import frida, time, subprocess
ADB="/opt/android-sdk/platform-tools/adb"
JS=r"""
var B=null, m=Process.findModuleByName("libil2cpp.so");
var getClass=new NativeFunction(m.findExportByName("il2cpp_object_get_class"),'pointer',['pointer']);
var clsName=new NativeFunction(m.findExportByName("il2cpp_class_get_name"),'pointer',['pointer']);
function cname(o){try{return clsName(getClass(o)).readUtf8String();}catch(e){return "?";}}
function rdstr(p){try{if(p.isNull()||p.compare(ptr(0x10000))<0)return null;var n=p.add(8).readS32();if(n<0||n>200)return null;return p.add(0xc).readUtf16String(n);}catch(e){return null;}}
var dumped=false;
function main(){
 var mm=Process.findModuleByName("libil2cpp.so");if(!mm){setTimeout(main,150);return;}
 B=mm.base;
 [[0xd53c49],[0xd3ce0b],[0xd494ee],[0xd4dcda]].forEach(function(x){try{var p=B.add(x[0]);Memory.protect(p,16,'rwx');p.writeU8(0xc3);}catch(e){}});
 try{Interceptor.attach(B.add(0xd6fede),{onLeave:function(r){r.replace(ptr(1));}});}catch(e){}
 try{Interceptor.attach(B.add(0xe5b13b),{onEnter:function(){var p=this.context.ecx;try{var rank=p.add(0xe0).readS32();p.add(0xd0).writeU8(rank>=0?1:2);}catch(e){}}});}catch(e){}
 try{Interceptor.attach(B.add(0xe4be5a),{onEnter:function(){var it=this.context.esi;try{var rank=it.add(0xe0).readS32();it.add(0xd0).writeU8(rank>=0?1:2);}catch(e){}}});}catch(e){}
 // dump the dict: hook right after mov eax,[eax+0x50] in FindAvatar
 try{Interceptor.attach(B.add(0x235261),{onEnter:function(){
   if(dumped)return; dumped=true;
   var d=this.context.eax; send({g:"dict-holder="+d+" class="+cname(d)});
   // probe candidate Dictionary layouts: entries ptr @+0x14, count @+0x18 (also try +0x10/+0x1c)
   [[0x14,0x18],[0x10,0x18],[0x18,0x1c],[0x14,0x1c]].forEach(function(pr){
     try{
       var entries=d.add(pr[0]).readPointer(); var count=d.add(pr[1]).readS32();
       if(entries.isNull()||count<0||count>500)return;
       var len=entries.add(0xc).readS32(); if(len<0||len>2000)return;
       var keys=[]; var base=entries.add(0x10);
       for(var i=0;i<Math.min(count,60);i++){ var key=base.add(i*16+8).readPointer(); var s=rdstr(key); if(s)keys.push(s); }
       if(keys.length) send({g:"LAYOUT entries@+0x"+pr[0].toString(16)+" count="+count+" KEYS: "+keys.join(", ")});
     }catch(e){}
   });
 }});}catch(e){}
 send({g:"__ready"});
}
main();
"""
def sh(*a): return subprocess.run([ADB]+list(a),capture_output=True,text=True)
def tap(x,y): subprocess.run([ADB,"shell","input","tap",str(x),str(y)],capture_output=True)
def cap(): return subprocess.run([ADB,"exec-out","screencap","-p"],capture_output=True).stdout
sh("shell","am","force-stop","se.foglo.svt"); time.sleep(1)
sh("shell","input","keyevent","3"); time.sleep(1)
sh("shell","monkey","-p","se.foglo.svt","-c","android.intent.category.LAUNCHER","1")
print("polling menu",flush=True); t0=time.time()
while time.time()-t0<130:
    time.sleep(4)
    if len(cap())>600000: break
print("menu",int(time.time()-t0),flush=True); time.sleep(3)
dev=frida.get_usb_device(timeout=10)
pid=int(sh("shell","pidof","se.foglo.svt").stdout.split()[0]); print("pid",pid,flush=True)
s=dev.attach(pid); sc=s.create_script(JS)
sc.on("message",lambda mm,d: print(mm.get("payload",{}).get("g",""),flush=True) if isinstance(mm.get("payload"),dict) else None)
sc.load(); time.sleep(2)
print("[SNIPER]",flush=True); tap(700,730); time.sleep(6)
print("[GO]",flush=True); tap(1355,960); time.sleep(30)
print("done",flush=True)