chore: 备份 TNG 注册/captcha 逆向与 MariBank SG bypass 进展

TngRootBypassHook 增强 captcha 诊断、TigerTally/JNIC 分层与 HWUI 策略；新增逆向脚本、Frida 工具与 UI dump；同步 MariBank SG hook 与 tng_exit_guard 更新。

reverse/scripts/scan_tng_so_exit.py

@@ -0,0 +1,61 @@
+"""Scan libtngdigital_ewallet.so for SVC / exit patterns."""
+from pathlib import Path
+import struct
+
+SO = Path(r"C:\Users\Administrator\Desktop\notiMessage\reverse\apks\tng\libtngdigital_ewallet.so")
+if not SO.exists():
+    # try from split apk
+    import zipfile
+    apk = Path(r"C:\Users\Administrator\Desktop\notiMessage\reverse\apks\tng\split_config.arm64_v8a.apk")
+    if apk.exists():
+        with zipfile.ZipFile(apk) as z:
+            for n in z.namelist():
+                if n.endswith("libtngdigital_ewallet.so"):
+                    SO.write_bytes(z.read(n))
+                    print("extracted from", apk, "->", SO)
+                    break
+
+data = SO.read_bytes()
+print("size", len(data), SO)
+
+svc = b"\x01\x00\x00\xd4"
+idxs = []
+start = 0
+while True:
+    i = data.find(svc, start)
+    if i < 0:
+        break
+    idxs.append(i)
+    start = i + 4
+print("total svc#0:", len(idxs))
+
+# movz x8,#93 = d2 80 0b a8 ; movz x8,#94 = d2 80 0b c8 (LE)
+# bytes LE: A8 0B 80 D2 / C8 0B 80 D2
+exit_setups = [
+    (b"\xa8\x0b\x80\xd2", 93),  # movz x8, #93
+    (b"\xc8\x0b\x80\xd2", 94),  # movz x8, #94
+    (b"\xa8\x0b\x80\x52", 93),  # movz w8, #93
+    (b"\xc8\x0b\x80\x52", 94),  # movz w8, #94
+]
+for pat, nr in exit_setups:
+    c = data.count(pat)
+    print(f"movz *8,#{nr} pattern count={c}")
+
+print("\nSVC with nearby exit setup (lookback 32 bytes):")
+hits = 0
+for i in idxs[:2000]:
+    window = data[max(0, i - 32) : i]
+    for pat, nr in exit_setups:
+        if pat in window:
+            print(f"  off=0x{i:x} exit_group/exit via #{nr}")
+            hits += 1
+            break
+print("hits", hits)
+
+# also search brk
+brk = b"\x00\x00\x20\xd4"  # brk #0
+print("brk#0 count", data.count(brk))
+
+# string refs
+for s in [b"_exit", b"exit_group", b"abort", b"frida", b"/proc/self/maps", b"xposed"]:
+    print(s, "->", data.find(s))