609635aba1
TngRootBypassHook 增强 captcha 诊断、TigerTally/JNIC 分层与 HWUI 策略；新增逆向脚本、Frida 工具与 UI dump；同步 MariBank SG hook 与 tng_exit_guard 更新。
41 lines
1.6 KiB
Python
41 lines
1.6 KiB
Python
# -*- coding: utf-8 -*-
|
|
"""TNG reverse notes helper — ForceExit / abort / Promon suicide map."""
|
|
import re
|
|
import zipfile
|
|
from pathlib import Path
|
|
|
|
APK = Path(__file__).resolve().parents[1] / "apks" / "tng" / "base.apk"
|
|
SO = Path(__file__).resolve().parents[1] / "apks" / "tng" / "libtngdigital_ewallet.so"
|
|
|
|
|
|
def main():
|
|
with zipfile.ZipFile(APK) as z:
|
|
data = b"".join(z.read(n) for n in z.namelist() if n.endswith(".dex"))
|
|
|
|
print("=== suicide ladder (from runtime + static) ===")
|
|
print("1) Promon root hit -> openSecurityUrl Rooting FAQ (Xposed blocks)")
|
|
print("2) xwwqazamx.W -> KillApplicationHandler (Xposed blocks)")
|
|
print("3) native exit_group(1) OR SIGABRT SI_USER via libc abort/raise/tgkill")
|
|
print("4) AppSecurityManager.startForceExitCountdown* / addIntoQueueAndLaunch")
|
|
print()
|
|
|
|
print("=== ForceExit-related descriptors ===")
|
|
for m in sorted(set(re.findall(rb"L[A-Za-z0-9_/$]*ForceExit[A-Za-z0-9_/$]*;", data))):
|
|
print(m.decode())
|
|
|
|
print("\n=== AppSecurityManager log strings (detection events) ===")
|
|
for m in re.finditer(rb"AppSecurityManager: [A-Za-z][^\x00]{5,80}", data):
|
|
s = m.group().decode("utf-8", "ignore")
|
|
if any(k in s for k in ("Root", "Hook", "Emulator", "Force", "Unhandled", "Navigat")):
|
|
print(s)
|
|
|
|
if SO.exists():
|
|
raw = SO.read_bytes()
|
|
print("\n=== SO imports of interest ===")
|
|
for s in (b"abort", b"raise", b"tgkill", b"kill", b"exit"):
|
|
print(s.decode(), "at", hex(raw.find(s)) if raw.find(s) >= 0 else None)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
main()
|