import frida, subprocess, time
ADB="/opt/android-sdk/platform-tools/adb"
pid=int(subprocess.run([ADB,"shell","pidof","se.foglo.svt"],capture_output=True,text=True).stdout.split()[0])
print("attaching to pid",pid,flush=True)
JS=r"""
var B=Process.findModuleByName("libil2cpp.so").base;
var dumped=0, mcCalls=0, mcTrue=0;
// hook the per-item role read (e4be5a: movzx eax,[esi+0xd0]); esi = current roster item
Interceptor.attach(B.add(0xe4be5a),{onEnter:function(){
  if(dumped<12){ var item=this.context.esi;
    try{ var role=item.add(0xd0).readU8(); var e4=item.add(0xe4).readS32();
      send({g:"item="+item+" role[+0xd0]="+role+" [+0xe4]="+e4}); }catch(e){ send({g:"rd err "+e}); }
    dumped++; }
}});
Interceptor.attach(B.add(0xd6fede),{onLeave:function(r){ mcCalls++; if(r.toInt32())mcTrue++; }});
setTimeout(function(){ send({g:"5s: isMasterClient calls="+mcCalls+" true="+mcTrue}); },5000);
send({g:"probe live"});
"""
dev=frida.get_usb_device(timeout=10)
s=dev.attach(pid); sc=s.create_script(JS)
sc.on("message",lambda m,d: print(m.get("payload",{}).get("g",""),flush=True) if isinstance(m.get("payload"),dict) else print("MSG",m,flush=True))
sc.load(); time.sleep(7)
print("done",flush=True)