import frida, time, subprocess, sys
ADB="/opt/android-sdk/platform-tools/adb"
JS=r"""
var B=null, rinv=null, addM=null, tbd=null, properDef=null, TBD=null, onew=null, csize=null;
function H(a,nm){try{Interceptor.attach(B.add(a),{onEnter:function(){send({g:nm});}});}catch(e){}}
function main(){
 var m=Process.findModuleByName("libil2cpp.so");if(!m){setTimeout(main,150);return;}
 B=m.base;
 function E(n){return m.findExportByName(n);}
 var getClass=new NativeFunction(E("il2cpp_object_get_class"),'pointer',['pointer']);
 var clsName=new NativeFunction(E("il2cpp_class_get_name"),'pointer',['pointer']);
 function cname(o){try{return clsName(getClass(o)).readUtf8String();}catch(e){return "?";}}
 function rdstr(p){try{if(p.isNull()||p.compare(ptr(0x10000))<0)return null;var n=p.add(8).readS32();if(n<0||n>400)return null;return p.add(0xc).readUtf16String(n);}catch(e){return null;}}
 var domain_get=new NativeFunction(E("il2cpp_domain_get"),'pointer',[]);
 var dga=new NativeFunction(E("il2cpp_domain_get_assemblies"),'pointer',['pointer','pointer']);
 var asm_img=new NativeFunction(E("il2cpp_assembly_get_image"),'pointer',['pointer']);
 var cfn=new NativeFunction(E("il2cpp_class_from_name"),'pointer',['pointer','pointer','pointer']);
 var gmn=new NativeFunction(E("il2cpp_class_get_method_from_name"),'pointer',['pointer','pointer','int']);
 rinv=new NativeFunction(E("il2cpp_runtime_invoke"),'pointer',['pointer','pointer','pointer','pointer']);
 // find Thief class + AddController method
 var dom=domain_get();var cnt=Memory.alloc(8);var arr=dga(dom,cnt);var n=cnt.readU32();var Thief=ptr(0);
 var nsp=Memory.allocUtf8String(""),nmp=Memory.allocUtf8String("Thief");
 for(var i=0;i<n;i++){var a=arr.add(i*4).readPointer();if(a.isNull())continue;var img=asm_img(a);if(img.isNull())continue;var k=cfn(img,nsp,nmp);if(!k.isNull()){Thief=k;break;}}
 addM = Thief.isNull()?ptr(0):gmn(Thief,Memory.allocUtf8String("AddController"),0);
 onew=new NativeFunction(E("il2cpp_object_new"),'pointer',['pointer']);
 csize=new NativeFunction(E("il2cpp_class_instance_size"),'int',['pointer']);
 TBD=ptr(0); var nmT=Memory.allocUtf8String("ThiefBotDef");
 for(var j=0;j<n;j++){var a2=arr.add(j*4).readPointer();if(a2.isNull())continue;var img2=asm_img(a2);if(img2.isNull())continue;var k2=cfn(img2,nsp,nmT);if(!k2.isNull()){TBD=k2;break;}}
 send({g:"Thief="+Thief+" AddController="+addM+" ThiefBotDef class="+TBD+" size="+(TBD.isNull()?0:csize(TBD))});
 [[0xd53c49],[0xd3ce0b],[0xd494ee],[0xd4dcda],[0xd29beb],[0xd299a4],[0xd2a24a],[0xd29aea]].forEach(function(x){try{var p=B.add(x[0]);Memory.protect(p,16,'rwx');p.writeU8(0xc3);}catch(e){}});
 try{Interceptor.attach(B.add(0xd6fede),{onLeave:function(r){r.replace(ptr(1));}});}catch(e){}
 try{Interceptor.attach(B.add(0xe5b13b),{onEnter:function(){var p=this.context.ecx;try{var rk=p.add(0xe0).readS32();p.add(0xd0).writeU8(rk>=0?1:2);}catch(e){}}});}catch(e){}
 try{Interceptor.attach(B.add(0xe4be5a),{onEnter:function(){var it=this.context.esi;try{var rk=it.add(0xe0).readS32();it.add(0xd0).writeU8(rk>=0?1:2);}catch(e){}}});}catch(e){}
 H(0xe0b90c,"OnHealthChange");
 // grab any ThiefBotDef instance that gets created (0x103a151 = ThiefBotDef::.ctor)
 try{Interceptor.attach(B.add(0x103a151),{onEnter:function(){var o=this.context.ecx; if(!tbd){tbd=o; send({g:"cached ThiefBotDef="+o});}}});}catch(e){}
 // force ALL bot-def lookups to return the cached ThiefBotDef (fix the SniperBotDef->ThiefBotDef cast)
 function forceDef(a){try{Interceptor.attach(B.add(a),{onLeave:function(r){
   if(r.isNull()||TBD.isNull())return;
   if(!properDef){ var nd=onew(TBD); var sz=csize(TBD); Memory.copy(nd.add(8),r.add(8),sz-8); properDef=nd; send({g:"created ThiefBotDef (copied "+cname(r)+" stats, size="+sz+")"}); }
   r.replace(properDef);
 }});}catch(e){}}
 forceDef(0xfde3f3); forceDef(0xfde55e); forceDef(0xfda9f8); forceDef(0xfdab63);
 // call AddController via runtime_invoke (proper MethodInfo) at Thief.Start onLeave
 try{Interceptor.attach(B.add(0xdf9369),{
   onEnter:function(){this.self=this.context.esp.add(4).readPointer();},
   onLeave:function(){ try{ var exc=Memory.alloc(4);exc.writePointer(ptr(0));
     rinv(addM,this.self,ptr(0),exc);
     var e=exc.readPointer(); var msg=null;
     if(!e.isNull()){ for(var off=0x8;off<=0x28;off+=4){var s=rdstr(e.add(off).readPointer()); if(s&&s.length>3){msg=s;break;}} }
     send({g:"AddController exc="+(e.isNull()?"none":cname(e)+" msg='"+msg+"'")+" ctrl[+0x260]="+this.self.add(0x260).readPointer()}); }catch(e){send({g:"rinv err "+e});} }
 });}catch(e){}
 // capture where AddController (0xdfc918-0xdfd4c0) throws its NRE
 try{Interceptor.attach(B.add(0xbd06f4),{onEnter:function(){var ra=this.returnAddress;var mm=Process.findModuleByAddress(ra);if(mm&&mm.name=="libil2cpp.so"){var o=ra.sub(mm.base);if(o.compare(ptr(0xdfc900))>=0&&o.compare(ptr(0xdfd4c0))<=0)send({g:"AddController THROW at 0x"+o.toString(16)});}}});}catch(e){}
 Process.setExceptionHandler(function(d){send({g:"NATIVE_CRASH"});return false;});
 send({g:"__ready"});
}
main();
"""
def sh(*a): return subprocess.run([ADB]+list(a),capture_output=True,text=True)
def tap(x,y): subprocess.run([ADB,"shell","input","tap",str(x),str(y)],capture_output=True)
def cap(): return subprocess.run([ADB,"exec-out","screencap","-p"],capture_output=True).stdout
def shot(n):
    d=cap(); open("/root/ants/shots/"+n,"wb").write(d); print("  shot",n,len(d),flush=True)
sh("shell","am","force-stop","se.foglo.svt"); time.sleep(1)
sh("shell","input","keyevent","3"); time.sleep(1)
sh("shell","monkey","-p","se.foglo.svt","-c","android.intent.category.LAUNCHER","1")
print("polling menu",flush=True); t0=time.time()
while time.time()-t0<140:
    time.sleep(4)
    if len(cap())>600000: break
print("menu",int(time.time()-t0),flush=True); time.sleep(3)
dev=frida.get_usb_device(timeout=10)
pid=int(sh("shell","pidof","se.foglo.svt").stdout.split()[0]); print("pid",pid,flush=True)
s=dev.attach(pid); sc=s.create_script(JS)
sc.on("message",lambda mm,d: print(mm.get("payload",{}).get("g",""),flush=True) if isinstance(mm.get("payload"),dict) else None)
sc.load(); time.sleep(2)
tap(700,730); time.sleep(6); tap(1355,960)
for k in range(10):
    time.sleep(8); shot("hp3_%02d.png"%k)
print("done",flush=True)