import json,sys,time,subprocess,frida
ADB="/opt/android-sdk/platform-tools/adb"
A=json.load(open("/root/ants/sid_addr.json"))
# mirror the STATIC PATCHES (no sessionId force; use get_Ready=1 instead)
JS=r"""
var A=%s;
function ins(){var m=Process.findModuleByName("libil2cpp.so");if(!m)return false;var b=m.base;
send({m:"hooks in"});
// get_Ready -> 1  (== ARM get_Ready static patch)
Interceptor.attach(b.add(A["MA.get_Ready"]),{onLeave:function(rv){rv.replace(ptr(1));}});
// terms -> 1
["get_TermsAccepted","get_FacebookTermsAccepted"].forEach(function(k){if(A[k])Interceptor.attach(b.add(A[k]),{onLeave:function(rv){rv.replace(ptr(1));}});});
// Check25 noop
if(A["Check25RoundsPlayed"])Interceptor.replace(b.add(A["Check25RoundsPlayed"]),new NativeCallback(function(s){},'void',['pointer']));
// device-limit noop
["OnDeviceLimit","OnPlayingOnAnotherDevice","Core.OnPlayingOnAnotherDevice"].forEach(function(k){if(A[k])Interceptor.replace(b.add(A[k]),new NativeCallback(function(){},'void',['pointer','pointer']));});
// Core.ready field write at PC=9 (== ARM branch patch)
Interceptor.attach(b.add(0xfd1c2a),{onEnter:function(a){this.s=a[0];},onLeave:function(rv){
  try{if(this.s.add(0x3c).readS32()==9){var c=this.s.add(0x1c).readPointer();var msg=this.s.add(0x20).readPointer();
    if(c.add(0xa0).readU8()==0)c.add(0xa0).writeU8(1);
    if(msg.add(0x20).readU8()!=0)msg.add(0x20).writeU8(0);}}catch(e){}
}});
return true;}
if(!ins()){var iv=setInterval(function(){if(ins())clearInterval(iv);},150);}
""" % json.dumps(A)
dev=frida.get_device_manager().add_remote_device("127.0.0.1:27042")
subprocess.run([ADB,"shell","am","force-stop","se.foglo.svt"])
subprocess.run([ADB,"shell","monkey","-p","se.foglo.svt","-c","android.intent.category.LAUNCHER","1"],stdout=subprocess.DEVNULL,stderr=subprocess.DEVNULL)
pid=None
for _ in range(80):
    o=subprocess.run([ADB,"shell","pidof","se.foglo.svt"],capture_output=True,text=True).stdout.strip()
    if o:pid=int(o.split()[0]);break
    time.sleep(0.25)
print("pid",pid,flush=True)
s=dev.attach(pid);sc=s.create_script(JS)
sc.on("message",lambda m,d:print("[msg]",m.get("payload",m),flush=True))
sc.load();time.sleep(int(sys.argv[1]) if len(sys.argv)>1 else 400)