chore: 备份 TNG 注册/captcha 逆向与 MariBank SG bypass 进展

TngRootBypassHook 增强 captcha 诊断、TigerTally/JNIC 分层与 HWUI 策略；新增逆向脚本、Frida 工具与 UI dump；同步 MariBank SG hook 与 tng_exit_guard 更新。

reverse/scripts/_scan_tng_promon_pkg.py

@@ -0,0 +1,41 @@
+import zipfile
+import re
+
+z = zipfile.ZipFile(r"reverse/dumps/tng_1.9.10_base.apk")
+names = [n for n in z.namelist() if n.endswith(".dex")]
+
+# Find packages that look like Promon (short random package + few classes)
+# Also search string markers
+markers = [
+    b"promon",
+    b"Promon",
+    b"PROMON",
+    b"xwwqazamx",
+    b"Rooting",
+    b"jailbroken",
+    b"JailBroken",
+    b"W:16",
+    b"libtngdigital_ewallet",
+]
+
+for m in markers:
+    hits = 0
+    for n in names:
+        hits += z.read(n).count(m)
+    print(f"marker {m!r}: {hits}")
+
+# Extract L.../...; type descriptors that contain 'promon' case-insensitive or weird short pkgs
+pkg_re = re.compile(rb"L([a-z]{6,12})/([A-Za-z0-9_$]{1,20});")
+pkg_counts = {}
+for n in names:
+    data = z.read(n)
+    for m in pkg_re.findall(data):
+        pkg = m[0].decode("ascii", errors="ignore")
+        pkg_counts[pkg] = pkg_counts.get(pkg, 0) + 1
+
+# Show rare short packages (likely obfuscated)
+cands = [(p, c) for p, c in pkg_counts.items() if 5 <= c <= 500 and p.isalpha() and len(p) <= 12]
+cands.sort(key=lambda x: -x[1])
+print("\ncandidate obfuscated packages:")
+for p, c in cands[:40]:
+    print(f"  {p}: {c}")