"""Scan libtngdigital_ewallet.so for SVC / exit patterns."""
from pathlib import Path
import struct

SO = Path(r"C:\Users\Administrator\Desktop\notiMessage\reverse\apks\tng\libtngdigital_ewallet.so")
if not SO.exists():
    # try from split apk
    import zipfile
    apk = Path(r"C:\Users\Administrator\Desktop\notiMessage\reverse\apks\tng\split_config.arm64_v8a.apk")
    if apk.exists():
        with zipfile.ZipFile(apk) as z:
            for n in z.namelist():
                if n.endswith("libtngdigital_ewallet.so"):
                    SO.write_bytes(z.read(n))
                    print("extracted from", apk, "->", SO)
                    break

data = SO.read_bytes()
print("size", len(data), SO)

svc = b"\x01\x00\x00\xd4"
idxs = []
start = 0
while True:
    i = data.find(svc, start)
    if i < 0:
        break
    idxs.append(i)
    start = i + 4
print("total svc#0:", len(idxs))

# movz x8,#93 = d2 80 0b a8 ; movz x8,#94 = d2 80 0b c8 (LE)
# bytes LE: A8 0B 80 D2 / C8 0B 80 D2
exit_setups = [
    (b"\xa8\x0b\x80\xd2", 93),  # movz x8, #93
    (b"\xc8\x0b\x80\xd2", 94),  # movz x8, #94
    (b"\xa8\x0b\x80\x52", 93),  # movz w8, #93
    (b"\xc8\x0b\x80\x52", 94),  # movz w8, #94
]
for pat, nr in exit_setups:
    c = data.count(pat)
    print(f"movz *8,#{nr} pattern count={c}")

print("\nSVC with nearby exit setup (lookback 32 bytes):")
hits = 0
for i in idxs[:2000]:
    window = data[max(0, i - 32) : i]
    for pat, nr in exit_setups:
        if pat in window:
            print(f"  off=0x{i:x} exit_group/exit via #{nr}")
            hits += 1
            break
print("hits", hits)

# also search brk
brk = b"\x00\x00\x20\xd4"  # brk #0
print("brk#0 count", data.count(brk))

# string refs
for s in [b"_exit", b"exit_group", b"abort", b"frida", b"/proc/self/maps", b"xposed"]:
    print(s, "->", data.find(s))