feat: MariBank 风控 bypass、澳洲银行 Hook 与 reverse 逆向工作区

新增 MariBank/SeaBank PH Root 与 SHPSSDK bypass、riskToken 净化及 Up/Suncorp/ubank 消息 Hook；整理 reverse/ 脚本与 Frida 工具链，并补充当日工作说明文档。

reverse/scripts/scan_target.py

@@ -0,0 +1,36 @@
+# -*- coding: utf-8 -*-
+import os, re, sys
+
+def extract_strings(data, min_len=5):
+    out = set()
+    for m in re.finditer(rb'[\x20-\x7e]{' + str(min_len).encode() + rb',}', data):
+        out.add(m.group().decode('ascii', 'ignore'))
+    return out
+
+def scan_app(app_dir, filters):
+    strings = set()
+    for name in os.listdir(app_dir):
+        if not name.endswith('.dex'):
+            continue
+        with open(os.path.join(app_dir, name), 'rb') as f:
+            strings |= extract_strings(f.read())
+    print('\n===', os.path.basename(app_dir), '===')
+    for label, rx in filters:
+        matched = sorted({s for s in strings if re.search(rx, s, re.I)})
+        print('\n[%s] count=%d' % (label, len(matched)))
+        for s in matched[:50]:
+            print(' ', s)
+
+filters = [
+    ('up notifications', r'au\.com\.up\.money\.notifications|Lau/com/up/money/notifications'),
+    ('suncorp messaging', r'au\.com\.suncorp\.marketplace.*(Messaging|Firebase|Notification|Push)'),
+    ('ubank messaging', r'au\.com\.bank86400|bank86400|86400.*(Messaging|Firebase|Notification|Push|MoEngage)'),
+    ('ubank onMessage', r'onMessageReceived|Will try to show push|MoEngage'),
+    ('custom FCM services', r'MessagingService;|HandlerService|FirebaseService'),
+]
+
+root = sys.argv[1]
+for app in sorted(os.listdir(root)):
+    p = os.path.join(root, app)
+    if os.path.isdir(p):
+        scan_app(p, filters)