chore: 备份 TNG 注册/captcha 逆向与 MariBank SG bypass 进展

TngRootBypassHook 增强 captcha 诊断、TigerTally/JNIC 分层与 HWUI 策略；新增逆向脚本、Frida 工具与 UI dump；同步 MariBank SG hook 与 tng_exit_guard 更新。

reverse/scripts/scan_sg_splits.py

@@ -0,0 +1,33 @@
+# -*- coding: utf-8 -*-
+import re
+import zipfile
+from pathlib import Path
+
+APKS = Path(__file__).resolve().parent.parent / "apks"
+for name in ["maribank_sg_base.apk", "maribank_sg_arm64.apk"]:
+    p = APKS / name
+    if not p.exists():
+        print(name, "missing")
+        continue
+    with zipfile.ZipFile(p) as z:
+        dex = [n for n in z.namelist() if n.endswith(".dex")]
+        print("\n", name, "dex:", dex)
+        if not dex:
+            so = [n for n in z.namelist() if n.endswith(".so")][:5]
+            print("  native:", so)
+            continue
+        d = b"".join(z.read(n) for n in dex)
+        for needle in [
+            b"safemode.b",
+            b"safemode/catchs",
+            b"safemode/util",
+            b"USB_ADB",
+            b"RISK_USB",
+            b"lib/safemode/",
+        ]:
+            print(" ", needle.decode(), d.count(needle))
+        classes = sorted(set(m.group().decode()[1:-1].replace("/", ".")
+                             for m in re.finditer(rb"Lcom/shopee/bke/lib/safemode/[^;]{1,80};", d)))
+        for c in classes:
+            if not c.endswith(".R") and ".R$" not in c:
+                print(" ", c)