#!/usr/bin/env python3
import frida, time, subprocess
ADB="/opt/android-sdk/platform-tools/adb"
JS=r"""
function hex(p,n){try{var b=p.readByteArray(n);return Array.prototype.map.call(new Uint8Array(b),function(x){return ('0'+x.toString(16)).slice(-2);}).join('');}catch(e){return "<e>";}}
function arr(p){ // il2cpp byte[]: length @ +0xc, data @ +0x10
  try{var len=p.add(0xc).readS32(); if(len<0||len>2000)return {n:len,h:"?"}; return {n:len,h:hex(p.add(0x10),Math.min(len,200))};}catch(e){return {n:-1,h:"<e>"};}}
function ins(){var m=Process.findModuleByName("libil2cpp.so");if(!m)return false;var b=m.base;
 function T(f){try{f();}catch(e){send({w:""+e});}}
 // Protocol16::SerializeOperationRequest(stream, opCode, Dictionary params, bool)
 T(function(){Interceptor.attach(b.add(0x604264),{onEnter:function(a){send({g:"SerOpReq opCode="+a[2].toInt32()});}});});
 // TPeer::EnqueueOperation - opcode is an arg
 T(function(){Interceptor.attach(b.add(0x61203a),{onEnter:function(a){try{send({g:"EnqueueOperation a2(op)="+a[2].toInt32()});}catch(e){}}});});
 // TPeer::SerializeOperationToMessage -> returns byte[]
 T(function(){Interceptor.attach(b.add(0x612750),{onLeave:function(r){if(!r.isNull()){var d=arr(r);send({g:"SerOpToMsg -> bytes["+d.n+"] "+d.h});}}});});
 // TPeer::SendData(this, byte[], length)
 T(function(){Interceptor.attach(b.add(0x611b94),{onEnter:function(a){var d=arr(a[1]);send({g:"SendData bytes["+d.n+"] "+d.h});}});});
 // SocketTcp::Send
 T(function(){Interceptor.attach(b.add(0x60b4fa),{onEnter:function(a){var d=arr(a[1]);send({g:"SocketTcp.Send ["+d.n+"] "+d.h});}});});
 T(function(){Interceptor.attach(b.add(0x60b194),{onEnter:function(){send({g:"SocketTcp.Connect"});}});});
 T(function(){Interceptor.attach(b.add(0x60be4a),{onEnter:function(){send({g:"SocketTcp.DnsAndConnect"});}});});
 send({g:"__ready"});return true;}
if(!ins()){var iv=setInterval(function(){if(ins())clearInterval(iv);},120);}
"""
subprocess.run([ADB,"shell","am","force-stop","se.foglo.svt"]); time.sleep(3)
subprocess.run([ADB,"shell","monkey","-p","se.foglo.svt","-c","android.intent.category.LAUNCHER","1"],stdout=-3,stderr=-3)
time.sleep(8)
dev=frida.get_usb_device(timeout=10)
pid=int(subprocess.run([ADB,"shell","pidof","se.foglo.svt"],capture_output=True,text=True).stdout.split()[0])
s=dev.attach(pid); sc=s.create_script(JS)
sc.on("message",lambda m,d: print(m.get("payload",m),flush=True)); sc.load(); time.sleep(36)
for c in [("690","730"),("690","730"),("1350","960"),("1350","960")]:
    subprocess.run([ADB,"shell","input","tap",c[0],c[1]]); time.sleep(4)
time.sleep(12); print("=== done ===",flush=True)