xuhuixiang/notiMessage
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore: 备份 TNG 注册/captcha 逆向与 MariBank SG bypass 进展

Browse Source 
TngRootBypassHook 增强 captcha 诊断、TigerTally/JNIC 分层与 HWUI 策略；新增逆向脚本、Frida 工具与 UI dump；同步 MariBank SG hook 与 tng_exit_guard 更新。
This commit is contained in:
mars
2026-08-03 15:23:02 +08:00
parent 193c04a24b
commit 609635aba1
185 changed files with 60843 additions and 231 deletions
Download Patch File Download Diff File Expand all files Collapse all files

43
magisk-modules/tng_exit_guard/jni/main.cpp
View File

@@ -335,13 +335,28 @@ static int hooked_pthread_kill(pthread_t thread, int sig) {
return orig_pthread_kill ? orig_pthread_kill(thread, sig) : -1;
}
/** Promon/libc++ 静态局部量递归初始化会 abort 主进程（Registration 页 HWUI 线程）。 */
/** 仅打断递归初始化；系统 libc++ 静态 ctor（含 gralloc）必须真实执行。 */
static thread_local void *tl_cxa_guard = nullptr;
static thread_local int tl_cxa_depth = 0;
static int hooked_cxa_guard_acquire(void *guard) {
(void)guard;
return 1;
if (guard != nullptr && tl_cxa_guard == guard) {
LOGI("cxa_guard recursive skip tid=%d", (int)gettid());
return 1;
}
if (!orig_cxa_guard_acquire) {
return 1;
}
void *prev = tl_cxa_guard;
tl_cxa_guard = guard;
++tl_cxa_depth;
int r = orig_cxa_guard_acquire(guard);
--tl_cxa_depth;
tl_cxa_guard = prev;
return r;
}
static void hooked_cxa_guard_abort() {
LOGI("blocked __cxa_guard_abort tid=%d", (int)gettid());
LOGI("blocked __cxa_guard_abort tid=%d depth=%d", (int)gettid(), tl_cxa_depth);
}
static void *hooked_dlopen(const char *name, int flags) {
@@ -349,11 +364,17 @@ static void *hooked_dlopen(const char *name, int flags) {
if (handle != nullptr || name == nullptr) {
return handle;
}
if (strstr(name, "libandroid.so") != nullptr) {
// Compose/HWUI 依赖 libandroid + gralloc mapper；sphal 失败时尝试绝对路径兜底
if (strstr(name, "libandroid.so") != nullptr
|| strstr(name, "mapper.pixel") != nullptr
|| strstr(name, "android.hardware.graphics.mapper") != nullptr) {
static const char *kFallbacks[] = {
"/system/lib64/libandroid.so",
"/system/lib/libandroid.so",
"/vendor/lib64/hw/mapper.pixel.so",
"/vendor/lib/hw/mapper.pixel.so",
"libandroid.so",
"mapper.pixel.so",
};
for (const char *path : kFallbacks) {
handle = orig_dlopen ? orig_dlopen(path, flags) : nullptr;
@@ -362,7 +383,7 @@ static void *hooked_dlopen(const char *name, int flags) {
return handle;
}
}
LOGI("dlopen libandroid.so failed tid=%d", (int)gettid());
LOGI("dlopen fallback failed name=%s tid=%d", name, (int)gettid());
}
return handle;
}
@@ -449,13 +470,16 @@ static void try_install_cxx_guard_plt() {
dev_t dev = 0;
ino_t ino = 0;
bool any = false;
if (find_lib_by_suffix("libc++_shared.so", &dev, &ino)
|| find_lib_contains("libc++", &dev, &ino)) {
// libc++：必须走 orig acquire（否则 gralloc 静态初始化被跳过 → mapper missing 黑屏）。
// 仅在同 guard 递归时 return 1；abort 仍拦截。
if (find_lib_by_suffix("libc++.so", &dev, &ino)
|| find_lib_by_suffix("libc++_shared.so", &dev, &ino)) {
register_plt(g_api, dev, ino, "__cxa_guard_acquire",
(void *)hooked_cxa_guard_acquire, (void **)&orig_cxa_guard_acquire);
register_plt(g_api, dev, ino, "__cxa_guard_abort",
(void *)hooked_cxa_guard_abort, (void **)&orig_cxa_guard_abort);
any = true;
LOGI("cxx guard target libc++");
}
if (find_lib_by_suffix("libtngdigital_ewallet.so", &dev, &ino)) {
register_plt(g_api, dev, ino, "__cxa_guard_acquire",
@@ -463,11 +487,12 @@ static void try_install_cxx_guard_plt() {
register_plt(g_api, dev, ino, "__cxa_guard_abort",
(void *)hooked_cxa_guard_abort, (void **)&orig_cxa_guard_abort);
any = true;
LOGI("cxx guard target libtngdigital_ewallet");
}
if (!any) return;
if (g_api->pltHookCommit()) {
g_cxx_plt.store(1);
LOGI("PLT cxx guards committed");
LOGI("PLT cxx guards committed (orig acquire + recursive skip)");
}
}