import frida, time, subprocess, sys
sys.path.insert(0,"/root/ants"); import emu
JS=r"""
function E(n){return Module.findExportByName("libil2cpp.so",n);}
var domain_get=new NativeFunction(E("il2cpp_domain_get"),'pointer',[]);
var dga=new NativeFunction(E("il2cpp_domain_get_assemblies"),'pointer',['pointer','pointer']);
var asm_img=new NativeFunction(E("il2cpp_assembly_get_image"),'pointer',['pointer']);
var cfn=new NativeFunction(E("il2cpp_class_from_name"),'pointer',['pointer','pointer','pointer']);
var onew=new NativeFunction(E("il2cpp_object_new"),'pointer',['pointer']);
var oinit=new NativeFunction(E("il2cpp_runtime_object_init"),'void',['pointer']);
var gmn=new NativeFunction(E("il2cpp_class_get_method_from_name"),'pointer',['pointer','pointer','int']);
var rinv=new NativeFunction(E("il2cpp_runtime_invoke"),'pointer',['pointer','pointer','pointer','pointer']);
var img_name=new NativeFunction(E("il2cpp_image_get_name"),'pointer',['pointer']);

function findClass(ns,nm){
 var dom=domain_get();var cnt=Memory.alloc(8);var arr=dga(dom,cnt);var n=cnt.readU32();
 var nsp=Memory.allocUtf8String(ns),nmp=Memory.allocUtf8String(nm);
 for(var i=0;i<n;i++){var asm=arr.add(i*Process.pointerSize).readPointer();var img=asm_img(asm);
  var k=cfn(img,nsp,nmp); if(!k.isNull())return k;}
 return ptr(0);
}
function hook(b){
 function H(a,nm){try{Interceptor.attach(b.add(a),{onEnter:function(){send({g:"HIT "+nm});}});}catch(e){}}
 H(0xe47cab,"GC.Awake");H(0xe4bd6a,"SpawnPlayers");H(0xd3df1a,"DoleCoro");
 H(0xd85fc5,"CreateMatch");H(0xd86224,"CreateMatch.coro");H(0x7947d4,"LoadSceneAsync");
}
function main(){
 var m=Process.findModuleByName("libil2cpp.so");if(!m){setTimeout(main,200);return;}
 var b=m.base; hook(b);
 var k=findClass("","PIERole");
 send({g:"PIERole class="+k});
 if(k.isNull()){send({g:"NO PIERole CLASS"});return;}
 // list candidate methods
 ["CreateMatch","OnSelectSniper","OnSelectThief","Start","Awake"].forEach(function(nm){
   for(var ac=0;ac<3;ac++){var mth=gmn(k,Memory.allocUtf8String(nm),ac); if(!mth.isNull()){send({g:"method "+nm+"("+ac+") @"+mth.add(0).readPointer());break;}}
 });
 // allocate a PIERole and try to start a match
 var obj=onew(k); try{oinit(obj);}catch(e){}
 send({g:"obj="+obj});
 var exc=Memory.alloc(Process.pointerSize);
 ["OnSelectSniper","CreateMatch"].forEach(function(nm){
   var mth=gmn(k,Memory.allocUtf8String(nm),0);
   if(mth.isNull()){send({g:nm+" not found argc0"});return;}
   exc.writePointer(ptr(0));
   try{ send({g:"invoking "+nm}); rinv(mth,obj,ptr(0),exc);
     var e=exc.readPointer(); send({g:nm+" returned exc="+(e.isNull()?"none":e));
   }catch(err){send({g:nm+" threw "+err});}
 });
}
main();
"""
t=emu.launch_to_menu(); print("menu",int(t) if t else "FAIL",flush=True)
dev=frida.get_usb_device(timeout=10)
pid=int(subprocess.run([emu.ADB,"shell","pidof","se.foglo.svt"],capture_output=True,text=True).stdout.split()[0])
s=dev.attach(pid); sc=s.create_script(JS)
sc.on("message",lambda m,d: print(m.get("payload",{}).get("g",""),flush=True) if isinstance(m.get("payload"),dict) else print("MSG",m,flush=True))
sc.load(); time.sleep(2)
emu.tap(700,730); time.sleep(3)   # select sniper to init the menu context
sc.post({}) if False else None
time.sleep(25)
try: emu.screenshot(); import shutil; shutil.copy("/root/ants/_emu.png","/root/ants/piestate.png"); print("shot saved",flush=True)
except Exception as e: print("shot err",e,flush=True)
print("done",flush=True)