chore: 备份 TNG 注册/captcha 逆向与 MariBank SG bypass 进展

TngRootBypassHook 增强 captcha 诊断、TigerTally/JNIC 分层与 HWUI 策略；新增逆向脚本、Frida 工具与 UI dump；同步 MariBank SG hook 与 tng_exit_guard 更新。

reverse/scripts/scan_tng_keys.py

@@ -0,0 +1,70 @@
+# -*- coding: utf-8 -*-
+import re
+import zipfile
+
+APK = "reverse/apks/tng/base.apk"
+
+KEYS = [
+    b"AppProtect", b"JailBroken", b"jailbroken", b"isRooted", b"isJailbroken",
+    b"VKey", b"Promon", b"promon", b"APSE", b"Close app", b"Rooted Device",
+    b"enhanced our security", b"How to keep device safe", b"Detected by",
+]
+
+CLASS_NEEDLES = [
+    b"JailBroken", b"AppProtect", b"ApSecurity", b"Promon", b"VKey", b"VGuard",
+    b"RootDetect", b"DeviceRisk", b"SecurityInitializer", b"libAPSE",
+]
+
+
+def main():
+    with zipfile.ZipFile(APK) as zf:
+        data = b"".join(zf.read(n) for n in zf.namelist() if n.endswith(".dex"))
+
+    print("=== KEY STRINGS ===")
+    for k in KEYS:
+        idx = 0
+        while True:
+            idx = data.find(k, idx)
+            if idx < 0:
+                break
+            s = max(0, idx - 80)
+            e = min(len(data), idx + len(k) + 120)
+            chunk = re.sub(rb"[^\x20-\x7e]+", b" ", data[s:e]).decode("ascii", "ignore")
+            print(f"[{k.decode()}] {chunk.strip()}")
+            idx += 1
+
+    print("\n=== KEY CLASSES ===")
+    classes = set(re.findall(rb"L[a-zA-Z0-9_$/]+;", data))
+    hits = []
+    for raw in classes:
+        if any(n in raw for n in CLASS_NEEDLES):
+            hits.append(raw.decode()[1:-1].replace("/", "."))
+    for h in sorted(set(hits)):
+        print(h)
+
+
+FLOW_KEYS = [
+    b"Detected by", b"Close app", b"AppSecurityManager", b"RootEvent", b"RootI18n",
+    b"PromonError", b"showJailBrokenAlert", b"onShowPopupDisable", b"isJailBroken",
+    b"detectJailBroken", b"APSecuritySdk", b"no/promon/shield", b"HookingFrameworks",
+    b"How to keep device safe", b"onBlockStaticCheck",
+]
+
+
+def scan_flow():
+    with zipfile.ZipFile(APK) as zf:
+        data = b"".join(zf.read(n) for n in zf.namelist() if n.endswith(".dex"))
+    print("\n=== FLOW STRINGS ===")
+    for k in FLOW_KEYS:
+        idx = data.find(k)
+        if idx < 0:
+            continue
+        s = max(0, idx - 80)
+        e = min(len(data), idx + len(k) + 120)
+        chunk = re.sub(rb"[^\x20-\x7e]+", b" ", data[s:e]).decode("ascii", "ignore")
+        print(f"[{k.decode()}] {chunk.strip()}")
+
+
+if __name__ == "__main__":
+    main()
+    scan_flow()