chore: 备份 TNG 注册/captcha 逆向与 MariBank SG bypass 进展

TngRootBypassHook 增强 captcha 诊断、TigerTally/JNIC 分层与 HWUI 策略；新增逆向脚本、Frida 工具与 UI dump；同步 MariBank SG hook 与 tng_exit_guard 更新。

reverse/scripts/scan_tng_suicide_map.py

@@ -0,0 +1,40 @@
+# -*- coding: utf-8 -*-
+"""TNG reverse notes helper — ForceExit / abort / Promon suicide map."""
+import re
+import zipfile
+from pathlib import Path
+
+APK = Path(__file__).resolve().parents[1] / "apks" / "tng" / "base.apk"
+SO = Path(__file__).resolve().parents[1] / "apks" / "tng" / "libtngdigital_ewallet.so"
+
+
+def main():
+    with zipfile.ZipFile(APK) as z:
+        data = b"".join(z.read(n) for n in z.namelist() if n.endswith(".dex"))
+
+    print("=== suicide ladder (from runtime + static) ===")
+    print("1) Promon root hit -> openSecurityUrl Rooting FAQ (Xposed blocks)")
+    print("2) xwwqazamx.W -> KillApplicationHandler (Xposed blocks)")
+    print("3) native exit_group(1) OR SIGABRT SI_USER via libc abort/raise/tgkill")
+    print("4) AppSecurityManager.startForceExitCountdown* / addIntoQueueAndLaunch")
+    print()
+
+    print("=== ForceExit-related descriptors ===")
+    for m in sorted(set(re.findall(rb"L[A-Za-z0-9_/$]*ForceExit[A-Za-z0-9_/$]*;", data))):
+        print(m.decode())
+
+    print("\n=== AppSecurityManager log strings (detection events) ===")
+    for m in re.finditer(rb"AppSecurityManager: [A-Za-z][^\x00]{5,80}", data):
+        s = m.group().decode("utf-8", "ignore")
+        if any(k in s for k in ("Root", "Hook", "Emulator", "Force", "Unhandled", "Navigat")):
+            print(s)
+
+    if SO.exists():
+        raw = SO.read_bytes()
+        print("\n=== SO imports of interest ===")
+        for s in (b"abort", b"raise", b"tgkill", b"kill", b"exit"):
+            print(s.decode(), "at", hex(raw.find(s)) if raw.find(s) >= 0 else None)
+
+
+if __name__ == "__main__":
+    main()