#!/usr/bin/env python3
import frida, time, subprocess
ADB="/opt/android-sdk/platform-tools/adb"
JS=r"""
function ins(){var m=Process.findModuleByName("libil2cpp.so");if(!m)return false;var b=m.base;
 function T(f){try{f();}catch(e){send({w:""+e});}}
 // Count guard so we reach Connect
 T(function(){var addr=b.add(0x11f1032);var orig=new NativeFunction(addr,'int',['pointer','pointer','pointer']);Interceptor.replace(addr,new NativeCallback(function(src,pred,mi){if(src.isNull())return 0;try{return orig(src,pred,mi);}catch(e){return 0;}},'int',['pointer','pointer','pointer']));});
 T(function(){Interceptor.attach(b.add(0x5f5784),{onEnter:function(){send({g:"ReceiveIncomingCommands (got UDP packet)"});}});});
 var ec=0;
 T(function(){Interceptor.attach(b.add(0x5f6e76),{onEnter:function(a){ec++;if(ec<40)send({g:"  ExecuteCommand #"+ec});}});});
 T(function(){Interceptor.attach(b.add(0x5efdea),{onEnter:function(){send({g:"  DispatchIncomingCommands"});}});});
 T(function(){Interceptor.attach(b.add(0x5fd898),{onEnter:function(a){send({g:"  DeserializeMessageAndCallback"});}});});
 T(function(){Interceptor.attach(b.add(0x5fd0e0),{onEnter:function(){send({g:"*** PeerBase.InitCallback (INIT DONE!)"});}});});
 T(function(){Interceptor.attach(b.add(0x1012c1a),{onEnter:function(a){try{send({g:">>> OnStatusChanged code="+a[1].toInt32()});}catch(e){send({g:">>> OnStatusChanged"});}}});});
 T(function(){Interceptor.attach(b.add(0x100ee8a),{onEnter:function(){send({g:">>> OnOperationResponse"});}});});
 send({g:"__ready"});return true;}
if(!ins()){var iv=setInterval(function(){if(ins())clearInterval(iv);},120);}
"""
subprocess.run([ADB,"shell","am","force-stop","se.foglo.svt"]); time.sleep(3)
subprocess.run([ADB,"shell","monkey","-p","se.foglo.svt","-c","android.intent.category.LAUNCHER","1"],stdout=-3,stderr=-3)
time.sleep(8)
dev=frida.get_usb_device(timeout=10)
pid=int(subprocess.run([ADB,"shell","pidof","se.foglo.svt"],capture_output=True,text=True).stdout.split()[0])
s=dev.attach(pid); sc=s.create_script(JS)
sc.on("message",lambda m,d: print(m.get("payload",m),flush=True)); sc.load(); time.sleep(34)
for c in [("690","730"),("690","730"),("1350","960"),("1350","960")]:
    subprocess.run([ADB,"shell","input","tap",c[0],c[1]]); time.sleep(4)
time.sleep(14); print("=== done ===",flush=True)