import frida, time, subprocess
ADB="/opt/android-sdk/platform-tools/adb"
JS=r"""
function ins(){ var m=Process.findModuleByName("libil2cpp.so"); if(!m) return false;
 var b=m.base;
 var getInvItem=new NativeFunction(b.add(0x10288e1),'pointer',['pointer']); // OwnedRifle::get_inventoryItem(this)
 Interceptor.attach(b.add(0xd99193),{onEnter:function(a){
   try{ var self=a[0]; var Y=a[1];
     var lst=self.add(0x4c).readPointer();
     var cnt=lst.isNull()?-1:lst.add(0xc).readS32();
     var out="SER cnt="+cnt+" | Y="+Y;
     if(!Y.isNull()){ out+=" Ycomm="+Y.add(8).readPointer()+" Yamt="+Y.add(0xc).readS32(); }
     if(cnt>0){
       var arr=lst.add(8).readPointer();       // List._items
       var or0=arr.add(0x10).readPointer();    // elem0 = OwnedRifle
       var X=or0.add(8).readPointer();          // OwnedRifle.inventoryItem
       out+=" | OwnedRifle="+or0+" X="+X;
       if(!X.isNull()){ out+=" Xcomm="+X.add(8).readPointer()+" Xamt="+X.add(0xc).readS32(); }
       out+=" | X==Y? "+X.equals(Y);
     }
     send(out);
   }catch(e){ send("SER err "+e); }
 }});
 var ab=Process.findModuleByName("libc.so").findExportByName("abort");
 Interceptor.attach(ab,{onEnter:function(){send("*** ABORT ***");}});
 send("__ready"); return true; }
if(!ins()){ var iv=setInterval(function(){ if(ins()) clearInterval(iv); },120); }
"""
subprocess.run([ADB,"shell","am","force-stop","se.foglo.svt"])
dev=frida.get_usb_device(timeout=10); pid=dev.spawn(["se.foglo.svt"])
s=dev.attach(pid); sc=s.create_script(JS)
s.on("detached", lambda r,c=None: print("DETACH %s"%r,flush=True))
sc.on("message",lambda m,d: print(m.get("payload",m),flush=True))
sc.load(); dev.resume(pid); time.sleep(38)