609635aba1
TngRootBypassHook 增强 captcha 诊断、TigerTally/JNIC 分层与 HWUI 策略；新增逆向脚本、Frida 工具与 UI dump；同步 MariBank SG hook 与 tng_exit_guard 更新。
62 lines
1.8 KiB
Python
62 lines
1.8 KiB
Python
"""Scan libtngdigital_ewallet.so for SVC / exit patterns."""
|
|
from pathlib import Path
|
|
import struct
|
|
|
|
SO = Path(r"C:\Users\Administrator\Desktop\notiMessage\reverse\apks\tng\libtngdigital_ewallet.so")
|
|
if not SO.exists():
|
|
# try from split apk
|
|
import zipfile
|
|
apk = Path(r"C:\Users\Administrator\Desktop\notiMessage\reverse\apks\tng\split_config.arm64_v8a.apk")
|
|
if apk.exists():
|
|
with zipfile.ZipFile(apk) as z:
|
|
for n in z.namelist():
|
|
if n.endswith("libtngdigital_ewallet.so"):
|
|
SO.write_bytes(z.read(n))
|
|
print("extracted from", apk, "->", SO)
|
|
break
|
|
|
|
data = SO.read_bytes()
|
|
print("size", len(data), SO)
|
|
|
|
svc = b"\x01\x00\x00\xd4"
|
|
idxs = []
|
|
start = 0
|
|
while True:
|
|
i = data.find(svc, start)
|
|
if i < 0:
|
|
break
|
|
idxs.append(i)
|
|
start = i + 4
|
|
print("total svc#0:", len(idxs))
|
|
|
|
# movz x8,#93 = d2 80 0b a8 ; movz x8,#94 = d2 80 0b c8 (LE)
|
|
# bytes LE: A8 0B 80 D2 / C8 0B 80 D2
|
|
exit_setups = [
|
|
(b"\xa8\x0b\x80\xd2", 93), # movz x8, #93
|
|
(b"\xc8\x0b\x80\xd2", 94), # movz x8, #94
|
|
(b"\xa8\x0b\x80\x52", 93), # movz w8, #93
|
|
(b"\xc8\x0b\x80\x52", 94), # movz w8, #94
|
|
]
|
|
for pat, nr in exit_setups:
|
|
c = data.count(pat)
|
|
print(f"movz *8,#{nr} pattern count={c}")
|
|
|
|
print("\nSVC with nearby exit setup (lookback 32 bytes):")
|
|
hits = 0
|
|
for i in idxs[:2000]:
|
|
window = data[max(0, i - 32) : i]
|
|
for pat, nr in exit_setups:
|
|
if pat in window:
|
|
print(f" off=0x{i:x} exit_group/exit via #{nr}")
|
|
hits += 1
|
|
break
|
|
print("hits", hits)
|
|
|
|
# also search brk
|
|
brk = b"\x00\x00\x20\xd4" # brk #0
|
|
print("brk#0 count", data.count(brk))
|
|
|
|
# string refs
|
|
for s in [b"_exit", b"exit_group", b"abort", b"frida", b"/proc/self/maps", b"xposed"]:
|
|
print(s, "->", data.find(s))
|