#!/usr/bin/env python3
import frida, time, subprocess
ADB="/opt/android-sdk/platform-tools/adb"
JS=r"""
var CN=null,GC=null;
function cn(p){try{if(p.isNull())return "NULL";var k=GC(p);return CN(k).readUtf8String();}catch(e){return "?";}}
function rs(p){try{if(p.isNull())return null;var l=p.add(8).readS32();if(l<0||l>400)return null;return p.add(0xc).readUtf16String(l);}catch(e){return null;}}
function ins(){var m=Process.findModuleByName("libil2cpp.so");if(!m)return false;var b=m.base;
 function T(f){try{f();}catch(e){send({w:""+e});}}
 GC=new NativeFunction(b.add(0xbc7128),'pointer',['pointer']);
 CN=new NativeFunction(b.add(0xbc61fc),'pointer',['pointer']);
 var inDecode=false;
 T(function(){Interceptor.attach(b.add(0xd34fb9),{onEnter:function(){inDecode=true;},onLeave:function(){inDecode=false;}});});
 // per-persona builder
 T(function(){Interceptor.attach(b.add(0xd36166),{onEnter:function(a){send({g:"BuildPersona a2(str)="+JSON.stringify(rs(a[2]))+" a1="+JSON.stringify(rs(a[1]))});}});});
 // il2cpp_raise_exception(ex) - capture during decode
 T(function(){Interceptor.attach(b.add(0xbc68b8),{onEnter:function(a){ if(!inDecode)return; var ex=a[0]; var cls=cn(ex); var msg=null; try{msg=rs(ex.add(0x40).readPointer());}catch(e){} var bt=Thread.backtrace(this.context,Backtracer.ACCURATE).slice(0,6).map(function(x){var mm=Process.findModuleByAddress(x);return mm&&mm.name=="libil2cpp.so"?"il+0x"+x.sub(mm.base).toString(16):""+x;}).join(" "); send({g:"*** EXC in decode: "+cls+" msg="+JSON.stringify(msg)+" @ "+bt}); }});});
 send({g:"__ready"});return true;}
if(!ins()){var iv=setInterval(function(){if(ins())clearInterval(iv);},120);}
"""
subprocess.run([ADB,"shell","am","force-stop","se.foglo.svt"]); time.sleep(3)
subprocess.run([ADB,"shell","monkey","-p","se.foglo.svt","-c","android.intent.category.LAUNCHER","1"],stdout=-3,stderr=-3)
time.sleep(42)
subprocess.run([ADB,"shell","input","tap","700","730"]); time.sleep(5)
dev=frida.get_usb_device(timeout=10)
pid=int(subprocess.run([ADB,"shell","pidof","se.foglo.svt"],capture_output=True,text=True).stdout.split()[0])
s=dev.attach(pid); sc=s.create_script(JS)
sc.on("message",lambda m,d: print(m.get("payload",m),flush=True)); sc.load(); time.sleep(1)
subprocess.run([ADB,"shell","input","tap","1355","970"]); time.sleep(20)
print("=== done ===",flush=True)