chore: 备份 TNG 注册/captcha 逆向与 MariBank SG bypass 进展

TngRootBypassHook 增强 captcha 诊断、TigerTally/JNIC 分层与 HWUI 策略；新增逆向脚本、Frida 工具与 UI dump；同步 MariBank SG hook 与 tng_exit_guard 更新。

reverse/scripts/_scan_tng_structure.py

@@ -0,0 +1,41 @@
+# -*- coding: utf-8 -*-
+import re
+import zipfile
+from pathlib import Path
+
+APK = Path(__file__).resolve().parent.parent / "apks" / "tng" / "base.apk"
+if not APK.exists():
+    APK = Path(__file__).resolve().parent.parent / "apks" / "tng" / "tng.apk"
+
+acts = set()
+ops = set()
+xww = set()
+tng = set()
+
+with zipfile.ZipFile(str(APK)) as zf:
+    for name in zf.namelist():
+        if not name.endswith(".dex"):
+            continue
+        data = zf.read(name)
+        for m in re.finditer(rb"my/com/tngdigital/[a-zA-Z0-9_/]+Activity", data):
+            acts.add(m.group().decode().replace("/", "."))
+        for m in re.finditer(rb"com\.(?:abl|tngd|zoloz|alipayplus)\.[a-z0-9.]+", data):
+            s = m.group().decode("ascii", "ignore")
+            if any(k in s for k in ("wallet", "otp", "login", "register", "phone", "member", "jail", "customer", "pin", "mobile")):
+                ops.add(s)
+        for m in re.finditer(rb"xwwqazamx/[a-zA-Z0-9_]+", data):
+            xww.add(m.group().decode().replace("/", "."))
+
+print("=== User flow Activities ===")
+for a in sorted(acts):
+    if any(k in a for k in ("User", "Splash", "Guide", "Registration", "Login", "Otp", "Pin", "WebView", "Security")):
+        print(a)
+
+print("\n=== Promon xwwqazamx classes (sample) ===")
+for c in sorted(xww)[:40]:
+    print(c)
+print(f"... total {len(xww)}")
+
+print("\n=== RPC operationTypes (sample) ===")
+for o in sorted(ops)[:50]:
+    print(o)