feat: MariBank 风控 bypass、澳洲银行 Hook 与 reverse 逆向工作区

新增 MariBank/SeaBank PH Root 与 SHPSSDK bypass、riskToken 净化及 Up/Suncorp/ubank 消息 Hook；整理 reverse/ 脚本与 Frida 工具链，并补充当日工作说明文档。

scripts/configure-lsposed.py

@@ -9,6 +9,9 @@ scopes = [
     "org.telegram.messenger.web",
     "org.telegram.messenger",
     "com.miraclegarden.smsmessage",
+    "au.com.up.money",
+    "au.com.suncorp.marketplace",
+    "au.com.bank86400",
 ]
 
 shutil.copy2(db_path, db_path + ".bak")

scripts/install-frida.ps1

@@ -0,0 +1,144 @@
+# Install Frida (PC) + frida-server (device) for MariBank trace
+param(
+    [switch]$SkipServer,
+    [switch]$StartServer
+)
+
+$ErrorActionPreference = "Stop"
+$ProjectRoot = Split-Path -Parent $PSScriptRoot
+$FridaDir = Join-Path $ProjectRoot "reverse\frida"
+$Req = Join-Path $FridaDir "requirements.txt"
+$Sdk = "C:\Users\Administrator\AppData\Local\Android\Sdk"
+$Adb = Join-Path $Sdk "platform-tools\adb.exe"
+
+if (-not (Test-Path $Adb)) {
+    throw "adb not found: $Adb"
+}
+
+# Prefer Python 3.8+ (3.6 breaks frida / type hints)
+$Py = $null
+foreach ($c in @("py -3.12", "py -3", "python3", "python")) {
+    try {
+        $v = Invoke-Expression "$c -c `"import sys; print(sys.version_info[:2])`"" 2>$null
+        if ($v -match "\(3,\s*([89]|1[0-9])\)") {
+            $Py = $c
+            break
+        }
+    } catch {}
+}
+if (-not $Py) { $Py = "py -3" }
+
+Write-Host "Using Python: $Py" -ForegroundColor Cyan
+$env:SSL_CERT_FILE = $null
+$env:REQUESTS_CA_BUNDLE = $null
+& Invoke-Expression "$Py -m pip install --upgrade pip --trusted-host pypi.org --trusted-host files.pythonhosted.org" 2>&1 | Out-Null
+& Invoke-Expression "$Py -m pip install -r `"$Req`" --trusted-host pypi.org --trusted-host files.pythonhosted.org"
+
+$FridaVer = (& Invoke-Expression "$Py -c `"import frida; print(frida.__version__)`"").Trim()
+Write-Host "frida-python $FridaVer installed" -ForegroundColor Green
+
+$env:Path = [System.Environment]::GetEnvironmentVariable("Path", "User") + ";" + (
+    & Invoke-Expression "$Py -c `"import sysconfig; import os; print(os.path.join(sysconfig.get_path('scripts')))`""
+)
+$FridaCli = Get-Command frida -ErrorAction SilentlyContinue
+if ($FridaCli) {
+    Write-Host "frida CLI: $($FridaCli.Source)" -ForegroundColor Green
+} else {
+    Write-Host "frida CLI not on PATH; use: $Py -m frida" -ForegroundColor Yellow
+}
+
+Write-Host "`nadb devices:" -ForegroundColor Cyan
+& $Adb devices
+$serial = (& $Adb devices | Select-String "device$" | Where-Object { $_ -notmatch "List of" } | ForEach-Object { ($_ -split "\s+")[0] } | Select-Object -First 1)
+if (-not $serial) {
+    Write-Warning "No device connected — skip frida-server push. Connect Pixel 6 and re-run."
+    exit 0
+}
+
+if ($SkipServer) { exit 0 }
+
+$Abi = (& $Adb -s $serial shell getprop ro.product.cpu.abi).Trim()
+Write-Host "Device ABI: $Abi" -ForegroundColor Cyan
+
+$ArchMap = @{
+    "arm64-v8a"   = "android-arm64"
+    "armeabi-v7a" = "android-arm"
+    "x86_64"      = "android-x86_64"
+    "x86"         = "android-x86"
+}
+if (-not $ArchMap.ContainsKey($Abi)) {
+    throw "Unsupported ABI: $Abi"
+}
+$FridaAsset = $ArchMap[$Abi]
+$ServerName = "frida-server-$FridaVer-$FridaAsset"
+$ServerDir = Join-Path $FridaDir "bin"
+$ServerBin = Join-Path $ServerDir "frida-server"
+$XzFile = Join-Path $ServerDir "$ServerName.xz"
+New-Item -ItemType Directory -Force -Path $ServerDir | Out-Null
+
+if (-not (Test-Path $ServerBin)) {
+    $Url = "https://github.com/frida/frida/releases/download/$FridaVer/$ServerName.xz"
+    Write-Host "Downloading $Url ..." -ForegroundColor Cyan
+    Invoke-WebRequest -Uri $Url -OutFile $XzFile -UseBasicParsing
+
+    # Windows 10+ tar supports xz in some builds; try 7z or python lzma
+    $extracted = $false
+    try {
+        tar -xf $XzFile -C $ServerDir 2>$null
+        if (Test-Path (Join-Path $ServerDir $ServerName)) {
+            Move-Item -Force (Join-Path $ServerDir $ServerName) $ServerBin
+            $extracted = $true
+        }
+    } catch {}
+
+    if (-not $extracted) {
+        $Py312 = "C:\Users\Administrator\AppData\Local\Programs\Python\Python312\python.exe"
+        if (-not (Test-Path $Py312)) { $Py312 = "python" }
+        & $Py312 -c @"
+import lzma
+from pathlib import Path
+xz = Path(r'$XzFile')
+out = Path(r'$ServerBin')
+with lzma.open(xz) as f:
+    out.write_bytes(f.read())
+print('extracted', out, out.stat().st_size)
+"@
+        $extracted = Test-Path $ServerBin
+    }
+    Remove-Item $XzFile -ErrorAction SilentlyContinue
+}
+
+if (-not (Test-Path $ServerBin)) {
+    throw "frida-server binary missing at $ServerBin"
+}
+
+Write-Host "Pushing frida-server to device ..." -ForegroundColor Cyan
+& $Adb -s $serial push $ServerBin /data/local/tmp/frida-server
+& $Adb -s $serial shell "su -c 'chmod 755 /data/local/tmp/frida-server && pkill -9 frida-server 2>/dev/null; /data/local/tmp/frida-server -D &'" 2>&1 | Out-Null
+Start-Sleep -Seconds 2
+
+$check = & $Adb -s $serial shell "su -c 'pgrep frida-server'" 2>&1
+if ($check -match "\d") {
+    Write-Host "frida-server running (pid $check)" -ForegroundColor Green
+} else {
+    Write-Warning "frida-server may not be running. Manual: adb shell su -c '/data/local/tmp/frida-server -D &'"
+}
+
+if ($StartServer) {
+    $Trace = Join-Path $FridaDir "run-frida-trace.ps1"
+    Write-Host "Starting trace ..." -ForegroundColor Cyan
+    & $Trace -Mode spawn
+}
+
+Write-Host @"
+
+安装完成:
+  PC  : frida $FridaVer
+  手机: /data/local/tmp/frida-server
+
+下一步:
+  cd reverse\frida
+  ..\..\scripts\install-frida.ps1 -StartServer
+  或: frida -U -f ph.seabank.seabank -l trace_maribank_register.js
+
+"@ -ForegroundColor Green

scripts/logcat-maribank.ps1

@@ -0,0 +1,29 @@
+# MariBank / Hook 相关 logcat（adb 不在 PATH 时也可用）
+param(
+    [switch]$Clear,
+    [switch]$Follow
+)
+
+$ErrorActionPreference = "Stop"
+$sdk = "C:\Users\Administrator\AppData\Local\Android\Sdk"
+$adb = Join-Path $sdk "platform-tools\adb.exe"
+
+if (-not (Test-Path $adb)) {
+    Write-Host "adb not found at $adb" -ForegroundColor Red
+    exit 1
+}
+
+$pattern = "MariBankRoot|1201|seabank|ClashMeta|LSPosed-Bridge.*notiMessage"
+
+if ($Clear) {
+    & $adb logcat -c
+    Write-Host "logcat cleared." -ForegroundColor Green
+    exit 0
+}
+
+if ($Follow) {
+    Write-Host "Following logcat (Ctrl+C to stop)..." -ForegroundColor Cyan
+    & $adb logcat | Select-String -Pattern $pattern
+} else {
+    & $adb logcat -d | Select-String -Pattern $pattern
+}

scripts/organize-reverse.ps1

@@ -0,0 +1,59 @@
+# One-time / repeatable layout for reverse/ workspace
+$ErrorActionPreference = "Stop"
+$Reverse = Join-Path (Split-Path -Parent $PSScriptRoot) "reverse"
+
+$dirs = @(
+    "scripts", "output", "logs", "logs\frida", "tmp"
+)
+foreach ($d in $dirs) {
+    New-Item -ItemType Directory -Force -Path (Join-Path $Reverse $d) | Out-Null
+}
+
+# Python scripts at reverse root -> scripts/
+Get-ChildItem (Join-Path $Reverse "*.py") -File -ErrorAction SilentlyContinue | ForEach-Object {
+    Move-Item -Force $_.FullName (Join-Path $Reverse "scripts\$($_.Name)")
+}
+
+# Dump outputs
+@("native_bridge2.txt", "native_bridge_dump.txt", "phone_vm_dump.txt", "crypto_scan.txt") | ForEach-Object {
+    $src = Join-Path $Reverse $_
+    if (Test-Path $src) { Move-Item -Force $src (Join-Path $Reverse "output\$_") }
+}
+
+# Logs
+$log = Join-Path $Reverse "maribank_crash.log"
+if (Test-Path $log) { Move-Item -Force $log (Join-Path $Reverse "logs\maribank_crash.log") }
+
+$fridaDir = Join-Path $Reverse "frida"
+@("*.log", "*.log.err", "logcat_capture.txt", "spawn_runner.out", "trace_runner.out", "trace_runner.err", "spawn_runner.err") | ForEach-Object {
+    Get-ChildItem (Join-Path $fridaDir $_) -File -ErrorAction SilentlyContinue | ForEach-Object {
+        $dest = Join-Path $Reverse "logs\frida\$($_.Name)"
+        try {
+            Move-Item -Force $_.FullName $dest -ErrorAction Stop
+        } catch {
+            Write-Warning "skip locked file: $($_.FullName)"
+        }
+    }
+}
+
+# Temp dex
+Get-ChildItem (Join-Path $Reverse "*.dex") -File -ErrorAction SilentlyContinue | ForEach-Object {
+    Move-Item -Force $_.FullName (Join-Path $Reverse "tmp\$($_.Name)")
+}
+
+# APK archive at root
+$zip = Join-Path $Reverse "seabank.zip"
+if (Test-Path $zip) { Move-Item -Force $zip (Join-Path $Reverse "apks\seabank.zip") }
+
+# Unpacked APK under extracted/
+$apkExtract = Join-Path $Reverse "apk_extract"
+if (Test-Path $apkExtract) {
+    $dest = Join-Path $Reverse "extracted\apk_extract"
+    if (Test-Path $dest) {
+        Write-Warning "extracted/apk_extract already exists; leaving reverse/apk_extract in place"
+    } else {
+        Move-Item -Force $apkExtract $dest
+    }
+}
+
+Write-Host "reverse/ layout done."

scripts/start-mari-trace.ps1

@@ -0,0 +1,26 @@
+# 启动 MariBank Frida attach trace + logcat
+$ErrorActionPreference = "Stop"
+$Root = Split-Path -Parent (Split-Path -Parent $PSScriptRoot)
+$FridaDir = Join-Path $Root "reverse\frida"
+$Adb = "C:\Users\Administrator\AppData\Local\Android\Sdk\platform-tools\adb.exe"
+$Py = "C:\Users\Administrator\AppData\Local\Programs\Python\Python312\python.exe"
+
+Write-Host "1. 请先在手机上打开 MariBank (Sign up 页面)" -ForegroundColor Yellow
+Write-Host "2. 建议暂时关闭 LSPosed 对 MariBank 作用域" -ForegroundColor Yellow
+Read-Host "准备好后按 Enter 继续"
+
+& $Adb shell "su -c 'pgrep frida-server || /data/local/tmp/frida-server -D &'" 2>$null | Out-Null
+Start-Sleep 1
+
+$logcatOut = Join-Path $Root "reverse\logs\frida\logcat_capture.txt"
+New-Item -ItemType Directory -Force -Path (Split-Path $logcatOut) | Out-Null
+Start-Process -FilePath $Adb -ArgumentList @(
+    "logcat","-c"
+) -Wait -NoNewWindow
+Start-Process -FilePath $Adb -ArgumentList @(
+    "logcat","-s","notiMessageHook/MariBankRoot:V","MB-TRACE:V","CharacterCryptoManager:V","NativeEncrypt:V"
+) -RedirectStandardOutput $logcatOut -WindowStyle Hidden
+
+Write-Host "logcat -> $logcatOut" -ForegroundColor Cyan
+Write-Host "Frida attach 启动中..." -ForegroundColor Cyan
+& $Py (Join-Path $FridaDir "run_frida_trace.py") attach