function S_Pointer(t_So, t_Offset, _bit)
	local function getRanges()
		local ranges = {}
		local t = gg.getRangesList('^/data/*.so*$')
		for i, v in pairs(t) do
			if v.type:sub(2, 2) == 'w' then
				table.insert(ranges, v)
			end
		end
		return ranges
	end
	local function Get_Address(N_So, Offset, ti_bit)
		local ti = gg.getTargetInfo()
		local S_list = getRanges()
		local t = {}
		local _t
		local _S = nil
		if ti_bit then
			_t = 32
		else
			_t = 4
		end
		for i in pairs(S_list) do
			local _N = S_list[i].internalName:gsub('^.*/', '')
			if N_So[1] == _N and N_So[2] == S_list[i].state then
				_S = S_list[i]
				break
			end
		end
		if _S then
			t[#t + 1] = {}
			t[#t].address = _S.start + Offset[1]
			t[#t].flags = _t
			if #Offset ~= 1 then
				for i = 2, #Offset do
					local S = gg.getValues(t)
					t = {}
					for _ in pairs(S) do
						if not ti.x64 then
							S[_].value = S[_].value & 0xFFFFFFFF
						end
						t[#t + 1] = {}
						t[#t].address = S[_].value + Offset[i]
						t[#t].flags = _t
					end
				end
			end
			_S = t[#t].address
		end
		return _S
	end
	local _A = string.format('0x%X', Get_Address(t_So, t_Offset, _bit))
	return _A
end
---静态配置
function XGBase(Address,AFV)
   local address=0
   for index,offset in ipairs(Address)do
      if index==1 then
         address=offset
      else
         address=gg.getValues({{address=address+offset,flags=4}})[1].value
      end
   end
   local Value,Freeze={},{}
   for index,value in ipairs(AFV)do
      local VALUE={address=address+value[3],flags=value[2],value=value[1],freeze=true}
      if value[4]then
         Freeze[#Freeze+1]=VALUE
      else
         Value[#Value+1]=VALUE
      end
   end
   gg.setValues(Value)
   gg.addListItems(Freeze)
end


function PS() end
function setvalue(address,flags,value) PS('修改地址数值(地址,数值类型,要修改的值)') local tt={} tt[1]={} tt[1].address=address tt[1].flags=flags tt[1].value=value gg.setValues(tt) end

draw.text("小宝",100,100)


local json =json
local g = {}
g.file = gg.getFile()
g.sel = nil
gqlb={"请先搜索歌曲",}
idb={"1010"}
SN,gc=1,nil
g.config = gg.getFile():gsub("%lua$", "").."cfg"
function bei()
	g.data = loadfile("-- WSG PRO 1.0.9(109)\n"..g.config)
	if g.data ~= nil then
		g.sel = g.data()
		g.data = nil
	end
	if g.sel == nil then
		g.sel = {"请输入歌曲名","10"}
	end
end
bei()
--搜索歌曲
function start(name,sl)
	fw=gg.makeRequest("http://music.163.com/api/search/get?s="..name.."&type=1&offset=0&total=true&limit="..sl)
	return fw
end
--歌词
--播放音乐
function play(id,name)
	gg.toast("正在播放音乐："..name,true)
	gg.playMusic("http://music.163.com/song/media/outer/url?id="..id..".mp3")
end
--停止播放
function stop()
	gg.toast("正在停止音乐")
	for i=1,100 do
		gg.playMusic("stop")
		gg.playMusic("stop")
		gg.playMusic("stop")
	end
end
----
function Play(gqlb,idb)
	SN = gg.choice(gqlb,nil,ts)
	if SN == nil then XGCK =-1 else
		sn=gg.choice({"播放歌曲","播放并下载"},nil,"歌曲："..gqlb[SN])
		if sn == nil then end
		if sn == 1 then
			play(idb[SN],gqlb[SN])
		end
		if sn == 2 then
			local XEY=gg.makeRequest("http://music.163.com/song/media/outer/url?id="..idb[SN]..".mp3").content
			local XEY1=gg.getFile():gsub("[^/]+$","")..gqlb[SN]..".mp3"
			io.open(XEY1,"w"):write(XEY)
			gg.alert("提示:\n\n音乐已成功下载位置:\n\n"..XEY1)
		end
		XGCK=-1
	end
end
function zjson(jsonr)
	local str = jsonr
	-- 匹配Json Key的正则表达式
	local pattern = "\"[%w]+\":"
	string.gsub(str, pattern, function(v)
		if string.find(str, v) then
			str = string.gsub(str, v, string.gsub(v, "\"", ""))
		end
	end)
	str = string.gsub(str, ":", "=")
	str = string.gsub(str, "%[", "{")
	str = string.gsub(str, "%]", "}")
	local data = "-- WSG PRO 1.0.9(109)\nreturn " .. str
	local res = load(data)()
	return res
end

function json(con)
	res=zjson(con)
	zd=res.result.songCount
	pd=go3-zd
	if pd <= 0 then else go3=zd end
	ts="《"..go1.."》找到"..zd.."首歌曲，当前显示"..go3.."首"
	gqlb={}
	idb={}
	for i=1,go3 do
		gqlb[i]=res.result.songs[i].name
		idb[i]=res.result.songs[i].id
	end
	--print(idb)
end
function YY998() Obtain=gg.makeRequest("https://api.uomg.com/api/rand.music?sort=热歌榜&format=json").content muchen=Obtain:match('url":"(.-)","picurl') gg.playMusic(muchen) end



draw.setColor("#00ffff")--16色颜色配置
local function switch2(...)
	local menus = {...}
	local block = luajava.getBlock()
	local context = app.context
	local window = context:getSystemService("window") -- 获取窗口管理器

	local function getWindowManagerParams()
		local params = luajava.new(WindowManager.LayoutParams)
		params.type = (Build.VERSION.SDK_INT >= 26 and 2038 or 2002)
		params.format = PixelFormat.RGBA_8888 -- 设置背景
		params.flags = params.FLAG_NOT_FOCUSABLE -- 焦点设置Finish
		params.width = params.WRAP_CONTENT -- 布局宽度
		params.height = params.WRAP_CONTENT -- 布局高度
		params.gravity = Gravity.LEFT | Gravity.TOP -- 重力设置
		return params
	end


	local mainLayout = {
		LinearLayout,
		backgroundResource = 0x7f02006c,
		orientation = 'vertical',
		layout_width = 'wrap_content',
		padding = {'10dp', '10dp', '10dp', '10dp'}
	}

	local function exit()
		window:removeView(mainLayout)
		block('end')
	end

	setExitEvent(exit)

	local hideLayout = {
		LinearLayout,
		orientation = 'horizontal',
		layout_width = 'fill_parent',
		gravity = 'center_horizontal',
		{
			ImageView,
			src = 0x7F02000C,
			padding = {'5dp', '5dp', '5dp', '5dp'},
			onClick = function()
				local gridLayout = luajava.getIdView('功能界面')
				if not gridLayout then
					return
				end
				local VISIBLE = GridLayout.VISIBLE
				local GONE = GridLayout.GONE
				local visibility = gridLayout:getVisibility() > VISIBLE and VISIBLE or GONE
				gridLayout:setVisibility(visibility)
			end
		}
	}

	mainLayout[#mainLayout + 1] = hideLayout

	local main2Layout = {
		LinearLayout,
		id = luajava.newId('功能界面'),
		orientation = 'vertical',
		layout_width = 'wrap_content',
		gravity = 'center_horizontal'
	}
	mainLayout[#mainLayout + 1] = main2Layout

	local function formatList(list)
		local gridLayout = {
			GridLayout,
			orientation = 'horizontal',
			columnCount = '3',
			layout_width = 'wrap_content'
		}

		list[#list + 1] = {
			setText = '进程',
			onCheckedChanged = function(buttonView)
				string.toMusic('请选择进程')
gg.setProcessX()
			end
		}

		for i, value in ipairs(list) do
			local name

			do
				local names = {'name', 'text', 'setText'}
				for i, key in ipairs(names) do
					name = value[key]
					if name then
						break
					end
				end
				if not name then
					name = string.format('功能%d', i)
				end
				for i, key in ipairs(names) do
					value[key] = name
				end
			end

			local switchLayout = {
				Switch,
				text = name
			}

			local onCheckedChanged = value.onCheckedChanged
			if not isFunction(onCheckedChanged) then
				onCheckedChanged = function(switch, isChecked)
					if not isSurvive() then
						gg.toast('脚本已结束')
						return exit()
					end

					local mode = isChecked and 'open' or 'close'

					local func = value[mode]
					if not isFunction(func) then
						switch:setChecked(not isChecked)

						func = function(self)
							gg.alert(string.format('%s缺少%s函数,该属性必须为function类型', value.name, mode))
						end
					end

					luajava.startThread(function(...)
						pcall(func, ...)
					end, name, value, switch)

				end
			end
			if isFunction(onCheckedChanged) then
				onCheckedChanged = luajava.createProxy('android.widget.CompoundButton$OnCheckedChangeListener', {
					onCheckedChanged = onCheckedChanged
				})
			end

			switchLayout.onCheckedChangeListener = onCheckedChanged

			gridLayout[#gridLayout + 1] = switchLayout
		end
		return gridLayout
	end

	local navigate2 = {
		LinearLayout,
		orientation = 'horizontal',
		layout_width = 'match_parent',
		gravity = 'center_horizontal'
	}

	local ids = {}
	local views = {}
	for i, menu in ipairs(menus) do
		local name = menu.name
		if not name then
			name = ('菜单%s'):format(i)
			menu.name = name
		end
		ids[i] = string.format('%s-%s', i, name)

		local menuLayout = {
			Button,
			text = name,
			background = '#0000000',
			layout_width = 'wrap_content',
			onClick = function()
				for i2, id in ipairs(ids) do
					local view = views[i2]
					if not view then
						view = luajava.getIdView(id)
						if view then
							views[i2] = view
						end
					end
					if view then
						local VISIBLE = view.VISIBLE
						local GONE = view.GONE
						local state = i == i2 and VISIBLE or GONE
						view:setVisibility(state)
					end
				end
			end
		}
		navigate2[#navigate2 + 1] = menuLayout
	end
	main2Layout[#main2Layout + 1] = navigate2

	local main3Layout = {
		LinearLayout,
		layout_width = 'match_parent',
		gravity = 'center_horizontal'
	}
	for i, menu in ipairs(menus) do
		local gridLayout = formatList(menu)
		gridLayout.id = luajava.newId(ids[i])
		gridLayout.visibility = i == 1 and GridLayout.VISIBLE or GridLayout.GONE

		main3Layout[#main3Layout + 1] = gridLayout
	end
	main2Layout[#main2Layout + 1] = main3Layout

	local function setOnTouchListener(move, layout, params)
		local RawX, RawY, x, y
		local ACTION_DOWN = MotionEvent.ACTION_DOWN
		local ACTION_MOVE = MotionEvent.ACTION_MOVE
		local tonumber = tonumber

		move:setOnTouchListener(luajava.createProxy("android.view.View$OnTouchListener", {
			onTouch = function(v, event)
				local Action = event:getAction()

				if Action == ACTION_DOWN then
					-- 点击时的XY坐标
					RawX = event:getRawX() -- 获取X坐标
					RawY = event:getRawY() -- 获取Y坐标
					x = params.x -- 申明变量xmX为原X坐标
					y = params.y -- 申明变量xmY为原Y坐标
				elseif Action == ACTION_MOVE then
					-- 移动时的XY坐标
					params.x = tonumber(x) + (event:getRawX() - RawX)
					params.y = tonumber(y) + (event:getRawY() - RawY)
					window:updateViewLayout(layout, params)
				end

			end
		}))
	end

	local params = getWindowManagerParams()

	mainLayout = luajava.loadlayout(mainLayout)
	setOnTouchListener(mainLayout, mainLayout, params)

	local function invoke()
		window:addView(mainLayout, params)
	end
	gg.setVisible(false)
	luajava.post(invoke)
	block('join')
	gg.setVisible(true)

end


_ENV['测试搜索'] = function()
	so=gg.getRangesList('libUE4.so')[1].start--范围开
py=0x301829C
setvalue(so+py,16,45)
string.toMusic('范围开启成功')
end


_ENV['开启锁血'] = function()
so=gg.getRangesList('libUE4.so')[1].start--聚点
py=0x4FB21E8
setvalue(so+py,16,8.47963525e-21)
string.toMusic('聚点开启成功')
end

_ENV['开启秒杀'] = function()
	gg.alert('秒已开启')
end
_ENV['开启范围'] = function()
so=gg.getRangesList('libUE4.so')[1].start--防抖
py=0x5BC1C0C
setvalue(so+py,16,2.19933704e12)
so=gg.getRangesList('libUE4.so')[1].start
py=0x80E99F0
setvalue(so+py,16,8.8411673e-21)
string.toMusic('防抖开启成功')
end

_ENV['菜单1'] = {
	{
		name = '防封',
		open = function(self)
if gg.getRangesList("libUE4.so")[1] then
	local t = {}
	t[1] = gg.getRangesList("libUE4.so")[1]["start"] + 0x6D998E8; -- 数值地址:0x72782168E8
	t[2] = gg.getRangesList("libUE4.so")[1]["start"] + 0x6D9AEA8; -- 数值地址:0x7278217EA8
	gg.addListItems({
		[1] = { 
			address = t[1],
			flags = 4,
			value = 131328,
			freeze = true,
		},
		[2] = { 
			address = t[2],
			flags = 4,
			value = 131328,
			freeze = true,
		},
	})
	gg.toast("2开启成功")
end
--ks小宝
local function findExecutableSegment(lib)
local ranges=gg.getRangesList(lib)
for _,v in ipairs(ranges) do
if v.type:find("-x") then return v.start end
end
return nil
end
local function readValue(address,flags)
return gg.getValues({[1]={address=address,flags=flags}})[1].value
end
local function writeValue(address,flags,value,freeze)
local item={address=address,flags=flags,value=value,freeze=freeze}
if freeze then gg.addListItems({item}) else gg.setValues({item}) end
end
function setvalue(address,flags,value,freeze) if address == 0 then return end local tt={} tt[1]={} tt[1].address=address tt[1].flags=flags tt[1].value=value tt[1].freeze=freeze if freeze==false then gg.setValues(tt) end gg.addListItems(tt) end
function getvalue(address,flags,value,freeze) if address == 0 then return end local tt={} tt[1]={} tt[1].address=address tt[1].flags=flags gg.addListItems(tt) end
function autovalue(address,flags,_o,_v,freeze) if address == 0 then return end local tt={} tt[1]={} tt[1].address=address tt[1].flags=flags tt[1].freeze=freeze local _v_ = gg.getValues(tt)[1].value if math.abs(_v_-_o) < 1e-7 then tt[1].value=_v else tt[1].value=_o end if freeze==false then gg.setValues(tt) end gg.addListItems(tt) end
function readD(address) return gg.getValues({{address = address, flags = 4}})[1].value end 
function S_Pointer(t_So, t_Offset, _bit)
	local function getRanges()
		local ranges = {}
		local t = gg.getRangesList('^/data/*.so*$')
		for i, v in pairs(t) do
			if v.type:sub(2, 2) == 'w' then
				table.insert(ranges, v)
			end
		end
		return ranges
	end
	local function Get_Address(N_So, Offset, ti_bit)
		local ti = gg.getTargetInfo()
		local _Q = tonumber(0x167ba0fe)
		local t = {}
		local _t
		local _S = nil
		if ti_bit then
			_t = 32
		 else
			_t = 4
		end
		local _S = gg.getRangesList(N_So[1])[1]
		if _S then
			t[#t + 1] = {}
			t[#t].address = _S.start + Offset[1]
			t[#t].flags = _t
			if #Offset ~= 1 then
				for i = 2, #Offset do
					local S = gg.getValues(t)
					t = {}
					for _ in pairs(S) do
						if not ti.x64 then
							S[_].value = S[_].value & 0xFFFFFFFF
						else
						    S[_].value = S[_].value & 0xFFFFFFFFFF
						end
						t[#t + 1] = {}
						t[#t].address = S[_].value + Offset[i]
						t[#t].flags = _t
					end
				end 
			end
			_S = t[#t].address
		end
		return _S
	end
	local ttt = Get_Address(t_So, t_Offset, _bit)
	if ttt ~= nil then
	local _A = string.format('0x%X', ttt)
	return _A
	end
	return 0
end
local t = {"libanogs.so"}
--VM
local tt = {0x213F88}local ttt = S_Pointer(t,tt,true)
setvalue(ttt,4, "~A8 NOP", false)
local tt = {0x2142E0}local ttt = S_Pointer(t,tt,true)
setvalue(ttt,4, "~A8 RET", false)
local tt = {0x1DEFF0}local ttt = S_Pointer(t,tt,true)
setvalue(ttt,4, "~A8 RET", false)
local tt = {0x21AFA0}local ttt = S_Pointer(t,tt,true)
setvalue(ttt,4, "~A8 NOP", false)
--crc32
local tt = {0x49AA48}local ttt = S_Pointer(t,tt,true)
setvalue(ttt,4, "~A8 LDRB W9, [X0]", false)
local tt = {0x2AF7E4 }local ttt = S_Pointer(t,tt,true)
setvalue(ttt,4, "~A8  LDRB W8, [X0]", false)
local tt = {0x39F62C }local ttt = S_Pointer(t,tt,true)
setvalue(ttt,4, "~A8  MOV  W9, wzr", false)
--结束vm虚拟机进程
--local tt = {0x3AFF1C}local ttt = S_Pointer(t,tt,true)
--setvalue(ttt,4, "~A8 NOP", false)
--下发mrpcs
local tt = {0x21AFF4}local ttt = S_Pointer(t,tt,true)
setvalue(ttt,4, "~A8 RET", false)
--gettingtimeoffday
local tt = {0x51FA80}local ttt = S_Pointer(t,tt,true)
setvalue(ttt,4, "~A8 RET", false)
--196864
local t = {"libanogs.so:bss", "Cb"}
local tt = {0xA098,0x8} local ttt = S_Pointer(t, tt, true)
gg.addListItems({{address = ttt, flags = 4, value = 65536, freeze = true}})
local tt = {0xA098,0xC} local ttt = S_Pointer(t, tt, true)
gg.addListItems({{address = ttt, flags = 4, value = 65537, freeze = true}})

string.toMusic('开启成功')
		end,
				close = function(self)
				so=gg.getRangesList('libgcloud.so')[1].start
py=0X42A480
setvalue(so+py,4,777231668)
string.toMusic('潇湘书院')
				end
		}
}


_ENV['菜单2'] = {
	name = '\n功能',
[1] = {
		name = '静态广角',
		open = function(self)
		if gg.getRangesList("libUE4.so")[1] then
	local t = {}
	t[1] = gg.getRangesList("libUE4.so")[1]["start"] + 0x3594978; -- 数值地址:0x723CB98978
	gg.addListItems({
		[1] = { 
			address = t[1],
			flags = 16,
			value = 1.5,
			freeze = true,
		},
	})
	gg.toast("1.5开启成功")
end
string.toMusic('广角开启成功')
		end,
				close = function(self)
				 
				end
		
	},
	[2] = {
		name = '防抖',
		open = _ENV['开启范围']
	},
	[3] = {
		name = '聚点',
		open = _ENV['开启锁血']
	},
	[4] = {
		name = '范围',
		open = _ENV['测试搜索']

	}
	 
}
_ENV['菜单3'] = {
			name = '音乐',
			[1] = {
				name = '搜索歌曲',---8391694libil2cpp.so:bss+0x2E268+0xBB0+0x200+0x798+0x1A60
				open = function(self)
search = gg.prompt({
								"输入要搜索的歌曲\n可加上歌手名字",
								"设置显示数量(数字)",
							},g.sel,{
								"text",
							})
							if not search then return end
							gg.saveVariable(search,g.config)
							bei()
							go1=search[1]
							go3=search[2]
							jg=start(go1,go3)
							if jg.code == 200 then
								fh=jg.content
								fh=json(fh)
								--print(fh)
								Play(gqlb,idb)
								else
								function inspect()
									gg.alert("访问网络异常，错误代码：\n\n"..jg.code)
								end
								if not pcall(inspect) then print("网络异常，请先连接上网络") os.exit() end
							end
							XGCK=-1
				end,
				close = function(self)
				end
			},
			[2] = {
				name = '停止播放',
				open = function(self)

						gg.playMusic("stop")
							gg.playMusic("stop")
							gg.playMusic("stop")
				end,
				close = function(self)
				end
			}
			 
		}
switch2(_ENV['菜单1'], _ENV['菜单2'], _ENV['菜单3'])
cs = '日落'
		while(true)do
			if gg.isVisible(true) then
				XGCK=1
				gg.setVisible(false)
			end
			gg.clearResults()
			if XGCK==1 then
				Main5()
			end
		end