#!/usr/bin/env python3
import frida, time, subprocess
ADB="/opt/android-sdk/platform-tools/adb"
JS=r"""
function rs(p){try{if(p.isNull())return null;var l=p.add(8).readS32();if(l<0||l>200)return null;return p.add(0xc).readUtf16String(l);}catch(e){return null;}}
function clsname(o){try{var k=o.readPointer();var np=k.add(0x10).readPointer();return np.readUtf8String();}catch(e){return "?";}}
function dumpnode(p,depth){
  if(p.isNull())return "null";
  var out="";
  try{ out+="cls="+clsname(p); }catch(e){}
  try{ var t0=p.add(0).readU8(); }catch(e){}
  // dump first 0x20 bytes
  try{ var hx=[]; for(var i=0;i<0x24;i+=4){hx.push(p.add(i).readU32().toString(16));} out+=" ["+hx.join(" ")+"]"; }catch(e){}
  return out;
}
function ins(){var m=Process.findModuleByName("libil2cpp.so");if(!m)return false;var b=m.base;
 function T(f){try{f();}catch(e){send({w:""+e});}}
 T(function(){Interceptor.attach(b.add(0xd34fb9),{onEnter:function(a){
   var recv=a[2]; send({g:"== DecodeResponse recv="+recv});
   send({g:"  recv "+dumpnode(recv,0)});
   // if List<T>: items @ +8, count @ +0xc, elems at items+0x10+i*4
   try{ var items=recv.add(8).readPointer(); var cnt=recv.add(0xc).readS32();
        send({g:"  as-List count="+cnt+" items="+items});
        if(cnt>0&&cnt<40){ for(var i=0;i<cnt;i++){ var el=items.add(0x10+i*4).readPointer();
            send({g:"    ["+i+"] "+dumpnode(el,1)}); } }
   }catch(e){send({g:"  list-err "+e});}
 }});});
 T(function(){Interceptor.attach(b.add(0x13a1ff6),{onEnter:function(a){this.o=a[0];this.i=a[2].toInt32();},onLeave:function(){try{var node=this.o.add(4).readPointer();send({g:"  GET6 idx="+this.i+" out0=0x"+this.o.readU32().toString(16)+" node="+node+" "+dumpnode(node,1)});}catch(e){send({g:"GET6err "+e});}}});});
 T(function(){var ab=Process.findModuleByName("libc.so").findExportByName("abort");Interceptor.attach(ab,{onEnter:function(){send({g:"*** ABORT"});}});});
 send({g:"__ready"});return true;}
if(!ins()){var iv=setInterval(function(){if(ins())clearInterval(iv);},120);}
"""
subprocess.run([ADB,"shell","am","force-stop","se.foglo.svt"]); time.sleep(3)
subprocess.run([ADB,"shell","monkey","-p","se.foglo.svt","-c","android.intent.category.LAUNCHER","1"],stdout=-3,stderr=-3)
time.sleep(44)
dev=frida.get_usb_device(timeout=10)
pid=int(subprocess.run([ADB,"shell","pidof","se.foglo.svt"],capture_output=True,text=True).stdout.split()[0])
s=dev.attach(pid); sc=s.create_script(JS)
sc.on("message",lambda m,d: print(m.get("payload",m),flush=True)); sc.load(); time.sleep(1)
for c in [("690","730"),("690","730"),("1350","960"),("1350","960")]:
    subprocess.run([ADB,"shell","input","tap",c[0],c[1]]); time.sleep(4)
time.sleep(6); print("=== done ===",flush=True)