feat(tng): TNG eWallet Promon bypass、Zygisk 信号守卫与注册链保护

新增 TngRootBypassHook 与 tng_exit_guard 模块，修复 BAL 强拉、SIGABRT/pc==lr SEGV 崩溃，验证可进入注册页。

scripts/build-install-tng-exit-guard.ps1

@@ -0,0 +1,55 @@
+# Build + install TNG Zygisk exit guard
+param(
+    [switch]$SkipInstall,
+    [switch]$NoReboot
+)
+
+$ErrorActionPreference = "Stop"
+$Root = Split-Path -Parent $PSScriptRoot
+$Mod = Join-Path $Root "magisk-modules\tng_exit_guard"
+$Ndk = "C:\Users\Administrator\AppData\Local\Android\Sdk\ndk\21.4.7075529"
+$NdkBuild = Join-Path $Ndk "ndk-build.cmd"
+$Adb = "C:\Users\Administrator\AppData\Local\Android\Sdk\platform-tools\adb.exe"
+
+if (-not (Test-Path $NdkBuild)) {
+    throw "ndk-build not found: $NdkBuild"
+}
+
+Write-Host "=== ndk-build ===" -ForegroundColor Cyan
+Push-Location $Mod
+& $NdkBuild NDK_PROJECT_PATH=. APP_BUILD_SCRIPT=jni/Android.mk NDK_APPLICATION_MK=jni/Application.mk -j8
+if ($LASTEXITCODE -ne 0) { Pop-Location; throw "ndk-build failed" }
+
+$built = Join-Path $Mod "libs\arm64-v8a\libtng_exit_guard.so"
+if (-not (Test-Path $built)) {
+    # some ndk versions omit lib prefix based on LOCAL_MODULE
+    $built = Get-ChildItem (Join-Path $Mod "libs\arm64-v8a") -Filter "*.so" | Select-Object -First 1 -ExpandProperty FullName
+}
+if (-not $built -or -not (Test-Path $built)) { Pop-Location; throw "built .so missing" }
+
+$zygiskDir = Join-Path $Mod "zygisk"
+New-Item -ItemType Directory -Force -Path $zygiskDir | Out-Null
+Copy-Item $built (Join-Path $zygiskDir "arm64-v8a.so") -Force
+Write-Host "built -> zygisk\arm64-v8a.so ($((Get-Item (Join-Path $zygiskDir 'arm64-v8a.so')).Length) bytes)"
+Pop-Location
+
+if ($SkipInstall) { return }
+
+Write-Host "=== install Magisk module ===" -ForegroundColor Cyan
+& $Adb wait-for-device
+& $Adb shell "su -c 'mkdir -p /data/adb/modules/tng_exit_guard/zygisk'"
+& $Adb push (Join-Path $Mod "module.prop") /data/local/tmp/tng_exit_guard_module.prop
+& $Adb push (Join-Path $zygiskDir "arm64-v8a.so") /data/local/tmp/tng_exit_guard.so
+& $Adb shell "su -c 'cp /data/local/tmp/tng_exit_guard_module.prop /data/adb/modules/tng_exit_guard/module.prop; cp /data/local/tmp/tng_exit_guard.so /data/adb/modules/tng_exit_guard/zygisk/arm64-v8a.so; chmod 644 /data/adb/modules/tng_exit_guard/module.prop; chmod 755 /data/adb/modules/tng_exit_guard/zygisk/arm64-v8a.so; rm -f /data/adb/modules/tng_exit_guard/disable /data/adb/modules/tng_exit_guard/remove; ls -la /data/adb/modules/tng_exit_guard/ /data/adb/modules/tng_exit_guard/zygisk/'"
+
+if (-not $NoReboot) {
+    Write-Host "=== soft reboot zygote (module loads on next specialize) ===" -ForegroundColor Yellow
+    Write-Host "Magisk Zygisk modules usually need a FULL reboot. Rebooting device..."
+    & $Adb reboot
+    Write-Host "Waiting for device..."
+    & $Adb wait-for-device
+    Start-Sleep -Seconds 25
+    & $Adb shell "getprop sys.boot_completed"
+}
+
+Write-Host "Done. Launch TNG and check: adb logcat -s TngExitGuard:I LSPosed-Bridge:I" -ForegroundColor Green

scripts/diag-tng-exit-guard.sh

@@ -0,0 +1,21 @@
+#!/system/bin/sh
+set -x
+echo "=== magisk ver ==="
+magisk -c
+magisk -v
+echo "=== zygisk setting ==="
+magisk --sqlite 'SELECT * FROM settings'
+echo "=== path ==="
+MAGISK_PATH=$(magisk --path)
+echo "MAGISK_PATH=$MAGISK_PATH"
+ls -la "$MAGISK_PATH" 2>/dev/null | head -30
+ls -la "$MAGISK_PATH/zygisk" 2>/dev/null
+ls -la /data/adb/modules/
+ls -la /data/adb/modules/tng_exit_guard/
+ls -la /data/adb/modules/tng_exit_guard/zygisk/
+echo "=== denylist tng ==="
+magisk --denylist ls 2>/dev/null | grep -i tng || echo "TNG not on denylist"
+echo "=== processes ==="
+ps -A | grep -iE 'magiskd|zygisk|lspd|vector|tngdigital' || true
+echo "=== logcat zygisk ==="
+logcat -d | grep -iE 'zygisk|TngExit|tng_exit' | tail -40

scripts/logcat-tng.ps1

@@ -0,0 +1,14 @@
+# Capture TNG eWallet hook logs (clears buffer first if -Clear switch passed)
+param([switch]$Clear)
+$adb = "C:\Users\Administrator\AppData\Local\Android\Sdk\platform-tools\adb.exe"
+if (-not (Test-Path $adb)) {
+    $adb = "adb"
+}
+if ($Clear) {
+    & $adb logcat -c
+    Write-Host "Logcat cleared. Launch TNG eWallet, then run without -Clear:" -ForegroundColor Yellow
+    Write-Host "  .\scripts\logcat-tng.ps1"
+    exit 0
+}
+& $adb logcat -d 2>&1 | Select-String -Pattern "notiMessageHook/TngRoot|LSPosed-Bridge.*TngRoot|LSPosed-Bridge.*notiMessageHook|support.tngdigital|SecurityError|xwwqazamx|UserLogin|blocked intent|blocked Promon" |
+    Select-Object -Last 80

scripts/pull-tng-log.sh

@@ -0,0 +1,4 @@
+#!/system/bin/sh
+logcat -d > /data/local/tmp/tnglog.txt
+grep -E '7500|exited cleanly|Process my.com.tngdigital|TngRoot|UserLogin|FATAL|Abort message|tombstone|blocked syscall|has died' /data/local/tmp/tnglog.txt | tail -120 > /data/local/tmp/tnglog2.txt
+wc -l /data/local/tmp/tnglog2.txt

scripts/test-tng-survive.sh

@@ -0,0 +1,16 @@
+#!/system/bin/sh
+logcat -c
+am force-stop my.com.tngdigital.ewallet
+sleep 1
+monkey -p my.com.tngdigital.ewallet -c android.intent.category.LAUNCHER 1 >/dev/null 2>&1
+sleep 2
+echo "=== @2s ==="; ps -A | grep -i tng || echo NONE
+sleep 5
+echo "=== @7s ==="; ps -A | grep -i tng || echo NONE
+sleep 8
+echo "=== @15s ==="; ps -A | grep -i tng || echo NONE
+logcat -d > /data/local/tmp/tngfull.txt
+echo "=== guard ==="
+grep TngExitGuard /data/local/tmp/tngfull.txt | tail -30
+echo "=== outcome ==="
+grep -E 'exited cleanly|exited due|has died|skipped SIGILL|blocked kill|blocked tgkill|UserLogin|Displayed|PLT blocked' /data/local/tmp/tngfull.txt | tail -30