chore: 备份 TNG 注册/captcha 逆向与 MariBank SG bypass 进展

TngRootBypassHook 增强 captcha 诊断、TigerTally/JNIC 分层与 HWUI 策略；新增逆向脚本、Frida 工具与 UI dump；同步 MariBank SG hook 与 tng_exit_guard 更新。

scripts/run-frida-sg-native.ps1

@@ -0,0 +1,48 @@
+# MariBank SG Frida native attestation trace
+# Usage:
+#   .\scripts\run-frida-sg-native.ps1
+#   .\scripts\run-frida-sg-native.ps1 -Spawn
+param(
+    [switch]$Attach,
+    [switch]$SkipLsposedHint
+)
+
+$ErrorActionPreference = "Stop"
+$ProjectRoot = Split-Path -Parent $PSScriptRoot
+$FridaDir = Join-Path $ProjectRoot "reverse\frida"
+$Py312 = "C:\Users\Administrator\AppData\Local\Programs\Python\Python312\python.exe"
+$Adb = Join-Path $env:LOCALAPPDATA "Android\Sdk\platform-tools\adb.exe"
+if (-not (Test-Path $Adb)) {
+    $Adb = "C:\Users\Administrator\AppData\Local\Android\Sdk\platform-tools\adb.exe"
+}
+
+Write-Host "=== MariBank SG Frida Native Trace ===" -ForegroundColor Cyan
+Write-Host "Package: sg.com.maribankmobile.digitalbank"
+Write-Host "Script:  reverse\frida\trace_maribank_sg_native.js"
+Write-Host ""
+
+if (-not $SkipLsposedHint) {
+    Write-Host "[Required before trace]" -ForegroundColor Yellow
+    Write-Host "  1. LSPosed -> KEEP scope ENABLED for sg.com.maribankmobile.digitalbank"
+    Write-Host "     (module bypasses ADB page; disabling scope shows ADB Detected screen)"
+    Write-Host "  2. Soft reboot SG app (force-stop then reopen)"
+    Write-Host "  3. frida-server running: .\scripts\install-frida.ps1 -StartServer"
+    Write-Host ""
+    Read-Host "Done? Press Enter to continue" | Out-Null
+}
+
+& $Adb devices
+& $Adb shell "su -c 'pgrep frida-server || /data/local/tmp/frida-server -D &'" 2>&1 | Out-Null
+Start-Sleep -Seconds 1
+
+if (-not (Test-Path $Py312)) {
+    Write-Host "Python 3.12 not found at $Py312" -ForegroundColor Red
+    Write-Host "Run: .\scripts\install-frida.ps1"
+    exit 1
+}
+
+$mode = if ($Attach) { "attach" } else { "spawn" }
+Write-Host "Mode: $mode (default spawn — open Sign up after app starts)" -ForegroundColor Cyan
+Write-Host ""
+
+& $Py312 (Join-Path $FridaDir "run_frida_sg_native.py") $mode