#!/usr/bin/env python3
import frida, time, subprocess
ADB="/opt/android-sdk/platform-tools/adb"
JS=r"""
function rs(p){try{if(p.isNull())return "null";var l=p.add(8).readS32();if(l<0||l>200)return "<l>";return p.add(0xc).readUtf16String(l);}catch(e){return "<e>";}}
function ins(){var m=Process.findModuleByName("libil2cpp.so");if(!m)return false;var b=m.base;
 function T(f){try{f();}catch(e){send({w:""+e});}}
 // ebx=0x1df6b7c. field-name GOT slots compared in DecodeResponse loop:
 var slots={"0x67a1c":0x1e5e598,"0x63d30":0x1e5a8ac,"0x67a44":0x1e5e5c0,"0x60b48":0x1e576c4,"0x67a20(EAGAIN)":0x1e5e59c,"0x608d4(fmt)":0x1e5f450};
 var done=false;
 T(function(){Interceptor.attach(b.add(0xd34fb9),{onEnter:function(){ if(done)return; done=true;
   for(var k in slots){ try{var s=b.add(slots[k]).readPointer(); send({g:"KEY "+k+" = "+JSON.stringify(rs(s))});}catch(e){send({g:"KEY "+k+" err "+e});} }
 }});});
 send({g:"__ready"});return true;}
if(!ins()){var iv=setInterval(function(){if(ins())clearInterval(iv);},120);}
"""
subprocess.run([ADB,"shell","am","force-stop","se.foglo.svt"]); time.sleep(3)
subprocess.run([ADB,"shell","monkey","-p","se.foglo.svt","-c","android.intent.category.LAUNCHER","1"],stdout=-3,stderr=-3)
time.sleep(43)
subprocess.run([ADB,"shell","input","tap","700","730"]); time.sleep(3)
subprocess.run([ADB,"shell","input","tap","700","730"]); time.sleep(4)
dev=frida.get_usb_device(timeout=10)
pid=int(subprocess.run([ADB,"shell","pidof","se.foglo.svt"],capture_output=True,text=True).stdout.split()[0])
s=dev.attach(pid); sc=s.create_script(JS)
sc.on("message",lambda m,d: print(m.get("payload",m),flush=True)); sc.load(); time.sleep(1)
subprocess.run([ADB,"shell","input","tap","1355","970"]); time.sleep(3)
subprocess.run([ADB,"shell","input","tap","1355","970"]); time.sleep(14)
print("=== done ===",flush=True)