import frida, time, subprocess, sys
ADB="/opt/android-sdk/platform-tools/adb"
JS=r"""
var B=null, forceOff=false, seq=0, upd=0;
function rdstr(p){try{if(p.isNull()||p.compare(ptr(0x10000))<0)return null;var n=p.add(8).readS32();if(n<0||n>40000)return null;return p.add(0xc).readUtf16String(n);}catch(e){return null;}}
function main(){
 var m=Process.findModuleByName("libil2cpp.so");if(!m){setTimeout(main,150);return;}
 B=m.base;
 try{Interceptor.attach(B.add(0xd6bb99),{onLeave:function(r){ if(forceOff) r.replace(ptr(1)); }});}catch(e){}
 function H(a,nm){try{Interceptor.attach(B.add(a),{onEnter:function(){seq++;send({g:"["+seq+"] "+nm});}});}catch(e){}}
 H(0xd34da2,"CreateBotMatch");
 // DecodeResponse: dump json from a few candidate arg slots
 try{Interceptor.attach(B.add(0xd34fb9),{onEnter:function(){var sp=this.context.esp;seq++;
   var a1=rdstr(sp.add(4).readPointer()), a2=rdstr(sp.add(8).readPointer());
   send({g:"["+seq+"] DecodeResponse a1="+(a1?a1.substring(0,600):"null")+" | a2="+(a2?a2.substring(0,600):"null")});}});}catch(e){}
 // AssemblePlayerList: log entry + return (eax)
 try{Interceptor.attach(B.add(0xe5a928),{onEnter:function(){seq++;send({g:"["+seq+"] AssemblePlayerList ENTER"});},onLeave:function(r){send({g:"    AssemblePlayerList RET="+r});}});}catch(e){}
 H(0xe47cab,"GameController.Awake");H(0xe484bd,"GameController.Start");H(0xe4bd6a,"SpawnPlayers");
 H(0xdf9152,"Thief.Awake");
 try{Interceptor.attach(B.add(0x7947d4),{onEnter:function(){var sp=this.context.esp;seq++;var s=rdstr(sp.add(4).readPointer());var idx=sp.add(4).readS32();send({g:"["+seq+"] LoadSceneAsync "+(s?("name="+s):("idx="+idx))});}});}catch(e){}
 // Matchmaking.Update: count only, occasionally note
 try{Interceptor.attach(B.add(0xd3053c),{onEnter:function(){upd++; if(upd==1||upd==60||upd==180)send({g:"(Matchmaking.Update x"+upd+")"});}});}catch(e){}
 send({g:"__ready"});
}
recv('off',function f(){forceOff=true; send({g:"offline forced"}); recv('off',f);});
main();
"""
def sh(*a): return subprocess.run([ADB]+list(a),capture_output=True,text=True)
def tap(x,y): subprocess.run([ADB,"shell","input","tap",str(x),str(y)],capture_output=True)
def cap(): return subprocess.run([ADB,"exec-out","screencap","-p"],capture_output=True).stdout

sh("shell","am","force-stop","se.foglo.svt"); time.sleep(1)
sh("shell","input","keyevent","3"); time.sleep(1)
sh("shell","monkey","-p","se.foglo.svt","-c","android.intent.category.LAUNCHER","1")
print("polling for menu",flush=True)
t0=time.time(); menu=False
while time.time()-t0<120:
    time.sleep(4)
    if len(cap())>600000: menu=True; break
print("MENU" if menu else "TIMEOUT",int(time.time()-t0),flush=True); time.sleep(3)
dev=frida.get_usb_device(timeout=10)
pid=int(sh("shell","pidof","se.foglo.svt").stdout.split()[0]); print("pid",pid,flush=True)
s=dev.attach(pid); sc=s.create_script(JS)
sc.on("message",lambda m,d: print(m.get("payload",{}).get("g",""),flush=True) if isinstance(m.get("payload"),dict) else None)
sc.load(); time.sleep(2)
ONLINE = "online" in sys.argv
if not ONLINE:
    print("[force offline]",flush=True); sc.post({'type':'off'}); time.sleep(1)
else:
    print("[ONLINE mode - not forcing offline]",flush=True)
print("[SNIPER]",flush=True); tap(700,730); time.sleep(6)
print("[GO]",flush=True); tap(1355,960)
time.sleep(40)
print("[tap to dismiss/continue]",flush=True)
for i in range(3): tap(960,540); time.sleep(3)
time.sleep(20)
print("done",flush=True)