import frida, time, subprocess
ADB="/opt/android-sdk/platform-tools/adb"
JS=r"""
function rd(p){ try{if(p.isNull())return null;var l=p.add(8).readS32();if(l<0||l>128)return null;return p.add(0xc).readUtf16String(l);}catch(e){return null;} }
function ins(){ var m=Process.findModuleByName("libil2cpp.so"); if(!m) return false;
 var b=m.base;
 // OnSectionChange(changeType edi=[esp+0x164]? , section esi=[esp+0x168]); args via a[]
 Interceptor.attach(b.add(0xd8820d),{onEnter:function(a){
   try{ var ct=a[1].toInt32(); var sec=a[2]; var nm=sec.isNull()?null:rd(sec.add(8)); var par=sec.isNull()?null:rd(sec.add(0x10));
        send("SEC ct="+ct+" name="+nm+" parent="+par); }catch(e){ send("err "+e); }
 }});
 Interceptor.attach(b.add(0xd9086e),{onEnter:function(){send("--> LinkInventory");}});
 Interceptor.attach(b.add(0xd8c232),{onEnter:function(){send("--> LoadInventoryItem");}});
 send("__ready"); return true; }
if(!ins()){ var iv=setInterval(function(){ if(ins()) clearInterval(iv); },120); }
"""
subprocess.run([ADB,"shell","am","force-stop","se.foglo.svt"])
dev=frida.get_usb_device(timeout=10); pid=dev.spawn(["se.foglo.svt"])
s=dev.attach(pid); sc=s.create_script(JS); t0=time.time()
s.on("detached", lambda r,c=None: print("DETACH @%.1f %s"%(time.time()-t0,r),flush=True))
sc.on("message",lambda m,d: print("[%5.1f] %s"%(time.time()-t0,m.get("payload",m)),flush=True))
sc.load(); dev.resume(pid)
time.sleep(35)