import frida, time, subprocess, sys
sys.path.insert(0,"/root/ants/patch"); import resolve_addr as R
ADB="/opt/android-sdk/platform-tools/adb"
JS=r"""
var B=null, isn=null, spawned=false, bagThis=null;
function main(){
 var m=Process.findModuleByName("libil2cpp.so");if(!m){setTimeout(main,150);return;}
 B=m.base;
 isn=new NativeFunction(m.findExportByName("il2cpp_string_new"),'pointer',['pointer']);
 [[0xd53c49],[0xd3ce0b],[0xd494ee],[0xd4dcda]].forEach(function(x){try{var p=B.add(x[0]);Memory.protect(p,16,'rwx');p.writeU8(0xc3);}catch(e){}});
 try{Interceptor.attach(B.add(0xd6fede),{onLeave:function(r){r.replace(ptr(1));}});}catch(e){}
 try{Interceptor.attach(B.add(0xe5b13b),{onEnter:function(){var p=this.context.ecx;try{var rk=p.add(0xe0).readS32();p.add(0xd0).writeU8(rk>=0?1:2);}catch(e){}}});}catch(e){}
 try{Interceptor.attach(B.add(0xe4be5a),{onEnter:function(){var it=this.context.esi;try{var rk=it.add(0xe0).readS32();it.add(0xd0).writeU8(rk>=0?1:2);}catch(e){}}});}catch(e){}
 try{Interceptor.attach(B.add(0xe4c559),{onEnter:function(){var gp=this.context.ebp;try{gp.add(0x58).writePointer(isn(Memory.allocUtf8String("ava_1")));}catch(e){}}});}catch(e){}
 try{Interceptor.attach(B.add(0xdf9152),{onEnter:function(){spawned=true;send({g:"Thief.Awake"});}});}catch(e){}
 try{Interceptor.attach(B.add(0xdf9369),{onEnter:function(){send({g:"Thief.Start"});}});}catch(e){}
 // SetupBag: capture this, report [thief+0x94] before/after
 try{Interceptor.attach(B.add(0xdf9eed),{onEnter:function(){bagThis=this.context.esp.add(4).readPointer();send({g:"SetupBag ENTER this="+bagThis+" [+0x94]="+bagThis.add(0x94).readPointer()});},onLeave:function(){try{send({g:"SetupBag LEAVE [+0x94]="+bagThis.add(0x94).readPointer()});}catch(e){send({g:"SetupBag LEAVE (crashed?) "+e});}}});}catch(e){}
 try{Interceptor.attach(B.add(0xe4fd9b),{onLeave:function(r){send({g:"FetchBagPrefab -> "+(r.isNull()?"NULL":r)});}});}catch(e){}
 try{Interceptor.attach(B.add(0xdfa69e),{onEnter:function(){var t=this.context.esp.add(4).readPointer();send({g:"PrepareMaterials ENTER thief[+0x94]="+t.add(0x94).readPointer()});}});}catch(e){}
 // reliable crash: bd06f4 caller after spawn
 try{Interceptor.attach(B.add(0xbd06f4),{onEnter:function(){ if(!spawned)return; var ra=this.returnAddress;var mm=Process.findModuleByAddress(ra); if(mm&&mm.name=="libil2cpp.so"){var o=ra.sub(mm.base); if(o.compare(ptr(0xd00000))>=0&&o.compare(ptr(0xf00000))<=0)send({g:"THROW_AT 0x"+o.toString(16)});}}});}catch(e){}
 Process.setExceptionHandler(function(d){send({g:"NATIVE_CRASH"});return false;});
 send({g:"__ready"});
}
main();
"""
def sh(*a): return subprocess.run([ADB]+list(a),capture_output=True,text=True)
def tap(x,y): subprocess.run([ADB,"shell","input","tap",str(x),str(y)],capture_output=True)
def cap(): return subprocess.run([ADB,"exec-out","screencap","-p"],capture_output=True).stdout
sh("shell","am","force-stop","se.foglo.svt"); time.sleep(1)
sh("shell","input","keyevent","3"); time.sleep(1)
sh("shell","monkey","-p","se.foglo.svt","-c","android.intent.category.LAUNCHER","1")
print("polling menu",flush=True); t0=time.time()
while time.time()-t0<140:
    time.sleep(4)
    if len(cap())>600000: break
print("menu",int(time.time()-t0),flush=True); time.sleep(3)
dev=frida.get_usb_device(timeout=10)
pid=int(sh("shell","pidof","se.foglo.svt").stdout.split()[0]); print("pid",pid,flush=True)
msgs=[]
def onm(m,d):
    if isinstance(m.get("payload"),dict):
        g=m["payload"].get("g",""); print("  ",g,flush=True)
        if g.startswith("THROW_AT"): msgs.append(g.split()[1])
s=dev.attach(pid); sc=s.create_script(JS); sc.on("message",onm); sc.load(); time.sleep(2)
tap(700,730); time.sleep(6); tap(1355,960); time.sleep(35)
for off in msgs[:5]:
    try: print("  THROW resolved:",off,"->",R.resolve(int(off,16)),flush=True)
    except Exception as e: pass
print("done",flush=True)