import frida, time, subprocess
ADB="/opt/android-sdk/platform-tools/adb"
JS=r"""
function il2s(p){try{if(p.isNull())return null;var l=p.add(8).readS32();if(l<0||l>80)return null;return p.add(0xc).readUtf16String(l);}catch(e){return null;}}
function ins(){var m=Process.findModuleByName("libil2cpp.so");if(!m)return false;var b=m.base;
 // read after LoadProfile runs; hook LoadProfile onLeave then dump slots
 Interceptor.attach(b.add(0xd9086e),{onEnter:function(){
   try{
     var bag=b.add(0x1e5f498).readPointer();
     var rifle=b.add(0x1e5f4ac).readPointer();
     send("BAG key literal = "+il2s(bag));
     send("RIFLE key literal = "+il2s(rifle));
   }catch(e){send("err "+e);}
 }});
 send("__ready");return true;}
if(!ins()){var iv=setInterval(function(){if(ins())clearInterval(iv);},120);}
"""
subprocess.run([ADB,"shell","am","force-stop","se.foglo.svt"])
dev=frida.get_usb_device(timeout=10); pid=dev.spawn(["se.foglo.svt"])
s=dev.attach(pid); sc=s.create_script(JS)
seen=set()
def om(m,d):
    p=m.get("payload",m)
    if p not in seen: seen.add(p); print(p,flush=True)
sc.on("message",om); sc.load(); dev.resume(pid); time.sleep(30)