#!/usr/bin/env python3
import frida, time, subprocess
ADB="/opt/android-sdk/platform-tools/adb"
JS=r"""
function hexb(p,n){try{var u=new Uint8Array(p.readByteArray(n));return Array.prototype.map.call(u,function(x){return ('0'+x.toString(16)).slice(-2);}).join('');}catch(e){return "<e>";}}
function asc(p,n){try{var u=new Uint8Array(p.readByteArray(n));var s="";for(var i=0;i<u.length;i++){var c=u[i];s+=(c>=32&&c<127)?String.fromCharCode(c):".";}return s;}catch(e){return "";}}
function ins(){var lc=Process.findModuleByName("libc.so");if(!lc)return false;
 var b=Process.findModuleByName("libil2cpp.so");
 function T(f){try{f();}catch(e){send({w:""+e});}}
 var pfd={};  // photon socket fds (connecting to :5058)
 T(function(){Interceptor.attach(lc.findExportByName("connect"),{onEnter:function(a){try{var sa=a[1];if(sa.readU16()==2){var port=(sa.add(2).readU8()<<8)|sa.add(3).readU8();if(port==5058){pfd[a[0].toInt32()]=1;send({g:"[photon fd "+a[0].toInt32()+" -> :5058]"});}}}catch(e){}}});});
 function dump(tag,fd,buf,n){ if(!pfd[fd])return; if(n<=0||n>4000)return;
   send({g:tag+" fd="+fd+" n="+n+" | "+asc(buf,Math.min(n,80))+" | "+hexb(buf,Math.min(n,64))}); }
 ["write","send"].forEach(function(fn){var e=lc.findExportByName(fn);if(e)T(function(){Interceptor.attach(e,{onEnter:function(a){dump(fn,a[0].toInt32(),a[1],a[2].toInt32());}});});});
 var sendto=lc.findExportByName("sendto"); if(sendto)T(function(){Interceptor.attach(sendto,{onEnter:function(a){dump("sendto",a[0].toInt32(),a[1],a[2].toInt32());}});});
 // also capture reads on those fds (server->client)
 ["read","recv"].forEach(function(fn){var e=lc.findExportByName(fn);if(e)T(function(){Interceptor.attach(e,{onEnter:function(a){this.fd=a[0].toInt32();this.buf=a[1];},onLeave:function(r){var n=r.toInt32();if(this.fd&&pfd[this.fd]&&n>0&&n<4000)send({g:"RECV fd="+this.fd+" n="+n+" | "+asc(this.buf,Math.min(n,80))});}});});});
 // Count guard so flow reaches Connect
 if(b){T(function(){var addr=b.add(0x11f1032);var orig=new NativeFunction(addr,'int',['pointer','pointer','pointer']);Interceptor.replace(addr,new NativeCallback(function(src,pred,mi){if(src.isNull())return 0;try{return orig(src,pred,mi);}catch(e){return 0;}},'int',['pointer','pointer','pointer']));});}
 send({g:"__ready"});return true;}
if(!ins()){var iv=setInterval(function(){if(ins())clearInterval(iv);},120);}
"""
subprocess.run([ADB,"shell","am","force-stop","se.foglo.svt"]); time.sleep(3)
subprocess.run([ADB,"shell","monkey","-p","se.foglo.svt","-c","android.intent.category.LAUNCHER","1"],stdout=-3,stderr=-3)
time.sleep(8)
dev=frida.get_usb_device(timeout=10)
pid=int(subprocess.run([ADB,"shell","pidof","se.foglo.svt"],capture_output=True,text=True).stdout.split()[0])
s=dev.attach(pid); sc=s.create_script(JS)
sc.on("message",lambda m,d: print(m.get("payload",m),flush=True)); sc.load(); time.sleep(34)
for c in [("690","730"),("690","730"),("1350","960"),("1350","960")]:
    subprocess.run([ADB,"shell","input","tap",c[0],c[1]]); time.sleep(4)
time.sleep(14); print("=== done ===",flush=True)