chore: 备份 TNG 注册/captcha 逆向与 MariBank SG bypass 进展

TngRootBypassHook 增强 captcha 诊断、TigerTally/JNIC 分层与 HWUI 策略；新增逆向脚本、Frida 工具与 UI dump；同步 MariBank SG hook 与 tng_exit_guard 更新。

reverse/scripts/scan_tng_callbacks.py

@@ -0,0 +1,25 @@
+"""Scan TNG AppSecurityManager callbacks and bl methods."""
+import re
+import zipfile
+
+APK = r"C:\Users\Administrator\Desktop\notiMessage\reverse\apks\tng\base.apk"
+with zipfile.ZipFile(APK) as z:
+    data = b"".join(z.read(n) for n in z.namelist() if n.endswith(".dex"))
+
+keys = [
+    b"handleRootingCallback", b"handleEmulatorCallback", b"handleHookingCallback",
+    b"handleMalwareCallback", b"onBlockStaticCheck", b"addIntoQueue",
+    b"ForceExit", b"exitApplication", b"startForceExit", b"Lxwwqazamx/bl;",
+]
+for k in keys:
+    i = data.find(k)
+    if i < 0:
+        continue
+    print("---", k.decode(), "---")
+    s = re.sub(rb"[^\x20-\x7e]+", b" ", data[max(0, i - 150) : i + len(k) + 200])
+    print(s.decode("ascii", "ignore")[:400])
+    print()
+
+print("=== bl method refs ===")
+for m in sorted(set(re.findall(rb"Lxwwqazamx/bl;->[a-zA-Z0-9_$<>\[\]]+", data))):
+    print(m.decode())