#!/usr/bin/env python3
import frida, time, subprocess
ADB="/opt/android-sdk/platform-tools/adb"
JS=r"""
var CN=null,GC=null;
function cn(p){try{if(p.isNull())return "NULL";var k=GC(p);return CN(k).readUtf8String();}catch(e){return "?";}}
function ins(){var m=Process.findModuleByName("libil2cpp.so");if(!m)return false;var b=m.base;
 function T(f){try{f();}catch(e){send({w:""+e});}}
 GC=new NativeFunction(b.add(0xbc7128),'pointer',['pointer']);
 CN=new NativeFunction(b.add(0xbc61fc),'pointer',['pointer']);
 // hook Count call site 0xd3c799: dump args + the Func delegate's method ptr
 T(function(){Interceptor.attach(b.add(0xd3c799),{onEnter:function(a){
   try{var sp=this.context.esp;
     var a0=sp.readPointer(),a1=sp.add(4).readPointer(),a2=sp.add(8).readPointer(),a3=sp.add(0xc).readPointer();
     send({g:"COUNT a0="+cn(a0)+" a1="+cn(a1)+" a2="+cn(a2)+" a3="+cn(a3)});
     // the Func delegate is a2 (from countargs). dump its fields to find method ptr
     if(!a2.isNull()){var fl=[];for(var i=8;i<0x2c;i+=4){fl.push("+0x"+i.toString(16)+"="+a2.add(i).readPointer());}send({g:"  Func fields: "+fl.join(" ")});}
     // Matchmaking instance = context edi? read this from the caller. Dump ebp (mm) fields
     var mm=this.context.ebp;
     send({g:"  mm(ebp)="+mm+" cls="+cn(mm)});
   }catch(e){send({g:"cerr "+e});}
 }});});
 // DecodeResponse return: retbuf at [esp+0x38] in OnResponse; hook DecodeResponse onLeave to see its struct
 T(function(){Interceptor.attach(b.add(0xd34fb9),{onEnter:function(a){this.rb=a[0];},onLeave:function(){try{send({g:"DecodeResp retstruct: "+[0,4,8,0xc,0x10].map(function(o){return this.rb.add(o).readPointer();},this).join(" ")});}catch(e){}}});});
 send({g:"__ready"});return true;}
if(!ins()){var iv=setInterval(function(){if(ins())clearInterval(iv);},120);}
"""
subprocess.run([ADB,"shell","am","force-stop","se.foglo.svt"]); time.sleep(3)
subprocess.run([ADB,"shell","monkey","-p","se.foglo.svt","-c","android.intent.category.LAUNCHER","1"],stdout=-3,stderr=-3)
time.sleep(42)
subprocess.run([ADB,"shell","input","tap","700","730"]); time.sleep(5)
dev=frida.get_usb_device(timeout=10)
pid=int(subprocess.run([ADB,"shell","pidof","se.foglo.svt"],capture_output=True,text=True).stdout.split()[0])
s=dev.attach(pid); sc=s.create_script(JS)
sc.on("message",lambda m,d: print(m.get("payload",m),flush=True)); sc.load(); time.sleep(1)
subprocess.run([ADB,"shell","input","tap","1355","970"]); time.sleep(20)
print("=== done ===",flush=True)