import frida, time, subprocess, sys
ADB="/opt/android-sdk/platform-tools/adb"
ROLEFORCE = "force" in sys.argv    # pass "force" to enable role-force; default OFF (natural)
JS=r"""
var B=null, ROLEFORCE=__RF__;
var cnt={SetBot:0, set_isSniper:0, FindBotDefRank:0, FindBotDefLevel:0, AddController:0, ThiefAwake:0, SpawnThief:0};
function C(a,k){try{Interceptor.attach(B.add(a),{onEnter:function(){cnt[k]++;}});}catch(e){}}
function main(){
 var m=Process.findModuleByName("libil2cpp.so");if(!m){setTimeout(main,150);return;}
 B=m.base;
 [[0xd53c49],[0xd3ce0b],[0xd494ee],[0xd4dcda],[0xd29beb],[0xd299a4],[0xd2a24a],[0xd29aea]].forEach(function(x){try{var p=B.add(x[0]);Memory.protect(p,16,'rwx');p.writeU8(0xc3);}catch(e){}});
 try{Interceptor.attach(B.add(0xd6fede),{onLeave:function(r){r.replace(ptr(1));}});}catch(e){}
 if(ROLEFORCE){
   try{Interceptor.attach(B.add(0xe5b13b),{onEnter:function(){var p=this.context.ecx;try{var rk=p.add(0xe0).readS32();p.add(0xd0).writeU8(rk>=0?1:2);}catch(e){}}});}catch(e){}
   try{Interceptor.attach(B.add(0xe4be5a),{onEnter:function(){var it=this.context.esi;try{var rk=it.add(0xe0).readS32();it.add(0xd0).writeU8(rk>=0?1:2);}catch(e){}}});}catch(e){}
 }
 C(0xd4164b,"SetBot"); C(0xd41677,"set_isSniper"); C(0xfde3f3,"FindBotDefRank"); C(0xfde55e,"FindBotDefLevel");
 C(0xdfc918,"AddController"); C(0xdf9152,"ThiefAwake"); C(0xe4c511,"SpawnThief");
 recv('report',function f(){ send({g:"COUNTS "+JSON.stringify(cnt)}); recv('report',f); });
 send({g:"__ready ROLEFORCE="+ROLEFORCE});
}
main();
"""
def sh(*a): return subprocess.run([ADB]+list(a),capture_output=True,text=True)
def tap(x,y): subprocess.run([ADB,"shell","input","tap",str(x),str(y)],capture_output=True)
def cap(): return subprocess.run([ADB,"exec-out","screencap","-p"],capture_output=True).stdout
sh("shell","am","force-stop","se.foglo.svt"); time.sleep(1)
sh("shell","input","keyevent","3"); time.sleep(1)
sh("shell","monkey","-p","se.foglo.svt","-c","android.intent.category.LAUNCHER","1")
print("polling menu (ROLEFORCE=%s)"%ROLEFORCE,flush=True); t0=time.time()
while time.time()-t0<140:
    time.sleep(4)
    if len(cap())>600000: break
print("menu",int(time.time()-t0),flush=True); time.sleep(3)
dev=frida.get_usb_device(timeout=10)
pid=int(sh("shell","pidof","se.foglo.svt").stdout.split()[0]); print("pid",pid,flush=True)
s=dev.attach(pid); sc=s.create_script(JS.replace("__RF__","true" if ROLEFORCE else "false"))
sc.on("message",lambda mm,d: print(mm.get("payload",{}).get("g",""),flush=True) if isinstance(mm.get("payload"),dict) else None)
sc.load(); time.sleep(2)
tap(700,730); time.sleep(6); tap(1355,960); time.sleep(35)
sc.post({'type':'report'}); time.sleep(2)
print("done",flush=True)