chore: 备份 TNG 注册/captcha 逆向与 MariBank SG bypass 进展
TngRootBypassHook 增强 captcha 诊断、TigerTally/JNIC 分层与 HWUI 策略；新增逆向脚本、Frida 工具与 UI dump；同步 MariBank SG hook 与 tng_exit_guard 更新。
This commit is contained in:
mars
10
scripts/_tng_anr_dump.sh
Normal file
10
scripts/_tng_anr_dump.sh
Normal file
@@ -0,0 +1,10 @@
|
||||
#!/system/bin/sh
|
||||
ANR=/data/anr/anr_2026-07-31-13-30-08-628
|
||||
echo "=== header ==="
|
||||
su -c "head -40 $ANR"
|
||||
echo "=== main tid ==="
|
||||
su -c "grep -n '\"main\"' $ANR | head -5"
|
||||
echo "=== main block ==="
|
||||
su -c "awk '/\"main\" prio/{p=1} p{print} p&&/^$/{c++} c>=2{exit}' $ANR" | head -80
|
||||
echo "=== cpu ==="
|
||||
su -c "grep -A20 'CPU usage' $ANR | head -30"
|
||||
6
scripts/_tng_anr_render.sh
Normal file
6
scripts/_tng_anr_render.sh
Normal file
@@ -0,0 +1,6 @@
|
||||
#!/system/bin/sh
|
||||
ANR=/data/anr/anr_2026-07-31-13-30-08-628
|
||||
echo "=== RenderThread ==="
|
||||
su -c "awk '/\"RenderThread\"/{p=1} p{print} p&&/^\"/{if(!/RenderThread/){exit}}' $ANR" | head -60
|
||||
echo "=== Quake / promon threads ==="
|
||||
su -c "grep -E '^\"|libtng|Quake|xwwq|promon|tiger' $ANR | head -80"
|
||||
22
scripts/_tng_getprop_hunt.sh
Normal file
22
scripts/_tng_getprop_hunt.sh
Normal file
@@ -0,0 +1,22 @@
|
||||
#!/system/bin/sh
|
||||
# 抓到 getprop 子进程瞬间 dump 其 syscall/status（验证 exit_group 被 seccomp 卡住）
|
||||
PKG="my.com.tngdigital.ewallet"
|
||||
|
||||
am force-stop "$PKG" 2>/dev/null
|
||||
sleep 1
|
||||
am start -n "$PKG/.ui.SplashActivity" 2>/dev/null
|
||||
|
||||
i=0
|
||||
while [ $i -lt 200 ]; do
|
||||
i=$((i+1))
|
||||
for gp in $(pidof getprop 2>/dev/null); do
|
||||
ppid=$(awk '/^PPid/{print $2}' /proc/$gp/status 2>/dev/null)
|
||||
pp=$(tr '\0' ' ' < /proc/$ppid/cmdline 2>/dev/null)
|
||||
echo "GETPROP pid=$gp ppid=$ppid pp=[$pp]"
|
||||
echo " seccomp: $(grep -i seccomp /proc/$gp/status 2>/dev/null | tr '\n' ' ')"
|
||||
echo " syscall: $(cat /proc/$gp/syscall 2>/dev/null)"
|
||||
echo " wchan: $(cat /proc/$gp/wchan 2>/dev/null) state=$(awk '/^State/{print $2}' /proc/$gp/status 2>/dev/null)"
|
||||
done
|
||||
sleep 0.05
|
||||
done
|
||||
echo "=== done ==="
|
||||
24
scripts/_tng_pin_check.sh
Normal file
24
scripts/_tng_pin_check.sh
Normal file
@@ -0,0 +1,24 @@
|
||||
#!/system/bin/sh
|
||||
logcat -c
|
||||
input keyevent KEYCODE_WAKEUP
|
||||
settings put system screen_off_timeout 600000
|
||||
am force-stop my.com.tngdigital.ewallet
|
||||
sleep 1
|
||||
monkey -p my.com.tngdigital.ewallet -c android.intent.category.LAUNCHER 1 >/dev/null 2>&1
|
||||
i=0
|
||||
while [ $i -lt 40 ]; do
|
||||
sleep 1
|
||||
i=$((i+1))
|
||||
p=$(pidof my.com.tngdigital.ewallet)
|
||||
if [ -z "$p" ]; then
|
||||
echo "t=${i}s DEAD"
|
||||
break
|
||||
fi
|
||||
if [ $((i % 5)) -eq 0 ]; then
|
||||
echo "t=${i}s pid=$p"
|
||||
fi
|
||||
done
|
||||
echo "=== focus ==="
|
||||
dumpsys window 2>/dev/null | grep -E 'mCurrentFocus|mFocusedApp' | head -4
|
||||
echo "=== key ==="
|
||||
logcat -d 2>/dev/null | grep -E 'TngExitGuard|Displayed.*User|UserPin|UserLogin|seccomp|caught sig=|exited cleanly|Fatal signal|ANR in my.com.tng' | tail -40
|
||||
39
scripts/_tng_pipe_writer.sh
Normal file
39
scripts/_tng_pipe_writer.sh
Normal file
@@ -0,0 +1,39 @@
|
||||
#!/system/bin/sh
|
||||
# 抓 TigerTally fread 阻塞的 pipe 写端进程。自动启动 TNG 并连续扫描。
|
||||
PKG="my.com.tngdigital.ewallet"
|
||||
|
||||
am force-stop "$PKG" 2>/dev/null
|
||||
sleep 1
|
||||
am start -n "$PKG/.ui.SplashActivity" 2>/dev/null
|
||||
|
||||
i=0
|
||||
while [ $i -lt 40 ]; do
|
||||
i=$((i+1))
|
||||
pid=""
|
||||
for p in $(pidof "$PKG"); do
|
||||
if [ "$(tr '\0' ' ' < /proc/$p/cmdline 2>/dev/null | tr -d ' ')" = "$PKG" ]; then pid=$p; break; fi
|
||||
done
|
||||
if [ -z "$pid" ]; then sleep 0.5; continue; fi
|
||||
|
||||
for d in /proc/$pid/task/*/; do
|
||||
t="${d%/}"
|
||||
s=$(cat "$t/syscall" 2>/dev/null)
|
||||
case "$s" in
|
||||
63*)
|
||||
c=$(cat "$t/comm" 2>/dev/null)
|
||||
fd=$(echo "$s" | awk '{print $2}')
|
||||
fd=$((fd))
|
||||
tgt=$(readlink "/proc/$pid/fd/$fd" 2>/dev/null)
|
||||
echo "[$i] pid=$pid TID=${t##*/} comm=$c wchan=$(cat "$t/wchan" 2>/dev/null) syscall=$s"
|
||||
echo "[$i] fd=$fd -> $tgt"
|
||||
ino=$(echo "$tgt" | sed 's/.*\[//; s/\]//')
|
||||
if [ -n "$ino" ]; then
|
||||
echo "[$i] writer-search inode=$ino:"
|
||||
find /proc/[0-9]*/fd -lname "*$ino*" 2>/dev/null
|
||||
fi
|
||||
;;
|
||||
esac
|
||||
done
|
||||
sleep 0.5
|
||||
done
|
||||
echo "=== scan done ==="
|
||||
65
scripts/_tng_pipe_writer2.sh
Normal file
65
scripts/_tng_pipe_writer2.sh
Normal file
@@ -0,0 +1,65 @@
|
||||
#!/system/bin/sh
|
||||
# 抓 TigerTally fread 阻塞的 pipe 写端进程，命中后立即 dump 该进程身份/冻结状态。
|
||||
PKG="my.com.tngdigital.ewallet"
|
||||
|
||||
am force-stop "$PKG" 2>/dev/null
|
||||
sleep 1
|
||||
am start -n "$PKG/.ui.SplashActivity" 2>/dev/null
|
||||
|
||||
i=0
|
||||
while [ $i -lt 60 ]; do
|
||||
i=$((i+1))
|
||||
pid=""
|
||||
for p in $(pidof "$PKG"); do
|
||||
if [ "$(tr '\0' ' ' < /proc/$p/cmdline 2>/dev/null | tr -d ' ')" = "$PKG" ]; then pid=$p; break; fi
|
||||
done
|
||||
if [ -z "$pid" ]; then sleep 0.5; continue; fi
|
||||
|
||||
for d in /proc/$pid/task/*/; do
|
||||
t="${d%/}"
|
||||
s=$(cat "$t/syscall" 2>/dev/null)
|
||||
case "$s" in
|
||||
63*)
|
||||
c=$(cat "$t/comm" 2>/dev/null)
|
||||
case "$c" in
|
||||
*pool*|*Tiger*|*tiger*|*tally*|*Tally*)
|
||||
fd=$(echo "$s" | awk '{print $2}')
|
||||
fd=$((fd))
|
||||
tgt=$(readlink "/proc/$pid/fd/$fd" 2>/dev/null)
|
||||
echo "[$i] MAIN pid=$pid TID=${t##*/} comm=$c wchan=$(cat "$t/wchan" 2>/dev/null)"
|
||||
echo "[$i] MAIN fd=$fd -> $tgt"
|
||||
ino=$(echo "$tgt" | sed 's/.*\[//; s/\]//')
|
||||
[ -z "$ino" ] && continue
|
||||
echo "[$i] writer-search inode=$ino:"
|
||||
for wp in $(find /proc/[0-9]*/fd -lname "*$ino*" 2>/dev/null); do
|
||||
echo "[$i] $wp"
|
||||
done
|
||||
# dump 所有非主进程端点
|
||||
for wp in $(find /proc/[0-9]*/fd -lname "*$ino*" 2>/dev/null); do
|
||||
wproc=$(echo "$wp" | cut -d/ -f3)
|
||||
[ "$wproc" = "$pid" ] && continue
|
||||
wfd=$(echo "$wp" | cut -d/ -f5)
|
||||
echo "[$i] WRITER proc=$wproc fd=$wfd"
|
||||
echo "[$i] cmdline: $(tr '\0' ' ' < /proc/$wproc/cmdline 2>/dev/null)"
|
||||
echo "[$i] comm: $(cat /proc/$wproc/comm 2>/dev/null) state=$(cat /proc/$wproc/stat 2>/dev/null | awk '{print $3}')"
|
||||
cg=$(cat /proc/$wproc/cgroup 2>/dev/null | grep -v freezer | head -1)
|
||||
echo "[$i] cgroup: $cg"
|
||||
# cgroup v2 freezer
|
||||
cgpath=$(echo "$cg" | sed 's/^[0-9]*://')
|
||||
if [ -f "/sys/fs/cgroup${cgpath}/cgroup.freeze" ]; then
|
||||
echo "[$i] cgroup.freeze=$(cat /sys/fs/cgroup${cgpath}/cgroup.freeze 2>/dev/null)"
|
||||
fi
|
||||
echo "[$i] threads(wchan):"
|
||||
for td in /proc/$wproc/task/*/; do
|
||||
ttn=${td%/}
|
||||
echo "[$i] ${ttn##*/} $(cat $ttn/comm 2>/dev/null) $(cat $ttn/wchan 2>/dev/null)"
|
||||
done
|
||||
done
|
||||
;;
|
||||
esac
|
||||
;;
|
||||
esac
|
||||
done
|
||||
sleep 0.4
|
||||
done
|
||||
echo "=== scan done ==="
|
||||
46
scripts/_tng_proc_scan.sh
Normal file
46
scripts/_tng_proc_scan.sh
Normal file
@@ -0,0 +1,46 @@
|
||||
#!/system/bin/sh
|
||||
# TNG eWallet — 启动期 /proc 扫描：定位阻塞在 read 的 TigerTally 线程及其 fd 目标。
|
||||
# 用法: adb shell su -c 'sh /data/local/tmp/_tng_proc_scan.sh [loop_seconds]'
|
||||
PKG="my.com.tngdigital.ewallet"
|
||||
LOOP="${1:-1}" # 持续扫描秒数（默认 1 秒抓一次快照）
|
||||
|
||||
# 选主进程（cmdline 恰为包名，排除 :tools / :goacqowmmt 等子进程）
|
||||
main_pid=""
|
||||
for p in $(pidof "$PKG"); do
|
||||
if [ "$(tr '\0' ' ' < /proc/$p/cmdline 2>/dev/null | tr -d ' ')" = "$PKG" ]; then
|
||||
main_pid="$p"
|
||||
break
|
||||
fi
|
||||
done
|
||||
|
||||
[ -z "$main_pid" ] && { echo "NO-MAIN-PROC pidof=$(pidof $PKG)"; exit 1; }
|
||||
echo "=== main pid=$main_pid ==="
|
||||
|
||||
i=0
|
||||
while [ $i -lt "$LOOP" ]; do
|
||||
i=$((i+1))
|
||||
echo "--- scan #$i ---"
|
||||
# 1) 所有可疑线程的状态
|
||||
for tid in $(ls /proc/$main_pid/task 2>/dev/null); do
|
||||
comm=$(cat /proc/$main_pid/task/$tid/comm 2>/dev/null)
|
||||
case "$comm" in
|
||||
*pool*|*location*|*tally*|*Tiger*|*tiger*)
|
||||
syscall=$(cat /proc/$main_pid/task/$tid/syscall 2>/dev/null)
|
||||
wchan=$(cat /proc/$main_pid/task/$tid/wchan 2>/dev/null)
|
||||
stat=$(cat /proc/$main_pid/task/$tid/stat 2>/dev/null | awk '{print $3}')
|
||||
echo "TID=$tid comm=$comm state=$stat syscall=[$syscall] wchan=$wchan"
|
||||
;;
|
||||
esac
|
||||
done
|
||||
# 2) 所有管道/套接字 fd（TigerTally 握手候选）
|
||||
for fd in /proc/$main_pid/fd/*; do
|
||||
tgt=$(readlink "$fd" 2>/dev/null)
|
||||
case "$tgt" in
|
||||
*pipe:*|*socket:*|*anon_inode:*)
|
||||
echo "FD=$(basename $fd) -> $tgt"
|
||||
;;
|
||||
esac
|
||||
done
|
||||
[ $i -lt "$LOOP" ] && sleep 1
|
||||
done
|
||||
echo "=== done ==="
|
||||
@@ -14,6 +14,7 @@ scopes = [
|
||||
"au.com.up.money",
|
||||
"au.com.suncorp.marketplace",
|
||||
"au.com.bank86400",
|
||||
"my.com.tngdigital.ewallet",
|
||||
]
|
||||
|
||||
shutil.copy2(db_path, db_path + ".bak")
|
||||
|
||||
87
scripts/launch-maribank-sg.ps1
Normal file
87
scripts/launch-maribank-sg.ps1
Normal file
@@ -0,0 +1,87 @@
|
||||
# Launch MariBank Singapore (not PH SeaBank)
|
||||
param(
|
||||
[switch]$ClearData,
|
||||
[switch]$StopPh,
|
||||
[switch]$ColdStart,
|
||||
[int]$WaitSeconds = 0
|
||||
)
|
||||
|
||||
$ErrorActionPreference = "Stop"
|
||||
$PkgSg = "sg.com.maribankmobile.digitalbank"
|
||||
$PkgPh = "ph.seabank.seabank"
|
||||
$Activity = "com.shopee.bke.digitalbank.ui.MainActivity"
|
||||
|
||||
function Resolve-AdbPath {
|
||||
$candidates = @(
|
||||
(Join-Path $env:LOCALAPPDATA "Android\Sdk\platform-tools\adb.exe"),
|
||||
"C:\Users\Administrator\AppData\Local\Android\Sdk\platform-tools\adb.exe"
|
||||
)
|
||||
foreach ($path in $candidates) {
|
||||
if (Test-Path $path) { return $path }
|
||||
}
|
||||
$cmd = Get-Command adb -ErrorAction SilentlyContinue
|
||||
if ($cmd) { return $cmd.Source }
|
||||
return $null
|
||||
}
|
||||
|
||||
$adb = Resolve-AdbPath
|
||||
if (-not $adb) {
|
||||
Write-Host "adb not found." -ForegroundColor Red
|
||||
exit 1
|
||||
}
|
||||
|
||||
$devices = & $adb devices 2>&1 | Where-Object { $_ -match "\tdevice$" }
|
||||
if (-not $devices) {
|
||||
Write-Host "No authorized adb device." -ForegroundColor Red
|
||||
exit 1
|
||||
}
|
||||
|
||||
Write-Host "=== Launch MariBank SINGAPORE ===" -ForegroundColor Cyan
|
||||
Write-Host "Package: $PkgSg (v3.2.2)"
|
||||
Write-Host ""
|
||||
Write-Host "[Required] After Xposed module update: LSPosed -> scope SG pkg -> re-optimize / force-stop / launch" -ForegroundColor Yellow
|
||||
Write-Host " Without soft reboot, old hooks may cause BLANK-PAGE white screen." -ForegroundColor Yellow
|
||||
Write-Host ""
|
||||
Write-Host "Package: sg.com.maribankmobile.digitalbank (NOT ph.seabank.seabank)" -ForegroundColor Yellow
|
||||
Write-Host ""
|
||||
|
||||
if ($StopPh) {
|
||||
& $adb shell am force-stop $PkgPh | Out-Null
|
||||
}
|
||||
|
||||
if ($ClearData) {
|
||||
Write-Host "Clearing SG app data..."
|
||||
& $adb shell pm clear $PkgSg | Out-Null
|
||||
}
|
||||
|
||||
if ($ColdStart) {
|
||||
Write-Host "Cold start: force-stop SG (first screen may stay white 30-60s)" -ForegroundColor Cyan
|
||||
& $adb shell am force-stop $PkgSg | Out-Null
|
||||
Start-Sleep -Seconds 2
|
||||
} else {
|
||||
Write-Host "Warm start (recommended). Use -ColdStart for cold start." -ForegroundColor Cyan
|
||||
}
|
||||
|
||||
& $adb shell am start -n "$PkgSg/$Activity"
|
||||
|
||||
Write-Host ""
|
||||
Write-Host "MariBank SG launched." -ForegroundColor Green
|
||||
Write-Host "RN may show BLANK-PAGE for ~25-45s before welcome screen."
|
||||
Write-Host "If white screen > 1 min: LSPosed soft reboot SG, then retry -ColdStart"
|
||||
Write-Host "Verify API: adb logcat -d | Select-String api.maribank.com.sg"
|
||||
|
||||
if ($WaitSeconds -gt 0) {
|
||||
Write-Host ""
|
||||
Write-Host "Waiting ${WaitSeconds}s for UI..." -ForegroundColor Cyan
|
||||
Start-Sleep -Seconds $WaitSeconds
|
||||
& $adb shell uiautomator dump /sdcard/ui_launch_check.xml 2>&1 | Out-Null
|
||||
$prevEap = $ErrorActionPreference
|
||||
$ErrorActionPreference = "Continue"
|
||||
& $adb pull /sdcard/ui_launch_check.xml "$env:TEMP\ui_launch_check.xml" 2>&1 | Out-Null
|
||||
$ErrorActionPreference = $prevEap
|
||||
if (Test-Path "$env:TEMP\ui_launch_check.xml") {
|
||||
$xml = Get-Content "$env:TEMP\ui_launch_check.xml" -Raw
|
||||
$blank = $xml -match "BLANK-PAGE"
|
||||
Write-Host ("BLANK-PAGE=" + $blank)
|
||||
}
|
||||
}
|
||||
@@ -11,5 +11,5 @@ if ($Clear) {
|
||||
Write-Host " .\scripts\logcat-maribank.ps1"
|
||||
exit 0
|
||||
}
|
||||
& $adb logcat -d 2>&1 | Select-String -Pattern "MariBankRoot|MariBankNative" |
|
||||
Select-String -Pattern "HTTP|outbound|register|faked|finish adb|blocked|ErrorFlow|RegisterViewModel|skip error|late app|late native|assessRisk|risk callback"
|
||||
& $adb logcat -d 2>&1 | Select-String -Pattern "MariBankRoot|MariBankNative|MariBankDfp|MariBankEncrypt|MariBankCapture" |
|
||||
Select-String -Pattern "HTTP|outbound|register|dfp/v1|dfp is empty|3100012|4067|faked|finish adb|blocked|ErrorFlow|RegisterViewModel|skip error|late app|late native|assessRisk|risk callback"
|
||||
|
||||
58
scripts/maribank-sg-all-in.ps1
Normal file
58
scripts/maribank-sg-all-in.ps1
Normal file
@@ -0,0 +1,58 @@
|
||||
# MariBank SG 一键：编译 → 安装模块 → 换 ID → 清数据 → 启动 SG
|
||||
# 用法:
|
||||
# .\scripts\maribank-sg-all-in.ps1
|
||||
# .\scripts\maribank-sg-all-in.ps1 -DisableUsbDebug # 测前关 USB 调试（会断 adb）
|
||||
# .\scripts\maribank-sg-all-in.ps1 -SkipBuild # 仅换 ID + 启动
|
||||
param(
|
||||
[switch]$SkipBuild,
|
||||
[switch]$DisableUsbDebug,
|
||||
[switch]$KeepAdb,
|
||||
[switch]$ColdStart
|
||||
)
|
||||
|
||||
$ErrorActionPreference = "Stop"
|
||||
$ProjectRoot = Split-Path -Parent $PSScriptRoot
|
||||
|
||||
Write-Host "=== MariBank SG All-In ===" -ForegroundColor Cyan
|
||||
|
||||
if (-not $SkipBuild) {
|
||||
Write-Host "`n[1/5] Build debug APKs..." -ForegroundColor Cyan
|
||||
& "$ProjectRoot\scripts\build-debug.ps1"
|
||||
if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
|
||||
|
||||
Write-Host "`n[2/5] Install APKs..." -ForegroundColor Cyan
|
||||
& "$ProjectRoot\scripts\install-debug.ps1"
|
||||
if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
|
||||
} else {
|
||||
Write-Host "`n[1-2/5] Skip build/install (-SkipBuild)" -ForegroundColor Yellow
|
||||
}
|
||||
|
||||
Write-Host "`n[3/5] New device identity + clear MariBank SG..." -ForegroundColor Cyan
|
||||
& "$ProjectRoot\scripts\maribank-spoof-device.ps1" -NewIdentity -ClearMariBank
|
||||
if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
|
||||
|
||||
Write-Host "`n[4/5] LSPosed 必做（PC 无法代劳）" -ForegroundColor Yellow
|
||||
Write-Host " 1. LSPosed -> 模块 -> notiMessage 启用"
|
||||
Write-Host " 2. 作用域勾选: sg.com.maribankmobile.digitalbank"
|
||||
Write-Host " 3. 对该包: 重新优化 -> 强行停止 -> 启动（等价软重启）"
|
||||
Write-Host " 4. Shamiko DenyList 含 SG 全部进程，Enforce=OFF"
|
||||
Write-Host ""
|
||||
Read-Host "完成 LSPosed 软重启后按 Enter 继续" | Out-Null
|
||||
|
||||
$launchArgs = @("-StopPh")
|
||||
if ($ColdStart) { $launchArgs += "-ColdStart" }
|
||||
|
||||
Write-Host "`n[5/5] Launch MariBank SG..." -ForegroundColor Cyan
|
||||
& "$ProjectRoot\scripts\launch-maribank-sg.ps1" @launchArgs
|
||||
if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
|
||||
|
||||
if ($DisableUsbDebug -and -not $KeepAdb) {
|
||||
Write-Host "`n=== Disable USB debugging (SG stricter) ===" -ForegroundColor Cyan
|
||||
& "$ProjectRoot\scripts\maribank-sg-register.ps1" -DisableUsbDebug
|
||||
} else {
|
||||
Write-Host "`n=== Ready to test ===" -ForegroundColor Green
|
||||
Write-Host "Phone: Sign up -> +65 -> Next"
|
||||
Write-Host "Log: .\scripts\maribank-sg-register.ps1 -CaptureLog -KeepAdb"
|
||||
Write-Host " .\scripts\logcat-maribank.ps1"
|
||||
Write-Host "Strict test (no adb): .\scripts\maribank-sg-all-in.ps1 -SkipBuild -DisableUsbDebug"
|
||||
}
|
||||
153
scripts/maribank-sg-register.ps1
Normal file
153
scripts/maribank-sg-register.ps1
Normal file
@@ -0,0 +1,153 @@
|
||||
# MariBank SG register test — new identity, optional log capture
|
||||
param(
|
||||
[switch]$NewIdentity,
|
||||
[switch]$CaptureLog,
|
||||
[switch]$DumpLog,
|
||||
[switch]$InstallModule,
|
||||
[switch]$DisableUsbDebug,
|
||||
[switch]$KeepAdb,
|
||||
[switch]$All
|
||||
)
|
||||
|
||||
$ErrorActionPreference = "Stop"
|
||||
$ProjectRoot = Split-Path -Parent $PSScriptRoot
|
||||
$Pkg = "sg.com.maribankmobile.digitalbank"
|
||||
|
||||
function Resolve-AdbPath {
|
||||
$candidates = @(
|
||||
(Join-Path $env:LOCALAPPDATA "Android\Sdk\platform-tools\adb.exe"),
|
||||
"C:\Users\Administrator\AppData\Local\Android\Sdk\platform-tools\adb.exe"
|
||||
)
|
||||
foreach ($path in $candidates) {
|
||||
if (Test-Path $path) { return $path }
|
||||
}
|
||||
$cmd = Get-Command adb -ErrorAction SilentlyContinue
|
||||
if ($cmd) { return $cmd.Source }
|
||||
return $null
|
||||
}
|
||||
|
||||
$adb = Resolve-AdbPath
|
||||
if (-not $adb) {
|
||||
Write-Host "adb not found. Install Android SDK platform-tools or add adb to PATH." -ForegroundColor Red
|
||||
exit 1
|
||||
}
|
||||
|
||||
function Get-AdbDevicesText {
|
||||
& $adb devices 2>&1 | Out-String
|
||||
}
|
||||
|
||||
function Test-AdbAuthorized {
|
||||
$lines = & $adb devices 2>&1 | Where-Object { $_ -match "\tdevice$" }
|
||||
return [bool]$lines
|
||||
}
|
||||
|
||||
function Invoke-AdbShell([string]$cmd) {
|
||||
& $adb shell $cmd 2>&1
|
||||
}
|
||||
|
||||
function Show-AdbHelp {
|
||||
param([string]$DevicesText)
|
||||
Write-Host "`nadb devices output:" -ForegroundColor Yellow
|
||||
Write-Host $DevicesText
|
||||
Write-Host @"
|
||||
|
||||
常见原因与处理：
|
||||
1. 上次跑脚本已关闭 USB 调试 → 手机上一律手动重新打开：
|
||||
设置 → 开发者选项 → USB 调试（+ 无线调试若在用）
|
||||
2. 换线 / 换 USB 口，通知栏选「文件传输 / MTP」
|
||||
3. 弹「允许 USB 调试？」→ 点允许（可勾始终允许）
|
||||
4. PC 执行：adb kill-server && adb start-server && adb devices
|
||||
5. 仅抓 log 时不要关调试：.\scripts\maribank-sg-register.ps1 -CaptureLog -KeepAdb
|
||||
|
||||
"@ -ForegroundColor Cyan
|
||||
}
|
||||
|
||||
Write-Host "=== MariBank SG Register Test ===" -ForegroundColor Cyan
|
||||
Write-Host "adb: $adb"
|
||||
|
||||
if ($All) {
|
||||
$allArgs = @()
|
||||
if ($DisableUsbDebug -and -not $KeepAdb) { $allArgs += "-DisableUsbDebug" }
|
||||
if ($KeepAdb) { $allArgs += "-KeepAdb" }
|
||||
& "$ProjectRoot\scripts\maribank-sg-all-in.ps1" @allArgs
|
||||
if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
|
||||
if (-not $CaptureLog) { exit 0 }
|
||||
}
|
||||
|
||||
& $adb start-server 2>&1 | Out-Null
|
||||
$devicesText = Get-AdbDevicesText
|
||||
|
||||
if (-not (Test-AdbAuthorized)) {
|
||||
Write-Host "No authorized adb device." -ForegroundColor Red
|
||||
Show-AdbHelp -DevicesText $devicesText
|
||||
exit 1
|
||||
}
|
||||
|
||||
Write-Host $devicesText
|
||||
|
||||
if ($NewIdentity -or $InstallModule) {
|
||||
$spoofArgs = @()
|
||||
if ($NewIdentity) { $spoofArgs += "-NewIdentity" }
|
||||
if ($InstallModule) { $spoofArgs += "-InstallModule" }
|
||||
& "$ProjectRoot\scripts\maribank-spoof-device.ps1" @spoofArgs -ClearMariBank
|
||||
if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
|
||||
}
|
||||
|
||||
$shouldDisableAdb = $DisableUsbDebug -and -not $KeepAdb
|
||||
if ($shouldDisableAdb) {
|
||||
Write-Host "`n=== Disable USB / wireless debugging (SG stricter) ===" -ForegroundColor Cyan
|
||||
Write-Host "WARNING: PC adb will disconnect after this. Re-enable USB debug on phone to connect again." -ForegroundColor Yellow
|
||||
Invoke-AdbShell "settings put global adb_enabled 0" | Out-Null
|
||||
Invoke-AdbShell "settings put global development_settings_enabled 0" | Out-Null
|
||||
Invoke-AdbShell "settings put secure adb_wifi_enabled 0" | Out-Null
|
||||
Invoke-AdbShell "su -c 'resetprop init.svc.adbd stopped; resetprop persist.sys.adb_enable 0'" 2>$null | Out-Null
|
||||
} elseif (-not $KeepAdb) {
|
||||
Write-Host "`n=== Skip disabling USB debug (default) ===" -ForegroundColor Cyan
|
||||
Write-Host "Use -DisableUsbDebug when ready to test SG without PC adb; use -KeepAdb with -CaptureLog."
|
||||
}
|
||||
|
||||
if (-not $CaptureLog) {
|
||||
Write-Host "`n=== Clear SG app + verify IDs ===" -ForegroundColor Cyan
|
||||
Invoke-AdbShell "pm clear $Pkg" | Out-Null
|
||||
Invoke-AdbShell "su -c 'getprop ro.serialno; settings get secure android_id'"
|
||||
}
|
||||
|
||||
Write-Host ""
|
||||
Write-Host "=== LSPosed: pick the correct MariBank package ===" -ForegroundColor Yellow
|
||||
Write-Host " SG: sg.com.maribankmobile.digitalbank (v3.2.2, api.maribank.com.sg)"
|
||||
Write-Host " PH: ph.seabank.seabank (v3.22.0, api.seabank.ph)"
|
||||
Write-Host " Launch SG: .\scripts\launch-maribank-sg.ps1"
|
||||
Write-Host ""
|
||||
Write-Host "Phone: LSPosed -> soft reboot $Pkg"
|
||||
Write-Host "Then: MariBank SG -> Sign up -> +65 phone -> Next"
|
||||
|
||||
if ($CaptureLog -or $DumpLog) {
|
||||
if ($CaptureLog) {
|
||||
Write-Host ""
|
||||
Write-Host "=== logcat cleared; tap Next then press Enter ===" -ForegroundColor Cyan
|
||||
& $adb logcat -c
|
||||
Write-Host "Tap Next on phone, then press Enter..."
|
||||
Read-Host | Out-Null
|
||||
} else {
|
||||
Write-Host ""
|
||||
Write-Host "=== dump current logcat (no clear) ===" -ForegroundColor Cyan
|
||||
}
|
||||
Write-Host ""
|
||||
Write-Host "--- register / dfp / attestation ---" -ForegroundColor Cyan
|
||||
$lines = & $adb logcat -d | Select-String "MariBankCapture|MariBankRegister|MariBankEncrypt|MariBankAttest|MariBankDfp|MariBankNative|MariBankRoot HTTP|ProbeGuard|3100012|4067012|OTP_SMS|register summary|dfp/v1|code=0|Gson REGISTRATION|uapi/v2/register|attestation hooks|native-core"
|
||||
if ($lines) {
|
||||
$lines
|
||||
} else {
|
||||
Write-Host "(no matches)" -ForegroundColor Yellow
|
||||
Write-Host "Likely: Enter pressed before Next, or register API not sent yet."
|
||||
Write-Host "You are on phone screen? Tap Next, wait for loading, then run:"
|
||||
Write-Host " .\scripts\maribank-sg-register.ps1 -DumpLog -KeepAdb"
|
||||
}
|
||||
} else {
|
||||
Write-Host "`nLog after Next:" -ForegroundColor Cyan
|
||||
Write-Host " .\scripts\maribank-sg-register.ps1 -CaptureLog -KeepAdb"
|
||||
Write-Host " .\scripts\maribank-sg-register.ps1 -DumpLog -KeepAdb # no clear, dump now"
|
||||
}
|
||||
|
||||
Write-Host ""
|
||||
Write-Host "Doc: docs/MariBank新加坡突破.md" -ForegroundColor Green
|
||||
48
scripts/run-frida-sg-native.ps1
Normal file
48
scripts/run-frida-sg-native.ps1
Normal file
@@ -0,0 +1,48 @@
|
||||
# MariBank SG Frida native attestation trace
|
||||
# Usage:
|
||||
# .\scripts\run-frida-sg-native.ps1
|
||||
# .\scripts\run-frida-sg-native.ps1 -Spawn
|
||||
param(
|
||||
[switch]$Attach,
|
||||
[switch]$SkipLsposedHint
|
||||
)
|
||||
|
||||
$ErrorActionPreference = "Stop"
|
||||
$ProjectRoot = Split-Path -Parent $PSScriptRoot
|
||||
$FridaDir = Join-Path $ProjectRoot "reverse\frida"
|
||||
$Py312 = "C:\Users\Administrator\AppData\Local\Programs\Python\Python312\python.exe"
|
||||
$Adb = Join-Path $env:LOCALAPPDATA "Android\Sdk\platform-tools\adb.exe"
|
||||
if (-not (Test-Path $Adb)) {
|
||||
$Adb = "C:\Users\Administrator\AppData\Local\Android\Sdk\platform-tools\adb.exe"
|
||||
}
|
||||
|
||||
Write-Host "=== MariBank SG Frida Native Trace ===" -ForegroundColor Cyan
|
||||
Write-Host "Package: sg.com.maribankmobile.digitalbank"
|
||||
Write-Host "Script: reverse\frida\trace_maribank_sg_native.js"
|
||||
Write-Host ""
|
||||
|
||||
if (-not $SkipLsposedHint) {
|
||||
Write-Host "[Required before trace]" -ForegroundColor Yellow
|
||||
Write-Host " 1. LSPosed -> KEEP scope ENABLED for sg.com.maribankmobile.digitalbank"
|
||||
Write-Host " (module bypasses ADB page; disabling scope shows ADB Detected screen)"
|
||||
Write-Host " 2. Soft reboot SG app (force-stop then reopen)"
|
||||
Write-Host " 3. frida-server running: .\scripts\install-frida.ps1 -StartServer"
|
||||
Write-Host ""
|
||||
Read-Host "Done? Press Enter to continue" | Out-Null
|
||||
}
|
||||
|
||||
& $Adb devices
|
||||
& $Adb shell "su -c 'pgrep frida-server || /data/local/tmp/frida-server -D &'" 2>&1 | Out-Null
|
||||
Start-Sleep -Seconds 1
|
||||
|
||||
if (-not (Test-Path $Py312)) {
|
||||
Write-Host "Python 3.12 not found at $Py312" -ForegroundColor Red
|
||||
Write-Host "Run: .\scripts\install-frida.ps1"
|
||||
exit 1
|
||||
}
|
||||
|
||||
$mode = if ($Attach) { "attach" } else { "spawn" }
|
||||
Write-Host "Mode: $mode (default spawn — open Sign up after app starts)" -ForegroundColor Cyan
|
||||
Write-Host ""
|
||||
|
||||
& $Py312 (Join-Path $FridaDir "run_frida_sg_native.py") $mode
|
||||
20
scripts/test-tng-full-flow.ps1
Normal file
20
scripts/test-tng-full-flow.ps1
Normal file
@@ -0,0 +1,20 @@
|
||||
# TNG eWallet 全流程自动化：注册/登录 → 点区号 → 国家列表
|
||||
# 依赖：adb、设备已 Root + LSPosed + notiMessage xposed-module 已勾选 TNG
|
||||
$ErrorActionPreference = "Stop"
|
||||
$Root = Split-Path -Parent $PSScriptRoot
|
||||
Set-Location $Root
|
||||
|
||||
Write-Host "== build xposed-module ==" -ForegroundColor Cyan
|
||||
& .\gradlew :xposed-module:assembleDebug
|
||||
if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
|
||||
|
||||
Write-Host "== install ==" -ForegroundColor Cyan
|
||||
adb install -r xposed-module\build\outputs\apk\debug\xposed-module-debug.apk
|
||||
if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
|
||||
|
||||
adb shell am force-stop my.com.tngdigital.ewallet
|
||||
Start-Sleep -Seconds 3
|
||||
|
||||
Write-Host "== full flow test ==" -ForegroundColor Cyan
|
||||
python reverse/scripts/test_tng_full_flow.py
|
||||
exit $LASTEXITCODE
|
||||
51
scripts/tng-bypass-finish.ps1
Normal file
51
scripts/tng-bypass-finish.ps1
Normal file
@@ -0,0 +1,51 @@
|
||||
# TNG eWallet bypass: install xposed + LSPosed scope + optional clear app data
|
||||
param(
|
||||
[switch]$ClearTng,
|
||||
[switch]$SkipBuild
|
||||
)
|
||||
|
||||
$ErrorActionPreference = "Stop"
|
||||
$ProjectRoot = Split-Path -Parent $PSScriptRoot
|
||||
Set-Location $ProjectRoot
|
||||
|
||||
$sdk = "C:\Users\Administrator\AppData\Local\Android\Sdk"
|
||||
$adb = Join-Path $sdk "platform-tools\adb.exe"
|
||||
if (-not (Test-Path $adb)) { $adb = "adb" }
|
||||
|
||||
if (-not $SkipBuild) {
|
||||
& "$ProjectRoot\scripts\build-debug.ps1"
|
||||
if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
|
||||
}
|
||||
|
||||
$xposedApk = Join-Path $ProjectRoot "xposed-module\build\outputs\apk\debug\xposed-module-debug.apk"
|
||||
Write-Host "=== Install Xposed module ===" -ForegroundColor Cyan
|
||||
& $adb install -r -t -g $xposedApk
|
||||
if ($LASTEXITCODE -ne 0) {
|
||||
& $adb install -r -t -g --bypass-low-target-sdk-block $xposedApk
|
||||
}
|
||||
|
||||
Write-Host "=== Configure LSPosed scope (incl. TNG) ===" -ForegroundColor Cyan
|
||||
$apkPath = (& $adb shell pm path com.miraclegarden.smsmessage.xposed) -replace '^package:', ''
|
||||
$apkPath = $apkPath.Trim()
|
||||
& $adb shell "su -c 'cp /data/adb/lspd/config/modules_config.db /sdcard/Download/modules_config.db; rm -f /data/adb/lspd/config/modules_config.db-wal /data/adb/lspd/config/modules_config.db-shm'"
|
||||
$db = Join-Path $env:TEMP "modules_config_tng_finish.db"
|
||||
& $adb pull /sdcard/Download/modules_config.db $db
|
||||
python "$ProjectRoot\scripts\configure-lsposed.py" $db $apkPath
|
||||
& $adb push $db /sdcard/Download/modules_config.db
|
||||
& $adb shell "su -c 'cp /sdcard/Download/modules_config.db /data/adb/lspd/config/modules_config.db; rm -f /data/adb/lspd/config/modules_config.db-wal /data/adb/lspd/config/modules_config.db-shm; chmod 660 /data/adb/lspd/config/modules_config.db'"
|
||||
|
||||
Write-Host "=== Phone checklist ===" -ForegroundColor Yellow
|
||||
Write-Host " 1. TNG must NOT be in Magisk DenyList (DenyList blocks Vector/LSPosed injection)"
|
||||
Write-Host " 2. MariBank/Seabank may stay on DenyList; Shamiko + ProcMaps hook hide root for them"
|
||||
Write-Host " 3. LSPosed: notiMessage Xposed enabled, scope includes my.com.tngdigital.ewallet"
|
||||
Write-Host " 4. LSPosed soft reboot / zygote restart after scope update"
|
||||
Write-Host " 5. Disable USB debugging before test (recommended)"
|
||||
|
||||
if ($ClearTng) {
|
||||
Write-Host "=== Clear TNG data ===" -ForegroundColor Cyan
|
||||
& $adb shell "su -c 'pm clear my.com.tngdigital.ewallet'"
|
||||
}
|
||||
|
||||
& $adb shell "am force-stop my.com.tngdigital.ewallet"
|
||||
Write-Host ""
|
||||
Write-Host "Done. Launch TNG eWallet, then run: .\scripts\logcat-tng.ps1" -ForegroundColor Green
|
||||
Reference in New Issue
Block a user