import frida, time, subprocess
ADB="/opt/android-sdk/platform-tools/adb"
JS=r"""
function ins(){var m=Process.findModuleByName("libil2cpp.so");if(!m)return false;var b=m.base;
 function T(f){try{f();}catch(e){send({warn:""+e});}}
 // THREE STATIC BYTE-PATCHES (no hooks)
 T(function(){Memory.patchCode(b.add(0x244e93),9,function(c){c.writeByteArray([0xb8,0x02,0x00,0x00,0x00,0x90,0x90,0x90,0x90]);});}); // playButtonMode->2
 T(function(){Memory.patchCode(b.add(0xfc9cfb),6,function(c){c.writeByteArray([0x90,0x90,0x90,0x90,0x90,0x90]);});}); // nop dir72 jne
 T(function(){Memory.patchCode(b.add(0xe9ea40),1,function(c){c.writeByteArray([0xc3]);});}); // SignalUnlocksToTutorial ret
 send({info:"3 static patches applied"});
 var seen={};
 [[0xea27d3,"OnSelectSniperMode"],[0xfc9bb9,"RequestChangeFeState"],[0xfcc12a,"ChangeState"],[0xd31a4f,"Matchmaking.Initiate"],[0xd30e76,"Matchmaking.OnInitiate"]].forEach(function(x){T(function(){Interceptor.attach(b.add(x[0]),{onEnter:function(){if(!seen[x[1]]){seen[x[1]]=1;send({info:"CHAIN "+x[1]});}}});});});
 T(function(){var ab=Process.findModuleByName("libc.so").findExportByName("abort");Interceptor.attach(ab,{onEnter:function(){send({info:"*** ABORT"});}});});
 send({info:"__ready"});return true;}
if(!ins()){var iv=setInterval(function(){if(ins())clearInterval(iv);},120);}
"""
subprocess.run([ADB,"shell","am","force-stop","se.foglo.svt"])
dev=frida.get_usb_device(timeout=10); pid=dev.spawn(["se.foglo.svt"])
s=dev.attach(pid); sc=s.create_script(JS); t0=time.time()
sc.on("message",lambda m,d: print("[%5.1f] %s"%(time.time()-t0,m.get("payload",m)),flush=True))
sc.load(); dev.resume(pid)
# wait for menu, tap SNIPER, then GO
time.sleep(30)
print("=== tap SNIPER ===",flush=True); subprocess.run([ADB,"shell","input","tap","690","730"]); time.sleep(5)
print("=== tap GO ===",flush=True); subprocess.run([ADB,"shell","input","tap","1350","960"]); time.sleep(15)
subprocess.run([ADB,"shell","screencap","-p","/sdcard/sv.png"]); subprocess.run([ADB,"pull","/sdcard/sv.png","/root/ants/staticverify.png"],stdout=-3,stderr=-3)