feat: MariBank 风控 bypass、澳洲银行 Hook 与 reverse 逆向工作区

新增 MariBank/SeaBank PH Root 与 SHPSSDK bypass、riskToken 净化及 Up/Suncorp/ubank 消息 Hook；整理 reverse/ 脚本与 Frida 工具链，并补充当日工作说明文档。

reverse/scripts/scan_root.py

@@ -0,0 +1,42 @@
+# -*- coding: utf-8 -*-
+import re
+import sys
+import zipfile
+
+KEYS = [
+    b"rooted", b"jailbroken", b"RootBeer", b"isRoot", b"checkRoot", b"detectRoot",
+    b"SafetyNet", b"PlayIntegrity", b"magisk", b"/su", b"tamper", b"safemode",
+    b"SafeMode", b"xposed", b"lsposed", b"frida", b"emulator", b"debuggable",
+    b"Integrity", b"jailbreak", b"factory settings", b"RiskDevice", b"DeviceRisk",
+    b"root device", b"seabank", b"SeaBank", b"MariBank", b"alc", b"ALC",
+]
+
+
+def scan_apk(apk_path):
+    with zipfile.ZipFile(apk_path) as zf:
+        for name in sorted(zf.namelist()):
+            if not name.endswith(".dex"):
+                continue
+            data = zf.read(name)
+            print("=== %s (%d bytes) ===" % (name, len(data)))
+            hits = set()
+            for key in KEYS:
+                start = 0
+                while True:
+                    idx = data.find(key, start)
+                    if idx < 0:
+                        break
+                    s = max(0, idx - 40)
+                    e = min(len(data), idx + len(key) + 60)
+                    chunk = re.sub(rb"[^\x20-\x7e]+", b" ", data[s:e])
+                    chunk = chunk.decode("ascii", "ignore").strip()
+                    if len(chunk) > 8:
+                        hits.add(chunk)
+                    start = idx + 1
+            for hit in sorted(hits):
+                print(" ", hit)
+            print()
+
+
+if __name__ == "__main__":
+    scan_apk(sys.argv[1] if len(sys.argv) > 1 else "reverse/apks/seabank_ph_base.apk")