chore: 备份 TNG 注册/captcha 逆向与 MariBank SG bypass 进展

TngRootBypassHook 增强 captcha 诊断、TigerTally/JNIC 分层与 HWUI 策略；新增逆向脚本、Frida 工具与 UI dump；同步 MariBank SG hook 与 tng_exit_guard 更新。

reverse/scripts/scan_tng_exit.py

@@ -0,0 +1,37 @@
+"""Scan TNG dex for Promon exit paths and ActivityThread refs."""
+import re
+import sys
+import zipfile
+
+apk = sys.argv[1] if len(sys.argv) > 1 else r"C:\Users\Administrator\AppData\Local\Temp\tng_base.apk"
+with zipfile.ZipFile(apk) as z:
+    data = b"".join(z.read(n) for n in z.namelist() if n.endswith(".dex"))
+
+patterns = [
+    rb"handleExitApplication",
+    rb"System;->exit",
+    rb"Runtime;->exit",
+    rb"Process;->killProcess",
+    rb"Runtime;->halt",
+    rb"xwwqazamx/bl",
+    rb"xwwqazamx/w",
+    rb"xwwqazamx/W",
+    rb"addIntoQueue",
+    rb"handleRootingCallback",
+    rb"startForceExit",
+]
+for pat in patterns:
+    hits = len(re.findall(pat, data))
+    print(f"{pat.decode('utf-8', 'ignore')}: {hits}")
+
+print("\n=== xwwqazamx class names (sample) ===")
+classes = sorted(set(m.group().decode("utf-8", "ignore") for m in re.finditer(rb"Lxwwqazamx/[A-Za-z0-9_$]+;", data)))
+for c in classes[:60]:
+    print(c)
+print(f"... total {len(classes)}")
+
+for pat in [b"startForceExit", b"ForceExit", b"openSecurityUrl", b"Lxwwqazamx/w;", b"Lxwwqazamx/bl;->"]:
+    print("---", pat.decode())
+    hits = sorted(set(m.group().decode("utf-8", "ignore") for m in re.finditer(pat + rb"[^\x00]{0,100}", data)))
+    for h in hits[:20]:
+        print(h)