foglo.svt").stdout.split()[0]); print("pid",pid,flush=True)
s=dev.attach(pid); sc=s.create_script(JS)
sc.on("message",lambda m,d: print(m.get("payload",{}).get("g",""),flush=True) if isinstance(m.get("payload"),dict) else None)
sc.load(); time.sleep(2)
print("[SNIPER]",flush=True); tap(700,730); time.sleep(6)
print("[GO]",flush=True); tap(1355,960)
for k in range(16):
    time.sleep(8); shot("fin2_%02d.png"%k)
print("done",flush=True)