import frida, time, subprocess
ADB="/opt/android-sdk/platform-tools/adb"
JS=r"""
function scanStr(p){ var out=[]; for(var o=8;o<=0x48;o+=4){ try{ var q=p.add(o).readPointer(); if(!q.isNull()){ var l=q.add(8).readS32(); if(l>0&&l<40){ var s=q.add(0xc).readUtf16String(l); if(s&&/^[\x20-\x7e]+$/.test(s)) out.push("+0x"+o.toString(16)+"='"+s+"'"); } } }catch(e){} } return out.join(" "); }
function ins(){ var m=Process.findModuleByName("libil2cpp.so"); if(!m) return false; var b=m.base;
 Interceptor.attach(b.add(0xd99193),{onEnter:function(a){
   try{ var self=a[0], Y=a[1]; var lst=self.add(0x4c).readPointer(); var cnt=lst.add(0xc).readS32();
     var arr=lst.add(8).readPointer(); var or0=arr.add(0x10).readPointer(); var X=or0.add(8).readPointer();
     var Xc=X.add(8).readPointer(), Yc=Y.add(8).readPointer();
     send("Y-item strs: "+scanStr(Y));
     send("Y-commodity strs: "+scanStr(Yc));
     send("X-item strs: "+scanStr(X));
     send("X-commodity strs: "+scanStr(Xc));
     send("equipped-key [profile+0x15c]: "+scanStr(self.add(0x150)));  // scan around 0x15c
   }catch(e){ send("err "+e); }
 }});
 send("__ready"); return true; }
if(!ins()){ var iv=setInterval(function(){ if(ins()) clearInterval(iv); },120); }
"""
subprocess.run([ADB,"shell","am","force-stop","se.foglo.svt"])
dev=frida.get_usb_device(timeout=10); pid=dev.spawn(["se.foglo.svt"])
s=dev.attach(pid); sc=s.create_script(JS)
sc.on("message",lambda m,d: print(m.get("payload",m),flush=True))
sc.load(); dev.resume(pid); time.sleep(38)