#!/usr/bin/env python3
import frida, time, subprocess, sys
sys.path.insert(0,"/root/ants"); import emu
JS=r"""
function ins(){var m=Process.findModuleByName("libil2cpp.so");if(!m)return false;var b=m.base;
 function T(f){try{f();}catch(e){send({w:""+e});}}
 var dep=0,bp=0;
 T(function(){Interceptor.attach(b.add(0xd34fb9),{onEnter:function(){dep++;bp=0;send({g:"ENTER"});},onLeave:function(){dep--;send({g:"LEAVE bp="+bp});}});});
 T(function(){Interceptor.attach(b.add(0xd36166),{onEnter:function(){if(dep>0){bp++;send({g:"  build-persona #"+bp});}}});});
 T(function(){Interceptor.attach(b.add(0xd35759),{onEnter:function(){if(dep>0)send({g:"  loop2-exit"});}});});
 T(function(){Interceptor.attach(b.add(0xd357e1),{onEnter:function(){if(dep>0)send({g:"  TAIL"});}});});
 T(function(){Interceptor.attach(b.add(0xd358e6),{onEnter:function(){if(dep>0)send({g:"  CATCH"});}});});
 Process.setExceptionHandler(function(d){var a=d.address;var mm=Process.findModuleByAddress(a);var loc=mm?mm.name+"+0x"+a.sub(mm.base).toString(16):""+a;var bt="";try{bt=Thread.backtrace(d.context,Backtracer.ACCURATE).slice(0,8).map(function(x){var m2=Process.findModuleByAddress(x);return m2&&m2.name=="libil2cpp.so"?"il+0x"+x.sub(m2.base).toString(16):(m2?m2.name:""+x);}).join(" ");}catch(e){}send({g:"*** SIGSEGV @"+loc+" bt="+bt});return false;});
 send({g:"__ready"});return true;}
if(!ins()){var iv=setInterval(function(){if(ins())clearInterval(iv);},120);}
"""
t=emu.launch_to_menu()
print(f"[menu ready in {t}s]",flush=True)
emu.tap(700,730); time.sleep(4)  # SNIPER -> loadout
dev=frida.get_usb_device(timeout=10)
pid=int(subprocess.run([emu.ADB,"shell","pidof","se.foglo.svt"],capture_output=True,text=True).stdout.split()[0])
s=dev.attach(pid); sc=s.create_script(JS)
sc.on("message",lambda m,d: print(m.get("payload",m),flush=True)); sc.load(); time.sleep(1)
print("[GO]",flush=True)
emu.tap(1355,970); time.sleep(3); emu.tap(1355,970); time.sleep(22)
print("=== done ===",flush=True)