import frida, subprocess, time
ADB="/opt/android-sdk/platform-tools/adb"
pid=int(subprocess.run([ADB,"shell","pidof","se.foglo.svt"],capture_output=True,text=True).stdout.split()[0])
print("attaching to pid",pid,flush=True)
JS=r"""
var B=Process.findModuleByName("libil2cpp.so").base;
function E(n){return B.add(0);} // placeholder
var m=Process.findModuleByName("libil2cpp.so");
var getClass=new NativeFunction(m.findExportByName("il2cpp_object_get_class"),'pointer',['pointer']);
var clsName=new NativeFunction(m.findExportByName("il2cpp_class_get_name"),'pointer',['pointer']);
var clsNs=new NativeFunction(m.findExportByName("il2cpp_class_get_namespace"),'pointer',['pointer']);
var dumped=0;
Interceptor.attach(B.add(0xe4be5a),{onEnter:function(){
  if(dumped<3){ var item=this.context.esi;
    try{
      var k=getClass(item); var nm=clsName(k).readUtf8String(); var ns=clsNs(k).readUtf8String();
      var fields="";
      for(var off=0xc8; off<=0xf0; off+=4){ fields += " +0x"+off.toString(16)+"="+item.add(off).readS32(); }
      send({g:"item="+item+" class="+ns+"."+nm+" fields:"+fields});
    }catch(e){ send({g:"err "+e}); }
    dumped++;
  }
}});
send({g:"probe live"});
"""
dev=frida.get_usb_device(timeout=10)
s=dev.attach(pid); sc=s.create_script(JS)
sc.on("message",lambda m,d: print(m.get("payload",{}).get("g",""),flush=True) if isinstance(m.get("payload"),dict) else print("MSG",m,flush=True))
sc.load(); time.sleep(5)
print("done",flush=True)