#!/usr/bin/env python3
import frida, time, subprocess
ADB="/opt/android-sdk/platform-tools/adb"
JS=r"""
function rs(p){try{if(p.isNull())return "null";var l=p.add(8).readS32();if(l<0||l>400)return "<l"+l+">";return p.add(0xc).readUtf16String(l);}catch(e){return "<e>";}}
function ins(){var m=Process.findModuleByName("libil2cpp.so");if(!m)return false;var b=m.base;
 function T(f){try{f();}catch(e){send({w:""+e});}}
 T(function(){Interceptor.attach(b.add(0xd708c4),{onEnter:function(){send({g:"PhotonNetwork.ConnectUsingSettings"});}});});
 T(function(){Interceptor.attach(b.add(0x1009bc0),{onEnter:function(){send({g:"NetworkingPeer.ConnectToNameServer"});}});});
 T(function(){Interceptor.attach(b.add(0x1009cfe),{onEnter:function(){send({g:"NetworkingPeer.ConnectToRegionMaster"});}});});
 T(function(){Interceptor.attach(b.add(0xd6c1e0),{onEnter:function(){send({g:"PhotonHandler.PingRegionsAndConnectBest"});}});});
 T(function(){Interceptor.attach(b.add(0x5fcd0c),{onEnter:function(a){send({g:"PepareWebSocketUrl -> (building url)"});},onLeave:function(r){send({g:"   url="+rs(r)});}});});
 T(function(){Interceptor.attach(b.add(0x8ec388),{onEnter:function(a){send({g:"WebSocket.ctor url="+rs(a[1])});}});});
 T(function(){Interceptor.attach(b.add(0x8f2dcc),{onEnter:function(){send({g:"WebSocket.Connect()"});}});});
 T(function(){Interceptor.attach(b.add(0x8ef884),{onEnter:function(){send({g:"WebSocket.createHandshakeRequest"});}});});
 T(function(){Interceptor.attach(b.add(0x8e4b06),{onLeave:function(r){send({g:"defaultValidateServerCertificate -> "+r.toInt32()});}});});
 T(function(){Interceptor.attach(b.add(0x8f1b28),{onEnter:function(a){send({g:"WS.send (outgoing frame)"});}});});
 var lc=Process.findModuleByName("libc.so");
 T(function(){Interceptor.attach(lc.findExportByName("connect"),{onEnter:function(a){try{var sa=a[1];var fam=sa.readU16();if(fam==2){var port=(sa.add(2).readU8()<<8)|sa.add(3).readU8();var ip=sa.add(4).readU8()+"."+sa.add(5).readU8()+"."+sa.add(6).readU8()+"."+sa.add(7).readU8();if(port!=39100)send({g:"connect->"+ip+":"+port});}}catch(e){}}});});
 send({g:"__ready"});return true;}
if(!ins()){var iv=setInterval(function(){if(ins())clearInterval(iv);},120);}
"""
subprocess.run([ADB,"shell","am","force-stop","se.foglo.svt"]); time.sleep(3)
subprocess.run([ADB,"shell","monkey","-p","se.foglo.svt","-c","android.intent.category.LAUNCHER","1"],stdout=-3,stderr=-3)
time.sleep(8)
dev=frida.get_usb_device(timeout=10)
pid=int(subprocess.run([ADB,"shell","pidof","se.foglo.svt"],capture_output=True,text=True).stdout.split()[0])
s=dev.attach(pid); sc=s.create_script(JS)
sc.on("message",lambda m,d: print(m.get("payload",m),flush=True)); sc.load(); time.sleep(36)
for c in [("690","730"),("690","730"),("1350","960"),("1350","960")]:
    subprocess.run([ADB,"shell","input","tap",c[0],c[1]]); time.sleep(4)
time.sleep(12); print("=== done ===",flush=True)