#!/usr/bin/env python3
import frida, time, subprocess, sys
ADB="/opt/android-sdk/platform-tools/adb"
JS=r"""
var GC=null,CN=null;
function ins(){var m=Process.findModuleByName("libil2cpp.so");if(!m)return false;var b=m.base;
 function T(f){try{f();}catch(e){send({w:""+e});}}
 GC=new NativeFunction(b.add(0xbc7128),'pointer',['pointer']);
 CN=new NativeFunction(b.add(0xbc61fc),'pointer',['pointer']);
 function cname(o){try{var k=GC(o);var p=CN(k);return p.readUtf8String();}catch(e){return "?";}}
 function rs(p){try{var l=p.add(8).readS32();if(l<0||l>200)return null;return p.add(0xc).readUtf16String(l);}catch(e){return null;}}
 function desc(p){ if(p.isNull())return "null"; var c=cname(p); var v="";
   if(c=="String"){v=" = "+JSON.stringify(rs(p));}
   else if(c=="Int32"||c=="Int64"||c=="Boolean"||c=="Single"||c=="Double"){try{v=" = "+p.add(8).readS32();}catch(e){}}
   else { try{var hx=[];for(var i=0;i<0x20;i+=4)hx.push(p.add(i).readU32().toString(16));v=" ["+hx.join(" ")+"]";}catch(e){} }
   return c+v; }
 function clsN(kp){try{var p=CN(kp);return p.readUtf8String();}catch(e){return "?";}}
 T(function(){Interceptor.attach(b.add(0xd34fb9),{onEnter:function(a){
   var recv=a[2]; send({g:"== DecodeResponse recv cls="+cname(recv)});
   try{ var exp=b.add(0x1e41430).readPointer(); var fc=b.add(0x1e44264).readPointer();
        send({g:"  EXPECT loop-class="+(exp.isNull()?"null":clsN(exp))+" firstcheck-class="+(fc.isNull()?"null":clsN(fc))}); }catch(e){send({g:"  clserr "+e});}
   try{var items=recv.add(8).readPointer();var cnt=recv.add(0xc).readS32();
     send({g:"  count="+cnt});
     for(var i=0;i<cnt&&i<50;i++){var el=items.add(0x10+i*4).readPointer();send({g:"   tok["+i+"] "+desc(el)});}
   }catch(e){send({g:"  err "+e});}
 }});});
 T(function(){Interceptor.attach(b.add(0x13a1ff6),{onEnter:function(a){this.o=a[0];this.i=a[2].toInt32();},onLeave:function(){try{var n=this.o.add(4).readPointer();send({g:"  GET6 idx="+this.i+" out0="+this.o.readU32()+" -> "+(n.isNull()?"null":desc(n))});}catch(e){}}});});
 T(function(){var ab=Process.findModuleByName("libc.so").findExportByName("abort");Interceptor.attach(ab,{onEnter:function(){var bt=Thread.backtrace(this.context,Backtracer.ACCURATE).slice(0,12).map(function(a){var mm=Process.findModuleByAddress(a);return mm&&mm.name=="libil2cpp.so"?"il+0x"+a.sub(mm.base).toString(16):(mm?mm.name:""+a);}).join(" ");send({g:"*** ABORT "+bt});}});});
 send({g:"__ready"});return true;}
if(!ins()){var iv=setInterval(function(){if(ins())clearInterval(iv);},120);}
"""
subprocess.run([ADB,"shell","am","force-stop","se.foglo.svt"]); time.sleep(3)
subprocess.run([ADB,"shell","monkey","-p","se.foglo.svt","-c","android.intent.category.LAUNCHER","1"],stdout=-3,stderr=-3)
time.sleep(44)
dev=frida.get_usb_device(timeout=10)
pid=int(subprocess.run([ADB,"shell","pidof","se.foglo.svt"],capture_output=True,text=True).stdout.split()[0])
s=dev.attach(pid); sc=s.create_script(JS)
sc.on("message",lambda m,d: print(m.get("payload",m),flush=True)); sc.load(); time.sleep(1)
for c in [("690","730"),("690","730"),("1350","960"),("1350","960")]:
    subprocess.run([ADB,"shell","input","tap",c[0],c[1]]); time.sleep(4)
time.sleep(6); print("=== done ===",flush=True)