chore: 备份 TNG 注册/captcha 逆向与 MariBank SG bypass 进展

TngRootBypassHook 增强 captcha 诊断、TigerTally/JNIC 分层与 HWUI 策略；新增逆向脚本、Frida 工具与 UI dump；同步 MariBank SG hook 与 tng_exit_guard 更新。

scripts/_tng_pipe_writer.sh

@@ -0,0 +1,39 @@
+#!/system/bin/sh
+# 抓 TigerTally fread 阻塞的 pipe 写端进程。自动启动 TNG 并连续扫描。
+PKG="my.com.tngdigital.ewallet"
+
+am force-stop "$PKG" 2>/dev/null
+sleep 1
+am start -n "$PKG/.ui.SplashActivity" 2>/dev/null
+
+i=0
+while [ $i -lt 40 ]; do
+  i=$((i+1))
+  pid=""
+  for p in $(pidof "$PKG"); do
+    if [ "$(tr '\0' ' ' < /proc/$p/cmdline 2>/dev/null | tr -d ' ')" = "$PKG" ]; then pid=$p; break; fi
+  done
+  if [ -z "$pid" ]; then sleep 0.5; continue; fi
+
+  for d in /proc/$pid/task/*/; do
+    t="${d%/}"
+    s=$(cat "$t/syscall" 2>/dev/null)
+    case "$s" in
+      63*)
+        c=$(cat "$t/comm" 2>/dev/null)
+        fd=$(echo "$s" | awk '{print $2}')
+        fd=$((fd))
+        tgt=$(readlink "/proc/$pid/fd/$fd" 2>/dev/null)
+        echo "[$i] pid=$pid TID=${t##*/} comm=$c wchan=$(cat "$t/wchan" 2>/dev/null) syscall=$s"
+        echo "[$i] fd=$fd -> $tgt"
+        ino=$(echo "$tgt" | sed 's/.*\[//; s/\]//')
+        if [ -n "$ino" ]; then
+          echo "[$i] writer-search inode=$ino:"
+          find /proc/[0-9]*/fd -lname "*$ino*" 2>/dev/null
+        fi
+        ;;
+    esac
+  done
+  sleep 0.5
+done
+echo "=== scan done ==="