chore: 备份 TNG 注册/captcha 逆向与 MariBank SG bypass 进展

TngRootBypassHook 增强 captcha 诊断、TigerTally/JNIC 分层与 HWUI 策略；新增逆向脚本、Frida 工具与 UI dump；同步 MariBank SG hook 与 tng_exit_guard 更新。

reverse/frida/run_tng_diag.py

@@ -0,0 +1,48 @@
+# -*- coding: utf-8 -*-
+import subprocess
+import time
+from pathlib import Path
+
+import frida
+
+ADB = r"C:\Users\Administrator\AppData\Local\Android\Sdk\platform-tools\adb.exe"
+PKG = "my.com.tngdigital.ewallet"
+SCRIPT = Path(__file__).with_name("trace_tng_diag_exit.js").read_text(encoding="utf-8")
+
+
+def adb(*a):
+    return subprocess.run([ADB, *a], capture_output=True, text=True)
+
+
+def on_msg(m, d):
+    if m.get("type") == "send":
+        print(m["payload"], flush=True)
+    else:
+        print(m, flush=True)
+
+
+def main():
+    adb("shell", "am", "force-stop", PKG)
+    time.sleep(0.5)
+    d = frida.get_usb_device(10)
+    pid = d.spawn([PKG])
+    s = d.attach(pid)
+    sc = s.create_script(SCRIPT)
+    sc.on("message", on_msg)
+    sc.load()
+    print("resume", pid, flush=True)
+    d.resume(pid)
+    for i in range(15):
+        time.sleep(1)
+        p = adb("shell", "pidof", PKG).stdout.strip()
+        print("t=%ds pid=%s" % (i + 1, p or "DEAD"), flush=True)
+        if not p:
+            break
+    try:
+        s.detach()
+    except Exception:
+        pass
+
+
+if __name__ == "__main__":
+    main()