import frida, time, subprocess, sys
sys.path.insert(0,"/root/ants/patch"); import resolve_addr as R
ADB="/opt/android-sdk/platform-tools/adb"
JS=r"""
var B=null, awoke=0;
function main(){
 var m=Process.findModuleByName("libil2cpp.so");if(!m){setTimeout(main,150);return;}
 B=m.base;
 // MINIMAL stubs: analytics + LootSafe + StartThiefIntro only
 [[0xd53c49],[0xd3ce0b],[0xd494ee],[0xd4dcda],[0xd29beb],[0xd299a4],[0xd2a24a],[0xd29aea],[0xe4a362]].forEach(function(x){try{var p=B.add(x[0]);Memory.protect(p,16,'rwx');p.writeU8(0xc3);}catch(e){}});
 try{Interceptor.attach(B.add(0xd6fede),{onLeave:function(r){r.replace(ptr(1));}});}catch(e){}
 try{Interceptor.attach(B.add(0xe5b13b),{onEnter:function(){var p=this.context.ecx;try{var rk=p.add(0xe0).readS32();p.add(0xd0).writeU8(rk>=0?1:2);}catch(e){}}});}catch(e){}
 try{Interceptor.attach(B.add(0xe4be5a),{onEnter:function(){var it=this.context.esi;try{var rk=it.add(0xe0).readS32();it.add(0xd0).writeU8(rk>=0?1:2);}catch(e){}}});}catch(e){}
 var getClass=new NativeFunction(m.findExportByName("il2cpp_object_get_class"),'pointer',['pointer']);
 var clsName=new NativeFunction(m.findExportByName("il2cpp_class_get_name"),'pointer',['pointer']);
 var getFields=new NativeFunction(m.findExportByName("il2cpp_class_get_fields"),'pointer',['pointer','pointer']);
 var fldName=new NativeFunction(m.findExportByName("il2cpp_field_get_name"),'pointer',['pointer']);
 var fldOff=new NativeFunction(m.findExportByName("il2cpp_field_get_offset"),'uint32',['pointer']);
 var getParent=new NativeFunction(m.findExportByName("il2cpp_class_get_parent"),'pointer',['pointer']);
 // FIX TEST: clear garbage pvCache (+0xc PhotonView cache) on every Thief so the ==null check is clean
 function clearPV(thief){try{var v=thief.add(0xc).readPointer().toUInt32(); if(v>=0xdd000000||(v&3)!=0){ thief.add(0xc).writePointer(ptr(0)); return "cleared 0x"+v.toString(16);} return "ok 0x"+v.toString(16);}catch(e){return "e";}}
 try{Interceptor.attach(B.add(0xdf9152),{onEnter:function(){awoke++;var t=this.context.esp.add(4).readPointer();send({g:"Thief.Awake #"+awoke+" pvCache="+clearPV(t)});}});}catch(e){}
 try{Interceptor.attach(B.add(0xdf9369),{onEnter:function(){var t=this.context.esp.add(4).readPointer();clearPV(t);}});}catch(e){}
 try{Interceptor.attach(B.add(0xdfc2bb),{onEnter:function(){var t=this.context.esp.add(4).readPointer();clearPV(t);}});}catch(e){}
 // catch the CALLER that passes a garbage object to IsNativeObjectAlive (0x788ab7)
 var nbad=0;
 function garb(v){return v>=0xdd000000 && v<0xfff00000 && (v&3)!=0;} // high + misaligned, not 0xffff-sentinel
 // hook CompareBaseObjects (0x78898a) -> catch the GAME method comparing the garbage object
 try{Interceptor.attach(B.add(0x78898a),{onEnter:function(){
   if(nbad>8)return; var a=this.context.esp.add(4).readPointer().toUInt32(), b=this.context.esp.add(8).readPointer().toUInt32();
   if(garb(a)||garb(b)){ nbad++; var ra=this.returnAddress; var mm=Process.findModuleByAddress(ra);
     var off=mm&&mm.name=="libil2cpp.so"?"0x"+ra.sub(mm.base).toString(16):(""+ra);
     send({g:"CMP garbage a=0x"+a.toString(16)+" b=0x"+b.toString(16)+" caller="+off});
   }
 }});}catch(e){}
 // detailed crash context, once
 var crashed=false;
 Process.setExceptionHandler(function(d){var a=d.address;var mm=Process.findModuleByAddress(a);var loc=mm?mm.name+"+0x"+a.sub(mm.base).toString(16):""+a;
   if(!crashed){crashed=true; var c=d.context;
     send({g:"CRASH @"+loc+" access="+(d.memory?d.memory.address:"?")});
     send({g:"  eax="+c.eax+" ebx="+c.ebx+" ecx="+c.ecx+" edx="+c.edx+" esi="+c.esi+" edi="+c.edi+" ebp="+c.ebp});
     try{send({g:"  insn: "+Instruction.parse(a).toString()});}catch(e){}
     // walk return addresses on the stack for il2cpp frames (manual, robust)
     try{var fr="";for(var i=0;i<0x1400;i+=4){var v=c.esp.add(i).readPointer();var m2=Process.findModuleByAddress(v);
       if(m2&&m2.name=="libil2cpp.so"){var off=v.sub(m2.base);if(off.compare(ptr(0xd00000))>=0&&off.compare(ptr(0x1200000))<=0)fr+="0x"+off.toString(16)+" ";}}
       send({g:"  il2cpp-stack: "+fr});}catch(e){}
     try{send({g:"  thread="+Process.getCurrentThreadId()});}catch(e){}
   }
   return false;});
 send({g:"__ready"});
}
main();
"""
def sh(*a): return subprocess.run([ADB]+list(a),capture_output=True,text=True)
def tap(x,y): subprocess.run([ADB,"shell","input","tap",str(x),str(y)],capture_output=True)
def cap(): return subprocess.run([ADB,"exec-out","screencap","-p"],capture_output=True).stdout
def shot(n):
    d=cap(); open("/root/ants/shots/"+n,"wb").write(d); print("  shot",n,len(d),flush=True)
sh("shell","am","force-stop","se.foglo.svt"); time.sleep(1)
sh("shell","input","keyevent","3"); time.sleep(1)
sh("shell","monkey","-p","se.foglo.svt","-c","android.intent.category.LAUNCHER","1")
print("polling menu",flush=True); t0=time.time()
while time.time()-t0<140:
    time.sleep(4)
    if len(cap())>600000: break
print("menu",int(time.time()-t0),flush=True); time.sleep(3)
dev=frida.get_usb_device(timeout=10)
pid=int(sh("shell","pidof","se.foglo.svt").stdout.split()[0]); print("pid",pid,flush=True)
frames=[]
def onm(m,d):
    if isinstance(m.get("payload"),dict):
        g=m["payload"].get("g",""); print("  ",g,flush=True)
        if "il2cpp-stack" in g: frames.append(g)
s=dev.attach(pid); sc=s.create_script(JS); sc.on("message",onm); sc.load(); time.sleep(2)
tap(700,730); time.sleep(6); tap(1355,960)
for k in range(14):
    time.sleep(8); shot("min_%02d.png"%k)
# resolve stack frames
for g in frames[:2]:
    for tok in g.split():
        if tok.startswith("0x"):
            try: print("   ",tok,"->",R.resolve(int(tok,16)),flush=True)
            except Exception: pass
print("done",flush=True)