chore: 备份 TNG 注册/captcha 逆向与 MariBank SG bypass 进展

TngRootBypassHook 增强 captcha 诊断、TigerTally/JNIC 分层与 HWUI 策略；新增逆向脚本、Frida 工具与 UI dump；同步 MariBank SG hook 与 tng_exit_guard 更新。

reverse/frida/trace_tng_diag_exit.js

@@ -0,0 +1,74 @@
+/**
+ * Diagnostic: only LOG exit-related calls, do not block.
+ */
+"use strict";
+function log(msg) { send("[TNG-diag] " + msg); }
+function findExport(mod, name) {
+  try {
+    var m = Process.findModuleByName(mod);
+    if (m) { var a = m.findExportByName(name); if (a) return a; }
+  } catch (e) {}
+  try { return Module.getGlobalExportByName(name); } catch (e2) { return null; }
+}
+function bt(ctx) {
+  try {
+    return Thread.backtrace(ctx, Backtracer.FUZZY).map(DebugSymbol.fromAddress).slice(0, 8).join(" <- ");
+  } catch (e) { return "?"; }
+}
+
+["_exit", "exit", "abort", "quick_exit"].forEach(function (n) {
+  var a = findExport("libc.so", n);
+  if (!a) return;
+  Interceptor.attach(a, {
+    onEnter: function (args) {
+      log("CALL " + n + "(" + args[0] + ") " + bt(this.context));
+    }
+  });
+  log("watch " + n + " @ " + a);
+});
+
+["kill", "tgkill", "raise"].forEach(function (n) {
+  var a = findExport("libc.so", n);
+  if (!a) return;
+  Interceptor.attach(a, {
+    onEnter: function (args) {
+      log("CALL " + n + "(" + args[0] + "," + args[1] + ") " + bt(this.context));
+    }
+  });
+});
+
+var sys = findExport("libc.so", "syscall");
+if (sys) {
+  Interceptor.attach(sys, {
+    onEnter: function (args) {
+      var nr = args[0].toInt32();
+      if (nr === 93 || nr === 94 || nr === 129 || nr === 131) {
+        log("CALL syscall(" + nr + ") " + bt(this.context));
+      }
+    }
+  });
+}
+
+// count mprotect EXEC
+var mp = findExport("libc.so", "mprotect");
+if (mp) {
+  Interceptor.attach(mp, {
+    onEnter: function (args) {
+      if (args[2].toInt32() & 4) {
+        log("mprotect EXEC " + args[0] + " len=" + args[1]);
+      }
+    }
+  });
+}
+
+log("diag ready pid=" + Process.id);
+setTimeout(function () {
+  var n = 0;
+  Process.enumerateRanges("r-x").forEach(function (r) {
+    var file = r.file ? r.file.path : "anon";
+    if (file.indexOf("/system") === 0 || file.indexOf("/apex") === 0) return;
+    n++;
+    log("RX " + file + " " + r.base + " +" + r.size);
+  });
+  log("app RX ranges=" + n);
+}, 800);