chore: 备份 TNG 注册/captcha 逆向与 MariBank SG bypass 进展

TngRootBypassHook 增强 captcha 诊断、TigerTally/JNIC 分层与 HWUI 策略；新增逆向脚本、Frida 工具与 UI dump；同步 MariBank SG hook 与 tng_exit_guard 更新。

magisk-modules/tng_exit_guard/jni/main.cpp

@@ -335,13 +335,28 @@ static int hooked_pthread_kill(pthread_t thread, int sig) {
     return orig_pthread_kill ? orig_pthread_kill(thread, sig) : -1;
 }
 
-/** Promon/libc++ 静态局部量递归初始化会 abort 主进程（Registration 页 HWUI 线程）。 */
+/** 仅打断递归初始化；系统 libc++ 静态 ctor（含 gralloc）必须真实执行。 */
+static thread_local void *tl_cxa_guard = nullptr;
+static thread_local int tl_cxa_depth = 0;
+
 static int hooked_cxa_guard_acquire(void *guard) {
-    (void)guard;
-    return 1;
+    if (guard != nullptr && tl_cxa_guard == guard) {
+        LOGI("cxa_guard recursive skip tid=%d", (int)gettid());
+        return 1;
+    }
+    if (!orig_cxa_guard_acquire) {
+        return 1;
+    }
+    void *prev = tl_cxa_guard;
+    tl_cxa_guard = guard;
+    ++tl_cxa_depth;
+    int r = orig_cxa_guard_acquire(guard);
+    --tl_cxa_depth;
+    tl_cxa_guard = prev;
+    return r;
 }
 static void hooked_cxa_guard_abort() {
-    LOGI("blocked __cxa_guard_abort tid=%d", (int)gettid());
+    LOGI("blocked __cxa_guard_abort tid=%d depth=%d", (int)gettid(), tl_cxa_depth);
 }
 
 static void *hooked_dlopen(const char *name, int flags) {
@@ -349,11 +364,17 @@ static void *hooked_dlopen(const char *name, int flags) {
     if (handle != nullptr || name == nullptr) {
         return handle;
     }
-    if (strstr(name, "libandroid.so") != nullptr) {
+    // Compose/HWUI 依赖 libandroid + gralloc mapper；sphal 失败时尝试绝对路径兜底
+    if (strstr(name, "libandroid.so") != nullptr
+            || strstr(name, "mapper.pixel") != nullptr
+            || strstr(name, "android.hardware.graphics.mapper") != nullptr) {
         static const char *kFallbacks[] = {
             "/system/lib64/libandroid.so",
             "/system/lib/libandroid.so",
+            "/vendor/lib64/hw/mapper.pixel.so",
+            "/vendor/lib/hw/mapper.pixel.so",
             "libandroid.so",
+            "mapper.pixel.so",
         };
         for (const char *path : kFallbacks) {
             handle = orig_dlopen ? orig_dlopen(path, flags) : nullptr;
@@ -362,7 +383,7 @@ static void *hooked_dlopen(const char *name, int flags) {
                 return handle;
             }
         }
-        LOGI("dlopen libandroid.so failed tid=%d", (int)gettid());
+        LOGI("dlopen fallback failed name=%s tid=%d", name, (int)gettid());
     }
     return handle;
 }
@@ -449,13 +470,16 @@ static void try_install_cxx_guard_plt() {
     dev_t dev = 0;
     ino_t ino = 0;
     bool any = false;
-    if (find_lib_by_suffix("libc++_shared.so", &dev, &ino)
-            || find_lib_contains("libc++", &dev, &ino)) {
+    // libc++：必须走 orig acquire（否则 gralloc 静态初始化被跳过 → mapper missing 黑屏）。
+    // 仅在同 guard 递归时 return 1；abort 仍拦截。
+    if (find_lib_by_suffix("libc++.so", &dev, &ino)
+            || find_lib_by_suffix("libc++_shared.so", &dev, &ino)) {
         register_plt(g_api, dev, ino, "__cxa_guard_acquire",
                      (void *)hooked_cxa_guard_acquire, (void **)&orig_cxa_guard_acquire);
         register_plt(g_api, dev, ino, "__cxa_guard_abort",
                      (void *)hooked_cxa_guard_abort, (void **)&orig_cxa_guard_abort);
         any = true;
+        LOGI("cxx guard target libc++");
     }
     if (find_lib_by_suffix("libtngdigital_ewallet.so", &dev, &ino)) {
         register_plt(g_api, dev, ino, "__cxa_guard_acquire",
@@ -463,11 +487,12 @@ static void try_install_cxx_guard_plt() {
         register_plt(g_api, dev, ino, "__cxa_guard_abort",
                      (void *)hooked_cxa_guard_abort, (void **)&orig_cxa_guard_abort);
         any = true;
+        LOGI("cxx guard target libtngdigital_ewallet");
     }
     if (!any) return;
     if (g_api->pltHookCommit()) {
         g_cxx_plt.store(1);
-        LOGI("PLT cxx guards committed");
+        LOGI("PLT cxx guards committed (orig acquire + recursive skip)");
     }
 }