chore: 备份 TNG 注册/captcha 逆向与 MariBank SG bypass 进展

TngRootBypassHook 增强 captcha 诊断、TigerTally/JNIC 分层与 HWUI 策略；新增逆向脚本、Frida 工具与 UI dump；同步 MariBank SG hook 与 tng_exit_guard 更新。

reverse/scripts/_dump_captcha_methods.py

@@ -0,0 +1,41 @@
+#!/usr/bin/env python3
+"""Dump aliyun captcha method signatures from TNG APK."""
+import zipfile
+import re
+import sys
+
+apk = r"C:\Users\Administrator\Desktop\notiMessage\reverse\dumps\tng_1.9.10_base.apk"
+targets = [
+    b"Lcom/aliyun/captcha/Captcha;",
+    b"Lcom/aliyun/captcha/CaptchaWebViewDialog;",
+    b"Lcom/aliyun/captcha/Captcha$VerificationCallback;",
+    b"Lcom/aliyun/captcha/CaptchaWebViewDialog$CaptchaCompletionListener;",
+    b"Lcom/aliyun/captcha/a;",
+    b"Lcom/aliyun/captcha/b;",
+    b"Lcom/aliyun/captcha/c;",
+]
+
+# Method refs: Lclass;->name(args)ret
+pat = re.compile(
+    rb"(Lcom/aliyun/captcha/[A-Za-z0-9_/$]+;)->([A-Za-z0-9_<>$]+)\(([^)]*)\)([A-Za-z0-9_/;$[\]-]+)"
+)
+
+found = {t.decode(): set() for t in targets}
+with zipfile.ZipFile(apk) as z:
+    for n in z.namelist():
+        if not n.endswith(".dex"):
+            continue
+        data = z.read(n)
+        for m in pat.finditer(data):
+            clazz = m.group(1).decode()
+            if clazz not in found:
+                continue
+            name = m.group(2).decode()
+            args = m.group(3).decode()
+            ret = m.group(4).decode()
+            found[clazz].add(f"{name}({args}){ret}")
+
+for clazz, methods in found.items():
+    print("====", clazz, "n=", len(methods))
+    for s in sorted(methods):
+        print(" ", s)